0

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell.

I want to show them how to use --os-shell option of sqlmap. How should I proceed with that?

I searched and found that:

  • You need to chown the directory as mysql user, I did that and it didn't work.
  • You need to change apparmor settings, I went further and disabled it , still couldn't write files using mysql
  • I changed the variable "secure_file_priv" to "" and checked it using SHOW VARIABLES LIKE "secure_file_priv";, it shows blank and then tried uploading a shell, still it didn't work.
  • I made the whole /var/www/html directory world readable,writable and executable using chmod -R 777 /var/www/html, still it didn't work
  • I tried writing from the mysql cli like this : select * from users INTO OUTFILE '/var/www/html/wordpress/a.csv'; but it resulted in --> ERROR 1 (HY000): Can't create/write to file '/var/www/html/a.csv' (Errcode: 13 - Permission denied)

I don't know how to move on with this. If someone can help me understand how to do this, that would be great.

Update

Yes I forgot to mention, I did enable the FILE permission in mysql.

As of now , I disabled apparmor's mysqld profile and am able to write files into /var/www/html from mysql-cli but not from sqlmap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.