鍍金池/ 問(wèn)答/Linux  數(shù)據(jù)庫(kù)/ mysql開(kāi)放端口,如何破壞mysql

mysql開(kāi)放端口,如何破壞mysql

我曾經(jīng)在Linux服務(wù)器(Ubuntu系統(tǒng))上,安裝了mysql服務(wù),并且開(kāi)放了 root的所有權(quán)限,外網(wǎng)也可以訪(fǎng)問(wèn),很簡(jiǎn)單的密碼123456,結(jié)果后來(lái)不知道什么緣故,數(shù)據(jù)庫(kù)崩潰了,而且連接不上,導(dǎo)致不得不重裝mysql,吸取經(jīng)驗(yàn)教訓(xùn)后,新建了用戶(hù),并且不開(kāi)放外網(wǎng)訪(fǎng)問(wèn)權(quán)限,而且使得新建的用戶(hù)擁有剛剛好的權(quán)限,密碼等都設(shè)置很復(fù)雜。通過(guò)查看error.log,看到了很多非法用戶(hù)訪(fǎng)問(wèn)了我的數(shù)據(jù)庫(kù),特此想請(qǐng)教:這些“黑客”是怎么破壞我的數(shù)據(jù)庫(kù),就算第一步能夠猜測(cè)出我root用戶(hù)的密碼,連接上數(shù)據(jù)庫(kù),然后可以干一些什么,來(lái)破壞我的數(shù)據(jù)庫(kù)?或者有什么類(lèi)似的書(shū)籍,可以推薦推薦,對(duì)于這方面,我還是完全的小白,希望大家?guī)兔獯?/p>

2017-06-02T19:10:15.136534Z 9 [Note] Aborted connection 9 to db: 'unconnected' user: 'root' host: '61.183.93.51' (Got an error reading communication packets)
2017-06-02T19:52:56.536963Z 184 [Warning] IP address '112.126.82.35' could not be resolved: Name or service not known
2017-06-02T19:52:56.785302Z 184 [Note] Access denied for user 'root'@'112.126.82.35' (using password: NO)
2017-06-02T19:52:57.622685Z 185 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:52:58.443990Z 186 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:52:59.211685Z 187 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:53:00.038428Z 188 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-03T00:14:58.529443Z 189 [Warning] IP address '222.134.193.2' could not be resolved: Name or service not known
2017-06-03T00:14:58.852414Z 189 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T00:14:59.767211Z 190 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T00:15:00.643125Z 191 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T03:55:26.601587Z 192 [Warning] IP address '123.249.0.134' could not be resolved: Temporary failure in name resolution
2017-06-03T03:55:29.959503Z 192 [Note] Access denied for user 'root'@'123.249.0.134' (using password: NO)
2017-06-03T03:55:43.592666Z 193 [Warning] IP address '123.249.0.134' could not be resolved: Temporary failure in name resolution
2017-06-03T03:55:43.867721Z 193 [Note] Access denied for user 'root'@'123.249.0.134' (using password: YES)
2017-06-03T04:30:34.923291Z 0 [Note] Giving 1 client threads a chance to die gracefully
2017-06-03T04:30:34.923557Z 0 [Note] Shutting down slave threads
2017-06-03T04:30:36.923775Z 0 [Note] Forcefully disconnecting 0 remaining clients
2017-06-03T04:30:36.923795Z 0 [Note] Event Scheduler: Purging the queue. 0 events
2017-06-03T04:30:36.923836Z 0 [Note] Binlog end
2017-06-03T04:30:36.929073Z 0 [Note] Shutting down plugin 'ngram'
2017-06-03T04:30:36.929084Z 0 [Note] Shutting down plugin 'partition'
2017-06-03T04:30:36.929086Z 0 [Note] Shutting down plugin 'ARCHIVE'
2017-06-03T04:30:36.929089Z 0 [Note] Shutting down plugin 'BLACKHOLE'
2017-06-03T04:30:36.929091Z 0 [Note] Shutting down plugin 'PERFORMANCE_SCHEMA'
2017-06-03T04:30:36.929108Z 0 [Note] Shutting down plugin 'CSV'
2017-06-03T04:30:36.929118Z 0 [Note] Shutting down plugin 'MyISAM'
2017-06-03T04:30:36.929129Z 0 [Note] Shutting down plugin 'MRG_MYISAM'
2017-06-03T04:30:36.929132Z 0 [Note] Shutting down plugin 'MEMORY'
2017-06-03T04:30:36.929134Z 0 [Note] Shutting down plugin 'INNODB_SYS_VIRTUAL'
2017-06-03T04:30:36.929137Z 0 [Note] Shutting down plugin 'INNODB_SYS_DATAFILES'
2017-06-03T04:30:36.929139Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESPACES'
2017-06-03T04:30:36.929141Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN_COLS'
2017-06-03T04:30:36.929142Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN'
2017-06-03T04:30:36.929144Z 0 [Note] Shutting down plugin 'INNODB_SYS_FIELDS'
2017-06-03T04:30:36.929146Z 0 [Note] Shutting down plugin 'INNODB_SYS_COLUMNS'
2017-06-03T04:30:36.929148Z 0 [Note] Shutting down plugin 'INNODB_SYS_INDEXES'
2017-06-03T04:30:36.929149Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESTATS'
2017-06-03T04:30:36.929151Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLES'
2017-06-03T04:30:36.929153Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_TABLE'
2017-06-03T04:30:36.929154Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_CACHE'
2017-06-03T04:30:36.929156Z 0 [Note] Shutting down plugin 'INNODB_FT_CONFIG'
2017-06-03T04:30:36.929157Z 0 [Note] Shutting down plugin 'INNODB_FT_BEING_DELETED'
2017-06-03T04:30:36.929159Z 0 [Note] Shutting down plugin 'INNODB_FT_DELETED'
2017-06-03T04:30:36.929161Z 0 [Note] Shutting down plugin 'INNODB_FT_DEFAULT_STOPWORD'
2017-06-03T04:30:36.929162Z 0 [Note] Shutting down plugin 'INNODB_METRICS'
2017-06-03T04:30:36.929164Z 0 [Note] Shutting down plugin 'INNODB_TEMP_TABLE_INFO'
2017-06-03T04:30:36.929166Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_POOL_STATS'
2017-06-03T04:30:36.929167Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE_LRU'
2017-06-03T04:30:36.929169Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE'
2017-06-03T04:30:36.929171Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX_RESET'
2017-06-03T04:30:36.929172Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX'
2017-06-03T04:30:36.929174Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM_RESET'
2017-06-03T04:30:36.929176Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM'
2017-06-03T04:30:36.929177Z 0 [Note] Shutting down plugin 'INNODB_CMP_RESET'
2017-06-03T04:30:36.929179Z 0 [Note] Shutting down plugin 'INNODB_CMP'
2017-06-03T04:30:36.929181Z 0 [Note] Shutting down plugin 'INNODB_LOCK_WAITS'
2017-06-03T04:30:36.929183Z 0 [Note] Shutting down plugin 'INNODB_LOCKS'
2017-06-03T04:30:36.929185Z 0 [Note] Shutting down plugin 'INNODB_TRX'
2017-06-03T04:30:36.929188Z 0 [Note] Shutting down plugin 'InnoDB'
2017-06-03T04:30:36.929385Z 0 [Note] InnoDB: FTS optimize thread exiting.
2017-06-03T04:30:36.929440Z 0 [Note] InnoDB: Starting shutdown...
2017-06-03T04:30:37.029561Z 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
2017-06-03T04:30:37.031470Z 0 [Note] InnoDB: Buffer pool(s) dump completed at 170603  0:30:37
2017-06-03T04:30:38.434892Z 0 [Note] InnoDB: Shutdown completed; log sequence number 2811011
2017-06-03T04:30:38.436582Z 0 [Note] InnoDB: Removed temporary tablespace data file: "ibtmp1"
2017-06-03T04:30:38.436591Z 0 [Note] Shutting down plugin 'sha256_password'
2017-06-03T04:30:38.436593Z 0 [Note] Shutting down plugin 'mysql_native_password'
2017-06-03T04:30:38.436686Z 0 [Note] Shutting down plugin 'binlog'
2017-06-03T04:30:38.437028Z 0 [Note] /usr/sbin/mysqld: Shutdown complete

2017-06-03T04:30:51.245428Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
2017-06-03T04:30:51.246404Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.18) starting as process 284 ...
2017-06-03T04:30:51.248307Z 0 [Note] InnoDB: PUNCH HOLE support available
2017-06-03T04:30:51.248325Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2017-06-03T04:30:51.248328Z 0 [Note] InnoDB: Uses event mutexes
2017-06-03T04:30:51.248331Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
2017-06-03T04:30:51.248340Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.3
2017-06-03T04:30:51.248342Z 0 [Note] InnoDB: Using Linux native AIO
2017-06-03T04:30:51.248715Z 0 [Note] InnoDB: Number of pools: 1
2017-06-03T04:30:51.248789Z 0 [Note] InnoDB: Using CPU crc32 instructions
2017-06-03T04:30:51.249535Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2017-06-03T04:30:51.254355Z 0 [Note] InnoDB: Completed initialization of buffer pool
2017-06-03T04:30:51.255453Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
2017-06-03T04:30:51.266552Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2017-06-03T04:30:51.271173Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2017-06-03T04:30:51.271207Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2017-06-03T04:30:51.275955Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2017-06-03T04:30:51.276435Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2017-06-03T04:30:51.276442Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2017-06-03T04:30:51.276622Z 0 [Note] InnoDB: Waiting for purge to start
2017-06-03T04:30:51.326752Z 0 [Note] InnoDB: 5.7.18 started; log sequence number 2811011
2017-06-03T04:30:51.326882Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2017-06-03T04:30:51.326997Z 0 [Note] Plugin 'FEDERATED' is disabled.
2017-06-03T04:30:51.328197Z 0 [Note] InnoDB: Buffer pool(s) load completed at 170603  0:30:51
2017-06-03T04:30:51.329795Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2017-06-03T04:30:51.329914Z 0 [Warning] CA certificate ca.pem is self signed.
2017-06-03T04:30:51.330900Z 0 [Note] Server hostname (bind-address): '*'; port: 3306
2017-06-03T04:30:51.330926Z 0 [Note] IPv6 is available.
2017-06-03T04:30:51.330932Z 0 [Note]   - '::' resolves to '::';
2017-06-03T04:30:51.330939Z 0 [Note] Server socket created on IP: '::'.
2017-06-03T04:30:51.335159Z 0 [Note] Event Scheduler: Loaded 0 events
2017-06-03T04:30:51.335236Z 0 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.7.18'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server (GPL)
2017-06-03T04:30:51.335243Z 0 [Note] Executing 'SELECT * FROM INFORMATION_SCHEMA.TABLES;' to get a list of tables using the deprecated partition engine. You may use the startup option '--disable-partition-engine-check' to skip this check. 
2017-06-03T04:30:51.335245Z 0 [Note] Beginning of list of non-natively partitioned tables
2017-06-03T04:30:51.340815Z 0 [Note] End of list of non-natively partitioned tables
2017-06-03T04:33:26.330159Z 3 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:33:36.966534Z 4 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:33:48.429292Z 5 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:34:11.914284Z 6 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:35:42.507762Z 7 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:36:09.545474Z 8 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T05:33:53.491224Z 10 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T06:44:43.843841Z 3 [Note] Aborted connection 3 to db: 'unconnected' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
2017-06-03T06:53:39.062842Z 4 [Note] Aborted connection 4 to db: '×××××××××' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
2017-06-03T06:53:58.975088Z 8 [Note] Aborted connection 8 to db: '×××××××××' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
回答
編輯回答
凹凸曼

你好, 你所描述的問(wèn)題是一個(gè)非常初級(jí)的 web黑 領(lǐng)域問(wèn)題。

在暴露有公網(wǎng)權(quán)限的mysql數(shù)據(jù)庫(kù)的情況下,黑客通常是無(wú)目的性地遍歷全網(wǎng)ip地址進(jìn)行端口掃描(最知名的工具非nmap莫屬了,開(kāi)源免費(fèi)的),通過(guò)tcp連接當(dāng)中的一些字段信息(被俗稱(chēng)指紋)來(lái)確定這是一個(gè)暴露在公網(wǎng)的mysql服務(wù)。
發(fā)現(xiàn)了mysql服務(wù)后,通常會(huì)猜測(cè)一些可能的username password排列組合,這在安全技術(shù)當(dāng)中俗稱(chēng)暴破攻擊,然后由于root admin這種username是使用的最多的,很多新手都會(huì)使用 因?yàn)槭悄J(rèn)的,所以他們往往會(huì)猜測(cè)這些value。
然后你可能會(huì)問(wèn),那么密碼他怎么知道該猜些什么? 網(wǎng)上其實(shí)流傳有很多免費(fèi)的密碼字典,這些往往最初是從黑市上流傳出來(lái)的,一般是一些大網(wǎng)站遭遇拖庫(kù)攻擊之后泄露的, 黑客一般會(huì)采取首先手動(dòng)輸入幾個(gè)詞 之后用自動(dòng)化工具批量嘗試密碼。
再教你個(gè)小技巧,如果你也想搞一些密碼字典來(lái)用, 除了去網(wǎng)上找這種字典之外,還有個(gè)更簡(jiǎn)單的辦法, 就是故意開(kāi)設(shè)一個(gè)公網(wǎng)mysql服務(wù),端口設(shè)默認(rèn)的3306, 故意引誘黑客來(lái)掃你, 然后在日志里去捕撈黑客們免費(fèi)送給你的這些密碼,去重后你就整理出了自己的一份密碼字典~ 這個(gè)思路 在安全技術(shù)領(lǐng)域中 被稱(chēng)為“蜜罐”。

這些是比較入門(mén)級(jí)的 web黑客 伎倆,掃你端口的多半是些初學(xué)的腳本小子,如果說(shuō)書(shū)籍推薦的話(huà), 對(duì)于web黑客領(lǐng)域, 最為經(jīng)典的應(yīng)該當(dāng)屬 道哥的《白帽子講web安全》 和 余弦的《web前端黑客技術(shù)揭秘》。
以上兩本比較經(jīng)典,還有些新書(shū),買(mǎi)的話(huà)注意出版的年份 別買(mǎi)太早的。

希望能幫到你,有問(wèn)題請(qǐng)留言或關(guān)注我 微博: https://weibo.com/u/5114485810 推特:https://twitter.com/zhu_yingda

2018年6月18日 16:45