Hacking SQL Injection for Remote Code Execution on a LAMP Stack

### Fundamentals of SQL Injection on LAMP Architectures At 01:00, Nemus opens the session with a practical guide to identifying and exploiting SQL injection (SQLi) vulnerabilities in PHP and MySQL environments on the Linux, Apache, MySQL, and PHP (LAMP) stack. The presentation focuses on transitioning from basic database query manipulation to achieving full Remote Code Execution (RCE) on the underlying operating system.

### Error-Based and UNION-Based Database Enumeration At 09:01 and 14:00, Nemus demonstrates error-based and UNION-based SQL injection techniques. By injecting tailored logical operators and matching column counts across database queries, an attacker can extract system banners, MySQL version numbers, and database metadata directly from server error messages and page responses.

### Credential Harvesting and Administrative Hash Extraction At 17:02 and 20:01, the speaker shows how attackers enumerate database users and extract password hashes from the `mysql.user` administrative table. Nemus highlights common password storage vulnerabilities, including legacy unsalted MD5 hashes, and demonstrates how extracted credentials can be leveraged for offline cracking or brute-force attacks against SSH and administrative panels.

### Filesystem Access via LOAD_FILE() and Privilege Pitfalls At 22:02 and 23:01, Nemus examines dangerous MySQL configurations where database daemons run with elevated OS privileges. Using the MySQL `LOAD_FILE()` function, attackers can read sensitive server configuration files, environment variables, and source code from the local filesystem, mapping internal application structures.

### Escalating to Remote Code Execution Starting at 27:00 and continuing through 36:02, the presentation demonstrates multiple vectors for achieving remote code execution. Nemus details using `SELECT ... INTO OUTFILE` to write interactive PHP web shells directly into web-accessible directories, exploiting Local File Inclusion (LFI) vulnerabilities, poisoning Apache access logs, and abusing wildcard expansion in administrative maintenance utilities like `tar` to establish interactive reverse shells.

(AI summary — Gemini Flash)