CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'yaml'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::MYSQL
10
  include Msf::Auxiliary::Report
11
  include Msf::Auxiliary::Scanner
12
  include Msf::OptionalSession::MySQL
13

14
  def initialize
15
    super(
16
      'Name'           => 'MYSQL Schema Dump',
17
      'Description'    => %Q{
18
          This module extracts the schema information from a
19
          MySQL DB server.
20
      },
21
      'Author'         => ['theLightCosine'],
22
      'License'        => MSF_LICENSE
23
    )
24

25
    register_options([
26
      OptBool.new('DISPLAY_RESULTS', [true, "Display the Results to the Screen", true])
27
      ])
28

29
  end
30

31
  def run_host(ip)
32
    # If we have a session make use of it
33
    if session
34
      print_status("Using existing session #{session.sid}")
35
      self.mysql_conn = session.client
36
    else
37
      # otherwise fallback to attempting to login
38
      return unless mysql_login_datastore
39
    end
40

41
    mysql_schema = get_schema
42
    mysql_schema.each do |db|
43
      report_note(
44
        :host  => mysql_conn.peerhost,
45
        :type  => "mysql.db.schema",
46
        :data  => db,
47
        :port  => mysql_conn.peerport,
48
        :proto => 'tcp',
49
        :update => :unique_data
50
      )
51
    end
52
    output = "MySQL Server Schema \n Host: #{mysql_conn.peerhost} \n Port: #{mysql_conn.peerport} \n ====================\n\n"
53
    output << YAML.dump(mysql_schema)
54
    this_service = report_service(
55
          :host  => mysql_conn.peerhost,
56
          :port => mysql_conn.peerport,
57
          :name => 'mysql',
58
          :proto => 'tcp'
59
          )
60
    p = store_loot('mysql_schema', "text/plain", mysql_conn.peerhost, output, "#{mysql_conn.peerhost}_mysql_schema.txt", "MySQL Schema", this_service)
61
    print_good("Schema stored in: #{p}")
62
    print_good output if datastore['DISPLAY_RESULTS']
63
  end
64

65

66
  def get_schema
67
    mysql_schema=[]
68
    res = mysql_query("show databases")
69
    if res.size > 0
70
      res.each do |row|
71
        next if row[0].nil?
72
        next if row[0].empty?
73
        next if row[0]== "information_schema"
74
        next if row[0]== "mysql"
75
        next if row[0]== "performance_schema"
76
        next if row[0]== "test"
77
        tmp_db ={}
78
        tmp_db['DBName'] = row[0]
79
        tmp_db['Tables'] = []
80
        tmp_tblnames = get_tbl_names(row[0])
81
        unless tmp_tblnames.nil? or tmp_tblnames.empty?
82
          tmp_tblnames.each do |table_name|
83
            tmp_tbl={}
84
            tmp_tbl['TableName'] = table_name
85
            tmp_tbl['Columns'] = []
86
            tmp_clmnames = get_columns(tmp_db['DBName'],table_name)
87
            unless tmp_clmnames.nil? or tmp_clmnames.empty?
88
              tmp_clmnames.each do |column|
89
                tmp_column = {}
90
                tmp_column['ColumnName'] = column[0]
91
                tmp_column['ColumnType'] = column[1]
92
                tmp_tbl['Columns'] << tmp_column
93
              end
94
            end
95
            tmp_db['Tables'] << tmp_tbl
96
          end
97
        end
98
        mysql_schema << tmp_db
99
      end
100
    end
101
    return mysql_schema
102
  end
103

104
  # Gets all of the Tables names inside the given Database
105
  def get_tbl_names(dbname)
106

107
    tables=[]
108
    res = mysql_query("SHOW tables from #{dbname}")
109
    if res.size > 0
110
      res.each do |row|
111
        next if row[0].nil?
112
        next if row[0].empty?
113
        tables<<row[0]
114
      end
115
    end
116
    return tables
117

118
  end
119

120
  def get_columns(db_name,tbl_name)
121
    tables=[]
122
    res = mysql_query("desc #{db_name}.#{tbl_name}")
123
    if res.size > 0
124
      res.each do |row|
125
        next if row[0].nil?
126
        next if row[0].empty?
127
        tables<< [row[0],row[1]]
128
      end
129
    end
130
    return tables
131
  end
132
end
133

134