迪信通某系统命令执行getshell可内网深入40多台机器

RT

迪信通招聘正式系统
http://123.196.123.21:8080/user/login.jsp

端口8010存在JAVA反序列化

拿到shell如下
http://123.196.123.21:8010/uddiexplorer/sss.jsp

探测内网
http://123.196.123.21:8010/uddiexplorer/out.jsp

http://123.196.123.21:8010/uddiexplorer/out.jsp

解决方案：

打补丁