[hezkey]

So basically I got access to admin accounts on this system my school uses, is there any way to dump passwords from the database? Ive heard of shells but im not sure if it would work?

[F.A.S.T]

Can you tell what is the System? Mybb Forum? or phpMyAdmin.

What sort of database you have access to?

[Berry White]

Well if you succeed in uploadign shell it will work. Connect to database, find database login info. When you find login info, usually on shell you have DB Connect tab, enter the login and find what you need. You will also have option to dump specific table, so you wont need to enter SQL commands manually.

[AceHardware]

How did you go about getting the admin login information off your school.

[hezkey]

Maybe I was unclear of what I actually had, but its basically a 3rd party company that has a system that schools use for their students, like timetables, lessons, assignments etc. So my school isnt the creator of the system, they just use it. So what I have is access to all the teachers logins (including the principle), some of whom are admins on this said system (not on the 3rd party companies whole system, just the schools OWN part). I dont really know how to explain it, as im not familiar to what equivalent you guys have in the US, but lets say the "3rd party company" is McDonalds, the system to which I have admin access to is one specific McDonalds store, in this case my school's, not the whole McDonalds database.


This is in a Scandinavian country.

Im probably being pretty unclear, but I can tell more in PM.

[an4rei]

Not much you can do except what the website allows you to.
Your best bet would be to look for vulnerabilities that the devs didn't care enough on the admin side( I doubt it though)
I developed something similar for someone based on a system called OpenSIS and there was no way you could get access to the main database where all the schools were added.

[hezkey]

Damn, yeah I figured. Pretty weird system but was hoping to find someone who knew something.

Not much you can do except what the website allows you to.
Your best bet would be to look for vulnerabilities that the devs didn't care enough on the admin side( I doubt it though)
I developed something similar for someone based on a system called OpenSIS and there was no way you could get access to the main database where all the schools were added.