WooYun.org

<?php
function str2js1( $_obfuscate_R2_b )
{
		$_obfuscate_R2_b = str_replace( "\\", "\\\\", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_replace( "\"", "\\\"", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_replace( "\r", "", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_replace( "\n", "\\n", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_replace( "\\v", "\\v", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_replace( "\t", "", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_ireplace( "?>", "?&gt;", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_ireplace( "<?", "&lt;?", $_obfuscate_R2_b );
		$_obfuscate_R2_b = str_ireplace( "<?php ", "&lt;?php ", $_obfuscate_R2_b );
		return $_obfuscate_R2_b;
}
$op = $_GET['op'];
if ( empty( $op ) )
{
		$op = $_POST['op'];
}
include( "../common.php" ); //伪全局变量注册机制，比如下面的atc_content变量则默认可以由gp来传递
if ( empty( $siteid ) )
{
		exit( "error" );
}
$v = $block_s;
if ( $op == "update" )
{
		$atc_content = stripslashes( $atc_content );//act_content可控
		$string = $atc_content;
		$patterns = "/(http\\:\\/\\/)([0-9a-z-]*)(\\.pt\\.17oh\\.com\\/)/siU";
		$patterns1 = "/(http\\:\\/\\/)([0-9a-z-]*)(\\.jy\\.17oh\\.com\\/)/siU";
		$patterns2 = "/(http\\:\\/\\/)([0-9a-z-]*)(\\.qy\\.17oh\\.com\\/)/siU";
		$patterns3 = "/(http\\:\\/\\/)([0-9a-z-]*)(\\.zf\\.17oh\\.com\\/)/siU";
		$string = preg_replace( $patterns, "", $string );
		$string = preg_replace( $patterns1, "", $string );
		$string = preg_replace( $patterns2, "", $string );
		$string = preg_replace( $patterns3, "", $string );
		$string = str_replace( $_config_rooturl, "", $string );
		$atc_content = str2js1( $string );//这个函数对html标签进行了html转义，对漏洞利用没有影响
		$cat1 = str_replace( "f_con", "", $blockid );//blockid可控
		if ( $cat1 == "2" )
		{
				$cat = "99";
		}
		else
		{
				$cat = $cat1;
		}
		$filename = SITE_CACHE."/tmp_".$mod."_".$cat1.".php";//mod可控
		$h_bg = "<?\n";
		$h_bg .= "\$fcon[".$cat."]=\"".$atc_content."\";\n";
		$h_bg .= "?>";
		file_put_contents( $filename, $h_bg );
}
?>