Analysis on MysqlDoor function Creation

In many cases, we use mysqldoor to retain our server permissions. Sometimes, udfs are often used to escalate permissions, can't open shared library 'mysqldll _ 1278197415. dll '.
The UDF Privilege Escalation tool written by yushui Rao Cheng Xiong is used here. 1.

Exclude several possibilities first.

1. KILL the server.

2. No file is written.

3. Because the file name generated by the script in the system32 directory is random, the program cannot find the file name.

1. I tested it locally and disabled the software kill. Therefore, this situation does not exist and is excluded.

2. Open the system32 directory, and the generated program is quietly lying in the directory. Figure 2

1. Make the third hypothesis to eliminate the first two possibilities. If you are afraid that the program is a problem, create it manually. (Absolute paths are not supported for mysql5.0 or above, so the paths are generated under system32.) 3

4

When I went to google, there was still no final answer on the Internet. I only found a good article about creating functions written by ninty. But I still cannot understand it later. Finally, I saw the anonymous online. He had a better understanding of mysql in the php environment all the year round.

After discussing with him, the solution to the problem is to put the udf under the data Directory in mysql. 5

He can succeed on his machine, and I cannot pass it. At last, I used QQ to help him operate my computer, but I still couldn't answer it. It could only end with magic.

In desperation, go to the BK group for help. ninty said it was a path problem, and then added Q to solve the problem after remote access. Finally, I finally understood his article. Haha, don't blame me here. I will organize the documents.

Before permission escalation, determine the mysql permission. If mysql 4.0 directly uses the path, if mysql 5.0 does not work in the system32 directory, put it in data. If mysql 5.1 does not work in the system32 directory, the operation will be troublesome. Use

show variables like %plugin%;

You only need to put the file under this path, and the execution will be successful! However, you must have the permission to create a directory under the mysql directory.