[TeoZ]

Hello to everyone,
I would ask you a lil thing:
Is there any way to get the MySQL password of a server if I have the total access to any file in the (linux) server?
Is there any file i can download to find this mysterious password?
It's not a problem if it is hashed, I just need to find it!

Thank you guys 🤝

[AdamDeJames]

maybe check config files.
IE for mybb, DB info is in /inc/config.php

[TeoZ]

I have no such directory, i only have mysql/my.cnf, but there is nothing useful wrote in...hmmm
If, for example, PhpMyAdmin asks me a password for login, how can't be there a file with the password written in? :(

[Viktory]

grep thru filesystem for "password" or something

[TeoZ]

I have tried to take the file debian.cnf but there is nothing written in, tried with the file my.cnf and there isn't any password, tried with mysql.cnf and is empty...
Maybe something in var/lib/mysql?

---

I may have found the file with the root pw, but i still need help :S
I need to access to the mysql directory (var/lib/mysql) but it is protected from default by Linux, how can I through PHP access to it, and download the file?
Is there any way I can "emulate" Linux termial to use chmod?
Maybe with shell_exec? I don't wanna make damage X)

[c00perzz]

www-data user will not give you access to that. You will need privilege escalation...

[How bout using your brain]

Ehm mysql root password is just stored in the mysql.user database. As a hash. So good luck with that.

Only thing you can do is to reset it, but you will probably have to have root (or mysql user) privs. which means you can just copy the whole mysql database anyway and resetting the root password would be then useless in that case.

[TeoZ]

no, you can't decrypt a hash

I wouldn't be so sure about this 🙃
That's the answer you find on low sites.

Ehm mysql root password is just stored in the mysql.user database. As a hash. So good luck with that.

I have found where I can get it, I just need to access to the directory, because PHP can't access to it, so I cannot download the file.

www-data user will not give you access to that. You will need privilege escalation...

Can you make me a little example of this? [img]http://forums.tigsource.com/Smileys/derek/beg.gif[/img]

[How bout using your brain]

I wouldn't be so sure about this 🙃

I am 100% certain about this 😝

I have found where I can get it, I just need to access to the directory, because PHP can't access to it, so I cannot download the file.

If you had access to that directory, you could just download the whole databases, no need to get root password...

[Sharkky]

No, hash are one-way, it is impossible for anyone to decrypt a hash.

But you can use rainbow tables ; You hash a dictionnary, so that you know what are the plaintext for the hash that are in your dictionnary.
And then you grep through it for the hash, and you'll find the corresponding pass.

But if the password wasn't originally in your dictionnary, you won't get any match.


Anyway, mysql is a realtively reliable service.
You can google "mysql privilege escalation", but you won't find much, and this will be rather complicated.

[Glubz]

Sometimes it's hidden and you have to search through the entire table until you find something juicy.

[TeoZ]

Anyway, mysql is a realtively reliable service.
You can google "mysql privilege escalation", but you won't find much, and this will be rather complicated.

Yeah, i tried it, and that's the reason I asked him to give me a little example 😖

If you had access to that directory, you could just download the whole databases, no need to get root password...

I have the access to the database through a "only read" user, so I want to take the root password, to connect to the db with it, and perfom an UPDATE query 😅
Through a PHP file that I can edit, i can access to the entire server, but (I checked it on a Linux pc of mine) the folder of mysql is protected, and to unlock it I needed to use "chmod 0777" on linux terminal...
I saw PHP cannot access to that folder when i tried to print all files in that (scandir), showing me nothing...

[How bout using your brain]

Through a PHP file that I can edit, i can access to the entire server, but (I checked it on a Linux pc of mine) the folder of mysql is protected, and to unlock it I needed to use "chmod 0777" on linux terminal...

You can not. You have to be root or the owner of the file/directory. In your case that is the "mysql" user, while php is running under "www-data" user. You can not change the permissions of files you do not own.

[Hooded Robin]

by default MySQL stores the databases in files in (select @@datadir) directory, typically /var/lib/mysql/. The mysql user table contains the login credentials for mysql and is the one you are looking for. Assuming @@datadir maps to /var/lib/mysql/ then you would want to look for the file /var/lib/mysql/mysql/user.MYD. By default on Debian/Ubuntu you need privileged permissions to access these files, on Windows it's less restricted typically. 🎉

If you have privileged mysql access or sqli, then just query the user table directly to dump the values:

Code

select host,user,password,super_priv,file_priv from mysql.user

[limainfinita]

you just have to check the config files
that is easy if you use c99 shell as it as an option to search for all the config files in the system.