2019年数据库安全.pdf

1、Comprehensive analysis of the mysql client attack chainLoRexxarKnownsec 404TeamAbout meLoRexxarKnownsec 404Team/Vidar-TeamSecurity researcher/ctferWeb/smart contracthttps:/ Dawu Knownsec 404Team Security researcher Evernote For Windows Read Local File and Command Execute VulnerabilitiesWhats Mysql C

2、lient Attack?2018.06 TCTF2018 Final h4x0rs.club pt.3Whats Mysql Client Attack?2018.06 TCTF2018 Final h4x0rs.club pt.3Write a file with controlled dataControllable mysqlconfigControllable mysqlqueryFurther useWhats Mysql Client Attack?2018.06 TCTF2018 Final h4x0rs.club pt.3Dragon Sector&Cykor Unexpec

3、ted use to get FlagWrite a file with controlled dataControllable mysqlconfigRead mysql client fileWhats Mysql Client Attack?load data infile/etc/passwd into table test FIELDS TERMINATED BY n;mysql select*from test;+-+-+-+|id|a|b|+-+-+-+|0|daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin|bin:x:2:2:bin

4、:/bin:/usr/sbin/nologin|0|sync:x:4:65534:sync:/bin:/bin/sync|games:x:5:60:games:/usr/games:/usr/sbin/nologin|0|lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin|mail:x:8:8:mail:/var/mail:/usr/sbin/nologin|0|uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin|proxy:x:13:13:proxy:/bin:/usr/sbin/nologin|0|b

5、ackup:x:34:34:backup:/var/backups:/usr/sbin/nologin|list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin|0|gnats:x:41:41:Gnats Bug-Reporting System(admin):/var/lib/gnats:/usr/sbin/nologin|nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin|0|systemd-network:x:101:103:systemd Network

6、Management,:/run/systemd/netif:/bin/false|systemd-resolve:x:102:104:systemd Resolver,:/run/systemd/resolve:/bin/false|0|syslog:x:104:108:/home/syslog:/bin/false|_apt:x:105:65534:/nonexistent:/bin/false|0|messagebus:x:107:111:/var/run/dbus:/bin/false|uuidd:x:108:112:/run/uuidd:/bin/false|0|sshd:x:110