And this lecture, I'd like to show you how we can use SQL injections to read any file in the server.
So even if the file exists outside, the W.W. Root will be able to read it exactly like a file disclosure
vulnerability.
And we'll also see how we can use it to write files and upload them to the system, just like a file
upload vulnerability.
So the first thing we're going to have a look at is the read in the file, and I'm going to set everything
to NULL here.
So I have my statement here and I'm going to set select one.
I'm going to leave number two because I'm going to do stuff with that and we're going to do another
three nulls here.
So no.
No.
Now.
So we have select no something.
No, no no so five because we have five records when we did the order by and instead of selecting something.
Remember in the third video we did select database.
For example, and showed us the current database.
What I want to do now is I want to do another function and that function is called load file.
And in here, I'm going to set the file that I want to load and I'm going to use the same file that
we had to look on in the file.
Inclusion, vulnerability and it was ETSI password.
So we're trying to read that file and our statement is union select that file and that's it.
So I'm going to copy this.
And I'm going to inject it here and I'm going to add my percentage 23, which is my comment.
And as you can see, we managed to read all the information, all the content of ETSI password, even
though it's not in the web root.
So it stored in Etsy password.
So we can read anything in the server from other websites, from other files anywhere in the server.
We can read it by specifying the full path of that file.
The next thing I'd like to show you.
Is writing to the server.
So we're actually going to write stuff to the server.
And this is very useful because you'd be able to write any code you want.
So for example, you can write the code for a PHP script, you can write a write a code for a shell,
a virus or a PHP code to get a reverse connection to you.
So it will basically just act like a file, upload vulnerability.
And to do that, I'm going to write the code that I want to do here, and I'm going to call that, for
example, just example, example.
And we're going to use a function called out file.
So we're going to do into.
I would file and then we're going to specify where we want to store that file.
Now, in best case scenarios, you be able to write to your web route, and that will mean that you
can access the file through the browser and execute it.
So you can upload a weebly file and then connect to it and do stuff like that.
So let's try to do that first.
So we're going to do it in VAR.
W w w and that's our web route.
So we'll be able to access things through it, or you can put it even via, W, W, W, and then put
Michelle de after it to store it in there.
So the command is very simple.
Again, Union Select.
Make sure you set everything to null so that nothing gets written to the file except what you put in
here.
And I put example example and it's going to be stored into our file and var w w w matilda and we call
that.
Example.
The Keep.
Let's try to run this and see if it works.
Now, this didn't work.
And if you come down here, you'll see that.
SQL or my SQL is not allowed to create or write to this directory.
So the problem is we're not the permissions that we have.
Don't allow us to write to this particular location.
So just to test this exploit, I'm going to change this location to temp, which is the temp, and you'll
see that you can actually write the temp.
So in real life scenarios, it depends.
You can try it and see if you're able to write stuff or not.
And this we're trying to write the temp now and if we read in temp.
If we clear that and then LZ and.
Temp, you'll see that we have something called example.
And if we try to read that, you'll see.
That it contains.
Obviously, it contains the content of what we did before, which was.
The normal selection that you'd see.
So what you see for putting this stuff for admin and then it showed us what's in there, which is example,
example, which is what we wanted to write to the file.
Now you can obviously get rid of the admin and the admin stuff by just putting the wrong username and
nothing is going to be displayed here.
So the only thing that you'll see is the output, which is.
Example.
Well, again, this is only useful if you're able to write to your web server so you can access it and
then use your shell or use your payload and further exploit the system.