��̳ › web app��͸����::��Web App penetration testing�� › Destoon cmsǰ̨getwebshell

admin ������ 2018-10-20 20:13:12

Destoon cmsǰ̨getwebshell

<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
</h1>
<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
        ǰ��
</h1>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        2018��9��21�գ�Destoon�ٷ�������ȫ���£��޸������û���������ĺ�����������һ��©����
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="1025" height="662" src="https://www.9kb.org/content/uploadfile/201809/24/45e542acc90049718fe3cdeeb48e253f.jpg" />&nbsp;
</p>
<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
        ©������
</h1>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ���ݸ�����Ϣ��֪©��������ͷ���ϴ�����Destoon�д���ͷ���ϴ����� module/member/avatar.inc.php �ļ����ڻ�Ա���Ĵ��ϴ�ͷ��ʱץ���������������£�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="812" height="330" src="https://www.9kb.org/content/uploadfile/201809/24/9f483b7cdf3f4cb893a676a70e4eafc8.jpg" />&nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��Ӧ��avatar.inc.php�������£�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &lt;?php&nbsp;defined('IN_DESTOON')&nbsp;or&nbsp;exit('Access Denied');login();require&nbsp;DT_ROOT.'/module/'.$module.'/common.inc.php';require&nbsp;DT_ROOT.'/include/post.func.php';$avatar&nbsp;=&nbsp;useravatar($_userid,&nbsp;'large',&nbsp;0,&nbsp;2);switch($action)&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;'upload':
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!$_FILES['file']['size'])&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($DT_PC)&nbsp;dheader('?action=html&amp;reload='.$DT_TIME);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit('{"error":1,"message":"Error FILE"}');
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;require&nbsp;DT_ROOT.'/include/upload.class.php';
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$ext&nbsp;=&nbsp;file_ext($_FILES['file']['name']);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$name&nbsp;=&nbsp;'avatar'.$_userid.'.'.$ext;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$file&nbsp;=&nbsp;DT_ROOT.'/file/temp/'.$name;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(is_file($file))&nbsp;file_del($file);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$upload&nbsp;=&nbsp;new&nbsp;upload($_FILES,&nbsp;'file/temp/',&nbsp;$name,&nbsp;'jpg|jpeg|gif|png');
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$upload-&gt;adduserid&nbsp;=&nbsp;false;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($upload-&gt;save())&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;...
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;else&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;...
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;break;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ����ͨ��$_FILES['file']���λ�ȡ���ϴ��ļ���չ��$ext��������ʱ�ļ���$name��������ʱ�ļ�����·��$file������֮��ͨ��new upload();����һ��upload���󣬵ȵ�$upload-&gt;save()ʱ�ٽ��ļ�����д�롣
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        upload�����캯�����£�include/upload.class.php:25��
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &lt;?phpclass&nbsp;upload&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;function&nbsp;__construct($_file,&nbsp;$savepath,&nbsp;$savename&nbsp;=&nbsp;'',&nbsp;$fileformat&nbsp;=&nbsp;'')&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;global&nbsp;$DT,&nbsp;$_userid;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;foreach($_file&nbsp;as&nbsp;$file)&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;file&nbsp;=&nbsp;$file['tmp_name'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;file_name&nbsp;=&nbsp;$file['name'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;file_size&nbsp;=&nbsp;$file['size'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;file_type&nbsp;=&nbsp;$file['type'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;file_error&nbsp;=&nbsp;$file['error'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;userid&nbsp;=&nbsp;$_userid;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;ext&nbsp;=&nbsp;file_ext($this-&gt;file_name);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;fileformat&nbsp;=&nbsp;$fileformat&nbsp;?&nbsp;$fileformat&nbsp;:&nbsp;$DT['uploadtype'];
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;maxsize&nbsp;=&nbsp;$DT['uploadsize']&nbsp;?&nbsp;$DT['uploadsize']*1024&nbsp;:&nbsp;2048*1024;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;savepath&nbsp;=&nbsp;$savepath;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;savename&nbsp;=&nbsp;$savename;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;}}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ����ͨ��foreach($_file as $file)��������ʼ�������������savepath��savename����ͨ��__construct($_file, $savepath, $savename = '', $fileformat = '')ֱ�Ӵ������ָ����
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��˿����ϴ��������ļ�����һ���ļ�����1.php���ڶ����ļ���1.jpg��ֻҪ��������ı����ϴ����ο���<a href="https://www.cnblogs.com/DeanChopper/p/4673577.html%EF%BC%89%EF%BC%8C%E5%88%99%E5%9C%A8avatar.inc.php%E4%B8%AD">https://www.cnblogs.com/DeanChopper/p/4673577.html��������avatar.inc.php��</a>
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        $ext = file_ext($_FILES['file']['name']); // `$ext`��Ϊ`php` $name = 'avatar'.$_userid.'.'.$ext; // $name Ϊ 'avatar'.$_userid.'.'php'$file = DT_ROOT.'/file/temp/'.$name; // $file ��Ϊ xx/xx/xx/xx.php
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ����upload���У����ڶ���ļ��ϴ���$this-&gt;file��$this-&gt;file_name��$this-&gt;file_type��foreach�ڵڶ���ѭ���б���Ϊjpg�ļ����������£�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="1153" height="640" src="https://www.9kb.org/content/uploadfile/201809/24/313c14941b854cd98a3b2188203fb968.jpg" />&nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        �ص�avatar.inc.php���������ļ�����ʱ����$upload-&gt;save()��include/upload.class.php:50:
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &lt;?phpclass&nbsp;upload&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;function&nbsp;save()&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;load('include.lang');
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($this-&gt;file_error)&nbsp;return&nbsp;$this-&gt;_('Error(21)'.$L['upload_failed'].' ('.$L['upload_error_'.$this-&gt;file_error].')');
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if($this-&gt;maxsize&nbsp;&gt;&nbsp;0&nbsp;&amp;&amp;&nbsp;$this-&gt;file_size&nbsp;&gt;&nbsp;$this-&gt;maxsize)&nbsp;return&nbsp;$this-&gt;_('Error(22)'.$L['upload_size_limit'].' ('.intval($this-&gt;maxsize/1024).'Kb)');
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!$this-&gt;is_allow())&nbsp;return&nbsp;$this-&gt;_('Error(23)'.$L['upload_not_allow']);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;set_savepath($this-&gt;savepath);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;set_savename($this-&gt;savename);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!is_writable(DT_ROOT.'/'.$this-&gt;savepath))&nbsp;return&nbsp;$this-&gt;_('Error(24)'.$L['upload_unwritable']);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!is_uploaded_file($this-&gt;file))&nbsp;return&nbsp;$this-&gt;_('Error(25)'.$L['upload_failed']);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!move_uploaded_file($this-&gt;file,&nbsp;DT_ROOT.'/'.$this-&gt;saveto))&nbsp;return&nbsp;$this-&gt;_('Error(26)'.$L['upload_failed']);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;image&nbsp;=&nbsp;$this-&gt;is_image();
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(DT_CHMOD)&nbsp;@chmod(DT_ROOT.'/'.$this-&gt;saveto,&nbsp;DT_CHMOD);
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;true;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;}}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        �Ⱦ����������������ļ�飬Ȼ�����$this-&gt;is_allow()�����а�ȫ��� include/upload.class.php:72��
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &lt;?php
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;function&nbsp;is_allow()&nbsp;{
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!$this-&gt;fileformat)&nbsp;return&nbsp;false;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!preg_match("/^(".$this-&gt;fileformat.")$/i",&nbsp;$this-&gt;ext))&nbsp;return&nbsp;false;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(preg_match("/^(php|phtml|php3|php4|jsp|exe|dll|cer|shtml|shtm|asp|asa|aspx|asax|ashx|cgi|fcgi|pl)$/i",&nbsp;$this-&gt;ext))&nbsp;return&nbsp;false;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;true;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        &nbsp;&nbsp;&nbsp;&nbsp;}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ���Կ������������$this-&gt;ext�����˼�飬��ǰ��ʱ$this-&gt;extΪjpg�����ͨ����
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ���Ż���������ı��档ͨ��$this-&gt;set_savepath($this-&gt;savepath); $this-&gt;set_savename($this-&gt;savename);������$this-&gt;saveto��Ȼ��ͨ��move_uploaded_file($this-&gt;file, DT_ROOT.'/'.$this-&gt;saveto)��file���浽$this-&gt;saveto&nbsp;��ע���ʱ��savepath��savename��saveto����phpΪ��׺����$this-&gt;fileʵ��ָ���ǵڶ���jpg�ļ���
</p>
<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
        ©������
</h1>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ���ϣ��ϴ������ļ������е�һ���ļ���phpΪ��β��1.php���������ú�׺��Ϊphp���ڶ����ļ�Ϊ1.jpg��jpg�����ƹ���⣬������Ϊphpһ�仰ľ��(ͼƬ��)��
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        &nbsp;<img src="https://www.9kb.org/content/uploadfile/201809/24/6f0f09c1a8314545a9080bcd4ba3d095.jpg" />
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        Ȼ�����<a href="http://127.0.0.1/file/temp/avatar1.php">http://127.0.0.1/file/temp/avatar1.php</a>&nbsp;���ɡ�����1���Լ���_userid
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ����ʵ�������ϻ���һ�������ơ�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��һ����destoonʹ����α��̬����������fileĿ¼��php�ļ���ִ�С�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="837" height="363" src="https://www.9kb.org/content/uploadfile/201809/24/3f58b59cece34094840f00dee9fef1f8.jpg" />&nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        �ڶ�����avatar.inc.php����$upload-&gt;save()�󣬻��ٴζ��ļ����м�飬Ȼ��������Ϊxx.jpg��
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        ʡ��...$img = array();$img = $dir.'.jpg';$img = $dir.'x48.jpg';$img = $dir.'x20.jpg';$md5 = md5($_username);$dir = DT_ROOT.'/file/avatar/'.substr($md5, 0, 2).'/'.substr($md5, 2, 2).'/_'.$_username;$img = $dir.'.jpg';$img = $dir.'x48.jpg';$img = $dir.'x20.jpg';file_copy($file, $img);file_copy($file, $img);ʡ��...
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ���Ҫ���óɹ�����Ҫ���������ˡ�
</p>
<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
        ��������
</h1>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="1475" height="414" src="https://www.9kb.org/content/uploadfile/201809/24/a547052a1ab5496d8566241df25923d2.jpg" />&nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��upload��һ��ʼ���ͽ���һ�κ�׺���ļ�顣����is_image���£�
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 12pt;padding:0pt;text-align:left;">
        function is_image($file) { &nbsp;&nbsp;&nbsp;return preg_match("/^(jpg|jpeg|gif|png|bmp)$/i", file_ext($file));}
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        <img width="32" height="32" src="https://www.9kb.org/content/uploadfile/201809/24/646b950046bb418ab761eddc9648032a.png" />&nbsp;
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��__construct()��foreach��ʹ����break����ȡ�˵�һ���ļ��������ѭ����
</p>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        ��is_allow()�����Ӷ�$this-&gt;savename�Ķ��μ�顣
</p>
<h1 style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:10.5pt 0pt 12pt;padding:0pt;">
        ���
</h1>
<p style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;background-origin:initial;background-clip:initial;margin:0pt 0pt 18pt;text-align:left;">
        �ף��λ��ʦ��������֣�
</p>
<p style="margin:0pt 0pt 0.0001pt;text-align:justify;">
        &nbsp;
</p>
<br />

�鿴�����汾: Destoon cmsǰ̨getwebshell