Back Home

TryHackMe - using enumeration to discover usernames/passwords in a MySQL database

Date: 6/14/2024

Default info:

• Name: polomysql
• IP: 10.10.37.41
• credentials: “root:password”

• mysql is using port 3306/tcp

• tested known credentials: success

• performed a search for mysql modules, needed to find mysql_sql

• loaded module and listed options

• set necessary options then run
• discovery
  • version = 5.7.29-0ubuntu0.18.04.1

• set sql to “show databases” instead of “select version()”, then run
• discovery
  • there are 4 databases

• searched for “mysql_schemadump” to print out a list of tables and checked options

• after setting options (same as version discovery module), then run
• A bunch of table names print out, along with column information

• use new module for dumping hashes (possibly for passwords?), and go through options

• set options, same as for other modules

• successful hash dump
• discovery
  • another user: Carl

• echo the username:hash into a text file and check the file to validate
• could also open nano and paste hash, then exit and save as txt file

• exit Metasploit and run John the Ripper against the txt file
• discovery
  • password = doggie
• let’s try the user and pass on ssh

• ssh onto the target IP using Carl username and password
• read MySQL.txt in default folder to find the flag

Back Home