2

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and write a textual file to the directory. The service in the background is checking is file written.

I did find administration panel password but not by using SQL injection over SELECT statement but through connecting to a network with port that resolve the username and password. Now, as far as I know, if there was SQL injection vulnerability over SELECT, I could easily INTO OUTFILE particular column to the data file, but this time, I'll have to use INSERT as the input is sent through admin panel to the mysql query. I'm interested is there equivalent command or payload to INTO OUTFILE using INSERT or any other way around. I'm thinking about using MySQL LOAD DATA but I can't wrap my head around it.

The call shall be made like this:

LOAD DATA INFILE 'foo.txt' INTO TABLE t FIELDS  TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' IGNORE 1 LINES (name, address, city, @skip, state, @skip, ...) [ SET col = <expr>, ... ]

One more thing, I successfully loaded the file from the file system using load_file('filename') so I have granted user account at least for reading.

Other information:
Machine: Linux RS x11 CERT UTIC (Testing lab)
Database: MySQL 5.x
Application language: PHP

Thanks and kind regards.

  • Have you tried using stacked queries? – wireghoul Feb 17 '15 at 0:12
  • Stacked queries are supported with MySQL / PHP? – sensation Feb 17 '15 at 0:30
  • Not natively, but its enabled by default on some interfaces, like PDO. – wireghoul Feb 17 '15 at 3:24
  • No data objects, application is procedural without prepared statements. Any other tip? – sensation Feb 17 '15 at 3:45
  • Yes, post the details, you say it's an INSERT statement, but then reference a LOAD statement. Knowing what you control, and some understanding of the query you're diverting is a vital starting point. Without those details I can only give generic advice, such as try to insert an admin user and create the file using application features. – wireghoul Feb 17 '15 at 3:52
1

By looking at the MySQL select syntax, you can see that it support into outfile at the end of a query. If you look at MySQL Insert Syntax, you'll see that there is no reference to into outfile. There is a good reason for this, insert is modifying the database, and a select is obtaining data, and the into outfile is a modifier of where that data goes. From a developer's perspective is no reason to give insert the ability to write to files.

However, all is not lost. The ability to insert data opens the door for second-order code injection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.