Baidu Hi 两个可能被利用的漏洞曝光！

煎饼

转载请注明出处：http://hi.baidu.com/biweilun
; u- l3 H3 ]- ^/ e, ?: V& P+ c我现在对百度的新聊天工具进行了稍微深入的分析，再下一步的分析工作就是在汇编调试里面展开的了。先说下我发现的可能威胁：
1、Swf文件跨站漏洞
" }6 g( H9 _" K; P: w6 Z3 L在Baidu Hi 的安装文件夹里的MovieData文件夹里面有3个swf文件，分别是loginCarton.swf，videoConnectingBig.swf和videoConnectingSmall.swf。其中，loginCarton.swf的可能别利用漏洞最大，这点上百度不如腾讯，没有做好swf文件的内嵌工作，让swf文件暴露在外面。病毒可以感染并放入恶意的swf文件来覆盖他们。loginCarton.swf是baiduhi的启动画面，这是非常危险的，因为swf木马在网上非常流行。还有，病毒要获取这个目录非常简单，只要以system来读取注册表就好，路径会保存在注册表的[HKEY_LOCAL_MACHINE\SOFTWARE\3D SoftWare]下的"path"键值里面，如果修改注册表，人为改变该键值，可能引发更大的危机！
/ U7 c. A2 n% R
2、自动升级漏洞
该漏洞目前没有测试，不过应该将来会盛行的。因为目前大家的Baidu HI都是最新版，不需要升级。将来如果需要升级的时候，这个漏洞就很危险了。Baidu Hi 的升级文件在AutoUpdate文件夹里面，

4 s. Z4 ?( m8 e' \
BaiduHiUpdate.exe文件通过调用config.ini文件来升级，我们来看config.ini文件的代码：
[AutoUpdate]
ConfigFileUrl=http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml
7 n* o! \0 U1 J' c% H6 EIsAutoUpdate=1
ConfigFileKey1=3F26F386EB827C141DF8FE539B7ECDF4
ConfigFileKey2=128509257100000000
, }9 u) t( }3 x& ULSTm_AutoUpdate=1206596754
看来使用的是下载http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml这个文件，我下载下来打开一看，这个文件和AutoUpdate文件夹里面的那个AutoUpdate.xml文件内容相同。代码都是如下的：
<AutoUpdate version="1.0">
<Updater version="1.0.0.8" url="http://update.im.baidu.com/AutoUpdate/updater48-49.cab" md5="8312201dc14e0ff595680f6bcf4d0fb1" hint="update 49">
& @' C3 W1 H/ Q. q' \. w( k% v<File name="atl71.dll" dest="updater:\" type="bin" operation="add" />
8 M4 r& g5 D" w5 r9 z<File name="AutoInstall.exe" dest="updater:\" type="bin" operation="add" />
5 o8 a3 G) C- ~/ h<File name="AutoUpdateUtil.dll" dest="updater:\" type="bin" operation="add" />
<File name="BaiduHiUpdate.exe" dest="updater:\" type="bin" operation="add" />
7 V* C7 U5 R  J5 _4 k& P0 Y) X<File name="Basement.dll" dest="updater:\" type="bin" operation="add" />
- Q) k$ o" G+ G5 u" l<File name="config.ini" dest="updater:\" type="resource" operation="add" />
' x, q9 |. U4 `8 y0 D* o; N<File name="msvcp71.dll" dest="updater:\" type="bin" operation="add" />
<File name="msvcr71.dll" dest="updater:\" type="bin" operation="add" />
0 Y& A2 |' V5 G<File name="resource.db" dest="updater:\" type="resource" operation="add" />
- i% r$ a5 M3 J" B0 B4 a$ S<File name="VersionInfo.xml" dest="updater:\" type="resource" operation="add" />
</Updater>
<Module name="BaiduHi" version="1.0.1.0" level="forcePrompt">
4 a1 s6 T; B$ u<Upgrade versi hint="update 49" md5="f684d6220bb2771433410e482287cc58" url="http://update.im.baidu.com/AutoUpdate/upgrade48-49.cab">
<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
4 i, Q$ O3 N" L1 I% D% _9 e& }0 o<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" />
9 i: E6 \  r( t. [- `7 ^: e- h<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" />
, L* g1 W/ S1 {<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" />
/ _: S% x/ M. r# x& {<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" />
<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" />
+ a* {0 K, m2 i! T<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
. _4 ~' Z4 B6 {<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" />
# h. H' w- q; s& ~+ B</Upgrade>
0 i/ W2 w% b( z  V7 m# ?2 N<FullPackage hint="update 49" md5="3af7588de47c7fdcb9ca5421de4c444c" url="http://update.im.baidu.com/AutoUpdate/fullpackage48-49.cab">
<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
& A- J- Q! t1 @5 T* T4 @2 I<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" />
1 W+ H. E# K7 l8 n<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" />
/ N. y2 n  g' W& V0 z4 l5 O<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" />
  S1 z# q+ v5 _# w4 ?5 ?<File name="MovieData\loginCarton.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="MovieData\videoConnectingBig.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="MovieData\videoConnectingSmall.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" />
' j0 n. W: @& h, X<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ServerConfig.dat" dest="BaiduHi:\" type="resource" operation="add" />
- t/ i, I& e# x' N1 C3 p  j2 m<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="SysCustomStatus.xml" dest="BaiduHi:\" type="resource" operation="add" />
<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" />
2 X7 q3 c" ?# f' p) x& Y% |<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" />
" [5 T7 t, i5 ]5 F" p+ s<File name="atl71.dll" dest="BaiduHi:\" type="bin" operation="add" />
( ]. ~/ a9 {" Y1 [' G. V<File name="dbghelp.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" />
$ e$ P+ v3 k- \# d8 H, b; [$ p<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="licence.txt" dest="BaiduHi:\" type="resource" operation="add" />
/ q0 P/ B/ |% W! m; u& c( M<File name="mediactrl.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="msvcp71.dll" dest="BaiduHi:\" type="bin" operation="add" />
9 Y( s5 P$ M! k. E0 |  K: A" F<File name="msvcr71.dll" dest="BaiduHi:\" type="bin" operation="add" />
7 X) P, [& J  Q* j: w9 y3 y<File name="resource.db" dest="BaiduHi:\" type="resource" operation="add" />
3 V3 {' O+ `) W' M( ~<File name="riched20.dll" dest="BaiduHi:\" type="bin" operation="add" />
* V, X' u" M5 n  ]8 h<File name="skin\default.db" dest="BaiduHi:\skin\" type="resource" operation="add" />
<File name="skin\rose.db" dest="BaiduHi:\skin\" type="resource" operation="add" />
7 P! p' \1 ]  O! e) Y; w1 o! H' V% I<File name="sound\msg.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
<File name="sound\online.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
<File name="sound\phone.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
5 R5 Y, k8 ^: ^% `1 T<File name="sound\snapshot.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
, s6 }$ F  Q5 `& x<File name="sound\system.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
' h* O2 z! d8 z+ `$ y# n<File name="sysimage\FaceError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
<File name="sysimage\FaceLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
2 e: s3 m5 D, |: H9 }4 W! ]<File name="sysimage\ImageError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
<File name="sysimage\ImageLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
6 C1 A8 f# W# s<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" />
/ [/ F: W. Q# p1 E* ?<File name="zlib1.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 M4 ]4 u; p4 Z9 J3 q# z</FullPackage>
</Module>
$ h# y+ h1 L4 b, L</AutoUpdate>
) z  e( d" }: A6 ]  V通过AutoUpdate.xml文件来下载http://update.im.baidu.com/AutoUpdate/updater48-49.cab ，我们可以通过构造恶意的config.ini，然后让程序下载我们构造的恶意AutoUpdate.xml，再让程序通过AutoUpdate.xml下载恶意构造好的cab安装包，释放。还是危害挺大的！
' {1 i& N& z8 l最后忠告大家，不要下载除官方以外任何地方的Baidu Hi ！否则后够可能很严重，这次我发现的这两个漏洞的利用说容易也容易，说不容易也不容易，本人如上所说只是一点肤浅之见，没什么技术含量，只是觉得软件搞这么明文不好。提醒大家小心一点而已，没有别的意图，更没有哗众取宠的意思。