I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.
My approach is to get the internal application path, and then, try to upload a file with
sqlmap --file-write "shell.aspx" --file-dest "C:/<The Web APP Path>".
I am trying to get the path with ->
sqlmap -u <url> --random-agent --no-escape --dbms=mssql --time-sec=9 --os-cmd="wmic process where name='w3wp.exe' get ExecutablePath
But I get the response:
so that make me thing the IIS process is not running there, as w3wp.exe is the IIS process name. That would have given me the Executable Path, not the app path though, I don't know how to get it.
How would you leverage this scenario and successfuly upload a shell? (I am DBA by the way)