WooYun.org

<?php
/*********************/
/*  iRadikal.com     */
/*         NWS       */
/* IonCube 7 support */
/*        by:        */
/*      tokk250      */
/*********************/
class SsoControl extends Control
{
    public function hello( )
    {
        session_unset( );
        $base_passwd = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_0123456789";
        $len = 264;
        $sess_key = "";
        $i = 248;
        while ( $i < $len )
        {
            ++$i;
        }
        $url = $_REQUEST['url']."&r=".$sess_key;//会吧我们需要的key穿到url上
        $_SESSION['sess_key'] = $sess_key;
        header( "Location: ".$url );
        exit( );
    }
    public function login( )
    {
        if ( $_SESSION['sess_key'] == "" )
        {
            exit( "error,sess_key is empty" );
        }
        $str = $_REQUEST['r'].$name.$_SESSION[sess_key].$skey;//这里对key进行加密
//name和skey我们不可控，但是我输出看了一下，默认是空
//so?
        $md5str = $_REQUEST['name'];
        if ( strtolower( $md5str ) == $_REQUEST['s'] && $_REQUEST['s'] != "" )
        {
            registerRole( "admin", "admin" );
            header( "Location: ?c=vhost&a=showVhost&name=".$name );
            exit( );
        }
        else
        {
            exit( "login failed" );
        }
    }
}
?>

strtolower( $md5str )