All language subtitles for 1. MySQL

We're going to start looking
at a database-- in this case,

a SQL or SQL database.

One of the most common open
versions of the SQL database

is MySQL.

It usually runs on Ubuntu
or some version of Linux--

rather, or Unix, and it allows
many users to store information

in the database.

It can be pulled and used in
many different operations,

and it's very common to find
on an enterprise network.

It's also very
often misconfigured

and very vulnerable.

So we're going to look at
what that would normally

look like when you're
come across an SQL Server

and how you would enumerate
or gather information from it.

So in our console, we'll
look at our IP address.

We'll take that same IP address
and use the .3 of the subnet.

And we see that we've
got 3306, which usually

ties to the MySQL service.

We'll run a service
scan on 3306,

and it should go
quite a bit quicker.

But it does confirm it is a
MySQL 5.5.62 running on Ubuntu.

Now we can try a few
different things.

The first being we'll
run a MySQL command using

the -h for the host,
our IP address, and then

-u for the username.

And we'll go with root.

Since it's running
on Ubuntu, root

tends to be the default admin.

Let's see if we're
able to log in.

And it looks like it
did take correctly

and we were able to log in.

With that, we can now look
at the databases with a show

databases.

It requires a
semicolon at the end.

Otherwise, it just
gives you a new line.

So we have 11 rows in the set,
so those are 11 databases.

If we wanted to script it,
we could dig into that.

But now let's look
at some information

in one of these databases.

Let's use books, include
that semicolon at the end,

and now we're looking in the
books table for the database.

And let's now dig into authors.

So if we select count from
all things from authors,

it should give us a
count of all the options.

So there's 10 in there.

If you're curious
what that looks like,

we just wanted to see
everything from the database.

Select star, for wild
card, from authors.

And now inside of the book's
database, there's authors

and there's all this information
that goes with those authors.

These are all just different
tables in the database.

What they're used for
may or may not matter.

In this case, it
looks like it is.

For something nondescript,
there's books.

There's videos.

There's a store.

There's secrets and vendors.

But mostly, we're trying
to enumerate this thing.

So, generally, you
log in with MySQL.

You use a database, and
then you can select items

from that database.

And if you ever need help,
you just type "help" and you

get a whole list of what is in
here, what options you have.

Now, if you're not
familiar with SQL, S-Q-L,

then it might be more useful
to use some tools that we

are more comfortable with.

And leave the syntax up to
those who created the tools.

Our good friend
Metasploit-- we're

going to use an auxiliary
scanner, very common

with enumeration.

And let's look at
writable directories.

So the options--
we'll pick a dir_list,

and we use this one
right out of Metasploit--

Metasploit data, word
lists, and directory.

And I used tab completion
whenever possible.

It prevents typos,
especially if you hit Tab.

And it goes all the way to the
end, and you know you're good.

We'll setg rhosts because
we're going to keep using this.

And setg sets it as
a global variable

for this whole
Metasploit session.

Also verbose to
false because it's

going to tell us a
lot of information,

and this will just make
life a little easier for us.

If you're curious
where verbose is,

since it's not showing up here,
it's in the advanced options.

And verbose gives you a
detailed status messages.

It's going to run a brute force
of all the directories, testing

things to see if
they're relatable.

And if we have
verbosity on verbose,

then we're going to get
flooded with messages.

Let's set a password
to annul password.

Double check that
we have all the

required items, yes,
yes, yes, and we'll run.

It gave us quite a list--

went too far.

For a lot of your enumeration,
if you are able to output

to a file, and then look at that
file, that can be quite useful.

So it checked some
common places--

came up with tmp is writable
and root is writable.

There's some error
codes in here,

but it looks like temp and
root are the only writable

directories.

And that's on the
system utilizing SQL.

So it's kind of crazy
that we get access

to things that aren't
necessarily about the database,

through the database.

Another scanner that
we can use is hashdump.

So use auxiliary/scanner/msql
and hashdump.

If we run options,
rhost is already

set because it was set
as a global variable.

So we changed our module from
this writable dirs to hashdump.

It kept it.

We'll username to be
root since we already

saw that was vulnerable,
and we'll set the password

to be a null password.

And even though in options
it shows that it's empty,

passing that empty
value actually did

give it something, ironically.

Delete.

Type exploit.

And we get a whole bunch of
hashes for different users.

Add that to our list
of things enumerated.

It can be quite useful later.

And now leave Metasploit,
and jump back into mysql.

So mysql dot h our IP
and the user as root.

And what we'll do is select,
and then we'll load file.

And see if we have access
to files on the system.

And we did that
enumeration before,

so we should have some access.

And we do.

We get the full etc shadow file.

Not in the prettiest
output, but we

can see what users and
services are currently

existing on the system.

We could use that to pull
other files as well, especially

if we have root access.

But currently we're just
enumerating and seeing

what we do have the
ability to find.

We'll return to our
good friend nmap.

In this case,
we'll run a script.

It will be the mysql
empty password--

just see if there are any
other accounts that can log in

with an empty password.

And it remains to be just root.

If we had run this first--

once we saw that we had
mysql ran the empty password,

we would have gotten that root.

We would have gotten
the empty password,

and that's how we were able to
do all the other scans we've

done so far.

We want more information
on the database.

We can run the
msql info command.

And this, again, gets
is our version number.

We can see that we've got
this interactive client, which

is going to allow us
access to the system

through mysql,
which is never good.

That's something
that they would want

to fix in the configuration,
but they left for us.

Another thing we can
look at is users.

And for this, we need
to pass some arguments.

We will pass it--

a user of root and
the password of null.

I see we do have root--

also got udadmin,
sysadmin, ultra.

And there is a guest
account on there.

And we want to add all
of these to our list--

another great command if you
didn't want to try logging in

or weren't sure if you
could log in the databases

with that same root
and null password.

And we get those same databases
that we found at the beginning.

For more access, we can also
look at mysql variables.

Since it's a database, knowing
how to interact with it

can be quite useful.

What's most useful is
the data directory.

Where is all this been stored?

Where are all the
variables being stored?

[INAUDIBLE]

This datadir, data
directory, a var/lib/mysql,

that has its potential uses.

After variables, let's
run the mysql audit

again with an null password, but
also with an audit file name.

So instead of mysql user, we
want mysql audit dot user.

A lot of these
scripts, you have to go

into the script on
your file to see

what they want for
arguments, which initially

can be a lot of work.

But as you get a
lot of this down

and you create
your own tool list,

you'll just put all these
commands into a file.

And when you come across
MySQL, or "Mis-QL," database,

you can just grab the
commands you want.

Pop them in, and you already
have mostly built out for you.

You can just change the
things that you find.

For example, maybe,
it's not root.

Maybe, it's another user.

So you run that initial nmap
scan for any empty passwords,

and then you can use that to do
the rest of your enumeration.

So all the rest
of these scripts,

you would just change
that little part.

The nselib is where a
lot of this is kept.

This one is quite
a script, so double

check that I wrote it
right, mysql audit.

No tab completion here, there
it is and my variable name.

And I feel bad showing you this,
but it's normal to have typos

and to mess things up
every once in a while.

And we go through
this whole audit.

Something's passed.

Something's failed.

As a developer, this
would be a useful thing

to run on your own system to
see what shows up, if you've

configured things correctly.

And it does not grant
privileges to non-admin users,

so it passed the audit.

So it would have to be an
admin user to get privileges.

I'll reuse this variables.

That's here from earlier.

Replace variables
with dump-hashes.

We used the Metasploit
dump-hashes earlier.

Change by variables again.

Username is root.

And password is empty.

Then we get the hashes
for all of those.

We can also use
nmap to run a query.

When we logged into the
database earlier, what we did

is we ran a query.

So this query is going
to be what we actually

want to ask it.

We'll replace that.

So we'll do that select count
of all the things, all the rows,

really, from books.authors with
a semicolon and a single quote.

Now we use the username of
root and password of empty.

And we see that there are 10
items, 10 rows in the database.

That's some basic
enumeration from MySQL.

It was a bit-- it was a lot.

Knowing these commands, having
them written down somewhere,

can be quite helpful
because later when

you come across
something, then you'll

want to use your toolset,
your cheat sheet.

Creating your own
cheat sheet is helpful

because it's what you're
comfortable running.

It's what you get used to.

And if something changes,
then you can adapt to that.

Knowing what tools are out
there, gives you the option.

If your tools aren't working,
you can try something else.

But when we're pen
testing, when you're

auditing your own system, or
thinking like the attacker,

if they're trying
to find ways in,

they're trying to
enumerate your system,

this is how you
would go about it.

MySQL or just SQL
databases in general

have the potential of
being very vulnerable

and allowing a lot of
access to a machine

without you knowing it.

By default, they just have
a lot that's vulnerable.

So if you have these databases,
you want to lock them down.

And if you come
across them, then you

want to find out how
vulnerable they are.

And if you-- as a pen
tester or as the auditor,

if there's anything that
can be locked down on that.