[5.20]从抖音信息收集到微信小程序sessionkey泄露伪造登录渗透某edu站

sessionkey引入

微信sessionkey是微信小程序开发中用于标识用户会话的一串密钥。当用户在微信小程序中进行登录操作时，微信服务器会返回一个session_key，开发者可以使用这个session_key来获取用户的身份信息或进行加密通信.

如果sessionkey泄露就可以进行获取用户信息,伪造登录.

师傅404Xyunxi就是通过sessionkey打的 拿到了江西财经大学的证书

[5.20]提交的某edusrc平台案例

此次案例就是通过sessionkey泄露达到伪造登录的

期中此次信息搜集的骚操作方法来自师傅404Xyunxi,收益匪浅

伪造登录工具:Wx_SessionKey_crypt

发现漏洞一:sessionkey泄露

点击登录

抓取数据包

微信session key泄露 伪造登录需要手机号

从抖音信息搜集到手机号

在抖音搜索相关平台信息,得到泄露的手机号

得到私人手机号187291*****

伪造登录

1.先解密自己的：

2.在伪加密替换成他的

替换encrypetdData,成功伪造登录

每次替换的时候encryptedData和iv都会改变,所以每次的包都不同,这里就不提供数据包了

发现漏洞二:逻辑缺陷

使用自己的手机号再次点击登录

无法登录

此时抓取数据包

登录失败的返回包:

抓取187291***登录成功的返回包

复制成功登录的返回包

{"code":2000,"msg":"success","data":{"user_id":3925,"class":[{"teacher_id":24,"name":"王萍萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"王萍萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}
{"code":2000,"msg":"success","data":{"user_id":3925,"class":[{"teacher_id":24,"name":"王萍萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"王萍萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}
{"code":2000,"msg":"success","data":{"user_id":3925,"class":[{"teacher_id":24,"name":"王萍萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"王萍萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}

对自己的返回包进行替换

再次成功登录

拿到其他手机号

重新操作再次替换返回包:

{"code":2000,"msg":"success","data":{"user_id":3905,"class":[{"teacher_id":24,"name":"湛善萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"湛善萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}
{"code":2000,"msg":"success","data":{"user_id":3905,"class":[{"teacher_id":24,"name":"湛善萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"湛善萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}
{"code":2000,"msg":"success","data":{"user_id":3905,"class":[{"teacher_id":24,"name":"湛善萍","role":9,"major_id":42,"grade":4,"class":3,"point":76,"status":"正常"},{"teacher_id":24,"name":"湛善萍","role":8,"major_id":43,"grade":4,"class":4,"point":80,"status":"正常"}]}}

也可再次成功伪造登录

结束语

最后祝大家都能挖到洞

博客内容均为打码内容,而我们圈内写的报告不打码而且包含poc,更适合挖洞小白学习复现!

欢迎加入我们的圈子,每日分享一手edu,cnvd,企业src报告(挖完就分享),带你领略渗透圈,手把手教挖洞!