Guest User

Untitled

a guest
Feb 15th, 2018
342
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.63 KB | None | 0 0
  1. sudo kill -STOP $(cat /var/run/mysqld/mysqld.pid)
  2.  
  3. sudo kill -CONT $(cat /var/run/mysqld/mysqld.pid)
  4.  
  5. mysql> SHOW TABLE STATUS where Name = 'user'G
  6. *************************** 1. row ***************************
  7. Name: user
  8. **Engine: MyISAM**
  9. Version: 10
  10. Row_format: Dynamic
  11. Rows: 27
  12. Avg_row_length: 91
  13. Data_length: 2476
  14. Max_data_length: 281474976710655
  15. Index_length: 2048
  16. Data_free: 0
  17. Auto_increment: NULL
  18. Create_time: 2012-04-12 11:46:21
  19. Update_time: 2013-01-22 00:16:00
  20. Check_time: 2013-01-19 20:52:09
  21. Collation: utf8_bin
  22. Checksum: NULL
  23. Create_options:
  24. Comment: Users and global privileges
  25. 1 row in set (0.00 sec)
  26.  
  27. # mkdir /var/lib/mysql2/
  28. # ln -s /var/lib/mysql/mysql /var/lib/mysql2/mysql
  29.  
  30. # /usr/sbin/mysqld --basedir=/usr
  31. --datadir=/var/lib/mysql2
  32. --plugin-dir=/usr/lib64/mysql/plugin
  33. --user=mysql
  34. --log-error=/var/lib/mysql2/server-64654.err
  35. --pid-file=/var/lib/mysql2/server-64654.pid
  36. --socket=/var/lib/mysql2/mysql.sock
  37. --port=3307
  38. --init-file=/var/cache/chef/grants.sql
  39. --datadir=/var/lib/mysql2/
  40.  
  41. GRANT ALL ON *.* TO 'nagios-user'@'127.0.0.1' IDENTIFIED BY 'xxx' WITH GRANT OPTION;
  42. FLUSH PRIVILEGES;
  43.  
  44. mysql --port=3307 -h 127.0.0.1 -e 'select User from mysql.user'
  45. +-------------+
  46. | User |
  47. +-------------+
  48. | root |
  49. | nagios_user |
  50.  
  51. mysql --port=3306 -h 127.0.0.1 -e 'select User from mysql.user'
  52. +-------------+
  53. | User |
  54. +-------------+
  55. | root |
  56.  
  57. GRANT SELECT ON heartbeart.* to 'nagios-monitor'@'123.123.123.123'
  58.  
  59. INSERT INTO mysql.user SET
  60. user='nagios-monitor',
  61. host='123.123.123.123',
  62. password=PASSWORD('whateverpassword');
  63. INSERT INTO mysql.db SET
  64. user='nagios-monitor',
  65. host='123.123.123.123',
  66. db='heartbeat',
  67. select_priv='Y';
  68. FLUSH PRIVILEGES;
  69.  
  70. mysql> show grants for 'nagios-monitor'@'123.123.123.123';
  71. +----------------------------------------------------------------------+
  72. | Grants for nagios-monitor@123.123.123.123 |
  73. +----------------------------------------------------------------------+
  74. | GRANT USAGE ON *.* TO 'nagios-monitor'@'123.123.123.123' |
  75. | GRANT SELECT ON `heartbeart`.* TO 'nagios-monitor'@'123.123.123.123' |
  76. +----------------------------------------------------------------------+
  77. 2 rows in set (0.03 sec)
  78.  
  79. mysql>
  80.  
  81. INSERT INTO mysql.user SET
  82. user='nagios-monitor',
  83. host='123.123.123.123',
  84. password=PASSWORD('whateverpassword');
  85. INSERT INTO mysql.tables_priv SET
  86. user='nagios-monitor',
  87. host='123.123.123.123',
  88. db='nagiosdb',
  89. grantor='root@localhost',
  90. table_priv='Select';
  91. FLUSH PRIVILEGES;
  92.  
  93. mysql> show grants for 'nagios-monitor'@'123.123.123.123';
  94. +------------------------------------------------------------------------------+
  95. | Grants for nagios-monitor@123.123.123.133 |
  96. +------------------------------------------------------------------------------+
  97. | GRANT USAGE ON *.* TO 'nagios-monitor'@'123.123.123.123' |
  98. | GRANT SELECT ON `nagiosdb`.`heartbeat` TO 'nagios-monitor'@'123.123.123.123' |
  99. +------------------------------------------------------------------------------+
  100. 2 rows in set (0.00 sec)
  101.  
  102. mkdir /var/lib/mysql/mysql_schema
  103. cd /var/lib/mysql/mysql_schema
  104. cp /var/lib/mysql/mysql/* .
  105. chown -R mysql:mysql /var/lib/mysql/mysql_schema
  106.  
  107. mkdir /var/lib/mysql/mysql_nagios
  108. cd /var/lib/mysql/mysql_nagios
  109. cp /var/lib/mysql/mysql/* .
  110. chown -R mysql:mysql /var/lib/mysql/mysql_nagios
  111.  
  112. mkdir /var/lib/mysql/mysql_injection
  113. chown -R mysql:mysql /var/lib/mysql/mysql_injection
  114.  
  115. INSERT INTO mysql_nagios.user SET
  116. user='nagios-monitor',
  117. host='123.123.123.123',
  118. password=PASSWORD('whateverpassword');
  119. INSERT INTO mysql_nagios.tables_priv SET
  120. user='nagios-monitor',
  121. host='123.123.123.123',
  122. db='nagiosdb',
  123. grantor='root@localhost',
  124. table_priv='Select';
  125.  
  126. SET GLOBAL event_scheduler = 1;
  127.  
  128. rm -f /var/lib/mysql/mysql_injection/*
  129. cp /var/lib/mysql/mysql_nagios/* /var/lib/mysql/mysql_injection/.
  130.  
  131. use mysql_injection
  132. DELIMITER $$
  133. CREATE EVENT ev_schema_inject
  134. ON SCHEDULE
  135. EVERY 1 MINUTE
  136. STARTS (NOW() + INTERVAL 1 MINUTE)
  137. DO
  138. BEGIN
  139. REPLACE INTO mysql.user SELECT * FROM mysql_injection.user;
  140. REPLACE INTO mysql.tables_priv SELECT * FROM mysql_injection.tables_priv;
  141. FLUSH PRIVILEGES;
  142. END $$
  143. DELIMITER ;
  144.  
  145. DELETE FROM mysql.user;
  146. DELETE FROM mysql.tables_priv;
  147. INSERT INTO mysql.user SELECT * FROM mysql_orig.user;
  148. INSERT INTO mysql.tables_priv SELECT * FROM mysql_orig.tables_priv;
  149. FLUSH PRIVILEGES;
  150. SET GLOBAL event_scheduler = 0;
  151.  
  152. # echo "select version()" | mysql -uroot
  153. ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
  154.  
  155. tbreak check_scramble
  156. commands
  157. silent
  158. return (long int)0
  159. end
  160. cont
  161.  
  162. # gdb -p $(cat /var/run/mysqld/mysqld.pid) -batch
  163. -x gdbscript
  164.  
  165. [New LWP 21273]
  166. [New LWP 21272]
  167. [Thread debugging using libthread_db enabled]
  168. 0x00007f6849d4a383 in poll () from /lib64/libc.so.6
  169. Temporary breakpoint 1 at 0x660204: file /export/home/pb2/build/sb_0-26265460-1512805762.25/rpm/BUILD/mysql-5.6.39/mysql-5.6.39/sql/password.c, line 556.
  170.  
  171. # mysql -uroot -p123
  172. Welcome to the MySQL monitor. Commands end with ; or g.
  173. Your MySQL connection id is 153
  174. mysql> UPDATE mysql.user SET Password=PASSWORD('SOMENEWPASSWORD') WHERE USER='root';
  175. mysql> flush privileges;
  176.  
  177. Temporary breakpoint 1 at 0x660204: file /export/home/pb2/build/sb_0-26265460-1512805762.25/rpm/BUILD/mysql-5.6.39/mysql-5.6.39/sql/password.c, line 556.
  178. [Switching to Thread 0x7f68209f3700 (LWP 22242)]
  179.  
  180. [~]# echo "SELECT VERSION() | mysql -uroot -pSOMENEWPASSWORD
  181. version()
  182. 5.6.39
Add Comment
Please, Sign In to add comment