raptor_udf

MySQL/MariaDB UDF privesc (do_system as the service account).

Classic MySQL/MariaDB UDF (User Defined Function) privesc: compiles a library (raptor_udf2) that adds a do_system function and runs commands as the service account, often root.

Family Databases

Flags CREATE FUNCTION sys_exec

Concepts MySQL UDF abuse (raptor_udf2)

Cheatsheet MySQL / MariaDB · 3306

Installation

searchsploit -m 1518   # raptor_udf2.c (o 46996)

Repositoryexploit-db.com/exploits/1518

Useful commands2 commands

Appears in

Some machines where its use is documented; not an exhaustive list.

PebblesProving Grounds Practice