From b3948715c46f6362a98c100ab7a9ecc7836ac569 Mon Sep 17 00:00:00 2001 From: dmiller Date: Sat, 18 Jul 2026 04:29:20 +0000 Subject: [PATCH] Check for correct schema. Fixes #2221 --- scripts/mysql-dump-hashes.nse | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/scripts/mysql-dump-hashes.nse b/scripts/mysql-dump-hashes.nse index b243ac80f..5148e1f57 100644 --- a/scripts/mysql-dump-hashes.nse +++ b/scripts/mysql-dump-hashes.nse @@ -75,6 +75,7 @@ action = function(host, port) return end + local pwcol = nil local result = {} for username, password in pairs(creds) do local socket = nmap.new_socket() @@ -84,7 +85,17 @@ action = function(host, port) local status, response = mysqlLogin(socket, username, password) if ( status ) then - local query = "SELECT DISTINCT CONCAT(user, ':', password) FROM mysql.user WHERE password <> ''" + if not pwcol then + local status, rs = mysql.sqlQuery(socket, + "SELECT column_name FROM information_schema.columns " + .. "WHERE table_schema = 'mysql' AND table_name = 'user' " + .. "AND column_name IN ('password', 'authentication_string')") + if status then + pwcol = rs.rows[1][1] + end + pwcol = pwcol or "password" + end + local query = ("SELECT DISTINCT CONCAT(user, ':', %s) FROM mysql.user WHERE %s <> ''"):format(pwcol, pwcol) local status, rows = mysql.sqlQuery( socket, query ) socket:close() if ( status ) then