Metasploit Revealed: Secrets of the Expert Pentester

Checking for writable directories

Metasploit also provides a mysql_writable_dirs module that helps to figure out writable directories on the target. We can run this module in a similar way as we did with the previous modules by setting the DIR_LIST option to our file containing the list of directories, along with the RHOSTS and USERNAME options, as shown in the following screen:

Setting all the options, let's run the module on the target and analyze the results as follows:

We can see that in /var/www/html the /tmp/ directories are writable. ...