An improper configuration of a financial asset exchange allows Intranet roaming

An improper configuration of a financial asset exchange allows Intranet roaming

 

Beijing Financial Assets Exchange



System of http://rzt.cfae.cn/Ox B

Http://rzt.cfae.cn/jmx-console/ jboss not much said


 

Direct deployment of war Horse



Shell address:

Http://rzt.cfae.cn/is/index.jsp


 

 

/> Ifconfig

Eth0 Link encap: Ethernet HWaddr 78: AC: C0: FA: 0C: 96



Inet addr: 10.10.33.33 Bcast: 10.10.33.255 Mask: 255.255.255.0



Inet6 addr: fe80: 7aac: c0ff: fefa: c96/64 Scope: Link



Up broadcast running multicast mtu: 1500 Metric: 1



RX packets: 402211559 errors: 0 dropped: 0 overruns: 0 frame: 0



TX packets: 537146083 errors: 0 dropped: 0 overruns: 0 carrier: 0



Collisions: 0 FIG: 1000



RX bytes: 2036842330 (1.8 GiB) TX bytes: 64706799 (61.7 MiB)



Interrupt: 169 Memory: f4000000-f4012800







Lo Link encap: Local Loopback



Inet addr: 127.0.0.1 Mask: 255.0.0.0



Inet6 addr: 1/128 Scope: Host



Up loopback running mtu: 16436 Metric: 1



RX packets: 863614869 errors: 0 dropped: 0 overruns: 0 frame: 0



TX packets: 863614869 errors: 0 dropped: 0 overruns: 0 carrier: 0



Collisions: 0 txqueuelen: 0



RX bytes: 2119524219 (1.9 GiB) TX bytes: 2119524219 (1.9 GiB)







/> Arp-

? (10.10.33.254) at 00: 00: 0C: 07: AC: 21 [ether] on eth0



? (10.10.33.11) at D8: D3: 85: BA: 80: 6A [ether] on eth0



? (10.10.33.170) at A0: B3: CC: EC: 65: 50 [ether] on eth0



? (10.10.33.12) at E4: 11: 5B: 0E: EF: A4 [ether] on eth0



? (10.10.33.14) at 78: E7: D1: E5: 5B: 90 [ether] on eth0



/>


 

Root: x: 0: 0: root:/bin/bash



Bin: x: 1: 1: bin:/sbin/nologin



Daemon: x: 2: 2: daemon:/sbin/nologin



Adm: x: 3: 4: adm:/var/adm:/sbin/nologin



Lp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologin



Sync: x: 5: 0: sync:/sbin:/bin/sync



Shutdown: x: 6: 0: shutdown:/sbin/shutdown



Halt: x: 7: 0: halt:/sbin/halt



Mail: x: 8: 12: mail:/var/spool/mail:/sbin/nologin



News: x: 9: 13: news:/etc/news:



Uucp: x: 10: 14: uucp:/var/spool/uucp:/sbin/nologin



Operator: x: 11: 0: operator:/root:/sbin/nologin



Games: x: 12: 100: games:/usr/games:/sbin/nologin



Gopher: x: 13: 30: gopher:/var/gopher:/sbin/nologin



Ftp: x: 14: 50: FTP User:/var/ftp:/sbin/nologin



Nobody: x: 99: 99: Nobody: // sbin/nologin



Nscd: x: 28: 28: NSCD Daemon: // sbin/nologin



Vcsa: x: 69: 69: virtual console memory owner:/dev:/sbin/nologin



Rpc: x: 32: 32: Portmapper RPC user: // sbin/nologin



Mailnull: x: 47: 47:/var/spool/mqueue:/sbin/nologin



Smmsp: x: 51: 51:/var/spool/mqueue:/sbin/nologin



Pcap: x: 77: 77:/var/arpwatch:/sbin/nologin



Ntp: x: 38: 38:/etc/ntp:/sbin/nologin



Messages: x: 81: 81: System message bus: // sbin/nologin



Avahi: x: 70: 70: Avahi daemon: // sbin/nologin



Sshd: x: 74: 74: Privilege-separated SSH:/var/empty/sshd:/sbin/nologin



Rpcuser: x: 29: 29: RPC Service User:/var/lib/nfs:/sbin/nologin



Nfsnobody: x: 65534: 65534: Anonymous NFS User:/var/lib/nfs:/sbin/nologin



Haldaemon: x: 68: 68: HAL daemon: // sbin/nologin



Avahi-autoipd: x: 100: 101: avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin



Xfs: x: 43: 43: X Font Server:/etc/X11/fs:/sbin/nologin



EM: x: 42: 42:/var/EM:/sbin/nologin



Sabayon: x: 86: 86: Sabayon user:/home/sabayon:/sbin/nologin



Oracle: x: 500: 501:/home/oracle:/bin/bash



Mysql: x: 101: 102: MySQL server:/var/lib/mysql:/bin/bash

 

Solution:

Filter