【转载】HDWiki百科程序后台拿webshell漏洞

        function display($file){//展现模板 by unknownman@t00ls 


                GLOBAL $starttime,$mquerynum; 


                $mtime = explode(' ', microtime()); 


                $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6)); 


                $this->assign('querynum',$mquerynum); 


                extract($this->vars, EXTR_SKIP); 


                include $this->gettpl($file); //注意，漏洞在这里，include之 by unknownman@t00ls 


        } 


 


        function gettpl($file){ 


                if(substr($file,0,7)=="file://"){ 


                        $ppos=strrpos($file,"/"); 


                        $dir_name=explode('/',substr($file,7)); 


                        $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm'; 


                        $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置 by unknownman@t00ls 


                }else{ 


                        if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){ 


                                $this->tplfile = $this->tpldir.'/'.$file.'.htm'; 


                                $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置 by unknownman@t00ls 


                        }else{ 


                                $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm'; 


                                $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置 by unknownman@t00ls 


                        } 


                } 


                if($this->force || @filemtime($this->objfile) < @filemtime($this->tplfile)){ 


                        $this->complie(); 


                } 


                return $this->objfile; 


        } 


 


        function  complie() {//模板编译函数 by unknownman@t00ls 


                $template = file::readfromfile($this->tplfile); 


                $template = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $template); 


                $template = preg_replace("/\{lang.(\w+?)\}/ise", "\$this->lang('\\1')", $template); 


                if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){ 


                        $template = preg_replace("/\{url.doc\-view\-(.+?)\['did'\]\}/ise", "\$this->stripvtag('{url doc-view-{eval echo urlencode(\\1[\'rawtitle\']);}}')", $template); 


                } 


                $template = preg_replace("/\{($this->var_regexp)\}/", "<?=\\1?>", $template); 


                $template = preg_replace("/\{($this->const_regexp)\}/", "<?=\\1?>", $template); 


                $template = preg_replace("/(?<!\<\?\=|\\\\)$this->var_regexp/", "<?=\\0?>", $template); 


                $template = preg_replace("/\{\{eval (.*?)\}\}/ies", "\$this->stripvtag('<? \\1?>')", $template); 


                $template = preg_replace("/\{eval (.*?)\}/ies", "\$this->stripvtag('<? \\1?>')", $template); 


                $template = preg_replace("/\{for (.*?)\}/ies", "\$this->stripvtag('<? for(\\1) {?>')", $template); 


                $template = preg_replace("/\{elseif\s+(.+?)\}/ies", "\$this->stripvtag('<? } elseif(\\1) { ?>')", $template); 


                $template = preg_replace("/\{hdwiki:([^\}]+?)\/\}/ies", "\$this->hdwiki('\\1')", $template); 


                for($i=0; $i<2; $i++) { 


                        $template = preg_replace("/\{hdwiki:(.+?)\}(.+?)\{\/hdwiki\}/ies", "\$this->hdwiki('\\1', '\\2')", $template); 


                        $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '\\2', '\\3', '\\4')", $template); 


                        $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '', '\\2', '\\3')", $template); 


                } 


                $template = preg_replace("/\{if\s+(.+?)\}/ies", "\$this->stripvtag('<? if(\\1) { ?>')", $template); 


                $template = preg_replace("/\{template\s+(\w+?)\}/is", "<? include \$this->gettpl('\\1');?>", $template); 


                $template = preg_replace("/\{template\s+(.+?)\}/ise", "\$this->stripvtag('<? include \$this->gettpl(\\1); ?>')", $template); 


                $template = preg_replace("/\{else\}/is", "<? } else { ?>", $template); 


                $template = preg_replace("/\{\/if\}/is", "<? } ?>", $template); 


                $template = preg_replace("/\{\/for\}/is", "<? } ?>", $template); 


                $template = preg_replace("/$this->const_regexp/", "<?=\\1?>", $template); 


                $template = "<? if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>\r\n$template"; 


                $template = preg_replace("/(\\\$[a-zA-Z_]\w+\[)([a-zA-Z_]\w+)\]/i", "\\1'\\2']", $template); 


                $template = preg_replace("/\{url.(.+?)\}/ise", "\$this->url('\\1')", $template); 


                $fp = fopen($this->objfile, 'w'); 


                fwrite($fp, $template);//写入模板到php文件 by unknownman@t00ls 


                fclose($fp); 


        }