TA的每日心情 | 奋斗 7 小时前 |
---|
签到天数: 2384 天 [LV.Master]伴坛终老
|
转载请注明出处:http://hi.baidu.com/biweilun: G4 R5 x/ Z' D# q( @0 U5 |
我现在对百度的新聊天工具进行了稍微深入的分析,再下一步的分析工作就是在汇编调试里面展开的了。先说下我发现的可能威胁:# n; k* v" c9 A
1、Swf文件跨站漏洞6 G+ E, |5 q. h
在Baidu Hi 的安装文件夹里的MovieData文件夹里面有3个swf文件,分别是loginCarton.swf,videoConnectingBig.swf和videoConnectingSmall.swf。其中,loginCarton.swf的可能别利用漏洞最大,这点上百度不如腾讯,没有做好swf文件的内嵌工作,让swf文件暴露在外面。病毒可以感染并放入恶意的swf文件来覆盖他们。loginCarton.swf是baiduhi的启动画面,这是非常危险的,因为swf木马在网上非常流行。还有,病毒要获取这个目录非常简单,只要以system来读取注册表就好,路径会保存在注册表的[HKEY_LOCAL_MACHINE\SOFTWARE\3D SoftWare]下的"path"键值里面,如果修改注册表,人为改变该键值,可能引发更大的危机!
& V) K! s' ?: q- N4 ~5 F6 I" `( P, W W) ? E" w
2、自动升级漏洞0 M; O6 e& b* v0 A( L
该漏洞目前没有测试,不过应该将来会盛行的。因为目前大家的Baidu HI都是最新版,不需要升级。将来如果需要升级的时候,这个漏洞就很危险了。Baidu Hi 的升级文件在AutoUpdate文件夹里面,
, @6 V3 h$ F0 V. U# c* a' ?
1 C2 d3 t+ S# G% h6 b! M K( ^& ~- y5 c% f
BaiduHiUpdate.exe文件通过调用config.ini文件来升级,我们来看config.ini文件的代码:
3 ]. e) O2 J* ?4 }4 w3 a3 y7 [[AutoUpdate]1 M& h* \9 p V4 H. J
ConfigFileUrl=http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml
7 s8 }& p) T( D" Y5 K5 G$ |6 U) BIsAutoUpdate=1$ w$ p n& H; l8 M. o
ConfigFileKey1=3F26F386EB827C141DF8FE539B7ECDF4
7 z7 _8 _$ M8 IConfigFileKey2=128509257100000000
: p7 [# a; v x1 O) R5 `4 hLSTm_AutoUpdate=12065967540 W4 I$ b5 U3 j3 Y8 T" `
看来使用的是下载http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml这个文件,我下载下来打开一看,这个文件和AutoUpdate文件夹里面的那个AutoUpdate.xml文件内容相同。代码都是如下的:5 @3 t3 Z4 G, {% V1 Q6 R
<AutoUpdate version="1.0">
8 Q- o* m( r! o) [<Updater version="1.0.0.8" url="http://update.im.baidu.com/AutoUpdate/updater48-49.cab" md5="8312201dc14e0ff595680f6bcf4d0fb1" hint="update 49">7 K V! U; G3 f+ H2 o! B
<File name="atl71.dll" dest="updater:\" type="bin" operation="add" />
# ]- a$ ?* \/ r9 E& n<File name="AutoInstall.exe" dest="updater:\" type="bin" operation="add" /> 1 s6 Y% T C) R! m+ x& \9 O, ]
<File name="AutoUpdateUtil.dll" dest="updater:\" type="bin" operation="add" /> & I) w: |5 X/ y/ s( J! W# o
<File name="BaiduHiUpdate.exe" dest="updater:\" type="bin" operation="add" />
h2 e/ X: P4 o<File name="Basement.dll" dest="updater:\" type="bin" operation="add" />
& y" e7 H" F" H' p5 q$ m# s<File name="config.ini" dest="updater:\" type="resource" operation="add" /> # r$ r& k( H3 _# L) O
<File name="msvcp71.dll" dest="updater:\" type="bin" operation="add" />
8 {9 v8 I: a0 ^. D3 O8 |<File name="msvcr71.dll" dest="updater:\" type="bin" operation="add" /> S: l1 K% I1 \1 V* d) z/ M
<File name="resource.db" dest="updater:\" type="resource" operation="add" />
8 A6 f+ t8 z# p3 U4 `. F<File name="VersionInfo.xml" dest="updater:\" type="resource" operation="add" /> ! b: M9 t% @: F
</Updater>
6 F5 t2 r9 g9 p0 R, h' F" n<Module name="BaiduHi" version="1.0.1.0" level="forcePrompt">
* T9 B1 \, Z* j' X" x5 |* }<Upgrade versi hint="update 49" md5="f684d6220bb2771433410e482287cc58" url="http://update.im.baidu.com/AutoUpdate/upgrade48-49.cab">
5 }0 b0 D: F8 t9 \6 k3 I<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
) U6 c" U* M. o$ V# Z! b$ t<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" /> 5 ^: P' i" m& w. m8 l
<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" /> g( X( I6 f. W" R0 U; k3 W2 `6 ?
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" />
% n+ _; A$ S! O<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" /> 8 s3 O0 D! A( e: Q# F! ?, X U) N( f
<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" /> 9 S. ^5 d/ n8 u
<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" /> , J8 X. g9 f9 q D! J
<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" /> % z, v, [5 s3 a2 `; `9 I
<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" /> 3 X* m) `" \3 q4 E9 r. f
<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" /> 2 h2 V* r! E; v% X+ [) p% ?
<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" /> ; Y0 V) B% X6 G( _
<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" />
0 B) ]# r$ H! e: z<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" /> 1 M6 [ u8 Y' Z
<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" /> . x; n: n. U, ]
<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" />
* ~: K* N" }5 M1 ~; b- H<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
4 d) J8 Z! f7 N) t; M' r<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" /> 1 P9 U8 p: V) k% ]3 B! c6 M- v
</Upgrade>& C: p }$ |0 n" ^
<FullPackage hint="update 49" md5="3af7588de47c7fdcb9ca5421de4c444c" url="http://update.im.baidu.com/AutoUpdate/fullpackage48-49.cab">- ? A g" D3 S2 y) \1 ]
<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 C7 d8 A7 N! h( |7 f4 { z4 A<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" /> - B4 M" O3 u# h* q
<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" /> * H4 w# r/ s6 \
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" /> 7 u* f5 f+ ?5 Y2 G. Y8 b% B
<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" />
' S% W8 Z: d" G! h; D; u6 ]8 y# v<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" />
; Q [% p( e& v' E: `2 }4 U' m- ]<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" /> 9 ?7 |' }# i& v$ I
<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" />
# s5 k+ k( U1 I* g- u7 S2 O<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" />
0 K6 y5 [* L7 X L% @4 m<File name="MovieData\loginCarton.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" /> $ Z) u* S. L7 A3 r0 v
<File name="MovieData\videoConnectingBig.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" /> 4 H9 X9 r9 W: Z" O5 v
<File name="MovieData\videoConnectingSmall.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" /> & i$ D8 G' ]4 r( F* G5 S$ E
<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" />
* d; A" _' e9 e+ {+ \) {1 V) B) Y<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" /> C6 f# R2 h6 b* ?' }5 r
<File name="ServerConfig.dat" dest="BaiduHi:\" type="resource" operation="add" />
% o5 G' ?' d/ M/ B- ]: l<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" /> 6 i2 Y! z/ v9 R5 I' Y* W! d
<File name="SysCustomStatus.xml" dest="BaiduHi:\" type="resource" operation="add" /> " {* M9 f+ j6 L$ ^
<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" /> I4 O! H: ? @- @3 I. z! s5 F0 w
<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" /> 2 F* N, O" B5 n R/ o
<File name="atl71.dll" dest="BaiduHi:\" type="bin" operation="add" />
' P9 d8 I6 g/ g8 s4 T7 m1 T# I& N<File name="dbghelp.dll" dest="BaiduHi:\" type="bin" operation="add" /> # h- f# h# C( C6 C- k
<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" /> 3 S- O9 `0 g( z
<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
, Q: W! D% J! ^<File name="licence.txt" dest="BaiduHi:\" type="resource" operation="add" />
9 j+ m& N4 r: l1 T<File name="mediactrl.dll" dest="BaiduHi:\" type="bin" operation="add" />
6 t2 y9 c: L2 x& O<File name="msvcp71.dll" dest="BaiduHi:\" type="bin" operation="add" /> ) O0 h* w4 Q" J' E
<File name="msvcr71.dll" dest="BaiduHi:\" type="bin" operation="add" /> ( W! j) v* o, `2 C: {6 {
<File name="resource.db" dest="BaiduHi:\" type="resource" operation="add" />
4 T6 ?0 _: n8 R<File name="riched20.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 q; k! U2 `& C( ?5 v0 \4 b4 Z% l<File name="skin\default.db" dest="BaiduHi:\skin\" type="resource" operation="add" /> ( ^& Q. G) @: g, x& }) Q
<File name="skin\rose.db" dest="BaiduHi:\skin\" type="resource" operation="add" />
0 X( v5 a9 \4 Q- ~/ N<File name="sound\msg.wav" dest="BaiduHi:\sound\" type="resource" operation="add" /> , P8 B# g0 M# S8 s
<File name="sound\online.wav" dest="BaiduHi:\sound\" type="resource" operation="add" /> 5 i6 L5 [8 [, U) L. T0 p
<File name="sound\phone.wav" dest="BaiduHi:\sound\" type="resource" operation="add" /> 6 j& o# m' M- J" \* r1 b& w8 p1 t, a
<File name="sound\snapshot.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
# S/ q% C/ @% {3 {- \<File name="sound\system.wav" dest="BaiduHi:\sound\" type="resource" operation="add" /> ( g$ b5 T# J8 U# a2 D
<File name="sysimage\FaceError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" /> ' R" H# m4 b. ?. {" o. P7 W
<File name="sysimage\FaceLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
: p+ |. e8 R$ y* H) K5 D$ |<File name="sysimage\ImageError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
$ f/ O" e% b9 R* J1 H<File name="sysimage\ImageLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
" R' @- |/ V9 h0 S<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" /> m0 C7 ~# w: o" B3 m
<File name="zlib1.dll" dest="BaiduHi:\" type="bin" operation="add" />
+ E q* ^% o3 a. }# S</FullPackage>2 \9 Q8 f, r4 e8 }2 i
</Module>
' y1 [' Y" R) E# T, p</AutoUpdate>
) v, J5 ~; N( g6 z; D通过AutoUpdate.xml文件来下载http://update.im.baidu.com/AutoUpdate/updater48-49.cab ,我们可以通过构造恶意的config.ini,然后让程序下载我们构造的恶意AutoUpdate.xml,再让程序通过AutoUpdate.xml下载恶意构造好的cab安装包,释放。还是危害挺大的!" A0 i) J! {" \! B' \! p
最后忠告大家,不要下载除官方以外任何地方的Baidu Hi !否则后够可能很严重,这次我发现的这两个漏洞的利用说容易也容易,说不容易也不容易,本人如上所说只是一点肤浅之见,没什么技术含量,只是觉得软件搞这么明文不好。提醒大家小心一点而已,没有别的意图,更没有哗众取宠的意思。 |
|