MySQL has a weird feature, by default enabled in many clients, that the server can request a file from the client. I have requested /etc/shadow, cracked the ha

MySQL has a weird feature, by default enabled in many clients, that the server can request a file from the client. I have requested /etc/shadow, cracked the hash for root password, and ssh'd back into the botnet node that was bruteforcing passwords. I then shared the information with the webhoster where the botnet was running and a local infamous antivirus company (Avast before it was leaked that they are evil) and got a t-shirt. https://www.abclinuxu.cz/blog/jenda/2019/2/exploiting-mysql-arbitrary-file-read-a-honeypot-that-kicks https://www.abclinuxu.cz/blog/jenda/2019/2/exploiting-mysql-...