Add MySQL Arch & Platform detection by query

[sjanusz-r7]

This PR adds in the ability to detect the MySQL server's host's platform and arch by running a query.

In the future, this should instead be gathered from the initial server connection info similar to MSSQL's ENVCHANGE and initial_connection_info. However I wasn't able to verify this information in WireShark as the data is encrypted, even if the SSL option is set to false:

In the above image, the initial MySQL connection receives an error 1158, Got an error reading communication packets. The second connection request is successful, but encrypted using TLS.

Before

msf6 auxiliary(scanner/mysql/mysql_login) > sessions

Active sessions
===============

  Id  Name  Type   Information                  Connection
  --  ----  ----   -----------                  ----------
  1         mysql  MySQL root @ 127.0.0.1:3306  127.0.0.1:64696 -> 127.0.0.1:3306 (127.0.0.1)
  2         mysql  MySQL root @ 127.0.0.1:4306  127.0.0.1:64698 -> 127.0.0.1:4306 (127.0.0.1)

After

msf6 auxiliary(scanner/mysql/mysql_login) > sessions

Active sessions
===============

  Id  Name  Type                           Information                  Connection
  --  ----  ----                           -----------                  ----------
  8         mysql x86_64/Linux             MySQL root @ 127.0.0.1:3306  127.0.0.1:64569 -> 127.0.0.1:3306 (127.0.0.1)
  9         mysql x86_64/debian-linux-gnu  MySQL root @ 127.0.0.1:4306  127.0.0.1:64631 -> 127.0.0.1:4306 (127.0.0.1)

Confirming we get the correct platform from the string:

>> framework.sessions[1].platform
=> "debian-linux-gnu"
>> Msf::Platform.find_platform(framework.sessions[1].platform)
=> Msf::Module::Platform::Linux

Verification

Get yourself a MySQL Docker container:

docker run -it --rm -e MYSQL_ROOT_PASSWORD='password' -p 3306:3306 mysql:8.3.0

and MariaDB:

docker run -it --rm -e MYSQL_ROOT_PASSWORD='password' -p 4306:3306 mariadb:11.2.2

• Start msfconsole
• use mysql_login
• run rhost={...} etc.
• Verify that sessions returns you a MySQL Linux x86_64 session.
• Verify that targeting a MariaDB server results in an x86_64 debian-linux-gnu platform, but you can call Msf::Module::Platform.find_platform(framework.sessions[session_id_here].platform) and that it returns Linux.

[cgranleese-r7]

Worked as expected 👍

Before

After

[sjanusz-r7]

turning this into draft until I fix the MySQL acceptance tests & convert the mysql_enum module to use the server variables if present.

[adfoster-r7]

What are your thoughts on naming this something more granular, since this is a very specific implementation that handles trying to detect the target's platform+arch, and in the future it might not even query the remote server - it might use the original server version connection string that it was greeted with

Maybe one of:

• def platform_and_arch
• def detect_platform_and_arch - similar to the jboss mixin, and a bunch of other modules that use the def detect_* convention
• def get_platform_and_arch - similar to the mssql_clr_payload module

[adfoster-r7]

Or I guess an explicit def query_platform_and_arch style method works too, as in the future we could provide a different implementation that does it based the connection details - your call 👍

[adfoster-r7]

Is there any extra details here? Is this for this part:

Verify that targeting a MariaDB server results in an x86_64 debian-linux-gnu platform, but you can call Msf::Module::Platform.find_platform(framework.sessions[session_id_here].platform) and that it returns Linux.

If so, I'm guessing we'd need a lot of new aliases for all of the possibilities that mysql will return? Or do the docs say the server will only return these values? Or does the mysql client need to normalize the platform value a bit more for the different possibilities that could be returned - presumably windows would need to be handled differently too?

[cgranleese-r7]

Updated testing, seems to be working as intended 👍

Note

Output has been updated to now return mysql x86_64/Linux for both

[adfoster-r7]

Just to confirm; should this be Msf::Platform::Linux or Linux ? 👀

[cgranleese-r7]

Retested and everything looks good 👍

Stale

[cgranleese-r7]

Release Notes

This PR adds support to detect the MySQL server's host's platform and arch by running a query.