当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-022760

漏洞标题：网络卡牌游戏大掌门本地数据验证不严导致严重破坏游戏平衡网游变单机

相关厂商：玩蟹科技

漏洞作者： 鸿学

提交时间：2013-05-02 14:46

修复时间：2013-07-31 14:47

公开时间：2013-07-31 14:47

漏洞类型：设计错误/逻辑缺陷

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-05-02： 积极联系厂商并且等待厂商认领中，细节不对外公开
2013-07-31： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

这个bug能修改安卓 ios 所有版本的大掌门游戏数据,无限增强自己削弱敌人,通过这个bug的利用这款网络游戏已经没有区别了.

详细说明：

本地数据aes加密,战斗过程没有网络验证下面代码主要作用是解密游戏的数据并进行修改和2次加密处理完成后直接覆盖游戏数据文件就可达到随意修改游戏的目的,

from Crypto.Cipher import AES
from Crypto import Random
import os
def walk_dir(dirs):
    for root,dirs, files in os.walk( dirs ):
        for f in files:
            file_path = os.path.join( root,f )
            file_path='%s'%file_path
            file_md5 = f
            
            if file_path.endswith('.s') or file_path.endswith('.c'):
                encryptorDZM(file_path,file_path+'encry')
                try:
                    encryptorDZM(file_path,file_path+'encry')
                except:
                    print 'error at %s' % file_path
def encryptorDZM(filein, fileout):
    key = "2IG'csN3B:R)l*?roi*zlkjRikfZ/fax"
    mode = AES.MODE_CBC
    encryptor = AES.new(key, mode,'0000000000000000')
    fhandle = open(filein,'rb')
    cryptorbuffer  = fhandle.read()
    fhandle.close()
    decryptorbuffer = encryptor.decrypt(cryptorbuffer)
    fwritehandle = open(fileout,'w+b')
    fwritehandle.write(decryptorbuffer)
    fwritehandle.close()
def fuckDZM(filein, fileout):
    key = "2IG'csN3B:R)l*?roi*zlkjRikfZ/fax"
    mode = AES.MODE_CBC
    encryptor = AES.new(key, mode,'0000000000000000')
    fhandle = open(filein,'rb')
    cryptorbuffer  = valueFuck(fhandle.read())
    cryptorbuffer = valueFuck2(cryptorbuffer)
    cryptorbuffer = valueFuck3(cryptorbuffer)
    fhandle.close()
    decryptorbuffer = encryptor.encrypt(cryptorbuffer)
    fwritehandle = open(fileout,'wb')
    fwritehandle.write(decryptorbuffer)
    fwritehandle.close()
def makefakestr(strin):
    strout = ' 1'
    while 1:
        if len(strin) > len(strout):
            strout = strout+' '
            #makefakestr(strout)
        else:
            return strout
def valueFuck3(buffervalue):
    valueindex = buffervalue.index(r'"magic":')
    print buffervalue[valueindex+len(r'"magic":'):].split(',')[0]
    valuelist = buffervalue.split(r'"magic":')
    fuckbuffer = buffervalue
    for valuesig in valuelist:
        #if len(valuesig.split(',')[0]) < 6:
            
        print r'"magic":'+valuesig.split(',')[0]
        print r'"magic":'+makefakestr(valuesig.split(',')[0])
        fuckbuffer =  fuckbuffer.replace(r'"magic":'+ valuesig.split(',')[0],r'"magic":'+makefakestr(valuesig.split(',')[0]))
    print len(fuckbuffer)
    print len(buffervalue)
    return fuckbuffer
def valueFuck2(buffervalue):
    valueindex = buffervalue.index(r'"attack":')
    print buffervalue[valueindex+len(r'"attack":'):].split(',')[0]
    valuelist = buffervalue.split(r'"attack":')
    fuckbuffer = buffervalue
    for valuesig in valuelist:
        #if len(valuesig.split(',')[0]) < 6:
            
        print r'"attack":'+valuesig.split(',')[0]
        print r'"attack":'+makefakestr(valuesig.split(',')[0])
        fuckbuffer =  fuckbuffer.replace(r'"attack":'+ valuesig.split(',')[0],r'"attack":'+makefakestr(valuesig.split(',')[0]))
    print len(fuckbuffer)
    print len(buffervalue)
    return fuckbuffer
def valueFuck(buffervalue):
    valueindex = buffervalue.index(r'"health":')
    print buffervalue[valueindex+len(r'"health":'):].split(',')[0]
    valuelist = buffervalue.split(r'"health":')
    fuckbuffer = buffervalue
    for valuesig in valuelist:
        #if len(valuesig.split(',')[0]) < 6:
            
        print r'"health":'+valuesig.split(',')[0]
        print r'"health":'+makefakestr(valuesig.split(',')[0])
        fuckbuffer =  fuckbuffer.replace(r'"health":'+ valuesig.split(',')[0],r'"health":'+makefakestr(valuesig.split(',')[0]))
    print len(fuckbuffer)
    print len(buffervalue)
    return fuckbuffer
if __name__ == '__main__': 
    #valueFuck(open(r'E:\DZMipad\91_release.app\release\176\f3692980f34eb0438348faeaae0ae0c90094B0.cencry').read())
    walk_dir(r'E:\DZMipad');
    filefuck = open(r'E:\DZMipad\jianghu.txt')
    
    for filename in filefuck:
        infile = r'E:\DZMipad\release' + '\\' + filename.replace('/','\\')[:-1] + 'encry'
        outfile = infile + '.fuck'
        print infile
        print outfile
        #fuckDZM(infile,outfile)
        
        try:
            fuckDZM(infile,outfile)
        except:
            pass

漏洞证明：

修复方案：

增强网络验证,祝大坑门越来越好.

版权声明：转载请注明来源 鸿学@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝