Instructor: In this lecture,
I'd like to show you how we can use SQL injections
to read any file in the server
so even if the file exists outside the www root,
we'll be able to read it exactly
like a file disclosure vulnerability
and we'll also see how we can use it
to write files and upload them to the system
just like a file upload vulnerability.
So the first thing we're going to have a look at
is the reading the file.
And I'm gonna set everything to null here.
So I have my statement here
and I'm gonna set select one,
and I'm gonna leave number two
'cause I'm gonna do stuff on that.
And we're gonna do another three nulls here.
So null,
null,
null.
So we have select null something null, null, null.
So five because we have five records
when we did the order by.
And instead of selecting something,
remember, in the third video,
we did select database, for example,
and it shows us the current database.
What I wanna do now
is I wanna do another function
and that function is called load_file.
And in here, I'm gonna set the file
that I wanna load and I'm gonna use the same file
that we had the look on
in the file inclusion vulnerability
and it was etc/passwd.
So we're trying to read that file
and our statement is union select that file and that's it.
So I'm gonna copy this.
And I'm gonna inject it here
and I'm gonna add my %23
which is my command.
And as you can see,
we managed to read all the information,
all the content of etc/passwd
even though it's not in the web root.
So it's stored in etc/passwd.
So we can read anything in the server
from other websites,
from other files anywhere in the server,
we can read it
by specifying the full path of that file.
The next thing I'd like to show you
is writing to the server.
So we're actually going to write stuff
to the server and this is very useful
because you'd be able to write any code you want,
so for example, you can write the code for a PHP script,
you can write a code of a shell, a virus
or a PHP code to get other connections to you.
So it'll basically just act
like a file upload vulnerability.
And to do that,
I'm going to write the code that I want to do here
and I'm gonna call that, for example,
just example example.
And we're going to use a function called outfile
so we're gonna do into outfile
and then we're gonna specify
where we want to store that file.
Now, in best case scenarios,
you'd be able to write to your web root
and that will mean that you can access the file
through the browser and execute it,
so you can upload a Weevely file
and then connect to it
and do stuff like that.
So let's try to do that first.
So we're gonna do it in var/www
and that's our web root so we'll be able
to access things through it
or you can put it even var/www
and then put mutillidae after it
to store it in there.
So the command is very simple.
Again union select.
Make sure you set everything to null
so that nothing gets written to the file
except what you put in here
and I put example example
and it's gonna be stored into our file
in var/www/mutillidae
and recall that example.txt.
Let's try to run this and see if it works.
Now, this didn't work.
And if you come down here,
you'll see that SQL or MySQL
is not allowed to create or write to this directory.
So the problem is we're not,
the permissions that we have
don't allow us to write to this particular location.
So just to test this exploit,
I'm going to change this location to tmp
which is the temp
and you'll see that you can actually write to temp
so in real life in scenarios,
it depends, you can try it and see if you're able
to write stuff or not.
In this, we're trying to write to temp now
and if we read in temp,
if we clear that
and then ls and /tmp
you'll see that we have something called example
and if you try to read that,
you'll see that it contains,
obviously it contains
the content of what we did before
which was the normal selection that you'd see.
So what you see for putting the stuff for admin
and then it showed us what's in there
which is example example
which is what we wanted to write to the file.
Now you can obviously get rid of the admin
and the adminpass stuff
by just putting a wrong username
and nothing's gonna be displayed here
so the only thing that you'll see is the output
which is example example.
But again, this is only useful
if you're able to write to your web server,
so you can access it
and then use your shell
or use your payload and further exploit the system.