Instructor: In this lecture, 2 2
I'd like to show you how we can use SQL injections 3 3
to read any file in the server 4 4
so even if the file exists outside the www root, 5 5
we'll be able to read it exactly 6 6
like a file disclosure vulnerability 7 7
and we'll also see how we can use it 8 8
to write files and upload them to the system 9 9
just like a file upload vulnerability. 10 10
So the first thing we're going to have a look at 11 11
is the reading the file. 12 12
And I'm gonna set everything to null here. 13 13
So I have my statement here 14 14
and I'm gonna set select one, 15 15
and I'm gonna leave number two 16 16
'cause I'm gonna do stuff on that. 17 17
And we're gonna do another three nulls here. 18 18
So null, 19 19
null, 20 20
null. 21 21
So we have select null something null, null, null. 22 22
So five because we have five records 23 23
when we did the order by. 24 24
And instead of selecting something, 25 25
remember, in the third video, 26 26
we did select database, for example, 27 27
and it shows us the current database. 28 28
What I wanna do now 29 29
is I wanna do another function 30 30
and that function is called load_file. 31 31
And in here, I'm gonna set the file 32 32
that I wanna load and I'm gonna use the same file 33 33
that we had the look on 34 34
in the file inclusion vulnerability 35 35
and it was etc/passwd. 36 36
So we're trying to read that file 37 37
and our statement is union select that file and that's it. 38 38
So I'm gonna copy this. 39 39
And I'm gonna inject it here 40 40
and I'm gonna add my %23 41 41
which is my command. 42 42
And as you can see, 43 43
we managed to read all the information, 44 44
all the content of etc/passwd 45 45
even though it's not in the web root. 46 46
So it's stored in etc/passwd. 47 47
So we can read anything in the server 48 48
from other websites, 49 49
from other files anywhere in the server, 50 50
we can read it 51 51
by specifying the full path of that file. 52 52
The next thing I'd like to show you 53 53
is writing to the server. 54 54
So we're actually going to write stuff 55 55
to the server and this is very useful 56 56
because you'd be able to write any code you want, 57 57
so for example, you can write the code for a PHP script, 58 58
you can write a code of a shell, a virus 59 59
or a PHP code to get other connections to you. 60 60
So it'll basically just act 61 61
like a file upload vulnerability. 62 62
And to do that, 63 63
I'm going to write the code that I want to do here 64 64
and I'm gonna call that, for example, 65 65
just example example. 66 66
And we're going to use a function called outfile 67 67
so we're gonna do into outfile 68 68
and then we're gonna specify 69 69
where we want to store that file. 70 70
Now, in best case scenarios, 71 71
you'd be able to write to your web root 72 72
and that will mean that you can access the file 73 73
through the browser and execute it, 74 74
so you can upload a Weevely file 75 75
and then connect to it 76 76
and do stuff like that. 77 77
So let's try to do that first. 78 78
So we're gonna do it in var/www 79 79
and that's our web root so we'll be able 80 80
to access things through it 81 81
or you can put it even var/www 82 82
and then put mutillidae after it 83 83
to store it in there. 84 84
So the command is very simple. 85 85
Again union select. 86 86
Make sure you set everything to null 87 87
so that nothing gets written to the file 88 88
except what you put in here 89 89
and I put example example 90 90
and it's gonna be stored into our file 91 91
in var/www/mutillidae 92 92
and recall that example.txt. 93 93
Let's try to run this and see if it works. 94 94
Now, this didn't work. 95 95
And if you come down here, 96 96
you'll see that SQL or MySQL 97 97
is not allowed to create or write to this directory. 98 98
So the problem is we're not, 99 99
the permissions that we have 100 100
don't allow us to write to this particular location. 101 101
So just to test this exploit, 102 102
I'm going to change this location to tmp 103 103
which is the temp 104 104
and you'll see that you can actually write to temp 105 105
so in real life in scenarios, 106 106
it depends, you can try it and see if you're able 107 107
to write stuff or not. 108 108
In this, we're trying to write to temp now 109 109
and if we read in temp, 110 110
if we clear that 111 111
and then ls and /tmp 112 112
you'll see that we have something called example 113 113
and if you try to read that, 114 114
you'll see that it contains, 115 115
obviously it contains 116 116
the content of what we did before 117 117
which was the normal selection that you'd see. 118 118
So what you see for putting the stuff for admin 119 119
and then it showed us what's in there 120 120
which is example example 121 121
which is what we wanted to write to the file. 122 122
Now you can obviously get rid of the admin 123 123
and the adminpass stuff 124 124
by just putting a wrong username 125 125
and nothing's gonna be displayed here 126 126
so the only thing that you'll see is the output 127 127
which is example example. 128 128
But again, this is only useful 129 129
if you're able to write to your web server, 130 130
so you can access it 131 131
and then use your shell 132 132
or use your payload and further exploit the system.