I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server.

Is it possible to somehow locate the root directory using a SQL query?


If you have permissions to write files, you probably have permission to read them, too.

I'd start from reading web server configuration files, e.g.

SELECT * LOAD_FILE('/etc/apache2/apache2.conf');
SELECT * LOAD_FILE('/etc/nginx/nginx.conf');

However, it's not guaranteed that the MySQL has permissions to write to the document root.

  • Figured out that the system was running on Alpine Linux, the web server configuration is located at "/opt/apache2/apache2.conf". Thanks! Aug 29 '20 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.