Videos
Factsheet
Credentials for MySQL include not only a username and a password, but also a set of allowed IP addresses. So, even if we have the correct username and password, but the connection is established from a not allowed IP, we will get the 1045 "Access denied" error from sqlmap.
To illustrate the problem, I setup a test database testdb with user admin. Here are the user's credentials:
MariaDB [testdb]> select host,user,password from mysql.user where user='admin';
+-------------+-------+-------------------------------------------+
| host | user | password |
+-------------+-------+-------------------------------------------+
| 92.168.0.20 | admin | *00A51F3F48415C7D4E8900010101010101010101 |
+-------------+-------+-------------------------------------------+
As it is shown in the host column, the user admin is allowed to access the server only from the IP 92.168.0.20. Now, if I run sqlmap from this IP it succeeds:
$ sudo sqlmap -d 'mysql://admin:12345@92.168.0.99:3306/testdb'
...
[*] starting at 09:28:43
[09:28:43] [INFO] connection to mysql server 92.168.0.99:3306 established
[09:28:43] [INFO] testing MySQL
[09:28:43] [INFO] resumed: [[u'1']]...
[09:28:43] [INFO] confirming MySQL
[09:28:43] [INFO] resumed: [[u'1']]...
[09:28:43] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[09:28:43] [INFO] connection to mysql server 92.168.0.99:3306 closed
[*] shutting down at 09:28:43
If I run sqlmap from a different IP it fails with the 1045 "Access denied" error (exactly as in your output):
$ sudo sqlmap -d 'mysql://admin:12345@92.168.0.99:3306/testdb'
...
[*] starting at 09:32:00
[09:32:00] [CRITICAL] SQLAlchemy connection issue ('(_mysql_exceptions.OperationalError)
(1045, "Access denied for user 'admin'@'92.168.0.55' (using password: YES)")')
[*] shutting down at 09:32:00
So, if you are sure that you have the correct username and password, the problem is highly likely in the allowed IPs. When creating a MySQL user, it is common practice to allow access only from localhost. Therefore, you may have the correct username and password, but you can use them only locally on the server. On the other hand, the fact that the server accepts connections from outside may indicate that some other IP's are allowed to connect. In this case, you have to find out which IP's are allowed and connect from one of those.
Go into MySQL with sufficient privileges and check what permissions you have:
SHOW GRANTS FOR 'admin'@'17.45.65.11';
SHOW GRANTS FOR 'admin'@'%';
SELECT host, plugin FROM mysql.user WHERE user = 'admin';
The last one is a desperation to see what you might have.
If not adequate, do something like
GRANT SELECT ON *.* TO 'admin'@'17.45.65.11' IDENTIFIED BY 'some password';
I say "something like" because you may need more than just SELECT or you may want to limit it to less than all databases (*.*), or more than just that one IP address. Etc.
Note: If you already have some GRANT ... TO 'admin'@'localhost' ..., that will not suffice.
Also, note that whatever you do should be scrutinized for security issues.
Most databases do not allow you to just insert data using SQL Injection (Unless of course you are already in an insert query and even then you usually can't control the table name). You can't simply stack queries, that is only allowed in Microsoft SQL Server, PostgreSQL and comic books (like xkcd). You can use a sub-select or union select to access data from another table, and SQLMap is doing this behind the scenes.
SQLMap's real strength is in data exfiltration, and it has some tricks to get RCE. But, If you want something more complex, like a multi-staged attack that gives you a shell, then you need to write a multi-staged SQLi exploit like this one, which I wrote. If you want a deeper understanding of security then you need to write exploits to have that experience, take off the training wheels and be man (or woman or whatever).
you can take a shell by --sql-shell option. For example in Kali:
sqlmap -u TARGET -D DBNAME --sql-shell
However,
some web application technologies do not support stacked queries on specic database management systems. For instance, PHP does not support stacked queries when the back-end DBMS is MySQL, but it does support when the back-end DBMS is PostgreSQL.
from sqlmap readme