The Ethical Hacker Network - spit out all users and passwords in MySQL DB?

wlandymore

Newbie

Offline

Posts: 34

spit out all users and passwords in MySQL DB?

« on: April 17, 2012, 01:02:01 PM »

I'm practicing a SQL injection on a DB and I've made some progress. When I enter:

') AND (SELECT * FROM mysql.user) -- AND (((1=1

I get: "Operand should contain 1 column(s)"

How can I get this to display on one line or something so that I can see the output from that command?


	Logged

j0rDy

Hero Member

Offline

Posts: 590

Re: spit out all users and passwords in MySQL DB?

« Reply #1 on: April 18, 2012, 02:43:58 AM »

its been a while, but let me try this.

the key is to know which tables and columns are containing the information you want, you can get these by requesting the information.schema database. When you have insufficient rights to access the information.schema database you can try two things, guess the names or brute force them.

in the end you want to inject a request like this:

UNION SELECT password FROM users where login_name='admin'--

there are several good sql injection tutorials out there which you can use for more information. good luck!


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

TheXero

Full Member

Offline

Posts: 112

Try Harder!

Re: spit out all users and passwords in MySQL DB?

« Reply #2 on: April 18, 2012, 05:28:54 AM »

This is where I'd start running "sqlmap" with a --dumpall xD


	Logged

OSCP | OSWP
www.thexero.co.uk

j0rDy

Hero Member

Offline

Posts: 590

Re: spit out all users and passwords in MySQL DB?

« Reply #3 on: April 18, 2012, 08:29:14 AM »

Quote from: TheXero on April 18, 2012, 05:28:54 AM

This is where I'd start running "sqlmap" with a --dumpall xD

hehe, me too, hence the its been a while. i know certain challenges block such tools so being able to do it manually is a plus in that situation, in real life however...


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

wlandymore

Newbie

Offline

Posts: 34

Re: spit out all users and passwords in MySQL DB?

« Reply #4 on: April 18, 2012, 11:24:55 AM »

I hadn't actually thought of sqlmap. I have it right on my desktop too.

Is --dumpall actually a switch for sqlmap?


	Logged

lorddicranius

Sr. Member

Offline

Posts: 447

Re: spit out all users and passwords in MySQL DB?

« Reply #5 on: April 18, 2012, 11:29:11 AM »

Quote from: wlandymore on April 18, 2012, 11:24:55 AM

I hadn't actually thought of sqlmap. I have it right on my desktop too.

Is --dumpall actually a switch for sqlmap?

"--dump-all", but yep! http://sqlmap.sourceforge.net/doc/README.html#s5


	Logged

GSEC, eCPPT, Sec+

wlandymore

Newbie

Offline

Posts: 34

Re: spit out all users and passwords in MySQL DB?

« Reply #6 on: April 18, 2012, 07:50:48 PM »

nah, didn't seem to work with sqlmap. Looks like I'll have to use the old fashioned way...


	Logged

j0rDy

Hero Member

Offline

Posts: 590

Re: spit out all users and passwords in MySQL DB?

« Reply #7 on: April 19, 2012, 01:54:38 AM »

see if you can access the information.schema table, it will save you loads of time and helps you configure your query once you know which tables and columns you want to extract.


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

wlandymore

Newbie

Offline

Posts: 34

Re: spit out all users and passwords in MySQL DB?

« Reply #8 on: April 25, 2012, 07:19:30 PM »

If I run:
') AND (select * from information_schema)-- (((1=1

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...


	Logged

j0rDy

Hero Member

Offline

Posts: 590

Re: spit out all users and passwords in MySQL DB?

« Reply #9 on: April 26, 2012, 04:49:20 AM »

Quote from: wlandymore on April 25, 2012, 07:19:30 PM

hmm, from here you can go two ways: try to guess the correct information.schema tablename (which could be glocken_emil.information_schema) or try to guess other tables like glocken_emil.users.

come to think of it, the error gets me thinking, it looks like the query is being modified to access a table with the tablename 'glocken_emil.*'. again it has been a while but you can try to use the brute forcer in sqlmap (where you define the prefix as glocken_emil) and see if you can get some tablenames.


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

MaXe

Hero Member

Offline

Posts: 669

I've just upgraded myself to a cyborg muahahaa!!1

Re: spit out all users and passwords in MySQL DB?

« Reply #10 on: April 26, 2012, 08:24:53 AM »

Use "LIMIT 0,1" in the end of your original query to return only one (1) result from your "SELECT * FROM information_schema" sub-query.

Furthermore, -- (((1=1 seems incorrect.
If you break out of a query with ' (apostrophe), you could something as simple as: AND 'a'='a . That will make the end of the query look like: 'a'='a', as it will append the "missing" apostrophe.

Using a comment like -- and then adding more data afterward seems a bit obscure, because either it (or other ways like #) works or you should avoid using it.

FYI I recommend you don't just use information_schema, but more specific queries like: information_schema.tables