记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

美的某系统任意命令执行

2015-08-15 01:00

首先访问这个后台系统

http://rddp.midea.com.cn:9083/rtssh/LoginAction.action



然后看下下面的网通入口,存在strtus 016

http://58.252.101.42:9083/rtssh/LoginAction.action



code 区域
Whoami: rdrts



netstat -an

====================================================================================================================================

Active Internet connections (including servers)

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp4 0 0 *.* *.* CLOSED

tcp4 0 0 *.13 *.* LISTEN

tcp 0 0 *.21 *.* LISTEN

tcp 0 0 *.23 *.* LISTEN

tcp4 0 0 *.25 *.* LISTEN

tcp4 0 0 *.37 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.242.255.31.4007 ESTABLISHED

tcp 0 0 *.80 *.* LISTEN

tcp4 0 0 *.111 *.* LISTEN

tcp 0 0 *.199 *.* LISTEN

tcp6 0 0 ::1.49191 ::1.49192 CLOSE_WAIT

tcp4 0 0 172.16.16.146.1334 115.239.230.218.1429 ESTABLISHED

tcp 0 0 *.443 *.* LISTEN

tcp 0 0 *.512 *.* LISTEN

tcp 0 0 *.513 *.* LISTEN

tcp 0 0 *.514 *.* LISTEN

tcp4 184 0 172.16.16.146.80 10.43.1.68.4177 CLOSE_WAIT

tcp 0 0 *.657 *.* LISTEN

tcp6 0 0 ::1.49405 ::1.49406 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.166.253.17.62127 ESTABLISHED

tcp4 182 0 172.16.16.146.80 10.41.241.48.1056 ESTABLISHED

tcp 0 0 172.16.16.146.9001 *.* LISTEN

tcp 0 0 172.16.16.146.9002 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.41.241.48.1093 ESTABLISHED

tcp4 0 0 *.1334 *.* LISTEN

tcp 0 0 172.16.16.146.9081 *.* LISTEN

tcp 0 0 172.16.16.146.9082 *.* LISTEN

tcp 0 0 172.16.16.146.9083 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.41.241.37.1205 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.41.241.176.1126 CLOSE_WAIT

tcp4 0 0 172.16.16.146.64211 172.16.14.54.873 ESTABLISHED

tcp4 184 0 172.16.16.146.80 10.43.1.68.5361 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.41.241.176.1850 CLOSE_WAIT

漏洞证明:

code 区域
Whoami: rdrts



netstat -an

====================================================================================================================================

Active Internet connections (including servers)

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp4 0 0 *.* *.* CLOSED

tcp4 0 0 *.13 *.* LISTEN

tcp 0 0 *.21 *.* LISTEN

tcp 0 0 *.23 *.* LISTEN

tcp4 0 0 *.25 *.* LISTEN

tcp4 0 0 *.37 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.242.255.31.4007 ESTABLISHED

tcp 0 0 *.80 *.* LISTEN

tcp4 0 0 *.111 *.* LISTEN

tcp 0 0 *.199 *.* LISTEN

tcp6 0 0 ::1.49191 ::1.49192 CLOSE_WAIT

tcp4 0 0 172.16.16.146.1334 115.239.230.218.1429 ESTABLISHED

tcp 0 0 *.443 *.* LISTEN

tcp 0 0 *.512 *.* LISTEN

tcp 0 0 *.513 *.* LISTEN

tcp 0 0 *.514 *.* LISTEN

tcp4 184 0 172.16.16.146.80 10.43.1.68.4177 CLOSE_WAIT

tcp 0 0 *.657 *.* LISTEN

tcp6 0 0 ::1.49405 ::1.49406 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.166.253.17.62127 ESTABLISHED

tcp4 182 0 172.16.16.146.80 10.41.241.48.1056 ESTABLISHED

tcp 0 0 172.16.16.146.9001 *.* LISTEN

tcp 0 0 172.16.16.146.9002 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.41.241.48.1093 ESTABLISHED

tcp4 0 0 *.1334 *.* LISTEN

tcp 0 0 172.16.16.146.9081 *.* LISTEN

tcp 0 0 172.16.16.146.9082 *.* LISTEN

tcp 0 0 172.16.16.146.9083 *.* LISTEN

tcp4 182 0 172.16.16.146.80 10.41.241.37.1205 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.41.241.176.1126 CLOSE_WAIT

tcp4 0 0 172.16.16.146.64211 172.16.14.54.873 ESTABLISHED

tcp4 184 0 172.16.16.146.80 10.43.1.68.5361 CLOSE_WAIT

tcp4 182 0 172.16.16.146.80 10.41.241.176.1850 CLOSE_WAIT

修复方案:

上补丁

知识来源: www.wooyun.org/bugs/wooyun-2015-0123218

阅读:114155 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“美的某系统任意命令执行”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云

本页关键词