A difficult Privilege Escalation

After reading the environment, windows2003 + iis6 does not support. net and asp
Asp permissions are slightly higher than php permissions.
Wscript. shell exists, but cannot execute commands. bincker says that wscript. shell is not deleted, but the permission to use wscript. shell is forbidden. Khan, who wants to make it through overflow, had to give up.
However, the first thing to do with PHP is to find the mysql root Password.
Fortunately, I switched to the password root! @ #178 s *****
I thought it was smooth, but the reality is cruel.

The file cannot be load_file anywhere. It indicates that mysql has been downgraded. I continue to check that there is a servu, but the password has been changed. However, even if the password is cracked, it is estimated that it will be downgraded, so I gave up this article directly.
Now we are in a deadlock, so I told binker that he had finished the Spring Festival holiday and I would help him with it.
After the Spring Festival holiday was completed, I asked binker TO SAY THAT MYSQL's permission downgrading had basically failed. But I want to try again. Maybe I can do it again.
As a result, I jumped in the directory and saw phpinfo. php. I looked at it casually. Now I can see the problem.

No. The PHP Directory is in D: WEST263_PHP_PACKAGE.
After testing, ASP horse can jump over, But PHP cannot.
There are a lot of sensitive things.

The Setup. ini file contains the mysql root Password.
Site. xml contains all the FTP usernames and passwords of the VM (dangerous)

Now we can control all the websites on the server, but this is not the result I want. Our goal is to grant server permissions.
I do not remember the research on UDF-Cant open shared library in ninty MYSQL.

Black and black. It can be used here.

Create a plugin directory

Upload a modified UDF. dll, create a function, and run the command successfully,
As mentioned earlier, MYSQL is not started with system permissions,

Is it necessary to give up at this time? Of course not. It has been so long.
At least we can execute system commands. What do we think.
Overflow. There were so many holes during this time. Let's try it. We found that the server was installed with 360, and we lost a 360 Privilege Escalation program. We found that the CMD of the system was disabled, slightly changed the program

Then, change "cmd.exe" to 1234567.exe" to "c: windowsemp ".
Overflow program successfully executed

Login 3389

So far, the elevation of privilege has been completed.
Finally, thank you again for the 360 XXXX