0

I'm using sqlmap to exploit databases in a DVWA-project.

However, after having exploited the database, I executed the following command to learn that the user is dvwa@%:

sqlmap -u "http://192.168.71.130/dvwa/vulnerabilities/sqli/?id=2&Submit=Submit#" -p id --cookie="security=low; PHPSESSID=kikm4b9s9tdk5kq21cs20jt9j1;" --current-user

I'm trying to INSERT something into the tables, with these commands: 

sqlmap -u "http://192.168.71.130/dvwa/vulnerabilities/sqli/?id=2&Submit=Submit#" -p id --cookie="security=low; PHPSESSID=kikm4b9s9tdk5kq21cs20jt9j1;" --sql-query="INSERT INTO guestbook (comment,name) VALUES ('foo','bar');"

However, this fails - although a basic SELECT statement works fine.

I guess the dvwa@% user doesn't have privileges to INSERT/UPDATE.

Is it possible for sqlmap to automatically obtain administrator privileges for the database (in this case DVWA)?

Stephen King
  • 201
  • 2
  • 12
Shuzheng
  • 1,097
  • 4
  • 22
  • 37

1 Answers1

3

1) If you are inserting into a SELECT/UPDATE/DELETE query you can only issue INSERT statements if stacked queries are available (you have to close the original query and start a new SQL statement). This is a limitation of the SQL language.

2) Privilege escalation would require a vulnerability in the database server or one of the stored procedures. Check the server version and look for stored procedures that execute as privileged user (e.g. EXECUTE AS statement in case of SQL Server). After you find a vulnerability you should execute the trigger instructions, which can be problematic if you don't have stacked queries.

buherator
  • 1,730
  • 1
  • 9
  • 15
  • So, 2) requires manual effort? This is not something that is automated, right? – Shuzheng Apr 16 '18 at 17:37
  • It depends, some of the techniques are automated as part of the Metasploit Framework for example, some (Oracle based) examples are in the Privilege Escalation part of this presentation: https://www.blackhat.com/presentations/bh-usa-09/GATES/BHUSA09-Gates-OracleMetasploit-SLIDES.pdf – buherator Apr 16 '18 at 21:18