Arbitrary Code Execution in a youku System

Arbitrary Code Execution by a youku system causes the server to fall.
Test start from here http: // 211.151.146.151
Splunk is a log statistics and analysis system.
 
 
 
 
However, the Free version is used, so you cannot configure the password ~ The tragedy is version 4.2.1 and a known cve Vulnerability exists.
 
CVE-2011-4642
Http://www.securityfocus.com/bid/51061/info
 
 
 
 
Run the following script.
 
Python splunk_exploit.py-f-t 211.151.145.151-w 80
 
 
 
 
Local nc listening, bounce back to a shell, direct root permission.
 
 
 
 
The server is on the Intranet.
 
 
 
 
A rootkit is required, but all other ports except the web port are wall-mounted. I checked that wget can be used and prepared to install a scanner. The download speed is so fast that it is indeed a video website. 0.0
 
 


 
During compilation, we found that the server was not even installed with gcc. Forget it, let's go here>. <after all, it's an online server.
 
 

Solution:

Upgrade to the latest version.