Baidu Hi 两个可能被利用的漏洞曝光！

煎饼

转载请注明出处：http://hi.baidu.com/biweilun
/ U: O* q, B( X. y8 F+ N2 ]8 f+ F我现在对百度的新聊天工具进行了稍微深入的分析，再下一步的分析工作就是在汇编调试里面展开的了。先说下我发现的可能威胁：
* u  J0 G, M  q/ e% |- D1、Swf文件跨站漏洞
, w" ^! I0 W) y/ l. g& Z7 }在Baidu Hi 的安装文件夹里的MovieData文件夹里面有3个swf文件，分别是loginCarton.swf，videoConnectingBig.swf和videoConnectingSmall.swf。其中，loginCarton.swf的可能别利用漏洞最大，这点上百度不如腾讯，没有做好swf文件的内嵌工作，让swf文件暴露在外面。病毒可以感染并放入恶意的swf文件来覆盖他们。loginCarton.swf是baiduhi的启动画面，这是非常危险的，因为swf木马在网上非常流行。还有，病毒要获取这个目录非常简单，只要以system来读取注册表就好，路径会保存在注册表的[HKEY_LOCAL_MACHINE\SOFTWARE\3D SoftWare]下的"path"键值里面，如果修改注册表，人为改变该键值，可能引发更大的危机！
0 o. |* @! F5 S; a8 o% ?) J
7 M' {' M& k% _2 {2、自动升级漏洞
该漏洞目前没有测试，不过应该将来会盛行的。因为目前大家的Baidu HI都是最新版，不需要升级。将来如果需要升级的时候，这个漏洞就很危险了。Baidu Hi 的升级文件在AutoUpdate文件夹里面，
1 w& \9 V8 k7 H

( \! ^! h) L, x3 X( l( x) r* ~BaiduHiUpdate.exe文件通过调用config.ini文件来升级，我们来看config.ini文件的代码：
% x  a& C' `# u9 _; v- D3 C[AutoUpdate]
7 v  F+ F: u, L* yConfigFileUrl=http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml
IsAutoUpdate=1
* L! O  H) s8 x* H( l: G8 DConfigFileKey1=3F26F386EB827C141DF8FE539B7ECDF4
0 t+ i' q: p7 r7 }ConfigFileKey2=128509257100000000
: B9 H% i' w7 C, j% K% aLSTm_AutoUpdate=1206596754
看来使用的是下载http://update.im.baidu.com/AutoUpdate/AutoUpdate.xml这个文件，我下载下来打开一看，这个文件和AutoUpdate文件夹里面的那个AutoUpdate.xml文件内容相同。代码都是如下的：
<AutoUpdate version="1.0">
* d! Z: i0 R% }) E<Updater version="1.0.0.8" url="http://update.im.baidu.com/AutoUpdate/updater48-49.cab" md5="8312201dc14e0ff595680f6bcf4d0fb1" hint="update 49">
<File name="atl71.dll" dest="updater:\" type="bin" operation="add" />
<File name="AutoInstall.exe" dest="updater:\" type="bin" operation="add" />
# F7 k7 h! A, m1 o% r4 e+ W<File name="AutoUpdateUtil.dll" dest="updater:\" type="bin" operation="add" />
. n3 e( g0 _" J* o8 G6 A% {<File name="BaiduHiUpdate.exe" dest="updater:\" type="bin" operation="add" />
' a5 y4 T0 c. X( d<File name="Basement.dll" dest="updater:\" type="bin" operation="add" />
' `) d5 N; q# p; M1 F<File name="config.ini" dest="updater:\" type="resource" operation="add" />
5 j4 {: F, j# I2 [, @<File name="msvcp71.dll" dest="updater:\" type="bin" operation="add" />
0 c! E" y" y  _<File name="msvcr71.dll" dest="updater:\" type="bin" operation="add" />
<File name="resource.db" dest="updater:\" type="resource" operation="add" />
<File name="VersionInfo.xml" dest="updater:\" type="resource" operation="add" />
</Updater>
<Module name="BaiduHi" version="1.0.1.0" level="forcePrompt">
<Upgrade versi hint="update 49" md5="f684d6220bb2771433410e482287cc58" url="http://update.im.baidu.com/AutoUpdate/upgrade48-49.cab">
<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 K3 A, }' o$ U6 H<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" />
) {* g' w! z( Q0 c0 K8 l' D, X<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" />
, s& }, L$ b3 t: f/ ^<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" />
0 Q% o1 ^) K) A2 q<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" />
# d4 o6 L* k4 X2 ~  G, b<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" />
* A& k7 X6 w/ n6 U5 {6 Y( e& ~<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" />
& c5 i8 H* n$ s' M<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" />
<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" />
# H% V% ?& ]6 X3 }5 F* I' i2 {</Upgrade>
<FullPackage hint="update 49" md5="3af7588de47c7fdcb9ca5421de4c444c" url="http://update.im.baidu.com/AutoUpdate/fullpackage48-49.cab">
<File name="AppUtil.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 C( w, q6 z6 x) T+ b' ^6 a/ r' L<File name="BaiduHi.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="Basement.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="BugReport.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="CSTransfer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="HistoryExplorer.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ImEngine.dll" dest="BaiduHi:\" type="bin" operation="add" />
' r; I# q  F9 n$ s<File name="ImStorage.dll" dest="BaiduHi:\" type="bin" operation="add" />
4 z. \: @# |) `) v1 L, w2 ~% y$ b<File name="LocalLog.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="MovieData\loginCarton.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="MovieData\videoConnectingBig.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="MovieData\videoConnectingSmall.swf" dest="BaiduHi:\MovieData\" type="resource" operation="add" />
<File name="NetService.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="RUDPLib.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="ServerConfig.dat" dest="BaiduHi:\" type="resource" operation="add" />
<File name="SkinDLL.dll" dest="BaiduHi:\" type="bin" operation="add" />
- I$ u' ]0 z4 x  i% Y<File name="SysCustomStatus.xml" dest="BaiduHi:\" type="resource" operation="add" />
<File name="UPnPDll.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="VersionInfo" dest="BaiduHi:\" type="resource" operation="add" />
* w2 A# V5 l0 V- R( M/ w* f<File name="atl71.dll" dest="BaiduHi:\" type="bin" operation="add" />
) Y. G% k  F4 r9 E5 m0 H1 e5 B<File name="dbghelp.dll" dest="BaiduHi:\" type="bin" operation="add" />
2 v* }% p) }& ~0 u% W: M<File name="fmmgr.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="imcs.dll" dest="BaiduHi:\" type="bin" operation="add" />
1 c. D7 o# ?% F; N/ t/ C; o$ `<File name="licence.txt" dest="BaiduHi:\" type="resource" operation="add" />
<File name="mediactrl.dll" dest="BaiduHi:\" type="bin" operation="add" />
9 b/ r/ j) U- v<File name="msvcp71.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="msvcr71.dll" dest="BaiduHi:\" type="bin" operation="add" />
<File name="resource.db" dest="BaiduHi:\" type="resource" operation="add" />
2 w& D9 t- R1 b+ c9 z6 A5 h$ v<File name="riched20.dll" dest="BaiduHi:\" type="bin" operation="add" />
3 j1 h; @* e; D2 u6 I% Q<File name="skin\default.db" dest="BaiduHi:\skin\" type="resource" operation="add" />
<File name="skin\rose.db" dest="BaiduHi:\skin\" type="resource" operation="add" />
! V4 W6 g, j& s6 Y/ f$ w! T<File name="sound\msg.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
; {. Q7 w; O+ A) k- V9 m) Q<File name="sound\online.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
/ \+ A" @7 b1 F0 }: P/ R, C# d% x<File name="sound\phone.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
<File name="sound\snapshot.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
<File name="sound\system.wav" dest="BaiduHi:\sound\" type="resource" operation="add" />
<File name="sysimage\FaceError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
. j: y0 ^3 T4 N+ t" |+ e<File name="sysimage\FaceLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
. W5 Q- O: p  ~2 K<File name="sysimage\ImageError.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
) ?. ^4 }, a; O1 Q<File name="sysimage\ImageLoading.gif" dest="BaiduHi:\sysimage\" type="resource" operation="add" />
<File name="uninst.exe" dest="BaiduHi:\" type="bin" operation="add" />
<File name="zlib1.dll" dest="BaiduHi:\" type="bin" operation="add" />
3 \; x8 L3 s' ^2 Q</FullPackage>
</Module>
% G+ Q- _# B8 ^9 D3 _</AutoUpdate>
' @  o6 ^8 b& y1 s3 S0 l6 s通过AutoUpdate.xml文件来下载http://update.im.baidu.com/AutoUpdate/updater48-49.cab ，我们可以通过构造恶意的config.ini，然后让程序下载我们构造的恶意AutoUpdate.xml，再让程序通过AutoUpdate.xml下载恶意构造好的cab安装包，释放。还是危害挺大的！
最后忠告大家，不要下载除官方以外任何地方的Baidu Hi ！否则后够可能很严重，这次我发现的这两个漏洞的利用说容易也容易，说不容易也不容易，本人如上所说只是一点肤浅之见，没什么技术含量，只是觉得软件搞这么明文不好。提醒大家小心一点而已，没有别的意图，更没有哗众取宠的意思。