Targeting the MySQL database server--
in this video, we'll be taking a look
at how to exploit or to gain access
to the MySQL database server that is running on the target
system.
And furthermore, or in addition to that,
we'll be taking a look at how access to a MySQL database
server can provide you with access to the web applications
that are currently utilizing the MySQL database
server for storage.
And this is, arguably, one of the most important services
to exploit when it comes down to a penetration test
because any database server is going
to be storing information.
And in the case of a company that
has customer data, if any of that data
is being stored on a database server
and you gain access to it, then that
is something that needs to be taken seriously
in the context of the company's organizational security
as well as their digital infrastructure.
So again, we'll be utilizing--
we will primarily be utilizing one technique.
But once we've gained access to the MySQL database server,
you'll actually see for yourself how this access can
be used to, essentially, gain access to web applications
and how you can modify data, so on and so forth.
So with that being said, as I said,
we're going to be using the same lab environment.
So just fire it up.
And remember to obtain the new IP address of the target system
if you've terminated your lab environment previously.
So I'll switch over to my lab environment.
And we can take a look at how we can gain access
to the MySQL database server.
So I'm back within the lab environment.
And I've just performed a service version detection
scan and a default Nmap script scan on the target system
and, more specifically, on the following port.
So 3306-- that's the default MySQL port--
as well as port 8585, where we were
able to identify that we have a WampServer
that is hosting a WordPress site as well as phpMyAdmin.
However, if you remember correctly,
we couldn't access phpMyAdmin because access
had been restricted to a specific IP, probably
the localhost.
With that information, we can start off
by taking a look at various techniques we can use to target
the MySQL database server.
The most important thing to know is
that MySQL supports authentication and can
be remotely authenticated with or to if you have
the legitimate credentials.
Now, we can also utilize or look for exploits
pertinent to this specific version of MySQL
with SearchSploit.
So we can say SearchSploit and MySQL.
And I can try and identify any exploits
that can provide us with access or maybe even access
to a specific set of user accounts and their passwords.
So I can say MySQL 5.5.
And you can see there isn't an exploit
for this specific version of MySQL apart from the following,
these ones right over here.
However, these ones are pretty much all privilege escalation
exploits right over here.
So the next best thing is to perform a brute force.
So in the previous videos, I performed a brute force
with Hydra.
However, in this case, we can also
take a look at how to perform a brute force with the Metasploit
Framework.
So I'll just open up MSF console here and we can get started.
So MSF console is started.
And we can search for the module mysql_login.
And we can use the only module here.
So we'll say use.
That's an auxiliary module.
If we show the options, you can see we have the ability
to set the user file, as well as the password file,
for the brute force.
However, you can see a default username has been specified.
And that is the root user, which is, again, pretty much
the user account that you need to
or that you should probably be targeting for because if you
obtain the root--
if you actually obtain the root account credentials for a MySQL
database server, then that means that you
can make whatever changes you want
to to any of the databases and their consequent or respective
tables without any issues.
So we can, essentially, perform a brute force
for the root user.
And let's see whether we can identify
any legitimate passwords.
So we can specify a password file if we want to.
And we can also set the RHOST option, which is the target IP.
So I'll say set RHOSTS and specify the target IP address
there.
And we can leave both as true.
That will show us all the output--
all the attempts here.
So for the pass file, if we say set PASS_FILE--
can I actually identify that?
There we are.
So that's PASS_FILE.
We can maybe use user/share/wordlists.
And we can then say metasploit and maybe unix_passwords.
And we can hit Enter and then run.
So it looks like that was relatively quickly.
It tells us the version of MySQL.
And it says that we don't have an active database.
That's fine.
And it looks like we've obtained legitimate credentials here.
So it says the username is "root."
And the password is "null."
So this is really, really bad.
It looks like the administrator did not
set a password for the root user of the MySQL database.
And that means that we can essentially log in
without providing any password.
So what we'll do here is I'll just exit.
And we can actually log into the MySQL database server
using the following command.
So we say mysql user.
And that is "root."
And the password we will specify upon login
or once we are prompted.
We then need to specify the remote host or the IP address
of the target, which I'll do.
And I'll hit Enter.
And since the password is "null,"
I'll just hit Enter there.
And voila, we have gained access to the SQL database server.
So that essentially means that we have root access
and that we can start modifying data that's
stored within the MySQL database server.
So if I say show databases, for example, here--
so databases-- and hit Enter, you
can see we have the following databases.
We have MySQL Test and WordPress.
So that's really what we're targeting.
Now, as I said, during the scanning-- the port scanning
and enumeration video, I-- we were
able to identify that we have a WampServer running
on port 8585.
And it is actually hosting a WordPress installation as well
as phpMyAdmin.
Now, we can gain access to the WordPress site.
We can gain access to the WordPress site via the admin
credentials because we have access to the MySQL database.
And of course, in that case, we will need to, essentially,
knew a lot of MySQL syntax, which, again, I
don't want to bother you with.
So while we're at it, we can also try and gain access
to phpMyAdmin.
So if we click on phpMyAdmin, you can see it's forbidden.
Now, in the previous video, we took a look
at how we can gain access to the target system via SMB.
And why don't we actually do that
so that we can modify the phpMyAdmin configuration
file, consequently allowing any user to access
phpMyAdmin via the browser?
So I'll just open up a new terminal here.
And let me just zoom in slightly if I can.
There we are.
So I'll say msfconsole.
And then we'll give this a couple of seconds.
And we can utilize any of the modules we used previously.
So we can use PsExec or we can utilize EternalBlue.
So in this case, let's just use EternalBlue.
So I'll say search eternalblue, use,
and we'll use the first exploit.
So I'll say use 0.
The payload is the default 64-bit payload.
So I'll say show options.
And really, the only option we need to specify
is the RHOSTS option.
You also need to configure the LHOST and LPORT option.
But in my case, that's done for me.
Once that is done, I'll just hit Exploit.
And we should get an elevated Meterpreter session
on the target system that will allow
us to modify or to download the phpMyAdmin config file,
modify it, and then upload the new modified version.
So it looks like we get an Meterpreter session.
So sysinfo and get user ID-- now, in certain cases,
in order to modify files that belong to applications
like WAMP, you will need-- you will actually
need elevated privileges in order to do that.
And in this case, we do.
So we can take advantage of that.
Now, the WAMP stack for Windows typically
stores the actual web applications
that are being hosted on it as well as
the configuration files for them within the C drive
in a folder called "wamp."
So you can see right over here if I print out
the current working directory, we're
in the root of the C drive.
And we can take a look at the wamp directory.
So under wamp, you will see that we'll
have quite a few folders and directories here.
And under apps, that's typically where you'll
find your web applications.
Alternatively, they could be under www.
So if I click on www here, you can
see that we have WordPress, Test MySQL, Meterpreter, et cetera.
Now, we could have obtained the MySQL credentials
by taking a look at the WordPress config file.
So if I head over into the WordPress directory
and I cat out the contents of wordpressconfig.php,
that file typically contains the MySQL database passwords.
So let's see if I can identify that there.
Indeed, it does.
So you can see the database name is WordPress.
The database user is root.
And the password is a null password.
So there's multiple techniques or ways
you could have identified the MySQL database
password for the root user.
But that's where the apps are stored.
Now, if we want to change the WordPress admin user--
the WordPress admin password, you
need to do that through MySQL.
But as I said, that will actually
require knowledge of MySQL syntax or queries.
So we can leverage phpMyAdmin because phpMyAdmin
is much easier to use in regards to modifying data that's
stored within a table.
So we can go back a step here as well.
And we can take a look at the--
I'm looking for the phpMyAdmin config file.
That is probably stored under alias, I believe.
So we take a look at the alias directory.
Yes, you can see we have phpmyadmin.conf.
Now, this configuration file is, essentially,
used to control access and the way phpMyAdmin works.
And it looks like this file has been modified to prevent anyone
from accessing it, apart from the actual user
on the actual system or localhost.
So we can download this file locally.
So I'm going to say download and phpmyadmin.conf.
That's downloaded.
In this terminal window, I'll just exit from MySQL.
And we should have phpMyAdmin downloaded here.
So we can modify this with VIM or any text editor
that you're comfortable with.
And if we take a look at it here,
you can see under directory C, WAMP, apps, phpMyAdmin,
this is where those rules have been set.
So you can see right over here the order, the default order,
is set to deny and allow.
And it denies access from all IP addresses and allows access
only from the localhost, or the target system itself.
So what we can do is we can get rid of all of these rules.
So I'll just delete that line there, delete that line there.
And instead of allowing access only from the localhost,
we can say allow from all, write and quit.
And that's pretty much it.
We now need to upload the updated version.
So we can say upload phpmyadmin.conf.
And the great thing with Meterpreter
is it will automatically replace the file with the one
that you've just uploaded.
So that contains the changes.
And we can confirm that by saying cat and phpmyadmin.conf.
And you can see that those rules have now been updated--
so allow from all.
Now, if we try and reload phpMyAdmin here,
you can see it's still saying forbidden.
The reason for that is because once you make any change
to the Apache configuration file for any of these applications
or to the default Apache configuration file,
you actually need to restart the Apache service.
Right now, in order to restart the service,
we need to open up a Windows command prompt session here.
And what we need to do now is we need to stop the WAMP Apache
service.
That can be done through the use of net stop.
And this requires administrative privileges.
So net stop wampapache--
that'll stop the service.
As you can see, WAMP Apache service is stopping.
We can then say net start wampapache.
If it starts successfully without any errors,
then we should be able to access phpMyAdmin.
So I'll reload that.
And we should be able to-- yeah, there we are.
In fact, we are automatically logged into phpMyAdmin .
So that is a huge security failure
on the side of the administrator of the website.
So again, what we were trying to do
is showcase how access to the MySQL database server
can be used to essentially gain access to the web applications
that are being hosted on the target system.
So if we take a look at WordPress,
WordPress user accounts are stored under the WordPress
users table.
And you can see we want to gain access to the admin account.
So we need to change the default password, or the password that
existed previously.
Now, as I said, in a real pen test,
you definitely do not want to do this.
Your job is to just show and, of course,
document the fact that you were able to do this.
And you need to highlight how you did it.
So this is just showing you what an attacker would typically
be able to do and how dangerous this is.
So you can click on Edit.
And under User Password, I'll click
on the default WordPress encryption
algorithm, which is MD5.
And I can change the actual hash there
to my own cleartext password-- so password123.
And the great thing with phpMyAdmin and MySQL
is it will automatically encrypt it with MD5.
So I'll hit Go.
And that is changed.
So I can now go back to the WampServer home page.
And we can try and log into WordPress.
So I'll click on WordPress there.
We'll give this a couple of seconds.
And under WordPress, I can then say WordPress Admin.
That'll allow me to log into the admin dashboard.
So the default username is "admin."
And the password that we set was "password123."
And log in.
And that should provide us access to the WordPress
dashboard, which, consequently, gives us access
to the entire WordPress site.
And we can make changes and, furthermore, download and view
customer data or whatever data is
being stored within the actual WordPress site itself.
So we'll give this a couple of seconds.
And it should log us in.
There we are.
And we now have access to the WordPress site.
And we can pretty much modify, do whatever we want with it.
So that, as you can see, was quite a lot.
And it, essentially, involved chaining or utilizing access
from one service to gain access to another service
or, in this case, a web application.
So that is how to target and exploit the MySQL database
server.
As I said, in this case, this system
was set up to showcase the techniques as opposed
to it being hardened and secured.
But if it was still protected with a weak password,
we would have been able to perform a brute force attack
and identify that password irregardless of that.
With that being said, that is going
to conclude the practical demonstration
side of this video.
So that concludes the Windows exploitation section
of this course-- more specifically,
the Windows black box penetration
test that you were assigned to do.
And hopefully, you went through the actual target yourself
and were able to identify other vulnerable services that you
could exploit in order to gain access to the target system.
There are still quite a few that I haven't explored,
and for good reason, the reason being--
is the rest of the vulnerable services
require a lot of manual exploitation.
And I wanted you to actually go through that yourself.
It's good practice.
And as I said, the only objective
is just to gain access.
And within the post-exploitation course,
we'll actually be covering the various tactics and techniques
involved within post-exploitation.
But if you were able to gain access to the target system
through any of these services, then well done.
And of course, I've actually covered pretty much
the most important service that you should have been targeting
given your current skill level.
But as you progress, you'll be able to find vulnerabilities
within API endpoints.
And there are quite a few on the target system,
probably about three or four more vulnerable services
that you could have exploited.
With that being said, we're now going
to move over to the Linux exploitation section, where
we are going to be covering a Linux black box penetration
test, similar to what we've done here.
And your objectives are going to be pretty much the same.
Your job is simply to gain access to the Linux system.
So I hope you're excited.
And I'll be seeing you in the next video.