In this code once the if condition is satisfied it executes include $_REQUEST['target'];. So, we just need to bypass the if condition to execute what we want.

Let us look at the if condition

1. The first two conditions says target parameter cannot be empty and it needs to be string.
2. The third condition restricts the target parameter from starting with index.
3. The fourth condition restricts that the target parameter should not be in $target_blacklist
   • The $target_blacklist is defined just before the if condition and it includes import.php and export.php meaning anything except these two pages are allowed.
4. The fifth and final condition is a whitelist check for the page validity using an existing function in Core class Core::checkPageValidity($_REQUEST['target']).
   • As shown in the code snippet below the function checkPageValidity strips everything behind ? from $page and checks if it is in the whitelist. The string after ? is not part of the URL path. A sample whitelist is also shown in the code snippet.
   root@kitploit:~

   public static function checkPageValidity(&$page, array $whitelist = [])
   {
       // ...
       $_page = mb_substr($page, 0, mb_strpos($page . '?', '?'));
       // example $whitelist == array('db_sql.php', 'sql.php', ...)
       if (in_array($_page, $whitelist)) {
           return true;
       }
       // ...
       return false;
   } 
   

   • The important point to note here is that the attacker has the complete control of $page, since it comes directly from $_REQUEST['target'].

How does the attack work

As mentioned previously the attacker has full control on $page in the checkPageValidity function via the $_REQUEST['target'] parameter in the URL. Lets imagine that the attacker sends something like the following using $_REQUEST['target'] parameter to $page

The checkPageValidity function then performs the following

1. First it splits the string at ? and assigns the first part to $page. So in this example case the value of $page = db_sql.php.
2. Next it checks if $_page, i.e. db_sql.php, is in whitelist or not? Since it is in the whitelist the function returns True and goes back to index.php

Since the if condition in index.php is now True it executes the following line as shown in the index.php code snippet above

What happens next is

• The statement above includes the non-splitted value of $_REQUEST['target'] which means the following gets executed
  root@kitploit:~

  GET /index.php?target=db_sql.php?/../../../../../../../../etc/passwd
  

• Since PHP magically converts path to /../../../../../../../../etc/passwd without checking whether db_sql.php exists or not, the /../../../../../../../../etc/passwd gets executed and the content of /etc/passwd file is sent in the response back to the attacker.

We can now use this to perform local file inclusion or even remote code execution to get a reverse shell back. Whenever we execute a query in phpMyAdmin, it creates a session file and stores in the /tmp directory with the query content. The session file named as sess_< SESSION ID >. The session ID can be easily found in the cookie using the inspect option of the browser.

So if we execute the following query in phpMyAdmin

It will be stored in the session file. Lets imagine our session ID for the phpMyAdmin is e15cffd3ab25a631136611fba9ca2042

Then if we trigger the following address in the browser

Then phpMyAdmin will try to load the session page and since the page contains the php code provided through the query, the php code will be executed and in this particular example we will see phpinfo in the page loaded by the browser. Using this technique we can execute any arbitrary code on the remote server.

How to install vulnerable component

The exploit infrastructure requires vulnerable version of phpMyAdmin and mysql. We will use docker containers to install the required components. For vulnerable version of phpMyAdmin we will use prebuilt docker environnement from Vulhub and for mysql we will use latest official version from dockerhub. The installation script is provided as a docker compose yml script which can be found in the repository.

We assume that the intended machine has docker and docker-compose installed. If not then please refer to the docker documentation to install them. Once docker is installed, perform the following steps to setup the vulnerable component:

First clone the repository in your intended machine and navigate to the cloned directory

Then run the docker compose script using the following command

Once installation process is finished docker will expose phpMyAdmin page on port 8080 of your machine. You can check by opening the page in your browser using the following address format

If the installation process is successful you should see a page like the following

How to perform the attack

The following video is a tutorial on how to perform the attack

Video Link: https://drive.google.com/file/d/1UbLGEwMYswdrRAOMJLd0mFHbsNl1aPvt/preview

References

[1] https://www.exploit-db.com/exploits/44928

[2] https://github.com/vulhub/vulhub

[3] https://docs.docker.com/get-docker/