MySQL 4.x/5.0 User-Defined Function Command Execution Exploit (win)

🗓️ 07 Feb 2007 00:00:00Reported by RootType

MySQL UDF backdoor kit allows command execution and reverse shell on Windows systems.


                                                --&nbsp;raptor_winudf.sql&nbsp;-&nbsp;A&nbsp;MySQL&nbsp;UDF&nbsp;backdoor&nbsp;kit&nbsp;for&nbsp;Windows
--&nbsp;Copyright&nbsp;(c)&nbsp;2007&nbsp;Marco&nbsp;Ivaldi&nbsp;&lt;[email protected]&gt;
--
--&nbsp;This&nbsp;is&nbsp;a&nbsp;MySQL&nbsp;backdoor&nbsp;kit&nbsp;for&nbsp;Windows&nbsp;based&nbsp;on&nbsp;the&nbsp;UDFs&nbsp;(User&nbsp;Defined
--&nbsp;Functions)&nbsp;mechanism.&nbsp;Use&nbsp;it&nbsp;to&nbsp;spawn&nbsp;a&nbsp;reverse&nbsp;shell&nbsp;(netcat&nbsp;UDF&nbsp;on&nbsp;port&nbsp;
--&nbsp;80/tcp)&nbsp;or&nbsp;to&nbsp;execute&nbsp;single&nbsp;OS&nbsp;commands&nbsp;(exec&nbsp;UDF).&nbsp;Don't&nbsp;forget&nbsp;to&nbsp;edit
--&nbsp;the&nbsp;MySQL&nbsp;bin&nbsp;path&nbsp;below&nbsp;according&nbsp;to&nbsp;your&nbsp;target's&nbsp;configuration.
--
--&nbsp;Thanks&nbsp;to&nbsp;KDM&nbsp;for&nbsp;asking&nbsp;me&nbsp;to&nbsp;do&nbsp;research&nbsp;on&nbsp;this&nbsp;interesting&nbsp;subject!
--
--&nbsp;See&nbsp;also:
--&nbsp;http://www.0xdeadbeef.info/exploits/raptor_udf.c
--&nbsp;http://www.0xdeadbeef.info/exploits/raptor_udf2.c
--
--&nbsp;Tested&nbsp;on:
--&nbsp;MySQL&nbsp;4.0.18-win32&nbsp;(running&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;SP2)
--&nbsp;MySQL&nbsp;4.1.22-win32&nbsp;(running&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;SP2)
--&nbsp;MySQL&nbsp;5.0.27-win32&nbsp;(running&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;SP2)

download:
http://www.0xdeadbeef.info/exploits/raptor_winudf.tgz
http://www.milw0rm.com/sploits/02062007-raptor_winudf.tgz

07 Feb 2007 00:00Current

7.1High risk

Vulners AI Score7.1