52 replies to this topic

[SeNe]

great tool m8 10x for it, but every time i execute the exe i keep getting this error

Access Violation at address 00000000. Read of address 00000000

did anyone got the same error or got an idea what this could be?

Thanks

Edit: forget it i realize that i was dumb not to read the first post, fixed now

[metatron]

i think a .dll file is missing on your system. look for the mysql.dll and libmysql.dll!! it also can cause an error if the dll´s version is wrong.!

[Cyrus]

This one isnt based on this exploit, right?

[Peter Schmidt]

1) this is no exploit ( no overflow in it,.... )
2) every tools linked in my start posting are based on the advisory from nextgenss

[Killaloop]

exactly
people learn to read please
is it that hard?
there is a thread in exploit research that explains and links to all the needed information on how that thing works

and an exploit uses weakness or flaws in a software
this one uses a feature and only exploits the stupidity of administrators putting weak passes (or even no pass) on the most powerful account, the root account.

[Max_Payne]

thanks for the nice GUI interface m8...gonna study this one and see how it reacts

[Steffan]

Is there any Sourcecode for study purpose out here ???

Or any related threads for more information about used technics ?

Would be nice...

THX. in advance

[dennis28]

ok
the cmdget.exe works ok

downloaded a file from a website
but how to execute the file ???

[mandawar]

what about the good old Dos Command?!? @ dennis28
Mandawar

[[_-ViCiOuS-_]]

Is there any Sourcecode for study purpose out here ???

Or any related threads for more information about used technics ?

Would be nice...

THX. in advance

<{POST_SNAPBACK}>

http://www.nextgenss...oofingMySQL.pdf

[Meads]

Thanks for the gui man

Appreciate your work youve donea great job

[FiNaLBeTa]

Securing a mysql server with weak pass : http://www.kd-team.c...topic.php?t=319

[Action]

i get this error when try to create own binary:
[+] creating table 'own'...done
[-] error on writing own-code... You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'Into [own]([own])
values (0x496E7365727420496E746F205B6F776E5D
[+] creating own.exe in c:\\...done
[+] dropping table 'own'...done

tried all da shit i can]

i need the binary image column name!!

[studnikov]

I ve tried to use the technique posted about securing mysql, but it doesn't seem to work, ive created the bats, restarted the server and it is still vonerable to attack, any other way of fixing this hole remotly ?