Brute-Force MySQL Password From a Hash

Brute Force MySQL passwordIn most cases, MySQL password instructions provide information on changing MySQL user passwords on the production system (e.g., reset root password without restart). It is even recommended to change passwords regularly for security reasons. But still, sometimes DBA duties on legacy systems offer surprises and you need to recover the original password for some old users.

There is no magic: as long as only hashes are stored and not the original passwords, the only way to recover the lost password is to brute force it from the known hash.

Note on Security and mysql-unsha1 Attack

Interestingly, if a hacker has access to password hash and can sniff mysql traffic, he doesn’t need to recover a plain text password from it. It doesn’t matter how strong the password and how strong the hashing algorithm inside the auth plugin, due to MySQL protocol design, sniffed hash is enough to connect to a database with a patched version of MySQL client. It means, if a hacker has access to a database backup and traffic, he automatically receives all needed information (SHAs) for connecting to a running database. See for the attack details.

Since MySQL 8.0, caching_sha2_password auth plugin is used by default, and this plugin brings a stronger sha256 function instead of sha1 used in mysql_native_password plugin. For authentication with caching_sha2_password plugin, it is also enough to have only a hash and be able to sniff traffic, see for the implementation details.

Still, if you want to have a password that works with an unmodified client, however, you need to do some hacking, see instructions below.

Dump Hash

Let’s return to the password recovery. First of all, we need to dump hashes.

MySQL 5.7 uses the mysql_native_password auth plugin by default and we can dump sha1 hashes with the following command.

MySQL 8.0 uses the caching_sha2_password auth plugin by default and we can dump sha256 hashes as follows.

If you need to get the root password hash and don’t have a user who has read access to mysql.user table, you should start mysqld with the --skip-grant-tables option, see the official doc for details.

Run Linode GPU Instance

For password recovery, it is needed to run calculations on some powerful GPUs, and there are not so many cloud providers with GPU instances on the market. Linode is one of the remarkable cloud providers if you need a simple, reliable provider with a really helpful support department. Linode has a powerful CLI tool that simplifies “bash” automation a lot. Also, for more serious automation, the official Terraform provider exists.

128GB GPU Linode instance password recovery speed is 30000 MH/s (million hashes per second), which is very good. It needs only 2 hours to brute-force an 8-characters MySQL 5.7 passwords (upper case, lower case, numbers). Instance price is only 6 USD/Hour.
For example, the other biggest cloud provider (4 x NVIDIA Tesla V100 instance) with the same recovery speed cost two times more expensive – 12.24 USD/Hour.

Prepare Dictionary

The password brute-forcing is done based on dictionaries. We will use a small rockyou dictionary as an example, to show how it goes.

You can find really good dictionaries on the weakpass dot com website.

But it is possible that even the largest dictionary will not be enough for the recovery. In such a case you should check if the validate_password plugin is enabled and prepare a dictionary based on it. Check it as follows:

If the output of this command is empty, it means that the plugin is disabled. You can find some more details about the plugin in one of our previous blog posts about it, Improving MySQL Password Security with Validation Plugin.

The validate_password_policy field is the most important one here. It can have the following values:

Policy Tests Performed
0 or LOW Length
1 or MEDIUM Length; numeric, lowercase/uppercase, and special characters
2 or STRONG Length; numeric, lowercase/uppercase, and special characters; dictionary file

If validate_password_policy=STRONG and validate_password_dictionary_file is set, we need to exclude passwords from validate_password_dictionary_file:

In the example above:
-m 8 is the minimal length of the password, value from validate_password_length variable;
-M 32 is the maximal length of the password, for replication passwords the maximal length is 32 characters, see MySQL release nodes;
-n password should contain numbers, see validate_password_number_count variable;
-l -u password should contain lowercase/uppercase characters, see validate_password_mixed_case_count variable;
-p password should contain special characters, see validate_password_special_char_count variable;
prohibited.txt is a file from validate_password_dictionary_file variable;
huge-dictonary.txt is the initial dictionary;
reduced-dictonary.txt is the new dictionary without words from prohibited.txt.
If the dictionary attack failed, you have to create your own dictionary for the brute force. In this case, we recommend using one of the following tools: crunch, maskprocessor or via Hashcat options.

Compile Hashcat

In the case of MySQL 8.0, the latest version of hashcat from the master branch should be compiled due to the fact that code from wasn’t released in any version right now.

Enable OpenCL for NVIDIA

Update to the latest software, disable the nouveau driver and reboot:

Install the proprietary driver and reboot

Check the driver

Run Password Recovery

For mysql_native_password (MySQL 5.7) use the 300 code:

For caching_sha2_password (MySQL 8.0) use the 7401 code:

If your password was recovered correctly, you can run the same command with the --show option to display the password.