当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0113314

漏洞标题：深航某站命令执行可深入内网

相关厂商：深圳航空

漏洞作者： fuckadmin

提交时间：2015-05-10 23:02

修复时间：2015-05-15 23:04

公开时间：2015-05-15 23:04

漏洞类型：命令执行

危害等级：高

自评Rank：13

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-10： 细节已通知厂商并且等待厂商处理中
2015-05-15： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

来两发深航。

详细说明：

1.深圳航空销售结算系统：http://119.147.23.66/
存在jboss invoker/JMXInvokerServlet 漏洞。
2.可以下载，证明漏洞存在：

1.jpg


3.已getshell,可深入内网

2.jpg


ifconfig

eth0      Link encap:Ethernet  HWaddr 00:22:19:7C:17:EE  
          inet addr:10.11.101.12  Bcast:10.11.101.255  Mask:255.255.255.0
          inet6 addr: fe80::222:19ff:fe7c:17ee/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3139641 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3168161 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:799244245 (762.2 MiB)  TX bytes:1653100713 (1.5 GiB)
          Interrupt:169 Memory:f8000000-f8012800 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:29392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:29392 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6302053 (6.0 MiB)  TX bytes:6302053 (6.0 MiB)


/etc/hosts

# Do not remove the following line, or various programs
# that require network functionality will fail.
::1     localhost.localdomain   localhost    js-12
127.0.0.1       js-12  js-12
10.20.222.21    song
10.11.101.22    ssms_vip2
10.11.101.21    ssms_vip1
10.10.20.65     nbuserver


数据库配置信息

<?xml version="1.0" encoding="UTF-8"?>
<!-- ===================================================================== -->
<!--                                                                       -->
<!--  JBoss Server Configuration                                           -->
<!--                                                                       -->
<!-- ===================================================================== -->
<!-- $Id: oracle-ds.xml 63175 2007-05-21 16:26:06Z rrajesh $ -->
<!-- ==================================================================== -->
<!--  Datasource config for Oracle originally from Steven Coy             -->
<!-- ==================================================================== -->
<datasources>
  <local-tx-datasource>
    <jndi-name>jdbc/ssmsdb</jndi-name>
    <connection-url>jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))</connection-url>
	<!--
		Here are a couple of the possible OCI configurations.
		For more information, see http://otn.oracle.com/docs/products/oracle9i/doc_library/release2/java.920/a96654/toc.htm
jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))
	<connection-url>jdbc:oracle:oci:@youroracle-tns-name</connection-url>
		or
	<connection-url>jdbc:oracle:oci:@(description=(address=(host=youroraclehost)(protocol=tcp)(port=1521))(connect_data=(SERVICE_NAME=yourservicename)))</connection-url>
		Clearly, its better to have TNS set up properly.
	 -->
    <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
    <user-name>ssmsenter</user-name>
    <password>jsxx09</password>
    <min-pool-size>50</min-pool-size>
		<max-pool-size>200</max-pool-size>
    <!-- Uses the pingDatabase method to check a connection is still valid before handing it out from the pool -->
    <!--valid-connection-checker-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleValidConnectionChecker</valid-connection-checker-class-name-->
    <!-- Checks the Oracle error codes and messages for fatal errors -->
    <exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleExceptionSorter</exception-sorter-class-name>
        <!-- sql to call when connection is created
        <new-connection-sql>some arbitrary sql</new-connection-sql>
        -->
        <!-- sql to call on an existing pooled connection when it is obtained from pool - the OracleValidConnectionChecker is prefered
        <check-valid-connection-sql>some arbitrary sql</check-valid-connection-sql>
        -->
      <!-- corresponding type-mapping in the standardjbosscmp-jdbc.xml -->
      <metadata>
         <type-mapping>Oracle9i</type-mapping>
      </metadata>
  </local-tx-datasource>
</datasources>

漏洞证明：

1.深圳航空销售结算系统：http://119.147.23.66/
存在jboss invoker/JMXInvokerServlet 漏洞。
2.可以下载，证明漏洞存在：

1.jpg


3.已getshell,可深入内网

2.jpg


ifconfig

eth0      Link encap:Ethernet  HWaddr 00:22:19:7C:17:EE  
          inet addr:10.11.101.12  Bcast:10.11.101.255  Mask:255.255.255.0
          inet6 addr: fe80::222:19ff:fe7c:17ee/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3139641 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3168161 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:799244245 (762.2 MiB)  TX bytes:1653100713 (1.5 GiB)
          Interrupt:169 Memory:f8000000-f8012800 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:29392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:29392 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6302053 (6.0 MiB)  TX bytes:6302053 (6.0 MiB)


/etc/hosts

# Do not remove the following line, or various programs
# that require network functionality will fail.
::1     localhost.localdomain   localhost    js-12
127.0.0.1       js-12  js-12
10.20.222.21    song
10.11.101.22    ssms_vip2
10.11.101.21    ssms_vip1
10.10.20.65     nbuserver


数据库配置信息

<?xml version="1.0" encoding="UTF-8"?>
<!-- ===================================================================== -->
<!--                                                                       -->
<!--  JBoss Server Configuration                                           -->
<!--                                                                       -->
<!-- ===================================================================== -->
<!-- $Id: oracle-ds.xml 63175 2007-05-21 16:26:06Z rrajesh $ -->
<!-- ==================================================================== -->
<!--  Datasource config for Oracle originally from Steven Coy             -->
<!-- ==================================================================== -->
<datasources>
  <local-tx-datasource>
    <jndi-name>jdbc/ssmsdb</jndi-name>
    <connection-url>jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))</connection-url>
	<!--
		Here are a couple of the possible OCI configurations.
		For more information, see http://otn.oracle.com/docs/products/oracle9i/doc_library/release2/java.920/a96654/toc.htm
jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))
	<connection-url>jdbc:oracle:oci:@youroracle-tns-name</connection-url>
		or
	<connection-url>jdbc:oracle:oci:@(description=(address=(host=youroraclehost)(protocol=tcp)(port=1521))(connect_data=(SERVICE_NAME=yourservicename)))</connection-url>
		Clearly, its better to have TNS set up properly.
	 -->
    <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
    <user-name>ssmsenter</user-name>
    <password>jsxx09</password>
    <min-pool-size>50</min-pool-size>
		<max-pool-size>200</max-pool-size>
    <!-- Uses the pingDatabase method to check a connection is still valid before handing it out from the pool -->
    <!--valid-connection-checker-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleValidConnectionChecker</valid-connection-checker-class-name-->
    <!-- Checks the Oracle error codes and messages for fatal errors -->
    <exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleExceptionSorter</exception-sorter-class-name>
        <!-- sql to call when connection is created
        <new-connection-sql>some arbitrary sql</new-connection-sql>
        -->
        <!-- sql to call on an existing pooled connection when it is obtained from pool - the OracleValidConnectionChecker is prefered
        <check-valid-connection-sql>some arbitrary sql</check-valid-connection-sql>
        -->
      <!-- corresponding type-mapping in the standardjbosscmp-jdbc.xml -->
      <metadata>
         <type-mapping>Oracle9i</type-mapping>
      </metadata>
  </local-tx-datasource>
</datasources>

修复方案：

你们更专业

版权声明：转载请注明来源 fuckadmin@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-05-15 23:04

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无