For pentesters: always check for phpMyAdmin early. For defenders: assume it will be discovered, and harden accordingly.
$cfg['Servers'][$i]['user'] = 'dbuser'; $cfg['Servers'][$i]['password'] = 'Sup3rS3cr3t'; If you manage to read system files, grab /var/lib/mysql/mysql/user.MYD or user.MYI to crack MySQL password hashes (pre-8.0 uses mysql_native_password ). Part 3: Post-Login Exploitation — The Holy Grail Once inside phpMyAdmin, here’s how you turn database access into server compromise. 1. SQL to Write a Web Shell (INTO OUTFILE) If the database user has FILE privileges, you can write a PHP shell directly to the web root.
CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so'; SELECT sys_exec('whoami > /tmp/test.txt'); Check your current privileges:
SELECT grantee, privilege_type FROM information_schema.user_privileges; If you have SUPER , you can change server variables, kill queries, and potentially compromise the entire DB server. CVE-2018-12613 (Authenticated RCE) In phpMyAdmin 4.8.0–4.8.1, a backdoor allows remote code execution via the $cfg['AllowArbitraryServer'] setting.
Phpmyadmin Hacktricks Today
For pentesters: always check for phpMyAdmin early. For defenders: assume it will be discovered, and harden accordingly.
$cfg['Servers'][$i]['user'] = 'dbuser'; $cfg['Servers'][$i]['password'] = 'Sup3rS3cr3t'; If you manage to read system files, grab /var/lib/mysql/mysql/user.MYD or user.MYI to crack MySQL password hashes (pre-8.0 uses mysql_native_password ). Part 3: Post-Login Exploitation — The Holy Grail Once inside phpMyAdmin, here’s how you turn database access into server compromise. 1. SQL to Write a Web Shell (INTO OUTFILE) If the database user has FILE privileges, you can write a PHP shell directly to the web root. phpmyadmin hacktricks
CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so'; SELECT sys_exec('whoami > /tmp/test.txt'); Check your current privileges: For pentesters: always check for phpMyAdmin early
SELECT grantee, privilege_type FROM information_schema.user_privileges; If you have SUPER , you can change server variables, kill queries, and potentially compromise the entire DB server. CVE-2018-12613 (Authenticated RCE) In phpMyAdmin 4.8.0–4.8.1, a backdoor allows remote code execution via the $cfg['AllowArbitraryServer'] setting. Part 3: Post-Login Exploitation — The Holy Grail