当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0155797

漏洞标题：中国移动某综合代维管理系统命令执行

相关厂商：中国移动

漏洞作者： 路人甲

提交时间：2015-11-25 17:00

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-25： 细节已通知厂商并且等待厂商处理中
2015-11-27： 厂商已经确认，细节仅向厂商公开
2015-12-07： 细节向核心白帽子及相关领域专家公开
2015-12-17： 细节向普通白帽子公开
2015-12-27： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

详细说明：

http://oms.lncmcc.info:8087/lnmams/portal/login.action
在这里下载一个软件，分析源码

2.png


1.png


**.**.**.**:8087/trouble/interface/call.action

3.png


为手机app后台服务器

4.png


shell地址
**.**.**.**:8087/trouble/shell.jsp
菜刀 **.**.**.**:8087/trouble/dns.jsp

5.png


10网段内网 root权限
以下是敏感信息：

#--------jdbc-----------------
jdbc.driverClassName=oracle.jdbc.driver.OracleDriver
jdbc.url="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOS=**.**.**.**)(PORT=1521)(QUEUESIZE=500))(ADDRESS=(PROTOCOL=TCP)(HOST=**.**.**.**)(PORT=1521)(QUEUESIZE=500))(LOAD_BALANCE=yes)(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=arsystem))))"
jdbc.username=aradmin
jdbc.password=LNeoms#2014
jdbc.dialect=org.hibernate.dialect.Oracle10gDialect
jdbc.alias=eoms4
#--------style-----------------
eoms.default.skin=blue
eoms.default.maxage=2592000
eoms.pwdmanage=false
eoms.exportinitdata.path=D\:\\
eoms.isaudit=true
eoms.isSynchToRemedy=true
eoms.remedy.servername=lneoms01
eoms.remedy.serverport=9997
eoms.remedy.demopwd=ULTRAeoms@2011
eoms.remedy.createurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?mode=CREATE
eoms.remedy.createdefurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?mode=CREATE
eoms.remedy.queryurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?eid=<REMEDY_EID>
eoms.remedy.querytaskurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?eid=<REMEDY_EID>&taskid=<PROCESSID>&processtype=<PROCESSTYPE>
eoms.remedy.flowmapurl=/workflow/flowmap/flowMap.jsp?mode=map&baseid=<BASEID>&baseschema=<BASESCHEMA>&type=<TYPE>&tplid=<TPLID>&modeltype=EOMS
eoms.remedy.logouturl=/arsys/forms/<REMEDY_SERVER>/WF4%3AApp_Logout
#------attachment path------------
attachment.path=/lneoms/attachments
docsmanager.path=D\:\\docsmanager
#-----worksheet path----------
worksheet.attachment.path=
#-----push to mobile chlient-----
push.waitDeal=false
#push thread scan interval (seconds)
push.interval=20
mobile.rmi.serverport=3366
#-------pasm-------
iam.pasm.isSynch=false
iam.uip.isPasmSynchEoms=false
iam.http.port=58045
iam.server.ip=**.**.**.**
iam.security.resource.appname=eoms4
iam.jms.port=61616
#JMS class config
iam.jms.consumer.class=**.**.**.**mon.external.manager.PASMMessageConsumer
#JMS method config
iam.jms.consumer.method=receiveMessage
local.service.url=**.**.**.**:8080
local.app.context=/eoms4
#intercept all urls
iam.intercept.all=true
#exceptive in the intercept= all urls (split: ";", eg: "/jsp/test.jsp;/jsp/exceptive.jsp")
iam.intercept.all.exceptives=/portal/password.action
#-------uip-------
iam.uip.isSynch=false
##webservice\u5730\u5740
AlarmMessage.ws.address=**.**.**.**:65432
AlarmMessage.ws.namespace = http://**.**.**.**/


#Created by JInto - www.guh-software.de
#Thu Oct 30 16:21:24 CST 2014
AlarmMessage.ws.address=http\**.**.**.**\:65432/
AlarmMessage.ws.namespace = http://**.**.**.**/
AlarmNELocation.ws.address=http\**.**.**.**\:65436/
BSNEHelper.ws.address=http\**.**.**.**/MobileEoms/Service.asmx
InterSwitchAlarm_createuser=Demo
PEETAlarmScreen.ws.address=http\://localhost\:9099/trouble/services/PEETAlarmScreen?wsdl
PEETHelper.ws.address=http\://localhost\:9099/trouble/services/PEETHelper?wsdl
TrafficAlarmScreen.ws.address=http\://localhost\:9099/trouble/services/TrafficAlarmScreen?wsdl
WLANAlarmScreen.ws.address=http\://localhost\:9099/trouble/services/WLANAlarmScreen?wsdl
WLANNETHelper.ws.address=http\://localhost\:9099/trouble/services/WLANNETHelper?wsdl
##\u5317\u4EAC\u76F4\u771F
WlanHelper.ws.address=**.**.**.**:12380/BCIMInterface/services/BcimWebServiceSOAP?wsdl
TransmissionHelper.ws.address=**.**.**.**:12380/BCIMInterface/services/BcimWebServiceSOAP?wsdl
oas.rmi.ip **.**.**.**
#oas.rmi.ip **.**.**.**
oas.rmi.port 59998
rmi.taskService.isOpen=true
rmi.taskService.port 9797
attachment.ftp.password=wf2010
attachment.ftp.port=21
attachment.ftp.server=**.**.**.**
attachment.ftp.username=Demo
attachment.storetype=local
attachment.temp.clear.delay=3600
attachment.tempfile.persistent.time=3600
docsmanager.path=docsmanager
eoms.default.maxage=2592000
eoms.default.skin=blue
eoms.exportinitdata.path=D\:\\
eoms.formattachftp.path=C\:\\test\\ftp
eoms.formattachftp.tmppath=C\:\\test\\tmp
eoms.formattachftp.url=ftp\://guest\:guest@localhost/formattach
eoms.interface.appServerNo=alarm_interface
eoms.isSynchToRemedy=false
eoms.loginlog=false
eoms.pwdmanage=false
eoms.remedy.createdefurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?mode\=CREATE
eoms.remedy.createurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?mode\=CREATE
eoms.remedy.demopwd=ULTRAeoms@2011
eoms.remedy.flowmapurl=/workflow/flowmap/flowMap.jsp?mode\=map&baseid\=<BASEID>&baseschema\=<BASESCHEMA>&type\=<TYPE>&tplid\=<TPLID>&modeltype\=EOMS
eoms.remedy.logouturl=/arsys/forms/<REMEDY_SERVER>/WF4%3AApp_Logout
eoms.remedy.querytaskurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?eid\=<REMEDY_EID>&taskid\=<PROCESSID>&processtype\=<PROCESSTYPE>
eoms.remedy.queryurl=/arsys/forms/<REMEDY_SERVER>/<REMEDY_FROM>/?eid\=<REMEDY_EID>
eoms.remedy.servername=lneoms
eoms.remedy.serverport=2722
eoms.verifyMinute=5
iam.http.port=58045
iam.intercept.all=false
iam.intercept.all.exceptives=/portal/password.action
iam.jms.consumer.class=**.**.**.**mon.external.manager.PASMMessageConsumer
iam.jms.consumer.method=receiveMessage
iam.jms.port=61616
iam.pasm.isSynch=false
iam.security.resource.appname=eoms4
iam.server.ip=**.**.**.**
iam.uip.isPasmSynchEoms=false
iam.uip.isSynch=false
jdbc.alias=eoms4
jdbc.dialect=org.hibernate.dialect.Oracle10gDialect
jdbc.driverClassName=oracle.jdbc.driver.OracleDriver
jdbc.password=ar\#admin\#
jdbc.url=jdbc\:oracle\:thin\:@**.**.**.**\:1521\:orcl
jdbc.username=lneoms_V4
local.app.context=/eoms4
local.service.url=localhost\:8010
mobile.oasService.address=localhost,5588,oasService
oas.webservice.interval=60
oas.webservice.timeout=3600
oas.webservice.url=http\**.**.**.**\:59999/oas/services/IPPAWS?wsdl
performance.ws.address=http\://localhost\:9099/trouble/services/PerformanceMessage?wsdl
synch.eoms_pasm.content=user,dep,userdep
synch.pasm_eoms=false
worksheet.attachment.path=D\:\\workspace6.6\\lneoms_V4\\WebRoot\\
#\u83B7\u53D6\u5B50\u5DE5\u5355\u5206\u9875
slave.rowNumber=12
openca.ip=**.**.**.**
openca.port=38097
openca.rongcloud.ip=**.**.**.**
openca.rongcloud.port=38097
transferstation.rmi.ip = **.**.**.**
transferstation.rmi.port = 3016


各种数据库连接信息，FTP信息，以及其他信息，包括class反编译很多敏感。

漏洞证明：

5.png

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-11-27 14:14

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向中国移动集团公司通报,由其后续协调网站管理部门处置.

最新状态：

暂无