Weak Password of a website on Netease causes getshell to go directly to the Intranet for analysis.

Weak Password of a website on Netease causes getshell to go directly to the Intranet for analysis.

A simple weak password, simple and crude.

 

http://223.252.223.246:8080/manager/html

Weak tomcat Password

Admin/admin

You can deploy the war package to getshell with the root permission.
 

 

eth0      Link encap:Ethernet  HWaddr fa:16:3e:a7:36:bd            inet addr:10.166.224.82  Bcast:10.166.227.255  Mask:255.255.252.0          inet6 addr: fe80::f816:3eff:fea7:36bd/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1400  Metric:1          RX packets:114430840 errors:0 dropped:0 overruns:0 frame:0          TX packets:101789664 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:29969074586 (27.9 GiB)  TX bytes:25795479477 (24.0 GiB)eth1      Link encap:Ethernet  HWaddr fa:16:3e:4d:90:54            inet addr:223.252.223.246  Bcast:223.252.223.255  Mask:255.255.255.0          inet6 addr: fe80::f816:3eff:fe4d:9054/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:12355262 errors:0 dropped:0 overruns:0 frame:0          TX packets:832694749 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:1060684677 (1011.5 MiB)  TX bytes:759653419735 (707.4 GiB)lo        Link encap:Local Loopback            inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host          UP LOOPBACK RUNNING  MTU:16436  Metric:1          RX packets:97463344 errors:0 dropped:0 overruns:0 frame:0          TX packets:97463344 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:0           RX bytes:388192841805 (361.5 GiB)  TX bytes:388192841805 (361.5 GiB)

Proper Intranet

And found that the previous user has passed the shell

In addition, a jenkins system is deployed on this site. commands are executed due to unauthorized access and can also be directly imported into the Intranet.

Http: // 223.252.223.246: 8080/jenkins/script

The Intranet will not be scanned.

Proof of vulnerability: 

 

eth0      Link encap:Ethernet  HWaddr fa:16:3e:a7:36:bd            inet addr:10.166.224.82  Bcast:10.166.227.255  Mask:255.255.252.0          inet6 addr: fe80::f816:3eff:fea7:36bd/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1400  Metric:1          RX packets:114430840 errors:0 dropped:0 overruns:0 frame:0          TX packets:101789664 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:29969074586 (27.9 GiB)  TX bytes:25795479477 (24.0 GiB)eth1      Link encap:Ethernet  HWaddr fa:16:3e:4d:90:54            inet addr:223.252.223.246  Bcast:223.252.223.255  Mask:255.255.255.0          inet6 addr: fe80::f816:3eff:fe4d:9054/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:12355262 errors:0 dropped:0 overruns:0 frame:0          TX packets:832694749 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:1060684677 (1011.5 MiB)  TX bytes:759653419735 (707.4 GiB)lo        Link encap:Local Loopback            inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host          UP LOOPBACK RUNNING  MTU:16436  Metric:1          RX packets:97463344 errors:0 dropped:0 overruns:0 frame:0          TX packets:97463344 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:0           RX bytes:388192841805 (361.5 GiB)  TX bytes:388192841805 (361.5 GiB)

Proper Intranet

Http: // 223.252.223.246: 8080/jenkins/script

Solution: 

You know ~