+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Acquiring Remote MySQL Connection (/showthread.php?tid=4575316)
Acquiring Remote MySQL Connection - DepLexOr - Dec 8, 2014
I tried remotely connecting to a MySQL server to do an authentication bypass exploit, however it comes up with:
Code
ERROR 1130: Host 'My IP Address' is not allowed to connect to this MySQL server* - kambrik - Dec 8, 2014
Not that i am aware of; i believe what its saying is that there is only a certain ip(s) that allowed to connect to the system. If someone has more information I would also like to hear a bypass.
* - ProblemSolva - Dec 9, 2014
This is a very good security measure. This means they whitelisted maybe some ips only to have access there. And the rest is blacklisted. I dont know anyways of bypassing that.
Or u have to be connected through their network. Maybe they use vpn access.
* - DepLexOr - Dec 9, 2014
(Dec 9, 2014 01:15 AM)ProblemSolva Wrote: This is a very good security measure. This means they whitelisted maybe some ips only to have access there. And the rest is blacklisted. I dont know anyways of bypassing that.I know they don't use VPNs. I have access to their forum's admin control panel (which blocks me out after 3 attempts). Their forum doesn't store their database, however I'd still have access to all the forum accounts (10,000+). Their database has over 1 million registered users (it's a gaming server).
Or u have to be connected through their network. Maybe they use vpn access.
(Dec 8, 2014 11:20 PM)kambrik Wrote: Not that i am aware of; i believe what its saying is that there is only a certain ip(s) that allowed to connect to the system. If someone has more information I would also like to hear a bypass.
Yes that's what it is. I know the owner gave permission to two other people (I can't R.A.T them because they're very security conscious).
If there's anything at all that will get me into that database I'd love some information on it.
Edit:
I have also discovered two other MySQL servers running Apache/2.2.26 (CentOS). It comes up with a login box saying "Who's there?!." when I try to access it through port 80. However, the MySQL server is not vulnerable to an authentication bypass, or the username is not "root". I'm not entirely sure what's in it, but I got the IPs after running a tracert and port scanning them.
* - 21redallday12 - Dec 12, 2014
shell it and access the mysql database locally?
* - InspectorGadget - Dec 12, 2014
Depending what backend it is running - load a shell into a template or php template.
Then use the shell's SQL manager from there.
Localhost will likely be the only IP allowed to connect.
* - DepLexOr - Dec 13, 2014
(Dec 12, 2014 03:10 PM)SirGravzy Wrote: Depending what backend it is running - load a shell into a template or php template.
Then use the shell's SQL manager from there.
Localhost will likely be the only IP allowed to connect.
I have no access to any administrative features. And the forum's admin panel will not be linked to the game's database. I don't even have access to it, I just know where the panel's located.