SQL Injection Attacks and Defense - 2009

274 Chapter 6 • Exploiting the Operating System
his attack. Regardless of the goal, the attacker wants to be able to read both ASCII text and
binary files somehow.
An obvious question that naturally follows is how the attacker is able to view these files,
assuming he is able to coerce the DBMS into reading it. Although in this chapter we will
examine a few of the answers to these questions, we covered these methods extensively in
Chapters 4 and 5. Simply put, the goal of this subsection is to understand how an attacker
can view the contents of the target file system as part of an SQL query. Actually extruding
the data is a different problem to be solved.
MySQL
MySQL provides the well-abused functionality of allowing a text file to be read into the
database through its LOAD DATA INFILE and LOAD_FILE commands. According to
the current MySQL reference manual, “The LOAD DATA INFILE statement reads rows
from a text file into a table at a very high speed. The filename must be given as a literal
string.”
Let’s examine the use of the LOAD DATA INFILE command as it was intended
to be used.
We’ll start by creating a simple text file called users.txt:
cat users.txt
haroon meer haroon@fakedomain.com 1
Dafydd Stuttard mail@fakedomain.net 1
Dave Hartley dave@fakedomain.co.uk 1
Rodrigo Marcos rodrigo@fakedomain.com 1
Gary Oleary-Steele garyo@fakedomain.com 1
Joe Hemler joe@fakedomain.com 1
Marco Slaviero marco@fakedomain.com 1
Alberto Revelli r00t@fakedomain.net 1
Alexander Kornbrust ak@fakedomain.com 1
Justin Clarke justin@fakedomain.com 1
Then we’ll run the following command within the MySQL console to create a table
to house the author details:
mysql> create table authors (fname char(50), sname char(50), email
char(100), flag int);
Query OK, 0 rows affected (0.01 sec)