From Sql Injection To Rce Leveraging Vulnerability For Maximum Impact 2fb356907eed

Today i will one of the most important topics, mostly asked in penetration testing interviews, that’s why it is important for people to have this skill.

SQL Injection (SQLi) is one of the most dangerous web application vulnerabilities. However, SQLi is not just data extraction; it can also open doors to a more severe threat: Remote Code Execution (RCE). This write-up covers five distinct methods where SQL injection leads to RCE across different databases, including MSSQL, MySQL, and PostgreSQL, providing insights into each exploitation technique.

this time we will the following methods:

Now let’s deep dive into each technique:

xp_cmdshell is a stored procedure in Microsoft SQL Server that allows users to execute operating system commands directly from within SQL queries. This feature can be extremely powerful for administrative tasks, By enabling xp_cmdshell attackers can interact with the file system, run scripts, or execute system commands.

attackers can enable xp_cmdshell using this command:

Once xp_cmdshell is enabled, an attacker can run commands:

This command enables attackers to execute arbitrary commands as the server’s system user, creating a bridge between SQL queries and full system compromise.

In MySQL, User Defined Functions (UDFs) are custom functions that developers can create to extend the database’s capabilities.

Written in languages like C, UDFs allow developers to implement specialized functions not natively available in MySQL, making them useful for custom calculations, data transformations, and more.

However Attackers exploit UDFs to gain RCE by leveraging the ability to run system-level commands through custom UDFs. Here’s how they use UDFs to their advantage:

Attackers upload or inject a malicious shared library into MySQL’s plugin directory, containing functions that execute arbitrary system commands. This requires write access to the plugin directory, which they may gain through privilege escalation or misconfigurations.

This code defines the sys_exec function that takes a command as an argument and runs it via system() . The .so file is compiled from this code.

2. Upload and Register the Malicious UDF:

Once the library is compiled into malicious_udf.so and uploaded to the MySQL plugin directory, the attacker registers the UDF in MySQL:

3. Execute Commands Using the UDF :

With the UDF in place, the attacker uses SQL queries to execute system commands. For example:

This enables them to run any command on the server, allowing remote code execution.

PostgreSQL enables extensions like plpythonu , which allows Python code execution directly from SQL. By creating a Python function, attackers can run system commands:

Define the Malicious Function :

This approach relies on the flexibility of PostgreSQL’s extensions, providing an avenue for RCE by interacting with the server’s OS.

Oracle databases support embedded Java, which allows developers to create and run Java stored procedures alongside SQL and PL/SQL. This capability is intended for extending the database’s functionality with complex logic.

but it can be exploited by attackers if they have sufficient privileges.

Here is how you can exploit stored java procedures

2. Creating a Wrapper PL/SQL Function : To make calling the Java function simpler, attackers often create a PL/SQL wrapper. This wrapper allows the Java method runCmd to be called like a standard SQL function.

With the Java procedure and PL/SQL wrapper in place, an attacker can now run system commands using SQL, such as:

This example command retrieves the system user under which the Oracle server is running. Attackers can replace whoami with any other command, sucefully gaining RCE.

Although you must have the knowledge to achieve RCE, manually testing each method can be time-consuming. SQLmap can simplify this process by exploiting vulnerabilities leading to RCE automatically.

You can automate RCE attempts using SQLmap using the following command:

Ok that was a lot to take in, so take your time absorbing all this

That’s all for today, until we meet again.

Follow me on Social Media :