So clear that screen for a fresh hack.
As you may remember, you discovered my school username while you were doing your renumeration, but
just to refresh your memory, let's do it again.
So choose the MySQL Auxillary.
Use auxiliary scanner.
Maisky, well.
I ask you, well, log in.
Show me the option.
And said, our hosts do tend to attend the hen.
Use blank passwords.
Set the user pass file, do the dictionary file that you created while you were doing your enumeration.
Now, set user as part as a variable set, that also to be true.
And let's see the options again.
All right, good.
So everything looks fine, so let's run the module.
And here is the user that you detected.
Username is root and the password is blank.
So with this information, you can directly connect to MySQL database on Métis Voidable three.
So to do that, let's open up a new tab.
And to connect to my ask you, well, let's use a command might ask you, will you?
Then username route.
H for host tend to tend to 10.
And excellent, connected to the database.
So now you can query data on my ask you out to list all the databases on the server type show databases.
Now, don't forget to put a semicolon on the end of the commands, so these are the database's.
And to get some information about the Maisky, well, server type show variables.
And here's an example.
This is the version of the database now.
Show database's again to enumerate more.
And you can, of course, change a database in use by typing use WordPress.
Now to display tables in the WordPress database type show tables.
And all the WordPress tables come up here.
So I'm going to view the information in the WP users table, so what we'll do is we'll type select from
WGP users.
There's not too many users, but they may work.
Well, you know, you can always start a reverse shell from Maisky.
Well.