Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the payload to base64 and executed this query in phpMyAdmin:

SELECT "<?php eval(base64_decode('payload encoded in base64')) ?>" INTO OUTFILE "payload.php";

it is executed successfully, but i do not know the path of the created file, and i do not know how to make it executed by the server

share|improve this question
3  
Funny story about phpMyAdmin, the hacking process usually starts and stops at finding it running. You should probably update your question a little more with useful information like what you're trying to do, what vulnerability you're working with, etc. Since this is a site for Information Security Professionals we expect a little more work than a plea to farm out penetration testing. – Scott Pack Aug 15 '12 at 19:23
my idea is to create .php file in the server, then request it from the website running on that server. there is a website running on the server infected with path disclosure vulnerability. is it clear now ?!! – user1028 Aug 15 '12 at 19:36
Why are you trying to compromise a server you don't have actually have access to? Furthermore why are people actually helping you do this? – Ramhound Aug 16 '12 at 13:38
1  
@Ramhound I'm helping because we get a lot of ITSec students, and people trying out boot-to-root VMs. If he is neither, as an administrator, it is also helpful to listen to the thought processes of people trying to hack my systems. Either way, it is educational for me to help. I learned far more from setting up my own honeypot with shell logging than from any class or book. – schroeder Aug 16 '12 at 14:49

closed as not a real question by Iszi, Scott Pack, Jeff Ferland♦, AviD♦ Aug 18 '12 at 20:34

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 2 down vote

Try "/var/www/html/payload.php" as a guess at the default location for the html root. You could also look at ways to map out the file system from sql queries.

If you have access to UDF's, you might have access to functions that access the filesystem. Check: SELECT * FROM mysql.func

For more detailed info on UDF's, read here.

share|improve this answer
i executed the query u suggested but returned empty result. what can i do now ? can i add functions? – user1028 Aug 16 '12 at 8:09
The mysqld is unlikely to be running in the document root, even if both services are on the same machine. More likely to be in /var/mysql – symcbean Aug 16 '12 at 13:11
@user1028 You seem like you are randomly firing commands at this system. The point is not to copy/paste but to find ways of approaching the problem. Commands come later. Find out what resources are available to you (UDFs for example), and use your current position to map out as much as you can so that you can move to the next step. Think "climbing a mountain" not "pushing a button". – schroeder Aug 16 '12 at 15:02
ok i got your point, but how to find the UDFs in phpMyAdmin ?? – user1028 Aug 16 '12 at 15:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.