Waraxe IT Security Portal

wokky · Regular user

Hello all,

I found mysql root account, I can login via phpmyadmin and do eveything i want but now i want to take advantage of this and install a phpbackdoor.

So i tried something like this:

select '<?php *phpcode*?' INTO OUTFILE '/www/backdoor.php'

and i got:
Can't create/write to file '/www/backdoor.php' (Errcode: 13)

if i don't use path of course it works and copy the file into tmp folder

I am sure that the directory exists and this probably due to write permission.

So how can i bypass that.

sry bad english :/

waraxe · Site admin

It's all about Linux filesystem security and you can do only things, you are allowed to, unless you have some 0-day vulnerability in your possession.
Now, some things to try:

1. load_file() allows to read files, this can be useful.
2. try to find some web-accessible directory, which is writable to mysql.
Examples: avatars,cache, smilies,temp,data,files,pictures,upload, uploads.
Many webmasters are giving 777 permissions to some dirs, this can be exploited.
3. use load_file() for peeking into the php script sources. This may reveal additional security vulnerabilities, which can lead to further exploitation (insecure uploads, LFI, RFI, sql injections).
4. try to find LFI vulns and in case of success just write your php code to the tmp dir and use LFI for getting php-level access.

wokky · Regular user

ye i tried to read some files successefully and i know where are directories writable by php but it doesn't works with mysql dunno why

wokky · Regular user

ok i dit it i found a directory to write but i got an another problem,
suPHP, safe mode ! impossible to execute the file, probably nothing to do about it

waraxe · Site admin

What php version?

wokky · Regular user

PHP Version 5.2.5-pl1-gentoo

waraxe · Site admin

It's old php version. There can be ways to bypass open_basedir, safe_mode and other restrictions.

http://secunia.com/advisories/product/13446/?task=advisories

http://feeds2.feedburner.com/phpvulnerability_database

wokky · Regular user

Well, suPHP test if the php file is execute by the right user.
in this case i wrote a file with mysql user so it cannot be executable by php

Look:

I tried a simple php without file/dir access file like that:
<?php echo 'test'; ?>

And it can't be executable.

waraxe · Site admin

You can write arbitrary files to the web server, right? Then consider other ways to leverage attack: .htaccess, cgi, perl, python.

wokky · Regular user

ok, can you give me some exemples cause i don't know how to process