Uploading of arbitrary files on a website of chinamoocs affects a large amount of data on the Intranet.

Uploading of arbitrary files on a website of chinamoocs affects a large amount of data on the Intranet.

Site: http: // 118.26.192.92 the website title is the auxiliary diagnosis and treatment system of the county-level regional health information platform in Shaanxi Province. But the website is in the intranet of China Medical Network. Why do you say this? There is an account of the staff of China Medical Network.


Let's take a look at the ip address. The intranet ip address of chinamoocs is 174.1.8.1/24.
Ethernet adapter local connection:
Connection-specific DNS Suffix .:
IP Address ......: 174.1.8.161
Subnet Mask ......: 255.255.255.0
Default Gateway .........:
Ethernet adapter local connection 2:
Connection-specific DNS Suffix .:
IP Address ......: 118.26.207.23
Subnet Mask ......
IP Address ......: 118.26.192.92
Subnet Mask...
Default Gateway ......: 118.26.192.81
118.26.207.1

In the Intranet environment, we found that the sensitive port number is 3389 based on the data obtained last time, but it is in the Intranet. Now we do not have an account for moma or something. This server cannot be used, but we can use this server as a stepping stone to access other server data. Well, yes!


Open the host that was not tried this time
174.1.8.50
[+] 174.1.8.50: 1433-login successful: WORKSTATION \ CM ***** server: 3TOM2 ************* x

Log on to the remote host and connect to the database. There are 13 databases and GB of data.


A large amount of data involves the examinee's name, doctor's number, and other sensitive information.




There is also a small problem with the upload interface
Http: // 118.26.192.92/ckeditor/uploadImage. aspx

Http: // 192.168.1.116/FRAMEDEMO/UploadImage/061b7c70-19d1-423e-880d-906072ba50dc.png
Upload to an intranet ip address. It does not matter. You can directly replace it with an Internet ip address to connect it smoothly.


The first is the passing pony.

There are two other Trojans and one exe file (the other one is not deleted successfully). I have deleted the files, and the others want the Administrator to clear the files by himself.

Solution:

Fix Arbitrary File Upload
Modify account