A website in sogou is incorrectly configured and directly posts data to the Intranet.

A website in sogou is incorrectly configured and directly posts data to the Intranet.

A website in sogou is incorrectly configured and directly posts data to the Intranet.

CVE-2014-3393, Cisco Adaptive Security Appliance (ASA) Software has Security vulnerabilities in the implementation of the Clientless ssl vpn entry custom framework, unauthenticated remote attackers can exploit this vulnerability to modify the Clientless ssl vpn entry content, resulting in credential theft, cross-site scripting, and other attacks. In other words, this is Cisco's unauthorized access vulnerability. The Exploitation and result of the vulnerability in the demo are followed up.

Sogou uses Cisco vpn.
 

For the code, see http://drops.wooyun.org/papers/3451,, send a postpackage
 

302 is returned, indicating that sogou has this vulnerability. You can modify the page and insert an xss Attack Script to record the password. However, blind modification will obviously be discovered, because it will be the default page without modification, so you need to modify it exactly like it.
 

Can you see that this page is self-imitated by sogou? Who knows?

The modification was successful, but the access page did not exist. After a long time, I found that it was a node problem. Because I hung a proxy during the modification, only one node was changed, because sogou's vpn group consists of Hong Kong and sougou inc
 

. Shut down and go to bed, and wait for the result. The next day, the account came.

refhttps://vpn.sogou-inc.com/+CSCOE+/logon.html?sgroup=sogougpData:  tgroup=&next=&tgcookieset=&group_list=sogougp&username=xiaoqin%40sogou-inc.com&password=QQ478751713%40&Login=%E7%99%BB%E9%99%86

Log on to your mailbox and go in.
 

Login vpn
 

Login successful

The following is a wonderful roaming intranet.

It is simple and rude. A demon can directly handle the Intranet domain name, and the Intranet system diagram has been displayed.
 

Simple stroll, only proof, not in-depth
 

 

 

 

 

I'm curious about where the data from the Public Opinion system comes from ..

Solution:

Update and delete the xss code on the vpn page