当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096900

漏洞标题：酷开网络由于一次SVN泄露导致的GETSHELL(可内网渗透)

相关厂商：深圳市酷开网络科技有限公司

漏洞作者： er0tic

提交时间：2015-02-12 09:08

修复时间：2015-02-28 17:03

公开时间：2015-02-28 17:03

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：12

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-12： 细节已通知厂商并且等待厂商处理中
2015-02-12： 厂商已经确认，细节仅向厂商公开
2015-02-22： 细节向核心白帽子及相关领域专家公开
2015-02-28： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

由于上次的SVN泄露 然后翻文件的时候进行了进一步的检测。

详细说明：

由于上次的SVN泄露 然后翻文件的时候进行了进一步的检测。
http://wooyun.org/bugs/wooyun-2015-096890
当我直接用IP访问的时候发现进入了另个WEB目录下 试了试同样存在SVN的泄露问题

1.jpg


整站下载 翻了翻源码发现了FTP账号。

2.jpg


果断连接FTP 扔个SHELL上去 但是发现貌似服务器上装了安全防护 访问SHELL就被拉入黑名单
然后传了个加密的就搞定了

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:16:3E:0E:0E:5E
          inet addr:10.200.240.207  Bcast:10.200.247.255  
Mask:255.255.248.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:51790160392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:43523430171 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:9423741499158 (8.5 TiB)  TX bytes:4406883449774 
(4.0 TiB)
          Interrupt:19
eth1      Link encap:Ethernet  HWaddr 00:16:3E:0E:0E:9D
          inet addr:42.121.104.85  Bcast:42.121.107.255  
Mask:255.255.252.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6857288612 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2632907083 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:860026620346 (800.9 GiB)  TX bytes:5608579939760 
(5.1 TiB)
          Interrupt:20
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:169135098844 errors:0 dropped:0 overruns:0 
frame:0
          TX packets:169135098844 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:0
          RX bytes:59052893992764 (53.7 TiB)  TX bytes:59052893992764 
(53.7 TiB)


define.php
<?php
require_once '../webservices/settings.php';
define("SRTLocalDBUser", "cloudtv");
//define("SRTLocalDBPassword", "abc.123");
define("SRTLocalDBPassword", "cl*****#");
define("SRTAITVDBHOST","10.200.240.208");
//Exception


然后找到了个这个文件 

dbhost.config.php
<?php
return array(
		"42.121.104.89"=>"10.135.9.151",
		"42.121.104.90"=>"10.135.9.151",
		"42.121.104.92"=>"10.135.9.150",
		"42.121.104.93"=>"10.135.9.150",
		"42.121.104.94"=>"10.135.9.149",
		"42.121.104.95"=>"10.135.9.149",
		"42.121.104.96"=>"10.135.9.240",
		"42.121.119.9"=>"10.135.9.240",
		"42.121.119.92"=>"10.135.9.147",
//		"42.121.119.94"=>"10.135.9.147",
//		"42.121.113.124"=>"10.132.58.84",
		"42.121.113.125"=>"10.132.58.84",
//		"42.121.113.128"=>"10.132.58.88",
//		"42.121.113.13"=>"10.132.58.85",
		"42.121.59.208"=>"10.132.58.86",
		"42.121.59.209"=>"10.132.58.86",
		"42.121.59.211"=>"10.132.58.85",
		"42.121.59.212"=>"10.132.58.88",
//		"42.121.59.213"=>"10.200.240.22",
//		"42.121.59.215"=>"10.200.240.22",
		"42.121.59.216"=>"10.200.240.224",//"10.200.240.209",
		"42.121.59.217"=>"10.200.240.209",
		"42.121.59.218"=>"10.200.240.219",
		"42.121.59.214"=>"10.200.25.168",//ep
		"42.121.104.91"=>"10.200.25.168",//ep
		"42.121.119.90"=>"10.200.25.168",//ep
		"42.121.119.91"=>"10.200.25.168",//ep
);
// return array(
// 		"42.121.104.89"=>"10.132.58.9",
// 		"42.121.104.90"=>"10.132.58.9",
// 		"42.121.104.92"=>"10.132.58.87",
// 		"42.121.104.94"=>"10.132.58.87"
// );


这是外网IP对应内网IP的节奏？
然后试了几个 一样存在SVN泄露，这是作死的节奏。
请自行删除SHELL 在APK 和RS目录里

漏洞证明：

由于上次的SVN泄露 然后翻文件的时候进行了进一步的检测。
http://wooyun.org/bugs/wooyun-2015-096890
当我直接用IP访问的时候发现进入了另个WEB目录下 试了试同样存在SVN的泄露问题

1.jpg


整站下载 翻了翻源码发现了FTP账号。

2.jpg


果断连接FTP 扔个SHELL上去 但是发现貌似服务器上装了安全防护 访问SHELL就被拉入黑名单
然后传了个加密的就搞定了

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:16:3E:0E:0E:5E
          inet addr:10.200.240.207  Bcast:10.200.247.255  
Mask:255.255.248.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:51790160392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:43523430171 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:9423741499158 (8.5 TiB)  TX bytes:4406883449774 
(4.0 TiB)
          Interrupt:19
eth1      Link encap:Ethernet  HWaddr 00:16:3E:0E:0E:9D
          inet addr:42.121.104.85  Bcast:42.121.107.255  
Mask:255.255.252.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6857288612 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2632907083 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:860026620346 (800.9 GiB)  TX bytes:5608579939760 
(5.1 TiB)
          Interrupt:20
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:169135098844 errors:0 dropped:0 overruns:0 
frame:0
          TX packets:169135098844 errors:0 dropped:0 overruns:0 
carrier:0
          collisions:0 txqueuelen:0
          RX bytes:59052893992764 (53.7 TiB)  TX bytes:59052893992764 
(53.7 TiB)


define.php
<?php
require_once '../webservices/settings.php';
define("SRTLocalDBUser", "cloudtv");
//define("SRTLocalDBPassword", "abc.123");
define("SRTLocalDBPassword", "cl*****#");
define("SRTAITVDBHOST","10.200.240.208");
//Exception


然后找到了个这个文件 

dbhost.config.php
<?php
return array(
		"42.121.104.89"=>"10.135.9.151",
		"42.121.104.90"=>"10.135.9.151",
		"42.121.104.92"=>"10.135.9.150",
		"42.121.104.93"=>"10.135.9.150",
		"42.121.104.94"=>"10.135.9.149",
		"42.121.104.95"=>"10.135.9.149",
		"42.121.104.96"=>"10.135.9.240",
		"42.121.119.9"=>"10.135.9.240",
		"42.121.119.92"=>"10.135.9.147",
//		"42.121.119.94"=>"10.135.9.147",
//		"42.121.113.124"=>"10.132.58.84",
		"42.121.113.125"=>"10.132.58.84",
//		"42.121.113.128"=>"10.132.58.88",
//		"42.121.113.13"=>"10.132.58.85",
		"42.121.59.208"=>"10.132.58.86",
		"42.121.59.209"=>"10.132.58.86",
		"42.121.59.211"=>"10.132.58.85",
		"42.121.59.212"=>"10.132.58.88",
//		"42.121.59.213"=>"10.200.240.22",
//		"42.121.59.215"=>"10.200.240.22",
		"42.121.59.216"=>"10.200.240.224",//"10.200.240.209",
		"42.121.59.217"=>"10.200.240.209",
		"42.121.59.218"=>"10.200.240.219",
		"42.121.59.214"=>"10.200.25.168",//ep
		"42.121.104.91"=>"10.200.25.168",//ep
		"42.121.119.90"=>"10.200.25.168",//ep
		"42.121.119.91"=>"10.200.25.168",//ep
);
// return array(
// 		"42.121.104.89"=>"10.132.58.9",
// 		"42.121.104.90"=>"10.132.58.9",
// 		"42.121.104.92"=>"10.132.58.87",
// 		"42.121.104.94"=>"10.132.58.87"
// );


这是外网IP对应内网IP的节奏？
然后试了几个 一样存在SVN泄露，这是作死的节奏。
请自行删除SHELL 在APK 和RS目录里

修复方案：

好好加班吧。

版权声明：转载请注明来源 er0tic@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-02-12 10:07

厂商回复：

已验证，并联系相关人员进行修复

最新状态：

2015-02-28：已完成修复：重新调整相关环境，关闭外网权限，删除和修改相关账户信息