MySQL Magic: Dump MySQL Client Password From Memory

I made this just for fun, use for illegal purposes are not allowed. The mysql client read the password, then write this for some malloc’ed memory, and free it, but just because a chunk was freed doesn’t mean it will be used again, to ensure that your programs not keep sensitive information in memory you must overwrite the memory.

The main goal is get the password passed through tty, but sometimes it also gets the password passed from command line (-pxxxxxx).

Tested in mysql Ver 15.1 Distrib 10.3.13-MariaDB, for Linux (x86_64) using readline 5.1

Also Read – Pyrit : The Famous WPA Pre-Computed Cracker, Migrated from Google

Compiling

For compile you only need to run make, if you want add some flags, for any reason, you can do that with CFLAGS=myflags make.

if the system mysql client is not placed at /usr/bin/mysql you’ll need compile with CFLAGS=-DMYSQLCLI=/path/to/mysql make

Options

mysql-magic [options]
-o comma-separated list of offset
-s search the memory for passwords and get offset
-d Write heap to the folder
-l Listen mode, wait for outgoing ipv4 connections on port 3306
-r Sleep time (Default: 3 seconds)
-p Use process_vm_readv instead of /proc/pid/mem

pass -d is a good thing to do, the password, and some informations like old queries, can remain in memory, so you can analyse this and maybe build a wordlist based on it, if the password don’t are in the offset

Demo

R K

Recent Posts

groupadd Command in Linux: Create Groups and Set GID Options

In Linux, groups organize user accounts and define shared access to files and resources. Every…

3 hours ago

touch Command in Linux: Create Files and Update Timestamps

The touch command in Linux does two things: it creates new empty files, and it updates the…

3 hours ago

rsync Command in Linux: Sync Files, Mirror, and Transfer Remotely

The rsync command in Linux synchronizes files and directories between two locations, locally or over SSH. Unlike scp,…

1 day ago

patch Command in Linux: Apply Diff Files and Reverse Changes

The patch command in Linux applies a set of changes from a diff file to one or…

1 day ago

basename Command in Linux: Strip Directory Paths and Suffixes

The basename command in Linux extracts the last component of a file path, removing the leading directory…

1 day ago

timeout Command in Linux: Kill Long-Running Commands Safely

The timeout command in Linux runs a command with a time limit and terminates it when the limit is reached. It is part of GNU coreutils, available on virtually every Linux distribution. It is most useful for commands with no built-in timeout option, such as ping, curl, tcpdump, or a custom script that might hang indefinitely. How the timeout Command Works in Linux The syntax is: bashtimeout [OPTIONS] DURATION COMMAND [ARG]...…

1 day ago