WooYun.org

if(!empty($_SERVER['REQUEST_URI'])) strip_uri($_SERVER['REQUEST_URI']); //跟进0x01


if($_POST) { $_POST = strip_sql($_POST); strip_key($_POST); }//跟进0x01


if($_GET) { $_GET = strip_sql($_GET); strip_key($_GET); }


if($_COOKIE) { $_COOKIE = strip_sql($_COOKIE); strip_key($_COOKIE); }


if(!IN_ADMIN) {


	$BANIP = cache_read('banip.php');


	if($BANIP) banip($BANIP);


	$destoon_task = '';


}


if($_POST) extract($_POST, EXTR_SKIP);


if($_GET) extract($_GET, EXTR_SKIP);


......


$forward = isset($forward) ? urldecode($forward) : $DT_REF;//用这里的urldecode来绕过。


......

function strip_uri($uri) { //检查了REQUEST_URI,里面有%就解码，解到最后检查敏感字符，我们要引入'，即使我们双编码过后，最终还是会被还原成',这里检查了',所以GET提交无解，但是我们POST提交的话,REQUEST_URI就不会接受任何数据，从而绕过了检查。


	if(strpos($uri, '%') !== false) {


		while($uri != urldecode($uri)) {


			$uri = urldecode($uri);


		}


	}


	if(strpos($uri, '<') !== false || strpos($uri, "'") !== false || strpos($uri, '"') !== false || strpos($uri, '0x') !== false) {


		dhttp(403, 0);


		dalert('HTTP 403 Forbidden', DT_PATH);


	}


}





function strip_sql($string) {//一长串过滤。我们绕过了上面，下面的话可以采用URL双编码绕过。比如union就可以写成unoin%256E来绕过，前提是要有urldecode或者rawurldecode。


	$search = array("/union/i","/0x([a-z0-9]{2,})/i","/select([[:space:]\*\/\-])/i","/update([[:space:]\*\/])/i","/replace([[:space:]\*\/])/i","/delete([[:space:]\*\/])/i","/drop([[:space:]\*\/])/i","/outfile([[:space:]\*\/])/i","/dumpfile([[:space:]\*\/])/i","/load_file\(/i","/substring\(/i","/substr\(/i","/concat\(/i","/concat_ws\(/i","/ascii\(/i","/hex\(/i","/ord\(/i","/char\(/i");


	$replace = array('unio&#110;','0&#120;\\1','selec&#116;\\1','updat&#101;\\1','replac&#101;\\1','delet&#101;\\1','dro&#112;\\1','outfil&#101;\\1','dumpfil&#101;\\1','load_fil&#101;(','substrin&#103;(','subst&#114;(','conca&#116;(','concat_w&#115;(','asci&#105;(','he&#120;(','or&#100;(','cha&#114;(');


	return is_array($string) ? array_map('strip_sql', $string) : preg_replace($search, $replace, $string);


}

switch($action) {


......


default:


		if(isset($touser) && check_name($touser)) {


			if($touser == $_username) dalert('不能与自己对话', 'chat.php');


			if(!$MG['chat']) {


				login(); //当然要登陆咯。


				dalert('您所在的会员组没有权限发起对话', 'grade.php');


			}


			$user = userinfo($touser);


			$user or dalert('会员不存在', 'chat.php');


			if($user['black']) {


				$black = explode(' ', $user['black']);


				if(in_array($chatuser, $black)) dalert('对方拒绝与您对话', 'chat.php');


				if(!$_username && in_array('Guest', $black)) dalert('对方拒绝与您对话', 'chat.php');


			}


			$chat_fromuser = $chatuser;


			$chat_touser = $touser;


			$chat_id = $chatid = get_chat_id($chat_fromuser, $chat_touser);


			$online = online($user['userid']);


			$user['type'] = 'member';


			$type = 1;


			if(!$_userid && !is_file(get_chat_file($chatid))) $type = 4;


			$head_title = '与【'.$user['company'].'】对话中';


			$chat = $db->get_one("SELECT * FROM {$table} WHERE chatid='$chatid'");


			$chat_status = 3;


			if($chat) { //第一次创建会话的时候执行下面的else，创建过后执行if下面的。


				//对话已经存在





				if($chat['touser'] == $_username) {//当前为接收人


					if($DT_TIME - $chat['freadtime'] > $MOD['chat_poll']*3) {//发起对话人已经断开


						$db->query("UPDATE {$table} SET fromuser='$chat_fromuser',touser='$chat_touser',tgettime=0 WHERE chatid='$chatid'");


					} else {//发起人在线


						dheader('?chatid='.$chatid);


					}


					//


				} else {//当前为发起人


					if($DT_TIME - $chat['treadtime'] > $MOD['chat_poll']*3) {//接收人已经断开


						$db->query("UPDATE {$table} SET tgettime=0 WHERE chatid='$chatid'");


					} else {//接收人在线


						//


					}


				}


			} else {//第一次执行这里。


				$forward = dsafe($forward);//过滤某些敏感字符的函数，不跟了。累死懒得贴，反正还是双编码绕过就行了。


				if(strpos($forward, $MOD['linkurl']) !== false) $forward = '';


				//创建一个新对话


				$db->query("INSERT INTO {$table} (chatid,fromuser,touser,tgettime,forward) VALUES ('$chat_id','$chat_fromuser','$chat_touser','0','$forward')"); //关键点！0x00已经贴出来了$forward是urldecode所解码而得到的,所以我们能引入'来进行注射。记得$chat_touser要等于当前用户，这样做是为了下面的可显查询。不然就只能盲注。


			}


		} else if(isset($chatid) && is_md5($chatid)) {


			$chat = $db->get_one("SELECT * FROM {$table} WHERE chatid='$chatid'"); //这里构造我们刚刚插入的$chatid的值就可以查询出来了。


			if($chat && $chat['touser'] == $_username) {//等于当前用户。


				$chat_id = $chatid;


				$chat_status = 3;


				if(check_name($chat['fromuser'])) {


					if($DT_TIME - $chat['freadtime'] > $MOD['chat_poll']*3) {//发起对话人已经断开


						$db->query("UPDATE {$table} SET tgettime=0 WHERE chatid='$chatid'");


						dheader('chat.php?touser='.$chat['fromuser']);


					}


					$user = userinfo($chat['fromuser']);


					$online = online($user['userid']);


					$user['type'] = 'member';


				} else {


					$user = array();


					$user['type'] = 'guest';


					$user['ip'] = $chat['fromuser'];


					$user['area'] = ip2area($chat['fromuser']);


					if($DT_TIME - $chat['freadtime'] > $MOD['chat_poll']*3) {//发起人是游客，并且已经断开，只能查看记录


						$time = $DT_TIME - $MOD['chat_poll']*4;


						$db->query("UPDATE {$table} SET freadtime='$time' WHERE chatid='$chatid'");


					}


				}


				$head_title = '与'.($user['type'] == 'guest' ? '【游客】' : $chat['fromuser']).'对话中';