Waraxe IT Security Portal
Login or Register
July 20, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 200
Members: 0
Total: 200
Full disclosure
[KIS-2024-06] XenForo <= 2.2.15 (Template System) Remote Code Execution Vulnerability
[KIS-2024-05] XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
SEC Consult SA-20240620-0 :: Arbitrary File Upload in edu-sharing (metaVentis GmbH)
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> All other security holes -> root mysql? stuck!
Post new topicReply to topic View previous topic :: View next topic
root mysql? stuck!
PostPosted: Fri Jan 09, 2009 4:14 am Reply with quote
-AO-
Advanced user
Advanced user
Joined: Jul 15, 2008
Posts: 205
Location: United States




I have a root mysql login but it's set host is only localhost. I only have privs to use the select command with another login. This password might match the ftp but I can't even connect to it or on http port...

ftp://xx.xx.xx.xx

http://xx.xx.xx.xx

so neither of these ports are open...

with select command I've got the root login but I'm stuck here.
Any suggestions? Sad
View user's profile Send private message Yahoo Messenger
PostPosted: Fri Jan 09, 2009 8:52 am Reply with quote
pexli
Valuable expert
Valuable expert
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




Try to find phpmyadmin or some other sql client on this server.
View user's profile Send private message
PostPosted: Fri Jan 09, 2009 3:38 pm Reply with quote
_mranderson_
Valuable expert
Valuable expert
Joined: Oct 30, 2008
Posts: 51




if you are root and can only use select statements, you're done.
use
Code:
select load_file('/complete/path/to/file')
to read a file, or
Code:
select 'data' into outfile '/path/to/file'
to write some data to a file.
View user's profile Send private message
PostPosted: Sat Jan 10, 2009 6:07 am Reply with quote
-AO-
Advanced user
Advanced user
Joined: Jul 15, 2008
Posts: 205
Location: United States




Thanks for replies. I tried every sql client I could think of and none of them worked. This server is mainly used for mysql and not a web server. I used nmap to do a port scan and the only port open was 22 which is probably ssh but couldn't connect w/ putty.

@mranderson
I tried these on my localhost and couldn't get them to work... and for load_file, wouldn't I need file privs? But if I could get the select into outfile to work... Do something like this maybe?

<?php

mysql_connect(localhost, root, password);
mysql_query('CREATE USER 'Administrator'@ '99.99.99.99' IDENTIFIED BY '****';

GRANT ALL PRIVILEGES ON * . * TO 'Administrator'@ '99.99.99.99' IDENTIFIED BY '****' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ;');

?>


But since this server isn't a webserver... maybe it doesn't have php Confused
View user's profile Send private message Yahoo Messenger
PostPosted: Sat Jan 10, 2009 10:19 am Reply with quote
pexli
Valuable expert
Valuable expert
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




How many databases have on this mysql server?
View user's profile Send private message
PostPosted: Sat Jan 10, 2009 7:24 pm Reply with quote
-AO-
Advanced user
Advanced user
Joined: Jul 15, 2008
Posts: 205
Location: United States




There is three databases including mysql and information_schema.
View user's profile Send private message Yahoo Messenger
PostPosted: Sat Jan 10, 2009 8:14 pm Reply with quote
pexli
Valuable expert
Valuable expert
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




-AO- wrote:
There is three databases including mysql and information_schema.


Some software???
View user's profile Send private message
PostPosted: Sun Jan 11, 2009 12:10 am Reply with quote
-AO-
Advanced user
Advanced user
Joined: Jul 15, 2008
Posts: 205
Location: United States




Nope, no software that i could find. Only open ports 22 & 7777. i know these dbs from connecting through another server.
View user's profile Send private message Yahoo Messenger
PostPosted: Sun Jan 11, 2009 1:18 pm Reply with quote
_mranderson_
Valuable expert
Valuable expert
Joined: Oct 30, 2008
Posts: 51




it's an L2 server aight?

anyways, as already said, if you have the mysql root's password you should find a way to run SQL code on it, because with root privs you can load_file() and select into outfile.
View user's profile Send private message
root mysql? stuck!
www.waraxe.us Forum Index -> All other security holes
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.128 Seconds