MySql local upgrade demonstration

Go to: Huaxia Hacker Alliance www.77169.org

Some time ago I heard that mysql uses Mix. dll can directly obtain system permissions. I tested it locally and it worked well. I tested it in windows server2003 sp1 and tested MYSQL version 4.0.23, how can this improvement be used? For example, if we get a phpshell without serv-u or pcanywhere, We have installed a mysql instance, and we don't know how to improve it here, this method can be used now. It can also be used when weak MYSQL passwords are scanned. How can I upload the DLL file? Please check the Mix article on your own. I won't perform any tests locally. Now let's take a look at how to get it. First, log on to MYSQL and start-run-CMD to the MYSQL installation directory. Enter the mysql-uroot-p username and root password. Login successful, 1

Now, enter create function Mixconnect returns string soname c: \ Mix. dll. We need to register Mixconnect to execute system commands. Here, c: \ mix. dll is the path of Mix. dll on my local machine. After entering the information, press enter and the words "Qusery OK" appear, which means the registration is successful. 2

Okay, the registration is successful. Then we use NC to listen to port 1234, nc-l-p 1234. 3

 

The key moment is approaching. always pay attention to this NC window. Now we enter select Mixconnect (127.0.0.1, 1234) in the CMD window that logs on to MYSQL. Press enter to set it there, and the window that listens to it has successfully obtained an external shell. 4

The mongoshell is successfully obtained, but MYSQL is already suspended. In this case, we need to KILL the mysql service process. It is not enough to restart MYSQL. After KILL, restart the service. Not only Mix. dll can take the system permission, and my_udf.dll can also be used. Let's continue to look at it. the usage is the same, but the method for getting the shell is different. log on to mysql first, and then enter create function my_udfdoor returns string soname c: \ Mix \ my_udf.dll; press enter, 5

After successfully registering the function, we start to activate the function, input select my_udfdoor (), press enter, connect to port 3306 with nc, and enter fuck to get a mongoshell, 6. 7

OK, the test is successful. The password of fuck is not changed to 77169.

Welcome to the China Hacker Alliance forum to exchange hacker technology Http: // bbs.77169.com/index.html