Atomic Honeypot: A MySQL Honeypot That Drops Shells
Active deception MySQL honeypot exploiting client-side vulnerabilities (CVE-2023-21980) to drop shells on connecting attackers.
Summary
The Concept of Offensive Honeypots
Meet an attacking MySQL honepot which can “Attack the attackers”. In 2023 we have found a CVE (CVE-2023-21980) in MySQL that allows a rogue MySQL “server” to attack a client connecting to it; attack meaning RCE on the client side. Since then we were thinking on how to use it for good. One obvious application is to create a honeypot which will attack the attackers. In 2024 we have found another RCE in mysqldump utility (CVE-2024-21096), so we have created a rogue MySQL server and weaponized it with a chain of 3 vulnerabilities: 1/ arbitrary file read 2/ RCE from 2023 (CVE-2023- 21980) 3/ the new RCE (CVE-2024-21096). With this atomic honeypot we were able to discover 2 new attacks against MySQL server. Using arbitrary file read vulnerability in MySQL we were able to download and analyze the attackers' code and then execute an “attack against attackers” using a chain of exploits.
Exploiting MySQL Client Side Vulnerability CVE 2023 21980
CVE-2023-21980 CVE-2024-21096
Related talks
Creator Stage·25 min
Kyle Murbach
Shares findings from physical small satellite modeling, attack simulations, and the development of the lightweight Small Satellite Defender mitigation tool.
Creator Stage·24 min
Tim Clevenger
Shares engineering best practices for deploying robust physical access control systems, from encrypted reader wiring to badge management.
Creator Stage·25 min
Adel Karimi
Presents Galah, an LLM-powered web honeypot that dynamically generates authentic HTTP responses to emulate diverse web applications.