3

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and write a textual file to the directory. The service in the background is checking is file written.

I did find administration panel password but not by using SQL injection over SELECT statement but through connecting to a network with port that resolve the username and password. Now, as far as I know, if there was SQL injection vulnerability over SELECT, I could easily INTO OUTFILE particular column to the data file, but this time, I'll have to use INSERT as the input is sent through admin panel to the mysql query. I'm interested is there equivalent command or payload to INTO OUTFILE using INSERT or any other way around. I'm thinking about using MySQL LOAD DATA but I can't wrap my head around it.

The call shall be made like this:

LOAD DATA INFILE 'foo.txt' INTO TABLE t FIELDS  TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' IGNORE 1 LINES (name, address, city, @skip, state, @skip, ...) [ SET col = <expr>, ... ]

One more thing, I successfully loaded the file from the file system using load_file('filename') so I have granted user account at least for reading.

Other information:
Machine: Linux RS x11 CERT UTIC (Testing lab)
Database: MySQL 5.x
Application language: PHP

Thanks and kind regards.

Improve this question
7
  • Have you tried using stacked queries?
    – wireghoul
    Feb 17, 2015 at 0:12
  • Stacked queries are supported with MySQL / PHP?
    – sensation
    Feb 17, 2015 at 0:30
  • Not natively, but its enabled by default on some interfaces, like PDO.
    – wireghoul
    Feb 17, 2015 at 3:24
  • No data objects, application is procedural without prepared statements. Any other tip?
    – sensation
    Feb 17, 2015 at 3:45
  • 1
    @Mints97 did you even try this? Sub-selct doesn't allow into outfile.
    – rook
    Feb 17, 2015 at 14:49

1 Answer 1

Reset to default
2

By looking at the MySQL select syntax, you can see that it support into outfile at the end of a query. If you look at MySQL Insert Syntax, you'll see that there is no reference to into outfile. There is a good reason for this, insert is modifying the database, and a select is obtaining data, and the into outfile is a modifier of where that data goes. From a developer's perspective is no reason to give insert the ability to write to files.

However, all is not lost. The ability to insert data opens the door for second-order code injection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .