Easily intercept the DZ X2 plaintext password in shell

 

Rainer

First, please smile when posting for the first time

Second, this is through simple modification of the DZ source file, using the principle of Password error records to intercept the plaintext Password

Haha, the purpose is relatively simple. I don't want to run the second-encrypted MD5, but it's not a bad thing.

Target file:/source/class/class_member.php

 

First look at the error password record section, about 200th lines

 

01} else {

02 $ password = preg_replace ("/^ (. {". round (strlen ($ _ G ['gp _ password'])/4 ). "})(. + ?) (. {". Round (strlen ($ _ G ['gp _ password'])/6 ). "}) $/s", "\ 1 *** \ 3", $ _ G ['gp _ password']);

03 $ errorlog = dhtmlspecialchars (

04 TIMESTAMP. "\ t ".

05 ($ result ['ucresresult'] ['username']? $ Result ['ucresresult'] ['username']: dstripslashes ($ _ G ['gp _ username']). "\ t ".

06 $ password. "\ t ".

07 "Ques #". intval ($ _ G ['gp _ questionid ']). "\ t ".

08 $ _ G ['clientip']);

09 writelog ('illegallog', $ errorlog );

10 loginfailed ($ _ G ['gp _ username']);

11 $ fmsg = $ result ['ucresresult'] ['uid'] = '-3 '? (Empty ($ _ G ['gp _ questionid ']) | $ answer = ''? 'Login _ question_empty': 'login _ question_invalid '): 'login _ invalid ';

12 showmessage ($ fmsg, '', array ('loginperm' => $ _ G ['Member _ loginperm']);

13}

The plaintext password 1 $ password = preg_replace ("/^ (. {". round (strlen ($ _ G ['gp _ password'])/4 ). "})(. + ?) (. {". Round (strlen ($ _ G ['gp _ password'])/6 ). "}) $/s", "\ 1 *** \ 3", $ _ G ['gp _ password']);

Remove the * password instead of the plain text.

 

$ Password = $ _ G ['gp _ password'];

 

The modified code is as follows: 01 if ($ result ['status']> 0 ){

02 $ password = $ _ G ['gp _ password'];

03 $ errorlog = dhtmlspecialchars (

04 TIMESTAMP. "\ t ".

05 ($ result ['ucresresult'] ['username']? $ Result ['ucresresult'] ['username']: dstripslashes ($ _ G ['gp _ username']). "\ t ".

06 $ password. "\ t ".

07 "Ques #". intval ($ _ G ['gp _ questionid ']). "\ t ".

08 $ _ G ['clientip']);

09 writelog ('illegallogs', $ errorlog );

10 www.2cto.com}

Insert the entire code segment to the front of the source code if ($ result ['status']> 0)

 

The plaintext password will be recorded in/data/log/2011 (month) _ illegallogs. php. Of course, errors and correctness will be recorded