【转载】HDWiki百科程序后台拿webshell漏洞

        function display($file){//展现模板 by unknownman@t00ls 


                GLOBAL $starttime,$mquerynum; 


                $mtime = explode(' ', microtime()); 


                $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6)); 


                $this->assign('querynum',$mquerynum); 


                extract($this->vars, EXTR_SKIP); 


                include $this->gettpl($file); //注意，漏洞在这里，include之 by unknownman@t00ls 


        } 



        function gettpl($file){ 


                if(substr($file,0,7)=="file://"){ 


                        $ppos=strrpos($file,"/"); 


                        $dir_name=explode('/',substr($file,7)); 


                        $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm'; 


                        $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置 by unknownman@t00ls 


                }else{ 


                        if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){ 


                                $this->tplfile = $this->tpldir.'/'.$file.'.htm'; 


                                $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置 by unknownman@t00ls 


                        }else{ 


                                $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm'; 


                                $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置 by unknownman@t00ls 


                        } 


                } 


                if($this->force || @filemtime($this->objfile) tplfile)){ 


                        $this->complie(); 


                } 


                return $this->objfile; 


        } 



        function  complie() {//模板编译函数 by unknownman@t00ls 


                $template = file::readfromfile($this->tplfile); 


                $template = preg_replace("//s", "{1}", $template); 


                $template = preg_replace("/{lang.(w+?)}/ise", "$this->lang('1')", $template); 


                if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){ 


                        $template = preg_replace("/{url.doc-view-(.+?)['did']}/ise", "$this->stripvtag('{url doc-view-{eval echo urlencode(1['rawtitle']);}}')", $template); 


                } 


                $template = preg_replace("/{($this->var_regexp)}/", "=1?>", $template); 


                $template = preg_replace("/{($this->const_regexp)}/", "=1?>", $template); 


                $template = preg_replace("/(?var_regexp/", "=?>", $template); 


                $template = preg_replace("/{{eval (.*?)}}/ies", "$this->stripvtag(' 1?>')", $template); 


                $template = preg_replace("/{eval (.*?)}/ies", "$this->stripvtag(' 1?>')", $template); 


                $template = preg_replace("/{for (.*?)}/ies", "$this->stripvtag(' for(1) {?>')", $template); 


                $template = preg_replace("/{elseifs+(.+?)}/ies", "$this->stripvtag(' } elseif(1) { ?>')", $template); 


                $template = preg_replace("/{hdwiki:([^}]+?)/}/ies", "$this->hdwiki('1')", $template); 


                for($i=0; $i

                        $template = preg_replace("/{hdwiki:(.+?)}(.+?){/hdwiki}/ies", "$this->hdwiki('1', '2')", $template); 


                        $template = preg_replace("/{loops+$this->vtag_regexps+$this->vtag_regexps+$this->vtag_regexp}(.+?){/loop}/ies", "$this->loopsection('1', '2', '3', '4')", $template); 


                        $template = preg_replace("/{loops+$this->vtag_regexps+$this->vtag_regexp}(.+?){/loop}/ies", "$this->loopsection('1', '', '2', '3')", $template); 


                } 


                $template = preg_replace("/{ifs+(.+?)}/ies", "$this->stripvtag(' if(1) { ?>')", $template); 


                $template = preg_replace("/{templates+(w+?)}/is", " include $this->gettpl('1');?>", $template); 


                $template = preg_replace("/{templates+(.+?)}/ise", "$this->stripvtag(' include $this->gettpl(1); ?>')", $template); 


                $template = preg_replace("/{else}/is", " } else { ?>", $template); 


                $template = preg_replace("/{/if}/is", " } ?>", $template); 


                $template = preg_replace("/{/for}/is", " } ?>", $template); 


                $template = preg_replace("/$this->const_regexp/", "=1?>", $template); 


                $template = " if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>rn$template"; 


                $template = preg_replace("/($[a-zA-Z_]w+[)([a-zA-Z_]w+)]/i", "1'2']", $template); 


                $template = preg_replace("/{url.(.+?)}/ise", "$this->url('1')", $template); 


                $fp = fopen($this->objfile, 'w'); 


                fwrite($fp, $template);//写入模板到php文件 by unknownman@t00ls 


                fclose($fp); 


        }