HanDs
NO.2

[7月漏洞公开] 紫金保险某系统GetShell影响数百万团体/个人保单信息 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

...

详细说明:

code 区域

mask 区域
1.://**.**.**/claim/



反序列getshell

code 区域

mask 区域
1.://**.**.**/bea_wls_internal/1.jsp



密码:

mask 区域
*****og*****



jdbc:

code 区域
<url>jdbc:oracle:thin:@**.**.**.**:1521:zjhxcs</url>
<driver-name>oracle.jdbc.OracleDriver</driver-name>
<properties>
<property>
<name>user</name>
<value>sales</value>
</property>
</properties>
<password-encrypted>{3DES}xTlUGem6cFo=</password-encrypted>



code 区域
BUSINESS	PRPDCARMODELPREMIUMPLAT	334538823
BUSINESS VSUNUSEDMARK 17724313
BUSINESS PRPTPROFITDETAIL 10909238
BUSINESS PRPTPROFIT 7417609
BUSINESS PRPDCARMODELGROUP 7013910
BUSINESS PRPTITEMKIND 4517908
BUSINESS PRPCITEMKIND_NEW 3419761
BUSINESS PRPTITEMKIND_NEW 3418459
BUSINESS PRPCITEMKIND_CHG 3024383
PJBJ_JY PJ_CLLBJDYB 2871990
PJBJ_JY_1 PJ_CLLBJDYB 2734877
PJBJ_JY PJ_QYLBJJGXXB 2201541
PJBJ_JY_1 PJ_QYLBJJGXXB 2083808
BUSINESS PRPTINSURED 1831896
SPZX YUP_SOURCE_BAK 1258551
PJBJ_JY CZ_CLBMXXB 1131993
PJBJ_JY PJ_CZLBJDYB 1025817
PJBJ_JY_1 CZ_CLBMXXB 1021984
PJBJ_JY_1 PJ_CZLBJDYB 973875
BUSINESS PRPCITEMKIND 877334
BUSINESS PRPCITEMKINDORIGIN 846845
SYS WRI$_OPTSTAT_HISTGRM_HISTORY 829123
BUSINESS PRPDCODERISK 827761
PJBJ_JY PJ_LJTXDYB 781342
BUSINESS PRPDADMIN 752926
BUSINESS PRPTMAIN 751456
BUSINESS PRPCPROFITDETAIL 743304
BUSINESS PRPTITEMCAR 711852
BUSINESS PRPTITEMCAREXT 709981
BUSINESS PRPTEXPENSE 675560
BUSINESS UWNOTION 663449
PJBJ_JY_1 PJ_LJTXDYB 629837
BUSINESS PRPJFCOMBINE 594216
BUSINESS PRPTINSUREDNATURE 556503
BUSINESS PRPCPROFIT 545981
PJBJ_JY PJ_CXLBJXXB 543378
PJBJ_JY PJ_LJZDJGB 540390
BUSINESS PRPCMAIN_TEMP2 516906
PJBJ_JY_1 PJ_LJZDJGB 502682
PJBJ_JY_1 PJ_CXLBJXXB 499973
BUSINESS PRPCINSURED 472047
BUSINESS PRPTDANGERITEM 459225
BUSINESS PRPCITEMCAR 457498



K4.png



K5.png

漏洞证明:

code 区域
BUSINESS	PRPDCARMODELPREMIUMPLAT	334538823
BUSINESS VSUNUSEDMARK 17724313
BUSINESS PRPTPROFITDETAIL 10909238
BUSINESS PRPTPROFIT 7417609
BUSINESS PRPDCARMODELGROUP 7013910
BUSINESS PRPTITEMKIND 4517908
BUSINESS PRPCITEMKIND_NEW 3419761
BUSINESS PRPTITEMKIND_NEW 3418459
BUSINESS PRPCITEMKIND_CHG 3024383
PJBJ_JY PJ_CLLBJDYB 2871990
PJBJ_JY_1 PJ_CLLBJDYB 2734877
PJBJ_JY PJ_QYLBJJGXXB 2201541
PJBJ_JY_1 PJ_QYLBJJGXXB 2083808
BUSINESS PRPTINSURED 1831896
SPZX YUP_SOURCE_BAK 1258551
PJBJ_JY CZ_CLBMXXB 1131993
PJBJ_JY PJ_CZLBJDYB 1025817
PJBJ_JY_1 CZ_CLBMXXB 1021984
PJBJ_JY_1 PJ_CZLBJDYB 973875
BUSINESS PRPCITEMKIND 877334
BUSINESS PRPCITEMKINDORIGIN 846845
SYS WRI$_OPTSTAT_HISTGRM_HISTORY 829123
BUSINESS PRPDCODERISK 827761
PJBJ_JY PJ_LJTXDYB 781342
BUSINESS PRPDADMIN 752926
BUSINESS PRPTMAIN 751456
BUSINESS PRPCPROFITDETAIL 743304
BUSINESS PRPTITEMCAR 711852
BUSINESS PRPTITEMCAREXT 709981
BUSINESS PRPTEXPENSE 675560
BUSINESS UWNOTION 663449
PJBJ_JY_1 PJ_LJTXDYB 629837
BUSINESS PRPJFCOMBINE 594216
BUSINESS PRPTINSUREDNATURE 556503
BUSINESS PRPCPROFIT 545981
PJBJ_JY PJ_CXLBJXXB 543378
PJBJ_JY PJ_LJZDJGB 540390
BUSINESS PRPCMAIN_TEMP2 516906
PJBJ_JY_1 PJ_LJZDJGB 502682
PJBJ_JY_1 PJ_CXLBJXXB 499973
BUSINESS PRPCINSURED 472047
BUSINESS PRPTDANGERITEM 459225
BUSINESS PRPCITEMCAR 457498



K4.png



K5.png

修复方案:

更新补丁


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
金鸨O
#1楼
发帖时间:2016-7-15   |   查看数:0   |   回复数:0
游客组