MySQL UDF
Zataz:
Augmentation significative des activités hostiles à l'encontre du portMySql des serveurs Internet. L'alerte a été donnée par SANS. Le portTCP/3306 semble être surveillé de très, très prêt par les pirates etautres codes malicieux. On n'a pas encore de preuve au sujet d'unnouvel exploit visant MySQL, mais clairement il y a un certain intérêtpour ce port.
Bon bin l'explication a mon avis elle est simple:
http://www.nextgenss.com/papers/HackproofingMySQL.pdf
il faut regarder la partie sur les UDF ( User defined Functions).
A short summary about UDF:
UDF stands for user defined function.
Its a feature in mysql that makes it possible to generate and load your own functions into your mysql server.
Itsa nice feature, however if you put weak passes on your root login itcan be a harmful feature that makes it possible to start shell commandsremotely using such a designed UDF.
All an attacker would have to do is generate an UDF as nextgenss has done.
Load it into a table, dump it to harddisk and load the function.
Its a very easy task since the only things you need to know are the root account and the folder where we need to store the udf.
In steps:
1.Compile an UDF for the targeted system
2.Generate a Hexdump of this UDF
3.Generate a blob table
4.Load the Hexdump into this table
5.Dump the table into an outputfile
6.Load the function
7.Call the function
le 27 decembre l'exploit Linux est sorti au public:
http://www.securiteam.com/exploits/6G00P1PC0U.html
et il y a 3 jours le POC pour windows est devenu public donc forcement il y a une montee des scans...
What it does:
It will generate an UDF in %systemdir% that it will need to guess.
Afterwards it will write a compressed version of netcat to C:\nc.exe.
If everything worked well it will open the shell on port 21000.
--------Myudf v0.1--------
Mysql UDF-Method for Win32
Written by Killaloop
Opens nc shell on port 21000
All credits to nextgenss
THIS IS POC DONT DO ANYTHING HARMFUL WITH IT
Usage: myudf.exe IP USER PASSWORD(optional)
----------------------------
L'exploit windows ICI
Augmentation significative des activités hostiles à l'encontre du portMySql des serveurs Internet. L'alerte a été donnée par SANS. Le portTCP/3306 semble être surveillé de très, très prêt par les pirates etautres codes malicieux. On n'a pas encore de preuve au sujet d'unnouvel exploit visant MySQL, mais clairement il y a un certain intérêtpour ce port.
Bon bin l'explication a mon avis elle est simple:
http://www.nextgenss.com/papers/HackproofingMySQL.pdf
il faut regarder la partie sur les UDF ( User defined Functions).
A short summary about UDF:
UDF stands for user defined function.
Its a feature in mysql that makes it possible to generate and load your own functions into your mysql server.
Itsa nice feature, however if you put weak passes on your root login itcan be a harmful feature that makes it possible to start shell commandsremotely using such a designed UDF.
All an attacker would have to do is generate an UDF as nextgenss has done.
Load it into a table, dump it to harddisk and load the function.
Its a very easy task since the only things you need to know are the root account and the folder where we need to store the udf.
In steps:
1.Compile an UDF for the targeted system
2.Generate a Hexdump of this UDF
3.Generate a blob table
4.Load the Hexdump into this table
5.Dump the table into an outputfile
6.Load the function
7.Call the function
le 27 decembre l'exploit Linux est sorti au public:
http://www.securiteam.com/exploits/6G00P1PC0U.html
et il y a 3 jours le POC pour windows est devenu public donc forcement il y a une montee des scans...
What it does:
It will generate an UDF in %systemdir% that it will need to guess.
Afterwards it will write a compressed version of netcat to C:\nc.exe.
If everything worked well it will open the shell on port 21000.
--------Myudf v0.1--------
Mysql UDF-Method for Win32
Written by Killaloop
Opens nc shell on port 21000
All credits to nextgenss
THIS IS POC DONT DO ANYTHING HARMFUL WITH IT
Usage: myudf.exe IP USER PASSWORD(optional)
----------------------------
L'exploit windows ICI
Publicité