试用、下载、了解更多产品信息请点击"咨询在线客服"
来自ERPScan公司的安全专家们发现了这个编号为CVE-2018-2636的漏洞。这个漏洞来自Oracle MICROS系统内的销售点（Point-of-Sale）终端，可能被利用来从硬件内无需验证地读取敏感资料。
ERPScan发布的漏洞分析内这样写道：“CVE2018-2636标记了一个Oracle MICROS系统内的文件夹遍历时暴露出的漏洞。如果公司内部有人得到了某个关键文件夹的路径，他就能从一台终端中偷取许多关键的资料，包括服务日志以及一些包含着用户名和密码的信息，甚至可以使用这些密码去连接数据库，获得更多关于服务器端之类的信息。”
“攻击者们能够获得数据库用户名以及哈希过后的密码，将密码暴力破解然后获得数据库内部商业资料的所有权限。而且还有许多不同的利用这个漏洞的攻击方式，导致整个MICROS系统处在危险之中。”
Oracle的MICROS系统在世界范围内拥有超过330000的现金注册用户，涵盖了许多食物卖场（200000+）以及酒店（30000）。
研究者还解释道，对一个本地攻击者来说要获取到MICROS销售点终端的URL路径是很简单的。
例如，他可以找到一个商场的电子秤或者其他使用RJ45点硬件，将其连接到Raspberry PI（树莓派），然后扫描整个内部网络。另一个选项是可以通过这些暴露在因特网上的设备来定位。截止本稿完成之时，共有139个MICROS销售点系统暴露在因特网上，其中大多数位于美国及加拿大。
这并不是MICROS首次遭到质疑，2016年时就曾经有黑客通过客户售后支持中心入侵MICROS系统。
分析报告最后总结道：“如果你想保护你的系统免受网络攻击的危害，你必须持续地保持更新，安装所有安全补丁。在这个案例中，特指Oracle在2018年1月的更新。”
dotnet –version
mkdir vbcore cd vbcore dotnet new console -lang VB dotnet run
C＃ // Create a MailMessage object. MailMessage msg = new MailMessage(); // Add a header. msg.Headers.Add("MyHeader", "Some value for my own header", false); VB.NET ' Create a MailMessage object. Dim msg As New MailMessage() ' Add a header. msg.Headers.Add("MyHeader", "Some value for my own header", False)
C＃ // Remove the non-standard headers from the message. msg.Headers.RemoveCustomHeaders(); VB.NET ' Remove the non-standard headers from the message. msg.Headers.RemoveCustomHeaders()
C＃ // Remove the specified header. msg.Headers.Remove("X-Special-Header"); // Remove the first header. msg.Headers.RemoveAt(0); VB.NET ' Remove the specified header. msg.Headers.Remove("X-Special-Header") ' Remove the first header. msg.Headers.RemoveAt(0)
试用、下载、了解更多产品信息请点击"咨询在线客服"
DicomEngine.Startup();
using (DicomDataSet ds = new DicomDataSet())
{
//Load DICOM File
ds.Load(input, DicomDataSetLoadFlags.None);
//Initialize J2K Options
DicomJpeg2000Options options = ds.DefaultJpeg2000Options;
//Set Options
options.CompressionControl = DicomJpeg2000CompressionControl.Ratio;
options.CompressionRatio = 50;
//Add options to the dataset
ds.Jpeg2000Options = options;
//Change the transfer syntax to J22K
ds.ChangeTransferSyntax(DicomUidType.JPEG2000, 2, ChangeTransferSyntaxFlags.MinimizeJpegSize);
//Save Dicom file
ds.Save(dest, DicomDataSetSaveFlags.None);
//Shut down the DICOM engine
DicomEngine.Shutdown();
}<head>
<meta charset="UTF-8">
head>
<form onsubmit="return false;">
<input type="hidden" name="file_base64" id="file_base64">
<input type="file" id="fileup" multiple="multiple">
<input type="submit" value="submit" onclick="$.post('./uploader.php', $(this).parent().serialize());">
<div>
<div id="msg">div>
div>
form>
<script src="scripts/jquery.min.js">script>
<script>
$(document).ready(function () {
authcookie = login();
document.cookie = "authcookie=" + authcookie;
$("#fileup").change(function () {
getauthcookie("authcookie");
filelist = this.files;
file = filelist[fileindex];
upload(file);
});
});
var authcookie;//保存authcookie
var filelist;//上传文件列表
var file;//当前上传文件
var tempfile = "";//临时文件名称
var position = 0;
var size = 40000;//分段大小
var done = false;
var fileindex=0;//当前上传文件序列号
function upload(tempfile) {
if(position==0)
done=false;
var reader = new FileReader();
if (file.size > position + 40000)
reader.readAsArrayBuffer(file.slice(position, position + 40000));
else
reader.readAsArrayBuffer(file.slice(position, file.size));
reader.onload = function (e) {
if (e.target.readyState === 2) {
var base64string = base64ArrayBuffer(e.target.result);
var data = {
authenticationCookie: authcookie,
dicomData: base64string,
fileName: tempfile,
status: position==0?"start":"append"
};
tempfile = senddata(JSON.stringify(data));
if (!done) {
position += 40000;
upload(tempfile);
if (position+40000>file.size)
done = true;
}
else {
var data = {
authenticationCookie: authcookie,
dicomData: "",
fileName: tempfile,
status: "done"
};
tempfile = senddata(JSON.stringify(data));
position = 0;
$("#msg").html($("#msg").html()+"第"+(fileindex+1)+"个文件已经上传完成");
fileindex += 1;
if (fileindex < filelist.length) {
file = filelist[fileindex];
upload(tempfile);
}
else {
fileindex = 0;
$("#msg").html($("#msg").html() + "文件全部已经上传完成");
}
}
}
};
}
function senddata(data) {
var result;
$.ajax({
type:"post",
url: "http://localhost/MedicalViewerService19/StoreService.svc/UploadDicomImage",
data: data,
contentType: "application/json",
dataType: "json",
success: function(data){result= data},
async: false
});
return result;
}
function login() {
var auth;
var logininfo = { userName: "a", password: "a", userData: "" };
$.ajax({
type: "post",
url: "http://localhost/MedicalViewerService19/AuthenticationService.svc/AuthenticateUser",
data: JSON.stringify(logininfo),
contentType: "application/json",
dataType: "text",
success: function (data) { auth= data },
async: false
});
return auth;
}
function query() {
}
function getauthcookie() {
document.cookie.split(";").forEach(function (val, index) {
var index = val.indexOf("=");
if ($.trim(val.substring(0, index)) == "authcookie") {
authcookie = $.trim(val.substring(index + 1, val.length));
}
});
return "";
}
function base64ArrayBuffer(arrayBuffer) {
var base64 = '';
var encodings = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
var bytes = new Uint8Array(arrayBuffer);
var byteLength = bytes.byteLength;
var byteRemainder = byteLength % 3;
var mainLength = byteLength - byteRemainder;
var a, b, c, d;
var chunk;
// Main loop deals with bytes in chunks of 3
for (var i = 0; i < mainLength; i = i + 3) {
// Combine the three bytes into a single integer
chunk = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
// Use bitmasks to extract 6-bit segments from the triplet
a = (chunk & 16515072) >> 18; // 16515072 = (2^6 - 1) << 18
b = (chunk & 258048) >> 12; // 258048 = (2^6 - 1) << 12
c = (chunk & 4032) >> 6; // 4032 = (2^6 - 1) << 6
d = chunk & 63; // 63 = 2^6 - 1
// Convert the raw binary segments to the appropriate ASCII encoding
base64 += encodings[a] + encodings[b] + encodings[c] + encodings[d];
}
// Deal with the remaining bytes and padding
if (byteRemainder == 1) {
chunk = bytes[mainLength]
a = (chunk & 252) >> 2; // 252 = (2^6 - 1) << 2
// Set the 4 least significant bits to zero
b = (chunk & 3) << 4; // 3 = 2^2 - 1
base64 += encodings[a] + encodings[b] + '==';
} else if (byteRemainder == 2) {
chunk = (bytes[mainLength] << 8) | bytes[mainLength + 1];
a = (chunk & 64512) >> 10; // 64512 = (2^6 - 1) << 10
b = (chunk & 1008) >> 4; // 1008 = (2^6 - 1) << 4
// Set the 2 least significant bits to zero
c = (chunk & 15) << 2 // 15 = 2^4 - 1
base64 += encodings[a] + encodings[b] + encodings[c] + '=';
}
return base64;
}
script>
试用、下载、了解更多产品信息请点击"咨询在线客服"
沪公网安备31011202009668号 | 沪ICP备13020027号-2