WooYun.org

$uid=$_GET["uid"];


$uid6=$_GET["uid6"];


if($fd=popen("/srun3/bin/online_user -".$ipv." -f ".$uid, "r"))//命令执行漏洞，无需登录


{


    $content=fread($fd, 1024);


    fclose($fd);


}


$array=explode("\t",$content);


if($uid6)


{


    if($fd=popen("/srun3/bin/online_user -6 -f ".$uid6, "r"))//命令执行漏洞，无需登录


    {


        $content="";


        $content=fread($fd, 1024);


        fclose($fd);


    }


    $array1=explode("\t",$content);


}

switch($_GET["action"])


{


case "drop_user1": //强制下线某个帐号的所有用户，无需登录，无线管理帐号


        if($_GET["ipv"]=="ipv4")


        {


            $pfd=popen("/srun3/bin/online_user -4 -d ".$_GET["uname1"], "r");    


        }


        else


        {


            $pfd=popen("/srun3/bin/online_user -6 -d ".$_GET["uname1"], "r");    


        }        


        $con = fread($pfd, 128);


        echo $con;


        pclose($pfd);


        break;

case "index_edit":


        $contents = urldecode($_POST["con"]);


        file_put_contents("/srun3/etc/msg.conf", $contents);


        $temp=file_get_contents("/srun3/web/templets/index_old.html");                


        $temp=str_replace("{:message:}", $contents, $temp);


        file_put_contents("/srun3/web/index_old.html", $temp);


        


        if(is_file("/srun3/web/templets/index.html"))


        {


            //写入公告


            $eidolon=new Eidolon("templets/index.html");


            $eidolon->setBlock("tr");


            //$temp=file_get_contents("/srun3/web/templets/login_dz.html");                


            //$temp=str_replace("{:message:}", $contents, $temp);            


            $message=$contents;

case "set_passwd":


        //修改内存中的密码


        $command="/srun3/bin/set_user passwd ".$_GET["uname"]." ".urldecode($_GET["pass"]);//修改任意用户的密码


        


        $fp=popen($command, "r");


        if($fp)


        {


            $con=fread($fp, 24);


            echo $con;


            pclose($fp);


        }    


        break;

public function prints() {


        global $ts,$action,$go,$page, $id;//$id等这些变量都是用户可控的


        $data_where =array (


                'check_out_id' => $id,


                'type' => 'bills',


                'user_login_name'=>$_SESSION['user_login_name']


        );


        $list =$this->model->get_list ( $this->model->get_index_where ( $data_where ), 0, 1 );//注入


        $data = $list [0];


        $data ['title'] = "用户帐单";


        parent::$templates->assign ( 'list', $data );


        parent::$templates->display ( 'user_info_print_bill' );


    }

public function get_index_where($data){


        $where = " WHERE 1";


        if ($data ['type'] == 'bills') {


            $where .= (! empty ( $data ['check_out_id'] ) && intval ( $data ['check_out_id'] ) > 0) ? " AND a.check_out_id=" . $data ['check_out_id'] : "";


            $where .= (! empty ( $data ['check_out_type'] ) && $data ['check_out_type'] != 'all') ? " AND a.check_out_type=" . $data ['check_out_type'] : "";


            if (! empty ( $data ['start_time'] )) {


                $where .= " AND a.check_end_date >= '" . $data ['start_time'] . " 00:00:00'";


            }


            if (! empty ( $data ['end_time'] ) && $data ['check_end_date'] != "0000-00-00") {


                $where .= " AND a.check_end_date <= '" . $data ['end_time'] . " 23:59:59'";


            }


        }


        


        $where .= " AND a.user_login_name='" . $data['user_login_name'] . "'";


        return $where;


    }

switch($_POST["action"])


{


    case "set_nat":


        file_put_contents("/proc/sys/net/ipv4/ip_forward","1");


        $fp = popen("iptables -t nat -A POSTROUTING -o ".trim($_POST["ifname"])." -j MASQUERADE", "r");//命令执行

public function download(){


        global $file;


        $this->model->download_file($file);//任意文件下载漏洞，无需登录


    }

public function download_file($file) {


        if (file_exists ( $file )) {


            $this_base_file = basename ( $file );


            header ( "Content-type:application/octet-stream" );


            header ( "Accept-Ranges: bytes" );


            header ( "Accept-Length: " . filesize ( $file ) );


            header ( "Content-Disposition: attachment; filename=\"" . $this_base_file . "\"" );


            readfile ( $file );


        }


    }

public function delete_file(){


        global $file;


        echo $this->model->delete_file($file)?101:100;//任意文件删除漏洞，无需登录


    }

public function delete_file($file) {


        if (file_exists ( $file )) {


            return unlink ( $file );


        } else {


            return false;


        }


    }

//验证数据来源，无法防模拟HTTP


if($_FILES){


    $sub_len=strlen($_SERVER['SERVER_NAME']);


    $from=substr($_SERVER['HTTP_REFERER'],7,$sub_len);


    if($from<>$_SERVER['SERVER_NAME']){


        exit;


    }


}


header('Content-Type: text/html; charset=gb2312');





$inputName='filedata';//表单文件域name


$attachDir='srun3/web/';//上传文件保存路径，结尾不要带/


!file_exists('/'.$attachDir) && newdir('/'.$attachDir);


$maxAttachSize=2097152;//最大上传大小，默认是2M


$upExt='txt,rar,zip,jpg,jpeg,gif,png,swf,wmv,avi,wma,mp3,mid';//上传扩展名

if($err==''){


    $fileInfo=pathinfo($localName);


    $extension=$fileInfo['extension'];


    if(preg_match('/'.str_replace(',','|',$upExt).'/i',$extension))