Waraxe IT Security Portal

-AO- · Advanced user

I have a root mysql login but it's set host is only localhost. I only have privs to use the select command with another login. This password might match the ftp but I can't even connect to it or on http port...

ftp://xx.xx.xx.xx

http://xx.xx.xx.xx

so neither of these ports are open...

with select command I've got the root login but I'm stuck here.
Any suggestions? Sad

pexli · Valuable expert

Try to find phpmyadmin or some other sql client on this server.

_mranderson_ · Valuable expert

if you are root and can only use select statements, you're done.
use

-AO- · Advanced user

Thanks for replies. I tried every sql client I could think of and none of them worked. This server is mainly used for mysql and not a web server. I used nmap to do a port scan and the only port open was 22 which is probably ssh but couldn't connect w/ putty.

@mranderson
I tried these on my localhost and couldn't get them to work... and for load_file, wouldn't I need file privs? But if I could get the select into outfile to work... Do something like this maybe?

<?php

mysql_connect(localhost, root, password);
mysql_query('CREATE USER 'Administrator'@ '99.99.99.99' IDENTIFIED BY '****';

GRANT ALL PRIVILEGES ON * . * TO 'Administrator'@ '99.99.99.99' IDENTIFIED BY '****' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ;');

?>

But since this server isn't a webserver... maybe it doesn't have php Confused

pexli · Valuable expert

How many databases have on this mysql server?

-AO- · Advanced user

There is three databases including mysql and information_schema.

pexli · Valuable expert

-AO- · Advanced user

Nope, no software that i could find. Only open ports 22 & 7777. i know these dbs from connecting through another server.

_mranderson_ · Valuable expert

it's an L2 server aight?

anyways, as already said, if you have the mysql root's password you should find a way to run SQL code on it, because with root privs you can load_file() and select into outfile.