All right, my name is Alex, and I'm a principal security engineer at Dramasum
The Services.
This is about us slide pretty much.
Also, here is Martin, who is not here.
Martin is my colleague, who is taking part in security research on databases.
Again, I don't have an additional slide for the introduction.
So again, my name is Alex.
My background is my SKL.
I have been working with my SKL more than 20 years.
I think at this point, and I joined my SKL AB in 2006.
I worked at Sun Microsystems Oracle, Percona, and then four years ago I joined Amazon
Pub Services, and I created the new team, which is called Red Team.
And this is, this talk is called Atomic Honeypot.
And this is the result of our database research against security research against my SKL.
So let's start.
So this is our agenda for the day.
First of all, we will start by creating a high interaction my SKL Honeypot.
And then I will explain why it's important, why we need a high interaction my SKL Honeypot.
When we have a Honeypot, the next step is going Atomic.
So what does it really mean?
Over the years, we have been finding the security issues in my SKL client.
And we did a presentation recently, which is called my SKL server, Kinatek You.
It actually, unusual thing, many people don't realize that it's possible.
The my SKL protocol is designed that way that actually a rogue server can tell the client what to do.
It can tell the client to load a plugin.
And we found this in 2023.
And in 2024, we also found another my SKL client issue, which affects my SKL dump.
And then today, I will be doing some demo in providing the details how it works.
And then finally step 3, we were thinking of how we can actually use all that stuff for good.
And then we realized that there are lots of bots attacking the databases.
And what we really wanted to do is to understand how that attacks are executed.
We wanted to see what's the code, what's the methodology, and stuff like that.
So we created the Atomic Honeypot, which actually strikes back.
And I explained what that means and how it works.
All right, let's start with this.
If you don't know, bots are everywhere, and my SKL server, and you, my SKL server, is under attack.
So they're scanning the network, they're scanning known ports.
And they're doing it very fast.
And database server is obviously a big target.
All right, a bot will try to find the server, try to use an old CVE, and try to do bad things.
So we wanted to understand what kind of attacks we're talking about, what they're doing.
So this is our original design.
Very simple.
We put a MySQL Honeypot server.
We open it from the internet, listening on port 336.
And then when you do that, you realize that immediately, almost immediately, someone will try to connect.
Now, let's go back and talk about MySQL protocol.
MySQL protocol is server initiated.
So if you just started a listener, a TCP listener, and then we'll be hoping that someone will connect, it will not happen.
MySQL client will not connect to just TCP, it needs this prompt.
So this prompt actually, this prompt will give you the version, the salt for the MySQL authentication and the plugin.
So basically, just creating a listener is not enough.
If you want to do the Honeypot, you need to implement MySQL protocol.
And the good news is there are lots of implementations of MySQL protocols.
One of them is in Python.
So this is a library in Python.
It can implement a fake MySQL server with MySQL protocol embedded in it.
So it's very, very simple.
So I created a prototype of high interaction MySQL Honeypot.
And then we started this Honeypot, and then we started seeing interesting things.
Connections are coming in, attacks are going.
And then this is the very interesting stuff that MySQL protocol supports called connection attributes.
Similar to HTTP user agent.
You can see the platform, client version, operating system, and even the program name from that.
So this is how MySQL defining those attributes in the documentation.
And this is something that we started collecting.
This is from the real attacks.
And then we can see that they're using a different client names.
They're using different client versions.
They're using different operating systems.
And also we can immediately see the client name.
So lots of useful info from that address.
And then we have identified two major attacks on MySQL.
Now if you run the Honeypot, you see everything.
You see the queries.
You see the connection attributes.
You see basically we started collecting fingerprints.
And this is one of the fingerprints that we collected from this of them.
So what this attack is doing is it tries to connect to the server and tries to install a malware on that server.
Right on Linux.
And on Windows as well.
So it's actually trying to write to a shared library plugin to put the file in there.
And we traced all that stuff.
Now this is less interesting because it's only works on a really, really old MySQL server.
The second attack is a completely different attack.
This is a ransomware attack.
This actually happened.
And this is many people actually been affected by this one.
So basically if you expose your MySQL server to the internet,
especially on ports 3606, you will get those guys.
And they will try and to brute force the passwords.
Connect to the database.
And then they will try to download your database.
And then remove the database and put the ransomware note.
Basically pay me something I'll give you.
I'll give you the database back.
And this is one of the attacks that we want to know about.
I want to trace and see what they're doing.
Here's what is interesting here.
See, there's a MySQL dump here.
We know that this is MySQL dump.
In this attack. Remember this.
All right.
So now, at this point, we were thinking,
Well, how do we actually create an atomic honeypot?
All right. Now, atomic honeypot will strike back.
So we again, we want to interact with the attackers,
and we want to download the code.
And then we started thinking, how we can do that.
And we started juggling with the CDs.
There are three CDs that we can potentially use here.
The first is called MySQL client arbitrary file.
It's very old, very old, from 2020.
The second one is the MySQL client RCE.
We actually found the modification of that.
In 2023 presented, this is basically this is the MySQL server
attacks you presentation.
And then finally, in 2024 we found an issue in MySQL dump.
So let me, this is probably one of the most important slides here.
And I will try to explain and real quick how those two things works.
MySQL client arbitrary read.
Basically, it's a server protocol.
MySQL server protocol issue.
It's very well known.
You can read this book post.
Basically a server can request a file and arbitrary file
from the client using load data in file.
The second one is actually more interesting.
This is less known in the community.
And the idea is that MySQL protocol
works with a plugable authentication.
You can write your plugin authentication plugin.
But the consequences of that is that the MySQL server and the client
will need to communicate which plugin they will be using.
So MySQL client will ask the server which plugin you want.
And the server will say, I want this plugin.
Then MySQL client will try to load a shared library.
So the plugin is actually a shared library name.
So this is how it works.
So if we have an ability to somehow upload an arbitrary file,
a shared library to the client, then during this communication,
between the server and the client,
server can push the arbitrary plugin name.
And then we found there is a directory traversal in it.
So this has been fixed.
You can read this.
You can look at the slides.
We presented a hitby conference in 2023.
So we have been looking at those and trying to figure out
how we can actually use that to do the atomic kind of thing.
And then finally, this is, I will be talking into details
about the MySQL dump one.
This is the RCE that we found in 2024.
So MySQL dump database backup program.
Everyone is using it.
And then MySQL dump will connect to a server and receive the SQL statements.
Now this is from the MySQL documentation webpage.
This is how you copy one database to another database.
You do MySQL dump on a server,
on your client machine, maybe on a web server,
I don't know, connect to one server,
then you pipe whatever you're getting from the MySQL dump
to MySQL client, which connects to another server.
What can happen here?
The thing is, MySQL,
common client have that ability to execute a command.
It can do file rights also.
But this is the same system, right?
If you put backslash exclamation mark,
followed by the OS command,
and then you put it into MySQL client,
then you execute this command.
So this is one of the simplest command execution
attacking the client.
So MySQL dump can connect to a server.
It's a rogue server, it's my server that I control,
and then I can push whatever there.
Now, what's the limitations?
Usually, MySQL dump do a very good job
on escaping this.
If you have a backtick around this,
that will not be interpreted as a system.
But we found a super simple way to exploit it,
really simple, right?
So this is the MySQL dump source code before the effects.
What it's doing, it reading the connection
from the server.
And then putting it as this is the output, right?
So if we control the server, we control everything.
We can change the version number,
and put end of line there in our command system command.
So this is one of the,
I would say, simplest change to the source code,
one line change can make this a rogue server.
Right? You put a server version here,
you see there's an end of line, and then a system command.
And then I connect, I compile this server,
and I connect it with a Telnet, and this is what they see.
And then we have MySQL dump,
we connect in to the server.
Yeah, this is MySQL dumps 57,
but before the effects in 80 was the same thing.
Right? You connect to the server,
and then this is what it will produce.
Now you pipe it to the MySQL command line,
and then we have a arbitrary code execution.
It's on the client, keep in mind, right?
It's on the client.
So basically people ask me about the risk.
What's the risk? You don't connect to an uncasted server, right?
But think about this.
Maybe your database has been hacked.
Maybe someone found an SQL injection in your database.
Now the good news is you have backup.
So you do this.
Now your backup is poisoned.
Your client connection is hacked.
Right? This is pretty bad.
There's a big risk here.
Right? So that has been fixed in all versions.
MySQL server has been fixed.
And my RGB server has been fixed.
So two things, first of all,
you need to upgrade if you didn't.
And second is, don't do this.
All right, going back to the offensive stuff.
We created this,
Honeypot, MySQL,
and implemented those two things.
So now this Honeypot can stride back.
It can use the connection string.
Basically you can pass the payload.
Whatever command you want to execute,
it will generate the version string.
And you can also use this plugin name,
which I talked about.
Now back to the atomic honeypot.
So here's the demo of how mySQL dump works
with the atomic honeypot.
So we have created this Windows payload.
Just for fun.
And then we run this Honeypot
with a version string payload.
This payload will allow you to download this payload
from our own HTTP server and then execute it.
Right? And then basically to demonstrate,
it will just show Windows you have been formed.
All right?
So next,
again this is the payload.
We will start the HTTP server to be able to download this payload.
Then we check the version.
Then we use mySQL dump to connect to our atomic honeypot.
There we go.
So basically mySQL dump downloaded this
and executed the arbitrary code.
So now let's see how we can actually do the counter attacks.
So basically the attack number one
is trying to take over your MySQL server.
And this is the fingerprints that we can see.
Here's the fingerprints that we can see.
First of all, we can see that it's running on Windows.
Second, we know the version.
It's a really old version.
So we actually don't know if it has the RCE in a plugin or not.
And then we don't see mySQL dump.
Right? If we would see mySQL dump,
we'll see the program name.
So we can use this client arbitrary file read.
And we can actually see how it works.
This is a quick demo here.
All right? So basically anyone can do that.
You just download this rogue SQL Python script.
Run it.
And then specify which file you want to copy.
And then in this case, I connect with mySQL.
I connect to mySQL.
And there we go.
The password file from the client has been downloaded.
And then I can see this file.
All right? So we wanted to do the same.
And we wanted to download.
So now we wanted first of all to understand which version of Windows is it.
How do you do that? When there are lots of a number of files you can download and see what this version of Windows.
And actually we figured out that this is a really old server.
Like Windows Server 2003.
Maybe it's a HP. I don't know.
So this is how you can get the file from the remote server.
Another thing that we were trying to do is we were trying to use this RCEB plugin.
And this is where we sort of failed.
So the question is, how do you push the GGL file to that attack aside?
This is the main, like if it's on Windows.
This is the main limitation of this, exploit.
The main limitation of this exploit is that you need to have something to trigger to do a GL open or load library.
So we were thinking maybe we can somehow upload this file.
And then we started collecting the, we started collecting the fingerprints from the server.
And this is what we found.
So this is the part of the attack.
This is what those guys are trying to do.
Right? They are trying to upload the, they're trying to upload the shell.
And they're using their own FTP server to do that.
Right? So they open the port.
So in theory, what we could have done is we can, we could have upload our file using that FTP server.
Right? And we know the port, we know the port, we know the username, we know the password.
Right? And this is the plan.
We upload the GGL to public location of FTP server.
Then we run the atomic honeypot and trigger the GGL load and then we'll get shell.
Actually, we did it as a simulation.
And here's how it would have worked if we would use that.
So this is a demo of the simulation.
So let's imagine that we have an FTP server there.
Right? A username, password, whatever.
Then we put this Eval DLL to that server.
Right? And then we start our honeypot.
We start our atomic honeypot.
And then we'll wait until the attackers will connect.
Right? We assume here that the public download is user's public download.
Right? And then we do the traversal directory traversal.
And we specify the directory traversal to that path.
Assuming that this is the path that we uploaded the file in.
And let's see, this is the launch.
Now we will wait until they will connect.
And this is our DLL. We compile this DLL to basically create, like, start a window.
And let's see how it will work.
We have this Maya's Kiel. All the version of Maya's Kiel here.
Maya's Kiel client. Maya's Kiel come and learn client.
So we connect to that toast with the honeypot. Yep? Five minutes.
And you have been calling.
Right? So we successfully did a simulation of how we would have done that.
All right. So we have successfully downloaded our retail file.
And then we have done the RCE via plugin as a simulation.
And then this is actually more interesting stuff.
So we collected this fingerprint from the ransomware attack.
And then we see that this is a new version of Maya's Kiel.
Maria's Kiel client. So there is no arbitrary file read.
There is no RCE via plugin.
But we can actually see Maya's Kiel dump here.
Right? So our hope was that we can actually create a Maya's Kiel dump payload
and execute something.
So we have been then trying to see first what they're doing.
Right? Why Maya's Kiel dump?
And this is the queries that we can see.
This is clearly the fingerprint of the Maya's Kiel dump command.
Right? And then this is what they're doing.
They're doing select from transactions.
Consection is the table that I generated in the Honeyboard, just the fake name.
Right? And then they're doing a backup.
What they're trying to do is they're trying to backup 10 records out of each table.
And the reason for that is that imagine that you being hacked by ransomware
and say give me whatever thousand dollars and they will bring your database back.
Now how do I trust them?
Right? And then what they're doing is that downloading only 10 records
and they will show you here the 10 records of your database.
We have everything, right?
But we clearly see they never download the whole thing.
It will be really hard, right?
To download the terabytes of data stored somewhere, right?
It's not logical. This is all wood.
There's no real people there I guess.
All wood. So they download 10 records.
And they drop the database. They will drop your database.
Basically scanning all that database as they will drop the database
and they replace it with this, read me out, and with that database name.
Right? So don't pay.
It's useless. 10 records.
Unless you want to turn records back.
All right. So we have been started brainstorming.
How we can do that?
We can not download arbitrary file. We can not execute it via plugin.
And then this Maya scale dump thing.
We have started thinking how this has been designed.
So from the fingerprints, we see this path.
First, it uses my read to be connector.
So it's probably some application.
Then suddenly, Maya scale dump is connecting to our server.
Then back to the my read to be connector.
So we also see that they're sending our table names
and database names back to us.
So maybe we can do some different thing.
Maybe we can, if we can throw the database name,
we can throw the table name. Can we use it?
So we're thinking, is there really a command injection there?
And it was exactly that. It was a command injection.
So basically, whatever you put in the schema name, in a table name
and you control everything, of course.
Go to that, inject it as a command,
and you will receive it back.
So this is one of the way how you can download stuff
without really executing the code, without the reward shell.
So you do base 64, you get it back, you base 64 decode,
and then you get it.
So it's a command injection.
We downloaded the code.
This is the part of the code.
What we know is, what we know is they are doing a math scan
to find all your servers, connect to the servers, do this.
MySQL dump, and the open, all that stuff.
They're also doing one good example.
It's actually eventually it's all attacked.
Yeah, I'm always done.
So, last slide, how to try it at home.
You don't even need the honeypot.
You start a normal mySQL server,
any version, read only password.
You can, you create a database.
You put the command injection there.
That's it.
I haven't tried that for a year ago.
They make a fix that.
I don't know.
All right.
That's it.
Thank you very much.
Atomicsanipot.com.
Do we have questions?
Okay.
One question, one minute of questions.
Any questions?
Yes.
So, you're attacked by assuming day and hour scale injection
as well.
Command injection.
You know, they will fix the escalation.
How many such roles do you think you're doing?
I don't know.
It's ideas.
Initially, when we looked at the code, it was like everywhere.
It was like database name,
command injection, schema name, command injection.
Everywhere.
But we come and check that after that.
Thank you very much.
All right.
Thank you.