forked from rapid7/metasploit-framework
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add more console output, add to pentesting side
- Loading branch information
1 parent
c87dd0c
commit f1e9350
Showing
8 changed files
with
1,091 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -79,6 +79,147 @@ run cidr:/24:mysql://user:[email protected] threads=50 | |
| run cidr:/24:mysql://[email protected] threads=50 pass_file=./wordlist.txt | ||
| ``` | ||
|
|
||
| ### Obtaining an Interactive Session on the Target | ||
|
|
||
| The CreateSession option in `scanner/mysql/msql_login` allows you to obtain an interactive session | ||
| for the MySQL client you're connecting to. The run command with CreateSession | ||
| set to true should give you an interactive session: | ||
|
|
||
| ``` | ||
| run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true | ||
| [+] 127.0.0.1:4306 - 127.0.0.1:4306 - Found remote MySQL version 11.2.2 | ||
| [+] 127.0.0.1:4306 - 127.0.0.1:4306 - Success: 'root:password' | ||
| [*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500 | ||
| [*] 127.0.0.1:4306 - Scanned 1 of 1 hosts (100% complete) | ||
| [*] Auxiliary module execution completed | ||
| msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1 | ||
| [*] Starting interaction with 1... | ||
| mysql @ 127.0.0.1:4306 () > | ||
| ``` | ||
|
|
||
| You can interact with your new session using `sessions -i -1` or `sessions REPLACE_WITH_SESSION_NUMBER`. | ||
| You can also use `help` to get more information about how to use your session. | ||
|
|
||
| ``` | ||
| msf6 auxiliary(scanner/mysql/mysql_login) > sessions | ||
| Active sessions | ||
| =============== | ||
| Id Name Type Information Connection | ||
| -- ---- ---- ----------- ---------- | ||
| 2 mssql MSSQL test @ 192.168.2.242:1433 192.168.2.1:61428 -> 192.168.2.242:1433 (192.168.2.242) | ||
| 3 mysql MySQL root @ 127.0.0.1:4306 127.0.0.1:61450 -> 127.0.0.1:4306 (127.0.0.1) | ||
| msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i 3 | ||
| [*] Starting interaction with 3... | ||
| mysql @ 127.0.0.1:4306 () > help | ||
| Core Commands | ||
| ============= | ||
| Command Description | ||
| ------- ----------- | ||
| ? Help menu | ||
| background Backgrounds the current session | ||
| bg Alias for background | ||
| exit Terminate the PostgreSQL session | ||
| help Help menu | ||
| irb Open an interactive Ruby shell on the current session | ||
| pry Open the Pry debugger on the current session | ||
| sessions Quickly switch to another session | ||
| MySQL Client Commands | ||
| ===================== | ||
| Command Description | ||
| ------- ----------- | ||
| query Run a single SQL query | ||
| query_interactive Enter an interactive prompt for running multiple SQL queries | ||
| Local File System Commands | ||
| ========================== | ||
| Command Description | ||
| ------- ----------- | ||
| getlwd Print local working directory (alias for lpwd) | ||
| lcat Read the contents of a local file to the screen | ||
| lcd Change local working directory | ||
| ldir List local files (alias for lls) | ||
| lls List local files | ||
| lmkdir Create new directory on local machine | ||
| lpwd Print local working directory | ||
| This session also works with the following modules: | ||
| auxiliary/admin/mysql/mysql_enum | ||
| auxiliary/admin/mysql/mysql_sql | ||
| auxiliary/scanner/mysql/mysql_file_enum | ||
| auxiliary/scanner/mysql/mysql_hashdump | ||
| auxiliary/scanner/mysql/mysql_schemadump | ||
| auxiliary/scanner/mysql/mysql_version | ||
| auxiliary/scanner/mysql/mysql_writable_dirs | ||
| exploit/multi/mysql/mysql_udf_payload | ||
| exploit/windows/mysql/mysql_mof | ||
| exploit/windows/mysql/mysql_start_up | ||
| ``` | ||
|
|
||
| Once you've done that, you can run any MySQL query against the target using | ||
| the `query` command, or run `query_interactive` to interact directly with | ||
| your session. | ||
|
|
||
| ``` | ||
| mysql @ 127.0.0.1:4306 () > query -h | ||
| Usage: query | ||
| Run a single SQL query on the target. | ||
| OPTIONS: | ||
| -h, --help Help menu. | ||
| -i, --interact Enter an interactive prompt for running multiple SQL queries | ||
| Examples: | ||
| query SHOW DATABASES; | ||
| query USE information_schema; | ||
| query SELECT * FROM SQL_FUNCTIONS; | ||
| query SELECT version(); | ||
| mysql @ 127.0.0.1:4306 () > query_interactive -h | ||
| Usage: query_interactive | ||
| Go into an interactive SQL shell where SQL queries can be executed. | ||
| To exit, type 'exit', 'quit', 'end' or 'stop'. | ||
| mysql @ 127.0.0.1:4306 () > query 'SELECT version();' | ||
| Response | ||
| ======== | ||
| # version() | ||
| - --------- | ||
| 0 11.2.2-MariaDB-1:11.2.2+maria~ubu2204 | ||
| mysql @ 127.0.0.1:4306 () > query_interactive | ||
| [*] Starting interactive SQL shell for mysql @ 127.0.0.1:4306 () | ||
| [*] SQL commands ending with ; will be executed on the remote server. Use the exit command to exit. | ||
| SQL >> SELECT version(); | ||
| [*] Executing query: SELECT version(); | ||
| Response | ||
| ======== | ||
| # version() | ||
| - --------- | ||
| 0 11.2.2-MariaDB-1:11.2.2+maria~ubu2204 | ||
| ``` | ||
|
|
||
| ### MySQL Dumping | ||
|
|
||
| User and hash dump: | ||
|
|
||
Oops, something went wrong.