Original subtitles

We're going to start looking at a database-- in this case,

a SQL or SQL database.

One of the most common open versions of the SQL database

is MySQL.

It usually runs on Ubuntu or some version of Linux--

rather, or Unix, and it allows many users to store information

in the database.

It can be pulled and used in many different operations,

and it's very common to find on an enterprise network.

It's also very often misconfigured

and very vulnerable.

So we're going to look at what that would normally

look like when you're come across an SQL Server

and how you would enumerate or gather information from it.

So in our console, we'll look at our IP address.

We'll take that same IP address and use the .3 of the subnet.

And we see that we've got 3306, which usually

ties to the MySQL service.

We'll run a service scan on 3306,

and it should go quite a bit quicker.

But it does confirm it is a MySQL 5.5.62 running on Ubuntu.

Now we can try a few different things.

The first being we'll run a MySQL command using

the -h for the host, our IP address, and then

-u for the username.

And we'll go with root.

Since it's running on Ubuntu, root

tends to be the default admin.

Let's see if we're able to log in.

And it looks like it did take correctly

and we were able to log in.

With that, we can now look at the databases with a show

databases.

It requires a semicolon at the end.

Otherwise, it just gives you a new line.

So we have 11 rows in the set, so those are 11 databases.

If we wanted to script it, we could dig into that.

But now let's look at some information

in one of these databases.

Let's use books, include that semicolon at the end,

and now we're looking in the books table for the database.

And let's now dig into authors.

So if we select count from all things from authors,

it should give us a count of all the options.

So there's 10 in there.

If you're curious what that looks like,

we just wanted to see everything from the database.

Select star, for wild card, from authors.

And now inside of the book's database, there's authors

and there's all this information that goes with those authors.

These are all just different tables in the database.

What they're used for may or may not matter.

In this case, it looks like it is.

For something nondescript, there's books.

There's videos.

There's a store.

There's secrets and vendors.

But mostly, we're trying to enumerate this thing.

So, generally, you log in with MySQL.

You use a database, and then you can select items

from that database.

And if you ever need help, you just type "help" and you

get a whole list of what is in here, what options you have.

Now, if you're not familiar with SQL, S-Q-L,

then it might be more useful to use some tools that we

are more comfortable with.

And leave the syntax up to those who created the tools.

Our good friend Metasploit-- we're

going to use an auxiliary scanner, very common

with enumeration.

And let's look at writable directories.

So the options-- we'll pick a dir_list,

and we use this one right out of Metasploit--

Metasploit data, word lists, and directory.

And I used tab completion whenever possible.

It prevents typos, especially if you hit Tab.

And it goes all the way to the end, and you know you're good.

We'll setg rhosts because we're going to keep using this.

And setg sets it as a global variable

for this whole Metasploit session.

Also verbose to false because it's

going to tell us a lot of information,

and this will just make life a little easier for us.

If you're curious where verbose is,

since it's not showing up here, it's in the advanced options.

And verbose gives you a detailed status messages.

It's going to run a brute force of all the directories, testing

things to see if they're relatable.

And if we have verbosity on verbose,

then we're going to get flooded with messages.

Let's set a password to annul password.

Double check that we have all the

required items, yes, yes, yes, and we'll run.

It gave us quite a list--

went too far.

For a lot of your enumeration, if you are able to output

to a file, and then look at that file, that can be quite useful.

So it checked some common places--

came up with tmp is writable and root is writable.

There's some error codes in here,

but it looks like temp and root are the only writable

directories.

And that's on the system utilizing SQL.

So it's kind of crazy that we get access

to things that aren't necessarily about the database,

through the database.

Another scanner that we can use is hashdump.

So use auxiliary/scanner/msql and hashdump.

If we run options, rhost is already

set because it was set as a global variable.

So we changed our module from this writable dirs to hashdump.

It kept it.

We'll username to be root since we already

saw that was vulnerable, and we'll set the password

to be a null password.

And even though in options it shows that it's empty,

passing that empty value actually did

give it something, ironically.

Delete.

Type exploit.

And we get a whole bunch of hashes for different users.

Add that to our list of things enumerated.

It can be quite useful later.

And now leave Metasploit, and jump back into mysql.

So mysql dot h our IP and the user as root.

And what we'll do is select, and then we'll load file.

And see if we have access to files on the system.

And we did that enumeration before,

so we should have some access.

And we do.

We get the full etc shadow file.

Not in the prettiest output, but we

can see what users and services are currently

existing on the system.

We could use that to pull other files as well, especially

if we have root access.

But currently we're just enumerating and seeing

what we do have the ability to find.

We'll return to our good friend nmap.

In this case, we'll run a script.

It will be the mysql empty password--

just see if there are any other accounts that can log in

with an empty password.

And it remains to be just root.

If we had run this first--

once we saw that we had mysql ran the empty password,

we would have gotten that root.

We would have gotten the empty password,

and that's how we were able to do all the other scans we've

done so far.

We want more information on the database.

We can run the msql info command.

And this, again, gets is our version number.

We can see that we've got this interactive client, which

is going to allow us access to the system

through mysql, which is never good.

That's something that they would want

to fix in the configuration, but they left for us.

Another thing we can look at is users.

And for this, we need to pass some arguments.

We will pass it--

a user of root and the password of null.

I see we do have root--

also got udadmin, sysadmin, ultra.

And there is a guest account on there.

And we want to add all of these to our list--

another great command if you didn't want to try logging in

or weren't sure if you could log in the databases

with that same root and null password.

And we get those same databases that we found at the beginning.

For more access, we can also look at mysql variables.

Since it's a database, knowing how to interact with it

can be quite useful.

What's most useful is the data directory.

Where is all this been stored?

Where are all the variables being stored?

[INAUDIBLE]

This datadir, data directory, a var/lib/mysql,

that has its potential uses.

After variables, let's run the mysql audit

again with an null password, but also with an audit file name.

So instead of mysql user, we want mysql audit dot user.

A lot of these scripts, you have to go

into the script on your file to see

what they want for arguments, which initially

can be a lot of work.

But as you get a lot of this down

and you create your own tool list,

you'll just put all these commands into a file.

And when you come across MySQL, or "Mis-QL," database,

you can just grab the commands you want.

Pop them in, and you already have mostly built out for you.

You can just change the things that you find.

For example, maybe, it's not root.

Maybe, it's another user.

So you run that initial nmap scan for any empty passwords,

and then you can use that to do the rest of your enumeration.

So all the rest of these scripts,

you would just change that little part.

The nselib is where a lot of this is kept.

This one is quite a script, so double

check that I wrote it right, mysql audit.

No tab completion here, there it is and my variable name.

And I feel bad showing you this, but it's normal to have typos

and to mess things up every once in a while.

And we go through this whole audit.

Something's passed.

Something's failed.

As a developer, this would be a useful thing

to run on your own system to see what shows up, if you've

configured things correctly.

And it does not grant privileges to non-admin users,

so it passed the audit.

So it would have to be an admin user to get privileges.

I'll reuse this variables.

That's here from earlier.

Replace variables with dump-hashes.

We used the Metasploit dump-hashes earlier.

Change by variables again.

Username is root.

And password is empty.

Then we get the hashes for all of those.

We can also use nmap to run a query.

When we logged into the database earlier, what we did

is we ran a query.

So this query is going to be what we actually

want to ask it.

We'll replace that.

So we'll do that select count of all the things, all the rows,

really, from books.authors with a semicolon and a single quote.

Now we use the username of root and password of empty.

And we see that there are 10 items, 10 rows in the database.

That's some basic enumeration from MySQL.

It was a bit-- it was a lot.

Knowing these commands, having them written down somewhere,

can be quite helpful because later when

you come across something, then you'll

want to use your toolset, your cheat sheet.

Creating your own cheat sheet is helpful

because it's what you're comfortable running.

It's what you get used to.

And if something changes, then you can adapt to that.

Knowing what tools are out there, gives you the option.

If your tools aren't working, you can try something else.

But when we're pen testing, when you're

auditing your own system, or thinking like the attacker,

if they're trying to find ways in,

they're trying to enumerate your system,

this is how you would go about it.

MySQL or just SQL databases in general

have the potential of being very vulnerable

and allowing a lot of access to a machine

without you knowing it.

By default, they just have a lot that's vulnerable.

So if you have these databases, you want to lock them down.

And if you come across them, then you

want to find out how vulnerable they are.

And if you-- as a pen tester or as the auditor,

if there's anything that can be locked down on that.