MySQL Default Account Credentials

#!/usr/bin/env python3
# verify_mysql_default_creds.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import shutil
import subprocess
import sys
import tempfile

DEFAULT_PROBES = [
    'root:',
    'root:root',
    'admin:admin',
    'mysql:mysql',
    'scrutinizer:scrutinizer',
]


def run_mysql(host, port, user, password, query, connect_timeout=5):
    mysql_bin = shutil.which('mysql')
    if not mysql_bin:
        return None, 'mysql client not found in PATH'

    cmd = [
        mysql_bin,
        '--protocol=TCP',
        '-h', host,
        '-P', str(port),
        '-u', user,
        '--connect-timeout=' + str(connect_timeout),
        '--batch',
        '--raw',
        '--skip-column-names',
        '-e', query,
    ]

    env = os.environ.copy()
    env['MYSQL_PWD'] = password

    try:
        cp = subprocess.run(cmd, capture_output=True, text=True, env=env, timeout=connect_timeout + 5)
    except subprocess.TimeoutExpired:
        return None, 'mysql command timed out'
    except Exception as e:
        return None, str(e)

    if cp.returncode == 0:
        return cp.stdout.strip(), None
    return None, (cp.stderr or cp.stdout or 'mysql command failed').strip()


def parse_probe(s):
    if ':' not in s:
        return s, ''
    user, password = s.split(':', 1)
    return user, password


def inspect_mysql_user_table(host, port, admin_user, admin_pass):
    findings = []

    q1 = (
        "SELECT CONCAT(IFNULL(User,''),'@',IFNULL(Host,'')) "
        "FROM mysql.user WHERE User=''"
    )
    out, err = run_mysql(host, port, admin_user, admin_pass, q1)
    if err is None and out:
        for line in out.splitlines():
            findings.append(f'anonymous account present: {line}')

    q2 = (
        "SELECT CONCAT(User,'@',Host,' plugin=',IFNULL(plugin,''),' authlen=',"
        "CHAR_LENGTH(IFNULL(authentication_string,''))) "
        "FROM mysql.user "
        "WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1')"
    )
    out, err = run_mysql(host, port, admin_user, admin_pass, q2)
    if err is None and out:
        for line in out.splitlines():
            findings.append(f'remote root account present: {line}')

    q3 = (
        "SELECT CONCAT(User,'@',Host,' plugin=',IFNULL(plugin,''),' authlen=',"
        "CHAR_LENGTH(IFNULL(authentication_string,''))) "
        "FROM mysql.user "
        "WHERE User IN ('scrutinizer','admin','mysql','test')"
    )
    out, err = run_mysql(host, port, admin_user, admin_pass, q3)
    if err is None and out:
        for line in out.splitlines():
            findings.append(f'suspicious default-style account present: {line}')

    return findings


def main():
    ap = argparse.ArgumentParser(description='Verify MySQL default / known credential exposure')
    ap.add_argument('--host', required=True, help='Target MySQL host')
    ap.add_argument('--port', type=int, default=3306, help='Target MySQL port (default: 3306)')
    ap.add_argument('--probe', action='append', default=[], help="Credential probe in user:password form; may be repeated")
    ap.add_argument('--admin-user', help='Optional MySQL admin/audit username for mysql.user inspection')
    ap.add_argument('--admin-pass', help='Optional MySQL admin/audit password for mysql.user inspection')
    args = ap.parse_args()

    probes = args.probe[:] if args.probe else DEFAULT_PROBES[:]
    vulnerable_reasons = []
    unknown_reasons = []

    if not shutil.which('mysql'):
        print('UNKNOWN - mysql client not found in PATH')
        sys.exit(2)

    for probe in probes:
        user, password = parse_probe(probe)
        out, err = run_mysql(args.host, args.port, user, password, 'SELECT CURRENT_USER();')
        if err is None:
            vulnerable_reasons.append(f'login succeeded with known/default credential {user}:{password}')
        else:
            unknown_reasons.append(f'probe failed or rejected for {user}: {err}')

    if args.admin_user and args.admin_pass is not None:
        out, err = run_mysql(args.host, args.port, args.admin_user, args.admin_pass, 'SELECT 1;')
        if err is None:
            findings = inspect_mysql_user_table(args.host, args.port, args.admin_user, args.admin_pass)
            vulnerable_reasons.extend(findings)
        else:
            unknown_reasons.append(f'admin inspection failed: {err}')

    if vulnerable_reasons:
        print('VULNERABLE - ' + ' | '.join(vulnerable_reasons))
        sys.exit(1)

    if args.admin_user and args.admin_pass is not None:
        print('PATCHED - supplied probes failed and mysql.user inspection found no obvious anonymous/remote-root/default-style accounts')
        sys.exit(0)

    print('UNKNOWN - supplied probes failed, but no admin inspection was performed; this does not rule out other known credentials')
    sys.exit(2)


if __name__ == '__main__':
    main()