[~OMC~]

Try using that password to log into the owners account, or find an SQL vulnerability of some sort.

[ℛℛℛoooℛℛℛ]

i have SQL vulnerability and i get the password hash but i couldn't crack it
all sites i know does not crack it
any way
i have now is mysql root password and md5 of the admin panel of the website
what i can do?

Well if you cant crack them online, then try to crack them offline using JTR. If you cant really crack them then just move on, they're encrypted for a reason, its not like you can just "Pass the Hash", if you know what i mean.

-Chosen-

[LocoJose]

Check if the script that contain the SQLi vuln has write privs. Maybe script run with root user too, if so you should be able to upload a shell via SQLi!

[LocoJose]

Forget about tools, try to check manually for write Privs! Tools may often work false positive and positive false :)