1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'yaml'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::MYSQL
10
  include Msf::Auxiliary::Report
11
  include Msf::Auxiliary::Scanner
12
  include Msf::OptionalSession::MySQL
13

14
  def initialize
15
    super(
16
      'Name' => 'MYSQL Schema Dump',
17
      'Description' => %Q{
18
          This module extracts the schema information from a
19
          MySQL DB server.
20
      },
21
      'Author' => ['theLightCosine'],
22
      'License' => MSF_LICENSE
23
    )
24

25
    register_options([
26
      OptBool.new('DISPLAY_RESULTS', [true, "Display the Results to the Screen", true])
27
    ])
28
  end
29

30
  def run_host(ip)
31
    # If we have a session make use of it
32
    if session
33
      print_status("Using existing session #{session.sid}")
34
      self.mysql_conn = session.client
35
    else
36
      # otherwise fallback to attempting to login
37
      return unless mysql_login_datastore
38
    end
39

40
    mysql_schema = get_schema
41
    mysql_schema.each do |db|
42
      report_note(
43
        :host => mysql_conn.peerhost,
44
        :type => "mysql.db.schema",
45
        :data => { :database => db },
46
        :port => mysql_conn.peerport,
47
        :proto => 'tcp',
48
        :update => :unique_data
49
      )
50
    end
51
    output = "MySQL Server Schema \n Host: #{mysql_conn.peerhost} \n Port: #{mysql_conn.peerport} \n ====================\n\n"
52
    output << YAML.dump(mysql_schema)
53
    this_service = report_service(
54
      :host => mysql_conn.peerhost,
55
      :port => mysql_conn.peerport,
56
      :name => 'mysql',
57
      :proto => 'tcp'
58
    )
59
    p = store_loot('mysql_schema', "text/plain", mysql_conn.peerhost, output, "#{mysql_conn.peerhost}_mysql_schema.txt", "MySQL Schema", this_service)
60
    print_good("Schema stored in: #{p}")
61
    print_good output if datastore['DISPLAY_RESULTS']
62
  end
63

64
  def get_schema
65
    mysql_schema = []
66
    res = mysql_query("show databases")
67
    if res.size > 0
68
      res.each do |row|
69
        next if row[0].nil?
70
        next if row[0].empty?
71
        next if row[0] == "information_schema"
72
        next if row[0] == "mysql"
73
        next if row[0] == "performance_schema"
74
        next if row[0] == "test"
75

76
        tmp_db = {}
77
        tmp_db['DBName'] = row[0]
78
        tmp_db['Tables'] = []
79
        tmp_tblnames = get_tbl_names(row[0])
80
        unless tmp_tblnames.nil? or tmp_tblnames.empty?
81
          tmp_tblnames.each do |table_name|
82
            tmp_tbl = {}
83
            tmp_tbl['TableName'] = table_name
84
            tmp_tbl['Columns'] = []
85
            tmp_clmnames = get_columns(tmp_db['DBName'], table_name)
86
            unless tmp_clmnames.nil? or tmp_clmnames.empty?
87
              tmp_clmnames.each do |column|
88
                tmp_column = {}
89
                tmp_column['ColumnName'] = column[0]
90
                tmp_column['ColumnType'] = column[1]
91
                tmp_tbl['Columns'] << tmp_column
92
              end
93
            end
94
            tmp_db['Tables'] << tmp_tbl
95
          end
96
        end
97
        mysql_schema << tmp_db
98
      end
99
    end
100
    return mysql_schema
101
  end
102

103
  # Gets all of the Tables names inside the given Database
104
  def get_tbl_names(dbname)
105
    tables = []
106
    res = mysql_query("SHOW tables from #{dbname}")
107
    if res.size > 0
108
      res.each do |row|
109
        next if row[0].nil?
110
        next if row[0].empty?
111

112
        tables << row[0]
113
      end
114
    end
115
    return tables
116
  end
117

118
  def get_columns(db_name, tbl_name)
119
    tables = []
120
    res = mysql_query("desc #{db_name}.#{tbl_name}")
121
    if res.size > 0
122
      res.each do |row|
123
        next if row[0].nil?
124
        next if row[0].empty?
125

126
        tables << [row[0], row[1]]
127
      end
128
    end
129
    return tables
130
  end
131
end
132

133