I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell.
I want to show them how to use
--os-shell option of sqlmap. How should I proceed with that?
I searched and found that:
- You need to chown the directory as mysql user, I did that and it didn't work.
- You need to change apparmor settings, I went further and disabled it , still couldn't write files using mysql
- I changed the variable
""and checked it using
SHOW VARIABLES LIKE "secure_file_priv";, it shows blank and then tried uploading a shell, still it didn't work.
- I made the whole
/var/www/htmldirectory world readable,writable and executable using
chmod -R 777 /var/www/html, still it didn't work
- I tried writing from the mysql cli like this :
select * from users INTO OUTFILE '/var/www/html/wordpress/a.csv';but it resulted in -->
ERROR 1 (HY000): Can't create/write to file '/var/www/html/a.csv' (Errcode: 13 - Permission denied)
I don't know how to move on with this. If someone can help me understand how to do this, that would be great.
Yes I forgot to mention, I did enable the FILE permission in mysql.
As of now , I disabled apparmor's mysqld profile and am able to write files into /var/www/html from mysql-cli but not from sqlmap.