[MUSIC PLAYING]
MySQL enumeration.
In this video, we're going to be taking a look at how
to enumerate as much information as possible
from a MySQL database server with or by taking advantage
of various auxiliary modules afforded
to us by the Metasploit framework.
So first and foremost, what is MySQL?
Well, MySQL is essentially an open source relational database
management system that's based on SQL.
SQL means the Structured Query Language,
and it's typically used to store records
like customer data and various other types of data associated
with the operations of a company.
So there are various deployment use cases for MySQL, or rather,
any other type of relational database management system,
but MySQL is typically or commonly deployed
to store web application data.
So if you're setting up a web application like WordPress,
WordPress requires a database to store data.
And as a result, you can either use
MySQL or any other type of relational database management
system to store your data.
So you will typically find MySQL deployed as a database
to store the web application data.
And again, given that is the fact,
exploiting or performing enumeration
on a MySQL database server can be vital in a penetration test.
And again, it really, really is very, very important,
and you need to take it into consideration
whenever you're performing information gathering.
Now, MySQL utilizes TCP port 3306 by default.
However, like any other service, it
can be hosted or configured to run on any other open TCP
port, which is something that companies or organizations have
started doing in order to avoid attacks
on their database servers.
So they'll typically change the MySQL port from 3306
to something else in a way, or rather as a technique
to avoid detection.
However, this again is not really helpful,
because we can perform a full port scan
and discover the port that actually
has MySQL running on it.
Now, we can utilize various auxiliary modules
to enumerate information like the version of MySQL
that's running, and that information can
be pertinent to exploitation.
We can also utilize auxiliary modules
to perform brute force attacks on the MySQL database server.
So we can, again, perform these brute force attacks
to identify usernames and passwords
and legitimate credentials that we can authenticate with,
which will consequently give us access to the database server.
After we've gained access to a database server
or after we have credentials to a database server,
we can use various other auxiliary modules
to essentially enumerate information
from the database server, like the tables or the databases,
as well as execute various SQL queries,
which we will be exploring within the lab environment.
So let's actually switch over to the lab environment now.
All right, so I am currently within the lab environment.
And the first thing we want to do
is, of course, identify the target IP address, which we
can do by typing in ifconfig.
And we're looking for the interface ethernet 1,
and of course, we identify our IP address here.
So that is 192.143.6.2, which means that the target IP
address will be 193.143.6.3.
And in your case, again, all you need
to do is just change the 2 to a 3,
and that's the target IP address.
So I'm just going to copy that.
We then want to start up the PostgreSQL database server.
So postgresql_start, that should start it up for us.
So give that a few seconds.
MSF console, to start up the Metasploit framework console.
Give that a few seconds.
All right, the next thing we want to do is add a workspace.
So I'm going to say workspace add, and we'll just
call this MySQL_enum, right, and we'll hit Enter.
And that's currently our workspace.
The next thing we want to do to avoid
any inconvenience of setting or actually constantly looking
up the target IP is to set up the global variable
for the RHOSTS variable.
So we're going to set that up, and we're
going to again paste in the target IP,
change the 2 into a 3, and we'll also
do this for the RHOST variable in addition to RHOSTS.
So again, just hit Enter, and that again should prevent us,
or again, will actually save us from typing in the target IP
every time we want to use a module.
All right, so let's get started.
Now, when it comes down to MySQL enumeration and exploitation,
the first thing that we need to do
is identify the version of MySQL that's running.
So we can run a search for the auxiliary modules
pertinent to MySQL by typing in search,
and then we can specify or use the type filter
to limit the results to auxiliary modules.
And then we can enter a name, which again, in this case,
we will type in MySQL and hit Enter.
And as you can see, we have quite a few modules.
The one we're starting off with is the MySQL version
module, which I'll just copy here, and we will say use.
We're going to then hit Enter.
There we are.
So it's loaded and active.
We're now going to show the options
for this particular module.
And as you can see, the options are fairly simple.
We need to provide the target IP,
which is done through the global variable that we just set.
You then have the RPORT option, which is the port
that MySQL is running on the target.
And in this case, it is running on port 3306.
We can, of course, confirm that-- we can actually confirm
this by performing a port scan.
So again, if I just search for port
scan, and we use the default TCP port scan module,
as we did during the port scanning video.
We can then, again, show the options here.
And then just hit Run, because the target IP
has been specified.
And once we hit Run, you should see that the open port
is port 3306, as you can see.
So that is the port that is actually hosting the MySQL
database server.
So now that we know or have confirmed
that that is the case, we can now
use the MySQL module, the MySQL version.
So, we're going to Enter again.
And again, we just show the options here.
So we have everything configured,
and we can now hit Run to enumerate the version of MySQL
running on the target.
And in this case, you can see it says that the target is running
MySQL all version 5.5.61, and we can also
get the version of Ubuntu running, which in this case,
it actually tells us that the target is running Ubuntu 14.04.
So we've been able to get the version of MySQL
and the distribution that's currently running,
which in this case is Ubuntu 14.04.
This information can be very useful
during the exploitation and post-exploitation phases.
So again, it is all very pertinent.
Now, when it comes down to further enumeration of MySQL,
we actually need some access to the database server.
And in order to obtain that access,
we can either find an exploit for this version of MySQL--
however, there isn't any active exploit
that can allow us to, again, target this version.
So what we'll need to do is perform a brute force
in order to see or identify whether we
can find any legitimate credentials that can provide us
with some form of access to the MySQL database server.
The module we can use to do that is one
called MySQL login, so I'm just going to search for it.
And that's the module there.
So it's the MySQL login utility.
And similar to the FTP SMB and the web server enumeration
videos, this can allow or this can be
used to perform a brute force.
So again, we'll just show the options here.
And the options that we need to set
are number 1, the brute force speed,
which is currently set to the highest.
We also need to configure the target IP, which is done,
and the target port.
We then can specify the username and the user file,
et cetera, all the information pertinent to a brute force
attack.
Now, when we talk about MySQL and the credentials
that we are pretty much going to be after,
that is going to be the root credentials, right?
Because the root user on any system essentially
has all privileges.
And so instead of performing a brute force for usernames,
we can automatically set the username
to root and then try and see whether we
can find any passwords for the root user.
So I'm going to set the username value to root,
and we are then going to set the password list to-- or rather
the password file to the following word list.
So we will utilize--
so let's set up pass file here.
And we are going to use the Metasploit framework word
list so user share Metasploit framework.
And under data and word lists, we
are looking for unixpasswords.txt,
and we hit Enter.
We can also disable verbosity or set it to false,
to only again print out the successful attempts.
And we can also specify the stop on success value,
which will stop whenever we obtain legitimate credentials.
So we will set the verbose option to false.
And of course, this is a Boolean value.
And once we are ready to go, all we need to type in is run,
and that is going to begin the brute force.
So let's see whether we can identify any credentials
for the MySQL database server.
As you can see, that is completed relatively quickly.
And we were able to find credentials, or rather
a password for the root user, which is excellent.
That means we can now access the MySQL database server
and pretty much do whatever we want with it.
So we've been rather lucky, if I can call it that.
So now that we have obtained the credentials,
you can see that the password for the root user
is twinkle, which is not a very good security
practice on the side of the systems administrator
on the target system.
The next step will be pretty much to perform some MySQL
enumeration.
And this can be done through the use of a module called MySQL
enum.
So again, I'll just search for it here.
So I'm going to say search mysql_enum,
and this is the module here.
As you can see, it falls under the Admin subdirectory
under auxiliary modules, which means in order to use it
or in order to utilize it, we require credentials, which
in this case, we already have.
So I'm going to copy that, and we're
going to paste that in there.
And if you want to learn more about this module,
you can type in info.
And as you can see, it says this module
allows for simple enumeration of a MySQL database server,
provided proper credentials to connect remotely.
So let's set up the username and password.
As you can see, the target IP has been set, as well as
the target port.
So I'm going to set the password value to twinkle, which
is what we were able to find.
So twinkle, and set the username to root.
And all we need to do now is just hit Run.
And as you can see, it's enumerated quite a bit
of information, right?
Now, let's go through the information
that it's enumerated.
All right, so as we can see, it enumerates the MySQL version,
which we already know.
It also tells us that this version of MySQL
was compiled for Debian Linux GNU, or rather, Linux.
The architecture of the target system
could be 32-bit or 64-bit.
We also get the server hostname, so we
know that this particular system is called Victim 1.
As for the other options that are pertinent or important
to us, that is going to fall under the accounts section.
So it will essentially enumerate a list of accounts
with their password hashes, and this
is referring to accounts for the MySQL database server.
So we already have the root credentials,
so we already have the root, the user root and its password,
but it will print out the hashes.
Now, whenever you have hashes, hashes
need to be cracked in order to obtain a clear text password,
but we're really not going to be focusing on that in this video.
We also are able to find out the other MySQL database users.
And in this case, you can see we have a user called
sysadmin backup gofer.
We also get the guest host account and a few others here.
So we are able to enumerate the other MySQL database users.
We also get the other information
pertinent to privileges, so we can
see that the following users have grant privilege.
And if we take a look at the users,
we can see they're the only user who
has these privileges is the root user.
And in our case, we already have access to the root user,
so we don't need to do much here.
So this module is essentially used
to enumerate additional information.
And of course, in order to do that,
it requires access through credentials.
Now, if we had obtained access via another user,
then of course, the information displayed here,
like the root user hash, would be very, very important,
because we could then take it and crack it and then
be able to get root access on the MySQL database server.
So now that we have enumerated or performed some basic MySQL
enumeration, we can now move on to the next module.
The next module is arguably one of the most important modules
when it comes down to MySQL enumeration
with the Metasploit framework, and that is the MySQL SQL
module.
So if we search for that right now,
I'm just going to say MySQL SQL.
We hit Enter.
As you can see, this also falls under the Admin subdirectory
under auxiliary modules, which means we require credentials
in order to run it.
What this module allows us to do is actually
execute SQL queries, which means we can now interact
with the MySQL database server.
So if I copy this and I say use and paste this in here,
we show the options, you can see that the target IP has been
set, the target port is set.
We need to set the password and the username,
so let's do that really quickly, so set the password to twinkle
and we're going to set the username to root.
The next option we need to configure
is the SQL query, right?
So when we're talking about a MySQL database,
in order to essentially extract information from it,
or rather, in order to interact with it,
we interact with a MySQL database
through the SQL, or Structured Query Language.
And for example, if we wanted to get the version of MySQL,
we would type in select version, which
is already added for us here.
So let's just use this sample command,
and I'll also take you through various other queries
that you can run.
So if I hit Run, you can see that it sends the query here,
and it tells us that it's MySQL version 5.5.61,
and it also gives us the operating system version.
But we already know this information, and given the fact
that we have root access, what we can do
is run another SQL query.
And that is going to be we can set the SQL option here.
And what we can do is run a query called show databases.
And what this will do is it will actually
display a list of all databases that are currently
on the MySQL database server.
So this will tell us what databases are currently
on there, and it'll give us an idea of what applications
are using the MySQL database server.
So I'll set SQL to show databases.
And of course, the Structured Query Language
requires a semicolon after every command,
so I'm going to hit Enter.
And then if I hit Run, you can see
it's going to send the statement,
and then it displays a list of databases available.
So you can see we have the default MySQL database.
We have a database called upload.
We have a database called vendors, videos, warehouse,
et cetera.
So for example, if we wanted to use one of these databases,
we could change the SQL setting to instead of show databases,
we could say use maybe the videos database.
So if we say use videos and then semicolon and then hit Run,
this will again send that statement
and it's going to execute.
But it doesn't give us an output,
because again, this particular command
is used to select a database.
After we have selected a database,
we can then again show the tables, et cetera, et cetera.
So this is a very important module
when it comes down to enumerating
as much information as possible regarding
the databases that are currently on a MySQL database server.
Now, if we wanted to learn more information about the schema,
the MySQL database schema, we can
use another module called MySQL schema dump.
So I'm just going to clear that out,
and we're going to run the search.
And what this will do is it'll actually
display all the databases and the tables
that fall under the databases, which again, we
can do with this module.
But again, this particular module
does it for us automatically.
So we can say search MySQL, and let's just say schema,
and this is the module here.
And as you can see, it is a MySQL schema dump module.
So I'm going to say use, paste that in there,
show the options.
Let me just do that again.
There we are.
And you can see the first option we
can set is the display results option, which essentially
displays the results to the screen.
We obviously want that.
We then need to specify the username and password.
We've already specified the target IP and port,
so we don't need to do that.
So I'm going to set the password value here
to the credentials we were able to get through the brute force.
So the password is twinkle, and then we're
going to set the username to root.
And once that is done, we can just hit Run.
And as you can see, it essentially
brings out or displays the schema.
And in this case, you can see that for all the databases,
they don't have any tables under them.
So again, as I said, this lab environment
is set up for the purpose of demonstration.
So we really don't have any data within this database.
However, if we did, it would actually
display the tables that fall under the databases.
And then of course, we would have an idea of what to target
and we could use the previous module
that allowed us to essentially execute various SQL queries.
So, so far, we've been able to get quite a lot of information.
We've actually been able to get access to the database server.
We've been able to enumerate the schema,
get an idea of the databases that are currently
on the MySQL database server.
Now, we can also log in using the MySQL utility
through the command line, and that's not a part
of the Metasploit framework.
And that will essentially give you a full control or access
to the MySQL database server, because we already
have the credentials.
So if we take a look at the information
we've been able to gather, so if I say hosts,
you can see we have the hosts there.
If I say services, there we are.
And then of course, if we type in loot,
that will display the credentials
that we were able to get.
And in this case, it displays--
you can see the schema that we were able to get.
If we type in the creds command, this
will actually dump out all the credentials
that we were able to gather through the MySQL enumeration
module.
And again, this is why I recommend
creating a workspace for every assessment,
because you can then go through all the information you were
able to gather, because the Metasploit framework will store
all of this information, so you can always
go back to it in the event that you missed out on something.
So you can see we have the credentials
here that we were able to get, which is very, very useful.
So what we'll do now is let's actually exit out
of the Metasploit framework, and I'll
show you what a typical penetration tester would
do once they got credentials.
And of course, you can do this via the Metasploit framework
modules.
But what they would typically do, then is, say,
MySQL paste in the IP and then log in using the user root,
and then we can provide the password.
So I'll type in the password, which we know is twinkle, hit
Enter.
And it says we don't have access through that.
So I'm just going to specify the remote host option, which
is -h, type in the password now, hit Enter,
and we have access to the SQL database server.
So this prompt here allows us to run any SQL queries.
So again, I can say show databases
and then use the semicolon, hit Enter.
And as you can see, we get the same information
that we did through the Metasploit auxiliary modules.
So you can see how powerful the Metasploit framework
auxiliary modules are in regards to enumerating information.
And you know I can then say something like use videos
to select the videos database.
As you can see, it says database changed.
I can then say show tables, show tables for the videos database.
And as you can see, it's an empty set.
So the Metasploit auxiliary module
that actually dumped the schema, or rather the database schema,
was actually accurate, because none of these databases
here have any tables under them.
So we've been able to confirm that the information we
got from the Metasploit framework is accurate.
And as you can see, these modules are extremely powerful.
So that is going to conclude the practical demonstration.
In the next video, we are going to be taking a look at how
to perform SSH enumeration through the use
of auxiliary modules.
So I'll see you there.