WooYun.org

function encrypt($txt, $key = '') {
	$key or $key = DT_KEY; //DT_KEY是在安装时生成的一个15位随机字符串
	$rnd = md5(microtime());//缺陷 下面说
	$len = strlen($txt);
	$ren = strlen($rnd);
	$ctr = 0;
	$str = '';
	for($i = 0; $i < $len; $i++) {
		$ctr = $ctr == $ren ? 0 : $ctr;
		$str .= $rnd[$ctr].($txt[$i] ^ $rnd[$ctr++]); //只是简单的按位异或
	}
	return str_replace('=', '', base64_encode(kecrypt($str, $key)));
}
function decrypt($txt, $key = '') {
	$key or $key = DT_KEY; //这里才用到key
	$txt = kecrypt(base64_decode($txt), $key);
	$len = strlen($txt);
	$str = '';
	for($i = 0; $i < $len; $i++) {
		$tmp = $txt[$i];
		$str .= $txt[++$i] ^ $tmp; //也是异或
	}
	return $str;
}

<?php
echo(microtime());
?>

0.25139300 1138197510

a^b = x
x^c = d

function anti_spam($string) {
	global $MODULE, $DT;
	if($DT['anti_spam'] && preg_match("/^[a-z0-9_@\-\s\/\.\,\(\)\+]+$/i", $string)) {
		do {
			$tmp = encrypt($string); //加密
			if(strpos($tmp, '0x') === false) break;
		} while(1);
		return '<img src="'.$MODULE[3]['linkurl'].'image.php?auth='.rawurlencode($tmp).'" align="absmddle"/>';//输出
	} else {
		return $string;
	}
}

{if $member[mail]}<li><span>邮件</span>{anti_spam($member[mail])}</li>{/if}
{if $member[telephone]}<li><span>电话</span>{anti_spam($member[telephone])}</li>{/if}
{if $member[fax]}<li><span>传真</span>{anti_spam($member[fax])}</li>{/if}

$auth = encrypt($user['userid']."\t".$user['username']."\t".$user['groupid']."\t".$user['password']."\t".$user['admin'], md5(DT_KEY.$_SERVER['HTTP_USER_AGENT']));
set_cookie('auth', $auth, $cookietime);
set_cookie('userid', $user['userid'], $cookietime);
set_cookie('username', $user['username'], $DT_TIME + 86400*365);

$destoon_auth = get_cookie('auth');
if($destoon_auth) {	
	$_dauth = explode("\t", decrypt($destoon_auth, md5(DT_KEY.$_SERVER['HTTP_USER_AGENT'])));//解密也是用的DT_KEY+user-agent
	$_userid = isset($_dauth[0]) ? intval($_dauth[0]) : 0;
	$_username = isset($_dauth[1]) ? trim($_dauth[1]) : '';
	$_groupid = isset($_dauth[2]) ? intval($_dauth[2]) : 3;
	$_admin = isset($_dauth[4]) ? intval($_dauth[4]) : 0;
	if($_userid && !defined('DT_NONUSER')) {
		$_password = isset($_dauth[3]) ? trim($_dauth[3]) : '';
		$USER = $db->get_one("SELECT username,passport,company,truename,password,groupid,email,message,chat,sound,online,sms,credit,money,loginip,admin,aid,edittime,trade FROM {$DT_PRE}member WHERE userid=$_userid");
		if($USER && $USER['password'] == $_password) {		//居然验证密码了...cookie伪造在这里失败了

<?php 
defined('IN_DESTOON') or exit('Access Denied');
$admin_user = false;
if($_groupid == 1) {
	$admin_user = decrypt(get_cookie('admin_user'));
	if($admin_user) {
		$_USER = explode('|', $admin_user); //cookie格式 uid|uname
		if($_username = $_USER[1]) {
			$userid = $_USER[0];// userid来自cookie 且经过decrypt 无视防御
			$USER = $db->get_one("SELECT username,passport,company,truename,password,groupid,email,message,chat,sound,online,sms,credit,money,loginip,admin,aid,edittime,trade FROM {$DT_PRE}member WHERE userid=$userid");//userid直接进sql
			if($USER) {
				$_userid = $userid;
				extract($USER, EXTR_PREFIX_ALL, '');
				$MG = cache_read('group-'.$_groupid.'.php');
				$admin_user = true;
			}
		}
	}
}
?>

$destoon_auth = get_cookie('auth');
if($destoon_auth) {	
	$_dauth = explode("\t", decrypt($destoon_auth, md5(DT_KEY.$_SERVER['HTTP_USER_AGENT'])));
	$_userid = isset($_dauth[0]) ? intval($_dauth[0]) : 0;
	$_username = isset($_dauth[1]) ? trim($_dauth[1]) : '';
	$_groupid = isset($_dauth[2]) ? intval($_dauth[2]) : 3; //来自cookie 可以伪造
	$_admin = isset($_dauth[4]) ? intval($_dauth[4]) : 0;
	if($_userid && !defined('DT_NONUSER')) {	//如果进入这个if就失败
		$_password = isset($_dauth[3]) ? trim($_dauth[3]) : '';
		$USER = $db->get_one("SELECT username,passport,company,truename,password,groupid,email,message,chat,sound,online,sms,credit,money,loginip,admin,aid,edittime,trade FROM {$DT_PRE}member WHERE userid=$_userid");
		if($USER && $USER['password'] == $_password) { 
			if($USER['groupid'] == 2) dalert(lang('message->common_forbidden'));
			extract($USER, EXTR_PREFIX_ALL, ''); //伪造的groupid被覆盖
			if($USER['loginip'] != $DT_IP && ($DT['ip_login'] == 2 || ($DT['ip_login'] == 1 && IN_ADMIN))) {
				$_userid = 0; set_cookie('auth', '');
				dalert(lang('message->common_login', array($USER['loginip'])), DT_PATH);
			}
		} else {
			$_userid = 0; //置0
			if($db->linked && !isset($swfupload) && strpos($_SERVER['HTTP_USER_AGENT'], 'Flash') === false) set_cookie('auth', '');
		}
		unset($destoon_auth, $USER, $_dauth, $_password);
	}
}
if($_userid == 0) { $_groupid = 3; $_username = ''; } //如果userid==0就设置groupid为3 
if(!IN_ADMIN) {
	if($_groupid == 1) include DT_ROOT.'/module/member/admin.inc.php'; //如果到了这里$_groupid还是1 就包含

define('DT_NONUSER', true);		//符合要求
if($_SERVER['QUERY_STRING']) {
	$exprise = isset($_GET['tag_expires']) ? intval($_GET['tag_expires']) : 0;
	$moduleid = isset($_GET['moduleid']) ? intval($_GET['moduleid']) : 0;
	$moduleid > 3 or exit('document.write("<h2>Bad Parameter</h2>");');	//moduleid<3会退出
	$tag = $_SERVER['QUERY_STRING'];
	$_SERVER['QUERY_STRING'] = $_SERVER['REQUEST_URI'] = '';
	foreach($_GET as $k=>$v) { unset($$k); }
	$_GET = array();
	require '../common.inc.php'; //包含了！
	header("Content-type:text/javascript");	
	($DT['jstag'] && $DT['safe_domain'] && check_referer()) or exit('document.write("<h2>Invalid Referer</h2>");');