鍍金池/ 問答/Linux  數(shù)據(jù)庫/ mysql開放端口,如何破壞mysql

mysql開放端口,如何破壞mysql

我曾經(jīng)在Linux服務(wù)器(Ubuntu系統(tǒng))上,安裝了mysql服務(wù),并且開放了 root的所有權(quán)限,外網(wǎng)也可以訪問,很簡單的密碼123456,結(jié)果后來不知道什么緣故,數(shù)據(jù)庫崩潰了,而且連接不上,導(dǎo)致不得不重裝mysql,吸取經(jīng)驗(yàn)教訓(xùn)后,新建了用戶,并且不開放外網(wǎng)訪問權(quán)限,而且使得新建的用戶擁有剛剛好的權(quán)限,密碼等都設(shè)置很復(fù)雜。通過查看error.log,看到了很多非法用戶訪問了我的數(shù)據(jù)庫,特此想請教:這些“黑客”是怎么破壞我的數(shù)據(jù)庫,就算第一步能夠猜測出我root用戶的密碼,連接上數(shù)據(jù)庫,然后可以干一些什么,來破壞我的數(shù)據(jù)庫?或者有什么類似的書籍,可以推薦推薦,對于這方面,我還是完全的小白,希望大家?guī)兔獯?/p>

2017-06-02T19:10:15.136534Z 9 [Note] Aborted connection 9 to db: 'unconnected' user: 'root' host: '61.183.93.51' (Got an error reading communication packets)
2017-06-02T19:52:56.536963Z 184 [Warning] IP address '112.126.82.35' could not be resolved: Name or service not known
2017-06-02T19:52:56.785302Z 184 [Note] Access denied for user 'root'@'112.126.82.35' (using password: NO)
2017-06-02T19:52:57.622685Z 185 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:52:58.443990Z 186 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:52:59.211685Z 187 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-02T19:53:00.038428Z 188 [Note] Access denied for user 'root'@'112.126.82.35' (using password: YES)
2017-06-03T00:14:58.529443Z 189 [Warning] IP address '222.134.193.2' could not be resolved: Name or service not known
2017-06-03T00:14:58.852414Z 189 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T00:14:59.767211Z 190 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T00:15:00.643125Z 191 [Note] Access denied for user 'root'@'222.134.193.2' (using password: YES)
2017-06-03T03:55:26.601587Z 192 [Warning] IP address '123.249.0.134' could not be resolved: Temporary failure in name resolution
2017-06-03T03:55:29.959503Z 192 [Note] Access denied for user 'root'@'123.249.0.134' (using password: NO)
2017-06-03T03:55:43.592666Z 193 [Warning] IP address '123.249.0.134' could not be resolved: Temporary failure in name resolution
2017-06-03T03:55:43.867721Z 193 [Note] Access denied for user 'root'@'123.249.0.134' (using password: YES)
2017-06-03T04:30:34.923291Z 0 [Note] Giving 1 client threads a chance to die gracefully
2017-06-03T04:30:34.923557Z 0 [Note] Shutting down slave threads
2017-06-03T04:30:36.923775Z 0 [Note] Forcefully disconnecting 0 remaining clients
2017-06-03T04:30:36.923795Z 0 [Note] Event Scheduler: Purging the queue. 0 events
2017-06-03T04:30:36.923836Z 0 [Note] Binlog end
2017-06-03T04:30:36.929073Z 0 [Note] Shutting down plugin 'ngram'
2017-06-03T04:30:36.929084Z 0 [Note] Shutting down plugin 'partition'
2017-06-03T04:30:36.929086Z 0 [Note] Shutting down plugin 'ARCHIVE'
2017-06-03T04:30:36.929089Z 0 [Note] Shutting down plugin 'BLACKHOLE'
2017-06-03T04:30:36.929091Z 0 [Note] Shutting down plugin 'PERFORMANCE_SCHEMA'
2017-06-03T04:30:36.929108Z 0 [Note] Shutting down plugin 'CSV'
2017-06-03T04:30:36.929118Z 0 [Note] Shutting down plugin 'MyISAM'
2017-06-03T04:30:36.929129Z 0 [Note] Shutting down plugin 'MRG_MYISAM'
2017-06-03T04:30:36.929132Z 0 [Note] Shutting down plugin 'MEMORY'
2017-06-03T04:30:36.929134Z 0 [Note] Shutting down plugin 'INNODB_SYS_VIRTUAL'
2017-06-03T04:30:36.929137Z 0 [Note] Shutting down plugin 'INNODB_SYS_DATAFILES'
2017-06-03T04:30:36.929139Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESPACES'
2017-06-03T04:30:36.929141Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN_COLS'
2017-06-03T04:30:36.929142Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN'
2017-06-03T04:30:36.929144Z 0 [Note] Shutting down plugin 'INNODB_SYS_FIELDS'
2017-06-03T04:30:36.929146Z 0 [Note] Shutting down plugin 'INNODB_SYS_COLUMNS'
2017-06-03T04:30:36.929148Z 0 [Note] Shutting down plugin 'INNODB_SYS_INDEXES'
2017-06-03T04:30:36.929149Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESTATS'
2017-06-03T04:30:36.929151Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLES'
2017-06-03T04:30:36.929153Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_TABLE'
2017-06-03T04:30:36.929154Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_CACHE'
2017-06-03T04:30:36.929156Z 0 [Note] Shutting down plugin 'INNODB_FT_CONFIG'
2017-06-03T04:30:36.929157Z 0 [Note] Shutting down plugin 'INNODB_FT_BEING_DELETED'
2017-06-03T04:30:36.929159Z 0 [Note] Shutting down plugin 'INNODB_FT_DELETED'
2017-06-03T04:30:36.929161Z 0 [Note] Shutting down plugin 'INNODB_FT_DEFAULT_STOPWORD'
2017-06-03T04:30:36.929162Z 0 [Note] Shutting down plugin 'INNODB_METRICS'
2017-06-03T04:30:36.929164Z 0 [Note] Shutting down plugin 'INNODB_TEMP_TABLE_INFO'
2017-06-03T04:30:36.929166Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_POOL_STATS'
2017-06-03T04:30:36.929167Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE_LRU'
2017-06-03T04:30:36.929169Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE'
2017-06-03T04:30:36.929171Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX_RESET'
2017-06-03T04:30:36.929172Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX'
2017-06-03T04:30:36.929174Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM_RESET'
2017-06-03T04:30:36.929176Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM'
2017-06-03T04:30:36.929177Z 0 [Note] Shutting down plugin 'INNODB_CMP_RESET'
2017-06-03T04:30:36.929179Z 0 [Note] Shutting down plugin 'INNODB_CMP'
2017-06-03T04:30:36.929181Z 0 [Note] Shutting down plugin 'INNODB_LOCK_WAITS'
2017-06-03T04:30:36.929183Z 0 [Note] Shutting down plugin 'INNODB_LOCKS'
2017-06-03T04:30:36.929185Z 0 [Note] Shutting down plugin 'INNODB_TRX'
2017-06-03T04:30:36.929188Z 0 [Note] Shutting down plugin 'InnoDB'
2017-06-03T04:30:36.929385Z 0 [Note] InnoDB: FTS optimize thread exiting.
2017-06-03T04:30:36.929440Z 0 [Note] InnoDB: Starting shutdown...
2017-06-03T04:30:37.029561Z 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
2017-06-03T04:30:37.031470Z 0 [Note] InnoDB: Buffer pool(s) dump completed at 170603  0:30:37
2017-06-03T04:30:38.434892Z 0 [Note] InnoDB: Shutdown completed; log sequence number 2811011
2017-06-03T04:30:38.436582Z 0 [Note] InnoDB: Removed temporary tablespace data file: "ibtmp1"
2017-06-03T04:30:38.436591Z 0 [Note] Shutting down plugin 'sha256_password'
2017-06-03T04:30:38.436593Z 0 [Note] Shutting down plugin 'mysql_native_password'
2017-06-03T04:30:38.436686Z 0 [Note] Shutting down plugin 'binlog'
2017-06-03T04:30:38.437028Z 0 [Note] /usr/sbin/mysqld: Shutdown complete

2017-06-03T04:30:51.245428Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
2017-06-03T04:30:51.246404Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.18) starting as process 284 ...
2017-06-03T04:30:51.248307Z 0 [Note] InnoDB: PUNCH HOLE support available
2017-06-03T04:30:51.248325Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2017-06-03T04:30:51.248328Z 0 [Note] InnoDB: Uses event mutexes
2017-06-03T04:30:51.248331Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
2017-06-03T04:30:51.248340Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.3
2017-06-03T04:30:51.248342Z 0 [Note] InnoDB: Using Linux native AIO
2017-06-03T04:30:51.248715Z 0 [Note] InnoDB: Number of pools: 1
2017-06-03T04:30:51.248789Z 0 [Note] InnoDB: Using CPU crc32 instructions
2017-06-03T04:30:51.249535Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2017-06-03T04:30:51.254355Z 0 [Note] InnoDB: Completed initialization of buffer pool
2017-06-03T04:30:51.255453Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
2017-06-03T04:30:51.266552Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2017-06-03T04:30:51.271173Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2017-06-03T04:30:51.271207Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2017-06-03T04:30:51.275955Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2017-06-03T04:30:51.276435Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2017-06-03T04:30:51.276442Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2017-06-03T04:30:51.276622Z 0 [Note] InnoDB: Waiting for purge to start
2017-06-03T04:30:51.326752Z 0 [Note] InnoDB: 5.7.18 started; log sequence number 2811011
2017-06-03T04:30:51.326882Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2017-06-03T04:30:51.326997Z 0 [Note] Plugin 'FEDERATED' is disabled.
2017-06-03T04:30:51.328197Z 0 [Note] InnoDB: Buffer pool(s) load completed at 170603  0:30:51
2017-06-03T04:30:51.329795Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2017-06-03T04:30:51.329914Z 0 [Warning] CA certificate ca.pem is self signed.
2017-06-03T04:30:51.330900Z 0 [Note] Server hostname (bind-address): '*'; port: 3306
2017-06-03T04:30:51.330926Z 0 [Note] IPv6 is available.
2017-06-03T04:30:51.330932Z 0 [Note]   - '::' resolves to '::';
2017-06-03T04:30:51.330939Z 0 [Note] Server socket created on IP: '::'.
2017-06-03T04:30:51.335159Z 0 [Note] Event Scheduler: Loaded 0 events
2017-06-03T04:30:51.335236Z 0 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.7.18'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server (GPL)
2017-06-03T04:30:51.335243Z 0 [Note] Executing 'SELECT * FROM INFORMATION_SCHEMA.TABLES;' to get a list of tables using the deprecated partition engine. You may use the startup option '--disable-partition-engine-check' to skip this check. 
2017-06-03T04:30:51.335245Z 0 [Note] Beginning of list of non-natively partitioned tables
2017-06-03T04:30:51.340815Z 0 [Note] End of list of non-natively partitioned tables
2017-06-03T04:33:26.330159Z 3 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:33:36.966534Z 4 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:33:48.429292Z 5 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:34:11.914284Z 6 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:35:42.507762Z 7 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T04:36:09.545474Z 8 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T05:33:53.491224Z 10 [Warning] IP address '61.183.93.19' has been resolved to the host name '19.93.183.61.broad.wh.hb.dynamic.163data.com.cn', which resembles IPv4-address itself.
2017-06-03T06:44:43.843841Z 3 [Note] Aborted connection 3 to db: 'unconnected' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
2017-06-03T06:53:39.062842Z 4 [Note] Aborted connection 4 to db: '×××××××××' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
2017-06-03T06:53:58.975088Z 8 [Note] Aborted connection 8 to db: '×××××××××' user: 'root' host: '61.183.93.19' (Got timeout reading communication packets)
回答
編輯回答
凹凸曼

你好, 你所描述的問題是一個(gè)非常初級的 web黑 領(lǐng)域問題。

在暴露有公網(wǎng)權(quán)限的mysql數(shù)據(jù)庫的情況下,黑客通常是無目的性地遍歷全網(wǎng)ip地址進(jìn)行端口掃描(最知名的工具非nmap莫屬了,開源免費(fèi)的),通過tcp連接當(dāng)中的一些字段信息(被俗稱指紋)來確定這是一個(gè)暴露在公網(wǎng)的mysql服務(wù)。
發(fā)現(xiàn)了mysql服務(wù)后,通常會猜測一些可能的username password排列組合,這在安全技術(shù)當(dāng)中俗稱暴破攻擊,然后由于root admin這種username是使用的最多的,很多新手都會使用 因?yàn)槭悄J(rèn)的,所以他們往往會猜測這些value。
然后你可能會問,那么密碼他怎么知道該猜些什么? 網(wǎng)上其實(shí)流傳有很多免費(fèi)的密碼字典,這些往往最初是從黑市上流傳出來的,一般是一些大網(wǎng)站遭遇拖庫攻擊之后泄露的, 黑客一般會采取首先手動輸入幾個(gè)詞 之后用自動化工具批量嘗試密碼。
再教你個(gè)小技巧,如果你也想搞一些密碼字典來用, 除了去網(wǎng)上找這種字典之外,還有個(gè)更簡單的辦法, 就是故意開設(shè)一個(gè)公網(wǎng)mysql服務(wù),端口設(shè)默認(rèn)的3306, 故意引誘黑客來掃你, 然后在日志里去捕撈黑客們免費(fèi)送給你的這些密碼,去重后你就整理出了自己的一份密碼字典~ 這個(gè)思路 在安全技術(shù)領(lǐng)域中 被稱為“蜜罐”。

這些是比較入門級的 web黑客 伎倆,掃你端口的多半是些初學(xué)的腳本小子,如果說書籍推薦的話, 對于web黑客領(lǐng)域, 最為經(jīng)典的應(yīng)該當(dāng)屬 道哥的《白帽子講web安全》 和 余弦的《web前端黑客技術(shù)揭秘》。
以上兩本比較經(jīng)典,還有些新書,買的話注意出版的年份 別買太早的。

希望能幫到你,有問題請留言或關(guān)注我 微博: https://weibo.com/u/5114485810 推特:https://twitter.com/zhu_yingda

2018年6月18日 16:45