当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0157609

漏洞标题：上海大智慧多台服务器redis未授权访问发现入侵痕迹

相关厂商：finchina.com

漏洞作者： 路人甲

提交时间：2015-12-02 16:23

修复时间：2015-12-07 16:24

公开时间：2015-12-07 16:24

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-02： 细节已通知厂商并且等待厂商处理中
2015-12-07： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

上海大智慧多台服务器redis未授权访问，发现入侵痕迹

详细说明：

114.80.136.195:6379 cj.gw.com.cn
114.80.136.124:6379 control.gw.com.cn
114.80.157.156:6379 log.gw.com.cn
222.73.171.232:6379 track.gw.com.cn
114.80.136.196:6379 www.gw.com.cn
114.80.158.68:6379 wx.gw.com.cn

漏洞证明：

114.80.136.195:6379> get crackit
"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCzlC1rOVtlCjeJuDXqHD5TrCx7E9tG7jB3j1RQGyUtLOJUvEDdvUr6PUlWFlHtzftlbs9JLnimAXGLKFHA+MC4lI4by2uybFPkMy8XX0oNzv2KHJVaCGg7HvT24RemvZIZzZreA94sKkoHv3sRbAHcm6frQNPrDv1aNWqMg4X+HREeGKuUZym1Ctqy1bRYX/BRWp6bkyQnA8fQ6OW//21nMIhX78U2EsfGI8lz2w6DefMeRtRFvtxkEWc7nK73FftzT2CBn/KhO1D6ckKE8BoNEM76kCMiXFIRzebBWGIoAhHB0GJ68C7xnqAhc2Sq4hRUTy7evS5vAy2/2ILQJqQ== root@localhost.localdomain\n\n\n\n"
114.80.136.195:6379>


114.80.136.124:6379> get crackit
"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCzlC1rOVtlCjeJuDXqHD5TrCx7E9tG7jB3j1RQGyUtLOJUvEDdvUr6PUlWFlHtzftlbs9JLnimAXGLKFHA+MC4lI4by2uybFPkMy8XX0oNzv2KHJVaCGg7HvT24RemvZIZzZreA94sKkoHv3sRbAHcm6frQNPrDv1aNWqMg4X+HREeGKuUZym1Ctqy1bRYX/BRWp6bkyQnA8fQ6OW//21nMIhX78U2EsfGI8lz2w6DefMeRtRFvtxkEWc7nK73FftzT2CBn/KhO1D6ckKE8BoNEM76kCMiXFIRzebBWGIoAhHB0GJ68C7xnqAhc2Sq4hRUTy7evS5vAy2/2ILQJqQ== root@localhost.localdomain\n\n\n\n"
114.80.136.124:6379>


222.73.171.232:6379> keys *
1) "crackit"
222.73.171.232:6379> get crackit
"\n\n\nSHELL=/bin/sh\n* * * * * root chmod 777 /tmp/shell.sh\n\n\n"
222.73.171.232:6379>


114.80.157.156:6379> keys *
1) "crackita"
2) "crackit"
114.80.157.156:6379> get crackit
"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCzlC1rOVtlCjeJuDXqHD5TrCx7E9tG7jB3j1RQGyUtLOJUvEDdvUr6PUlWFlHtzftlbs9JLnimAXGLKFHA+MC4lI4by2uybFPkMy8XX0oNzv2KHJVaCGg7HvT24RemvZIZzZreA94sKkoHv3sRbAHcm6frQNPrDv1aNWqMg4X+HREeGKuUZym1Ctqy1bRYX/BRWp6bkyQnA8fQ6OW//21nMIhX78U2EsfGI8lz2w6DefMeRtRFvtxkEWc7nK73FftzT2CBn/KhO1D6ckKE8BoNEM76kCMiXFIRzebBWGIoAhHB0GJ68C7xnqAhc2Sq4hRUTy7evS5vAy2/2ILQJqQ== root@localhost.localdomain\n\n\n\n"
114.80.157.156:6379>


114.80.136.196:6379> get crackit
"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDp9EjCWit6uThg4A9JCOHaqW469v4x4VtYwr16dnUK/L+oabBqaRmJdGKi+sojJ/7z5ZUSKY69hIVxANxcOm1X4IsMNOVwx/ZinfgBcuExpt2iY14fKx3frOWNoWknv6WPRxZHq1lV5zeA3CFvCF79nu9orVtIBZcoKESt5QSy96l4HqpH5WK6xyOcdLJAaVhvOLIh5ik8VKeRMs1CQhySOQA14N+0wWTdG7uCIj8HlyT9mqeJ+HDSiMf1xmyT0WAoLhdx0A4TJmNmigWUP/4+iaNZ7XiZ7W74HG4rfBVG1TEEnNVFtX/F0XsvjR/9c6eTffF1iIJ2sdwNHk/i7iVB root@MyServer\n\n\n\n"


114.80.158.68:6379> get crackit
"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCzlC1rOVtlCjeJuDXqHD5TrCx7E9tG7jB3j1RQGyUtLOJUvEDdvUr6PUlWFlHtzftlbs9JLnimAXGLKFHA+MC4lI4by2uybFPkMy8XX0oNzv2KHJVaCGg7HvT24RemvZIZzZreA94sKkoHv3sRbAHcm6frQNPrDv1aNWqMg4X+HREeGKuUZym1Ctqy1bRYX/BRWp6bkyQnA8fQ6OW//21nMIhX78U2EsfGI8lz2w6DefMeRtRFvtxkEWc7nK73FftzT2CBn/KhO1D6ckKE8BoNEM76kCMiXFIRzebBWGIoAhHB0GJ68C7xnqAhc2Sq4hRUTy7evS5vAy2/2ILQJqQ== root@localhost.localdomain\n\n\n\n"


修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-07 16:24

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无