当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0115909

漏洞标题：携程旅游网服务器配置不当可直接导致官方邮件劫持（邮件伪造与防识别原理）

相关厂商：携程旅行网

漏洞作者： 黑暗游侠

提交时间：2015-05-25 13:19

修复时间：2015-05-25 15:30

公开时间：2015-05-25 15:30

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-25： 细节已通知厂商并且等待厂商处理中
2015-05-25： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

以为快乐会永久 像不变星空 陪著我

详细说明：

之前提交了 http://wooyun.org/bugs/wooyun-2015-0114708
(标题:一种可大规模定向钓鱼携程旅游网千万用户的攻击过程重放（附案例，非携程用户依然躺枪）
这个比较鸡肋，因为还需要高深的html技术去构造，并且后面的表单并不能去掉，只能在一块区域自定义内容
那么so，附上直接版的吧，大招。
携程有两个域名
ctrip.com 和 c-ctrip.com

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -t ctrip.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16330
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13
;; QUESTION SECTION:
;.				IN	NS
;; ANSWER SECTION:
.			250997	IN	NS	c.root-servers.net.
.			250997	IN	NS	a.root-servers.net.
.			250997	IN	NS	h.root-servers.net.
.			250997	IN	NS	b.root-servers.net.
.			250997	IN	NS	f.root-servers.net.
.			250997	IN	NS	l.root-servers.net.
.			250997	IN	NS	j.root-servers.net.
.			250997	IN	NS	d.root-servers.net.
.			250997	IN	NS	g.root-servers.net.
.			250997	IN	NS	i.root-servers.net.
.			250997	IN	NS	m.root-servers.net.
.			250997	IN	NS	e.root-servers.net.
.			250997	IN	NS	k.root-servers.net.
;; ADDITIONAL SECTION:
c.root-servers.net.	581623	IN	A	192.33.4.12
c.root-servers.net.	581625	IN	AAAA	2001:500:2::c
a.root-servers.net.	580364	IN	A	198.41.0.4
a.root-servers.net.	581623	IN	AAAA	2001:503:ba3e::2:30
h.root-servers.net.	581623	IN	A	128.63.2.53
h.root-servers.net.	581623	IN	AAAA	2001:500:1::803f:235
b.root-servers.net.	581624	IN	A	192.228.79.201
b.root-servers.net.	581626	IN	AAAA	2001:500:84::b
f.root-servers.net.	581623	IN	A	192.5.5.241
f.root-servers.net.	581623	IN	AAAA	2001:500:2f::f
l.root-servers.net.	581623	IN	A	199.7.83.42
l.root-servers.net.	581623	IN	AAAA	2001:500:3::42
j.root-servers.net.	581624	IN	A	192.58.128.30
;; Query time: 5 msec
;; SERVER: 211.137.130.3#53(211.137.130.3)
;; WHEN: Sun May 24 04:26:52 2015
;; MSG SIZE  rcvd: 508


; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -t c-ctrip.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52168
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13
;; QUESTION SECTION:
;.				IN	NS
;; ANSWER SECTION:
.			251076	IN	NS	c.root-servers.net.
.			251076	IN	NS	a.root-servers.net.
.			251076	IN	NS	h.root-servers.net.
.			251076	IN	NS	b.root-servers.net.
.			251076	IN	NS	f.root-servers.net.
.			251076	IN	NS	l.root-servers.net.
.			251076	IN	NS	j.root-servers.net.
.			251076	IN	NS	d.root-servers.net.
.			251076	IN	NS	g.root-servers.net.
.			251076	IN	NS	i.root-servers.net.
.			251076	IN	NS	m.root-servers.net.
.			251076	IN	NS	e.root-servers.net.
.			251076	IN	NS	k.root-servers.net.
;; ADDITIONAL SECTION:
c.root-servers.net.	581702	IN	A	192.33.4.12
c.root-servers.net.	581704	IN	AAAA	2001:500:2::c
a.root-servers.net.	580443	IN	A	198.41.0.4
a.root-servers.net.	581702	IN	AAAA	2001:503:ba3e::2:30
h.root-servers.net.	581702	IN	A	128.63.2.53
h.root-servers.net.	581702	IN	AAAA	2001:500:1::803f:235
b.root-servers.net.	581703	IN	A	192.228.79.201
b.root-servers.net.	581705	IN	AAAA	2001:500:84::b
f.root-servers.net.	581702	IN	A	192.5.5.241
f.root-servers.net.	581702	IN	AAAA	2001:500:2f::f
l.root-servers.net.	581702	IN	A	199.7.83.42
l.root-servers.net.	581702	IN	AAAA	2001:500:3::42
j.root-servers.net.	581703	IN	A	192.58.128.30
;; Query time: 4 msec
;; SERVER: 211.137.130.3#53(211.137.130.3)
;; WHEN: Sun May 24 04:25:32 2015
;; MSG SIZE  rcvd: 508


其中
ctrip的mx和txt记录：

;; QUESTION SECTION:
;ctrip.com.			IN	MX
;; ANSWER SECTION:
ctrip.com.		777	IN	MX	20 mx2.ctrip.com.
ctrip.com.		777	IN	MX	10 mx.ctrip.com.


ctrip.com.		900	IN	TXT	"0RhgfGwGA1HoaS1HmgmNzd+tKZb46AxM4nqm73bTsj9/3MIn0pmyIbZasbdvgvrrXYGtnr6K+wHvPhQ0QysxoQ=="
ctrip.com.		900	IN	TXT	"v=spf1 include:spf.ctrip.com ~all"
ctrip.com.		900	IN	TXT	"v=spf2.0/pra include:spf.ctrip.com ~all"
ctrip.com.		900	IN	TXT	"MS=ms62746735"


c-ctrip.com的mx和txt记录：

;; QUESTION SECTION:
;c-ctrip.com.			IN	MX
;; ANSWER SECTION:
c-ctrip.com.		900	IN	MX	20 mx1.c-ctrip.com.
c-ctrip.com.		900	IN	MX	10 mx2.c-ctrip.com.


Address:  211.137.130.3
c-ctrip.com
        primary name server = ns5.ctrip.com
        responsible mail addr = hostmaster.ctrip.com
        serial  = 2015051301
        refresh = 7200 (2 hours)
        retry   = 3600 (1 hour)
        expire  = 604800 (7 days)
        default TTL = 3600 (1 hour)


diff 一下
ctrip.com域下作了spf
但是
c-ctrip.com域下并没有DNS记录txt类型的spf记录登记邮件服务器IP
看证明：

漏洞证明：

伪造csrc@c-ctrip.com
搭建一个邮局服务器
添加域名c-ctrip.com
添加用户csrc
自定义邮件发给自己（茫茫用户中的小小一个）

12.png


(亲，携程邀请你去看5月28号的多啦A梦：伴我同行）

修复方案：

给个参考链接 http://www.openspf.org/SPF_Record_Syntax

版权声明：转载请注明来源 黑暗游侠@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-05-25 15:30

厂商回复：

感谢您对携程的关注。

漏洞Rank：5 (WooYun评价)

最新状态：

暂无