axublog 1.0.6原始后台地址登录绕过以及getshell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

function jsloginpost(){
global $tabhead;
global $txtchk;
@$user=$_POST["user"];
@$psw=$_POST["psw"];$psw = authcode(@$psw, 'ENCODE', 'key',0);
@$loginlong=$_POST["loginlong"];

setcookie("lggqsj",date('Y-m-d H:i:s',time()+$loginlong), time()+60*60*24,"/; HttpOnly" , "",'');

$tab=$tabhead."adusers";
$chk=" where adnaa='".$user."' and adpss='".$psw."' ";
mysql_select_db($tab);
$sql = mysql_query("select * from ".$tab.$chk);
if(!$sql){$jieguo="<div id=redmsg>(数据库查询失败!)</div>";}else{
	$num=mysql_num_rows($sql);
				if($num==0){$jieguo='<div id=redmsg>登录失败：账户或密码错误！</div>';}
				else{
loginpass($loginlong);
				$jieguo='<div id=bluemsg>登录成功！正在前往<a href="index.php">后台</a>。。。</div><meta http-equiv="refresh" content="1;url=index.php">';
				@$chkmoblie=isMobile();
				if($chkmoblie==1){$jieguo='<div id=bluemsg>登录成功！正在前往<a href="wap.php">后台</a>。。。</div><meta http-equiv="refresh" content="1;url=wap.php">';}
				}

}
$json_arr = array("jieguo"=>$jieguo);
$json_obj = json_encode($json_arr);
echo $json_obj;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

@$g=$_GET["g"];
    switch ($g)
    {
	default:index();break;
    case "power":power();break;
    case "edit":edit();break;
	case "edit2":edit2();break;
	case "edit2save":edit2save();break;
    }

...

function edit2(){
global $themepath;
$path=$_REQUEST['path'];
?>
<div class="yj_green" id=full>
<b class="b1"></b><b class="b2"></b><b class="b3"></b><b class="b4"></b>
<div class="boxcontent">
<h2><a href="?">主题管理</a> > <a href="javascript:history.go(-1)">编辑主题</a> > 编辑文件 > <a href="javascript:history.go(-1)">返回</a></h2>
</div>
<div class="t1"><div class="t2">
<p>编辑文件：<?=$path?>  &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;   &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<button onclick="javascript:frm.submit()" >保存编辑</button></p>
<?php
if($path==''){echo'文件路径错误！';exit;}


$text2 = file_get_contents($path);
#$text2=addslashes($text2);
#echo $text2;
#die();
$encode = mb_detect_encoding($text2 , array('UTF-8','GBK')) ;
if( $encode!= 'UTF-8'){
$text2 = mb_convert_encoding($text2 ,'utf-8' , $encode);
}
?>
<p>编码：<?=$encode?>  （本编辑器只支持GBK和UTF-8编码，如果文件内容不能显示中文为乱码时，请勿修改！）</p>
<form id="frm" name="frm" method="post" action="?g=edit2save" onSubmit="return false;" >
<input  name=path type=hidden size=50 value="<?=$path?>" >
<textarea name=content cols=110 rows=30><?=$text2?></textarea>
</div></div>
<b class="b4b"></b><b class="b3b"></b><b class="b2b"></b><b class="b1b"></b>
</div>