SQL Injection Attacks and Defense - 2009

As expected, this creates sp.txt file in the /tmp directory:
$ cat sp.txt
SensePost 2008
Exploiting the Operating System • Chapter 6 293
When reading binary files from the file system we used MySQL’s built-in HEX function,
so it makes perfect sense that when trying to write binary to the file system we would do
the reverse. We therefore use the MySQL built-in function, UNHEX( ):
mysql> select UNHEX('53656E7365506F7374203038');
+-----------------------------------+
| UNHEX('53656E7365506F7374203038') |
+-----------------------------------+
| SensePost 08 |
+-----------------------------------+
1 row in set (0.00 sec)
With this combination, we are effectively primed to write any kind of file, anywhere on
the file system (without the ability to overwrite existing files [and keeping in mind that the
file will be world-writable]). Before a brief discussion on what you can do with the ability
to write any file anywhere, it is probably worth it to see what happened to www.apache.org
when attackers gave themselves the same capability.
Notes from the Underground…
How We Defaced apache.org
In May 2000, the main Web page of the Apache Foundation (maker of the Apache
Web Server) was subtly defaced to house the “Powered by Microsoft BackOffice” logo.
The pranksters, { } and Hardbeat, documented their attack at www.dataloss.net/papers/
how.defaced.apache.org.txt in a paper titled “How we defaced www.apache.org.”
The pair first obtained access by abusing an ftpd configuration error and then
uploading a crude Web shell to the Web server root. This allowed them to have a
low-privileged shell running as the user nobody. They then went on to say:
“After a long search we found out that mysql was running as user root and was
reachable locally. Because apache.org was running bugzilla which requires a mysql
account and has it username/password plaintext in the bugzilla source it was easy to
get a username/passwd for the mysql database.”
Continued