Analysis: Mysql does not have the file Permission to read root hash?

Analysis: Mysql does not have the file Permission to read root hash?
As the question.

For example, wooyun Community posts the Daniel http://www.bkjia.com/Article/201405/303746.html
 

I am very happy to see the title of the post. It probably means that I have created an account named test without the file Permission and cannot load the file, however, you can use load data local to read the content of a file to a certain table, and then select to read balabala .....

At first, I thought this was the only Daniel who said this, but then I saw a lot of Daniel, just as I had a 0-day MySQL experience. I was so happy to share it in various places (Oh, right, I would like to give a verbal praise for this kind of sharing spirit), and even some people have written the script. Although there are just a few SQL statements, the script is quite similar, so I downloaded it. We will test the script later.

In fact, I really don't know MySQL, and I really don't know. By default, if you load data from a file, it can only be localhost, in addition, I really don't know that when you load data local, you actually have the same permissions as the WEB !!! Don't ask me how I know it. When I think about it with my heel, I will know that such a 2B "excessive privilege" cannot appear in such a mature MySQL. so, I found the information, note the following:

[I am Referencing] in the WEB environment, the customer connects from the WEB server, you can use the load data local statement to read any files that the WEB server process has read access permissions (assuming that you can run any commands on the SQL Server ). In this environment, the MySQL server is actually a WEB server, rather than a program run by the user who connects to the WEB server. [/I ended the reference]

As for the source, I think... Baidu, I will not post the address.

OK. You have no choice but to test it in practice. For convenience, I set up a win2003 Virtual Machine and installed wampserver. To avoid disputes like "whether or not it is related to MySQL account Permissions, in the test, MySQL uses the root account throughout the entire process.

As we all know, in general, wampServer Apache is started as a system by default. so, it was confirmed by a Sike Trojan.

Now our PHP (Apache) runs under the omnipotent system permission. Of course, we can also directly use the PHP webshell to directly read the file that saves the hash of the MySQL account.

Well, we have all said that we are an omnipotent system. Now let's test a so-called MySQL "unauthorized" load data local. I found a script written on the Internet by a great God (it is much more convenient, it is really for the benefit of the people). I tested it with this script and read the same content. (I will provide the source code for this script later)

Now we create a test user for testing.

Right-click my computer, manage, services, applications, services, find wampapache, that is, Apache services, right-click Properties-log on, we can see, the current login identity is "Local SYSTEM account"

Obviously, this is the system permission, so we have Apache run as the test user just created.

We have to restart the Apache service, but it seems that something is wrong.

Okay, let's take a look at the log. What is the situation...

I wiped it. It turns out that the permission is not enough after I replace it with the test user... Okay. Grant the test user the corresponding permissions. Apache is successfully started. At this time, let's look at whoami and make sure it is the identity of test.

In this case, we set the MySQL data DIRECTORY with the permission to reject the read/write permission of the user test.

Obviously, PHP webshell cannot read the data directory at this time (the permission is denied to apply to the data DIRECTORY And all sub-files (folders ))

At this time, we can use the load data local script to read it. (I promise I cannot read it. If I can read my live video, I can eat Xiang.) Well, it turns out that I don't need to eat Xiang on the live video.

Summary:First, the so-called "excessive permission" does not exist at all. load data only reads data from a file, and into outfile is a reciprocal operation, which makes it easier to understand. In theory, this load data method can only be used when the database is localhost.

Second, your load data permission is the same as the running permission of WEB scripts -- this means that if you can get the file content through load data, so webshell can be used to read it directly. Why do I have to take off my pants and fart?

Third, in fact, it is not completely useless. I suddenly think of a scenario, for example, you can directly select @ datadir at the injection point, load data after reading the path, and then select, this is also a way of thinking (obviously, I just thought that this may happen and I have never practiced it ).

Finally, you can paste the source code of a script written by a great god to check the load data statement.

In addition, I also pointed out the shortcomings of this script. If you are lucky enough to see it, I hope it will be helpful to you.

First: Line 1, original code: if (! Link) {, brother, you wrote less $. Please change it to if (! $ Link ){.

Second: line 2, original code: $ db_path_ SQL = "select @ basedir"; I suggest you use @ datadir instead of @ basedir here, although in most cases (by default), @ datadir is indeed equal to @ basedir. "/data", but @ datadir can be customized. Sometimes it is possible that @ datadir and @ basedir have no relationship at all.

Third: Row 3, original Code :". $ db_path. "data/mysql/user. MYD, in fact, it seems that there is no problem here, but it seems that the $ db_path value here should not end with a slash "/", so the path you splice should be wrong, it may be similar to "c: \ mysqldata/mysql/user. because $ db_path does not have a slash at the end, the string data/mysql/user. MYD, with no diagonal lines at the front, causes this problem (at least during my test). so, changed :". $ db_path. "/data/mysql/user. MYD can solve this problem.

Fourth: Let the user enter the host. At this time, the host can only be localhost. If it is a remote host, it cannot be read.

The final code is attached (don't forget to modify the code of Line 4)

<? Phpif (isset ($ _ POST ['sub ']) {$ name = $ _ POST ['name']; $ pass = $ _ POST ['Password']; $ host = $ _ POST ['host']; $ db = $ _ POST ['db']; $ link = mysql_connect ($ host, $ name, $ pass ); if (! Link) {die ("cocould not connect". mysql_error ();} if (! Mysql_select_db ($ db, $ link) {die ("db ". mysql_error ();} $ db_path_ SQL = "select @ basedir"; if ($ n = mysql_query ($ db_path_ SQL) {$ db_path_rs = mysql_fetch_array ($ n ); $ db_path = str_replace ("\", "/", $ db_path_rs [0]);} $ dropmoon = 'drop table moon '; $ SQL = "CREATE TABLE moon ('code' TEXT NOT NULL) ENGINE = MYISAM CHARACTER SET utf8 COLLATE utf8_general_ci;"; $ exp = "LOAD DATA LOCAL INFILE '". $ db_path. "data/mysql/user. MY D 'into TABLE moon fields terminated by ''' lines terminated by '\ 0'; "; $ select =" SELECT code FROM moon "; $ pass = ""; mysql_query ($ dropmoon); if (mysql_query ($ SQL) {if ($ row = mysql_query ($ exp) {if ($ row = mysql_query ($ select )) {while ($ rows = mysql_fetch_array ($ row) {echo $ pass. = $ rows ['code'] ;}}}} else {echo "
[Via @ okadwin]