CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
require 'metasploit/framework/tcp/client'
2
require 'metasploit/framework/login_scanner/base'
3
require 'metasploit/framework/login_scanner/rex_socket'
4
require 'rex/proto/mysql/client'
5

6
module Metasploit
7
  module Framework
8
    module LoginScanner
9

10
      # This is the LoginScanner class for dealing with MySQL Database servers.
11
      # It is responsible for taking a single target, and a list of credentials
12
      # and attempting them. It then saves the results.
13
      class MySQL
14
        include Metasploit::Framework::LoginScanner::Base
15
        include Metasploit::Framework::LoginScanner::RexSocket
16
        include Metasploit::Framework::Tcp::Client
17

18
        # @returns [Boolean] If a login is successful and this attribute is true - a MySQL::Client instance is used as proof,
19
        #   and the socket is not immediately closed
20
        attr_accessor :use_client_as_proof
21

22
        DEFAULT_PORT         = 3306
23
        LIKELY_PORTS         = [3306]
24
        LIKELY_SERVICE_NAMES = ['mysql']
25
        PRIVATE_TYPES        = [:password]
26
        REALM_KEY            = nil
27

28
        def attempt_login(credential)
29
          result_options = {
30
            credential:   credential,
31
            host:         host,
32
            port:         port,
33
            protocol:     'tcp',
34
            service_name: 'mysql'
35
          }
36

37
          begin
38
            # manage our behind the scenes socket. Close any existing one and open a new one
39
            disconnect if self.sock
40
            connect
41

42
            mysql_conn = ::Rex::Proto::MySQL::Client.connect(host, credential.public, credential.private, '', port, io: self.sock)
43

44
          rescue ::SystemCallError, Rex::ConnectionError => e
45
            result_options.merge!({
46
              status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT,
47
              proof: e
48
            })
49
          rescue Rex::Proto::MySQL::Client::ClientError => e
50
            result_options.merge!({
51
              status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT,
52
              proof: e
53
            })
54
          rescue Rex::Proto::MySQL::Client::HostNotPrivileged => e
55
            result_options.merge!({
56
              status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT,
57
              proof: e
58
            })
59
          rescue Rex::Proto::MySQL::Client::AccessDeniedError => e
60
            result_options.merge!({
61
              status: Metasploit::Model::Login::Status::INCORRECT,
62
              proof: e
63
            })
64
          rescue Rex::Proto::MySQL::Client::HostIsBlocked => e
65
            result_options.merge!({
66
              status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT,
67
              proof: e
68
            })
69
          end
70

71
          if mysql_conn
72
            result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
73

74
            # This module no long owns the socket, return it as proof so the calling context can perform additional operations
75
            # Additionally assign values to nil to avoid closing the socket etc automatically
76
            if use_client_as_proof
77
              result_options[:proof] = mysql_conn
78
              result_options[:connection] = self.sock
79
              self.sock = nil
80
            else
81
              mysql_conn.close
82
            end
83
          end
84

85
          ::Metasploit::Framework::LoginScanner::Result.new(result_options)
86
        end
87

88
        # This method sets the sane defaults for things
89
        # like timeouts and TCP evasion options
90
        def set_sane_defaults
91
          self.connection_timeout ||= 30
92
          self.port               ||= DEFAULT_PORT
93
          self.max_send_size      ||= 0
94
          self.send_delay         ||= 0
95
        end
96

97
      end
98

99
    end
100
  end
101
end
102

103