12 Antworten in diesem Thema

[len0]

Morgen zusammen,

habe duch zufall die Backupdaten (SQL-Host,User,Pass usw.) eines Bitcoin Exchangers gefunden.

Scheint auch ein sehr großes Unternehmen zu sein. Täglich 400 Trades.

Meine frage wäre nun, was ich damit am sinnvollsten anstelle bevor ich mich, "vielleicht" einmalig einlogge.

Shell, Backdoor?

 

Gruß

[B1nary]

Das kommt ganz darauf an, was du erreichen willst. Mit einer Shell könntest du den Server übernehmen oder aber auch den Source Code derart manipulieren, dass du Bitcoins abfangen kannst. It's up to you

[len0]

Mhh, die Daten sind Valid.

Allerdings ist das die DB von dem "phplive"

Information_schema und die phplive DB lassen sich auslesen.

Kommt man irgendwie weiter?

[FalkE]

Mhh, die Daten sind Valid.

Allerdings ist das die DB von dem "phplive"

Information_schema und die phplive DB lassen sich auslesen.

Kommt man irgendwie weiter?

was hast du denn für rechte?

[len0]

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| phplive            |
+--------------------+
2 rows in set (0.09 sec)

mysql> FLUSH PRIVILEGES;
ERROR 1227 (42000): Access denied; you need (at least one of) the RELOAD privilege(s) for this operation

Ist das überhaupt der richtige Weg, um die Rechte zu erfahren?

[Erikson]

SHOW GRANTS FOR 'user'@'localhost'

[len0]

Danke!

Allerdings führt das scheinbar zu nichts:

mysql> SHOW GRANTS FOR 'phplive'@'localhost';
ERROR 1141 (42000): There is no such grant defined for user 'phplive' on host 'localhost'

Hatte auch statt "localhost" den Host vom Exchanger probiert, bekomme aber das selber ergeniss...

[Cranky]

SHOW PRIVILEGES;

[len0]

Ergeniss:

mysql> SHOW PRIVILEGES;
+-------------------------+---------------------------------------+-------------------------------------------------------+
| Privilege               | Context                               | Comment                                               |
+-------------------------+---------------------------------------+-------------------------------------------------------+
| Alter                   | Tables                                | To alter the table                                    |
| Alter routine           | Functions,Procedures                  | To alter or drop stored functions/procedures          |
| Create                  | Databases,Tables,Indexes              | To create new databases and tables                    |
| Create routine          | Databases                             | To use CREATE FUNCTION/PROCEDURE                      |
| Create temporary tables | Databases                             | To use CREATE TEMPORARY TABLE                         |
| Create view             | Tables                                | To create new views                                   |
| Create user             | Server Admin                          | To create new users                                   |
| Delete                  | Tables                                | To delete existing rows                               |
| Drop                    | Databases,Tables                      | To drop databases, tables, and views                  |
| Event                   | Server Admin                          | To create, alter, drop and execute events             |
| Execute                 | Functions,Procedures                  | To execute stored routines                            |
| File                    | File access on server                 | To read and write files on the server                 |
| Grant option            | Databases,Tables,Functions,Procedures | To give to other users those privileges you possess   |
| Index                   | Tables                                | To create or drop indexes                             |
| Insert                  | Tables                                | To insert data into tables                            |
| Lock tables             | Databases                             | To use LOCK TABLES (together with SELECT privilege)   |
| Process                 | Server Admin                          | To view the plain text of currently executing queries |
| Proxy                   | Server Admin                          | To make proxy user possible                           |
| References              | Databases,Tables                      | To have references on tables                          |
| Reload                  | Server Admin                          | To reload or refresh tables, logs and privileges      |
| Replication client      | Server Admin                          | To ask where the slave or master servers are          |
| Replication slave       | Server Admin                          | To read binary log events from the master             |
| Select                  | Tables                                | To retrieve rows from table                           |
| Show databases          | Server Admin                          | To see all databases with SHOW DATABASES              |
| Show view               | Tables                                | To see views with SHOW CREATE VIEW                    |
| Shutdown                | Server Admin                          | To shut down the server                               |
| Super                   | Server Admin                          | To use KILL thread, SET GLOBAL, CHANGE MASTER, etc.   |
| Trigger                 | Tables                                | To use triggers                                       |
| Create tablespace       | Server Admin                          | To create/alter/drop tablespaces                      |
| Update                  | Tables                                | To update existing rows                               |
| Usage                   | Server Admin                          | No privileges - allow connect only                    |
+-------------------------+---------------------------------------+-------------------------------------------------------+
31 rows in set (0.09 sec)

mysql> 

[Cranky]

mein fehler versuchs damit:

SHOW GRANTS FOR CURRENT_USER;

[len0]

mysql> SHOW GRANTS FOR CURRENT_USER;
+--------------------------------------------------------------------------------------------------------+
| Grants for phplive@%                                                                                   |
+--------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'phplive'@'%' IDENTIFIED BY PASSWORD '*C829344D20B6205798E2E234FSD92BD2486658A2' |
| GRANT ALL PRIVILEGES ON `phplive`.* TO 'phplive'@'%'                                                   |
+--------------------------------------------------------------------------------------------------------+
2 rows in set (0.07 sec)

Heißt volle rechte?!

[Cranky]

mysql> SHOW GRANTS FOR CURRENT_USER;
+--------------------------------------------------------------------------------------------------------+
| Grants for phplive@%                                                                                   |
+--------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'phplive'@'%' IDENTIFIED BY PASSWORD '*C829344D20B6205798E2E234FSD92BD2486658A2' |
| GRANT ALL PRIVILEGES ON `phplive`.* TO 'phplive'@'%'                                                   |
+--------------------------------------------------------------------------------------------------------+
2 rows in set (0.07 sec)

Heißt volle rechte?!

 

scheint so auszusehen

 

Jetzt würd ich vorsichtiger vorgehen wenn ich du wär

[len0]

SE?

Ja wird langsam ne Nummer zu heavy, ich melde die lücke wohl lieber...