Can't dump to file despite mysqld running as root

Question

TL;DR

I don't understand how mysql running as root@localhost would not be allowed to write to /usr/lib/? Writing a file there is a common step in going from SQL injection to root shell. Details below.

On this challenge I'm doing, I've managed to gain admin access to a wordpress panel. From there I can edit php files, allowing me to run queries on the database at my leisure.

My first step was to check which user was running the mysql server:

$results = $wpdb->get_results( 'select system_user() ', OBJECT );
var_dump($results);

This showed that mysql is running as root@localhost. In my mind root should have all rights on the system. I confirmed that it had FILE permissions:

...  "'root'@'localhost'" ["privilege_type"]=> string(4) "FILE" ["is_grantable"]=> string(3) "YES" }

Just to be sure I tried to write a file to /tmp/:

select "hello world" into outfile "/tmp/test"

It worked. I now need a root shell on the system so I proceeded to follow this methodology here which involves writing a file to /usr/lib/:

select "hello world" into dumpfile "/usr/lib/test"

But I'm getting a permission-related error:

[Can't create/write to file '/usr/lib/raptor_udf2.so' (Errcode: 13)]

Using a web shell running as a low privilege user I checked the rights on /usr/lib/:

drwxr-xr-x 173 root root 53248 Sep 29  2011 lib

Nothing funky here, root should be able to write.

Answer 1

You are using the root MYSQL user which doesn't have the permissions of the root system user.

Try giving the "mysql" user write permissions to the file.