PHP injection + MYSQL = SYSTEM permission

(I didn't think I had to post an article a month later. I thought I couldn't send it, so I immediately posted it. Now, since I have published it, I will make up the picture by the end of August. I have already completed it)

StudiedMysqlAfter the question of privilege escalation, we can easily think of what to do without a password? Brute force cracking? You need luck! Actually combinedPhpInjection is easy to handle~I will usePhpInjection is used to demonstrate how to get started!

Find a site and its software download Part existsPhpInjection Vulnerability. Add a quotation mark to another vulnerability, and an error is reported. 1:

The website path is obtained.~But our goal is to getMysqlThe password, which is usually inConfig. php. So we only needConfig. phpThe content is easy to say!PhpOf course, the content of injection files isLoad_file (),,Load_fileWe need to know the complete path. Should we guess? No, let's take a look.1An error is reported to get the file name, because these files generally have such statements:Require ("IncludedPhpFile Path")And this generally includesConfig. php. Well, let me do it: