WooYun.org

case 'raise': //这个功能是 "知道功能" 悬赏的次数更新,因为默认只允许2次提高悬赏的次数
	
		if($credit < 1) dalert($L['select_credit'], 'goback');
		//这里credit 不能小于 1 
               //由于php是弱语言,所以 1xxx 这样被转换过去就变成了 1 条件也就成立了
		if($credit > $_credit) dalert($L['lack_credit'], 'goback');
		$could_raise = $could_admin;//是否是 "知道"发布的作者.
		if($item['process'] != 1) $could_raise = false;
		if($item['raise'] >= $MOD['maxraise'])  $could_raise = false;
		//$MOD['maxraise']就是最大能 “提高悬赏” 次数。
	
		if($could_raise) { //条件通过进入这个流程
			if($credit >= $MOD['raisecredit']) {
				$addtime = $DT_TIME;
				$totime = $DT_TIME + $MOD['overdays']*86400 + $MOD['raisedays']*86400;
			} else {
				$addtime = $item['addtime'];
				$totime = $item['totime'] + $MOD['raisedays']*86400;
			}
			
			$db->query("UPDATE {$table} SET credit=credit+$credit,raise=raise+1,addtime=$addtime,totime=$totime WHERE itemid=$itemid"); //看直接带入了 credit+$credit ,由于他$credit 并没有 int掉,所以导致能注入...

"/select([\s\S]*?)from/i"

$item = $db->get_one("SELECT * FROM {$table} WHERE itemid=$itemid");
item是等于我们 “提问知道” 的数据。由于我们掌握了一个 update的注入点，想更新什么都行咯。

if($item['template']) $template = $item['template'];// 这个我们可以更新来达到包含的目的
include template($template, $module);//这个函数并不陌生..上次提交了个命令执行也是这个步骤

function template($template = 'index', $dir = '') {
	global $CFG;
	$to = $dir ? DT_CACHE.'/tpl/'.$dir.'-'.$template.'.php' : DT_CACHE.'/tpl/'.$template.'.php';
	$isfileto = is_file($to);
	
	if($CFG['template_refresh'] || !$isfileto) {
		if($dir) $dir = $dir.'/';
        $from = DT_ROOT.'/template/'.$CFG['template'].'/'.$dir.$template.'.htm';
		if($CFG['template'] != 'default' && !is_file($from)) {
			$from = DT_ROOT.'/template/default/'.$dir.$template.'.htm';
		}
        if(!$isfileto || filemtime($from) > filemtime($to) || (filesize($to) == 0 && filesize($from) > 0)) {
			require_once DT_ROOT.'/include/template.func.php';
			template_compile($from, $to);
		}
	}
	return $to;
}

if(!$isfileto || filemtime($from) > filemtime($to) || (filesize($to) == 0 && filesize($from) > 0)) {

template_compile($from, $to);创建缓存文件。
function template_compile($from, $to) {
	$content = template_parse(file_get($from));
	file_put($to, $content);//关键是这个 file_put会帮我们创建目录,
}
function template_parse($str) {
	global $CFG;
	$str = preg_replace("/\<\!\-\-\[(.+?)\]\-\-\>/", "", $str);
	$str = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $str);
	$str = preg_replace("/\{template\s+([^\}]+)\}/", "<?php include template(\\1);?>", $str);
	$str = preg_replace("/\{php\s+(.+)\}/", "<?php \\1?>", $str);
	$str = preg_replace("/\{if\s+(.+?)\}/", "<?php if(\\1) { ?>", $str);
	$str = preg_replace("/\{else\}/", "<?php } else { ?>", $str);
	$str = preg_replace("/\{elseif\s+(.+?)\}/", "<?php } else if(\\1) { ?>", $str);
	$str = preg_replace("/\{\/if\}/", "<?php } ?>\r\n", $str);
	$str = preg_replace("/\{loop\s+(\S+)\s+(\S+)\}/", "<?php if(is_array(\\1)) { foreach(\\1 as \\2) { ?>", $str);
	$str = preg_replace("/\{loop\s+(\S+)\s+(\S+)\s+(\S+)\}/", "<?php if(is_array(\\1)) { foreach(\\1 as \\2 => \\3) { ?>", $str);
	$str = preg_replace("/\{\/loop\}/", "<?php } } ?>", $str);
	$str = preg_replace("/\{([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\(([^{}]*)\))\}/", "<?php echo \\1;?>", $str);
	$str = preg_replace("/<\?php([^\?]+)\?>/es", "template_addquote('<?php\\1?>')", $str);
	$str = preg_replace("/\{(\\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\+\-\x7f-\xff]*)\}/", "<?php echo \\1;?>", $str);
	$str = preg_replace("/\{(\\$[a-zA-Z0-9_\[\]\'\"\$\x7f-\xff]+)\}/es", "template_addquote('<?php echo \\1;?>')", $str);
	$str = preg_replace("/\{([A-Z_\x7f-\xff][A-Z0-9_\x7f-\xff]*)\}/s", "<?php echo \\1;?>", $str);
	$str = preg_replace("/\'([A-Za-z]+)\[\'([A-Za-z\.]+)\'\](.?)\'/s", "'\\1[\\2]\\3'", $str);
	$str = preg_replace("/(\r?\n)\\1+/", "\\1", $str);
	$str = str_replace("\t", '', $str);
	$str = "<?php defined('IN_DESTOON') or exit('Access Denied');?>".$str;
	if($CFG['template_trim']) return strip_nr($str);
	return $str;
}

function file_put($filename, $data) {
	dir_create(dirname($filename));	
	if(@$fp = fopen($filename, 'wb')) {
		flock($fp, LOCK_EX);
		$len = fwrite($fp, $data);
		flock($fp, LOCK_UN);
		fclose($fp);
		if(DT_CHMOD) @chmod($filename, DT_CHMOD);
		return $len;
	} else {
		return false;
	}
}

function dir_create($path) {
	if(is_dir($path)) return true;
	if(DT_CACHE != DT_ROOT.'/file/cache' && strpos($path, DT_CACHE) !== false) {
		$dir = str_replace(DT_CACHE.'/', '', $path);
		$dir = dir_path($dir);
		$temp = explode('/', $dir);
		$cur_dir = DT_CACHE.'/';
		$max = count($temp) - 1;
		for($i = 0; $i < $max; $i++) {
			$cur_dir .= $temp[$i].'/';
			if(is_dir($cur_dir)) continue;
			@mkdir($cur_dir);
			if(DT_CHMOD) @chmod($cur_dir, DT_CHMOD);
			if(!is_file($cur_dir.'/index.html') && !is_file($cur_dir.'/index.php')) file_copy(DT_ROOT.'/file/index.html', $cur_dir.'/index.html');
		}
	} else {
		$idx = strpos($path, '/file/') !== false ? true : false;
		$dir = str_replace(DT_ROOT.'/', '', $path);
		$dir = dir_path($dir);
		$temp = explode('/', $dir);
		$cur_dir = DT_ROOT.'/';
		$max = count($temp) - 1;
		for($i = 0; $i < $max; $i++) {
			$cur_dir .= $temp[$i].'/';
			if(is_dir($cur_dir)) continue;
			@mkdir($cur_dir);
			if(DT_CHMOD) @chmod($cur_dir, DT_CHMOD);
			if($idx && !is_file($cur_dir.'/index.html') && !is_file($cur_dir.'/index.php')) file_copy(DT_ROOT.'/file/index.html', $cur_dir.'/index.html');
		}
	}
	return is_dir($path);
}

defined('IN_DESTOON') or exit('Access Denied');//common.inc.php 就定义了这个常量。

$tag_code .= ';';
		$tag_safe = substr($tag_code, 5, -7);
		foreach(array('(', '`', ',', ';') as $v) {
			if(strpos($tag_safe, $v) !== false) msg('标签内容包含不安全写法，禁止在线预览');
		}
		ob_start();
		eval($tag_code);

function strip_sql($string) {
	$match = array("/union/i","/where/i","/outfile/i","/dumpfile/i","/0x([a-z0-9]{2,})/i","/select([\s\S]*?)from/i","/select([\s\*\/\-\(\+@])/i","/update([\s\*\/\-\(\+@])/i","/replace([\s\*\/\-\(\+@])/i","/delete([\s\*\/\-\(\+@])/i","/drop([\s\*\/\-\(\+@])/i","/load_file[\s]*\(/i","/substring[\s]*\(/i","/substr[\s]*\(/i","/left[\s]*\(/i","/concat[\s]*\(/i","/concat_ws[\s]*\(/i","/make_set[\s]*\(/i","/ascii[\s]*\(/i","/hex[\s]*\(/i","/ord[\s]*\(/i","/char[\s]*\(/i");
	$replace = array('union','where','outfile','dumpfile','0x\\1','select\\1from','select\\1','update\\1','replace\\1','delete\\1','drop\\1','load_file(','substring(','substr(','left(','concat(','concat_ws(','make_set(','ascii(','hex(','ord(','char(');
	return is_array($string) ? array_map('strip_sql', $string) : preg_replace($match, $replace, $string);
}