{"id":170,"date":"2023-06-11T21:20:26","date_gmt":"2023-06-11T21:20:26","guid":{"rendered":"https:\/\/justatrainingblog.co.uk\/?p=170"},"modified":"2023-06-11T21:20:27","modified_gmt":"2023-06-11T21:20:27","slug":"thm-hacking-sql","status":"publish","type":"post","link":"https:\/\/justatrainingblog.co.uk\/?p=170","title":{"rendered":"THM &#8211; Hacking SQL"},"content":{"rendered":"\n<p>Finishing off the extended Network Services section of TryHackMe is SQL. I will cover SQL in a later knowledge article however this session will focus on enumerating and exploiting improperly configured SQL servers. <\/p>\n\n\n\n<p>Note this is using mySQL.<\/p>\n\n\n\n<p><strong>Target IP Address: 10.10.59.74 (IP changed after initial scan)<\/strong><\/p>\n\n\n\n<p><strong>Assumed login details: root:password<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"text-decoration: underline;\">Footprinting &amp; Enumeration<\/span><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"943\" height=\"511\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-17.png\" alt=\"\" class=\"wp-image-171\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-17.png 943w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-17-300x163.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-17-768x416.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-17-850x461.png 850w\" sizes=\"(max-width: 943px) 100vw, 943px\" \/><\/figure>\n\n\n\n<p>To start we&#8217;ve done a port scan of the target server. On this we can see both port 22 and port 3306 open both over TCP. <\/p>\n\n\n\n<p>Now we have some assumed login details. Lets test if these are correct. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"522\" height=\"82\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-18.png\" alt=\"\" class=\"wp-image-172\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-18.png 522w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-18-300x47.png 300w\" sizes=\"(max-width: 522px) 100vw, 522px\" \/><\/figure>\n\n\n\n<p>Ok so the login details are correct. Time to swap to Metasploit. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"936\" height=\"461\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-19.png\" alt=\"\" class=\"wp-image-173\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-19.png 936w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-19-300x148.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-19-768x378.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-19-850x419.png 850w\" sizes=\"(max-width: 936px) 100vw, 936px\" \/><\/figure>\n\n\n\n<p>We&#8217;ve now launched metasploit and loaded up the mysql_sql module. We will be running an exploit using PASSWORD\/RHOSTS\/USERNAME<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"935\" height=\"377\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-20.png\" alt=\"\" class=\"wp-image-174\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-20.png 935w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-20-300x121.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-20-768x310.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-20-850x343.png 850w\" sizes=\"(max-width: 935px) 100vw, 935px\" \/><\/figure>\n\n\n\n<p>Variables have been successfully set. The exploit is set to simply pull the version it&#8217;s running on. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"575\" height=\"116\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-21.png\" alt=\"\" class=\"wp-image-175\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-21.png 575w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-21-300x61.png 300w\" sizes=\"(max-width: 575px) 100vw, 575px\" \/><\/figure>\n\n\n\n<p>Perfect. Now lets try something a little more ambitious. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"604\" height=\"201\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-22.png\" alt=\"\" class=\"wp-image-176\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-22.png 604w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-22-300x100.png 300w\" sizes=\"(max-width: 604px) 100vw, 604px\" \/><\/figure>\n\n\n\n<p>and we now have a full list of databases running on the server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exploiting mySQL<\/h2>\n\n\n\n<p>This time around we&#8217;ll be using the mysql_schemadump module. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"953\" height=\"497\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-23.png\" alt=\"\" class=\"wp-image-177\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-23.png 953w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-23-300x156.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-23-768x401.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-23-850x443.png 850w\" sizes=\"(max-width: 953px) 100vw, 953px\" \/><\/figure>\n\n\n\n<p>Not a lot of point screenshotting it again but PASSWORD, RHOSTS and USERNAME variables set and the exploit has been run and the tables dumped. <\/p>\n\n\n\n<p>Swapping over to the <strong>mysql_hashdump <\/strong>module we again set the variables and run<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"956\" height=\"669\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-27.png\" alt=\"\" class=\"wp-image-181\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-27.png 956w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-27-300x210.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-27-768x537.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-27-850x595.png 850w\" sizes=\"(max-width: 956px) 100vw, 956px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"957\" height=\"236\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-28.png\" alt=\"\" class=\"wp-image-182\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-28.png 957w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-28-300x74.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-28-768x189.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-28-850x210.png 850w\" sizes=\"(max-width: 957px) 100vw, 957px\" \/><\/figure>\n\n\n\n<p>From here we can see a user account &#8216;Carl&#8217; which is worth exploring. We have a hash so lets see if we can crack that hash using John the Ripper. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"853\" height=\"293\" src=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-29.png\" alt=\"\" class=\"wp-image-183\" srcset=\"https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-29.png 853w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-29-300x103.png 300w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-29-768x264.png 768w, https:\/\/justatrainingblog.co.uk\/wp-content\/uploads\/2023\/06\/image-29-850x292.png 850w\" sizes=\"(max-width: 853px) 100vw, 853px\" \/><\/figure>\n\n\n\n<p>There we go. One successfully decrypted hash. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Finishing off the extended Network Services section of TryHackMe is SQL. I will cover SQL in a later knowledge article&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[6,3],"tags":[],"class_list":["post-170","post","type-post","status-publish","format-standard","hentry","category-practice","category-tryhackme"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=170"}],"version-history":[{"count":1,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/170\/revisions"}],"predecessor-version":[{"id":184,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/170\/revisions\/184"}],"wp:attachment":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}