[公开漏洞]CCTV某处设计不当导致用户爆破（大量弱口令）

CCTV某处设计不当导致用户爆破（大量弱口令）相关厂商：中国网络电视台漏洞作者：魇提交时间：2014-03-18 19:03 公开时间：2014-05-02 19:04 漏洞类型：设计缺陷/逻辑错误危害等级：高自评Rank：10 漏洞状态：厂商已经确认漏洞来源：http://www.wooyun.org Tags标签：无漏洞详情披露状态：

2014-03-18：细节已通知厂商并且等待厂商处理中
2014-03-25：厂商已经确认，细节仅向厂商公开
2014-04-04：细节向核心白帽子及相关领域专家公开
2014-04-14：细节向普通白帽子公开
2014-04-24：细节向实习白帽子公开
2014-05-02：细节向公众公开

简要描述：

RT,说多了你们都知道了

详细说明：

http://vip.cntv.cn/

(VIP邮箱为会员邀请制，暂不开放注册)

也就是说基本为内部人员使用。

没有限制尝试次数，也没有验证码，那么我们就可以枚举用户再逐一进行爆破

这里登录返回的有三种信息

1.该帐号尚未激活，激活后才可登录央视网。

2.用户名不存在

3.密码错误

这是我直接随便输一个密码登录抓包，导入我的user字典

然后根据返回的长度导出3.密码错误的用户

再导入弱口令top100进行爆破

这样的话比起盲目的爆破效率快点

过程截图略过，直接上结果

songchun@vip.cntv.cn:123456

zhangbing@vip.cntv.cn:123456

aguo@vip.cntv.cn:000000

lixin@vip.cntv.cn:000000

liqi@vip.cntv.cn:000000

liwei@vip.cntv.cn:000000

siqin@vip.cntv.cn:000000

wenge@vip.cntv.cn:123456789

wenge@vip.cntv.cn:123456789

weiwei@vip.cntv.cn:123456a

fengjin@vip.cntv.cn:000000

hekun@vip.cntv.cn:000000

hufeng@vip.cntv.cn:000000

jiwei@vip.cntv.cn:000000

lijin@vip.cntv.cn:000000

lipei@vip.cntv.cn:000000

liqian@vip.cntv.cn:000000

liubo@vip.cntv.cn:000000

malei@vip.cntv.cn:000000

lumei@vip.cntv.cn:000000

nifei@vip.cntv.cn:000000

qikai@vip.cntv.cn:000000

subin@vip.cntv.cn:000000

wubai@vip.cntv.cn:000000

xudan@vip.cntv.cn:000000

xuhui@vip.cntv.cn:000000

gaoxia@vip.cntv.cn:111111

baijie@vip.cntv.cn:000000

chenxin@vip.cntv.cn:000000

chidan@vip.cntv.cn:000000

dabing@vip.cntv.cn:000000

fenglu@vip.cntv.cn:000000

fudan@vip.cntv.cn:000000

douxiao@vip.cntv.cn:000000

gengna@vip.cntv.cn:000000

hanfeng@vip.cntv.cn:000000

hanbin@vip.cntv.cn:000000

jinkai@vip.cntv.cn:000000

lijian@vip.cntv.cn:000000

lijing@vip.cntv.cn:000000

jindou@vip.cntv.cn:000000

lixuan@vip.cntv.cn:000000

liuwei@vip.cntv.cn:000000

machao@vip.cntv.cn:000000

maning@vip.cntv.cn:000000

maomao@vip.cntv.cn:000000

peifei@vip.cntv.cn:000000

sunhao@vip.cntv.cn:000000

suntao@vip.cntv.cn:000000

shixin@vip.cntv.cn:000000

tianwei@vip.cntv.cn:000000

shidan@vip.cntv.cn:000000

pengna@vip.cntv.cn:000000

wangxi@vip.cntv.cn:000000

wenjie@vip.cntv.cn:000000

wangge@vip.cntv.cn:000000

xiefei@vip.cntv.cn:000000

xiurui@vip.cntv.cn:000000

xunbao@vip.cntv.cn:000000

liujun@vip.cntv.cn:123abc

aduo@vip.cntv.cn:000000

caodong@vip.cntv.cn:000000

chenwei@vip.cntv.cn:000000

daifeng@vip.cntv.cn:000000

dengrui@vip.cntv.cn:000000

duyun@vip.cntv.cn:000000

fanming@vip.cntv.cn:000000

haidong@vip.cntv.cn:000000

hangeng@vip.cntv.cn:000000

heli@vip.cntv.cn:000000

houxian@vip.cntv.cn:000000

houfeng@vip.cntv.cn:000000

jibin@vip.cntv.cn:000000

jiyi@vip.cntv.cn:000000

jiyu@vip.cntv.cn:000000

jialian@vip.cntv.cn:000000

jialing@vip.cntv.cn:000000

kanghui@vip.cntv.cn:000000

liqiong@vip.cntv.cn:000000

lianglu@vip.cntv.cn:000000

liuchen@vip.cntv.cn:000000

kangrui@vip.cntv.cn:000000

liuting@vip.cntv.cn:000000

mayu@vip.cntv.cn:000000

mengjia@vip.cntv.cn:000000

ningjing@vip.cntv.cn:000000

liufang@vip.cntv.cn:000000

mengtao@vip.cntv.cn:000000

songdan@vip.cntv.cn:000000

suguo@vip.cntv.cn:000000

sunjing@vip.cntv.cn:000000

tianjun@vip.cntv.cn:000000

wanglei@vip.cntv.cn:000000

wangsen@vip.cntv.cn:000000

wangkai@vip.cntv.cn:000000

xiatian@vip.cntv.cn:000000

xiaolei@vip.cntv.cn:000000

xiaoshi@vip.cntv.cn:000000

xiongbo@vip.cntv.cn:000000

xujiang@vip.cntv.cn:000000

xuke@vip.cntv.cn:000000

xuri@vip.cntv.cn:000000

xuechen@vip.cntv.cn:000000

yili@vip.cntv.cn:000000

gaoxi@vip.cntv.cn:111111

xiaoa@vip.cntv.cn:111111

chenguang@vip.cntv.cn:000000

chenming@vip.cntv.cn:000000

chenrong@vip.cntv.cn:000000

chengqin@vip.cntv.cn:000000

changkai@vip.cntv.cn:000000

dongdong@vip.cntv.cn:000000

dongqing@vip.cntv.cn:000000

gubin@vip.cntv.cn:000000

guangxin@vip.cntv.cn:000000

guoyi@vip.cntv.cn:000000

hongchao@vip.cntv.cn:000000

huanming@vip.cntv.cn:000000

huangwei@vip.cntv.cn:000000

jiangbing@vip.cntv.cn:000000

huwei@vip.cntv.cn:000000

jingjing@vip.cntv.cn:000000

layan@vip.cntv.cn:000000

lihui@vip.cntv.cn:000000

lijia@vip.cntv.cn:000000

lilei@vip.cntv.cn:000000

lijie@vip.cntv.cn:000000

liyan@vip.cntv.cn:000000

liyou@vip.cntv.cn:000000

liujia@vip.cntv.cn:000000

liunan@vip.cntv.cn:000000

liuya@vip.cntv.cn:000000

lumin@vip.cntv.cn:000000

lvxin@vip.cntv.cn:000000

makai@vip.cntv.cn:000000

mabin@vip.cntv.cn:000000

pangsong@vip.cntv.cn:000000

rongrong@vip.cntv.cn:000000

tianmiao@vip.cntv.cn:000000

wangxiao@vip.cntv.cn:000000

wangding@vip.cntv.cn:000000

wangning@vip.cntv.cn:000000

wumin@vip.cntv.cn:000000

xiaobing@vip.cntv.cn:000000

xinyu@vip.cntv.cn:000000

xuliu@vip.cntv.cn:000000

xutao@vip.cntv.cn:000000

xuwei@vip.cntv.cn:000000

xuxun@vip.cntv.cn:000000

yeqing@vip.cntv.cn:000000

yinan@vip.cntv.cn:000000

yinan@vip.cntv.cn:000000

yindi@vip.cntv.cn:000000

yujia@vip.cntv.cn:000000

zilei@vip.cntv.cn:000000

yelei@vip.cntv.cn:000000

zenglu@vip.cntv.cn:000000

lubing@vip.cntv.cn:111111

baihua@vip.cntv.cn:000000

caoyan@vip.cntv.cn:000000

chailu@vip.cntv.cn:000000

changqing@vip.cntv.cn:000000

chenle@vip.cntv.cn:000000

chenli@vip.cntv.cn:000000

dongyi@vip.cntv.cn:000000

fanhui@vip.cntv.cn:000000

fangqiong@vip.cntv.cn:000000

guojia@vip.cntv.cn:000000

guohai@vip.cntv.cn:000000

guohao@vip.cntv.cn:000000

guokai@vip.cntv.cn:000000

guoyan@vip.cntv.cn:000000

hanlei@vip.cntv.cn:000000

haojun@vip.cntv.cn:000000

huabei@vip.cntv.cn:000000

jiajie@vip.cntv.cn:000000

jiangchao@vip.cntv.cn:000000

juyang@vip.cntv.cn:000000

lidong@vip.cntv.cn:000000

lifeng@vip.cntv.cn:000000

lishan@vip.cntv.cn:000000

liudan@vip.cntv.cn:000000

liuliu@vip.cntv.cn:000000

liutao@vip.cntv.cn:000000

liuxin@vip.cntv.cn:000000

luzong@vip.cntv.cn:000000

lujian@vip.cntv.cn:000000

mafang@vip.cntv.cn:000000

lvsong@vip.cntv.cn:000000

ningxin@vip.cntv.cn:000000

maxing@vip.cntv.cn:000000

qinyue@vip.cntv.cn:000000

nining@vip.cntv.cn:000000

pengkun@vip.cntv.cn:000000

sunpeng@vip.cntv.cn:000000

shenle@vip.cntv.cn:000000

miaopu@vip.cntv.cn:000000

shiwei@vip.cntv.cn:000000

tangqi@vip.cntv.cn:000000

sunyan@vip.cntv.cn:000000

wangjiang@vip.cntv.cn:000000

wangliang@vip.cntv.cn:000000

mayong@vip.cntv.cn:000000

wangyan@vip.cntv.cn:000000

wangyu@vip.cntv.cn:000000

wubing@vip.cntv.cn:000000

xianzi@vip.cntv.cn:000000

xiaopu@vip.cntv.cn:000000

xinxin@vip.cntv.cn:000000

xiongxiong@vip.cntv.cn:000000

xuyuan@vip.cntv.cn:000000

yanfang@vip.cntv.cn:000000

yaohua@vip.cntv.cn:000000

youwei@vip.cntv.cn:000000

yangdi@vip.cntv.cn:000000

yuequn@vip.cntv.cn:000000

zhaohe@vip.cntv.cn:000000

zhujun@vip.cntv.cn:000000

youku@vip.cntv.cn:111111

buyi@vip.cntv.cn:000000

chenjuan@vip.cntv.cn:000000

duishou@vip.cntv.cn:000000

fangying@vip.cntv.cn:000000

gaomiao@vip.cntv.cn:000000

gongming@vip.cntv.cn:000000

guoting@vip.cntv.cn:000000

guojing@vip.cntv.cn:000000

hanhong@vip.cntv.cn:000000

hanyu@vip.cntv.cn:000000

jiangbo@vip.cntv.cn:000000

jingyan@vip.cntv.cn:000000

liqiang@vip.cntv.cn:000000

lixiang@vip.cntv.cn:000000

liuning@vip.cntv.cn:000000

liutong@vip.cntv.cn:000000

liuyang@vip.cntv.cn:000000

liuying@vip.cntv.cn:000000

luoming@vip.cntv.cn:000000

mina@vip.cntv.cn:000000

miaojie@vip.cntv.cn:000000

longhua@vip.cntv.cn:000000

qiqi@vip.cntv.cn:000000

macheng@vip.cntv.cn:000000

sangchen@vip.cntv.cn:000000

siyu@vip.cntv.cn:000000

songjun@vip.cntv.cn:000000

mina@vip.cntv.cn:000000

shenzhu@vip.cntv.cn:000000

wangdong@vip.cntv.cn:000000

wanghao@vip.cntv.cn:000000

wangpan@vip.cntv.cn:000000

wanghui@vip.cntv.cn:000000

weixing@vip.cntv.cn:000000

xiangxiang@vip.cntv.cn:000000

xieqing@vip.cntv.cn:000000

xuli@vip.cntv.cn:000000

yanhong@vip.cntv.cn:000000

yangfan@vip.cntv.cn:000000

yangliu@vip.cntv.cn:000000

yangling@vip.cntv.cn:000000

yubo@vip.cntv.cn:000000

yujiang@vip.cntv.cn:000000

zuoxing@vip.cntv.cn:000000

zhangjun@vip.cntv.cn:000000

yuze@vip.cntv.cn:000000

zhangxi@vip.cntv.cn:000000

zhaodan@vip.cntv.cn:000000

zhaotao@vip.cntv.cn:000000

yanglin@vip.cntv.cn:000000

zhuhong@vip.cntv.cn:000000

zhaocan@vip.cntv.cn:000000

gaofeng@vip.cntv.cn:123abc

liuqian@vip.cntv.cn:123abc

chaijing@vip.cntv.cn:000000

duanxuan@vip.cntv.cn:000000

gufan@vip.cntv.cn:000000

dongfang@vip.cntv.cn:000000

guanzhou@vip.cntv.cn:000000

guocheng@vip.cntv.cn:000000

hexin@vip.cntv.cn:000000

huxia@vip.cntv.cn:000000

jixin@vip.cntv.cn:000000

kongqian@vip.cntv.cn:000000

jiangying@vip.cntv.cn:000000

leibo@vip.cntv.cn:000000

liangzhi@vip.cntv.cn:000000

liuge@vip.cntv.cn:000000

liuxiang@vip.cntv.cn:000000

liuyu@vip.cntv.cn:000000

taozi@vip.cntv.cn:000000

shenbing@vip.cntv.cn:000000

shenyang@vip.cntv.cn:000000

tongying@vip.cntv.cn:000000

wanggang@vip.cntv.cn:000000

wangpeng@vip.cntv.cn:000000

wangqian@vip.cntv.cn:000000

tangying@vip.cntv.cn:000000

wangrong@vip.cntv.cn:000000

wangchen@vip.cntv.cn:000000

wangxing@vip.cntv.cn:000000

xiangxue@vip.cntv.cn:000000

xiaomian@vip.cntv.cn:000000

xujie@vip.cntv.cn:000000

xiaoming@vip.cntv.cn:000000

yanggang@vip.cntv.cn:000000

yangjian@vip.cntv.cn:000000

yangpeng@vip.cntv.cn:000000

yulei@vip.cntv.cn:000000

zuoli@vip.cntv.cn:000000

zhangchun@vip.cntv.cn:000000

zhanghui@vip.cntv.cn:000000

yinbo@vip.cntv.cn:000000

zhangshu@vip.cntv.cn:000000

zhaofang@vip.cntv.cn:000000

zhima@vip.cntv.cn:000000

zhoulong@vip.cntv.cn:000000

liaoqing@vip.cntv.cn:123abc

bianzhang@vip.cntv.cn:000000

changying@vip.cntv.cn:000000

dengxiong@vip.cntv.cn:000000

dingge@vip.cntv.cn:000000

dingxi@vip.cntv.cn:000000

feifei@vip.cntv.cn:000000

gangqiang@vip.cntv.cn:000000

guowei@vip.cntv.cn:000000

hejing@vip.cntv.cn:000000

hongyu@vip.cntv.cn:000000

huting@vip.cntv.cn:000000

huangdong@vip.cntv.cn:000000

huolei@vip.cntv.cn:000000

huoyan@vip.cntv.cn:000000

jiangshan@vip.cntv.cn:000000

kangbo@vip.cntv.cn:000000

kongzheng@vip.cntv.cn:000000

huanghong@vip.cntv.cn:000000

lining@vip.cntv.cn:000000

liuhua@vip.cntv.cn:000000

liying@vip.cntv.cn:000000

linhai@vip.cntv.cn:000000

liufan@vip.cntv.cn:000000

pangye@vip.cntv.cn:000000

tangyi@vip.cntv.cn:000000

wangguang@vip.cntv.cn:000000

wangwei@vip.cntv.cn:000000

wufang@vip.cntv.cn:000000

wuyang@vip.cntv.cn:000000

xuping@vip.cntv.cn:000000

yanfei@vip.cntv.cn:000000

yiyang@vip.cntv.cn:000000

zhangping@vip.cntv.cn:000000

zhaopu@vip.cntv.cn:000000

zhaoxu@vip.cntv.cn:000000

zhouqi@vip.cntv.cn:000000

zhubin@vip.cntv.cn:000000

zhuxun@vip.cntv.cn:000000

zhouyu@vip.cntv.cn:000000

liuwen@vip.cntv.cn:123abc

caimeng@vip.cntv.cn:000000

caiying@vip.cntv.cn:000000

chenduo@vip.cntv.cn:000000

lanyang@vip.cntv.cn:000000

lengyan@vip.cntv.cn:000000

lizheng@vip.cntv.cn:000000

linzhong@vip.cntv.cn:000000

liuchao@vip.cntv.cn:000000

mengbin@vip.cntv.cn:000000

mihe@vip.cntv.cn:000000

pingfan@vip.cntv.cn:000000

pengyan@vip.cntv.cn:000000

qinfang@vip.cntv.cn:000000

shenhao@vip.cntv.cn:000000

shengle@vip.cntv.cn:000000

tangyan@vip.cntv.cn:000000

tianhao@vip.cntv.cn:000000

wanghan@vip.cntv.cn:000000

wangjie@vip.cntv.cn:000000

xiangtu@vip.cntv.cn:000000

xiaoyan@vip.cntv.cn:000000

xiaowei@vip.cntv.cn:000000

yangcan@vip.cntv.cn:000000

yanghui@vip.cntv.cn:000000

yanglei@vip.cntv.cn:000000

yangrui@vip.cntv.cn:000000

yangwei@vip.cntv.cn:000000

yuantao@vip.cntv.cn:000000

zenglei@vip.cntv.cn:000000

zhangxiang@vip.cntv.cn:000000

zhaoyan@vip.cntv.cn:000000

zhaoyue@vip.cntv.cn:000000

zhongquan@vip.cntv.cn:000000

zhoulei@vip.cntv.cn:000000

zhangsan@vip.cntv.cn:123456a

chenjing@vip.cntv.cn:000000

chenshuo@vip.cntv.cn:000000

chenyang@vip.cntv.cn:000000

chenxiao@vip.cntv.cn:000000

gaobo@vip.cntv.cn:000000

gaoqiong@vip.cntv.cn:000000

kongying@vip.cntv.cn:000000

lizhe@vip.cntv.cn:000000

qiaojing@vip.cntv.cn:000000

shenchen@vip.cntv.cn:000000

wangyong@vip.cntv.cn:000000

yangchun@vip.cntv.cn:000000

zoucheng@vip.cntv.cn:000000

zusun@vip.cntv.cn:000000

zhangbin@vip.cntv.cn:000000

zhanghong@vip.cntv.cn:000000

zhanglei@vip.cntv.cn:000000

zhanglin@vip.cntv.cn:000000

zhangwei@vip.cntv.cn:000000

zhangying@vip.cntv.cn:000000

zhangyun@vip.cntv.cn:000000

zhengjun@vip.cntv.cn:000000

zhongman@vip.cntv.cn:000000

zhoubing@vip.cntv.cn:000000

zhourong@vip.cntv.cn:000000

zhouzhuo@vip.cntv.cn:000000

zhengyan@vip.cntv.cn:000000

chenhong@vip.cntv.cn:123abc

liaojing@vip.cntv.cn:123abc

cuiwei@vip.cntv.cn:000000

chenqi@vip.cntv.cn:000000

haojie@vip.cntv.cn:000000

jiangyuan@vip.cntv.cn:000000

lianyi@vip.cntv.cn:000000

liuyan@vip.cntv.cn:000000

liuzhuang@vip.cntv.cn:000000

lvyang@vip.cntv.cn:000000

shenyu@vip.cntv.cn:000000

yangguang@vip.cntv.cn:000000

yinwen@vip.cntv.cn:000000

zouyue@vip.cntv.cn:000000

zhangjing@vip.cntv.cn:000000

zhanglang@vip.cntv.cn:000000

zhangmeng@vip.cntv.cn:000000

zhangni@vip.cntv.cn:000000

zining@vip.cntv.cn:000000

zhangzhao@vip.cntv.cn:000000

zhengxuan@vip.cntv.cn:000000

zhongfeng@vip.cntv.cn:000000

chenghong@vip.cntv.cn:123abc

huning@vip.cntv.cn:123abc

gaoning@vip.cntv.cn:000000

gechong@vip.cntv.cn:000000

hanying@vip.cntv.cn:000000

hongmei@vip.cntv.cn:000000

nana@vip.cntv.cn:000000

nana@vip.cntv.cn:000000

shatong@vip.cntv.cn:000000

shanyao@vip.cntv.cn:000000

tanzhen@vip.cntv.cn:000000

yangxin@vip.cntv.cn:000000

yaopeng@vip.cntv.cn:000000

zhangqiang@vip.cntv.cn:000000

zhongliang@vip.cntv.cn:000000

zhangyu@vip.cntv.cn:000000

zhouzuo@vip.cntv.cn:000000

duyue@vip.cntv.cn:000000

gaozhong@vip.cntv.cn:000000

liangyan@vip.cntv.cn:000000

nasen@vip.cntv.cn:000000

qizhi@vip.cntv.cn:000000

qinzheng@vip.cntv.cn:000000

tianwang@vip.cntv.cn:000000

wangyuan@vip.cntv.cn:000000

wuyue@vip.cntv.cn:000000

xujun@vip.cntv.cn:000000

yanqiang@vip.cntv.cn:000000

zhangjie@vip.cntv.cn:000000

zhangtao@vip.cntv.cn:000000

zhangyue@vip.cntv.cn:000000

zhaogang@vip.cntv.cn:000000

zhangzhe@vip.cntv.cn:000000

zhangyan@vip.cntv.cn:000000

zhuangqiang@vip.cntv.cn:000000

pengyue@vip.cntv.cn:123456a

jinyue@vip.cntv.cn:000000

yangyu@vip.cntv.cn:000000

zourui@vip.cntv.cn:000000

zhangning@vip.cntv.cn:000000

zhaoyu@vip.cntv.cn:000000

zhencheng@vip.cntv.cn:000000

zhaoxi@vip.cntv.cn:123abc

jiaoyan@vip.cntv.cn:000000

jingwei@vip.cntv.cn:000000

pengtan@vip.cntv.cn:000000

qinying@vip.cntv.cn:000000

yangyong@vip.cntv.cn:000000

zhouzhou@vip.cntv.cn:000000