Update mysql authbypass hashdump module to correctly close sockets

[adfoster-r7]

Relates to #18278, #18296, and #18297

Fixes an issue with the mysql authbypass hashdump module to correctly close sockets

Verification

Before

docker run --rm -p 3306:3306 -e MYSQL_ROOT_PASSWORD=foo123 mysql:5.7.42

Socket errors:

msf6 auxiliary(scanner/mysql/mysql_authbypass_hashdump) > run rhost=127.0.0.1

[+] 127.0.0.1:3306        - 127.0.0.1:3306 The server allows logins, proceeding with bypass test
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 10% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 20% complete
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 244] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 245] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 248] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 247] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 250] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 251] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 252] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 253] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 249] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 254] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 246] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 256] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 255] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 258] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 261] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 262] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 263] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 264] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 260] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 266] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 268] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 259] caught an unhandled exception: Too many open files - socket(2)
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Thread 257] caught an unhandled exception: Too many open files - socket(2)


...etc..

After

No socket errors:

msf6 auxiliary(scanner/mysql/mysql_authbypass_hashdump) > run rhost=127.0.0.1

[+] 127.0.0.1:3306        - 127.0.0.1:3306 The server allows logins, proceeding with bypass test
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 10% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 20% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 30% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 40% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 50% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 60% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 70% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 80% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 90% complete
[*] 127.0.0.1:3306        - 127.0.0.1:3306 Authentication bypass is 100% complete
[-] 127.0.0.1:3306        - 127.0.0.1:3306 Unable to bypass authentication, this target may not be vulnerable
[*] 127.0.0.1:3306        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Exploitation still works against a vulnerable target:

docker run -it --rm -p 3306:3306 vulhub/mysql:5.5.23

msf6 auxiliary(scanner/mysql/mysql_authbypass_hashdump) > run rhost=127.0.0.1

[+] 127.0.0.1:3306        - 127.0.0.1:3306 The server allows logins, proceeding with bypass test
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Successfully bypassed authentication after 2 attempts. URI: mysql://root:[email protected]:3306
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Successfully exploited the authentication bypass flaw, dumping hashes...
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Saving HashString as Loot: root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
[+] 127.0.0.1:3306        - 127.0.0.1:3306 Hash Table has been saved: /Users/user/.msf4/loot/20231012174520_default_127.0.0.1_mysql.hashes_407628.txt
[*] 127.0.0.1:3306        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[sempervictus]

Sockets should probably be registered on instantiation for automated cleanup/GC when the module completes, but i'm all for this direct leak-plugging effort. Thanks as always sir.

[adfoster-r7]

Sockets should probably be registered on instantiation for automated cleanup/GC when the module completes

That all happens currently, it's just for this scenario the module is creating hundreds of sockets in a tight threaded loop, so we run out of available sockets before the module can complete and close the opened sockets 😄

[sempervictus]

Yeah, the FD cost of our abstractions is high. I've been toying with a rust-based "under-lib" leveraging raw access where possible and delivering fast abstraction to the Ruby side (think "splice-capable" internally) to ameliorate the effects of our dependency on stdlib... but being pure Ruby has an academic benefit, and its no small effort to implement properly.

[cgranleese-r7]

Everything seems to be working as expected.

Before

After

Not vulnerable

Vulnerable

[cgranleese-r7]

Release Notes

Fixes an issue with the scanner/mysql/mysql_authbypass_hashdump module to now correctly close sockets.