CMS Live
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2102
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2435
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2451
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2456
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2461
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2467
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2479
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2496
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2497
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2498
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2499
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2517
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2518
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2519
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2520
Deprecated: Non-static method MagicWord::get() should not be called statically, assuming $this from incompatible context in /home/clients/newman_ftp0/domains/wiki.pws.ru/html/includes/Parser.php on line 2550
Материал из Newman's WiKi.
CMS Live - самописная система управления контентом.
Содержание |
Вход в админ панель без пароля
Хак исходников
Для входа в админ панель нужно знать любой логин и иметь доступ к исходным файлам системы. Логин можно узнать из базы, если к ней есть доступ, либо подобрать. Итак, логин мы знаем. Находим файл include/auth/admin/default.php и находим в нем проверку пароля
if (md5($_POST_GET["password"] . md5($user_regdate . $_POST_GET["password"])) == $user_password) {
$user = new User($user_id);
и делаем так что бы условие всегда было истинно. Например вот так:
if (true || md5($_POST_GET["password"] . md5($user_regdate . $_POST_GET["password"])) == $user_password) {
Теперь вводим существующий логин и любой набор символов. Удачно заходим в систему, меняем пароль. Теперь можно убирать наш хак и заходить под логином и известным нам паролем.
Через cookie
Анализ вот этого кусочка из файла include/auth/admin/default.php
if ((isset($_COOKIE["adminname"])) && (strlen($_COOKIE["adminname"]) >= $this->options["min_user_login_length"])
&& (isset($_COOKIE["admin_identify"]))
&& (strlen($_COOKIE["admin_identify"]) >= $this->options["min_user_password_length"])) {
$adminname = $_COOKIE["adminname"];
$password_hash = $_COOKIE["admin_identify"];
подсказывает нам что для удачного входа нужен только доступ к базе данных. Создать же нужные куки не проблема. Firefox с установленым плагинов webdeveloper позволяет сделать это за несколько минут.