Privilege Escalation for mysql off-star

Author: shangjian
Hello everyone,I am the final sword. Hake is now available today.,Share an original article

Statement,Today, I testedBlog.WpProgram,No0 day,Go directly

A registered website is displayed. After logging on to the system, you will find that you can upload your avatar directly.PhpHorse, simply get a side StationSHELL. Supported. NETSupportedPHP. High Permissions,This permission is a benefit, but unfortunately it is out of the stars.

Column directory not supported...Not to mention cross-directory .... Tragedy

 

Locate the readable and writable directory and upload a cmd file for execution.

FindMYSQL. Directory. I wonder if Mu has such high access permissions? Try it at will

 

 

Naturally, it is a tragedy. It can be opened. What do you know?...

DownloadData/mysqlDirectoryUser. MYD user. MYI user. frmThree files.

Local setupMysql,SearchRootAccount password. Now.,Account found,The password is also unbound.

The first thing I want to know is:UDFElevation of Privilege. Everyone knows.

 

Someone has been here. Also executed. I tried to check his field. Yes. But it seems that the execution fails. Just give up? Impossible!

Now that people come first. Let's look at the database version.

UsePHPThe trojan is connected.

 

Yes5.1. Looks likeMysql5.1Different methods of Elevation of Privilege

Baidu. I won't say much about it.You need to find the currentMysqlDirectoryInLib/pluginThe function can be executed only in the directory.

Okay. Let's change the export directory. ImportD:/mysql/lib/plugin

 

.

 Exported successfully. Check whether it is successfulExecute the function.

 

 SystemI want you to know what to do.

 The server is ready. Clear logsLeave

 This article is just a summary of experience. Please stop smiling.