mysql lua scripts throw mysql.lua:93: bad argument #2 to 'unpack' (data string too short) error #2128
Description
Describe the bug
I'm running nmap 7.80 from the latest Kali distribution (2020.3).
As a target I'm using the Metasploitable-Linux-2.0.0 VM which runs a mysql 5.0.51a-3ubuntu5 on 192.168.56.103:3306 and has a root account without a password.
Running nmap mysql scripts against it results in this output:
nmap -n -Pn --script mysql-\* 192.168.56.103 -p 3306
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-22 10:03 CEST
Nmap scan report for 192.168.56.103
Host is up (0.00026s latency).
PORT STATE SERVICE
3306/tcp open mysql
| mysql-brute:
| Accounts:
| root:<empty> - Valid credentials
| guest:<empty> - Valid credentials
|_ Statistics: Performed 40013 guesses in 19 seconds, average tps: 2105.9
|_mysql-databases: ERROR: Script execution failed (use -d to debug)
|_mysql-dump-hashes: ERROR: Script execution failed (use -d to debug)
| mysql-empty-password:
|_ root account has empty password
| mysql-enum:
| Accounts: No valid accounts found
|_ Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0
| mysql-info:
| Protocol: 10
| Version: 5.0.51a-3ubuntu5
| Thread ID: 123125
| Capabilities flags: 43564
| Some Capabilities: LongColumnFlag, SwitchToSSLAfterHandshake, SupportsTransactions, Support41Auth, ConnectWithDatabase, SupportsCompression, Speaks41ProtocolNew
| Status: Autocommit
|_ Salt: gCXoHXcfYh#q4Md3lIeC
|_mysql-users: ERROR: Script execution failed (use -d to debug)
|_mysql-variables: ERROR: Script execution failed (use -d to debug)
Nmap done: 1 IP address (1 host up) scanned in 18.81 seconds
Debug output (-d) for one of the failed scripts as an example (it seems to be the same for all of them):
nmap -n -Pn --script mysql-empty-password,mysql-databases -d 192.168.56.103 -p 3306
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-22 10:04 CEST
--------------- Timing report ---------------
hostgroups: min 1, max 100000
rtt-timeouts: init 1000, min 100, max 10000
max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
parallelism: min 0, max 0
max-retries: 10, host-timeout: 0
min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI:
NSE: Loaded 2 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 10:04
Completed NSE at 10:04, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 10:04
Completed NSE at 10:04, 0.00s elapsed
Initiating Connect Scan at 10:04
Scanning 192.168.56.103 [1 port]
Discovered open port 3306/tcp on 192.168.56.103
Completed Connect Scan at 10:04, 0.00s elapsed (1 total ports)
Overall sending rates: 2923.98 packets / s.
NSE: Script scanning 192.168.56.103.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 10:04
NSE: Starting mysql-empty-password against 192.168.56.103:3306.
NSE: Finished mysql-empty-password against 192.168.56.103:3306.
Completed NSE at 10:04, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 10:04
NSE: Starting mysql-databases against 192.168.56.103:3306.
NSE: mysql-databases against 192.168.56.103:3306 threw an error!
/usr/bin/../share/nmap/nselib/mysql.lua:93: bad argument #2 to 'unpack' (data string too short)
stack traceback:
[C]: in function 'string.unpack'
/usr/bin/../share/nmap/nselib/mysql.lua:93: in upvalue 'decodeHeader'
/usr/bin/../share/nmap/nselib/mysql.lua:469: in function 'mysql.decodeDataPackets'
/usr/bin/../share/nmap/nselib/mysql.lua:532: in function 'mysql.sqlQuery'
/usr/bin/../share/nmap/scripts/mysql-databases.nse:84: in function </usr/bin/../share/nmap/scripts/mysql-databases.nse:42>
(...tail calls...)
Completed NSE at 10:04, 0.00s elapsed
Nmap scan report for 192.168.56.103
Host is up, received user-set (0.00027s latency).
Scanned at 2020-09-22 10:04:57 CEST for 0s
PORT STATE SERVICE REASON
3306/tcp open mysql syn-ack
| mysql-empty-password:
|_ root account has empty password
Final times for host: srtt: 268 rttvar: 5000 to: 100000
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 10:04
Completed NSE at 10:04, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 10:04
Completed NSE at 10:04, 0.00s elapsed
Read from /usr/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
To Reproduce
See above discription
Expected behavior
Scripts to retrieve and display the information successfully.
Version info (please complete the following information):
- OS:
uname -a
Linux kaliacer 5.8.0-kali1-amd64 #1 SMP Debian 5.8.7-1kali1 (2020-09-14) x86_64 GNU/Linux
cat /etc/*-release
PRETTY_NAME="Kali GNU/Linux Rolling"
NAME="Kali GNU/Linux"
ID=kali
VERSION="2020.3"
VERSION_ID="2020.3"
VERSION_CODENAME="kali-rolling"
ID_LIKE=debian
ANSI_COLOR="1;31"
HOME_URL="https://www.kali.org/"
SUPPORT_URL="https://forums.kali.org/"
BUG_REPORT_URL="https://bugs.kali.org/"
- Output of
nmap --version:
nmap --version
Nmap version 7.80 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.3 openssl-1.1.1g libssh2-1.8.0 libz-1.2.11 libpcre-8.39 nmap-libpcap-1.7.3 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select