5 ms·

Database access control is layers deep. Even if you had the MySQL passwords, you wouldn't be able to connect to the database servers.

bradleyland 16y ago
I'm not sure I follow. If you have root access on a machine that runs PHP web apps that connect to a MySQL server, you have, at a minimum, access to the databases those web apps relied upon. The web app MySQL credentials have to be supplied somewhere in the code.
- jjm 16y ago
  Possibly, the machines that got rooted were just the nodes running PHP code. Each 'site' may have database user/pass for their respective tables and not the DB root. However, if the servers that got rooted were the DBs then that would be very bad. You could dump, crack etc... There are other vectors to consider, such as 'workers/jobs' doing 'db cleanup' where they would need some 'dba' access.
- skeltoac 16y ago
  True. But the MySQL servers have layers of access control beyond passwords. The unauthorized access has been closed. So even if the attacker saved the passwords, they don't have the other factors for a MySQL connection.
  - jacques_chester 16y ago
    If they have root access on the PHP servers they still access all the data in MySQL by writing code like this: <?php $pwnd = mysql_select_or_whatever_it_is('select * from sensitive_tables'); ?> Like most LAMP applications Wordpress uses only one connection with total access to all tables. It's the same unavoidable design issue that causes plugins and themes to be a security issue.
- xuki 16y ago
  You can set it up such that the PHP app uses up all the available connection to the database and you can't connect unless you stop the PHP app (which people may notice).
  - iuguy 16y ago
    If you're thinking of limiting to the PHP worker process then all I have to do is wrap my SQL in PHP statements. I can still use SQL queries using the PHP worker which is a bit long winded but scriptable. I can then use LOAD_FILE and SELECT INTO to read and write to files, but I won't be able to execute arbitrary code. If the application user has access to mysql.user though I can then SELECT host, user, password FROM mysql.user; to get the credential details and password hashes, which can then be fed through a password cracker of my choice. Once I've done that I can reconfigure the worker to use the root mysql account, restart the PHP worker process and start sucking the database down or modifying it. Of course, in theory you'd have some access to the database server beyond port 3306 such as SSH, in which case I'd look at grabbing mysql account info from /etc/passwd, then dropping ssh keys into that user's home directory so I can use key-based auth to get onto the box. This may or may not work (there's many variables) but I'm just writing that here to illustrate that breaking in as is with perl, there's more than one way to do it.

bradleyland 16y ago

I'm not sure I follow. If you have root access on a machine that runs PHP web apps that connect to a MySQL server, you have, at a minimum, access to the databases those web apps relied upon. The web app MySQL credentials have to be supplied somewhere in the code.

jjm 16y ago
Possibly, the machines that got rooted were just the nodes running PHP code. Each 'site' may have database user/pass for their respective tables and not the DB root. However, if the servers that got rooted were the DBs then that would be very bad. You could dump, crack etc... There are other vectors to consider, such as 'workers/jobs' doing 'db cleanup' where they would need some 'dba' access.
skeltoac 16y ago
True. But the MySQL servers have layers of access control beyond passwords. The unauthorized access has been closed. So even if the attacker saved the passwords, they don't have the other factors for a MySQL connection.
- jacques_chester 16y ago
  If they have root access on the PHP servers they still access all the data in MySQL by writing code like this: <?php $pwnd = mysql_select_or_whatever_it_is('select * from sensitive_tables'); ?> Like most LAMP applications Wordpress uses only one connection with total access to all tables. It's the same unavoidable design issue that causes plugins and themes to be a security issue.
xuki 16y ago
You can set it up such that the PHP app uses up all the available connection to the database and you can't connect unless you stop the PHP app (which people may notice).
- iuguy 16y ago
  If you're thinking of limiting to the PHP worker process then all I have to do is wrap my SQL in PHP statements. I can still use SQL queries using the PHP worker which is a bit long winded but scriptable. I can then use LOAD_FILE and SELECT INTO to read and write to files, but I won't be able to execute arbitrary code. If the application user has access to mysql.user though I can then SELECT host, user, password FROM mysql.user; to get the credential details and password hashes, which can then be fed through a password cracker of my choice. Once I've done that I can reconfigure the worker to use the root mysql account, restart the PHP worker process and start sucking the database down or modifying it. Of course, in theory you'd have some access to the database server beyond port 3306 such as SSH, in which case I'd look at grabbing mysql account info from /etc/passwd, then dropping ssh keys into that user's home directory so I can use key-based auth to get onto the box. This may or may not work (there's many variables) but I'm just writing that here to illustrate that breaking in as is with perl, there's more than one way to do it.