# MySQL (Port 3306)

## Quick Intro <a href="#quick-intro" id="quick-intro"></a>

* MySQL is an open-source relational database management system
* Use Port 3306

## Nmap

```
nmap -sV -Pn -vv --script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $ip -p 3306

nmap -sV -Pn -vv -script=mysql* $ip -p 3306
```

## Local Access <a href="#local-access" id="local-access"></a>

if you gain access to target box and see mysql running , you can try to connect with it from target locally

```
mysql -u root 
# Connect to root without password

mysql -u root -p 
# A password will be asked

# Always test root:root credential
```

## Remote Access  <a href="#remote-access" id="remote-access"></a>

```
mysql -h <Hostname> -u root

mysql -h <Hostname> -u root@localhost
```

## If mysql is running as root <a href="#if-running-as-root" id="if-running-as-root"></a>

If Mysql is running as root and you have acces, you can run commands:

```
mysql> select do_system('id');

mysql> \! sh
```

## Getting all the information from inside the database <a href="#getting-all-the-information-from-inside-the-database" id="getting-all-the-information-from-inside-the-database"></a>

```
mysqldump -u admin -p admin --all-databases --skip-lock-tables 
```

## Post Enumeration <a href="#post-enumeration" id="post-enumeration"></a>

Here are list of some files to check after shell on target system to get some credentials or some juicy information that help to get root easily&#x20;

### MySQL server configuration file <a href="#mysql-server-configuration-file" id="mysql-server-configuration-file"></a>

* Unix

```
my.cnf
/etc/mysql
/etc/my.cnf
/etc/mysql/my.cnf
/var/lib/mysql/my.cnf
~/.my.cnf
/etc/my.cnf
```

* Windows

```
config.ini
my.ini
windows\my.ini
winnt\my.ini
<InstDir>/mysql/data/
```

### Command History <a href="#command-history" id="command-history"></a>

```
~/.mysql.history
```

### Log Files <a href="#log-files" id="log-files"></a>

```
connections.log
update.log
common.log
```

### Finding passwords to MySQL <a href="#finding-passwords-to-mysql" id="finding-passwords-to-mysql"></a>

> You might gain access to a shell by uploading a reverse-shell. And then you need to escalate your privilege.

> Look into the database and see what users and passwords that are available.

```
/var/www/html/configuration.php
```