133 lines
3.7 KiB
Ruby
133 lines
3.7 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'yaml'
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
include Msf::Exploit::Remote::MYSQL
|
|
include Msf::Auxiliary::Report
|
|
include Msf::Auxiliary::Scanner
|
|
include Msf::OptionalSession::MySQL
|
|
|
|
def initialize
|
|
super(
|
|
'Name' => 'MYSQL Schema Dump',
|
|
'Description' => %Q{
|
|
This module extracts the schema information from a
|
|
MySQL DB server.
|
|
},
|
|
'Author' => ['theLightCosine'],
|
|
'License' => MSF_LICENSE
|
|
)
|
|
|
|
register_options([
|
|
OptBool.new('DISPLAY_RESULTS', [true, "Display the Results to the Screen", true])
|
|
])
|
|
|
|
end
|
|
|
|
def run_host(ip)
|
|
# If we have a session make use of it
|
|
if session
|
|
print_status("Using existing session #{session.sid}")
|
|
self.mysql_conn = session.client
|
|
else
|
|
# otherwise fallback to attempting to login
|
|
return unless mysql_login_datastore
|
|
end
|
|
|
|
mysql_schema = get_schema
|
|
mysql_schema.each do |db|
|
|
report_note(
|
|
:host => mysql_conn.peerhost,
|
|
:type => "mysql.db.schema",
|
|
:data => db,
|
|
:port => mysql_conn.peerport,
|
|
:proto => 'tcp',
|
|
:update => :unique_data
|
|
)
|
|
end
|
|
output = "MySQL Server Schema \n Host: #{mysql_conn.peerhost} \n Port: #{mysql_conn.peerport} \n ====================\n\n"
|
|
output << YAML.dump(mysql_schema)
|
|
this_service = report_service(
|
|
:host => mysql_conn.peerhost,
|
|
:port => mysql_conn.peerport,
|
|
:name => 'mysql',
|
|
:proto => 'tcp'
|
|
)
|
|
p = store_loot('mysql_schema', "text/plain", mysql_conn.peerhost, output, "#{mysql_conn.peerhost}_mysql_schema.txt", "MySQL Schema", this_service)
|
|
print_good("Schema stored in: #{p}")
|
|
print_good output if datastore['DISPLAY_RESULTS']
|
|
end
|
|
|
|
|
|
def get_schema
|
|
mysql_schema=[]
|
|
res = mysql_query("show databases")
|
|
if res.size > 0
|
|
res.each do |row|
|
|
next if row[0].nil?
|
|
next if row[0].empty?
|
|
next if row[0]== "information_schema"
|
|
next if row[0]== "mysql"
|
|
next if row[0]== "performance_schema"
|
|
next if row[0]== "test"
|
|
tmp_db ={}
|
|
tmp_db['DBName'] = row[0]
|
|
tmp_db['Tables'] = []
|
|
tmp_tblnames = get_tbl_names(row[0])
|
|
unless tmp_tblnames.nil? or tmp_tblnames.empty?
|
|
tmp_tblnames.each do |table_name|
|
|
tmp_tbl={}
|
|
tmp_tbl['TableName'] = table_name
|
|
tmp_tbl['Columns'] = []
|
|
tmp_clmnames = get_columns(tmp_db['DBName'],table_name)
|
|
unless tmp_clmnames.nil? or tmp_clmnames.empty?
|
|
tmp_clmnames.each do |column|
|
|
tmp_column = {}
|
|
tmp_column['ColumnName'] = column[0]
|
|
tmp_column['ColumnType'] = column[1]
|
|
tmp_tbl['Columns'] << tmp_column
|
|
end
|
|
end
|
|
tmp_db['Tables'] << tmp_tbl
|
|
end
|
|
end
|
|
mysql_schema << tmp_db
|
|
end
|
|
end
|
|
return mysql_schema
|
|
end
|
|
|
|
# Gets all of the Tables names inside the given Database
|
|
def get_tbl_names(dbname)
|
|
|
|
tables=[]
|
|
res = mysql_query("SHOW tables from #{dbname}")
|
|
if res.size > 0
|
|
res.each do |row|
|
|
next if row[0].nil?
|
|
next if row[0].empty?
|
|
tables<<row[0]
|
|
end
|
|
end
|
|
return tables
|
|
|
|
end
|
|
|
|
def get_columns(db_name,tbl_name)
|
|
tables=[]
|
|
res = mysql_query("desc #{db_name}.#{tbl_name}")
|
|
if res.size > 0
|
|
res.each do |row|
|
|
next if row[0].nil?
|
|
next if row[0].empty?
|
|
tables<< [row[0],row[1]]
|
|
end
|
|
end
|
|
return tables
|
|
end
|
|
end
|