+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Getting passwords from database logged in as admin (/showthread.php?tid=5757639)
Getting passwords from database logged in as admin - hezkey - Nov 24, 2017
So basically I got access to admin accounts on this system my school uses, is there any way to dump passwords from the database? Ive heard of shells but im not sure if it would work?
RE: Getting passwords from database logged in as admin - F.A.S.T - Nov 24, 2017
Can you tell what is the System? Mybb Forum? or phpMyAdmin.
What sort of database you have access to?
RE: Getting passwords from database logged in as admin - Berry White - Nov 24, 2017
Well if you succeed in uploadign shell it will work. Connect to database, find database login info. When you find login info, usually on shell you have DB Connect tab, enter the login and find what you need. You will also have option to dump specific table, so you wont need to enter SQL commands manually.
RE: Getting passwords from database logged in as admin - AceHardware - Nov 24, 2017
How did you go about getting the admin login information off your school.
RE: Getting passwords from database logged in as admin - hezkey - Nov 25, 2017
Maybe I was unclear of what I actually had, but its basically a 3rd party company that has a system that schools use for their students, like timetables, lessons, assignments etc. So my school isnt the creator of the system, they just use it. So what I have is access to all the teachers logins (including the principle), some of whom are admins on this said system (not on the 3rd party companies whole system, just the schools OWN part). I dont really know how to explain it, as im not familiar to what equivalent you guys have in the US, but lets say the "3rd party company" is McDonalds, the system to which I have admin access to is one specific McDonalds store, in this case my school's, not the whole McDonalds database.
This is in a Scandinavian country.
Im probably being pretty unclear, but I can tell more in PM.
RE: Getting passwords from database logged in as admin - an4rei - Nov 26, 2017
Not much you can do except what the website allows you to.
Your best bet would be to look for vulnerabilities that the devs didn't care enough on the admin side( I doubt it though)
I developed something similar for someone based on a system called OpenSIS and there was no way you could get access to the main database where all the schools were added.
RE: Getting passwords from database logged in as admin - hezkey - Nov 26, 2017
Damn, yeah I figured. Pretty weird system but was hoping to find someone who knew something.
(Nov 26, 2017 12:07 PM)an4rei Wrote: Not much you can do except what the website allows you to.
Your best bet would be to look for vulnerabilities that the devs didn't care enough on the admin side( I doubt it though)
I developed something similar for someone based on a system called OpenSIS and there was no way you could get access to the main database where all the schools were added.