Examples of MySQL users and permissions and methods for cracking root passwords
- 2021-11-30 01:47:33
- OfStack
MySQL Users and Permissions
In MySQL, a system itself has a database called MySQL. After the database is installed, the system has several databases. MySQL is one of them. MySQL database has a table related to user account authority called user table, in which there are created users.
The complete user name in MySQL is formed by user + host name, and the host name determines which host the user can log in on.
1. User creation and password modification
1. User creation
create user 'USERNAME'@'HOST' identified by 'PASSWORD';
USERNAME: User name
HOST: Host address
PASSWORD: Password
Example:
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
There are anonymous accounts in MySQL, which can be deleted by running the security hardening script mysql_secure_installation or manually.
Delete user:
DROP USER 'USERNAME'@'HOST';Example:
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
MariaDB [(none)]> DROP USER ''@'localhost';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> DROP USER ''@'localhost.localdomain';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
5 rows in set (0.00 sec)
2. Password changes
Modification of mysql password
SET PASSWORD FOR user = PASSWORD('cleartext password')
UPDATE table SET password = password('cleartext password')
Example:
Make password changes for masuri users
MariaDB [(none)]> SET PASSWORD FOR masuri@192.168.73.133 = PASSWORD ('magedu');
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| masuri | 192.168.73.133 | *6B8CCC83799A26CD19D7AD9AEEADBCD30D8A8664 |
+--------+-----------------------+-------------------------------------------+
# The password has changed at this time
The password of root account is empty, and the password is set for root password. Because the setting of one item and one item is too troublesome, you can also use the operation of modifying the table to modify the password
MariaDB [(none)]> update mysql.user set password=password('centos') where user='root';
Query OK, 4 rows affected (0.01 sec)
Rows matched: 4 Changed: 4 Warnings: 0
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | *128977E278358FF80A246B5046F51043A2B1FCED |
| root | localhost.localdomain | *128977E278358FF80A246B5046F51043A2B1FCED |
| root | 127.0.0.1 | *128977E278358FF80A246B5046F51043A2B1FCED |
| root | ::1 | *128977E278358FF80A246B5046F51043A2B1FCED |
| masuri | 192.168.73.133 | *6B8CCC83799A26CD19D7AD9AEEADBCD30D8A8664 |
+--------+-----------------------+-------------------------------------------+
5 rows in set (0.00 sec)
At this time, the password has been modified but still can't log in, so you need to refresh the permissions
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
2. MySQL Rights Management
Permission management involves several categories of permissions, such as administrative class, program class, database level, table level and field level
Management class: Can create users, can display the database list, can reload the configuration file, can close the database, and replication-related can be executed, can manage the process, can create temporary tables, can create files in the database.
Program class mainly involves three programs, functions, stored procedures and triggers, such as whether you can create, modify, delete and execute these permissions at the level of libraries, tables and fields, such as whether you can add, delete, check and change the fields of libraries and tables
1. Authorize GRANT
When authorizing a user, if the user does not exist, you can create it. Before authorizing, you must first confirm that you are an administrator and have authorized rights.
GRANT
priv_type [(column_list)]
[, priv_type [(column_list)]] ...
ON [object_type] priv_level
TO user_specification [, user_specification] ...
[REQUIRE {NONE | ssl_option [[AND] ssl_option] ...}]
[WITH with_option ...]
Example:
Create a user of wordpress and authorize it.
MariaDB [(none)]> CREATE DATABASE wordpress;
Query OK, 1 row affected (0.02 sec)
MariaDB [(none)]> GRANT ALL ON wordpress.* TO wpuser@'192.168.73.%' identified by 'mylinuxops';
Query OK, 0 rows affected (0.00 sec)
2. View user permissions
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
3. Additional options for authorization
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
Cancel permission
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
Example:
MariaDB [(none)]> revoke delete on wordpress.* from wpuser@'192.168.73.%';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> show grants for wpuser@'192.168.73.%';
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for wpuser@192.168.73.% |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'wpuser'@'192.168.73.%' IDENTIFIED BY PASSWORD '*EC0DBFB480593BB6ED2EC028A4231A72D8137406' |
| GRANT SELECT, INSERT, UPDATE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `wordpress`.* TO 'wpuser'@'192.168.73.%' |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)
# At this time wpuser@'192.168.73.%' It's gone delete Authority
Cracking of root Password in MySQL
Sometimes you may encounter the loss of root password in your work. At this time, you can retrieve root password by the following methods
The following is a demonstration of how to crack the root password
1. Unable to log in to MySQL with unknown password
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
Step 2 Crack
1. Modify the configuration file/etc/my. cnf to add two lines of parameters
skip_grant_tables: Skip the authorization table information. If you use MySQL again after this item takes effect, you don't need to use a password, but other remote users can log in without using a password, which has a certain risk
skip_networking: Turn off the network function. Because the skip_grant_tables option is enabled, it is very dangerous for other users to log in to MySQL without password, so it is necessary to turn off the network function and only allow local users to operate.
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
2. Log in to MySQL and change the password
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
3. After the password is modified, the configuration file needs to be restored
Log off or delete the two options you just enabled, and then restart the service
MariaDB [(none)]> create user masuri@192.168.73.133 identified by 'centos';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> select user,host,password from mysql.user;
+--------+-----------------------+-------------------------------------------+
| user | host | password |
+--------+-----------------------+-------------------------------------------+
| root | localhost | |
| root | localhost.localdomain | |
| root | 127.0.0.1 | |
| root | ::1 | |
| | localhost | |
| | localhost.localdomain | |
| masuri | 192.168.73.133 | *128977E278358FF80A246B5046F51043A2B1FCED |
+--------+-----------------------+-------------------------------------------+
7 rows in set (0.00 sec)
4. Log in to MySQL with the new password
[root@localhost ~]# mysql -uroot -p123456
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 10.2.23-MariaDB-log Source distribution
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>