如何渗透Discuz论坛（一）

<?php  /** * DiscuzX Convert * * $Id: index.php 10469 2010-05-11 09:12:14Z monkey $ */  require './include/common.inc.php';  $action = getgpc('a'); $action = empty($action) ? getgpc('action') : $action; $source = getgpc('source') ? getgpc('source') : getgpc('s'); $step = getgpc('step'); $start = getgpc('start');  $setting = array(); if($source) {         if(!$setting = loadsetting($source)) {                 showmessage('load_setting_error');         } }  $action = empty($action) || empty($source) ? 'source' : $action; showheader($action, $setting);  if($action == 'source') {         require DISCUZ_ROOT.'./include/do_source.inc.php'; } elseif($action == 'config' || CONFIG_EMPTY) {         require DISCUZ_ROOT.'./include/do_config.inc.php'; } elseif($action == 'setting') {         require DISCUZ_ROOT.'./include/do_setting.inc.php'; } elseif($action == 'select') {         require DISCUZ_ROOT.'./include/do_select.inc.php'; } elseif($action == 'convert') {         require DISCUZ_ROOT.'./include/do_convert.inc.php'; } elseif($action == 'finish') {         require DISCUZ_ROOT.'./include/do_finish.inc.php'; } else {         showmessage('非法请求'); }  showfooter(); ?>

?php  /** * DiscuzX Convert * * $Id: do_config.inc.php 10469 2010-05-11 09:12:14Z monkey $ */  if(!defined('DISCUZ_ROOT')) {         exit('Access error'); }  $configfile = DISCUZ_ROOT.'./data/config.inc.php'; $configfile_default = DISCUZ_ROOT.'./data/config.default.php';  @touch($configfile);//创建文件 if(!is_writable($configfile)) {//文件是否可写         showmessage('config_write_error'); }  $config_default = loadconfig('config.default.php');//载入默认配置文件 $error = array(); if(submitcheck()) {//检测是否提交         $newconfig = getgpc('newconfig');         if(is_array($newconfig)) {//是否为数组                 $checkarray = $setting['config']['ucenter'] ? array('source', 'target', 'ucenter') : array('source', 'target');                 foreach ($checkarray as $key) {                         if(!empty($newconfig[$key]['dbhost'])) {                                 $check = mysql_connect_test($newconfig[$key], $key);                                 if($check < 0) {                                         $error[$key] = lang('mysql_connect_error_'.abs($check));                                 }                         } else {                                 $error[$key] = lang('mysql_config_error');                         }                 }                 save_config_file($configfile, $newconfig, $config_default);                 if(empty($error)) {                         $db_target = new db_mysql($newconfig['target']);                         $db_target->connect();                         delete_process('all');                         showmessage('config_success', 'index.php?a=select&source='.$source);                 }         } }  showtips('如果无法显示设置项目，请删除文件 data/config.inc.php'); $config = loadconfig('config.inc.php'); if(empty($config)) {         $config = $config_default; } show_form_header(); show_config_input('source', $config['source'], $error['source']); show_config_input('target', $config['target'], $error['target']); if($setting['config']['ucenter']) {         show_config_input('ucenter', $config['ucenter'], $error['ucenter']); } show_form_footer('submit', 'config_save');  ?>

function lang($name, $vars = array()) {         static $language;         if($language === null) {                 @include DISCUZ_ROOT.'./language/lang.php';                 if(empty($language)) {                         $language = array();                 }         }         $ret = isset($language[$name]) ? $language[$name] : $name;         if(!empty($vars)) {                 foreach ($vars as $key => $value) {                         $ret = str_replace('{'.$key.'}', $value);                 }         }         return $ret; }  function show_hidden_field($name, $value) {         echo '<input type="hidden" name="'.$name.'" value="'.$value.'">'."/n"; }  function show_form_header($method = 'post') {         echo <<<EOT <form method="$method" action="index.php"> <input type="hidden" name="a" value="$GLOBALS[action]"> <input type="hidden" name="source" value="$GLOBALS[source]"> <input type="hidden" name="submit" value="yes"> EOT; }  function show_form_footer($submitname = '', $submitvalue = 'submit') {         if($submitname != '') {                 $submitvalue = lang($submitvalue);                 echo <<<EOT <table class="button">         <tr><td><input type="submit" value="$submitvalue" name="$submitname"></td></tr> </table> EOT;         }         echo '</form>'; }  function show_config_input($type, $config, $error = array()) {         $title = lang('config_type_'.$type);         show_table_header();         show_table_row(array(array('colspan="3"', $title)), 'header title');         if($type == 'target') {                 show_table_row(array(array('colspan="3"', '<font color="red">'.lang('config_type_target_comment').'</font>')), 'bg2');         }         foreach ($config as $key => $value) {                 $addmsg = $error && $key == 'dbhost' ? lang($error) : '';                 $tip = $key == 'pconnect' ? lang('tips_pconnect') : '';                 show_table_row(        array(                 array('width="150"', lang('config_'.$key)),                 array('class="bg2"', '<input type="text" size="40" name="newconfig['.$type.']['.$key.']" value="'.htmlspecialchars($value).'">'),                 array('class="bg2"', '<font color="red">'.$tip.'</font><font color="red">'.$addmsg.'</font>')                 ), 'bg1'                 );         }          show_table_footer();         echo '<br>'; }  function getvars($data, $type = 'VAR') {         $evaluate = '';         foreach($data as $key => $val) {                 if(!preg_match("/^[a-zA-Z_/x7f-/xff][a-zA-Z0-9_/x7f-/xff]*$/", $key)) {                         continue;                 }                 if(is_array($val)) {                         $evaluate .= buildarray($val, 0, "/${$key}")."/r/n";                 } else {                         $val = addcslashes($val, '/'//');                         $evaluate .= $type == 'VAR' ? "/$key = '$val';/n" : "define('".strtoupper($key)."', '$val');/n";                 }         }         return $evaluate; }  function buildarray($array, $level = 0, $pre = '$_config') {         static $ks;         if($level == 0) {                 $ks = array();                 $return = '';         }          foreach ($array as $key => $val) {                  if($level == 0) {                         $newline = str_pad('  CONFIG '.strtoupper($key).'  ', 50, '-', STR_PAD_BOTH);                         $return .= "/r/n// $newline ///r/n";                 }                  $ks[$level] = $ks[$level - 1]."['$key']";                 if(is_array($val)) {                         $ks[$level] = $ks[$level - 1]."['$key']";                         $return .= buildarray($val, $level + 1, $pre);                 } else {                         $val = !is_array($val) && (!preg_match("/^/-?[1-9]/d*$/", $val) || strlen($val) > 12) ? '/''.addcslashes($val, '/'//').'/'' : $val;                         $return .= $pre.$ks[$level - 1]."['$key']"." = $val;/r/n";                 }         }         return $return; }  function save_config_file($filename, $config, $default) {         $config = setdefault($config, $default);          $date = gmdate("Y-m-d H:i:s", time() + 3600 * 8);         $year = date('Y');         $content = <<<EOT <?php   /$_config = array();  EOT;         $content .= getvars(array('_config' => $config));         $content .= "/r/n// ".str_pad('  THE END  ', 50, '-', STR_PAD_BOTH)." ///r/n/r/n?>";         file_put_contents($filename, $content); }  function setdefault($var, $default) {         foreach ($default as $k => $v) {                 if(!isset($var[$k])) {                         $var[$k] = $default[$k];                 } elseif(is_array($v)) {                         $var[$k] = setdefault($var[$k], $default[$k]);                 }         }         return $var; } 

0x06：扩展：

最近暗月有时间会写下关于Discuz渗透方面的文章，这是开头篇，欢迎长期关注暗月论坛微信号 （moonsec）和本论坛。

dzscan team：http://dzscan.org/

moon_Discuz_utility 下载：moon_Discuz_utility.zip