漏洞概要
缺陷编号：
WooYun-2014-50406
漏洞标题： 某网络银行支付平台存在重大安全问题
相关厂商：
cycb.com
漏洞作者：
abaddon
提交时间： 2014-02-07 17:09
公开时间： 2014-03-24 17:10
漏洞类型： 系统/服务运维配置不当
危害等级： 高自评
Rank： 20
漏洞状态： 已交由第三方厂商(cncert国家互联网应急中心)处理
漏洞来源：
http://www.wooyun.org
Tags标签：
敏感信息泄露 默认配置不当
漏洞详情披露状态：
2014-02-07： 细节已通知厂商并且等待厂商处理中
2014-02-12： 厂商已经确认，细节仅向厂商公开
2014-02-22： 细节向核心白帽子及相关领域专家公开
2014-03-04： 细节向普通白帽子公开
2014-03-14： 细节向实习白帽子公开
2014-03-24： 细节向公众公开
简要描述：
防火墙配置错误 黑客可利用其查看防火墙配置并以此作为跳板探测内部网络
同时也泄漏了所有网络设备的访问密钥等很多敏感信息。网上银行服务器群安全防护形同虚设
同时也威胁到与之联网的其他商业银行 人民银行 政府系统企业内外安全
详细说明：
防火墙配置错误 黑客可利用其配置漏洞查看防火墙配置并以此作为跳板探测内部网络
同时也泄漏了所有网络设备的pre-shared-key访问密钥等很多敏感信息。网上银行服务器群安全防护形同虚设
同时也潜在威胁到与之联网的其他商业银行 甚至人民银行 政府系统企业内外安全
默认密码admin
漏洞证明：
code 区域<h3c>
<h3c>display cur
<h3c>display current-configuration
#
sysname h3c
#
ike local-name cyyh
#
firewall packet-filter enable
firewall packet-filter default permit
#
nat dns-map 这里是地址 tcp
#
firewall statistic system enable
#
ip http shutdown
#
pki entity abc
common-name abc
organization-unit abc
#
pki domain abc
ca identifier h3c
certificate request url
http://3.1.1.1
certificate request from ra
certificate request entity abc
crl check disable
#
radius scheme system
server-type extended
#
domain system
#
local-user admin
password simple admin
service-type telnet
level 3
service-type ftp
local-user admincy
password simple 删除
service-type telnet
level 3
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
sa duration 43200
#
ike proposal 5
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
sa duration 7200
#
ike proposal 10
authentication-method rsa-signature
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike proposal 20
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike dpd defaultdpd
#
ike peer abc
remote-address 202.99.52.18
local-address 221.202.188.146
nat traversal
certificate domain abc
dpd defaultdpd
#
ike peer bjcb
exchange-mode aggressive
pre-shared-key 删除
remote-address 119.253.56.40
local-address 221.202.188.146
#
ike peer qszx
pre-shared-key 删除
remote-name QSZX
remote-address 211.99.8.228
local-address 221.202.188.146
nat traversal
#
ike peer zfb_peer
pre-shared-key 45free43&f#X#t@
remote-name zfb
remote-address 110.75.135.233
local-address 221.202.188.146
nat traversal
dpd defaultdpd
#
ipsec proposal bjcb
esp authentication-algorithm sha1
esp encryption-algorithm 3des
#
ipsec proposal prop1
esp authentication-algorithm sha1
esp encryption-algorithm 3des
#
ipsec proposal qszx
esp encryption-algorithm 3des
#
ipsec proposal zfb_prop
esp encryption-algorithm 3des
#
ipsec policy zfb_pol 1 isakmp
security acl 3000
pfs dh-group2
ike-peer zfb_peer
proposal zfb_prop
sa duration time-based 5400
#
ipsec policy zfb_pol 2 isakmp
security acl 3010
ike-peer abc
proposal prop1
sa duration time-based 86400
#
ipsec policy zfb_pol 3 isakmp
security acl 3020
pfs dh-group2
ike-peer qszx
proposal qszx
sa duration time-based 86400
#
ipsec policy zfb_pol 4 isakmp
security acl 3600
pfs dh-group2
ike-peer bjcb
proposal bjcb
sa duration time-based 7200
#
acl number 3000
rule 0 permit ip source 172.27.20.50 0.0.0.1 destination 172.27.16.0 0.0.0.255
acl number 3010
rule 0 permit ip source 11.11.0.0 0.0.0.255 destination 19.1.1.0 0.0.0.255
acl number 3020
rule 0 permit ip source 10.4.5.0 0.0.0.15 destination 10.102.80.0 0.0.15.255
rule 1 permit ip source 10.4.5.0 0.0.0.15 destination 10.102.96.0 0.0.31.255
rule 2 permit ip source 10.4.5.0 0.0.0.15 destination 10.0.90.0 0.0.0.255
rule 3 permit ip source 10.4.5.0 0.0.0.15 destination 10.3.2.64 0.0.0.15
rule 4 permit ip source 10.4.5.0 0.0.0.15 destination 10.4.2.64 0.0.0.15
acl number 3100
rule 0 deny ip source 11.11.0.0 0.0.0.255 destination 19.1.1.0 0.0.0.255
rule 2 deny ip source 172.27.20.51 0 destination 172.27.16.0 0.0.0.255
rule 3 deny ip source 10.4.5.0 0.0.0.15 destination 10.102.80.0 0.0.15.255
rule 4 deny ip source 10.4.5.0 0.0.0.15 destination 10.102.96.0 0.0.31.255
删除若干行
acl number 3400
rule 0 permit ip source 54.0.1.11 0
acl number 3500
rule 0 permit ip
acl number 3600
rule 10 permit ip source 53.0.8.11 0 destination 192.168.0.125 0
rule 20 deny ip
#
interface Aux0
async mode flow
#
interface Ethernet0/0
ip address 172.16.33.254 255.255.255.0
#
interface Ethernet0/1
ip address 221.202.188.146 255.255.255.0
nat outbound 3400
nat outbound 3100
nat server protocol tcp global current-interface www inside 11.0.0.1 www
nat server protocol tcp global current-interface 8088 inside 54.0.1.11 8088
nat server protocol tcp global current-interface smtp inside 54.0.1.11 smtp
ipsec policy zfb_pol
#
interface Ethernet0/2
ip address 11.0.0.254 255.255.255.0
ip address 11.11.0.254 255.255.255.0 sub
nat outbound 3300
nat outbound 3200
nat server protocol tcp global 221.202.188.146 www inside 11.0.0.1 www
#
interface NULL0
#
interface LoopBack0
ip address 95.1.1.1 255.255.255.0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/0
add interface Ethernet0/2
set priority 85
#
firewall zone untrust
add interface Ethernet0/1
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
FTP server enable
#
ip route-static 0.0.0.0 0.0.0.0 221.202.188.129 preference 60
删除若干行
preference 60
ip route-static 192.168.2.0 255.255.255.0 11.0.0.251 preference 60
#
ntp-service authentication enable
ntp-service source-interface Ethernet0/1
ntp-service unicast-server 210.72.145.44
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
user privilege level 3
set authentication password simple admin
idle-timeout 1000 0
#
return
<h3c>
<h3c>
<h3c>
<h3c>
<h3c>
修复方案：
速度修复防火墙配置
版权声明：转载请注明来源
abaddon@
乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：11
确认时间：2014-02-12 16:42
厂商回复：
CNVD确认并复现所述情况，已经转由CNCERT下发给CNCERT辽宁分中心，由其后续联系网站管理单位处置。
最新状态：
暂无
原文：http://www.wooyun.org/bugs/wooyun-2010-050406
[
本帖最后由 linda 于 2016-2-15 17:34 编辑 ]
