天天团购getshell

转载自90sec@Joseph

首先跟踪到这个文件:modules\account.mod.php

function Login_callback()
        {
                $from = get('from', 'txt');//$_GET
                $uuid = account('ulogin')->verify($from);
                if ($uuid !== false)
                {
                        if (meta($uuid))
                        {
                                                                $result = account('ulogin')->login($uuid);
                                $ref = account()->loginReferer();
                                $ref || $ref = '?mod=me';
                                $this->Messager(__('登录成功！').$result, $ref);
                        }
                        else
                        {
                                                                $data = account('ulogin')->ddata($from);
                                                                include handler('template')->file('account_active');
                        }
                }
                else
                {
                        $this->Messager(__('快捷登录验证出错！'));
                }
        }

然后看着这个正常得再正常类，首先获取了一个from参数然后再进入到verify,跟踪进去瞧瞧
文件:/include/logic/account.logic.php

public function verify($flag)
{
        $uid = driver('ulogin')->api($flag)->verify();
        return $uid ? 'ul.'.$flag.'.'.$uid : false;
}

可以看见传进来的变量又进入到了驱动类中的api中，进行跟踪
文件:/include/driver/ulogin.drv.php

class UnionLoginDriver
{
         
        public final function api($name)
        {
                $SID = 'driver.ulogin.api.'.$name;
                $obj = moSpace($SID);
                if ( ! $obj )
                {
                        require dirname(__FILE__).'/ulogin/'.$name.'.php';
                        $className = $name.'UnionLoginDriver';
                        $obj = moSpace($SID, (new $className()));
                }
                return $obj;
        }
}

可以看见我们的值变成了$name这个变量,然后又链接了一下赋值给$SID最后再进moSpace这个玩意判断了一下(并没有什么卵用),最后一个if判断是不是成立进入,然后就包含了。
o(︶︿︶)o 唉 又是一个去乌云大会约炮的程序员，好好的代码不写，约什么炮，要跟我学习找女朋友堂堂正正的约.

证明一下可以跳目录(没办法，我的php版本太高了，根本不存在截断)但肯定是可以截断的.

大家都说没有找到上传的方式,这里给大家送一个上传方式/index.php?mod=upload&code=Image
需要写表单