mysqlhttpdnssmb

Understanding select into outfile


I was going through OOB scenario as mentioned here (Windows scenario).

https://www.exploit-db.com/docs/english/41273-mysql-out-of-band-hacking.pdf

I have very few queries that I couldn’t get answer over internet.

I think the core answer lies in the fact if the original functions allow network request.


Solution

  • It allows writing to any file that a user of the server could write to. If the server has a remote filesystem mounted, you may be able to write to it.

    However, the MySQL system variable secure_file_priv may be set. When set, it contains a directory pathname, and only files in this directory may be written to. And even if this isn't set, the directory needs to have permissions that allow the user running mysqld to write into it. This generally means that the directory must be world-writable.

    It also won't overwrite existing files, so you can't use it to replace a file.

    If the automounter is enabled, you may be able to access remote NFS servers this way.

    DNS would be involved to resolve the hostname if you use the automounter or UNC. It doesn't accept HTTP URLs, only ordinary filenames.