_
_ _ 11.21.2008
 
_ Navigation: _
Main Page Technology Downloads Security Entertainment Videos
Search Site: Advanced
_
 
Login Login
 
Register Register
   
_ News Item

MySQL 4.x/5.0 User-Defined Function Command Execution Exploit (win)

Feb 07 2007 19:54:01
Source: ace
vote bad  vote good
0
-- raptor_winudf.sql - A MySQL UDF backdoor kit for Windows
-- Copyright (c) 2007 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- This is a MySQL backdoor kit for Windows based on the UDFs (User Defined
-- Functions) mechanism.

Use it to spawn a reverse shell (netcat UDF on port
-- 80/tcp) or to execute single OS commands (exec UDF).

Don't forget to edit
-- the MySQL bin path below according to your target's configuration.
--
-- Thanks to KDM for asking me to do research on this interesting subject!
--
-- See also:
-- http://www.0xdeadbeef.info/exploits/raptor_udf.c
-- http://www.0xdeadbeef.info/exploits/raptor_udf2.c
--
-- Tested on:
-- MySQL 4.0.18-win32 (running on Windows XP SP2)
-- MySQL 4.1.22-win32 (running on Windows XP SP2)
-- MySQL 5.0.27-win32 (running on Windows XP SP2)

download:
http://www.0xdeadbeef.info/exploits/raptor_winudf.tgz
http://www.milw0rm.com/sploits/02062007-raptor_winudf.tgz
.



» full story @ source-link: ace
_ Comments
Add Comment
You must be registered and logged in to add comments!

Register
Login
_ Sponsors

_ Sponsors