Repository navigation
Check for errors when creating a MySQL UDF (sys_exec etc.) #187
Description
Looks like sqlmap doesn't actually check whether the function was created, which misleadingly makes it seem like the process worked.
[01:13:42] [PAYLOAD] CREATE FUNCTION sys_eval RETURNS string SONAME 'libskapx.so'
[01:13:42] [TRAFFIC IN] Can't open shared library 'libskapx.so' (errno: 22 libskapx.so: cannot open shared object file: No such file or directory)
The real reason for the error seems to be that the place the .so is written to (.) isn't a place MySQL looks for the .so when trying to create the function. Perhaps a second bug could be opened to address this (maybe try writing the .so to /usr/lib or something? https://bugs.gentoo.org/show_bug.cgi?id=220813 looks interestingly relevant).
[01:13:41] [PAYLOAD] SELECT LENGTH(LOAD_FILE('./libskapx.so'))
[01:13:41] [INFO] the file has been successfully written and its size is 5696 bytes, same size as the local file '/home/ss23/sqlmap/udf/mysql/linux/32/lib_mysqludf_sys.so'
Activity
ss23 commentedon Sep 16, 2012
Ah, worth noting, this particular case is 5.0.51a-24+lenny5, which seems to be before plugin_dir was added.
bdamele commentedon Sep 17, 2012
@ss23 MySQL on Linux/UNIX runs as unprivileged 'mysql' user hence it does not have privileges over /usr/lib folder to create the binary .so file. However, I agree with you we should check for the file before carry on creating the function