Exploit

The main security issue of a server is the system access which allows you to execute commands remotely.

Injection can also lead to system access or at least to write files on the server in some indirect techniques described here.

When exploitation is successful a text terminal opens to enter commands like you were on the server.

Important

This content is delivered for education purpose and security concern, to use on a controlled environment.

Tip

Share also your concern, add new techniques to the list and open a pull request.

---

1. Types

Provided that the injection is successful, each exploit creates a function or adds a file to the remote system first, then it proceeds to the exploit. The modes allowing to write the exploit are also described below.

UDF — RCE via internal script or library

Remote command execution is performed by a user defined function either packaged into a library or built by crafted methods, it then gives access to system commands via an additional SQL function that runs the command.

Following process describes the methodology for the library use case:

- finds the database plugins folder
- identifies target's system architecture
- writes the correct library to the folder using the proper mode
- loads library into the database
- opens the terminal when SQL function is confirmed

Process for crafted methods use case is more straightforward:

- create a SQL function into the database
- opens the terminal when SQL function is confirmed

UDF needs several requirements to setup, but it's really easy to build as it does not require any user input, just a single click.

Web — RCE via interpreted language (e.g PHP)

It also gives access to system commands, though it requests a page from a presumed web folder that you have to choose:

- writes the payload to the presumed folder using the proper mode
- opens the terminal when connection to the presumed web page is confirmed

It just needs basic queries and file db privilege, and also some guessing to find the correct working folder.

RCE requirements

Warning

RCE can be difficult to craft, here are the requirements by db vendor for a successful process :

Type	Db	Need stack query	Web+db on same server	⚠️ GET size	Db file priv	Write access	⚠️ Server setup
UDF	mysql	✔		✔ ℹ️	✔	✔
	postgres ext	✔					ℹ️ any pg extensions installed
	postgres wal						conf 'archive_mode' enabled
	sqlite	✔					extension 'exec' installed
	oracle	✔					❌ semi-colon in 'begin end;' prevents exploit
Web	mysql		✔		✔
	postgres		✔
	sqlite	✔	✔			✔
	hsqldb h2 derby	✔	✔				JDBC bridge installed

SQL — shell via interpreted language (e.g PHP)

Similar to Web, it runs directly SQL queries without any injection layer:

- writes the payload to the presumed folder using the proper mode
- checks the connection method (e.g. `new PDO()`, `mysqli_connect()`, `mysql_connect()`)
- opens the terminal when connection to the presumed web page is confirmed

Depending on the database settings, credentials may be required and in that case must be set.

Tip

To retrieve username and password you can use tab Read file and open any file containing the hard-coded credentials (eg. index.php, mydb.php).

Upload — via interpreted language (e.g PHP)

Any target that runs a language like PHP may also gives access to direct upload via Content-Type: multipart/form-data:

- writes the payload to the presumed folder using the proper mode
- starts uploading when connection to the presumed web page is confirmed

You also select the file on your system to start uploading.

---

2. Modes

Any exploit can be created by one of three modes, you select the mode or leave it to auto.

Query body

A single query that includes the exploit's body encoded in hex creates the file, it means that when using method GET it's limited to relatively small payloads.

Warning

Use POST and mode temp table for large payload like UDF.

Temp table

Exploit is split into small chunks encoded to hex then loaded into a temp table, next the table is loaded into the destination file.

With temp table the small GET size limitation is avoided by processing smaller chunks, but you need stack queries.

Network share

You can also connect directly the database to your file system for transferring the exploit, for example on a local network during a CTF.

You set your path to the network share folder where the exploit is created, like \\127.0.0.1\C$\folder\, then the database loads it with a direct connection from the remote server to your netshare.

---

Previous topic: Insight, Next topic: Window